From 41585ff3a0121aa623cdb0651a996ad3ef6e5d43 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 28 Oct 2023 00:43:44 +0000 Subject: [PATCH] Deploy to GitHub pages --- .nojekyll | 0 en/.buildinfo | 4 + en/_images/Eo_circle_green_checkmark.svg | 2 + en/_images/Eo_circle_red_letter-x.svg | 1 + en/_images/automatic_client_registration.svg | 1 + en/_images/cie_esempio_trust_chain.svg | 597 + en/_images/cieid3.svg | 86 + en/_images/flusso.svg | 1816 +++ en/_images/metadata_discovery.svg | 848 ++ en/_images/spid3.svg | 85 + en/_images/spid_cie_oidc_federation_model.svg | 1 + en/_images/trust_anchor.svg | 202 + en/_sources/attributi_utente.rst.txt | 334 + en/_sources/authorization_endpoint.rst.txt | 345 + en/_sources/avvisi_spid.rst.txt | 40 + en/_sources/come_contribuire.rst.txt | 10 + .../confronto_oidc_cie_e_oidc_igov.rst.txt | 40 + en/_sources/cryptographic_algos.rst.txt | 120 + en/_sources/differenze_oidc_fed.rst.txt | 26 + en/_sources/differenze_spid_cie.rst.txt | 81 + en/_sources/diventa_fornitore.rst.txt | 11 + en/_sources/entity_configuration.rst.txt | 126 + en/_sources/entity_statement.rst.txt | 307 + en/_sources/errors_federation.rst.txt | 61 + en/_sources/esempi.rst.txt | 10 + en/_sources/federation_endpoint.rst.txt | 31 + en/_sources/flusso_autenticazione.rst.txt | 37 + en/_sources/index.rst.txt | 53 + en/_sources/introspection_endpoint.rst.txt | 114 + .../la_federazione_delle_identita.rst.txt | 78 + en/_sources/log_management.rst.txt | 54 + en/_sources/logout.rst.txt | 13 + en/_sources/metadata_aa.rst.txt | 116 + en/_sources/metadata_oidc.rst.txt | 23 + en/_sources/metadata_oidc_op.rst.txt | 176 + en/_sources/metadata_oidc_rp.rst.txt | 105 + en/_sources/metadata_oidc_ta_sa.rst.txt | 62 + en/_sources/revocation_endpoint.rst.txt | 91 + en/_sources/seccons_bcps.rst.txt | 61 + en/_sources/soggetti_aggregatori.rst.txt | 40 + en/_sources/standards.rst.txt | 33 + en/_sources/termini_acronimi.rst.txt | 123 + en/_sources/token_endpoint.rst.txt | 432 + en/_sources/trust_marks.rst.txt | 237 + en/_sources/trust_negotiation.rst.txt | 114 + en/_sources/userinfo_endpoint.rst.txt | 144 + .../_sphinx_javascript_frameworks_compat.js | 134 + en/_static/basic.css | 932 ++ en/_static/css/theme.css | 1 + en/_static/data/glossary.json | 1 + en/_static/doctools.js | 264 + en/_static/documentation_options.js | 14 + en/_static/file.png | Bin 0 -> 286 bytes en/_static/font/docs-italia.eot | Bin 0 -> 11192 bytes en/_static/font/docs-italia.svg | 68 + en/_static/font/docs-italia.ttf | Bin 0 -> 11012 bytes en/_static/font/docs-italia.woff | Bin 0 -> 11092 bytes en/_static/font/italia-icon-font.eot | Bin 0 -> 23672 bytes en/_static/font/italia-icon-font.svg | 134 + en/_static/font/italia-icon-font.ttf | Bin 0 -> 23472 bytes en/_static/font/italia-icon-font.woff | Bin 0 -> 13888 bytes en/_static/font/italia-icon-font.woff2 | Bin 0 -> 11952 bytes en/_static/images/agid-logo.svg | 25 + en/_static/images/may.svg | 37 + en/_static/images/must.svg | 71 + en/_static/images/must_not.svg | 65 + en/_static/images/should.svg | 52 + en/_static/images/should_not.svg | 52 + en/_static/images/team-digitale-logo.svg | 15 + en/_static/jquery-3.6.0.js | 10881 ++++++++++++++++ en/_static/jquery.js | 2 + en/_static/js/theme.js | 1 + en/_static/language_data.js | 199 + en/_static/minus.png | Bin 0 -> 90 bytes en/_static/pkce.py | 22 + en/_static/plus.png | Bin 0 -> 90 bytes en/_static/pygments.css | 74 + en/_static/searchtools.js | 531 + en/_static/underscore-1.13.1.js | 2042 +++ en/_static/underscore.js | 6 + en/attributi_utente.html | 1686 +++ en/authorization_endpoint.html | 1762 +++ en/avvisi_spid.html | 1384 ++ en/come_contribuire.html | 1350 ++ en/confronto_oidc_cie_e_oidc_igov.html | 1374 ++ en/cryptographic_algos.html | 1503 +++ en/differenze_oidc_fed.html | 1365 ++ en/differenze_spid_cie.html | 1399 ++ en/diventa_fornitore.html | 1359 ++ en/doctrees/attributi_utente.doctree | Bin 0 -> 101388 bytes en/doctrees/authorization_endpoint.doctree | Bin 0 -> 146576 bytes en/doctrees/avvisi_spid.doctree | Bin 0 -> 13324 bytes en/doctrees/come_contribuire.doctree | Bin 0 -> 43872 bytes .../confronto_oidc_cie_e_oidc_igov.doctree | Bin 0 -> 60271 bytes en/doctrees/cryptographic_algos.doctree | Bin 0 -> 72260 bytes en/doctrees/differenze_oidc_fed.doctree | Bin 0 -> 47614 bytes en/doctrees/differenze_spid_cie.doctree | Bin 0 -> 57630 bytes en/doctrees/diventa_fornitore.doctree | Bin 0 -> 44963 bytes en/doctrees/entity_configuration.doctree | Bin 0 -> 71887 bytes en/doctrees/entity_statement.doctree | Bin 0 -> 139009 bytes en/doctrees/environment.pickle | Bin 0 -> 93793 bytes en/doctrees/errors_federation.doctree | Bin 0 -> 56174 bytes en/doctrees/esempi.doctree | Bin 0 -> 112538 bytes en/doctrees/federation_endpoint.doctree | Bin 0 -> 51749 bytes en/doctrees/flusso_autenticazione.doctree | Bin 0 -> 54791 bytes en/doctrees/index.doctree | Bin 0 -> 10881 bytes en/doctrees/introspection_endpoint.doctree | Bin 0 -> 63010 bytes .../la_federazione_delle_identita.doctree | Bin 0 -> 58628 bytes en/doctrees/log_management.doctree | Bin 0 -> 58224 bytes en/doctrees/logout.doctree | Bin 0 -> 45527 bytes en/doctrees/metadata_aa.doctree | Bin 0 -> 79586 bytes en/doctrees/metadata_oidc.doctree | Bin 0 -> 44709 bytes en/doctrees/metadata_oidc_op.doctree | Bin 0 -> 94308 bytes en/doctrees/metadata_oidc_rp.doctree | Bin 0 -> 74448 bytes en/doctrees/metadata_oidc_ta_sa.doctree | Bin 0 -> 59001 bytes en/doctrees/revocation_endpoint.doctree | Bin 0 -> 59118 bytes en/doctrees/seccons_bcps.doctree | Bin 0 -> 57065 bytes en/doctrees/soggetti_aggregatori.doctree | Bin 0 -> 53334 bytes en/doctrees/standards.doctree | Bin 0 -> 91327 bytes en/doctrees/termini_acronimi.doctree | Bin 0 -> 76322 bytes en/doctrees/token_endpoint.doctree | Bin 0 -> 163513 bytes en/doctrees/trust_marks.doctree | Bin 0 -> 98829 bytes en/doctrees/trust_negotiation.doctree | Bin 0 -> 68416 bytes en/doctrees/userinfo_endpoint.doctree | Bin 0 -> 76083 bytes en/entity_configuration.html | 1498 +++ en/entity_statement.html | 1723 +++ en/errors_federation.html | 1421 ++ en/esempi.html | 2250 ++++ en/federation_endpoint.html | 1380 ++ en/flusso_autenticazione.html | 1375 ++ en/genindex.html | 1423 ++ en/index.html | 1525 +++ en/introspection_endpoint.html | 1478 +++ en/la_federazione_delle_identita.html | 1410 ++ en/log_management.html | 1409 ++ en/logout.html | 1361 ++ en/metadata_aa.html | 1497 +++ en/metadata_oidc.html | 1363 ++ en/metadata_oidc_op.html | 1523 +++ en/metadata_oidc_rp.html | 1479 +++ en/metadata_oidc_ta_sa.html | 1422 ++ en/objects.inv | Bin 0 -> 1751 bytes en/revocation_endpoint.html | 1439 ++ en/search.html | 1359 ++ en/searchindex.js | 1 + en/seccons_bcps.html | 1387 ++ en/soggetti_aggregatori.html | 1395 ++ en/standards.html | 1546 +++ en/termini_acronimi.html | 1502 +++ en/token_endpoint.html | 1826 +++ en/trust_marks.html | 1602 +++ en/trust_negotiation.html | 1428 ++ en/userinfo_endpoint.html | 1512 +++ index.html | 15 + it/.buildinfo | 4 + it/_images/Eo_circle_green_checkmark.svg | 2 + it/_images/Eo_circle_red_letter-x.svg | 1 + it/_images/automatic_client_registration.svg | 1 + it/_images/cie_esempio_trust_chain.svg | 597 + it/_images/cieid3.svg | 86 + it/_images/flusso.svg | 1816 +++ it/_images/metadata_discovery.svg | 848 ++ it/_images/spid3.svg | 85 + it/_images/spid_cie_oidc_federation_model.svg | 1 + it/_images/trust_anchor.svg | 202 + it/_sources/attributi_utente.rst.txt | 336 + it/_sources/authorization_endpoint.rst.txt | 350 + it/_sources/avvisi_spid.rst.txt | 37 + it/_sources/come_contribuire.rst.txt | 12 + .../confronto_oidc_cie_e_oidc_igov.rst.txt | 41 + it/_sources/cryptographic_algos.rst.txt | 120 + it/_sources/differenze_oidc_fed.rst.txt | 27 + it/_sources/differenze_spid_cie.rst.txt | 68 + it/_sources/diventa_fornitore.rst.txt | 11 + it/_sources/entity_configuration.rst.txt | 121 + it/_sources/entity_statement.rst.txt | 303 + it/_sources/errors_federation.rst.txt | 61 + it/_sources/esempi.rst.txt | 10 + it/_sources/federation_endpoint.rst.txt | 23 + it/_sources/flusso_autenticazione.rst.txt | 41 + it/_sources/index.rst.txt | 57 + it/_sources/introspection_endpoint.rst.txt | 109 + .../la_federazione_delle_identita.rst.txt | 57 + it/_sources/log_management.rst.txt | 56 + it/_sources/logout.rst.txt | 14 + it/_sources/metadata_aa.rst.txt | 116 + it/_sources/metadata_oidc.rst.txt | 21 + it/_sources/metadata_oidc_op.rst.txt | 176 + it/_sources/metadata_oidc_rp.rst.txt | 105 + it/_sources/metadata_oidc_ta_sa.rst.txt | 62 + it/_sources/revocation_endpoint.rst.txt | 92 + it/_sources/seccons_bcps.rst.txt | 55 + it/_sources/soggetti_aggregatori.rst.txt | 40 + it/_sources/standards.rst.txt | 33 + it/_sources/termini_acronimi.rst.txt | 113 + it/_sources/token_endpoint.rst.txt | 425 + it/_sources/trust_marks.rst.txt | 213 + it/_sources/trust_negotiation.rst.txt | 92 + it/_sources/userinfo_endpoint.rst.txt | 149 + .../_sphinx_javascript_frameworks_compat.js | 134 + it/_static/base-stemmer.js | 294 + it/_static/basic.css | 932 ++ it/_static/css/theme.css | 1 + it/_static/data/glossary.json | 1 + it/_static/doctools.js | 264 + it/_static/documentation_options.js | 14 + it/_static/file.png | Bin 0 -> 286 bytes it/_static/font/docs-italia.eot | Bin 0 -> 11192 bytes it/_static/font/docs-italia.svg | 68 + it/_static/font/docs-italia.ttf | Bin 0 -> 11012 bytes it/_static/font/docs-italia.woff | Bin 0 -> 11092 bytes it/_static/font/italia-icon-font.eot | Bin 0 -> 23672 bytes it/_static/font/italia-icon-font.svg | 134 + it/_static/font/italia-icon-font.ttf | Bin 0 -> 23472 bytes it/_static/font/italia-icon-font.woff | Bin 0 -> 13888 bytes it/_static/font/italia-icon-font.woff2 | Bin 0 -> 11952 bytes it/_static/images/agid-logo.svg | 25 + it/_static/images/may.svg | 37 + it/_static/images/must.svg | 71 + it/_static/images/must_not.svg | 65 + it/_static/images/should.svg | 52 + it/_static/images/should_not.svg | 52 + it/_static/images/team-digitale-logo.svg | 15 + it/_static/italian-stemmer.js | 996 ++ it/_static/jquery-3.6.0.js | 10881 ++++++++++++++++ it/_static/jquery.js | 2 + it/_static/js/theme.js | 1 + it/_static/language_data.js | 19 + it/_static/minus.png | Bin 0 -> 90 bytes it/_static/pkce.py | 22 + it/_static/plus.png | Bin 0 -> 90 bytes it/_static/pygments.css | 74 + it/_static/searchtools.js | 531 + it/_static/translations.js | 61 + it/_static/underscore-1.13.1.js | 2042 +++ it/_static/underscore.js | 6 + it/attributi_utente.html | 1691 +++ it/authorization_endpoint.html | 1759 +++ it/avvisi_spid.html | 1382 ++ it/come_contribuire.html | 1352 ++ it/confronto_oidc_cie_e_oidc_igov.html | 1376 ++ it/cryptographic_algos.html | 1505 +++ it/differenze_oidc_fed.html | 1367 ++ it/differenze_spid_cie.html | 1397 ++ it/diventa_fornitore.html | 1361 ++ it/doctrees/attributi_utente.doctree | Bin 0 -> 103768 bytes it/doctrees/authorization_endpoint.doctree | Bin 0 -> 154010 bytes it/doctrees/avvisi_spid.doctree | Bin 0 -> 13614 bytes it/doctrees/come_contribuire.doctree | Bin 0 -> 43794 bytes .../confronto_oidc_cie_e_oidc_igov.doctree | Bin 0 -> 61955 bytes it/doctrees/cryptographic_algos.doctree | Bin 0 -> 72311 bytes it/doctrees/differenze_oidc_fed.doctree | Bin 0 -> 47439 bytes it/doctrees/differenze_spid_cie.doctree | Bin 0 -> 57572 bytes it/doctrees/diventa_fornitore.doctree | Bin 0 -> 45230 bytes it/doctrees/entity_configuration.doctree | Bin 0 -> 72212 bytes it/doctrees/entity_statement.doctree | Bin 0 -> 140196 bytes it/doctrees/environment.pickle | Bin 0 -> 94264 bytes it/doctrees/errors_federation.doctree | Bin 0 -> 56678 bytes it/doctrees/esempi.doctree | Bin 0 -> 112604 bytes it/doctrees/federation_endpoint.doctree | Bin 0 -> 51389 bytes it/doctrees/flusso_autenticazione.doctree | Bin 0 -> 55649 bytes it/doctrees/index.doctree | Bin 0 -> 11094 bytes it/doctrees/introspection_endpoint.doctree | Bin 0 -> 64061 bytes .../la_federazione_delle_identita.doctree | Bin 0 -> 59630 bytes it/doctrees/log_management.doctree | Bin 0 -> 58404 bytes it/doctrees/logout.doctree | Bin 0 -> 45689 bytes it/doctrees/metadata_aa.doctree | Bin 0 -> 79668 bytes it/doctrees/metadata_oidc.doctree | Bin 0 -> 44781 bytes it/doctrees/metadata_oidc_op.doctree | Bin 0 -> 94235 bytes it/doctrees/metadata_oidc_rp.doctree | Bin 0 -> 74288 bytes it/doctrees/metadata_oidc_ta_sa.doctree | Bin 0 -> 58945 bytes it/doctrees/revocation_endpoint.doctree | Bin 0 -> 59676 bytes it/doctrees/seccons_bcps.doctree | Bin 0 -> 57712 bytes it/doctrees/soggetti_aggregatori.doctree | Bin 0 -> 53606 bytes it/doctrees/standards.doctree | Bin 0 -> 91653 bytes it/doctrees/termini_acronimi.doctree | Bin 0 -> 76703 bytes it/doctrees/token_endpoint.doctree | Bin 0 -> 171086 bytes it/doctrees/trust_marks.doctree | Bin 0 -> 98501 bytes it/doctrees/trust_negotiation.doctree | Bin 0 -> 68980 bytes it/doctrees/userinfo_endpoint.doctree | Bin 0 -> 77238 bytes it/entity_configuration.html | 1491 +++ it/entity_statement.html | 1719 +++ it/errors_federation.html | 1423 ++ it/esempi.html | 2252 ++++ it/federation_endpoint.html | 1374 ++ it/flusso_autenticazione.html | 1377 ++ it/genindex.html | 1425 ++ it/index.html | 1531 +++ it/introspection_endpoint.html | 1473 +++ it/la_federazione_delle_identita.html | 1388 ++ it/log_management.html | 1412 ++ it/logout.html | 1363 ++ it/metadata_aa.html | 1499 +++ it/metadata_oidc.html | 1364 ++ it/metadata_oidc_op.html | 1522 +++ it/metadata_oidc_rp.html | 1480 +++ it/metadata_oidc_ta_sa.html | 1423 ++ it/objects.inv | Bin 0 -> 1772 bytes it/revocation_endpoint.html | 1441 ++ it/search.html | 1361 ++ it/searchindex.js | 1 + it/seccons_bcps.html | 1385 ++ it/soggetti_aggregatori.html | 1396 ++ it/standards.html | 1544 +++ it/termini_acronimi.html | 1493 +++ it/token_endpoint.html | 1827 +++ it/trust_marks.html | 1589 +++ it/trust_negotiation.html | 1405 ++ it/userinfo_endpoint.html | 1518 +++ 309 files changed, 154294 insertions(+) create mode 100644 .nojekyll create mode 100644 en/.buildinfo create mode 100644 en/_images/Eo_circle_green_checkmark.svg create mode 100644 en/_images/Eo_circle_red_letter-x.svg create mode 100644 en/_images/automatic_client_registration.svg create mode 100644 en/_images/cie_esempio_trust_chain.svg create mode 100644 en/_images/cieid3.svg create mode 100644 en/_images/flusso.svg create mode 100644 en/_images/metadata_discovery.svg create mode 100644 en/_images/spid3.svg create mode 100644 en/_images/spid_cie_oidc_federation_model.svg create mode 100644 en/_images/trust_anchor.svg create mode 100644 en/_sources/attributi_utente.rst.txt create mode 100644 en/_sources/authorization_endpoint.rst.txt create mode 100644 en/_sources/avvisi_spid.rst.txt create mode 100644 en/_sources/come_contribuire.rst.txt create mode 100644 en/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt create mode 100644 en/_sources/cryptographic_algos.rst.txt create mode 100644 en/_sources/differenze_oidc_fed.rst.txt create mode 100644 en/_sources/differenze_spid_cie.rst.txt create mode 100644 en/_sources/diventa_fornitore.rst.txt create mode 100644 en/_sources/entity_configuration.rst.txt create mode 100644 en/_sources/entity_statement.rst.txt create mode 100644 en/_sources/errors_federation.rst.txt create mode 100644 en/_sources/esempi.rst.txt create mode 100644 en/_sources/federation_endpoint.rst.txt create mode 100644 en/_sources/flusso_autenticazione.rst.txt create mode 100644 en/_sources/index.rst.txt create mode 100644 en/_sources/introspection_endpoint.rst.txt create mode 100644 en/_sources/la_federazione_delle_identita.rst.txt create mode 100644 en/_sources/log_management.rst.txt create mode 100644 en/_sources/logout.rst.txt create mode 100644 en/_sources/metadata_aa.rst.txt create mode 100644 en/_sources/metadata_oidc.rst.txt create mode 100644 en/_sources/metadata_oidc_op.rst.txt create mode 100644 en/_sources/metadata_oidc_rp.rst.txt create mode 100644 en/_sources/metadata_oidc_ta_sa.rst.txt create mode 100644 en/_sources/revocation_endpoint.rst.txt create mode 100644 en/_sources/seccons_bcps.rst.txt create mode 100644 en/_sources/soggetti_aggregatori.rst.txt create mode 100644 en/_sources/standards.rst.txt create mode 100644 en/_sources/termini_acronimi.rst.txt create mode 100644 en/_sources/token_endpoint.rst.txt create mode 100644 en/_sources/trust_marks.rst.txt create mode 100644 en/_sources/trust_negotiation.rst.txt create mode 100644 en/_sources/userinfo_endpoint.rst.txt create mode 100644 en/_static/_sphinx_javascript_frameworks_compat.js create mode 100644 en/_static/basic.css create mode 100644 en/_static/css/theme.css create mode 100644 en/_static/data/glossary.json create mode 100644 en/_static/doctools.js create mode 100644 en/_static/documentation_options.js create mode 100644 en/_static/file.png create mode 100644 en/_static/font/docs-italia.eot create mode 100644 en/_static/font/docs-italia.svg create mode 100644 en/_static/font/docs-italia.ttf create mode 100644 en/_static/font/docs-italia.woff create mode 100644 en/_static/font/italia-icon-font.eot create mode 100644 en/_static/font/italia-icon-font.svg create mode 100644 en/_static/font/italia-icon-font.ttf create mode 100644 en/_static/font/italia-icon-font.woff create mode 100644 en/_static/font/italia-icon-font.woff2 create mode 100644 en/_static/images/agid-logo.svg create mode 100644 en/_static/images/may.svg create mode 100644 en/_static/images/must.svg create mode 100644 en/_static/images/must_not.svg create mode 100644 en/_static/images/should.svg create mode 100644 en/_static/images/should_not.svg create mode 100644 en/_static/images/team-digitale-logo.svg create mode 100644 en/_static/jquery-3.6.0.js create mode 100644 en/_static/jquery.js create mode 100644 en/_static/js/theme.js create mode 100644 en/_static/language_data.js create mode 100644 en/_static/minus.png create mode 100644 en/_static/pkce.py create mode 100644 en/_static/plus.png create mode 100644 en/_static/pygments.css create mode 100644 en/_static/searchtools.js create mode 100644 en/_static/underscore-1.13.1.js create mode 100644 en/_static/underscore.js create mode 100644 en/attributi_utente.html create mode 100644 en/authorization_endpoint.html create mode 100644 en/avvisi_spid.html create mode 100644 en/come_contribuire.html create mode 100644 en/confronto_oidc_cie_e_oidc_igov.html create mode 100644 en/cryptographic_algos.html create mode 100644 en/differenze_oidc_fed.html create mode 100644 en/differenze_spid_cie.html create mode 100644 en/diventa_fornitore.html create mode 100644 en/doctrees/attributi_utente.doctree create mode 100644 en/doctrees/authorization_endpoint.doctree create mode 100644 en/doctrees/avvisi_spid.doctree create mode 100644 en/doctrees/come_contribuire.doctree create mode 100644 en/doctrees/confronto_oidc_cie_e_oidc_igov.doctree create mode 100644 en/doctrees/cryptographic_algos.doctree create mode 100644 en/doctrees/differenze_oidc_fed.doctree create mode 100644 en/doctrees/differenze_spid_cie.doctree create mode 100644 en/doctrees/diventa_fornitore.doctree create mode 100644 en/doctrees/entity_configuration.doctree create mode 100644 en/doctrees/entity_statement.doctree create mode 100644 en/doctrees/environment.pickle create mode 100644 en/doctrees/errors_federation.doctree create mode 100644 en/doctrees/esempi.doctree create mode 100644 en/doctrees/federation_endpoint.doctree create mode 100644 en/doctrees/flusso_autenticazione.doctree create mode 100644 en/doctrees/index.doctree create mode 100644 en/doctrees/introspection_endpoint.doctree create mode 100644 en/doctrees/la_federazione_delle_identita.doctree create mode 100644 en/doctrees/log_management.doctree create mode 100644 en/doctrees/logout.doctree create mode 100644 en/doctrees/metadata_aa.doctree create mode 100644 en/doctrees/metadata_oidc.doctree create mode 100644 en/doctrees/metadata_oidc_op.doctree create mode 100644 en/doctrees/metadata_oidc_rp.doctree create mode 100644 en/doctrees/metadata_oidc_ta_sa.doctree create mode 100644 en/doctrees/revocation_endpoint.doctree create mode 100644 en/doctrees/seccons_bcps.doctree create mode 100644 en/doctrees/soggetti_aggregatori.doctree create mode 100644 en/doctrees/standards.doctree create mode 100644 en/doctrees/termini_acronimi.doctree create mode 100644 en/doctrees/token_endpoint.doctree create mode 100644 en/doctrees/trust_marks.doctree create mode 100644 en/doctrees/trust_negotiation.doctree create mode 100644 en/doctrees/userinfo_endpoint.doctree create mode 100644 en/entity_configuration.html create mode 100644 en/entity_statement.html create mode 100644 en/errors_federation.html create mode 100644 en/esempi.html create mode 100644 en/federation_endpoint.html create mode 100644 en/flusso_autenticazione.html create mode 100644 en/genindex.html create mode 100644 en/index.html create mode 100644 en/introspection_endpoint.html create mode 100644 en/la_federazione_delle_identita.html create mode 100644 en/log_management.html create mode 100644 en/logout.html create mode 100644 en/metadata_aa.html create mode 100644 en/metadata_oidc.html create mode 100644 en/metadata_oidc_op.html create mode 100644 en/metadata_oidc_rp.html create mode 100644 en/metadata_oidc_ta_sa.html create mode 100644 en/objects.inv create mode 100644 en/revocation_endpoint.html create mode 100644 en/search.html create mode 100644 en/searchindex.js create mode 100644 en/seccons_bcps.html create mode 100644 en/soggetti_aggregatori.html create mode 100644 en/standards.html create mode 100644 en/termini_acronimi.html create mode 100644 en/token_endpoint.html create mode 100644 en/trust_marks.html create mode 100644 en/trust_negotiation.html create mode 100644 en/userinfo_endpoint.html create mode 100644 index.html create mode 100644 it/.buildinfo create mode 100644 it/_images/Eo_circle_green_checkmark.svg create mode 100644 it/_images/Eo_circle_red_letter-x.svg create mode 100644 it/_images/automatic_client_registration.svg create mode 100644 it/_images/cie_esempio_trust_chain.svg create mode 100644 it/_images/cieid3.svg create mode 100644 it/_images/flusso.svg create mode 100644 it/_images/metadata_discovery.svg create mode 100644 it/_images/spid3.svg create mode 100644 it/_images/spid_cie_oidc_federation_model.svg create mode 100644 it/_images/trust_anchor.svg create mode 100644 it/_sources/attributi_utente.rst.txt create mode 100644 it/_sources/authorization_endpoint.rst.txt create mode 100644 it/_sources/avvisi_spid.rst.txt create mode 100644 it/_sources/come_contribuire.rst.txt create mode 100644 it/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt create mode 100644 it/_sources/cryptographic_algos.rst.txt create mode 100644 it/_sources/differenze_oidc_fed.rst.txt create mode 100644 it/_sources/differenze_spid_cie.rst.txt create mode 100644 it/_sources/diventa_fornitore.rst.txt create mode 100644 it/_sources/entity_configuration.rst.txt create mode 100644 it/_sources/entity_statement.rst.txt create mode 100644 it/_sources/errors_federation.rst.txt create mode 100644 it/_sources/esempi.rst.txt create mode 100644 it/_sources/federation_endpoint.rst.txt create mode 100644 it/_sources/flusso_autenticazione.rst.txt create mode 100644 it/_sources/index.rst.txt create mode 100644 it/_sources/introspection_endpoint.rst.txt create mode 100644 it/_sources/la_federazione_delle_identita.rst.txt create mode 100644 it/_sources/log_management.rst.txt create mode 100644 it/_sources/logout.rst.txt create mode 100644 it/_sources/metadata_aa.rst.txt create mode 100644 it/_sources/metadata_oidc.rst.txt create mode 100644 it/_sources/metadata_oidc_op.rst.txt create mode 100644 it/_sources/metadata_oidc_rp.rst.txt create mode 100644 it/_sources/metadata_oidc_ta_sa.rst.txt create mode 100644 it/_sources/revocation_endpoint.rst.txt create mode 100644 it/_sources/seccons_bcps.rst.txt create mode 100644 it/_sources/soggetti_aggregatori.rst.txt create mode 100644 it/_sources/standards.rst.txt create mode 100644 it/_sources/termini_acronimi.rst.txt create mode 100644 it/_sources/token_endpoint.rst.txt create mode 100644 it/_sources/trust_marks.rst.txt create mode 100644 it/_sources/trust_negotiation.rst.txt create mode 100644 it/_sources/userinfo_endpoint.rst.txt create mode 100644 it/_static/_sphinx_javascript_frameworks_compat.js create mode 100644 it/_static/base-stemmer.js create mode 100644 it/_static/basic.css create mode 100644 it/_static/css/theme.css create mode 100644 it/_static/data/glossary.json create mode 100644 it/_static/doctools.js create mode 100644 it/_static/documentation_options.js create mode 100644 it/_static/file.png create mode 100644 it/_static/font/docs-italia.eot create mode 100644 it/_static/font/docs-italia.svg create mode 100644 it/_static/font/docs-italia.ttf create mode 100644 it/_static/font/docs-italia.woff create mode 100644 it/_static/font/italia-icon-font.eot create mode 100644 it/_static/font/italia-icon-font.svg create mode 100644 it/_static/font/italia-icon-font.ttf create mode 100644 it/_static/font/italia-icon-font.woff create mode 100644 it/_static/font/italia-icon-font.woff2 create mode 100644 it/_static/images/agid-logo.svg create mode 100644 it/_static/images/may.svg create mode 100644 it/_static/images/must.svg create mode 100644 it/_static/images/must_not.svg create mode 100644 it/_static/images/should.svg create mode 100644 it/_static/images/should_not.svg create mode 100644 it/_static/images/team-digitale-logo.svg create mode 100644 it/_static/italian-stemmer.js create mode 100644 it/_static/jquery-3.6.0.js create mode 100644 it/_static/jquery.js create mode 100644 it/_static/js/theme.js create mode 100644 it/_static/language_data.js create mode 100644 it/_static/minus.png create mode 100644 it/_static/pkce.py create mode 100644 it/_static/plus.png create mode 100644 it/_static/pygments.css create mode 100644 it/_static/searchtools.js create mode 100644 it/_static/translations.js create mode 100644 it/_static/underscore-1.13.1.js create mode 100644 it/_static/underscore.js create mode 100644 it/attributi_utente.html create mode 100644 it/authorization_endpoint.html create mode 100644 it/avvisi_spid.html create mode 100644 it/come_contribuire.html create mode 100644 it/confronto_oidc_cie_e_oidc_igov.html create mode 100644 it/cryptographic_algos.html create mode 100644 it/differenze_oidc_fed.html create mode 100644 it/differenze_spid_cie.html create mode 100644 it/diventa_fornitore.html create mode 100644 it/doctrees/attributi_utente.doctree create mode 100644 it/doctrees/authorization_endpoint.doctree create mode 100644 it/doctrees/avvisi_spid.doctree create mode 100644 it/doctrees/come_contribuire.doctree create mode 100644 it/doctrees/confronto_oidc_cie_e_oidc_igov.doctree create mode 100644 it/doctrees/cryptographic_algos.doctree create mode 100644 it/doctrees/differenze_oidc_fed.doctree create mode 100644 it/doctrees/differenze_spid_cie.doctree create mode 100644 it/doctrees/diventa_fornitore.doctree create mode 100644 it/doctrees/entity_configuration.doctree create mode 100644 it/doctrees/entity_statement.doctree create mode 100644 it/doctrees/environment.pickle create mode 100644 it/doctrees/errors_federation.doctree create mode 100644 it/doctrees/esempi.doctree create mode 100644 it/doctrees/federation_endpoint.doctree create mode 100644 it/doctrees/flusso_autenticazione.doctree create mode 100644 it/doctrees/index.doctree create mode 100644 it/doctrees/introspection_endpoint.doctree create mode 100644 it/doctrees/la_federazione_delle_identita.doctree create mode 100644 it/doctrees/log_management.doctree create mode 100644 it/doctrees/logout.doctree create mode 100644 it/doctrees/metadata_aa.doctree create mode 100644 it/doctrees/metadata_oidc.doctree create mode 100644 it/doctrees/metadata_oidc_op.doctree create mode 100644 it/doctrees/metadata_oidc_rp.doctree create mode 100644 it/doctrees/metadata_oidc_ta_sa.doctree create mode 100644 it/doctrees/revocation_endpoint.doctree create mode 100644 it/doctrees/seccons_bcps.doctree create mode 100644 it/doctrees/soggetti_aggregatori.doctree create mode 100644 it/doctrees/standards.doctree create mode 100644 it/doctrees/termini_acronimi.doctree create mode 100644 it/doctrees/token_endpoint.doctree create mode 100644 it/doctrees/trust_marks.doctree create mode 100644 it/doctrees/trust_negotiation.doctree create mode 100644 it/doctrees/userinfo_endpoint.doctree create mode 100644 it/entity_configuration.html create mode 100644 it/entity_statement.html create mode 100644 it/errors_federation.html create mode 100644 it/esempi.html create mode 100644 it/federation_endpoint.html create mode 100644 it/flusso_autenticazione.html create mode 100644 it/genindex.html create mode 100644 it/index.html create mode 100644 it/introspection_endpoint.html create mode 100644 it/la_federazione_delle_identita.html create mode 100644 it/log_management.html create mode 100644 it/logout.html create mode 100644 it/metadata_aa.html create mode 100644 it/metadata_oidc.html create mode 100644 it/metadata_oidc_op.html create mode 100644 it/metadata_oidc_rp.html create mode 100644 it/metadata_oidc_ta_sa.html create mode 100644 it/objects.inv create mode 100644 it/revocation_endpoint.html create mode 100644 it/search.html create mode 100644 it/searchindex.js create mode 100644 it/seccons_bcps.html create mode 100644 it/soggetti_aggregatori.html create mode 100644 it/standards.html create mode 100644 it/termini_acronimi.html create mode 100644 it/token_endpoint.html create mode 100644 it/trust_marks.html create mode 100644 it/trust_negotiation.html create mode 100644 it/userinfo_endpoint.html diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 00000000..e69de29b diff --git a/en/.buildinfo b/en/.buildinfo new file mode 100644 index 00000000..bf41cbae --- /dev/null +++ b/en/.buildinfo @@ -0,0 +1,4 @@ +# Sphinx build info version 1 +# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done. +config: 9b1e6d321160e90419e6d21fb8109a7c +tags: 645f666f9bcd5a90fca523b33c5a78b7 diff --git a/en/_images/Eo_circle_green_checkmark.svg b/en/_images/Eo_circle_green_checkmark.svg new file mode 100644 index 00000000..19e0bd7f --- /dev/null +++ b/en/_images/Eo_circle_green_checkmark.svg @@ -0,0 +1,2 @@ + diff --git a/en/_images/Eo_circle_red_letter-x.svg b/en/_images/Eo_circle_red_letter-x.svg new file mode 100644 index 00000000..4c3c8e78 --- /dev/null +++ b/en/_images/Eo_circle_red_letter-x.svg @@ -0,0 +1 @@ + diff --git a/en/_images/automatic_client_registration.svg b/en/_images/automatic_client_registration.svg new file mode 100644 index 00000000..3223e202 --- /dev/null +++ b/en/_images/automatic_client_registration.svg @@ -0,0 +1 @@ +User-AgentCIE (OP)RPCIE Fed AuthOIDC Authz Requestsigned by the RP https://rp.example.it/Entity Configuration Requesthttps://rp.example.it/.well-known/openid-federationEntity Configuration ResponseContent-Type: application/joseValidation of Trust MarksRoute to authority_hint https://registry.gov.it/Entity Configuration Requesthttps://registry.gov.it/.well-known/openid-federationEntity Configuration ResponseContent-Type: application/joseResponse ValidationEntity Statement request to Authority about its descendanthttps://registry.gov.it/oidc/fedapi?sub=https%3A%2F%2Frp.example.it%2FEntity Statement response about its descendanthttps://registry.gov.it/oidc/fedapi?sub=https%3A%2F%2Frp.example.it%2FValidates ResponseAcquires the policy and produces the final entity statementRP registration(Metadata and Trust Chain)The user submits the login form and give consentHTTP 200 - auth code responseUser-AgentCIE (OP)RPCIE Fed Auth \ No newline at end of file diff --git a/en/_images/cie_esempio_trust_chain.svg b/en/_images/cie_esempio_trust_chain.svg new file mode 100644 index 00000000..a6974252 --- /dev/null +++ b/en/_images/cie_esempio_trust_chain.svg @@ -0,0 +1,597 @@ + + + + + + + + + + + + + + + + + + + + + + + + cie_esempio_trust_chain + + + + + Foglio.194 + + Rettangolo.132 + + + + + + + Rettangolo.133 + OP + + + + + + + OP + + Rettangolo + + + + + + + Rettangolo.126 + TA + + + + + + + TA + + Rettangolo.121 + + + + + + + Rettangolo.126 + RP + + + + + + + RP + + Foglio.193 + + Cerchio + + + + + + + Rettangolo arrotondato + OIDC authentication request + + + + + + + + + + + + + + + + + + + + + + OIDCauthenticationrequest + + Rettangolo arrotondato.100 + send EC + + + + + + + + + + + + + + + + + + + + + + send EC + + Rettangolo arrotondato.102 + Validate EC and acquire the fed_api_endpoint + + + + + + + + + + + + + + + + + + Validate EC andacquire thefed_api_endpoint + + Rettangolo arrotondato.103 + ES request querying the fed_api_endpoint + + + + + + + + + + + + + + + + + + ES requestquerying thefed_api_endpoint + + Cerchio.104 + + + + + + + Rettangolo arrotondato.106 + RP EC request + + + + + + + + + + + + + + + + + + + + + + RP ECrequest + + Rettangolo arrotondato.107 + Validate EC, trust marks and acquire the authority_hint + + + + + + + + + + + + + + + + + + + + + + Validate EC, trustmarks and acquirethe authority_hint + + Rettangolo arrotondato.108 + TA EC request following authority_hint + + + + + + + + + + + + + + + + + + + + + + TA EC requestfollowingauthority_hint + + Connettore dinamico.111 + + + + Connettore dinamico.113 + + + + Connettore dinamico.115 + + + + Connettore dinamico.116 + + + + Connettore dinamico.118 + + + + Connettore dinamico.134 + + + + Connettore dinamico.136 + + + + Rettangolo arrotondato.137 + send EC + + + + + + + + + + + + + + + + + + + + + + send EC + + Foglio.161 + + Rettangolo + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + + Foglio.168 + + Rettangolo + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + + Connettore dinamico.175 + + + + Rettangolo arrotondato.176 + Validate ES of RP and apply metadata policy + + + + + + + + + + + + + + + + + + Validate ES of RPand apply metadata policy + + Rettangolo arrotondato.177 + send ES of RP + + + + + + + + + + + + + + + + + + + + + + send ES of RP + + Connettore dinamico.180 + + + + Foglio.181 + + Rettangolo + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + + Connettore dinamico.188 + + + + Rettangolo arrotondato.189 + Store the RP trust chain + + + + + + + + + + + + + + + + + + Store the RPtrust chain + + Connettore dinamico.190 + + + + Connettore dinamico.191 + + + + + + diff --git a/en/_images/cieid3.svg b/en/_images/cieid3.svg new file mode 100644 index 00000000..e0619876 --- /dev/null +++ b/en/_images/cieid3.svg @@ -0,0 +1,86 @@ + + + + + + + + + + Pagina 1 + + + Foglio.3617 + + Foglio.2903 + + + + Foglio.2954 + + + + Foglio.3603 + + Foglio.3601 + + + + Foglio.3602 + + + + + Foglio.3616 + + Foglio.3609 + + + + Foglio.3610 + + + + Foglio.3611 + + + + Foglio.3613 + + + + Rettangolo + + + + + + + + + diff --git a/en/_images/flusso.svg b/en/_images/flusso.svg new file mode 100644 index 00000000..d2ecc30a --- /dev/null +++ b/en/_images/flusso.svg @@ -0,0 +1,1816 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + flow + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.363 + + Foglio.364 + + + + Foglio.365 + + Foglio.366 + + + + Foglio.367 + + + + + Foglio.368 + + + + + + + + + + + Foglio.369 + + Foglio.370 + + + + Foglio.371 + + + + Foglio.372 + + + + + + + Foglio.373 + + + + + + + + + + + Foglio.374 + + Foglio.375 + + + + Foglio.376 + + + Foglio.377 + + + Foglio.378 + + Foglio.379 + + + + Foglio.380 + + + + Foglio.381 + + + Foglio.382 + + + Foglio.383 + + + Foglio.384 + + + Foglio.385 + + + + + + + + Rettangolo + + + + + + + Rettangolo.175 + + + + + + + Rettangolo.176 + + + + + + + Rettangolo.177 + + + + + + + Rettangolo.178 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività + Relying Party + + Foglio.2 + + + + Foglio.3 + + Foglio.4 + + + + Foglio.5 + + + + + Foglio.6 + + + + + + + + + + + Foglio.7 + + Foglio.8 + + + + Foglio.9 + + + + Foglio.10 + + + + + + + Foglio.11 + + + + + + + + + + + Foglio.12 + + Foglio.13 + + + + Foglio.14 + + + Foglio.15 + + + Foglio.16 + + Foglio.17 + + + + Foglio.18 + + + + Foglio.19 + + + Foglio.20 + + + Foglio.21 + + + Foglio.22 + + + Foglio.23 + + + + + + + + + Relying Party + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.24 + User + + Foglio.25 + + + + Foglio.26 + + Foglio.27 + + + + Foglio.28 + + + + + Foglio.29 + + + + + + + + + + + Foglio.30 + + Foglio.31 + + + + Foglio.32 + + + + Foglio.33 + + + + + + + Foglio.34 + + + + + + + + + + + Foglio.35 + + Foglio.36 + + + + Foglio.37 + + + Foglio.38 + + + Foglio.39 + + Foglio.40 + + + + Foglio.41 + + + + Foglio.42 + + + Foglio.43 + + + Foglio.44 + + + Foglio.45 + + + Foglio.46 + + + + + + + + + User + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.47 + Authorization Endpoint + + Foglio.48 + + + + Foglio.49 + + Foglio.50 + + + + Foglio.51 + + + + + Foglio.52 + + + + + + + + + + + Foglio.53 + + Foglio.54 + + + + Foglio.55 + + + + Foglio.56 + + + + + + + Foglio.57 + + + + + + + + + + + Foglio.58 + + Foglio.59 + + + + Foglio.60 + + + Foglio.61 + + + Foglio.62 + + Foglio.63 + + + + Foglio.64 + + + + Foglio.65 + + + Foglio.66 + + + Foglio.67 + + + Foglio.68 + + + Foglio.69 + + + + + + + + + AuthorizationEndpoint + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.70 + Token Endpoint + + Foglio.71 + + + + Foglio.72 + + Foglio.73 + + + + Foglio.74 + + + + + Foglio.75 + + + + + + + + + + + Foglio.76 + + Foglio.77 + + + + Foglio.78 + + + + Foglio.79 + + + + + + + Foglio.80 + + + + + + + + + + + Foglio.81 + + Foglio.82 + + + + Foglio.83 + + + Foglio.84 + + + Foglio.85 + + Foglio.86 + + + + Foglio.87 + + + + Foglio.88 + + + Foglio.89 + + + Foglio.90 + + + Foglio.91 + + + Foglio.92 + + + + + + + + + TokenEndpoint + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.93 + UserInfo Endpoint + + Foglio.94 + + + + Foglio.95 + + Foglio.96 + + + + Foglio.97 + + + + + Foglio.98 + + + + + + + + + + + Foglio.99 + + Foglio.100 + + + + Foglio.101 + + + + Foglio.102 + + + + + + + Foglio.103 + + + + + + + + + + + Foglio.104 + + Foglio.105 + + + + Foglio.106 + + + Foglio.107 + + + Foglio.108 + + Foglio.109 + + + + Foglio.110 + + + + Foglio.111 + + + Foglio.112 + + + Foglio.113 + + + Foglio.114 + + + Foglio.115 + + + + + + + + + UserInfoEndpoint + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.116 + OpenID Provider (OP) + + Foglio.117 + + + + Foglio.118 + + Foglio.119 + + + + Foglio.120 + + + + + Foglio.121 + + + + + + + + + + + Foglio.122 + + Foglio.123 + + + + Foglio.124 + + + + Foglio.125 + + + + + + + Foglio.126 + + + + + + + + + + + Foglio.127 + + Foglio.128 + + + + Foglio.129 + + + Foglio.130 + + + Foglio.131 + + Foglio.132 + + + + Foglio.133 + + + + Foglio.134 + + + Foglio.135 + + + Foglio.136 + + + Foglio.137 + + + Foglio.138 + + + + + + + + + OpenID Provider (OP) + + + Cerchio + 1 + + + + + + + 1 + + Cerchio.179 + + + + + + + Cerchio.180 + 2 + + + + + + + 2 + + Flusso di attività + Scelta OP + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Scelta OP + + Cerchio.183 + + + + + + + Flusso di attività.184 + Authorization Request + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Authorization Request + + Cerchio.185 + 3 + + + + + + + 3 + + Cerchio.187 + + + + + + + Flusso di attività.339 + + + + + + + + + + + + + + + + + + + + + + + + + + + Cerchio.340 + + + + + + + Flusso di attività.342 + + + + + + + + + + + + + + + + + + + + + + + + + + + Connettore dinamico + + + + Cerchio.341 + + + + + + + Connettore dinamico.345 + + + + Cerchio.346 + 4 + + + + + + + 4 + + Cerchio.347 + + + + + + + Flusso di attività.348 + + + + + + + + + + + + + + + + + + + + + + + + + + + Cerchio.349 + 5 + + + + + + + 5 + + Cerchio.350 + + + + + + + Flusso di attività.351 + Authorization Code + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Authorization Code + + Cerchio.352 + + + + + + + Cerchio.353 + 6 + + + + + + + 6 + + Flusso di attività.354 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cerchio.355 + 7 + + + + + + + 7 + + Cerchio.356 + + + + + + + Flusso di attività.357 + Access Token + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Access Token + + Cerchio.358 + + + + + + + Cerchio.359 + 8 + + + + + + + 8 + + Flusso di attività.360 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Foglio.386 + User Authentication Autorizzazione Invio Attributi + + + + User Authentication Autorizzazione Invio Attributi + + Foglio.388 + Redirect Message + + + + Redirect Message + + Foglio.390 + Access Token e ID Token + + + + Access Token eID Token + + Foglio.392 + Claims + + + + Claims + + diff --git a/en/_images/metadata_discovery.svg b/en/_images/metadata_discovery.svg new file mode 100644 index 00000000..bfae860e --- /dev/null +++ b/en/_images/metadata_discovery.svg @@ -0,0 +1,848 @@ + + + + + + + + + + + + + + + + + + + + + + + + metadata_discovery + + + + + Foglio.266 + + + Foglio.321 + + Foglio.200 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.175 + { “kid” : bfxafKvtP } { “iss” : RP2 “sub” : RP2 “authority_hi... + + + + {kid” : bfxafKvtP}{iss” : RP2sub” : RP2authority_hints” : SAkid” : bfxafKvtP[...]} + + Foglio.193 + + Cerchio + + + + + + + + Foglio.194 + + Foglio.195 + + Foglio.196 + + + + Foglio.197 + + + + + + Foglio.199 + RP2 Entity Configuration + + + + RP2 EntityConfiguration + + + Foglio.315 + RP2 .well-known endpoint + + + + RP2 .well-known endpoint + + + Foglio.322 + + Foglio.232 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.224 + { “kid” : dcEE870s } { “iss” : SA “sub” : SA “authority_hints... + + + + {kid” : dcEE870s}{iss” : SAsub” : SAauthority_hints” : TAkid” : dcEE870s[...]} + + Foglio.231 + SA Entity Configuration + + + + SA EntityConfiguration + + Foglio.214 + + Cerchio + + + + + + + Foglio.213 + + Cerchio.203 + + + + + + + Rettangolo + + + + + + + Cerchio.205 + + + + + + + Cerchio.206 + + + + + + + Cerchio.207 + + + + + + + Rettangolo.208 + + + + + + + Rettangolo.209 + + + + + + + Rettangolo.210 + + + + + + + + + + Foglio.317 + SA .well-known endpoint + + + + SA .well-known endpoint + + + Foglio.323 + + Foglio.233 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.242 + { “kid” : dcEE870s } { “iss” : SA “sub” : RP2 “kid” : bfxafKv... + + + + {kid” : dcEE870s}{iss” : SAsub” : RP2kid” : bfxafKvtP[...]} + + Foglio.243 + SA Entity Statement of RP2 + + + + SA EntityStatement of RP2 + + Foglio.244 + + Cerchio + + + + + + + Foglio.246 + + Cerchio.203 + + + + + + + Rettangolo + + + + + + + Cerchio.205 + + + + + + + Cerchio.206 + + + + + + + Cerchio.207 + + + + + + + Rettangolo.208 + + + + + + + Rettangolo.209 + + + + + + + Rettangolo.210 + + + + + + + + + + Foglio.318 + SA FETCH endpoint + + + + SA FETCH endpoint + + + Foglio.324 + + Foglio.296 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.282 + { “kid” : pZQU9t0A } { “iss” : TA “sub” : TA “kid” : pZQU9t0A... + + + + {kid” : pZQU9t0A}{iss” : TAsub” : TAkid” : pZQU9t0A[...]} + + Foglio.283 + TA Entity Configuration + + + + TA EntityConfiguration + + Foglio.272 + + Cerchio + + + + + + + Foglio.268 + + Foglio.269 + + Foglio.270 + + + + Foglio.271 + + + + + + + + Foglio.319 + TA .well-known endpoint + + + + TA .well-known endpoint + + + Foglio.325 + + Foglio.297 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.306 + { “kid” : pZQU9t0A } { “iss” : TA “sub” : SA “kid” : dcEE870s... + + + + {kid” : pZQU9t0A}{iss” : TAsub” : SAkid” : dcEE870s[...]} + + Foglio.307 + TA Entity Statement of SA + + + + TA EntityStatement ofSA + + Foglio.308 + + Cerchio + + + + + + + Foglio.310 + + Foglio.311 + + Foglio.312 + + + + Foglio.313 + + + + + + + + Foglio.320 + TA FETCH endpoint + + + + TA FETCH endpoint + + + Connettore dinamico + OP acquires the authority_hints to follow + + + + + OP acquires the authority_hints to follow + + Connettore dinamico.327 + OP acquires the authority_hints to follow + + + + + OP acquires the authority_hints to follow + + Connettore dinamico.328 + OP acquires the federation_fetch_endpoint to query + + + + + OP acquires the federation_fetch_endpoint to query + + Connettore dinamico.329 + OP acquires the federation_fetch_endpoint to query + + + + + OP acquires the federation_fetch_endpoint to query + + diff --git a/en/_images/spid3.svg b/en/_images/spid3.svg new file mode 100644 index 00000000..f2056e3a --- /dev/null +++ b/en/_images/spid3.svg @@ -0,0 +1,85 @@ + + + + + + + + + + Pagina 1 + + + Foglio.4311 + + Foglio.3619 + + + + Foglio.3621 + + + + Foglio.3625 + + + + Foglio.3631 + + + + Foglio.3808 + + + + Foglio.3830 + + + + Foglio.3845 + + + + + + + Semicerchio + + Foglio.4309 + + + + + Cerchio + + + + + + + + diff --git a/en/_images/spid_cie_oidc_federation_model.svg b/en/_images/spid_cie_oidc_federation_model.svg new file mode 100644 index 00000000..7529aeef --- /dev/null +++ b/en/_images/spid_cie_oidc_federation_model.svg @@ -0,0 +1 @@ +AgIDTrust AnchorSPID OPRPRPIntermediaryIntermediaryRPSPID OPRPMinInternoTrust AnchorCIE OPRPRPIntermediary \ No newline at end of file diff --git a/en/_images/trust_anchor.svg b/en/_images/trust_anchor.svg new file mode 100644 index 00000000..6581bf0e --- /dev/null +++ b/en/_images/trust_anchor.svg @@ -0,0 +1,202 @@ + + + + + + + + + + + + + + + + trust_anchor eng + + + Foglio.3 + Exposes its Entity Configuration + + + + Exposes its Entity Configuration + + Foglio.4 + Exposes the FETCH endpoint and releases Entity Statements + + + + Exposes the FETCH endpoint and releases Entity Statements + + Foglio.5 + about its subordinates + + + + about its subordinates + + Foglio.6 + + + + Foglio.7 + + + + Foglio.8 + OpenID Relying Party + + + + OpenID Relying Party + + Foglio.9 + + + + Foglio.10 + + + + Foglio.11 + Intermediary + + + + Intermediary + + Foglio.12 + (federation entity) + + + + (federation entity) + + Foglio.13 + Exposes its Entity Configuration containing the Trust Marks + + + + Exposes its Entity Configuration containing the Trust Marks + + Foglio.14 + Exposes the FETCH endpoint and releases Entity Statements + + + + Exposes the FETCH endpoint and releases Entity Statements + + Foglio.17 + + + + Foglio.18 + + + + Foglio.19 + + + + Foglio.20 + + + + Foglio.21 + authority + + + + authority + + Foglio.22 + hint + + + + hint + + Foglio.23 + + + + Foglio.24 + + + + Foglio.25 + authority + + + + authority + + Foglio.26 + hint + + + + hint + + Foglio.27 + + + + Foglio.28 + + + + Foglio.29 + Trust Anchor + + + + Trust Anchor + + Foglio.30 + (federation entity) + + + + (federation entity) + + Foglio.31 + about its subordinates + + + + about its subordinates + + Foglio.32 + Exposes its Entity Configuration containing the Trust Marks + + + + Exposes its Entity Configuration containing the Trust Marks + + diff --git a/en/_sources/attributi_utente.rst.txt b/en/_sources/attributi_utente.rst.txt new file mode 100644 index 00000000..eb02c571 --- /dev/null +++ b/en/_sources/attributi_utente.rst.txt @@ -0,0 +1,334 @@ +.. include:: ../common/common_definitions.rst + +.. _user_claims: + +User attributes +--------------- + +The following table shows the list of user attributes supported by SPID and/or CIE. The variable ``$PREFIX=https://attributes.eid.gov.it`` represents the namespace. + +.. list-table:: + :widths: 20 40 1 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **$PREFIX/spid_code** |br| Category:registry + - Identification code. String. The identification code is assigned by the digital identity provider + and must be unique. + + The format is the following: + + `` = `` + + Where: + + ****: is a code made by 4 letters, uniquely assigned to the identity provider. + + ****: is an alphanumeric string composed by 10 characters that the identity provider + uniquely generates in its own domain. + + Example: + + ``"$PREFIX/spid_code":"ABCD123456789A"`` + + - |spid-icon| + * - **given_name** |br| Category:registry + - Name. String. String composed by a sequence of words, separated by single spaces, each starting with a capital letter. + + + Example: + + ``"given_name":"Giovanni Mario"`` + + - |spid-icon| |cieid-icon| + * - **family_name** |br| Category:registry + - Last name. String. String composed by a sequence of words, separated by single spaces, each starting with a capital letter. + + Example: + + ``"family_name":"Bianchi Verdi"`` + + - |spid-icon| |cieid-icon| + * - **place_of_birth** |br| Category:registry + - Place of birth, province of birth. JSON Object: + + "**locality** : String corresponding to the real estate registry code (Belfiore Code) of the city or foreign country of birth (e.g. "F205" for the city of Milano) + + "**region**" : String corresponding to the code of the province of birth. + + Example: + + .. code-block:: json + + "place_of_birth": { + "region":"MI", + "locality":"F205" + } + + - |spid-icon| |cieid-icon| + * - **birthdate** |br| Category:registry + - Date of birth. String. Following the specifications ISO8601-2004 in the format + YYYY indicates the year using 4 (four) digits |br| + MM indicates the month with 2 (two) digits |br| + DD indicates the day with 2 (two) digits |br| + Example: |br| + + ``"birthdate":"2002-09-24"`` + + - |spid-icon| |cieid-icon| + * - **gender** |br| Category:registry + - Gender. String. Values accepted: |br| + "female" for female |br| + "male" for male |br| + Example: |br| + + ``"gender":"female"`` + + - |spid-icon| |cieid-icon| + * - **$PREFIX/company_name** |br| Category:registry + - Company name. String. String composed by a sequence of words, separated by single spaces. + In capital letters the substrings corresponding to names (e.g. "Agenzia per l'Italia Digitale") + + .. code-block:: json + + "$PREFIX/company_name": "Agenzia per l'Italia Digitale" + + - |spid-icon| + * - **$PREFIX/registered_office** |br| Category: extra registry + - Registered Office. JSON Object: formatted, street_address, locality, region, postal_code, country, + country_code. + Json made of a string composed by a sequence of words, separated by single spaces, representing: + + - Type of address (via, viale, piazza …) + - Address + - Hiuse number + - ZIP + - City + - Province + + the string is included in the claim "formatted" of the JSON Object "address" + + Example: + + .. code-block:: json + + "$PREFIX/registered_office":{ + "formatted":"via Listz 21 00144 Roma" + } + + - |spid-icon| + * - **$PREFIX/fiscal_number** |br| Category:registry + - Fiscal number of the natural person. String. For the format, please refer to the coding of the attribute + CF for the certificates, proposed in the Draft ETSI EN 319 412-1, that implies, in the specific case, the following format: + TINIT- + + Example: + + ``"$PREFIX/fiscal_number":“TINIT-ABCXYZ00W00Z000Z"`` + + - |spid-icon| |cieid-icon| + * - **$PREFIX/company_fiscal_number** |br| Category:registry + - Fiscal number of the legal person. String. For the format, please refer to the coding of the attribute + CF for the certificates, proposed in the Draft ETSI EN 319 412-1, that implies, in the specific case, the following format: + + ``TINIT-`` + + Example: + + ``"$PREFIX/company_fiscal_number":"TINIT-ABCXYZ00W00Z000Z"`` + + - |spid-icon| + * - **$PREFIX/vat_number** |br| Category:registry + - VAT number. String. For the format, please refer to the coding of the attribute VAT number for + the certificates, proposed in the Draft ETSI EN 319 412-1, that implies, in the specific case, the following format: + + ``VATIT-`` + + Example: + + ``"$PREFIX/vat_number": "VATIT-12345678901"`` + + - |spid-icon| + * - **document_details** |br| Category: extra registry + - Identity document. JSON Object (document): + + Json contains the proprieties that represent: + + - "**type**" : accepted values: + + - *cartaIdentita, passaporto, patenteGuida,* + + - *patenteNautica, librettoPensione,* + + - *patentinoImpTermici, portoArmi,* + + - *tesseraRiconoscimento;* + + - "**document_number**" : Document number; + - "**issuer**" : JSON Object: + + - "**name**" string obtained from the concatenation + of the terms that build the Entity name + unless conjunctions, articles and prepositions. + + E.g. regioneLazio ( Region Lazio); + provinciaCatania ( Province of Catania); + prefetturaRoma ( Prefecture of Roma ); + MinisteroEconomiaFinanze ( Ministry + of Economy and Finance ); + + - "**date_of_issuance**" : date of issuance of the document; + + - "**date_of_expiry**" : expiry date of the document. + + Example: + + .. code-block:: json + + "document_details":{ + "type":"cartaIdentita", + "document_number":"AS09452389", + "issuer":{ + "name":"ComuneRoma" + }, + "date_of_issuance":"2013-01-02", + "date_of_expiry":"2013-01-31" + } + + - |spid-icon| |cieid-icon| + * - **phone_number** |br| Category: extra registry + - Mobile phone name. String. Numeric string without internal spaces |br| + Example: |br| + ``"phone_number": "VATIT-12345678901"`` + - |spid-icon| |cieid-icon| + * - **phone_number_verified** |br| Category: extra registry + - Boolean value indicating whether the user's mobile phone number has been verified by the OP. + - |cieid-icon| + * - **$PREFIX/landline_number** |br| Category: extra registry + - Landline number. String. Numeric string without internal spaces |br| + Example: |br| + ``"$PREFIX/landline_number":"VATIT-12345678901"`` + - |cieid-icon| + * - **email** |br| Category: extra registry + - E-mail address. String. Standard e-mail address |br| + Example: |br| + ``"email":"name@domain.it"`` + - |spid-icon| |cieid-icon| + * - **email_verified** |br| Category: extra registry + - Boolean value indicating whether the user's e-mail has been verified by the OP. + - |cieid-icon| + * - **$PREFIX/e_delivery_service** |br| Category: extra registry + - Qualified electronic registered delivery. PEC e-mail address |br| + Example: |br| + ``"$PREFIX/e_delivery_service":"name@pecdomain.it"`` + - |spid-icon| |cieid-icon| + * - **$PREFIX/eid_exp_date** |br| Category: extra registry + - Identity expiry date. According to the specifications ISO8601-2004 in the format + "YYYY-MM-DD" where |br| + YYYY indicates the year using 4 (four) digits |br| + MM indicates the month with 2 (two) digits |br| + DD indicates the day with 2 (two) digits |br| + Example: |br| + ``"$PREFIX/eid_exp_date":"2002-09-24"`` + - |spid-icon| + * - **address** |br| Category: extra registry + - JSON Object (address): + + - "**street_address**": The attribute contains the address type (via, viale, piazza …), the address and the house number. The three informations are preferably sorted as in the specific countries. + + - "**postal_code**": ZIP + + - "**locality**": City + + - "**region**": Province + + - "**country_code**": Country + + Example: + + .. code-block:: json + + "address": { + "street_address":"Via Liszt 21", + "postal_code":"00144", + "locality":"Roma", + "region":"RM", + "country_code":"IT" + } + + - |spid-icon| |cieid-icon| + +.. _user_claims_scopes: + + +Examples +++++++++ + +For convenience, we report examples that produce the composition of a unique JSON Object, from +several attributes and in particular the claims ``"place_of_birth"``, ``"address"``, ``"document_details"``, ``$PREFIX/registered_office``. + +As an example, two Italian addresses are reported: + + +.. list-table:: + :widths: 20 80 + :header-rows: 1 + + * - **Attribute** + - **Example of OIDC coding** + * - Physical domicile address + ZIP of the physical domicile + City of the of the physical domicile + Province of the physical domicile + Country of the physical domicile + - .. code-block:: json + + "address":{ + "street_address":"Via Liszt 21", + "postal_code":"00144", + "locality":"Roma", + "region":"RM", + "country_code":"IT" + } + + * - Physical domicile address + ZIP of the physical domicile + City of the of the physical domicile + Province of the physical domicile + Country of the physical domicile + - .. code-block:: json + + "address":{ + "street_address":"S.S. Salaria Km 23,800", + "postal_code":"00015", + "locality":"Monterotondo", + "region":"RM", + "country_code":"IT" + } + +There are cases, as for the United States of America, where both the country (US) and a State must be indicated. +In such cases the State is indicated in the field Province. +In the following, an example: + +.. list-table:: + :widths: 20 80 + :header-rows: 1 + + * - **Attribute** + - **Example of OIDC coding** + * - Physical domicile address + ZIP of the physical domicile + City of the of the physical domicile + Province of the physical domicile + Country of the physical domicile + - .. code-block:: json + + "address":{ + "street_address":"503,Washington Avenue", + "postal_code":"12401", + "locality":"Kingston", + "region":"New york", + "country_code":"US" + } diff --git a/en/_sources/authorization_endpoint.rst.txt b/en/_sources/authorization_endpoint.rst.txt new file mode 100644 index 00000000..068e0b1d --- /dev/null +++ b/en/_sources/authorization_endpoint.rst.txt @@ -0,0 +1,345 @@ +.. include:: ../common/common_definitions.rst + +Authorization endpoint +---------------------- + +Request ++++++++ + +The Authorization request is initiated by the user that selects the OP for the authentication. +The RP redirects the user to the *Authorization Endpoint* of the selected OP, including in the request the parameter **request** that is a signed JWT containing the *Authorization Request*. + +For conveying the request, the RP MAY use the methods **POST** and **GET**. With the method **POST** the parameters MUST be sent using the *Form Serialization*. +With the method **GET** the parameters MUST be sent using the *Query String Serialization*. For more details see `OpenID.Core#Serializations`_. + +.. warning:: + The parameter **scope** MUST be sent both as a parameter in the HTTP request, and inside the request object. The two values MUST be the same. + + |cieid-icon| + The parameters **client_id** and **response_type** SHOULD be sent both as parameters in the HTTP request, and inside the request object. + + |spid-icon| + The parameters **client_id** and **response_type** MUST be sent both as parameters in the HTTP request, and inside the request object + and MUST be the same, in case of mismatching the values inside the request object MUST be considered. + +.. seealso:: + + - :ref:`Example of Authorization Request ` + + +In the following the mandatory parameters in the *HTTP* authentication request. + +.. _tabella_parametri_http_req: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **scope** + - It contains values of *scope* that are supported by the OP and defined by the parameter + **scopes_supported** in the :ref:`Metadata OP `. + At least the value *openid* MUST be present. + - |spid-icon| |cieid-icon| + * - **code_challenge** + - See :rfc:`7636#section-4.2`. + - |spid-icon| |cieid-icon| + * - **code_challenge_method** + - As defined by the parameter **code_challenge_methods_supported** in the :ref:`Metadata OP `. + - |spid-icon| |cieid-icon| + * - **request** + - See `OpenID.Core#JWTRequests`_. It MUST be a signed **JWT**. + - |spid-icon| |cieid-icon| + +In the following, a table that reports the composition of the **JWT** header. + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Jose Header** + - **Description** + - **Supported by** + * - **alg** + - See :rfc:`7516#section-4.1.1`. See :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **kid** + - See :rfc:`7638#section_3`. + - |spid-icon| |cieid-icon| + +.. note:: + The parameter **typ**, if omitted, assumes the implicit value **JWT**. + + +The **JWT** payload contains the following mandatory claims: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **client_id** + - See `OpenID.Registration`_. It MUST contain an HTTPS URL that uniquely identifies the RP. + - |spid-icon| |cieid-icon| + * - **code_challenge** + - As defined in the :ref:`Table of the HTTP parameters `. + - |spid-icon| |cieid-icon| + * - **code_challenge_method** + - As defined in the :ref:`Table of the HTTP parameters `. + - |spid-icon| |cieid-icon| + * - **nonce** + - See `OpenID.Core#AuthRequest`_. It MUST be a casual string with at least 32 alphanumeric characters. + This value will be returned in the ID Token provided by the Token Endpoint, so that the client can test that it is equals as in the authentication request. + - |spid-icon| |cieid-icon| + * - **prompt** + - See `OpenID.Core#AuthRequest`_. The allowed values are: + + **consent**: If a Single Sign On session is not yet active, + the OP makes an Authentication Request to the user. + Then it asks permission to transfer the claims. + + **consent login**: The OP forces an authentication request to the user. + Then it asks permission to transfer the claims. + + - |spid-icon| |cieid-icon| + * - **redirect_uri** + - See `OpenID.Core#AuthRequest`_. It MUST be an URL included in the :ref:`Metadata RP `. + - |spid-icon| |cieid-icon| + * - **response_type** + - See `OpenID.Core#AuthRequest`_. As defined by the parameter **response_types_supported** in the + :ref:`Metadata OP `. + - |spid-icon| |cieid-icon| + * - **scope** + - As defined in the :ref:`Table of the HTTP parameters `. + - |spid-icon| |cieid-icon| + * - **acr_values** + - See `OpenID.Core#AuthRequest`_. As defined by the parameter **acr_values_supported** in the + :ref:`Metadata OP `. + Reference values of the contest class of the Authentication Request. + It MUST be a string with the requested "acr" values, each of them separated by a single space, appearing in order of preference. The OP MAY use an authentication at a higher level than requested. Such a choice MUST NOT cause a negative result of the request. + - |spid-icon| |cieid-icon| + * - **claims** + - See `OpenID.Core#ClaimsRequestParameter`_. See Section "Parameters scope and claims". + - |spid-icon| |cieid-icon| + * - **state** + - See `OpenID.Core#AuthRequest`_. It must be a casual string with at least 32 alphanumeric characters. + Unique session identifier at the RP side. This value will be returned to the client in the response, at the end of the authentication. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the generation time of the JWT, coded as NumericDate as indicated in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **iss** + - It MUST correspond to *client_id*. + - |spid-icon| |cieid-icon| + * - **aud** + - It MUST correspond to the OP identifier (parameter *issuer*, present in the :ref:`Metadata OP `.) + - |spid-icon| |cieid-icon| + * - **ui_locales** + - OPTIONAL. End-User's preferred languages and scripts for the user interface. Represented as a space-separated list of BCP47 [RFC5646]. + - |spid-icon| |cieid-icon| + +.. note:: + **PKCE** is an extension of the protocol *OAuth 2.0* also provided in the profile *iGov* (`International Government Assurance Profile for OAuth 2.0 `_) and aimed at avoiding possible attacks from intercepting the *authorization code*. It consists of the generation of a code (**code verifier**) and its hash (**code challenge**). The **code challenge** is sent to the OP in the authentication request. + + When the RP contacts the *Token Endpoint* at the end of the authentication flow, it sends the **code verifier** created initially, so that the OP can check if its hash is the same as in the authentication request. + + An example of a Python script for generating the requested parameters is shown. + + .. literalinclude :: ../../static/pkce.py + :language: python + + +.. _parametri_scope_claims: + +Parameters **scope** and **claims** +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. admonition:: |spid-icon| + + The attributes of the user MAY be requested by the RP using the **claims** parameter in the Authorization Request. + + SPID doesn't allow the user attributes in ID Token, they are only available at the "userinfo" endpoint. + + +.. admonition:: |cieid-icon| + + The user attributes MAY be requested by the RP using the **scope** or **claims** parameters in the Authorization Request. + + When the **scope** parameter is used, the following values are supported: + + - **profile**: requests the user attributes equivalent to the eIDAS Minimum Dataset: + + - *family_name*, + - *given_name*, + - *birthdate*, + - *\https://attributes.eid.gov.it/fiscal_number* (National Unique Identifier). + + - **email**: requests the following attributes: + + - *email*; + - *email_verified*. + + + The parameter **scope** MAY contain one or more values, with single spaces as separators. For example, using both profile and email in the scope parameter returns the Minimum eIDAS Dataset and the email. + In case of requests of single user-attributes or specific combinations of them, the RP SHOULD use the parameter **claims**. + + The attributes requested by the parameter **scope** are available both in the ID Token and in the *userinfo endpoint* response. + + .. warning:: + + If in the **scope** parameter there was only the *openid* value and the **claims** parameter was not present or valued, the response of the userinfo endpoint would not have any user attributes but only the claim **sub**. + +For the definition of the parameter **claims** and its usage modes for requesting the user attributes, please refer to `OpenID.Core#ClaimsParameter`_. + + +Response +++++++++ + +An Authentication response is returned by the authorization endpoint of the OpenID Provider (OP) at the end of the authentication flow. The OP redirects the user +to the URL contained in the parameter redirect_uri specified in the authorization request, adding the response parameters. + +.. seealso:: + + - https://tools.ietf.org/html/rfc6749#section-4.1.2 + - https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation + +If the authentication is successful the OpenID Provider (OP) redirects the user by adding the following parameters required as query parameters to the *redirect_uri* (as defined in `OpenID.Core#AuthResponse`_): + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **code** + - Unique *Authorization Code* that the client can pass to the Token Endpoint for obtaining an ID Token and an Access Token. This has the advantage of not exposing any token to the User Agent or to malware that could be controlling it. + - |spid-icon| |cieid-icon| + * - **state** + - State value included in the *Authentication Request*. The client is supposed to check its correspondence. It must have the same value indicated by the client in the Authorization Request. + - |spid-icon| |cieid-icon| + * - **iss** + - Unique Identifier of the OP that has created the Authentication Response. The RP MUST validate + this parameter and MUST NOT allow more OPs to use the same identifier. + - |cieid-icon| + +Authorization Response example: + + .. code-block:: http + + http://rp-test.it/oidc/rp/callback/?code=a032faf23d986353019ff8eda96cadce2ea1c368f04bf4c5e1759d559dda1c08056c7c4d4e8058cb002a0c8fa9a920272350aa102548523a8aff4ccdb44cb3fa&state=2Ujz3tbBHWQEL4XPFSJ5ANSjkhd7IlfC&iss=http%3A%2F%2Fop-test%2Foidc%2Fop%2F + +Error Management +++++++++++++++++ + +In the event of an error, the OP or RP represent the anomaly message +as described in the related tables defined by the `Linee Guida UX SPID`_. + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **error** + - See :ref:`Error codes ` + - |spid-icon| |cieid-icon| + * - **error_description** + - Error description. + - |spid-icon| |cieid-icon| + * - **state** + - It MUST be equal to the *status* value included in the *Authentication Request*. The RP MUST verify that it matches the one sent in the *Authentication Request*. + - |spid-icon| |cieid-icon| + + +.. _codici_errore: + +Error Codes +^^^^^^^^^^^ + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Error Code** + - **Description** + - **HTTP Code** + - **Supported by** + + * - *access_denied* + - The OP denied access due to invalid or unsuitable credentials for the required SPID level (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *unauthorized_client* + - The client is not authorized to request an authorization code (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *invalid_request* + - The request is not valid due to the lack or incorrectness of one or more parameters (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *invalid_scope* + - Invalid scopes in the Authorization request (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *server_error* + - The OP encountered an internal problem (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *temporarily_unavailable* + - The OP encountered a temporary internal problem (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *unsupported_response_type* + - The OP does not support the requested response_type. (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *login_required* + - The OP requires End-User authentication (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *consent_required* + - The OP requires End-User consent (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *request_uri_not_supported* + - The OP does not support use of the request_uri parameter (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *registration_not_supported* + - The OP does not support use of the *registration* parameter (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *invalid_request_object* + - The *request* parameter contains an invalid *Request Object* (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + +.. warning:: + + In case of invalid, mismatching, or missing redirection URI, the OP will return *400 Bad Request* as the HTTP code. + + diff --git a/en/_sources/avvisi_spid.rst.txt b/en/_sources/avvisi_spid.rst.txt new file mode 100644 index 00000000..b3008d39 --- /dev/null +++ b/en/_sources/avvisi_spid.rst.txt @@ -0,0 +1,40 @@ +SPID regulatory references +++++++++++++++++++++++++++ + +The **SPID System** start-up, for its nature and complexity, can require interventions on different aspects +with specifyings, clarifications, information notes and case studies, in order to provide support for a better +application and understanding of the SPID Regulations, already issued by AgID in compliancy to what prescribed +by the art. 4 of the DPCM 24 October 2014. + +In order to organically gather such interventions and attribute them a character that involve application commitment by the involved actors in the SPID System, be they public or private, the present section **"SPID Announcements"** has been created, aimed at ensuring a uniform interpretation of the rules, the technical +aspects and what else might be necessary for the correct System operation as a whole. + +The present technical rules implement the following SPID announcements: + +.. list-table:: + :widths: 20 40 20 + :header-rows: 1 + + * - Announcement + - Reference + - Date + + * - LL.GG. OpenID Connect in SPID + - `LL.GG. OpenID Connect in SPID `_ + - 24/11/2021 + + * - Avviso n.41 + - `Avviso n.41 v2 - Integrazione LL.GG. OpenID Connect in SPID.pdf `_ + - 06/05/2022 + + * - Tabella Attributi utente v1.3 + - `Tabella Attributi in SPID - Integrazione LL.GG. OpenID Connect in SPID.pdf `_ + - 24/06/2022 + + * - Determina SPID OpenID Connect Federation + - `Regole tecniche per il funzionamento della Federazione SPID OpenID Connect - Integrazione LL.GG. OpenID Connect in SPID.pdf - `_ + - 14/09/2022 + + * - Linee Guida Attribute Authority SPID + - `SPID Attribute Authority Guidelines `_ + - 18/07/2022 diff --git a/en/_sources/come_contribuire.rst.txt b/en/_sources/come_contribuire.rst.txt new file mode 100644 index 00000000..46bd810a --- /dev/null +++ b/en/_sources/come_contribuire.rst.txt @@ -0,0 +1,10 @@ +.. include:: ../common/common_definitions.rst + +How to contribute +----------------- + +If you want to contribute, please click the GitHub icon on the upper right corner by the label "Source", and access the public repository. + +Should you find some mistake, or wish you clarify something, or even simply notify something, with the aim of improving this documentation, please open a new Issue. + +After opening the Issue and receiving returns from the Italian Community of Developers, you will be able to open a new Pull Request containing the modification or correction that you propose. diff --git a/en/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt b/en/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt new file mode 100644 index 00000000..103a31f6 --- /dev/null +++ b/en/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt @@ -0,0 +1,40 @@ +.. include:: ../common/common_definitions.rst + +Differences with OIDC iGov +-------------------------- + +CIE OpenID Connect and SPID OpenID Connect are based on `iGov.OIDC`_ with the following differences: + + - Section 2.1 of iGov shows **vtr**, **acr_values** and **PKCE** as OPTIONAL, in both SPID and CIE id PKCE and acr_values are REQUIRED. In the both SPID and CIE implementation the acr_values has been adopted instead of vtr. + + - The Authentication response in the Auth code flow of CIE mandates the usage of the **iss** claim parameter to avoid the mix-up attack `I-D.ietf-OAuth-Security-BCP`_. The usage of this parameter is OPTIONAL in SPID. + + - Section 2.4 of iGov states "RPs MAY optionally send requests to the Authorization endpoint using request parameter." In both SPID and CIE id the usage of request parameter is REQUIRED. + + - Section 3.1 of iGov states " in the case of using vtr in the authentication request the ID Token MUST contain the following REQUIRED claims, namely: **vot** and **vtm** ". As vtr is not used in both SPID and CIE id, thus the aforementioned claims are not included within the ID Token. + + - Section 3.1 of iGov states "the auth-time claim in ID Token is RECOMMENDED". The SPID and CIE id do not adopt this claim in the ID Token. + + - ID Token in both SPID and CIE id MUST have the acr claim as REQUIRED, while this is optional in the OpenID iGov specs . + + - ID Token in both SPID and CIE id has the requirement of the **at_hash** claim as mandatory, this is OPTIONAL in OIDC-CORE and not present in iGov. + + - In both SPID and CIE id the subject identifier MUST be pairwised. + + - The UserInfo response in both SPID and CIE id MUST be a Nested JWT, signed with the private key of the issuer and encrypted with the public key of the RP. + + - The signed JWT of the UserInfo response MUST have the claims **iss**, **sub**, **aud**, **iat** and **exp**. + + - Section 3.4 of iGov states "OpenID Providers MAY accept request object by reference using the request_uri parameter". This parameter is interchangeable with the request parameter. SPID and CIE id only adopts the usage of request parameter. + + - Section 3.8. Dynamic Registration of iGOV specifies that dynamic client registration is mandatory. In both CIE id and SPID the OIDC Federation automatic client registration is REQUIRED and the OIDC Dynamic client registration SHOULD NOT be supported. + + - Section 4.2 of iGOV the scopes **openid**, **offline_access**, **profile** and **email** are used in CIE id OpenID Connect and they do not consider the other recommended scopes in the iGov profile, namely: **doc**. + + - Section 4.2 of iGOV the scopes **openid**, **offline_access** are used in SPID OpenID Connect and they do not consider the other recommended scopes in the iGov profile, namely: **doc**. + + - Section 4.3 of iGov defines the policy regarding the userinfo object of claim request parameter. In CIE id, we define the policy both for the userinfo and ID Token object. + + - Sections 3.7 and 2.5 of iGOV : both SPID and CIE id OP metadata are distributed according to the modalities defined in Section "3. Metadata". + + - The Access token is a signed jwt in compliance to :rfc:`9068` diff --git a/en/_sources/cryptographic_algos.rst.txt b/en/_sources/cryptographic_algos.rst.txt new file mode 100644 index 00000000..78d2eb14 --- /dev/null +++ b/en/_sources/cryptographic_algos.rst.txt @@ -0,0 +1,120 @@ +.. include:: ../common/common_definitions.rst + +.. _supported_algs: + +Cryptographic algorithms +++++++++++++++++++++++++ + +All the participants MUST expose the supported +signature and encryption algorithms in their metadata. They are used for all encryption and signature operations required by OIDC core and Federation. + +.. note:: + + The length of the RSA keys must be equal to or greater than 2048 bits. + A length of 4096 bits is recommended. + +In the SPID and CIE id the following algorithms MUST be supported: + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Algorithm** + - **Operations** + - **References** + - **Applicable to** + * - **RS256** + - Signature + - `OpenID.Core`_ and `RFC7518 `_. + - |spid-icon| |cieid-icon| + * - **RS512** + - Signature + - `RFC7518 `_ + - |spid-icon| |cieid-icon| + * - **RSA-OAEP** + - Key Encryption + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **RSA-OAEP-256** + - Key Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + * - **A128CBC-HS256** + - Content Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + * - **A256CBC-HS512** + - Content Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + +In the SPID and CIE id the following algorithms are RECOMMENDED to be supported: + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Algorithm** + - **Operations** + - **References** + - **Applicable to** + * - **ES256** + - Signature + - `OpenID.Core`_ and `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **ES512** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **PS256** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **PS512** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **ECDH-ES** + - Key Encryption + - `RFC7518`_. + - |cieid-icon| + * - **ECDH-ES+A128KW** + - Key Encryption + - `RFC7518`_. + - |cieid-icon| + * - **ECDH-ES+A256KW** + - Key Encryption + - `RFC7518`_. + - |cieid-icon| + + +In the SPID and CIE id the following algorithms MUST NOT be supported: + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Algorithm** + - **Operations** + - **References** + - **Applicable to** + * - **none** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **RSA_1_5** + - Key Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + * - **HS256** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **HS384** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **HS512** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| diff --git a/en/_sources/differenze_oidc_fed.rst.txt b/en/_sources/differenze_oidc_fed.rst.txt new file mode 100644 index 00000000..fd36463d --- /dev/null +++ b/en/_sources/differenze_oidc_fed.rst.txt @@ -0,0 +1,26 @@ +.. include:: ../common/common_definitions.rst + +.. _differenze_con_oidc_federation: + +Differences with OIDC Federation +-------------------------------- + +This section lists the differences between the official standard and the SPID / CIE implementation. + + +Client Registration ++++++++++++++++++++ + +SPID and CIE support only **automatic_client_registration**. The **explicit client registration** flow is not supported. + + +Trust Mark +++++++++++ + +In OIDC Federation international specifications the adoption of the Trust Marks is not mandatory. Rather, in the SPID and CIE Federation it is mandatory to expose them. For more details about the reasons why the Trust Marks are required, please see the section :ref:`Security Considerations `. + + +Unsupported Claims in the Entity Statements ++++++++++++++++++++++++++++++++++++++++++++ + +Since SPID and CIE don't need any additional claim of the Federation scope, they don't need the claim **crit**. Likewise, the claims **aud**, **naming_constraints**, **policy_language_crit** and **trust_anchor_id** are not supported. Any possible presence of these claims does not have implications, they are simply ignored until possible future communications about their regulation. diff --git a/en/_sources/differenze_spid_cie.rst.txt b/en/_sources/differenze_spid_cie.rst.txt new file mode 100644 index 00000000..372337ec --- /dev/null +++ b/en/_sources/differenze_spid_cie.rst.txt @@ -0,0 +1,81 @@ +.. include:: ../common/common_definitions.rst + +.. _DifferenzeSPID_CIE: + +Differences between SPID e CIE id +--------------------------------- + +This section provides the main differences between SPID and CIE id. + +Metadata +++++++++ + +CIE id allows th ID Token encryption, the OP and RP metadata include the parameters that enable this feature (see section `Metadata OP `_ and `Metadata RP `_). + +SPID does not allow the ID Token encryption. + +Moreover, CIE id requires the parameter *revocation_endpoint_auth_methods_supported* to be included in the OP metadata, while SPID does not. + +Authorization Endpoint +++++++++++++++++++++++ + +SPID requires the parameters *client_id* and *response_type* in the HTTP request as mandatory, while in CIE id they are recommended. + +Moreover, in CIE id the response requires the presence of the *iss* parameter as mitigation against the mix-up attacks `I-D.ietf-OAuth-Security-BCP`_. SPID does not require it. + + +Parameters Scope and Claims ++++++++++++++++++++++++++++ + +CIE id allows an RP to request user attributes using both the *claims* parameter and the *scope* parameter, enabling in the scope parameter the values *profile* and *email*. + +SPID does not allow *profile* and *email* values in the *scope* parameter. + +For further details see section :ref:`Parameters Scope and claims `. + + +ID Token +++++++++ + +In SPID the user attributes are not available in the ID Token. + +In CIE id the user attributes are available in both ID Token and UserInfo response. +Moreover, CIE id allows the ID Token encryption. + + +Refresh Token ++++++++++++++ + +SPID allows the Refresh Token to enable the revocable long sessions as defined in `LL.GG. OpenID Connect in SPID `_ e nell' `Avviso n.41 `_ . Whith a Refresh Token an RP can obtain an ID Token which only contains the value *https://www.spid.gov.it/SpidL1* in the *acr* parameter. + +In CIE id the Refresh Token does not allow to obtain an ID Token. Thus, an RP can not obtain a new user authentication with the OP or renewing a pre-existing one. The Refresh Token in CIE id may be used to obtain from the UserInfo endpoint the same set of user attributes requested at the initial authentication phase, for which the user has given explicit consent. + +For further details see section :ref:`Refresh Token `. + + +UserInfo Endpoint ++++++++++++++++++ + +CIE id supports both GET and POST HTTP methods. + +SPID only allows the HTTP GET method. + +Introspection Endpoint +++++++++++++++++++++++ + +In CIE id, only the parameter *active* is given in the introspection response. + +SPID includes additional parameters as defined in section :ref:`Introspection Endpoint `. + + +Revocation Endpoint and Logout +++++++++++++++++++++++++++++++ + +SPID and CIE id require the RP to request an Access Token revocation during the user logout. +In SPID the Access Token revocation implies the Refresh Token revocation, if any or still active, and the end of the Single Sign-On session if still active. + +In CIE id the Access Token revocation does not imply the Refresh Token revocation, if any. +In CIE id the Refresh Token revocation requires all related active token to be revoked. + + + diff --git a/en/_sources/diventa_fornitore.rst.txt b/en/_sources/diventa_fornitore.rst.txt new file mode 100644 index 00000000..beba10fe --- /dev/null +++ b/en/_sources/diventa_fornitore.rst.txt @@ -0,0 +1,11 @@ +.. include:: ../common/common_definitions.rst + + +Become a service provider +------------------------- + +Official links of the SPID and CIE onboarding systems. + + - `How to become SPID service provider `_ + + - `How to become CIE service provider `_ diff --git a/en/_sources/entity_configuration.rst.txt b/en/_sources/entity_configuration.rst.txt new file mode 100644 index 00000000..3b2c074b --- /dev/null +++ b/en/_sources/entity_configuration.rst.txt @@ -0,0 +1,126 @@ +.. include:: ../common/common_definitions.rst + +.. _Entity_Configuration: + +Entity Configuration +-------------------- + +An **Entity Configuration (EC)** is a Federation Metadata in Jose format, signed by an Entity +and regarding itself, published at the web endpoint **.well-known/openid-federation**. + +.. _firma_EC: + +Entity Configuration Signature +++++++++++++++++++++++++++++++ + +All the signature-check operations regarding the ESs, ECs and TMs, +are carried out with the Federation public keys. For the supported algorithms refer to Section :ref:`Cryptografic Algorithm ` + +.. warning:: + The Federation keys SHOULD be different from the OIDC Core ones. The latter ones are contained in the OIDC Metadata. An EC contains both the Federation public keys and the OIDC Metadata. + + +Entity Configuration - common claims +++++++++++++++++++++++++++++++++++++ + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **iss** + - String. Identifier of the issuing Entity. + - |spid-icon| |cieid-icon| + * - **sub** + - String. Identifier of the Entity to which it is referred. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the time of generation of the JWT, coded as NumericDate as indicated at :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated at :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **jwks** + - A JSON Web Key Set (JWKS) :rfc:`7517` that represents the public part of the signing keys of the + Entity at issue. Each JWK in the JWK set MUST have a key ID (claim kid). + - |spid-icon| |cieid-icon| + * - **metadata** + - JSON Object. Each key of the JSON Object represents an identifier of the type of + :ref:`Metadata` and each value MUST be a JSON Object that represents + the Metadata, according to the Metadata schema of that type. + + An Entity Configuration MAY contain more Metadata statements, but only one for each type of + Metadata (<**entity_type**>). + + The allowed types are the following: + + - openid_relying_party + - openid_provider + - federation_entity + - oauth_authorization_server + - oauth_resource + - |spid-icon| |cieid-icon| + +.. warning:: + Inside the EC the claims **iss** e **sub** contain the same value (URL). + + +Entity Configuration Leaves and Intermediates ++++++++++++++++++++++++++++++++++++++++++++++ + +In addition to the previously defined claims, the EC of the Leaf and Intermediate Entities, contain also +the following claims: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **authority_hints** + - Array if URLs. It contains a list of URLs of the superior Entities, such as TA or SA, + that MAY issue an ES related to this subject. + - |spid-icon| |cieid-icon| + * - **trust_marks** + - A JSON Array containing the Trust Marks. See the Section :ref:`Trust Mark `. + Required for all the members except the Trust Anchor. + - |spid-icon| |cieid-icon| + +.. seealso:: + + - :ref:`Non-normative example of EC of an OP` + - :ref:`Non-normative example of EC of a RP` + - :ref:`Non-normative example of EC of a Federation Intermediate (SA)` + +.. _entity_configuration_ta: + +Entity Configuration Trust Anchor ++++++++++++++++++++++++++++++++++ + +The ECs of a TA, other than the common claims of all the other members, contains also the following ones: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **constraints** + - JSON Object that describes the Trust Chain bounds and MUST contain the attribute **max_path_length**. + It represents the maximum number of SAs between a Leaf and the TA. + + It MAY contain also **allowed_leaf_entity_types**, that restricts what types of Leaf Entities that MAY appear beneath the entity described in this Entity Statement + - |spid-icon| |cieid-icon| + * - **trust_marks_issuers** + - JSON Array that indicates which Federation authorities are considered trustworthy + for issuing specific TMs, assigned with their unique identifiers. + - |spid-icon| |cieid-icon| + +.. seealso:: + + - :ref:`Non-normative example of EC of a TA` diff --git a/en/_sources/entity_statement.rst.txt b/en/_sources/entity_statement.rst.txt new file mode 100644 index 00000000..8ad31ccf --- /dev/null +++ b/en/_sources/entity_statement.rst.txt @@ -0,0 +1,307 @@ +.. include:: ../common/common_definitions.rst + +.. _Entity_Statement: + +Entity Statements +----------------- + +The basic component for building a Trust Chain is the **Entity Statement (ES)**, a signed JWT that +contains the Federation public keys of a subordinate Entity (subject) and further data used to control the +process of Trust Chain resolution. + +An Entity publishes an **ES** related to a subordinate, at its :ref:`Fetch Endpoint`. +The superior Entity MAY define the Metadata policy for a subject and publishes the TMs that it has issued for it. + + +Entity Statement Signature +++++++++++++++++++++++++++ + +The same considerations made for the **ECs** and reported in the section :ref:`Firma della Entity Configuration`, apply. + + +Entity Statement +++++++++++++++++ + +The ES issued by the TA or by an Intermediate for its own direct subordinates, MUST contain the following attributes: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **iss** + - See `OIDC-FED`_ Section 3.1 for further details. + - |spid-icon| |cieid-icon| + * - **sub** + - See `OIDC-FED`_ Section 3.1 for further details. + - |spid-icon| |cieid-icon| + * - **iat** + - See `OIDC-FED`_ Section 3.1 for further details. + - |spid-icon| |cieid-icon| + * - **exp** + - See `OIDC-FED`_ Section 3.1 for further details. + - |spid-icon| |cieid-icon| + * - **jwks** + - Federation JWKS of the *sub* entity. See `OIDC-FED`_ Section 3.1 for further details. + - |spid-icon| |cieid-icon| + * - **metadata_policy** + - JSON Object that describes the Metadata policy. Each key of the JSON Object represents an + identifier of the type of Metadata and each value MUST be a JSON Object that represents the Metadata + policy according to that Metadata type. Please refer to the `OIDC-FED`_ specifications, Section-5.1, + for the implementation details. + - |spid-icon| |cieid-icon| + * - **trust_marks** + - JSON Array containing the Trust Marks issued by itself for the subordinate subject. + - |spid-icon| |cieid-icon| + * - **constraints** + - It MAY contain the **allowed_leaf_entity_types**, that restricts what types of metadata a subject is allowed to publish. + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - `OIDC-FED#Section_3.1`_ + - :ref:`Non-normative example of Entity Statement` + + +.. _Metadata_Policy: + +Metadata Policy ++++++++++++++++ + +Trust Anchors and Intermediates (SAs) MUST publish a policy regarding their respective descendants in the Entity Statement referring to them. The Metadata Policy MUST cascade to all descendants. + +TA Metadata Policy for RP +^^^^^^^^^^^^^^^^^^^^^^^^^ + +The following claims MUST be considered in the *metadata* parameter of type *openid_realying_party* within the policy that the TA establishes for an RP. + + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operations** / **Values** + - **Supported by** + * - **jwks** + - Operations: *subset_of* |br| + Values: MUST contain the RP JWKS related to the OIDC Core operations. + - |spid-icon| |cieid-icon| + * - **grant_types** + - Operations: *subset_of* |br| + Values: MUST be *authorization_code*, *refresh_token* + - |spid-icon| |cieid-icon| + * - **id_token_signed_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **id_token_encrypted_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |cieid-icon| + * - **id_token_encrypted_response_enc** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |cieid-icon| + * - **userinfo_signed_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_enc** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_method** + - Operations: *one_of* |br| + Values: MUST be *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **client_registration_types** + - Operations: *one_of* |br| + Values: MUST be *automatic* + - |spid-icon| |cieid-icon| + + +TA Metadata Policy for SA +^^^^^^^^^^^^^^^^^^^^^^^^^ + +The following claims MUST be considered in the *metadata* parameter of type *openid_relying_party* within the policy that the TA establishes for a SA. This policy MUST be cascaded to the metadata of the direct descendant (RP aggregate) of the SA. + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operations** / **Values** + - **Supported by** + * - **grant_types** + - Operations: *subset_of* |br| + Values: MUST be *authorization_code*, *refresh_token* + - |spid-icon| |cieid-icon| + * - **id_token_signed_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **id_token_encrypted_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |cieid-icon| + * - **id_token_encrypted_response_enc** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |cieid-icon| + * - **userinfo_signed_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_alg** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_enc** + - Operations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_method** + - Operations: *one_of* |br| + Values: MUST be *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **client_registration_types** + - Operations: *one_of* |br| + Values: MUST be *automatic* + - |spid-icon| |cieid-icon| + +SA Metadata Policy for RP +^^^^^^^^^^^^^^^^^^^^^^^^^ + +The following claims MUST be considered in the *metadata* parameter of type *openid_relying_party* within the policy that the SA establishes for an RP its direct descendant (Aggregate). + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operations** / **Values** + - **Supported by** + * - **jwks** + - Operations: *subset_of* |br| + Values: MUST contain the RP JWKS related to the OIDC Core Operations + - |spid-icon| |cieid-icon| + + +TA Metadata Policy for OP +^^^^^^^^^^^^^^^^^^^^^^^^^ + +Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro *metadata* di tipo *openid_provider* all'interno della policy che il TA stabilisce per un RP suo discendente diretto. + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operarations** / **Values** + - **Supportato da** + * - **jwks** + - Operarations: *subset_of* |br| + Values: DEVE contenere i JWKS del OP relativi alle Operarations di Core + - |spid-icon| |cieid-icon| + * - **revocation_endpoint_auth_methods_supported** + - Operarations: *one_of* |br| + Values: MUST be *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **code_challenge_methods_supported** + - Operarations: *subset_of* |br| + Values: MUST be *S256* + - |spid-icon| |cieid-icon| + * - **scopes_supported** + - Operarations: *subset_of* |br| + Values: MUST contain *openid*, *offline_access*. CIE id MAY also contain *profile*, *email*. + - |spid-icon| |cieid-icon| + * - **response_types_supported** + - Operarations: *one_of* |br| + Values: MUST be *code*. + - |spid-icon| |cieid-icon| + * - **response_modes_supported** + - Operarations: *subset_of* |br| + Values: MUST be *form_post*, *query*. + - |spid-icon| |cieid-icon| + * - **grant_types_supported** + - Operarations: *subset_of* |br| + Values: MUST be *refresh_token*, *authorization_code*. + - |spid-icon| |cieid-icon| + * - **acr_values_supported** + - Operarations: *subset_of* |br| + Values: MUST be |br| *https://www.spid.gov.it/SpidL1*, |br| *https://www.spid.gov.it/SpidL2*, |br| *https://www.spid.gov.it/SpidL3*. + - |spid-icon| |cieid-icon| + * - **subject_types_supported** + - Operarations: *one_of* |br| + Values: MUST be *pairwise*. + - |spid-icon| |cieid-icon| + * - **id_token_signing_alg_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **id_token_encryption_alg_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **id_token_encryption_enc_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_signing_alg_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_alg_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_enc_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_methods_supported** + - Operarations: *one_of* |br| + Values: MUST be *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_signing_alg_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + * - **claims_parameter_supported** + - Operarations: *one_of* |br| + Values: MUST be *true* + - |spid-icon| |cieid-icon| + * - **request_parameter_supported** + - Operarations: *one_of* |br| + Values: MUST be *true* + - |spid-icon| |cieid-icon| + * - **authorization_response_iss_parameter_supported** + - Operarations: *one_of* |br| + Values: MUST be *true* + - |spid-icon| |cieid-icon| + * - **client_registration_types_supported** + - Operarations: *one_of* |br| + Values: MUST be *automatic* + - |spid-icon| |cieid-icon| + * - **request_authentication_methods_supported** + - Operarations: *one_of* |br| + Values: MUST be *request_object* + - |spid-icon| |cieid-icon| + * - **request_authentication_signing_alg_values_supported** + - Operarations: *subset_of* |br| + Values: MUST contain the algorithms defined in the Section :ref:`Cryptographic Algorithms ` + - |spid-icon| |cieid-icon| + +.. seealso:: + + - :ref:`Non-normative examples of Metadata Policy` + diff --git a/en/_sources/errors_federation.rst.txt b/en/_sources/errors_federation.rst.txt new file mode 100644 index 00000000..69a27955 --- /dev/null +++ b/en/_sources/errors_federation.rst.txt @@ -0,0 +1,61 @@ +.. include:: ../common/common_definitions.rst + +.. _errors_federation: + +Federation error management ++++++++++++++++++++++++++++ + +In case of errors during Federation operations, entities MUST give anomaly messages as following. + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **error** + - See :ref:`Federation error codes ` + - |spid-icon| |cieid-icon| + * - **error_description** + - Error description. + - |spid-icon| |cieid-icon| + + +.. _codici_errore_federation: + +Federation error codes +^^^^^^^^^^^^^^^^^^^^^^ + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Erro** + - **Description** + - **HTTP Code** + - **Supported by** + * - *temporarily_unavailable* + - well-known or Federation endpoint is unreachable. + - *302 Found*/*400 Bad Request* + - |spid-icon| |cieid-icon| + * - *invalid_client* + - The Trust Chain validation fails and the Client is not authorized. + - *302 Found* + - |spid-icon| |cieid-icon| + * - *unauthorized_client* + - Applying the metadata policy results in a metadata not compliant or no valid Trust Mark for the requested profile is present within the configuration. + - *302 Found* + - |spid-icon| |cieid-icon| + * - *invalid_request* + - The request is incomplete or does not comply with current specifications. + - *400 Bad Request* + - |spid-icon| |cieid-icon| + * - *not_found* + - The required resource is not found. + - *404 Not Found* + - |spid-icon| |cieid-icon| + + + diff --git a/en/_sources/esempi.rst.txt b/en/_sources/esempi.rst.txt new file mode 100644 index 00000000..f546c633 --- /dev/null +++ b/en/_sources/esempi.rst.txt @@ -0,0 +1,10 @@ +.. include:: ../common/common_definitions.rst + +Examples +======== + +This section gathers all the non-normative examples of the requests and responses to the Federation's endpoints, that are defined in this document. + +All the responses of type jose have been decoded and represented with their headings, for the sake of reading. + +.. include:: ../common/common_examples.rst diff --git a/en/_sources/federation_endpoint.rst.txt b/en/_sources/federation_endpoint.rst.txt new file mode 100644 index 00000000..0f461e84 --- /dev/null +++ b/en/_sources/federation_endpoint.rst.txt @@ -0,0 +1,31 @@ +.. include:: ../common/common_definitions.rst + +.. _federation_endpoint: + +Federation Endpoints +-------------------- + +All the Entities MUST contain the following endpoints: + + - **/.well-known/openid-federation**: gives the `Entity Configuration `__ (for + more details, see `OIDC-FED`_ Section 6) + - **resolve Entity statement endpoint**: gives the final Metadata, the Trust Chain and the Trust Marks + regarding another subject. For more details, see `OIDC-FED`_ Section 7.2). + +.. warning:: + + - the resolve endpoint MUST NOT return TMs which are not valid at the time of the request; + - the resolve endpoint MUST return the serialized Trust Chain for the subject. + + +In addition to the Federation endpoints reported before, the Entities of type **TA** or **SA** MUST provide the following endpoints: + + + - **fetch Entity statement endpoint**: returns the ESs regarding a direct subordinate subject. + For obtaining the ES of an Entity, at least its Entity identifier is needed. (For more details, see `OIDC-FED`_ Section 7.1). + - **trust mark status endpoint**: allows an Entity to test if a TM is still active or not. The request MUST + be sent to the subject that has released that TM. (For more details, see `OIDC-FED`_ Section 7.4). + - **Entity listing endpoint**: returns the list of the subordinate Entities registered by the TA or an SA. + (For more details, see `OIDC-FED`_ Section 7.3). + +An Entity of type **AA**, in addition to the common Federation endpoints like all the Entities, MUST also include the **trust mark status endpoint** for allowing the dynamic validation of the TMs, released by the AA. diff --git a/en/_sources/flusso_autenticazione.rst.txt b/en/_sources/flusso_autenticazione.rst.txt new file mode 100644 index 00000000..6f02304c --- /dev/null +++ b/en/_sources/flusso_autenticazione.rst.txt @@ -0,0 +1,37 @@ +.. include:: ../common/common_definitions.rst + +.. _flusso_autenticazione: + +Authentication Flow +------------------- + +The authentication schemas **"Entra con SPID"** and **"Entra con CIE"** implement the **OpenID Connect Authorization Code Flow** with the **PKCE** (Proof Key for Code Exchange, :rfc:`7636`). +This flow returns an **Authorization Code** that can be used to get an **ID Token**, an **Access Token** +and possibly a **Refresh Token** too. +The **Authorization Code Flow** gets the **Authorization Code** from the *Authorization Endpoint* of the OpenID Provider and all the tokens are returned by the **Token Endpoint**. + +.. image:: ../../images/flusso.svg + :width: 100% + + +In the following, the descriptions of the flow steps, with the numbers indicated in the picture. + + #. The User, in the access page of the Relying Party (RP): + + * Clicks on the button "Enter with SPID" or "Enter with CIE"; + + * In the SPID case, choses the authentication OP. + + #. The RP prepares an Authorization Request and sends it to the *Authorization Endpoint* of the OP. + + #. The OP authenticates the user and received the user's consent to release his attributes to the RP. + + #. The OP redirects the user to the URL contained in the parameter *redirect_uri* specified by the RP, passing an *Authorization Code* in the Authorization Response. + + #. The RP sends the *Authorization Code* received at the OP *Token Endpoint*. + + #. The OP *Token Endpoint* releases an **ID Token**, an **Access Token** and, if expected, a **Refresh Token**. + + #. The RP receives and validates the **Access Token** and the **ID Token**. Then requests the user's attributes to the OP *UserInfo Endpoint* and uses, for the authentication, the **Access Token** contained in the HTTP Authorization header. + + #. The OP *UserInfo Endpoint* checks the **Access Token** validity and releases the required attributes to the RP. diff --git a/en/_sources/index.rst.txt b/en/_sources/index.rst.txt new file mode 100644 index 00000000..723f511e --- /dev/null +++ b/en/_sources/index.rst.txt @@ -0,0 +1,53 @@ +======================= +SPID/CIE OpenID Connect +======================= + +`SPID `_ and `CIE id `_ are the Italian Systems of Public Digital Identity. They adopt the standards `OpenID Connect Core `_, `International Government Assurance Profile (iGov) for OpenID Connect 1.0 `_ and `OpenID Connect Federation 1.0 `_. + +Thanks to the `digital identity `_ the public and private services provides the keys to access the online services through unique access credentials. + +This documentation contains the consolidated technical specifications, compliant to the national guidelines, to improve the experience of integration in the OIDC SPID and CIE id Federations, for the public and private Service Providers (RP), Identity Providers (OP) and Intermediate Entities (SA). + +In this documentation you can find: + + - Practical examples of Metadata, OpenID Connect requests and responses. + - How to perform and automatic registration of the RPs to the OpenID Providers. + - How an OpenID Provider recognizes and dynamically registers an RP. + - How to use the endpoints of the Federation APIs. + - How to authenticate a user to SPID and CIE id. + + +Index of content +---------------- + +.. toctree:: + :maxdepth: 2 + + standards.rst + termini_acronimi.rst + la_federazione_delle_identita.rst + entity_configuration.rst + entity_statement.rst + trust_marks.rst + soggetti_aggregatori.rst + trust_negotiation.rst + federation_endpoint.rst + errors_federation.rst + metadata_oidc.rst + flusso_autenticazione.rst + authorization_endpoint.rst + token_endpoint.rst + userinfo_endpoint.rst + attributi_utente.rst + introspection_endpoint.rst + revocation_endpoint.rst + logout.rst + cryptographic_algos.rst + log_management.rst + differenze_spid_cie.rst + confronto_oidc_cie_e_oidc_igov.rst + differenze_oidc_fed.rst + seccons_bcps.rst + esempi.rst + diventa_fornitore.rst + come_contribuire.rst diff --git a/en/_sources/introspection_endpoint.rst.txt b/en/_sources/introspection_endpoint.rst.txt new file mode 100644 index 00000000..a069aabe --- /dev/null +++ b/en/_sources/introspection_endpoint.rst.txt @@ -0,0 +1,114 @@ +.. include:: ../common/common_definitions.rst + +Introspection Endpoint +---------------------- + +The Introspection Endpoint exposed by the OP, allows the RPs to obtain information +about a token in their possession, as for example its validity. + +.. seealso:: + + - https://tools.ietf.org/html/rfc7662 + - https://openid.net/specs/openid-igov-oauth2-1_0-03.html#Section-3.2.2 + +Request ++++++++ + +The request to the Introspection Endpoint contains the token, +together with a Client Assertion that allows authenticating the RP that makes the request. + + +**Example:** + +.. code-block:: http + + POST /introspection HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88… + & + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + client_id=https%3A%2F%2Frp.spid.agid.gov.it& + token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT + QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8 + iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4 + MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA + RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw + RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9 + h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w… + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **client_assertion** + - JWT signed with the Relying Party's private key, containing the same parameters as documented + for the requests to the Token Endpoint. The OP must test the validity of all the fields that + are present in the JWT, plus the validity of its signature, + with respect to the parameter **client_id**. + - |spid-icon| |cieid-icon| + * - **client_assertion_type** + - String. Allowed values: **urn:ietf:params:oauth:clientassertion-type:jwt-bearer** + - |spid-icon| |cieid-icon| + * - **client_id** + - URI that unquely identifies the RP. The OP must check that the client_id is known inside the + Federation. + - |spid-icon| |cieid-icon| + * - **token** + - The token about which the RP wants to obtain information. + - |spid-icon| |cieid-icon| + + +Response +++++++++ + +The Introspection Endpoint responds with a JSON Object defined as follows. + +**Example:** + +.. code-block:: json + + { + "active":true + } + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **active** + - Boolean value that indicates the token validity. If the token is expired, it has been revoked or it + has never been issued for the calling client_id, the Introspection Endpoint must return false. + - |spid-icon| |cieid-icon| + * - **scope** + - List of scopes required in the Authorization Request. + - |spid-icon| + * - **exp** + - Token expiration. + - |spid-icon| + * - **sub** + - Subject identifier. The same released in the ID Token. The RP MUST verify that the value is the same contained in the ID Token. + - |spid-icon| + * - **client_id** + - URI of the RP registered in the federation. The RP MUST verify that the value is the same of the own client_id. + - |spid-icon| + * - **iss** + - OP identified registered in the federation in Uniform Resource Locator (URL) format. The RP MUST verify that the value is the same of the OP queried. + - |spid-icon| + * - **aud** + - RP client ID. The RP MUST verify that the value is the same of the own client ID. + - |spid-icon| + +Error Codes ++++++++++++ + +As defined for :ref:`Token endpoint`. diff --git a/en/_sources/la_federazione_delle_identita.rst.txt b/en/_sources/la_federazione_delle_identita.rst.txt new file mode 100644 index 00000000..ec2342b1 --- /dev/null +++ b/en/_sources/la_federazione_delle_identita.rst.txt @@ -0,0 +1,78 @@ +.. include:: ../common/common_definitions.rst + +The Italian eID Federations +--------------------------- + +A Digital Identity Federation is an infrastructure inside which many organizations, with different domains, +participate in the same regulatory framework for building a mechanism of trust, both administrative, by +stipulating conventions and getting accreditation by one or more authorities and technological by +adopting standards of interoperability. + +This configuration establishes the levels of assurance and security that are appropriate for the +citizens in order to authenticate on a web service (Service Provider) using their own digital identity, released +by another web service (Identity Provider). + +The participants (RP or OP) who are recognized inside the same Federation, obtain Metadata from each +other. The Metadata contains the public keys for the operations of digital signature and encryption, +and the information needed for the data interchange. + +The Metadata are certified by a trusted party who is AgID in the SPID Federation and the Ministry of Interior in the CIE Federation. They both correspond to the Federation Authorities. + +Both SPID and CIE id implement OpenID Connect Federation 1.0 and extend some functionalities, achieving +a solid implementation and producing the good practices for its adoption. For more details about the +standard please refer to the official specifications `OIDC-FED`_ and the section :ref:`Differences with OIDC Federation 1.0`. + + +OpenID Connect Federation ++++++++++++++++++++++++++ + +The OIDC Federation produces an infrastructure of trust that is: + + - **Dynamic**. The trust may be dynamically established during the first authentication request. + The Federation Authorities expose an endpoint that supplies signed statements about the subordinate + Entities. These statements contain the public keys of the subordinate Entities and the Metadata policy. + The Federation Authorities can disable an Entity in the Federation at every moment, simply by + stopping supplying statements about it. + - **Scalable**. It reduces significantly the onboarding costs, according to the delegation principle, with + the institution of Intermediate Entities (SA). + - **Transparent**. Any Entity involved in the Federation can always build the trust towards an Entity + securely. Furthermore, the federation composition, in all its parts, becomes navigable in real time + through the Federation API. + +.. image:: ../../images/spid_cie_oidc_federation_model.svg + :width: 100% + +*At the base of the trees there are the Federation Authorities of SPID and CIE id and, going up, the OPs that have no Intermediates, the RPs and the +Intermediates that, in turn, aggregate other RPs.* + +Configuration of the Federation ++++++++++++++++++++++++++++++++ + +The configuration of the Federation is published by the Trust Anchor inside its :ref:`Entity Configuration`, available at a well known web path and corresponding to a +**.well-known/openid-federation**. + +All the members MUST obtain the Federation configuration before the operational phase and they +MUST keep it up-to-date on a daily basis. The Federation configuration contains the Trust Anchor +public keys for the signature operations, the maximum number of Intermediates allowed between a Leaf and the Trust Anchor (**max_path length**) and the authorities who are enabled to issue the Trust Marks (**trust_marks_issuers**). + +Here a non-normative example of :ref:`Entity Configuration response Trust Anchor`. + +For further details, please read the section about the :ref:`Entity Configuration`. + +How to participate +++++++++++++++++++ + +The participant MUST publish its configuration +(Entity Configuration) at the webpath :ref:`.well-known/openid-federation`. + +The technical and administrative representatives complete the onboarding procedure, +defined by the Federation Authority or by an Intermediate (SA), +in order to register a new Entity or for updating a preexisting one. + +The Federation Authority or an Intermediate, after doing all the required technical and administrative controls, registers the public keys of the onboarded Entity and releases a proof of Federation membership, +in the form of Trust Mark (TM). + +The Leaf MUST include the TM inside its own Federation configuration (Entity Configuration) as proof of +success in the Onboarding process. + +The Federation Authority or an Intermediate MUST publish the Leaf Entity Statement containing the Federation public keys of the onboarded Entity and the TMs released for it. diff --git a/en/_sources/log_management.rst.txt b/en/_sources/log_management.rst.txt new file mode 100644 index 00000000..b833610c --- /dev/null +++ b/en/_sources/log_management.rst.txt @@ -0,0 +1,54 @@ +.. include:: ../common/common_definitions.rst + +.. _Log_Management: + +Retention Policy +================ + +Log management of a OP and an RP +-------------------------------- + +OPs and RPs MUST retain the following. + +1. A transaction log containing the exchanged messages. The messages stored in the log MUST be at least the following: + + - **Trust Chain** related to the Entity which messages are being exchanged with, composed as follows: + + 1. The **Entity Configuration** of the Entity which messages are being exchanged with. + 2. [Only for OP] The **Entity Statement** of the SA referring to the RP, if any. + 3. The **Entity Statement** of the TA referring to the descendant Entity. + 4. The **Entity Configuration** of the TA. + + - **AuthenticationRequest** + - **AuthenticationResponse** related to the *AuthenticationRequest**. + - **TokenRequest** related to the *AuthenticationRequest*. + - **TokenResponse** related to the *TokenRequest*. + - The **UserInfoRequest** related to the *TokenRequest*, if any. + - The **UserInfoResponse** related to the *UserInfoRequest*, if any. + - **RevocationRequest** related to the *TokenRequest*, if any. + - The **RevocationResponse** related to the *RevocationRequest*, if any. + +.. admonition:: |spid-icon| + + For each message, where applicable, the following information could be indexed for research and consultation purposes: + + - authorization code + - client_id + - jti + - iss + - sub + - iat + - exp + +.. warning:: + The information stored in the logs MUST be retained and managed for not less than 24 months in full compliance with national and european privacy regulations. Access to the data MUST be restricted to designated personnel. In order to ensure confidentiality data encryption mechanisms or employed database systems (DBMS) that realize encrypted persistence of information MUST be adopted. Integrity e non-repudiation properties MUST be ensured. + + +Federation Historical Key registry +---------------------------------- + +In order to enable the verification of messages exchanged by Entities participating in the federation and their Trust Chains, the TA MUST publish its federation public key history (JWKS) within a registry made available to all participants via the */.well-known/openid-federation-historical-jwks* endpoint. For further technical details, please refer to Section 7.5 of `OIDC-FED`_. + +.. warning:: + Keys that have not been active more than 24 months MAY be removed from the registry at the TA's convenience. + diff --git a/en/_sources/logout.rst.txt b/en/_sources/logout.rst.txt new file mode 100644 index 00000000..eb1a0072 --- /dev/null +++ b/en/_sources/logout.rst.txt @@ -0,0 +1,13 @@ +.. include:: ../common/common_definitions.rst + +Logout +------ + +.. admonition:: |cieid-icon| + + RPs MAY establish individual sessions related to authenticated users. In cases where such individual sessions are instaurated by the RPs, the RPs MUST provide users with a logout functionality for the purpose of deleting the established individual session. + During the logout phase the RPs MUST revoke all the Access Tokens still active and related to user authentication, through the use of the revocation endpoint ( :ref:`Revocation Endpoint ` ). + + .. note:: + In case an *offline_access* mechanism via *Refresh Token* is supported by the OP, the latter MUST NOT be revoked following a logout. + diff --git a/en/_sources/metadata_aa.rst.txt b/en/_sources/metadata_aa.rst.txt new file mode 100644 index 00000000..8c2eb3d1 --- /dev/null +++ b/en/_sources/metadata_aa.rst.txt @@ -0,0 +1,116 @@ +.. include:: ../common/common_definitions.rst + + +Attribute Authority Metadata +++++++++++++++++++++++++++++ + +An AA MUST publish in its EC a *federation_entity* Metadata and an *oauth_resource* Metadata, if the resources are protected it MUST also publish an *oauth_authorization_server* Metadata. + + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + }, + "oauth_authorization_server":{ + ... + }, + "oauth_resource":{ + ... + } + } + } + +The AA Metadata of type **"federation_entity"** MUST contain at least the following mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **organization_name** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **policy_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL of the entity's logo; it MUST be in SVG format. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **contacts** + - Institutional certified email address (PEC) of the entity. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_trust_mark_status_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.8. + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.8. + - |spid-icon| |cieid-icon| + +The AA Metadata with **"oauth_authorization_server"** MUST contain at least the following mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **issuer** + - See :rfc:`8414#page-4`. It MUST contain an HTTPS URL that uniquely identifies the AA. + - |spid-icon| |cieid-icon| + * - **authorization_endpoint** + - Only for Attribute Authority private flow. See `LG-AA` and :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **token_endpoint** + - See :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **jwks** + - See `JWK`_. + - |spid-icon| |cieid-icon| + * - **scopes_supported** + - See :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **response_types_supported** + - See :rfc:`8414#page-4`, + - |spid-icon| |cieid-icon| + * - **grant_types_supported** + - See :rfc:`8414#page-4` and :rfc:`8623`. + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_methods_supported** + - See :rfc:`8414#page-4`. The supported value is **private_key_jwt**. + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_signing_alg_values_supported** + - See :rfc:`8414#page-4`. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **op_policy_uri** + - See :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **op_tos_uri** + - See :rfc:`8414#page-6`. + - |spid-icon| |cieid-icon| + * - **dpop_signing_alg_values_supported** + - See `OAuth-DPoP`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + + + +The AA Metadata of type **"oauth_resource"** MUST contain at least the following mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **resource** + - See `OAuth-RS`_. One or more HTTPS URLs that identify the endpoints of the protected resources. + - |spid-icon| |cieid-icon| diff --git a/en/_sources/metadata_oidc.rst.txt b/en/_sources/metadata_oidc.rst.txt new file mode 100644 index 00000000..50e5eaca --- /dev/null +++ b/en/_sources/metadata_oidc.rst.txt @@ -0,0 +1,23 @@ +.. include:: ../common/common_definitions.rst + +.. _metadata_oidc: + +Metadata +-------- + +OIDC-FED uses and extends the Metadata claims as defined in the specifications OpenID Connect Discovery 1.0 (`OpenID.Discovery`_) and OpenID Connect Dynamic Client Registration 1.0 (`OpenID.Registration`_), respectively for OP and RP. + +In OIDC-FED the OIDC Metadata regarding an RP or OP is defined inside the claim **metadata** and its sub-claim +****, inside the Entity Configuration, as a JSON Object. + + +.. toctree:: + :maxdepth: 1 + + metadata_oidc_op.rst + metadata_oidc_rp.rst + metadata_oidc_ta_sa.rst + metadata_aa.rst + + + diff --git a/en/_sources/metadata_oidc_op.rst.txt b/en/_sources/metadata_oidc_op.rst.txt new file mode 100644 index 00000000..39718a6c --- /dev/null +++ b/en/_sources/metadata_oidc_op.rst.txt @@ -0,0 +1,176 @@ +.. include:: ../common/common_definitions.rst + +.. _MetadataOP: + +OpenID Connect Provider Metadata (OP) ++++++++++++++++++++++++++++++++++++++ + +An OP MUST publish in its EC a Metadata of type *federation_entity* and a Metadata of type *openid_provider*, as +reported in the following example: + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + } + "openid_provider":{ + ... + } + } + } + +The EC of an OP MUST configure a Metadata of type **"federation_entity"** and contain at least the following +mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **organization_name** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **policy_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL of the entity's logo; it MUST be in SVG format. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **contacts** + - Institutional certified email address (PEC) of the entity. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.6. + - |spid-icon| |cieid-icon| + + +The EC of an OP MUST configure a metadata of type **"openid_provider"**, that MUST contain at least the following mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **issuer** + - See `OpenID.Discovery#OP_Metadata`_. It MUST contain an HTTPS URL that uniquely identifies the OP. + - |spid-icon| |cieid-icon| + * - **authorization_endpoint** + - See `OpenID.Discovery#OP_Metadata`_. + - |spid-icon| |cieid-icon| + * - **token_endpoint** + - See `OpenID.Discovery#OP_Metadata`_. + - |spid-icon| |cieid-icon| + * - **userinfo_endpoint** + - See `OpenID.Discovery#OP_Metadata`_. + - |spid-icon| |cieid-icon| + * - **introspection_endpoint** + - See :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **revocation_endpoint** + - See :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **revocation_endpoint_auth_methods_supported** + - See :rfc:`8414#page-4`. The supported value is **private_key_jwt** + - |cieid-icon| + * - **code_challenge_methods_supported** + - See :rfc:`8414#page-4`. The OP MUST support S256 (see :rfc:`7636#section-4.3`). + - |spid-icon| |cieid-icon| + * - **scopes_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported values are **openid** and **offline_access**. CIE id supports also **profile**, **email**. For more details, see the section :ref:`User's Claims `. + - |spid-icon| |cieid-icon| + * - **response_types_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported value is **code**. + - |spid-icon| |cieid-icon| + * - **response_modes_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported values are **form_post** and **query**. + - |spid-icon| |cieid-icon| + * - **grant_types_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported values are **refresh_token** and **authorization_code**. + - |spid-icon| |cieid-icon| + * - **acr_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported values are: + + ``https://www.spid.gov.it/SpidL1`` + ``https://www.spid.gov.it/SpidL2`` + ``https://www.spid.gov.it/SpidL3`` + + - |spid-icon| |cieid-icon| + * - **subject_types_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported value is **pairwise**. + - |spid-icon| |cieid-icon| + * - **id_token_signing_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **id_token_encryption_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See key encryption :ref:`supported_algs`. + - |cieid-icon| + * - **id_token_encryption_enc_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See content encryption :ref:`supported_algs`. + - |cieid-icon| + * - **userinfo_signing_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See key encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_enc_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See content encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **request_object_signing_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| +.. * - **request_object_encryption_alg_values_supported** +.. - Until otherwise indicated by AgID, this MUST NOT be included. +.. - |spid-icon| +.. * - **request_object_encryption_enc_values_supported** +.. - Until otherwise indicated by AgID, this MUST NOT be included. +.. - |spid-icon| + * - **token_endpoint_auth_methods_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported value is **private_key_jwt** + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_signing_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **claims_supported** + - See `OpenID.Discovery#OP_Metadata`_. See :ref:`User Claims ` for more details. + - |spid-icon| |cieid-icon| + * - **claims_parameter_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported value is **true**. + - |spid-icon| |cieid-icon| + * - **request_parameter_supported** + - See `OpenID.Discovery#OP_Metadata`_. The supported value is **true**. + - |spid-icon| |cieid-icon| + * - **authorization_response_iss_parameter_supported** + - See :rfc:`9207#section-3`. It must contain *true*. + - |cieid-icon| + * - **jwks** + - See `OIDC-FED`_ Section 4.2 and `JWK`_. + - |spid-icon| |cieid-icon| + * - **client_registration_types_supported** + - See `OIDC-FED`_ Section 4.2. The supported value is **automatic**. + - |spid-icon| |cieid-icon| + * - **request_authentication_methods_supported** + - See `OIDC-FED`_ Section 4.2`_. The supported value is **request_object**. + - |spid-icon| |cieid-icon| + * - **request_authentication_signing_alg_values_supported** + - See `OIDC-FED`_ Section 4.2. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + + +.. warning:: + The OP Metadata of type **"openid_provider"** exposes the claim **jwks** as regulated by OID-FED instead of + the claim **jwks_uri** as required at `OpenID.Discovery#OP_Metadata`_. + +.. seealso:: + + - :ref:`Example of an EC of an OP ` + diff --git a/en/_sources/metadata_oidc_rp.rst.txt b/en/_sources/metadata_oidc_rp.rst.txt new file mode 100644 index 00000000..55212cc8 --- /dev/null +++ b/en/_sources/metadata_oidc_rp.rst.txt @@ -0,0 +1,105 @@ +.. include:: ../common/common_definitions.rst + +.. _MetadataRP: + +OpenID Connect Relying Party Metadata (RP) +++++++++++++++++++++++++++++++++++++++++++ + +An RP MUST publish in its EC a Metadata of type *federation_entity* and a Metadata of type *openid_relying_party*, as reported in the following example: + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + } + "openid_relying_party":{ + ... + } + } + } + +The OP Metadata of type **"federation_entity"** MUST contain at least the following mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **organization_name** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **policy_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL of the entity's logo; it MUST be in SVG format. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **contacts** + - Institutional certified email address (PEC) of the entity. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.6. + - |spid-icon| |cieid-icon| + + + +The RP Metadata of type **"openid_relying_party"** MUST contain at least the following mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by*** + * - **redirect_uris** + - See `OpenID.Registration#ClientMetadata`_. It is mandatory using an HTTPS schema in case of a web-based client. + - |spid-icon| |cieid-icon| + * - **grant_types** + - See `OpenID.Registration#ClientMetadata`_. The supported values are **authorization_code** and **refresh_token**. + - |spid-icon| |cieid-icon| + * - **jwks** + - See `OpenID.Registration#ClientMetadata`_ and `JWK`_. + - |spid-icon| |cieid-icon| + * - **id_token_signed_response_alg** + - See `OpenID.Registration#ClientMetadata`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **id_token_encrypted_response_alg** + - See `OpenID.Registration#ClientMetadata`_. See key encryption :ref:`supported_algs`. + - |cieid-icon| + * - **id_token_encrypted_response_enc** + - See `OpenID.Registration#ClientMetadata`_. This content encryption is required only if the *id_token_encrypted_response_alg* is given. See key encryption :ref:`supported_algs`. + - |cieid-icon| + * - **userinfo_signed_response_alg** + - See `OpenID.Registration#ClientMetadata`_. See signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_alg** + - See `OpenID.Registration#ClientMetadata`_. See key encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_enc** + - See `OpenID.Registration#ClientMetadata`_. See content encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_method** + - See `OpenID.Registration#ClientMetadata`_. The required value is **private_key_jwt**. + - |spid-icon| |cieid-icon| + * - **client_id** + - See `OpenID.Registration`_. It MUST contain an HTTPS URL that uniquely identifies the RP. + - |spid-icon| |cieid-icon| + * - **client_registration_types** + - See `OIDC-FED`_ Section 4.1. The required value is **automatic**. + - |spid-icon| |cieid-icon| + * - **response_types** + - JSON array containing a list of the OAuth 2.0 response_type values that the RP is declaring that it will restrict itself to using. It MUST contain the value **code**. + - |spid-icon| |cieid-icon| + +.. note:: + The URIs contained in the claim **redirect_uris** MAY also use custom schemas (e.g. myapp://) + in order to support mobile applications. + diff --git a/en/_sources/metadata_oidc_ta_sa.rst.txt b/en/_sources/metadata_oidc_ta_sa.rst.txt new file mode 100644 index 00000000..8ecff737 --- /dev/null +++ b/en/_sources/metadata_oidc_ta_sa.rst.txt @@ -0,0 +1,62 @@ +.. include:: ../common/common_definitions.rst + +.. _MetadataTA: + +Trust Anchor (TA) and Intermediate (SA) Metadata +++++++++++++++++++++++++++++++++++++++++++++++++ + +A TA and a SA MUST publish in the EC a Metadata of type *federation_entity*, as reported in the following example: + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + } + } + } + +The EC of a TA and a SA MUST configure a Metadata of type **"federation_entity"** and contain at least the following +mandatory parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **organization_name** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **policy_uri** + - See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL of the entity's logo; it MUST be in SVG format. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **contacts** + - Institutional certified email address (PEC) of the entity. See `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_fetch_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.8. + - |spid-icon| |cieid-icon| + * - **federation_list_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.8. + - |spid-icon| |cieid-icon| + * - **federation_trust_mark_status_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.8. + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - See Section :ref:`Federation Endpoint ` and `OIDC-FED`_ Section 4.8. + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - Example of an EC of a :ref:`TA ` and a SA :ref:`SA ` + diff --git a/en/_sources/revocation_endpoint.rst.txt b/en/_sources/revocation_endpoint.rst.txt new file mode 100644 index 00000000..6e5642d6 --- /dev/null +++ b/en/_sources/revocation_endpoint.rst.txt @@ -0,0 +1,91 @@ +.. include:: ../common/common_definitions.rst + +.. _Revocation_Endpoint: + +Revocation Endpoint +------------------- + +An RP MAY request the revocation of an Access Token or a Refresh Token issued by an OP. + +The OP MUST revoke the token specified in the request. + +.. admonition:: |spid-icon| + + When the user logs out or when his/her session with the RP expires (according to the policies decided by the RP) the RP MUST revoke the Access Token in its possession, if it is not expired yet. + + .. note:: + The Access Token revocation implies revoking all the Refresh Tokens linked to it, if not expired yet. + + The OP MUST revoke the token specified in the request and MUST end the Single Sign-On session, if it is still active. Any other active tokens for the user must be kept valid. + +.. admonition:: |cieid-icon| + + The Access Token revocation MUST NOT imply revoking all the Refresh Tokens linked to it. + + If the token passed to the request is a Refresh Token, the OP MUST revoke the respective Access Token as well, if it is not expired yet. + +.. note:: + The authentication method MUST be **private_key_jwt** (see the *revocation_endpoint_auth_methods_supported* parameter in Section :ref:`Metadata OP `) + +.. seealso:: + + - https://tools.ietf.org/html/rfc7009 + +Request ++++++++ + +The request to the Revocation Endpoint consists of sending the token to be revoked, together with a Client Assertion that allows the identification of the RP that sends the request. + + +**Example:** + +.. code-block:: http + + POST /revoke HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88& + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + client_id=https%3A%2F%2Frp.spid.agid.gov.it& + token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT + QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8 + iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4 + MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA + RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw + RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9 + h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **client_assertion** + - JWT signed with the Relying Party's private key, containing the same parameters included in the Token Endpoint request. The OP must check the validity of all the fields in the JWT, and the validity of its signature, according to the parameter **client_id**. + - |spid-icon| |cieid-icon| + * - **client_assertion_type** + - String. **urn:ietf:params:oauth:clientassertion-type:jwt-bearer** + - |spid-icon| |cieid-icon| + * - **client_id** + - URL HTTPS that uniquely identifies the RP. + - |spid-icon| |cieid-icon| + * - **token** + - The token which the RP is asking to revoke. + - |spid-icon| |cieid-icon| + + +Response +++++++++ + +The Revocation Endpoint answers with a code HTTP 200, also though the indicated token does not exist or has already been revoked (so that non information is going to be released). + + +Error codes ++++++++++++ + +As defined for :ref:`Token endpoint`. diff --git a/en/_sources/seccons_bcps.rst.txt b/en/_sources/seccons_bcps.rst.txt new file mode 100644 index 00000000..7d2e7072 --- /dev/null +++ b/en/_sources/seccons_bcps.rst.txt @@ -0,0 +1,61 @@ +.. include:: ../common/common_definitions.rst + +.. _Considerazioni_di_Sicurezza: + +Security Considerations +----------------------- + +In this section we describe some security considerations in the OIDC Federation scope. + + +Trust Marks as deterrent against abuses ++++++++++++++++++++++++++++++++++++++++ + +The TM implementation and the filter on the TMs in the process of Federation Entity Discovery, turn out to be necessary +against attacks aimed at the resource consumption. If an OP suffers an attack at the *authorization* endpoint and the attack consists of an high number of connections with fake **client_id** and **authority_hints**, then the OP, trying to find a path to the TA for establishing the trust with the requester, would produce several connections to third-party systems. + +The OP MUST statically validate the TM or a-priori exclude the request whenever the TM is not present. +In case the TM is not present or not valid, the procedure of Federation Entity Discovery MUST NOT +be started and consequently MUST NOT create connections to third party systems. + + +Maximum Number of authority_hints ++++++++++++++++++++++++++++++++++ + +Inside a Federation, through the constraint named **max_path_length**, the Trust Anchor decides how many Intermediates are allowed between it and the Leaves. This kind of relationship is vertical, from the Leaf to the root. As an example, if this attribute has the value equal to 1, it means that only one SA is allowed between a Leaf and the TA. + +Every Leaf MUST publish its superiors inside the list contained in the claim **authority_hints**. A Leaf in the Federation MAY have superiors belonging to different Federations. The analysis of the available superiors introduces an horizontal navigation model. As an example, an OP tries to find the shortest path to the Trust Anchor through all the URLs contained in the array **authority_hints**, before doing a further vertical move upwards, to one of the Intermediates that are present in this array. + +The threshold **max_path_length** is applied to the vertical navigation and, after exceeding this threshold without finding a TA, the procedure of Federation Entity Discovery MUST be stopped. Consider the example of an RP that's a subordinate of an SA that's in turn a subordinate of another SA, while the **max_path_length** claim is equal to 1 and, after exceeding this threshold without finding the Trust Anchor, the procedure MUST be stopped. + +At the same time, the specifications of OIDC Federation 1.0 don't define a limit of the number of **authority_hints**, and this is because no TA can limit the number of Federations in which a member can take part. For this reason, it is useful that implementers adopt a maximum limit to the number of elements allowed inside the array authority_hints. The reason is avoiding that an exaggerated number of URLs contained in the list **authority_hints**, due to a bad configuration of a Leaf, produce an excessive resource consumption. + + + +Resolve endpoint +++++++++++++++++ + +This endpoint MUST release the Metadata, the Trust Marks and the previously processed Trust Chain, and MUST +NOT trigger a procedure of Federation Entity Discovery for each request arrival, unless this endpoint is secured with a client authentication mechanism, such as *private_key_jwt* [OIDC-CORE]. When using *private_key_jwt* the value in the *sub* parameter of the *private_key_jwt* MUST match the value *sub* in the request to the Resolve endpoint. + + + +Best Practices +-------------- + +In this section we describe some best practices. + + +Specializing the OpenID Core and Federation public keys ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +It is a best practice to use public keys that are specialized for the two kinds of operations, Core and Federation. + +Upgrading strategy of the OpenID Metadata ++++++++++++++++++++++++++++++++++++++++++ + +The interoperability among members works through the Metadata obtained from the Trust Chain calculation and preservation. This means that if an OP at the time T calculates the Trust Chain for an RP and this, at the time T+n, changes its own Metadata, the OP could consequently run into problems of validating the RP authorization requests, until the OP will have once again updated the RP-related Trust Chain. + +A best practice to avoid service stops on the OIDC Core operations, is adding the new public keys inside the objects *jwks* without removing the previous values. Or, for example, the new *redirect_uri*. + +In this way, after exceeding the maximum duration limit of the Trust Chain, defined in the claim **exp** and published in the TA Entity Configuration, it is certain that all the members have renewed their Trust Chain and it is possible, for the Leaf administrators, to remove the old definitions from the top of the list. diff --git a/en/_sources/soggetti_aggregatori.rst.txt b/en/_sources/soggetti_aggregatori.rst.txt new file mode 100644 index 00000000..26a58178 --- /dev/null +++ b/en/_sources/soggetti_aggregatori.rst.txt @@ -0,0 +1,40 @@ +.. include:: ../common/common_definitions.rst + +.. _Soggetti_aggregatori: + +Intermediate Entities +^^^^^^^^^^^^^^^^^^^^^ + +An Intermediate Entity (SA) can register pre-existing RPs that are compliant to the OIDC-FED standard or mask their subordinates behind it. In the first case, the SA is of type *Transparent* (**Light Aggregator**), and in the second case it is of type *Proxy* (**Full Aggregator**) + +The **Light** SAs register pre-existing RPs that are compliant to OIDC-FED and publishes the ESs referred to them. + +The **Full** SAs arrange building an authentication and federation interface, on behalf of their own subordinates, by using web resources that are usually exposed inside their own domain. This kind of SAs expose for each of their subordinates, the following resources: + + - **.well-known/openid-federation**, containing the Leaf's Entity Configuration; + - Authorization callback endpoint for obtaining the auth code by the OP (**redirect_uri**). + +The **Full** type SAs MUST add at least one of the available identification code in the **id_code** (as defined in the Section :ref:`Trust Mark Composition `) inside the web path, which in turn is inside the client_id that identifies the subordinate Entity ``//``. If more than one identification code is available, the SA MAY include them in the web path as in the following example: ``/ipa_code/aoo_code/``. + +The following table contains some non-normative examples for outlining the differences between the SAs of +types Light and Full: + +.. list-table:: + :widths: 10 50 50 + :header-rows: 1 + + * - + - Mode **Light** + - Mode **Full** + * - **client_id** + - \https://www.rp.it/ + - \https://www.sa.it// + * - **redirect_uri** + - \https://www.rp.it/callback/ + - \https://www.sa.it//callback/ + * - **authz endpoint** + - \https://www.rp.it/authorization/ + - \https://www.sa.it//authorization/ + * - **Entity Configuration** + - \https://www.rp.it/.well-known/openid-federation + - \https://www.sa.it//.well-known/openid-federation diff --git a/en/_sources/standards.rst.txt b/en/_sources/standards.rst.txt new file mode 100644 index 00000000..9a0bcf10 --- /dev/null +++ b/en/_sources/standards.rst.txt @@ -0,0 +1,33 @@ +References +---------- + +.. include:: ../common/standards.rst + + +National and European legislation +---------------------------------- + +.. list-table:: + :widths: 25 75 + :header-rows: 0 + + * - `CAD`_ + - DL 7 March 2005 n.82: "Codice dell'amministrazione digitale." (GU Serie Generale n.112 16-05-2005 - Suppl. Ordinario n. 93) + * - `DL-SEMPLIFICAZIONI`_ + - DL 16 July 2020 n.76: "Misure urgenti per la semplificazione e l'innovazione digitale." (20A04921) (GU Serie Generale n.228 14-09-2020 - Suppl. Ordinario n. 33) and its conversion into Law, with amendments, Law 11 September 2020 n. 120. + * - `EIDAS`_ + - Regulation (Eu) No 910/2014 of the European Parliament and of the Council 23 July 2014 "on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC." + + +.. include:: ../en/avvisi_spid.rst + + +CIE id References ++++++++++++++++++ + +.. list-table:: + :widths: 25 75 + :header-rows: 0 + + * - `DM-CIE`_ + - DM 23 December 2015 n.210: "Modalità tecniche di emissione della Carta d'identità elettronica." (15A09809) (GU Serie Generale n.302 30-12-2015) diff --git a/en/_sources/termini_acronimi.rst.txt b/en/_sources/termini_acronimi.rst.txt new file mode 100644 index 00000000..0e46985d --- /dev/null +++ b/en/_sources/termini_acronimi.rst.txt @@ -0,0 +1,123 @@ +.. include:: ../common/common_definitions.rst + +Terms and Acronyms +------------------ + +Terms ++++++ + +Terms used by `OIDC-FED#Section_1.2`_ and this documentation. + +.. list-table:: + :widths: 15 85 + :header-rows: 0 + + * - **Fedetarion Authority** + - A legal Entity that handles the trust among the parties involved in the Federation, regulates the + funcional aspects and the onboarding procedures. + * - **Trust Anchor** + - Entity handled by the Federation Authority that represents the Federation, its configuration and the trust root. + * - **Intermediate Entity** or **Intermediate** + - An Intermediate Entity (SA), facilitates the onboarding process in the Federation and MAY handle the functionalities on behalf of its subordinate (aggregated) Entities. Inside the Federation, the Intermediate publishes its configuration and the Entity statements of its subordinates, according to the rules defined by Fedetarion Authority. + * - **Leaf Entity** or **Leaf** + - Entity defined by OpenID Connect as Relying Party and OpenID Provider. It could also be an Attribute Authority (OAuth2 Authorization Server and Resource Server). + * - **Entity** + - Participant to the the Federation. It may be a Trust Anchor, Intermediate or Leaf. + * - **Entity Configuration** + - Federation metadata issued by an Entity about itself, in the form of a self-signed JWT :rfc:`7515`. It contains the public Federation's signing keys, the OIDC metadata, the URLs of its superiors authorities and the Trust Marks issued by authorities that are recognizable inside the Federation and that certify the Entity's compliance to specific profiles. + * - **Entity Statement** + - Statement issued by a superior Entity (Trust Anchor or Intermediate) regarding + a subordinate subject (RP, OP or Intermediate), in the form of a signed JWT :rfc:`7515`, containing + the public key of the Entity, the Trust Marks issued by the Entity itself and the Metadata policy + to be applied to the subject's Metadata. + * - **Trust Mark** + - JWT :rfc:`7515` signed by a Trust Mark issuer about an Entity. It certifies that the + Entity complies with profiles that are recognizable inside the Federation (public of private RP, public or private Intermediate Entity, etc.). A Leaf that aquires a Trust Mark during an Onboarding process, MUST include it in its Entity Configuration. + * - **Metadata** + - A Metadata document describes the implementation of an OpenID Connect or OAuth2 Entity. The implementations + of all the Entities share the Metadata to establish a common method of trust and interoperability. + * - **Metadata policy** + - The Trust Anchor publishes rules and policies to be applied to the subordinates' Metadata, + specifying what values and values subsets are allowed for a given Metadata claim. + * - **Authority hint** + - An array of URLs containing the identifiers of the superior Entities, Trust Anchor or + Intermediate, that MUST issue an Entity Statement for their own subordinates. + * - **Federation Entity Discovery** + - Collection of Entity Configuration / Statements, from a Leaf Entity up to the Trust Anchor + * - **Trust Chain** + - Validation Procedure of the sequence of Entity Configuration / Statements that have + been collected through the Federation Entity Discovery, + whose positive result is a final Metadata regarding + an Entity, and the expiry date before which it must be updated. + * - **Onboarding** + - Registration Procedure of a new Entity inside the SPID and CIE Federations. + * - **Federation Endpoint** + - Endpoints defined in OIDC Federation 1.0, used to fetch and resolve Entity statements, query a list of all the subordinate Entities and check the trust mark status. +.. * - **Individual session** +.. - Session established between a web service (RP) and web browser (user-agent) in control of the user, after the user has been authenticated. + +Acronyms +++++++++ + +In this section are defined all the acronyms that are used throughout the text. + +.. list-table:: + :widths: 15 85 + :header-rows: 0 + + * - **SPID** + - Italian Public System of Digital Identity, whose Federation Authority is AgID (Agenzia per L'Italia Digitale). + * - **CIEid** + - Italian Digital Identity System based on the Electronic ID Card (CIE), whose Federation Authority is the + Ministry of the Interior. The technical and operative management is given to the State Mint and Polygraphic Institute (IPZS). + * - **OIDC** + - OpenID Connect. + * - **OIDC-FED** + - `OIDC Federation 1.0 `_. + * - **FA** + - Federation Authority. + * - **TA** + - OIDC Federation Trust Anchor. + * - **AgID** + - Agenzia per l'Italia Digitale, FA/TA of SPID. + * - **MinInterno** + - Ministry of Interior, FA/TA of CIE id. + * - **OP** + - OpenID Provider (Leaf Entity). + * - **RP** + - Relying Party (Leaf Entity). + * - **SA** + - Intermediate Entity or Intermediate. An intermediate Entity that can handle all the Federation + aspects of one or more RPs. + * - **AA** + - Attribute Authority, handler of the qualified attribues (Leaf Entity). + * - **TM** + - Trust Mark. + * - **EC** + - Entity Configuration. + * - **ES** + - Entity Statement. + * - **URL** + - Uniform Resource Locator, it is a web address. + * - **JWT** + - See :rfc:`7519` Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015. + * - **RS** + - OAuth2 Resource Server + * - **$JWT** + - The value of a JWT (JSON Web Token). + + + +Conventions and Normative Terms ++++++++++++++++++++++++++++++++ + +The keywords "MUST", "MUST NOT", "REQUIRES", "REQUIRE", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY" and "OPTIONAL" in the present document must be interpreted as described at BCP 14 :rfc:`2119` :rfc:`8174` when and only when they appear in capital letters. + +Le notations [...] and ... mean that the text has been cut off for editor's requirements. + +*base64url* denotes the URL-safe base64 coding without padding, defined at :rfc:`7515#section-2`. + +All the examples contained in this document must be considered as non-normative. + +.. warning:: + |warning-message-en| diff --git a/en/_sources/token_endpoint.rst.txt b/en/_sources/token_endpoint.rst.txt new file mode 100644 index 00000000..707a71f2 --- /dev/null +++ b/en/_sources/token_endpoint.rst.txt @@ -0,0 +1,432 @@ +.. include:: ../common/common_definitions.rst + + +Token Endpoint +-------------- + +At the end of the authentication flow described at the previous section, the RP sends a request to the Token Endpoint with the authorization code received by the OP. These tokens MUST be signed JWT. + +The Token response, if succesfull, returns an *ID Token*, an *Access Token* and possibly a *Refresh Token* (if the authentication request has *scope=offline_access* and *prompt=consent*. See Section :ref:`Refresh Token `.). + +.. admonition:: |spid-icon| + + In a `long revocable session`_, the RP MAY request a Token to the *Token Endpoint* sending a *Refresh Token* in its possession, for obtaining a new *Access Token* and a new *ID Token*. + +.. note:: + The authentication method of the RP by the Token Endpoint is the **private_key_jwt** (`OpenID.Core#ClientAuthentication`_) + + +.. seealso:: + + * https://tools.ietf.org/html/rfc6749#section-3.2 + * https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint + * https://openid.net/specs/openid-igov-oauth2-1_0-03.html#Section-2.1.2 + * https://openid.net/specs/openid-igov-openid-connect-1_0-03.html#Section-2.2 + + +Request ++++++++ + +The claims that MUST be included in the *Token Request* are given below. + +**Request example with authorization code (case 1)** + + .. code-block:: http + + POST /token HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_id=https://rp.spid.agid.gov.it& + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…& + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + code=usDwMnEzJPpG5oaV8x3j& + code_verifier=9g8S40MozM3NSqjHnhi7OnsE38jklFv2& + grant_type=authorization_code + + +.. seealso:: + + - https://openid.net/specs/openid-connect-core-1_0.html#RPAuthentication + +**Request example with Refresh Token (case 2):** + + .. code-block:: http + + POST /token HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_id=https://rp.spid.agid.gov.it& + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…& + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + grant_type=refresh_token& + refresh_token=8xLOxBtZp8 + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **client_id** + - See `OpenID.Registration`_. It MUST contain an HTTPS URL that uniquely identifies the RP. + - |spid-icon| |cieid-icon| + * - **client_assertion** + - JWT signed with the Relying Party's private key containing the following parameters: + + **iss**: This MUST contain the *client_id*. + + **sub**: This MUST contain the *iss*. + + **aud**: URL of the OP Token Endpoint. + + **iat**: UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. + + **exp**: UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. + + **jti**: Unique Identifier uuid4 for this authentication request, generated by the client. Eg: it can be in *uuid4* format. + - |spid-icon| |cieid-icon| + * - **client_assertion_type** + - It must get the following value: |br| + **urn:ietf:params:oauth:client-assertion-type:jwtbearer**. + - |spid-icon| |cieid-icon| + * - **code** + - Authorization code returned in the Authentication Response. Required only if **grant_type** is **authorization_code**. + - |spid-icon| |cieid-icon| + * - **code_verifier** + - Verification code of the code_challenge. Required only if **grant_type** is **authorization_code**. + - |spid-icon| |cieid-icon| + * - **grant_type** + - Type of credentials, presented by the RP, for the current request. + It MAY get one of the following values: + + - **authorization_code** + - **refresh_token** + + - |spid-icon| |cieid-icon| + * - **refresh_token** + - Required only if **grant_type** is **refresh_token**. + - |spid-icon| |cieid-icon| + + +Response +++++++++ + +The OpenID Provider (OP) returns an ID Token, an Access Token and possibly a Refresh Token. + +The Access Token must be formed according to the standard indications of the `"International Government Assurance Profile (iGov) for OAuth 2.0 - Draft 03", section 3.2.1, "JWT Bearer Tokens" `_. + +The ID Token must be formed according to the indications contained in the next section. + +The response MUST contain the following claims. + + +**Response example:** + +.. code-block:: http + + HTTP/1.1 200 OK + Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT + Content-Type: application/json + + { + "access_token":"dC34Pf6kdG...", + "token_type":"Bearer", + "refresh_token":"wJ848BcyLP...", + "expires_in":1800, + "id_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY..." + } + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **access_token** + - The Access Token, in signed JWT format, allows accessing the UserInfo Endpoint for obtaining the attributes. + - |spid-icon| |cieid-icon| + * - **token_type** + - Type of *Access Token* returned. It MUST always be equal to **Bearer**. + - |spid-icon| |cieid-icon| + * - **refresh_token** + - Available only in case of `long revocable session`_. The *Refresh Token* MUST be a signed JWT format. It allows calling again the *Token Endpoint* for obtaining a new *Access Token* and a new *ID Token*. + - |spid-icon| |cieid-icon| + * - **expires_in** + - Expity time of the *Access Token* in seconds. + - |spid-icon| |cieid-icon| + * - **id_token** + - ID Token in JWT format (see next section). + - |spid-icon| |cieid-icon| + + +Access Token +++++++++++++ + +The Access Token is a signed JSON Web Token (JWT) that allows access to the +UserInfo endpoint to get user attributes. + +**Access Token header and payload example:** + +.. code-block:: json + + { + "alg": "RS256", + "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw", + "typ": "at+jwt" + } + . + { + "iss":"https://op.spid.agid.gov.it/", + "sub": "9sd798asd98asui23hiuds89y798sfyg", + "aud": [ + "https://rp.spid.example.it" + ], + "client_id": "https://rp.spid.example.it", + "scope": "openid", + "jti": "9ea42af0-594c-4486-9602-8a1f8dde42d3", + "exp": 1656859559, + "iat": 1656857579 + } + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **iss** + - It MUST be an HTTPS URL that uniquely identifies the OP. The client MUST verify that this value matches the called OP. + - |spid-icon| |cieid-icon| + * - **sub** + - See `OpenID.Core#SubjectIDTypes`_. It MUST be of type *pairwise*. + - |spid-icon| |cieid-icon| + * - **client_id** + - It MUST contain a HTTPS URL that uniquely identifies the RP. + - |spid-icon| |cieid-icon| + * - **aud** + - It MUST match the value *client_id*. The RP MUST verify that this value matches its client ID. + - |spid-icon| |cieid-icon| + * - **scope** + - The OP SHOULD add the *scope* parameter as defined in :rfc:`9068` Section 2.2.3. It MUST match the value in the authentication request. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **jti** + - It MUST be a String in *uuid4* format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed. + - |spid-icon| |cieid-icon| + * - **nonce** + - See `OpenID.Core#AuthRequest`_. It MUST be a random string of at least 32 alphanumeric characters. This value MUST match the value sent by the RP in the authentication request. + - |spid-icon| |cieid-icon| + +ID Token +++++++++ + +The ID Token is a signed JSON Web Token (JWT) that contains information about the user that has executed the authentication. The RPs MUST validate the ID Token. + + +.. admonition:: |cieid-icon| + + If the RP exposes in its metadata the parameter **id_token_encrypted_response_alg** the OP MUST encrypt the ID Token. + + +In this case the ID Token MUST be a **nested signed and encrypted JWT** containing the *cty* (Content-Type) parameter in the JOSE header configured to *JWT* (see :rfc:`7519#section-5.2`). + +The claims available in the *ID Token* are given below. + +**Example of header and payload of an ID Token:** + +.. code-block:: json + + + { + "alg": "RS256", + "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw" + } + . + { + "iss":"https://op.spid.agid.gov.it/", + "sub":"9sd798asd98asui23hiuds89y798sfyg", + "aud":"https://rp.spid.agid.gov.it/auth", + "acr":"https://www.spid.gov.it/SpidL2", + "at_hash":"qiyh4XPJGsOZ2MEAyLkfWqeQ", + "iat":1519032969, + "nbf":1519032969, + "exp":1519033149, + "jti":"nw4J0zMwRk4kRbQ53G7z", + "nonce":"MBzGqyf9QytD28eupyWhSqMj78WNqpc2" + } + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **iss** + - It MUST be an HTTPS URL that uniquely identifies the OP. The client MUST verify that this value matches the called OP. + - |spid-icon| |cieid-icon| + * - **sub** + - See `OpenID.Core#SubjectIDTypes`_. It MUST be *pairwise* type. + - |spid-icon| |cieid-icon| + * - **aud** + - It MUST match the value *client_id*. The RP MUST verify that this value matches its client ID. + - |spid-icon| |cieid-icon| + * - **acr** + - Effective authentication level. It MUST be equal or greater than the one requested by the client in the Authentication Request. + - |spid-icon| |cieid-icon| + * - **at_hash** + - See `OpenID.Core#CodeIDToken`_. Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the *Access Token* value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. The client MUST verify this value by applying the same function to the *Access Token* returned with the Token ID. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **nbf** + - UNIX Timestamp. Time of the validity beginning of the JWT in NumericDate format, as indicated in :rfc:`7519`. MUST match with the value of **iat**. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **jti** + - It MUST be a String in *uuid4* format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed. + - |spid-icon| |cieid-icon| + * - **nonce** + - See `OpenID.Core#AuthRequest`_. It MUST be a random string of at least 32 alphanumeric characters. This value MUST match the value sent by the RP in the authentication request. + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - https://openid.net/specs/openid-connect-core-1_0.html#IDToken + - https://openid.net/specs/openid-igov-openid-connect-1_0-03.html#Section-3.1 + + +.. _Refresh_Token: + + +Refresh Token ++++++++++++++ + +The *Refresh Token* is a signed JWT that MAY be issued by the OP and MAY be used to obtain a new *Access Token* that enables the RP to access the UserInfo endpoint without requiring any direct user interaction. + +The *Refresh Token* MUST be a signed JWT containing at least the following parameters. + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **iss** + - It MUST be an HTTPS URL that uniquely identifies the OP. The RP MUST verify that this value matches the called OP. + - |spid-icon| |cieid-icon| + * - **aud** + - It MUST match the value client_id. The RP MUST verify that this value matches its client ID. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **jti** + - It MUST be a String in uuid4 format. Unique *Refresh Token* identifier that the RP MAY use to prevent reuse by rejecting the *Refresh Token* if already processed. + - |spid-icon| |cieid-icon| + +.. admonition:: |cieid-icon| + + To obtain a *Refresh Token*, the RP MUST include in the *scope* parameter of the authentication request the value *offline_access* and in the *prompt* parameter, the value *consent*. The use of this scope can be useful in scenarios where an RP needs to verify that an end user's digital identity is still valid or wants to keep attributes it has previously collected during the authentication phase up-to-date, such as for sending notifications to the end user after the end user has been authenticated. + **The Refresh Token MUST NOT allow the requesting RP to obtain an ID Token, neither the one previously issued during authentication nor a new ID Token. The use of the Refresh Token MUST NOT be used by RPs to obtain a new user authentication with the OP or to renew a pre-existing session, but MAY be used as a mechanism to obtain from the UserInfo endpoint only the same set of user attributes requested at the initial authentication phase and for which the user has given explicit consent.** Such consent MUST be collected by the OP at the end-user authentication phase on the consent page (it requires the ability to enable or disable this option on the consent page) and MAY be conditional on a validity period if defined by the OP according to policies on the treatment of personal data. Disabling this option by the user MUST still allow user authentication but MUST NOT release a *Refresh Token*. + + The OP who receives a request for a new *Access Token* via a *Refresh Token* MAY send a notification to the user via one of the available e-delivery services (email, sms, mobile app notification). The user who does not recognize this operation as legitimate or who wants to disable this option can request from the OP a revocation of the given consent (and therefore of the tokens issued as a result of the same) according to the procedures made known within the consent acquisition page. The notification MUST be informative only and not authorizing. Within the notification MUST be made known to the user how to revoke the consent given. The OP MUST allow the user to disable this option at any time through appropriate functionality made available by the OP itself. + + For security reasons, an OP MUST return, along with a new *Access Token*, also a new *Refresh Token*, invalidating all previously issued tokens (*refresh token rotation*) to the RP and related to the end-user. The new *Refresh Token* MUST have the *exp* parameter according to the expected duration. + +.. admonition:: |spid-icon| + + In a mobile application scenario, to prevent the user from entering credentials every time, an RP MAY use the Refresh Token to enable revocable long sessions as defined in `LL.GG. OpenID Connect in SPID `_ and `Avviso n.41 `_ . + The *Token endpoint* verifies the validity of the Refresh Token and, if the the original authentication request included *https://www.spid.gov.it/SpidL1* in the *acr_values*, a new *ID Token* valid only for the SPID level 1 is issued. + For more details on the Refresh Token in SPID, please refer to the following documentation: + + - `LL.GG. OpenID Connect in SPID `_ + - `Avviso n.41 - Integrazione LL.GG. OpenID Connect in SPID `_ + +Validity Period of a Refresh Token +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + + +The *Refresh Token* MUST NOT be valid (difference between *iat* and *exp*) more than 30 days. + +If the Refresh Token is not valid (expired or revoked) and the RP sends a Token refresh request to the OP, the OP MUST return an error in the response (see :ref:`Error codes `). + +.. admonition:: |cieid-icon| + + Notwithstanding the validity of the token, the OP MAY set a validity period related to the consent the user has provided to use the *scope=offline_access* and the *Refresh Token*. Approaching the expiration of the validity period of the consensus, whenever such a period is provided for in the OP's policies, the value of *exp* MUST be calculated as the minimum value between the validity period of the token and that of the consensus. + +.. note:: + + In order to clarify the rotation mechanism, a non-normative example is given below where *Refresh Tokens* are assumed to be valid for 30 days. + + - t1: an RP authenticates with scope=offline_access, then obtains a *Refresh Token* RT1 (validity 30gg) + - t2 = t1 + 4gg: the RP makes a request to the Token endpoint by presenting RT1. The OP recognizes that the request is from the same RP and issues a new *Access Token* and new *Refresh Token* RT2 with validity 30gg from t2 + - t3 = t1 + 32gg: after 28gg from t2 the RP makes a request to the Token endpoint by submitting RT2. The OP recognizes that the request is from the same RP and issues a new *Access Token* and new *Refresh Token* RT3 with validity 30gg from t3 + - t4 = t1 + 64gg: after 32gg from t3 the RP makes a request to the Token endpoint by submitting RT3. This time the OP rejects the request with an error because RT3 is found to be no longer valid. + +.. _TOKEN_ENDPOINT_ERRORS: + +Error codes ++++++++++++ + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **HTTP Code** + - **Supported by** + + * - *invalid_client* + - Client authentication failed (e.g., unknown client_id, no client authentication included, or unsupported authentication method) |br| (:rfc:`6749#section-5.2`). + - *401 Unauthorized* + - |spid-icon| |cieid-icon| + + * - *unsupported_grant_type* + - The grant_type parameter contains an incorrect value. + - *400 Bad Request* + - |spid-icon| |cieid-icon| + + * - *invalid_grant* + - The grant_type, code, code_verifier, access_token parameters are not valid. + - *400 Bad Request* + - |spid-icon| |cieid-icon| + + * - *invalid_request* + - The request is not valid due to the lack or incorrectness of one or more parameters. + - *400 Bad Request* + - |spid-icon| |cieid-icon| + + * - *server_error* + - The OP encountered an internal problem. + - *500 internal server error* + - |spid-icon| |cieid-icon| + + * - *temporarily_unavailable* + - The OP encountered a temporary internal problem. + - *503 Service Unavailable* + - |spid-icon| |cieid-icon| diff --git a/en/_sources/trust_marks.rst.txt b/en/_sources/trust_marks.rst.txt new file mode 100644 index 00000000..94b35ee8 --- /dev/null +++ b/en/_sources/trust_marks.rst.txt @@ -0,0 +1,237 @@ +.. include:: ../common/common_definitions.rst + +.. _Trust_Mark: + +Trust Marks +=========== + +The **Trust Marks (TM)** are signed JWT :rfc:`7515` and represent the statements of compliance with a well defined set of requirements of trust and/or interoperability, or an agreement among the parties involved in the Federation. + +The main aim of the TMs is exposing information that is not required by the OpenID Connect Core protocol, +but turns out to be useful in the federative context. + +Typical examples include the Entity's national or international identification code (fiscal code, IPA code, VAT number), institutional contacts and so forth, as defined at `OIDC-FED`_. Further data may be added +by the issuing subject. + +During the registration process of a new Leaf Entity (onboarding), the TMs are issued and signed by the TA +or its Intermediates (SA) or by Attribute Authorities (AA), if they are defined inside the attribute **trust_marks_issuers**, published inside the TA's Entity Configuration. + +Each member Entity MUST expose, in its own configuration (EC), the TMs released by the issuing authorities. + +In the CIE / SPID scenario, a TM is signed by the TA **MinInterno** / **Agid** or their Intermediates (SA) or by Attribute Authorities (AA). + +The TA defines the subjects who are enabled to issue TMs that are recognizable inside the Federation, +and this is done by the claim **trust_marks_issuers**, contained in its own Entity Configuration. +The value of the claim **trust_marks_issuers** is composed by a JSON Object having as keys the TM identifiers, and as values the list of identifiers (URLs) or the Entities who are enabled to issue them. + +In the following, a non-normative example of the object **trust_marks_issuers** inside the TA's Entity Configuration. + + +.. code-block:: json + + { + "trust_marks_issuers":{ + "https://registry.agid.gov.it/openid_relying_party/public/":[ + "https://registry.spid.agid.gov.it/", + "https://public.intermediate.spid.it/" + ], + "https://registry.agid.gov.it/openid_relying_party/private/":[ + "https://registry.spid.agid.gov.it/", + "https://private.other.intermediate.it/" + ] + } + } + +Each member Entity MUST expose in its configuration (EC), the TMs released by the issuing authority. + +In the CIE / SPID scenario, a TM is signed by the TA **MinInterno** / **Agid** or their Intermediates (SA) or +Attribute Authorities (AA). + +The TA defines the subjects that are enabled to issue TMs that are recognizable inside the Federation, +and it does it with the claim **trust_marks_issuers**, that is present in its Entity Configuration. +The value of the attribute **trust_marks_issuers** is composed by a JSON Object whose keys are the TM identifiers and whose values are the list of the identifiers (URLs) of the Entities enabled +to issue them. + +The Trust Marks represent the first filter for establishing the trust among the parties. +They are essential elements for starting the Metadata resolution. +In their absence, an Entity is not recognized as a member inside the Federation. + +Inside the SPID Federation, the Trust Marks have unique identifiers (claim id) in URL format, that adopt +the following structure: **https:// / / / [extension /]** + +In the following, some non-normative examples: + + + - TM RP public: **\https://registry.agid.gov.it/openid_relying_party/public/** + - TM SA private: **\https://registry.agid.gov.it/intermediate/private/full/** + - TM AA: **\https://registry.agid.gov.it/oauth_resource/public/** + + +The following table defines the that are recognizable inside the SPID and CIE id Federations: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Type** + - **Description** + - **Entity** + * - **openid_relying_party** + - the Entity in the claim *sub* is an RP. + - RP + * - **openid_provider** + - the Entity in the claim *sub* is an OP. + - OP + * - **intermediate** + - the Entity in the claim *sub* is an Intermediate. + - SA + * - **oauth_resource** + - the Entity in the claim *sub* is an Attribute Authority. + - AA + +The following table defines the that are recognizable inside the SPID and CIE id Federations: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Profile** + - **Description** + - **Entity** + * - **public** + - the Entity in the claim *sub* belongs to the Italian Public Administration. + - RP, OP, SA, AA + * - **private** + - the Entity in the claim *sub* belongs to the private sector. + - RP, OP, SA, AA + + +**federation_entity** Trust Mark +-------------------------------- + +In addition to the claims of the **public** and **private** profiles, the profile **intermediate** identifies the SA and adds the extensions **full** and **light** in the **sa_profile** claim, according to the ways of operation towards the subordinate Entities. + +.. seealso:: + + See Section :ref:`Intermediate Entities in the Federative context ` + + +**oauth_resource** Trust Mark +------------------------------ + +In addition to the claims of the **public** and **private** profiles, the profile **oauth_resource** +identifies the AA and adds the following mandatory claims: + +.. list-table:: + :widths: 20 60 + :header-rows: 1 + + * - **Claim** + - **Description** + * - **policy_uri** + - URL where the AA privacy policy is available. + * - **tos_uri** + - URL where the AA info policy is available. + * - **claims** + - List of JSON Objects that define the user's attributes, required by the AA. + Example: |br| ``{"https://attributes.eid.gov.it/fiscal_number":{"essential":true},`` |br| ``"email":{"essential":true},}`` + * - **service_documentation** + - URL where the OAS3 document, that describes how the AA services works, is available. + + +Trust Mark Validation +--------------------- + +There are two ways of validating a Trust Mark: + + 1. **Static** Validation. The Trust Mark is validated through its issuing authority's public key (claim **iss**), on top of the correspondence of the claim **sub** to the same claim of the Entity Configuration in which it is contained, and on top of the expiry value (claim **exp**) + + 2. **Dynamic** Validation. The Federation members can query the endpoint :ref:`trust mark status` supplied by its issuer (claim **iss**), for a real-time checking of the TMs that it has issued. + +All the Entities that release Trust Marks, MUST expose a Trust Mark status endpoint for allowing the **dynamic** validation. + +.. seealso:: + + - `OIDC-FED`_ Section .5.3.2. + +Trust Mark Revocation +--------------------- + +A Trust Mark can be revoked at any moment only and exclusively by the issuing subject. +For example, in case of exclusion of an Aggregated Subject by the Federation Authority, it communicates the exclusion of the Aggregated Subject to the SA. Consequently, the SA MUST revoke the TM for its subordinate. + + +.. note:: + + In case of TM revocation, the **dynamic** validation gives a negative result, while the **static** + validation keeps on giving a positive result, unless the signing encryption keys of the TM-releasing subject are rotated. + + +.. _ComposizioneTM: + +Trust Mark Composition +---------------------- + +The claims defined inside the TMs are compliant with the elements defined in the OIDC Federation 1.0 (`OIDC-FED`_) standard. See the following list. + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **iss** + - String. URL that uniquely identifies its issuing Authority. + - |spid-icon| |cieid-icon| + * - **sub** + - String. URL that uniquely identifies the subject for which the Trust Mark has been issued. + - |spid-icon| |cieid-icon| + * - **id** + - String. Unique identifier of the Trust Mark. It is an URL with the following structure: |br| + **///** |br| + non-normative example: ``https://registry.interno.gov.it/openid_relying_party/public/`` + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the JWT issuance time, coded as NumericDate as indicated at :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **logo_uri** + - String. An URL that points to the logo that represents the Trust Mark. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the JWT expiry time, coded as NumericDate as indicated at :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **ref** + - String. URL that points to public web information, about this Trust Mark + - |spid-icon| |cieid-icon| + * - **organization_type** + - String. Specifies if the Entity belongs to the Italian Public Administration or the private sector (**public** or **private**) + - |spid-icon| |cieid-icon| + * - **id_code** + - JSON Object. It contains one or more ogranization identification codes. Available claims are: + - **ipa_code**: REQUIRED for public organization. + - **aoo_code**: OPTIONAL. + - **uo_code**: OPTIONAL. + - **vat_number**: REQUIRED for private organization only if *fiscal_number* is not available. + - **fiscal_number**: REQUIRED for private organization only if *vat_number* is not available. + - |spid-icon| |cieid-icon| + * - **email** + - String. Institutional e-mail or PEC of the Organization. + - |spid-icon| |cieid-icon| + * - **organization_name** + - String. The complete name of the service-supplying Entity. + - |spid-icon| |cieid-icon| + +.. warning:: + + The value in the claim **exp** MUST NOT be greater than the duration of the agreements submitted during the onboarding process, between the Trust Mark issuer and the Organizations receiving the TM. + + +.. seealso:: + + - `OIDC-FED`_ Section 5.3.1. + - Non-normative example: :ref:`Trust Mark issued by TA to a RP `, :ref:`Trust Mark issued by TA to a SA `, :ref:`Trust Mark issued by SA to a RP `, + + diff --git a/en/_sources/trust_negotiation.rst.txt b/en/_sources/trust_negotiation.rst.txt new file mode 100644 index 00000000..81ee9061 --- /dev/null +++ b/en/_sources/trust_negotiation.rst.txt @@ -0,0 +1,114 @@ +.. include:: ../common/common_definitions.rst + +Metadata retrieval +------------------ + +This section explains the ways the participants of a federation have to establish the trust among them, the ways for the Leaves to recognize each other inside the same federation and get each other's Metadata. + + +Relying Party ++++++++++++++ + +The RP gets the list of the OPs in JSON format by querying the :ref:`endpoint list`, +available by the :ref:`Trust Anchor`. For each subject contained in the :ref:`JSON response` and corresponding to an OP, the RP :ref:`requests` the Entity Configuration of the OP. + +For each EC of the OPs, the RP validates the signature of the OP Entity Configuration using the public key obtained in the Entity +Statement released by the Trust Anchor for that OP. After validating the Entity Configuration signature, the RP establishes the trust with the OP. + +Finally, the RP applies the policies published by the Trust Anchor on the OP's Metadata and saves the resulting +Metadata by associating it to an expiry date (claim **exp**). The expiry date corresponds to the lowest +value of **exp**, obtained from all the elements that compose the **Trust Chain**. Periodically, the RP updates +the Metadata of all the OPs, renewing their related Trust Chain. + +After obtaining the final Metadata of all the OpenID Connect Providers, the RP generates the **SPID button** or **CIE button** and publishes it inside its authentication page. + +The procedure of Federation Entity Discovery for the RPs gets simplified because, inside the Federation, the existence of Intermediates between the OPs and their Trust Anchor is not allowed. + + +.. image:: ../../images/metadata_discovery.svg + :width: 100% + +*The Federation Entity Discovery procedure from the Leaf, up to the Trust Anchor. The public key for validating the Entity Configuration of the subordinate Entity is obtained from the Entity Statement released by a superior*. + + +OpenID Provider ++++++++++++++++ + +When a Provider (OP) receives an authorization request from a non-previously-recognized RP, +the **automatic client registration** procedure occurs. The operations made by the OP to +dynamically register an RP are described below. + +.. image:: ../../images/automatic_client_registration.svg + :width: 100% + + +*The registration of an RP from the perspective of an OP that, for the first time, receives an authorization +request from the RP and starts the Federation Entity Discovery process and the Trust Chain saving*. + + +The OP extracts the unique identifier (**client_id**) from the object *request* contained in the +*Authorization Request* and sends an Entity Configuration request (:ref:`RP`). +The OP obtains the Entity Configuration of the RP and validates the signatures of Trust Mark that are +recognized inside the Federation [1]_. + +If the RP configuration does not expose any Trust Mark that is recognizable by the RP profile (see Section :ref:`Trust Mark`), the Provider MUST refuse the authorization with an error message as defined in Section :ref:`Federation Error Management `. + +If the Provider successfully validates at least a Trust Mark for the RP profile contained inside the +configuration of the requesting RP, it extracts the superior Entities from the claim **authority_hints** and +starts the Federation Entity Discovery process until the **Trust Chain** calculation and the achievement of +the final Metadata. + +During the Federation Entity Discovery, the Provider requests one ore more superior Entities [2]_ for the Entity +Statement regarding the RP, obtains the public key for validating the RP configuration and finally reaches +the Trust Anchor. Then it applies the Metadata policy published by the Trust Anchor and saves the +resulting final RP Metadata, associating them to an expiry date. After that date, it will +renew the RP Metadata, according to the Trust Chain renewal procedure. + +After obtaining the final Metadata, the Provider validates the request sent by RP. + +In case an RP has a SA as a superior Entity and not directly the TA, the procedure of achieving and validating the Entity Configuration of the RP occurs through the Entity Statement published +by the SA towards the RP and through validating the Entity Configuration of the SA with the Entity Statement issued by the TA towards the SA. If the threshold of the maximum number of vertical Intermediates, +defined by the value **max_path_length**, is exceeded, the OP stops the process of Federation Entity Discovery and rejects the RP request. + + +.. [1] The Federation Trust Marks are configured in the claim **trust_marks_issuers** and contained in the Entity Configuration of the Trust Anchor. + +.. [2] An RP can expose more than one superior Entity inside its own claim **authority_hints**. An example is an RP that takes part both in the SPID and in the CIE Federation. Besides, an RP can result as a subordinate of more than one Intermediates, either of SPID or CIE. + + +.. image:: ../../images/trust_anchor.svg + :width: 100% + +*Each member exposes its own configuration and its own Trust Marks. The link between a Leaf and +the Trust Anchor occurs directly or through an Intermediate (SA) as in the picture.* + + +Access to the Entity Configuration +++++++++++++++++++++++++++++++++++ + +This section describes how to identify the URL :rfc:`3986` in order to download the Entity Configuration of a given subject. + +The web path ``.well-known/openid-federation`` is the resource by which an Entity publishes its configuration (Entity Configuration). This web path MUST be appended to the URL which identifies the subject. + +Examples: + + - with a subject identifier equal to ``https://rp.example.it`` the resulting Entity Configuration URL is |br| + ``https://rp.example.it/.well-known/oidc-federation``. + + - with a subject identifier equal to ``https://rp.servizi-spid.it/oidc/`` the resulting + Entity Configuration URL is |br| + ``https://rp.servizi-spid.it/oidc/.well-known/oidc-federation``. + +In case of subject identifier URLs lacking the ending slash mark "/", this must be added between the URL and the appended web path resource. + +Once the RP is recognized as part in the Federation, it gets the permission to make an Authentication Request. +The OP that doesn't recognize the RP that sent the request, has to resolve the trust for that RP. The OP starts +requesting the Entity Configuration of the RP at the .well-known endpoint of the RP and, following the path +provided by the *authority_hint*, reaches the TA. At each chain step, the OP can perform all the security controls by requesting the Entity Statements to each Entity and validating the Trust Marks and the signatures. The following picture is a representative example of how the Trust Chain works. + + +.. image:: ../../images/cie_esempio_trust_chain.svg + :width: 100% + + +*The Federation Entity Discovery process to build a Trust Chain and obtain the final Metadata.* diff --git a/en/_sources/userinfo_endpoint.rst.txt b/en/_sources/userinfo_endpoint.rst.txt new file mode 100644 index 00000000..e877c0ce --- /dev/null +++ b/en/_sources/userinfo_endpoint.rst.txt @@ -0,0 +1,144 @@ +.. include:: ../common/common_definitions.rst + +UserInfo Endpoint +----------------- + +The UserInfo Endpoint is a protected resource that returns the authenticated user's claims. In order to obtain +the requested claims, the RP sends a request to the UserInfo Endpoint using the Access Token. + +Request ++++++++ + +.. admonition:: |spid-icon| + + The UserInfo Endpoint MUST only support the method HTTP GET :rfc:`2616` and MUST accept and validate the Access Token sent in the Authorization field of the Header, whose type is Bearer :rfc:`6750`. + +.. admonition:: |cieid-icon| + + The UserInfo Endpoint MUST support the method HTTP GET and HTTP POST :rfc:`2616` and MUST accept and validate the Access Token sent in the Authorization field of the Header, whose type is Bearer :rfc:`6750`. + + +.. code-block:: http + + GET https://op.spid.agid.gov.it/userinfo + Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImRCNjdnTDdja ... + +.. seealso:: + + - https://openid.net/specs/openid-connect-core-1_0.html#UserInfo + - https://openid.net/specs/openid-igov-openid-connect-1_0-03.html#Section-4 + + +.. _userinfo_response: + +Response +++++++++ + +The content of the Response body MUST be a `signed and encrypted JWT. `_ + +The JOSE header MUST contain the *cty* parameter (Content Type) configured to *JWT* (see :rfc:`7519#section-5.2`). + +The UserInfo Endpoint returns user attributes explicitly requested through the **claims** parameter or through the use of the **scope** parameter in the Authentication Request. + +.. code-block:: http + + HTTP/1.1 200 OK + Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT + Content-Type: application/jose + + { + "alg": "RSA-OAEP", + "enc": "A256CBC-HS512", + "kid": "HIvo33-Km7n03ZqKDJfWVnlFudsW28YhQZx5eaXtAKA", + "cty": "JWT" + } + . + { + "iss": "https://op.fornitore_identita.it", + "aud": "https://rp.fornitore_servizio.it", + "iat": 1519032969, + "nbf": 1519032969, + "exp": 1519033149, + "sub": "OP-1234567890", + "name": "Mario", + "family_name": "Rossi", + "https://attributes.spid.gov.it/fiscal_number": "MROXXXXXXXXXXXXX" + } + +The JWE header MUST contain the parameter below: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **alg** + - String. See :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **kid** + - See :rfc:`7638#section_3`. + - |spid-icon| |cieid-icon| + * - **enc** + - String. See :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **cty** + - String. It MUST contain the value "JWT". + - |spid-icon| |cieid-icon| + +The JWE payload is a JWS containing the following parameters: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Supported by** + * - **sub** + - String. Subject identifier, equal to the identifier already released in the ID Token. + The RP MUST check that the value is equal to the one, contained in the ID Token. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **aud** + - String. Subject Identifier of the response recipient (RP). + The RP MUST check that the value is equal to its own client_id. + - |spid-icon| |cieid-icon| + * - **iss** + - String. URI that uniquely identifies the OP. + - |spid-icon| |cieid-icon| + * - **** + - The requested user claims. + - |spid-icon| |cieid-icon| + +The JWS header MUST contains the parameters below: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **alg** + - String. See :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **kid** + - See :rfc:`7638#section_3`. + - |spid-icon| |cieid-icon| + * - **cty** + - String. It MUST contain the value "JWT". + - |spid-icon| |cieid-icon| + +Error codes ++++++++++++ + +As defined for :ref:`Token endpoint`. + + diff --git a/en/_static/_sphinx_javascript_frameworks_compat.js b/en/_static/_sphinx_javascript_frameworks_compat.js new file mode 100644 index 00000000..8549469d --- /dev/null +++ b/en/_static/_sphinx_javascript_frameworks_compat.js @@ -0,0 +1,134 @@ +/* + * _sphinx_javascript_frameworks_compat.js + * ~~~~~~~~~~ + * + * Compatability shim for jQuery and underscores.js. + * + * WILL BE REMOVED IN Sphinx 6.0 + * xref RemovedInSphinx60Warning + * + */ + +/** + * select a different prefix for underscore + */ +$u = _.noConflict(); + + +/** + * small helper function to urldecode strings + * + * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURIComponent#Decoding_query_parameters_from_a_URL + */ +jQuery.urldecode = function(x) { + if (!x) { + return x + } + return decodeURIComponent(x.replace(/\+/g, ' ')); +}; + +/** + * small helper function to urlencode strings + */ +jQuery.urlencode = encodeURIComponent; + +/** + * This function returns the parsed url parameters of the + * current request. Multiple values per key are supported, + * it will always return arrays of strings for the value parts. + */ +jQuery.getQueryParameters = function(s) { + if (typeof s === 'undefined') + s = document.location.search; + var parts = s.substr(s.indexOf('?') + 1).split('&'); + var result = {}; + for (var i = 0; i < parts.length; i++) { + var tmp = parts[i].split('=', 2); + var key = jQuery.urldecode(tmp[0]); + var value = jQuery.urldecode(tmp[1]); + if (key in result) + result[key].push(value); + else + result[key] = [value]; + } + return result; +}; + +/** + * highlight a given string on a jquery object by wrapping it in + * span elements with the given class name. + */ +jQuery.fn.highlightText = function(text, className) { + function highlight(node, addItems) { + if (node.nodeType === 3) { + var val = node.nodeValue; + var pos = val.toLowerCase().indexOf(text); + if (pos >= 0 && + !jQuery(node.parentNode).hasClass(className) && + !jQuery(node.parentNode).hasClass("nohighlight")) { + var span; + var isInSVG = jQuery(node).closest("body, svg, foreignObject").is("svg"); + if (isInSVG) { + span = document.createElementNS("http://www.w3.org/2000/svg", "tspan"); + } else { + span = document.createElement("span"); + span.className = className; + } + span.appendChild(document.createTextNode(val.substr(pos, text.length))); + node.parentNode.insertBefore(span, node.parentNode.insertBefore( + document.createTextNode(val.substr(pos + text.length)), + node.nextSibling)); + node.nodeValue = val.substr(0, pos); + if (isInSVG) { + var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect"); + var bbox = node.parentElement.getBBox(); + rect.x.baseVal.value = bbox.x; + rect.y.baseVal.value = bbox.y; + rect.width.baseVal.value = bbox.width; + rect.height.baseVal.value = bbox.height; + rect.setAttribute('class', className); + addItems.push({ + "parent": node.parentNode, + "target": rect}); + } + } + } + else if (!jQuery(node).is("button, select, textarea")) { + jQuery.each(node.childNodes, function() { + highlight(this, addItems); + }); + } + } + var addItems = []; + var result = this.each(function() { + highlight(this, addItems); + }); + for (var i = 0; i < addItems.length; ++i) { + jQuery(addItems[i].parent).before(addItems[i].target); + } + return result; +}; + +/* + * backward compatibility for jQuery.browser + * This will be supported until firefox bug is fixed. + */ +if (!jQuery.browser) { + jQuery.uaMatch = function(ua) { + ua = ua.toLowerCase(); + + var match = /(chrome)[ \/]([\w.]+)/.exec(ua) || + /(webkit)[ \/]([\w.]+)/.exec(ua) || + /(opera)(?:.*version|)[ \/]([\w.]+)/.exec(ua) || + /(msie) ([\w.]+)/.exec(ua) || + ua.indexOf("compatible") < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua) || + []; + + return { + browser: match[ 1 ] || "", + version: match[ 2 ] || "0" + }; + }; + jQuery.browser = {}; + jQuery.browser[jQuery.uaMatch(navigator.userAgent).browser] = true; +} diff --git a/en/_static/basic.css b/en/_static/basic.css new file mode 100644 index 00000000..9039e027 --- /dev/null +++ b/en/_static/basic.css @@ -0,0 +1,932 @@ +/* + * basic.css + * ~~~~~~~~~ + * + * Sphinx stylesheet -- basic theme. + * + * :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS. + * :license: BSD, see LICENSE for details. + * + */ + +/* -- main layout ----------------------------------------------------------- */ + +div.clearer { + clear: both; +} + +div.section::after { + display: block; + content: ''; + clear: left; +} + +/* -- relbar ---------------------------------------------------------------- */ + +div.related { + width: 100%; + font-size: 90%; +} + +div.related h3 { + display: none; +} + +div.related ul { + margin: 0; + padding: 0 0 0 10px; + list-style: none; +} + +div.related li { + display: inline; +} + +div.related li.right { + float: right; + margin-right: 5px; +} + +/* -- sidebar --------------------------------------------------------------- */ + +div.sphinxsidebarwrapper { + padding: 10px 5px 0 10px; +} + +div.sphinxsidebar { + float: left; + width: 230px; + margin-left: -100%; + font-size: 90%; + word-wrap: break-word; + overflow-wrap : break-word; +} + +div.sphinxsidebar ul { + list-style: none; +} + +div.sphinxsidebar ul ul, +div.sphinxsidebar ul.want-points { + margin-left: 20px; + list-style: square; +} + +div.sphinxsidebar ul ul { + margin-top: 0; + margin-bottom: 0; +} + +div.sphinxsidebar form { + margin-top: 10px; +} + +div.sphinxsidebar input { + border: 1px solid #98dbcc; + font-family: sans-serif; + font-size: 1em; +} + +div.sphinxsidebar #searchbox form.search { + overflow: hidden; +} + +div.sphinxsidebar #searchbox input[type="text"] { + float: left; + width: 80%; + padding: 0.25em; + box-sizing: border-box; +} + +div.sphinxsidebar #searchbox input[type="submit"] { + float: left; + width: 20%; + border-left: none; + padding: 0.25em; + box-sizing: border-box; +} + + +img { + border: 0; + max-width: 100%; +} + +/* -- search page ----------------------------------------------------------- */ + +ul.search { + margin: 10px 0 0 20px; + padding: 0; +} + +ul.search li { + padding: 5px 0 5px 20px; + background-image: url(file.png); + background-repeat: no-repeat; + background-position: 0 7px; +} + +ul.search li a { + font-weight: bold; +} + +ul.search li p.context { + color: #888; + margin: 2px 0 0 30px; + text-align: left; +} + +ul.keywordmatches li.goodmatch a { + font-weight: bold; +} + +/* -- index page ------------------------------------------------------------ */ + +table.contentstable { + width: 90%; + margin-left: auto; + margin-right: auto; +} + +table.contentstable p.biglink { + line-height: 150%; +} + +a.biglink { + font-size: 1.3em; +} + +span.linkdescr { + font-style: italic; + padding-top: 5px; + font-size: 90%; +} + +/* -- general index --------------------------------------------------------- */ + +table.indextable { + width: 100%; +} + +table.indextable td { + text-align: left; + vertical-align: top; +} + +table.indextable ul { + margin-top: 0; + margin-bottom: 0; + list-style-type: none; +} + +table.indextable > tbody > tr > td > ul { + padding-left: 0em; +} + +table.indextable tr.pcap { + height: 10px; +} + +table.indextable tr.cap { + margin-top: 10px; + background-color: #f2f2f2; +} + +img.toggler { + margin-right: 3px; + margin-top: 3px; + cursor: pointer; +} + +div.modindex-jumpbox { + border-top: 1px solid #ddd; + border-bottom: 1px solid #ddd; + margin: 1em 0 1em 0; + padding: 0.4em; +} + +div.genindex-jumpbox { + border-top: 1px solid #ddd; + border-bottom: 1px solid #ddd; + margin: 1em 0 1em 0; + padding: 0.4em; +} + +/* -- domain module index --------------------------------------------------- */ + +table.modindextable td { + padding: 2px; + border-collapse: collapse; +} + +/* -- general body styles --------------------------------------------------- */ + +div.body { + min-width: 360px; + max-width: 800px; +} + +div.body p, div.body dd, div.body li, div.body blockquote { + -moz-hyphens: auto; + -ms-hyphens: auto; + -webkit-hyphens: auto; + hyphens: auto; +} + +a.headerlink { + visibility: hidden; +} + +a.brackets:before, +span.brackets > a:before{ + content: "["; +} + +a.brackets:after, +span.brackets > a:after { + content: "]"; +} + +h1:hover > a.headerlink, +h2:hover > a.headerlink, +h3:hover > a.headerlink, +h4:hover > a.headerlink, +h5:hover > a.headerlink, +h6:hover > a.headerlink, +dt:hover > a.headerlink, +caption:hover > a.headerlink, +p.caption:hover > a.headerlink, +div.code-block-caption:hover > a.headerlink { + visibility: visible; +} + +div.body p.caption { + text-align: inherit; +} + +div.body td { + text-align: left; +} + +.first { + margin-top: 0 !important; +} + +p.rubric { + margin-top: 30px; + font-weight: bold; +} + +img.align-left, figure.align-left, .figure.align-left, object.align-left { + clear: left; + float: left; + margin-right: 1em; +} + +img.align-right, figure.align-right, .figure.align-right, object.align-right { + clear: right; + float: right; + margin-left: 1em; +} + +img.align-center, figure.align-center, .figure.align-center, object.align-center { + display: block; + margin-left: auto; + margin-right: auto; +} + +img.align-default, figure.align-default, .figure.align-default { + display: block; + margin-left: auto; + margin-right: auto; +} + +.align-left { + text-align: left; +} + +.align-center { + text-align: center; +} + +.align-default { + text-align: center; +} + +.align-right { + text-align: right; +} + +/* -- sidebars -------------------------------------------------------------- */ + +div.sidebar, +aside.sidebar { + margin: 0 0 0.5em 1em; + border: 1px solid #ddb; + padding: 7px; + background-color: #ffe; + width: 40%; + float: right; + clear: right; + overflow-x: auto; +} + +p.sidebar-title { + font-weight: bold; +} + +div.admonition, div.topic, aside.topic, blockquote { + clear: left; +} + +/* -- topics ---------------------------------------------------------------- */ + +div.topic, aside.topic { + border: 1px solid #ccc; + padding: 7px; + margin: 10px 0 10px 0; +} + +p.topic-title { + font-size: 1.1em; + font-weight: bold; + margin-top: 10px; +} + +/* -- admonitions ----------------------------------------------------------- */ + +div.admonition { + margin-top: 10px; + margin-bottom: 10px; + padding: 7px; +} + +div.admonition dt { + font-weight: bold; +} + +p.admonition-title { + margin: 0px 10px 5px 0px; + font-weight: bold; +} + +div.body p.centered { + text-align: center; + margin-top: 25px; +} + +/* -- content of sidebars/topics/admonitions -------------------------------- */ + +div.sidebar > :last-child, +aside.sidebar > :last-child, +div.topic > :last-child, +aside.topic > :last-child, +div.admonition > :last-child { + margin-bottom: 0; +} + +div.sidebar::after, +aside.sidebar::after, +div.topic::after, +aside.topic::after, +div.admonition::after, +blockquote::after { + display: block; + content: ''; + clear: both; +} + +/* -- tables ---------------------------------------------------------------- */ + +table.docutils { + margin-top: 10px; + margin-bottom: 10px; + border: 0; + border-collapse: collapse; +} + +table.align-center { + margin-left: auto; + margin-right: auto; +} + +table.align-default { + margin-left: auto; + margin-right: auto; +} + +table caption span.caption-number { + font-style: italic; +} + +table caption span.caption-text { +} + +table.docutils td, table.docutils th { + padding: 1px 8px 1px 5px; + border-top: 0; + border-left: 0; + border-right: 0; + border-bottom: 1px solid #aaa; +} + +th { + text-align: left; + padding-right: 5px; +} + +table.citation { + border-left: solid 1px gray; + margin-left: 1px; +} + +table.citation td { + border-bottom: none; +} + +th > :first-child, +td > :first-child { + margin-top: 0px; +} + +th > :last-child, +td > :last-child { + margin-bottom: 0px; +} + +/* -- figures --------------------------------------------------------------- */ + +div.figure, figure { + margin: 0.5em; + padding: 0.5em; +} + +div.figure p.caption, figcaption { + padding: 0.3em; +} + +div.figure p.caption span.caption-number, +figcaption span.caption-number { + font-style: italic; +} + +div.figure p.caption span.caption-text, +figcaption span.caption-text { +} + +/* -- field list styles ----------------------------------------------------- */ + +table.field-list td, table.field-list th { + border: 0 !important; +} + +.field-list ul { + margin: 0; + padding-left: 1em; +} + +.field-list p { + margin: 0; +} + +.field-name { + -moz-hyphens: manual; + -ms-hyphens: manual; + -webkit-hyphens: manual; + hyphens: manual; +} + +/* -- hlist styles ---------------------------------------------------------- */ + +table.hlist { + margin: 1em 0; +} + +table.hlist td { + vertical-align: top; +} + +/* -- object description styles --------------------------------------------- */ + +.sig { + font-family: 'Consolas', 'Menlo', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; +} + +.sig-name, code.descname { + background-color: transparent; + font-weight: bold; +} + +.sig-name { + font-size: 1.1em; +} + +code.descname { + font-size: 1.2em; +} + +.sig-prename, code.descclassname { + background-color: transparent; +} + +.optional { + font-size: 1.3em; +} + +.sig-paren { + font-size: larger; +} + +.sig-param.n { + font-style: italic; +} + +/* C++ specific styling */ + +.sig-inline.c-texpr, +.sig-inline.cpp-texpr { + font-family: unset; +} + +.sig.c .k, .sig.c .kt, +.sig.cpp .k, .sig.cpp .kt { + color: #0033B3; +} + +.sig.c .m, +.sig.cpp .m { + color: #1750EB; +} + +.sig.c .s, .sig.c .sc, +.sig.cpp .s, .sig.cpp .sc { + color: #067D17; +} + + +/* -- other body styles ----------------------------------------------------- */ + +ol.arabic { + list-style: decimal; +} + +ol.loweralpha { + list-style: lower-alpha; +} + +ol.upperalpha { + list-style: upper-alpha; +} + +ol.lowerroman { + list-style: lower-roman; +} + +ol.upperroman { + list-style: upper-roman; +} + +:not(li) > ol > li:first-child > :first-child, +:not(li) > ul > li:first-child > :first-child { + margin-top: 0px; +} + +:not(li) > ol > li:last-child > :last-child, +:not(li) > ul > li:last-child > :last-child { + margin-bottom: 0px; +} + +ol.simple ol p, +ol.simple ul p, +ul.simple ol p, +ul.simple ul p { + margin-top: 0; +} + +ol.simple > li:not(:first-child) > p, +ul.simple > li:not(:first-child) > p { + margin-top: 0; +} + +ol.simple p, +ul.simple p { + margin-bottom: 0; +} + +/* Docutils 0.17 and older (footnotes & citations) */ +dl.footnote > dt, +dl.citation > dt { + float: left; + margin-right: 0.5em; +} + +dl.footnote > dd, +dl.citation > dd { + margin-bottom: 0em; +} + +dl.footnote > dd:after, +dl.citation > dd:after { + content: ""; + clear: both; +} + +/* Docutils 0.18+ (footnotes & citations) */ +aside.footnote > span, +div.citation > span { + float: left; +} +aside.footnote > span:last-of-type, +div.citation > span:last-of-type { + padding-right: 0.5em; +} +aside.footnote > p { + margin-left: 2em; +} +div.citation > p { + margin-left: 4em; +} +aside.footnote > p:last-of-type, +div.citation > p:last-of-type { + margin-bottom: 0em; +} +aside.footnote > p:last-of-type:after, +div.citation > p:last-of-type:after { + content: ""; + clear: both; +} + +/* Footnotes & citations ends */ + +dl.field-list { + display: grid; + grid-template-columns: fit-content(30%) auto; +} + +dl.field-list > dt { + font-weight: bold; + word-break: break-word; + padding-left: 0.5em; + padding-right: 5px; +} + +dl.field-list > dt:after { + content: ":"; +} + +dl.field-list > dd { + padding-left: 0.5em; + margin-top: 0em; + margin-left: 0em; + margin-bottom: 0em; +} + +dl { + margin-bottom: 15px; +} + +dd > :first-child { + margin-top: 0px; +} + +dd ul, dd table { + margin-bottom: 10px; +} + +dd { + margin-top: 3px; + margin-bottom: 10px; + margin-left: 30px; +} + +dl > dd:last-child, +dl > dd:last-child > :last-child { + margin-bottom: 0; +} + +dt:target, span.highlighted { + background-color: #fbe54e; +} + +rect.highlighted { + fill: #fbe54e; +} + +dl.glossary dt { + font-weight: bold; + font-size: 1.1em; +} + +.versionmodified { + font-style: italic; +} + +.system-message { + background-color: #fda; + padding: 5px; + border: 3px solid red; +} + +.footnote:target { + background-color: #ffa; +} + +.line-block { + display: block; + margin-top: 1em; + margin-bottom: 1em; +} + +.line-block .line-block { + margin-top: 0; + margin-bottom: 0; + margin-left: 1.5em; +} + +.guilabel, .menuselection { + font-family: sans-serif; +} + +.accelerator { + text-decoration: underline; +} + +.classifier { + font-style: oblique; +} + +.classifier:before { + font-style: normal; + margin: 0 0.5em; + content: ":"; + display: inline-block; +} + +abbr, acronym { + border-bottom: dotted 1px; + cursor: help; +} + +/* -- code displays --------------------------------------------------------- */ + +pre { + overflow: auto; + overflow-y: hidden; /* fixes display issues on Chrome browsers */ +} + +pre, div[class*="highlight-"] { + clear: both; +} + +span.pre { + -moz-hyphens: none; + -ms-hyphens: none; + -webkit-hyphens: none; + hyphens: none; + white-space: nowrap; +} + +div[class*="highlight-"] { + margin: 1em 0; +} + +td.linenos pre { + border: 0; + background-color: transparent; + color: #aaa; +} + +table.highlighttable { + display: block; +} + +table.highlighttable tbody { + display: block; +} + +table.highlighttable tr { + display: flex; +} + +table.highlighttable td { + margin: 0; + padding: 0; +} + +table.highlighttable td.linenos { + padding-right: 0.5em; +} + +table.highlighttable td.code { + flex: 1; + overflow: hidden; +} + +.highlight .hll { + display: block; +} + +div.highlight pre, +table.highlighttable pre { + margin: 0; +} + +div.code-block-caption + div { + margin-top: 0; +} + +div.code-block-caption { + margin-top: 1em; + padding: 2px 5px; + font-size: small; +} + +div.code-block-caption code { + background-color: transparent; +} + +table.highlighttable td.linenos, +span.linenos, +div.highlight span.gp { /* gp: Generic.Prompt */ + user-select: none; + -webkit-user-select: text; /* Safari fallback only */ + -webkit-user-select: none; /* Chrome/Safari */ + -moz-user-select: none; /* Firefox */ + -ms-user-select: none; /* IE10+ */ +} + +div.code-block-caption span.caption-number { + padding: 0.1em 0.3em; + font-style: italic; +} + +div.code-block-caption span.caption-text { +} + +div.literal-block-wrapper { + margin: 1em 0; +} + +code.xref, a code { + background-color: transparent; + font-weight: bold; +} + +h1 code, h2 code, h3 code, h4 code, h5 code, h6 code { + background-color: transparent; +} + +.viewcode-link { + float: right; +} + +.viewcode-back { + float: right; + font-family: sans-serif; +} + +div.viewcode-block:target { + margin: -1px -10px; + padding: 0 10px; +} + +/* -- math display ---------------------------------------------------------- */ + +img.math { + vertical-align: middle; +} + +div.body div.math p { + text-align: center; +} + +span.eqno { + float: right; +} + +span.eqno a.headerlink { + position: absolute; + z-index: 1; +} + +div.math:hover a.headerlink { + visibility: visible; +} + +/* -- printout stylesheet --------------------------------------------------- */ + +@media print { + div.document, + div.documentwrapper, + div.bodywrapper { + margin: 0 !important; + width: 100%; + } + + div.sphinxsidebar, + div.related, + div.footer, + #top-link { + display: none; + } +} \ No newline at end of file diff --git a/en/_static/css/theme.css b/en/_static/css/theme.css new file mode 100644 index 00000000..6c29bebe --- /dev/null +++ b/en/_static/css/theme.css @@ -0,0 +1 @@ +@charset "UTF-8";@import url("https://fonts.googleapis.com/css?family=Lora:400,700");@import url("https://fonts.googleapis.com/css?family=Roboto+Mono:400,700");@import url("https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700");.primary-bg{background-color:#06c}.primary-color{color:#06c}.primary-border-color,.primary-border-color.border{border-color:#06c!important}.white-bg{background-color:#fff}.white-color{color:#fff}.white-border-color-,.white-border-color-.border{border-color:#fff!important}.primary-bg-a1{background-color:#bfdfff}.primary-color-a1{color:#bfdfff}.primary-border-color-a1,.primary-border-color-a1.border{border-color:#bfdfff!important}.primary-bg-a2{background-color:#93c4f5}.primary-color-a2{color:#93c4f5}.primary-border-color-a2,.primary-border-color-a2.border{border-color:#93c4f5!important}.primary-bg-a3{background-color:#6aaaeb}.primary-color-a3{color:#6aaaeb}.primary-border-color-a3,.primary-border-color-a3.border{border-color:#6aaaeb!important}.primary-bg-a4{background-color:#4392e0}.primary-color-a4{color:#4392e0}.primary-border-color-a4,.primary-border-color-a4.border{border-color:#4392e0!important}.primary-bg-a5{background-color:#207bd6}.primary-color-a5{color:#207bd6}.primary-border-color-a5,.primary-border-color-a5.border{border-color:#207bd6!important}.primary-bg-a6{background-color:#06c}.primary-color-a6{color:#06c}.primary-border-color-a6,.primary-border-color-a6.border{border-color:#06c!important}.primary-bg-a7{background-color:#0059b3}.primary-color-a7{color:#0059b3}.primary-border-color-a7,.primary-border-color-a7.border{border-color:#0059b3!important}.primary-bg-a8{background-color:#004d99}.primary-color-a8{color:#004d99}.primary-border-color-a8,.primary-border-color-a8.border{border-color:#004d99!important}.primary-bg-a9{background-color:#004080}.primary-color-a9{color:#004080}.primary-border-color-a9,.primary-border-color-a9.border{border-color:#004080!important}.primary-bg-a10{background-color:#036}.primary-color-a10{color:#036}.primary-border-color-a10,.primary-border-color-a10.border{border-color:#036!important}.primary-bg-a11{background-color:#00264d}.primary-color-a11{color:#00264d}.primary-border-color-a11,.primary-border-color-a11.border{border-color:#00264d!important}.primary-bg-a12{background-color:#001a33}.primary-color-a12{color:#001a33}.primary-border-color-a12,.primary-border-color-a12.border{border-color:#001a33!important}.primary-bg-b1{background-color:#06c}.primary-color-b1{color:#06c}.primary-border-color-b1,.primary-border-color-b1.border{border-color:#06c!important}.primary-bg-b2{background-color:#1262b3}.primary-color-b2{color:#1262b3}.primary-border-color-b2,.primary-border-color-b2.border{border-color:#1262b3!important}.primary-bg-b3{background-color:#1f5c99}.primary-color-b3{color:#1f5c99}.primary-border-color-b3,.primary-border-color-b3.border{border-color:#1f5c99!important}.primary-bg-b4{background-color:#265380}.primary-color-b4{color:#265380}.primary-border-color-b4,.primary-border-color-b4.border{border-color:#265380!important}.primary-bg-b5{background-color:#294766}.primary-color-b5{color:#294766}.primary-border-color-b5,.primary-border-color-b5.border{border-color:#294766!important}.primary-bg-b6{background-color:#26394d}.primary-color-b6{color:#26394d}.primary-border-color-b6,.primary-border-color-b6.border{border-color:#26394d!important}.primary-bg-b7{background-color:#1f2933}.primary-color-b7{color:#1f2933}.primary-border-color-b7,.primary-border-color-b7.border{border-color:#1f2933!important}.primary-bg-b8{background-color:#12161a}.primary-color-b8{color:#12161a}.primary-border-color-b8,.primary-border-color-b8.border{border-color:#12161a!important}.primary-bg-c1{background-color:#dce9f5}.primary-color-c1{color:#dce9f5}.primary-border-color-c1,.primary-border-color-c1.border{border-color:#dce9f5!important}.primary-bg-c2{background-color:#c4dcf5}.primary-color-c2{color:#c4dcf5}.primary-border-color-c2,.primary-border-color-c2.border{border-color:#c4dcf5!important}.primary-bg-c3{background-color:#abd0f5}.primary-color-c3{color:#abd0f5}.primary-border-color-c3,.primary-border-color-c3.border{border-color:#abd0f5!important}.primary-bg-c4{background-color:#93c4f5}.primary-color-c4{color:#93c4f5}.primary-border-color-c4,.primary-border-color-c4.border{border-color:#93c4f5!important}.primary-bg-c5{background-color:#7ab8f5}.primary-color-c5{color:#7ab8f5}.primary-border-color-c5,.primary-border-color-c5.border{border-color:#7ab8f5!important}.primary-bg-c6{background-color:#62abf5}.primary-color-c6{color:#62abf5}.primary-border-color-c6,.primary-border-color-c6.border{border-color:#62abf5!important}.primary-bg-c7{background-color:#499ff5}.primary-color-c7{color:#499ff5}.primary-border-color-c7,.primary-border-color-c7.border{border-color:#499ff5!important}.primary-bg-c8{background-color:#3193f5}.primary-color-c8{color:#3193f5}.primary-border-color-c8,.primary-border-color-c8.border{border-color:#3193f5!important}.primary-bg-c9{background-color:#1887f5}.primary-color-c9{color:#1887f5}.primary-border-color-c9,.primary-border-color-c9.border{border-color:#1887f5!important}.primary-bg-c10{background-color:#007af5}.primary-color-c10{color:#007af5}.primary-border-color-c10,.primary-border-color-c10.border{border-color:#007af5!important}.primary-bg-c11{background-color:#0070e0}.primary-color-c11{color:#0070e0}.primary-border-color-c11,.primary-border-color-c11.border{border-color:#0070e0!important}.primary-bg-c12{background-color:#06c}.primary-color-c12{color:#06c}.primary-border-color-c12,.primary-border-color-c12.border{border-color:#06c!important}.analogue-1-bg-a1{background-color:#e7e6ff}.analogue-1-color-a1{color:#e7e6ff}.analogue-1-border-color-a1,.analogue-1-border-color-a1.border{border-color:#e7e6ff!important}.analogue-1-bg-a2{background-color:#bbb8f5}.analogue-1-color-a2{color:#bbb8f5}.analogue-1-border-color-a2,.analogue-1-border-color-a2.border{border-color:#bbb8f5!important}.analogue-1-bg-a3{background-color:#918deb}.analogue-1-color-a3{color:#918deb}.analogue-1-border-color-a3,.analogue-1-border-color-a3.border{border-color:#918deb!important}.analogue-1-bg-a4{background-color:#6b65e0}.analogue-1-color-a4{color:#6b65e0}.analogue-1-border-color-a4,.analogue-1-border-color-a4.border{border-color:#6b65e0!important}.analogue-1-bg-a5{background-color:#4840d6}.analogue-1-color-a5{color:#4840d6}.analogue-1-border-color-a5,.analogue-1-border-color-a5.border{border-color:#4840d6!important}.analogue-1-bg-a6{background-color:#271fcc}.analogue-1-color-a6{color:#271fcc}.analogue-1-border-color-a6,.analogue-1-border-color-a6.border{border-color:#271fcc!important}.analogue-1-bg-a7{background-color:#221bb3}.analogue-1-color-a7{color:#221bb3}.analogue-1-border-color-a7,.analogue-1-border-color-a7.border{border-color:#221bb3!important}.analogue-1-bg-a8{background-color:#1d1799}.analogue-1-color-a8{color:#1d1799}.analogue-1-border-color-a8,.analogue-1-border-color-a8.border{border-color:#1d1799!important}.analogue-1-bg-a9{background-color:#191380}.analogue-1-color-a9{color:#191380}.analogue-1-border-color-a9,.analogue-1-border-color-a9.border{border-color:#191380!important}.analogue-1-bg-a10{background-color:#140f66}.analogue-1-color-a10{color:#140f66}.analogue-1-border-color-a10,.analogue-1-border-color-a10.border{border-color:#140f66!important}.analogue-1-bg-a11{background-color:#0f0b4d}.analogue-1-color-a11{color:#0f0b4d}.analogue-1-border-color-a11,.analogue-1-border-color-a11.border{border-color:#0f0b4d!important}.analogue-1-bg-a12{background-color:#0a0833}.analogue-1-color-a12{color:#0a0833}.analogue-1-border-color-a12,.analogue-1-border-color-a12.border{border-color:#0a0833!important}.analogue-2-bg-a1{background-color:#ccfffd}.analogue-2-color-a1{color:#ccfffd}.analogue-2-border-color-a1,.analogue-2-border-color-a1.border{border-color:#ccfffd!important}.analogue-2-bg-a2{background-color:#9ff5f2}.analogue-2-color-a2{color:#9ff5f2}.analogue-2-border-color-a2,.analogue-2-border-color-a2.border{border-color:#9ff5f2!important}.analogue-2-bg-a3{background-color:#75ebe7}.analogue-2-color-a3{color:#75ebe7}.analogue-2-border-color-a3,.analogue-2-border-color-a3.border{border-color:#75ebe7!important}.analogue-2-bg-a4{background-color:#4fe0dc}.analogue-2-color-a4{color:#4fe0dc}.analogue-2-border-color-a4,.analogue-2-border-color-a4.border{border-color:#4fe0dc!important}.analogue-2-bg-a5{background-color:#2bd6d0}.analogue-2-color-a5{color:#2bd6d0}.analogue-2-border-color-a5,.analogue-2-border-color-a5.border{border-color:#2bd6d0!important}.analogue-2-bg-a6{background-color:#0accc6}.analogue-2-color-a6{color:#0accc6}.analogue-2-border-color-a6,.analogue-2-border-color-a6.border{border-color:#0accc6!important}.analogue-2-bg-a7{background-color:#09b3ad}.analogue-2-color-a7{color:#09b3ad}.analogue-2-border-color-a7,.analogue-2-border-color-a7.border{border-color:#09b3ad!important}.analogue-2-bg-a8{background-color:#089994}.analogue-2-color-a8{color:#089994}.analogue-2-border-color-a8,.analogue-2-border-color-a8.border{border-color:#089994!important}.analogue-2-bg-a9{background-color:#06807b}.analogue-2-color-a9{color:#06807b}.analogue-2-border-color-a9,.analogue-2-border-color-a9.border{border-color:#06807b!important}.analogue-2-bg-a10{background-color:#056663}.analogue-2-color-a10{color:#056663}.analogue-2-border-color-a10,.analogue-2-border-color-a10.border{border-color:#056663!important}.analogue-2-bg-a11{background-color:#044d4a}.analogue-2-color-a11{color:#044d4a}.analogue-2-border-color-a11,.analogue-2-border-color-a11.border{border-color:#044d4a!important}.analogue-2-bg-a12{background-color:#033331}.analogue-2-color-a12{color:#033331}.analogue-2-border-color-a12,.analogue-2-border-color-a12.border{border-color:#033331!important}.complementary-1-bg{background-color:#f73e5a}.complementary-1-color{color:#f90}.complementary-1-border-color-,.complementary-1-border-color-.border{border-color:#f73e5a!important}.complementary-1-bg-a1{background-color:#fffcfd}.complementary-1-color-a1{color:#fffcfd}.complementary-1-border-color-a1,.complementary-1-border-color-a1.border{border-color:#fffcfd!important}.complementary-1-bg-a2{background-color:#f5d0d6}.complementary-1-color-a2{color:#f5d0d6}.complementary-1-border-color-a2,.complementary-1-border-color-a2.border{border-color:#f5d0d6!important}.complementary-1-bg-a3{background-color:#eba4af}.complementary-1-color-a3{color:#eba4af}.complementary-1-border-color-a3,.complementary-1-border-color-a3.border{border-color:#eba4af!important}.complementary-1-bg-a4{background-color:#e07b8b}.complementary-1-color-a4{color:#e07b8b}.complementary-1-border-color-a4,.complementary-1-border-color-a4.border{border-color:#e07b8b!important}.complementary-1-bg-a5{background-color:#d65669}.complementary-1-color-a5{color:#d65669}.complementary-1-border-color-a5,.complementary-1-border-color-a5.border{border-color:#d65669!important}.complementary-1-bg-a6{background-color:#cc334a}.complementary-1-color-a6{color:#cc334a}.complementary-1-border-color-a6,.complementary-1-border-color-a6.border{border-color:#cc334a!important}.complementary-1-bg-a7{background-color:#b32d41}.complementary-1-color-a7{color:#b32d41}.complementary-1-border-color-a7,.complementary-1-border-color-a7.border{border-color:#b32d41!important}.complementary-1-bg-a8{background-color:#992637}.complementary-1-color-a8{color:#992637}.complementary-1-border-color-a8,.complementary-1-border-color-a8.border{border-color:#992637!important}.complementary-1-bg-a9{background-color:#80202e}.complementary-1-color-a9{color:#80202e}.complementary-1-border-color-a9,.complementary-1-border-color-a9.border{border-color:#80202e!important}.complementary-1-bg-a10{background-color:#661a25}.complementary-1-color-a10{color:#661a25}.complementary-1-border-color-a10,.complementary-1-border-color-a10.border{border-color:#661a25!important}.complementary-1-bg-a11{background-color:#4d131c}.complementary-1-color-a11{color:#4d131c}.complementary-1-border-color-a11,.complementary-1-border-color-a11.border{border-color:#4d131c!important}.complementary-1-bg-a12{background-color:#330d12}.complementary-1-color-a12{color:#330d12}.complementary-1-border-color-a12,.complementary-1-border-color-a12.border{border-color:#330d12!important}.complementary-2-bg{background-color:#f90}.complementary-2-color{color:#f90}.complementary-2-border-color-,.complementary-2-border-color-.border{border-color:#f90!important}.complementary-2-bg-a1{background-color:#ffe6bf}.complementary-2-color-a1{color:#ffe6bf}.complementary-2-border-color-a1,.complementary-2-border-color-a1.border{border-color:#ffe6bf!important}.complementary-2-bg-a2{background-color:#f5ce93}.complementary-2-color-a2{color:#f5ce93}.complementary-2-border-color-a2,.complementary-2-border-color-a2.border{border-color:#f5ce93!important}.complementary-2-bg-a3{background-color:#ebb76a}.complementary-2-color-a3{color:#ebb76a}.complementary-2-border-color-a3,.complementary-2-border-color-a3.border{border-color:#ebb76a!important}.complementary-2-bg-a4{background-color:#e0a243}.complementary-2-color-a4{color:#e0a243}.complementary-2-border-color-a4,.complementary-2-border-color-a4.border{border-color:#e0a243!important}.complementary-2-bg-a5{background-color:#d68d20}.complementary-2-color-a5{color:#d68d20}.complementary-2-border-color-a5,.complementary-2-border-color-a5.border{border-color:#d68d20!important}.complementary-2-bg-a6{background-color:#cc7a00}.complementary-2-color-a6{color:#cc7a00}.complementary-2-border-color-a6,.complementary-2-border-color-a6.border{border-color:#cc7a00!important}.complementary-2-bg-a7{background-color:#b36b00}.complementary-2-color-a7{color:#b36b00}.complementary-2-border-color-a7,.complementary-2-border-color-a7.border{border-color:#b36b00!important}.complementary-2-bg-a8{background-color:#995c00}.complementary-2-color-a8{color:#995c00}.complementary-2-border-color-a8,.complementary-2-border-color-a8.border{border-color:#995c00!important}.complementary-2-bg-a9{background-color:#804d00}.complementary-2-color-a9{color:#804d00}.complementary-2-border-color-a9,.complementary-2-border-color-a9.border{border-color:#804d00!important}.complementary-2-bg-a10{background-color:#663d00}.complementary-2-color-a10{color:#663d00}.complementary-2-border-color-a10,.complementary-2-border-color-a10.border{border-color:#663d00!important}.complementary-2-bg-a11{background-color:#4d2e00}.complementary-2-color-a11{color:#4d2e00}.complementary-2-border-color-a11,.complementary-2-border-color-a11.border{border-color:#4d2e00!important}.complementary-2-bg-a12{background-color:#331f00}.complementary-2-color-a12{color:#331f00}.complementary-2-border-color-a12,.complementary-2-border-color-a12.border{border-color:#331f00!important}.complementary-3-bg{background-color:#00cf86}.complementary-3-color{color:#00cf86}.complementary-3-border-color-,.complementary-3-border-color-.border{border-color:#00cf86!important}.complementary-3-bg-a1{background-color:#bfffe9}.complementary-3-color-a1{color:#bfffe9}.complementary-3-border-color-a1,.complementary-3-border-color-a1.border{border-color:#bfffe9!important}.complementary-3-bg-a2{background-color:#93f5d3}.complementary-3-color-a2{color:#93f5d3}.complementary-3-border-color-a2,.complementary-3-border-color-a2.border{border-color:#93f5d3!important}.complementary-3-bg-a3{background-color:#6aebbd}.complementary-3-color-a3{color:#6aebbd}.complementary-3-border-color-a3,.complementary-3-border-color-a3.border{border-color:#6aebbd!important}.complementary-3-bg-a4{background-color:#43e0a9}.complementary-3-color-a4{color:#43e0a9}.complementary-3-border-color-a4,.complementary-3-border-color-a4.border{border-color:#43e0a9!important}.complementary-3-bg-a5{background-color:#20d696}.complementary-3-color-a5{color:#20d696}.complementary-3-border-color-a5,.complementary-3-border-color-a5.border{border-color:#20d696!important}.complementary-3-bg-a6{background-color:#00cc85}.complementary-3-color-a6{color:#00cc85}.complementary-3-border-color-a6,.complementary-3-border-color-a6.border{border-color:#00cc85!important}.complementary-3-bg-a7{background-color:#00b374}.complementary-3-color-a7{color:#00b374}.complementary-3-border-color-a7,.complementary-3-border-color-a7.border{border-color:#00b374!important}.complementary-3-bg-a8{background-color:#009963}.complementary-3-color-a8{color:#009963}.complementary-3-border-color-a8,.complementary-3-border-color-a8.border{border-color:#009963!important}.complementary-3-bg-a9{background-color:#008053}.complementary-3-color-a9{color:#008053}.complementary-3-border-color-a9,.complementary-3-border-color-a9.border{border-color:#008053!important}.complementary-3-bg-a10{background-color:#006642}.complementary-3-color-a10{color:#006642}.complementary-3-border-color-a10,.complementary-3-border-color-a10.border{border-color:#006642!important}.complementary-3-bg-a11{background-color:#004d32}.complementary-3-color-a11{color:#004d32}.complementary-3-border-color-a11,.complementary-3-border-color-a11.border{border-color:#004d32!important}.complementary-3-bg-a12{background-color:#003321}.complementary-3-color-a12{color:#003321}.complementary-3-border-color-a12,.complementary-3-border-color-a12.border{border-color:#003321!important}.analogue-1-bg{background-color:#3126ff}.analogue-1-color{color:#3126ff}.analogue-1-border-color-,.analogue-1-border-color-.border{border-color:#3126ff!important}.analogue-1-bg-b1{background-color:#3126ff}.analogue-1-color-b1{color:#3126ff}.analogue-1-border-color-b1,.analogue-1-border-color-b1.border{border-color:#3126ff!important}.analogue-1-bg-b2{background-color:#4239e6}.analogue-1-color-b2{color:#4239e6}.analogue-1-border-color-b2,.analogue-1-border-color-b2.border{border-color:#4239e6!important}.analogue-1-bg-b3{background-color:#4e47cc}.analogue-1-color-b3{color:#4e47cc}.analogue-1-border-color-b3,.analogue-1-border-color-b3.border{border-color:#4e47cc!important}.analogue-1-bg-b4{background-color:#5550b3}.analogue-1-color-b4{color:#5550b3}.analogue-1-border-color-b4,.analogue-1-border-color-b4.border{border-color:#5550b3!important}.analogue-1-bg-b5{background-color:#585499}.analogue-1-color-b5{color:#585499}.analogue-1-border-color-b5,.analogue-1-border-color-b5.border{border-color:#585499!important}.analogue-1-bg-b6{background-color:#555380}.analogue-1-color-b6{color:#555380}.analogue-1-border-color-b6,.analogue-1-border-color-b6.border{border-color:#555380!important}.analogue-1-bg-b7{background-color:#4e4d66}.analogue-1-color-b7{color:#4e4d66}.analogue-1-border-color-b7,.analogue-1-border-color-b7.border{border-color:#4e4d66!important}.analogue-1-bg-b8{background-color:#42414d}.analogue-1-color-b8{color:#42414d}.analogue-1-border-color-b8,.analogue-1-border-color-b8.border{border-color:#42414d!important}.analogue-2-bg{background-color:#0bd9d2}.analogue-2-color{color:#0bd9d2}.analogue-2-border-color-,.analogue-2-border-color-.border{border-color:#0bd9d2!important}.analogue-2-bg-b1{background-color:#0bd9d2}.analogue-2-color-b1{color:#0bd9d2}.analogue-2-border-color-b1,.analogue-2-border-color-b1.border{border-color:#0bd9d2!important}.analogue-2-bg-b2{background-color:#1dbfba}.analogue-2-color-b2{color:#1dbfba}.analogue-2-border-color-b2,.analogue-2-border-color-b2.border{border-color:#1dbfba!important}.analogue-2-bg-b3{background-color:#29a6a2}.analogue-2-color-b3{color:#29a6a2}.analogue-2-border-color-b3,.analogue-2-border-color-b3.border{border-color:#29a6a2!important}.analogue-2-bg-b4{background-color:#318c89}.analogue-2-color-b4{color:#318c89}.analogue-2-border-color-b4,.analogue-2-border-color-b4.border{border-color:#318c89!important}.analogue-2-bg-b5{background-color:#347371}.analogue-2-color-b5{color:#347371}.analogue-2-border-color-b5,.analogue-2-border-color-b5.border{border-color:#347371!important}.analogue-2-bg-b6{background-color:#315958}.analogue-2-color-b6{color:#315958}.analogue-2-border-color-b6,.analogue-2-border-color-b6.border{border-color:#315958!important}.analogue-2-bg-b7{background-color:#29403f}.analogue-2-color-b7{color:#29403f}.analogue-2-border-color-b7,.analogue-2-border-color-b7.border{border-color:#29403f!important}.analogue-2-bg-b8{background-color:#1d2626}.analogue-2-color-b8{color:#1d2626}.analogue-2-border-color-b8,.analogue-2-border-color-b8.border{border-color:#1d2626!important}.complementary-1-bg-b1{background-color:#f73e5a}.complementary-1-color-b1{color:#f73e5a}.complementary-1-border-color-b1,.complementary-1-border-color-b1.border{border-color:#f73e5a!important}.complementary-1-bg-b2{background-color:#de4e63}.complementary-1-color-b2{color:#de4e63}.complementary-1-border-color-b2,.complementary-1-border-color-b2.border{border-color:#de4e63!important}.complementary-1-bg-b3{background-color:#c45869}.complementary-1-color-b3{color:#c45869}.complementary-1-border-color-b3,.complementary-1-border-color-b3.border{border-color:#c45869!important}.complementary-1-bg-b4{background-color:#ab5e69}.complementary-1-color-b4{color:#ab5e69}.complementary-1-border-color-b4,.complementary-1-border-color-b4.border{border-color:#ab5e69!important}.complementary-1-bg-b5{background-color:#915e66}.complementary-1-color-b5{color:#915e66}.complementary-1-border-color-b5,.complementary-1-border-color-b5.border{border-color:#915e66!important}.complementary-1-bg-b6{background-color:#785a5e}.complementary-1-color-b6{color:#785a5e}.complementary-1-border-color-b6,.complementary-1-border-color-b6.border{border-color:#785a5e!important}.complementary-1-bg-b7{background-color:#5e5052}.complementary-1-color-b7{color:#5e5052}.complementary-1-border-color-b7,.complementary-1-border-color-b7.border{border-color:#5e5052!important}.complementary-1-bg-b8{background-color:#454142}.complementary-1-color-b8{color:#454142}.complementary-1-border-color-b8,.complementary-1-border-color-b8.border{border-color:#454142!important}.complementary-2-bg-b1{background-color:#f90}.complementary-2-color-b1{color:#f90}.complementary-2-border-color-b1,.complementary-2-border-color-b1.border{border-color:#f90!important}.complementary-2-bg-b2{background-color:#e69317}.complementary-2-color-b2{color:#e69317}.complementary-2-border-color-b2,.complementary-2-border-color-b2.border{border-color:#e69317!important}.complementary-2-bg-b3{background-color:#cc8b29}.complementary-2-color-b3{color:#cc8b29}.complementary-2-border-color-b3,.complementary-2-border-color-b3.border{border-color:#cc8b29!important}.complementary-2-bg-b4{background-color:#b38136}.complementary-2-color-b4{color:#b38136}.complementary-2-border-color-b4,.complementary-2-border-color-b4.border{border-color:#b38136!important}.complementary-2-bg-b5{background-color:#99743d}.complementary-2-color-b5{color:#99743d}.complementary-2-border-color-b5,.complementary-2-border-color-b5.border{border-color:#99743d!important}.complementary-2-bg-b6{background-color:#806640}.complementary-2-color-b6{color:#806640}.complementary-2-border-color-b6,.complementary-2-border-color-b6.border{border-color:#806640!important}.complementary-2-bg-b7{background-color:#66563d}.complementary-2-color-b7{color:#66563d}.complementary-2-border-color-b7,.complementary-2-border-color-b7.border{border-color:#66563d!important}.complementary-2-bg-b8{background-color:#4d4336}.complementary-2-color-b8{color:#4d4336}.complementary-2-border-color-b8,.complementary-2-border-color-b8.border{border-color:#4d4336!important}.complementary-3-bg-b1{background-color:#00cf86}.complementary-3-color-b1{color:#00cf86}.complementary-3-border-color-b1,.complementary-3-border-color-b1.border{border-color:#00cf86!important}.complementary-3-bg-b2{background-color:#12b57c}.complementary-3-color-b2{color:#12b57c}.complementary-3-border-color-b2,.complementary-3-border-color-b2.border{border-color:#12b57c!important}.complementary-3-bg-b3{background-color:#1f9c70}.complementary-3-color-b3{color:#1f9c70}.complementary-3-border-color-b3,.complementary-3-border-color-b3.border{border-color:#1f9c70!important}.complementary-3-bg-b4{background-color:#278262}.complementary-3-color-b4{color:#278262}.complementary-3-border-color-b4,.complementary-3-border-color-b4.border{border-color:#278262!important}.complementary-3-bg-b5{background-color:#2a6953}.complementary-3-color-b5{color:#2a6953}.complementary-3-border-color-b5,.complementary-3-border-color-b5.border{border-color:#2a6953!important}.complementary-3-bg-b6{background-color:#284f41}.complementary-3-color-b6{color:#284f41}.complementary-3-border-color-b6,.complementary-3-border-color-b6.border{border-color:#284f41!important}.complementary-3-bg-b7{background-color:#20362e}.complementary-3-color-b7{color:#20362e}.complementary-3-border-color-b7,.complementary-3-border-color-b7.border{border-color:#20362e!important}.complementary-3-bg-b8{background-color:#141c19}.complementary-3-color-b8{color:#141c19}.complementary-3-border-color-b8,.complementary-3-border-color-b8.border{border-color:#141c19!important}.neutral-1-bg{background-color:#17324d}.neutral-1-color{color:#17324d}.neutral-1-border-color-,.neutral-1-border-color-.border{border-color:#17324d!important}.neutral-1-bg-a1{background-color:#ebeced}.neutral-1-color-a1{color:#ebeced}.neutral-1-border-color-a1,.neutral-1-border-color-a1.border{border-color:#ebeced!important}.neutral-1-bg-a2{background-color:#d9dadb}.neutral-1-color-a2{color:#d9dadb}.neutral-1-border-color-a2,.neutral-1-border-color-a2.border{border-color:#d9dadb!important}.neutral-1-bg-a3{background-color:#c5c7c9}.neutral-1-color-a3{color:#c5c7c9}.neutral-1-border-color-a3,.neutral-1-border-color-a3.border{border-color:#c5c7c9!important}.neutral-1-bg-a4{background-color:#adb2b8}.neutral-1-color-a4{color:#adb2b8}.neutral-1-border-color-a4,.neutral-1-border-color-a4.border{border-color:#adb2b8!important}.neutral-1-bg-a5{background-color:#959da6}.neutral-1-color-a5{color:#959da6}.neutral-1-border-color-a5,.neutral-1-border-color-a5.border{border-color:#959da6!important}.neutral-1-bg-a6{background-color:#768594}.neutral-1-color-a6{color:#768594}.neutral-1-border-color-a6,.neutral-1-border-color-a6.border{border-color:#768594!important}.neutral-1-bg-a7{background-color:#5b6f82}.neutral-1-color-a7{color:#5b6f82}.neutral-1-border-color-a7,.neutral-1-border-color-a7.border{border-color:#5b6f82!important}.neutral-1-bg-a8{background-color:#435a70}.neutral-1-color-a8{color:#435a70}.neutral-1-border-color-a8,.neutral-1-border-color-a8.border{border-color:#435a70!important}.neutral-1-bg-a9{background-color:#2f475e}.neutral-1-color-a9{color:#2f475e}.neutral-1-border-color-a9,.neutral-1-border-color-a9.border{border-color:#2f475e!important}.neutral-1-bg-a10{background-color:#17324d}.neutral-1-color-a10{color:#17324d}.neutral-1-border-color-a10,.neutral-1-border-color-a10.border{border-color:#17324d!important}.neutral-2-bg{background-color:#e6ecf2}.neutral-2-color{color:#e6ecf2}.neutral-2-border-color-{border-color:#e6ecf2}.neutral-2-bg-b1{background-color:#e6ecf2}.neutral-2-color-b1{color:#e6ecf2}.neutral-2-border-color-b1,.neutral-2-border-color-b1.border{border-color:#e6ecf2!important}.neutral-2-bg-b2{background-color:#c2c7cc}.neutral-2-color-b2{color:#c2c7cc}.neutral-2-border-color-b2,.neutral-2-border-color-b2.border{border-color:#c2c7cc!important}.neutral-2-bg-b3{background-color:#9da2a6}.neutral-2-color-b3{color:#9da2a6}.neutral-2-border-color-b3,.neutral-2-border-color-b3.border{border-color:#9da2a6!important}.neutral-2-bg-b4{background-color:#797c80}.neutral-2-color-b4{color:#797c80}.neutral-2-border-color-b4,.neutral-2-border-color-b4.border{border-color:#797c80!important}.neutral-2-bg-b5{background-color:#565759}.neutral-2-color-b5{color:#565759}.neutral-2-border-color-b5,.neutral-2-border-color-b5.border{border-color:#565759!important}.neutral-2-bg-b6{background-color:#2f3133}.neutral-2-color-b6{color:#2f3133}.neutral-2-border-color-b6,.neutral-2-border-color-b6.border{border-color:#2f3133!important}.neutral-2-bg-b7{background-color:#0c0c0d}.neutral-2-color-b7{color:#0c0c0d}.neutral-2-border-color-b7,.neutral-2-border-color-b7.border{border-color:#0c0c0d!important}.neutral-2-bg-a1{background-color:#e6ecf2}.neutral-2-color-a1{color:#e6ecf2}.neutral-2-border-color-a1,.neutral-2-border-color-a1.border{border-color:#e6ecf2!important}.neutral-2-bg-a2{background-color:#bcc4cc}.neutral-2-color-a2{color:#bcc4cc}.neutral-2-border-color-a2,.neutral-2-border-color-a2.border{border-color:#bcc4cc!important}.neutral-2-bg-a3{background-color:#9aa0a6}.neutral-2-color-a3{color:#9aa0a6}.neutral-2-border-color-a3,.neutral-2-border-color-a3.border{border-color:#9aa0a6!important}.neutral-2-bg-a4{background-color:#777b80}.neutral-2-color-a4{color:#777b80}.neutral-2-border-color-a4,.neutral-2-border-color-a4.border{border-color:#777b80!important}.neutral-2-bg-a5{background-color:#535659}.neutral-2-color-a5{color:#535659}.neutral-2-border-color-a5,.neutral-2-border-color-a5.border{border-color:#535659!important}.neutral-2-bg-a6{background-color:#2f3133}.neutral-2-color-a6{color:#2f3133}.neutral-2-border-color-a6,.neutral-2-border-color-a6.border{border-color:#2f3133!important}.neutral-2-bg-a7{background-color:#17181a}.neutral-2-color-a7{color:#17181a}.neutral-2-border-color-a7,.neutral-2-border-color-a7.border{border-color:#17181a!important}.lightgrey-bg-a1{background-color:#e8f2fc}.lightgrey-color-a1{color:#e8f2fc}.lightgrey-border-color-a1,.lightgrey-border-color-a1.border{border-color:#e8f2fc!important}.lightgrey-bg-a2{background-color:#edf5fc}.lightgrey-color-a2{color:#edf5fc}.lightgrey-border-color-a2,.lightgrey-border-color-a2.border{border-color:#edf5fc!important}.lightgrey-bg-a3{background-color:#f2f7fc}.lightgrey-color-a3{color:#f2f7fc}.lightgrey-border-color-a3,.lightgrey-border-color-a3.border{border-color:#f2f7fc!important}.lightgrey-bg-a4{background-color:#f5f9fc}.lightgrey-color-a4{color:#f5f9fc}.lightgrey-border-color-a4,.lightgrey-border-color-a4.border{border-color:#f5f9fc!important}.lightgrey-bg-b1{background-color:#e6f0fa}.lightgrey-color-b1{color:#e6f0fa}.lightgrey-border-color-b1,.lightgrey-border-color-b1.border{border-color:#e6f0fa!important}.lightgrey-bg-b2{background-color:#ebf2fa}.lightgrey-color-b2{color:#ebf2fa}.lightgrey-border-color-b2,.lightgrey-border-color-b2.border{border-color:#ebf2fa!important}.lightgrey-bg-b3{background-color:#edf4fa}.lightgrey-color-b3{color:#edf4fa}.lightgrey-border-color-b3,.lightgrey-border-color-b3.border{border-color:#edf4fa!important}.lightgrey-bg-b4{background-color:#f2f6fa}.lightgrey-color-b4{color:#f2f6fa}.lightgrey-border-color-b4,.lightgrey-border-color-b4.border{border-color:#f2f6fa!important}.lightgrey-bg-c1{background-color:#f7f9fa}.lightgrey-color-c1{color:#f7f9fa}.lightgrey-border-color-c1,.lightgrey-border-color-c1.border{border-color:#f7f9fa!important}.lightgrey-bg-c2{background-color:#f5f6f7}.lightgrey-color-c2{color:#f5f6f7}.lightgrey-border-color-c2,.lightgrey-border-color-c2.border{border-color:#f5f6f7!important}:root{--blue:#0073e6;--indigo:#554dff;--purple:#9e99ff;--pink:#ffb3bf;--red:#f73e5a;--orange:#f90;--yellow:#ffda73;--green:#00cc85;--teal:#0bd9d2;--cyan:#00fff7;--white:#fff;--gray:#656566;--gray-dark:#323333;--italia:#06c;--gray-secondary:#5c6f82;--gray-tertiary:#5a768a;--gray-quaternary:#fcfdff;--primary:#0073e6;--secondary:#5c6f82;--success:#00cc85;--info:#979899;--warning:#f90;--danger:#f73e5a;--light:#e9e6f2;--dark:#17324d;--100:#e3e4e6;--200:#cacacc;--300:#b1b1b3;--400:#979899;--500:#7e7f80;--600:#656566;--700:#4c4c4d;--800:#323333;--900:#19191a;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:"Titillium Web",Geneva,Tahoma,sans-serif;--font-family-monospace:"Roboto Mono",monospace}@media print{*,:after,:before{text-shadow:none!important;-webkit-box-shadow:none!important;box-shadow:none!important}a:not(.btn){text-decoration:underline}abbr[title]:after{content:" (" attr(title) ")"}pre{white-space:pre-wrap!important}blockquote,pre{border:1px solid #7e7f80;page-break-inside:avoid}thead{display:table-header-group}img,tr{page-break-inside:avoid}h2,h3,p{orphans:3;widows:3}h2,h3{page-break-after:avoid}@page{size:a3}.container,body{min-width:992px!important}.navbar{display:none}.badge{border:1px solid #000}.table{border-collapse:collapse!important}.table td,.table th{background-color:#fff!important}.table-bordered td,.table-bordered th{border:1px solid #b1b1b3!important}.table-dark{color:inherit}.table-dark tbody+tbody,.table-dark td,.table-dark th,.table-dark thead th{border-color:#d6dce3}.table .thead-dark th{color:inherit;border-color:#d6dce3}}*,:after,:before{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:rgba(0,0,0,0)}article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;font-family:Titillium Web,Geneva,Tahoma,sans-serif;font-size:16px;font-size:1rem;font-weight:300;line-height:1.5;color:#19191a;text-align:left;background-color:#fff}[tabindex="-1"]:focus{outline:0!important}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:8px}p{margin-top:0;margin-bottom:1rem}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0;text-decoration-skip-ink:none}address{font-style:normal;line-height:inherit}address,dl,ol,ul{margin-bottom:1rem}dl,ol,ul{margin-top:0}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}a{color:#0073e6;text-decoration:none;background-color:transparent}a:hover{color:#004d99;text-decoration:underline}a:not([href]):not([tabindex]),a:not([href]):not([tabindex]):focus,a:not([href]):not([tabindex]):hover{color:inherit;text-decoration:none}a:not([href]):not([tabindex]):focus{outline:0}code,kbd,pre,samp{font-family:Roboto Mono,monospace;font-size:1em}pre{margin-top:0;margin-bottom:1rem;overflow:auto}figure{margin:0 0 1rem}img{border-style:none}img,svg{vertical-align:middle}svg{overflow:hidden}table{border-collapse:collapse}caption{padding-top:1em;padding-bottom:1em;color:#5a768a;text-align:left;caption-side:bottom}th{text-align:inherit}label{display:inline-block;margin-bottom:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,input{overflow:visible}button,select{text-transform:none}select{word-wrap:normal}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]:not(:disabled),[type=reset]:not(:disabled),[type=submit]:not(:disabled),button:not(:disabled){cursor:pointer}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{padding:0;border-style:none}input[type=checkbox],input[type=radio]{-webkit-box-sizing:border-box;box-sizing:border-box;padding:0}input[type=date],input[type=datetime-local],input[type=month],input[type=time]{-webkit-appearance:listbox}textarea{overflow:auto;resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{display:block;width:100%;max-width:100%;padding:0;margin-bottom:.5rem;font-size:24px;font-size:1.5rem;line-height:inherit;color:inherit;white-space:normal}progress{vertical-align:baseline}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{outline-offset:-2px;-webkit-appearance:none}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}output{display:inline-block}summary{display:list-item;cursor:pointer}template{display:none}[hidden]{display:none!important}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{margin-bottom:8px;font-weight:700;line-height:1.2}.h1,h1{font-size:40px;font-size:2.5rem}.h2,h2{font-size:32px;font-size:2rem}.h3,h3{font-size:28px;font-size:1.75rem}.h4,h4{font-size:24px;font-size:1.5rem}.h5,h5{font-size:20px;font-size:1.25rem}.h6,h6{font-size:16px;font-size:1rem}.lead{font-size:20px;font-size:1.25rem;font-weight:300}.display-1{font-size:56px;font-size:3.5rem}.display-1,.display-2{font-weight:700;line-height:1.2}.display-2{font-size:40px;font-size:2.5rem}.display-3{font-size:24px;font-size:1.5rem}.display-3,.display-4{font-weight:700;line-height:1.2}.display-4{font-size:20px;font-size:1.25rem}hr{margin-top:16px;margin-bottom:16px;border:0;border-top:1px solid rgba(0,0,0,.1)}.small,small{font-size:12.432px;font-size:.777rem}.mark,mark{padding:.2em;background-color:#fcf8e3}.list-inline,.list-unstyled{padding-left:0;list-style:none}.list-inline-item{display:inline-block}.list-inline-item:not(:last-child){margin-right:.5rem}.initialism{font-size:90%;text-transform:uppercase}.blockquote{margin-bottom:16px;font-size:20px;font-size:1.25rem}.blockquote-footer{display:block;font-size:12.432px;font-size:.777rem}.blockquote-footer:before{content:"\2014\00A0"}.img-fluid,.img-thumbnail{max-width:100%;height:auto}.img-thumbnail{padding:.25rem;background-color:#fff;border:1px solid #b1b1b3;border-radius:4px;-webkit-box-shadow:0 1px 2px rgba(0,0,0,.075);box-shadow:0 1px 2px rgba(0,0,0,.075)}.figure{display:inline-block}.figure-img{margin-bottom:8px;line-height:1}.figure-caption{font-size:90%;color:#656566}code{font-size:87.5%;color:#17324d;word-break:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:87.5%;color:#fff;background-color:#19191a;border-radius:2px;-webkit-box-shadow:inset 0 -.1rem 0 rgba(0,0,0,.25);box-shadow:inset 0 -.1rem 0 rgba(0,0,0,.25)}kbd kbd{padding:0;font-size:100%;font-weight:700;-webkit-box-shadow:none;box-shadow:none}pre{display:block;font-size:87.5%;color:#19191a}pre code{font-size:inherit;color:inherit;word-break:normal}.pre-scrollable{max-height:340px;overflow-y:scroll}.container{width:100%;padding-right:6px;padding-left:6px;margin-right:auto;margin-left:auto}@media (min-width:576px){.container{max-width:540px}}@media (min-width:768px){.container{max-width:720px}}@media (min-width:992px){.container{max-width:960px}}@media (min-width:1200px){.container{max-width:1140px}}.container-fluid{width:100%;padding-right:6px;padding-left:6px;margin-right:auto;margin-left:auto}.row{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;margin-right:-6px;margin-left:-6px}.no-gutters{margin-right:0;margin-left:0}.no-gutters>.col,.no-gutters>[class*=col-]{padding-right:0;padding-left:0}.col,.col-1,.col-2,.col-3,.col-4,.col-5,.col-6,.col-7,.col-8,.col-9,.col-10,.col-11,.col-12,.col-auto,.col-lg,.col-lg-1,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg-auto,.col-md,.col-md-1,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-md-10,.col-md-11,.col-md-12,.col-md-auto,.col-sm,.col-sm-1,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-auto,.col-xl,.col-xl-1,.col-xl-2,.col-xl-3,.col-xl-4,.col-xl-5,.col-xl-6,.col-xl-7,.col-xl-8,.col-xl-9,.col-xl-10,.col-xl-11,.col-xl-12,.col-xl-auto{position:relative;width:100%;padding-right:6px;padding-left:6px}.col{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-auto{-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-1,.col-auto{-webkit-box-flex:0}.col-1{-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-2{-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-2,.col-3{-webkit-box-flex:0}.col-3{-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-4{-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-4,.col-5{-webkit-box-flex:0}.col-5{-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-6{-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-6,.col-7{-webkit-box-flex:0}.col-7{-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-8{-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-8,.col-9{-webkit-box-flex:0}.col-9{-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-10{-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-10,.col-11{-webkit-box-flex:0}.col-11{-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-1{margin-left:8.3333333333%}.offset-2{margin-left:16.6666666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.3333333333%}.offset-5{margin-left:41.6666666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.3333333333%}.offset-8{margin-left:66.6666666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.3333333333%}.offset-11{margin-left:91.6666666667%}@media (min-width:576px){.col-sm{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-sm-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-sm-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-sm-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-sm-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-sm-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-sm-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-sm-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-sm-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-sm-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-sm-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-sm-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-sm-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-sm-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-sm-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-sm-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-sm-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-sm-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-sm-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-sm-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-sm-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-sm-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-sm-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-sm-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-sm-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-sm-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-sm-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-sm-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-sm-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-sm-0{margin-left:0}.offset-sm-1{margin-left:8.3333333333%}.offset-sm-2{margin-left:16.6666666667%}.offset-sm-3{margin-left:25%}.offset-sm-4{margin-left:33.3333333333%}.offset-sm-5{margin-left:41.6666666667%}.offset-sm-6{margin-left:50%}.offset-sm-7{margin-left:58.3333333333%}.offset-sm-8{margin-left:66.6666666667%}.offset-sm-9{margin-left:75%}.offset-sm-10{margin-left:83.3333333333%}.offset-sm-11{margin-left:91.6666666667%}}@media (min-width:768px){.col-md{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-md-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-md-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-md-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-md-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-md-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-md-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-md-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-md-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-md-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-md-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-md-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-md-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-md-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-md-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-md-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-md-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-md-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-md-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-md-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-md-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-md-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-md-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-md-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-md-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-md-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-md-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-md-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-md-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-md-0{margin-left:0}.offset-md-1{margin-left:8.3333333333%}.offset-md-2{margin-left:16.6666666667%}.offset-md-3{margin-left:25%}.offset-md-4{margin-left:33.3333333333%}.offset-md-5{margin-left:41.6666666667%}.offset-md-6{margin-left:50%}.offset-md-7{margin-left:58.3333333333%}.offset-md-8{margin-left:66.6666666667%}.offset-md-9{margin-left:75%}.offset-md-10{margin-left:83.3333333333%}.offset-md-11{margin-left:91.6666666667%}}@media (min-width:992px){.col-lg{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-lg-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-lg-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-lg-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-lg-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-lg-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-lg-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-lg-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-lg-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-lg-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-lg-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-lg-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-lg-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-lg-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-lg-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-lg-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-lg-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-lg-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-lg-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-lg-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-lg-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-lg-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-lg-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-lg-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-lg-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-lg-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-lg-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-lg-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-lg-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-lg-0{margin-left:0}.offset-lg-1{margin-left:8.3333333333%}.offset-lg-2{margin-left:16.6666666667%}.offset-lg-3{margin-left:25%}.offset-lg-4{margin-left:33.3333333333%}.offset-lg-5{margin-left:41.6666666667%}.offset-lg-6{margin-left:50%}.offset-lg-7{margin-left:58.3333333333%}.offset-lg-8{margin-left:66.6666666667%}.offset-lg-9{margin-left:75%}.offset-lg-10{margin-left:83.3333333333%}.offset-lg-11{margin-left:91.6666666667%}}@media (min-width:1200px){.col-xl{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-xl-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-xl-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-xl-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-xl-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-xl-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-xl-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-xl-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-xl-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-xl-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-xl-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-xl-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-xl-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-xl-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-xl-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-xl-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-xl-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-xl-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-xl-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-xl-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-xl-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-xl-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-xl-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-xl-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-xl-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-xl-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-xl-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-xl-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-xl-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-xl-0{margin-left:0}.offset-xl-1{margin-left:8.3333333333%}.offset-xl-2{margin-left:16.6666666667%}.offset-xl-3{margin-left:25%}.offset-xl-4{margin-left:33.3333333333%}.offset-xl-5{margin-left:41.6666666667%}.offset-xl-6{margin-left:50%}.offset-xl-7{margin-left:58.3333333333%}.offset-xl-8{margin-left:66.6666666667%}.offset-xl-9{margin-left:75%}.offset-xl-10{margin-left:83.3333333333%}.offset-xl-11{margin-left:91.6666666667%}}.table{width:100%;margin-bottom:16px;color:#19191a}.table td,.table th{padding:1em;vertical-align:top;border-top:1px solid #d6dce3}.table thead th{vertical-align:bottom;border-bottom:2px solid #d6dce3}.table tbody+tbody{border-top:2px solid #d6dce3}.table-sm td,.table-sm th{padding:.3rem}.table-bordered,.table-bordered td,.table-bordered th{border:1px solid #d6dce3}.table-bordered thead td,.table-bordered thead th{border-bottom-width:2px}.table-borderless tbody+tbody,.table-borderless td,.table-borderless th,.table-borderless thead th{border:0}.table-striped tbody tr:nth-of-type(odd){background-color:#f6f7f9}.table-hover tbody tr:hover{color:#19191a;background-color:#e5f1fa}.table-primary,.table-primary>td,.table-primary>th{background-color:#b8d8f8}.table-primary tbody+tbody,.table-primary td,.table-primary th,.table-primary thead th{border-color:#7ab6f2}.table-hover .table-primary:hover,.table-hover .table-primary:hover>td,.table-hover .table-primary:hover>th{background-color:#a1cbf6}.table-secondary,.table-secondary>td,.table-secondary>th{background-color:#d1d7dc}.table-secondary tbody+tbody,.table-secondary td,.table-secondary th,.table-secondary thead th{border-color:#aab4be}.table-hover .table-secondary:hover,.table-hover .table-secondary:hover>td,.table-hover .table-secondary:hover>th{background-color:#c3cad1}.table-success,.table-success>td,.table-success>th{background-color:#b8f1dd}.table-success tbody+tbody,.table-success td,.table-success th,.table-success thead th{border-color:#7ae4c0}.table-hover .table-success:hover,.table-hover .table-success:hover>td,.table-hover .table-success:hover>th{background-color:#a3edd3}.table-info,.table-info>td,.table-info>th{background-color:#e2e2e2}.table-info tbody+tbody,.table-info td,.table-info th,.table-info thead th{border-color:#c9c9ca}.table-hover .table-info:hover,.table-hover .table-info:hover>td,.table-hover .table-info:hover>th{background-color:#d5d5d5}.table-warning,.table-warning>td,.table-warning>th{background-color:#ffe2b8}.table-warning tbody+tbody,.table-warning td,.table-warning th,.table-warning thead th{border-color:#ffca7a}.table-hover .table-warning:hover,.table-hover .table-warning:hover>td,.table-hover .table-warning:hover>th{background-color:#ffd89f}.table-danger,.table-danger>td,.table-danger>th{background-color:#fdc9d1}.table-danger tbody+tbody,.table-danger td,.table-danger th,.table-danger thead th{border-color:#fb9ba9}.table-hover .table-danger:hover,.table-hover .table-danger:hover>td,.table-hover .table-danger:hover>th{background-color:#fcb0bc}.table-light,.table-light>td,.table-light>th{background-color:#f9f8fb}.table-light tbody+tbody,.table-light td,.table-light th,.table-light thead th{border-color:#f4f2f8}.table-hover .table-light:hover,.table-hover .table-light:hover>td,.table-hover .table-light:hover>th{background-color:#ebe8f2}.table-dark,.table-dark>td,.table-dark>th{background-color:#bec6cd}.table-dark tbody+tbody,.table-dark td,.table-dark th,.table-dark thead th{border-color:#8694a2}.table-hover .table-dark:hover,.table-hover .table-dark:hover>td,.table-hover .table-dark:hover>th{background-color:#b0b9c2}.table-100,.table-100>td,.table-100>th{background-color:#f7f7f8}.table-100 tbody+tbody,.table-100 td,.table-100 th,.table-100 thead th{border-color:#f0f1f2}.table-hover .table-100:hover,.table-hover .table-100:hover>td,.table-hover .table-100:hover>th{background-color:#e9e9ec}.table-200,.table-200>td,.table-200>th{background-color:#f0f0f1}.table-200 tbody+tbody,.table-200 td,.table-200 th,.table-200 thead th{border-color:#e3e3e4}.table-hover .table-200:hover,.table-hover .table-200:hover>td,.table-hover .table-200:hover>th{background-color:#e3e3e5}.table-300,.table-300>td,.table-300>th{background-color:#e9e9ea}.table-300 tbody+tbody,.table-300 td,.table-300 th,.table-300 thead th{border-color:#d6d6d7}.table-hover .table-300:hover,.table-hover .table-300:hover>td,.table-hover .table-300:hover>th{background-color:#dcdcde}.table-400,.table-400>td,.table-400>th{background-color:#e2e2e2}.table-400 tbody+tbody,.table-400 td,.table-400 th,.table-400 thead th{border-color:#c9c9ca}.table-hover .table-400:hover,.table-hover .table-400:hover>td,.table-hover .table-400:hover>th{background-color:#d5d5d5}.table-500,.table-500>td,.table-500>th{background-color:#dbdbdb}.table-500 tbody+tbody,.table-500 td,.table-500 th,.table-500 thead th{border-color:#bcbcbd}.table-hover .table-500:hover,.table-hover .table-500:hover>td,.table-hover .table-500:hover>th{background-color:#cecece}.table-600,.table-600>td,.table-600>th{background-color:#d4d4d4}.table-600 tbody+tbody,.table-600 td,.table-600 th,.table-600 thead th{border-color:#afafaf}.table-hover .table-600:hover,.table-hover .table-600:hover>td,.table-hover .table-600:hover>th{background-color:#c7c7c7}.table-700,.table-700>td,.table-700>th{background-color:#cdcdcd}.table-700 tbody+tbody,.table-700 td,.table-700 th,.table-700 thead th{border-color:#a2a2a2}.table-hover .table-700:hover,.table-hover .table-700:hover>td,.table-hover .table-700:hover>th{background-color:silver}.table-800,.table-800>td,.table-800>th{background-color:#c6c6c6}.table-800 tbody+tbody,.table-800 td,.table-800 th,.table-800 thead th{border-color:#949595}.table-hover .table-800:hover,.table-hover .table-800:hover>td,.table-hover .table-800:hover>th{background-color:#b9b9b9}.table-900,.table-900>td,.table-900>th{background-color:#bfbfbf}.table-900 tbody+tbody,.table-900 td,.table-900 th,.table-900 thead th{border-color:#878788}.table-hover .table-900:hover,.table-hover .table-900:hover>td,.table-hover .table-900:hover>th{background-color:#b2b2b2}.table-active,.table-active>td,.table-active>th{background-color:#e5f1fa}.table-hover .table-active:hover,.table-hover .table-active:hover>td,.table-hover .table-active:hover>th{background-color:#d0e5f6}.table .thead-dark th{color:#fff;background-color:#323333;border-color:#464646}.table .thead-light th{color:#4c4c4d;background-color:#cacacc;border-color:#d6dce3}.table-dark{color:#fff;background-color:#323333}.table-dark td,.table-dark th,.table-dark thead th{border-color:#464646}.table-dark.table-bordered{border:0}.table-dark.table-striped tbody tr:nth-of-type(odd){background-color:hsla(0,0%,100%,.05)}.table-dark.table-hover tbody tr:hover{color:#fff;background-color:hsla(0,0%,100%,.075)}@media (max-width:575.98px){.table-responsive-sm{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-sm>.table-bordered{border:0}}@media (max-width:767.98px){.table-responsive-md{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-md>.table-bordered{border:0}}@media (max-width:991.98px){.table-responsive-lg{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-lg>.table-bordered{border:0}}@media (max-width:1199.98px){.table-responsive-xl{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-xl>.table-bordered{border:0}}.table-responsive{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive>.table-bordered{border:0}.form-control{display:block;width:100%;height:calc(1.5em + .75rem + 2px);padding:.375rem .75rem;font-size:16px;font-size:1rem;font-weight:300;line-height:1.5;color:#4c4c4d;background-color:#fff;background-clip:padding-box;border:1px solid #979899;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075);-webkit-transition:border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-control{-webkit-transition:none;transition:none}}.form-control::-ms-expand{background-color:transparent;border:0}.form-control:focus{color:#4c4c4d;background-color:#fff;border-color:#5c6f82;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.25);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.25)}.form-control::-webkit-input-placeholder{color:#656566;opacity:1}.form-control::-moz-placeholder{color:#656566;opacity:1}.form-control::-ms-input-placeholder{color:#656566;opacity:1}.form-control::placeholder{color:#656566;opacity:1}.form-control:disabled,.form-control[readonly]{background-color:#cacacc;opacity:1}select.form-control:focus::-ms-value{color:#4c4c4d;background-color:#fff}.form-control-file,.form-control-range{display:block;width:100%}.col-form-label{padding-top:calc(.375rem + 1px);padding-bottom:calc(.375rem + 1px);margin-bottom:0;font-size:inherit;line-height:1.5}.col-form-label-lg{padding-top:calc(.5rem + 1px);padding-bottom:calc(.5rem + 1px);font-size:20px;font-size:1.25rem;line-height:1.556}.col-form-label-sm{padding-top:calc(.25rem + 1px);padding-bottom:calc(.25rem + 1px);font-size:14px;font-size:.875rem;line-height:1.428}.form-control-plaintext{display:block;width:100%;padding-top:.375rem;padding-bottom:.375rem;margin-bottom:0;line-height:1.5;color:#19191a;background-color:transparent;border:solid transparent;border-width:1px 0}.form-control-plaintext.form-control-lg,.form-control-plaintext.form-control-sm{padding-right:0;padding-left:0}.form-control-sm{height:calc(1.428em + .5rem + 2px);padding:.25rem .5rem;font-size:14px;font-size:.875rem;line-height:1.428;border-radius:2px}.form-control-lg{height:calc(1.556em + 1rem + 2px);padding:.5rem 1rem;font-size:20px;font-size:1.25rem;line-height:1.556;border-radius:8px}select.form-control[multiple],select.form-control[size],textarea.form-control{height:auto}.form-group{margin-bottom:1rem}.form-text{display:block;margin-top:.25rem}.form-row{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;margin-right:-5px;margin-left:-5px}.form-row>.col,.form-row>[class*=col-]{padding-right:5px;padding-left:5px}.form-check{position:relative;display:block;padding-left:1.25rem}.form-check-input{position:absolute;margin-top:.3rem;margin-left:-1.25rem}.form-check-input:disabled~.form-check-label{color:#5a768a}.form-check-label{margin-bottom:0}.form-check-inline{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding-left:0;margin-right:.75rem}.form-check-inline .form-check-input{position:static;margin-top:0;margin-right:.3125rem;margin-left:0}.valid-feedback{display:none;width:100%;margin-top:.25rem;font-size:12.432px;font-size:.777rem;color:#00cc85}.valid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:1rem;margin-top:.1rem;font-size:14px;font-size:.875rem;line-height:1.5;color:#19191a;background-color:#00cc85;border-radius:4px}.form-control.is-valid,.was-validated .form-control:valid{border-color:#00cc85;padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%2300cc85' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3E%3C/svg%3E");background-repeat:no-repeat;background-position:100% calc(.375em + .1875rem);background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-valid:focus,.was-validated .form-control:valid:focus{border-color:#00cc85;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.form-control.is-valid~.valid-feedback,.form-control.is-valid~.valid-tooltip,.was-validated .form-control:valid~.valid-feedback,.was-validated .form-control:valid~.valid-tooltip{display:block}.was-validated textarea.form-control:valid,textarea.form-control.is-valid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.custom-select.is-valid,.was-validated .custom-select:valid{border-color:#00cc85;padding-right:calc((3em + 2.25rem)/4 + 1.75rem);background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23323333' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px,url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%2300cc85' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3E%3C/svg%3E") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)}.custom-select.is-valid:focus,.was-validated .custom-select:valid:focus{border-color:#00cc85;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.custom-select.is-valid~.valid-feedback,.custom-select.is-valid~.valid-tooltip,.form-control-file.is-valid~.valid-feedback,.form-control-file.is-valid~.valid-tooltip,.was-validated .custom-select:valid~.valid-feedback,.was-validated .custom-select:valid~.valid-tooltip,.was-validated .form-control-file:valid~.valid-feedback,.was-validated .form-control-file:valid~.valid-tooltip{display:block}.form-check-input.is-valid~.form-check-label,.was-validated .form-check-input:valid~.form-check-label{color:#00cc85}.form-check-input.is-valid~.valid-feedback,.form-check-input.is-valid~.valid-tooltip,.was-validated .form-check-input:valid~.valid-feedback,.was-validated .form-check-input:valid~.valid-tooltip{display:block}.custom-control-input.is-valid~.custom-control-label,.was-validated .custom-control-input:valid~.custom-control-label{color:#00cc85}.custom-control-input.is-valid~.custom-control-label:before,.was-validated .custom-control-input:valid~.custom-control-label:before{border-color:#00cc85}.custom-control-input.is-valid~.valid-feedback,.custom-control-input.is-valid~.valid-tooltip,.was-validated .custom-control-input:valid~.valid-feedback,.was-validated .custom-control-input:valid~.valid-tooltip{display:block}.custom-control-input.is-valid:checked~.custom-control-label:before,.was-validated .custom-control-input:valid:checked~.custom-control-label:before{border-color:#00ffa6;background-color:#00ffa6}.custom-control-input.is-valid:focus~.custom-control-label:before,.was-validated .custom-control-input:valid:focus~.custom-control-label:before{-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.custom-control-input.is-valid:focus:not(:checked)~.custom-control-label:before,.custom-file-input.is-valid~.custom-file-label,.was-validated .custom-control-input:valid:focus:not(:checked)~.custom-control-label:before,.was-validated .custom-file-input:valid~.custom-file-label{border-color:#00cc85}.custom-file-input.is-valid~.valid-feedback,.custom-file-input.is-valid~.valid-tooltip,.was-validated .custom-file-input:valid~.valid-feedback,.was-validated .custom-file-input:valid~.valid-tooltip{display:block}.custom-file-input.is-valid:focus~.custom-file-label,.was-validated .custom-file-input:valid:focus~.custom-file-label{border-color:#00cc85;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.invalid-feedback{display:none;width:100%;margin-top:.25rem;font-size:12.432px;font-size:.777rem;color:#f73e5a}.invalid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:1rem;margin-top:.1rem;font-size:14px;font-size:.875rem;line-height:1.5;color:#19191a;background-color:#f73e5a;border-radius:4px}.form-control.is-invalid,.was-validated .form-control:invalid{border-color:#f73e5a;padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f73e5a' viewBox='-2 -2 7 7'%3E%3Cpath stroke='%23f73e5a' d='M0 0l3 3m0-3L0 3'/%3E%3Ccircle r='.5'/%3E%3Ccircle cx='3' r='.5'/%3E%3Ccircle cy='3' r='.5'/%3E%3Ccircle cx='3' cy='3' r='.5'/%3E%3C/svg%3E");background-repeat:no-repeat;background-position:100% calc(.375em + .1875rem);background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-invalid:focus,.was-validated .form-control:invalid:focus{border-color:#f73e5a;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.form-control.is-invalid~.invalid-feedback,.form-control.is-invalid~.invalid-tooltip,.was-validated .form-control:invalid~.invalid-feedback,.was-validated .form-control:invalid~.invalid-tooltip{display:block}.was-validated textarea.form-control:invalid,textarea.form-control.is-invalid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.custom-select.is-invalid,.was-validated .custom-select:invalid{border-color:#f73e5a;padding-right:calc((3em + 2.25rem)/4 + 1.75rem);background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23323333' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px,url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f73e5a' viewBox='-2 -2 7 7'%3E%3Cpath stroke='%23f73e5a' d='M0 0l3 3m0-3L0 3'/%3E%3Ccircle r='.5'/%3E%3Ccircle cx='3' r='.5'/%3E%3Ccircle cy='3' r='.5'/%3E%3Ccircle cx='3' cy='3' r='.5'/%3E%3C/svg%3E") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)}.custom-select.is-invalid:focus,.was-validated .custom-select:invalid:focus{border-color:#f73e5a;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.custom-select.is-invalid~.invalid-feedback,.custom-select.is-invalid~.invalid-tooltip,.form-control-file.is-invalid~.invalid-feedback,.form-control-file.is-invalid~.invalid-tooltip,.was-validated .custom-select:invalid~.invalid-feedback,.was-validated .custom-select:invalid~.invalid-tooltip,.was-validated .form-control-file:invalid~.invalid-feedback,.was-validated .form-control-file:invalid~.invalid-tooltip{display:block}.form-check-input.is-invalid~.form-check-label,.was-validated .form-check-input:invalid~.form-check-label{color:#f73e5a}.form-check-input.is-invalid~.invalid-feedback,.form-check-input.is-invalid~.invalid-tooltip,.was-validated .form-check-input:invalid~.invalid-feedback,.was-validated .form-check-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid~.custom-control-label,.was-validated .custom-control-input:invalid~.custom-control-label{color:#f73e5a}.custom-control-input.is-invalid~.custom-control-label:before,.was-validated .custom-control-input:invalid~.custom-control-label:before{border-color:#f73e5a}.custom-control-input.is-invalid~.invalid-feedback,.custom-control-input.is-invalid~.invalid-tooltip,.was-validated .custom-control-input:invalid~.invalid-feedback,.was-validated .custom-control-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid:checked~.custom-control-label:before,.was-validated .custom-control-input:invalid:checked~.custom-control-label:before{border-color:#f96f84;background-color:#f96f84}.custom-control-input.is-invalid:focus~.custom-control-label:before,.was-validated .custom-control-input:invalid:focus~.custom-control-label:before{-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.custom-control-input.is-invalid:focus:not(:checked)~.custom-control-label:before,.custom-file-input.is-invalid~.custom-file-label,.was-validated .custom-control-input:invalid:focus:not(:checked)~.custom-control-label:before,.was-validated .custom-file-input:invalid~.custom-file-label{border-color:#f73e5a}.custom-file-input.is-invalid~.invalid-feedback,.custom-file-input.is-invalid~.invalid-tooltip,.was-validated .custom-file-input:invalid~.invalid-feedback,.was-validated .custom-file-input:invalid~.invalid-tooltip{display:block}.custom-file-input.is-invalid:focus~.custom-file-label,.was-validated .custom-file-input:invalid:focus~.custom-file-label{border-color:#f73e5a;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.form-inline{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.form-inline .form-check{width:100%}@media (min-width:576px){.form-inline label{-ms-flex-align:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.form-inline .form-group,.form-inline label{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;align-items:center;margin-bottom:0}.form-inline .form-group{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;-ms-flex-align:center}.form-inline .form-control{display:inline-block;width:auto;vertical-align:middle}.form-inline .form-control-plaintext{display:inline-block}.form-inline .custom-select,.form-inline .input-group{width:auto}.form-inline .form-check{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:auto;padding-left:0}.form-inline .form-check-input{position:relative;-ms-flex-negative:0;flex-shrink:0;margin-top:0;margin-right:.25rem;margin-left:0}.form-inline .custom-control{-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.form-inline .custom-control-label{margin-bottom:0}}.btn{display:inline-block;font-weight:600;color:#19191a;text-align:center;vertical-align:middle;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;background-color:transparent;border:0 solid transparent;padding:.375rem .75rem;font-size:1rem;line-height:1.5;border-radius:4px;-webkit-transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.btn{-webkit-transition:none;transition:none}}.btn:hover{color:#19191a;text-decoration:none}.btn.focus,.btn:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.25);box-shadow:0 0 0 .2rem rgba(0,115,230,.25)}.btn.disabled,.btn:disabled{opacity:.65;-webkit-box-shadow:none;box-shadow:none}.btn:not(:disabled):not(.disabled).active,.btn:not(:disabled):not(.disabled):active{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125);box-shadow:inset 0 3px 5px rgba(0,0,0,.125)}.btn:not(:disabled):not(.disabled).active:focus,.btn:not(:disabled):not(.disabled):active:focus{-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.25),inset 0 3px 5px rgba(0,0,0,.125);box-shadow:0 0 0 .2rem rgba(0,115,230,.25),inset 0 3px 5px rgba(0,0,0,.125)}a.btn.disabled,fieldset:disabled a.btn{pointer-events:none}.btn-primary{color:#fff;background-color:#0073e6;border-color:#0073e6;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-primary:hover{color:#fff;background-color:#0060bf;border-color:#0059b3}.btn-primary.focus,.btn-primary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5)}.btn-primary.disabled,.btn-primary:disabled{color:#fff;background-color:#0073e6;border-color:#0073e6}.btn-primary:not(:disabled):not(.disabled).active,.btn-primary:not(:disabled):not(.disabled):active,.show>.btn-primary.dropdown-toggle{color:#fff;background-color:#0059b3;border-color:#0053a6}.btn-primary:not(:disabled):not(.disabled).active:focus,.btn-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5)}.btn-secondary{color:#fff;background-color:#5c6f82;border-color:#5c6f82;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-secondary:hover{color:#fff;background-color:#4c5c6c;border-color:#475664}.btn-secondary.focus,.btn-secondary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(92,111,130,.5)}.btn-secondary.disabled,.btn-secondary:disabled{color:#fff;background-color:#5c6f82;border-color:#5c6f82}.btn-secondary:not(:disabled):not(.disabled).active,.btn-secondary:not(:disabled):not(.disabled):active,.show>.btn-secondary.dropdown-toggle{color:#fff;background-color:#475664;border-color:#424f5d}.btn-secondary:not(:disabled):not(.disabled).active:focus,.btn-secondary:not(:disabled):not(.disabled):active:focus,.show>.btn-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5)}.btn-success{color:#19191a;background-color:#00cc85;border-color:#00cc85;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-success:hover{color:#fff;background-color:#00a66c;border-color:#009963}.btn-success.focus,.btn-success:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,204,133,.5)}.btn-success.disabled,.btn-success:disabled{color:#19191a;background-color:#00cc85;border-color:#00cc85}.btn-success:not(:disabled):not(.disabled).active,.btn-success:not(:disabled):not(.disabled):active,.show>.btn-success.dropdown-toggle{color:#fff;background-color:#009963;border-color:#008c5b}.btn-success:not(:disabled):not(.disabled).active:focus,.btn-success:not(:disabled):not(.disabled):active:focus,.show>.btn-success.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5)}.btn-info{color:#19191a;background-color:#979899;border-color:#979899;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-info:hover{color:#19191a;background-color:#848586;border-color:#7e7e80}.btn-info.focus,.btn-info:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5)}.btn-info.disabled,.btn-info:disabled{color:#19191a;background-color:#979899;border-color:#979899}.btn-info:not(:disabled):not(.disabled).active,.btn-info:not(:disabled):not(.disabled):active,.show>.btn-info.dropdown-toggle{color:#19191a;background-color:#7e7e80;border-color:#777879}.btn-info:not(:disabled):not(.disabled).active:focus,.btn-info:not(:disabled):not(.disabled):active:focus,.show>.btn-info.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-warning{color:#19191a;background-color:#f90;border-color:#f90;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-warning:hover{color:#19191a;background-color:#d98200;border-color:#cc7a00}.btn-warning.focus,.btn-warning:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(255,153,0,.5)}.btn-warning.disabled,.btn-warning:disabled{color:#19191a;background-color:#f90;border-color:#f90}.btn-warning:not(:disabled):not(.disabled).active,.btn-warning:not(:disabled):not(.disabled):active,.show>.btn-warning.dropdown-toggle{color:#19191a;background-color:#cc7a00;border-color:#bf7300}.btn-warning:not(:disabled):not(.disabled).active:focus,.btn-warning:not(:disabled):not(.disabled):active:focus,.show>.btn-warning.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5)}.btn-danger{color:#19191a;background-color:#f73e5a;border-color:#f73e5a;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-danger:hover{color:#fff;background-color:#f6193a;border-color:#f50d30}.btn-danger.focus,.btn-danger:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(247,62,90,.5)}.btn-danger.disabled,.btn-danger:disabled{color:#19191a;background-color:#f73e5a;border-color:#f73e5a}.btn-danger:not(:disabled):not(.disabled).active,.btn-danger:not(:disabled):not(.disabled):active,.show>.btn-danger.dropdown-toggle{color:#fff;background-color:#f50d30;border-color:#ec092b}.btn-danger:not(:disabled):not(.disabled).active:focus,.btn-danger:not(:disabled):not(.disabled):active:focus,.show>.btn-danger.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5)}.btn-light{color:#19191a;background-color:#e9e6f2;border-color:#e9e6f2;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-light:hover{color:#19191a;background-color:#d3cde5;border-color:#ccc4e1}.btn-light.focus,.btn-light:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(233,230,242,.5)}.btn-light.disabled,.btn-light:disabled{color:#19191a;background-color:#e9e6f2;border-color:#e9e6f2}.btn-light:not(:disabled):not(.disabled).active,.btn-light:not(:disabled):not(.disabled):active,.show>.btn-light.dropdown-toggle{color:#19191a;background-color:#ccc4e1;border-color:#c4bcdd}.btn-light:not(:disabled):not(.disabled).active:focus,.btn-light:not(:disabled):not(.disabled):active:focus,.show>.btn-light.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5)}.btn-dark{color:#fff;background-color:#17324d;border-color:#17324d;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-dark:hover{color:#fff;background-color:#0e1f2f;border-color:#0b1825}.btn-dark.focus,.btn-dark:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(23,50,77,.5)}.btn-dark.disabled,.btn-dark:disabled{color:#fff;background-color:#17324d;border-color:#17324d}.btn-dark:not(:disabled):not(.disabled).active,.btn-dark:not(:disabled):not(.disabled):active,.show>.btn-dark.dropdown-toggle{color:#fff;background-color:#0b1825;border-color:#08121b}.btn-dark:not(:disabled):not(.disabled).active:focus,.btn-dark:not(:disabled):not(.disabled):active:focus,.show>.btn-dark.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5)}.btn-100{color:#19191a;background-color:#e3e4e6;border-color:#e3e4e6;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-100:hover{color:#19191a;background-color:#cfd0d3;border-color:#c9cacd}.btn-100.focus,.btn-100:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(227,228,230,.5)}.btn-100.disabled,.btn-100:disabled{color:#19191a;background-color:#e3e4e6;border-color:#e3e4e6}.btn-100:not(:disabled):not(.disabled).active,.btn-100:not(:disabled):not(.disabled):active,.show>.btn-100.dropdown-toggle{color:#19191a;background-color:#c9cacd;border-color:#c2c3c7}.btn-100:not(:disabled):not(.disabled).active:focus,.btn-100:not(:disabled):not(.disabled):active:focus,.show>.btn-100.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5)}.btn-200{color:#19191a;background-color:#cacacc;border-color:#cacacc;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-200:hover{color:#19191a;background-color:#b6b7b9;border-color:#b0b1b3}.btn-200.focus,.btn-200:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(202,202,204,.5)}.btn-200.disabled,.btn-200:disabled{color:#19191a;background-color:#cacacc;border-color:#cacacc}.btn-200:not(:disabled):not(.disabled).active,.btn-200:not(:disabled):not(.disabled):active,.show>.btn-200.dropdown-toggle{color:#19191a;background-color:#b0b1b3;border-color:#a9aaad}.btn-200:not(:disabled):not(.disabled).active:focus,.btn-200:not(:disabled):not(.disabled):active:focus,.show>.btn-200.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5)}.btn-300{color:#19191a;background-color:#b1b1b3;border-color:#b1b1b3;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-300:hover{color:#19191a;background-color:#9d9ea0;border-color:#979899}.btn-300.focus,.btn-300:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(177,177,179,.5)}.btn-300.disabled,.btn-300:disabled{color:#19191a;background-color:#b1b1b3;border-color:#b1b1b3}.btn-300:not(:disabled):not(.disabled).active,.btn-300:not(:disabled):not(.disabled):active,.show>.btn-300.dropdown-toggle{color:#19191a;background-color:#979899;border-color:#909193}.btn-300:not(:disabled):not(.disabled).active:focus,.btn-300:not(:disabled):not(.disabled):active:focus,.show>.btn-300.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5)}.btn-400{color:#19191a;background-color:#979899;border-color:#979899;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-400:hover{color:#19191a;background-color:#848586;border-color:#7e7e80}.btn-400.focus,.btn-400:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5)}.btn-400.disabled,.btn-400:disabled{color:#19191a;background-color:#979899;border-color:#979899}.btn-400:not(:disabled):not(.disabled).active,.btn-400:not(:disabled):not(.disabled):active,.show>.btn-400.dropdown-toggle{color:#19191a;background-color:#7e7e80;border-color:#777879}.btn-400:not(:disabled):not(.disabled).active:focus,.btn-400:not(:disabled):not(.disabled):active:focus,.show>.btn-400.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-500{color:#19191a;background-color:#7e7f80;border-color:#7e7f80;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-500:hover{color:#fff;background-color:#6b6b6c;border-color:#656566}.btn-500.focus,.btn-500:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(126,127,128,.5)}.btn-500.disabled,.btn-500:disabled{color:#19191a;background-color:#7e7f80;border-color:#7e7f80}.btn-500:not(:disabled):not(.disabled).active,.btn-500:not(:disabled):not(.disabled):active,.show>.btn-500.dropdown-toggle{color:#fff;background-color:#656566;border-color:#5f5f5f}.btn-500:not(:disabled):not(.disabled).active:focus,.btn-500:not(:disabled):not(.disabled):active:focus,.show>.btn-500.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5)}.btn-600{color:#fff;background-color:#656566;border-color:#656566;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-600:hover{color:#fff;background-color:#525253;border-color:#4c4c4c}.btn-600.focus,.btn-600:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(101,101,102,.5)}.btn-600.disabled,.btn-600:disabled{color:#fff;background-color:#656566;border-color:#656566}.btn-600:not(:disabled):not(.disabled).active,.btn-600:not(:disabled):not(.disabled):active,.show>.btn-600.dropdown-toggle{color:#fff;background-color:#4c4c4c;border-color:#454546}.btn-600:not(:disabled):not(.disabled).active:focus,.btn-600:not(:disabled):not(.disabled):active:focus,.show>.btn-600.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5)}.btn-700{color:#fff;background-color:#4c4c4d;border-color:#4c4c4d;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-700:hover{color:#fff;background-color:#393939;border-color:#323233}.btn-700.focus,.btn-700:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(76,76,77,.5)}.btn-700.disabled,.btn-700:disabled{color:#fff;background-color:#4c4c4d;border-color:#4c4c4d}.btn-700:not(:disabled):not(.disabled).active,.btn-700:not(:disabled):not(.disabled):active,.show>.btn-700.dropdown-toggle{color:#fff;background-color:#323233;border-color:#2c2c2c}.btn-700:not(:disabled):not(.disabled).active:focus,.btn-700:not(:disabled):not(.disabled):active:focus,.show>.btn-700.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5)}.btn-800{color:#fff;background-color:#323333;border-color:#323333;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-800:hover{color:#fff;background-color:#1f2020;border-color:#191919}.btn-800.focus,.btn-800:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(50,51,51,.5)}.btn-800.disabled,.btn-800:disabled{color:#fff;background-color:#323333;border-color:#323333}.btn-800:not(:disabled):not(.disabled).active,.btn-800:not(:disabled):not(.disabled):active,.show>.btn-800.dropdown-toggle{color:#fff;background-color:#191919;border-color:#131313}.btn-800:not(:disabled):not(.disabled).active:focus,.btn-800:not(:disabled):not(.disabled):active:focus,.show>.btn-800.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5)}.btn-900{color:#fff;background-color:#19191a;border-color:#19191a;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-900:hover{color:#fff;background-color:#060606;border-color:#000}.btn-900.focus,.btn-900:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(25,25,26,.5)}.btn-900.disabled,.btn-900:disabled{color:#fff;background-color:#19191a;border-color:#19191a}.btn-900:not(:disabled):not(.disabled).active,.btn-900:not(:disabled):not(.disabled):active,.show>.btn-900.dropdown-toggle{color:#fff;background-color:#000;border-color:#000}.btn-900:not(:disabled):not(.disabled).active:focus,.btn-900:not(:disabled):not(.disabled):active:focus,.show>.btn-900.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5)}.btn-outline-primary{color:#0073e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #0073e6;box-shadow:inset 0 0 0 1px #0073e6}.btn-outline-primary:hover{color:#0959aa;-webkit-box-shadow:inset 0 0 0 1px #0959aa;box-shadow:inset 0 0 0 1px #0959aa}.btn-outline-primary.focus,.btn-outline-primary:focus{-webkit-box-shadow:inset 0 0 0 1px #0073e6,0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 0 0 1px #0073e6,0 0 0 .2rem rgba(0,115,230,.5)}.btn-outline-primary.disabled,.btn-outline-primary:disabled{color:#0073e6;background-color:transparent}.btn-outline-primary:not(:disabled):not(.disabled).active,.btn-outline-primary:not(:disabled):not(.disabled):active,.show>.btn-outline-primary.dropdown-toggle{color:#0073e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #0073e6;box-shadow:inset 0 0 0 1px #0073e6}.btn-outline-primary:not(:disabled):not(.disabled).active:focus,.btn-outline-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5)}.btn-outline-secondary{color:#5c6f82;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #5c6f82;box-shadow:inset 0 0 0 1px #5c6f82}.btn-outline-secondary:hover{color:#50565c;-webkit-box-shadow:inset 0 0 0 1px #50565c;box-shadow:inset 0 0 0 1px #50565c}.btn-outline-secondary.focus,.btn-outline-secondary:focus{-webkit-box-shadow:inset 0 0 0 1px #5c6f82,0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 0 0 1px #5c6f82,0 0 0 .2rem rgba(92,111,130,.5)}.btn-outline-secondary.disabled,.btn-outline-secondary:disabled{color:#5c6f82;background-color:transparent}.btn-outline-secondary:not(:disabled):not(.disabled).active,.btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.btn-outline-secondary.dropdown-toggle{color:#5c6f82;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #5c6f82;box-shadow:inset 0 0 0 1px #5c6f82}.btn-outline-secondary:not(:disabled):not(.disabled).active:focus,.btn-outline-secondary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5)}.btn-outline-success{color:#00cc85;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #00cc85;box-shadow:inset 0 0 0 1px #00cc85}.btn-outline-success:hover{color:#089161;-webkit-box-shadow:inset 0 0 0 1px #089161;box-shadow:inset 0 0 0 1px #089161}.btn-outline-success.focus,.btn-outline-success:focus{-webkit-box-shadow:inset 0 0 0 1px #00cc85,0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 0 0 1px #00cc85,0 0 0 .2rem rgba(0,204,133,.5)}.btn-outline-success.disabled,.btn-outline-success:disabled{color:#00cc85;background-color:transparent}.btn-outline-success:not(:disabled):not(.disabled).active,.btn-outline-success:not(:disabled):not(.disabled):active,.show>.btn-outline-success.dropdown-toggle{color:#00cc85;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #00cc85;box-shadow:inset 0 0 0 1px #00cc85}.btn-outline-success:not(:disabled):not(.disabled).active:focus,.btn-outline-success:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-success.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5)}.btn-outline-info{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-info:hover{color:#7f7f7f;-webkit-box-shadow:inset 0 0 0 1px #7f7f7f;box-shadow:inset 0 0 0 1px #7f7f7f}.btn-outline-info.focus,.btn-outline-info:focus{-webkit-box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-info.disabled,.btn-outline-info:disabled{color:#979899;background-color:transparent}.btn-outline-info:not(:disabled):not(.disabled).active,.btn-outline-info:not(:disabled):not(.disabled):active,.show>.btn-outline-info.dropdown-toggle{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-info:not(:disabled):not(.disabled).active:focus,.btn-outline-info:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-info.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-warning{color:#f90;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f90;box-shadow:inset 0 0 0 1px #f90}.btn-outline-warning:hover{color:#c2780a;-webkit-box-shadow:inset 0 0 0 1px #c2780a;box-shadow:inset 0 0 0 1px #c2780a}.btn-outline-warning.focus,.btn-outline-warning:focus{-webkit-box-shadow:inset 0 0 0 1px #f90,0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 0 0 1px #f90,0 0 0 .2rem rgba(255,153,0,.5)}.btn-outline-warning.disabled,.btn-outline-warning:disabled{color:#f90;background-color:transparent}.btn-outline-warning:not(:disabled):not(.disabled).active,.btn-outline-warning:not(:disabled):not(.disabled):active,.show>.btn-outline-warning.dropdown-toggle{color:#f90;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f90;box-shadow:inset 0 0 0 1px #f90}.btn-outline-warning:not(:disabled):not(.disabled).active:focus,.btn-outline-warning:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-warning.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5)}.btn-outline-danger{color:#f73e5a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f73e5a;box-shadow:inset 0 0 0 1px #f73e5a}.btn-outline-danger:hover{color:#e91938;-webkit-box-shadow:inset 0 0 0 1px #e91938;box-shadow:inset 0 0 0 1px #e91938}.btn-outline-danger.focus,.btn-outline-danger:focus{-webkit-box-shadow:inset 0 0 0 1px #f73e5a,0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 0 0 1px #f73e5a,0 0 0 .2rem rgba(247,62,90,.5)}.btn-outline-danger.disabled,.btn-outline-danger:disabled{color:#f73e5a;background-color:transparent}.btn-outline-danger:not(:disabled):not(.disabled).active,.btn-outline-danger:not(:disabled):not(.disabled):active,.show>.btn-outline-danger.dropdown-toggle{color:#f73e5a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f73e5a;box-shadow:inset 0 0 0 1px #f73e5a}.btn-outline-danger:not(:disabled):not(.disabled).active:focus,.btn-outline-danger:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-danger.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5)}.btn-outline-light{color:#e9e6f2;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e9e6f2;box-shadow:inset 0 0 0 1px #e9e6f2}.btn-outline-light:hover{color:#cec9dd;-webkit-box-shadow:inset 0 0 0 1px #cec9dd;box-shadow:inset 0 0 0 1px #cec9dd}.btn-outline-light.focus,.btn-outline-light:focus{-webkit-box-shadow:inset 0 0 0 1px #e9e6f2,0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 0 0 1px #e9e6f2,0 0 0 .2rem rgba(233,230,242,.5)}.btn-outline-light.disabled,.btn-outline-light:disabled{color:#e9e6f2;background-color:transparent}.btn-outline-light:not(:disabled):not(.disabled).active,.btn-outline-light:not(:disabled):not(.disabled):active,.show>.btn-outline-light.dropdown-toggle{color:#e9e6f2;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e9e6f2;box-shadow:inset 0 0 0 1px #e9e6f2}.btn-outline-light:not(:disabled):not(.disabled).active:focus,.btn-outline-light:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-light.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5)}.btn-outline-dark{color:#17324d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #17324d;box-shadow:inset 0 0 0 1px #17324d}.btn-outline-dark:hover{color:#0e1823;-webkit-box-shadow:inset 0 0 0 1px #0e1823;box-shadow:inset 0 0 0 1px #0e1823}.btn-outline-dark.focus,.btn-outline-dark:focus{-webkit-box-shadow:inset 0 0 0 1px #17324d,0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 0 0 1px #17324d,0 0 0 .2rem rgba(23,50,77,.5)}.btn-outline-dark.disabled,.btn-outline-dark:disabled{color:#17324d;background-color:transparent}.btn-outline-dark:not(:disabled):not(.disabled).active,.btn-outline-dark:not(:disabled):not(.disabled):active,.show>.btn-outline-dark.dropdown-toggle{color:#17324d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #17324d;box-shadow:inset 0 0 0 1px #17324d}.btn-outline-dark:not(:disabled):not(.disabled).active:focus,.btn-outline-dark:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-dark.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5)}.btn-outline-100{color:#e3e4e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e3e4e6;box-shadow:inset 0 0 0 1px #e3e4e6}.btn-outline-100:hover{color:#cbcbcb;-webkit-box-shadow:inset 0 0 0 1px #cbcbcb;box-shadow:inset 0 0 0 1px #cbcbcb}.btn-outline-100.focus,.btn-outline-100:focus{-webkit-box-shadow:inset 0 0 0 1px #e3e4e6,0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 0 0 1px #e3e4e6,0 0 0 .2rem rgba(227,228,230,.5)}.btn-outline-100.disabled,.btn-outline-100:disabled{color:#e3e4e6;background-color:transparent}.btn-outline-100:not(:disabled):not(.disabled).active,.btn-outline-100:not(:disabled):not(.disabled):active,.show>.btn-outline-100.dropdown-toggle{color:#e3e4e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e3e4e6;box-shadow:inset 0 0 0 1px #e3e4e6}.btn-outline-100:not(:disabled):not(.disabled).active:focus,.btn-outline-100:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-100.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5)}.btn-outline-200{color:#cacacc;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #cacacc;box-shadow:inset 0 0 0 1px #cacacc}.btn-outline-200:hover{color:#b1b1b1;-webkit-box-shadow:inset 0 0 0 1px #b1b1b1;box-shadow:inset 0 0 0 1px #b1b1b1}.btn-outline-200.focus,.btn-outline-200:focus{-webkit-box-shadow:inset 0 0 0 1px #cacacc,0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 0 0 1px #cacacc,0 0 0 .2rem rgba(202,202,204,.5)}.btn-outline-200.disabled,.btn-outline-200:disabled{color:#cacacc;background-color:transparent}.btn-outline-200:not(:disabled):not(.disabled).active,.btn-outline-200:not(:disabled):not(.disabled):active,.show>.btn-outline-200.dropdown-toggle{color:#cacacc;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #cacacc;box-shadow:inset 0 0 0 1px #cacacc}.btn-outline-200:not(:disabled):not(.disabled).active:focus,.btn-outline-200:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-200.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5)}.btn-outline-300{color:#b1b1b3;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #b1b1b3;box-shadow:inset 0 0 0 1px #b1b1b3}.btn-outline-300:hover{color:#989898;-webkit-box-shadow:inset 0 0 0 1px #989898;box-shadow:inset 0 0 0 1px #989898}.btn-outline-300.focus,.btn-outline-300:focus{-webkit-box-shadow:inset 0 0 0 1px #b1b1b3,0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 0 0 1px #b1b1b3,0 0 0 .2rem rgba(177,177,179,.5)}.btn-outline-300.disabled,.btn-outline-300:disabled{color:#b1b1b3;background-color:transparent}.btn-outline-300:not(:disabled):not(.disabled).active,.btn-outline-300:not(:disabled):not(.disabled):active,.show>.btn-outline-300.dropdown-toggle{color:#b1b1b3;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #b1b1b3;box-shadow:inset 0 0 0 1px #b1b1b3}.btn-outline-300:not(:disabled):not(.disabled).active:focus,.btn-outline-300:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-300.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5)}.btn-outline-400{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-400:hover{color:#7f7f7f;-webkit-box-shadow:inset 0 0 0 1px #7f7f7f;box-shadow:inset 0 0 0 1px #7f7f7f}.btn-outline-400.focus,.btn-outline-400:focus{-webkit-box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-400.disabled,.btn-outline-400:disabled{color:#979899;background-color:transparent}.btn-outline-400:not(:disabled):not(.disabled).active,.btn-outline-400:not(:disabled):not(.disabled):active,.show>.btn-outline-400.dropdown-toggle{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-400:not(:disabled):not(.disabled).active:focus,.btn-outline-400:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-400.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-500{color:#7e7f80;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #7e7f80;box-shadow:inset 0 0 0 1px #7e7f80}.btn-outline-500:hover{color:#656565;-webkit-box-shadow:inset 0 0 0 1px #656565;box-shadow:inset 0 0 0 1px #656565}.btn-outline-500.focus,.btn-outline-500:focus{-webkit-box-shadow:inset 0 0 0 1px #7e7f80,0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 0 0 1px #7e7f80,0 0 0 .2rem rgba(126,127,128,.5)}.btn-outline-500.disabled,.btn-outline-500:disabled{color:#7e7f80;background-color:transparent}.btn-outline-500:not(:disabled):not(.disabled).active,.btn-outline-500:not(:disabled):not(.disabled):active,.show>.btn-outline-500.dropdown-toggle{color:#7e7f80;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #7e7f80;box-shadow:inset 0 0 0 1px #7e7f80}.btn-outline-500:not(:disabled):not(.disabled).active:focus,.btn-outline-500:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-500.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5)}.btn-outline-600{color:#656566;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #656566;box-shadow:inset 0 0 0 1px #656566}.btn-outline-600:hover{color:#4c4c4c;-webkit-box-shadow:inset 0 0 0 1px #4c4c4c;box-shadow:inset 0 0 0 1px #4c4c4c}.btn-outline-600.focus,.btn-outline-600:focus{-webkit-box-shadow:inset 0 0 0 1px #656566,0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 0 0 1px #656566,0 0 0 .2rem rgba(101,101,102,.5)}.btn-outline-600.disabled,.btn-outline-600:disabled{color:#656566;background-color:transparent}.btn-outline-600:not(:disabled):not(.disabled).active,.btn-outline-600:not(:disabled):not(.disabled):active,.show>.btn-outline-600.dropdown-toggle{color:#656566;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #656566;box-shadow:inset 0 0 0 1px #656566}.btn-outline-600:not(:disabled):not(.disabled).active:focus,.btn-outline-600:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-600.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5)}.btn-outline-700{color:#4c4c4d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #4c4c4d;box-shadow:inset 0 0 0 1px #4c4c4d}.btn-outline-700:hover{color:#333;-webkit-box-shadow:inset 0 0 0 1px #333;box-shadow:inset 0 0 0 1px #333}.btn-outline-700.focus,.btn-outline-700:focus{-webkit-box-shadow:inset 0 0 0 1px #4c4c4d,0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 0 0 1px #4c4c4d,0 0 0 .2rem rgba(76,76,77,.5)}.btn-outline-700.disabled,.btn-outline-700:disabled{color:#4c4c4d;background-color:transparent}.btn-outline-700:not(:disabled):not(.disabled).active,.btn-outline-700:not(:disabled):not(.disabled):active,.show>.btn-outline-700.dropdown-toggle{color:#4c4c4d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #4c4c4d;box-shadow:inset 0 0 0 1px #4c4c4d}.btn-outline-700:not(:disabled):not(.disabled).active:focus,.btn-outline-700:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-700.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5)}.btn-outline-800{color:#323333;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #323333;box-shadow:inset 0 0 0 1px #323333}.btn-outline-800:hover{color:#191919;-webkit-box-shadow:inset 0 0 0 1px #191919;box-shadow:inset 0 0 0 1px #191919}.btn-outline-800.focus,.btn-outline-800:focus{-webkit-box-shadow:inset 0 0 0 1px #323333,0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 0 0 1px #323333,0 0 0 .2rem rgba(50,51,51,.5)}.btn-outline-800.disabled,.btn-outline-800:disabled{color:#323333;background-color:transparent}.btn-outline-800:not(:disabled):not(.disabled).active,.btn-outline-800:not(:disabled):not(.disabled):active,.show>.btn-outline-800.dropdown-toggle{color:#323333;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #323333;box-shadow:inset 0 0 0 1px #323333}.btn-outline-800:not(:disabled):not(.disabled).active:focus,.btn-outline-800:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-800.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5)}.btn-outline-900{color:#19191a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #19191a;box-shadow:inset 0 0 0 1px #19191a}.btn-outline-900:hover{color:#000;-webkit-box-shadow:inset 0 0 0 1px #000;box-shadow:inset 0 0 0 1px #000}.btn-outline-900.focus,.btn-outline-900:focus{-webkit-box-shadow:inset 0 0 0 1px #19191a,0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 0 0 1px #19191a,0 0 0 .2rem rgba(25,25,26,.5)}.btn-outline-900.disabled,.btn-outline-900:disabled{color:#19191a;background-color:transparent}.btn-outline-900:not(:disabled):not(.disabled).active,.btn-outline-900:not(:disabled):not(.disabled):active,.show>.btn-outline-900.dropdown-toggle{color:#19191a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #19191a;box-shadow:inset 0 0 0 1px #19191a}.btn-outline-900:not(:disabled):not(.disabled).active:focus,.btn-outline-900:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-900.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5)}.btn-link{font-weight:400;color:#0073e6;text-decoration:none}.btn-link:hover{color:#004d99;text-decoration:underline}.btn-link.focus,.btn-link:focus{text-decoration:underline;-webkit-box-shadow:none;box-shadow:none}.btn-link.disabled,.btn-link:disabled{color:#656566;pointer-events:none}.btn-group-lg>.btn,.btn-lg{padding:.5rem 1rem;font-size:1.125rem;border-radius:8px}.btn-group-sm>.btn,.btn-sm{padding:.25rem .5rem;font-size:.875rem;border-radius:2px}.btn-block{display:block;width:100%}.btn-block+.btn-block{margin-top:.5rem}input[type=button].btn-block,input[type=reset].btn-block,input[type=submit].btn-block{width:100%}.fade{-webkit-transition:opacity .15s linear;transition:opacity .15s linear}@media (prefers-reduced-motion:reduce){.fade{-webkit-transition:none;transition:none}}.fade:not(.show){opacity:0}.collapse:not(.show){display:none}.collapsing{position:relative;height:0;overflow:hidden;-webkit-transition:height .35s ease;transition:height .35s ease}@media (prefers-reduced-motion:reduce){.collapsing{-webkit-transition:none;transition:none}}.dropdown,.dropleft,.dropright,.dropup{position:relative}.dropdown-toggle{white-space:nowrap}.dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid;border-right:.3em solid transparent;border-bottom:0;border-left:.3em solid transparent}.dropdown-toggle:empty:after{margin-left:0}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;display:none;float:left;min-width:160px;min-width:10rem;padding:.5rem 0;margin:.125rem 0 0;font-size:16px;font-size:1rem;color:#19191a;text-align:left;list-style:none;background-clip:padding-box;border:0 solid transparent;border-radius:4px;-webkit-box-shadow:0 0 30px 5px rgba(0,0,0,.05);box-shadow:0 0 30px 5px rgba(0,0,0,.05)}.dropdown-menu-left{right:auto;left:0}.dropdown-menu-right{right:0;left:auto}@media (min-width:576px){.dropdown-menu-sm-left{right:auto;left:0}.dropdown-menu-sm-right{right:0;left:auto}}@media (min-width:768px){.dropdown-menu-md-left{right:auto;left:0}.dropdown-menu-md-right{right:0;left:auto}}@media (min-width:992px){.dropdown-menu-lg-left{right:auto;left:0}.dropdown-menu-lg-right{right:0;left:auto}}@media (min-width:1200px){.dropdown-menu-xl-left{right:auto;left:0}.dropdown-menu-xl-right{right:0;left:auto}}.dropup .dropdown-menu{top:auto;bottom:100%;margin-top:0;margin-bottom:.125rem}.dropup .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:0;border-right:.3em solid transparent;border-bottom:.3em solid;border-left:.3em solid transparent}.dropup .dropdown-toggle:empty:after{margin-left:0}.dropright .dropdown-menu{top:0;right:auto;left:100%;margin-top:0;margin-left:.125rem}.dropright .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:0;border-bottom:.3em solid transparent;border-left:.3em solid}.dropright .dropdown-toggle:empty:after{margin-left:0}.dropright .dropdown-toggle:after{vertical-align:0}.dropleft .dropdown-menu{top:0;right:100%;left:auto;margin-top:0;margin-right:.125rem}.dropleft .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";display:none}.dropleft .dropdown-toggle:before{display:inline-block;margin-right:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:.3em solid;border-bottom:.3em solid transparent}.dropleft .dropdown-toggle:empty:after{margin-left:0}.dropleft .dropdown-toggle:before{vertical-align:0}.dropdown-divider{height:0;margin:8px 0;overflow:hidden;border-top:1px solid #cacacc}.dropdown-item{display:block;width:100%;padding:12px 24px;clear:both;font-weight:400;color:#17324d;text-align:inherit;white-space:nowrap;background-color:transparent;border:0}.dropdown-item:focus,.dropdown-item:hover{color:#17324d;text-decoration:none;background-color:#e6ecf2}.dropdown-item.active,.dropdown-item:active{color:#fff;text-decoration:none;background-color:#0073e6}.dropdown-item.disabled,.dropdown-item:disabled{color:#656566;pointer-events:none;background-color:transparent}.dropdown-menu.show{display:block}.dropdown-header{display:block;padding:.5rem 24px;margin-bottom:0;font-size:14px;font-size:.875rem;color:#17324d;white-space:nowrap}.dropdown-item-text{display:block;padding:12px 24px;color:#17324d}.btn-group,.btn-group-vertical{position:relative;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;vertical-align:middle}.btn-group-vertical>.btn,.btn-group>.btn{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto}.btn-group-vertical>.btn.active,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:hover,.btn-group>.btn.active,.btn-group>.btn:active,.btn-group>.btn:focus,.btn-group>.btn:hover{z-index:1}.btn-toolbar{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.btn-toolbar .input-group{width:auto}.btn-group>.btn-group:not(:first-child),.btn-group>.btn:not(:first-child){margin-left:0}.btn-group>.btn-group:not(:last-child)>.btn,.btn-group>.btn:not(:last-child):not(.dropdown-toggle){border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn-group:not(:first-child)>.btn,.btn-group>.btn:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.dropdown-toggle-split{padding-right:.5625rem;padding-left:.5625rem}.dropdown-toggle-split:after,.dropright .dropdown-toggle-split:after,.dropup .dropdown-toggle-split:after{margin-left:0}.dropleft .dropdown-toggle-split:before{margin-right:0}.btn-group-sm>.btn+.dropdown-toggle-split,.btn-sm+.dropdown-toggle-split{padding-right:.375rem;padding-left:.375rem}.btn-group-lg>.btn+.dropdown-toggle-split,.btn-lg+.dropdown-toggle-split{padding-right:.75rem;padding-left:.75rem}.btn-group.show .dropdown-toggle{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125);box-shadow:inset 0 3px 5px rgba(0,0,0,.125)}.btn-group.show .dropdown-toggle.btn-link{-webkit-box-shadow:none;box-shadow:none}.btn-group-vertical{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group{width:100%}.btn-group-vertical>.btn-group:not(:first-child),.btn-group-vertical>.btn:not(:first-child){margin-top:0}.btn-group-vertical>.btn-group:not(:last-child)>.btn,.btn-group-vertical>.btn:not(:last-child):not(.dropdown-toggle){border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn-group:not(:first-child)>.btn,.btn-group-vertical>.btn:not(:first-child){border-top-left-radius:0;border-top-right-radius:0}.btn-group-toggle>.btn,.btn-group-toggle>.btn-group>.btn{margin-bottom:0}.btn-group-toggle>.btn-group>.btn input[type=checkbox],.btn-group-toggle>.btn-group>.btn input[type=radio],.btn-group-toggle>.btn input[type=checkbox],.btn-group-toggle>.btn input[type=radio]{position:absolute;clip:rect(0,0,0,0);pointer-events:none}.input-group{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:stretch;-ms-flex-align:stretch;align-items:stretch;width:100%}.input-group>.custom-file,.input-group>.custom-select,.input-group>.form-control,.input-group>.form-control-plaintext{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;width:1%;margin-bottom:0}.input-group>.custom-file+.custom-file,.input-group>.custom-file+.custom-select,.input-group>.custom-file+.form-control,.input-group>.custom-select+.custom-file,.input-group>.custom-select+.custom-select,.input-group>.custom-select+.form-control,.input-group>.form-control+.custom-file,.input-group>.form-control+.custom-select,.input-group>.form-control+.form-control,.input-group>.form-control-plaintext+.custom-file,.input-group>.form-control-plaintext+.custom-select,.input-group>.form-control-plaintext+.form-control{margin-left:-1px}.input-group>.custom-file .custom-file-input:focus~.custom-file-label,.input-group>.custom-select:focus,.input-group>.form-control:focus{z-index:3}.input-group>.custom-file .custom-file-input:focus{z-index:4}.input-group>.custom-select:not(:last-child),.input-group>.form-control:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-select:not(:first-child),.input-group>.form-control:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.input-group>.custom-file{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.input-group>.custom-file:not(:last-child) .custom-file-label,.input-group>.custom-file:not(:last-child) .custom-file-label:after{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-file:not(:first-child) .custom-file-label{border-top-left-radius:0;border-bottom-left-radius:0}.input-group-append,.input-group-prepend{display:-webkit-box;display:-ms-flexbox;display:flex}.input-group-append .btn,.input-group-prepend .btn{position:relative;z-index:2}.input-group-append .btn:focus,.input-group-prepend .btn:focus{z-index:3}.input-group-append .btn+.btn,.input-group-append .btn+.input-group-text,.input-group-append .input-group-text+.btn,.input-group-append .input-group-text+.input-group-text,.input-group-prepend .btn+.btn,.input-group-prepend .btn+.input-group-text,.input-group-prepend .input-group-text+.btn,.input-group-prepend .input-group-text+.input-group-text{margin-left:-1px}.input-group-prepend{margin-right:-1px}.input-group-append{margin-left:-1px}.input-group-text{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding:.375rem .75rem;margin-bottom:0;font-size:16px;font-size:1rem;font-weight:400;line-height:1.5;color:#4c4c4d;text-align:center;white-space:nowrap;background-color:#cacacc;border:1px solid #979899;border-radius:4px}.input-group-text input[type=checkbox],.input-group-text input[type=radio]{margin-top:0}.input-group-lg>.custom-select,.input-group-lg>.form-control:not(textarea){height:calc(1.556em + 1rem + 2px)}.input-group-lg>.custom-select,.input-group-lg>.form-control,.input-group-lg>.input-group-append>.btn,.input-group-lg>.input-group-append>.input-group-text,.input-group-lg>.input-group-prepend>.btn,.input-group-lg>.input-group-prepend>.input-group-text{padding:.5rem 1rem;font-size:20px;font-size:1.25rem;line-height:1.556;border-radius:8px}.input-group-sm>.custom-select,.input-group-sm>.form-control:not(textarea){height:calc(1.428em + .5rem + 2px)}.input-group-sm>.custom-select,.input-group-sm>.form-control,.input-group-sm>.input-group-append>.btn,.input-group-sm>.input-group-append>.input-group-text,.input-group-sm>.input-group-prepend>.btn,.input-group-sm>.input-group-prepend>.input-group-text{padding:.25rem .5rem;font-size:14px;font-size:.875rem;line-height:1.428;border-radius:2px}.input-group-lg>.custom-select,.input-group-sm>.custom-select{padding-right:1.75rem}.input-group>.input-group-append:last-child>.btn:not(:last-child):not(.dropdown-toggle),.input-group>.input-group-append:last-child>.input-group-text:not(:last-child),.input-group>.input-group-append:not(:last-child)>.btn,.input-group>.input-group-append:not(:last-child)>.input-group-text,.input-group>.input-group-prepend>.btn,.input-group>.input-group-prepend>.input-group-text{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.input-group-append>.btn,.input-group>.input-group-append>.input-group-text,.input-group>.input-group-prepend:first-child>.btn:not(:first-child),.input-group>.input-group-prepend:first-child>.input-group-text:not(:first-child),.input-group>.input-group-prepend:not(:first-child)>.btn,.input-group>.input-group-prepend:not(:first-child)>.input-group-text{border-top-left-radius:0;border-bottom-left-radius:0}.nav{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.nav-link{display:block;padding:.5rem 1rem}.nav-link:focus,.nav-link:hover{text-decoration:none}.nav-link.disabled{color:#656566;pointer-events:none;cursor:default}.nav-tabs{border-bottom:1px solid #b1b1b3}.nav-tabs .nav-item{margin-bottom:-1px}.nav-tabs .nav-link{border:1px solid transparent;border-top-left-radius:4px;border-top-right-radius:4px}.nav-tabs .nav-link:focus,.nav-tabs .nav-link:hover{border-color:#cacacc #cacacc #b1b1b3}.nav-tabs .nav-link.disabled{color:#656566;background-color:transparent;border-color:transparent}.nav-tabs .nav-item.show .nav-link,.nav-tabs .nav-link.active{color:#4c4c4d;background-color:#fff;border-color:#b1b1b3 #b1b1b3 #fff}.nav-tabs .dropdown-menu{margin-top:-1px;border-top-left-radius:0;border-top-right-radius:0}.nav-pills .nav-link{border-radius:4px}.nav-pills .nav-link.active,.nav-pills .show>.nav-link{color:#fff;background-color:#0073e6}.nav-fill .nav-item{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;text-align:center}.nav-justified .nav-item{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;text-align:center}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.navbar{position:relative;padding:8px 16px}.navbar,.navbar>.container,.navbar>.container-fluid{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.navbar-brand{display:inline-block;padding-top:.5rem;padding-bottom:.5rem;margin-right:16px;font-size:16px;font-size:1rem;line-height:inherit;white-space:nowrap}.navbar-brand:focus,.navbar-brand:hover{text-decoration:none}.navbar-nav{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;padding-left:0;margin-bottom:0;list-style:none}.navbar-nav .nav-link{padding-right:0;padding-left:0}.navbar-nav .dropdown-menu{position:static;float:none}.navbar-text{display:inline-block;padding-top:.5rem;padding-bottom:.5rem}.navbar-collapse{-ms-flex-preferred-size:100%;flex-basis:100%;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.navbar-toggler{padding:.25rem .75rem;font-size:20px;font-size:1.25rem;line-height:1;background-color:transparent;border:1px solid transparent;border-radius:0}.navbar-toggler:focus,.navbar-toggler:hover{text-decoration:none}.navbar-toggler-icon{display:inline-block;width:1.5em;height:1.5em;vertical-align:middle;content:"";background:no-repeat 50%;background-size:100% 100%}@media (max-width:575.98px){.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:576px){.navbar-expand-sm{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-sm,.navbar-expand-sm .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-sm .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-sm .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-sm .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-sm .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-sm .navbar-toggler{display:none}}@media (max-width:767.98px){.navbar-expand-md>.container,.navbar-expand-md>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:768px){.navbar-expand-md{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-md,.navbar-expand-md .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-md .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-md .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-md .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-md>.container,.navbar-expand-md>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-md .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-md .navbar-toggler{display:none}}@media (max-width:991.98px){.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:992px){.navbar-expand-lg{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-lg,.navbar-expand-lg .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-lg .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-lg .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-lg .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-lg .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-lg .navbar-toggler{display:none}}@media (max-width:1199.98px){.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:1200px){.navbar-expand-xl{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-xl,.navbar-expand-xl .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-xl .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-xl .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-xl .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-xl .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-xl .navbar-toggler{display:none}}.navbar-expand{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand>.container,.navbar-expand>.container-fluid{padding-right:0;padding-left:0}.navbar-expand .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand .navbar-nav .dropdown-menu{position:absolute}.navbar-expand .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand>.container,.navbar-expand>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand .navbar-toggler{display:none}.navbar-light .navbar-brand,.navbar-light .navbar-brand:focus,.navbar-light .navbar-brand:hover{color:rgba(0,0,0,.9)}.navbar-light .navbar-nav .nav-link{color:rgba(0,0,0,.5)}.navbar-light .navbar-nav .nav-link:focus,.navbar-light .navbar-nav .nav-link:hover{color:rgba(0,0,0,.7)}.navbar-light .navbar-nav .nav-link.disabled{color:rgba(0,0,0,.3)}.navbar-light .navbar-nav .active>.nav-link,.navbar-light .navbar-nav .nav-link.active,.navbar-light .navbar-nav .nav-link.show,.navbar-light .navbar-nav .show>.nav-link{color:rgba(0,0,0,.9)}.navbar-light .navbar-toggler{color:rgba(0,0,0,.5);border-color:rgba(0,0,0,.1)}.navbar-light .navbar-toggler-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E")}.navbar-light .navbar-text{color:rgba(0,0,0,.5)}.navbar-light .navbar-text a,.navbar-light .navbar-text a:focus,.navbar-light .navbar-text a:hover{color:rgba(0,0,0,.9)}.navbar-dark .navbar-brand,.navbar-dark .navbar-brand:focus,.navbar-dark .navbar-brand:hover{color:#fff}.navbar-dark .navbar-nav .nav-link{color:hsla(0,0%,100%,.5)}.navbar-dark .navbar-nav .nav-link:focus,.navbar-dark .navbar-nav .nav-link:hover{color:hsla(0,0%,100%,.75)}.navbar-dark .navbar-nav .nav-link.disabled{color:hsla(0,0%,100%,.25)}.navbar-dark .navbar-nav .active>.nav-link,.navbar-dark .navbar-nav .nav-link.active,.navbar-dark .navbar-nav .nav-link.show,.navbar-dark .navbar-nav .show>.nav-link{color:#fff}.navbar-dark .navbar-toggler{color:hsla(0,0%,100%,.5);border-color:transparent}.navbar-dark .navbar-toggler-icon{background-image:url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkuMiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDEyIDEwIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxwYXRoIGQ9Ik0wIDRoMTJ2MkgwVjR6bTAtNGg4djJIMFYwem0wIDhoOHYySDBWOHoiIGZpbGw9IiNGRkYiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvc3ZnPg==)}.navbar-dark .navbar-text{color:hsla(0,0%,100%,.5)}.navbar-dark .navbar-text a,.navbar-dark .navbar-text a:focus,.navbar-dark .navbar-text a:hover{color:#fff}.card{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;min-width:0;word-wrap:break-word;background-color:#fff;background-clip:border-box;border:1px solid rgba(0,0,0,.125);border-radius:0}.card>hr{margin-right:0;margin-left:0}.card>.list-group:first-child .list-group-item:first-child{border-top-left-radius:0;border-top-right-radius:0}.card>.list-group:last-child .list-group-item:last-child{border-bottom-right-radius:0;border-bottom-left-radius:0}.card-body{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;padding:2rem}.card-title{margin-bottom:1rem}.card-subtitle{margin-top:-.5rem}.card-subtitle,.card-text:last-child{margin-bottom:0}.card-link:hover{text-decoration:none}.card-link+.card-link{margin-left:2rem}.card-header{padding:1rem 2rem;margin-bottom:0;background-color:transparent;border-bottom:1px solid rgba(0,0,0,.125)}.card-header:first-child{border-radius:-1px -1px 0 0}.card-header+.list-group .list-group-item:first-child{border-top:0}.card-footer{padding:1rem 2rem;background-color:transparent;border-top:1px solid rgba(0,0,0,.125)}.card-footer:last-child{border-radius:0 0 -1px -1px}.card-header-tabs{margin-bottom:-1rem;border-bottom:0}.card-header-pills,.card-header-tabs{margin-right:-1rem;margin-left:-1rem}.card-img-overlay{position:absolute;top:0;right:0;bottom:0;left:0;padding:1.25rem}.card-img{width:100%;border-radius:-1px}.card-img-top{width:100%;border-top-left-radius:-1px;border-top-right-radius:-1px}.card-img-bottom{width:100%;border-bottom-right-radius:-1px;border-bottom-left-radius:-1px}.card-deck{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.card-deck .card{margin-bottom:6px}@media (min-width:576px){.card-deck{-webkit-box-orient:horizontal;-ms-flex-flow:row wrap;flex-flow:row wrap;margin-right:-6px;margin-left:-6px}.card-deck,.card-deck .card{-webkit-box-direction:normal}.card-deck .card{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-flex:1;-ms-flex:1 0 0%;flex:1 0 0%;-webkit-box-orient:vertical;-ms-flex-direction:column;flex-direction:column;margin-right:6px;margin-bottom:0;margin-left:6px}}.card-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.card-group>.card{margin-bottom:6px}@media (min-width:576px){.card-group{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap}.card-group>.card{-webkit-box-flex:1;-ms-flex:1 0 0%;flex:1 0 0%;margin-bottom:0}.card-group>.card+.card{margin-left:0;border-left:0}.card-group>.card:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.card-group>.card:not(:last-child) .card-header,.card-group>.card:not(:last-child) .card-img-top{border-top-right-radius:0}.card-group>.card:not(:last-child) .card-footer,.card-group>.card:not(:last-child) .card-img-bottom{border-bottom-right-radius:0}.card-group>.card:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.card-group>.card:not(:first-child) .card-header,.card-group>.card:not(:first-child) .card-img-top{border-top-left-radius:0}.card-group>.card:not(:first-child) .card-footer,.card-group>.card:not(:first-child) .card-img-bottom{border-bottom-left-radius:0}}.card-columns .card{margin-bottom:1rem}@media (min-width:576px){.card-columns{-webkit-column-count:3;-moz-column-count:3;column-count:3;-webkit-column-gap:1.25rem;-moz-column-gap:1.25rem;column-gap:1.25rem;orphans:1;widows:1}.card-columns .card{display:inline-block;width:100%}}.accordion>.card{overflow:hidden}.accordion>.card:not(:first-of-type) .card-header:first-child{border-radius:0}.accordion>.card:not(:first-of-type):not(:last-of-type){border-bottom:0;border-radius:0}.accordion>.card:first-of-type{border-bottom:0;border-bottom-right-radius:0;border-bottom-left-radius:0}.accordion>.card:last-of-type{border-top-left-radius:0;border-top-right-radius:0}.accordion>.card .card-header{margin-bottom:-1px}.breadcrumb{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;padding:.75rem 1rem;margin-bottom:1rem;list-style:none;background-color:transparent;border-radius:0}.breadcrumb-item+.breadcrumb-item{padding-left:.5rem}.breadcrumb-item+.breadcrumb-item:before{display:inline-block;padding-right:.5rem;color:#656566;content:"/"}.breadcrumb-item+.breadcrumb-item:hover:before{text-decoration:underline;text-decoration:none}.breadcrumb-item.active{color:#656566}.pagination{display:-webkit-box;display:-ms-flexbox;display:flex;padding-left:0;list-style:none;border-radius:4px}.page-link{position:relative;display:block;padding:.5rem .75rem;margin-left:-1px;line-height:1.25;color:#0073e6;background-color:#fff;border:1px solid #b1b1b3}.page-link:hover{z-index:2;color:#004d99;text-decoration:none;background-color:#cacacc;border-color:#b1b1b3}.page-link:focus{z-index:2;outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.25);box-shadow:0 0 0 .2rem rgba(0,115,230,.25)}.page-item:first-child .page-link{margin-left:0;border-top-left-radius:4px;border-bottom-left-radius:4px}.page-item:last-child .page-link{border-top-right-radius:4px;border-bottom-right-radius:4px}.page-item.active .page-link{z-index:1;color:#fff;background-color:#0073e6;border-color:#0073e6}.page-item.disabled .page-link{color:#656566;pointer-events:none;cursor:auto;background-color:#fff;border-color:#b1b1b3}.pagination-lg .page-link{padding:.75rem 1.5rem;font-size:20px;font-size:1.25rem;line-height:1.5}.pagination-lg .page-item:first-child .page-link{border-top-left-radius:8px;border-bottom-left-radius:8px}.pagination-lg .page-item:last-child .page-link{border-top-right-radius:8px;border-bottom-right-radius:8px}.pagination-sm .page-link{padding:.25rem .5rem;font-size:14px;font-size:.875rem;line-height:1.5}.pagination-sm .page-item:first-child .page-link{border-top-left-radius:2px;border-bottom-left-radius:2px}.pagination-sm .page-item:last-child .page-link{border-top-right-radius:2px;border-bottom-right-radius:2px}.badge{display:inline-block;padding:.25em .4em;font-size:75%;font-weight:700;line-height:1;text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:4px;-webkit-transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.badge{-webkit-transition:none;transition:none}}a.badge:focus,a.badge:hover{text-decoration:none}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.badge-pill{padding-right:.6em;padding-left:.6em;border-radius:10rem}.badge-primary{color:#fff;background-color:#0073e6}a.badge-primary:focus,a.badge-primary:hover{color:#fff;background-color:#0059b3}a.badge-primary.focus,a.badge-primary:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.5);box-shadow:0 0 0 .2rem rgba(0,115,230,.5)}.badge-secondary{color:#fff;background-color:#5c6f82}a.badge-secondary:focus,a.badge-secondary:hover{color:#fff;background-color:#475664}a.badge-secondary.focus,a.badge-secondary:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(92,111,130,.5);box-shadow:0 0 0 .2rem rgba(92,111,130,.5)}.badge-success{color:#19191a;background-color:#00cc85}a.badge-success:focus,a.badge-success:hover{color:#19191a;background-color:#009963}a.badge-success.focus,a.badge-success:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.5);box-shadow:0 0 0 .2rem rgba(0,204,133,.5)}.badge-info{color:#19191a;background-color:#979899}a.badge-info:focus,a.badge-info:hover{color:#19191a;background-color:#7e7e80}a.badge-info.focus,a.badge-info:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(151,152,153,.5);box-shadow:0 0 0 .2rem rgba(151,152,153,.5)}.badge-warning{color:#19191a;background-color:#f90}a.badge-warning:focus,a.badge-warning:hover{color:#19191a;background-color:#cc7a00}a.badge-warning.focus,a.badge-warning:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(255,153,0,.5);box-shadow:0 0 0 .2rem rgba(255,153,0,.5)}.badge-danger{color:#19191a;background-color:#f73e5a}a.badge-danger:focus,a.badge-danger:hover{color:#19191a;background-color:#f50d30}a.badge-danger.focus,a.badge-danger:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.5);box-shadow:0 0 0 .2rem rgba(247,62,90,.5)}.badge-light{color:#19191a;background-color:#e9e6f2}a.badge-light:focus,a.badge-light:hover{color:#19191a;background-color:#ccc4e1}a.badge-light.focus,a.badge-light:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(233,230,242,.5);box-shadow:0 0 0 .2rem rgba(233,230,242,.5)}.badge-dark{color:#fff;background-color:#17324d}a.badge-dark:focus,a.badge-dark:hover{color:#fff;background-color:#0b1825}a.badge-dark.focus,a.badge-dark:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(23,50,77,.5);box-shadow:0 0 0 .2rem rgba(23,50,77,.5)}.badge-100{color:#19191a;background-color:#e3e4e6}a.badge-100:focus,a.badge-100:hover{color:#19191a;background-color:#c9cacd}a.badge-100.focus,a.badge-100:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(227,228,230,.5);box-shadow:0 0 0 .2rem rgba(227,228,230,.5)}.badge-200{color:#19191a;background-color:#cacacc}a.badge-200:focus,a.badge-200:hover{color:#19191a;background-color:#b0b1b3}a.badge-200.focus,a.badge-200:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(202,202,204,.5);box-shadow:0 0 0 .2rem rgba(202,202,204,.5)}.badge-300{color:#19191a;background-color:#b1b1b3}a.badge-300:focus,a.badge-300:hover{color:#19191a;background-color:#979899}a.badge-300.focus,a.badge-300:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(177,177,179,.5);box-shadow:0 0 0 .2rem rgba(177,177,179,.5)}.badge-400{color:#19191a;background-color:#979899}a.badge-400:focus,a.badge-400:hover{color:#19191a;background-color:#7e7e80}a.badge-400.focus,a.badge-400:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(151,152,153,.5);box-shadow:0 0 0 .2rem rgba(151,152,153,.5)}.badge-500{color:#19191a;background-color:#7e7f80}a.badge-500:focus,a.badge-500:hover{color:#19191a;background-color:#656566}a.badge-500.focus,a.badge-500:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(126,127,128,.5);box-shadow:0 0 0 .2rem rgba(126,127,128,.5)}.badge-600{color:#fff;background-color:#656566}a.badge-600:focus,a.badge-600:hover{color:#fff;background-color:#4c4c4c}a.badge-600.focus,a.badge-600:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(101,101,102,.5);box-shadow:0 0 0 .2rem rgba(101,101,102,.5)}.badge-700{color:#fff;background-color:#4c4c4d}a.badge-700:focus,a.badge-700:hover{color:#fff;background-color:#323233}a.badge-700.focus,a.badge-700:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(76,76,77,.5);box-shadow:0 0 0 .2rem rgba(76,76,77,.5)}.badge-800{color:#fff;background-color:#323333}a.badge-800:focus,a.badge-800:hover{color:#fff;background-color:#191919}a.badge-800.focus,a.badge-800:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(50,51,51,.5);box-shadow:0 0 0 .2rem rgba(50,51,51,.5)}.badge-900{color:#fff;background-color:#19191a}a.badge-900:focus,a.badge-900:hover{color:#fff;background-color:#000}a.badge-900.focus,a.badge-900:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(25,25,26,.5);box-shadow:0 0 0 .2rem rgba(25,25,26,.5)}@-webkit-keyframes progress-bar-stripes{0%{background-position:16px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{0%{background-position:16px 0}to{background-position:0 0}}.progress{height:16px;overflow:hidden;font-size:12px;font-size:.75rem;background-color:#cacacc;border-radius:0;-webkit-box-shadow:inset 0 .1rem .1rem rgba(0,0,0,.1);box-shadow:inset 0 .1rem .1rem rgba(0,0,0,.1)}.progress,.progress-bar{display:-webkit-box;display:-ms-flexbox;display:flex}.progress-bar{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;color:#fff;text-align:center;white-space:nowrap;background-color:#0073e6;-webkit-transition:width .6s ease;transition:width .6s ease}@media (prefers-reduced-motion:reduce){.progress-bar{-webkit-transition:none;transition:none}}.progress-bar-striped{background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent);background-size:16px 16px}.progress-bar-animated{-webkit-animation:progress-bar-stripes 1s linear infinite;animation:progress-bar-stripes 1s linear infinite}@media (prefers-reduced-motion:reduce){.progress-bar-animated{-webkit-animation:none;animation:none}}.media{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start}.media-body{-webkit-box-flex:1;-ms-flex:1;flex:1}.list-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;padding-left:0;margin-bottom:0}.list-group-item-action{width:100%;color:#0073e6;text-align:inherit}.list-group-item-action:focus,.list-group-item-action:hover{z-index:1;color:#00264d;text-decoration:none}.list-group-item-action:active{color:#19191a;background-color:#cacacc}.list-group-item{position:relative;display:block;padding:1rem 1.25rem;margin-bottom:-1px;background-color:#fff;border:1px solid rgba(0,0,0,.125)}.list-group-item:first-child{border-top-left-radius:4px;border-top-right-radius:4px}.list-group-item:last-child{margin-bottom:0;border-bottom-right-radius:4px;border-bottom-left-radius:4px}.list-group-item.disabled,.list-group-item:disabled{color:#656566;pointer-events:none;background-color:#fff}.list-group-item.active{z-index:2;color:#fff;background-color:#0073e6;border-color:#0073e6}.list-group-horizontal{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}@media (min-width:576px){.list-group-horizontal-sm{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-sm .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-sm .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-sm .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}@media (min-width:768px){.list-group-horizontal-md{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-md .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-md .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-md .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}@media (min-width:992px){.list-group-horizontal-lg{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-lg .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-lg .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-lg .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}@media (min-width:1200px){.list-group-horizontal-xl{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-xl .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-xl .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-xl .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}.list-group-flush .list-group-item{border-right:0;border-left:0;border-radius:0}.list-group-flush .list-group-item:last-child{margin-bottom:-1px}.list-group-flush:first-child .list-group-item:first-child{border-top:0}.list-group-flush:last-child .list-group-item:last-child{margin-bottom:0;border-bottom:0}.list-group-item-primary{color:#003c78;background-color:#b8d8f8}.list-group-item-primary.list-group-item-action:focus,.list-group-item-primary.list-group-item-action:hover{color:#003c78;background-color:#a1cbf6}.list-group-item-primary.list-group-item-action.active{color:#fff;background-color:#003c78;border-color:#003c78}.list-group-item-secondary{color:#303a44;background-color:#d1d7dc}.list-group-item-secondary.list-group-item-action:focus,.list-group-item-secondary.list-group-item-action:hover{color:#303a44;background-color:#c3cad1}.list-group-item-secondary.list-group-item-action.active{color:#fff;background-color:#303a44;border-color:#303a44}.list-group-item-success{color:#006a45;background-color:#b8f1dd}.list-group-item-success.list-group-item-action:focus,.list-group-item-success.list-group-item-action:hover{color:#006a45;background-color:#a3edd3}.list-group-item-success.list-group-item-action.active{color:#fff;background-color:#006a45;border-color:#006a45}.list-group-item-info{color:#4f4f50;background-color:#e2e2e2}.list-group-item-info.list-group-item-action:focus,.list-group-item-info.list-group-item-action:hover{color:#4f4f50;background-color:#d5d5d5}.list-group-item-info.list-group-item-action.active{color:#fff;background-color:#4f4f50;border-color:#4f4f50}.list-group-item-warning{color:#855000;background-color:#ffe2b8}.list-group-item-warning.list-group-item-action:focus,.list-group-item-warning.list-group-item-action:hover{color:#855000;background-color:#ffd89f}.list-group-item-warning.list-group-item-action.active{color:#fff;background-color:#855000;border-color:#855000}.list-group-item-danger{color:#80202f;background-color:#fdc9d1}.list-group-item-danger.list-group-item-action:focus,.list-group-item-danger.list-group-item-action:hover{color:#80202f;background-color:#fcb0bc}.list-group-item-danger.list-group-item-action.active{color:#fff;background-color:#80202f;border-color:#80202f}.list-group-item-light{color:#79787e;background-color:#f9f8fb}.list-group-item-light.list-group-item-action:focus,.list-group-item-light.list-group-item-action:hover{color:#79787e;background-color:#ebe8f2}.list-group-item-light.list-group-item-action.active{color:#fff;background-color:#79787e;border-color:#79787e}.list-group-item-dark{color:#0c1a28;background-color:#bec6cd}.list-group-item-dark.list-group-item-action:focus,.list-group-item-dark.list-group-item-action:hover{color:#0c1a28;background-color:#b0b9c2}.list-group-item-dark.list-group-item-action.active{color:#fff;background-color:#0c1a28;border-color:#0c1a28}.list-group-item-100{color:#767778;background-color:#f7f7f8}.list-group-item-100.list-group-item-action:focus,.list-group-item-100.list-group-item-action:hover{color:#767778;background-color:#e9e9ec}.list-group-item-100.list-group-item-action.active{color:#fff;background-color:#767778;border-color:#767778}.list-group-item-200{color:#69696a;background-color:#f0f0f1}.list-group-item-200.list-group-item-action:focus,.list-group-item-200.list-group-item-action:hover{color:#69696a;background-color:#e3e3e5}.list-group-item-200.list-group-item-action.active{color:#fff;background-color:#69696a;border-color:#69696a}.list-group-item-300{color:#5c5c5d;background-color:#e9e9ea}.list-group-item-300.list-group-item-action:focus,.list-group-item-300.list-group-item-action:hover{color:#5c5c5d;background-color:#dcdcde}.list-group-item-300.list-group-item-action.active{color:#fff;background-color:#5c5c5d;border-color:#5c5c5d}.list-group-item-400{color:#4f4f50;background-color:#e2e2e2}.list-group-item-400.list-group-item-action:focus,.list-group-item-400.list-group-item-action:hover{color:#4f4f50;background-color:#d5d5d5}.list-group-item-400.list-group-item-action.active{color:#fff;background-color:#4f4f50;border-color:#4f4f50}.list-group-item-500{color:#424243;background-color:#dbdbdb}.list-group-item-500.list-group-item-action:focus,.list-group-item-500.list-group-item-action:hover{color:#424243;background-color:#cecece}.list-group-item-500.list-group-item-action.active{color:#fff;background-color:#424243;border-color:#424243}.list-group-item-600{color:#353535;background-color:#d4d4d4}.list-group-item-600.list-group-item-action:focus,.list-group-item-600.list-group-item-action:hover{color:#353535;background-color:#c7c7c7}.list-group-item-600.list-group-item-action.active{color:#fff;background-color:#353535;border-color:#353535}.list-group-item-700{color:#282828;background-color:#cdcdcd}.list-group-item-700.list-group-item-action:focus,.list-group-item-700.list-group-item-action:hover{color:#282828;background-color:silver}.list-group-item-700.list-group-item-action.active{color:#fff;background-color:#282828;border-color:#282828}.list-group-item-800{color:#1a1b1b;background-color:#c6c6c6}.list-group-item-800.list-group-item-action:focus,.list-group-item-800.list-group-item-action:hover{color:#1a1b1b;background-color:#b9b9b9}.list-group-item-800.list-group-item-action.active{color:#fff;background-color:#1a1b1b;border-color:#1a1b1b}.list-group-item-900{color:#0d0d0e;background-color:#bfbfbf}.list-group-item-900.list-group-item-action:focus,.list-group-item-900.list-group-item-action:hover{color:#0d0d0e;background-color:#b2b2b2}.list-group-item-900.list-group-item-action.active{color:#fff;background-color:#0d0d0e;border-color:#0d0d0e}.close{float:right;font-size:24px;font-size:1.5rem;font-weight:700;line-height:1;color:#000;text-shadow:0 1px 0 #fff;opacity:.5}.close:hover{color:#000;text-decoration:none}.close:not(:disabled):not(.disabled):focus,.close:not(:disabled):not(.disabled):hover{opacity:.75}button.close{padding:0;background-color:transparent;border:0;-webkit-appearance:none;-moz-appearance:none;appearance:none}a.close.disabled{pointer-events:none}.modal-open{overflow:hidden}.modal-open .modal{overflow-x:hidden;overflow-y:auto}.modal{position:fixed;top:0;left:0;z-index:1050;display:none;width:100%;height:100%;overflow:hidden;outline:0}.modal-dialog{position:relative;width:auto;margin:.5rem;pointer-events:none}.modal.fade .modal-dialog{-webkit-transition:-webkit-transform .3s ease-out;transition:-webkit-transform .3s ease-out;transition:transform .3s ease-out;transition:transform .3s ease-out,-webkit-transform .3s ease-out;-webkit-transform:translateY(-50px);transform:translateY(-50px)}@media (prefers-reduced-motion:reduce){.modal.fade .modal-dialog{-webkit-transition:none;transition:none}}.modal.show .modal-dialog{-webkit-transform:none;transform:none}.modal-dialog-scrollable{display:-webkit-box;display:-ms-flexbox;display:flex;max-height:calc(100% - 1rem)}.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 1rem);overflow:hidden}.modal-dialog-scrollable .modal-footer,.modal-dialog-scrollable .modal-header{-ms-flex-negative:0;flex-shrink:0}.modal-dialog-scrollable .modal-body{overflow-y:auto}.modal-dialog-centered{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;min-height:calc(100% - 1rem)}.modal-dialog-centered:before{display:block;height:calc(100vh - 1rem);content:""}.modal-dialog-centered.modal-dialog-scrollable{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;height:100%}.modal-dialog-centered.modal-dialog-scrollable .modal-content{max-height:none}.modal-dialog-centered.modal-dialog-scrollable:before{content:none}.modal-content{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;width:100%;pointer-events:auto;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.2);border-radius:8px;-webkit-box-shadow:0 .25rem .5rem rgba(0,0,0,.5);box-shadow:0 .25rem .5rem rgba(0,0,0,.5);outline:0}.modal-backdrop{position:fixed;top:0;left:0;z-index:1040;width:100vw;height:100vh;background-color:#000}.modal-backdrop.fade{opacity:0}.modal-backdrop.show{opacity:.8}.modal-header{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;padding:1.5rem;border-bottom:0 solid #b1b1b3;border-top-left-radius:8px;border-top-right-radius:8px}.modal-header .close{padding:1.5rem;margin:-1rem -1rem -1rem auto}.modal-title{margin-bottom:0;line-height:1.5}.modal-body{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;padding:1.5rem}.modal-footer{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:end;-ms-flex-pack:end;justify-content:flex-end;padding:1.5rem;border-top:0 solid #b1b1b3;border-bottom-right-radius:8px;border-bottom-left-radius:8px}.modal-footer>:not(:first-child){margin-left:.25rem}.modal-footer>:not(:last-child){margin-right:.25rem}.modal-scrollbar-measure{position:absolute;top:-9999px;width:50px;height:50px;overflow:scroll}@media (min-width:576px){.modal-dialog{max-width:500px;margin:1.5rem auto}.modal-dialog-scrollable{max-height:calc(100% - 3rem)}.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 3rem)}.modal-dialog-centered{min-height:calc(100% - 3rem)}.modal-dialog-centered:before{height:calc(100vh - 3rem)}.modal-content{-webkit-box-shadow:0 .5rem 1rem rgba(0,0,0,.5);box-shadow:0 .5rem 1rem rgba(0,0,0,.5)}.modal-sm{max-width:300px}}@media (min-width:992px){.modal-lg,.modal-xl{max-width:800px}}@media (min-width:1200px){.modal-xl{max-width:1140px}}.tooltip{position:absolute;z-index:1070;display:block;margin:0;font-family:Titillium Web,Geneva,Tahoma,sans-serif;font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:14px;font-size:.875rem;word-wrap:break-word;opacity:0}.tooltip.show{opacity:1}.tooltip .arrow{position:absolute;display:block;width:12.8px;width:.8rem;height:6.4px;height:.4rem}.tooltip .arrow:before{position:absolute;content:"";border-color:transparent;border-style:solid}.bs-tooltip-auto[x-placement^=top],.bs-tooltip-top{padding:.4rem 0}.bs-tooltip-auto[x-placement^=top] .arrow,.bs-tooltip-top .arrow{bottom:0}.bs-tooltip-auto[x-placement^=top] .arrow:before,.bs-tooltip-top .arrow:before{top:0;border-width:.4rem .4rem 0;border-top-color:#004a4d}.bs-tooltip-auto[x-placement^=right],.bs-tooltip-right{padding:0 .4rem}.bs-tooltip-auto[x-placement^=right] .arrow,.bs-tooltip-right .arrow{left:0;width:6.4px;width:.4rem;height:12.8px;height:.8rem}.bs-tooltip-auto[x-placement^=right] .arrow:before,.bs-tooltip-right .arrow:before{right:0;border-width:.4rem .4rem .4rem 0;border-right-color:#004a4d}.bs-tooltip-auto[x-placement^=bottom],.bs-tooltip-bottom{padding:.4rem 0}.bs-tooltip-auto[x-placement^=bottom] .arrow,.bs-tooltip-bottom .arrow{top:0}.bs-tooltip-auto[x-placement^=bottom] .arrow:before,.bs-tooltip-bottom .arrow:before{bottom:0;border-width:0 .4rem .4rem;border-bottom-color:#004a4d}.bs-tooltip-auto[x-placement^=left],.bs-tooltip-left{padding:0 .4rem}.bs-tooltip-auto[x-placement^=left] .arrow,.bs-tooltip-left .arrow{right:0;width:6.4px;width:.4rem;height:12.8px;height:.8rem}.bs-tooltip-auto[x-placement^=left] .arrow:before,.bs-tooltip-left .arrow:before{left:0;border-width:.4rem 0 .4rem .4rem;border-left-color:#004a4d}.tooltip-inner{max-width:32em;padding:1rem;color:#fff;text-align:center;background-color:#004a4d;border-radius:4px}.popover{top:0;left:0;z-index:1060;max-width:276px;font-family:Titillium Web,Geneva,Tahoma,sans-serif;font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:14px;font-size:.875rem;word-wrap:break-word;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.2);border-radius:8px;-webkit-box-shadow:0 .25rem .5rem rgba(0,0,0,.2);box-shadow:0 .25rem .5rem rgba(0,0,0,.2)}.popover,.popover .arrow{position:absolute;display:block}.popover .arrow{width:16px;width:1rem;height:8px;height:.5rem;margin:0 8px}.popover .arrow:after,.popover .arrow:before{position:absolute;display:block;content:"";border-color:transparent;border-style:solid}.bs-popover-auto[x-placement^=top],.bs-popover-top{margin-bottom:.5rem}.bs-popover-auto[x-placement^=top]>.arrow,.bs-popover-top>.arrow{bottom:calc(-.5rem + -1px)}.bs-popover-auto[x-placement^=top]>.arrow:before,.bs-popover-top>.arrow:before{bottom:0;border-width:.5rem .5rem 0;border-top-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=top]>.arrow:after,.bs-popover-top>.arrow:after{bottom:1px;border-width:.5rem .5rem 0;border-top-color:#fff}.bs-popover-auto[x-placement^=right],.bs-popover-right{margin-left:.5rem}.bs-popover-auto[x-placement^=right]>.arrow,.bs-popover-right>.arrow{left:calc(-.5rem + -1px);width:8px;width:.5rem;height:16px;height:1rem;margin:8px 0}.bs-popover-auto[x-placement^=right]>.arrow:before,.bs-popover-right>.arrow:before{left:0;border-width:.5rem .5rem .5rem 0;border-right-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=right]>.arrow:after,.bs-popover-right>.arrow:after{left:1px;border-width:.5rem .5rem .5rem 0;border-right-color:#fff}.bs-popover-auto[x-placement^=bottom],.bs-popover-bottom{margin-top:.5rem}.bs-popover-auto[x-placement^=bottom]>.arrow,.bs-popover-bottom>.arrow{top:calc(-.5rem + -1px)}.bs-popover-auto[x-placement^=bottom]>.arrow:before,.bs-popover-bottom>.arrow:before{top:0;border-width:0 .5rem .5rem;border-bottom-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=bottom]>.arrow:after,.bs-popover-bottom>.arrow:after{top:1px;border-width:0 .5rem .5rem;border-bottom-color:#fff}.bs-popover-auto[x-placement^=bottom] .popover-header:before,.bs-popover-bottom .popover-header:before{position:absolute;top:0;left:50%;display:block;width:16px;width:1rem;margin-left:-.5rem;content:"";border-bottom:1px solid #f7f7f7}.bs-popover-auto[x-placement^=left],.bs-popover-left{margin-right:.5rem}.bs-popover-auto[x-placement^=left]>.arrow,.bs-popover-left>.arrow{right:calc(-.5rem + -1px);width:8px;width:.5rem;height:16px;height:1rem;margin:8px 0}.bs-popover-auto[x-placement^=left]>.arrow:before,.bs-popover-left>.arrow:before{right:0;border-width:.5rem 0 .5rem .5rem;border-left-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=left]>.arrow:after,.bs-popover-left>.arrow:after{right:1px;border-width:.5rem 0 .5rem .5rem;border-left-color:#fff}.popover-header{padding:.5rem .75rem;margin-bottom:0;font-size:16px;font-size:1rem;background-color:#f7f7f7;border-bottom:1px solid #ebebeb;border-top-left-radius:7px;border-top-right-radius:7px}.popover-header:empty{display:none}.popover-body{padding:.5rem .75rem;color:#19191a}.carousel{position:relative}.carousel.pointer-event{-ms-touch-action:pan-y;touch-action:pan-y}.carousel-inner{position:relative;width:100%;overflow:hidden}.carousel-inner:after{display:block;clear:both;content:""}.carousel-item{position:relative;display:none;float:left;width:100%;margin-right:-100%;-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-transition:-webkit-transform .6s ease-in-out;transition:-webkit-transform .6s ease-in-out;transition:transform .6s ease-in-out;transition:transform .6s ease-in-out,-webkit-transform .6s ease-in-out}@media (prefers-reduced-motion:reduce){.carousel-item{-webkit-transition:none;transition:none}}.carousel-item-next,.carousel-item-prev,.carousel-item.active{display:block}.active.carousel-item-right,.carousel-item-next:not(.carousel-item-left){-webkit-transform:translateX(100%);transform:translateX(100%)}.active.carousel-item-left,.carousel-item-prev:not(.carousel-item-right){-webkit-transform:translateX(-100%);transform:translateX(-100%)}.carousel-fade .carousel-item{opacity:0;-webkit-transition-property:opacity;transition-property:opacity;-webkit-transform:none;transform:none}.carousel-fade .carousel-item-next.carousel-item-left,.carousel-fade .carousel-item-prev.carousel-item-right,.carousel-fade .carousel-item.active{z-index:1;opacity:1}.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{z-index:0;opacity:0;-webkit-transition:opacity 0s .6s;transition:opacity 0s .6s}@media (prefers-reduced-motion:reduce){.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{-webkit-transition:none;transition:none}}.carousel-control-next,.carousel-control-prev{position:absolute;top:0;bottom:0;z-index:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:auto;color:#5c6f82;text-align:center;opacity:1;-webkit-transition:opacity .15s ease;transition:opacity .15s ease}@media (prefers-reduced-motion:reduce){.carousel-control-next,.carousel-control-prev{-webkit-transition:none;transition:none}}.carousel-control-next:focus,.carousel-control-next:hover,.carousel-control-prev:focus,.carousel-control-prev:hover{color:#5c6f82;text-decoration:none;outline:0;opacity:.9}.carousel-control-prev{left:0}.carousel-control-next{right:0}.carousel-control-next-icon,.carousel-control-prev-icon{display:inline-block;width:32px;height:32px;background:no-repeat 50%/100% 100%}.carousel-control-prev-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 8 8'%3E%3Cpath d='M5.25 0l-4 4 4 4 1.5-1.5L4.25 4l2.5-2.5L5.25 0z'/%3E%3C/svg%3E")}.carousel-control-next-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 8 8'%3E%3Cpath d='M2.75 0l-1.5 1.5L3.75 4l-2.5 2.5L2.75 8l4-4-4-4z'/%3E%3C/svg%3E")}.carousel-indicators{position:absolute;right:0;bottom:0;left:0;z-index:15;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;padding-left:0;margin-right:auto;margin-left:auto;list-style:none}.carousel-indicators li{-webkit-box-sizing:content-box;box-sizing:content-box;-webkit-box-flex:0;-ms-flex:0 1 auto;flex:0 1 auto;width:30px;height:3px;margin-right:3px;margin-left:3px;text-indent:-999px;cursor:pointer;background-color:#fff;background-clip:padding-box;border-top:10px solid transparent;border-bottom:10px solid transparent;opacity:.5;-webkit-transition:opacity .6s ease;transition:opacity .6s ease}@media (prefers-reduced-motion:reduce){.carousel-indicators li{-webkit-transition:none;transition:none}}.carousel-indicators .active{opacity:1}.carousel-caption{position:absolute;right:15%;bottom:20px;left:15%;z-index:10;padding-top:20px;padding-bottom:20px;color:#fff;text-align:center}.align-baseline{vertical-align:baseline!important}.align-top{vertical-align:top!important}.align-middle{vertical-align:middle!important}.align-bottom{vertical-align:bottom!important}.align-text-bottom{vertical-align:text-bottom!important}.align-text-top{vertical-align:text-top!important}.bg-primary{background-color:#0073e6!important}a.bg-primary:focus,a.bg-primary:hover,button.bg-primary:focus,button.bg-primary:hover{background-color:#0059b3!important}.bg-secondary{background-color:#5c6f82!important}a.bg-secondary:focus,a.bg-secondary:hover,button.bg-secondary:focus,button.bg-secondary:hover{background-color:#475664!important}.bg-success{background-color:#00cc85!important}a.bg-success:focus,a.bg-success:hover,button.bg-success:focus,button.bg-success:hover{background-color:#009963!important}.bg-info{background-color:#979899!important}a.bg-info:focus,a.bg-info:hover,button.bg-info:focus,button.bg-info:hover{background-color:#7e7e80!important}.bg-warning{background-color:#f90!important}a.bg-warning:focus,a.bg-warning:hover,button.bg-warning:focus,button.bg-warning:hover{background-color:#cc7a00!important}.bg-danger{background-color:#f73e5a!important}a.bg-danger:focus,a.bg-danger:hover,button.bg-danger:focus,button.bg-danger:hover{background-color:#f50d30!important}.bg-light{background-color:#e9e6f2!important}a.bg-light:focus,a.bg-light:hover,button.bg-light:focus,button.bg-light:hover{background-color:#ccc4e1!important}.bg-dark{background-color:#17324d!important}a.bg-dark:focus,a.bg-dark:hover,button.bg-dark:focus,button.bg-dark:hover{background-color:#0b1825!important}.bg-100{background-color:#e3e4e6!important}a.bg-100:focus,a.bg-100:hover,button.bg-100:focus,button.bg-100:hover{background-color:#c9cacd!important}.bg-200{background-color:#cacacc!important}a.bg-200:focus,a.bg-200:hover,button.bg-200:focus,button.bg-200:hover{background-color:#b0b1b3!important}.bg-300{background-color:#b1b1b3!important}.bg-400,a.bg-300:focus,a.bg-300:hover,button.bg-300:focus,button.bg-300:hover{background-color:#979899!important}a.bg-400:focus,a.bg-400:hover,button.bg-400:focus,button.bg-400:hover{background-color:#7e7e80!important}.bg-500{background-color:#7e7f80!important}.bg-600,a.bg-500:focus,a.bg-500:hover,button.bg-500:focus,button.bg-500:hover{background-color:#656566!important}a.bg-600:focus,a.bg-600:hover,button.bg-600:focus,button.bg-600:hover{background-color:#4c4c4c!important}.bg-700{background-color:#4c4c4d!important}a.bg-700:focus,a.bg-700:hover,button.bg-700:focus,button.bg-700:hover{background-color:#323233!important}.bg-800{background-color:#323333!important}a.bg-800:focus,a.bg-800:hover,button.bg-800:focus,button.bg-800:hover{background-color:#191919!important}.bg-900{background-color:#19191a!important}a.bg-900:focus,a.bg-900:hover,button.bg-900:focus,button.bg-900:hover{background-color:#000!important}.bg-white{background-color:#fff!important}.bg-transparent{background-color:transparent!important}.border{border:1px solid #b1b1b3!important}.border-top{border-top:1px solid #b1b1b3!important}.border-right{border-right:1px solid #b1b1b3!important}.border-bottom{border-bottom:1px solid #b1b1b3!important}.border-left{border-left:1px solid #b1b1b3!important}.border-0{border:0!important}.border-top-0{border-top:0!important}.border-right-0{border-right:0!important}.border-bottom-0{border-bottom:0!important}.border-left-0{border-left:0!important}.border-primary{border-color:#0073e6!important}.border-secondary{border-color:#5c6f82!important}.border-success{border-color:#00cc85!important}.border-info{border-color:#979899!important}.border-warning{border-color:#f90!important}.border-danger{border-color:#f73e5a!important}.border-light{border-color:#e9e6f2!important}.border-dark{border-color:#17324d!important}.border-100{border-color:#e3e4e6!important}.border-200{border-color:#cacacc!important}.border-300{border-color:#b1b1b3!important}.border-400{border-color:#979899!important}.border-500{border-color:#7e7f80!important}.border-600{border-color:#656566!important}.border-700{border-color:#4c4c4d!important}.border-800{border-color:#323333!important}.border-900{border-color:#19191a!important}.border-white{border-color:#fff!important}.rounded-sm{border-radius:2px!important}.rounded{border-radius:4px!important}.rounded-top{border-top-left-radius:4px!important}.rounded-right,.rounded-top{border-top-right-radius:4px!important}.rounded-bottom,.rounded-right{border-bottom-right-radius:4px!important}.rounded-bottom,.rounded-left{border-bottom-left-radius:4px!important}.rounded-left{border-top-left-radius:4px!important}.rounded-lg{border-radius:8px!important}.rounded-circle{border-radius:50%!important}.rounded-pill{border-radius:50rem!important}.rounded-0{border-radius:0!important}.clearfix:after{display:block;clear:both;content:""}.d-none{display:none!important}.d-inline{display:inline!important}.d-inline-block{display:inline-block!important}.d-block{display:block!important}.d-table{display:table!important}.d-table-row{display:table-row!important}.d-table-cell{display:table-cell!important}.d-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}@media (min-width:576px){.d-sm-none{display:none!important}.d-sm-inline{display:inline!important}.d-sm-inline-block{display:inline-block!important}.d-sm-block{display:block!important}.d-sm-table{display:table!important}.d-sm-table-row{display:table-row!important}.d-sm-table-cell{display:table-cell!important}.d-sm-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-sm-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media (min-width:768px){.d-md-none{display:none!important}.d-md-inline{display:inline!important}.d-md-inline-block{display:inline-block!important}.d-md-block{display:block!important}.d-md-table{display:table!important}.d-md-table-row{display:table-row!important}.d-md-table-cell{display:table-cell!important}.d-md-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-md-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media (min-width:992px){.d-lg-none{display:none!important}.d-lg-inline{display:inline!important}.d-lg-inline-block{display:inline-block!important}.d-lg-block{display:block!important}.d-lg-table{display:table!important}.d-lg-table-row{display:table-row!important}.d-lg-table-cell{display:table-cell!important}.d-lg-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-lg-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media (min-width:1200px){.d-xl-none{display:none!important}.d-xl-inline{display:inline!important}.d-xl-inline-block{display:inline-block!important}.d-xl-block{display:block!important}.d-xl-table{display:table!important}.d-xl-table-row{display:table-row!important}.d-xl-table-cell{display:table-cell!important}.d-xl-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-xl-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media print{.d-print-none{display:none!important}.d-print-inline{display:inline!important}.d-print-inline-block{display:inline-block!important}.d-print-block{display:block!important}.d-print-table{display:table!important}.d-print-table-row{display:table-row!important}.d-print-table-cell{display:table-cell!important}.d-print-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-print-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}.embed-responsive{position:relative;display:block;width:100%;padding:0;overflow:hidden}.embed-responsive:before{display:block;content:""}.embed-responsive .embed-responsive-item,.embed-responsive embed,.embed-responsive iframe,.embed-responsive object,.embed-responsive video{position:absolute;top:0;bottom:0;left:0;width:100%;height:100%;border:0}.embed-responsive-21by9:before{padding-top:42.8571428571%}.embed-responsive-16by9:before{padding-top:56.25%}.embed-responsive-4by3:before{padding-top:75%}.embed-responsive-1by1:before{padding-top:100%}.flex-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-column,.flex-row{-webkit-box-direction:normal!important}.flex-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-row-reverse{-webkit-box-orient:horizontal!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-column-reverse,.flex-row-reverse{-webkit-box-direction:reverse!important}.flex-column-reverse{-webkit-box-orient:vertical!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}@media (min-width:576px){.flex-sm-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-sm-column,.flex-sm-row{-webkit-box-direction:normal!important}.flex-sm-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-sm-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-sm-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-sm-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-sm-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-sm-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-sm-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-sm-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-sm-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-sm-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-sm-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-sm-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-sm-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-sm-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-sm-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-sm-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-sm-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-sm-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-sm-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-sm-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-sm-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-sm-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-sm-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-sm-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-sm-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-sm-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-sm-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-sm-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-sm-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-sm-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-sm-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-sm-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-sm-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}@media (min-width:768px){.flex-md-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-md-column,.flex-md-row{-webkit-box-direction:normal!important}.flex-md-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-md-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-md-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-md-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-md-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-md-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-md-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-md-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-md-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-md-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-md-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-md-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-md-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-md-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-md-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-md-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-md-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-md-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-md-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-md-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-md-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-md-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-md-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-md-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-md-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-md-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-md-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-md-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-md-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-md-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-md-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-md-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-md-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}@media (min-width:992px){.flex-lg-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-lg-column,.flex-lg-row{-webkit-box-direction:normal!important}.flex-lg-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-lg-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-lg-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-lg-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-lg-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-lg-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-lg-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-lg-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-lg-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-lg-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-lg-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-lg-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-lg-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-lg-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-lg-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-lg-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-lg-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-lg-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-lg-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-lg-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-lg-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-lg-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-lg-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-lg-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-lg-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-lg-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-lg-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-lg-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-lg-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-lg-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-lg-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-lg-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-lg-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}@media (min-width:1200px){.flex-xl-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-xl-column,.flex-xl-row{-webkit-box-direction:normal!important}.flex-xl-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-xl-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-xl-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-xl-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-xl-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-xl-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-xl-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-xl-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-xl-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-xl-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-xl-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-xl-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-xl-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-xl-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-xl-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-xl-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-xl-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-xl-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-xl-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-xl-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-xl-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-xl-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-xl-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-xl-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-xl-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-xl-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-xl-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-xl-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-xl-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-xl-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-xl-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-xl-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-xl-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}.float-left{float:left!important}.float-right{float:right!important}.float-none{float:none!important}@media (min-width:576px){.float-sm-left{float:left!important}.float-sm-right{float:right!important}.float-sm-none{float:none!important}}@media (min-width:768px){.float-md-left{float:left!important}.float-md-right{float:right!important}.float-md-none{float:none!important}}@media (min-width:992px){.float-lg-left{float:left!important}.float-lg-right{float:right!important}.float-lg-none{float:none!important}}@media (min-width:1200px){.float-xl-left{float:left!important}.float-xl-right{float:right!important}.float-xl-none{float:none!important}}.overflow-auto{overflow:auto!important}.overflow-hidden{overflow:hidden!important}.position-static{position:static!important}.position-relative{position:relative!important}.position-absolute{position:absolute!important}.position-fixed{position:fixed!important}.position-sticky{position:-webkit-sticky!important;position:sticky!important}.fixed-top{top:0}.fixed-bottom,.fixed-top{position:fixed;right:0;left:0;z-index:1030}.fixed-bottom{bottom:0}@supports ((position:-webkit-sticky) or (position:sticky)){.sticky-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}}.sr-only{position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;overflow:visible;clip:auto;white-space:normal}.shadow-sm{-webkit-box-shadow:0 .125rem .25rem rgba(0,0,0,.075)!important;box-shadow:0 .125rem .25rem rgba(0,0,0,.075)!important}.shadow{-webkit-box-shadow:0 .5rem 1rem rgba(0,0,0,.15)!important;box-shadow:0 .5rem 1rem rgba(0,0,0,.15)!important}.shadow-lg{-webkit-box-shadow:0 1rem 3rem rgba(0,0,0,.175)!important;box-shadow:0 1rem 3rem rgba(0,0,0,.175)!important}.shadow-none{-webkit-box-shadow:none!important;box-shadow:none!important}.w-25{width:25%!important}.w-50{width:50%!important}.w-75{width:75%!important}.w-100{width:100%!important}.w-auto{width:auto!important}.h-25{height:25%!important}.h-50{height:50%!important}.h-75{height:75%!important}.h-100{height:100%!important}.h-auto{height:auto!important}.mw-100{max-width:100%!important}.mh-100{max-height:100%!important}.min-vw-100{min-width:100vw!important}.min-vh-100{min-height:100vh!important}.vw-100{width:100vw!important}.vh-100{height:100vh!important}.stretched-link:after{position:absolute;top:0;right:0;bottom:0;left:0;z-index:1;pointer-events:auto;content:"";background-color:transparent}.m-0{margin:0!important}.mt-0,.my-0{margin-top:0!important}.mr-0,.mx-0{margin-right:0!important}.mb-0,.my-0{margin-bottom:0!important}.ml-0,.mx-0{margin-left:0!important}.m-1{margin:4px!important}.mt-1,.my-1{margin-top:4px!important}.mr-1,.mx-1{margin-right:4px!important}.mb-1,.my-1{margin-bottom:4px!important}.ml-1,.mx-1{margin-left:4px!important}.m-2{margin:8px!important}.mt-2,.my-2{margin-top:8px!important}.mr-2,.mx-2{margin-right:8px!important}.mb-2,.my-2{margin-bottom:8px!important}.ml-2,.mx-2{margin-left:8px!important}.m-3{margin:16px!important}.mt-3,.my-3{margin-top:16px!important}.mr-3,.mx-3{margin-right:16px!important}.mb-3,.my-3{margin-bottom:16px!important}.ml-3,.mx-3{margin-left:16px!important}.m-4{margin:24px!important}.mt-4,.my-4{margin-top:24px!important}.mr-4,.mx-4{margin-right:24px!important}.mb-4,.my-4{margin-bottom:24px!important}.ml-4,.mx-4{margin-left:24px!important}.m-5{margin:48px!important}.mt-5,.my-5{margin-top:48px!important}.mr-5,.mx-5{margin-right:48px!important}.mb-5,.my-5{margin-bottom:48px!important}.ml-5,.mx-5{margin-left:48px!important}.p-0{padding:0!important}.pt-0,.py-0{padding-top:0!important}.pr-0,.px-0{padding-right:0!important}.pb-0,.py-0{padding-bottom:0!important}.pl-0,.px-0{padding-left:0!important}.p-1{padding:4px!important}.pt-1,.py-1{padding-top:4px!important}.pr-1,.px-1{padding-right:4px!important}.pb-1,.py-1{padding-bottom:4px!important}.pl-1,.px-1{padding-left:4px!important}.p-2{padding:8px!important}.pt-2,.py-2{padding-top:8px!important}.pr-2,.px-2{padding-right:8px!important}.pb-2,.py-2{padding-bottom:8px!important}.pl-2,.px-2{padding-left:8px!important}.p-3{padding:16px!important}.pt-3,.py-3{padding-top:16px!important}.pr-3,.px-3{padding-right:16px!important}.pb-3,.py-3{padding-bottom:16px!important}.pl-3,.px-3{padding-left:16px!important}.p-4{padding:24px!important}.pt-4,.py-4{padding-top:24px!important}.pr-4,.px-4{padding-right:24px!important}.pb-4,.py-4{padding-bottom:24px!important}.pl-4,.px-4{padding-left:24px!important}.p-5{padding:48px!important}.pt-5,.py-5{padding-top:48px!important}.pr-5,.px-5{padding-right:48px!important}.pb-5,.py-5{padding-bottom:48px!important}.pl-5,.px-5{padding-left:48px!important}.m-n1{margin:-4px!important}.mt-n1,.my-n1{margin-top:-4px!important}.mr-n1,.mx-n1{margin-right:-4px!important}.mb-n1,.my-n1{margin-bottom:-4px!important}.ml-n1,.mx-n1{margin-left:-4px!important}.m-n2{margin:-8px!important}.mt-n2,.my-n2{margin-top:-8px!important}.mr-n2,.mx-n2{margin-right:-8px!important}.mb-n2,.my-n2{margin-bottom:-8px!important}.ml-n2,.mx-n2{margin-left:-8px!important}.m-n3{margin:-16px!important}.mt-n3,.my-n3{margin-top:-16px!important}.mr-n3,.mx-n3{margin-right:-16px!important}.mb-n3,.my-n3{margin-bottom:-16px!important}.ml-n3,.mx-n3{margin-left:-16px!important}.m-n4{margin:-24px!important}.mt-n4,.my-n4{margin-top:-24px!important}.mr-n4,.mx-n4{margin-right:-24px!important}.mb-n4,.my-n4{margin-bottom:-24px!important}.ml-n4,.mx-n4{margin-left:-24px!important}.m-n5{margin:-48px!important}.mt-n5,.my-n5{margin-top:-48px!important}.mr-n5,.mx-n5{margin-right:-48px!important}.mb-n5,.my-n5{margin-bottom:-48px!important}.ml-n5,.mx-n5{margin-left:-48px!important}.m-auto{margin:auto!important}.mt-auto,.my-auto{margin-top:auto!important}.mr-auto,.mx-auto{margin-right:auto!important}.mb-auto,.my-auto{margin-bottom:auto!important}.ml-auto,.mx-auto{margin-left:auto!important}@media (min-width:576px){.m-sm-0{margin:0!important}.mt-sm-0,.my-sm-0{margin-top:0!important}.mr-sm-0,.mx-sm-0{margin-right:0!important}.mb-sm-0,.my-sm-0{margin-bottom:0!important}.ml-sm-0,.mx-sm-0{margin-left:0!important}.m-sm-1{margin:4px!important}.mt-sm-1,.my-sm-1{margin-top:4px!important}.mr-sm-1,.mx-sm-1{margin-right:4px!important}.mb-sm-1,.my-sm-1{margin-bottom:4px!important}.ml-sm-1,.mx-sm-1{margin-left:4px!important}.m-sm-2{margin:8px!important}.mt-sm-2,.my-sm-2{margin-top:8px!important}.mr-sm-2,.mx-sm-2{margin-right:8px!important}.mb-sm-2,.my-sm-2{margin-bottom:8px!important}.ml-sm-2,.mx-sm-2{margin-left:8px!important}.m-sm-3{margin:16px!important}.mt-sm-3,.my-sm-3{margin-top:16px!important}.mr-sm-3,.mx-sm-3{margin-right:16px!important}.mb-sm-3,.my-sm-3{margin-bottom:16px!important}.ml-sm-3,.mx-sm-3{margin-left:16px!important}.m-sm-4{margin:24px!important}.mt-sm-4,.my-sm-4{margin-top:24px!important}.mr-sm-4,.mx-sm-4{margin-right:24px!important}.mb-sm-4,.my-sm-4{margin-bottom:24px!important}.ml-sm-4,.mx-sm-4{margin-left:24px!important}.m-sm-5{margin:48px!important}.mt-sm-5,.my-sm-5{margin-top:48px!important}.mr-sm-5,.mx-sm-5{margin-right:48px!important}.mb-sm-5,.my-sm-5{margin-bottom:48px!important}.ml-sm-5,.mx-sm-5{margin-left:48px!important}.p-sm-0{padding:0!important}.pt-sm-0,.py-sm-0{padding-top:0!important}.pr-sm-0,.px-sm-0{padding-right:0!important}.pb-sm-0,.py-sm-0{padding-bottom:0!important}.pl-sm-0,.px-sm-0{padding-left:0!important}.p-sm-1{padding:4px!important}.pt-sm-1,.py-sm-1{padding-top:4px!important}.pr-sm-1,.px-sm-1{padding-right:4px!important}.pb-sm-1,.py-sm-1{padding-bottom:4px!important}.pl-sm-1,.px-sm-1{padding-left:4px!important}.p-sm-2{padding:8px!important}.pt-sm-2,.py-sm-2{padding-top:8px!important}.pr-sm-2,.px-sm-2{padding-right:8px!important}.pb-sm-2,.py-sm-2{padding-bottom:8px!important}.pl-sm-2,.px-sm-2{padding-left:8px!important}.p-sm-3{padding:16px!important}.pt-sm-3,.py-sm-3{padding-top:16px!important}.pr-sm-3,.px-sm-3{padding-right:16px!important}.pb-sm-3,.py-sm-3{padding-bottom:16px!important}.pl-sm-3,.px-sm-3{padding-left:16px!important}.p-sm-4{padding:24px!important}.pt-sm-4,.py-sm-4{padding-top:24px!important}.pr-sm-4,.px-sm-4{padding-right:24px!important}.pb-sm-4,.py-sm-4{padding-bottom:24px!important}.pl-sm-4,.px-sm-4{padding-left:24px!important}.p-sm-5{padding:48px!important}.pt-sm-5,.py-sm-5{padding-top:48px!important}.pr-sm-5,.px-sm-5{padding-right:48px!important}.pb-sm-5,.py-sm-5{padding-bottom:48px!important}.pl-sm-5,.px-sm-5{padding-left:48px!important}.m-sm-n1{margin:-4px!important}.mt-sm-n1,.my-sm-n1{margin-top:-4px!important}.mr-sm-n1,.mx-sm-n1{margin-right:-4px!important}.mb-sm-n1,.my-sm-n1{margin-bottom:-4px!important}.ml-sm-n1,.mx-sm-n1{margin-left:-4px!important}.m-sm-n2{margin:-8px!important}.mt-sm-n2,.my-sm-n2{margin-top:-8px!important}.mr-sm-n2,.mx-sm-n2{margin-right:-8px!important}.mb-sm-n2,.my-sm-n2{margin-bottom:-8px!important}.ml-sm-n2,.mx-sm-n2{margin-left:-8px!important}.m-sm-n3{margin:-16px!important}.mt-sm-n3,.my-sm-n3{margin-top:-16px!important}.mr-sm-n3,.mx-sm-n3{margin-right:-16px!important}.mb-sm-n3,.my-sm-n3{margin-bottom:-16px!important}.ml-sm-n3,.mx-sm-n3{margin-left:-16px!important}.m-sm-n4{margin:-24px!important}.mt-sm-n4,.my-sm-n4{margin-top:-24px!important}.mr-sm-n4,.mx-sm-n4{margin-right:-24px!important}.mb-sm-n4,.my-sm-n4{margin-bottom:-24px!important}.ml-sm-n4,.mx-sm-n4{margin-left:-24px!important}.m-sm-n5{margin:-48px!important}.mt-sm-n5,.my-sm-n5{margin-top:-48px!important}.mr-sm-n5,.mx-sm-n5{margin-right:-48px!important}.mb-sm-n5,.my-sm-n5{margin-bottom:-48px!important}.ml-sm-n5,.mx-sm-n5{margin-left:-48px!important}.m-sm-auto{margin:auto!important}.mt-sm-auto,.my-sm-auto{margin-top:auto!important}.mr-sm-auto,.mx-sm-auto{margin-right:auto!important}.mb-sm-auto,.my-sm-auto{margin-bottom:auto!important}.ml-sm-auto,.mx-sm-auto{margin-left:auto!important}}@media (min-width:768px){.m-md-0{margin:0!important}.mt-md-0,.my-md-0{margin-top:0!important}.mr-md-0,.mx-md-0{margin-right:0!important}.mb-md-0,.my-md-0{margin-bottom:0!important}.ml-md-0,.mx-md-0{margin-left:0!important}.m-md-1{margin:4px!important}.mt-md-1,.my-md-1{margin-top:4px!important}.mr-md-1,.mx-md-1{margin-right:4px!important}.mb-md-1,.my-md-1{margin-bottom:4px!important}.ml-md-1,.mx-md-1{margin-left:4px!important}.m-md-2{margin:8px!important}.mt-md-2,.my-md-2{margin-top:8px!important}.mr-md-2,.mx-md-2{margin-right:8px!important}.mb-md-2,.my-md-2{margin-bottom:8px!important}.ml-md-2,.mx-md-2{margin-left:8px!important}.m-md-3{margin:16px!important}.mt-md-3,.my-md-3{margin-top:16px!important}.mr-md-3,.mx-md-3{margin-right:16px!important}.mb-md-3,.my-md-3{margin-bottom:16px!important}.ml-md-3,.mx-md-3{margin-left:16px!important}.m-md-4{margin:24px!important}.mt-md-4,.my-md-4{margin-top:24px!important}.mr-md-4,.mx-md-4{margin-right:24px!important}.mb-md-4,.my-md-4{margin-bottom:24px!important}.ml-md-4,.mx-md-4{margin-left:24px!important}.m-md-5{margin:48px!important}.mt-md-5,.my-md-5{margin-top:48px!important}.mr-md-5,.mx-md-5{margin-right:48px!important}.mb-md-5,.my-md-5{margin-bottom:48px!important}.ml-md-5,.mx-md-5{margin-left:48px!important}.p-md-0{padding:0!important}.pt-md-0,.py-md-0{padding-top:0!important}.pr-md-0,.px-md-0{padding-right:0!important}.pb-md-0,.py-md-0{padding-bottom:0!important}.pl-md-0,.px-md-0{padding-left:0!important}.p-md-1{padding:4px!important}.pt-md-1,.py-md-1{padding-top:4px!important}.pr-md-1,.px-md-1{padding-right:4px!important}.pb-md-1,.py-md-1{padding-bottom:4px!important}.pl-md-1,.px-md-1{padding-left:4px!important}.p-md-2{padding:8px!important}.pt-md-2,.py-md-2{padding-top:8px!important}.pr-md-2,.px-md-2{padding-right:8px!important}.pb-md-2,.py-md-2{padding-bottom:8px!important}.pl-md-2,.px-md-2{padding-left:8px!important}.p-md-3{padding:16px!important}.pt-md-3,.py-md-3{padding-top:16px!important}.pr-md-3,.px-md-3{padding-right:16px!important}.pb-md-3,.py-md-3{padding-bottom:16px!important}.pl-md-3,.px-md-3{padding-left:16px!important}.p-md-4{padding:24px!important}.pt-md-4,.py-md-4{padding-top:24px!important}.pr-md-4,.px-md-4{padding-right:24px!important}.pb-md-4,.py-md-4{padding-bottom:24px!important}.pl-md-4,.px-md-4{padding-left:24px!important}.p-md-5{padding:48px!important}.pt-md-5,.py-md-5{padding-top:48px!important}.pr-md-5,.px-md-5{padding-right:48px!important}.pb-md-5,.py-md-5{padding-bottom:48px!important}.pl-md-5,.px-md-5{padding-left:48px!important}.m-md-n1{margin:-4px!important}.mt-md-n1,.my-md-n1{margin-top:-4px!important}.mr-md-n1,.mx-md-n1{margin-right:-4px!important}.mb-md-n1,.my-md-n1{margin-bottom:-4px!important}.ml-md-n1,.mx-md-n1{margin-left:-4px!important}.m-md-n2{margin:-8px!important}.mt-md-n2,.my-md-n2{margin-top:-8px!important}.mr-md-n2,.mx-md-n2{margin-right:-8px!important}.mb-md-n2,.my-md-n2{margin-bottom:-8px!important}.ml-md-n2,.mx-md-n2{margin-left:-8px!important}.m-md-n3{margin:-16px!important}.mt-md-n3,.my-md-n3{margin-top:-16px!important}.mr-md-n3,.mx-md-n3{margin-right:-16px!important}.mb-md-n3,.my-md-n3{margin-bottom:-16px!important}.ml-md-n3,.mx-md-n3{margin-left:-16px!important}.m-md-n4{margin:-24px!important}.mt-md-n4,.my-md-n4{margin-top:-24px!important}.mr-md-n4,.mx-md-n4{margin-right:-24px!important}.mb-md-n4,.my-md-n4{margin-bottom:-24px!important}.ml-md-n4,.mx-md-n4{margin-left:-24px!important}.m-md-n5{margin:-48px!important}.mt-md-n5,.my-md-n5{margin-top:-48px!important}.mr-md-n5,.mx-md-n5{margin-right:-48px!important}.mb-md-n5,.my-md-n5{margin-bottom:-48px!important}.ml-md-n5,.mx-md-n5{margin-left:-48px!important}.m-md-auto{margin:auto!important}.mt-md-auto,.my-md-auto{margin-top:auto!important}.mr-md-auto,.mx-md-auto{margin-right:auto!important}.mb-md-auto,.my-md-auto{margin-bottom:auto!important}.ml-md-auto,.mx-md-auto{margin-left:auto!important}}@media (min-width:992px){.m-lg-0{margin:0!important}.mt-lg-0,.my-lg-0{margin-top:0!important}.mr-lg-0,.mx-lg-0{margin-right:0!important}.mb-lg-0,.my-lg-0{margin-bottom:0!important}.ml-lg-0,.mx-lg-0{margin-left:0!important}.m-lg-1{margin:4px!important}.mt-lg-1,.my-lg-1{margin-top:4px!important}.mr-lg-1,.mx-lg-1{margin-right:4px!important}.mb-lg-1,.my-lg-1{margin-bottom:4px!important}.ml-lg-1,.mx-lg-1{margin-left:4px!important}.m-lg-2{margin:8px!important}.mt-lg-2,.my-lg-2{margin-top:8px!important}.mr-lg-2,.mx-lg-2{margin-right:8px!important}.mb-lg-2,.my-lg-2{margin-bottom:8px!important}.ml-lg-2,.mx-lg-2{margin-left:8px!important}.m-lg-3{margin:16px!important}.mt-lg-3,.my-lg-3{margin-top:16px!important}.mr-lg-3,.mx-lg-3{margin-right:16px!important}.mb-lg-3,.my-lg-3{margin-bottom:16px!important}.ml-lg-3,.mx-lg-3{margin-left:16px!important}.m-lg-4{margin:24px!important}.mt-lg-4,.my-lg-4{margin-top:24px!important}.mr-lg-4,.mx-lg-4{margin-right:24px!important}.mb-lg-4,.my-lg-4{margin-bottom:24px!important}.ml-lg-4,.mx-lg-4{margin-left:24px!important}.m-lg-5{margin:48px!important}.mt-lg-5,.my-lg-5{margin-top:48px!important}.mr-lg-5,.mx-lg-5{margin-right:48px!important}.mb-lg-5,.my-lg-5{margin-bottom:48px!important}.ml-lg-5,.mx-lg-5{margin-left:48px!important}.p-lg-0{padding:0!important}.pt-lg-0,.py-lg-0{padding-top:0!important}.pr-lg-0,.px-lg-0{padding-right:0!important}.pb-lg-0,.py-lg-0{padding-bottom:0!important}.pl-lg-0,.px-lg-0{padding-left:0!important}.p-lg-1{padding:4px!important}.pt-lg-1,.py-lg-1{padding-top:4px!important}.pr-lg-1,.px-lg-1{padding-right:4px!important}.pb-lg-1,.py-lg-1{padding-bottom:4px!important}.pl-lg-1,.px-lg-1{padding-left:4px!important}.p-lg-2{padding:8px!important}.pt-lg-2,.py-lg-2{padding-top:8px!important}.pr-lg-2,.px-lg-2{padding-right:8px!important}.pb-lg-2,.py-lg-2{padding-bottom:8px!important}.pl-lg-2,.px-lg-2{padding-left:8px!important}.p-lg-3{padding:16px!important}.pt-lg-3,.py-lg-3{padding-top:16px!important}.pr-lg-3,.px-lg-3{padding-right:16px!important}.pb-lg-3,.py-lg-3{padding-bottom:16px!important}.pl-lg-3,.px-lg-3{padding-left:16px!important}.p-lg-4{padding:24px!important}.pt-lg-4,.py-lg-4{padding-top:24px!important}.pr-lg-4,.px-lg-4{padding-right:24px!important}.pb-lg-4,.py-lg-4{padding-bottom:24px!important}.pl-lg-4,.px-lg-4{padding-left:24px!important}.p-lg-5{padding:48px!important}.pt-lg-5,.py-lg-5{padding-top:48px!important}.pr-lg-5,.px-lg-5{padding-right:48px!important}.pb-lg-5,.py-lg-5{padding-bottom:48px!important}.pl-lg-5,.px-lg-5{padding-left:48px!important}.m-lg-n1{margin:-4px!important}.mt-lg-n1,.my-lg-n1{margin-top:-4px!important}.mr-lg-n1,.mx-lg-n1{margin-right:-4px!important}.mb-lg-n1,.my-lg-n1{margin-bottom:-4px!important}.ml-lg-n1,.mx-lg-n1{margin-left:-4px!important}.m-lg-n2{margin:-8px!important}.mt-lg-n2,.my-lg-n2{margin-top:-8px!important}.mr-lg-n2,.mx-lg-n2{margin-right:-8px!important}.mb-lg-n2,.my-lg-n2{margin-bottom:-8px!important}.ml-lg-n2,.mx-lg-n2{margin-left:-8px!important}.m-lg-n3{margin:-16px!important}.mt-lg-n3,.my-lg-n3{margin-top:-16px!important}.mr-lg-n3,.mx-lg-n3{margin-right:-16px!important}.mb-lg-n3,.my-lg-n3{margin-bottom:-16px!important}.ml-lg-n3,.mx-lg-n3{margin-left:-16px!important}.m-lg-n4{margin:-24px!important}.mt-lg-n4,.my-lg-n4{margin-top:-24px!important}.mr-lg-n4,.mx-lg-n4{margin-right:-24px!important}.mb-lg-n4,.my-lg-n4{margin-bottom:-24px!important}.ml-lg-n4,.mx-lg-n4{margin-left:-24px!important}.m-lg-n5{margin:-48px!important}.mt-lg-n5,.my-lg-n5{margin-top:-48px!important}.mr-lg-n5,.mx-lg-n5{margin-right:-48px!important}.mb-lg-n5,.my-lg-n5{margin-bottom:-48px!important}.ml-lg-n5,.mx-lg-n5{margin-left:-48px!important}.m-lg-auto{margin:auto!important}.mt-lg-auto,.my-lg-auto{margin-top:auto!important}.mr-lg-auto,.mx-lg-auto{margin-right:auto!important}.mb-lg-auto,.my-lg-auto{margin-bottom:auto!important}.ml-lg-auto,.mx-lg-auto{margin-left:auto!important}}@media (min-width:1200px){.m-xl-0{margin:0!important}.mt-xl-0,.my-xl-0{margin-top:0!important}.mr-xl-0,.mx-xl-0{margin-right:0!important}.mb-xl-0,.my-xl-0{margin-bottom:0!important}.ml-xl-0,.mx-xl-0{margin-left:0!important}.m-xl-1{margin:4px!important}.mt-xl-1,.my-xl-1{margin-top:4px!important}.mr-xl-1,.mx-xl-1{margin-right:4px!important}.mb-xl-1,.my-xl-1{margin-bottom:4px!important}.ml-xl-1,.mx-xl-1{margin-left:4px!important}.m-xl-2{margin:8px!important}.mt-xl-2,.my-xl-2{margin-top:8px!important}.mr-xl-2,.mx-xl-2{margin-right:8px!important}.mb-xl-2,.my-xl-2{margin-bottom:8px!important}.ml-xl-2,.mx-xl-2{margin-left:8px!important}.m-xl-3{margin:16px!important}.mt-xl-3,.my-xl-3{margin-top:16px!important}.mr-xl-3,.mx-xl-3{margin-right:16px!important}.mb-xl-3,.my-xl-3{margin-bottom:16px!important}.ml-xl-3,.mx-xl-3{margin-left:16px!important}.m-xl-4{margin:24px!important}.mt-xl-4,.my-xl-4{margin-top:24px!important}.mr-xl-4,.mx-xl-4{margin-right:24px!important}.mb-xl-4,.my-xl-4{margin-bottom:24px!important}.ml-xl-4,.mx-xl-4{margin-left:24px!important}.m-xl-5{margin:48px!important}.mt-xl-5,.my-xl-5{margin-top:48px!important}.mr-xl-5,.mx-xl-5{margin-right:48px!important}.mb-xl-5,.my-xl-5{margin-bottom:48px!important}.ml-xl-5,.mx-xl-5{margin-left:48px!important}.p-xl-0{padding:0!important}.pt-xl-0,.py-xl-0{padding-top:0!important}.pr-xl-0,.px-xl-0{padding-right:0!important}.pb-xl-0,.py-xl-0{padding-bottom:0!important}.pl-xl-0,.px-xl-0{padding-left:0!important}.p-xl-1{padding:4px!important}.pt-xl-1,.py-xl-1{padding-top:4px!important}.pr-xl-1,.px-xl-1{padding-right:4px!important}.pb-xl-1,.py-xl-1{padding-bottom:4px!important}.pl-xl-1,.px-xl-1{padding-left:4px!important}.p-xl-2{padding:8px!important}.pt-xl-2,.py-xl-2{padding-top:8px!important}.pr-xl-2,.px-xl-2{padding-right:8px!important}.pb-xl-2,.py-xl-2{padding-bottom:8px!important}.pl-xl-2,.px-xl-2{padding-left:8px!important}.p-xl-3{padding:16px!important}.pt-xl-3,.py-xl-3{padding-top:16px!important}.pr-xl-3,.px-xl-3{padding-right:16px!important}.pb-xl-3,.py-xl-3{padding-bottom:16px!important}.pl-xl-3,.px-xl-3{padding-left:16px!important}.p-xl-4{padding:24px!important}.pt-xl-4,.py-xl-4{padding-top:24px!important}.pr-xl-4,.px-xl-4{padding-right:24px!important}.pb-xl-4,.py-xl-4{padding-bottom:24px!important}.pl-xl-4,.px-xl-4{padding-left:24px!important}.p-xl-5{padding:48px!important}.pt-xl-5,.py-xl-5{padding-top:48px!important}.pr-xl-5,.px-xl-5{padding-right:48px!important}.pb-xl-5,.py-xl-5{padding-bottom:48px!important}.pl-xl-5,.px-xl-5{padding-left:48px!important}.m-xl-n1{margin:-4px!important}.mt-xl-n1,.my-xl-n1{margin-top:-4px!important}.mr-xl-n1,.mx-xl-n1{margin-right:-4px!important}.mb-xl-n1,.my-xl-n1{margin-bottom:-4px!important}.ml-xl-n1,.mx-xl-n1{margin-left:-4px!important}.m-xl-n2{margin:-8px!important}.mt-xl-n2,.my-xl-n2{margin-top:-8px!important}.mr-xl-n2,.mx-xl-n2{margin-right:-8px!important}.mb-xl-n2,.my-xl-n2{margin-bottom:-8px!important}.ml-xl-n2,.mx-xl-n2{margin-left:-8px!important}.m-xl-n3{margin:-16px!important}.mt-xl-n3,.my-xl-n3{margin-top:-16px!important}.mr-xl-n3,.mx-xl-n3{margin-right:-16px!important}.mb-xl-n3,.my-xl-n3{margin-bottom:-16px!important}.ml-xl-n3,.mx-xl-n3{margin-left:-16px!important}.m-xl-n4{margin:-24px!important}.mt-xl-n4,.my-xl-n4{margin-top:-24px!important}.mr-xl-n4,.mx-xl-n4{margin-right:-24px!important}.mb-xl-n4,.my-xl-n4{margin-bottom:-24px!important}.ml-xl-n4,.mx-xl-n4{margin-left:-24px!important}.m-xl-n5{margin:-48px!important}.mt-xl-n5,.my-xl-n5{margin-top:-48px!important}.mr-xl-n5,.mx-xl-n5{margin-right:-48px!important}.mb-xl-n5,.my-xl-n5{margin-bottom:-48px!important}.ml-xl-n5,.mx-xl-n5{margin-left:-48px!important}.m-xl-auto{margin:auto!important}.mt-xl-auto,.my-xl-auto{margin-top:auto!important}.mr-xl-auto,.mx-xl-auto{margin-right:auto!important}.mb-xl-auto,.my-xl-auto{margin-bottom:auto!important}.ml-xl-auto,.mx-xl-auto{margin-left:auto!important}}.text-monospace{font-family:Roboto Mono,monospace!important}.text-justify{text-align:justify!important}.text-wrap{white-space:normal!important}.text-nowrap{white-space:nowrap!important}.text-truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.text-left{text-align:left!important}.text-right{text-align:right!important}.text-center{text-align:center!important}@media (min-width:576px){.text-sm-left{text-align:left!important}.text-sm-right{text-align:right!important}.text-sm-center{text-align:center!important}}@media (min-width:768px){.text-md-left{text-align:left!important}.text-md-right{text-align:right!important}.text-md-center{text-align:center!important}}@media (min-width:992px){.text-lg-left{text-align:left!important}.text-lg-right{text-align:right!important}.text-lg-center{text-align:center!important}}@media (min-width:1200px){.text-xl-left{text-align:left!important}.text-xl-right{text-align:right!important}.text-xl-center{text-align:center!important}}.text-lowercase{text-transform:lowercase!important}.text-uppercase{text-transform:uppercase!important}.text-capitalize{text-transform:capitalize!important}.font-weight-light{font-weight:300!important}.font-weight-lighter{font-weight:lighter!important}.font-weight-normal{font-weight:400!important}.font-weight-bold{font-weight:700!important}.font-weight-bolder{font-weight:bolder!important}.font-italic{font-style:italic!important}.text-white{color:#fff!important}.text-primary{color:#004d99!important}a.text-primary:focus,a.text-primary:hover{color:#004080!important}.text-secondary{color:#3d4955!important}a.text-secondary:focus,a.text-secondary:hover{color:#323c46!important}.text-success{color:#008053!important}a.text-success:focus,a.text-success:hover{color:#006642!important}.text-info{color:#717273!important}a.text-info:focus,a.text-info:hover{color:#646566!important}.text-warning{color:#a36200!important}a.text-warning:focus,a.text-warning:hover{color:#995c00!important}.text-danger{color:#e00929!important}a.text-danger:focus,a.text-danger:hover{color:#c70825!important}.text-light{color:#bdb4d8!important}a.text-light:focus,a.text-light:hover{color:#aea3d0!important}.text-dark{color:#050b12!important}a.text-dark:focus,a.text-dark:hover{color:#000!important}.text-100{color:#bbbdc1!important}a.text-100:focus,a.text-100:hover{color:#aeb0b5!important}.text-200{color:#a3a4a7!important}a.text-200:focus,a.text-200:hover{color:#96979a!important}.text-300{color:#8a8b8d!important}a.text-300:focus,a.text-300:hover{color:#7d7e80!important}.text-400{color:#717273!important}a.text-400:focus,a.text-400:hover{color:#646566!important}.text-500{color:#585859!important}a.text-500:focus,a.text-500:hover{color:#4b4c4c!important}.text-600{color:#3f3f40!important}a.text-600:focus,a.text-600:hover{color:#323233!important}.text-700{color:#262626!important}a.text-700:focus,a.text-700:hover{color:#191919!important}.text-800{color:#0c0c0d!important}.text-900,a.text-800:focus,a.text-800:hover,a.text-900:focus,a.text-900:hover{color:#000!important}.text-body{color:#19191a!important}.text-muted{color:#5a768a!important}.text-black-50{color:rgba(0,0,0,.5)!important}.text-white-50{color:hsla(0,0%,100%,.5)!important}.text-hide{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.text-decoration-none{text-decoration:none!important}.text-break{word-break:break-word!important;overflow-wrap:break-word!important}.text-reset{color:inherit!important}.visible{visibility:visible!important}.invisible{visibility:hidden!important}body,html{font-size:16px;line-height:1.5}@media (min-width:576px){body,html{font-size:18px;line-height:1.555}}.h1,h1{letter-spacing:-1px}@media (min-width:576px){.h1,h1{font-size:2.666rem;letter-spacing:-1.3px;line-height:1.25}}.h2,h2{line-height:1.25}@media (min-width:576px){.h2,h2{font-size:2.222rem;line-height:1.2;letter-spacing:-2px}}.h3,h3{line-height:1.1428}@media (min-width:576px){.h3,h3{font-size:1.777rem;line-height:1.25}}.h4,h4{line-height:1.1666}@media (min-width:576px){.h4,h4{font-size:1.555rem;line-height:1.428;font-weight:600}}.h5,h5{font-weight:400}@media (min-width:576px){.h5,h5{font-size:1.333rem}}.h6,h6{font-weight:600;line-height:1.5}.display-1{font-size:49.776px;font-size:3.111rem}@media (min-width:576px){.display-1{font-size:3.111rem;line-height:1.428}}.blockquote,blockquote{font-family:Lora,Georgia,serif;margin:1.5rem 0}caption{font-size:12.432px;font-size:.777rem;line-height:1.4285}b,strong{font-weight:600}.small,small{font-size:15px;font-size:.9375rem;font-weight:400}@media (min-width:576px){.small,small{font-size:.8888rem}}.x-small{font-size:14px;font-size:.875rem;font-weight:400}@media (min-width:576px){.x-small{font-size:.7777rem}}.blockquote-footer{color:#656566}.bg-dark .blockquote-footer{color:#979899}.row.variable-gutters{margin-right:-6px;margin-left:-6px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:6px;padding-left:6px}@media (min-width:576px){.row.variable-gutters{margin-right:-6px;margin-left:-6px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:6px;padding-left:6px}}@media (min-width:768px){.row.variable-gutters{margin-right:-10px;margin-left:-10px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:10px;padding-left:10px}}@media (min-width:992px){.row.variable-gutters{margin-right:-10px;margin-left:-10px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:10px;padding-left:10px}}@media (min-width:1200px){.row.variable-gutters{margin-right:-14px;margin-left:-14px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:14px;padding-left:14px}}.table td,.table th{text-align:left;border-bottom:1px solid #d6dce3;border-top:none}.breadcrumb-container .breadcrumb{padding:24px;border-radius:0}.breadcrumb-container .breadcrumb .breadcrumb-item{padding-left:0}.breadcrumb-container .breadcrumb .breadcrumb-item+.breadcrumb-item:before{display:none}.breadcrumb-container .breadcrumb .breadcrumb-item i{padding-right:.5em}.breadcrumb-container .breadcrumb .breadcrumb-item a{color:#5b6f82;font-weight:600}.breadcrumb-container .breadcrumb .breadcrumb-item.active a{font-weight:400;pointer-events:none}.breadcrumb-container .breadcrumb .breadcrumb-item span.separator{display:inline-block;font-weight:600;padding:0 .5em}.breadcrumb-container .breadcrumb.dark{background:#435a70}.breadcrumb-container .breadcrumb.dark .breadcrumb-item a,.breadcrumb-container .breadcrumb.dark .breadcrumb-item span.separator{color:#fff}.breadcrumb-container .breadcrumb.dark .breadcrumb-item i{color:#0bd9d2}.modal-content,.modal-header{border-radius:0}[data-toggle=collapse] .collapse-icon:before{content:"";display:inline-block;width:0;height:0;border-top:.5rem solid;border-right:.5rem solid transparent;border-bottom:0;border-left:.5rem solid transparent;vertical-align:3px;vertical-align:.1875rem}[data-toggle=collapse].collapsed .collapse-icon:before{-webkit-transform:rotate(180deg);transform:rotate(180deg)}.collapse-div{border-bottom:1px solid #e3e4e6}.collapse-div .collapse-div{border:1px solid #e3e4e6;border-top:0}.collapse-header{position:relative}.collapse-header [data-toggle=collapse]{width:100%;text-align:left;border:0;background-color:transparent;border-top:1px solid #e3e4e6;padding:14px 24px;cursor:pointer;color:#5c6f82;font-weight:600}.collapse-header [data-toggle=collapse][aria-expanded=false]{color:#0073e6}.collapse-header [data-toggle=collapse][aria-expanded=false]:after{content:"\e818"}.collapse-header [data-toggle=collapse][aria-expanded=true]:before{height:2px;width:56px;border-radius:2px;background-color:#0073e6;position:absolute;top:0;display:block;content:"";left:20px}.collapse-header [data-toggle=collapse][aria-expanded=false]:hover:after,.collapse-header [data-toggle=collapse][aria-expanded=true]:hover:after{text-decoration:none}.collapse-header [data-toggle=collapse]:after{content:"\e810";font-family:italia-icon-font;font-style:normal;font-weight:400;float:right;text-decoration:inherit;width:1em;margin-right:.2em;margin-top:5px;text-align:center;font-variant:normal;text-transform:none;line-height:1em}.collapse-header [data-toggle=collapse]:hover{background-color:#e6ecf2;text-decoration:underline}.collapse-header [data-toggle=collapse]:active{background-color:#0073e6;color:#fff;border-color:#0073e6}.collapse-body{padding:12px 24px 42px}.collapse-body .collapse-header button[aria-expanded=true]:before{height:0;width:0}.carousel{background-color:#444e57;padding:3.5em 3em 3em}.carousel-control-next,.carousel-control-prev{top:1em;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start}.carousel-control-prev{left:auto;right:6em}.carousel-control-next{right:3em}.carousel-caption{position:static;padding-bottom:0}.carousel-indicators li{background-color:rgba(101,220,223,.5)}.carousel-indicators .active{background-color:#5c6f82}.list-group-item{padding:1rem}.list-group-item.disabled,.list-group-item:disabled{cursor:default}.list-group-item-action:focus,.list-group-item-action:hover{text-decoration:underline;background-color:#d9e6f2}.list-group-item-action.disabled:focus,.list-group-item-action.disabled:hover,.list-group-item-action:disabled:focus,.list-group-item-action:disabled:hover{text-decoration:none;background-color:transparent;border-top-color:transparent}.list-group-item.active:focus,.list-group-item.active:hover{background-color:#0073e6}.alert{position:relative;margin-bottom:1rem;border:1px solid #b1b1b3;padding:1rem 1rem 1rem 4em}.alert-heading{color:inherit}.alert-link{font-weight:700}.alert-dismissible{padding-right:3.5rem}.alert-dismissible .close{position:absolute;top:0;right:0;padding:.8rem 1rem;color:inherit}.alert-success{border-left:8px solid #00cc85}.alert-info,.alert-success{background-position:1em .8em;background-repeat:no-repeat}.alert-info{border-left:8px solid #979899}.alert-warning{border-left:8px solid #f90}.alert-danger,.alert-warning{background-position:1em .8em;background-repeat:no-repeat}.alert-danger{border-left:8px solid #f73e5a;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M16 1.6C24 1.6 30.4 8 30.4 16S24 30.4 16 30.4 1.6 24 1.6 16 8 1.6 16 1.6zM16 0C7.2 0 0 7.2 0 16s7.2 16 16 16 16-7.2 16-16S24.8 0 16 0z'/%3E%3Cpath d='M14.4 24c0-.96.64-1.6 1.6-1.6s1.6.64 1.6 1.6c0 .96-.64 1.6-1.6 1.6s-1.6-.64-1.6-1.6zm.64-3.2l-.32-14.4h2.56l-.32 14.4z'/%3E%3C/svg%3E")}.alert-warning{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M14.333 26c0-1 .667-1.667 1.667-1.667S17.667 25 17.667 26 17 27.667 16 27.667 14.333 27 14.333 26zM15 22.667l-.333-15h2.667l-.333 15z'/%3E%3Cpath d='M16 2.667c1 0 2 .5 2.5 1.333l10.333 20.833c.5.833.5 2 0 2.833s-1.5 1.5-2.5 1.5H5.666c-1 0-2-.5-2.5-1.5-.5-.833-.5-2 0-2.833L13.499 4c.5-.833 1.5-1.333 2.5-1.333zM16 1c-1.5 0-3 .833-4 2.333L1.667 24.166c-1.667 3 .5 6.833 4 6.833h20.667c3.5 0 5.667-3.833 4-6.833L20.001 3.333c-1-1.667-2.5-2.333-4-2.333z'/%3E%3C/svg%3E")}.alert-success{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M32 6.682l-2.824-2.635-18.447 18.635-8.094-8.094L0 17.412l8.094 7.906h-.188l2.824 2.635 2.635-2.635z'/%3E%3C/svg%3E")}.alert-info{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M16 1.6C24 1.6 30.4 8 30.4 16S24 30.4 16 30.4 1.6 24 1.6 16 8.16 1.6 16 1.6zM16 0C7.2 0 0 7.2 0 16s7.2 16 16 16 16-7.2 16-16S24.8 0 16 0z'/%3E%3Cpath d='M14.72 9.76V6.72h2.88v3.04h-2.88zm0 15.84V12h2.88v13.6h-2.88z'/%3E%3C/svg%3E")}.btn{padding:12px 24px;font-size:16px;white-space:normal}.btn-group-lg>.btn,.btn-group-sm>.btn,.btn-lg,.btn-sm,.btn-xs{border-radius:4px;line-height:1.5}.btn-xs{padding:8px;font-size:14px;line-height:1.428}.btn-group-sm>.btn,.btn-sm{padding:10px 20px;font-size:14px;line-height:1.428}.btn-group-lg>.btn,.btn-lg{padding:14px 28px;font-size:18px;line-height:1.556}.btn-block{border-radius:0}.btn-primary.disabled,.btn-primary:disabled{color:#bfc2c9;background-color:#e6e9f2;border-color:#dfe4f2}.btn-outline-secondary{background:#fcfdff;-webkit-box-shadow:inset 0 0 0 1px #e6e9f2;box-shadow:inset 0 0 0 1px #e6e9f2}.btn-outline-secondary:hover{-webkit-box-shadow:inset 0 0 0 1px #c9cedc;box-shadow:inset 0 0 0 1px #c9cedc}.bg-dark .btn-link{color:#fff}.bg-dark .btn-primary{color:#19191a;background-color:#fff;border-color:#0073e6;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);color:#0073e6}.bg-dark .btn-primary:hover{color:#19191a;background-color:#fff;border-color:#0059b3}.bg-dark .btn-primary.focus,.bg-dark .btn-primary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5)}.bg-dark .btn-primary.disabled,.bg-dark .btn-primary:disabled{color:#19191a;background-color:#fff;border-color:#0073e6}.bg-dark .btn-primary:not(:disabled):not(.disabled).active,.bg-dark .btn-primary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-primary.dropdown-toggle{color:#19191a;background-color:#fff;border-color:#0053a6}.bg-dark .btn-primary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-primary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5)}.bg-dark .btn-primary.disabled,.bg-dark .btn-primary:disabled,.bg-dark .btn-primary:hover{color:#0059b3}.bg-dark .btn-outline-primary{color:#fff;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #fff;box-shadow:inset 0 0 0 1px #fff;-webkit-box-shadow:inset 0 0 0 2px #fff;box-shadow:inset 0 0 0 2px #fff}.bg-dark .btn-outline-primary:hover{color:#e6e6e6;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-primary.focus,.bg-dark .btn-outline-primary:focus{-webkit-box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-primary.disabled,.bg-dark .btn-outline-primary:disabled{color:#fff;background-color:transparent}.bg-dark .btn-outline-primary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-primary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-primary.dropdown-toggle{color:#e6e6e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-primary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-outline-primary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-outline-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-primary:hover{-webkit-box-shadow:inset 0 0 0 2px #e6e6e6;box-shadow:inset 0 0 0 2px #e6e6e6}.bg-dark .btn-outline-primary.focus,.bg-dark .btn-outline-primary:focus{-webkit-box-shadow:inset 0 0 0 2px #fff,0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 0 0 2px #fff,0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-primary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-primary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-primary.dropdown-toggle{-webkit-box-shadow:inset 0 0 0 2px #fff;box-shadow:inset 0 0 0 2px #fff}.bg-dark .btn-secondary{background-color:#0073e6;border-color:#fff;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);color:#fff}.bg-dark .btn-secondary:hover{color:#fff;background-color:#0d86ff;border-color:#e6e6e6}.bg-dark .btn-secondary.focus,.bg-dark .btn-secondary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-secondary.disabled,.bg-dark .btn-secondary:disabled{color:#fff;background-color:#0073e6;border-color:#fff}.bg-dark .btn-secondary:not(:disabled):not(.disabled).active,.bg-dark .btn-secondary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-secondary.dropdown-toggle{color:#fff;background-color:#1a8cff;border-color:#dfdfdf}.bg-dark .btn-secondary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-secondary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary{color:#fff;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #fff;box-shadow:inset 0 0 0 1px #fff;-webkit-box-shadow:none;box-shadow:none}.bg-dark .btn-outline-secondary:hover{color:#e6e6e6;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-secondary.focus,.bg-dark .btn-outline-secondary:focus{-webkit-box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary.disabled,.bg-dark .btn-outline-secondary:disabled{color:#fff;background-color:transparent}.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-secondary.dropdown-toggle{color:#e6e6e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-outline-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary:hover{-webkit-box-shadow:none;box-shadow:none}.bg-dark .btn-outline-secondary.focus,.bg-dark .btn-outline-secondary:focus{-webkit-box-shadow:0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-secondary.dropdown-toggle{-webkit-box-shadow:none;box-shadow:none}.form-group{position:relative;margin-bottom:4px;padding:1.5rem 0 1rem}.form-group button,.form-group input,.form-group optgroup,.form-group select,.form-group textarea{color:#17324d}.form-group label{position:absolute;color:#5c6f82;font-weight:600;line-height:40px;line-height:2.5rem;-webkit-transition:.2s ease-out;transition:.2s ease-out;top:24px;top:1.5rem;font-size:16px;font-size:1rem;cursor:text;display:block;width:100%;padding:0 .75rem;z-index:6}.form-group small.form-text{position:absolute;margin:0;padding:0 .75rem;font-size:12.432px;font-size:.777rem}.form-group.active label{-webkit-transform:translateY(-75%);transform:translateY(-75%);font-size:12.432px;font-size:.777rem}.form-group.active .ico-prefix,.form-group.active label{color:#5c6f82}.form-row .form-group{padding-bottom:0}input[type=date],input[type=datetime-local],input[type=email],input[type=number],input[type=password],input[type=search],input[type=tel],input[type=text],input[type=time],input[type=url],select,textarea{border:none;border-bottom:1px solid #5c6f82;border-radius:0;outline:0;height:40px;height:2.5rem;width:100%;-webkit-box-shadow:none;box-shadow:none;-webkit-transition:all .3s;transition:all .3s;font-weight:700}select,textarea{border:1px solid #5c6f82}input[type=file]+label{background-color:transparent}.form-control-plaintext+label,.form-group input.form-control-file+label,.form-group label.active,.form-group select.form-control+label,.input-group+label,.input-group~label,:disabled .form-group label{-webkit-transform:translateY(-75%);transform:translateY(-75%);font-size:12.432px;font-size:.777rem;background:transparent}:disabled .form-group label{top:0}.form-group.active .form-file-name{padding-bottom:1.95rem}.form-control-plaintext{padding:.375rem .75rem;background-color:#fff}.form-control:active,.form-control:focus{-webkit-box-shadow:none!important;box-shadow:none!important}.custom-select.is-valid,.form-control.is-valid,.was-validated .custom-select:valid,.was-validated .form-control:valid{background-position:100%!important;background-repeat:no-repeat!important;background-size:45px 45%!important;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%2300cc85' viewBox='0 0 192 512'%3E%3Cpath d='M435.848 83.466L172.804 346.51l-96.652-96.652c-4.686-4.686-12.284-4.686-16.971 0l-28.284 28.284c-4.686 4.686-4.686 12.284 0 16.971l133.421 133.421c4.686 4.686 12.284 4.686 16.971 0l299.813-299.813c4.686-4.686 4.686-12.284 0-16.971l-28.284-28.284c-4.686-4.686-12.284-4.686-16.97 0z'/%3E%3C/svg%3E")}.custom-select.is-invalid,.form-control.is-invalid,.was-validated .custom-select:invalid,.was-validated .form-control:invalid{background-position:100%!important;background-repeat:no-repeat!important;background-size:45px 45%!important;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f73e5a' viewBox='0 0 384 512'%3E%3Cpath d='M231.6 256l130.1-130.1c4.7-4.7 4.7-12.3 0-17l-22.6-22.6c-4.7-4.7-12.3-4.7-17 0L192 216.4 61.9 86.3c-4.7-4.7-12.3-4.7-17 0l-22.6 22.6c-4.7 4.7-4.7 12.3 0 17L152.4 256 22.3 386.1c-4.7 4.7-4.7 12.3 0 17l22.6 22.6c4.7 4.7 12.3 4.7 17 0L192 295.6l130.1 130.1c4.7 4.7 12.3 4.7 17 0l22.6-22.6c4.7-4.7 4.7-12.3 0-17L231.6 256z'/%3E%3C/svg%3E")}.custom-select.warning,.form-control.warning{background-position:100%!important;background-repeat:no-repeat!important;background-size:25px 45%!important;border-color:#f90;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f90' viewBox='0 0 192 512'%3E%3Cpath d='M176 432c0 44.112-35.888 80-80 80s-80-35.888-80-80 35.888-80 80-80 80 35.888 80 80zM25.26 25.199l13.6 272C39.499 309.972 50.041 320 62.83 320h66.34c12.789 0 23.331-10.028 23.97-22.801l13.6-272C167.425 11.49 156.496 0 142.77 0H49.23C35.504 0 24.575 11.49 25.26 25.199z'/%3E%3C/svg%3E")}.custom-select.is-valid~.warning-feedback,.form-control.is-valid~.warning-feedback{display:block}.warning-feedback{display:none;width:100%;margin-top:.25rem;font-size:12.432px;font-size:.777rem;color:#f90}.invalid-feedback,.valid-feedback,.warning-feedback{margin-left:.75rem}.form-file input[type=file]{filter:alpha(opacity=0);margin:0;max-width:100%;opacity:0}.form-file .form-file-name{border-bottom:1px solid rgba(0,0,0,.15);border-radius:0;color:#464a4c;left:0;overflow:hidden;padding:.5rem .6rem 2rem;max-height:32px;max-height:2rem;pointer-events:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;z-index:5}.form-file .form-file-name,.form-file .form-file-name:before{background-color:#fff;line-height:1.7;position:absolute;right:0;top:0}.form-file .form-file-name:before{bottom:-1px;color:#0073e6;content:"Sfoglia";display:block;height:40px;height:2.5rem;padding:.4rem 1rem 1.5rem;border:1px solid #0073e6;z-index:6;border-top-right-radius:4px}.input-group-text{background-color:#f8f8f8;border:0;border-radius:0!important;border-bottom:1px solid #555}.input-group-prepend{margin-right:0}.input-group-append{margin-left:0}.input-group-lg>.form-control,.input-group-lg>.input-group-append>.btn,.input-group-lg>.input-group-append>.input-group-text,.input-group-lg>.input-group-prepend>.btn,.input-group-lg>.input-group-prepend>.input-group-text{padding:0 1rem;border-radius:0}.ico-prefix{position:absolute;width:48px;width:3rem;font-size:28.8px;font-size:1.8rem;z-index:10;text-align:center}.ico-prefix~.form-file-name{padding-left:3.5rem}.ico-prefix~.select-wrapper .select-dropdown,.ico-prefix~input,.ico-prefix~label,.ico-prefix~textarea{padding-left:3rem}.form-group.active .ico-prefix~label,.ico-prefix~.custom-select~label,.ico-prefix~label.active{padding-left:.75rem}.form-group .form-check,.form-row .form-check,.row .form-check{padding-left:0;margin-top:1rem}.form-check [type=checkbox],.form-check [type=radio]{position:absolute;left:-9999px}.form-check [type=checkbox]+label,.form-check [type=radio]+label{position:relative;padding-left:36px;cursor:pointer;display:inline-block;height:32px;line-height:32px;font-size:16px;font-size:1rem;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.form-check [type=checkbox]+label:after,.form-check [type=checkbox]+label:before{content:"";left:0;position:absolute;-webkit-transition:.2s;transition:.2s;z-index:1;border-style:solid;border-width:2px}.form-check [type=checkbox]+label:before{top:0;width:17px;height:17px;border:1px solid #e6e9f2;border-radius:1px;margin:2px 5px;-webkit-transform:rotate(37deg);transform:rotate(37deg);-webkit-transform-origin:100% 100%;transform-origin:100% 100%}.form-check [type=checkbox]+label:after{border-radius:4px;height:20px;width:20px;margin:6px 5px;top:0}.form-check [type=checkbox]:checked+label:before{top:6px;left:1px;width:8px;height:13px;border-color:transparent #fff #fff transparent;border-style:solid;border-width:2px;-webkit-transform:rotate(40deg);transform:rotate(40deg);-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-transform-origin:100% 100%;transform-origin:100% 100%;opacity:.8}.form-check [type=checkbox]:checked+label:after{border-color:#0073e6;background-color:#0073e6;z-index:0}.form-check [type=checkbox]:not(:checked)+label:after{background-color:transparent;border-color:#5c6f82;z-index:0}.form-check [type=checkbox]:not(:checked)+label:before{width:0;height:0;border-color:transparent;left:6px;top:10px}.form-check [type=checkbox]:disabled+label{cursor:not-allowed}.form-check [type=checkbox]:disabled:not(:checked)+label:after{border-color:#e6e9f2;background-color:#fff}.form-check [type=checkbox]:disabled:checked+label:after{background-color:#e6e9f2;border-color:#e6e9f2}.form-check [type=radio]+label{-webkit-transition:.2s ease;transition:.2s ease}.form-check [type=radio]+label:after,.form-check [type=radio]+label:before{content:"";position:absolute;left:0;top:0;margin:5px;width:22px;height:22px;z-index:0;border-radius:50%;border-style:solid;border-width:2px;-webkit-transition:.2s ease;transition:.2s ease}.form-check [type=radio]:not(:checked)+label:after,.form-check [type=radio]:not(:checked)+label:before{border-color:#5c6f82}.form-check [type=radio]:not(:checked)+label:after{z-index:-1;-webkit-transform:scale(0);transform:scale(0)}.form-check [type=radio]:checked+label:after{border-color:#0073e6;background-color:#0073e6;z-index:0;-webkit-transform:scale(.64);transform:scale(.64)}.form-check [type=radio]:checked+label:before{border-color:#0073e6}.form-check [type=radio]:disabled+label{cursor:not-allowed}.form-check [type=radio]:disabled:not(:checked)+label:after,.form-check [type=radio]:disabled:not(:checked)+label:before{border-color:#e6e9f2}.form-check [type=radio]:disabled:checked+label:after{border-color:#e6e9f2;background-color:#e6e9f2}.form-check [type=radio]:disabled:checked+label:before{border-color:#e6e9f2}.form-check.form-check-group{padding:0 0 8px;margin-bottom:16px;-webkit-box-shadow:inset 0 -1px 0 0 rgba(1,1,1,.1);box-shadow:inset 0 -1px 0 0 rgba(1,1,1,.1)}.form-check.form-check-group [type=checkbox]+label,.form-check.form-check-group [type=radio]+label{position:static;padding-left:8px;padding-right:52px}.form-check.form-check-group [type=checkbox]+label:after,.form-check.form-check-group [type=checkbox]+label:before,.form-check.form-check-group [type=radio]+label:after,.form-check.form-check-group [type=radio]+label:before{right:15px;left:auto}.form-check.form-check-group [type=checkbox]:checked+label:before{right:26px}.form-check.form-check-group [type=radio]:checked+label:before{right:15px}.form-check.form-check-group .form-text{opacity:.6;margin:0;padding-left:8px;padding-right:52px}.toggles,.toggles *{-webkit-appearance:none;-moz-appearance:none;appearance:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.toggles label{cursor:pointer;width:100%;margin:0 8px 8px;height:32px;line-height:32px;font-weight:700}.toggles label input[type=checkbox]{opacity:0;width:0;height:0}.toggles label input[type=checkbox]+.lever{content:"";position:relative;width:46px;height:16px;background-color:#e6e9f2;border-radius:10px;-webkit-transition:background .3s ease;transition:background .3s ease;vertical-align:middle;float:right;margin:8px 16px 0}.toggles label input[type=checkbox]+.lever:after,.toggles label input[type=checkbox]+.lever:before{content:"";position:absolute;display:inline-block;width:26px;height:26px;border-radius:50%;left:0;top:-5px;left:-3px;-webkit-transition:left .3s ease,background .1s ease,-webkit-transform .1s ease;transition:left .3s ease,background .1s ease,-webkit-transform .1s ease;transition:left .3s ease,background .1s ease,transform .1s ease;transition:left .3s ease,background .1s ease,transform .1s ease,-webkit-transform .1s ease}.toggles label input[type=checkbox]+.lever:before{background-color:rgba(0,115,230,.15)}.toggles label input[type=checkbox]+.lever:after{background-color:#5c6f82;background-size:10px 10px;background-repeat:no-repeat;background-position:50%;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg width='10' height='10' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M6.364 4.95l3.535 3.535L8.485 9.9 4.95 6.364 1.414 9.899 0 8.485 3.536 4.95 0 1.414 1.414 0 4.95 3.536 8.485 0 9.9 1.414 6.364 4.95z' fill='%23FFF' fill-rule='evenodd' opacity='.8'/%3E%3C/svg%3E");border:2px solid #fff}.toggles label input[type=checkbox]:checked+.lever{background-color:#e6e9f2}.toggles label input[type=checkbox]:checked+.lever:after,.toggles label input[type=checkbox]:checked+.lever:before{left:23px}.toggles label input[type=checkbox]:checked+.lever:after{background-color:#0073e6;background-size:14px 14px;background-repeat:no-repeat;background-position:50%;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg width='14' height='11' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M4.879 7.536l7.07-7.072 1.415 1.415-7.071 7.07-1.414 1.415L.636 6.121 2.05 4.707 4.88 7.536z' fill='%23FFF' fill-rule='evenodd' opacity='.5'/%3E%3C/svg%3E")}.toggles label input[type=checkbox][disabled]+.lever{cursor:default;background-color:#e6e9f2}.toggles label input[type=checkbox][disabled]+.lever:after,.toggles label input[type=checkbox][disabled]:checked+.lever:after{background-color:#e6e9f2}.select-wrapper{position:relative}.select-wrapper .search-wrap input{width:100%;border:none;border-bottom:1px solid #0073e6;font-size:14.4px;font-size:.9rem;padding:0 .5em}.select-wrapper .dropdown-menu{background-color:#fff;border-radius:0;-webkit-box-shadow:0 2px 4px 3px rgba(0,0,0,.1);box-shadow:0 2px 4px 3px rgba(0,0,0,.1);margin:0;display:none;min-width:100px;max-height:240px;overflow-y:auto;position:absolute;padding:.3rem;z-index:999;will-change:width,height;list-style-type:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;width:100%}.select-wrapper .dropdown-menu.show{display:block}.select-wrapper .dropdown-menu li{clear:both;color:#000;cursor:pointer;line-height:32px;width:100%;text-align:left;text-transform:none}.select-wrapper .dropdown-menu li.optgroup>span{color:#ccc;padding:0}.select-wrapper .dropdown-menu li:not(.disabled):focus,.select-wrapper .dropdown-menu li:not(.disabled):hover{background-color:#eee}.select-wrapper .dropdown-menu li.active>span:after{content:"";background-image:url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1MTIiIGhlaWdodD0iNTEyIiB2aWV3Qm94PSIwIDAgNDQ4LjggNDQ4LjgiPjxwYXRoIGZpbGw9IiMwMDZERjAiIGQ9Ik0xNDIuOCAzMjMuODVMMzUuNyAyMTYuNzUgMCAyNTIuNDVsMTQyLjggMTQyLjggMzA2LTMwNi0zNS43LTM1Ljd6Ii8+PC9zdmc+");background-size:16px 16px;background-repeat:no-repeat;background-position:50%;float:right;display:block;height:32px;width:16px;opacity:.5}.select-wrapper .dropdown-menu li>a,.select-wrapper .dropdown-menu li>span{font-size:14px;color:#5c6f82;font-weight:600;display:block;padding:0 .5rem}.select-wrapper .dropdown-menu li>a.filtrable label,.select-wrapper .dropdown-menu li>a [type=checkbox],.select-wrapper .dropdown-menu li>span.filtrable label,.select-wrapper .dropdown-menu li>span [type=checkbox]{display:none}.select-wrapper .dropdown-menu li.disabled>span{cursor:unset;color:#ccc}.select-wrapper .dropdown-menu li>a>i{height:inherit;line-height:inherit}.select-wrapper .select-dropdown{color:#17324d;border-bottom:1px solid #5c6f82;position:relative;cursor:pointer;background-color:transparent;outline:0;width:100%;font-size:16px;font-size:1rem;margin:0 0 15px;display:block;line-height:24px;padding:12px 38px 12px 16px}.select-wrapper .select-dropdown:disabled{color:rgba(0,0,0,.3);border-bottom-color:rgba(0,0,0,.3);cursor:default}.select-wrapper .select-dropdown ul{list-style-type:none;padding:0}.select-wrapper .select-dropdown ul li.disabled,.select-wrapper .select-dropdown ul li.disabled>span,.select-wrapper .select-dropdown ul li.optgroup{color:rgba(0,0,0,.3);background-color:transparent!important;cursor:context-menu}.select-wrapper .select-dropdown ul li.optgroup{border-top:1px solid #eee}.select-wrapper .select-dropdown ul li.optgroup.selected>span{color:rgba(0,0,0,.7)}.select-wrapper .select-dropdown ul li.optgroup>span{color:rgba(0,0,0,.4)}.select-wrapper .caret{color:#757575;position:absolute;right:12px;line-height:16px;top:calc(50% - 8px)}.select-wrapper .caret .disabled{color:rgba(0,0,0,.46)}.select-wrapper.show .select-dropdown{color:#0073e6;border-bottom:1px solid #0073e6}.select-wrapper.show .caret{color:#0073e6}.select-wrapper+label{padding:0 .75rem!important;position:absolute;top:-18px;font-size:12.8px;font-size:.8rem}.select-wrapper select.custom-select{display:none!important}.select-wrapper select:disabled{color:rgba(0,0,0,.3)}.btn-eye{background-position:50%!important;background-repeat:no-repeat!important;width:28px;height:22px;position:absolute;right:8px;right:.5rem;top:36px;top:2.25rem;z-index:10;color:#5c6f82;cursor:pointer}.eye-on{background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 576 512'%3E%3Cpath d='M272.702 359.139c-80.483-9.011-136.212-86.886-116.93-167.042l116.93 167.042zM288 392c-102.556 0-192.092-54.701-240-136 21.755-36.917 52.1-68.342 88.344-91.658l-27.541-39.343C67.001 152.234 31.921 188.741 6.646 231.631a47.999 47.999 0 0 0 0 48.739C63.004 376.006 168.14 440 288 440a332.89 332.89 0 0 0 39.648-2.367l-32.021-45.744A284.16 284.16 0 0 1 288 392zm281.354-111.631c-33.232 56.394-83.421 101.742-143.554 129.492l48.116 68.74c3.801 5.429 2.48 12.912-2.949 16.712L450.23 509.83c-5.429 3.801-12.912 2.48-16.712-2.949L102.084 33.399c-3.801-5.429-2.48-12.912 2.949-16.712L125.77 2.17c5.429-3.801 12.912-2.48 16.712 2.949l55.526 79.325C226.612 76.343 256.808 72 288 72c119.86 0 224.996 63.994 281.354 159.631a48.002 48.002 0 0 1 0 48.738zM528 256c-44.157-74.933-123.677-127.27-216.162-135.007C302.042 131.078 296 144.83 296 160c0 30.928 25.072 56 56 56s56-25.072 56-56l-.001-.042c30.632 57.277 16.739 130.26-36.928 171.719l26.695 38.135C452.626 346.551 498.308 306.386 528 256z'/%3E%3C/svg%3E")}.eye-off{background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 576 512'%3E%3Cpath d='M569.354 231.631C512.97 135.949 407.81 72 288 72 168.14 72 63.004 135.994 6.646 231.631a47.999 47.999 0 0 0 0 48.739C63.031 376.051 168.19 440 288 440c119.86 0 224.996-63.994 281.354-159.631a47.997 47.997 0 0 0 0-48.738zM288 392c-102.556 0-192.091-54.701-240-136 44.157-74.933 123.677-127.27 216.162-135.007C273.958 131.078 280 144.83 280 160c0 30.928-25.072 56-56 56s-56-25.072-56-56l.001-.042C157.794 179.043 152 200.844 152 224c0 75.111 60.889 136 136 136s136-60.889 136-136c0-31.031-10.4-59.629-27.895-82.515C451.704 164.638 498.009 205.106 528 256c-47.908 81.299-137.444 136-240 136z'/%3E%3C/svg%3E")}.psw-wrapper{padding:0 .75rem}.psw-meter{height:3px;max-width:180px}.psw-meter .col-3{height:3px}.psw-percent,.psw-text{font-size:12px;font-size:.75rem;display:block;padding:.25rem 0;font-weight:500}.psw-percent{margin-right:5px}@-webkit-keyframes dropdownFadeIn{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:16px}}@keyframes dropdownFadeIn{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:16px}}@-webkit-keyframes dropdownFadeInTop{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:-16px}}@keyframes dropdownFadeInTop{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:-16px}}.btn-dropdown{color:#06c;padding:0 4px;background-color:transparent;font-size:16px;font-size:1rem;border-radius:0}.btn-dropdown:not(:disabled):not(.disabled):active{-webkit-box-shadow:none;box-shadow:none}.btn-dropdown:after{content:"";font-size:12.8px;font-size:.8rem;font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;border:none;display:inline-block;vertical-align:0;width:auto;height:auto;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.btn-dropdown[aria-expanded=true]:after{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.dropdown-menu{border-radius:0 0 4px 4px}.dropdown-menu.full-width{width:100%}.dropdown-menu.full-width .link-list li{display:inline-block;width:auto}.dropdown-menu.full-width .link-list li:focus,.dropdown-menu.full-width .link-list li:hover{background:none;text-decoration:underline}.dropdown-menu .link-list{margin-bottom:0}.dropdown-menu .link-list h3{line-height:2.3em;margin-bottom:0}.dropdown-menu:before{content:"";position:absolute;top:-6px;left:24px;width:18px;height:18px;border-radius:4px;background-color:#fff;-webkit-transform:rotate(45deg);transform:rotate(45deg)}.dropdown-menu[x-placement=top-start]{border-radius:4px 4px 0 0}.dropdown-menu[x-placement=top-start]:before{bottom:-6px;top:auto}.dropdown-menu.dark{background-color:#435a70}.dropdown-menu.dark .link-list-wrapper ul span.divider{background:#2e465e}.dropdown-menu.dark .link-list-wrapper ul li a:hover span,.dropdown-menu.dark .link-list-wrapper ul li a span,.dropdown-menu.dark .link-list-wrapper ul li h3,.dropdown-menu.dark .link-list-wrapper ul li i{color:#fff}.dropdown-menu.dark .link-list-wrapper ul li a:not(.active):not(.disabled):hover i{color:#4fe0dc}.dropdown-menu.dark .link-list-wrapper ul li a.disabled span{color:#adb2b8}.dropdown-menu.dark:before{background-color:#435a70}nav.pagination-wrapper{display:-webkit-box;display:-ms-flexbox;display:flex}nav.pagination-wrapper,nav.pagination-wrapper.pagination-total{-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}nav.pagination-wrapper.pagination-total{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}nav.pagination-wrapper.pagination-total ul{margin-bottom:.5rem}nav.pagination-wrapper.pagination-total p{font-size:14.222px;font-size:.8888888889rem;color:#5b6f82;margin-bottom:1rem;font-weight:600;text-align:center}nav.pagination-wrapper .form-group{margin-left:2.5rem;width:72px;width:4.5rem;margin-top:0}nav.pagination-wrapper .form-group label{font-size:14.222px;font-size:.8888888889rem;color:#9da2a6}nav.pagination-wrapper .form-group.active label{font-size:12.8px;font-size:.8rem}nav.pagination-wrapper .btn.dropdown-toggle{font-size:14.222px;font-size:.8888888889rem;color:#5b6f82;font-weight:600;padding:12px;height:40px;height:2.5rem;border:none;width:100%}nav.pagination-wrapper .btn.dropdown-toggle:after{color:#0073e6;margin-left:.5rem}.pagination{-ms-flex-wrap:wrap;flex-wrap:wrap}.pagination .page-item{margin-right:5px}.pagination .page-item.disabled a.page-link,.pagination .page-item.disabled a.page-link i[class^=it-]{color:#c2c7cc}.pagination .page-item span.page-link{pointer-events:none}.pagination .page-item .page-link{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;height:40px;height:2.5rem;min-width:40px;min-width:2.5rem;border-radius:4px;border:none;font-size:14.222px;font-size:.8888888889rem;font-weight:600;color:#5b6f82;background-color:transparent}.pagination .page-item .page-link[aria-current]{border:1px solid #06c;color:#06c;pointer-events:none}.pagination .page-item .page-link.text,.pagination .page-item .page-link i[class^=it-]{color:#0073e6}.pagination .page-item .page-link i[class^=it-]{font-size:11.2px;font-size:.7rem}.pagination .page-item .page-link span.d-inline-block{margin-right:.5rem}.pagination .page-item .page-link:hover{color:#06c;background-color:transparent}.pagination .page-item .page-link:hover i[class^=it-]{color:#06c}@media (min-width:576px){.pagination .page-item .page-link{height:2.6666666667rem;min-width:2.6666666667rem}nav.pagination-wrapper .btn.dropdown-toggle{height:2.6666666667rem}}@media (min-width:768px){nav.pagination-wrapper{-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}nav.pagination-wrapper .dropdown{margin-left:2.6666666667rem}}@media (max-width:767.98px){.offcanvas-collapse{position:fixed;top:56px;bottom:0;left:1em;width:100%;overflow-y:auto;background-color:#323333;-webkit-transition:-webkit-transform .3s ease-in-out;transition:-webkit-transform .3s ease-in-out;transition:transform .3s ease-in-out;transition:transform .3s ease-in-out,-webkit-transform .3s ease-in-out;-webkit-transform:translateX(100%);transform:translateX(100%)}.offcanvas-collapse.open{-webkit-transform:translateX(-1rem);transform:translateX(-1rem)}}.nav-tabs{position:relative;background-color:#fff;border-bottom:0}.nav-tabs:after{content:"";position:absolute;z-index:-1;-webkit-box-shadow:0 0 2rem rgba(0,0,0,.15);box-shadow:0 0 2rem rgba(0,0,0,.15);bottom:0;left:10%;right:10%;width:80%;height:50%;border-radius:100%}.nav-tabs .nav-link{border-radius:0;font-weight:600;color:#5c6f82;border:none;border-bottom:2px solid transparent}.nav-tabs .nav-link.disabled{color:#b1b1b3;font-weight:400}.nav-tabs .nav-item.show .nav-link,.nav-tabs .nav-link.active{border-bottom:2px solid #06c;color:#06c;cursor:inherit}.nav-tabs .nav-item{margin-bottom:0}.nav-tabs.nav-dark{background-color:#455b71}.nav-tabs.nav-dark .nav-link{color:#c7d1d0}.nav-tabs.nav-dark .nav-item.show .nav-link,.nav-tabs.nav-dark .nav-link.active{background-color:#455b71;color:#00fff7;border-bottom:2px solid #00fff7}.it-ico-sm{font-size:28px;font-size:1.75rem}.it-ico{font-size:20px;font-size:1.25rem}.it-ico-lg{font-size:24px;font-size:1.5rem}.cookiebar{bottom:0;left:0;right:0;display:none;position:fixed;width:100%;z-index:1100}.cookiebar.cookiebar-top{bottom:auto;top:0}.cookiebar.show{display:block}.hero{padding:1rem;margin-bottom:1rem;background-color:#cacacc;border-radius:0}@media (min-width:576px){.hero{padding:1rem}}.hero .hero-heading{font-size:32px;font-size:2rem;font-weight:700;color:#00264d;margin-bottom:.8rem}.hero-fluid{padding-right:0;padding-left:0;border-radius:0}.forward{display:block;text-align:center;font-size:48px;font-size:3rem;-webkit-transition:all .2s ease-in-out;transition:all .2s ease-in-out}.forward:hover{text-decoration:none}.return-to-top{position:fixed;bottom:16px;right:16px;background:#0073e6;background:rgba(0,115,230,.7);width:48px;height:48px;display:block;text-decoration:none;border-radius:50%;display:none;text-align:center;z-index:1}.return-to-top,.return-to-top i{-webkit-transition:all .2s ease-in-out;transition:all .2s ease-in-out}.return-to-top i{color:#fff;margin:0;position:relative;top:8px;font-size:20px}.return-to-top i:before{margin:0}.return-to-top:hover{background:rgba(0,115,230,.9);text-decoration:none}.return-to-top:hover i{color:#fff;top:4px}.autocomplete-clear{visibility:hidden;position:absolute;z-index:2;right:4px;right:.25rem;top:8px;top:.5rem;background:transparent;border:none;cursor:pointer}.autocomplete-clear svg{fill:#a6a6a6}.autocomplete-wrap{position:absolute;left:0;right:0;background:#fff;-webkit-box-shadow:0 2px 5px rgba(0,0,0,.25);box-shadow:0 2px 5px rgba(0,0,0,.25);z-index:100;max-height:240px;overflow-y:auto;padding-left:0;list-style-type:none}.autocomplete-wrap li{cursor:pointer;padding:12px 16px;font-size:14px;font-size:.875rem}.autocomplete-wrap li:hover{background:#eee}.link-list-wrapper ul{padding:0;list-style-type:none}.link-list-wrapper ul.link-sublist{padding-left:24px}.link-list-wrapper ul li a{font-size:.889em;line-height:2.3em;display:block;padding:0 24px;position:relative}.link-list-wrapper ul li a:hover:not(.disabled){text-decoration:none}.link-list-wrapper ul li a:hover:not(.disabled) span{color:#06c;text-decoration:underline}.link-list-wrapper ul li a:hover:not(.disabled) p{color:#06c;text-decoration:none}.link-list-wrapper ul li a.disabled:hover{text-decoration:none}.link-list-wrapper ul li a.medium{font-weight:600}.link-list-wrapper ul li a span{color:#06c;display:block;margin-right:24px}.link-list-wrapper ul li a.right-icon i.right{position:absolute;top:0;right:24px;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.link-list-wrapper ul li a.right-icon i.right.secondary{color:#9da2a6}.link-list-wrapper ul li a.right-icon[aria-expanded=true] i.right{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.link-list-wrapper ul li a.active span{color:#17324d;text-decoration:underline}.link-list-wrapper ul li a.disabled{cursor:not-allowed}.link-list-wrapper ul li a.disabled.left-icon i,.link-list-wrapper ul li a.disabled.left-icon i.secondary,.link-list-wrapper ul li a.disabled.right-icon i,.link-list-wrapper ul li a.disabled.right-icon i.secondary,.link-list-wrapper ul li a.disabled span{color:#adb2b8}.link-list-wrapper ul li a.left-icon{display:-webkit-box;display:-ms-flexbox;display:flex}.link-list-wrapper ul li a.left-icon i.left{margin-right:8px}.link-list-wrapper ul li a.large{font-size:1em}.link-list-wrapper ul li a p{font-size:.778em;line-height:normal;color:#5b6f82}.link-list-wrapper ul li a.avatar{display:-webkit-box;display:-ms-flexbox;display:flex;margin-bottom:8px}.link-list-wrapper ul li a.avatar .avatar{display:block;border-radius:50px;margin-right:8px}.link-list-wrapper ul li h3{font-size:1em;color:#17324d;padding:0 24px}.link-list-wrapper ul li h3 a{line-height:inherit;font-size:1em;padding:0}.link-list-wrapper ul .divider{display:block;height:1px;background:#ebeced;margin:8px 0}.link-list-wrapper ul .toggles label{padding:0 24px;font-size:.889em;line-height:2.3em;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;height:auto;font-weight:inherit;margin:0}.link-list-wrapper ul .toggles input[type=checkbox]+.lever{margin:8px 0 0}.link-list-wrapper ul .form-check.form-check-group{padding:0 24px;-webkit-box-shadow:none;box-shadow:none}.link-list-wrapper ul .form-check.form-check-group [type=checkbox]+label{padding-left:0;font-size:.889em;line-height:2.3em;height:inherit;margin-bottom:0}.link-list-wrapper ul .form-check.form-check-group [type=checkbox]+label:after{right:24px}.link-list-wrapper ul .form-check.form-check-group [type=checkbox]+label:before{right:35px}.link-list-wrapper ul .form-check.form-check-group [type=checkbox][disabled]+label{color:#adb2b8}@media (min-width:576px){.link-list-wrapper ul li a.large{font-size:1em;line-height:2.7em}}@media (min-width:768px){.link-list-wrapper ul li a.large{line-height:2.7em}}@-webkit-keyframes megamenuFadeIn{0%{opacity:0;margin-top:16px}to{opacity:1;margin-top:16px}}@keyframes megamenuFadeIn{0%{opacity:0;margin-top:16px}to{opacity:1;margin-top:16px}}.navbar{background:#06c}.navbar .navbar-collapsable{position:fixed;top:0;right:0;left:0;bottom:0;z-index:10;background:rgba(0,0,0,.6);display:none}.navbar .navbar-collapsable .menu-wrapper{background:#06c;position:absolute;top:0;bottom:0;right:0;left:48px;pointer-events:all;overflow-y:auto;-webkit-transform:translateX(100%);transform:translateX(100%);-webkit-transition:all .3s;transition:all .3s}.navbar .navbar-collapsable .navbar-nav{margin-top:102px;padding:24px 0}.navbar .navbar-collapsable .navbar-nav li a.nav-link{color:#fff;font-weight:400;padding:12px 24px;position:relative}.navbar .navbar-collapsable .navbar-nav li a.nav-link.active{border-left:2px solid #fff}.navbar .navbar-collapsable.expanded .close-div,.navbar .navbar-collapsable.expanded .menu-wrapper{-webkit-transform:translateX(0);transform:translateX(0)}.navbar .close-div{-webkit-transform:translateX(100%);transform:translateX(100%);padding:24px;position:fixed;left:48px;right:0;top:0;background:#06c;z-index:10;-webkit-transition:all .3s;transition:all .3s}.navbar .close-div .close-menu{background:transparent;color:#fff;text-align:center;font-size:.75em;text-transform:uppercase;padding:0}.navbar .close-div .close-menu span{display:block;text-align:center;font-size:2em}.navbar .close-div .close-menu span:before{margin-right:0}.navbar .dropdown-menu{background:transparent;-webkit-box-shadow:none;box-shadow:none}.navbar .dropdown-menu:before{display:none}.navbar .dropdown-menu .link-list-wrapper{padding-left:24px;padding-right:24px}.navbar .dropdown-menu .link-list-wrapper ul li a h3,.navbar .dropdown-menu .link-list-wrapper ul li a span,.navbar .dropdown-menu .link-list-wrapper ul li h3{color:#fff}.navbar .dropdown-toggle{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.navbar .dropdown-toggle:after{font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;display:inline-block;text-decoration:inherit;width:auto;height:auto;margin-right:.2em;text-align:center;font-variant:normal;text-transform:none;line-height:1em;content:"\e818";vertical-align:auto;border:none;border-bottom:0;font-size:.8em;line-height:2em;-webkit-transform-origin:center;transform-origin:center;-webkit-transition:all .3s;transition:all .3s}.navbar .dropdown-toggle[aria-expanded=true]:after{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.custom-navbar-toggler{background:none;border:none}.custom-navbar-toggler span{color:#fff;font-size:1.625em}.inline-menu .link-list-wrapper .link-list,.inline-menu .link-list-wrapper .link-list li a{position:relative}.inline-menu .link-list-wrapper .link-list li a i{color:#6aaaeb}.inline-menu .link-list-wrapper .link-list li a:after{content:"";display:block;width:2px;background:#06c;position:absolute;right:0;top:0;height:100%;-webkit-transform-origin:center;transform-origin:center;-webkit-transform:scaleY(0);transform:scaleY(0);-webkit-transition:all .3s;transition:all .3s;z-index:1}.inline-menu .link-list-wrapper .link-list li a.active span{color:#06c;text-decoration:none}.inline-menu .link-list-wrapper .link-list li a[aria-expanded=true]:after{-webkit-transform:scaleY(1);transform:scaleY(1)}.inline-menu .link-list-wrapper .link-list:after{content:"";display:block;width:2px;background:-webkit-gradient(linear,left top,left bottom,from(#e6ecf2),to(rgba(230,236,242,.3)));background:linear-gradient(180deg,#e6ecf2 0,rgba(230,236,242,.3));position:absolute;right:0;top:0;height:100%}@media (min-width:992px){.navbar{background:#06c;padding:0}.navbar .navbar-collapsable{position:relative;z-index:auto;background:none;display:block!important}.navbar .navbar-collapsable,.navbar .navbar-collapsable .menu-wrapper{top:auto;right:auto;left:auto;bottom:auto;-webkit-transition:none;transition:none}.navbar .navbar-collapsable .menu-wrapper{position:inherit;overflow-y:visible;-webkit-transform:none;transform:none}.navbar .navbar-collapsable .navbar-nav{margin-top:0;padding:0 24px}.navbar .navbar-collapsable .navbar-nav li a.nav-link{font-weight:400;padding:12px 24px}.navbar .navbar-collapsable .navbar-nav li a.nav-link.active{border-left:0;border-bottom:2px solid #fff}.navbar .navbar-collapsable .navbar-nav li a.nav-link.disabled{opacity:.5;cursor:not-allowed}.navbar .close-div{display:none}.navbar .dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;float:left;min-width:10rem;padding:.5rem 0;margin:.125rem 0 0;font-size:1rem;color:#19191a;text-align:left;list-style:none;background-color:#fff;background-clip:padding-box;border:0 solid transparent;border-radius:4px;-webkit-box-shadow:0 0 30px 5px rgba(0,0,0,.05);box-shadow:0 0 30px 5px rgba(0,0,0,.05)}.navbar .dropdown-menu.show{-webkit-animation:dropdownFadeIn .3s forwards;animation:dropdownFadeIn .3s forwards;top:calc(100% - 16px)}.navbar .dropdown-menu:before{display:block}.navbar .dropdown-menu .link-list-wrapper{padding-left:0;padding-right:0}.navbar .dropdown-menu .link-list-wrapper ul li a h3,.navbar .dropdown-menu .link-list-wrapper ul li a span{color:#06c}.navbar .dropdown-menu .link-list-wrapper ul li h3{color:#19191a}.navbar .dropdown-toggle{display:block;-webkit-box-pack:inherit;-ms-flex-pack:inherit;justify-content:inherit}.navbar .dropdown-toggle:after{content:"";font-size:.8rem;font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;border:none;display:inline-block;vertical-align:0;width:auto;height:auto;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.navbar.megamenu .navbar-collapsable{width:100%}.navbar.megamenu .navbar-collapsable .nav-item{position:static}.navbar.megamenu .navbar-collapsable .nav-item a{position:relative}.navbar.megamenu .navbar-collapsable .nav-item a:before{content:"";position:absolute;top:auto;bottom:-12px;left:24px;width:18px;height:18px;border-radius:4px;background-color:#fff;-webkit-transform:rotate(45deg);transform:rotate(45deg);opacity:0;-webkit-transition:opacity .3s;transition:opacity .3s}.navbar.megamenu .navbar-collapsable .nav-item.show a:before{opacity:1}.navbar.megamenu .navbar-collapsable .dropdown-menu{min-width:auto;left:24px;right:24px}.navbar.megamenu .navbar-collapsable .dropdown-menu:before{display:none}.navbar.megamenu .navbar-collapsable .dropdown-menu.show{-webkit-animation:megamenuFadeIn .3s forwards;animation:megamenuFadeIn .3s forwards}.custom-navbar-toggler{display:none}}.skiplinks{background-color:#0bd9d2;text-align:center}.skiplinks a{display:inline-block;padding:.5rem;display:block;font-weight:600;color:#5b6f82;text-decoration:underline}.componente-base{background-color:#0073e6;color:#fff;cursor:pointer;padding:8px}.focus--keyboard,.form-check [type=checkbox]:focus+label,.toggles label input[type=checkbox]:focus+.lever{border-color:#f90;-webkit-box-shadow:0 0 6px 2px #f90;box-shadow:0 0 6px 2px #f90;outline:none}.focus--mouse,.form-check [type=checkbox]:focus.focus--mouse+label,.toggles label input[type=checkbox]:focus.focus--mouse+.lever{border-color:inherit;-webkit-box-shadow:none;box-shadow:none;outline:none}.bg-primary--dark{background-color:#06c}.bg-primary--mid-dark{background-color:#004e95}.bg-primary--darken{background-color:#002b4d}.text-grey{color:#ccc}.text-sans-serif{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}.text-serif{font-family:Lora,serif}.text-light-blue{color:#e6f3fe}.text-blue{color:#0073e6}.border-dark-blue{border-color:#193e5e!important}.border-medium-blue{border-color:#06c!important}.border-grey-light{border-color:#eaebed!important}.border-width-2{border-width:2px!important}.stopScrolling--vertical{overflow-y:hidden}.deactive{display:none!important}@font-face{font-family:docs-icons;src:url(../font/docs.eot);src:url(../font/docs-italia.eot#iefix) format("embedded-opentype"),url(../font/docs-italia.ttf) format("truetype"),url(../font/docs-italia.woff) format("woff"),url(../font/docs-italia.svg#docs) format("svg");font-weight:400;font-style:normal}[class*=" docs-icon-"],[class^=docs-icon-]{font-family:docs-icons!important;speak:none;font-style:normal;font-weight:400;font-variant:normal;text-transform:none;line-height:1;vertical-align:middle;color:inherit;font-size:20.8px;font-size:1.3rem;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.docs-icon-more:before{content:""}.docs-icon-expand:before{content:""}.docs-icon-collapse:before{content:""}.docs-icon-plus:before{content:""}.docs-icon-minus:before{content:""}.docs-icon-document:before{content:""}.docs-icon-edit:before{content:""}.docs-icon-download:before{content:""}.docs-icon-info:before{content:""}.docs-icon-compare:before{content:""}.docs-icon-github:before{content:""}.docs-icon-share:before{content:""}.docs-icon-search:before{content:""}.docs-icon-link:before{content:""}.docs-icon-external-link:before{content:""}.docs-icon-comment:before{content:""}.docs-icon-attention:before,.docs-icon-warning:before{content:""}.docs-icon-example:before{content:""}.docs-icon-procedure:before{content:""}.docs-icon-hint:before{content:""}.docs-icon-note:before{content:""}.docs-icon-step:before{content:""}.docs-icon-pdf:before{content:""}.docs-icon-html:before{content:""}.docs-icon-project:before{content:""}.docs-icon-publisher:before{content:""}.docs-icon-docs:before{content:""}.docs-icon-user:before{content:""}.small{font-size:14px}.navbar-dark--text-white{color:#fff}.navbar-dark .lang-selector .nav-link,.navbar-dark .navbar-nav .nav-link{color:#fff!important}.navbar.bg-white{background-color:#fff}.navbar.primary-bg-a7{background-color:#0059b3}@media (min-width:992px){.dropdown-menu.dropdown-menu-right:before{right:24px;left:auto}}@media (min-width:992px){.navbar .dropdown-menu.dropdown-menu-right{left:auto;right:0}}@media (max-width:991.98px){.dropdown-menu-right{right:auto;left:auto}}.btn-group.show .dropdown-menu[x-placement=bottom-start],.dropdown.show .dropdown-menu[x-placement=bottom-start]{-webkit-animation:dropdownFadeIn .3s forwards;animation:dropdownFadeIn .3s forwards}.btn-group.show .dropdown-menu[x-placement=top-start],.dropdown.show .dropdown-menu[x-placement=top-start]{-webkit-animation:dropdownFadeInTop .3s forwards;animation:dropdownFadeInTop .3s forwards}.dropdown-menu[x-placement^=bottom],.dropdown-menu[x-placement^=left],.dropdown-menu[x-placement^=right],.dropdown-menu[x-placement^=top]{right:auto;bottom:auto}.dropdown-menu:before{z-index:-1}.injected{display:none}body{color:#596771;background-color:#002b4d}body.no-scroll{overflow-y:hidden}p{font-family:Lora,serif}h1,h2,h3,h4,h5{color:#000;margin-bottom:2rem}img{max-width:100%;height:auto}.container-fluid--desktop{max-width:1450px}@-webkit-keyframes pulsate{0%{-webkit-transform:scale(.1);transform:scale(.1);opacity:0}50%{opacity:1}to{-webkit-transform:scale(1.2);transform:scale(1.2);opacity:0}}@keyframes pulsate{0%{-webkit-transform:scale(.1);transform:scale(.1);opacity:0}50%{opacity:1}to{-webkit-transform:scale(1.2);transform:scale(1.2);opacity:0}}.loading{overflow:hidden}.loading:after{position:absolute;background:#0073e6;height:100%;width:100%;z-index:10;content:"";left:0;top:0}.loading:before{border:5px solid #fff;margin:-15px 0 0 -15px;border-radius:30px;position:absolute;content:"";z-index:11;height:30px;left:50%;top:50%;opacity:0;width:30px;-webkit-animation:pulsate 1s ease-out;animation:pulsate 1s ease-out;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.loading.no-bg:after{background:none;position:relative}.dropdown-menu{background-color:#fff;padding:.5rem;margin:0;border-radius:.2rem;-webkit-box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);z-index:100}.dropdown-menu .dropdown-item{color:#0073e6}.dropdown-menu .dropdown-item.active,.dropdown-menu .dropdown-item:active{font-weight:600;text-decoration:inherit;background-color:inherit}#version-list .dropdown-toggle .current-version{max-width:8em;text-overflow:ellipsis;overflow:hidden;display:inline-block;font-size:inherit;font-weight:400}#version-list .version-list-wrapper{max-height:10.2em;max-width:18em;overflow-y:scroll}#version-list .dropdown-item{text-overflow:ellipsis;max-width:16em;overflow-x:hidden}.document-actions .dropdown-toggle:after{vertical-align:middle;line-height:1.5}@media (max-width:767.98px){.document-actions .dropdown-toggle:after{font-family:italia-icon-font!important;border:none;margin:0 2em 0 0;width:auto;height:auto;float:right;content:"\e818";vertical-align:middle;font-size:.8em;line-height:2em;-webkit-transform-origin:center;transform-origin:center;-webkit-transition:all .3s;transition:all .3s}.document-actions .dropdown-toggle[aria-expanded=true]:after{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.document-actions .dropdown-toggle:hover{text-decoration:none}.document-actions .dropdown-menu.show{position:static!important;-webkit-transform:none!important;transform:none!important;-webkit-box-shadow:none;box-shadow:none;padding:0;margin-top:16px;-webkit-animation:none;animation:none}.document-actions .dropdown-menu.show:before{display:none}}.header{font-size:16px;font-size:1rem}.header .navbar-brand{font-size:14.224px;font-size:.889rem;font-weight:600}.header .navbar-brand a{text-decoration:none}.header .navbar .dropdown-toggle:after{margin:0 .2rem;font-size:11.2px;font-size:.7rem}.header .nav-item{margin-left:.2rem}@media (min-width:992px){.header .nav-item{border-left:0;margin-left:0}}.header .nav-item.active{font-weight:600}.header .nav-item:not(.nav-text):not(.nav-item--no-underline).active,.header .nav-item:not(.nav-text):not(.nav-item--no-underline):hover{border-left:.2rem solid #fff;margin-left:0}@media (min-width:992px){.header .nav-item:not(.nav-text):not(.nav-item--no-underline).active,.header .nav-item:not(.nav-text):not(.nav-item--no-underline):hover{border-left:0;margin-left:0;border-bottom:2px solid #fff;margin-bottom:0}}.slim-header{font-size:14.224px;font-size:.889rem}.slim-header .navbar-toggler .navbar__icon{font-size:11.2px;font-size:.7rem;line-height:3em;display:inline-block;-webkit-transform:scaleY(-1);transform:scaleY(-1);-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.slim-header .navbar-toggler.collapsed .navbar__icon{-webkit-transform:scaleY(1);transform:scaleY(1)}.slim-header .navbar-toggler .dropdown-toggle:after{content:""}.slim-header.navbar .divider{border-top:.05rem solid #799ebc;padding-right:1px;width:10%;margin-top:.75rem;margin-bottom:1rem;margin-left:.2rem;padding-bottom:1px}.slim-header.navbar .divider:first-child{margin-top:1px}.slim-header.navbar .divider.divider--w-100{width:100%}@media (min-width:992px){.slim-header.navbar .divider.divider--w-100{width:inherit}}@media (min-width:992px){.slim-header.navbar .divider{border-top:0;width:inherit;margin-top:inherit;margin-bottom:inherit;border-right:.05rem solid #06c;padding-right:1px;margin-left:0}}.secondary-nav{font-weight:600}@media (max-width:991.98px){.secondary-nav.secondary-nav--offcanvas{-webkit-transform:translateX(-100%);transform:translateX(-100%);z-index:10;background-color:#fff;color:#06c;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s;-webkit-transition-timing-function:ease-in-out;transition-timing-function:ease-in-out;position:fixed;top:0;left:0;bottom:0;right:25%;overflow-y:auto}.secondary-nav.secondary-nav--offcanvas.active{-webkit-transform:translateX(0);transform:translateX(0)}}.secondary-nav .navbar-nav li{padding:.5rem;border-bottom:.2rem solid transparent}.secondary-nav .nav-item:not(.nav-text):not(.nav-item--no-underline).active,.secondary-nav .nav-item:not(.nav-text):not(.nav-item--no-underline):hover{border-bottom:.2rem solid #fff}@media (max-width:991.98px){.article-intro-more .dropdown.show:before{content:"";width:100vw;height:100%;position:fixed;top:0;left:0;background-color:rgba(0,0,0,.5);z-index:999}}.article-intro-more .dropdown .dropdown-toggle:after{display:none}.article-intro-more .dropdown .dropdown-menu{background-color:#fff;padding:.5rem;margin:0;border-radius:.2rem;-webkit-box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);z-index:100}@media (max-width:991.98px){.article-intro-more .dropdown .dropdown-menu{position:fixed!important;z-index:1001!important;top:calc(50% - 140px)!important;left:calc(50% - 140px)!important;-webkit-transform:none!important;transform:none!important}.article-intro-more .dropdown .dropdown-menu:before{display:none}}.article-intro-more .dropdown .dropdown-menu .dropdown-item{color:#0073e6}@media (max-width:991.98px){.lang-selector .dropdown.show:before{content:"";width:100vw;height:100%;position:fixed;top:0;left:0;background-color:rgba(0,0,0,.5);z-index:999}}.lang-selector .dropdown .dropdown-menu{background-color:#fff;padding:.5rem;margin:0;border-radius:.2rem;-webkit-box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);z-index:100}@media (max-width:991.98px){.lang-selector .dropdown .dropdown-menu{position:fixed!important;z-index:1001!important;top:calc(50% - 80px)!important;left:calc(50% - 80px)!important;-webkit-transform:none!important;transform:none!important}.lang-selector .dropdown .dropdown-menu:before{display:none}}.lang-selector .dropdown .dropdown-menu .dropdown-item{color:#0073e6}.lang-selector .dropdown .dropdown-menu .dropdown-item.active,.lang-selector .dropdown .dropdown-menu .dropdown-item:active{font-weight:600;text-decoration:inherit;background-color:inherit}.h1--header{font-size:21.328px;font-size:1.333rem;font-weight:600;line-height:1.2;letter-spacing:unset}@media (min-width:576px){.h1--header{font-size:1.8rem}}.h1--header span{font-size:11.2px;font-size:.7rem;font-weight:400}.svg--header{width:39px;height:36px}@media (min-width:576px){.svg--header{width:65px;height:60px}}.h2--header{font-size:14px;font-weight:300;letter-spacing:unset}.docs__document-info{color:#fff;font-size:14.4px;font-size:.9rem;vertical-align:bottom}.docs__document-info .docs__document-info__icon{font-size:19.2px;font-size:1.2rem;vertical-align:bottom}.docs__document-info .docs__document-info__ownership .docs__document-info__label{font-size:12.8px;font-size:.8rem}.docs__document-info .docs__document-info__ownership .docs__document-info__icon{font-size:16px;font-size:1rem}.doc-header{-webkit-box-shadow:0 0 120px 0 rgba(0,0,0,.1);box-shadow:0 0 120px 0 rgba(0,0,0,.1);position:relative;z-index:10;color:#0073e6;font-size:16px;font-weight:600}.doc-header .progress-container{width:100%;height:4px;height:.25rem;background:#e6f3fe}.doc-header .progress-bar{height:4px;height:.25rem;background:#06c;width:0}.docs-italia #cerca{border:1px solid #ccc;font-size:12.8px;font-size:.8rem;font-weight:100}.docs-italia #cerca::-webkit-input-placeholder{color:#ccc}.docs-italia #cerca::-moz-placeholder{color:#ccc}.docs-italia #cerca::-ms-input-placeholder{color:#ccc}.docs-italia #cerca::placeholder{color:#ccc}.social{color:#fff}.social .social__label{font-size:15.2px;font-size:.95rem}.social .social__link{color:#fff;font-size:16px;font-size:1rem}.social .social__link:active,.social .social__link:hover{text-decoration:none}#rtd-search-form{border:1px solid #ccc}#rtd-search-form input[type=text]{border:none;height:100%}#rtd-search-form .input-group-append button{background-color:#fff}#rtd-search-form .input-group-append button .docs-icon-search{font-size:19.2px;font-size:1.2rem}#documentInfo .tag{font-family:Titillium Web,Geneva,Tahoma,sans-serif}.offcanvas-menu{position:fixed;z-index:1000;width:100vw;height:100vh;top:0;left:0;right:0;bottom:0}.offcanvas-menu.animate--left{-webkit-transform:translate3d(-100%,0,0);transform:translate3d(-100%,0,0);-webkit-transition:-webkit-transform .4s;transition:-webkit-transform .4s;transition:transform .4s;transition:transform .4s,-webkit-transform .4s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1)}.offcanvas-menu.js-active{-webkit-transform:translateZ(0);transform:translateZ(0);-webkit-transition:-webkit-transform .8s;transition:-webkit-transform .8s;transition:transform .8s;transition:transform .8s,-webkit-transform .8s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1)}.offcanvas-menu .offcanvas-menu__inner{width:80%;background-color:#fff;height:100vh;-webkit-transform:translateX(0);transform:translateX(0);-webkit-transition:all .5s ease-out;transition:all .5s ease-out}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__header{padding:1.5rem 1.8rem 1rem}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__header .offcanvas-menu__title{font-weight:600;font-size:19.2px;font-size:1.2rem}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav{padding:.5rem 0 0;margin:0}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item{list-style:none;margin:0;padding:.5rem 1rem}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:first-child,.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:nth-child(4){position:relative}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:first-child:before,.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:nth-child(4):before{content:"";width:64px;height:1px;left:32px;left:2rem;border-top:1px solid rgba(0,102,204,.2);position:absolute;top:0}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item .offcanvas-menu__nav__link{padding:.5rem 1rem;font-size:16px;font-size:1rem;display:block}.offcanvas-menu.deactive .offcanvas-menu__inner{margin-left:-80%;overflow:hidden}.offcanvas-menu .offcanvas-menu__extra{width:20%;height:100vh;position:fixed;right:0;top:0}body:before{position:fixed;top:0;left:0;z-index:999;bottom:0;right:0;background:rgba(0,0,0,.5);content:"";opacity:0;-webkit-transform:translate3d(100%,0,0);transform:translate3d(100%,0,0);-webkit-transition:opacity .4s,-webkit-transform 0s .4s;transition:opacity .4s,-webkit-transform 0s .4s;transition:opacity .4s,transform 0s .4s;transition:opacity .4s,transform 0s .4s,-webkit-transform 0s .4s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1)}body.show-menu:before{opacity:1;-webkit-transition:opacity .8s;transition:opacity .8s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1);-webkit-transform:translateZ(0);transform:translateZ(0)}#desktop-menu{-webkit-transform:translate(0);transform:translate(0);-webkit-transform:translateZ(0);transform:translateZ(0);will-change:position,transform;padding-bottom:5rem}#desktop-menu>button:first-of-type{margin-top:1.5rem}.col--nav{width:100%}@media (min-width:768px){.col--nav{width:420px;float:left;border-right:1px solid #eeeff0;padding-left:4.5rem}}.docs-menu{will-change:min-height;display:none}@media (min-width:768px){.docs-menu{display:block}}@media (max-width:767.98px){.docs-offcanvas-menu{-webkit-transform:translateX(100%);transform:translateX(100%);z-index:10;background-color:#fff;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s;-webkit-transition-timing-function:ease-in-out;transition-timing-function:ease-in-out;position:fixed;top:0;left:0;bottom:0;right:0;overflow-y:auto}.docs-offcanvas-menu.active{-webkit-transform:translateX(0);transform:translateX(0)}}@media (min-width:768px){.docs-offcanvas-menu{display:none}}.navbar-toggler--wrap{position:fixed;bottom:0;left:0;right:0;z-index:9;background-color:#fff;-webkit-box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25);box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25)}@media (min-width:768px){.navbar-toggler--wrap{display:none}}.navbar-toggler{color:#06c;padding:1rem 1rem 1rem 2rem}.navbar-toggler__chapter{color:#000;font-size:12.8px;font-size:.8rem}.sidebar-tabs{position:fixed;top:0;left:0;right:0;background-color:#fff;-webkit-transform:translateX(100%);transform:translateX(100%);-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s;-webkit-transition-timing-function:ease-in-out;transition-timing-function:ease-in-out;z-index:11;-webkit-box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25);box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25)}.sidebar-tabs.active{-webkit-transform:translateX(0);transform:translateX(0)}@media (min-width:768px){.sidebar-tabs{display:none}}.sidebar-btn{text-transform:uppercase;color:#06c;font-weight:700;cursor:pointer;border:0;border-bottom:3px solid #0073e6;background:none}@media (min-width:768px){.sidebar-btn{border-bottom:2px solid #bbd8f1}}.sidebar-btn.sidebar-btn--mobile{display:inline-block;font-size:11.2px;font-size:.7rem;text-align:center;border:0}.sidebar-btn.sidebar-btn--mobile.active.show{border-bottom:3px solid #0073e6;text-decoration:none}@media (min-width:768px){.sidebar-btn.sidebar-btn--mobile.active.show{border-bottom:2px solid #bbd8f1}}.form-check [type=checkbox]:focus.focus--mouse+label.sidebar-btn,.sidebar-btn.focus--mouse,.toggles label input[type=checkbox]:focus.focus--mouse+.sidebar-btn.lever{border-color:#0073e6!important}@media (min-width:768px){.form-check [type=checkbox]:focus.focus--mouse+label.sidebar-btn,.sidebar-btn.focus--mouse,.toggles label input[type=checkbox]:focus.focus--mouse+.sidebar-btn.lever{border-color:#bbd8f1!important}}.sidebar-btn .it-collapse,.sidebar-btn .it-expand{font-size:9.6px;font-size:.6rem;line-height:2.5}.sidebar-btn .it-expand{display:inline-block}.sidebar-btn.collapsed .it-expand,.sidebar-btn .it-collapse{display:none}.sidebar-btn.collapsed .it-collapse{display:inline-block}@media (min-width:768px){.sidebar-btn{display:block;width:100%;text-align:left}}@media (max-width:767.98px){.sidebar-btn.collapsed .it-collapse,.sidebar-btn.collapsed .it-expand,.sidebar-btn .it-collapse,.sidebar-btn .it-expand{display:none}}.main-container{overflow:hidden;position:relative;background-color:#fff}.doc-content__consultation{position:absolute;right:0;left:0;top:0;background-color:#4bd4d6;text-align:left;text-transform:uppercase;font-weight:700;color:#000;padding:.5rem 0 .5rem 2rem}@media (min-width:992px){.doc-content__consultation{padding-left:4rem}}@media (min-width:1200px){.doc-content__consultation{-webkit-transform:rotate(45deg) translate(45px,-125px);transform:rotate(45deg) translate(45px,-125px);width:320px;-webkit-transform-origin:left;transform-origin:left;z-index:1;left:auto;text-align:center;padding-left:0}}.col-content{padding:4rem 2rem}@media (min-width:992px){.col-content{padding:4rem 4rem 5rem}}.caption-wrap{clear:both}.caption-wrap .caption--table{margin-top:1rem;margin-bottom:1rem;display:block;font-family:Lora,serif;font-style:italic;font-size:12px;font-size:.75rem;padding:0}@media (min-width:992px){.caption-wrap .caption--table{width:calc(100% - 200px);float:left}}.caption-wrap .reference--wrap{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;margin-top:1rem;margin-bottom:2rem;font-size:.9em}@media (min-width:768px){.caption-wrap .reference--wrap{width:200px;float:right;padding-left:2rem}}.caption-number{font-weight:700;color:#000}.chapter-header{margin-bottom:1rem;margin-left:.5rem}.chapter-nav{position:relative}@media (min-width:992px){.chapter-nav{width:200px;float:left}}.figure-fixed-wrap{display:block;width:100%;overflow-x:auto}.figure-fixed{max-width:none}.title__background{width:100%;background-color:#e6f3fe;position:absolute;top:-1px;height:auto;left:-8px;left:-.5rem;display:none;right:0;z-index:0}.title__background:after{content:"";position:absolute;left:100%;-webkit-transform:translateX(-50%);transform:translateX(-50%);top:0;bottom:0;width:0;height:0;border-left:20px solid transparent;border-right:20px solid transparent;border-top:20px solid #e6f3fe}.std-term{background-color:#bffffd;color:#000;padding:.2rem}.footer-buttons--next{clear:both;margin-top:4rem}.footer-buttons--next a{background-color:#0073e6;color:#fff;padding:.5rem 1rem;border-radius:.2rem;font-weight:700;display:inline-block}.footer-buttons--prev{margin-bottom:2.5rem}.reference-icon{vertical-align:middle;display:inline-block}#doc-content{width:100%;position:relative}@media (min-width:768px){#doc-content{width:calc(100% - 420px);float:left}}#doc-content a.reference[href]{text-decoration:underline}#doc-content .useful-docs .mimetype{display:none}#doc-content .useful-docs ul{list-style-type:none;padding-left:0}#doc-content .useful-docs li{border-top:1px solid #ccc;padding-top:1rem;padding-bottom:1rem;vertical-align:middle}#doc-content .useful-docs li:after{display:none}#doc-content .useful-docs [class*=" docs-icon-"],#doc-content .useful-docs [class^=docs-icon-]{font-size:30.4px;font-size:1.9rem;color:#0073e6}#doc-content ul.simple,#doc-content ul.simple ul{list-style-type:disc}#doc-content ul.simple li,#doc-content ul.simple ul li{position:relative;margin-bottom:.5rem;font-size:14.4px;font-size:.9rem}#doc-content ul.simple li ul li,#doc-content ul.simple ul li ul li{margin-top:.5rem}#doc-content .section{clear:both}#doc-content .section:after{content:"";display:table;clear:both}@media (min-width:992px){#doc-content .section>*{width:calc(100% - 200px);float:left;clear:left}}@media (min-width:992px){#doc-content .section .caption-wrap,#doc-content .section .chapter-header,#doc-content .section .figure,#doc-content .section .full-width,#doc-content .section .section,#doc-content .section .table-responsive,#doc-content .section>.toctree-wrapper.compound{width:100%}}#doc-content .section .figure{width:100%}#doc-content .section .figure[id],#doc-content .section .rubric.ref[id],#doc-content .section .section[id],#doc-content .section .table[id]{border-top:4.2rem solid transparent}#doc-content .section .glossary dt:not([id=""]){margin-top:-4em;padding-top:4em}#doc-content .section ol.loweralpha,#doc-content .section ol.loweralpha li{list-style:lower-alpha}#doc-content .section ol.upperalpha,#doc-content .section ol.upperalpha li{list-style:upper-alpha}#doc-content .section ol.upperroman,#doc-content .section ol.upperroman li{list-style:upper-roman}#doc-content .section ol,#doc-content .section ol.arabic{list-style:decimal}#doc-content .topic-title{color:#000;font-weight:700;font-size:22.4px;font-size:1.4rem;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .topic.procedure{margin-bottom:3rem}#doc-content .topic.procedure em{font-weight:700}#doc-content .topic.procedure ol{padding-left:1rem}#doc-content .topic.procedure ol li{position:relative;margin-bottom:1rem;padding-left:1rem;counter-increment:list;list-style-type:none;font-family:Lora,serif}#doc-content .topic.procedure ol li:after{position:absolute;left:-16px;left:-1rem;top:0;width:16px;width:1rem;height:24px;height:1.5rem;z-index:1;content:counter(list);color:#fff;text-align:center;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;font-weight:600}#doc-content .topic.procedure .topic-title{text-transform:uppercase;font-size:17.6px;font-size:1.1rem;font-weight:700;color:#002b4d;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;padding-bottom:.2rem;background:-webkit-gradient(linear,left top,left bottom,from(#004e95),to(#004e95)) no-repeat 100% 100%/calc(100% - 2rem) 2px;background:linear-gradient(#004e95,#004e95) no-repeat 100% 100%/calc(100% - 2rem) 2px;margin-bottom:1rem}#doc-content .topic.procedure .topic-title [class*=" docs-icon-"],#doc-content .topic.procedure .topic-title [class^=docs-icon-]{margin-right:.5rem}#doc-content .topic.procedure .procedure__img{padding-left:1.5rem;margin-bottom:2rem;margin-left:.5rem;margin-top:2rem;border-left:1px solid #799ebc}#doc-content .topic.procedure .procedure__img img{-webkit-box-shadow:0 0 61px 0 rgba(0,0,0,.15);box-shadow:0 0 61px 0 rgba(0,0,0,.15)}#doc-content .topic.procedure .procedure-internal-title{text-transform:uppercase;color:#000;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:12.8px;font-size:.8rem;font-weight:700}#doc-content .topic.procedure .docs-icon-step{color:#004e95;position:absolute;left:-24px;left:-1.5rem;font-size:32px;font-size:2rem}@media (min-width:992px){#doc-content .title-wrap{width:calc(100% - 200px);float:left;clear:left;position:relative}#doc-content .title-wrap h2{line-height:60px}#doc-content .title-wrap h3{line-height:46px}#doc-content .title-wrap h1,#doc-content .title-wrap h2,#doc-content .title-wrap h3{display:inline;cursor:pointer;position:relative;color:#000;box-shadow:.5rem 0 0 #fff,-.5rem 0 0 #fff;-webkit-box-shadow:.5rem 0 0 #fff,-.5rem 0 0 #fff;-webkit-box-decoration-break:clone;-ms-box-decoration-break:clone;-o-box-decoration-break:clone;box-decoration-break:clone;left:-.5rem;z-index:1}#doc-content .title-wrap h1 .title__chapter,#doc-content .title-wrap h2 .title__chapter,#doc-content .title-wrap h3 .title__chapter{position:relative;color:#0073e6}#doc-content .title-wrap h1{line-height:71px}#doc-content .title-wrap h1 .title__chapter{position:relative;background-color:#0073e6;color:#fff;margin-right:.5rem;padding-left:.5rem;padding-right:.5rem;display:inline-block;z-index:1}#doc-content .title-wrap h1 .title__chapter:after,#doc-content .title-wrap h1 .title__chapter:before{content:"";top:0;bottom:0;width:.5rem;background-color:#0073e6;position:absolute}#doc-content .title-wrap h1 .title__chapter:after{right:100%}#doc-content .title-wrap h1 .title__chapter:before{left:100%}}#doc-content .title-wrap.active h1,#doc-content .title-wrap.active h2,#doc-content .title-wrap.active h3{-webkit-box-shadow:.5rem 0 0 #e6f3fe,-.5rem 0 0 #e6f3fe;box-shadow:.5rem 0 0 #e6f3fe,-.5rem 0 0 #e6f3fe;background-color:#e6f3fe}#doc-content .title-wrap.active .title__background{display:block}#doc-content .headerlink{display:none}#doc-content .document-info{padding:0}#doc-content .document-info .docutils.field-list{width:100%;margin-bottom:2rem;border-bottom:1px solid #ccc;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;display:grid}#doc-content .document-info .docutils.field-list tr{display:block;margin-bottom:2rem}@media (min-width:576px){#doc-content .document-info .docutils.field-list tr{width:50%;float:left}}#doc-content .document-info .docutils.field-list .field-body,#doc-content .document-info .docutils.field-list .field-name{display:block;font-weight:400}#doc-content .document-info .docutils.field-list .field-body{color:#06c;text-decoration:underline}#doc-content dd>p{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .highlights{font-size:24px;font-size:1.5rem;font-family:Lora,serif}#doc-content blockquote.epigraph{margin-top:2rem;padding-left:2rem;border-left:4px solid #00c4c8;color:#596771;font-size:19.2px;font-size:1.2rem;margin-bottom:2rem}#doc-content blockquote.epigraph .attribution{margin-bottom:0;font-size:16px;font-size:1rem}#doc-content .question-and-answers blockquote{margin-top:.5rem;margin-bottom:0}#doc-content .question-and-answers blockquote>div{font-weight:700;font-family:Lora,serif}#doc-content .question-and-answers .pull-quote{max-width:490px;margin-bottom:2rem}#doc-content .question-and-answers .pull-quote ul{list-style-type:none;padding-left:1.5rem}#doc-content .question-and-answers .pull-quote ul li{display:inline-block;margin-top:1rem}#doc-content .question-and-answers .pull-quote ul li:after{display:none}#doc-content .question-and-answers .pull-quote ul li a{padding:.2rem .5rem;margin-right:.2rem;background-color:#bffffd;color:#000;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;border-bottom:2px dotted #ccc}#doc-content .question-and-answers .pull-quote>div>p{text-transform:uppercase;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;color:#0b0b0b;margin-bottom:0;font-weight:100}#doc-content .question-and-answers .pull-quote:nth-of-type(odd){float:left;clear:right}#doc-content .question-and-answers .pull-quote:nth-of-type(odd) blockquote>div,#doc-content .question-and-answers .pull-quote:nth-of-type(odd) ul{padding-left:1.5rem;border-left:5px solid #00c4c8}#doc-content .question-and-answers .pull-quote:nth-of-type(2n){float:right;text-align:right;clear:left}#doc-content .question-and-answers .pull-quote:nth-of-type(2n) blockquote>div,#doc-content .question-and-answers .pull-quote:nth-of-type(2n) ul{padding-right:1.5rem;border-right:5px solid #00c4c8}#doc-content .question-and-answers .glossary.docutils{display:none}#doc-content .highlighted{background:#bffffd;display:inline-block;font-weight:700}.highlight{padding:1rem;margin-bottom:1em}.highlight pre{margin:0;padding-bottom:1em}.highlighttable .highlight{padding:0}.code .highlight{background:none}code:not(.download) .pre{background-color:#efc;padding:.2rem}code.download{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:100%}#doc-content .admonition{margin-bottom:2rem;margin-top:2rem;padding-left:2rem;border-left:4px solid;color:#596771}#doc-content .admonition .more{padding:0}#doc-content .admonition .admonition-title{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;text-transform:uppercase;font-weight:700}#doc-content .admonition .admonition-title [class*=" docs-icon-"],#doc-content .admonition .admonition-title [class^=docs-icon-]{font-size:24px;font-size:1.5rem;margin-right:.5rem}#doc-content .admonition .admonition__hidden-paragraph{display:none}#doc-content .admonition .admonition__toggle-wrap{border-top:1px solid #ccc;padding-top:1rem;margin-top:1.5rem}#doc-content .admonition .admonition__toggle-btn{cursor:pointer;background:none;border:none;color:#0073e6;padding-left:0}#doc-content .admonition .admonition__toggle-btn [class*=" docs-icon-"],#doc-content .admonition .admonition__toggle-btn [class^=docs-icon-]{font-size:9.6px;font-size:.6rem;margin-left:.5rem;position:relative}#doc-content .admonition .admonition__toggle-btn [class*=" docs-icon-"]:after,#doc-content .admonition .admonition__toggle-btn [class^=docs-icon-]:after{content:"";width:16px;width:1rem;height:16px;height:1rem;border:2px solid #0073e6;left:50%;top:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);position:absolute;border-radius:50%}#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-less:first-letter,#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-more:first-letter{text-transform:uppercase}#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-less{display:none}#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-more{display:inline-block}#doc-content .admonition .admonition__toggle-btn.active .admonition__toggle-show-more{display:none}#doc-content .admonition .admonition__toggle-btn.active .admonition__toggle-show-less{display:inline-block}#doc-content .admonition.display-page{background-color:#f9fafb;padding:2rem;position:relative;border:none}#doc-content .admonition.display-page:after,#doc-content .admonition.display-page:before{content:"";width:0;height:0;right:0;top:0;position:absolute;z-index:1}#doc-content .admonition.display-page:before{border-bottom:50px solid transparent;border-right:50px solid #fff}#doc-content .admonition.display-page:after{border-top:50px solid transparent;border-bottom:50px solid #ccc;border-right:50px solid transparent;-webkit-transform:translateY(-50%);transform:translateY(-50%)}#doc-content .admonition.display-page .admonition__hidden-paragraph p,#doc-content .admonition.display-page>p,#doc-content .admonition.display-page li{font-size:12.8px;font-size:.8rem;color:#002b4d}#doc-content .admonition.display-page ol{counter-reset:list}#doc-content .admonition.display-page ol li{margin-bottom:1rem;position:relative;list-style-type:none;counter-increment:list;color:#002b4d;font-family:Lora,serif;text-indent:16px;text-indent:1rem}#doc-content .admonition.display-page ol li:after{position:absolute;left:-16px;left:-1rem;top:0;width:17.6px;width:1.1rem;height:24px;height:1.5rem;z-index:1;content:counter(list) ".";text-align:center;font-weight:700}#doc-content .admonition.display-page ol li:before{position:absolute;left:-32px;left:-2rem;top:.65em;height:1px;z-index:1;content:"";font-weight:700;background-color:#002b4d;width:16px;width:1rem}#doc-content .admonition.display-page .admonition-title,#doc-content .admonition.display-page .code-block__header{color:#004e95;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .admonition.display-page .admonition-title{padding-bottom:.2rem;display:inline-block;background:-webkit-gradient(linear,left top,left bottom,from(#004e95),to(#004e95)) no-repeat 100% 100%/calc(100% - 2.2rem) 2px;background:linear-gradient(#004e95,#004e95) no-repeat 100% 100%/calc(100% - 2.2rem) 2px;margin-bottom:1rem;overflow:hidden}#doc-content .admonition.display-page .admonition-internal-title{text-transform:uppercase;font-size:12.8px;font-size:.8rem;font-weight:700;color:#002b4d;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .admonition.display-page .linenodiv pre{color:#8998a5;font-weight:400}#doc-content .admonition.display-page .highlighttable pre{font-size:12.8px;font-size:.8rem}#doc-content .admonition.admonition-consultation{padding-bottom:1rem;border-bottom:1px solid #ccc;position:relative}#doc-content .admonition.admonition-consultation a{text-decoration:underline}#doc-content .admonition.admonition-consultation .last{font-family:Lora,serif}#doc-content .admonition.admonition-consultation .admonition-title{color:#000;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .admonition.admonition-consultation .admonition-title [class*=" docs-icon-"],#doc-content .admonition.admonition-consultation .admonition-title [class^=docs-icon-]{font-size:19.2px;font-size:1.2rem}#doc-content .admonition.error{border-color:#d83750}#doc-content .admonition.error .admonition-title{color:#d83750}#doc-content .admonition.note{border-color:#004e95}#doc-content .admonition.note .admonition-title{color:#004e95}#doc-content .admonition.attention,#doc-content .admonition.warning{border-color:#df7d26}#doc-content .admonition.attention .admonition-title,#doc-content .admonition.warning .admonition-title{color:#df7d26}#doc-content .admonition.important{border-color:#008255}#doc-content .admonition.important .admonition-title{color:#008255}#doc-content .admonition.important .last{font-weight:700;font-size:19.2px;font-size:1.2rem}#doc-content .admonition.hint{border-color:#008255}#doc-content .admonition.hint .admonition-title{color:#008255}#doc-content .admonition.hint .reference.internal{font-size:12.8px;font-size:.8rem;position:relative}#doc-content .admonition.hint .reference.internal:after{content:"";width:6.4px;width:.4rem;height:6.4px;height:.4rem;border-top:1px solid #0073e6;border-right:1px solid #0073e6;left:100%;-webkit-transform:rotate(45deg) translateY(-50%);transform:rotate(45deg) translateY(-50%);position:absolute;top:50%}#doc-content .admonition.admonition-may,#doc-content .admonition.admonition-must,#doc-content .admonition.admonition-must-not,#doc-content .admonition.admonition-should,#doc-content .admonition.admonition-should-not,#doc-content .admonition.admonition-use,#doc-content .admonition.admonition-use-not{margin-top:2rem;border:2px solid;border-radius:1em;padding:2em;position:relative}#doc-content .admonition.admonition-may .admonition__header,#doc-content .admonition.admonition-must-not .admonition__header,#doc-content .admonition.admonition-must .admonition__header,#doc-content .admonition.admonition-should-not .admonition__header,#doc-content .admonition.admonition-should .admonition__header,#doc-content .admonition.admonition-use-not .admonition__header,#doc-content .admonition.admonition-use .admonition__header{display:inline-block;position:relative;padding:0 1em;background:#fff}#doc-content .admonition.admonition-may .admonition__header .admonition-title,#doc-content .admonition.admonition-must-not .admonition__header .admonition-title,#doc-content .admonition.admonition-must .admonition__header .admonition-title,#doc-content .admonition.admonition-should-not .admonition__header .admonition-title,#doc-content .admonition.admonition-should .admonition__header .admonition-title,#doc-content .admonition.admonition-use-not .admonition__header .admonition-title,#doc-content .admonition.admonition-use .admonition__header .admonition-title{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;margin:0}#doc-content .admonition.admonition-may:before,#doc-content .admonition.admonition-must-not:before,#doc-content .admonition.admonition-must:before,#doc-content .admonition.admonition-should-not:before,#doc-content .admonition.admonition-should:before,#doc-content .admonition.admonition-use-not:before,#doc-content .admonition.admonition-use:before{position:absolute;right:4em;top:-.65em;width:6em;padding:0 1em;display:inline-block;background-color:#fff}#doc-content .admonition.admonition-may,#doc-content .admonition.admonition-must,#doc-content .admonition.admonition-must-not,#doc-content .admonition.admonition-should,#doc-content .admonition.admonition-should-not{border-color:#004080}#doc-content .admonition.admonition-may .admonition__header,#doc-content .admonition.admonition-must-not .admonition__header,#doc-content .admonition.admonition-must .admonition__header,#doc-content .admonition.admonition-should-not .admonition__header,#doc-content .admonition.admonition-should .admonition__header{top:-2.8em}#doc-content .admonition.admonition-may .admonition__header .admonition-title,#doc-content .admonition.admonition-must-not .admonition__header .admonition-title,#doc-content .admonition.admonition-must .admonition__header .admonition-title,#doc-content .admonition.admonition-should-not .admonition__header .admonition-title,#doc-content .admonition.admonition-should .admonition__header .admonition-title{color:#004080}#doc-content .admonition.admonition-use{border-color:#00cf86}#doc-content .admonition.admonition-use .admonition__header .admonition-title{color:#00cf86}#doc-content .admonition.admonition-use .admonition__header .admonition-title:before{content:""}#doc-content .admonition.admonition-use-not{border-color:#d1344c}#doc-content .admonition.admonition-use-not .admonition__header .admonition-title{color:#d1344c}#doc-content .admonition.admonition-use-not .admonition__header .admonition-title:before{content:""}#doc-content .admonition.admonition-use-not .admonition__header,#doc-content .admonition.admonition-use .admonition__header{top:-3.2em}#doc-content .admonition.admonition-use-not .admonition__header .admonition-title:before,#doc-content .admonition.admonition-use .admonition__header .admonition-title:before{font-family:docs-icons;margin-right:.5rem;font-size:1.6em;vertical-align:middle}#doc-content .admonition.admonition-must:before{content:url(../images/must.svg)}#doc-content .admonition.admonition-should:before{content:url(../images/should.svg)}#doc-content .admonition.admonition-must-not:before{content:url(../images/must_not.svg)}#doc-content .admonition.admonition-should-not:before{content:url(../images/should_not.svg)}#doc-content .admonition.admonition-may:before{content:url(../images/may.svg)}.footer *{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}.footer a:hover{text-decoration:none}.footer .in-collaboration{font-size:.8em}.footer .team-logo--icon{width:54px}.footer .team-logo--text{font-size:16px;font-size:1rem;line-height:18px;max-width:160px;text-transform:uppercase}.footer .agid-logo--icon{width:8em}@media (min-width:768px){.footer .agid-logo--icon{width:10em}}.footer .agid-logo--separator{border-left-width:2px!important;height:30px}@media (min-width:768px){.footer .agid-logo--separator{height:40px}}.footer .agid-logo--text{width:112px;width:7rem;line-height:1.2;font-size:1em;display:inline-block;vertical-align:middle}@media (min-width:768px){.footer .agid-logo--text{font-size:1.1em;width:8rem}}.footer .small-prints{color:#00fff8;font-weight:600}.footer .social{font-size:1em;color:#fff}.footer .social .icon{color:#00264d;background-color:#fff;padding:.3em;border-radius:100%;font-size:22px}.footer .colophon{border-top:1px solid hsla(0,0%,100%,.1);margin-top:1.5em}@media (min-width:992px){.footer .colophon{margin-top:2em}}.footer-menu__link:hover{color:#fff}.t_translate-wrap{display:none}.doc-tooltip{background-color:#fff;font-family:Lora,serif;-webkit-box-shadow:0 0 100px 0 rgba(0,0,0,.15);box-shadow:0 0 100px 0 rgba(0,0,0,.15)}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:before,.doc-tooltip.bs-popover-auto[x-placement^=top]:before,.doc-tooltip.bs-popover-bottom:before,.doc-tooltip.bs-popover-top:before{content:"";width:0;height:0;border-top:40px solid transparent;border-bottom:40px solid transparent;border-left:40px solid #fff;position:absolute;left:0;z-index:-1}.doc-tooltip.bs-popover-auto[x-placement^=top]:before,.doc-tooltip.bs-popover-top:before{bottom:-40px}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:before,.doc-tooltip.bs-popover-bottom:before{top:-40px}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:after,.doc-tooltip.bs-popover-auto[x-placement^=top]:after,.doc-tooltip.bs-popover-bottom:after,.doc-tooltip.bs-popover-top:after{content:"";width:15px;height:15px;-webkit-transform:rotate(45deg);transform:rotate(45deg);position:absolute;left:5px;z-index:-2}.doc-tooltip.bs-popover-auto[x-placement^=top]:after,.doc-tooltip.bs-popover-top:after{-webkit-box-shadow:5px 5px 70px 8px rgba(0,0,0,.15);box-shadow:5px 5px 70px 8px rgba(0,0,0,.15);bottom:-20px}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:after,.doc-tooltip.bs-popover-bottom:after{-webkit-box-shadow:-5px -5px 70px 8px rgba(0,0,0,.15);box-shadow:-5px -5px 70px 8px rgba(0,0,0,.15);top:-20px}.doc-tooltip.doc-tooltip--note:after,.doc-tooltip.doc-tooltip--note:before{content:none}.tooltip__wrap{overflow:hidden;width:330px;padding:2rem;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}.tooltip__title{overflow:hidden;font-style:italic;margin-bottom:.5rem;font-size:1em;letter-spacing:0}.tooltip__content{font-size:14.4px;font-size:.9rem;font-style:italic;margin-bottom:0}.tooltip__close-btn{position:absolute;top:16px;top:1rem;right:16px;right:1rem;width:20px;height:20px;padding:0;background:none;border:0;cursor:pointer}.tooltip__close-btn:after,.tooltip__close-btn:before{content:"";position:absolute;height:20px;width:1px;background-color:#0073e6;top:0;left:50%}.tooltip__close-btn:after{-webkit-transform:rotate(45deg) translateX(-50%);transform:rotate(45deg) translateX(-50%)}.tooltip__close-btn:before{-webkit-transform:rotate(-45deg) translateX(-50%);transform:rotate(-45deg) translateX(-50%)}.tooltip__link{color:#0073e6;font-size:12.8px;font-size:.8rem;font-weight:100;text-transform:uppercase;letter-spacing:0;position:relative;display:inline-block;margin-top:1rem}.tooltip__link:after{content:"";position:absolute;left:100%;top:0;width:30px;background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAsAAAAGCAYAAAAVMmT4AAAABmJLR0QAAAAAAAD5Q7t/AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH4gUPDDQNy1r5IQAAAH5JREFUGNNj+I8HTD704v+ZR1/gfCYGPODNlz8MLv3XGc4+/srAwMDAwHjx6df//jNuYVX84esfhg9f/jAI8LAw3G4yYGD8+vPv/ztvfmBVPP3wK4YZ+14wdIfJM5Q4SzIw/v///z8uZzRsf8rAw8bEUOIsCRHA58EXn36h8AF2435mx6vmAAAAAABJRU5ErkJggg==");background-repeat:no-repeat;bottom:0;background-position:50%}@media (max-width:991.98px){.chapter-nav__list--hidden:not(.show){display:none}}@media (min-width:992px){.chapter-nav__list--hidden{visibility:hidden;opacity:0;-webkit-transition:visibility .35s,opacity .35s;transition:visibility .35s,opacity .35s}.chapter-nav__list--hidden.active{visibility:visible;opacity:1}}@media (max-width:991.98px){.chapter-nav__list-wrap{max-width:300px;margin-left:auto;margin-right:auto;border-radius:4px}}@media (min-width:992px){.chapter-nav__wrap{position:absolute;left:2rem;top:1rem}}.chapter-link{background:none;border:none;color:#0073e6;padding:0;display:inline-block;font-size:.9em;font-weight:400;cursor:pointer;vertical-align:middle}.chapter-link:hover{text-decoration:underline}.chapter-link__title{float:left}.chapter-link__counter{margin-right:.3rem;display:inline-block;float:left}.chapter-nav__list{list-style-type:none;margin-bottom:0;padding:1rem}@media (min-width:992px){.chapter-nav__list{padding:0}}.chapter-nav__title{padding:1rem;color:#000;font-size:12.8px;font-size:.8rem;font-weight:700;border-bottom:1px solid #ccc}.chapter-nav__title .title__chapter{color:#8998a5}@media (min-width:992px){.chapter-nav__title{display:none}}.chapter-nav__item:not(:last-child){margin-bottom:1rem}@media (min-width:992px){.chapter-nav__item:not(:last-child){margin-bottom:0}}.chapter-nav__list--visible{margin-top:1rem}@media (min-width:992px){.chapter-nav__list--visible{margin-top:-.5rem}}.chapter-nav__list--visible .chapter-nav__item{display:inline-block}@media (min-width:992px){.chapter-nav__list--visible .chapter-nav__item{display:block}}#doc-content ::-webkit-scrollbar{width:1em;height:14px}#doc-content ::-webkit-scrollbar-track{background-color:#e6f3fe;border-radius:7px;border:2px solid #fff}#doc-content ::-webkit-scrollbar-thumb{background-color:#0073e6;border-radius:7px;background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAHCAYAAAABIM1CAAAALUlEQVQoU2N88+m/hggf4w0GLODJp//CLEwMUhI8jJexyT/7/l+OcdSAQRAGABbrTN6F2sNMAAAAAElFTkSuQmCC");background-repeat:no-repeat;background-position:50%}#doc-content table:not(.footnote){border:0}#doc-content table:not(.footnote) td{border-right:0;border-left:0}#doc-content table:not(.footnote):not(.highlighttable) td{min-width:220px}#doc-content table:not(.footnote) thead .head{border-right:0;border-left:0;text-transform:uppercase;color:#000;font-size:12px;font-size:.75rem;vertical-align:top}#doc-content table:not(.footnote) tr{font-size:12px;font-size:.75rem}#doc-content .footnote-reference{color:#193e5e;border:1px solid #193e5e;border-radius:3px;padding:0 .4rem;line-height:1.4}#doc-content .note-action{margin-top:.5rem}#doc-content .note-back-btn,#doc-content .note-close-btn{background:none;border:0;display:inline-block;color:#0073e6;font-size:1.2em;cursor:pointer}#doc-content .note-back-btn{position:relative}#doc-content .note-back-btn:before{content:"";top:0;bottom:0;width:1px;position:absolute;background-color:#0073e6;left:0}#doc-content .note-back-btn:hover{text-decoration:underline}#doc-content .docutils.footnote{color:#000;font-size:12.8px;font-size:.8rem;display:none;margin-bottom:2rem}#doc-content .docutils.footnote td{width:100%;float:left}#doc-content .docutils.footnote .fn-backref{color:#193e5e;border:1px solid #193e5e;border-radius:3px;padding:.2rem;line-height:1;display:inline-block;margin-bottom:.5rem}.block-comments{margin-top:4.4rem;padding-bottom:2rem}.block-comments__body p{font-family:Titillium Web,Geneva,Tahoma,sans-serif}.block-comments__header{border-bottom-color:#ccc!important;border-top-color:#eeeff0!important}.block-comments__header h6{color:#06c}.block-comments__img{width:56px}.block-comments__reply-anchor{margin-top:-5em;padding-top:5em}.block-comments__logout-link{display:none;padding-top:.25em}.block-comments__logout-link--icon{position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);color:#d83750;text-shadow:0 0 20px #000}.block-comments__logout-link--icon:hover{color:#fff}.block-comments__logout-link:hover{text-decoration:none}.block-comments__logout-link--visible{display:block;position:relative}.block-comments__input{margin-bottom:1em!important}.block-comments__toggle-btn{background:none;width:32px;width:2rem;height:32px;height:2rem}.block-comments__toggle-btn .docs-icon-minus,.block-comments__toggle-btn .docs-icon-plus{color:#06c;position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%)}.block-comments__toggle-btn .docs-icon-plus{display:none}.block-comments__toggle-btn.collapsed .docs-icon-plus{display:block}.block-comments__toggle-btn.collapsed .docs-icon-minus{display:none}.block-comments__item-btn{background:none;width:32px;width:2rem;height:24px;height:1.5rem;border:0}.block-comments__item-btn .it-collapse,.block-comments__item-btn .it-expand{color:#06c}.block-comments__item-btn.collapsed .it-collapse,.block-comments__item-btn .it-expand{display:none}.block-comments__item-btn.collapsed .it-expand{display:inline-block}.block-comments__item{padding-top:1em}.block-comments__item.hidden{opacity:.5}.block-comments__item.is-new{background-color:#e6f3fe;-webkit-animation:background-fade-highlight 2s ease-out 1 forwards;animation:background-fade-highlight 2s ease-out 1 forwards}.block-comments__content{word-wrap:break-word}.block-comments__name{color:#06c;font-weight:400;font-size:16px;font-size:1rem;letter-spacing:0}.block-comments__date,.block-comments__role{font-size:14px;line-height:21px}.block-comments__role{letter-spacing:.88px}.block-comments__paragraph{font-size:14px;line-height:21px}.block-comments__paragraph a{text-decoration:underline}.box-comment{position:relative;width:100%}.box-comment:not(.sending) .loading{display:none}.box-comment.sending .loading{margin-left:1em;display:inline-block!important;position:relative;overflow:visible;width:40px;z-index:1}.box-comment.sending .loading:before{border:5px solid #0073e6!important;top:60%}.box-comment textarea{min-height:5em;font-weight:400;border:1px solid #eeeff0;border-radius:5px}.box-comment textarea:focus{border:1px solid #596771}.box-comment textarea::-webkit-input-placeholder{color:#ccc}.box-comment textarea::-moz-placeholder{color:#ccc}.box-comment textarea::-ms-input-placeholder{color:#ccc}.box-comment textarea::placeholder{color:#ccc}.box-comment__login{display:-webkit-box;display:-ms-flexbox;display:flex;border:1px solid #edf5fc;border-radius:5px;padding:1em}.box-comment__legend{font-size:12px}.box-comment__user-image{border-radius:50%;position:relative;height:56px;width:56px;float:left}.box-comment__user-image--anon{margin:.25em .75em .25em .25em;background-color:#e8f2fc}.box-comment__user-image i{position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%)}.box-comment__buttons{float:left}.box-comment__required{float:right}.box-comment__required>span{font-size:.8em}.box-comment__submit{position:relative;overflow:hidden}.box-comment__submit .loading.no-bg{display:none;width:30px;height:0;content:" ";overflow:visible;margin-bottom:5px;margin-left:-15px;margin-right:5px}.box-comment__submit .loading.no-bg:before{left:auto}.box-comment__submit>div:not(.loading){display:inline}.box-comment__suggestions__tooltip .tooltip__content{font-style:normal;padding-left:1.75em;font-size:.95em}.missing_permission{width:100%}.missing_permission__text{border:1px solid #edf5fc;border-radius:5px;padding:1em}@-webkit-keyframes background-fade-highlight{to{background-color:transparent}}@keyframes background-fade-highlight{to{background-color:transparent}}@media (max-width:767.98px){.sidebar-nav{padding-top:5.5rem}}.sidebar-nav a{text-decoration:none;color:#596771;font-size:14.4px;font-size:.9rem;display:block;line-height:1.6;margin-bottom:1rem;margin-top:1rem}.sidebar-nav a.current_item{position:relative;z-index:1;margin-bottom:1rem;margin-top:1rem;-webkit-transition:margin-bottom .3s,margin-top .3s;transition:margin-bottom .3s,margin-top .3s}.sidebar-nav a.current_item:before{content:"";position:absolute;top:-8px;top:-.5rem;bottom:-8px;bottom:-.5rem;left:-8px;left:-.5rem;right:-8px;right:-.5rem;background-color:#bffffd;z-index:-1}.sidebar-nav a:focus,.sidebar-nav a:hover{text-decoration:underline}.sidebar-nav>.sidebar-list--wrapper{padding:1rem}@media (min-width:768px){.sidebar-nav>.sidebar-list--wrapper{padding:0}}.sidebar-nav>.sidebar-list--wrapper>ul>li{padding:.1rem 3rem .1rem 1rem}.sidebar-nav>.sidebar-list--wrapper>ul>li>a{font-weight:700}.sidebar-nav>.sidebar-list--wrapper ul{list-style-type:none;padding-left:0;margin-bottom:0}.sidebar-nav>.sidebar-list--wrapper ul.current>li.current{background-color:#f6fbff}.sidebar-nav>.sidebar-list--wrapper ul.current>li.current a{color:#004e95}.sidebar-nav>.sidebar-list--wrapper ul ul{padding-left:1rem}.sidebar-nav>.sidebar-list--wrapper.figures-index--menu,.sidebar-nav>.sidebar-list--wrapper.glossary-mobile--menu,.sidebar-nav>.sidebar-list--wrapper.table-index--menu{padding-top:1rem}.sidebar-nav>.sidebar-list--wrapper.figures-index--menu>ul>li,.sidebar-nav>.sidebar-list--wrapper.glossary-mobile--menu>ul>li,.sidebar-nav>.sidebar-list--wrapper.table-index--menu>ul>li{padding-bottom:0;padding-top:.5rem}#glossary-page>.chapter-header{display:none}#glossary-page .chapter-header{padding-top:2rem;padding-bottom:2rem;padding-left:.5rem;overflow:hidden}#glossary-page .chapter-header h2{font-size:128px;font-size:8rem;font-family:Lora,serif;line-height:1}#glossary-page .glossary-page__btn{border:0;background:none;cursor:pointer;color:#0073e6;display:block;width:100%;text-align:left;text-transform:uppercase;-webkit-transition:color .3s;transition:color .3s}#glossary-page .glossary-page__btn .docs-icon-minus,#glossary-page .glossary-page__btn .docs-icon-plus{color:#0073e6}#glossary-page .glossary-page__btn .docs-icon-minus{display:inline-block}#glossary-page .glossary-page__btn .docs-icon-plus{display:none}#glossary-page .glossary-page__btn.collapsed{color:#596771}#glossary-page .glossary-page__btn.collapsed .docs-icon-minus{display:none}#glossary-page .glossary-page__btn.collapsed .docs-icon-plus{display:inline-block}#glossary-page .term-content{padding-left:2.3rem}#glossary-page .term-content,#glossary-page .term-content p{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#glossary-page .term-content:last-of-type.show,#glossary-page dt:last-of-type .glossary-page__btn.collapsed{border-bottom:2px solid #eaebed}.glossary-page__copy-link-wrap{color:#0073e6}.glossary-page__copy-link{background:none;border:none;color:#0073e6;cursor:pointer}@media (max-width:767.98px){.return-to-top{bottom:4rem}}.return-to-top i:before{margin:0}@media (max-width:767.98px){.modal.modal-sm-full .modal-dialog{margin:0;max-width:none}.modal.modal-sm-full .modal-dialog .modal-content{margin:0;width:100vw;height:100vh;border-radius:0!important;border:none}}@font-face{font-family:italia-icon-font;src:url(../font/italia-icon-font.eot?94539880);src:url(../font/italia-icon-font.eot?94539880#iefix) format("embedded-opentype"),url(../font/italia-icon-font.woff2?94539880) format("woff2"),url(../font/italia-icon-font.woff?94539880) format("woff"),url(../font/italia-icon-font.ttf?94539880) format("truetype"),url(../font/italia-icon-font.svg?94539880#italia-icon-font) format("svg");font-weight:400;font-style:normal}[class*=" it-"]:before,[class^=it-]:before{font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;display:inline-block;text-decoration:inherit;width:1em;margin-right:.2em;text-align:center;font-variant:normal;text-transform:none;line-height:1em;font-smoothing:antialiased}.it-app:before{content:"\e800"}.it-app-1:before{content:"\e801"}.it-arrow-down:before{content:"\e802"}.it-arrow-left:before{content:"\e803"}.it-arrow-right:before{content:"\e804"}.it-arrow-up:before{content:"\e805"}.it-behance:before{content:"\e806"}.it-calendar:before{content:"\e807"}.it-camera:before{content:"\e808"}.it-cancel:before{content:"\e809"}.it-check:before{content:"\e80a"}.it-chevron-left:before{content:"\e80d"}.it-chevron-right:before{content:"\e80e"}.it-close:before{content:"\e80f"}.it-collapse:before{content:"\e810"}.it-comment:before{content:"\e811"}.it-copy:before{content:"\e812"}.it-download:before{content:"\e813"}.it-drop-down:before{content:"\e814"}.it-drop-up:before{content:"\e815"}.it-help:before{content:"\e816"}.it-expand-media:before{content:"\e817"}.it-expand:before{content:"\e818"}.it-external-link:before{content:"\e819"}.it-facebook:before{content:"\e81a"}.it-favorite:before{content:"\e81b"}.it-file:before{content:"\e81c"}.it-flickr:before{content:"\e81d"}.it-github:before{content:"\e81e"}.it-googleplus:before{content:"\e81f"}.it-no:before{content:"\e820"}.it-instagram:before{content:"\e821"}.it-link:before{content:"\e822"}.it-linkedin:before{content:"\e823"}.it-list:before{content:"\e824"}.it-lock:before{content:"\e825"}.it-mail:before{content:"\e826"}.it-medium:before{content:"\e827"}.it-more-actions:before{content:"\e828"}.it-more-items:before{content:"\e829"}.it-pdf:before{content:"\e82a"}.it-pin:before{content:"\e82b"}.it-print:before{content:"\e82c"}.it-refresh:before{content:"\e82f"}.it-rss:before{content:"\e830"}.it-search:before{content:"\e831"}.it-settings:before{content:"\e832"}.it-share:before{content:"\e833"}.it-slideshare:before{content:"\e834"}.it-twitter:before{content:"\e835"}.it-unlock:before{content:"\e836"}.it-upload:before{content:"\e837"}.it-video:before{content:"\e838"}.it-warning:before{content:"\e839"}.it-whatsapp:before{content:"\e83a"}.it-youtube-text:before{content:"\e83b"}.it-youtube:before{content:"\e83c"}.it-zoom-in:before{content:"\e83d"}.it-zoom-out:before{content:"\e83e"}.it-error:before{content:"\e83f"}.it-info:before{content:"\e840"}.it-paper-plane:before{content:"\e841"} \ No newline at end of file diff --git a/en/_static/data/glossary.json b/en/_static/data/glossary.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/en/_static/data/glossary.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/en/_static/doctools.js b/en/_static/doctools.js new file mode 100644 index 00000000..c3db08d1 --- /dev/null +++ b/en/_static/doctools.js @@ -0,0 +1,264 @@ +/* + * doctools.js + * ~~~~~~~~~~~ + * + * Base JavaScript utilities for all Sphinx HTML documentation. + * + * :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS. + * :license: BSD, see LICENSE for details. + * + */ +"use strict"; + +const _ready = (callback) => { + if (document.readyState !== "loading") { + callback(); + } else { + document.addEventListener("DOMContentLoaded", callback); + } +}; + +/** + * highlight a given string on a node by wrapping it in + * span elements with the given class name. + */ +const _highlight = (node, addItems, text, className) => { + if (node.nodeType === Node.TEXT_NODE) { + const val = node.nodeValue; + const parent = node.parentNode; + const pos = val.toLowerCase().indexOf(text); + if ( + pos >= 0 && + !parent.classList.contains(className) && + !parent.classList.contains("nohighlight") + ) { + let span; + + const closestNode = parent.closest("body, svg, foreignObject"); + const isInSVG = closestNode && closestNode.matches("svg"); + if (isInSVG) { + span = document.createElementNS("http://www.w3.org/2000/svg", "tspan"); + } else { + span = document.createElement("span"); + span.classList.add(className); + } + + span.appendChild(document.createTextNode(val.substr(pos, text.length))); + parent.insertBefore( + span, + parent.insertBefore( + document.createTextNode(val.substr(pos + text.length)), + node.nextSibling + ) + ); + node.nodeValue = val.substr(0, pos); + + if (isInSVG) { + const rect = document.createElementNS( + "http://www.w3.org/2000/svg", + "rect" + ); + const bbox = parent.getBBox(); + rect.x.baseVal.value = bbox.x; + rect.y.baseVal.value = bbox.y; + rect.width.baseVal.value = bbox.width; + rect.height.baseVal.value = bbox.height; + rect.setAttribute("class", className); + addItems.push({ parent: parent, target: rect }); + } + } + } else if (node.matches && !node.matches("button, select, textarea")) { + node.childNodes.forEach((el) => _highlight(el, addItems, text, className)); + } +}; +const _highlightText = (thisNode, text, className) => { + let addItems = []; + _highlight(thisNode, addItems, text, className); + addItems.forEach((obj) => + obj.parent.insertAdjacentElement("beforebegin", obj.target) + ); +}; + +/** + * Small JavaScript module for the documentation. + */ +const Documentation = { + init: () => { + Documentation.highlightSearchWords(); + Documentation.initDomainIndexTable(); + Documentation.initOnKeyListeners(); + }, + + /** + * i18n support + */ + TRANSLATIONS: {}, + PLURAL_EXPR: (n) => (n === 1 ? 0 : 1), + LOCALE: "unknown", + + // gettext and ngettext don't access this so that the functions + // can safely bound to a different name (_ = Documentation.gettext) + gettext: (string) => { + const translated = Documentation.TRANSLATIONS[string]; + switch (typeof translated) { + case "undefined": + return string; // no translation + case "string": + return translated; // translation exists + default: + return translated[0]; // (singular, plural) translation tuple exists + } + }, + + ngettext: (singular, plural, n) => { + const translated = Documentation.TRANSLATIONS[singular]; + if (typeof translated !== "undefined") + return translated[Documentation.PLURAL_EXPR(n)]; + return n === 1 ? singular : plural; + }, + + addTranslations: (catalog) => { + Object.assign(Documentation.TRANSLATIONS, catalog.messages); + Documentation.PLURAL_EXPR = new Function( + "n", + `return (${catalog.plural_expr})` + ); + Documentation.LOCALE = catalog.locale; + }, + + /** + * highlight the search words provided in the url in the text + */ + highlightSearchWords: () => { + const highlight = + new URLSearchParams(window.location.search).get("highlight") || ""; + const terms = highlight.toLowerCase().split(/\s+/).filter(x => x); + if (terms.length === 0) return; // nothing to do + + // There should never be more than one element matching "div.body" + const divBody = document.querySelectorAll("div.body"); + const body = divBody.length ? divBody[0] : document.querySelector("body"); + window.setTimeout(() => { + terms.forEach((term) => _highlightText(body, term, "highlighted")); + }, 10); + + const searchBox = document.getElementById("searchbox"); + if (searchBox === null) return; + searchBox.appendChild( + document + .createRange() + .createContextualFragment( + '" + ) + ); + }, + + /** + * helper function to hide the search marks again + */ + hideSearchWords: () => { + document + .querySelectorAll("#searchbox .highlight-link") + .forEach((el) => el.remove()); + document + .querySelectorAll("span.highlighted") + .forEach((el) => el.classList.remove("highlighted")); + const url = new URL(window.location); + url.searchParams.delete("highlight"); + window.history.replaceState({}, "", url); + }, + + /** + * helper function to focus on search bar + */ + focusSearchBar: () => { + document.querySelectorAll("input[name=q]")[0]?.focus(); + }, + + /** + * Initialise the domain index toggle buttons + */ + initDomainIndexTable: () => { + const toggler = (el) => { + const idNumber = el.id.substr(7); + const toggledRows = document.querySelectorAll(`tr.cg-${idNumber}`); + if (el.src.substr(-9) === "minus.png") { + el.src = `${el.src.substr(0, el.src.length - 9)}plus.png`; + toggledRows.forEach((el) => (el.style.display = "none")); + } else { + el.src = `${el.src.substr(0, el.src.length - 8)}minus.png`; + toggledRows.forEach((el) => (el.style.display = "")); + } + }; + + const togglerElements = document.querySelectorAll("img.toggler"); + togglerElements.forEach((el) => + el.addEventListener("click", (event) => toggler(event.currentTarget)) + ); + togglerElements.forEach((el) => (el.style.display = "")); + if (DOCUMENTATION_OPTIONS.COLLAPSE_INDEX) togglerElements.forEach(toggler); + }, + + initOnKeyListeners: () => { + // only install a listener if it is really needed + if ( + !DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS && + !DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS + ) + return; + + const blacklistedElements = new Set([ + "TEXTAREA", + "INPUT", + "SELECT", + "BUTTON", + ]); + document.addEventListener("keydown", (event) => { + if (blacklistedElements.has(document.activeElement.tagName)) return; // bail for input elements + if (event.altKey || event.ctrlKey || event.metaKey) return; // bail with special keys + + if (!event.shiftKey) { + switch (event.key) { + case "ArrowLeft": + if (!DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) break; + + const prevLink = document.querySelector('link[rel="prev"]'); + if (prevLink && prevLink.href) { + window.location.href = prevLink.href; + event.preventDefault(); + } + break; + case "ArrowRight": + if (!DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) break; + + const nextLink = document.querySelector('link[rel="next"]'); + if (nextLink && nextLink.href) { + window.location.href = nextLink.href; + event.preventDefault(); + } + break; + case "Escape": + if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) break; + Documentation.hideSearchWords(); + event.preventDefault(); + } + } + + // some keyboard layouts may need Shift to get / + switch (event.key) { + case "/": + if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) break; + Documentation.focusSearchBar(); + event.preventDefault(); + } + }); + }, +}; + +// quick alias for translations +const _ = Documentation.gettext; + +_ready(Documentation.init); diff --git a/en/_static/documentation_options.js b/en/_static/documentation_options.js new file mode 100644 index 00000000..860ac217 --- /dev/null +++ b/en/_static/documentation_options.js @@ -0,0 +1,14 @@ +var DOCUMENTATION_OPTIONS = { + URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), + VERSION: 'version: latest', + LANGUAGE: 'en', + COLLAPSE_INDEX: false, + BUILDER: 'html', + FILE_SUFFIX: '.html', + LINK_SUFFIX: '.html', + HAS_SOURCE: true, + SOURCELINK_SUFFIX: '.txt', + NAVIGATION_WITH_KEYS: false, + SHOW_SEARCH_SUMMARY: true, + ENABLE_SEARCH_SHORTCUTS: false, +}; \ No newline at end of file diff --git a/en/_static/file.png b/en/_static/file.png new file mode 100644 index 0000000000000000000000000000000000000000..a858a410e4faa62ce324d814e4b816fff83a6fb3 GIT binary patch literal 286 zcmV+(0pb3MP)s`hMrGg#P~ix$^RISR_I47Y|r1 z_CyJOe}D1){SET-^Amu_i71Lt6eYfZjRyw@I6OQAIXXHDfiX^GbOlHe=Ae4>0m)d(f|Me07*qoM6N<$f}vM^LjV8( literal 0 HcmV?d00001 diff --git a/en/_static/font/docs-italia.eot b/en/_static/font/docs-italia.eot new file mode 100644 index 0000000000000000000000000000000000000000..169c6163b35c962c959ee57b2c2257fd4ae9f981 GIT binary patch literal 11192 zcmeHNdypK(dGDUy*_oZ)*?H{D&hFgq&h6v&w7S>s?d?5~ba2S%^a9C;AO>S}7roF$ z4<1T@U<9!fY+_L;aZ0gCpxy%e1vE^OIkJx&Ais)|1#&w|(&T!S+>W*f(dP*1B@Hr6 z>Z0cTu%MDpAVKaYj9f8$?R8iFWc{ndDEWIrq@6pi9T_$3=old^hqC!ShZk(|` zc;A)}J^d2$gP8c&Z#{a)G0Yp++8^DC^`< z$7?Ck#Iu*^WEvzqNuH+;tH?H%B7(PC{UZ*^Md(JlpyCh9rHnCR(a9VJnd1uhdU zWaN59i2}Uc-eVX&1&nE=8mW>o(5!|T_+mCL`pW1X!L0)}NRC8N$LC@L*C2ZOfcfl9 zj9f%Z6)ionsy?*ka025+A=Xi}8AS^Z?M;YRMBohDmXWhDgOupGrc-Bhdi5Zm5~~j| z8lOo9Gv<^V5jC80GREnJ$bNuaL&lNkWAa(2Q659z7Ut>#OA8GWNS~FU5#-@8 zrLU4EjUm7KqELfNuPX?7CC{E)evVwhaHEn-VfX440GD2V=TH}>Oti{j4qRtA-x(-K zL6;$NE7bk2SMtkC%gdrSFXPI8=PN{%(dBDB)#Hf{cu+#o+gMcx zV>K})ny$3}|1vQB{{&qaeRTOvX`VdwSPp(-r`Cd00 z>YtqKM_v0@It@YqrCj#r$RD$(q;HZeAu(DlDKzSM1=<`PpNP>g9UtpwPqiNj<^ntd zqvARhg9a3k<5r9ypx4sHLZN*M4Gdf~X#bF>!F6y^9RC*t{xmW`FUG(S9o$qP59SK( zAGUv3m9nYf~9aV>4o%_1?=$kJI} z9gk~TWN*faV4{=H?U}N(Oc6z!|*f(t_*XfA7w8}6jmK`y<~Ei&gR1T72M1P z%<<`IjJh%oN-kn1u!N5+FR}gX0m#V+Sx2^zU&0um1t&)_Nd-MRgy>K}EWN)UvNOPU&&PcfCT zGiR1g(BpDcPO2|H+xq*wCaMnycxSaxx-C z<Ie;`g9?h|X-JU?>S6Wo&yfe8kQG^qF?vRhMb#%{Q^N$>6HJyEmF1`%Uqe5CxIKSF zdVa}{8zDiAxb$xq;lHI4lVti`*@$CtUy#+P(jJjw5{t=S(9l78mOg&CebeFgcf_(U z_JgPaKlcw3*7YXV^$@)8orI*iLf&0MD9#(`D)~nhSA#NG2O-!%$E*FF)pOlgQ4=Q} z(DZ1to^CXqbn`Ny@*q}yyu}rzi_oAJgy~T*ND$w&?IB;$s1_nAF zPl!TZDv(E248%*Ndw4}OskW1gvK;Ho;Dn*H9)!B`6fA1_G$jsH&QptVwc|L2;;A>AQE=uH859+I4SVMZh=D1FlrqTu@k? zo!$At+1Z0Is=>k8*$?iVon0&h?KfVXo_=b>4k6l{4>Xj$gsOr;7%wJ8qeAu~WP%(3 zyMQ&4Bl2JsI^>2#b5Ra;v0#)4qn^<3BMLM*d2o;QqqTuUYr7a_XW zv?ExqX&OVh{On+DetdksR-4V`hD^hRs4^r&x!i26Q?oh94H-{(>w@CuYISolSm${) z+sMdr#xQFByUUfdVb`R!-I+{yUOMf0tzs~K;*yDkQ_A@Ti5tQwlL~%zst`uM9 zTR~wei#o6iwvqY1KN%ESzMsybt`JP+KIB!QE~ahNJa5SH%5kj>!1ek>som#!!;V)> z=ta*N0s~21=)gndI5MHUdt7F@*mJ2>c%)GuYpoY1K+u`94@QK0*O2|gbO6-$U`~V` z1%QqrpU{XS3(MhsVT6Hq0CEEkcGPS_=*xIhA|peCbA8ovF`F%_v7y0%+pf~|xMdA* z4|0X97pJ=BtuJDY`Kdx>DihVI=4A`H{Pu=sNV;!kYo=cIT;`Zr4K_KI(95pjs&QSp z>e#^GkgAq|xKiz(8yp&855;0-zo%5LR(A~#HMW0h!}RrDT+ebQ25U{Z;Ct6kmuLK7 zx|sD;O;i1JaXRp4%4p^VO1$LAF+b~Nle${=Wle@N&=kt%;<|VJhUri3XbcVSs#eRT z9={yJMkGQ`kTQFWeT2-C8_9kg0g%3E+DngO@gOHx7^OS{Y3736nh*>apFl7)%xTH9 zZdu`V)u~OtfvPPq_XP7sRoL9ENWJe9nU++Nl zwjolIGe~?tyUowG|3H9+a=9Ln|EzM2-)Ib9w(i5OTTtx8CnJfPA;(qrTTF9Q$1OH~ zd$>s({`P98FeSU`BIZ^}xr(JR_8_xm5Ef3*P+g8bYu7#L&Tyz~ZcF?2Y!>4M5qYGH zpqTr{3HZimV9%@Eh#CCwE| zXt5GixE+j&THc}i?+O@t3N7ak^x&Ewsv{(Etg1*~3$E_BgM^-SOvBZ4oBAh5M&>Gg zl}svSMVOlodbh1zJFsELpkeEF%^cpnwH5?9Rqbm(UYVO5>aW&i+0%-KU9q*aS^jX% z@oclE8aL#wJ~frQJlAX6(RiY#I5M(-baag!7>EGZ*!1`OxGr0UUXYn**gd*ml2y}O zSFKjE#nR@!N^hkQ)YO=&ZL1o6o^P4MTkUvn@6K8+kAZi{lAGSNb^!QHXN`?$-Nmn@ z=?S|!qgQHEh0B8Sn%Z@12dcx_tZG^PM#;qVvX0%Aqqo`fkfRTf2SNK#R3J>2FoNZV zh=uwa^(tIC!YWR?Znz9;clguoH6aT6I?XzpkIt^+(rwD>Fs)^Uj`Py($#HIFc$`Hg z*te)0K{UzQudT$1PqnY%vV|%MCMgV7zbwn`x%O+h5!X(oY#^e>`{>L&CO-zzw43_H*h8CBJpWV?3FgNE7;kYcB; z0O@Ogfy7NnCq>bP7gSIWL%f*HUR5rqY>5`)y1t>&*r4n2_BmQ}Tu7Eb>iL2E4ttUud*YY96%1gTng3LXKBO;W)Q|EGozg zB@dgfr;Yk}Q#9pvHe`;Ic3HEz*xdYy?WGMly{6*SBr4B9!Xo?x}lbdt1JU(ZG zuCo2JTPxf9%bP1#>5Xd!2d--j?x-<#y{DVrSj>=3U9afdwrx9wyEa#=R5VMg?Wn;( zC77J+^?c7(`$|{*=9T?Bt1hgmWwuE!T{P24w)J?8T+rNti>f2^Z!nTPi8Hd;_FA#qGty*v#! zl{iMR%8Ia9>!{MIml{0G2Pr#>n5VSp7F+y&aYkH^oI59NGxF|I#?2dg+|U!fjdK>Ua42;~4udBbt+zG?rnPLHBSRAXcFVck#Y*w^`vThC-2)B&*z5Z)~#dKBv}xw#P77d46(g)^ykUgLK-J zT**wBfnB+|c`{M-JP$FJneg@BZC+_AOjYuRzrOgEZh*`N4&G`X8K2zZs2M7hZsjzyW?whC_ zW`*!e=LKN}b@Ysi15PFG>QV+4UQ-aDr4#qvce*e?-#)N=rFy1Nm{v6~31>x`yn9~H zC^%?UHCLYxrjpW%1W080UL>=ZWJBe701n3m2`FmzU{X5 z>$lw|ojqN;r`;FKoZfIx5bVaEZm;8jr+|B~L%?%FwgoLYs2e35B)j_e1l54r)z1lX zy?CEEp4T253&+QifM`vapJqNpo^VHPxbL>y>mh4LGT~CB^9@;=WyQhzx(Bx9n z9|~l*N^Dew$t(AZvT#eX`benbs^1k1HLcaBX{(Qyq%XDi`;AOyO)BMUF)gYnsYC*y zmz;6alL39CIPRuBUK&ea*CxlbSkAK6W~@>F1%C|POe=?O_~$HhZ93D)=Q*->l#cnO zR@%)7l)+>OwMz6x^aHk9Iy0I(kVq+9l`;GQF(yt?CWF~3r>hSHpYElci%nqHaPxneiY4l6}h#F_AN6F+An-=H~F7pgAnYWqhk zFzs#M-!qs>Ijq+oOj+2rq(*w^5B!molgf+dzqB`jdQO5)IlS%$kkd)DD+vcShrX3? zz~Pg-mVUy!-3=IZWz+#ulyof5ob>yT{f!91O+`r}k>v=7kVsJ{of^pCG3YNnkQq*; zoo>N!hAvU^aXzMYFQ0X)y-8#s7fwR@^R((tjyO z#E3{%Afa>kY$8I~R=nq~lFPwW_z?tL;^hT@jm4SPvKZa~qO@hz$C}0ZsB2kHX+o}7 zH_-YRb_<~=g6GInymr@?exR7rkd{fdzhY|a?=|x>%ee5>gu~baIEKG)Cu9F?^(a+L zNJ=Lh={bJNyhYP5{48dgG3nl==M#>dq*pW6{tA5v+bAl%&8);GC2A)RW6p4h%iqDA zzk;t1T)gYU+o$j?qBz77QZ`=gi_s!2bFavK<$nt(MY)aP{ka!Xcr3}@Y?osxt(}LX zkn99|PP1f5y>NowOYdAtu=;ieM8etcB$D`+YQ$>*daVeE}UgGX`Wt- zE%KLO9W-6nVs4yj*b7zY6wkK*_7|nDaevZvllL3${p;6@m~nY|`9-$Oo`l!_9JtnX z%;KO$Shez0xK-nUA3p}=Iv4(%Q{Wg653x7lI}vey6`D)*S;27ekb&zi`mA8+dg;!q zAwEDy)5D+yn6W$L$ir7*>`yg2f*mXJl`{5nYg;8HFqGDTANaA z$S)6ybR|>IWXAmF{LtX`QfUl&2!$Ohm98Ehm~V~F4-Z{aDz;D*RWviUMKQFPskA2! zga9{^pNJ?j{!&bi;Fa1dD3a2M@{QQqa032-Wf_>(ntaa;rd3;2D%3LUt@kb+n5*`0%;yF}IuGXZ8~dws1MgY- zF-{mmIlRdEXTXQb%Hkq_%1VUA)ChDiChu9~Eae9!{Ml`Tts8p|)^f5~*;%hIteQ(& zlwO?S@LZ+Rf@Qt%5pezI&Sqtfh9&Lfj68gJg`M3=MzG-qQx_LI07MH*z_bl5VJcuL z_>BAL{mshoPvEZOKGA{KcT!$n!~G!cZeQN+9PU%N zC$Rby(#vr3wc=i0M#{t*G<>U7!1r^bIIrG>sQE^+7aum>MLvcY@f3NKJW0MvzD53y z`~&$u`B(Bfd7DP)Wpt6AqOVE5^f{)nKaXsdN9BKwekR(+7U;P8lh_|>Rqe0iH^tA! zFC@OMZ%Wz*F>W-zZ+^@Ab3y4T@+abpKz`Em?kh>2>hOc&dzmh8BJH4mO?$ip%YX+va1`*7 z4y@rDz_WXg?zv;=;IV~62NyuL_xOtR`hB^a;*2jz9ai?UpTgJZ|^VP-MeMa(W{RhJu(a_;Gec0Bfa?absr%9 k!RrF@`>@1b^2_9IJhy + + +Generated by IcoMoon + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/_static/font/docs-italia.ttf b/en/_static/font/docs-italia.ttf new file mode 100644 index 0000000000000000000000000000000000000000..96a7767f4dd660a0d79cc2678274189f10fb7ad4 GIT binary patch literal 11012 zcmeHNd5|2{d4I3p^mI?p^!72`(=)v@(>uq`YP8qP&dwf4T3BSXxQ5*r`*0-na9n>yetszk*cVxBu3?n>X%Sf&A|XDa~EGXXkGF zch~-mkiPe!e(YKlDBojmB7Y3|^0fyJ-*Wr+V$;Zf1NmR>KeTJ-M>ih5laLjkMgH)C zowr<1-a{TCq?$m!=itr*dp5l9iRY0YAcTJF`a?Gz#=LQ@{3Wj^d@UNulL12a?>u~v zs3gK`aq$|u|GIrUQP$3(j@MH3;LjeSlPR*D93#(AhgRrC^fG!iy@lRIe=4b{*NIFN z^p24@=%r)T7O{y#QY4Mq2OJH1CSdJ-5@NHtO+qo7$8Gw{W1T=bREJAzvW zY>+I8qK?nS2Cf10^a1nPnHaf%mMU6$VpY9p%i#pZixLU9Nk-7ZLwl190pd8rwk70j z%pfUxu4va8?Oxr;C&lUmjK+JVF=I}-VNt^=Cu5u*Qp5Z&BV)+(G5M@hD376U6LWQe zr3*O)qYjEvzV;aAoEF&gz-9{EbwNcZ5q|Zsv2y$PT(w9hs#*klrQK-TB*F}W9m}5^bK20uSxKYWauygeYfJ-mG zv#1MGCR$}N2d*=m?+g^=@;OMZCm$lWyqH^DSX>mndD%{KBf0rSBFgCEFBYF)d}#5( z#lP{o(Qo;9q5~e3Q1mvI)k%bmPl~2X?f<_FO#eSY7e*ggd`+5T_rk7uqyzzRqNQS` zIXc!DNm=g#OLG$|R!qFp%?A4>Ci+m<`r~$k5I`xHy;<@__PF#Nk|88UD@BDy9WPHC zBV*$+8m42TeeChp{lRR2M_`m)r)D*((B$ zx3TyNI|Ul?MHH;jO5YGI6{AWQb*(~}Iw`)8f)%D%&=hT2g)j}FsdIm}B z2|XQGG%c>B47y$i+Q&G2-I(oIXP&^xZAm-Pk~EiQU%nr9fErofe9uJps~ zIf=rmW3J~-?)=%DJ+p+Hxqvx7J%v%1#zDzB%mkM3{>25hm)!+9878a92J%N31GM1e zD0ERlk2WFN6c9`A>jP~9Fd?9&X0l)vT+wJ1Wra}E3L`1ki7Myi*!sVe?YQPBtt-?n zSzKMJ^pQ3!>GJcM8kdhVm9dj27mm^+a#Ze8pS!R1sF6$>bUS}8gQf3(0nKHZMP)QQ zdr~nKISSa&q%E4O>6UUVB1PpdNL{LS>g;J&c|kQ)SzaVbgJUw1_asdYm`QH2uU`C5 z_5eEuI#kJ8*a7$il8cGKh6v@$$BIDG<>ffCs_dF~svJ_+Vq#TQ?56h;8 z3ADzUEHNs}Q9HhZe&IlC?x6I{f*m(Pf*5h>-_OB6pc0d0`a{`>V{wnjYE)?rOEHPX z~sAfYQWF^gM@XxhIQQw?|U;L$&QeBmJo{b8oEsWQN`7u z1lBcgAxHPhh9dgO@?(<37)S?_GJp~Gm>?Lh zm-j*hC|HZjP>=W=dD6f@N8$-l$V&zCsEUDjsdO8!h<2&1u6bFGwP*4ei$Foa9Y&?c z#L%MqJbhK|io$<$oAE5W2flp*GIA}{r^rW~n(oDg4mmewj_Lh%azHP^H z_`Ngh<^veG`E@hzT?YTtL$j}6am8hnNl^(31*(AnYBZ{;t`Ac%fmkpF9A|(viQ=T!cE-9INo<3UPyz0-4T{LFSS) z777!mTWFVr1?05F--)_e$_d>0xAhkM2wQ}B+npz&&YTV6ACA)QI2o$8H1CZD!ICYv2J4HKfukPK$CGu3v@ z`XD=KJnXFs3hOJC^@U)S=T&VZEz4=csQPa&S5k&ul~#6UGVXb)l;<@I!PwFBCK665 z>*pnI2%}8O`lLMTujdUpULm0uJZBILBsHM}_mU&Xg!1ljndM^7rB>mQMs2jYT9^Pq zXU;wt5$;_>_7Bm1P}_q!5q1;+I);2gBaSRAhxdgM2Ht+i4LI0VvvHv>V-1N64-U-s zR!W6Trl7_K2l{WgMAPGzHMBX%<}+TL>YBH@fHmeO^X18ORHvGk$!Bw$>zX0yzL}|- zddYK{V`eni))7{R4xlS_I;9rEhj%aG2d2iJz zl+DI0E9eTc4ZHm3|whY3;2^y-)(P!+M zC*2$lmC0^s-I&Q>ydWYEmk<iFI-*g0!T#LJ2Kaq6)WzQBlh~bp9OyLr6^i& zeRh!0GmdGvdUjpk#PINJxwo87Canl_Q$f$Bl`H$#Y#A_Y-L9HLJ2qB>Agijqt%u69 z6N7z~nk;)-!LZA=mNHB4uR5M>R#oH5?4`#ivlnK2Y&#lHbQgw)_l}ILumb}T;0l}m zg&)^t%h2;O^9;LN_lvS>nyV_6a;8vR-&^h}=Yy&mQ?*SMqu28-b7-R-@9EiEt>!TB z7Flvr>sIyypXscy5v{xU6*WC!SEluHbuxcJP+C#FVr742D3ehwtIsH!m|n)QJ96|U zdj@j!9&!(8ABqZu$r47eR2Q*OU%gg=OGjA6Y1avtLG3nwI=#k4L2tWRd-KuWb)3IV zSstb}tG@PF2uXIWn7EU9OMI>~PsU^NgiHWdM zW{-yJ`k`1O;~0X4BF+@UxU4k>3`!Io==FzTp>~i%T851MuUbwPtwRP1Bc(1t7k2#VP1Lh$-&JHoGxa3a-sPsgoAm1O9P!&qz; zwHhU>QFG2AcI7^6oSkUB-uko5kn5FAJEN-Ll49w4w{4c(m?}GoD|J^;2 z4+`rC3prL1g=5?TvZx?0lss&@n$~M$4bha_*^oI-%4Lnld}IA5HW$}q^{R?flc+om z35)16pSt*xyVqxDczn(VTxIj;HkLQ{mDZOp(d(BD^j}dQ*ivO|yQiDpXv~mJT`%jK zHf=hNyEZxS=O{9BDnY@r*>f^lv&ny56;LM%J(oWZg%*VRaPs@KLsKA530ck$xp= z7JfpzTfd@Dw%$XJO;4Ygo^JgR$fbYK4d4sxg>ENjm(ttYNVgb}3=AEm$AD^QAx`PMVjFHBE|zM!$leZgHg9o_*tg$@>q8R}~2YA=LY z3L$KL`o=q%&|`-Vmg}+tiuS^b1H^xb4pR=Gls6p1?wj^K<#a1*L^akn?$iB*j(wf) zxF!9*i7U$nT%|5K&g)*?b9>ALV&Bb;$!iAevSk}GGxRrt371N88Ga42 z_AF#AM;c@u*#aGWcVWWX<+lh+tyJtO72C&m%VkXIm@xLZUUC+Cor0lvfukiyx&+qw z41!ieKl?0X1P<^gG8|ImmRno@dh0EW-OXucEW9BK89O2T=U#S$kd>0VP;q-gS?PkY zmb%?i;=vt!^99=mZ@Qy(#NfM$$3;%6wNC!zHqB+jUghWPi4)>Zb|y=8yleuO7aD$%I&q?$3Ly*_^vb)38chjDNF zTw*({*q@NQAbp`*d+UKtsA+CnBSTLay2j2qkirip+y;O4HqULwA;SGo^yawR-nWOI z1Se(O5Vl9@r%kV2-@*2}lwKnI!WltWK^;A<;($|$ySkKyh1V1WXsN^s2!q@ei} zxdfK+8k}(a&nX^?ung+rV5m1Fy;~cpgA*t#iSpV=p^tOLYk&jIl5$)+wY1WO0l-G0 zOE(IR?uz4PtV%ky1mAE&>y;aBkWQT_-qz|3rcbQ7EeLktPdC?az>~*4&?ew%A=`qM z9Mp{>4w7B{CxU7~?dqomx!%m5e(Jn>O$3JU2Xkx38p=*JG%#xNr(0L14#?pmgI0Z{h2?Ubdovo{6%XWsOKc; zq{Hj31Ua2VtDJCPbLi^{2OK`OZQ(b(+pU06S3(^iMM=eS%t^ib*x!yI+*Fh}w=fC3O|B?OT4_`udz7Onij(w zK$JGE+GwLt8*wemDUQpv${Jc5#cm<=MDQFrir4Pi!p{^_8r0HVt*@IJ`;lf|U>Rq> zk#HEh3&-$hZ)WV@tZt=(2}!AhBR$PenKx+q**9XQ8Ix{bcqZZ4UG!4MT3@I4VjD%J zH<^`Kr$p_p1DG=$;^Ox)=da`I0~hc5@b)Quizp7Ugp`d{dSkReOWZ4RU-{nxicxN3 zcz^DN6dp^m*IK1mQfuYlC?q?V&t06u>Thqg!1emcqYrH zU&dSbg#p9S8XdM>$Ttn=a^NFI9p?Pxdk={;cMsNPi-if8O8h4Z#o5~6?&dp}_Rm)O z*5DtVrm3B7?XF+bC&Xh68`M8 z!PbpE4Qn}3C~vLRb}pMsN|c_P;m~Zk+=OL4`vGwM_s(W%j)o;|<%~RVV2PcbNk*{Y z220(4EiRvBOyXA0#fKdGh>k?HX5OoxW}>jB+?6T^R?n$Ttv#m8Z>;XmB;sUBRH>Khp71~vYQ+v zw~&t@Mm$a)Adix7knfUzCjUZyN`6gVA#c(My@1Zsf8KVtw;kjYSf89=y?GOgM37?ByM-JnYvHeJQ zZr^j`P1hYd*i#>>;k(B@_>Sx*6dwYX9#Y4*eYHP`;SV;L-LvmQ`*+?5SG|Yq!^dm; z`R8hXu-Cdn2M_n`+jDTwjXMwT+1>NOTYEO_I&|rwLkEW-1$=&oF~fa8c~H!HC-Qr+ e#2)fNax0!2u+&4K*CElCf6W?7)7!b(F8MDQ8O)Xd literal 0 HcmV?d00001 diff --git a/en/_static/font/docs-italia.woff b/en/_static/font/docs-italia.woff new file mode 100644 index 0000000000000000000000000000000000000000..cda2cacb9b6c8afb3c845bff87d03a2b034e3dea GIT binary patch literal 11092 zcmeHNdypK(dGDUy*_oZ)xq0l&&hFgq&h6v&w7S>s?d?5~bZ`iCdV$0t6oWB3Sub?a z!+;#X7(x8NU_?ReloFH3g#$JOmx(#FeZMkxIgb;QBE$4VL?C9vOgF8QfvL7OUgs1dZeza}h&YMscxd?f+oy>g)ZrzKr z^@Nn>c-p*i*NW@+?A%RA-(zSq#*_V@*Z=f-6r${B$d`FizRTXa{@{^Y2w4$9{+B%6 z{@vL0fy2AdZp9ho#ke2cciU^G$BF~&qsAL}TJnhbE6XdxrlBT5wD?ereS=t*Eq z;i-`d86}sHDrVq|*|_K{qjv;J2W*fmiK33r#Rjec^z;Gq*_jx*fR-v+dSX?*Xv^UQ z#)}dO$s{9a;i0`rh5&J#VcQaNHfE3%Jy*2rjCQYXA!(wH%)+_0$Ol#?+| z52<1PmqVIjVoW~k6v|`h+r(U5VCh0m!Kj0xl&?L8Ij05oJg}JpcU@3X6L%X@Q9}(M z#Q}}@NFgu!uqHmT3oHpSp9b1-9=L?D-_Qq8N2Je4Ts!U$pY#>dpfTi^U({Tl9YHII}aAWpPYtTac*8Y3y|cfiuz#EKOY@0QqL-^4^8>RNx?ZV&<} z<+3+RKF^+zzD+WO#Av0c(5U0(X=7w;JVwLk*k~VnqV-@f8{ifgW!EViG@yVSw`>Ff zy^_x7^R44(VBn%b>*xF#Tm?7B@joW;r;q`9F$RWc8Eu-rhJX%lc>A0e4aV=%g_2OZskfk%cIv&>yPnRg&wA2c{ z<4Ss2Z(z~lqPM1bhT&-nTp8v{Kg^z&D6Bf>dfw#DpUv4bOSqW}nB&t^7zg7Zvnq6QWH4vGl$^&?W#A0$OS&3s%7ujaE@s z2qmpBl5(A>a$b(D{|niUYmU;oO6`)x)ul=wX~U8(zo4mc`8ZP97(FUSMzgag6;qL;fDKLBqPd!GDGx-XsQfvpOVv)DJmUSc=vbw%y?U-2OKRez0-73W)Kc|^lWJTb zR35~tjWxNVbPyWUf-pS<1_|Puwms-eTQY;TZDPSF?E;gdik#FIzM`3`9Al9vy)CSe zqkCmT5&dNOi;~0`NC%QKfD!gZK`>q~?}Z3Zuojo09`!l$q=A8s#uK8DmkQ)j6$9~7 z={8;w?NVD^^RgUk&*Y0N0tE$k7?r*#h8ErD>Fa7&6#kprjOW-r@a+?jk?Wy8MXo9^ ztz1-KUZE5oR<gc#*=&%XpPAWu#mvlp7}a3^ z%*+*AXJ+Q}LF@Hbrly`)vqgwD=K~F8FQKYn5XOs1(WsEU2pK2)Kra_wXqX%z55cl@ z;id!s=x=6bH{bs(1B7|$6-F0OSY66YYg+q5HCu4x*B+1$)P zb#82Iu3DYRW(Q5fgs3t+2D90jYP)8AkR3E0^;QLi^_9x{La@s7sXCI6R_pTxPhiE^j?ZKP~I|=|DLq4GqM;4aD z`@#qVZ$IP)9BixExX_oehD3%32WERKr9viCP-BAw{Wn~y>2b>%+8ku_881$C&0Af- z8grBR@?<)yQ_aidv$@T6&5(58%v4RiAG?m?~sERnt^IRhSC= z=@OcGff6q|a?HNn(|U3SUkwd6-FryLz=l@H^&77#>Np04RKoXtXooeT_viBfD9sk zA)NJS)P1~#Kj1!p4A_(03`%FH2>Wy+=F1Kgx+D)4;Ub`!o4dIJ!>VI8Ls!CEd zjD=Um>-7yO*G+Ax*T(^GbW$J#TO!kp{-;o!E~WJeGnkAPA)}|mK0Ygp~Xs6;dU@8YI%pw zzawDiDYTs5(1UA!sE&}t(TXB{Be<;34ib9CF%4JGuIrl^9-b}tmea|k6=7~F=-IS# zW&fHj1BR{JRdZ;^#%d5`RkgSENO^W*u&+{+Wlt*@cG=caX6e0E$Ft3wm?5_-EGOA_u8ATJ*%Q$vNj^1L=LXIvW_ki}Hs6d!3VFXKc5exOzYZbV3gjJk& zop2e{Zu6(pYg`ocwwtv#AMIVo`P-D`VOrA)9q0MmlcU_q@HmS~uy0X0f@qSpUR{b4 zpJ-jqWeZgjOi~!EenpmBv#nRN!>*l7+U{_cp3RQfj)fpC#HNZMqNT)b1f)?_G2_$` zqhKIYlU9nD$%s>rhiegra7_k;&@2o~Tbos#2f{osp>Uu~rr&r%vy>lMjy;lXDcKRr z1?XU4m&dUPoe|QvUctUW3}@-|xA7!m8IDpDYYBDvEp`&}-;X^E84m;WNzRK-WO^Yz zpNa(`$*z^0!X___yRbP1Z`v$E1QFK4X#}!}gbp#a#P=vM5mw6V@o-%~5Nl){L$FZ9nPM21wZ?!!iGn6FJ18B= z;h0LsZX^P|{xB@m4sw{>K|TrzlSApiT+fLTS5W*xv(CRRXt0Wkeasr#kOcri5nEjd zUO#O|__YyEq#Ez(xV5N~41IAJi>;zoqhvK|&N;-c+-Hrm6RkH}f0`L`y|QU%R25uO zEM4!m&5|2aWhZg9?kZ~RRjTO@YGbPE=nE$$Qx0To{UpamC(0gt)f+7qN*{)snprN({q}XXIK>F%e@o*E;1ET2c zb1JBZA)e1ol!8E+oqz@%%vk%BShBPjT6~hh*3h?2*=x zJssN_o&_jTgf$^uoGACc&}gC5JZOgph4q7l9IJ@JF>V1_RFD@+9yVP~>$S0lXv*zu z$Q&o-vPNURvHlaAi)*raRmG`ERGx-}Mf90_FTV8d_1PI7pR)m1+5DM}<;{Ji_2o83XtGh|cO%lf8Gn~oz@XRGD1W@*(eRT!uQle0aZ@7Zc^@uH7i z+_$yj!kSuUi)2#;Gu6d5{@Es{>ZrXAvkkLXW)>Se&@9gs)Bz1=z76=s=RuPQ&P}^; zYFUE>ZY6VMH`$MUB;UL=`OV_DRn#r<(Ego93(6%VjtQ%mqv56!$0$}w5f*C|RhqS8 zorn1#Wm^$*los4Vlc(pW#r5Fn)6ym*=Psn(oT0}JJ<;Px>!FQjB-*8a!|BoWu7xwQ zhJ7IGKGqGZqo_xYv4#6#^5Tm0lBikuG3{=>M4xJ1LLZo(J~2Jr`T>wj|DYSd7uXBk zPR=kB*wI)pTvA{cw1rb$y58eFiE{)+m8M%yUW*7LN*_H&U)n2Bii-Kxv(qn5Plvvs zvB-VFT{s=y0Xl^a7K$0_YUpY&gjot9Y<>F1JDJd9hYptOvI2_s!ixjMe~1oK4xp4b z9K-IL_C4)%D{4eF);8|f{e+Hvo$t6M{r-uo%LZJfE;-JdUfpwh%miZJ&5gR9jDX8wM-QO-#<1?n-}vPPvjRnF%wn%hxp?NEAHJ zLyTo6eEn06i%o^8O3v_C7v9tjklDb&TlIZo6B}Gr*0gTd8}Z-t>{lJ^B-Yhy+sjfs z?zEmB@COWIN)^=O80+fIpVukRrF-+WOa9Z(;0iPBUZS zx1x}-6T*M)Wj6>}DY*+3w7rM2#ALxXd=C(C5^pv4%?3@EB z{9wXu@Oy9b+-4ji+z&->j=SxBd+14UQpOEodz60K^xE|uY;Q{GCBiS95rh@g(bFmp zIF-1oOKDhmO+kQ`O5AbBiTvDLYu}Eg>gjxbO4Yz5oE2&EjyXN8;Gk92TzxK>QsN*w zE^OiMgC3XM7neqR5nR%ZK;V6G3Ezuiv=dYL7w3ZF8q~VFsN8WPm;$D_%yCBZqGC?R zc1}5+|13t=Y$UpLqu}VSIBv$Oq*F`q4L7u2yWs}u)QRG4t=?ez z#G2cJUPKP|}hR{r$UC!T&f2-fU4 zy+iyTnx1~>H0&PEQw1K#HP9NK$$@!)~6v$4M*r*7TSLzdG z;g)3ikx<)JzatoGSj$h-mLD%kUuy03>*@50WYX7ST2xVzi3CC~Iqjw<0{UQK%uRW` zG?u`wO^#`?tYxiCTOlnG^S4wAO)oPJ&K4yzXj{(@C_-2?sWZzL{{q;Rm)Y{F-;W6)@^b zr~{-ZsaTFVsoy>Jw;~8P6{QOgS&ncB4=L)TlKpAi2K)`<+{!bwOU`jBB+xx|%UT6j2_(rg5|?Q+p(;iNy9`g=JdM#N(Y5;{l7$_QZ_ z@t(UvE(BNMM-Xs{mlyms7H3-1Vt50H(xz1#Z4_!Fu4OsJak*AmLu;ehErgy3o+C%` z+Fe`tsbWflTDq(CHB)0h)XWPk*<GKh9l(9~>?u~2=IE8!B7X_iLDO|D=EkXp zy-=A>@@(t-f9UBNcXqjM*PVuY=jzoWW?Woce4Z_`$Kka<3$Aq>vp8rGR;@G{Zq<0; z$B#j|&V~QRBsj*yL+nlXPDGqvh2|1{mN1+uFT}ju{=~2Hi zH#o4lSR92OLSaXX#mk2J=b9sPLxYzW3r!S770rxoPz)_*Dy{K-A;68~CnAcBzZ8=r zc%}9-ilh{xd?U6poPghNSq7%HBG)~QX;qh%3N;avP;D(1m%w>h#tfQ;;^l)wb0e74 z&}HwKR0Ykn7`=uM-WuB{47C~44CNF2GzFoaM1P~8AR%;*!LBaAuGU~xKi}bE=<&`Y z{xZ^^=fo^wA>W0=A%Ddtpnb$HWFq93@iu;8z;Luihiw<~O~bhy_=r)5IY0T{Ln6)H zgSFXWVFIQS|A|6zwl=uC`R=9tvz5NJx$Hnl=Yec)ZC_=!|6NNz!UVM$v#BM%;2VrOTP5p1}@)cN@~0MWt{Fl|FimhuUigh&<7&*G(Bx-e&7MJ4#koRwp^x}x2*!?o<%3=v)ADOF#1s~Fx-D<;zX{{x z!iO;4Y&$jZYb&)69{Gj+=ro$TvyQ+`1%NfcqZo?74pJ~G~;6fXY0^Zez zHN;lm;@@gTVkk+WCWIxNqukqu8Okqf!~EN{N7}Fqc%ThO0Uv6^8omKMwfpd{n+EqE z*?D09PLS;|2D}NMi|xm!mOHWe*iUwD-*e+l`wt)LsSnlg-Qym7M|Km64+BdNspH$e z+8@O52OG@p+4sQ%J8y)m-b41`S569uxL93E``$cPHwhK{tGp| B(DMKQ literal 0 HcmV?d00001 diff --git a/en/_static/font/italia-icon-font.eot b/en/_static/font/italia-icon-font.eot new file mode 100644 index 0000000000000000000000000000000000000000..5242e53839d7d1643699f0b6fc9a012d4f4d5f56 GIT binary patch literal 23672 zcmd_S33yxAeJ6U(-2q(eJ4k{T00C|wNP+}Fi4+NulqiXmM3GuZ$)-qgktnXBDBDTA zB(@XVl3(MbQ;%ai9mkW!P22{uV`r(`dNPyN$)uSX$F-BDahs*{(DXI+%S)4fstC{T z+zV=PKiZt`)^5ni3XWnGhAds84}|05{W=2lNGo&V57EDr73RJm@C%AXrXLxSM z49OQsaXUZq=4o=2A0-b1fVE_NP$yQ2kR%e?rLULoeG8=wDv7gMFBizuxK{8*i$!xW zS=|2So5+!(wb;yZ`iJ$qk{m^z;>+P_0sWSUjB*odvJjP6fpT`Npp&?Wn|O#92?HS&}0iWDD6! zI!PDVhQ`^<{r~-=vI*e+wLA^oY^{vMR<>A9dY-K)lD@LQh9biVb_PbU#4w`>Oks&( zVG*;-62s4;Y$U8ODFTaG!djD}$w*jrV2hC$CKatl0w$26%}BrrQnVWh*g=Y*ZkB*2 zr06sfFoqOeMq<=obQ=j+M2a3G0iQ_GYb0P6Df)~A93w@)k$`Qa2u{Ef@QxINMgj(s zV#r9qMN+IV60njKD~$yFB*iKt0aHmaY$V_;DOMW^*h`9tsniQi(0&bIH z%t*j;Qmio&@SPOnMgr!OV!}wE0aC0r5~zU`>x=}tAjNtkfkH^J!APJLQfxF5sD>0l z-7JBANU_;Spd?akF%qNxVylrrU8I;c66lN++l&N?BgJ+jF;P&=7ztEJir}^^fgVXQ zXCzQ2DRvkMG)jtFj09>WMR04DK)0mWX(UiEDRvnNv`mViVwOPFq{wg=3G_{hJw^hh zlVaXTpm}gOBQfe{IQQmhzQ~UNi)CP%9oXQ3s>+H`FyQff{64SSBoQf7 zK2vX7hF!CAcK^~Pdh4Z2r3WtI!*WO)A2hO;E^%X*E(dVqj`Gb*>>hp?2fZ>5g;eE3 zvLp&TM`hAaaYrS)0Ro21iJnI4q_TLiB61_RQltI(v#e! zYw9zRx_n$fHFSXIII=^QINFZ}DU<;=9{{C${0>g^HPQ&`_0t@U@Wpa{WAx!8r9a>< z(T~!JBPI1nY5E8~{+9mg^`pW8N#y7b)<{2VpN_Cb4zscC@#*zDBh+uAGL3NmR(kRX z{b|W{Go9EFsaEg)QBxlm-un2Q~3F0A@on23qZh3G_QWpvrewQcrqj7~gU zuK!4BUT*+(G9E_wBKIL+h!5DVxBvplNR8mH%C<_A>g9Y;q zZrRwa8$K{TZdA61NQz03OiNIVD76qei9TBdt7Vc14$AQYH;Dx`E2?=CIIBp!GU=oy zSu`CavM9bS! zpixm=6NKvK#vX<4Fk3eEzx0xp;#2?lR3H)wJVmo%F||Kcl5JLnMl(kJw{n+N^-niqAJ1V2mO8xMqd!ilD(u1*%=bvi$ibks{W6`R6*j(y-;WHSA zheROzI>=`R3x3c@Coxfpnr4Y2h=L+6Stw_w)P$+CQc0zPA_cWNBG=5ijp4sD;*3YGoz(V3OiYKV z$3~+m+TKlb1|0ySf#EUHBSjPK*|d)@T)v;b?ehJ>>gphW8#|W%F*TG-4&AgDhvu%6 zU0o+{o9pVD>ni;ylF}kg5pI3s6)u?z2RB{`hQmQF84Q0ixtD>nL#}I12gf1jkFY10 zj;YJ$QOvAHVtMU~c=h|h7wG^JFi+>{L9Z@=JhCK9T5X~>;mCn*HNVgAYo>Co?3evH zf3B7_-lx^+n1pRSkQ$9?x)NiC`8=v_C4ucl1)y|@m!r>@hxBIlUMJ6C$&HS*4KwLgG0 zF=>ewil<8JrE~N2!P5FXy+9v4RXWH02nTwB-B>@xZs5S`(Q*01dLKE0KE`vXgz{%M zd)BboIs*lbmvtu@GBE@lc3*zbDsg;25vWK7af!$hkz}&ODwIV@=NW{*NuiW-V89{T5^Ew%NM!fo$|MbSN)noY}zi|2YDr1+p z0wdCmVKzT3@t%zjn#>RJ9uW5B!3a}*c!KQ8?=WHfib#|R zGlVDQpo~D833SZBGD%{j$y@o|p%5jBcofJOstQ5f^Ehp)ERY}#T9|spI99AoQJvJQ zO9Q>%jMV(#R%{e)eBqPf(8e62n@?5;xkrQ5;mgb1qpxqw(HBDDPjWxVg~H*`<(~(u zI~cL>=1_Pe#hWhwd?m-g%l&^<=iz4TYQO(m%F&LUn)IUdhT;{ zrZidlzv=hs_e=kHw2ObbbX(~!=oWf^7c$%Ef7bC^$DJ`ytvAm^gsyGPp;@%fbghhu zGK8IBOLHT5T~oaV-o)`mMh_g*N`I=a*_)T&e29OPPlE1z(7?v>hdQzxFG42q+yIfl zW+mX9$O|IBKzI&X--3)q6(k}|DwG4#9mI)aOUlt9GZwry5!I?HoHmos>=Ol|P{qX7 zFpK@6fR4MdR*?J<>$1n^cW2qsM!{mBw72K7X{h*MICjc@S4yEP&_DlE>X1r5E8ScA zu|(Au!U--B<|=Wld@6K$BwyDrEISsc?#sPNgdGH#~heyXxA0_eVesemQbBwu`i%L!LBa+W)+U- z+xGA4?y9e&WPI$<=)U9oCw2|=_jT><9?E4}Q+1v7TWb@Ma4>-FmcuMVYqoosZXbyz zz%H^-#(Yp2B!<>Bn%G96#AOm$s2DzId=f|%W$pU4m#K1I8-?0o6fzK|=y_rhlrW$S zlYLdxC&l=eFZU}ptBHT!YPVe;??}RLgz0iHk8_2RzRfpYrd5>aC^Y@niJ-Y?eaGUV36$iINMa@=w=|gsF z`AH>e)MZmH2rz_T?%&G0-TF4~+@_e|KD=HQGz@f8wvLbp_V>g2y_j7oK{>gW@*F=v zWPuZ8Zi%q{28annB!h^EB#DQC5KQ4KFFyE5EZR^XuZcFs8iQVM5bPufieZ8ndtkpW z%>;2Krc351lgywTC?#>maIo=e!#?!3x#_K)om;2p-k3YFwX?e|eQ4}!V~5gh$Q+pi zzt}_XEyWw@_q(~j0@UmqbJJV882D{-M-DTn!$-b;1mJ(%U5Y2^_e!f^7nqMXPjlY| zf2<<4`5J)|$XtlD2{wc=qK`n|w@2b^i|&xcibmQd$DH_LZ{D8kreNMWv9qDrsLb^~ z=D6^U`T2C!q0aN8cG)b;5-;&0&zYZQ6Z`b(#jRBpPg4rEBZ)Q$7&gaG!nRNWtIRIa zo$st?Js8+(<+y&v6;}nwO03#JcIL?#6`2)uC=usKQ!>6QF%YQ=1xO87BQu`V3U*^K z9P|g%Sesxxh^codZfj{xqsuwgSKPTe`+i?FWl-$f&K`IFLu6%oYzUyFqIN4qw&u`no{lMpM zOl>=I>(tVbzFmixCvQ2JPc`_wndZt!LnarAZO_+4s>0dM$Bz#m+dY&^*VUzSL%WX+ zAAhVX8-~&ADvvT`Zv(7HX|kR_LrjWUF`1W$%_>@L;*uS!sF)y;nK@WBTfl+{wkFmI z$EJjydRqydZf$8!H6g#H6EUlevR(~~Vy{U09z2hAu_vN3{7fSt`>7C^GXva!! z1vac}^btF-WeeGo&kDd69t5~VcoDw^B2xSoBuom(PnYDBWZIJrk!ru!B!TbQbVM=O z9ph^{`(tW5mK`VoUBqAB(8k*nwb14v*Yr|@NcpDSYb!$=AKbIHvX`o!Ccih@8B2Qo z?zTW>OQ4aS@%mkDfvOfi%93j_pUKLPY{GMAcCVGxs+J~`oJ@8A#^&_+8{3d^c>v8y zlF5h%=1-khK}LN7w0V^D=eG~$yIKV*xF}B#M>&Xc2qs}*Aj1hephpTT1UFV7&iNHa zG)$3!lMw?DA)fChLI3!Yg*vlhSugjc($CY$nsCr^C^f?WdT`EuU08^$Wuqp@pRu-fd_8`Z4BEJiE`iIvrF{Z;G#f3x$j zJLSIp?Zt&}|M1&C{K5CX_jiB$`gi~4JAeJPm;U@KU-Com;nbWHZ=01Ownf@%CDLfw>tSeWS?5K%ThJ#Shag**9wAyt+WuQM#=xSPjme z;dS1wV}A_$bw<^U^RpjAa%RMWMT(EeF~$OPt(8NihTaO`O;8;k2L=&?v~K2fs$ry6 zrW}w;8%rt5v?eIKjI_X9m}%@9s5a3XgF%PMQW#{ck_79KsHo5=Es9BS@QNf>`z;Qu z>PQ#uIY6WCJmCMb+&JD%K>`=w#y^*NH)g9Ji_3=UO%;STPKR%drOR6klB(h+F zt<5YePyn#&pj1T5u(?Z$yRynv8+NH?vy8EF7TmJfTtSSk7trJ#hNV9umS)zq#* zHW8vpRLq*o>2>((>SGmNKPOqxAAicNio7TY*b2eQSXtE+Z%7XBjCuVgNgvANkL&)q zH}B+MD3KXP{2!hpBerSE5*C1|t*&V1c z+~jpP^A*>YQ_3IQyv@@gP>b8+rouZg-bY?JO}R&29oZ2 zJKlZvo^yAvtgWn_Sv_@fYWc*{v7-kk4^8ghH?Xs(yJK|gXnVS@*6<;DV!oJaB5uxI z!Dc1`s>Ut`;#;>ZJ0aA?2+VY_j6&Okb+nu6COe%3b#Vr<7N+h9jCe3NfY!Zun3<&+ zr)YD+yhq>O$_LH&7j3b;dE*tB^YG)6`g!9KE(w!g>8tye_m#ey9O9aKVBD_Oy0g^* zE!^9d+t#%43IHzE`uuzDdi1V6eqZgSGL`D z13!W`u4}L(Ih6WPH2NXbxbas#3q9M~bK83stL%z75`{Gjcj-!PI=f}>U3>Q2wRcN4 zU0Y(X^vjVgtgS8EJEE{mP7F2bHcFaUUvKg`-^&`rf$1gC*UL7HFnoi@Ac`dHBP6;+ zumz@2z(6LPVwxnd;}VG@lNOZA0yEzVJTDxCF3M~~0zafxQufW&scgaY)dr(wz6CEdeSODD{~=hj4Rcre zkUo)-fBBbSO-+!#-zcRk*OmT5b#Q$>+!n^~b)=5!!0W;4(vPk$&1tMuA3kX0PV8B_ zu`g_aZ{VBHc_>vjc|kiY0X)2EP)V8N2{QtJ7hNC_I88(_J}f=)h44z z{|e9IF=ob*n8S%Z2^;z^YY@%By2#ok%Xkz!yMwG@2@5AmjLX0$+uoLLZLEv7#9Hdy zz8a?)o6|Tpd7uJAx_X^4x2v|z+p>jYVog^XnHvZ4vkiMHX7b_NoH4%mTCj3ULpW#^ zU*jnMTDT@Nv@6?DtzCYoyOYKN{`SaZI2&K`D?1R zo<90dy{*mRNF>~x-hMgHy`SxabbMQfnt#>z+?C&ArUFAPL7afH5BoCPx597*ck>9d zU-5@cY?BUh@_MduF{`?Z8Dh813sqJ`7KdPOwZ+Z@xPe=EzRk01oRc}svA`UKQ@HC2EbECQ89DYAO+5`Vq z&x|h=@^O#ixbcJbBd3nEmG0r>jXCbo&)0Tz?CQNX+OU4dmO?5^nI2-=bwQG&;?IF?53DSr!Maxu|&)=;V|v67VslD>EaF|%k6eJ zU=Q@W{SKGI#jH%6UEgiJ#diXm3-2^hCv%TnagDT>j+c&C&==?n+-I(Jf8UnK2et;!f&SnXf=pHsgJR8_y$;m^g^3C<$is-&>WuSlAi4=s(zxVapvlsU zFaIU&+;|Ulm;R~rDKiSbHuy02p4UoGmo9Qj>38mu^V8dbfX!Nl@pI~+!Y=gmqxlP=I7j+Dr*DCCOo31ihXSlM^)$1;< z?dsLeUCmwFO?v2RmoL9@HII&7)hi5pMhmR2qu7C+BcIQI?g;f*hp5TR4Y=%_MS&h? zT_Rr9qJXW>M%rS_lq?ei+IdALnZDEd+bB6X@DJ!D>1rOHaT2lh06 z;^F!6gXwoN!<7DZ*S{Q0HZ=w6tsMX5e}-bsn@tgOR6<)$nA zwjB89rd`Q{3?HFWhG5GG5Ley~cSAog0s%MBZ<(Oi2XBV~=IZ817cqP&70;(~Dg5&B zR9$Uf{}cUvwRK#w<2@%Hm|7ScTbO#_#Ctl1cl6fQ)z$XyVDwq4 zuW`z=PzZV>r@Xu=KWn{_46~l|Iux85x|GNDM=n3l@45VZpsFgs?_tMGI9Xkt49{=; zgzMY5pSvxync4UW{Y2>)OWeEJIa3uV9rIUJ`ROMDRlo1UL)Fzko1f3TT#A%Rlxr{j z9_2Fah{r4Adl5Xjk!;U*`yeL$Zn)IA0r(yvJ;fynnhSnV3h5?`hH6n}(Ws%3GzR1D zdaumf1Uh+K;}w7{TaGwoP>Z3RIhgfAV@8e)|E^5i*wI&yjFw|DJ+n?-EJr66HlcLz*3?}zx3WDJVIZX+ZvsDn&Xn!0e-E1SkY4Nsd-FZb zloxtq5PldFMKA_aegvEZp7}rIG3ci1E+#6iy9}LYe)i^LL%a7>Hq^xx3`*1o#kibd zGGW}%s~6f>gb*{lW^{JI_+>3~KC$t2!cr5ax<%6GzY2X7Sbv1oT7ICdRX6SEPf(Y| z>`HWWYsrMq8>r~1PSPdH%e>b#q1Z)5ajtLe?>*=?S$NKYP!x-_dNO;sArTE#)p_Yj z2I(}rU%)owj-pJ>2YV6XVtorBqJEwlN!+vjjN zXAH=}L^`wM)@KW!*L@~NJZ2DHfmFURz!Y9O5Tvx98N}hZy@|!jjA89mes@JEUK2`H zr0RnrR7@|$)atXT^VlovfIth~3#A*$uKGskmgbgB+xW3pkBu{&8b7wMyT2z>`U|f8 z*uJ5rRH|uc-}C#1lE@71TcKOh_Y5s;Lh6rH1d{NAtL!%5u6Y1`V|v_a{(Hcy9x_Cp zBF~c#W|l2zLM=|9-FcY7Z1gnaf7p8xc7|KXz_c>kTZ zudnTWYTu^@cIJn+51|)5TD6@?q-qXU!5-?jQ@=;I^Vw-Nl@TN(+4&gkea#f&s)yD> zR%0rAXfw?*7g7)JHbQ`~U&Y209#YB6?2=5jHDkjBQzGicl!dj#sgZ*r z2YBv>qQIi*ni!i*rx^S~_1&&!-JW0lQ! zI0Lq@$7W%WwW&Lp0dGd&dmXP@-ZtFCrgi^!3jxvKB>cDnyt?zQ^O~QQ(ph`Dtr9EO$S<%&lxX18T9r)L2o&dC;P}v zWGR0-zct%JMTKv)a#X4W>tLgkq0T8wR+GxhW~xZC!i;zb_n`>J6NSSTgS6lqX7mM5 z)A0V@?SvdTwEw2zn|2Ru-`BfuTi2EjG?QyjCu%A}K93D#<#sY&E=$b1?(<6qA8!NK z*+$dVFu0=t)*SHpT(*`Sax9WWlAU72iO4A6eVo}Gn0HQ(vuiV`tbEleTAAS)I^EbU zl_uF2h(Ud?s#g8L5W&_~HQ3x>F;%Lg^#iJ6fiisgKk=H|z0m>FH&|J_*?c*t&WR6 zRF{4_yZ8Aq^Wat8EL6kK=2nukd@*Bf>d=F1+*?+58%=!l=V-g+XLv8gtUC!)Bi9Vv=D zZrHobCg!n@N2@CQKDP_TlLm9c+Zj*1ZC8vX*Ben-NbFloC(XLOWaEu178Ku&>?UPP z$+gxK!)juT@7wymgTF8v zP2h%{fp{hp(fJlg&<=&+O1K`Zt)N#O$6zQ&s3Gg2yEc>Kzb-nho(t7MBVvz*>s|0! zoTAn4C|zQ6`NOB5=I#X$DWYzF0;q0(VswF^5U0~>b$Xnz_gNiQhufQ0M1P}* zFr*0RB1aL6=FY^tIaoINKQVhem+y6%trq&HN>T|eFE0li@MSr8o6EIPGc)r?unoO( z1#g+|n+Ko2Kt7%iWZ_Uf1)2E1)APJQ@1n9G47``h{YFG{3sXvHnZQ7GC0RG%Hofg5fP?W|z6o5n{HVBlJYT)E*t?yQJ8xgSuyo<@!R-sZ z3*BAunB7Y9v`3GxWNrCN>=tYn@eWMGVFq@lE2o(s zw2fy0{p`!M58Y$Bx!EXtLpN2JoX@SRk$#`fgcu`Y0?fUsW9G8l?Q*uF%ESo)rxtaG zW3^(9E8G-thCOCe8WCSU31L(mn7q@k*aD4_K2GJ8Hu=5v`x^JRY(tcDyj@IqBHG~L zcw<%bNRy!112%*rx!m>X$7bJk>d@Z(Jq@+Bm3#9ywb!MaZ#z?ZV>A*;RPF7W+)I;{ z78hdc!lD{f9451e_o|-8h%Z$g4OfVr^$Nl*1_wnz#J;Xkt$k2ytWE242mAgu}z?hcw7^Zt8h3?TOZRqHezqF%XGeR>}`oF!WY4r3zzD-ZP zu#RHw|G&}I{3m}4y(B?v$QleS{nl~yDw@IuHJ(5A)vsz=!2i|Pzxw*${Pki(K(*VQa5q9li^KK{i$(_Q6n0=g%)u-^)*Hv0jNUfH zcDms@^MY-HF~>HQ;B?Ll-zc~>3qX_g*B;@SHkdLVLr5+Ihj&zuV+5-Q?`8okjAet} zGl5-xSu3423`k(ix|Wz=7L|IVbY169&~W`FT{5#5RIK}IywHl~rw5`cAE3X>?1 zoEg@zAw=3(*nT>f;btv%n}9$L+5KXx&1cQrUE6>^fdJG6=-GJ@A$ z?Qd;$1gg9OxW|iWRkm5C?fyMpyUF5Bcr;nY_Jh*Wr%;X6f)L=3*cG4CY~<7+HonohCu1&+Ohke!JZ_Zmq1gJ6Kz3 z1hYCHyT$2~gik>h#e`tc<@LJW)7o14GrAqg^G#SszWZILY?3WXGU&FLNY{4xVF)k*Nv){_V@aRWkvW4M@_+SRptWswbvhcq;+RyYv|wAPN$ezF*VKVm16^?VpY^+mQ~sP z`VVA2_{}Rm_ZMKvZXuz(Kb35N#Z6b|@Q)Id&Q*sFam*&FFO3n}$|Qd|y4cugG3ySZ zU$Nvs8rq)m`E8W{wp?A+IC`q*Quq95Vw(kiOAdy6RyN;#spr&{vW*YEyxjg8x4W() zs2D&(u0Gvc`$TPT`UYjCr$6zDjtBAk%mPdbuqQCp z7U8Qm7(6qMZw^}i^#{!?;BPzF8yNGbsZ^lDzkIB3G3n7W9njr35F7CT&+H2$*xdYK z-qH-+9qWtzY&lvgzWM4CHbSuB@q`)k45c2(tlR9^I}%3hRLw5{L#tZ8?g7ME(%o(L+4Ex_P7*`f>{=Z2>YCFlFI^=+3H}w3$uGZ!^9VceGrlTB3QM)-8kn_0{a3Q zwpN<&urF;+sZmEdntiv=qhysp;B>(3IqboYK}9(!>>CcG)s$MJ;^@2I=TN%LfzVn= z@f>!!O0Uk$%>2j^m3&e%G!pQbld8iv=Hop3S}J$i9D$Dq>Nr)XbPPGtNM*2)$DA-b ze8WBt?b~bz0rzQNf>SvI?x|C!o}fbMGTVDyeSgReesdxZ-xtpzq}C4(5Bmg*;FB4q zviDsUu(`ojokg|*!zG!QCJ~nbrTQRFy4O{pLtbe5cpI!n3s(d^_1=1i&Ez(_jfggV zx3c*rksq6MiHWgHJKKQNLe^kPnF+`b$%z?#%R56qX-IKVEs^?Mc(L8p60n&YLM`E2 zIvnjjRjmoV^);b~TSApuQro)mNA2x_n#2>6TT`KE^pR6A-hoH`kbfNSDhBX=p7LBc zga{J6dzeM6Gyd9u*2ZDT$|hvkVA+cqgl7C;t^A!f{I9`-0vAwAKl0IgCA=!O@z<+= zs;UZqV<C+^xE}|1Q{6Y2yjJ6eK+yq9115KP% z=YJfxcl`^o@I{o6S09akZS#yBG2^1_ElK?!V^}$RM*klgymOEH|AwbnP1k<9Sxvvy z^vIi+f2I0f{4KY8?Kr;t=A|3<;r(xJ@T`9yDNn%+d62w7endUoyLpZOh7c0kg(2aD z@B!iXh0Eei;>X1o#8;(L@{D}D{C_DaYeJ(Y?AGMd$;`q_J4Kka@_9t zhBNBYT!-C{c!=jEZ_;<0?}z?R2BLuv2VMp*t+AdI`ZMYV+TL;QK_Gv33*|k4!nw5t-~L=XsP5mGc7fHG#!0htu+SK~&3~T-DEhp3K>vP)N+RBo)v)rz>y0&t9c6vQ^YJGimYjg9p z{ULqOtyamquw9=gC&?-N^OuIdg6RWO)JPhNSS#s3?gSt-KpIf<2$p6452oRG4o{rY z@0`VT9%=Jm!e#-nh&w65{y%I9_5bpJ6}$c)#oh_}o$lZG-^kwSsR8_l*)q}^Mz)Ug z48~)O{Vcf!^MjX@@SW2~xu%awBRg?k)}f8@YM4)U?=+sDMtMq~)pe9^#h(H+zwP|! z6l9Q%**N{ev731=AbLbd2^qndCTgY@yj)?0IJZ*={>jA!bA^X`5hm@Y0UAVvbOo)1 z)hi5fuh9sN(ip9wahkw;>UFf9Hoy^`q)l*_Hq#c`O4GEBw$lvWT+PuAx`l3q39SnO z{@t{P@KdX+=Bc%{m0O!;R&HG`XBTJZ)-6V#K5YtZeHjWiPMWKXYusP;^Nfm*;yIXvoyQBE=+^& z6xM;om8lui%-YJT-W^%bom&-7%`UF0v$w5IEzdM9&CbkENydeB_O|ueHIQc0;{5W0 zGB-6ndtzmUWo`k{uFnc{^NX|6+~WN7!kTn)e*M(B6XugED<>CcR~OHn<(5}W^UG(~ zr%tX-EeU!J?11{0admcGz@Ne`2uoA*ixO+}+>*MqvNqc^HN6hHJ!{r4(8$tResyM! zU!7kTSJ&p3*X6a@xwYA|r}(wAXQi{VQ)|+{Pe&x&VHO|8wE&o0i-00LQg z{nq()j6phwu}?2Z=T_Mih_~SWihS$T+A^L}Zap=%eikdGzH8;&`neOcP3su9T)vRs zy|S{@G{3CqX8?$^SkE9 zl7uKYG`3@0(+0mlYzGDl(&*8#LVHD_ZhUf1JAY`bz{RJ&$o>RwdOCKZA`&T(@dD|K z^*@6)`X+mu3N%^JCg++8TvD6S3NH>9gv8Nj>ZrMI$MlYoV`Gt6q~iRTRu~>0ixl$X z6hAj4y`j&0G{u z^lI#m(KtKe{*LJa-w;80pLSk5kGe0mh;a<-z}Vz)#nj07SZo}3^P^+9Rlx>TZn>!- zCJS<3<1-MZ`qW6cjP=Ga#j)P00(WArK&MfEL2PI$$VrWL($Y8m1%aFZ2)db{9A_Yt z{dy;rW-kkT zJT}#DG+}w0#|t%h3J+fy+O-d<3}<4!&tNOQV=Ph;i;Oo!nhMtBMULB1n3?KtD%g@3 zfTk7HzCCPQ$i#Zb3s!bDf-5VonhJJQ!wgKL+XY+Sq;`H%E7&k;O$A4C@Zi`* zVWxk)reK|o-PTlaCI=6U4UQUx6%mxX^>SD8BC+=!8oOw>WBsOj3-(5aq(I%?iz+)< zaVSt9R)UWYk6mP#i^=LekL6{}Hbi20Y%^bB+-Hvf_u1WXjAQ`)ADF}*N7@NDXso+gsr0nd&JhQVud68%5K=Pu%&cWnGk)1=yixN9mBrnSBT$#M6 zuya-NqKTcuNm8&j{stYXMn}S^Kto5^If9O`a}*t6=NLM|&Nb)=JIB!xc21xp>|BeE zuyY+c!p`+ctxL!Ah9t)CnAG~%T(Cu(!nsh-kg73RXlN`nfLxNm)B&K>4e2E|)e&R7 z>X$+QUz!R{SJr^~3dx27^|t7auD{is)G~TMTL43M{35x63*4|hNFri}(C=lUjRVgzk@TesUay`POHq&?Ru)*v_eriWpkhiE-hiw}Sd^&}-?0xGHHvHc8#YlB2W{A*L9^Bt9i9}+m&J+dh^liV7ilqOylOA>niO@7P5`!fkO;g z&Vw9(p^l>|w1sL=dOx+ysJEP*jjS%BE!9F%` zjIVUXIw~U9taoI*+{a!v8Jm;Z$HpIFGtatM9>Cp%t{a<88`! zg4a@yyO0LVK(f$|(=Ik^J20=>PROjydD@+1=vdf=Y2A~2hLG*Z3?f5WW+?d#)l2pw zqnGSsFul07pTV%qFoR*40}O^`Mi@*tGNTNJWezeJmN~>=SmrQ;$s==w!LZC2gJGF* z2E#H(8B8BC#~2LD+{9p5=4J-NG7}7@2btpxhGixh49iS07?wGaEaa|C^EA6CbfS1h z&vhX;tK$=jx8Y(gS?IU|eUe@1(5LhqgPzxO4D@ueu;mKq0=v*b7xf$iUD9(5bU9hr zdIfZaUFe{zdX9mf(Q^!RE%~eo|Fu%qjCvaj%4~tJ8NQ8)nkE7z`=t>mAoO>@lnu3d z^&$~_F?!O#GS8Yhsu(#N(Q{Jom$(;k+k{fN_e&&i + + +Copyright (C) 2018 by original authors @ fontello.com + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/_static/font/italia-icon-font.ttf b/en/_static/font/italia-icon-font.ttf new file mode 100644 index 0000000000000000000000000000000000000000..f290bd6e060305044fed76427a695f7cf364aa71 GIT binary patch literal 23472 zcmd_S33yxAc_w_$-2q(eJ4k{T00C|wNP+}Fi4+NulqiXmM3GuZ$)-qgktnXBDBDTA zB(@XVlK*DuUyoxu9mkW!P22{uV<%1B){~jEPX07AzvJ3T)40vj88n@yo=lqbQAK#( zb1$eZa<(V)%skJKJolb^&UerHZRh*GOF{`DcJgk*lhuLIL%rIC_&ZT@8R_8u(dKlw zw)LxPoY50@edQSD}d*k zQ%mc2y!qR2{S%(M@cb`}E7Mbd__?Rg6SBJ<&v!3P-LcAzseg>;&*E8Io?4py(Z7BX zeeHgg5WZ=3-uNOR$Law8KEmd1CM~3!aQ!=n4iekq z)cP_B5kTudtp3_OU7SBTMHG~>8j3nrOHo3Jv{}l3hkk&F=GA|#1~e(4+Kx^JMAK_ziF>*WG@ z2G0t9(PPnEOcuAl^%ioZXe~Cgoc_bcT}h52Pw~s)Z2{w!h>UU*TCxz8ScwhT;UG@p zB5vX#Ug9Hu5+FgWQU%_wB4JWZG!h|E5+gMvP7axV}vnU%0J4}keVwSMiq-Zh{b{*JaB!)>vtC4^Sq-Zk|aDo)= zMgn$_BB+}s;0Y-@jRcG#MVFBn^%vbn0v3^?$4I~@QuG=Lm_>>{BLT-q(QhPR8!3Vl zumrp##h{UZfutBR5^#|eD~trJB*jW20Y6Ex%1FReQVbgjI7^DvMgsPdqGlxEF)2oj z1dJxdsF8r%q!=?2u$&ZYj0Aiq#ki4x`J|XI5@>)FYmEeIAjLW(fi6g~-bkPjQfx31 zXoVCTjRdM8MNl_OpdV6fHWDa_6kCkMsK3~1Bv2PAri}zTBgHl&f#OK9-AJH4Qp^|$ zR7i^8wk&}jNik<6P$nsM7zs2=id&2XY9&Q*YnDK_q}XXBP%tTW840vZilAbaK-Hwk za2E;mO^Q860;Q8;-bkQ%a5y6|>Ss9j)@i=Tj{u8hV45A+;Kzl6Qf8XQl@;T-nI;TX63B@(j|KPrAwuUF5!pekT%|LWG`Lf#x7kBpyIA_8Ges$!>svA#N{+RywNa-nlWJ978 zVO8593oak$$5wz>4IU3=M z<@UztBS%WV$6cZyp%X_+>XFj)5qkWF@#^iP!2wC+=nmFNKkJ{4uucxMx$W`k?K>mX zZ=y1daQ|9*>InUD$#pB8*bu2!`Y4|CiJ4;D6() zMyV(Z0~Lb>^G&L3tm>vOjE@_Q?IDt4QY6z76eCJ4gid127Qt$nB!Yu-yueLjL(Ph6 zo&?S+60b};sYw=12Z=0-GOn^XX2Tf7q4F38fAtoLY(rCMm)Jy;ZBlQOl$*3*TDz|_ zX(iNp5bBnlqXHZ2uRO;5Z*aonBBDC5-!o(NYmMEv^~*Cqf!<1_}ctwpFh@3#r719+NdW?+tS%wwufdDjhrmS zqKVo_I-3zeziFS>C-Jy>q(&-cYw-qa#p^^Xk#slBq$oeBn9a(6VwV-I&H1vUohsc6 zcQ15zFZ6WIX(DJ;6xRfyy1B7Op*zf$jr}jbtflzWKRg|XL;_FKY*|;^BrxXs)#0D>qx4mm5(-S(H44lq$Q%YCR2lr zR%PR5#nwKSNsltQ44(I2b)M$|$L#<~yeEHmn%b;%z=5l3wW&*rx7r8 z#KNhT2{+|jAR~@WFnTZ(ep05QsO}ahos~)|6%`8?SQ7TsXM#YA_rQa>-!$6Un^{oLzEV zb2>OKIe&z`!E{VrHjiRuH4@8fSH!E|2fj!LkbrqQPY-%^0pyV-S<-3~wFyTKbgTJ& zeqS?{Yh}Oe&-rt;d~rwbnRBHdojcRJgXO4=aVTt!_yx(O00Pg`|Up{;(R>_^IjDD;8E~tf==9RGrp@%2P zuKW%Y=C6oEnJ`0mQVz-pq?tg+3@no*Mw+~p-yI53l88rvjG?L!)IE>Wrpf{d(x8Q@ zSBzuD$`sW}y}C5e$IVF14{pU~(Z&}(5e{w4F}nFgb&z{3SRKB+%suwT#vFYy6#fMF zy<8|94qg6fu)2d03vUjEH&VRm@=sTC47@!4*K{6k#>u89-({CM@Z|v_3gU`F1xZ+u zsl-VuJP!Wc3g*moHEN~11;Ob6leY+F!R&H59VRi*=*NmuXPb$(VYQtR6OFj||9H8J zJNt#w^QGrMOJ_=xrTZCL(lg zYYyF_ccyD)Oq3z)4BMKU!RwmpHSi{mFEV=Im{$5@eb3&y{MHBf$M_`Z&Ib)_EPtpY z%kd&)63-0~32asZ&WXGr@(YCLp!F@t*i=Cx!lXhuAl*USIJTu69WrCXYZFnes={eA z`OH31APQAXY!9?C(k`bOrin ze?lEn=_jT8OFxvT`eHc2CBj@Ku9Z)RPLJg4`h{hOW1s49D5}qF_F5#Huqa5r$`s$g zmHx$e%}np4u8nY_GMuPE;^?kua^Fy>;gleRDgz!*z~xgFyR0}(if5}Ls1A?A6=iyA znI_purWR+Pz2rFgA9;TpHHjTm5)N9u3nq>*i2^RYT z+7s;R!mrohc)o4_zV5F2I!eaJ4vp?RzJFrZK!0D?-tM7XrZrX9S--V55eWwaIBq%2 zGPGv9hw1i_Xaeja3uVj)l|f=?O{0lz6iQqsk%fxkgT^O;R8iKhKYN)f=e1F&9Y!Go zVTzt77C{LE$}rhiMSW6?f8}z&VzZj~7p!*MmxRWe?fKFt(W&Gwlsf#>EEy_poZIom#w(C z9V%M3+Djj_Tgz`MQKK!JazTJ01Z#gI?{@3QymOmkg8R^VSm5RnWbB9bH?20}1}ue|x-C$VTleY_^x7;6lAy+N>( zASi|jVw{2fzBCiWnV2q_qf9b`a-fvN8N0;n_%pEz*pbj7T>JfndQFkexq~9s6 zf?Z%e-a5^F8~m|~)aGjhN+5F~(k9px#)v)x{oEdjvm?4g7AqQQn;diE7iaVKTsH;t z)`^`>#YSbW_i@LCug%Y=s}6OZAGOP7S(bQ-7kSS73|rV|PA_h)s(6M{upLRXLBOyz zehRjQ3Rq=!k?wqFJsZKmRx8K#Gp@KQKvrVc4zfE>#;C}wphJl`N1BrHU5SB6RVYAe zxEh)9q*kySgW+I2SjO4}<3UWlLvdS6YZ^n&v9Y4&>gxM_)s#W8-*)y=jQhrxmbR+u zk-js>j@>%G);pqAwWTuKPJ~^W=JHHz-P75l)%0$=(A6EUZBGv84|e6-+w)xq^TWyZ z`gnfZ4(@wCe`9Lfk=v)1j`Zz1ygYf^!F;O0=gl-%MjA4?NNjt)CQ=p7c0O@@_}K2D zT)M6|2*hR$ziOkHw zs@Vb-L~t~*PB=Ct^wir*=yYpKbE+xX*ic_rdvj^+WUKniN$X9GgXtZ=KyqLHDSffj zznOlK93Smi$*sVKb&Wn^2exb>Tk=@}*usMVmk2N7Z-Iyue+v>81>~noa!NAo$%aU^ z-)oY<_iQ?%80?PmHJ$x2wH@0Ilz=YcFCS>*?TK1w^N?$LsX?TC)9$sEp^f+NSzFml zRZo-O8|{oGy?%FFpt2>Kn`oxS1*FlY(@Ql4bpZL>vpF5W zpc$6WF>=B$2*|IKM-TOZdh|k_S+T5_`$Flb>10hf=(d?MEgS;VlG?b^S$wV}f4_e3*WIbOE71JPJ48gN@= zp4*ymhL(?XWh2#!xkmF{qmTEK)8rfE`}AXmcz2CahkJlJ9WPQ9b{dZ8<|$^! zxu(XtS#xdSCO9)rF>}^Y;&ez3Cr+hy8&m`p0$wGmg)I5KoZCemPPYRbme}l)ZPH3r zsDYeHpnJhEHRkbgvJA}SIMbM!!c?$JpgdpBn|8xk#YQxCO%GO^-FmZ@RhY$yb@gM=V@MSCpLP*oR~ zB|N$%Kj#Tp?Pgb1quK8{K;@AGDW_HCd6AP9L6QEH+mVbMkQ3pw;8_ zB~4Y4prk2OT@%$tG%tI7=KI2!~&kbV#>8G`}^sUw15b(J4l zALuoRYA>sS8pBOqSDCN4wwzM_;AS;Xhd?cEkDC&A$P;qdjB}U7q;VSlIt@vr9zUoc zD!E0Rz}jo6kN)k;G*Bv*)=K|{hUm*19~$Afnfo7o^)%%keQji;bb{}`Qu|vp@Ykiw z_n+Xnk=IIdr(b*I-noquoE0!Ml+Q+Pcz1GSluVLkvPSMBPv$=oqOKq~q{}&h{@sGZ zjl(~|9?EQ97HYEbrilQx`6)AwPC^9PC953@F)Zu7truGa7& zd1AhpY9emVUBOl+0;Lxp#1a)x+u@KA?leO%XJM{+3j!D#e@XmR5&dlq`Owdc0?ELPbSb0i9D7Ha8AZ92PU z?>&3=+_QH}HeFj{u=INZN6SYL1QIp57X#D(c4(AUd0j4*tI z#~_L%oFgQE zYGT#fw5|YrfvO3Jjtx_FL}v%f3^S;*jm0@MjN?Y8eClj7j;U)1Z0L4uvtNH=U zWSkLYFsn^Qk^Uv##cRxrBQb{)dlNSFpVuL}gLRShOP28}PId=b#}YP9lo*$RPqw`+ z-P%|eZHcwixqUTGGY+S59P&T~hII8hV{TV%o3~{P$HbbhG%`01e{c z@%3QkmWFW9D!$H9{`GK8W@uNoqguQCf%bkalFLQ3?N7e``kSTSqT~HF^+9jc9xFXc zle9g4H07_U)_VHrKlZjZha-`2b9(#bJojF94$|>$9cunn-*Z=fiK4aE@p_`HZNSs-WW6Kv0o?BivIHkZ@&DK%|str zU0LChD=WqgLow{RXAt?LkSIL;Eo3l{g9d!16ee8#B(@+6W}ZU9sIwj=GwH-3jh7=V7x(%1ac@Bq5t>4)7EtLW6_9VC{BRVEyk9o7PV z1UFsWL1ekz4hQUkez)J@a=4h4iL>jcts8tNu(|L~6Lm88$Q9Q}d+B)Tcm;itzQ}$0 zTK7k;^eRnmyh<;X{)G0HbaY^Q@I2@bULnY26)`B*yxHqeEl`-K0E0Y?c&*Mj?*^iq zASI1Q?nRm`z4Xdo(9Vr_QFrMdOP@5O;46cVaPNA(^i1g@r<8u{0s62*tDsPU>x2zw-6@ekejz@3S1>E9C7 zFQtdB=D8nU&C`i!8A87sz}IEVdj%T~!$)I`_4x#|>);p+7R+tp9=xby;Jj90_uCAW z$vVT8g`r;eaP3g94(@91+F{Z|SBHH0&8v9~^r~KA*fUySbsfbC>>T-A{&X zMQU5>T5fI@(bbJ#&MZQiirT0qAg^TOFfHZUnWH_!_$~v3 zG-HQ{tRLqCon?7rzreDxVXaM$k2a0gI(-&SG+S!_Y2QAt0-J~1MP``N-|YJ5gUP0*K)sdYzxYp3ta-C3Vvb7a%V|?&o=!NO z5#GsIF#ouPH_Mg-|J1ZAd63~FbjlEH83E$T+u?5L2Sy;^2Kp@%^!nuOFu+_r9O)v4 z52fPyR4#?Td^}ZG+t>eOe_w4Km+W}giHD{Z#>N(=9y;-^j^Q1>wRLs1y*n5^7_mxU zLto6-Tm=aoN6c0e;;J(AtAhm}wDDUY5IIhog#*R}{xAz?kV%{dXEzCCf!KIEZ=1yd z+iZ5u!fT@Q@#88bUJJ+D2tNs?=y2K{6CNtd%3-i|@OHD=dW2Zr+BPIk{!1xm;KRaJia@j%t@`tVY9^-t#K zGq02)r4r@ZOTR<8OgrN7%J^OcPi`dJ^W8p(NxvH|HEsaDM@Ua`NrL8rKPZKClSM;mDXK`&NDxI>#?ETdnz01 z;tD1u>XTwz&M=uUZs^quZ7f2F8D29wJ7D~>mN}o;{5oN&2~*u7>GNNOz6z|r!dflA z(AKJ(cJw!>%VKsVI=Z!F!siWC^i(J566IyyYno8(qM|t0xAylQbek+Z=RhcmMOrU@Gh0p0e6C)lo2(LgY-xy#DFC7R{+RqH)aNOR)Vr9m# zcPhWTA{4I)r7BYOK@lpZmttx4)zo?Hm3=^!9eM3oP2KTMdE$RD)7B(UES1JNYc)?Xx4Y+Gwz}T1` zcbfkW@T!Llk*CQEwO-J$z(F$f37YO^ds5;UN;4Lr@}8G zqzaa95qO7?dJ}J+v{91^+A?uCazZ$bS*aj^HN%yHqmE>ic7N*k_U+xCC#3M1-+SRx z&;Q$xyzjkt-?_fF_vw9~9N3v3+CGF)^k~&~CXuQ+SOt5i-%kA=-OgvH)l^21jAZ9y zu=h1nh^ro23t5e&?4ivx$6QD~yxRx?!g&=3Q+P-vFSAQB+188$6HJL{7fY@iDd8}~ zgRhh3fTTtah8*CzABqBtrfX(cuiGMEn8X7#0!H=CsEYAdv^8jMF|OAx27~FKXMXso zM-;(TM9zHin6b*{yPN@A*kiLW$lBCh%z!r|aPrx!K&ny(LNw+~^KeVc@C3Uw^V)LQY!2JS zrU!P~!*Uo(iP;vm?|h)iY!BPb;pJ|yUMZ`@iQC5FoVrBw#K$aXc2 z!71`*1eY=_+guj6Vl^Ma!)F934Ue+@UU-h>d#&-btb9gs2{(m#K(K7wS{@~a3WPEA z6~@0)WFX()7>0wl$_bAE5#f2j>1O~23>KHjVs-?^#^H=1+yb~eVq78Q8Q$r>r?@|! z@YWay1Fwja^JdK0HX4^=#uhT)WSrTij7o4X5q75uI@7VGbvV^BJUN^yJ<+j6U&`ia zho7Eq8NT&EOUr>&f3oyAI-HQC7m_+0mf8AzGBtc+IOX-fpt9Ew+;X5L`MmK#i$QPy z1@x99d9sh(LYDHU^INkmR8;szD@UbDunsmm8S0#}WHqV0Y^I7NE6j+8a36|bJW)7o zF-Qx(VMbr@G!5_X-A>4nL;G(TzGe5o_Ips6^@bNZqoozH-4TC!hV9f!a&t+@bCC4I3B-trOoQRA9-p85EfqCcjIJ-83%F0ij zqLmq*q0^1sR%w!bff&^Hs%q5_3=wQ?RfEk97E`4^2K`pLls22-nw7uP*M=4&x$c}+oz0hXI&S?L;^KaS^G{zszqO-1 z!66taQt8L}T7WcVkx4L>!KG(-^C-M|Ku8KT8V62>oI~jrxNDt}fP|PN1l2G<1PkcH zN-|*ywvL=GL3Qb;vwNQ(D-T}P%|bQ&Y;7eu%NLW~+qOUa?$U2RkbZc*C)?rRB%7ty zxvw?=n{&XIYN+_V5)9?r!n+%qcSe%lnoy{xmitg=s`9-T?mIR#Zk}8HZ}a zcp{3M+L5BjFW;ZEYO0Kn@7*-Qwe&5v39W2(YGv5KnEMo|W4`DhVqO3$7e+asQ$wXR!Oj>4J zir9UE2tTJ2-$5WYM-eL<-B4CV8iVQ@LyQ@25j+2t%USw&bno+}Z-0^QEma^Y&!?UFazEN=k z2*(K{U|bwx(*$nF8Hi^x5uI;=1np25u7vBs+6sEraSVoXgc`CDx@$8z{;Q(X>bX!I zG$Qs`xZVYy#VK0tj?yKzmfwHo8SWm@vT~XQ>lyK_$5&KI2_P`URh_x{ZX zF#NYJz4ZeB=e&Y5q60c7tbK$E@Na|ZB3@5~D@D}pPXN{JPmC@Q6ykJRtxk^<_CBk_ z>TrA0is)|?5rz~2UF0ZY(cGDsHwVim|Ho#J=kon7v(-ZXL`f>4<>lpo1HLQ=Z*#de zYG!8s0Jfo5ui!1yee>Y+7s$u*fh-)VryvvGb9$Z^=si>xgn@Tcx!;IrZedCZR1>C` zuz;E+g;B2__Rp-YW-3YQE)y82t|aRQ+@`mE1#mE)%eR2*mR}WjkLRnG7JIi-a`&B! z7nUv@KDd3MccHs09B?#52W{h7KtKCs+K28j-8^iRy`h^bOwQ-l)kwcjXF`k-F#+b@)G>2e?oK&d zQDx$UfK!XQ!?9Yi#uaV~IKv*ZDUFCPpM)?f4ou$ZS8RdCNFS&2N}K%d`hAW2Tecy} zIo>WNJP~d1aJ;dqd8A3u>;W4>kzDTj^y9PdICW_6{+@=~+RDB8TiWZ=&3BwBy*V0* zB&zmyP41=1N{b7zbzxBrDh`v`!+TXvW5k!Lj)p75&UyvmmI7y!>gPFk;EEfEjv24WgbcQ@^_=-?ukSH`Ov<-`39UF zw&BB;%zOGz9^SjZyRjDd11CKA-oJq^VMRP(|J{7cx4-eZ z!taX-|JT3DRR^{sTzjjG!{V8hks5)xc4j!m^4m0Ml?R@t_9dX+&cT9;!~c^pS{s&qOK%kx6`kXBR8&6JQP%;z$*(AYNOA7Y0QS<=7$6MLezv$W^!} zEig1{G#rM;6AVHfuv$aoBowlSm?gxDaenld7^hc-*7Uz~pf(Kjsh>MguNk44D*fL+ z(lkc;@7`vlURX!5_y1=MHUEjOi&Iop3ioMT^7s3yVeu>=brjKg_`_ zKGqw@myF&v#CE#jI`e{Uf-%Q7mEd&F3*RWXH48wK_0JyRnKqa*UPDMO1BZ81k7ER@ z2k&M9ER1D?-7|q*{#YxWH4I2#%(|ACU>22(@#zNx*8^43erA91c@f=-;Xy_;(>A7& z%MyTfTMCmXkenITu^~j-SlE6#m*HkDcAJ1e4%z)utIcQKc%$?8yE;G8+Uitgz7=wk zw>z|oA~J&4UhQvfbp)!s0=UOZX;rpartSVcUc1TSO?Wg}#_@yF(kIc3)q)V<58D-= z(`sxK*us;Yj;?{`5{1c{aY*xhHE5SR6`c-B0Y^J$}30H{_9( zKWeS4wmVo~X#}%6AHU7%lY~z~7R7{M(B<{I-qqS#`ct|c$@6tsN51`Sr)-ifN;G(I z&2O^HHha~(N)Lq{HoIN6n!@I&qI%q|T@AjfDqq92KWssjj2IV_$k}ga?cw4now=_! z;OjQgO#CPD)qv1;j$w9g`=imxGHmj`^p=SKH9povNiPo)=sCGSur)u+LdDi zrD9doWR_Lg{l@oXKKS)3KKB=4$!;N`yg!v}fW=K$=Lk**bgnvdh+{TUeQS)+Rwnt& z(Z$9=i&=LN{faFI($Myd&u^prH|6T8#?ezfm%8Ui6Wc8CTXHbmv$FZ_OFgHqlx@8K zmF4!=x!rXYLB#+Pa`oxn+9zv!(>EzAJ@fI8FXt+jnOer=ANzKg*{ZgZgZTr@S_N-8 zvsSV15Dc|JnW5nz`uQg$sD=hIL3YyD(b^=;Zo3 zU=?6efIWe!wg_Ln$>f=Fd~?$BuRdvJ0e{=c-o%(kO{D@I{`qsg!K6pebU=6CKy1WA zJhLy1;BfQ%c}p{NckD0Dv*l>1_~xfiI0(Up#}j7EGn9HDvu?9v-$)p-Q#C&W46SPU zx)%^>oKWyrskCRA8Zq z`(UGEW;ve(tyj`ye9wMX+l9 zxN**-1oj0q9IZ6pVPD#uQlpM^H2Y4UN69LI!0CY5bJ&AF1{LL`ux~h!R#R$?imUHI zpF`;~2SRHh#dFx@D!n!{GxGySRPss5&`7{zPO1*yn2+=9YpL96a|AvXsN+0VcX4tb&J<7==QEnE@w)O+h4 zHj~@zHX_>e)5_+TM1CC7B__r)?d$+j3t59DWhNj$Bqvt%hHr*`)R5w$S|at?@M62G zC15i*gj&M4bvW96s#+7e@iU=ET0)gtQro)m2kq^Fn#7ZnTT`KE^wCo=-hoGbpML`1 zDhBX zm+-0B#$T=eiK;66iH$Eld9Ui?{>7QToQ^4eqZuWa6NB4%8aeI=>?#~4=5-qHUL4ZgWY{lDTZ z*3z{<-K?eGXnORm%fD26Fa3u5y>=d7eCyIp$MD{_Hh4C^50{ryTWDh7V%@^i{fk2DS1Y|Q~qyCO8J7R-}D9ZoO-wV6Psjv(B5r- zpZ#APyBv2qzUGX&G}mGGqaNaU*_-s;;rqV-6M<;pLxI}k4!nw5t-~L=XsP5 zmGc7fx0LfDdRQ#yC6wP@&YR&we4w1S;48OhnK?p$cN{SnUn=J*(P(oy&k-BlU(WL= zzqOnfkiV;(7m1I4q@0&f{#-e4CWqt>LNE(V*E9pS)1Ryj(8c_2HmYu?e zXtjS|vv|%U&EaVorL%xoL_S5Paa}_D>-t;sxHjR5l`bQ<2|t22PNKa<)U$qm zKJ+iDKaAGafQ<8cFB;~N!fbxgTLXA&S$}g%pTP{~W6b?5xecSk$4U5|(`UJ+&q^aZ z^&YOySHpU;y3=T98qg_yRo79v75@~V`O186Tpyi+46-pBx1YIoGtUJ?j|eFtBN)>} z&D4UAE36RbcIv=?a&f_2;h|oHN&9Jl1`#1$K`UYP3Pap$G(w{^Mr&xCCh(nl9j&Jg za6~6*6WpcEw1u|PG;O2pG=nc!bF_nQp<7`>>q3BkH|-(()at5vYHe-h_NJMY+n3AP z#o4)ai&3gmgJR^*t;#26PfaaP&nnYXi?ho!Q)|*R{x90v6mBS86sJ$kPA{mq-nIr} zV9i)JAM}RA>BW_^czb1WaccGKtPJW|nq6KOra^ZK8^Geq)Qo9nZDmy-j;!a-tqP}R z7gyEUJ65NbXPTB~XXd9Q#aU@? zaejJXO*%Qhe(Kx_^U0N!lZ&&fi|5XA%PXe&<+JNkC)cKy1ib}zLHo;iI=e35pTaE& zOH=cU66^HblDf3AHrq5cy$-rPYt|po$vx4&T{M8EW(svEDnDt3 z7FOTFAYU3D(=dqhQyTkfX%ZzGt247)mgTaO6_YTIR1|3A_;{>9hR0^d$D0a#Qrn>w zg!mK&B=!xD6~tI?L5lTa_~QjS*;EjcF^o%_xhS6K)mV+uIlH2M$8>>jh@iYrJFlHb z+ZS8JIHq-AY;w3_YGiyYHjdi-=oqRh*rdumHxWW`fc z!H#Ae`jTi^foTl8VC$RI&QEFu8y2mp;7AT09J?sY^pDpRth2E@nhMV3;DNEhQKPUT zf^xTB?n+)H_P#@77wvZJ-&AkG-pG&?sM~u{WfvK2IZ}K8#cOTZ7 z-TldnJi7;y7X@|?CNGNY9!g%6*u5foQD*nb>f^%g0=D27)Uh+5=H|W z2Ey(U420dI7zn$^Fc5aH!9dtOj)Aay0s~?9S`38U>o5>@uTN@SI-WNqF@MLT*2mU@ zZQ2y>g?ffmjmbhoW1#`$k_4s>0Htn9FR`hP7~@qx7XtXwRA{=g2h>+cHWaA0MPKFA zwX1S{RdZ6y=;Lew4BhdwR zq?0LsS5u+w7l8u9rUBlLtsuU*meK|oWnu|;pFckk8vrL51J4G}1G%1|r1p#dWN-InQT@!H33s8G}>6 zD$yT$jO_$zVHdBb6A(3RG&nieH#rk4@O@J=;4xg^R0Z;r;~>l%-UA*P$wH=av*x-+dy<80<9Xl^LzeR($DipK+mb3YqW`?UTnqs>SC=7I z3{;TP9zJtE6Y619txc(p3!q%$j$2bgyL;@m`fHqu0Wq;4?6TI zJ;$Ku^&A5|oh)p*0=mE+bkIdT$3U0#90OfW7PejiU11M8=&GJ$pl9?P16@l#XTtwl zDQiZ(jRj@4z}F1l!9-0Hfs+052ow%p6sWoQ>!?srL)q zOQ<%XRPOx($s2i|^k1x@4<3Nl_~6(@ey0Cof<1jfc{hwG`3I+=Ist^a4xdvwsy2L{ QzV+UM@c%$i^b_(w0enpTDF6Tf literal 0 HcmV?d00001 diff --git a/en/_static/font/italia-icon-font.woff b/en/_static/font/italia-icon-font.woff new file mode 100644 index 0000000000000000000000000000000000000000..101f487bc8f60c2e787058058785bbec8f2a43cf GIT binary patch literal 13888 zcmY*=V~{3I6YVp$xntY5ZQHiZ9ox2T@7O!mj&0kXx$}Pa{<#%#qB~FJsm_i@Ra9iU z%ZrHtfB-*@O#p!K-%-2%|JwhZ|Nl)~Syc!C0MhtjxqqNS5Jl=GuT0PM!zKUN!aq>s zBamz~wl#G4;Z}a&3jlyFv0V-VjNM!a005Bxv?xCy0AKzFHFGex{o!l?0I+xf0LCFQ zAzstm(D_FT`SIfe`Tu}uZsTbN06>8P02DuZK?9N$ATA42LlXdiQRl~p`3G!>tZ{4> zKjaVhGZp~<2P6>eAkh}KE*?Kz{f|xYgO{76?`s=-x*wllOf{o#J}|J@%5?cMu8yo0^73jn|Z`@^*W0Km~18Hq3sPNqLv)}bGr z*AGGu1*y9{vW*Q)3=DRR7!2x-4V)bBp$vB>Bx%NsmV^ zH~hAQCol^N2L_OFgGm7Xr}Z1<2na|C2&jm(L;wL1MhG_Z=`$D|1w}PAFg5Fg2L7j` zjESSi(B)tP|CTq5IE*vN07o$inFs=a1BX@k8RK$ZU2Q-CHDs5c1xZxVW~Dx$oC3WX z)fFpt4(RpZ9yie5!>x6Yp*k-317}pL9cWyD@j)1>(VnTdf^r{ zzkgn7hk7Y@*4M!Z*u=HXTr-u@STmE-YO|5j@T}kTY>$-%zrBS%b4{^In+8-d>3mA5 zsc^Spc^&3iRjAjzfu|MyS`e0zT&1a%ma=rUs90v3AsPw2QfgorT5K z*6c=5LA$uHvwY}LF5FZ%W+wKpOl<7TEX>R-tW0lKmS;1ItIhNe;4t&to}ZWCzh@`_ zf{Zwd^T7`j420|kvi-x=s9Czti=pCrN@fSskiyVf84e9u){BwZ^#6tuY&0g&&8|tw zk3!`>?YWKE-qF7|S#v&N_tUz@rYDJSK6c1VDsn%bTAW-rMb=7OfjLh|&Y~Y)SR#wL z;DI^~m7P%Zq2Tr=G>shF22(_=NnLBh4HFR|QfR5I7eRc-)66vSIZ+gwXf0Nk9jE0z zrPJOQ>{i|O!{Qom;4UaOV|KCNZ6sC2R4tS!+h_@7PfiwxCLwLK1HNW;|7HiN#?E~s%P>d^6^0=6zn*}RQ%m|8Peh4M|ky0QMOvW zbnE;_54~rZJ12jGzP)1WfdKw!?8VN73#opvwzlC$bJ8V+3XC++C&^ zNE$Z*rn}mv|7buAdeeG&ksjxf7<7j*We$T#QfFDjJQ@{ z=1(mT=x;684v9oh-%fw|$?OR(0W&4gvJEB&LD+x7|C?A&#R*vkU%9%xr!Mzh61gb` zddHr{lV7BSk_kyy4ObH|s4|py)MsW+O-Jt8 zj+k#ErsH+Kl!lzg@yT-K&0MY+b^>xV^OP&oOuas58My<=InvBsK82LlE-RwpU$6`~ z6z9S<_7sH4blL8Yk776ghL2|mE&&nN&XZ#vE|^6fI#cOyny<%m7s^?WE|E5x zsn0l_5+`=}vV=x!kHxLt*KlT!AN$04tF#mq!VmVnxTHebZ8SBQRCR+LnrlN|$yVXv zBAYg&%G>d!ucD#>^MEZ8qCqj{)2?%R!1@VT8U4MtT^!@b zJGI7`#BD*8+ptoUmotU;Rm0AX6d$|yFHktGGwnLa@x1isE7$vnb!h6JY~lYYkzp)6 z8iv3XP7IeQoSCvnUjKo>M8}-HR)~!Gu6kSX$)#2enR6uBmRo3>J2rs*Kv?k?e*~F* zHa>BJqnmloM9H&z*tN;1EyOr4J7H(Au4&io0NOQdw2(BvnBdS8Bp{Z&B@nyJZU&<0v|+s#IRyEjnxP5jCsKn){p0m>C>O> z`kOvukl?2`oD(*efgIp5jsvdG7}mc$X?O$Yd;c9 zDyW(dqAahmF}SCoY&!ZCixK+SEjanrPf+?*e)<&uhC&bfXdaaQ79}Y2sXCuS_{gq@ zd3FuX_=xaB%JgDRn1c64`=mibBXy*00^uZApQ^3ZwSal4o{Rq3T0HvNFvI}WShuVccYS? z4Y2*dSc3|M`A`H%2@)JdAmTSDy63 z(%Lw1n)qGn`4C-1H<5E-6nCth8=|H|&L%^GNw_ew;d9XPC%7nC-rB;`@XMF|XZa3U z00=kDMn|f5Ks$&iDRYom;>)}ISw2#kn$>TpsRHB;1Mr4=*@M}AvFx&Zr1~WiMWX7y z29_0St9V0EiKEiiknN0agk8YCZVi>zU=4UOn5or$f#Zclb%2>j9^%>)4P*{WJSZG; z0V;$i>ZgHJXW;{p)rtj2NNlGkaT6-;eF&Nr!qYHbdChQp7Zv1usX0kAkK%d zJc8D@=L*t1{L#{!lhxskG+$`4Y(`+8n(|0dgH>&H@CbFWu-V~`1VuRRp{7N;xWq(T zq@Ar#yze$NBL`on5du7T9>8hDI(GWg=q##35&sI1#}b-pjx0msyXgNdptjqNc(ru+ zEqk@J^-&U$Gd65h6WRKdQ>UK%Z5!#_Z^*T=YZOLn%SCJ1Gos`V;}GZj>MXj4RT1eX zKz3KNpD~sl-p7+bQ&nCP*)q`BlvRmQP5aakq$~WB>YMH%7!9dcdPhKPCfbKnb|KbC zLrWy7R1)#UH$T$^d5O2p%GP0Q;^B~QU+7=hrbOpz%3LABgA5P$DcV%tt`YPsh>y7$ zoFeg>R3g>b3JdaRD*2XJVw8C_e7=0}1e+%9#W^+f=s~GRg-P}i%Wc^&uh)6mx}J#= zVMhL1)QQp!_5NjIzo+(=#5tF}gDjhcz(~%9-vJkSqe;<)6M3=YN{iKdDP~S{TmWl&9UCj7iBA9`F~pM|Nf>pi z9<6C-NMKAgI8&LVPDk@}1Ixt_s8!2{|2tPUNtA;aAKAY)|FK4Y|Dwd2BeS4ZphS1D zu7#pIrsJH%Z}*oz%Qfb%7jIelc7hzuEN4QzzF=1b9wW@Lgbbo@u5VXzdI#myh|``) z-nJ*K-SnQf--2ayLrD2O&q;apVxh&G@D!`d(c$K=wj3;cE@rbo;>_?~j-!*?Iap$i zNT4=7C~*S87&tNh)K$p=O9gDM!zf{ehT|J3kt;7B1T(hqn3c_XmsV-i8jQ##gOiKb z>@_BV@D3PXs-*e9TCpW#szHnOIO|QD^nO*Coy%8%?+jG)(dHv(F&f^ZbZkx#+IKKTPzjQu;h~K$y z-no#}0zlP_>>eU;*&>5J7E>uenQg6|XnGg9N{!pKQU8{OEr86dm8;}2{EHaHIq76A zv4cdP&#G0>cN;q`Fxf)%H=RZ*9T7}^lt?JX^wFY_^1XnIkZw7hxxdpfN055`;@30x z_au3%nabcJpPB1@TV@i*n6ipQo0$c|X&Phe7WvqW_W zLR{jts!)Q2#eG@71w9(N7`$k!Q*`s|d<-;c-SfAoc-Vx5IPs!jn}7g)9C7R+o5nEM37!1Gz}F!!!2z&zTVA@|KWVS`Q-XI( z{Ed07d0()6W_2syDE=7!%U@-}L6b>Ov`=Xc_pa?b%Uiob@nD92p z!hewvyb>XD_c2qA)sTey&b86FH#vqoDcJK)(25sSvSD8;vv~}T@juE?`mR9;6sSZIpT`ii8|wpBE!g~hI6J1 z#_Ebil2JEF+*jy{k!AYuh6@XG^_lBGEOechp1BmUEn}&SbZk^9;Ge6h`L{!-RfhP^ z4+h!RVA9g!rDyRq+Iv2~tW5WJ4=Sf9$=AB(*YGFBiU$Hgw(&FqYC|1I4j zlO)eHV;>ulNyUhv($?BOy3yoG?J2gvCc<7NacpQC;BM)qr^M22ut%0eat&K&$p99UW-pqlW^FNh%k z5sE-0AFLg$;pk>@8TvtzX>KdkO45adJJ8P`aX}K1BoxaiD07>Kb*QA+I0I#Y3Byv1 zP!tUwR1Yj%*q+m|+20`l`y^snZey08L1z?S!^iGcpa;MXA^*E)CFr_A8TX}g@Zem) z^`iwv{2iR~m6jZyPN6a+NS_n(z@Nvatnr2WNn1ddgDs&8b|0olrUh(Iy1syccESY` zaohnuPH+QHp7XZ7kJWW2Fn(dTSLDzGGw9AOILD8bCVnoA_xSs6p~B~-uh08T|c0oDsZb&>2fPYk$NrHcJ6!Ehe-I#I_k?|C5T)SY@I+1WX&M zicP)_R%-|c$d)ff4rw7n_EIixWUv5WMMw+0D9P)|mE~uS7s8S=s$@$>Xv7G!$@>cZ zxM*dXX12{#l&&=QP2@`<*)zAS3n^~yp3CR+(ow=()YRZWsE*Y^xEC|r_1Eb;Hy}Y{ z;$-%q>{IK~HMjx$jd7YLSqbbBdHDPGb4AmZk zkD4d+$wjRso>+-dD=%Kl2Qq?}yfbD==~W`!qxj}iv~jC}iyCjfEZTeq4qT~KJ1e0n z7x}b}jBU65Oh!z%1|t`(zY#&kqjrx_emnPUfc!hHJt5*%D*?SXnWYpJ^Ljpc8Ts^z z)Spge6S3by3G% zncJ6(1B7)WhbbOJL7EB&*}I0}|9B4eh#Ky8db)WpWjjnsq&|a@bb17cGGst~=mH2o zOM(r(ver8BacM@13OA6M>F-BIW@S&XPu^b!S?{lOhw!#JmUw3jhGl=(;CPI?nntWq zv}19Cm08G!#b536a*34K!Rdg4!FC0rVrVse3>^>SZ5{)`MX|8g)s$-#NCX6`l@BAL z!zDom7P*y({*q4Y$Qp)K?oA^*)lkQ1PbjexFk(&GrSPmB@JDb>f zPHG{)VWJ#5oBvdvi^IKNUM1HZDFg-00iatr;P~ zwo#cp)$YD zdgsG68WjwQQ^ri-)!*C~6r=h?&yTF)b5^{E#>!b5Y{GaVEB>bY#n!w1Z$J;7TEu`<^uRN8#XKmmp@6;6lFDiJ2PoNRXKMX!Hw79M^>{p(4=R*}YXeD7@MJ%TsfBj+pbhdm@JoX; zZ-5bJqLIZkb10**qvX}IBS^>`!l#^rUa`HICFuaT;oUj{la9b-S5J7+iQ>W&Eu;zjwZ*W2W`16kIy$a>oA0=IvkBvc3!`!QHN`t zZym<%%!&XVv41jD$ahHkC^;D%60GU24BPOn)j^8Kd#{l2`y3wLw@Qwf-0?ZYfvixI zLB;QT5jYAMIE3y3UC4{5V7L~y*hM}sRvI+K_T3C81YRWPI&F9)s~ajyUw030&7X%C zsHZrZ-M*|?*mU9`4WkwXObhLgz=%4N=}WoXcpb)Zre<_zWf$gq-M1ds6ta8mTpwwh zS%bIE*MEfBWj7_$H7)id!M&T5+Yv~R@qc5r_3$-vF{xBvV77B!pdWhd75l-Tv8u1vy}|%hd@f||_NX>|)Eg)(W zo{0(8(U6_0u#VT(fQHRQ5DC~l)VxAk>e(p{5(m5XYC4x1_~@ymv&N0hn;UsHI&+3y)m3$-x0fo<$}xCPkV9Z!RsA&9N)B zyw$=9#OzXnQR*cfBSaY9(|a@MuPZ(!6fB0{F4zzk=0HYN(60<&yklK&O7-n^yvQo; zX^>`mkZzxyAp9Ir;MrR7sRuO;2 z-1fd1*XGe8Mu>G^akEtKt}c0po769O5!BvICY6?q+D#pvLbNuhj5;=Xq;ILs1PcY< z@UY{nL^R%2q;OtEKprzU}l$Q96+ z{2QSILW4=7m#h+2D*MJ^17L}0*@5Xa%oPt(2};%4p)@N)bTeEy4xZatDGAAa^f1ib zim|vMT;xYqb-g$3+2e>xz zR=2Py*TgS~WnX@Mz`hP98CtRYsB$_ z$U-kA$0Mlr%>HHnu2zq>y({abujGAdx%Q;|g^Q;M8}7HgBMMg-pZ4dZpiQ~5#$A$Q zUDh9woBajW19g&N`Wmo?V(P>mtbt6r^UN+YqYMzV7AwV_LD2vNVZ|8D;ulrZt>XX< z@nscX(wlpBicoNEW>jEK_otd23!Cb?O`newIO@gS{`P|QfF2=vb8&C&($1FmvwDg7 ztT0gq*IO9R-hOj}0SYq$gOfh=DJxKXgSucXhAH*Pg(wQeZt1bU%(CM$w zu2iJJ76bzOMOuUK?i>*Io$Y@SF5uUH)4~*DBMgPwRan)>`pYuMTg=>IdD&W-=cO9E zue)}8&ebt6)a!b$L*1XIFR-SXTg}AW36E!?ZO`e?-=7TYXDJs#xfBtocI#yLOal|T z(P4=QKOE`*BA$% z#1$sbpGpMV4WyN0D2))$+n%;A$yAbNgbxwlYBaY~8gyS#45_johJ=1jzU-4m<}$;l zz_&KS%Y02Aftk%5g$Quq7(C53qmGFct&UdI;3wp0UlX<^W3g-V58yW-%+q^9bf*pg zz1O3`YrhZ&++1hgD6qUGDVIsjtUIp%Ew=bZCo3^JZER9?E(f_RhtDz~qs1pok0uW6 z_j0oC+NT*r6;jj{4brTtviNf;fZLy3H$^{d8@PN8eIP3xelFCpo8wttJ!FMAQkMc9 z6{g42tU)oCwRqb}bv+P-&7BHQv+e%$aI&&;a@w>aeSLFh6*NwGJ+>J@jm@3tC}s3r zFX*#f;=9uek-;=eF%(#|m_RpKU-Yw|#6SisEtG?gPDdmB%pWW&50)pVaAwNfRJOhN`1nPKp6 zbq&A531iJ){-+KT`wn-GRN1UAfq4m*sAUFX20u$p7w5wAyi0uSoM%b8P!Ej+=Ue;s zhOXIMx!{2sKOf=}mV=_mG3Y%B>B<_9kDiR(3SGXjeZ=qEkyNr$w~w`d$$jh)wD#tu z+1L?Yr0QH*`c8_7BFG$SNqjD?{8&i5fs^g2t_bBa4b&VfxfCXE&)XA=Cpy(}@3WUl zhXq&ri^($&9uLN><6|y8&F7bSerHW-m(pO0@Q0PSKxa35w*-HUQ4vQ#^`#LyX_ROu zWLQF!XbW_dYiUOVqE1H`w9{NJp14d%vbVPY?al0g?;Rb|Ati(KczT5!jV>OpMmEJJ z{t>7M^75`nPC3f+7^P*64$Pe00q=M2@-=J}IpUeXn(xvY1;ZG%9tP`aU+~e!pt1$z zvtSSBi=Ft~E9yx7a#7;r!?A4h4w8u^+s?JDxXpd(%=?I&eI^Xnz?)D+I5)UKCJ_nh zEHsn^+QCDFh=|2Y|%_^U5xZW~}rR zQ4P+5@&=G|K$>ypn6%=uI4mWaEKGp~z2-Yw9mV%M=Bsk-&rVk4CrCkXJ`dWxR))M1 zpiaZiD@(NfJGeC$-MsP8Eqz9ZoE1&s{R=%nDYW^a3~U%z5$KbJH%kxN$bCY?3<arm|{KkV(=S)sGp&rX$q|%m{5_Val({3BK zdU7*#o+rm;ru~ZBW-`WWMe0KA&vM)C{N10wHZ+#}FtK!wUSTxD;2{^vn%Xn4&7Azs z1BLLn{V%_+F6MEZPig+~|L#&%K$9)9p3{0PweoMrb|#uHK%Qg|I?FFY>B~V`R*^IW z{T0FDJgvjc*kkPF;$=}^hml!jw+r0DmoQqPKrnC%d#0KPMs*iiABrI?2=+oIb6rU)vdz(&OqLqZN&ymtM_U^ zU%^weF>|HoV=E}hr=x;57CnaFgy!pGg3tY!p+2jir#Yo`wX zBq*cUi|2Z>!dMXZ{J7kEzOsFZ)vd^R0><=c@#1DS_I=y*`>6Z%eI_>9n>Tn_=a(-R z3WHGY?+k1Ew?9)xJg6BK*BxZJk8Qz1#J}$P19a{?XSRJkEG_A>sEt$aQVyB z3bHSK<&aer`Bh>?vi9i&9p#JLZSf03vu3+5R?qklaWT0xy>Yz;CW?V_9X3dBL^LXQ zbsI%^hg66*OfvZDw3F5jpV)!rKSFHl52VBsUYBPj(}L1$x?5xN)71xM&m_hUPbA@3 zD`Kv**3GBDE4v|W7)$qw7ml^Tf`$!_XVKz*`JvhT^ZLBtQ@RPR^*$XTcACQFb5P;T z23=;QRE!so>&!T2n|Qgt-733G>;3(_Cc82aXPlFP`a&E{{=U#QV(!f8Y`5r>;vrTpKdVeywDDaEe33+lehdswg z!v_Lg!|g*?1G6f};;K{*>JQlheF22kk_c7zbc26n$9Vd2$|f>}!ic0BU}Kuy2lOPq z4|-Y8D>+M}Qf%1{Z!=)-vTe)9@A6~dBX)7_XJM)GucnX+&v9D)pKS~S+eW&bGnaRA zI#qC{zl^W3mlK4GaBc_gbil7j7A4z+viE#2vh5WX+9h`x?0zv{_U7FI6&d}ljtdTf zsf+_3IQ%9hvNq_$(t44V-+0n5L}ReadoeEH58;H;o=e1;U44O(i=3OtEdt^`oZ)nM@t9OvaH>LfX%Z0tTNaM`PGc|28IVf!2x%V-p~c< zJ{lejSdfMiBhAkB6Z`?G#L^Nfh{q}<2!a0mn9VvV(+8?M{Wce8JvrIuZ!7ZC)cky& zo#%OYc;3!0^OMzkcb{K86ZZ$}77=7E1{b#Oz1z||J3$63fcJl$Xwc|;yQ9|kJGB2k zD#7?ZtNOldr~i7*<8j_SmH*sL%KI1%^Z$PKd!BpVe$Mr_?|rJ#HC+tfe;fm@H4gpnxhrtS=gdX}Lo#_tx=8 z8O_i5Q=6IexXed!qU8N({GKnhRrvC=Dgy)RI37w5DR%}f4Jc8F0#0pO;1~psQ6A#f zr%c$VYx^rjL;k|IU6gUQL=EE4z;RPe)yuX3ve8sE#Y6 zX_))_L2Z<&^~=dXUK9Qg&z``!{Kgk=>bkAmufUfP-YLblu-24g4pILX+m5j&d=Twq zlOVym?Q36i`MA$A4+x)_IxxvVtMTdk0N0Ksx6#+E)5}ph zJbSMevbI{qKGgPxaG6!?uz1i@R%XpU?|psUjnBuAf3)_T;hQ$7^D^{$f3t9YL@4iQ z$c3Qei)Vn2`9_B*uDh=KWfj!xGdn;JbTHR+&}ms8cM+ z>~gGUz^=N9%nZcz;P9%e>230MzCBWjwoyW9{@juMy+xw@)1q8+JDq>hXdq-#8G4mU zF^~lK%CFL7A%O<~)8xtd)~`23?^qI}(+zVXc8u;#AXz&ESMjZ-bIQ!ff5={+)Wmk}C71 zIB6C100F{(OafFG+pO_YH)axl8-4c;J>OJM+I>!G^OaE$IS(#j;B`vhCia@KhHQJu z%$a-zAbv5BHY_(OS3{7I_bz^=tTsi4e$gLaOdlLK=vAd*2R ztHcXh?ECwXKk60CnIV3nzYi1{3=nz@|6ktz|LO*Qa{9qY^gq5IzuE6$!1E!Y>p=jm zND!m{_51br^~uQc?0@4IF5u=jc8|Wye(P%tYkz-(b=s4GfB*<;`PqI_&;bAwKs2BW za0Y}5>;*yqG7X9a$^t3_Y6KbznhW{?rUO5Q^}ED1qpMIE_SvOn|J0l8y>M9Yv!-_dq|uD8(egOvGIJ#qrAzD;Kv9 z4-c;pA07XRz=7buYK#ABO85YW0GR&*0RRKk0A>K^A6gXVr&i*>{P>WBDXBpL)DZc# z%9X(I!1K;Tbjvr8z(2^59Z11+9sfkJ=1rtBDU&Mxg;?heq|KV&KyAF!C zZSy{FWVE9I#9so!7M-UXj1a=2)pYvtYH`&owmEAP@Nus50~T)S9x+B-vv;Q)K}KG7 zp!IC?=1}!xdBc|-b@~I`um4DW&N;?>oOwWyZ*}hLp5?`!V|s4KVsq3qgM0O`P{~!Z zK+vALdt)%^MV1yf5~LUyqS!jMCq_)$B$uusJj$#Rs0wO_a9Lx#F+^fm8n7Ksd7x(K zoXU9lxihbBhVAin9~=a+<_TSDb)bI%eu2aL2L}hG<&)2!C<~mVXT@5=9pS#q3>~VDZrb4?ZnpS!t z<BT>GF$w=JX` zKg=lVATi!Eu^g62Z{H764+D=5NRUYkno9a!M`S z?Zfo!VfXAq`0ZiD-f(9?TOSW_ZmF|gPf;!`1P=powO9&!_I1-PEkF}jBnu@~giMs2 zj7DG@shKyDw(E-ZI@^e4Eb=o!n<_QMEmpVG=R%L^ijx&5UP^Mp=4&oAtu^3|P>LPt3s8m zNiIWy!wTos?W}8t7m9rSpEBgQjn9$xuEkYLrDd?_N)@8}s5i6Agg3X3U~AO1&P51w zL*+&r(ThjLA=Gn$zB1b0)-WaI7lV5W(;=oYU6BWE8rA&G0JL;%qZX!AVlVSxr|AE_ zCF7f|eg`57BVuA>{R8m7IXJL5uw!7@zcg~#7#Wx>0x+}M(=j;-X!yVxqNXe{=7I8A z$m6H3nxp!G2F%PHR?7!gkT4ti3y6(~og*j2SP|_p#6duaqlCqsBtRu3Nf2$042=%v Y*7{$1T|uO;#mK-h0I+Vv4*(^b literal 0 HcmV?d00001 diff --git a/en/_static/font/italia-icon-font.woff2 b/en/_static/font/italia-icon-font.woff2 new file mode 100644 index 0000000000000000000000000000000000000000..4598d5a9919533a1c6aba2b07bddaec3786da1df GIT binary patch literal 11952 zcmV;hE>F>SPew8T0RR9104}fq4*&oF09&vC04`Sm0RR9100000000000000000000 z0000SR0dW6iBa%zykd<= zBrm<)dH?3dn(f=mkiseyGTGrysUDoE=Tim#<%KqHokKql1e z0>-}od@f(l#Rt+8446NmQ)d5;=hr3IamIy-0;noZ8CKnPv%%G(Kk3%@CPdMQqfrvV zLNFiJjQ!@EduLvBruEnEtmv=4@&@>A_Ky%Af;zAOK@e*aA~8WhN>~sjScPIz;x-q$ zC}ZWKQqSQ+SM9AD*Y18S)r&F!rgCb#3GcQnFtluQ2|!Q+kb6Jr=3W9ra%gj)9I^vN z6dXMPSS?$69}wd4Jy=B@QlJIy4hg=t-|hV$gNP0mgV{zlnF`&3(xngT(e_G3nea8M zJOk-MWYnjGZI*(Psi;%b*Hxnn@2C50h?E>q>AtWCh|x~=%gwmh`>tR*Sp177XN?rq;DYw=19hz?`39`mkO&Uu@s zD5%uLLeRxU{WTGw=fmcR)wT6~!Pf_Ow}?pjLj$(c$Mwb80dO3mo%JE+y|HZhix*9( z?yG)0te*I_5Ky0)75P$apN@~o61jw#>)QO1W!-fy45w1S^m9hyyE*;^rHbiQ=9ahN zf9RA!7&4jDDIXh4$V|?~>|3UyBiB_4lj%9eh5s{Nl2vL&qty|JBr=6cqcfQD3W`d~ zDl9gK%j2sGglZyn8ycEoEo~iLJ$(a1BV!X&GY~ELv;&~}H$4Ig%L@dgz9|Bg$^?~4 zl1e2-rIMyn$xx|esZ?@QDw9+yGcTtPnSD6}$Q0C>f#@h*BX+gD4%M z42UuzDi2Wwh$=!<38KmnRe>lAqHKtAAj*X(52AdCszOu%Q6WUtAS!~WIz%-gDu$?* zmoo#h{c>hOcF-Bsg{U4x^&x5iQA3CtLDU$cCJ;4+s2N1fA!-3p7^0R0t;&k2a>=S| z!wrbh00ex;QIg*NL+|}9{`o2L@ioDJzEpQ9!dCuA@es<+?6h$X_y@FMk08v!gFq#| z^bpXw_-7Z5KJ|}7i=(sA{^#h-HQiNlwi_KdHDXw&hyO|S5Wy|yJbs;xIU;s!Vl48H z5C^_56Onw2Ie`^8CL^s+`o)~4p9bV98SoY_Qt~7q5`B>*(y z)$6=k8U)QyhJfdJMrX*?!N#ag-n+qTT(x5g+lzU(Df=l}%5m^Pyus#(vP{p*Lji`X zJ(T1k=)fwY48&m|#j}4ZsY;jma!%Ppd1zf2i=Jrcs`^Jt#hmlr;MpPQe3W|d=l>F`n)6$d2&<%A~b6#I$bdUhy@s~6n| zRa)=JoU5NTq}HDlqy~(VSSxZf-itr^FnehB64C4`gv~fl`My9hsZp1?f z=5r&#a-QWfOS8wUU0UM%i%F1?jk`@4ad!;cR%h@Yvm9l5%psXW7s|@IB?2b~wUNdF z57e&y+J#Lyc?R`2HJhO#&|vG&Ji{~>Rs-A|1C*enI8%{2+*7A1xu zZ_6z<@Ab5rX{9*_ZMIXmc$+AnVx&Ykkq;^ucqu)`J0%@2Ey2qLq+@(DCR{-=_-A z00E5vngBGT5-kg$1wbo+*{Dp*0hkM59)S61rd9y35Wpe;i&3do0yl2^M<5*lajr^7SJFv$1kwYX zu7TNufo ziaA=YcUXbrjP(iuAS6eUCpeM zxTF1TGj5vFq-CAlYmcq!fhG+>BsEVuacs=Vp#ezf)rlmg!}Y-zMp=cJ^tjDF0?n2TGI#ZLJoDU}GrO0a^)jm9C_-$U1x% z1tDo?-WA)pBP}3Kw8=jdiFYGboN5qQMJO@=f`U_h=tr@~n?t54x?UOvsWnogX)W7_ zgVIP|_34ZrvJru_0IKtAwq7BRu=QylpjSalu4Jf|1y{_203k=o10WPIX&VG?MfDg! zGS?}DOj<(whx=z+PjxHp4!c2I7UD7tLddvEztXe)#55AkklgZ|MJ;L=rLK!u`bji70wEbuJmEfOdsT}^byubXIw&3lDnD9cJ2u}F6(FznKll$c)+E@ z6Q(oY`CKKEIKh;2FqsEsc`PPBlA(>^dt76IL!2y%xT9qjnT?1AB)tQt%Hv*X1fjTb zDeVusxgzT5BHJE#L1z&_(dq6X?#5zR3f)nba!JPDpH6y9+%IeMN@WYpY`>8jH=h1kbp&_z^aFZf_gG+UwK+TIvOE9uxX(;ZCk=^(2u@ z$^)U+pLmG1CD^t#R2RrTLel7i+^Gd=YP~bIzY}~i=4K!nP#sj%5v8asWExBE1gVf@ z?f4sG8@!=ww7KBX!dt)t-wDQo(LV2w%m_{RGlSc(4z3U8yoxm7m3~#Wj6Ku4TA0?p z^g*KZj(~$qEnP~5CpK#+(Lt<6l9E|fcEyQ!7%HaIVIcS;q~azSM&rRZBs%47@aBRk zT7yl@lR4yVO=%X|%G=O5W$*CFU^3%Yo+GrynW~3%VS?`tj=VRBo^2zDFkw$hljoL0 zD*hFdn2cJolhs}0L7|cqx89~wSx2MVMV%++7HZxGeABDpJ9Wc`YX?CGoX?Ag#GKID zrw%e-A8Z-hfHxU5XrOKqGEP6g^x2zVyz%AcLnV8%8%1BeSuM!iv8wALx^7h4U~D!n zp3kPav8x(}L8oq!=>%+9yT-XS;_5zRVal7ry7+0ewgYFGVCkJUrAKW6m5MPB}OD{F0u7@`pAj7vJKJh@vvYO`8?uz`_EMDSe z+qxQTXW?yW==IoZbgGY3WPj| zH5Z~pN=2By2Gt2mkb@Nf1e@TK4VzEqLl8I$vvm~Lkb3*qW{ri?8aAlaHz!PHIKUjB zYKRF})UQ|;$s%E&;w5ET%!YDOh6537iA-GMMfTj{#oG-+OFiaQV=)ujBrZ|sX$KNV zB3esZ*q28#__4 zVmcl*>bT~@TgwA`u~}CGc?(q8<%fXcqx$Kb22i+1%eU=NADQc2baSL*hr1K=-Cmwe zCfS7uU=+jVW|?e?t8tXe#-MD3C%NF($Z+{oM=1JObb6SbP7XfydY%0GF_IZCo@OL* zz_iJ-E*Ga#lqeI793feOFf9%vhYw~bnDXmx#U1t36wF^vWwB~BuSF?tg0djX!Qr)- zecmd<h zew(j8!U}Jf9Wi?Cq_gcy!FfXfD=#j2HbK6Dbyp!=Cll^g6Y@xd?Oc6&bJdvK zV1_@EzNkTU^OdSD&_#uDo#OJ*-m7&xdV$5FBlJQWIxa_Dj7k}(;gDX(N^3D_Il8ON zRcy>4-*>zQ^%JQmeKsc9*F!Y9MQ?}BPh>_?cS26P;z&FE-+QTc{3C}W9}TDW6l->S$G=g#%Rrnd}Z)U{yr%y`7_`OI6;X)xWYvTI53;a zu9Ox74YimvC;63Xz6jyo$cE90bf)}gNe#lY7XsNaCU;L}>B;pMz20T2gx*H~YJX<5 z!QR!mR^ITs?+5%lp+4rJ5UjEfz8%F_H)$%GK+n!%qR?tr(p|4|G4UEZ8%cY(ak&ha!4N9Jbmlb#7hJ)A~IBZ_?jqub=Ee5~@y+tip50 zt2lg3JyQQ|Lk67hhcAT6|8kXo1Ft+BcTVNk`94yMJQb0O>FeAVVb{$^`wd19{uzU2 zAZN=n9JSIGv*7&bfg}}G3VtXxg1E^64RG#PHsjMQRp4P%m-EKX8`ME+%0~L0=$A2b8Kzhd8lk5`vf@U&`OKv35g5L8N%o9NynN3W=TtO4z zGl6LtVN=-NWDSF%Ei}t$p*E@=65BBVuZ5(ENaZ3y0JoTVfGXK9-RUPeRRu=~h+D@zL5P}qXqZfz4L7(Zn!#rIPRu9Lx23;)i~61rH;QCk&HBtNJsP{==*&FqMx{l@R^7rd?D-;N`W6-aY7)` zpGJFt+Jy2uHwpTQgM>}{CS&uih_58_j-s@I*o(P~>J9o5)C>C4=W-X0)mIH^ z=W>CcL6HyDf%$QGP=BXK(tq2+`eo6@`;>tsaNG#5C0+`{!o-qX`*h{J|(H08q!J z74g@pcf6y>r1IDc9sPb)?G|1!!(hmlPR`Qwejh9N-g~m^*P9`qVc->S?ojQPw_al9<|f6VV|_lGo^nWdblVZsGdj@G5UmLgPldilZK}q za&!F#Y%HEUVo&>@yRU&^TyQ(>^jg#sqK|)nS=?Z!IZ@OhNh&b>toG zVK+cDB<%||{OH&C0)uX4Ti_1+Wsaq0=YwC>-1R2f{3Q=e>$&P*AMC8La4s+ECbk{l zDhj{1O^tlMdwYZu!w9uvvI7ob`;eJUeM|TO2d6E8!$xhdC6f}lUI|y7spUVI^C)HR%>fP6EOlCSU*V(pD)u zT!+Bn`vGii6oxcHU>Y-24@MGNRT}qZ&6X{z@Uc`hOp^BjO}|Ck-?IO^Y3Tc(Y$`sq zd^14%szc$|#<~bxcgiqMTw1;zpf#;&nw_%S%oOV_Qyl$q_gJY)z|?uQn&eJ_F2?DK zpfj1F;aV~2Qb}#Cq@`B;{#Us)qptAF^gp5%)G~1uvmLpu>rcC>GEFz7rDe*dVrkT+ zRhsO7x{5YuUW{>r3Zz@HJ#wT6ovcMRi(S&v3nQ*oS;CX4@r_d(XE5hrt=PG1BOGMM zFTW5ZgvN}7o19?KU;WF zA6xwt!T@-2Prq)}C*V)b)J`s*^M#@iKtA&`oUG((fI+xqE z5X`m5?+kPYx-7v2uOT+~CRQ1%3~fHg=aQv4?rZ!B7mZl{ehcQgvG|dj8Luu2`l>v zLE20TO@~g2pcfgxu4C0q&SP3E+>@MLOd)G#T$!|$RhnAM$`KFD(l7SYo;6cwOjIVw z6$zP%JIoR*L7u3@rLCH|SG||NV}cq#fZrQ=@X(6fyZ7+7Mhr5)EU(O9^=M6Sje_6w zpou>S4TdUsO?6E{ki8T3^6hS8&&PHa*YWeXIXT=s{u8ro=jQP9o+JjVn=~)QF{ec= za5`nOT$+Vi+~&=k!pAbbxQ0o6i#HQzKOEcS*Z|Ujb=X3ooScOWU9m4I3|)*JOKp&$5iX=XIoB%MXu_?#nP?1K zY=;-R#=<}wCZAUxfZQQzj#aCcN-HW_rG~f%ns8OcC(Gilvj>Du%_?%r%{_lB&H>`nUHY|nN(G9or(G3uT3|&0p*jF4iokL5Z zg4a`R$9QE`)dnOv1|5pTBvo5%Si$d7@T?pO*9N#{X-Hr01QAp)W-Zw7wPSW`6 zm@7+r1K#iz3La(1NTZY@Bts>?QHld(h|*}9aVW-h&|lD2o$-?viQ8rKJM!n`Iu_@0 zmwL_8g62`E@gX`9uESL}N)mugznwHcO0uRh_aC_V515KUV)L*1Cr8uSswm*h9MLwy zAr=r?U%G|AFf5V?`p@2#FyqMu|etW z&RVmQV}@qQ^GR8N#;UG=!i;49q_~@yo8E^UUikX(3aRKGemf^@Hg5aH<5BN}JxmYb zWrefCag^y~if1v91&1!e(ILyiL`}#sTIjPRn}Q$p@RmEkFX>zs6(GV3eg`9rr93Fs zfk5g5k=RPFAC7502vJa>J{V|MF0kT_z&z| z#;Pe*|Glx_jH-gZ{que`)QrlycAyg~kJu3bm3R7YL^bsOpKq&vExEJy?!E7Dq^3V{ z5Y5<2rJ?inEOk+Tq8W8+rk>@~C3XWrZROGqVaHP8QhTqm7|FW|bQ^_6xxn~esb{J# zeCl5Wm??5N&&nvEtYzi+u)`c3rC^4tNIHGO?&;G#HE8cre|D_H#LTv@pxdnX`Z)_3_@Qt+~}Lt2P{s4eFg0d$>G&wwd-J6 zuQeWK*7Fjp3Qyt-=>#Bx zSc}pn2=siHCu|32HE7Zs(=$YdAfLf)26u;_?|>6cHaI2iS)y!6NFhgex$kVSlvc)# zqE){@9=}H|=<4w33%0G(wQX+X;j3#E-PwoWF-1=k&=OUk0R@$oYJhgcqCB8Rj&&X& zh%RyHQ3{qW5X?gGV!<{I%bl@*J0B5q5SnT@$p$o*nt@yn4o$5(=vYAI0;pOhC3^OX z_p~`$^J?xiTptbu9$@q0>SS+c6Hi8i#cVhX>U7C7|eIeSnTpBIgC8|+zU2W%xXGCDy0+0+D0<-!QIj0R$Drx=Mk*d%NoUV4Z zH^9}EZmUb9~HY^zi>4W+Agvz0D&R#0PF{jRxRZIgMJ$ZRI? zob4TB(bkQEc+=a!U_Iq1Pws?E!#*K4Cl+48)zoc*iJFWMR^c%K)S*MfM0~MznKn2W z_$&wEk#ARuc_Ev2@{TDY#YFN_YaNvA)8u;j6=H3FNJ~=)Y%A4|B{1w-slS1$t*h72 z)=j(Jq?Slu7lXR#7Il;Bb2RfZlgv$i1tLWaSxDdw2+gr-<&Y-#~9A#RaT)wyDa8l|brw(HZ!?3G`NkGA4wW1}9`!l2r} zwLaY^$tPf$AhtSWgi&>L06AS6OH%qow_dZ#n!-6+YB-ItJi^l!Njf8;%ew>%FF)&Q z)g$y7VAeI<^fhGU8j7-b!TL)x-?J*J%u~jVCYKhkqJ6%H9^D`6mWeSvE|7w*EOVm5 z%|azYXwUOa zn=GYrszml9X)VmTuM#KaEf%6pwF;;%0QZiQ^0eig&wI562%bN$uY3MMH`@DmZ{NHg z^uK!f;?|98S5KYn^_}S1x@Gf5r=#v!{nJXD$skHk6Q)iWBsKxx#il$io=mO6q%o*2 zH3g;mN%g52F}!i8feQ3XS-`{XyWsr8$wYGTXbDZs=ZPg*LYSMf$!B$!=2zi6(`+C0 zohaOf4kWUhuR#%#1_B)`N{yuL9%^=Jb{=FvLF=U*;K^(0sWx^0&$oV-%S2e7pVFUOcD3~EeV~Lyn6%*qj-h5@B;vF+dCS$Oh|#WK zR&1Ta@I_VqqNzx^Cf&_<=VI!NT}-P+;eOGTf)NXN>%;K`=iW4zc%Hyq(`sIXxuwKy zutJirE?q@8(kUibri2Ngi!hY1(aa#6E!E{^kZ3zN#y%jx2m_dT{3*?J1J$Byq#NMj z6?l|0iY2dRIj&-fRhh6%r+S&DeU$pz-9{5NeeRn)?VxP^s*Jk`fbmCTi$%ID&Y@nG z`eM!#1%0;kgMR8${=zh<&J)fre*Q+!@8^}5UwZMWCmvtp`SilMKum$ zUpw^V2H^zu6xIs~UGz}(mc0ocnEj0zqGXBQfN8SVph$`ljkMCdfu2w1{tXGW;?;Y( zhGmMSfedKT3At`7qY&aHVmz64%S$K==+~eUZ}ArSzY!f>nm@L;KS1r|zJKtY%0JIt zpPXE{>hbk`zf__Xb9kY1PT=^Vf9v&J$1Yi=Yih>3)3wWwu6V8@lHEDM#49i{!8W;> zvoPKpy?I}tBYr@OVr=zyxJ5SxZ zaeQ!Cs0AKdIwH~$v(RcE(TS>LVEQ3MumMoZ`q1=TvypFv2Bp|>KKhX#KVaP@zWm8< z6smG6O^^Kd>hleaHkK9Q{mm9-3XH*q34)v?4~7^!q1GlxgK!K&ldz5~2{%N=CGABt&oY1QgZ@6Vad&|?!)7f-1{CqChZToKCROPI=%j5B| z>l3DS=SUMsQNH34crni4D1{I}7a+oB=i=<6@tI{=uyp!b=X+a$8k_Q@skivT&I!zh z!_{2F0MF;y#k{6UA~@h_ep(&^NsZ%7V9R4;V6t*X$o*-2g!_B%$kd~zbuWmP%d>W* zt3&CHG6ObNa-4CmwQtN7Mmeb z06`c8XT6Xq{X&?kikVK=e6F-v+dam5AA#Q{@|UOGiAsN>p}P7r3MZHIjWG}g<9;`r zAT&k5`y()eE|R&|r-|yw&?n=!ZUdd;d=Y|%9~Qg%w!XsUmtNdlqV&h#zxdTl(q(4( z!sZL}spsShzD)ni+B+rw?^y%2r4M)i9VjaAEs^@Ofth}CecmN8+wBpt`sek239Emh zcA~^z|Hj?4*muZ}j$3=KUUpxizpS=2T~5#}bKAUuT(|i()YR6mp+ZCzrza=|_$f5* z2t22ulG+AT~E?feEhgpxg6u7MZC=U9LU zvUodz=7fqc+(tKVrcbeNWKL1a!4({snFF0oGjHopBL4j@YZ_geJ?1}~%l@k$?`iv( z{PK@s+2qOnK;z#9{HKNe%t6^dcv(lUGcw3@1t;{3d9i^(`;vPzk$kV&o^O7w*Icf*U+ z)XF>uBPn=FXlOzx!w@${CNt?U2w?a+02hEjJB4V4&gf{GPFLs}{}f@OVmcuP4v{CP zi9*z{%@ZxZF68f7X3ijtNmonZoLthlHzsO~8H?ZJ=#}hNSYxWGlax5v4B<X4-j||A2KDx#a2H7zvN11 zOF5Yc58X;BZ^)q%^4T=c^UGc^&1ZV_d9%bz@AOTy>Z_9z@3 z`*WAfpCo0l^}k(mfRZ`n-;IyPLX47okM+m?TK|W$H@&mm4ZPux`teEqzi7G0FFxx= z{)fKBGL=hqUOYX0w}BlKaW>cXCZz&uNNNYeq#ah}rx_bHshDOFFre@|Asn`v2UW2MUkJFLkm*+>EZKJD!8t&WH z+@CN2dmKEW$P;MiA)&&SLwvFI0sVO!Ok7mBiu~?Cf2_7XN-5b}VuW0<_mUE_HD2Lx zpguDSOsh#H^CJ7`lGWS&@-coNy&4Hr=|Y-Wns z&5`_ByM-*&(|QqEBIa1j4a*?CdGeNOQB|}do@J9EqmDTO z;}8G;vlW2Kd7j*=61s>URpxU8E`H@B~Qy{@ohkP{ubSXfkH6!Q;@MmUGQbyP(TTC CrWaHI literal 0 HcmV?d00001 diff --git a/en/_static/images/agid-logo.svg b/en/_static/images/agid-logo.svg new file mode 100644 index 00000000..a81f5eb8 --- /dev/null +++ b/en/_static/images/agid-logo.svg @@ -0,0 +1,25 @@ + + + +Logo dell&Agenzia per l&Italia Digitale +Emblema della Repubblica Italiana con accanto l&acronimo AGID + + + + + + + + + + + + + + + + + diff --git a/en/_static/images/may.svg b/en/_static/images/may.svg new file mode 100644 index 00000000..53670ba9 --- /dev/null +++ b/en/_static/images/may.svg @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + diff --git a/en/_static/images/must.svg b/en/_static/images/must.svg new file mode 100644 index 00000000..177c3c51 --- /dev/null +++ b/en/_static/images/must.svg @@ -0,0 +1,71 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/en/_static/images/must_not.svg b/en/_static/images/must_not.svg new file mode 100644 index 00000000..8c0c0d85 --- /dev/null +++ b/en/_static/images/must_not.svg @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/en/_static/images/should.svg b/en/_static/images/should.svg new file mode 100644 index 00000000..c1f35d65 --- /dev/null +++ b/en/_static/images/should.svg @@ -0,0 +1,52 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/en/_static/images/should_not.svg b/en/_static/images/should_not.svg new file mode 100644 index 00000000..88e64a64 --- /dev/null +++ b/en/_static/images/should_not.svg @@ -0,0 +1,52 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/en/_static/images/team-digitale-logo.svg b/en/_static/images/team-digitale-logo.svg new file mode 100644 index 00000000..fa557011 --- /dev/null +++ b/en/_static/images/team-digitale-logo.svg @@ -0,0 +1,15 @@ + + + + + + + + + diff --git a/en/_static/jquery-3.6.0.js b/en/_static/jquery-3.6.0.js new file mode 100644 index 00000000..fc6c299b --- /dev/null +++ b/en/_static/jquery-3.6.0.js @@ -0,0 +1,10881 @@ +/*! + * jQuery JavaScript Library v3.6.0 + * https://jquery.com/ + * + * Includes Sizzle.js + * https://sizzlejs.com/ + * + * Copyright OpenJS Foundation and other contributors + * Released under the MIT license + * https://jquery.org/license + * + * Date: 2021-03-02T17:08Z + */ +( function( global, factory ) { + + "use strict"; + + if ( typeof module === "object" && typeof module.exports === "object" ) { + + // For CommonJS and CommonJS-like environments where a proper `window` + // is present, execute the factory and get jQuery. + // For environments that do not have a `window` with a `document` + // (such as Node.js), expose a factory as module.exports. + // This accentuates the need for the creation of a real `window`. + // e.g. var jQuery = require("jquery")(window); + // See ticket #14549 for more info. + module.exports = global.document ? + factory( global, true ) : + function( w ) { + if ( !w.document ) { + throw new Error( "jQuery requires a window with a document" ); + } + return factory( w ); + }; + } else { + factory( global ); + } + +// Pass this if window is not defined yet +} )( typeof window !== "undefined" ? window : this, function( window, noGlobal ) { + +// Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1 +// throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode +// arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common +// enough that all such attempts are guarded in a try block. +"use strict"; + +var arr = []; + +var getProto = Object.getPrototypeOf; + +var slice = arr.slice; + +var flat = arr.flat ? function( array ) { + return arr.flat.call( array ); +} : function( array ) { + return arr.concat.apply( [], array ); +}; + + +var push = arr.push; + +var indexOf = arr.indexOf; + +var class2type = {}; + +var toString = class2type.toString; + +var hasOwn = class2type.hasOwnProperty; + +var fnToString = hasOwn.toString; + +var ObjectFunctionString = fnToString.call( Object ); + +var support = {}; + +var isFunction = function isFunction( obj ) { + + // Support: Chrome <=57, Firefox <=52 + // In some browsers, typeof returns "function" for HTML elements + // (i.e., `typeof document.createElement( "object" ) === "function"`). + // We don't want to classify *any* DOM node as a function. + // Support: QtWeb <=3.8.5, WebKit <=534.34, wkhtmltopdf tool <=0.12.5 + // Plus for old WebKit, typeof returns "function" for HTML collections + // (e.g., `typeof document.getElementsByTagName("div") === "function"`). (gh-4756) + return typeof obj === "function" && typeof obj.nodeType !== "number" && + typeof obj.item !== "function"; + }; + + +var isWindow = function isWindow( obj ) { + return obj != null && obj === obj.window; + }; + + +var document = window.document; + + + + var preservedScriptAttributes = { + type: true, + src: true, + nonce: true, + noModule: true + }; + + function DOMEval( code, node, doc ) { + doc = doc || document; + + var i, val, + script = doc.createElement( "script" ); + + script.text = code; + if ( node ) { + for ( i in preservedScriptAttributes ) { + + // Support: Firefox 64+, Edge 18+ + // Some browsers don't support the "nonce" property on scripts. + // On the other hand, just using `getAttribute` is not enough as + // the `nonce` attribute is reset to an empty string whenever it + // becomes browsing-context connected. + // See https://github.com/whatwg/html/issues/2369 + // See https://html.spec.whatwg.org/#nonce-attributes + // The `node.getAttribute` check was added for the sake of + // `jQuery.globalEval` so that it can fake a nonce-containing node + // via an object. + val = node[ i ] || node.getAttribute && node.getAttribute( i ); + if ( val ) { + script.setAttribute( i, val ); + } + } + } + doc.head.appendChild( script ).parentNode.removeChild( script ); + } + + +function toType( obj ) { + if ( obj == null ) { + return obj + ""; + } + + // Support: Android <=2.3 only (functionish RegExp) + return typeof obj === "object" || typeof obj === "function" ? + class2type[ toString.call( obj ) ] || "object" : + typeof obj; +} +/* global Symbol */ +// Defining this global in .eslintrc.json would create a danger of using the global +// unguarded in another place, it seems safer to define global only for this module + + + +var + version = "3.6.0", + + // Define a local copy of jQuery + jQuery = function( selector, context ) { + + // The jQuery object is actually just the init constructor 'enhanced' + // Need init if jQuery is called (just allow error to be thrown if not included) + return new jQuery.fn.init( selector, context ); + }; + +jQuery.fn = jQuery.prototype = { + + // The current version of jQuery being used + jquery: version, + + constructor: jQuery, + + // The default length of a jQuery object is 0 + length: 0, + + toArray: function() { + return slice.call( this ); + }, + + // Get the Nth element in the matched element set OR + // Get the whole matched element set as a clean array + get: function( num ) { + + // Return all the elements in a clean array + if ( num == null ) { + return slice.call( this ); + } + + // Return just the one element from the set + return num < 0 ? this[ num + this.length ] : this[ num ]; + }, + + // Take an array of elements and push it onto the stack + // (returning the new matched element set) + pushStack: function( elems ) { + + // Build a new jQuery matched element set + var ret = jQuery.merge( this.constructor(), elems ); + + // Add the old object onto the stack (as a reference) + ret.prevObject = this; + + // Return the newly-formed element set + return ret; + }, + + // Execute a callback for every element in the matched set. + each: function( callback ) { + return jQuery.each( this, callback ); + }, + + map: function( callback ) { + return this.pushStack( jQuery.map( this, function( elem, i ) { + return callback.call( elem, i, elem ); + } ) ); + }, + + slice: function() { + return this.pushStack( slice.apply( this, arguments ) ); + }, + + first: function() { + return this.eq( 0 ); + }, + + last: function() { + return this.eq( -1 ); + }, + + even: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return ( i + 1 ) % 2; + } ) ); + }, + + odd: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return i % 2; + } ) ); + }, + + eq: function( i ) { + var len = this.length, + j = +i + ( i < 0 ? len : 0 ); + return this.pushStack( j >= 0 && j < len ? [ this[ j ] ] : [] ); + }, + + end: function() { + return this.prevObject || this.constructor(); + }, + + // For internal use only. + // Behaves like an Array's method, not like a jQuery method. + push: push, + sort: arr.sort, + splice: arr.splice +}; + +jQuery.extend = jQuery.fn.extend = function() { + var options, name, src, copy, copyIsArray, clone, + target = arguments[ 0 ] || {}, + i = 1, + length = arguments.length, + deep = false; + + // Handle a deep copy situation + if ( typeof target === "boolean" ) { + deep = target; + + // Skip the boolean and the target + target = arguments[ i ] || {}; + i++; + } + + // Handle case when target is a string or something (possible in deep copy) + if ( typeof target !== "object" && !isFunction( target ) ) { + target = {}; + } + + // Extend jQuery itself if only one argument is passed + if ( i === length ) { + target = this; + i--; + } + + for ( ; i < length; i++ ) { + + // Only deal with non-null/undefined values + if ( ( options = arguments[ i ] ) != null ) { + + // Extend the base object + for ( name in options ) { + copy = options[ name ]; + + // Prevent Object.prototype pollution + // Prevent never-ending loop + if ( name === "__proto__" || target === copy ) { + continue; + } + + // Recurse if we're merging plain objects or arrays + if ( deep && copy && ( jQuery.isPlainObject( copy ) || + ( copyIsArray = Array.isArray( copy ) ) ) ) { + src = target[ name ]; + + // Ensure proper type for the source value + if ( copyIsArray && !Array.isArray( src ) ) { + clone = []; + } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) { + clone = {}; + } else { + clone = src; + } + copyIsArray = false; + + // Never move original objects, clone them + target[ name ] = jQuery.extend( deep, clone, copy ); + + // Don't bring in undefined values + } else if ( copy !== undefined ) { + target[ name ] = copy; + } + } + } + } + + // Return the modified object + return target; +}; + +jQuery.extend( { + + // Unique for each copy of jQuery on the page + expando: "jQuery" + ( version + Math.random() ).replace( /\D/g, "" ), + + // Assume jQuery is ready without the ready module + isReady: true, + + error: function( msg ) { + throw new Error( msg ); + }, + + noop: function() {}, + + isPlainObject: function( obj ) { + var proto, Ctor; + + // Detect obvious negatives + // Use toString instead of jQuery.type to catch host objects + if ( !obj || toString.call( obj ) !== "[object Object]" ) { + return false; + } + + proto = getProto( obj ); + + // Objects with no prototype (e.g., `Object.create( null )`) are plain + if ( !proto ) { + return true; + } + + // Objects with prototype are plain iff they were constructed by a global Object function + Ctor = hasOwn.call( proto, "constructor" ) && proto.constructor; + return typeof Ctor === "function" && fnToString.call( Ctor ) === ObjectFunctionString; + }, + + isEmptyObject: function( obj ) { + var name; + + for ( name in obj ) { + return false; + } + return true; + }, + + // Evaluates a script in a provided context; falls back to the global one + // if not specified. + globalEval: function( code, options, doc ) { + DOMEval( code, { nonce: options && options.nonce }, doc ); + }, + + each: function( obj, callback ) { + var length, i = 0; + + if ( isArrayLike( obj ) ) { + length = obj.length; + for ( ; i < length; i++ ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } else { + for ( i in obj ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } + + return obj; + }, + + // results is for internal usage only + makeArray: function( arr, results ) { + var ret = results || []; + + if ( arr != null ) { + if ( isArrayLike( Object( arr ) ) ) { + jQuery.merge( ret, + typeof arr === "string" ? + [ arr ] : arr + ); + } else { + push.call( ret, arr ); + } + } + + return ret; + }, + + inArray: function( elem, arr, i ) { + return arr == null ? -1 : indexOf.call( arr, elem, i ); + }, + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + merge: function( first, second ) { + var len = +second.length, + j = 0, + i = first.length; + + for ( ; j < len; j++ ) { + first[ i++ ] = second[ j ]; + } + + first.length = i; + + return first; + }, + + grep: function( elems, callback, invert ) { + var callbackInverse, + matches = [], + i = 0, + length = elems.length, + callbackExpect = !invert; + + // Go through the array, only saving the items + // that pass the validator function + for ( ; i < length; i++ ) { + callbackInverse = !callback( elems[ i ], i ); + if ( callbackInverse !== callbackExpect ) { + matches.push( elems[ i ] ); + } + } + + return matches; + }, + + // arg is for internal usage only + map: function( elems, callback, arg ) { + var length, value, + i = 0, + ret = []; + + // Go through the array, translating each of the items to their new values + if ( isArrayLike( elems ) ) { + length = elems.length; + for ( ; i < length; i++ ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + + // Go through every key on the object, + } else { + for ( i in elems ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + } + + // Flatten any nested arrays + return flat( ret ); + }, + + // A global GUID counter for objects + guid: 1, + + // jQuery.support is not used in Core but other projects attach their + // properties to it so it needs to exist. + support: support +} ); + +if ( typeof Symbol === "function" ) { + jQuery.fn[ Symbol.iterator ] = arr[ Symbol.iterator ]; +} + +// Populate the class2type map +jQuery.each( "Boolean Number String Function Array Date RegExp Object Error Symbol".split( " " ), + function( _i, name ) { + class2type[ "[object " + name + "]" ] = name.toLowerCase(); + } ); + +function isArrayLike( obj ) { + + // Support: real iOS 8.2 only (not reproducible in simulator) + // `in` check used to prevent JIT error (gh-2145) + // hasOwn isn't used here due to false negatives + // regarding Nodelist length in IE + var length = !!obj && "length" in obj && obj.length, + type = toType( obj ); + + if ( isFunction( obj ) || isWindow( obj ) ) { + return false; + } + + return type === "array" || length === 0 || + typeof length === "number" && length > 0 && ( length - 1 ) in obj; +} +var Sizzle = +/*! + * Sizzle CSS Selector Engine v2.3.6 + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://js.foundation/ + * + * Date: 2021-02-16 + */ +( function( window ) { +var i, + support, + Expr, + getText, + isXML, + tokenize, + compile, + select, + outermostContext, + sortInput, + hasDuplicate, + + // Local document vars + setDocument, + document, + docElem, + documentIsHTML, + rbuggyQSA, + rbuggyMatches, + matches, + contains, + + // Instance-specific data + expando = "sizzle" + 1 * new Date(), + preferredDoc = window.document, + dirruns = 0, + done = 0, + classCache = createCache(), + tokenCache = createCache(), + compilerCache = createCache(), + nonnativeSelectorCache = createCache(), + sortOrder = function( a, b ) { + if ( a === b ) { + hasDuplicate = true; + } + return 0; + }, + + // Instance methods + hasOwn = ( {} ).hasOwnProperty, + arr = [], + pop = arr.pop, + pushNative = arr.push, + push = arr.push, + slice = arr.slice, + + // Use a stripped-down indexOf as it's faster than native + // https://jsperf.com/thor-indexof-vs-for/5 + indexOf = function( list, elem ) { + var i = 0, + len = list.length; + for ( ; i < len; i++ ) { + if ( list[ i ] === elem ) { + return i; + } + } + return -1; + }, + + booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|" + + "ismap|loop|multiple|open|readonly|required|scoped", + + // Regular expressions + + // http://www.w3.org/TR/css3-selectors/#whitespace + whitespace = "[\\x20\\t\\r\\n\\f]", + + // https://www.w3.org/TR/css-syntax-3/#ident-token-diagram + identifier = "(?:\\\\[\\da-fA-F]{1,6}" + whitespace + + "?|\\\\[^\\r\\n\\f]|[\\w-]|[^\0-\\x7f])+", + + // Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors + attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace + + + // Operator (capture 2) + "*([*^$|!~]?=)" + whitespace + + + // "Attribute values must be CSS identifiers [capture 5] + // or strings [capture 3 or capture 4]" + "*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" + + whitespace + "*\\]", + + pseudos = ":(" + identifier + ")(?:\\((" + + + // To reduce the number of selectors needing tokenize in the preFilter, prefer arguments: + // 1. quoted (capture 3; capture 4 or capture 5) + "('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" + + + // 2. simple (capture 6) + "((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" + + + // 3. anything else (capture 2) + ".*" + + ")\\)|)", + + // Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latter + rwhitespace = new RegExp( whitespace + "+", "g" ), + rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + + whitespace + "+$", "g" ), + + rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ), + rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" + whitespace + + "*" ), + rdescend = new RegExp( whitespace + "|>" ), + + rpseudo = new RegExp( pseudos ), + ridentifier = new RegExp( "^" + identifier + "$" ), + + matchExpr = { + "ID": new RegExp( "^#(" + identifier + ")" ), + "CLASS": new RegExp( "^\\.(" + identifier + ")" ), + "TAG": new RegExp( "^(" + identifier + "|[*])" ), + "ATTR": new RegExp( "^" + attributes ), + "PSEUDO": new RegExp( "^" + pseudos ), + "CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" + + whitespace + "*(even|odd|(([+-]|)(\\d*)n|)" + whitespace + "*(?:([+-]|)" + + whitespace + "*(\\d+)|))" + whitespace + "*\\)|)", "i" ), + "bool": new RegExp( "^(?:" + booleans + ")$", "i" ), + + // For use in libraries implementing .is() + // We use this for POS matching in `select` + "needsContext": new RegExp( "^" + whitespace + + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" + whitespace + + "*((?:-\\d)?\\d*)" + whitespace + "*\\)|)(?=[^-]|$)", "i" ) + }, + + rhtml = /HTML$/i, + rinputs = /^(?:input|select|textarea|button)$/i, + rheader = /^h\d$/i, + + rnative = /^[^{]+\{\s*\[native \w/, + + // Easily-parseable/retrievable ID or TAG or CLASS selectors + rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/, + + rsibling = /[+~]/, + + // CSS escapes + // http://www.w3.org/TR/CSS21/syndata.html#escaped-characters + runescape = new RegExp( "\\\\[\\da-fA-F]{1,6}" + whitespace + "?|\\\\([^\\r\\n\\f])", "g" ), + funescape = function( escape, nonHex ) { + var high = "0x" + escape.slice( 1 ) - 0x10000; + + return nonHex ? + + // Strip the backslash prefix from a non-hex escape sequence + nonHex : + + // Replace a hexadecimal escape sequence with the encoded Unicode code point + // Support: IE <=11+ + // For values outside the Basic Multilingual Plane (BMP), manually construct a + // surrogate pair + high < 0 ? + String.fromCharCode( high + 0x10000 ) : + String.fromCharCode( high >> 10 | 0xD800, high & 0x3FF | 0xDC00 ); + }, + + // CSS string/identifier serialization + // https://drafts.csswg.org/cssom/#common-serializing-idioms + rcssescape = /([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g, + fcssescape = function( ch, asCodePoint ) { + if ( asCodePoint ) { + + // U+0000 NULL becomes U+FFFD REPLACEMENT CHARACTER + if ( ch === "\0" ) { + return "\uFFFD"; + } + + // Control characters and (dependent upon position) numbers get escaped as code points + return ch.slice( 0, -1 ) + "\\" + + ch.charCodeAt( ch.length - 1 ).toString( 16 ) + " "; + } + + // Other potentially-special ASCII characters get backslash-escaped + return "\\" + ch; + }, + + // Used for iframes + // See setDocument() + // Removing the function wrapper causes a "Permission Denied" + // error in IE + unloadHandler = function() { + setDocument(); + }, + + inDisabledFieldset = addCombinator( + function( elem ) { + return elem.disabled === true && elem.nodeName.toLowerCase() === "fieldset"; + }, + { dir: "parentNode", next: "legend" } + ); + +// Optimize for push.apply( _, NodeList ) +try { + push.apply( + ( arr = slice.call( preferredDoc.childNodes ) ), + preferredDoc.childNodes + ); + + // Support: Android<4.0 + // Detect silently failing push.apply + // eslint-disable-next-line no-unused-expressions + arr[ preferredDoc.childNodes.length ].nodeType; +} catch ( e ) { + push = { apply: arr.length ? + + // Leverage slice if possible + function( target, els ) { + pushNative.apply( target, slice.call( els ) ); + } : + + // Support: IE<9 + // Otherwise append directly + function( target, els ) { + var j = target.length, + i = 0; + + // Can't trust NodeList.length + while ( ( target[ j++ ] = els[ i++ ] ) ) {} + target.length = j - 1; + } + }; +} + +function Sizzle( selector, context, results, seed ) { + var m, i, elem, nid, match, groups, newSelector, + newContext = context && context.ownerDocument, + + // nodeType defaults to 9, since context defaults to document + nodeType = context ? context.nodeType : 9; + + results = results || []; + + // Return early from calls with invalid selector or context + if ( typeof selector !== "string" || !selector || + nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) { + + return results; + } + + // Try to shortcut find operations (as opposed to filters) in HTML documents + if ( !seed ) { + setDocument( context ); + context = context || document; + + if ( documentIsHTML ) { + + // If the selector is sufficiently simple, try using a "get*By*" DOM method + // (excepting DocumentFragment context, where the methods don't exist) + if ( nodeType !== 11 && ( match = rquickExpr.exec( selector ) ) ) { + + // ID selector + if ( ( m = match[ 1 ] ) ) { + + // Document context + if ( nodeType === 9 ) { + if ( ( elem = context.getElementById( m ) ) ) { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( elem.id === m ) { + results.push( elem ); + return results; + } + } else { + return results; + } + + // Element context + } else { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( newContext && ( elem = newContext.getElementById( m ) ) && + contains( context, elem ) && + elem.id === m ) { + + results.push( elem ); + return results; + } + } + + // Type selector + } else if ( match[ 2 ] ) { + push.apply( results, context.getElementsByTagName( selector ) ); + return results; + + // Class selector + } else if ( ( m = match[ 3 ] ) && support.getElementsByClassName && + context.getElementsByClassName ) { + + push.apply( results, context.getElementsByClassName( m ) ); + return results; + } + } + + // Take advantage of querySelectorAll + if ( support.qsa && + !nonnativeSelectorCache[ selector + " " ] && + ( !rbuggyQSA || !rbuggyQSA.test( selector ) ) && + + // Support: IE 8 only + // Exclude object elements + ( nodeType !== 1 || context.nodeName.toLowerCase() !== "object" ) ) { + + newSelector = selector; + newContext = context; + + // qSA considers elements outside a scoping root when evaluating child or + // descendant combinators, which is not what we want. + // In such cases, we work around the behavior by prefixing every selector in the + // list with an ID selector referencing the scope context. + // The technique has to be used as well when a leading combinator is used + // as such selectors are not recognized by querySelectorAll. + // Thanks to Andrew Dupont for this technique. + if ( nodeType === 1 && + ( rdescend.test( selector ) || rcombinators.test( selector ) ) ) { + + // Expand context for sibling selectors + newContext = rsibling.test( selector ) && testContext( context.parentNode ) || + context; + + // We can use :scope instead of the ID hack if the browser + // supports it & if we're not changing the context. + if ( newContext !== context || !support.scope ) { + + // Capture the context ID, setting it first if necessary + if ( ( nid = context.getAttribute( "id" ) ) ) { + nid = nid.replace( rcssescape, fcssescape ); + } else { + context.setAttribute( "id", ( nid = expando ) ); + } + } + + // Prefix every selector in the list + groups = tokenize( selector ); + i = groups.length; + while ( i-- ) { + groups[ i ] = ( nid ? "#" + nid : ":scope" ) + " " + + toSelector( groups[ i ] ); + } + newSelector = groups.join( "," ); + } + + try { + push.apply( results, + newContext.querySelectorAll( newSelector ) + ); + return results; + } catch ( qsaError ) { + nonnativeSelectorCache( selector, true ); + } finally { + if ( nid === expando ) { + context.removeAttribute( "id" ); + } + } + } + } + } + + // All others + return select( selector.replace( rtrim, "$1" ), context, results, seed ); +} + +/** + * Create key-value caches of limited size + * @returns {function(string, object)} Returns the Object data after storing it on itself with + * property name the (space-suffixed) string and (if the cache is larger than Expr.cacheLength) + * deleting the oldest entry + */ +function createCache() { + var keys = []; + + function cache( key, value ) { + + // Use (key + " ") to avoid collision with native prototype properties (see Issue #157) + if ( keys.push( key + " " ) > Expr.cacheLength ) { + + // Only keep the most recent entries + delete cache[ keys.shift() ]; + } + return ( cache[ key + " " ] = value ); + } + return cache; +} + +/** + * Mark a function for special use by Sizzle + * @param {Function} fn The function to mark + */ +function markFunction( fn ) { + fn[ expando ] = true; + return fn; +} + +/** + * Support testing using an element + * @param {Function} fn Passed the created element and returns a boolean result + */ +function assert( fn ) { + var el = document.createElement( "fieldset" ); + + try { + return !!fn( el ); + } catch ( e ) { + return false; + } finally { + + // Remove from its parent by default + if ( el.parentNode ) { + el.parentNode.removeChild( el ); + } + + // release memory in IE + el = null; + } +} + +/** + * Adds the same handler for all of the specified attrs + * @param {String} attrs Pipe-separated list of attributes + * @param {Function} handler The method that will be applied + */ +function addHandle( attrs, handler ) { + var arr = attrs.split( "|" ), + i = arr.length; + + while ( i-- ) { + Expr.attrHandle[ arr[ i ] ] = handler; + } +} + +/** + * Checks document order of two siblings + * @param {Element} a + * @param {Element} b + * @returns {Number} Returns less than 0 if a precedes b, greater than 0 if a follows b + */ +function siblingCheck( a, b ) { + var cur = b && a, + diff = cur && a.nodeType === 1 && b.nodeType === 1 && + a.sourceIndex - b.sourceIndex; + + // Use IE sourceIndex if available on both nodes + if ( diff ) { + return diff; + } + + // Check if b follows a + if ( cur ) { + while ( ( cur = cur.nextSibling ) ) { + if ( cur === b ) { + return -1; + } + } + } + + return a ? 1 : -1; +} + +/** + * Returns a function to use in pseudos for input types + * @param {String} type + */ +function createInputPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for buttons + * @param {String} type + */ +function createButtonPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return ( name === "input" || name === "button" ) && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for :enabled/:disabled + * @param {Boolean} disabled true for :disabled; false for :enabled + */ +function createDisabledPseudo( disabled ) { + + // Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable + return function( elem ) { + + // Only certain elements can match :enabled or :disabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled + if ( "form" in elem ) { + + // Check for inherited disabledness on relevant non-disabled elements: + // * listed form-associated elements in a disabled fieldset + // https://html.spec.whatwg.org/multipage/forms.html#category-listed + // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled + // * option elements in a disabled optgroup + // https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled + // All such elements have a "form" property. + if ( elem.parentNode && elem.disabled === false ) { + + // Option elements defer to a parent optgroup if present + if ( "label" in elem ) { + if ( "label" in elem.parentNode ) { + return elem.parentNode.disabled === disabled; + } else { + return elem.disabled === disabled; + } + } + + // Support: IE 6 - 11 + // Use the isDisabled shortcut property to check for disabled fieldset ancestors + return elem.isDisabled === disabled || + + // Where there is no isDisabled, check manually + /* jshint -W018 */ + elem.isDisabled !== !disabled && + inDisabledFieldset( elem ) === disabled; + } + + return elem.disabled === disabled; + + // Try to winnow out elements that can't be disabled before trusting the disabled property. + // Some victims get caught in our net (label, legend, menu, track), but it shouldn't + // even exist on them, let alone have a boolean value. + } else if ( "label" in elem ) { + return elem.disabled === disabled; + } + + // Remaining elements are neither :enabled nor :disabled + return false; + }; +} + +/** + * Returns a function to use in pseudos for positionals + * @param {Function} fn + */ +function createPositionalPseudo( fn ) { + return markFunction( function( argument ) { + argument = +argument; + return markFunction( function( seed, matches ) { + var j, + matchIndexes = fn( [], seed.length, argument ), + i = matchIndexes.length; + + // Match elements found at the specified indexes + while ( i-- ) { + if ( seed[ ( j = matchIndexes[ i ] ) ] ) { + seed[ j ] = !( matches[ j ] = seed[ j ] ); + } + } + } ); + } ); +} + +/** + * Checks a node for validity as a Sizzle context + * @param {Element|Object=} context + * @returns {Element|Object|Boolean} The input node if acceptable, otherwise a falsy value + */ +function testContext( context ) { + return context && typeof context.getElementsByTagName !== "undefined" && context; +} + +// Expose support vars for convenience +support = Sizzle.support = {}; + +/** + * Detects XML nodes + * @param {Element|Object} elem An element or a document + * @returns {Boolean} True iff elem is a non-HTML XML node + */ +isXML = Sizzle.isXML = function( elem ) { + var namespace = elem && elem.namespaceURI, + docElem = elem && ( elem.ownerDocument || elem ).documentElement; + + // Support: IE <=8 + // Assume HTML when documentElement doesn't yet exist, such as inside loading iframes + // https://bugs.jquery.com/ticket/4833 + return !rhtml.test( namespace || docElem && docElem.nodeName || "HTML" ); +}; + +/** + * Sets document-related variables once based on the current document + * @param {Element|Object} [doc] An element or document object to use to set the document + * @returns {Object} Returns the current document + */ +setDocument = Sizzle.setDocument = function( node ) { + var hasCompare, subWindow, + doc = node ? node.ownerDocument || node : preferredDoc; + + // Return early if doc is invalid or already selected + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( doc == document || doc.nodeType !== 9 || !doc.documentElement ) { + return document; + } + + // Update global variables + document = doc; + docElem = document.documentElement; + documentIsHTML = !isXML( document ); + + // Support: IE 9 - 11+, Edge 12 - 18+ + // Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936) + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( preferredDoc != document && + ( subWindow = document.defaultView ) && subWindow.top !== subWindow ) { + + // Support: IE 11, Edge + if ( subWindow.addEventListener ) { + subWindow.addEventListener( "unload", unloadHandler, false ); + + // Support: IE 9 - 10 only + } else if ( subWindow.attachEvent ) { + subWindow.attachEvent( "onunload", unloadHandler ); + } + } + + // Support: IE 8 - 11+, Edge 12 - 18+, Chrome <=16 - 25 only, Firefox <=3.6 - 31 only, + // Safari 4 - 5 only, Opera <=11.6 - 12.x only + // IE/Edge & older browsers don't support the :scope pseudo-class. + // Support: Safari 6.0 only + // Safari 6.0 supports :scope but it's an alias of :root there. + support.scope = assert( function( el ) { + docElem.appendChild( el ).appendChild( document.createElement( "div" ) ); + return typeof el.querySelectorAll !== "undefined" && + !el.querySelectorAll( ":scope fieldset div" ).length; + } ); + + /* Attributes + ---------------------------------------------------------------------- */ + + // Support: IE<8 + // Verify that getAttribute really returns attributes and not properties + // (excepting IE8 booleans) + support.attributes = assert( function( el ) { + el.className = "i"; + return !el.getAttribute( "className" ); + } ); + + /* getElement(s)By* + ---------------------------------------------------------------------- */ + + // Check if getElementsByTagName("*") returns only elements + support.getElementsByTagName = assert( function( el ) { + el.appendChild( document.createComment( "" ) ); + return !el.getElementsByTagName( "*" ).length; + } ); + + // Support: IE<9 + support.getElementsByClassName = rnative.test( document.getElementsByClassName ); + + // Support: IE<10 + // Check if getElementById returns elements by name + // The broken getElementById methods don't pick up programmatically-set names, + // so use a roundabout getElementsByName test + support.getById = assert( function( el ) { + docElem.appendChild( el ).id = expando; + return !document.getElementsByName || !document.getElementsByName( expando ).length; + } ); + + // ID filter and find + if ( support.getById ) { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + return elem.getAttribute( "id" ) === attrId; + }; + }; + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var elem = context.getElementById( id ); + return elem ? [ elem ] : []; + } + }; + } else { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + var node = typeof elem.getAttributeNode !== "undefined" && + elem.getAttributeNode( "id" ); + return node && node.value === attrId; + }; + }; + + // Support: IE 6 - 7 only + // getElementById is not reliable as a find shortcut + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var node, i, elems, + elem = context.getElementById( id ); + + if ( elem ) { + + // Verify the id attribute + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + + // Fall back on getElementsByName + elems = context.getElementsByName( id ); + i = 0; + while ( ( elem = elems[ i++ ] ) ) { + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + } + } + + return []; + } + }; + } + + // Tag + Expr.find[ "TAG" ] = support.getElementsByTagName ? + function( tag, context ) { + if ( typeof context.getElementsByTagName !== "undefined" ) { + return context.getElementsByTagName( tag ); + + // DocumentFragment nodes don't have gEBTN + } else if ( support.qsa ) { + return context.querySelectorAll( tag ); + } + } : + + function( tag, context ) { + var elem, + tmp = [], + i = 0, + + // By happy coincidence, a (broken) gEBTN appears on DocumentFragment nodes too + results = context.getElementsByTagName( tag ); + + // Filter out possible comments + if ( tag === "*" ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem.nodeType === 1 ) { + tmp.push( elem ); + } + } + + return tmp; + } + return results; + }; + + // Class + Expr.find[ "CLASS" ] = support.getElementsByClassName && function( className, context ) { + if ( typeof context.getElementsByClassName !== "undefined" && documentIsHTML ) { + return context.getElementsByClassName( className ); + } + }; + + /* QSA/matchesSelector + ---------------------------------------------------------------------- */ + + // QSA and matchesSelector support + + // matchesSelector(:active) reports false when true (IE9/Opera 11.5) + rbuggyMatches = []; + + // qSa(:focus) reports false when true (Chrome 21) + // We allow this because of a bug in IE8/9 that throws an error + // whenever `document.activeElement` is accessed on an iframe + // So, we allow :focus to pass through QSA all the time to avoid the IE error + // See https://bugs.jquery.com/ticket/13378 + rbuggyQSA = []; + + if ( ( support.qsa = rnative.test( document.querySelectorAll ) ) ) { + + // Build QSA regex + // Regex strategy adopted from Diego Perini + assert( function( el ) { + + var input; + + // Select is set to empty string on purpose + // This is to test IE's treatment of not explicitly + // setting a boolean content attribute, + // since its presence should be enough + // https://bugs.jquery.com/ticket/12359 + docElem.appendChild( el ).innerHTML = "" + + ""; + + // Support: IE8, Opera 11-12.16 + // Nothing should be selected when empty strings follow ^= or $= or *= + // The test attribute must be unknown in Opera but "safe" for WinRT + // https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section + if ( el.querySelectorAll( "[msallowcapture^='']" ).length ) { + rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" ); + } + + // Support: IE8 + // Boolean attributes and "value" are not treated correctly + if ( !el.querySelectorAll( "[selected]" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" ); + } + + // Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+ + if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) { + rbuggyQSA.push( "~=" ); + } + + // Support: IE 11+, Edge 15 - 18+ + // IE 11/Edge don't find elements on a `[name='']` query in some cases. + // Adding a temporary attribute to the document before the selection works + // around the issue. + // Interestingly, IE 10 & older don't seem to have the issue. + input = document.createElement( "input" ); + input.setAttribute( "name", "" ); + el.appendChild( input ); + if ( !el.querySelectorAll( "[name='']" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*name" + whitespace + "*=" + + whitespace + "*(?:''|\"\")" ); + } + + // Webkit/Opera - :checked should return selected option elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + // IE8 throws error here and will not see later tests + if ( !el.querySelectorAll( ":checked" ).length ) { + rbuggyQSA.push( ":checked" ); + } + + // Support: Safari 8+, iOS 8+ + // https://bugs.webkit.org/show_bug.cgi?id=136851 + // In-page `selector#id sibling-combinator selector` fails + if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) { + rbuggyQSA.push( ".#.+[+~]" ); + } + + // Support: Firefox <=3.6 - 5 only + // Old Firefox doesn't throw on a badly-escaped identifier. + el.querySelectorAll( "\\\f" ); + rbuggyQSA.push( "[\\r\\n\\f]" ); + } ); + + assert( function( el ) { + el.innerHTML = "" + + ""; + + // Support: Windows 8 Native Apps + // The type and name attributes are restricted during .innerHTML assignment + var input = document.createElement( "input" ); + input.setAttribute( "type", "hidden" ); + el.appendChild( input ).setAttribute( "name", "D" ); + + // Support: IE8 + // Enforce case-sensitivity of name attribute + if ( el.querySelectorAll( "[name=d]" ).length ) { + rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" ); + } + + // FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled) + // IE8 throws error here and will not see later tests + if ( el.querySelectorAll( ":enabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: IE9-11+ + // IE's :disabled selector does not pick up the children of disabled fieldsets + docElem.appendChild( el ).disabled = true; + if ( el.querySelectorAll( ":disabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: Opera 10 - 11 only + // Opera 10-11 does not throw on post-comma invalid pseudos + el.querySelectorAll( "*,:x" ); + rbuggyQSA.push( ",.*:" ); + } ); + } + + if ( ( support.matchesSelector = rnative.test( ( matches = docElem.matches || + docElem.webkitMatchesSelector || + docElem.mozMatchesSelector || + docElem.oMatchesSelector || + docElem.msMatchesSelector ) ) ) ) { + + assert( function( el ) { + + // Check to see if it's possible to do matchesSelector + // on a disconnected node (IE 9) + support.disconnectedMatch = matches.call( el, "*" ); + + // This should fail with an exception + // Gecko does not error, returns false instead + matches.call( el, "[s!='']:x" ); + rbuggyMatches.push( "!=", pseudos ); + } ); + } + + rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join( "|" ) ); + rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join( "|" ) ); + + /* Contains + ---------------------------------------------------------------------- */ + hasCompare = rnative.test( docElem.compareDocumentPosition ); + + // Element contains another + // Purposefully self-exclusive + // As in, an element does not contain itself + contains = hasCompare || rnative.test( docElem.contains ) ? + function( a, b ) { + var adown = a.nodeType === 9 ? a.documentElement : a, + bup = b && b.parentNode; + return a === bup || !!( bup && bup.nodeType === 1 && ( + adown.contains ? + adown.contains( bup ) : + a.compareDocumentPosition && a.compareDocumentPosition( bup ) & 16 + ) ); + } : + function( a, b ) { + if ( b ) { + while ( ( b = b.parentNode ) ) { + if ( b === a ) { + return true; + } + } + } + return false; + }; + + /* Sorting + ---------------------------------------------------------------------- */ + + // Document order sorting + sortOrder = hasCompare ? + function( a, b ) { + + // Flag for duplicate removal + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + // Sort on method existence if only one input has compareDocumentPosition + var compare = !a.compareDocumentPosition - !b.compareDocumentPosition; + if ( compare ) { + return compare; + } + + // Calculate position if both inputs belong to the same document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + compare = ( a.ownerDocument || a ) == ( b.ownerDocument || b ) ? + a.compareDocumentPosition( b ) : + + // Otherwise we know they are disconnected + 1; + + // Disconnected nodes + if ( compare & 1 || + ( !support.sortDetached && b.compareDocumentPosition( a ) === compare ) ) { + + // Choose the first element that is related to our preferred document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( a == document || a.ownerDocument == preferredDoc && + contains( preferredDoc, a ) ) { + return -1; + } + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( b == document || b.ownerDocument == preferredDoc && + contains( preferredDoc, b ) ) { + return 1; + } + + // Maintain original order + return sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + } + + return compare & 4 ? -1 : 1; + } : + function( a, b ) { + + // Exit early if the nodes are identical + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + var cur, + i = 0, + aup = a.parentNode, + bup = b.parentNode, + ap = [ a ], + bp = [ b ]; + + // Parentless nodes are either documents or disconnected + if ( !aup || !bup ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + return a == document ? -1 : + b == document ? 1 : + /* eslint-enable eqeqeq */ + aup ? -1 : + bup ? 1 : + sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + + // If the nodes are siblings, we can do a quick check + } else if ( aup === bup ) { + return siblingCheck( a, b ); + } + + // Otherwise we need full lists of their ancestors for comparison + cur = a; + while ( ( cur = cur.parentNode ) ) { + ap.unshift( cur ); + } + cur = b; + while ( ( cur = cur.parentNode ) ) { + bp.unshift( cur ); + } + + // Walk down the tree looking for a discrepancy + while ( ap[ i ] === bp[ i ] ) { + i++; + } + + return i ? + + // Do a sibling check if the nodes have a common ancestor + siblingCheck( ap[ i ], bp[ i ] ) : + + // Otherwise nodes in our document sort first + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + ap[ i ] == preferredDoc ? -1 : + bp[ i ] == preferredDoc ? 1 : + /* eslint-enable eqeqeq */ + 0; + }; + + return document; +}; + +Sizzle.matches = function( expr, elements ) { + return Sizzle( expr, null, null, elements ); +}; + +Sizzle.matchesSelector = function( elem, expr ) { + setDocument( elem ); + + if ( support.matchesSelector && documentIsHTML && + !nonnativeSelectorCache[ expr + " " ] && + ( !rbuggyMatches || !rbuggyMatches.test( expr ) ) && + ( !rbuggyQSA || !rbuggyQSA.test( expr ) ) ) { + + try { + var ret = matches.call( elem, expr ); + + // IE 9's matchesSelector returns false on disconnected nodes + if ( ret || support.disconnectedMatch || + + // As well, disconnected nodes are said to be in a document + // fragment in IE 9 + elem.document && elem.document.nodeType !== 11 ) { + return ret; + } + } catch ( e ) { + nonnativeSelectorCache( expr, true ); + } + } + + return Sizzle( expr, document, null, [ elem ] ).length > 0; +}; + +Sizzle.contains = function( context, elem ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( context.ownerDocument || context ) != document ) { + setDocument( context ); + } + return contains( context, elem ); +}; + +Sizzle.attr = function( elem, name ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( elem.ownerDocument || elem ) != document ) { + setDocument( elem ); + } + + var fn = Expr.attrHandle[ name.toLowerCase() ], + + // Don't get fooled by Object.prototype properties (jQuery #13807) + val = fn && hasOwn.call( Expr.attrHandle, name.toLowerCase() ) ? + fn( elem, name, !documentIsHTML ) : + undefined; + + return val !== undefined ? + val : + support.attributes || !documentIsHTML ? + elem.getAttribute( name ) : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; +}; + +Sizzle.escape = function( sel ) { + return ( sel + "" ).replace( rcssescape, fcssescape ); +}; + +Sizzle.error = function( msg ) { + throw new Error( "Syntax error, unrecognized expression: " + msg ); +}; + +/** + * Document sorting and removing duplicates + * @param {ArrayLike} results + */ +Sizzle.uniqueSort = function( results ) { + var elem, + duplicates = [], + j = 0, + i = 0; + + // Unless we *know* we can detect duplicates, assume their presence + hasDuplicate = !support.detectDuplicates; + sortInput = !support.sortStable && results.slice( 0 ); + results.sort( sortOrder ); + + if ( hasDuplicate ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem === results[ i ] ) { + j = duplicates.push( i ); + } + } + while ( j-- ) { + results.splice( duplicates[ j ], 1 ); + } + } + + // Clear input after sorting to release objects + // See https://github.com/jquery/sizzle/pull/225 + sortInput = null; + + return results; +}; + +/** + * Utility function for retrieving the text value of an array of DOM nodes + * @param {Array|Element} elem + */ +getText = Sizzle.getText = function( elem ) { + var node, + ret = "", + i = 0, + nodeType = elem.nodeType; + + if ( !nodeType ) { + + // If no nodeType, this is expected to be an array + while ( ( node = elem[ i++ ] ) ) { + + // Do not traverse comment nodes + ret += getText( node ); + } + } else if ( nodeType === 1 || nodeType === 9 || nodeType === 11 ) { + + // Use textContent for elements + // innerText usage removed for consistency of new lines (jQuery #11153) + if ( typeof elem.textContent === "string" ) { + return elem.textContent; + } else { + + // Traverse its children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + ret += getText( elem ); + } + } + } else if ( nodeType === 3 || nodeType === 4 ) { + return elem.nodeValue; + } + + // Do not include comment or processing instruction nodes + + return ret; +}; + +Expr = Sizzle.selectors = { + + // Can be adjusted by the user + cacheLength: 50, + + createPseudo: markFunction, + + match: matchExpr, + + attrHandle: {}, + + find: {}, + + relative: { + ">": { dir: "parentNode", first: true }, + " ": { dir: "parentNode" }, + "+": { dir: "previousSibling", first: true }, + "~": { dir: "previousSibling" } + }, + + preFilter: { + "ATTR": function( match ) { + match[ 1 ] = match[ 1 ].replace( runescape, funescape ); + + // Move the given value to match[3] whether quoted or unquoted + match[ 3 ] = ( match[ 3 ] || match[ 4 ] || + match[ 5 ] || "" ).replace( runescape, funescape ); + + if ( match[ 2 ] === "~=" ) { + match[ 3 ] = " " + match[ 3 ] + " "; + } + + return match.slice( 0, 4 ); + }, + + "CHILD": function( match ) { + + /* matches from matchExpr["CHILD"] + 1 type (only|nth|...) + 2 what (child|of-type) + 3 argument (even|odd|\d*|\d*n([+-]\d+)?|...) + 4 xn-component of xn+y argument ([+-]?\d*n|) + 5 sign of xn-component + 6 x of xn-component + 7 sign of y-component + 8 y of y-component + */ + match[ 1 ] = match[ 1 ].toLowerCase(); + + if ( match[ 1 ].slice( 0, 3 ) === "nth" ) { + + // nth-* requires argument + if ( !match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + // numeric x and y parameters for Expr.filter.CHILD + // remember that false/true cast respectively to 0/1 + match[ 4 ] = +( match[ 4 ] ? + match[ 5 ] + ( match[ 6 ] || 1 ) : + 2 * ( match[ 3 ] === "even" || match[ 3 ] === "odd" ) ); + match[ 5 ] = +( ( match[ 7 ] + match[ 8 ] ) || match[ 3 ] === "odd" ); + + // other types prohibit arguments + } else if ( match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + return match; + }, + + "PSEUDO": function( match ) { + var excess, + unquoted = !match[ 6 ] && match[ 2 ]; + + if ( matchExpr[ "CHILD" ].test( match[ 0 ] ) ) { + return null; + } + + // Accept quoted arguments as-is + if ( match[ 3 ] ) { + match[ 2 ] = match[ 4 ] || match[ 5 ] || ""; + + // Strip excess characters from unquoted arguments + } else if ( unquoted && rpseudo.test( unquoted ) && + + // Get excess from tokenize (recursively) + ( excess = tokenize( unquoted, true ) ) && + + // advance to the next closing parenthesis + ( excess = unquoted.indexOf( ")", unquoted.length - excess ) - unquoted.length ) ) { + + // excess is a negative index + match[ 0 ] = match[ 0 ].slice( 0, excess ); + match[ 2 ] = unquoted.slice( 0, excess ); + } + + // Return only captures needed by the pseudo filter method (type and argument) + return match.slice( 0, 3 ); + } + }, + + filter: { + + "TAG": function( nodeNameSelector ) { + var nodeName = nodeNameSelector.replace( runescape, funescape ).toLowerCase(); + return nodeNameSelector === "*" ? + function() { + return true; + } : + function( elem ) { + return elem.nodeName && elem.nodeName.toLowerCase() === nodeName; + }; + }, + + "CLASS": function( className ) { + var pattern = classCache[ className + " " ]; + + return pattern || + ( pattern = new RegExp( "(^|" + whitespace + + ")" + className + "(" + whitespace + "|$)" ) ) && classCache( + className, function( elem ) { + return pattern.test( + typeof elem.className === "string" && elem.className || + typeof elem.getAttribute !== "undefined" && + elem.getAttribute( "class" ) || + "" + ); + } ); + }, + + "ATTR": function( name, operator, check ) { + return function( elem ) { + var result = Sizzle.attr( elem, name ); + + if ( result == null ) { + return operator === "!="; + } + if ( !operator ) { + return true; + } + + result += ""; + + /* eslint-disable max-len */ + + return operator === "=" ? result === check : + operator === "!=" ? result !== check : + operator === "^=" ? check && result.indexOf( check ) === 0 : + operator === "*=" ? check && result.indexOf( check ) > -1 : + operator === "$=" ? check && result.slice( -check.length ) === check : + operator === "~=" ? ( " " + result.replace( rwhitespace, " " ) + " " ).indexOf( check ) > -1 : + operator === "|=" ? result === check || result.slice( 0, check.length + 1 ) === check + "-" : + false; + /* eslint-enable max-len */ + + }; + }, + + "CHILD": function( type, what, _argument, first, last ) { + var simple = type.slice( 0, 3 ) !== "nth", + forward = type.slice( -4 ) !== "last", + ofType = what === "of-type"; + + return first === 1 && last === 0 ? + + // Shortcut for :nth-*(n) + function( elem ) { + return !!elem.parentNode; + } : + + function( elem, _context, xml ) { + var cache, uniqueCache, outerCache, node, nodeIndex, start, + dir = simple !== forward ? "nextSibling" : "previousSibling", + parent = elem.parentNode, + name = ofType && elem.nodeName.toLowerCase(), + useCache = !xml && !ofType, + diff = false; + + if ( parent ) { + + // :(first|last|only)-(child|of-type) + if ( simple ) { + while ( dir ) { + node = elem; + while ( ( node = node[ dir ] ) ) { + if ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) { + + return false; + } + } + + // Reverse direction for :only-* (if we haven't yet done so) + start = dir = type === "only" && !start && "nextSibling"; + } + return true; + } + + start = [ forward ? parent.firstChild : parent.lastChild ]; + + // non-xml :nth-child(...) stores cache data on `parent` + if ( forward && useCache ) { + + // Seek `elem` from a previously-cached index + + // ...in a gzip-friendly way + node = parent; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex && cache[ 2 ]; + node = nodeIndex && parent.childNodes[ nodeIndex ]; + + while ( ( node = ++nodeIndex && node && node[ dir ] || + + // Fallback to seeking `elem` from the start + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + // When found, cache indexes on `parent` and break + if ( node.nodeType === 1 && ++diff && node === elem ) { + uniqueCache[ type ] = [ dirruns, nodeIndex, diff ]; + break; + } + } + + } else { + + // Use previously-cached element index if available + if ( useCache ) { + + // ...in a gzip-friendly way + node = elem; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex; + } + + // xml :nth-child(...) + // or :nth-last-child(...) or :nth(-last)?-of-type(...) + if ( diff === false ) { + + // Use the same loop as above to seek `elem` from the start + while ( ( node = ++nodeIndex && node && node[ dir ] || + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + if ( ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) && + ++diff ) { + + // Cache the index of each encountered element + if ( useCache ) { + outerCache = node[ expando ] || + ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + uniqueCache[ type ] = [ dirruns, diff ]; + } + + if ( node === elem ) { + break; + } + } + } + } + } + + // Incorporate the offset, then check against cycle size + diff -= last; + return diff === first || ( diff % first === 0 && diff / first >= 0 ); + } + }; + }, + + "PSEUDO": function( pseudo, argument ) { + + // pseudo-class names are case-insensitive + // http://www.w3.org/TR/selectors/#pseudo-classes + // Prioritize by case sensitivity in case custom pseudos are added with uppercase letters + // Remember that setFilters inherits from pseudos + var args, + fn = Expr.pseudos[ pseudo ] || Expr.setFilters[ pseudo.toLowerCase() ] || + Sizzle.error( "unsupported pseudo: " + pseudo ); + + // The user may use createPseudo to indicate that + // arguments are needed to create the filter function + // just as Sizzle does + if ( fn[ expando ] ) { + return fn( argument ); + } + + // But maintain support for old signatures + if ( fn.length > 1 ) { + args = [ pseudo, pseudo, "", argument ]; + return Expr.setFilters.hasOwnProperty( pseudo.toLowerCase() ) ? + markFunction( function( seed, matches ) { + var idx, + matched = fn( seed, argument ), + i = matched.length; + while ( i-- ) { + idx = indexOf( seed, matched[ i ] ); + seed[ idx ] = !( matches[ idx ] = matched[ i ] ); + } + } ) : + function( elem ) { + return fn( elem, 0, args ); + }; + } + + return fn; + } + }, + + pseudos: { + + // Potentially complex pseudos + "not": markFunction( function( selector ) { + + // Trim the selector passed to compile + // to avoid treating leading and trailing + // spaces as combinators + var input = [], + results = [], + matcher = compile( selector.replace( rtrim, "$1" ) ); + + return matcher[ expando ] ? + markFunction( function( seed, matches, _context, xml ) { + var elem, + unmatched = matcher( seed, null, xml, [] ), + i = seed.length; + + // Match elements unmatched by `matcher` + while ( i-- ) { + if ( ( elem = unmatched[ i ] ) ) { + seed[ i ] = !( matches[ i ] = elem ); + } + } + } ) : + function( elem, _context, xml ) { + input[ 0 ] = elem; + matcher( input, null, xml, results ); + + // Don't keep the element (issue #299) + input[ 0 ] = null; + return !results.pop(); + }; + } ), + + "has": markFunction( function( selector ) { + return function( elem ) { + return Sizzle( selector, elem ).length > 0; + }; + } ), + + "contains": markFunction( function( text ) { + text = text.replace( runescape, funescape ); + return function( elem ) { + return ( elem.textContent || getText( elem ) ).indexOf( text ) > -1; + }; + } ), + + // "Whether an element is represented by a :lang() selector + // is based solely on the element's language value + // being equal to the identifier C, + // or beginning with the identifier C immediately followed by "-". + // The matching of C against the element's language value is performed case-insensitively. + // The identifier C does not have to be a valid language name." + // http://www.w3.org/TR/selectors/#lang-pseudo + "lang": markFunction( function( lang ) { + + // lang value must be a valid identifier + if ( !ridentifier.test( lang || "" ) ) { + Sizzle.error( "unsupported lang: " + lang ); + } + lang = lang.replace( runescape, funescape ).toLowerCase(); + return function( elem ) { + var elemLang; + do { + if ( ( elemLang = documentIsHTML ? + elem.lang : + elem.getAttribute( "xml:lang" ) || elem.getAttribute( "lang" ) ) ) { + + elemLang = elemLang.toLowerCase(); + return elemLang === lang || elemLang.indexOf( lang + "-" ) === 0; + } + } while ( ( elem = elem.parentNode ) && elem.nodeType === 1 ); + return false; + }; + } ), + + // Miscellaneous + "target": function( elem ) { + var hash = window.location && window.location.hash; + return hash && hash.slice( 1 ) === elem.id; + }, + + "root": function( elem ) { + return elem === docElem; + }, + + "focus": function( elem ) { + return elem === document.activeElement && + ( !document.hasFocus || document.hasFocus() ) && + !!( elem.type || elem.href || ~elem.tabIndex ); + }, + + // Boolean properties + "enabled": createDisabledPseudo( false ), + "disabled": createDisabledPseudo( true ), + + "checked": function( elem ) { + + // In CSS3, :checked should return both checked and selected elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + var nodeName = elem.nodeName.toLowerCase(); + return ( nodeName === "input" && !!elem.checked ) || + ( nodeName === "option" && !!elem.selected ); + }, + + "selected": function( elem ) { + + // Accessing this property makes selected-by-default + // options in Safari work properly + if ( elem.parentNode ) { + // eslint-disable-next-line no-unused-expressions + elem.parentNode.selectedIndex; + } + + return elem.selected === true; + }, + + // Contents + "empty": function( elem ) { + + // http://www.w3.org/TR/selectors/#empty-pseudo + // :empty is negated by element (1) or content nodes (text: 3; cdata: 4; entity ref: 5), + // but not by others (comment: 8; processing instruction: 7; etc.) + // nodeType < 6 works because attributes (2) do not appear as children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + if ( elem.nodeType < 6 ) { + return false; + } + } + return true; + }, + + "parent": function( elem ) { + return !Expr.pseudos[ "empty" ]( elem ); + }, + + // Element/input types + "header": function( elem ) { + return rheader.test( elem.nodeName ); + }, + + "input": function( elem ) { + return rinputs.test( elem.nodeName ); + }, + + "button": function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === "button" || name === "button"; + }, + + "text": function( elem ) { + var attr; + return elem.nodeName.toLowerCase() === "input" && + elem.type === "text" && + + // Support: IE<8 + // New HTML5 attribute values (e.g., "search") appear with elem.type === "text" + ( ( attr = elem.getAttribute( "type" ) ) == null || + attr.toLowerCase() === "text" ); + }, + + // Position-in-collection + "first": createPositionalPseudo( function() { + return [ 0 ]; + } ), + + "last": createPositionalPseudo( function( _matchIndexes, length ) { + return [ length - 1 ]; + } ), + + "eq": createPositionalPseudo( function( _matchIndexes, length, argument ) { + return [ argument < 0 ? argument + length : argument ]; + } ), + + "even": createPositionalPseudo( function( matchIndexes, length ) { + var i = 0; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "odd": createPositionalPseudo( function( matchIndexes, length ) { + var i = 1; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "lt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? + argument + length : + argument > length ? + length : + argument; + for ( ; --i >= 0; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "gt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? argument + length : argument; + for ( ; ++i < length; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ) + } +}; + +Expr.pseudos[ "nth" ] = Expr.pseudos[ "eq" ]; + +// Add button/input type pseudos +for ( i in { radio: true, checkbox: true, file: true, password: true, image: true } ) { + Expr.pseudos[ i ] = createInputPseudo( i ); +} +for ( i in { submit: true, reset: true } ) { + Expr.pseudos[ i ] = createButtonPseudo( i ); +} + +// Easy API for creating new setFilters +function setFilters() {} +setFilters.prototype = Expr.filters = Expr.pseudos; +Expr.setFilters = new setFilters(); + +tokenize = Sizzle.tokenize = function( selector, parseOnly ) { + var matched, match, tokens, type, + soFar, groups, preFilters, + cached = tokenCache[ selector + " " ]; + + if ( cached ) { + return parseOnly ? 0 : cached.slice( 0 ); + } + + soFar = selector; + groups = []; + preFilters = Expr.preFilter; + + while ( soFar ) { + + // Comma and first run + if ( !matched || ( match = rcomma.exec( soFar ) ) ) { + if ( match ) { + + // Don't consume trailing commas as valid + soFar = soFar.slice( match[ 0 ].length ) || soFar; + } + groups.push( ( tokens = [] ) ); + } + + matched = false; + + // Combinators + if ( ( match = rcombinators.exec( soFar ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + + // Cast descendant combinators to space + type: match[ 0 ].replace( rtrim, " " ) + } ); + soFar = soFar.slice( matched.length ); + } + + // Filters + for ( type in Expr.filter ) { + if ( ( match = matchExpr[ type ].exec( soFar ) ) && ( !preFilters[ type ] || + ( match = preFilters[ type ]( match ) ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + type: type, + matches: match + } ); + soFar = soFar.slice( matched.length ); + } + } + + if ( !matched ) { + break; + } + } + + // Return the length of the invalid excess + // if we're just parsing + // Otherwise, throw an error or return tokens + return parseOnly ? + soFar.length : + soFar ? + Sizzle.error( selector ) : + + // Cache the tokens + tokenCache( selector, groups ).slice( 0 ); +}; + +function toSelector( tokens ) { + var i = 0, + len = tokens.length, + selector = ""; + for ( ; i < len; i++ ) { + selector += tokens[ i ].value; + } + return selector; +} + +function addCombinator( matcher, combinator, base ) { + var dir = combinator.dir, + skip = combinator.next, + key = skip || dir, + checkNonElements = base && key === "parentNode", + doneName = done++; + + return combinator.first ? + + // Check against closest ancestor/preceding element + function( elem, context, xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + return matcher( elem, context, xml ); + } + } + return false; + } : + + // Check against all ancestor/preceding elements + function( elem, context, xml ) { + var oldCache, uniqueCache, outerCache, + newCache = [ dirruns, doneName ]; + + // We can't set arbitrary data on XML nodes, so they don't benefit from combinator caching + if ( xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + if ( matcher( elem, context, xml ) ) { + return true; + } + } + } + } else { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + outerCache = elem[ expando ] || ( elem[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ elem.uniqueID ] || + ( outerCache[ elem.uniqueID ] = {} ); + + if ( skip && skip === elem.nodeName.toLowerCase() ) { + elem = elem[ dir ] || elem; + } else if ( ( oldCache = uniqueCache[ key ] ) && + oldCache[ 0 ] === dirruns && oldCache[ 1 ] === doneName ) { + + // Assign to newCache so results back-propagate to previous elements + return ( newCache[ 2 ] = oldCache[ 2 ] ); + } else { + + // Reuse newcache so results back-propagate to previous elements + uniqueCache[ key ] = newCache; + + // A match means we're done; a fail means we have to keep checking + if ( ( newCache[ 2 ] = matcher( elem, context, xml ) ) ) { + return true; + } + } + } + } + } + return false; + }; +} + +function elementMatcher( matchers ) { + return matchers.length > 1 ? + function( elem, context, xml ) { + var i = matchers.length; + while ( i-- ) { + if ( !matchers[ i ]( elem, context, xml ) ) { + return false; + } + } + return true; + } : + matchers[ 0 ]; +} + +function multipleContexts( selector, contexts, results ) { + var i = 0, + len = contexts.length; + for ( ; i < len; i++ ) { + Sizzle( selector, contexts[ i ], results ); + } + return results; +} + +function condense( unmatched, map, filter, context, xml ) { + var elem, + newUnmatched = [], + i = 0, + len = unmatched.length, + mapped = map != null; + + for ( ; i < len; i++ ) { + if ( ( elem = unmatched[ i ] ) ) { + if ( !filter || filter( elem, context, xml ) ) { + newUnmatched.push( elem ); + if ( mapped ) { + map.push( i ); + } + } + } + } + + return newUnmatched; +} + +function setMatcher( preFilter, selector, matcher, postFilter, postFinder, postSelector ) { + if ( postFilter && !postFilter[ expando ] ) { + postFilter = setMatcher( postFilter ); + } + if ( postFinder && !postFinder[ expando ] ) { + postFinder = setMatcher( postFinder, postSelector ); + } + return markFunction( function( seed, results, context, xml ) { + var temp, i, elem, + preMap = [], + postMap = [], + preexisting = results.length, + + // Get initial elements from seed or context + elems = seed || multipleContexts( + selector || "*", + context.nodeType ? [ context ] : context, + [] + ), + + // Prefilter to get matcher input, preserving a map for seed-results synchronization + matcherIn = preFilter && ( seed || !selector ) ? + condense( elems, preMap, preFilter, context, xml ) : + elems, + + matcherOut = matcher ? + + // If we have a postFinder, or filtered seed, or non-seed postFilter or preexisting results, + postFinder || ( seed ? preFilter : preexisting || postFilter ) ? + + // ...intermediate processing is necessary + [] : + + // ...otherwise use results directly + results : + matcherIn; + + // Find primary matches + if ( matcher ) { + matcher( matcherIn, matcherOut, context, xml ); + } + + // Apply postFilter + if ( postFilter ) { + temp = condense( matcherOut, postMap ); + postFilter( temp, [], context, xml ); + + // Un-match failing elements by moving them back to matcherIn + i = temp.length; + while ( i-- ) { + if ( ( elem = temp[ i ] ) ) { + matcherOut[ postMap[ i ] ] = !( matcherIn[ postMap[ i ] ] = elem ); + } + } + } + + if ( seed ) { + if ( postFinder || preFilter ) { + if ( postFinder ) { + + // Get the final matcherOut by condensing this intermediate into postFinder contexts + temp = []; + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) ) { + + // Restore matcherIn since elem is not yet a final match + temp.push( ( matcherIn[ i ] = elem ) ); + } + } + postFinder( null, ( matcherOut = [] ), temp, xml ); + } + + // Move matched elements from seed to results to keep them synchronized + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) && + ( temp = postFinder ? indexOf( seed, elem ) : preMap[ i ] ) > -1 ) { + + seed[ temp ] = !( results[ temp ] = elem ); + } + } + } + + // Add elements to results, through postFinder if defined + } else { + matcherOut = condense( + matcherOut === results ? + matcherOut.splice( preexisting, matcherOut.length ) : + matcherOut + ); + if ( postFinder ) { + postFinder( null, results, matcherOut, xml ); + } else { + push.apply( results, matcherOut ); + } + } + } ); +} + +function matcherFromTokens( tokens ) { + var checkContext, matcher, j, + len = tokens.length, + leadingRelative = Expr.relative[ tokens[ 0 ].type ], + implicitRelative = leadingRelative || Expr.relative[ " " ], + i = leadingRelative ? 1 : 0, + + // The foundational matcher ensures that elements are reachable from top-level context(s) + matchContext = addCombinator( function( elem ) { + return elem === checkContext; + }, implicitRelative, true ), + matchAnyContext = addCombinator( function( elem ) { + return indexOf( checkContext, elem ) > -1; + }, implicitRelative, true ), + matchers = [ function( elem, context, xml ) { + var ret = ( !leadingRelative && ( xml || context !== outermostContext ) ) || ( + ( checkContext = context ).nodeType ? + matchContext( elem, context, xml ) : + matchAnyContext( elem, context, xml ) ); + + // Avoid hanging onto element (issue #299) + checkContext = null; + return ret; + } ]; + + for ( ; i < len; i++ ) { + if ( ( matcher = Expr.relative[ tokens[ i ].type ] ) ) { + matchers = [ addCombinator( elementMatcher( matchers ), matcher ) ]; + } else { + matcher = Expr.filter[ tokens[ i ].type ].apply( null, tokens[ i ].matches ); + + // Return special upon seeing a positional matcher + if ( matcher[ expando ] ) { + + // Find the next relative operator (if any) for proper handling + j = ++i; + for ( ; j < len; j++ ) { + if ( Expr.relative[ tokens[ j ].type ] ) { + break; + } + } + return setMatcher( + i > 1 && elementMatcher( matchers ), + i > 1 && toSelector( + + // If the preceding token was a descendant combinator, insert an implicit any-element `*` + tokens + .slice( 0, i - 1 ) + .concat( { value: tokens[ i - 2 ].type === " " ? "*" : "" } ) + ).replace( rtrim, "$1" ), + matcher, + i < j && matcherFromTokens( tokens.slice( i, j ) ), + j < len && matcherFromTokens( ( tokens = tokens.slice( j ) ) ), + j < len && toSelector( tokens ) + ); + } + matchers.push( matcher ); + } + } + + return elementMatcher( matchers ); +} + +function matcherFromGroupMatchers( elementMatchers, setMatchers ) { + var bySet = setMatchers.length > 0, + byElement = elementMatchers.length > 0, + superMatcher = function( seed, context, xml, results, outermost ) { + var elem, j, matcher, + matchedCount = 0, + i = "0", + unmatched = seed && [], + setMatched = [], + contextBackup = outermostContext, + + // We must always have either seed elements or outermost context + elems = seed || byElement && Expr.find[ "TAG" ]( "*", outermost ), + + // Use integer dirruns iff this is the outermost matcher + dirrunsUnique = ( dirruns += contextBackup == null ? 1 : Math.random() || 0.1 ), + len = elems.length; + + if ( outermost ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + outermostContext = context == document || context || outermost; + } + + // Add elements passing elementMatchers directly to results + // Support: IE<9, Safari + // Tolerate NodeList properties (IE: "length"; Safari: ) matching elements by id + for ( ; i !== len && ( elem = elems[ i ] ) != null; i++ ) { + if ( byElement && elem ) { + j = 0; + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( !context && elem.ownerDocument != document ) { + setDocument( elem ); + xml = !documentIsHTML; + } + while ( ( matcher = elementMatchers[ j++ ] ) ) { + if ( matcher( elem, context || document, xml ) ) { + results.push( elem ); + break; + } + } + if ( outermost ) { + dirruns = dirrunsUnique; + } + } + + // Track unmatched elements for set filters + if ( bySet ) { + + // They will have gone through all possible matchers + if ( ( elem = !matcher && elem ) ) { + matchedCount--; + } + + // Lengthen the array for every element, matched or not + if ( seed ) { + unmatched.push( elem ); + } + } + } + + // `i` is now the count of elements visited above, and adding it to `matchedCount` + // makes the latter nonnegative. + matchedCount += i; + + // Apply set filters to unmatched elements + // NOTE: This can be skipped if there are no unmatched elements (i.e., `matchedCount` + // equals `i`), unless we didn't visit _any_ elements in the above loop because we have + // no element matchers and no seed. + // Incrementing an initially-string "0" `i` allows `i` to remain a string only in that + // case, which will result in a "00" `matchedCount` that differs from `i` but is also + // numerically zero. + if ( bySet && i !== matchedCount ) { + j = 0; + while ( ( matcher = setMatchers[ j++ ] ) ) { + matcher( unmatched, setMatched, context, xml ); + } + + if ( seed ) { + + // Reintegrate element matches to eliminate the need for sorting + if ( matchedCount > 0 ) { + while ( i-- ) { + if ( !( unmatched[ i ] || setMatched[ i ] ) ) { + setMatched[ i ] = pop.call( results ); + } + } + } + + // Discard index placeholder values to get only actual matches + setMatched = condense( setMatched ); + } + + // Add matches to results + push.apply( results, setMatched ); + + // Seedless set matches succeeding multiple successful matchers stipulate sorting + if ( outermost && !seed && setMatched.length > 0 && + ( matchedCount + setMatchers.length ) > 1 ) { + + Sizzle.uniqueSort( results ); + } + } + + // Override manipulation of globals by nested matchers + if ( outermost ) { + dirruns = dirrunsUnique; + outermostContext = contextBackup; + } + + return unmatched; + }; + + return bySet ? + markFunction( superMatcher ) : + superMatcher; +} + +compile = Sizzle.compile = function( selector, match /* Internal Use Only */ ) { + var i, + setMatchers = [], + elementMatchers = [], + cached = compilerCache[ selector + " " ]; + + if ( !cached ) { + + // Generate a function of recursive functions that can be used to check each element + if ( !match ) { + match = tokenize( selector ); + } + i = match.length; + while ( i-- ) { + cached = matcherFromTokens( match[ i ] ); + if ( cached[ expando ] ) { + setMatchers.push( cached ); + } else { + elementMatchers.push( cached ); + } + } + + // Cache the compiled function + cached = compilerCache( + selector, + matcherFromGroupMatchers( elementMatchers, setMatchers ) + ); + + // Save selector and tokenization + cached.selector = selector; + } + return cached; +}; + +/** + * A low-level selection function that works with Sizzle's compiled + * selector functions + * @param {String|Function} selector A selector or a pre-compiled + * selector function built with Sizzle.compile + * @param {Element} context + * @param {Array} [results] + * @param {Array} [seed] A set of elements to match against + */ +select = Sizzle.select = function( selector, context, results, seed ) { + var i, tokens, token, type, find, + compiled = typeof selector === "function" && selector, + match = !seed && tokenize( ( selector = compiled.selector || selector ) ); + + results = results || []; + + // Try to minimize operations if there is only one selector in the list and no seed + // (the latter of which guarantees us context) + if ( match.length === 1 ) { + + // Reduce context if the leading compound selector is an ID + tokens = match[ 0 ] = match[ 0 ].slice( 0 ); + if ( tokens.length > 2 && ( token = tokens[ 0 ] ).type === "ID" && + context.nodeType === 9 && documentIsHTML && Expr.relative[ tokens[ 1 ].type ] ) { + + context = ( Expr.find[ "ID" ]( token.matches[ 0 ] + .replace( runescape, funescape ), context ) || [] )[ 0 ]; + if ( !context ) { + return results; + + // Precompiled matchers will still verify ancestry, so step up a level + } else if ( compiled ) { + context = context.parentNode; + } + + selector = selector.slice( tokens.shift().value.length ); + } + + // Fetch a seed set for right-to-left matching + i = matchExpr[ "needsContext" ].test( selector ) ? 0 : tokens.length; + while ( i-- ) { + token = tokens[ i ]; + + // Abort if we hit a combinator + if ( Expr.relative[ ( type = token.type ) ] ) { + break; + } + if ( ( find = Expr.find[ type ] ) ) { + + // Search, expanding context for leading sibling combinators + if ( ( seed = find( + token.matches[ 0 ].replace( runescape, funescape ), + rsibling.test( tokens[ 0 ].type ) && testContext( context.parentNode ) || + context + ) ) ) { + + // If seed is empty or no tokens remain, we can return early + tokens.splice( i, 1 ); + selector = seed.length && toSelector( tokens ); + if ( !selector ) { + push.apply( results, seed ); + return results; + } + + break; + } + } + } + } + + // Compile and execute a filtering function if one is not provided + // Provide `match` to avoid retokenization if we modified the selector above + ( compiled || compile( selector, match ) )( + seed, + context, + !documentIsHTML, + results, + !context || rsibling.test( selector ) && testContext( context.parentNode ) || context + ); + return results; +}; + +// One-time assignments + +// Sort stability +support.sortStable = expando.split( "" ).sort( sortOrder ).join( "" ) === expando; + +// Support: Chrome 14-35+ +// Always assume duplicates if they aren't passed to the comparison function +support.detectDuplicates = !!hasDuplicate; + +// Initialize against the default document +setDocument(); + +// Support: Webkit<537.32 - Safari 6.0.3/Chrome 25 (fixed in Chrome 27) +// Detached nodes confoundingly follow *each other* +support.sortDetached = assert( function( el ) { + + // Should return 1, but returns 4 (following) + return el.compareDocumentPosition( document.createElement( "fieldset" ) ) & 1; +} ); + +// Support: IE<8 +// Prevent attribute/property "interpolation" +// https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx +if ( !assert( function( el ) { + el.innerHTML = ""; + return el.firstChild.getAttribute( "href" ) === "#"; +} ) ) { + addHandle( "type|href|height|width", function( elem, name, isXML ) { + if ( !isXML ) { + return elem.getAttribute( name, name.toLowerCase() === "type" ? 1 : 2 ); + } + } ); +} + +// Support: IE<9 +// Use defaultValue in place of getAttribute("value") +if ( !support.attributes || !assert( function( el ) { + el.innerHTML = ""; + el.firstChild.setAttribute( "value", "" ); + return el.firstChild.getAttribute( "value" ) === ""; +} ) ) { + addHandle( "value", function( elem, _name, isXML ) { + if ( !isXML && elem.nodeName.toLowerCase() === "input" ) { + return elem.defaultValue; + } + } ); +} + +// Support: IE<9 +// Use getAttributeNode to fetch booleans when getAttribute lies +if ( !assert( function( el ) { + return el.getAttribute( "disabled" ) == null; +} ) ) { + addHandle( booleans, function( elem, name, isXML ) { + var val; + if ( !isXML ) { + return elem[ name ] === true ? name.toLowerCase() : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; + } + } ); +} + +return Sizzle; + +} )( window ); + + + +jQuery.find = Sizzle; +jQuery.expr = Sizzle.selectors; + +// Deprecated +jQuery.expr[ ":" ] = jQuery.expr.pseudos; +jQuery.uniqueSort = jQuery.unique = Sizzle.uniqueSort; +jQuery.text = Sizzle.getText; +jQuery.isXMLDoc = Sizzle.isXML; +jQuery.contains = Sizzle.contains; +jQuery.escapeSelector = Sizzle.escape; + + + + +var dir = function( elem, dir, until ) { + var matched = [], + truncate = until !== undefined; + + while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { + if ( elem.nodeType === 1 ) { + if ( truncate && jQuery( elem ).is( until ) ) { + break; + } + matched.push( elem ); + } + } + return matched; +}; + + +var siblings = function( n, elem ) { + var matched = []; + + for ( ; n; n = n.nextSibling ) { + if ( n.nodeType === 1 && n !== elem ) { + matched.push( n ); + } + } + + return matched; +}; + + +var rneedsContext = jQuery.expr.match.needsContext; + + + +function nodeName( elem, name ) { + + return elem.nodeName && elem.nodeName.toLowerCase() === name.toLowerCase(); + +} +var rsingleTag = ( /^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i ); + + + +// Implement the identical functionality for filter and not +function winnow( elements, qualifier, not ) { + if ( isFunction( qualifier ) ) { + return jQuery.grep( elements, function( elem, i ) { + return !!qualifier.call( elem, i, elem ) !== not; + } ); + } + + // Single element + if ( qualifier.nodeType ) { + return jQuery.grep( elements, function( elem ) { + return ( elem === qualifier ) !== not; + } ); + } + + // Arraylike of elements (jQuery, arguments, Array) + if ( typeof qualifier !== "string" ) { + return jQuery.grep( elements, function( elem ) { + return ( indexOf.call( qualifier, elem ) > -1 ) !== not; + } ); + } + + // Filtered directly for both simple and complex selectors + return jQuery.filter( qualifier, elements, not ); +} + +jQuery.filter = function( expr, elems, not ) { + var elem = elems[ 0 ]; + + if ( not ) { + expr = ":not(" + expr + ")"; + } + + if ( elems.length === 1 && elem.nodeType === 1 ) { + return jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : []; + } + + return jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { + return elem.nodeType === 1; + } ) ); +}; + +jQuery.fn.extend( { + find: function( selector ) { + var i, ret, + len = this.length, + self = this; + + if ( typeof selector !== "string" ) { + return this.pushStack( jQuery( selector ).filter( function() { + for ( i = 0; i < len; i++ ) { + if ( jQuery.contains( self[ i ], this ) ) { + return true; + } + } + } ) ); + } + + ret = this.pushStack( [] ); + + for ( i = 0; i < len; i++ ) { + jQuery.find( selector, self[ i ], ret ); + } + + return len > 1 ? jQuery.uniqueSort( ret ) : ret; + }, + filter: function( selector ) { + return this.pushStack( winnow( this, selector || [], false ) ); + }, + not: function( selector ) { + return this.pushStack( winnow( this, selector || [], true ) ); + }, + is: function( selector ) { + return !!winnow( + this, + + // If this is a positional/relative selector, check membership in the returned set + // so $("p:first").is("p:last") won't return true for a doc with two "p". + typeof selector === "string" && rneedsContext.test( selector ) ? + jQuery( selector ) : + selector || [], + false + ).length; + } +} ); + + +// Initialize a jQuery object + + +// A central reference to the root jQuery(document) +var rootjQuery, + + // A simple way to check for HTML strings + // Prioritize #id over to avoid XSS via location.hash (#9521) + // Strict HTML recognition (#11290: must start with <) + // Shortcut simple #id case for speed + rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/, + + init = jQuery.fn.init = function( selector, context, root ) { + var match, elem; + + // HANDLE: $(""), $(null), $(undefined), $(false) + if ( !selector ) { + return this; + } + + // Method init() accepts an alternate rootjQuery + // so migrate can support jQuery.sub (gh-2101) + root = root || rootjQuery; + + // Handle HTML strings + if ( typeof selector === "string" ) { + if ( selector[ 0 ] === "<" && + selector[ selector.length - 1 ] === ">" && + selector.length >= 3 ) { + + // Assume that strings that start and end with <> are HTML and skip the regex check + match = [ null, selector, null ]; + + } else { + match = rquickExpr.exec( selector ); + } + + // Match html or make sure no context is specified for #id + if ( match && ( match[ 1 ] || !context ) ) { + + // HANDLE: $(html) -> $(array) + if ( match[ 1 ] ) { + context = context instanceof jQuery ? context[ 0 ] : context; + + // Option to run scripts is true for back-compat + // Intentionally let the error be thrown if parseHTML is not present + jQuery.merge( this, jQuery.parseHTML( + match[ 1 ], + context && context.nodeType ? context.ownerDocument || context : document, + true + ) ); + + // HANDLE: $(html, props) + if ( rsingleTag.test( match[ 1 ] ) && jQuery.isPlainObject( context ) ) { + for ( match in context ) { + + // Properties of context are called as methods if possible + if ( isFunction( this[ match ] ) ) { + this[ match ]( context[ match ] ); + + // ...and otherwise set as attributes + } else { + this.attr( match, context[ match ] ); + } + } + } + + return this; + + // HANDLE: $(#id) + } else { + elem = document.getElementById( match[ 2 ] ); + + if ( elem ) { + + // Inject the element directly into the jQuery object + this[ 0 ] = elem; + this.length = 1; + } + return this; + } + + // HANDLE: $(expr, $(...)) + } else if ( !context || context.jquery ) { + return ( context || root ).find( selector ); + + // HANDLE: $(expr, context) + // (which is just equivalent to: $(context).find(expr) + } else { + return this.constructor( context ).find( selector ); + } + + // HANDLE: $(DOMElement) + } else if ( selector.nodeType ) { + this[ 0 ] = selector; + this.length = 1; + return this; + + // HANDLE: $(function) + // Shortcut for document ready + } else if ( isFunction( selector ) ) { + return root.ready !== undefined ? + root.ready( selector ) : + + // Execute immediately if ready is not present + selector( jQuery ); + } + + return jQuery.makeArray( selector, this ); + }; + +// Give the init function the jQuery prototype for later instantiation +init.prototype = jQuery.fn; + +// Initialize central reference +rootjQuery = jQuery( document ); + + +var rparentsprev = /^(?:parents|prev(?:Until|All))/, + + // Methods guaranteed to produce a unique set when starting from a unique set + guaranteedUnique = { + children: true, + contents: true, + next: true, + prev: true + }; + +jQuery.fn.extend( { + has: function( target ) { + var targets = jQuery( target, this ), + l = targets.length; + + return this.filter( function() { + var i = 0; + for ( ; i < l; i++ ) { + if ( jQuery.contains( this, targets[ i ] ) ) { + return true; + } + } + } ); + }, + + closest: function( selectors, context ) { + var cur, + i = 0, + l = this.length, + matched = [], + targets = typeof selectors !== "string" && jQuery( selectors ); + + // Positional selectors never match, since there's no _selection_ context + if ( !rneedsContext.test( selectors ) ) { + for ( ; i < l; i++ ) { + for ( cur = this[ i ]; cur && cur !== context; cur = cur.parentNode ) { + + // Always skip document fragments + if ( cur.nodeType < 11 && ( targets ? + targets.index( cur ) > -1 : + + // Don't pass non-elements to Sizzle + cur.nodeType === 1 && + jQuery.find.matchesSelector( cur, selectors ) ) ) { + + matched.push( cur ); + break; + } + } + } + } + + return this.pushStack( matched.length > 1 ? jQuery.uniqueSort( matched ) : matched ); + }, + + // Determine the position of an element within the set + index: function( elem ) { + + // No argument, return index in parent + if ( !elem ) { + return ( this[ 0 ] && this[ 0 ].parentNode ) ? this.first().prevAll().length : -1; + } + + // Index in selector + if ( typeof elem === "string" ) { + return indexOf.call( jQuery( elem ), this[ 0 ] ); + } + + // Locate the position of the desired element + return indexOf.call( this, + + // If it receives a jQuery object, the first element is used + elem.jquery ? elem[ 0 ] : elem + ); + }, + + add: function( selector, context ) { + return this.pushStack( + jQuery.uniqueSort( + jQuery.merge( this.get(), jQuery( selector, context ) ) + ) + ); + }, + + addBack: function( selector ) { + return this.add( selector == null ? + this.prevObject : this.prevObject.filter( selector ) + ); + } +} ); + +function sibling( cur, dir ) { + while ( ( cur = cur[ dir ] ) && cur.nodeType !== 1 ) {} + return cur; +} + +jQuery.each( { + parent: function( elem ) { + var parent = elem.parentNode; + return parent && parent.nodeType !== 11 ? parent : null; + }, + parents: function( elem ) { + return dir( elem, "parentNode" ); + }, + parentsUntil: function( elem, _i, until ) { + return dir( elem, "parentNode", until ); + }, + next: function( elem ) { + return sibling( elem, "nextSibling" ); + }, + prev: function( elem ) { + return sibling( elem, "previousSibling" ); + }, + nextAll: function( elem ) { + return dir( elem, "nextSibling" ); + }, + prevAll: function( elem ) { + return dir( elem, "previousSibling" ); + }, + nextUntil: function( elem, _i, until ) { + return dir( elem, "nextSibling", until ); + }, + prevUntil: function( elem, _i, until ) { + return dir( elem, "previousSibling", until ); + }, + siblings: function( elem ) { + return siblings( ( elem.parentNode || {} ).firstChild, elem ); + }, + children: function( elem ) { + return siblings( elem.firstChild ); + }, + contents: function( elem ) { + if ( elem.contentDocument != null && + + // Support: IE 11+ + // elements with no `data` attribute has an object + // `contentDocument` with a `null` prototype. + getProto( elem.contentDocument ) ) { + + return elem.contentDocument; + } + + // Support: IE 9 - 11 only, iOS 7 only, Android Browser <=4.3 only + // Treat the template element as a regular one in browsers that + // don't support it. + if ( nodeName( elem, "template" ) ) { + elem = elem.content || elem; + } + + return jQuery.merge( [], elem.childNodes ); + } +}, function( name, fn ) { + jQuery.fn[ name ] = function( until, selector ) { + var matched = jQuery.map( this, fn, until ); + + if ( name.slice( -5 ) !== "Until" ) { + selector = until; + } + + if ( selector && typeof selector === "string" ) { + matched = jQuery.filter( selector, matched ); + } + + if ( this.length > 1 ) { + + // Remove duplicates + if ( !guaranteedUnique[ name ] ) { + jQuery.uniqueSort( matched ); + } + + // Reverse order for parents* and prev-derivatives + if ( rparentsprev.test( name ) ) { + matched.reverse(); + } + } + + return this.pushStack( matched ); + }; +} ); +var rnothtmlwhite = ( /[^\x20\t\r\n\f]+/g ); + + + +// Convert String-formatted options into Object-formatted ones +function createOptions( options ) { + var object = {}; + jQuery.each( options.match( rnothtmlwhite ) || [], function( _, flag ) { + object[ flag ] = true; + } ); + return object; +} + +/* + * Create a callback list using the following parameters: + * + * options: an optional list of space-separated options that will change how + * the callback list behaves or a more traditional option object + * + * By default a callback list will act like an event callback list and can be + * "fired" multiple times. + * + * Possible options: + * + * once: will ensure the callback list can only be fired once (like a Deferred) + * + * memory: will keep track of previous values and will call any callback added + * after the list has been fired right away with the latest "memorized" + * values (like a Deferred) + * + * unique: will ensure a callback can only be added once (no duplicate in the list) + * + * stopOnFalse: interrupt callings when a callback returns false + * + */ +jQuery.Callbacks = function( options ) { + + // Convert options from String-formatted to Object-formatted if needed + // (we check in cache first) + options = typeof options === "string" ? + createOptions( options ) : + jQuery.extend( {}, options ); + + var // Flag to know if list is currently firing + firing, + + // Last fire value for non-forgettable lists + memory, + + // Flag to know if list was already fired + fired, + + // Flag to prevent firing + locked, + + // Actual callback list + list = [], + + // Queue of execution data for repeatable lists + queue = [], + + // Index of currently firing callback (modified by add/remove as needed) + firingIndex = -1, + + // Fire callbacks + fire = function() { + + // Enforce single-firing + locked = locked || options.once; + + // Execute callbacks for all pending executions, + // respecting firingIndex overrides and runtime changes + fired = firing = true; + for ( ; queue.length; firingIndex = -1 ) { + memory = queue.shift(); + while ( ++firingIndex < list.length ) { + + // Run callback and check for early termination + if ( list[ firingIndex ].apply( memory[ 0 ], memory[ 1 ] ) === false && + options.stopOnFalse ) { + + // Jump to end and forget the data so .add doesn't re-fire + firingIndex = list.length; + memory = false; + } + } + } + + // Forget the data if we're done with it + if ( !options.memory ) { + memory = false; + } + + firing = false; + + // Clean up if we're done firing for good + if ( locked ) { + + // Keep an empty list if we have data for future add calls + if ( memory ) { + list = []; + + // Otherwise, this object is spent + } else { + list = ""; + } + } + }, + + // Actual Callbacks object + self = { + + // Add a callback or a collection of callbacks to the list + add: function() { + if ( list ) { + + // If we have memory from a past run, we should fire after adding + if ( memory && !firing ) { + firingIndex = list.length - 1; + queue.push( memory ); + } + + ( function add( args ) { + jQuery.each( args, function( _, arg ) { + if ( isFunction( arg ) ) { + if ( !options.unique || !self.has( arg ) ) { + list.push( arg ); + } + } else if ( arg && arg.length && toType( arg ) !== "string" ) { + + // Inspect recursively + add( arg ); + } + } ); + } )( arguments ); + + if ( memory && !firing ) { + fire(); + } + } + return this; + }, + + // Remove a callback from the list + remove: function() { + jQuery.each( arguments, function( _, arg ) { + var index; + while ( ( index = jQuery.inArray( arg, list, index ) ) > -1 ) { + list.splice( index, 1 ); + + // Handle firing indexes + if ( index <= firingIndex ) { + firingIndex--; + } + } + } ); + return this; + }, + + // Check if a given callback is in the list. + // If no argument is given, return whether or not list has callbacks attached. + has: function( fn ) { + return fn ? + jQuery.inArray( fn, list ) > -1 : + list.length > 0; + }, + + // Remove all callbacks from the list + empty: function() { + if ( list ) { + list = []; + } + return this; + }, + + // Disable .fire and .add + // Abort any current/pending executions + // Clear all callbacks and values + disable: function() { + locked = queue = []; + list = memory = ""; + return this; + }, + disabled: function() { + return !list; + }, + + // Disable .fire + // Also disable .add unless we have memory (since it would have no effect) + // Abort any pending executions + lock: function() { + locked = queue = []; + if ( !memory && !firing ) { + list = memory = ""; + } + return this; + }, + locked: function() { + return !!locked; + }, + + // Call all callbacks with the given context and arguments + fireWith: function( context, args ) { + if ( !locked ) { + args = args || []; + args = [ context, args.slice ? args.slice() : args ]; + queue.push( args ); + if ( !firing ) { + fire(); + } + } + return this; + }, + + // Call all the callbacks with the given arguments + fire: function() { + self.fireWith( this, arguments ); + return this; + }, + + // To know if the callbacks have already been called at least once + fired: function() { + return !!fired; + } + }; + + return self; +}; + + +function Identity( v ) { + return v; +} +function Thrower( ex ) { + throw ex; +} + +function adoptValue( value, resolve, reject, noValue ) { + var method; + + try { + + // Check for promise aspect first to privilege synchronous behavior + if ( value && isFunction( ( method = value.promise ) ) ) { + method.call( value ).done( resolve ).fail( reject ); + + // Other thenables + } else if ( value && isFunction( ( method = value.then ) ) ) { + method.call( value, resolve, reject ); + + // Other non-thenables + } else { + + // Control `resolve` arguments by letting Array#slice cast boolean `noValue` to integer: + // * false: [ value ].slice( 0 ) => resolve( value ) + // * true: [ value ].slice( 1 ) => resolve() + resolve.apply( undefined, [ value ].slice( noValue ) ); + } + + // For Promises/A+, convert exceptions into rejections + // Since jQuery.when doesn't unwrap thenables, we can skip the extra checks appearing in + // Deferred#then to conditionally suppress rejection. + } catch ( value ) { + + // Support: Android 4.0 only + // Strict mode functions invoked without .call/.apply get global-object context + reject.apply( undefined, [ value ] ); + } +} + +jQuery.extend( { + + Deferred: function( func ) { + var tuples = [ + + // action, add listener, callbacks, + // ... .then handlers, argument index, [final state] + [ "notify", "progress", jQuery.Callbacks( "memory" ), + jQuery.Callbacks( "memory" ), 2 ], + [ "resolve", "done", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 0, "resolved" ], + [ "reject", "fail", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 1, "rejected" ] + ], + state = "pending", + promise = { + state: function() { + return state; + }, + always: function() { + deferred.done( arguments ).fail( arguments ); + return this; + }, + "catch": function( fn ) { + return promise.then( null, fn ); + }, + + // Keep pipe for back-compat + pipe: function( /* fnDone, fnFail, fnProgress */ ) { + var fns = arguments; + + return jQuery.Deferred( function( newDefer ) { + jQuery.each( tuples, function( _i, tuple ) { + + // Map tuples (progress, done, fail) to arguments (done, fail, progress) + var fn = isFunction( fns[ tuple[ 4 ] ] ) && fns[ tuple[ 4 ] ]; + + // deferred.progress(function() { bind to newDefer or newDefer.notify }) + // deferred.done(function() { bind to newDefer or newDefer.resolve }) + // deferred.fail(function() { bind to newDefer or newDefer.reject }) + deferred[ tuple[ 1 ] ]( function() { + var returned = fn && fn.apply( this, arguments ); + if ( returned && isFunction( returned.promise ) ) { + returned.promise() + .progress( newDefer.notify ) + .done( newDefer.resolve ) + .fail( newDefer.reject ); + } else { + newDefer[ tuple[ 0 ] + "With" ]( + this, + fn ? [ returned ] : arguments + ); + } + } ); + } ); + fns = null; + } ).promise(); + }, + then: function( onFulfilled, onRejected, onProgress ) { + var maxDepth = 0; + function resolve( depth, deferred, handler, special ) { + return function() { + var that = this, + args = arguments, + mightThrow = function() { + var returned, then; + + // Support: Promises/A+ section 2.3.3.3.3 + // https://promisesaplus.com/#point-59 + // Ignore double-resolution attempts + if ( depth < maxDepth ) { + return; + } + + returned = handler.apply( that, args ); + + // Support: Promises/A+ section 2.3.1 + // https://promisesaplus.com/#point-48 + if ( returned === deferred.promise() ) { + throw new TypeError( "Thenable self-resolution" ); + } + + // Support: Promises/A+ sections 2.3.3.1, 3.5 + // https://promisesaplus.com/#point-54 + // https://promisesaplus.com/#point-75 + // Retrieve `then` only once + then = returned && + + // Support: Promises/A+ section 2.3.4 + // https://promisesaplus.com/#point-64 + // Only check objects and functions for thenability + ( typeof returned === "object" || + typeof returned === "function" ) && + returned.then; + + // Handle a returned thenable + if ( isFunction( then ) ) { + + // Special processors (notify) just wait for resolution + if ( special ) { + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ) + ); + + // Normal processors (resolve) also hook into progress + } else { + + // ...and disregard older resolution values + maxDepth++; + + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ), + resolve( maxDepth, deferred, Identity, + deferred.notifyWith ) + ); + } + + // Handle all other returned values + } else { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Identity ) { + that = undefined; + args = [ returned ]; + } + + // Process the value(s) + // Default process is resolve + ( special || deferred.resolveWith )( that, args ); + } + }, + + // Only normal processors (resolve) catch and reject exceptions + process = special ? + mightThrow : + function() { + try { + mightThrow(); + } catch ( e ) { + + if ( jQuery.Deferred.exceptionHook ) { + jQuery.Deferred.exceptionHook( e, + process.stackTrace ); + } + + // Support: Promises/A+ section 2.3.3.3.4.1 + // https://promisesaplus.com/#point-61 + // Ignore post-resolution exceptions + if ( depth + 1 >= maxDepth ) { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Thrower ) { + that = undefined; + args = [ e ]; + } + + deferred.rejectWith( that, args ); + } + } + }; + + // Support: Promises/A+ section 2.3.3.3.1 + // https://promisesaplus.com/#point-57 + // Re-resolve promises immediately to dodge false rejection from + // subsequent errors + if ( depth ) { + process(); + } else { + + // Call an optional hook to record the stack, in case of exception + // since it's otherwise lost when execution goes async + if ( jQuery.Deferred.getStackHook ) { + process.stackTrace = jQuery.Deferred.getStackHook(); + } + window.setTimeout( process ); + } + }; + } + + return jQuery.Deferred( function( newDefer ) { + + // progress_handlers.add( ... ) + tuples[ 0 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onProgress ) ? + onProgress : + Identity, + newDefer.notifyWith + ) + ); + + // fulfilled_handlers.add( ... ) + tuples[ 1 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onFulfilled ) ? + onFulfilled : + Identity + ) + ); + + // rejected_handlers.add( ... ) + tuples[ 2 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onRejected ) ? + onRejected : + Thrower + ) + ); + } ).promise(); + }, + + // Get a promise for this deferred + // If obj is provided, the promise aspect is added to the object + promise: function( obj ) { + return obj != null ? jQuery.extend( obj, promise ) : promise; + } + }, + deferred = {}; + + // Add list-specific methods + jQuery.each( tuples, function( i, tuple ) { + var list = tuple[ 2 ], + stateString = tuple[ 5 ]; + + // promise.progress = list.add + // promise.done = list.add + // promise.fail = list.add + promise[ tuple[ 1 ] ] = list.add; + + // Handle state + if ( stateString ) { + list.add( + function() { + + // state = "resolved" (i.e., fulfilled) + // state = "rejected" + state = stateString; + }, + + // rejected_callbacks.disable + // fulfilled_callbacks.disable + tuples[ 3 - i ][ 2 ].disable, + + // rejected_handlers.disable + // fulfilled_handlers.disable + tuples[ 3 - i ][ 3 ].disable, + + // progress_callbacks.lock + tuples[ 0 ][ 2 ].lock, + + // progress_handlers.lock + tuples[ 0 ][ 3 ].lock + ); + } + + // progress_handlers.fire + // fulfilled_handlers.fire + // rejected_handlers.fire + list.add( tuple[ 3 ].fire ); + + // deferred.notify = function() { deferred.notifyWith(...) } + // deferred.resolve = function() { deferred.resolveWith(...) } + // deferred.reject = function() { deferred.rejectWith(...) } + deferred[ tuple[ 0 ] ] = function() { + deferred[ tuple[ 0 ] + "With" ]( this === deferred ? undefined : this, arguments ); + return this; + }; + + // deferred.notifyWith = list.fireWith + // deferred.resolveWith = list.fireWith + // deferred.rejectWith = list.fireWith + deferred[ tuple[ 0 ] + "With" ] = list.fireWith; + } ); + + // Make the deferred a promise + promise.promise( deferred ); + + // Call given func if any + if ( func ) { + func.call( deferred, deferred ); + } + + // All done! + return deferred; + }, + + // Deferred helper + when: function( singleValue ) { + var + + // count of uncompleted subordinates + remaining = arguments.length, + + // count of unprocessed arguments + i = remaining, + + // subordinate fulfillment data + resolveContexts = Array( i ), + resolveValues = slice.call( arguments ), + + // the primary Deferred + primary = jQuery.Deferred(), + + // subordinate callback factory + updateFunc = function( i ) { + return function( value ) { + resolveContexts[ i ] = this; + resolveValues[ i ] = arguments.length > 1 ? slice.call( arguments ) : value; + if ( !( --remaining ) ) { + primary.resolveWith( resolveContexts, resolveValues ); + } + }; + }; + + // Single- and empty arguments are adopted like Promise.resolve + if ( remaining <= 1 ) { + adoptValue( singleValue, primary.done( updateFunc( i ) ).resolve, primary.reject, + !remaining ); + + // Use .then() to unwrap secondary thenables (cf. gh-3000) + if ( primary.state() === "pending" || + isFunction( resolveValues[ i ] && resolveValues[ i ].then ) ) { + + return primary.then(); + } + } + + // Multiple arguments are aggregated like Promise.all array elements + while ( i-- ) { + adoptValue( resolveValues[ i ], updateFunc( i ), primary.reject ); + } + + return primary.promise(); + } +} ); + + +// These usually indicate a programmer mistake during development, +// warn about them ASAP rather than swallowing them by default. +var rerrorNames = /^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/; + +jQuery.Deferred.exceptionHook = function( error, stack ) { + + // Support: IE 8 - 9 only + // Console exists when dev tools are open, which can happen at any time + if ( window.console && window.console.warn && error && rerrorNames.test( error.name ) ) { + window.console.warn( "jQuery.Deferred exception: " + error.message, error.stack, stack ); + } +}; + + + + +jQuery.readyException = function( error ) { + window.setTimeout( function() { + throw error; + } ); +}; + + + + +// The deferred used on DOM ready +var readyList = jQuery.Deferred(); + +jQuery.fn.ready = function( fn ) { + + readyList + .then( fn ) + + // Wrap jQuery.readyException in a function so that the lookup + // happens at the time of error handling instead of callback + // registration. + .catch( function( error ) { + jQuery.readyException( error ); + } ); + + return this; +}; + +jQuery.extend( { + + // Is the DOM ready to be used? Set to true once it occurs. + isReady: false, + + // A counter to track how many items to wait for before + // the ready event fires. See #6781 + readyWait: 1, + + // Handle when the DOM is ready + ready: function( wait ) { + + // Abort if there are pending holds or we're already ready + if ( wait === true ? --jQuery.readyWait : jQuery.isReady ) { + return; + } + + // Remember that the DOM is ready + jQuery.isReady = true; + + // If a normal DOM Ready event fired, decrement, and wait if need be + if ( wait !== true && --jQuery.readyWait > 0 ) { + return; + } + + // If there are functions bound, to execute + readyList.resolveWith( document, [ jQuery ] ); + } +} ); + +jQuery.ready.then = readyList.then; + +// The ready event handler and self cleanup method +function completed() { + document.removeEventListener( "DOMContentLoaded", completed ); + window.removeEventListener( "load", completed ); + jQuery.ready(); +} + +// Catch cases where $(document).ready() is called +// after the browser event has already occurred. +// Support: IE <=9 - 10 only +// Older IE sometimes signals "interactive" too soon +if ( document.readyState === "complete" || + ( document.readyState !== "loading" && !document.documentElement.doScroll ) ) { + + // Handle it asynchronously to allow scripts the opportunity to delay ready + window.setTimeout( jQuery.ready ); + +} else { + + // Use the handy event callback + document.addEventListener( "DOMContentLoaded", completed ); + + // A fallback to window.onload, that will always work + window.addEventListener( "load", completed ); +} + + + + +// Multifunctional method to get and set values of a collection +// The value/s can optionally be executed if it's a function +var access = function( elems, fn, key, value, chainable, emptyGet, raw ) { + var i = 0, + len = elems.length, + bulk = key == null; + + // Sets many values + if ( toType( key ) === "object" ) { + chainable = true; + for ( i in key ) { + access( elems, fn, i, key[ i ], true, emptyGet, raw ); + } + + // Sets one value + } else if ( value !== undefined ) { + chainable = true; + + if ( !isFunction( value ) ) { + raw = true; + } + + if ( bulk ) { + + // Bulk operations run against the entire set + if ( raw ) { + fn.call( elems, value ); + fn = null; + + // ...except when executing function values + } else { + bulk = fn; + fn = function( elem, _key, value ) { + return bulk.call( jQuery( elem ), value ); + }; + } + } + + if ( fn ) { + for ( ; i < len; i++ ) { + fn( + elems[ i ], key, raw ? + value : + value.call( elems[ i ], i, fn( elems[ i ], key ) ) + ); + } + } + } + + if ( chainable ) { + return elems; + } + + // Gets + if ( bulk ) { + return fn.call( elems ); + } + + return len ? fn( elems[ 0 ], key ) : emptyGet; +}; + + +// Matches dashed string for camelizing +var rmsPrefix = /^-ms-/, + rdashAlpha = /-([a-z])/g; + +// Used by camelCase as callback to replace() +function fcamelCase( _all, letter ) { + return letter.toUpperCase(); +} + +// Convert dashed to camelCase; used by the css and data modules +// Support: IE <=9 - 11, Edge 12 - 15 +// Microsoft forgot to hump their vendor prefix (#9572) +function camelCase( string ) { + return string.replace( rmsPrefix, "ms-" ).replace( rdashAlpha, fcamelCase ); +} +var acceptData = function( owner ) { + + // Accepts only: + // - Node + // - Node.ELEMENT_NODE + // - Node.DOCUMENT_NODE + // - Object + // - Any + return owner.nodeType === 1 || owner.nodeType === 9 || !( +owner.nodeType ); +}; + + + + +function Data() { + this.expando = jQuery.expando + Data.uid++; +} + +Data.uid = 1; + +Data.prototype = { + + cache: function( owner ) { + + // Check if the owner object already has a cache + var value = owner[ this.expando ]; + + // If not, create one + if ( !value ) { + value = {}; + + // We can accept data for non-element nodes in modern browsers, + // but we should not, see #8335. + // Always return an empty object. + if ( acceptData( owner ) ) { + + // If it is a node unlikely to be stringify-ed or looped over + // use plain assignment + if ( owner.nodeType ) { + owner[ this.expando ] = value; + + // Otherwise secure it in a non-enumerable property + // configurable must be true to allow the property to be + // deleted when data is removed + } else { + Object.defineProperty( owner, this.expando, { + value: value, + configurable: true + } ); + } + } + } + + return value; + }, + set: function( owner, data, value ) { + var prop, + cache = this.cache( owner ); + + // Handle: [ owner, key, value ] args + // Always use camelCase key (gh-2257) + if ( typeof data === "string" ) { + cache[ camelCase( data ) ] = value; + + // Handle: [ owner, { properties } ] args + } else { + + // Copy the properties one-by-one to the cache object + for ( prop in data ) { + cache[ camelCase( prop ) ] = data[ prop ]; + } + } + return cache; + }, + get: function( owner, key ) { + return key === undefined ? + this.cache( owner ) : + + // Always use camelCase key (gh-2257) + owner[ this.expando ] && owner[ this.expando ][ camelCase( key ) ]; + }, + access: function( owner, key, value ) { + + // In cases where either: + // + // 1. No key was specified + // 2. A string key was specified, but no value provided + // + // Take the "read" path and allow the get method to determine + // which value to return, respectively either: + // + // 1. The entire cache object + // 2. The data stored at the key + // + if ( key === undefined || + ( ( key && typeof key === "string" ) && value === undefined ) ) { + + return this.get( owner, key ); + } + + // When the key is not a string, or both a key and value + // are specified, set or extend (existing objects) with either: + // + // 1. An object of properties + // 2. A key and value + // + this.set( owner, key, value ); + + // Since the "set" path can have two possible entry points + // return the expected data based on which path was taken[*] + return value !== undefined ? value : key; + }, + remove: function( owner, key ) { + var i, + cache = owner[ this.expando ]; + + if ( cache === undefined ) { + return; + } + + if ( key !== undefined ) { + + // Support array or space separated string of keys + if ( Array.isArray( key ) ) { + + // If key is an array of keys... + // We always set camelCase keys, so remove that. + key = key.map( camelCase ); + } else { + key = camelCase( key ); + + // If a key with the spaces exists, use it. + // Otherwise, create an array by matching non-whitespace + key = key in cache ? + [ key ] : + ( key.match( rnothtmlwhite ) || [] ); + } + + i = key.length; + + while ( i-- ) { + delete cache[ key[ i ] ]; + } + } + + // Remove the expando if there's no more data + if ( key === undefined || jQuery.isEmptyObject( cache ) ) { + + // Support: Chrome <=35 - 45 + // Webkit & Blink performance suffers when deleting properties + // from DOM nodes, so set to undefined instead + // https://bugs.chromium.org/p/chromium/issues/detail?id=378607 (bug restricted) + if ( owner.nodeType ) { + owner[ this.expando ] = undefined; + } else { + delete owner[ this.expando ]; + } + } + }, + hasData: function( owner ) { + var cache = owner[ this.expando ]; + return cache !== undefined && !jQuery.isEmptyObject( cache ); + } +}; +var dataPriv = new Data(); + +var dataUser = new Data(); + + + +// Implementation Summary +// +// 1. Enforce API surface and semantic compatibility with 1.9.x branch +// 2. Improve the module's maintainability by reducing the storage +// paths to a single mechanism. +// 3. Use the same single mechanism to support "private" and "user" data. +// 4. _Never_ expose "private" data to user code (TODO: Drop _data, _removeData) +// 5. Avoid exposing implementation details on user objects (eg. expando properties) +// 6. Provide a clear path for implementation upgrade to WeakMap in 2014 + +var rbrace = /^(?:\{[\w\W]*\}|\[[\w\W]*\])$/, + rmultiDash = /[A-Z]/g; + +function getData( data ) { + if ( data === "true" ) { + return true; + } + + if ( data === "false" ) { + return false; + } + + if ( data === "null" ) { + return null; + } + + // Only convert to a number if it doesn't change the string + if ( data === +data + "" ) { + return +data; + } + + if ( rbrace.test( data ) ) { + return JSON.parse( data ); + } + + return data; +} + +function dataAttr( elem, key, data ) { + var name; + + // If nothing was found internally, try to fetch any + // data from the HTML5 data-* attribute + if ( data === undefined && elem.nodeType === 1 ) { + name = "data-" + key.replace( rmultiDash, "-$&" ).toLowerCase(); + data = elem.getAttribute( name ); + + if ( typeof data === "string" ) { + try { + data = getData( data ); + } catch ( e ) {} + + // Make sure we set the data so it isn't changed later + dataUser.set( elem, key, data ); + } else { + data = undefined; + } + } + return data; +} + +jQuery.extend( { + hasData: function( elem ) { + return dataUser.hasData( elem ) || dataPriv.hasData( elem ); + }, + + data: function( elem, name, data ) { + return dataUser.access( elem, name, data ); + }, + + removeData: function( elem, name ) { + dataUser.remove( elem, name ); + }, + + // TODO: Now that all calls to _data and _removeData have been replaced + // with direct calls to dataPriv methods, these can be deprecated. + _data: function( elem, name, data ) { + return dataPriv.access( elem, name, data ); + }, + + _removeData: function( elem, name ) { + dataPriv.remove( elem, name ); + } +} ); + +jQuery.fn.extend( { + data: function( key, value ) { + var i, name, data, + elem = this[ 0 ], + attrs = elem && elem.attributes; + + // Gets all values + if ( key === undefined ) { + if ( this.length ) { + data = dataUser.get( elem ); + + if ( elem.nodeType === 1 && !dataPriv.get( elem, "hasDataAttrs" ) ) { + i = attrs.length; + while ( i-- ) { + + // Support: IE 11 only + // The attrs elements can be null (#14894) + if ( attrs[ i ] ) { + name = attrs[ i ].name; + if ( name.indexOf( "data-" ) === 0 ) { + name = camelCase( name.slice( 5 ) ); + dataAttr( elem, name, data[ name ] ); + } + } + } + dataPriv.set( elem, "hasDataAttrs", true ); + } + } + + return data; + } + + // Sets multiple values + if ( typeof key === "object" ) { + return this.each( function() { + dataUser.set( this, key ); + } ); + } + + return access( this, function( value ) { + var data; + + // The calling jQuery object (element matches) is not empty + // (and therefore has an element appears at this[ 0 ]) and the + // `value` parameter was not undefined. An empty jQuery object + // will result in `undefined` for elem = this[ 0 ] which will + // throw an exception if an attempt to read a data cache is made. + if ( elem && value === undefined ) { + + // Attempt to get data from the cache + // The key will always be camelCased in Data + data = dataUser.get( elem, key ); + if ( data !== undefined ) { + return data; + } + + // Attempt to "discover" the data in + // HTML5 custom data-* attrs + data = dataAttr( elem, key ); + if ( data !== undefined ) { + return data; + } + + // We tried really hard, but the data doesn't exist. + return; + } + + // Set the data... + this.each( function() { + + // We always store the camelCased key + dataUser.set( this, key, value ); + } ); + }, null, value, arguments.length > 1, null, true ); + }, + + removeData: function( key ) { + return this.each( function() { + dataUser.remove( this, key ); + } ); + } +} ); + + +jQuery.extend( { + queue: function( elem, type, data ) { + var queue; + + if ( elem ) { + type = ( type || "fx" ) + "queue"; + queue = dataPriv.get( elem, type ); + + // Speed up dequeue by getting out quickly if this is just a lookup + if ( data ) { + if ( !queue || Array.isArray( data ) ) { + queue = dataPriv.access( elem, type, jQuery.makeArray( data ) ); + } else { + queue.push( data ); + } + } + return queue || []; + } + }, + + dequeue: function( elem, type ) { + type = type || "fx"; + + var queue = jQuery.queue( elem, type ), + startLength = queue.length, + fn = queue.shift(), + hooks = jQuery._queueHooks( elem, type ), + next = function() { + jQuery.dequeue( elem, type ); + }; + + // If the fx queue is dequeued, always remove the progress sentinel + if ( fn === "inprogress" ) { + fn = queue.shift(); + startLength--; + } + + if ( fn ) { + + // Add a progress sentinel to prevent the fx queue from being + // automatically dequeued + if ( type === "fx" ) { + queue.unshift( "inprogress" ); + } + + // Clear up the last queue stop function + delete hooks.stop; + fn.call( elem, next, hooks ); + } + + if ( !startLength && hooks ) { + hooks.empty.fire(); + } + }, + + // Not public - generate a queueHooks object, or return the current one + _queueHooks: function( elem, type ) { + var key = type + "queueHooks"; + return dataPriv.get( elem, key ) || dataPriv.access( elem, key, { + empty: jQuery.Callbacks( "once memory" ).add( function() { + dataPriv.remove( elem, [ type + "queue", key ] ); + } ) + } ); + } +} ); + +jQuery.fn.extend( { + queue: function( type, data ) { + var setter = 2; + + if ( typeof type !== "string" ) { + data = type; + type = "fx"; + setter--; + } + + if ( arguments.length < setter ) { + return jQuery.queue( this[ 0 ], type ); + } + + return data === undefined ? + this : + this.each( function() { + var queue = jQuery.queue( this, type, data ); + + // Ensure a hooks for this queue + jQuery._queueHooks( this, type ); + + if ( type === "fx" && queue[ 0 ] !== "inprogress" ) { + jQuery.dequeue( this, type ); + } + } ); + }, + dequeue: function( type ) { + return this.each( function() { + jQuery.dequeue( this, type ); + } ); + }, + clearQueue: function( type ) { + return this.queue( type || "fx", [] ); + }, + + // Get a promise resolved when queues of a certain type + // are emptied (fx is the type by default) + promise: function( type, obj ) { + var tmp, + count = 1, + defer = jQuery.Deferred(), + elements = this, + i = this.length, + resolve = function() { + if ( !( --count ) ) { + defer.resolveWith( elements, [ elements ] ); + } + }; + + if ( typeof type !== "string" ) { + obj = type; + type = undefined; + } + type = type || "fx"; + + while ( i-- ) { + tmp = dataPriv.get( elements[ i ], type + "queueHooks" ); + if ( tmp && tmp.empty ) { + count++; + tmp.empty.add( resolve ); + } + } + resolve(); + return defer.promise( obj ); + } +} ); +var pnum = ( /[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/ ).source; + +var rcssNum = new RegExp( "^(?:([+-])=|)(" + pnum + ")([a-z%]*)$", "i" ); + + +var cssExpand = [ "Top", "Right", "Bottom", "Left" ]; + +var documentElement = document.documentElement; + + + + var isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ); + }, + composed = { composed: true }; + + // Support: IE 9 - 11+, Edge 12 - 18+, iOS 10.0 - 10.2 only + // Check attachment across shadow DOM boundaries when possible (gh-3504) + // Support: iOS 10.0-10.2 only + // Early iOS 10 versions support `attachShadow` but not `getRootNode`, + // leading to errors. We need to check for `getRootNode`. + if ( documentElement.getRootNode ) { + isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ) || + elem.getRootNode( composed ) === elem.ownerDocument; + }; + } +var isHiddenWithinTree = function( elem, el ) { + + // isHiddenWithinTree might be called from jQuery#filter function; + // in that case, element will be second argument + elem = el || elem; + + // Inline style trumps all + return elem.style.display === "none" || + elem.style.display === "" && + + // Otherwise, check computed style + // Support: Firefox <=43 - 45 + // Disconnected elements can have computed display: none, so first confirm that elem is + // in the document. + isAttached( elem ) && + + jQuery.css( elem, "display" ) === "none"; + }; + + + +function adjustCSS( elem, prop, valueParts, tween ) { + var adjusted, scale, + maxIterations = 20, + currentValue = tween ? + function() { + return tween.cur(); + } : + function() { + return jQuery.css( elem, prop, "" ); + }, + initial = currentValue(), + unit = valueParts && valueParts[ 3 ] || ( jQuery.cssNumber[ prop ] ? "" : "px" ), + + // Starting value computation is required for potential unit mismatches + initialInUnit = elem.nodeType && + ( jQuery.cssNumber[ prop ] || unit !== "px" && +initial ) && + rcssNum.exec( jQuery.css( elem, prop ) ); + + if ( initialInUnit && initialInUnit[ 3 ] !== unit ) { + + // Support: Firefox <=54 + // Halve the iteration target value to prevent interference from CSS upper bounds (gh-2144) + initial = initial / 2; + + // Trust units reported by jQuery.css + unit = unit || initialInUnit[ 3 ]; + + // Iteratively approximate from a nonzero starting point + initialInUnit = +initial || 1; + + while ( maxIterations-- ) { + + // Evaluate and update our best guess (doubling guesses that zero out). + // Finish if the scale equals or crosses 1 (making the old*new product non-positive). + jQuery.style( elem, prop, initialInUnit + unit ); + if ( ( 1 - scale ) * ( 1 - ( scale = currentValue() / initial || 0.5 ) ) <= 0 ) { + maxIterations = 0; + } + initialInUnit = initialInUnit / scale; + + } + + initialInUnit = initialInUnit * 2; + jQuery.style( elem, prop, initialInUnit + unit ); + + // Make sure we update the tween properties later on + valueParts = valueParts || []; + } + + if ( valueParts ) { + initialInUnit = +initialInUnit || +initial || 0; + + // Apply relative offset (+=/-=) if specified + adjusted = valueParts[ 1 ] ? + initialInUnit + ( valueParts[ 1 ] + 1 ) * valueParts[ 2 ] : + +valueParts[ 2 ]; + if ( tween ) { + tween.unit = unit; + tween.start = initialInUnit; + tween.end = adjusted; + } + } + return adjusted; +} + + +var defaultDisplayMap = {}; + +function getDefaultDisplay( elem ) { + var temp, + doc = elem.ownerDocument, + nodeName = elem.nodeName, + display = defaultDisplayMap[ nodeName ]; + + if ( display ) { + return display; + } + + temp = doc.body.appendChild( doc.createElement( nodeName ) ); + display = jQuery.css( temp, "display" ); + + temp.parentNode.removeChild( temp ); + + if ( display === "none" ) { + display = "block"; + } + defaultDisplayMap[ nodeName ] = display; + + return display; +} + +function showHide( elements, show ) { + var display, elem, + values = [], + index = 0, + length = elements.length; + + // Determine new display value for elements that need to change + for ( ; index < length; index++ ) { + elem = elements[ index ]; + if ( !elem.style ) { + continue; + } + + display = elem.style.display; + if ( show ) { + + // Since we force visibility upon cascade-hidden elements, an immediate (and slow) + // check is required in this first loop unless we have a nonempty display value (either + // inline or about-to-be-restored) + if ( display === "none" ) { + values[ index ] = dataPriv.get( elem, "display" ) || null; + if ( !values[ index ] ) { + elem.style.display = ""; + } + } + if ( elem.style.display === "" && isHiddenWithinTree( elem ) ) { + values[ index ] = getDefaultDisplay( elem ); + } + } else { + if ( display !== "none" ) { + values[ index ] = "none"; + + // Remember what we're overwriting + dataPriv.set( elem, "display", display ); + } + } + } + + // Set the display of the elements in a second loop to avoid constant reflow + for ( index = 0; index < length; index++ ) { + if ( values[ index ] != null ) { + elements[ index ].style.display = values[ index ]; + } + } + + return elements; +} + +jQuery.fn.extend( { + show: function() { + return showHide( this, true ); + }, + hide: function() { + return showHide( this ); + }, + toggle: function( state ) { + if ( typeof state === "boolean" ) { + return state ? this.show() : this.hide(); + } + + return this.each( function() { + if ( isHiddenWithinTree( this ) ) { + jQuery( this ).show(); + } else { + jQuery( this ).hide(); + } + } ); + } +} ); +var rcheckableType = ( /^(?:checkbox|radio)$/i ); + +var rtagName = ( /<([a-z][^\/\0>\x20\t\r\n\f]*)/i ); + +var rscriptType = ( /^$|^module$|\/(?:java|ecma)script/i ); + + + +( function() { + var fragment = document.createDocumentFragment(), + div = fragment.appendChild( document.createElement( "div" ) ), + input = document.createElement( "input" ); + + // Support: Android 4.0 - 4.3 only + // Check state lost if the name is set (#11217) + // Support: Windows Web Apps (WWA) + // `name` and `type` must use .setAttribute for WWA (#14901) + input.setAttribute( "type", "radio" ); + input.setAttribute( "checked", "checked" ); + input.setAttribute( "name", "t" ); + + div.appendChild( input ); + + // Support: Android <=4.1 only + // Older WebKit doesn't clone checked state correctly in fragments + support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked; + + // Support: IE <=11 only + // Make sure textarea (and checkbox) defaultValue is properly cloned + div.innerHTML = ""; + support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue; + + // Support: IE <=9 only + // IE <=9 replaces "; + support.option = !!div.lastChild; +} )(); + + +// We have to close these tags to support XHTML (#13200) +var wrapMap = { + + // XHTML parsers do not magically insert elements in the + // same way that tag soup parsers do. So we cannot shorten + // this by omitting or other required elements. + thead: [ 1, "", "
" ], + col: [ 2, "", "
" ], + tr: [ 2, "", "
" ], + td: [ 3, "", "
" ], + + _default: [ 0, "", "" ] +}; + +wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead; +wrapMap.th = wrapMap.td; + +// Support: IE <=9 only +if ( !support.option ) { + wrapMap.optgroup = wrapMap.option = [ 1, "" ]; +} + + +function getAll( context, tag ) { + + // Support: IE <=9 - 11 only + // Use typeof to avoid zero-argument method invocation on host objects (#15151) + var ret; + + if ( typeof context.getElementsByTagName !== "undefined" ) { + ret = context.getElementsByTagName( tag || "*" ); + + } else if ( typeof context.querySelectorAll !== "undefined" ) { + ret = context.querySelectorAll( tag || "*" ); + + } else { + ret = []; + } + + if ( tag === undefined || tag && nodeName( context, tag ) ) { + return jQuery.merge( [ context ], ret ); + } + + return ret; +} + + +// Mark scripts as having already been evaluated +function setGlobalEval( elems, refElements ) { + var i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + dataPriv.set( + elems[ i ], + "globalEval", + !refElements || dataPriv.get( refElements[ i ], "globalEval" ) + ); + } +} + + +var rhtml = /<|&#?\w+;/; + +function buildFragment( elems, context, scripts, selection, ignored ) { + var elem, tmp, tag, wrap, attached, j, + fragment = context.createDocumentFragment(), + nodes = [], + i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + elem = elems[ i ]; + + if ( elem || elem === 0 ) { + + // Add nodes directly + if ( toType( elem ) === "object" ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, elem.nodeType ? [ elem ] : elem ); + + // Convert non-html into a text node + } else if ( !rhtml.test( elem ) ) { + nodes.push( context.createTextNode( elem ) ); + + // Convert html into DOM nodes + } else { + tmp = tmp || fragment.appendChild( context.createElement( "div" ) ); + + // Deserialize a standard representation + tag = ( rtagName.exec( elem ) || [ "", "" ] )[ 1 ].toLowerCase(); + wrap = wrapMap[ tag ] || wrapMap._default; + tmp.innerHTML = wrap[ 1 ] + jQuery.htmlPrefilter( elem ) + wrap[ 2 ]; + + // Descend through wrappers to the right content + j = wrap[ 0 ]; + while ( j-- ) { + tmp = tmp.lastChild; + } + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, tmp.childNodes ); + + // Remember the top-level container + tmp = fragment.firstChild; + + // Ensure the created nodes are orphaned (#12392) + tmp.textContent = ""; + } + } + } + + // Remove wrapper from fragment + fragment.textContent = ""; + + i = 0; + while ( ( elem = nodes[ i++ ] ) ) { + + // Skip elements already in the context collection (trac-4087) + if ( selection && jQuery.inArray( elem, selection ) > -1 ) { + if ( ignored ) { + ignored.push( elem ); + } + continue; + } + + attached = isAttached( elem ); + + // Append to fragment + tmp = getAll( fragment.appendChild( elem ), "script" ); + + // Preserve script evaluation history + if ( attached ) { + setGlobalEval( tmp ); + } + + // Capture executables + if ( scripts ) { + j = 0; + while ( ( elem = tmp[ j++ ] ) ) { + if ( rscriptType.test( elem.type || "" ) ) { + scripts.push( elem ); + } + } + } + } + + return fragment; +} + + +var rtypenamespace = /^([^.]*)(?:\.(.+)|)/; + +function returnTrue() { + return true; +} + +function returnFalse() { + return false; +} + +// Support: IE <=9 - 11+ +// focus() and blur() are asynchronous, except when they are no-op. +// So expect focus to be synchronous when the element is already active, +// and blur to be synchronous when the element is not already active. +// (focus and blur are always synchronous in other supported browsers, +// this just defines when we can count on it). +function expectSync( elem, type ) { + return ( elem === safeActiveElement() ) === ( type === "focus" ); +} + +// Support: IE <=9 only +// Accessing document.activeElement can throw unexpectedly +// https://bugs.jquery.com/ticket/13393 +function safeActiveElement() { + try { + return document.activeElement; + } catch ( err ) { } +} + +function on( elem, types, selector, data, fn, one ) { + var origFn, type; + + // Types can be a map of types/handlers + if ( typeof types === "object" ) { + + // ( types-Object, selector, data ) + if ( typeof selector !== "string" ) { + + // ( types-Object, data ) + data = data || selector; + selector = undefined; + } + for ( type in types ) { + on( elem, type, selector, data, types[ type ], one ); + } + return elem; + } + + if ( data == null && fn == null ) { + + // ( types, fn ) + fn = selector; + data = selector = undefined; + } else if ( fn == null ) { + if ( typeof selector === "string" ) { + + // ( types, selector, fn ) + fn = data; + data = undefined; + } else { + + // ( types, data, fn ) + fn = data; + data = selector; + selector = undefined; + } + } + if ( fn === false ) { + fn = returnFalse; + } else if ( !fn ) { + return elem; + } + + if ( one === 1 ) { + origFn = fn; + fn = function( event ) { + + // Can use an empty set, since event contains the info + jQuery().off( event ); + return origFn.apply( this, arguments ); + }; + + // Use same guid so caller can remove using origFn + fn.guid = origFn.guid || ( origFn.guid = jQuery.guid++ ); + } + return elem.each( function() { + jQuery.event.add( this, types, fn, data, selector ); + } ); +} + +/* + * Helper functions for managing events -- not part of the public interface. + * Props to Dean Edwards' addEvent library for many of the ideas. + */ +jQuery.event = { + + global: {}, + + add: function( elem, types, handler, data, selector ) { + + var handleObjIn, eventHandle, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.get( elem ); + + // Only attach events to objects that accept data + if ( !acceptData( elem ) ) { + return; + } + + // Caller can pass in an object of custom data in lieu of the handler + if ( handler.handler ) { + handleObjIn = handler; + handler = handleObjIn.handler; + selector = handleObjIn.selector; + } + + // Ensure that invalid selectors throw exceptions at attach time + // Evaluate against documentElement in case elem is a non-element node (e.g., document) + if ( selector ) { + jQuery.find.matchesSelector( documentElement, selector ); + } + + // Make sure that the handler has a unique ID, used to find/remove it later + if ( !handler.guid ) { + handler.guid = jQuery.guid++; + } + + // Init the element's event structure and main handler, if this is the first + if ( !( events = elemData.events ) ) { + events = elemData.events = Object.create( null ); + } + if ( !( eventHandle = elemData.handle ) ) { + eventHandle = elemData.handle = function( e ) { + + // Discard the second event of a jQuery.event.trigger() and + // when an event is called after a page has unloaded + return typeof jQuery !== "undefined" && jQuery.event.triggered !== e.type ? + jQuery.event.dispatch.apply( elem, arguments ) : undefined; + }; + } + + // Handle multiple events separated by a space + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // There *must* be a type, no attaching namespace-only handlers + if ( !type ) { + continue; + } + + // If event changes its type, use the special event handlers for the changed type + special = jQuery.event.special[ type ] || {}; + + // If selector defined, determine special event api type, otherwise given type + type = ( selector ? special.delegateType : special.bindType ) || type; + + // Update special based on newly reset type + special = jQuery.event.special[ type ] || {}; + + // handleObj is passed to all event handlers + handleObj = jQuery.extend( { + type: type, + origType: origType, + data: data, + handler: handler, + guid: handler.guid, + selector: selector, + needsContext: selector && jQuery.expr.match.needsContext.test( selector ), + namespace: namespaces.join( "." ) + }, handleObjIn ); + + // Init the event handler queue if we're the first + if ( !( handlers = events[ type ] ) ) { + handlers = events[ type ] = []; + handlers.delegateCount = 0; + + // Only use addEventListener if the special events handler returns false + if ( !special.setup || + special.setup.call( elem, data, namespaces, eventHandle ) === false ) { + + if ( elem.addEventListener ) { + elem.addEventListener( type, eventHandle ); + } + } + } + + if ( special.add ) { + special.add.call( elem, handleObj ); + + if ( !handleObj.handler.guid ) { + handleObj.handler.guid = handler.guid; + } + } + + // Add to the element's handler list, delegates in front + if ( selector ) { + handlers.splice( handlers.delegateCount++, 0, handleObj ); + } else { + handlers.push( handleObj ); + } + + // Keep track of which events have ever been used, for event optimization + jQuery.event.global[ type ] = true; + } + + }, + + // Detach an event or set of events from an element + remove: function( elem, types, handler, selector, mappedTypes ) { + + var j, origCount, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.hasData( elem ) && dataPriv.get( elem ); + + if ( !elemData || !( events = elemData.events ) ) { + return; + } + + // Once for each type.namespace in types; type may be omitted + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // Unbind all events (on this namespace, if provided) for the element + if ( !type ) { + for ( type in events ) { + jQuery.event.remove( elem, type + types[ t ], handler, selector, true ); + } + continue; + } + + special = jQuery.event.special[ type ] || {}; + type = ( selector ? special.delegateType : special.bindType ) || type; + handlers = events[ type ] || []; + tmp = tmp[ 2 ] && + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ); + + // Remove matching events + origCount = j = handlers.length; + while ( j-- ) { + handleObj = handlers[ j ]; + + if ( ( mappedTypes || origType === handleObj.origType ) && + ( !handler || handler.guid === handleObj.guid ) && + ( !tmp || tmp.test( handleObj.namespace ) ) && + ( !selector || selector === handleObj.selector || + selector === "**" && handleObj.selector ) ) { + handlers.splice( j, 1 ); + + if ( handleObj.selector ) { + handlers.delegateCount--; + } + if ( special.remove ) { + special.remove.call( elem, handleObj ); + } + } + } + + // Remove generic event handler if we removed something and no more handlers exist + // (avoids potential for endless recursion during removal of special event handlers) + if ( origCount && !handlers.length ) { + if ( !special.teardown || + special.teardown.call( elem, namespaces, elemData.handle ) === false ) { + + jQuery.removeEvent( elem, type, elemData.handle ); + } + + delete events[ type ]; + } + } + + // Remove data and the expando if it's no longer used + if ( jQuery.isEmptyObject( events ) ) { + dataPriv.remove( elem, "handle events" ); + } + }, + + dispatch: function( nativeEvent ) { + + var i, j, ret, matched, handleObj, handlerQueue, + args = new Array( arguments.length ), + + // Make a writable jQuery.Event from the native event object + event = jQuery.event.fix( nativeEvent ), + + handlers = ( + dataPriv.get( this, "events" ) || Object.create( null ) + )[ event.type ] || [], + special = jQuery.event.special[ event.type ] || {}; + + // Use the fix-ed jQuery.Event rather than the (read-only) native event + args[ 0 ] = event; + + for ( i = 1; i < arguments.length; i++ ) { + args[ i ] = arguments[ i ]; + } + + event.delegateTarget = this; + + // Call the preDispatch hook for the mapped type, and let it bail if desired + if ( special.preDispatch && special.preDispatch.call( this, event ) === false ) { + return; + } + + // Determine handlers + handlerQueue = jQuery.event.handlers.call( this, event, handlers ); + + // Run delegates first; they may want to stop propagation beneath us + i = 0; + while ( ( matched = handlerQueue[ i++ ] ) && !event.isPropagationStopped() ) { + event.currentTarget = matched.elem; + + j = 0; + while ( ( handleObj = matched.handlers[ j++ ] ) && + !event.isImmediatePropagationStopped() ) { + + // If the event is namespaced, then each handler is only invoked if it is + // specially universal or its namespaces are a superset of the event's. + if ( !event.rnamespace || handleObj.namespace === false || + event.rnamespace.test( handleObj.namespace ) ) { + + event.handleObj = handleObj; + event.data = handleObj.data; + + ret = ( ( jQuery.event.special[ handleObj.origType ] || {} ).handle || + handleObj.handler ).apply( matched.elem, args ); + + if ( ret !== undefined ) { + if ( ( event.result = ret ) === false ) { + event.preventDefault(); + event.stopPropagation(); + } + } + } + } + } + + // Call the postDispatch hook for the mapped type + if ( special.postDispatch ) { + special.postDispatch.call( this, event ); + } + + return event.result; + }, + + handlers: function( event, handlers ) { + var i, handleObj, sel, matchedHandlers, matchedSelectors, + handlerQueue = [], + delegateCount = handlers.delegateCount, + cur = event.target; + + // Find delegate handlers + if ( delegateCount && + + // Support: IE <=9 + // Black-hole SVG instance trees (trac-13180) + cur.nodeType && + + // Support: Firefox <=42 + // Suppress spec-violating clicks indicating a non-primary pointer button (trac-3861) + // https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click + // Support: IE 11 only + // ...but not arrow key "clicks" of radio inputs, which can have `button` -1 (gh-2343) + !( event.type === "click" && event.button >= 1 ) ) { + + for ( ; cur !== this; cur = cur.parentNode || this ) { + + // Don't check non-elements (#13208) + // Don't process clicks on disabled elements (#6911, #8165, #11382, #11764) + if ( cur.nodeType === 1 && !( event.type === "click" && cur.disabled === true ) ) { + matchedHandlers = []; + matchedSelectors = {}; + for ( i = 0; i < delegateCount; i++ ) { + handleObj = handlers[ i ]; + + // Don't conflict with Object.prototype properties (#13203) + sel = handleObj.selector + " "; + + if ( matchedSelectors[ sel ] === undefined ) { + matchedSelectors[ sel ] = handleObj.needsContext ? + jQuery( sel, this ).index( cur ) > -1 : + jQuery.find( sel, this, null, [ cur ] ).length; + } + if ( matchedSelectors[ sel ] ) { + matchedHandlers.push( handleObj ); + } + } + if ( matchedHandlers.length ) { + handlerQueue.push( { elem: cur, handlers: matchedHandlers } ); + } + } + } + } + + // Add the remaining (directly-bound) handlers + cur = this; + if ( delegateCount < handlers.length ) { + handlerQueue.push( { elem: cur, handlers: handlers.slice( delegateCount ) } ); + } + + return handlerQueue; + }, + + addProp: function( name, hook ) { + Object.defineProperty( jQuery.Event.prototype, name, { + enumerable: true, + configurable: true, + + get: isFunction( hook ) ? + function() { + if ( this.originalEvent ) { + return hook( this.originalEvent ); + } + } : + function() { + if ( this.originalEvent ) { + return this.originalEvent[ name ]; + } + }, + + set: function( value ) { + Object.defineProperty( this, name, { + enumerable: true, + configurable: true, + writable: true, + value: value + } ); + } + } ); + }, + + fix: function( originalEvent ) { + return originalEvent[ jQuery.expando ] ? + originalEvent : + new jQuery.Event( originalEvent ); + }, + + special: { + load: { + + // Prevent triggered image.load events from bubbling to window.load + noBubble: true + }, + click: { + + // Utilize native event to ensure correct state for checkable inputs + setup: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Claim the first handler + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + // dataPriv.set( el, "click", ... ) + leverageNative( el, "click", returnTrue ); + } + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Force setup before triggering a click + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + leverageNative( el, "click" ); + } + + // Return non-false to allow normal event-path propagation + return true; + }, + + // For cross-browser consistency, suppress native .click() on links + // Also prevent it if we're currently inside a leveraged native-event stack + _default: function( event ) { + var target = event.target; + return rcheckableType.test( target.type ) && + target.click && nodeName( target, "input" ) && + dataPriv.get( target, "click" ) || + nodeName( target, "a" ); + } + }, + + beforeunload: { + postDispatch: function( event ) { + + // Support: Firefox 20+ + // Firefox doesn't alert if the returnValue field is not set. + if ( event.result !== undefined && event.originalEvent ) { + event.originalEvent.returnValue = event.result; + } + } + } + } +}; + +// Ensure the presence of an event listener that handles manually-triggered +// synthetic events by interrupting progress until reinvoked in response to +// *native* events that it fires directly, ensuring that state changes have +// already occurred before other listeners are invoked. +function leverageNative( el, type, expectSync ) { + + // Missing expectSync indicates a trigger call, which must force setup through jQuery.event.add + if ( !expectSync ) { + if ( dataPriv.get( el, type ) === undefined ) { + jQuery.event.add( el, type, returnTrue ); + } + return; + } + + // Register the controller as a special universal handler for all event namespaces + dataPriv.set( el, type, false ); + jQuery.event.add( el, type, { + namespace: false, + handler: function( event ) { + var notAsync, result, + saved = dataPriv.get( this, type ); + + if ( ( event.isTrigger & 1 ) && this[ type ] ) { + + // Interrupt processing of the outer synthetic .trigger()ed event + // Saved data should be false in such cases, but might be a leftover capture object + // from an async native handler (gh-4350) + if ( !saved.length ) { + + // Store arguments for use when handling the inner native event + // There will always be at least one argument (an event object), so this array + // will not be confused with a leftover capture object. + saved = slice.call( arguments ); + dataPriv.set( this, type, saved ); + + // Trigger the native event and capture its result + // Support: IE <=9 - 11+ + // focus() and blur() are asynchronous + notAsync = expectSync( this, type ); + this[ type ](); + result = dataPriv.get( this, type ); + if ( saved !== result || notAsync ) { + dataPriv.set( this, type, false ); + } else { + result = {}; + } + if ( saved !== result ) { + + // Cancel the outer synthetic event + event.stopImmediatePropagation(); + event.preventDefault(); + + // Support: Chrome 86+ + // In Chrome, if an element having a focusout handler is blurred by + // clicking outside of it, it invokes the handler synchronously. If + // that handler calls `.remove()` on the element, the data is cleared, + // leaving `result` undefined. We need to guard against this. + return result && result.value; + } + + // If this is an inner synthetic event for an event with a bubbling surrogate + // (focus or blur), assume that the surrogate already propagated from triggering the + // native event and prevent that from happening again here. + // This technically gets the ordering wrong w.r.t. to `.trigger()` (in which the + // bubbling surrogate propagates *after* the non-bubbling base), but that seems + // less bad than duplication. + } else if ( ( jQuery.event.special[ type ] || {} ).delegateType ) { + event.stopPropagation(); + } + + // If this is a native event triggered above, everything is now in order + // Fire an inner synthetic event with the original arguments + } else if ( saved.length ) { + + // ...and capture the result + dataPriv.set( this, type, { + value: jQuery.event.trigger( + + // Support: IE <=9 - 11+ + // Extend with the prototype to reset the above stopImmediatePropagation() + jQuery.extend( saved[ 0 ], jQuery.Event.prototype ), + saved.slice( 1 ), + this + ) + } ); + + // Abort handling of the native event + event.stopImmediatePropagation(); + } + } + } ); +} + +jQuery.removeEvent = function( elem, type, handle ) { + + // This "if" is needed for plain objects + if ( elem.removeEventListener ) { + elem.removeEventListener( type, handle ); + } +}; + +jQuery.Event = function( src, props ) { + + // Allow instantiation without the 'new' keyword + if ( !( this instanceof jQuery.Event ) ) { + return new jQuery.Event( src, props ); + } + + // Event object + if ( src && src.type ) { + this.originalEvent = src; + this.type = src.type; + + // Events bubbling up the document may have been marked as prevented + // by a handler lower down the tree; reflect the correct value. + this.isDefaultPrevented = src.defaultPrevented || + src.defaultPrevented === undefined && + + // Support: Android <=2.3 only + src.returnValue === false ? + returnTrue : + returnFalse; + + // Create target properties + // Support: Safari <=6 - 7 only + // Target should not be a text node (#504, #13143) + this.target = ( src.target && src.target.nodeType === 3 ) ? + src.target.parentNode : + src.target; + + this.currentTarget = src.currentTarget; + this.relatedTarget = src.relatedTarget; + + // Event type + } else { + this.type = src; + } + + // Put explicitly provided properties onto the event object + if ( props ) { + jQuery.extend( this, props ); + } + + // Create a timestamp if incoming event doesn't have one + this.timeStamp = src && src.timeStamp || Date.now(); + + // Mark it as fixed + this[ jQuery.expando ] = true; +}; + +// jQuery.Event is based on DOM3 Events as specified by the ECMAScript Language Binding +// https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html +jQuery.Event.prototype = { + constructor: jQuery.Event, + isDefaultPrevented: returnFalse, + isPropagationStopped: returnFalse, + isImmediatePropagationStopped: returnFalse, + isSimulated: false, + + preventDefault: function() { + var e = this.originalEvent; + + this.isDefaultPrevented = returnTrue; + + if ( e && !this.isSimulated ) { + e.preventDefault(); + } + }, + stopPropagation: function() { + var e = this.originalEvent; + + this.isPropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopPropagation(); + } + }, + stopImmediatePropagation: function() { + var e = this.originalEvent; + + this.isImmediatePropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopImmediatePropagation(); + } + + this.stopPropagation(); + } +}; + +// Includes all common event props including KeyEvent and MouseEvent specific props +jQuery.each( { + altKey: true, + bubbles: true, + cancelable: true, + changedTouches: true, + ctrlKey: true, + detail: true, + eventPhase: true, + metaKey: true, + pageX: true, + pageY: true, + shiftKey: true, + view: true, + "char": true, + code: true, + charCode: true, + key: true, + keyCode: true, + button: true, + buttons: true, + clientX: true, + clientY: true, + offsetX: true, + offsetY: true, + pointerId: true, + pointerType: true, + screenX: true, + screenY: true, + targetTouches: true, + toElement: true, + touches: true, + which: true +}, jQuery.event.addProp ); + +jQuery.each( { focus: "focusin", blur: "focusout" }, function( type, delegateType ) { + jQuery.event.special[ type ] = { + + // Utilize native event if possible so blur/focus sequence is correct + setup: function() { + + // Claim the first handler + // dataPriv.set( this, "focus", ... ) + // dataPriv.set( this, "blur", ... ) + leverageNative( this, type, expectSync ); + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function() { + + // Force setup before trigger + leverageNative( this, type ); + + // Return non-false to allow normal event-path propagation + return true; + }, + + // Suppress native focus or blur as it's already being fired + // in leverageNative. + _default: function() { + return true; + }, + + delegateType: delegateType + }; +} ); + +// Create mouseenter/leave events using mouseover/out and event-time checks +// so that event delegation works in jQuery. +// Do the same for pointerenter/pointerleave and pointerover/pointerout +// +// Support: Safari 7 only +// Safari sends mouseenter too often; see: +// https://bugs.chromium.org/p/chromium/issues/detail?id=470258 +// for the description of the bug (it existed in older Chrome versions as well). +jQuery.each( { + mouseenter: "mouseover", + mouseleave: "mouseout", + pointerenter: "pointerover", + pointerleave: "pointerout" +}, function( orig, fix ) { + jQuery.event.special[ orig ] = { + delegateType: fix, + bindType: fix, + + handle: function( event ) { + var ret, + target = this, + related = event.relatedTarget, + handleObj = event.handleObj; + + // For mouseenter/leave call the handler if related is outside the target. + // NB: No relatedTarget if the mouse left/entered the browser window + if ( !related || ( related !== target && !jQuery.contains( target, related ) ) ) { + event.type = handleObj.origType; + ret = handleObj.handler.apply( this, arguments ); + event.type = fix; + } + return ret; + } + }; +} ); + +jQuery.fn.extend( { + + on: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn ); + }, + one: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn, 1 ); + }, + off: function( types, selector, fn ) { + var handleObj, type; + if ( types && types.preventDefault && types.handleObj ) { + + // ( event ) dispatched jQuery.Event + handleObj = types.handleObj; + jQuery( types.delegateTarget ).off( + handleObj.namespace ? + handleObj.origType + "." + handleObj.namespace : + handleObj.origType, + handleObj.selector, + handleObj.handler + ); + return this; + } + if ( typeof types === "object" ) { + + // ( types-object [, selector] ) + for ( type in types ) { + this.off( type, selector, types[ type ] ); + } + return this; + } + if ( selector === false || typeof selector === "function" ) { + + // ( types [, fn] ) + fn = selector; + selector = undefined; + } + if ( fn === false ) { + fn = returnFalse; + } + return this.each( function() { + jQuery.event.remove( this, types, fn, selector ); + } ); + } +} ); + + +var + + // Support: IE <=10 - 11, Edge 12 - 13 only + // In IE/Edge using regex groups here causes severe slowdowns. + // See https://connect.microsoft.com/IE/feedback/details/1736512/ + rnoInnerhtml = /\s*$/g; + +// Prefer a tbody over its parent table for containing new rows +function manipulationTarget( elem, content ) { + if ( nodeName( elem, "table" ) && + nodeName( content.nodeType !== 11 ? content : content.firstChild, "tr" ) ) { + + return jQuery( elem ).children( "tbody" )[ 0 ] || elem; + } + + return elem; +} + +// Replace/restore the type attribute of script elements for safe DOM manipulation +function disableScript( elem ) { + elem.type = ( elem.getAttribute( "type" ) !== null ) + "/" + elem.type; + return elem; +} +function restoreScript( elem ) { + if ( ( elem.type || "" ).slice( 0, 5 ) === "true/" ) { + elem.type = elem.type.slice( 5 ); + } else { + elem.removeAttribute( "type" ); + } + + return elem; +} + +function cloneCopyEvent( src, dest ) { + var i, l, type, pdataOld, udataOld, udataCur, events; + + if ( dest.nodeType !== 1 ) { + return; + } + + // 1. Copy private data: events, handlers, etc. + if ( dataPriv.hasData( src ) ) { + pdataOld = dataPriv.get( src ); + events = pdataOld.events; + + if ( events ) { + dataPriv.remove( dest, "handle events" ); + + for ( type in events ) { + for ( i = 0, l = events[ type ].length; i < l; i++ ) { + jQuery.event.add( dest, type, events[ type ][ i ] ); + } + } + } + } + + // 2. Copy user data + if ( dataUser.hasData( src ) ) { + udataOld = dataUser.access( src ); + udataCur = jQuery.extend( {}, udataOld ); + + dataUser.set( dest, udataCur ); + } +} + +// Fix IE bugs, see support tests +function fixInput( src, dest ) { + var nodeName = dest.nodeName.toLowerCase(); + + // Fails to persist the checked state of a cloned checkbox or radio button. + if ( nodeName === "input" && rcheckableType.test( src.type ) ) { + dest.checked = src.checked; + + // Fails to return the selected option to the default selected state when cloning options + } else if ( nodeName === "input" || nodeName === "textarea" ) { + dest.defaultValue = src.defaultValue; + } +} + +function domManip( collection, args, callback, ignored ) { + + // Flatten any nested arrays + args = flat( args ); + + var fragment, first, scripts, hasScripts, node, doc, + i = 0, + l = collection.length, + iNoClone = l - 1, + value = args[ 0 ], + valueIsFunction = isFunction( value ); + + // We can't cloneNode fragments that contain checked, in WebKit + if ( valueIsFunction || + ( l > 1 && typeof value === "string" && + !support.checkClone && rchecked.test( value ) ) ) { + return collection.each( function( index ) { + var self = collection.eq( index ); + if ( valueIsFunction ) { + args[ 0 ] = value.call( this, index, self.html() ); + } + domManip( self, args, callback, ignored ); + } ); + } + + if ( l ) { + fragment = buildFragment( args, collection[ 0 ].ownerDocument, false, collection, ignored ); + first = fragment.firstChild; + + if ( fragment.childNodes.length === 1 ) { + fragment = first; + } + + // Require either new content or an interest in ignored elements to invoke the callback + if ( first || ignored ) { + scripts = jQuery.map( getAll( fragment, "script" ), disableScript ); + hasScripts = scripts.length; + + // Use the original fragment for the last item + // instead of the first because it can end up + // being emptied incorrectly in certain situations (#8070). + for ( ; i < l; i++ ) { + node = fragment; + + if ( i !== iNoClone ) { + node = jQuery.clone( node, true, true ); + + // Keep references to cloned scripts for later restoration + if ( hasScripts ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( scripts, getAll( node, "script" ) ); + } + } + + callback.call( collection[ i ], node, i ); + } + + if ( hasScripts ) { + doc = scripts[ scripts.length - 1 ].ownerDocument; + + // Reenable scripts + jQuery.map( scripts, restoreScript ); + + // Evaluate executable scripts on first document insertion + for ( i = 0; i < hasScripts; i++ ) { + node = scripts[ i ]; + if ( rscriptType.test( node.type || "" ) && + !dataPriv.access( node, "globalEval" ) && + jQuery.contains( doc, node ) ) { + + if ( node.src && ( node.type || "" ).toLowerCase() !== "module" ) { + + // Optional AJAX dependency, but won't run scripts if not present + if ( jQuery._evalUrl && !node.noModule ) { + jQuery._evalUrl( node.src, { + nonce: node.nonce || node.getAttribute( "nonce" ) + }, doc ); + } + } else { + DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc ); + } + } + } + } + } + } + + return collection; +} + +function remove( elem, selector, keepData ) { + var node, + nodes = selector ? jQuery.filter( selector, elem ) : elem, + i = 0; + + for ( ; ( node = nodes[ i ] ) != null; i++ ) { + if ( !keepData && node.nodeType === 1 ) { + jQuery.cleanData( getAll( node ) ); + } + + if ( node.parentNode ) { + if ( keepData && isAttached( node ) ) { + setGlobalEval( getAll( node, "script" ) ); + } + node.parentNode.removeChild( node ); + } + } + + return elem; +} + +jQuery.extend( { + htmlPrefilter: function( html ) { + return html; + }, + + clone: function( elem, dataAndEvents, deepDataAndEvents ) { + var i, l, srcElements, destElements, + clone = elem.cloneNode( true ), + inPage = isAttached( elem ); + + // Fix IE cloning issues + if ( !support.noCloneChecked && ( elem.nodeType === 1 || elem.nodeType === 11 ) && + !jQuery.isXMLDoc( elem ) ) { + + // We eschew Sizzle here for performance reasons: https://jsperf.com/getall-vs-sizzle/2 + destElements = getAll( clone ); + srcElements = getAll( elem ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + fixInput( srcElements[ i ], destElements[ i ] ); + } + } + + // Copy the events from the original to the clone + if ( dataAndEvents ) { + if ( deepDataAndEvents ) { + srcElements = srcElements || getAll( elem ); + destElements = destElements || getAll( clone ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + cloneCopyEvent( srcElements[ i ], destElements[ i ] ); + } + } else { + cloneCopyEvent( elem, clone ); + } + } + + // Preserve script evaluation history + destElements = getAll( clone, "script" ); + if ( destElements.length > 0 ) { + setGlobalEval( destElements, !inPage && getAll( elem, "script" ) ); + } + + // Return the cloned set + return clone; + }, + + cleanData: function( elems ) { + var data, elem, type, + special = jQuery.event.special, + i = 0; + + for ( ; ( elem = elems[ i ] ) !== undefined; i++ ) { + if ( acceptData( elem ) ) { + if ( ( data = elem[ dataPriv.expando ] ) ) { + if ( data.events ) { + for ( type in data.events ) { + if ( special[ type ] ) { + jQuery.event.remove( elem, type ); + + // This is a shortcut to avoid jQuery.event.remove's overhead + } else { + jQuery.removeEvent( elem, type, data.handle ); + } + } + } + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataPriv.expando ] = undefined; + } + if ( elem[ dataUser.expando ] ) { + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataUser.expando ] = undefined; + } + } + } + } +} ); + +jQuery.fn.extend( { + detach: function( selector ) { + return remove( this, selector, true ); + }, + + remove: function( selector ) { + return remove( this, selector ); + }, + + text: function( value ) { + return access( this, function( value ) { + return value === undefined ? + jQuery.text( this ) : + this.empty().each( function() { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + this.textContent = value; + } + } ); + }, null, value, arguments.length ); + }, + + append: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.appendChild( elem ); + } + } ); + }, + + prepend: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.insertBefore( elem, target.firstChild ); + } + } ); + }, + + before: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this ); + } + } ); + }, + + after: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this.nextSibling ); + } + } ); + }, + + empty: function() { + var elem, + i = 0; + + for ( ; ( elem = this[ i ] ) != null; i++ ) { + if ( elem.nodeType === 1 ) { + + // Prevent memory leaks + jQuery.cleanData( getAll( elem, false ) ); + + // Remove any remaining nodes + elem.textContent = ""; + } + } + + return this; + }, + + clone: function( dataAndEvents, deepDataAndEvents ) { + dataAndEvents = dataAndEvents == null ? false : dataAndEvents; + deepDataAndEvents = deepDataAndEvents == null ? dataAndEvents : deepDataAndEvents; + + return this.map( function() { + return jQuery.clone( this, dataAndEvents, deepDataAndEvents ); + } ); + }, + + html: function( value ) { + return access( this, function( value ) { + var elem = this[ 0 ] || {}, + i = 0, + l = this.length; + + if ( value === undefined && elem.nodeType === 1 ) { + return elem.innerHTML; + } + + // See if we can take a shortcut and just use innerHTML + if ( typeof value === "string" && !rnoInnerhtml.test( value ) && + !wrapMap[ ( rtagName.exec( value ) || [ "", "" ] )[ 1 ].toLowerCase() ] ) { + + value = jQuery.htmlPrefilter( value ); + + try { + for ( ; i < l; i++ ) { + elem = this[ i ] || {}; + + // Remove element nodes and prevent memory leaks + if ( elem.nodeType === 1 ) { + jQuery.cleanData( getAll( elem, false ) ); + elem.innerHTML = value; + } + } + + elem = 0; + + // If using innerHTML throws an exception, use the fallback method + } catch ( e ) {} + } + + if ( elem ) { + this.empty().append( value ); + } + }, null, value, arguments.length ); + }, + + replaceWith: function() { + var ignored = []; + + // Make the changes, replacing each non-ignored context element with the new content + return domManip( this, arguments, function( elem ) { + var parent = this.parentNode; + + if ( jQuery.inArray( this, ignored ) < 0 ) { + jQuery.cleanData( getAll( this ) ); + if ( parent ) { + parent.replaceChild( elem, this ); + } + } + + // Force callback invocation + }, ignored ); + } +} ); + +jQuery.each( { + appendTo: "append", + prependTo: "prepend", + insertBefore: "before", + insertAfter: "after", + replaceAll: "replaceWith" +}, function( name, original ) { + jQuery.fn[ name ] = function( selector ) { + var elems, + ret = [], + insert = jQuery( selector ), + last = insert.length - 1, + i = 0; + + for ( ; i <= last; i++ ) { + elems = i === last ? this : this.clone( true ); + jQuery( insert[ i ] )[ original ]( elems ); + + // Support: Android <=4.0 only, PhantomJS 1 only + // .get() because push.apply(_, arraylike) throws on ancient WebKit + push.apply( ret, elems.get() ); + } + + return this.pushStack( ret ); + }; +} ); +var rnumnonpx = new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" ); + +var getStyles = function( elem ) { + + // Support: IE <=11 only, Firefox <=30 (#15098, #14150) + // IE throws on elements created in popups + // FF meanwhile throws on frame elements through "defaultView.getComputedStyle" + var view = elem.ownerDocument.defaultView; + + if ( !view || !view.opener ) { + view = window; + } + + return view.getComputedStyle( elem ); + }; + +var swap = function( elem, options, callback ) { + var ret, name, + old = {}; + + // Remember the old values, and insert the new ones + for ( name in options ) { + old[ name ] = elem.style[ name ]; + elem.style[ name ] = options[ name ]; + } + + ret = callback.call( elem ); + + // Revert the old values + for ( name in options ) { + elem.style[ name ] = old[ name ]; + } + + return ret; +}; + + +var rboxStyle = new RegExp( cssExpand.join( "|" ), "i" ); + + + +( function() { + + // Executing both pixelPosition & boxSizingReliable tests require only one layout + // so they're executed at the same time to save the second computation. + function computeStyleTests() { + + // This is a singleton, we need to execute it only once + if ( !div ) { + return; + } + + container.style.cssText = "position:absolute;left:-11111px;width:60px;" + + "margin-top:1px;padding:0;border:0"; + div.style.cssText = + "position:relative;display:block;box-sizing:border-box;overflow:scroll;" + + "margin:auto;border:1px;padding:1px;" + + "width:60%;top:1%"; + documentElement.appendChild( container ).appendChild( div ); + + var divStyle = window.getComputedStyle( div ); + pixelPositionVal = divStyle.top !== "1%"; + + // Support: Android 4.0 - 4.3 only, Firefox <=3 - 44 + reliableMarginLeftVal = roundPixelMeasures( divStyle.marginLeft ) === 12; + + // Support: Android 4.0 - 4.3 only, Safari <=9.1 - 10.1, iOS <=7.0 - 9.3 + // Some styles come back with percentage values, even though they shouldn't + div.style.right = "60%"; + pixelBoxStylesVal = roundPixelMeasures( divStyle.right ) === 36; + + // Support: IE 9 - 11 only + // Detect misreporting of content dimensions for box-sizing:border-box elements + boxSizingReliableVal = roundPixelMeasures( divStyle.width ) === 36; + + // Support: IE 9 only + // Detect overflow:scroll screwiness (gh-3699) + // Support: Chrome <=64 + // Don't get tricked when zoom affects offsetWidth (gh-4029) + div.style.position = "absolute"; + scrollboxSizeVal = roundPixelMeasures( div.offsetWidth / 3 ) === 12; + + documentElement.removeChild( container ); + + // Nullify the div so it wouldn't be stored in the memory and + // it will also be a sign that checks already performed + div = null; + } + + function roundPixelMeasures( measure ) { + return Math.round( parseFloat( measure ) ); + } + + var pixelPositionVal, boxSizingReliableVal, scrollboxSizeVal, pixelBoxStylesVal, + reliableTrDimensionsVal, reliableMarginLeftVal, + container = document.createElement( "div" ), + div = document.createElement( "div" ); + + // Finish early in limited (non-browser) environments + if ( !div.style ) { + return; + } + + // Support: IE <=9 - 11 only + // Style of cloned element affects source element cloned (#8908) + div.style.backgroundClip = "content-box"; + div.cloneNode( true ).style.backgroundClip = ""; + support.clearCloneStyle = div.style.backgroundClip === "content-box"; + + jQuery.extend( support, { + boxSizingReliable: function() { + computeStyleTests(); + return boxSizingReliableVal; + }, + pixelBoxStyles: function() { + computeStyleTests(); + return pixelBoxStylesVal; + }, + pixelPosition: function() { + computeStyleTests(); + return pixelPositionVal; + }, + reliableMarginLeft: function() { + computeStyleTests(); + return reliableMarginLeftVal; + }, + scrollboxSize: function() { + computeStyleTests(); + return scrollboxSizeVal; + }, + + // Support: IE 9 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Behavior in IE 9 is more subtle than in newer versions & it passes + // some versions of this test; make sure not to make it pass there! + // + // Support: Firefox 70+ + // Only Firefox includes border widths + // in computed dimensions. (gh-4529) + reliableTrDimensions: function() { + var table, tr, trChild, trStyle; + if ( reliableTrDimensionsVal == null ) { + table = document.createElement( "table" ); + tr = document.createElement( "tr" ); + trChild = document.createElement( "div" ); + + table.style.cssText = "position:absolute;left:-11111px;border-collapse:separate"; + tr.style.cssText = "border:1px solid"; + + // Support: Chrome 86+ + // Height set through cssText does not get applied. + // Computed height then comes back as 0. + tr.style.height = "1px"; + trChild.style.height = "9px"; + + // Support: Android 8 Chrome 86+ + // In our bodyBackground.html iframe, + // display for all div elements is set to "inline", + // which causes a problem only in Android 8 Chrome 86. + // Ensuring the div is display: block + // gets around this issue. + trChild.style.display = "block"; + + documentElement + .appendChild( table ) + .appendChild( tr ) + .appendChild( trChild ); + + trStyle = window.getComputedStyle( tr ); + reliableTrDimensionsVal = ( parseInt( trStyle.height, 10 ) + + parseInt( trStyle.borderTopWidth, 10 ) + + parseInt( trStyle.borderBottomWidth, 10 ) ) === tr.offsetHeight; + + documentElement.removeChild( table ); + } + return reliableTrDimensionsVal; + } + } ); +} )(); + + +function curCSS( elem, name, computed ) { + var width, minWidth, maxWidth, ret, + + // Support: Firefox 51+ + // Retrieving style before computed somehow + // fixes an issue with getting wrong values + // on detached elements + style = elem.style; + + computed = computed || getStyles( elem ); + + // getPropertyValue is needed for: + // .css('filter') (IE 9 only, #12537) + // .css('--customProperty) (#3144) + if ( computed ) { + ret = computed.getPropertyValue( name ) || computed[ name ]; + + if ( ret === "" && !isAttached( elem ) ) { + ret = jQuery.style( elem, name ); + } + + // A tribute to the "awesome hack by Dean Edwards" + // Android Browser returns percentage for some values, + // but width seems to be reliably pixels. + // This is against the CSSOM draft spec: + // https://drafts.csswg.org/cssom/#resolved-values + if ( !support.pixelBoxStyles() && rnumnonpx.test( ret ) && rboxStyle.test( name ) ) { + + // Remember the original values + width = style.width; + minWidth = style.minWidth; + maxWidth = style.maxWidth; + + // Put in the new values to get a computed value out + style.minWidth = style.maxWidth = style.width = ret; + ret = computed.width; + + // Revert the changed values + style.width = width; + style.minWidth = minWidth; + style.maxWidth = maxWidth; + } + } + + return ret !== undefined ? + + // Support: IE <=9 - 11 only + // IE returns zIndex value as an integer. + ret + "" : + ret; +} + + +function addGetHookIf( conditionFn, hookFn ) { + + // Define the hook, we'll check on the first run if it's really needed. + return { + get: function() { + if ( conditionFn() ) { + + // Hook not needed (or it's not possible to use it due + // to missing dependency), remove it. + delete this.get; + return; + } + + // Hook needed; redefine it so that the support test is not executed again. + return ( this.get = hookFn ).apply( this, arguments ); + } + }; +} + + +var cssPrefixes = [ "Webkit", "Moz", "ms" ], + emptyStyle = document.createElement( "div" ).style, + vendorProps = {}; + +// Return a vendor-prefixed property or undefined +function vendorPropName( name ) { + + // Check for vendor prefixed names + var capName = name[ 0 ].toUpperCase() + name.slice( 1 ), + i = cssPrefixes.length; + + while ( i-- ) { + name = cssPrefixes[ i ] + capName; + if ( name in emptyStyle ) { + return name; + } + } +} + +// Return a potentially-mapped jQuery.cssProps or vendor prefixed property +function finalPropName( name ) { + var final = jQuery.cssProps[ name ] || vendorProps[ name ]; + + if ( final ) { + return final; + } + if ( name in emptyStyle ) { + return name; + } + return vendorProps[ name ] = vendorPropName( name ) || name; +} + + +var + + // Swappable if display is none or starts with table + // except "table", "table-cell", or "table-caption" + // See here for display values: https://developer.mozilla.org/en-US/docs/CSS/display + rdisplayswap = /^(none|table(?!-c[ea]).+)/, + rcustomProp = /^--/, + cssShow = { position: "absolute", visibility: "hidden", display: "block" }, + cssNormalTransform = { + letterSpacing: "0", + fontWeight: "400" + }; + +function setPositiveNumber( _elem, value, subtract ) { + + // Any relative (+/-) values have already been + // normalized at this point + var matches = rcssNum.exec( value ); + return matches ? + + // Guard against undefined "subtract", e.g., when used as in cssHooks + Math.max( 0, matches[ 2 ] - ( subtract || 0 ) ) + ( matches[ 3 ] || "px" ) : + value; +} + +function boxModelAdjustment( elem, dimension, box, isBorderBox, styles, computedVal ) { + var i = dimension === "width" ? 1 : 0, + extra = 0, + delta = 0; + + // Adjustment may not be necessary + if ( box === ( isBorderBox ? "border" : "content" ) ) { + return 0; + } + + for ( ; i < 4; i += 2 ) { + + // Both box models exclude margin + if ( box === "margin" ) { + delta += jQuery.css( elem, box + cssExpand[ i ], true, styles ); + } + + // If we get here with a content-box, we're seeking "padding" or "border" or "margin" + if ( !isBorderBox ) { + + // Add padding + delta += jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + + // For "border" or "margin", add border + if ( box !== "padding" ) { + delta += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + + // But still keep track of it otherwise + } else { + extra += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + + // If we get here with a border-box (content + padding + border), we're seeking "content" or + // "padding" or "margin" + } else { + + // For "content", subtract padding + if ( box === "content" ) { + delta -= jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + } + + // For "content" or "padding", subtract border + if ( box !== "margin" ) { + delta -= jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + } + } + + // Account for positive content-box scroll gutter when requested by providing computedVal + if ( !isBorderBox && computedVal >= 0 ) { + + // offsetWidth/offsetHeight is a rounded sum of content, padding, scroll gutter, and border + // Assuming integer scroll gutter, subtract the rest and round down + delta += Math.max( 0, Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + computedVal - + delta - + extra - + 0.5 + + // If offsetWidth/offsetHeight is unknown, then we can't determine content-box scroll gutter + // Use an explicit zero to avoid NaN (gh-3964) + ) ) || 0; + } + + return delta; +} + +function getWidthOrHeight( elem, dimension, extra ) { + + // Start with computed style + var styles = getStyles( elem ), + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-4322). + // Fake content-box until we know it's needed to know the true value. + boxSizingNeeded = !support.boxSizingReliable() || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + valueIsBorderBox = isBorderBox, + + val = curCSS( elem, dimension, styles ), + offsetProp = "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ); + + // Support: Firefox <=54 + // Return a confounding non-pixel value or feign ignorance, as appropriate. + if ( rnumnonpx.test( val ) ) { + if ( !extra ) { + return val; + } + val = "auto"; + } + + + // Support: IE 9 - 11 only + // Use offsetWidth/offsetHeight for when box sizing is unreliable. + // In those cases, the computed value can be trusted to be border-box. + if ( ( !support.boxSizingReliable() && isBorderBox || + + // Support: IE 10 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Interestingly, in some cases IE 9 doesn't suffer from this issue. + !support.reliableTrDimensions() && nodeName( elem, "tr" ) || + + // Fall back to offsetWidth/offsetHeight when value is "auto" + // This happens for inline elements with no explicit setting (gh-3571) + val === "auto" || + + // Support: Android <=4.1 - 4.3 only + // Also use offsetWidth/offsetHeight for misreported inline dimensions (gh-3602) + !parseFloat( val ) && jQuery.css( elem, "display", false, styles ) === "inline" ) && + + // Make sure the element is visible & connected + elem.getClientRects().length ) { + + isBorderBox = jQuery.css( elem, "boxSizing", false, styles ) === "border-box"; + + // Where available, offsetWidth/offsetHeight approximate border box dimensions. + // Where not available (e.g., SVG), assume unreliable box-sizing and interpret the + // retrieved value as a content box dimension. + valueIsBorderBox = offsetProp in elem; + if ( valueIsBorderBox ) { + val = elem[ offsetProp ]; + } + } + + // Normalize "" and auto + val = parseFloat( val ) || 0; + + // Adjust for the element's box model + return ( val + + boxModelAdjustment( + elem, + dimension, + extra || ( isBorderBox ? "border" : "content" ), + valueIsBorderBox, + styles, + + // Provide the current computed size to request scroll gutter calculation (gh-3589) + val + ) + ) + "px"; +} + +jQuery.extend( { + + // Add in style property hooks for overriding the default + // behavior of getting and setting a style property + cssHooks: { + opacity: { + get: function( elem, computed ) { + if ( computed ) { + + // We should always get a number back from opacity + var ret = curCSS( elem, "opacity" ); + return ret === "" ? "1" : ret; + } + } + } + }, + + // Don't automatically add "px" to these possibly-unitless properties + cssNumber: { + "animationIterationCount": true, + "columnCount": true, + "fillOpacity": true, + "flexGrow": true, + "flexShrink": true, + "fontWeight": true, + "gridArea": true, + "gridColumn": true, + "gridColumnEnd": true, + "gridColumnStart": true, + "gridRow": true, + "gridRowEnd": true, + "gridRowStart": true, + "lineHeight": true, + "opacity": true, + "order": true, + "orphans": true, + "widows": true, + "zIndex": true, + "zoom": true + }, + + // Add in properties whose names you wish to fix before + // setting or getting the value + cssProps: {}, + + // Get and set the style property on a DOM Node + style: function( elem, name, value, extra ) { + + // Don't set styles on text and comment nodes + if ( !elem || elem.nodeType === 3 || elem.nodeType === 8 || !elem.style ) { + return; + } + + // Make sure that we're working with the right name + var ret, type, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ), + style = elem.style; + + // Make sure that we're working with the right name. We don't + // want to query the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Gets hook for the prefixed version, then unprefixed version + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // Check if we're setting a value + if ( value !== undefined ) { + type = typeof value; + + // Convert "+=" or "-=" to relative numbers (#7345) + if ( type === "string" && ( ret = rcssNum.exec( value ) ) && ret[ 1 ] ) { + value = adjustCSS( elem, name, ret ); + + // Fixes bug #9237 + type = "number"; + } + + // Make sure that null and NaN values aren't set (#7116) + if ( value == null || value !== value ) { + return; + } + + // If a number was passed in, add the unit (except for certain CSS properties) + // The isCustomProp check can be removed in jQuery 4.0 when we only auto-append + // "px" to a few hardcoded values. + if ( type === "number" && !isCustomProp ) { + value += ret && ret[ 3 ] || ( jQuery.cssNumber[ origName ] ? "" : "px" ); + } + + // background-* props affect original clone's values + if ( !support.clearCloneStyle && value === "" && name.indexOf( "background" ) === 0 ) { + style[ name ] = "inherit"; + } + + // If a hook was provided, use that value, otherwise just set the specified value + if ( !hooks || !( "set" in hooks ) || + ( value = hooks.set( elem, value, extra ) ) !== undefined ) { + + if ( isCustomProp ) { + style.setProperty( name, value ); + } else { + style[ name ] = value; + } + } + + } else { + + // If a hook was provided get the non-computed value from there + if ( hooks && "get" in hooks && + ( ret = hooks.get( elem, false, extra ) ) !== undefined ) { + + return ret; + } + + // Otherwise just get the value from the style object + return style[ name ]; + } + }, + + css: function( elem, name, extra, styles ) { + var val, num, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ); + + // Make sure that we're working with the right name. We don't + // want to modify the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Try prefixed name followed by the unprefixed name + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // If a hook was provided get the computed value from there + if ( hooks && "get" in hooks ) { + val = hooks.get( elem, true, extra ); + } + + // Otherwise, if a way to get the computed value exists, use that + if ( val === undefined ) { + val = curCSS( elem, name, styles ); + } + + // Convert "normal" to computed value + if ( val === "normal" && name in cssNormalTransform ) { + val = cssNormalTransform[ name ]; + } + + // Make numeric if forced or a qualifier was provided and val looks numeric + if ( extra === "" || extra ) { + num = parseFloat( val ); + return extra === true || isFinite( num ) ? num || 0 : val; + } + + return val; + } +} ); + +jQuery.each( [ "height", "width" ], function( _i, dimension ) { + jQuery.cssHooks[ dimension ] = { + get: function( elem, computed, extra ) { + if ( computed ) { + + // Certain elements can have dimension info if we invisibly show them + // but it must have a current display style that would benefit + return rdisplayswap.test( jQuery.css( elem, "display" ) ) && + + // Support: Safari 8+ + // Table columns in Safari have non-zero offsetWidth & zero + // getBoundingClientRect().width unless display is changed. + // Support: IE <=11 only + // Running getBoundingClientRect on a disconnected node + // in IE throws an error. + ( !elem.getClientRects().length || !elem.getBoundingClientRect().width ) ? + swap( elem, cssShow, function() { + return getWidthOrHeight( elem, dimension, extra ); + } ) : + getWidthOrHeight( elem, dimension, extra ); + } + }, + + set: function( elem, value, extra ) { + var matches, + styles = getStyles( elem ), + + // Only read styles.position if the test has a chance to fail + // to avoid forcing a reflow. + scrollboxSizeBuggy = !support.scrollboxSize() && + styles.position === "absolute", + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-3991) + boxSizingNeeded = scrollboxSizeBuggy || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + subtract = extra ? + boxModelAdjustment( + elem, + dimension, + extra, + isBorderBox, + styles + ) : + 0; + + // Account for unreliable border-box dimensions by comparing offset* to computed and + // faking a content-box to get border and padding (gh-3699) + if ( isBorderBox && scrollboxSizeBuggy ) { + subtract -= Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + parseFloat( styles[ dimension ] ) - + boxModelAdjustment( elem, dimension, "border", false, styles ) - + 0.5 + ); + } + + // Convert to pixels if value adjustment is needed + if ( subtract && ( matches = rcssNum.exec( value ) ) && + ( matches[ 3 ] || "px" ) !== "px" ) { + + elem.style[ dimension ] = value; + value = jQuery.css( elem, dimension ); + } + + return setPositiveNumber( elem, value, subtract ); + } + }; +} ); + +jQuery.cssHooks.marginLeft = addGetHookIf( support.reliableMarginLeft, + function( elem, computed ) { + if ( computed ) { + return ( parseFloat( curCSS( elem, "marginLeft" ) ) || + elem.getBoundingClientRect().left - + swap( elem, { marginLeft: 0 }, function() { + return elem.getBoundingClientRect().left; + } ) + ) + "px"; + } + } +); + +// These hooks are used by animate to expand properties +jQuery.each( { + margin: "", + padding: "", + border: "Width" +}, function( prefix, suffix ) { + jQuery.cssHooks[ prefix + suffix ] = { + expand: function( value ) { + var i = 0, + expanded = {}, + + // Assumes a single number if not a string + parts = typeof value === "string" ? value.split( " " ) : [ value ]; + + for ( ; i < 4; i++ ) { + expanded[ prefix + cssExpand[ i ] + suffix ] = + parts[ i ] || parts[ i - 2 ] || parts[ 0 ]; + } + + return expanded; + } + }; + + if ( prefix !== "margin" ) { + jQuery.cssHooks[ prefix + suffix ].set = setPositiveNumber; + } +} ); + +jQuery.fn.extend( { + css: function( name, value ) { + return access( this, function( elem, name, value ) { + var styles, len, + map = {}, + i = 0; + + if ( Array.isArray( name ) ) { + styles = getStyles( elem ); + len = name.length; + + for ( ; i < len; i++ ) { + map[ name[ i ] ] = jQuery.css( elem, name[ i ], false, styles ); + } + + return map; + } + + return value !== undefined ? + jQuery.style( elem, name, value ) : + jQuery.css( elem, name ); + }, name, value, arguments.length > 1 ); + } +} ); + + +function Tween( elem, options, prop, end, easing ) { + return new Tween.prototype.init( elem, options, prop, end, easing ); +} +jQuery.Tween = Tween; + +Tween.prototype = { + constructor: Tween, + init: function( elem, options, prop, end, easing, unit ) { + this.elem = elem; + this.prop = prop; + this.easing = easing || jQuery.easing._default; + this.options = options; + this.start = this.now = this.cur(); + this.end = end; + this.unit = unit || ( jQuery.cssNumber[ prop ] ? "" : "px" ); + }, + cur: function() { + var hooks = Tween.propHooks[ this.prop ]; + + return hooks && hooks.get ? + hooks.get( this ) : + Tween.propHooks._default.get( this ); + }, + run: function( percent ) { + var eased, + hooks = Tween.propHooks[ this.prop ]; + + if ( this.options.duration ) { + this.pos = eased = jQuery.easing[ this.easing ]( + percent, this.options.duration * percent, 0, 1, this.options.duration + ); + } else { + this.pos = eased = percent; + } + this.now = ( this.end - this.start ) * eased + this.start; + + if ( this.options.step ) { + this.options.step.call( this.elem, this.now, this ); + } + + if ( hooks && hooks.set ) { + hooks.set( this ); + } else { + Tween.propHooks._default.set( this ); + } + return this; + } +}; + +Tween.prototype.init.prototype = Tween.prototype; + +Tween.propHooks = { + _default: { + get: function( tween ) { + var result; + + // Use a property on the element directly when it is not a DOM element, + // or when there is no matching style property that exists. + if ( tween.elem.nodeType !== 1 || + tween.elem[ tween.prop ] != null && tween.elem.style[ tween.prop ] == null ) { + return tween.elem[ tween.prop ]; + } + + // Passing an empty string as a 3rd parameter to .css will automatically + // attempt a parseFloat and fallback to a string if the parse fails. + // Simple values such as "10px" are parsed to Float; + // complex values such as "rotate(1rad)" are returned as-is. + result = jQuery.css( tween.elem, tween.prop, "" ); + + // Empty strings, null, undefined and "auto" are converted to 0. + return !result || result === "auto" ? 0 : result; + }, + set: function( tween ) { + + // Use step hook for back compat. + // Use cssHook if its there. + // Use .style if available and use plain properties where available. + if ( jQuery.fx.step[ tween.prop ] ) { + jQuery.fx.step[ tween.prop ]( tween ); + } else if ( tween.elem.nodeType === 1 && ( + jQuery.cssHooks[ tween.prop ] || + tween.elem.style[ finalPropName( tween.prop ) ] != null ) ) { + jQuery.style( tween.elem, tween.prop, tween.now + tween.unit ); + } else { + tween.elem[ tween.prop ] = tween.now; + } + } + } +}; + +// Support: IE <=9 only +// Panic based approach to setting things on disconnected nodes +Tween.propHooks.scrollTop = Tween.propHooks.scrollLeft = { + set: function( tween ) { + if ( tween.elem.nodeType && tween.elem.parentNode ) { + tween.elem[ tween.prop ] = tween.now; + } + } +}; + +jQuery.easing = { + linear: function( p ) { + return p; + }, + swing: function( p ) { + return 0.5 - Math.cos( p * Math.PI ) / 2; + }, + _default: "swing" +}; + +jQuery.fx = Tween.prototype.init; + +// Back compat <1.8 extension point +jQuery.fx.step = {}; + + + + +var + fxNow, inProgress, + rfxtypes = /^(?:toggle|show|hide)$/, + rrun = /queueHooks$/; + +function schedule() { + if ( inProgress ) { + if ( document.hidden === false && window.requestAnimationFrame ) { + window.requestAnimationFrame( schedule ); + } else { + window.setTimeout( schedule, jQuery.fx.interval ); + } + + jQuery.fx.tick(); + } +} + +// Animations created synchronously will run synchronously +function createFxNow() { + window.setTimeout( function() { + fxNow = undefined; + } ); + return ( fxNow = Date.now() ); +} + +// Generate parameters to create a standard animation +function genFx( type, includeWidth ) { + var which, + i = 0, + attrs = { height: type }; + + // If we include width, step value is 1 to do all cssExpand values, + // otherwise step value is 2 to skip over Left and Right + includeWidth = includeWidth ? 1 : 0; + for ( ; i < 4; i += 2 - includeWidth ) { + which = cssExpand[ i ]; + attrs[ "margin" + which ] = attrs[ "padding" + which ] = type; + } + + if ( includeWidth ) { + attrs.opacity = attrs.width = type; + } + + return attrs; +} + +function createTween( value, prop, animation ) { + var tween, + collection = ( Animation.tweeners[ prop ] || [] ).concat( Animation.tweeners[ "*" ] ), + index = 0, + length = collection.length; + for ( ; index < length; index++ ) { + if ( ( tween = collection[ index ].call( animation, prop, value ) ) ) { + + // We're done with this property + return tween; + } + } +} + +function defaultPrefilter( elem, props, opts ) { + var prop, value, toggle, hooks, oldfire, propTween, restoreDisplay, display, + isBox = "width" in props || "height" in props, + anim = this, + orig = {}, + style = elem.style, + hidden = elem.nodeType && isHiddenWithinTree( elem ), + dataShow = dataPriv.get( elem, "fxshow" ); + + // Queue-skipping animations hijack the fx hooks + if ( !opts.queue ) { + hooks = jQuery._queueHooks( elem, "fx" ); + if ( hooks.unqueued == null ) { + hooks.unqueued = 0; + oldfire = hooks.empty.fire; + hooks.empty.fire = function() { + if ( !hooks.unqueued ) { + oldfire(); + } + }; + } + hooks.unqueued++; + + anim.always( function() { + + // Ensure the complete handler is called before this completes + anim.always( function() { + hooks.unqueued--; + if ( !jQuery.queue( elem, "fx" ).length ) { + hooks.empty.fire(); + } + } ); + } ); + } + + // Detect show/hide animations + for ( prop in props ) { + value = props[ prop ]; + if ( rfxtypes.test( value ) ) { + delete props[ prop ]; + toggle = toggle || value === "toggle"; + if ( value === ( hidden ? "hide" : "show" ) ) { + + // Pretend to be hidden if this is a "show" and + // there is still data from a stopped show/hide + if ( value === "show" && dataShow && dataShow[ prop ] !== undefined ) { + hidden = true; + + // Ignore all other no-op show/hide data + } else { + continue; + } + } + orig[ prop ] = dataShow && dataShow[ prop ] || jQuery.style( elem, prop ); + } + } + + // Bail out if this is a no-op like .hide().hide() + propTween = !jQuery.isEmptyObject( props ); + if ( !propTween && jQuery.isEmptyObject( orig ) ) { + return; + } + + // Restrict "overflow" and "display" styles during box animations + if ( isBox && elem.nodeType === 1 ) { + + // Support: IE <=9 - 11, Edge 12 - 15 + // Record all 3 overflow attributes because IE does not infer the shorthand + // from identically-valued overflowX and overflowY and Edge just mirrors + // the overflowX value there. + opts.overflow = [ style.overflow, style.overflowX, style.overflowY ]; + + // Identify a display type, preferring old show/hide data over the CSS cascade + restoreDisplay = dataShow && dataShow.display; + if ( restoreDisplay == null ) { + restoreDisplay = dataPriv.get( elem, "display" ); + } + display = jQuery.css( elem, "display" ); + if ( display === "none" ) { + if ( restoreDisplay ) { + display = restoreDisplay; + } else { + + // Get nonempty value(s) by temporarily forcing visibility + showHide( [ elem ], true ); + restoreDisplay = elem.style.display || restoreDisplay; + display = jQuery.css( elem, "display" ); + showHide( [ elem ] ); + } + } + + // Animate inline elements as inline-block + if ( display === "inline" || display === "inline-block" && restoreDisplay != null ) { + if ( jQuery.css( elem, "float" ) === "none" ) { + + // Restore the original display value at the end of pure show/hide animations + if ( !propTween ) { + anim.done( function() { + style.display = restoreDisplay; + } ); + if ( restoreDisplay == null ) { + display = style.display; + restoreDisplay = display === "none" ? "" : display; + } + } + style.display = "inline-block"; + } + } + } + + if ( opts.overflow ) { + style.overflow = "hidden"; + anim.always( function() { + style.overflow = opts.overflow[ 0 ]; + style.overflowX = opts.overflow[ 1 ]; + style.overflowY = opts.overflow[ 2 ]; + } ); + } + + // Implement show/hide animations + propTween = false; + for ( prop in orig ) { + + // General show/hide setup for this element animation + if ( !propTween ) { + if ( dataShow ) { + if ( "hidden" in dataShow ) { + hidden = dataShow.hidden; + } + } else { + dataShow = dataPriv.access( elem, "fxshow", { display: restoreDisplay } ); + } + + // Store hidden/visible for toggle so `.stop().toggle()` "reverses" + if ( toggle ) { + dataShow.hidden = !hidden; + } + + // Show elements before animating them + if ( hidden ) { + showHide( [ elem ], true ); + } + + /* eslint-disable no-loop-func */ + + anim.done( function() { + + /* eslint-enable no-loop-func */ + + // The final step of a "hide" animation is actually hiding the element + if ( !hidden ) { + showHide( [ elem ] ); + } + dataPriv.remove( elem, "fxshow" ); + for ( prop in orig ) { + jQuery.style( elem, prop, orig[ prop ] ); + } + } ); + } + + // Per-property setup + propTween = createTween( hidden ? dataShow[ prop ] : 0, prop, anim ); + if ( !( prop in dataShow ) ) { + dataShow[ prop ] = propTween.start; + if ( hidden ) { + propTween.end = propTween.start; + propTween.start = 0; + } + } + } +} + +function propFilter( props, specialEasing ) { + var index, name, easing, value, hooks; + + // camelCase, specialEasing and expand cssHook pass + for ( index in props ) { + name = camelCase( index ); + easing = specialEasing[ name ]; + value = props[ index ]; + if ( Array.isArray( value ) ) { + easing = value[ 1 ]; + value = props[ index ] = value[ 0 ]; + } + + if ( index !== name ) { + props[ name ] = value; + delete props[ index ]; + } + + hooks = jQuery.cssHooks[ name ]; + if ( hooks && "expand" in hooks ) { + value = hooks.expand( value ); + delete props[ name ]; + + // Not quite $.extend, this won't overwrite existing keys. + // Reusing 'index' because we have the correct "name" + for ( index in value ) { + if ( !( index in props ) ) { + props[ index ] = value[ index ]; + specialEasing[ index ] = easing; + } + } + } else { + specialEasing[ name ] = easing; + } + } +} + +function Animation( elem, properties, options ) { + var result, + stopped, + index = 0, + length = Animation.prefilters.length, + deferred = jQuery.Deferred().always( function() { + + // Don't match elem in the :animated selector + delete tick.elem; + } ), + tick = function() { + if ( stopped ) { + return false; + } + var currentTime = fxNow || createFxNow(), + remaining = Math.max( 0, animation.startTime + animation.duration - currentTime ), + + // Support: Android 2.3 only + // Archaic crash bug won't allow us to use `1 - ( 0.5 || 0 )` (#12497) + temp = remaining / animation.duration || 0, + percent = 1 - temp, + index = 0, + length = animation.tweens.length; + + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( percent ); + } + + deferred.notifyWith( elem, [ animation, percent, remaining ] ); + + // If there's more to do, yield + if ( percent < 1 && length ) { + return remaining; + } + + // If this was an empty animation, synthesize a final progress notification + if ( !length ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + } + + // Resolve the animation and report its conclusion + deferred.resolveWith( elem, [ animation ] ); + return false; + }, + animation = deferred.promise( { + elem: elem, + props: jQuery.extend( {}, properties ), + opts: jQuery.extend( true, { + specialEasing: {}, + easing: jQuery.easing._default + }, options ), + originalProperties: properties, + originalOptions: options, + startTime: fxNow || createFxNow(), + duration: options.duration, + tweens: [], + createTween: function( prop, end ) { + var tween = jQuery.Tween( elem, animation.opts, prop, end, + animation.opts.specialEasing[ prop ] || animation.opts.easing ); + animation.tweens.push( tween ); + return tween; + }, + stop: function( gotoEnd ) { + var index = 0, + + // If we are going to the end, we want to run all the tweens + // otherwise we skip this part + length = gotoEnd ? animation.tweens.length : 0; + if ( stopped ) { + return this; + } + stopped = true; + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( 1 ); + } + + // Resolve when we played the last frame; otherwise, reject + if ( gotoEnd ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + deferred.resolveWith( elem, [ animation, gotoEnd ] ); + } else { + deferred.rejectWith( elem, [ animation, gotoEnd ] ); + } + return this; + } + } ), + props = animation.props; + + propFilter( props, animation.opts.specialEasing ); + + for ( ; index < length; index++ ) { + result = Animation.prefilters[ index ].call( animation, elem, props, animation.opts ); + if ( result ) { + if ( isFunction( result.stop ) ) { + jQuery._queueHooks( animation.elem, animation.opts.queue ).stop = + result.stop.bind( result ); + } + return result; + } + } + + jQuery.map( props, createTween, animation ); + + if ( isFunction( animation.opts.start ) ) { + animation.opts.start.call( elem, animation ); + } + + // Attach callbacks from options + animation + .progress( animation.opts.progress ) + .done( animation.opts.done, animation.opts.complete ) + .fail( animation.opts.fail ) + .always( animation.opts.always ); + + jQuery.fx.timer( + jQuery.extend( tick, { + elem: elem, + anim: animation, + queue: animation.opts.queue + } ) + ); + + return animation; +} + +jQuery.Animation = jQuery.extend( Animation, { + + tweeners: { + "*": [ function( prop, value ) { + var tween = this.createTween( prop, value ); + adjustCSS( tween.elem, prop, rcssNum.exec( value ), tween ); + return tween; + } ] + }, + + tweener: function( props, callback ) { + if ( isFunction( props ) ) { + callback = props; + props = [ "*" ]; + } else { + props = props.match( rnothtmlwhite ); + } + + var prop, + index = 0, + length = props.length; + + for ( ; index < length; index++ ) { + prop = props[ index ]; + Animation.tweeners[ prop ] = Animation.tweeners[ prop ] || []; + Animation.tweeners[ prop ].unshift( callback ); + } + }, + + prefilters: [ defaultPrefilter ], + + prefilter: function( callback, prepend ) { + if ( prepend ) { + Animation.prefilters.unshift( callback ); + } else { + Animation.prefilters.push( callback ); + } + } +} ); + +jQuery.speed = function( speed, easing, fn ) { + var opt = speed && typeof speed === "object" ? jQuery.extend( {}, speed ) : { + complete: fn || !fn && easing || + isFunction( speed ) && speed, + duration: speed, + easing: fn && easing || easing && !isFunction( easing ) && easing + }; + + // Go to the end state if fx are off + if ( jQuery.fx.off ) { + opt.duration = 0; + + } else { + if ( typeof opt.duration !== "number" ) { + if ( opt.duration in jQuery.fx.speeds ) { + opt.duration = jQuery.fx.speeds[ opt.duration ]; + + } else { + opt.duration = jQuery.fx.speeds._default; + } + } + } + + // Normalize opt.queue - true/undefined/null -> "fx" + if ( opt.queue == null || opt.queue === true ) { + opt.queue = "fx"; + } + + // Queueing + opt.old = opt.complete; + + opt.complete = function() { + if ( isFunction( opt.old ) ) { + opt.old.call( this ); + } + + if ( opt.queue ) { + jQuery.dequeue( this, opt.queue ); + } + }; + + return opt; +}; + +jQuery.fn.extend( { + fadeTo: function( speed, to, easing, callback ) { + + // Show any hidden elements after setting opacity to 0 + return this.filter( isHiddenWithinTree ).css( "opacity", 0 ).show() + + // Animate to the value specified + .end().animate( { opacity: to }, speed, easing, callback ); + }, + animate: function( prop, speed, easing, callback ) { + var empty = jQuery.isEmptyObject( prop ), + optall = jQuery.speed( speed, easing, callback ), + doAnimation = function() { + + // Operate on a copy of prop so per-property easing won't be lost + var anim = Animation( this, jQuery.extend( {}, prop ), optall ); + + // Empty animations, or finishing resolves immediately + if ( empty || dataPriv.get( this, "finish" ) ) { + anim.stop( true ); + } + }; + + doAnimation.finish = doAnimation; + + return empty || optall.queue === false ? + this.each( doAnimation ) : + this.queue( optall.queue, doAnimation ); + }, + stop: function( type, clearQueue, gotoEnd ) { + var stopQueue = function( hooks ) { + var stop = hooks.stop; + delete hooks.stop; + stop( gotoEnd ); + }; + + if ( typeof type !== "string" ) { + gotoEnd = clearQueue; + clearQueue = type; + type = undefined; + } + if ( clearQueue ) { + this.queue( type || "fx", [] ); + } + + return this.each( function() { + var dequeue = true, + index = type != null && type + "queueHooks", + timers = jQuery.timers, + data = dataPriv.get( this ); + + if ( index ) { + if ( data[ index ] && data[ index ].stop ) { + stopQueue( data[ index ] ); + } + } else { + for ( index in data ) { + if ( data[ index ] && data[ index ].stop && rrun.test( index ) ) { + stopQueue( data[ index ] ); + } + } + } + + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && + ( type == null || timers[ index ].queue === type ) ) { + + timers[ index ].anim.stop( gotoEnd ); + dequeue = false; + timers.splice( index, 1 ); + } + } + + // Start the next in the queue if the last step wasn't forced. + // Timers currently will call their complete callbacks, which + // will dequeue but only if they were gotoEnd. + if ( dequeue || !gotoEnd ) { + jQuery.dequeue( this, type ); + } + } ); + }, + finish: function( type ) { + if ( type !== false ) { + type = type || "fx"; + } + return this.each( function() { + var index, + data = dataPriv.get( this ), + queue = data[ type + "queue" ], + hooks = data[ type + "queueHooks" ], + timers = jQuery.timers, + length = queue ? queue.length : 0; + + // Enable finishing flag on private data + data.finish = true; + + // Empty the queue first + jQuery.queue( this, type, [] ); + + if ( hooks && hooks.stop ) { + hooks.stop.call( this, true ); + } + + // Look for any active animations, and finish them + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && timers[ index ].queue === type ) { + timers[ index ].anim.stop( true ); + timers.splice( index, 1 ); + } + } + + // Look for any animations in the old queue and finish them + for ( index = 0; index < length; index++ ) { + if ( queue[ index ] && queue[ index ].finish ) { + queue[ index ].finish.call( this ); + } + } + + // Turn off finishing flag + delete data.finish; + } ); + } +} ); + +jQuery.each( [ "toggle", "show", "hide" ], function( _i, name ) { + var cssFn = jQuery.fn[ name ]; + jQuery.fn[ name ] = function( speed, easing, callback ) { + return speed == null || typeof speed === "boolean" ? + cssFn.apply( this, arguments ) : + this.animate( genFx( name, true ), speed, easing, callback ); + }; +} ); + +// Generate shortcuts for custom animations +jQuery.each( { + slideDown: genFx( "show" ), + slideUp: genFx( "hide" ), + slideToggle: genFx( "toggle" ), + fadeIn: { opacity: "show" }, + fadeOut: { opacity: "hide" }, + fadeToggle: { opacity: "toggle" } +}, function( name, props ) { + jQuery.fn[ name ] = function( speed, easing, callback ) { + return this.animate( props, speed, easing, callback ); + }; +} ); + +jQuery.timers = []; +jQuery.fx.tick = function() { + var timer, + i = 0, + timers = jQuery.timers; + + fxNow = Date.now(); + + for ( ; i < timers.length; i++ ) { + timer = timers[ i ]; + + // Run the timer and safely remove it when done (allowing for external removal) + if ( !timer() && timers[ i ] === timer ) { + timers.splice( i--, 1 ); + } + } + + if ( !timers.length ) { + jQuery.fx.stop(); + } + fxNow = undefined; +}; + +jQuery.fx.timer = function( timer ) { + jQuery.timers.push( timer ); + jQuery.fx.start(); +}; + +jQuery.fx.interval = 13; +jQuery.fx.start = function() { + if ( inProgress ) { + return; + } + + inProgress = true; + schedule(); +}; + +jQuery.fx.stop = function() { + inProgress = null; +}; + +jQuery.fx.speeds = { + slow: 600, + fast: 200, + + // Default speed + _default: 400 +}; + + +// Based off of the plugin by Clint Helfers, with permission. +// https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/ +jQuery.fn.delay = function( time, type ) { + time = jQuery.fx ? jQuery.fx.speeds[ time ] || time : time; + type = type || "fx"; + + return this.queue( type, function( next, hooks ) { + var timeout = window.setTimeout( next, time ); + hooks.stop = function() { + window.clearTimeout( timeout ); + }; + } ); +}; + + +( function() { + var input = document.createElement( "input" ), + select = document.createElement( "select" ), + opt = select.appendChild( document.createElement( "option" ) ); + + input.type = "checkbox"; + + // Support: Android <=4.3 only + // Default value for a checkbox should be "on" + support.checkOn = input.value !== ""; + + // Support: IE <=11 only + // Must access selectedIndex to make default options select + support.optSelected = opt.selected; + + // Support: IE <=11 only + // An input loses its value after becoming a radio + input = document.createElement( "input" ); + input.value = "t"; + input.type = "radio"; + support.radioValue = input.value === "t"; +} )(); + + +var boolHook, + attrHandle = jQuery.expr.attrHandle; + +jQuery.fn.extend( { + attr: function( name, value ) { + return access( this, jQuery.attr, name, value, arguments.length > 1 ); + }, + + removeAttr: function( name ) { + return this.each( function() { + jQuery.removeAttr( this, name ); + } ); + } +} ); + +jQuery.extend( { + attr: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set attributes on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + // Fallback to prop when attributes are not supported + if ( typeof elem.getAttribute === "undefined" ) { + return jQuery.prop( elem, name, value ); + } + + // Attribute hooks are determined by the lowercase version + // Grab necessary hook if one is defined + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + hooks = jQuery.attrHooks[ name.toLowerCase() ] || + ( jQuery.expr.match.bool.test( name ) ? boolHook : undefined ); + } + + if ( value !== undefined ) { + if ( value === null ) { + jQuery.removeAttr( elem, name ); + return; + } + + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + elem.setAttribute( name, value + "" ); + return value; + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + ret = jQuery.find.attr( elem, name ); + + // Non-existent attributes return null, we normalize to undefined + return ret == null ? undefined : ret; + }, + + attrHooks: { + type: { + set: function( elem, value ) { + if ( !support.radioValue && value === "radio" && + nodeName( elem, "input" ) ) { + var val = elem.value; + elem.setAttribute( "type", value ); + if ( val ) { + elem.value = val; + } + return value; + } + } + } + }, + + removeAttr: function( elem, value ) { + var name, + i = 0, + + // Attribute names can contain non-HTML whitespace characters + // https://html.spec.whatwg.org/multipage/syntax.html#attributes-2 + attrNames = value && value.match( rnothtmlwhite ); + + if ( attrNames && elem.nodeType === 1 ) { + while ( ( name = attrNames[ i++ ] ) ) { + elem.removeAttribute( name ); + } + } + } +} ); + +// Hooks for boolean attributes +boolHook = { + set: function( elem, value, name ) { + if ( value === false ) { + + // Remove boolean attributes when set to false + jQuery.removeAttr( elem, name ); + } else { + elem.setAttribute( name, name ); + } + return name; + } +}; + +jQuery.each( jQuery.expr.match.bool.source.match( /\w+/g ), function( _i, name ) { + var getter = attrHandle[ name ] || jQuery.find.attr; + + attrHandle[ name ] = function( elem, name, isXML ) { + var ret, handle, + lowercaseName = name.toLowerCase(); + + if ( !isXML ) { + + // Avoid an infinite loop by temporarily removing this function from the getter + handle = attrHandle[ lowercaseName ]; + attrHandle[ lowercaseName ] = ret; + ret = getter( elem, name, isXML ) != null ? + lowercaseName : + null; + attrHandle[ lowercaseName ] = handle; + } + return ret; + }; +} ); + + + + +var rfocusable = /^(?:input|select|textarea|button)$/i, + rclickable = /^(?:a|area)$/i; + +jQuery.fn.extend( { + prop: function( name, value ) { + return access( this, jQuery.prop, name, value, arguments.length > 1 ); + }, + + removeProp: function( name ) { + return this.each( function() { + delete this[ jQuery.propFix[ name ] || name ]; + } ); + } +} ); + +jQuery.extend( { + prop: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set properties on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + + // Fix name and attach hooks + name = jQuery.propFix[ name ] || name; + hooks = jQuery.propHooks[ name ]; + } + + if ( value !== undefined ) { + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + return ( elem[ name ] = value ); + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + return elem[ name ]; + }, + + propHooks: { + tabIndex: { + get: function( elem ) { + + // Support: IE <=9 - 11 only + // elem.tabIndex doesn't always return the + // correct value when it hasn't been explicitly set + // https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/ + // Use proper attribute retrieval(#12072) + var tabindex = jQuery.find.attr( elem, "tabindex" ); + + if ( tabindex ) { + return parseInt( tabindex, 10 ); + } + + if ( + rfocusable.test( elem.nodeName ) || + rclickable.test( elem.nodeName ) && + elem.href + ) { + return 0; + } + + return -1; + } + } + }, + + propFix: { + "for": "htmlFor", + "class": "className" + } +} ); + +// Support: IE <=11 only +// Accessing the selectedIndex property +// forces the browser to respect setting selected +// on the option +// The getter ensures a default option is selected +// when in an optgroup +// eslint rule "no-unused-expressions" is disabled for this code +// since it considers such accessions noop +if ( !support.optSelected ) { + jQuery.propHooks.selected = { + get: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent && parent.parentNode ) { + parent.parentNode.selectedIndex; + } + return null; + }, + set: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent ) { + parent.selectedIndex; + + if ( parent.parentNode ) { + parent.parentNode.selectedIndex; + } + } + } + }; +} + +jQuery.each( [ + "tabIndex", + "readOnly", + "maxLength", + "cellSpacing", + "cellPadding", + "rowSpan", + "colSpan", + "useMap", + "frameBorder", + "contentEditable" +], function() { + jQuery.propFix[ this.toLowerCase() ] = this; +} ); + + + + + // Strip and collapse whitespace according to HTML spec + // https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace + function stripAndCollapse( value ) { + var tokens = value.match( rnothtmlwhite ) || []; + return tokens.join( " " ); + } + + +function getClass( elem ) { + return elem.getAttribute && elem.getAttribute( "class" ) || ""; +} + +function classesToArray( value ) { + if ( Array.isArray( value ) ) { + return value; + } + if ( typeof value === "string" ) { + return value.match( rnothtmlwhite ) || []; + } + return []; +} + +jQuery.fn.extend( { + addClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).addClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + if ( cur.indexOf( " " + clazz + " " ) < 0 ) { + cur += clazz + " "; + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + removeClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).removeClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + if ( !arguments.length ) { + return this.attr( "class", "" ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + + // This expression is here for better compressibility (see addClass) + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + + // Remove *all* instances + while ( cur.indexOf( " " + clazz + " " ) > -1 ) { + cur = cur.replace( " " + clazz + " ", " " ); + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + toggleClass: function( value, stateVal ) { + var type = typeof value, + isValidValue = type === "string" || Array.isArray( value ); + + if ( typeof stateVal === "boolean" && isValidValue ) { + return stateVal ? this.addClass( value ) : this.removeClass( value ); + } + + if ( isFunction( value ) ) { + return this.each( function( i ) { + jQuery( this ).toggleClass( + value.call( this, i, getClass( this ), stateVal ), + stateVal + ); + } ); + } + + return this.each( function() { + var className, i, self, classNames; + + if ( isValidValue ) { + + // Toggle individual class names + i = 0; + self = jQuery( this ); + classNames = classesToArray( value ); + + while ( ( className = classNames[ i++ ] ) ) { + + // Check each className given, space separated list + if ( self.hasClass( className ) ) { + self.removeClass( className ); + } else { + self.addClass( className ); + } + } + + // Toggle whole class name + } else if ( value === undefined || type === "boolean" ) { + className = getClass( this ); + if ( className ) { + + // Store className if set + dataPriv.set( this, "__className__", className ); + } + + // If the element has a class name or if we're passed `false`, + // then remove the whole classname (if there was one, the above saved it). + // Otherwise bring back whatever was previously saved (if anything), + // falling back to the empty string if nothing was stored. + if ( this.setAttribute ) { + this.setAttribute( "class", + className || value === false ? + "" : + dataPriv.get( this, "__className__" ) || "" + ); + } + } + } ); + }, + + hasClass: function( selector ) { + var className, elem, + i = 0; + + className = " " + selector + " "; + while ( ( elem = this[ i++ ] ) ) { + if ( elem.nodeType === 1 && + ( " " + stripAndCollapse( getClass( elem ) ) + " " ).indexOf( className ) > -1 ) { + return true; + } + } + + return false; + } +} ); + + + + +var rreturn = /\r/g; + +jQuery.fn.extend( { + val: function( value ) { + var hooks, ret, valueIsFunction, + elem = this[ 0 ]; + + if ( !arguments.length ) { + if ( elem ) { + hooks = jQuery.valHooks[ elem.type ] || + jQuery.valHooks[ elem.nodeName.toLowerCase() ]; + + if ( hooks && + "get" in hooks && + ( ret = hooks.get( elem, "value" ) ) !== undefined + ) { + return ret; + } + + ret = elem.value; + + // Handle most common string cases + if ( typeof ret === "string" ) { + return ret.replace( rreturn, "" ); + } + + // Handle cases where value is null/undef or number + return ret == null ? "" : ret; + } + + return; + } + + valueIsFunction = isFunction( value ); + + return this.each( function( i ) { + var val; + + if ( this.nodeType !== 1 ) { + return; + } + + if ( valueIsFunction ) { + val = value.call( this, i, jQuery( this ).val() ); + } else { + val = value; + } + + // Treat null/undefined as ""; convert numbers to string + if ( val == null ) { + val = ""; + + } else if ( typeof val === "number" ) { + val += ""; + + } else if ( Array.isArray( val ) ) { + val = jQuery.map( val, function( value ) { + return value == null ? "" : value + ""; + } ); + } + + hooks = jQuery.valHooks[ this.type ] || jQuery.valHooks[ this.nodeName.toLowerCase() ]; + + // If set returns undefined, fall back to normal setting + if ( !hooks || !( "set" in hooks ) || hooks.set( this, val, "value" ) === undefined ) { + this.value = val; + } + } ); + } +} ); + +jQuery.extend( { + valHooks: { + option: { + get: function( elem ) { + + var val = jQuery.find.attr( elem, "value" ); + return val != null ? + val : + + // Support: IE <=10 - 11 only + // option.text throws exceptions (#14686, #14858) + // Strip and collapse whitespace + // https://html.spec.whatwg.org/#strip-and-collapse-whitespace + stripAndCollapse( jQuery.text( elem ) ); + } + }, + select: { + get: function( elem ) { + var value, option, i, + options = elem.options, + index = elem.selectedIndex, + one = elem.type === "select-one", + values = one ? null : [], + max = one ? index + 1 : options.length; + + if ( index < 0 ) { + i = max; + + } else { + i = one ? index : 0; + } + + // Loop through all the selected options + for ( ; i < max; i++ ) { + option = options[ i ]; + + // Support: IE <=9 only + // IE8-9 doesn't update selected after form reset (#2551) + if ( ( option.selected || i === index ) && + + // Don't return options that are disabled or in a disabled optgroup + !option.disabled && + ( !option.parentNode.disabled || + !nodeName( option.parentNode, "optgroup" ) ) ) { + + // Get the specific value for the option + value = jQuery( option ).val(); + + // We don't need an array for one selects + if ( one ) { + return value; + } + + // Multi-Selects return an array + values.push( value ); + } + } + + return values; + }, + + set: function( elem, value ) { + var optionSet, option, + options = elem.options, + values = jQuery.makeArray( value ), + i = options.length; + + while ( i-- ) { + option = options[ i ]; + + /* eslint-disable no-cond-assign */ + + if ( option.selected = + jQuery.inArray( jQuery.valHooks.option.get( option ), values ) > -1 + ) { + optionSet = true; + } + + /* eslint-enable no-cond-assign */ + } + + // Force browsers to behave consistently when non-matching value is set + if ( !optionSet ) { + elem.selectedIndex = -1; + } + return values; + } + } + } +} ); + +// Radios and checkboxes getter/setter +jQuery.each( [ "radio", "checkbox" ], function() { + jQuery.valHooks[ this ] = { + set: function( elem, value ) { + if ( Array.isArray( value ) ) { + return ( elem.checked = jQuery.inArray( jQuery( elem ).val(), value ) > -1 ); + } + } + }; + if ( !support.checkOn ) { + jQuery.valHooks[ this ].get = function( elem ) { + return elem.getAttribute( "value" ) === null ? "on" : elem.value; + }; + } +} ); + + + + +// Return jQuery for attributes-only inclusion + + +support.focusin = "onfocusin" in window; + + +var rfocusMorph = /^(?:focusinfocus|focusoutblur)$/, + stopPropagationCallback = function( e ) { + e.stopPropagation(); + }; + +jQuery.extend( jQuery.event, { + + trigger: function( event, data, elem, onlyHandlers ) { + + var i, cur, tmp, bubbleType, ontype, handle, special, lastElement, + eventPath = [ elem || document ], + type = hasOwn.call( event, "type" ) ? event.type : event, + namespaces = hasOwn.call( event, "namespace" ) ? event.namespace.split( "." ) : []; + + cur = lastElement = tmp = elem = elem || document; + + // Don't do events on text and comment nodes + if ( elem.nodeType === 3 || elem.nodeType === 8 ) { + return; + } + + // focus/blur morphs to focusin/out; ensure we're not firing them right now + if ( rfocusMorph.test( type + jQuery.event.triggered ) ) { + return; + } + + if ( type.indexOf( "." ) > -1 ) { + + // Namespaced trigger; create a regexp to match event type in handle() + namespaces = type.split( "." ); + type = namespaces.shift(); + namespaces.sort(); + } + ontype = type.indexOf( ":" ) < 0 && "on" + type; + + // Caller can pass in a jQuery.Event object, Object, or just an event type string + event = event[ jQuery.expando ] ? + event : + new jQuery.Event( type, typeof event === "object" && event ); + + // Trigger bitmask: & 1 for native handlers; & 2 for jQuery (always true) + event.isTrigger = onlyHandlers ? 2 : 3; + event.namespace = namespaces.join( "." ); + event.rnamespace = event.namespace ? + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) : + null; + + // Clean up the event in case it is being reused + event.result = undefined; + if ( !event.target ) { + event.target = elem; + } + + // Clone any incoming data and prepend the event, creating the handler arg list + data = data == null ? + [ event ] : + jQuery.makeArray( data, [ event ] ); + + // Allow special events to draw outside the lines + special = jQuery.event.special[ type ] || {}; + if ( !onlyHandlers && special.trigger && special.trigger.apply( elem, data ) === false ) { + return; + } + + // Determine event propagation path in advance, per W3C events spec (#9951) + // Bubble up to document, then to window; watch for a global ownerDocument var (#9724) + if ( !onlyHandlers && !special.noBubble && !isWindow( elem ) ) { + + bubbleType = special.delegateType || type; + if ( !rfocusMorph.test( bubbleType + type ) ) { + cur = cur.parentNode; + } + for ( ; cur; cur = cur.parentNode ) { + eventPath.push( cur ); + tmp = cur; + } + + // Only add window if we got to document (e.g., not plain obj or detached DOM) + if ( tmp === ( elem.ownerDocument || document ) ) { + eventPath.push( tmp.defaultView || tmp.parentWindow || window ); + } + } + + // Fire handlers on the event path + i = 0; + while ( ( cur = eventPath[ i++ ] ) && !event.isPropagationStopped() ) { + lastElement = cur; + event.type = i > 1 ? + bubbleType : + special.bindType || type; + + // jQuery handler + handle = ( dataPriv.get( cur, "events" ) || Object.create( null ) )[ event.type ] && + dataPriv.get( cur, "handle" ); + if ( handle ) { + handle.apply( cur, data ); + } + + // Native handler + handle = ontype && cur[ ontype ]; + if ( handle && handle.apply && acceptData( cur ) ) { + event.result = handle.apply( cur, data ); + if ( event.result === false ) { + event.preventDefault(); + } + } + } + event.type = type; + + // If nobody prevented the default action, do it now + if ( !onlyHandlers && !event.isDefaultPrevented() ) { + + if ( ( !special._default || + special._default.apply( eventPath.pop(), data ) === false ) && + acceptData( elem ) ) { + + // Call a native DOM method on the target with the same name as the event. + // Don't do default actions on window, that's where global variables be (#6170) + if ( ontype && isFunction( elem[ type ] ) && !isWindow( elem ) ) { + + // Don't re-trigger an onFOO event when we call its FOO() method + tmp = elem[ ontype ]; + + if ( tmp ) { + elem[ ontype ] = null; + } + + // Prevent re-triggering of the same event, since we already bubbled it above + jQuery.event.triggered = type; + + if ( event.isPropagationStopped() ) { + lastElement.addEventListener( type, stopPropagationCallback ); + } + + elem[ type ](); + + if ( event.isPropagationStopped() ) { + lastElement.removeEventListener( type, stopPropagationCallback ); + } + + jQuery.event.triggered = undefined; + + if ( tmp ) { + elem[ ontype ] = tmp; + } + } + } + } + + return event.result; + }, + + // Piggyback on a donor event to simulate a different one + // Used only for `focus(in | out)` events + simulate: function( type, elem, event ) { + var e = jQuery.extend( + new jQuery.Event(), + event, + { + type: type, + isSimulated: true + } + ); + + jQuery.event.trigger( e, null, elem ); + } + +} ); + +jQuery.fn.extend( { + + trigger: function( type, data ) { + return this.each( function() { + jQuery.event.trigger( type, data, this ); + } ); + }, + triggerHandler: function( type, data ) { + var elem = this[ 0 ]; + if ( elem ) { + return jQuery.event.trigger( type, data, elem, true ); + } + } +} ); + + +// Support: Firefox <=44 +// Firefox doesn't have focus(in | out) events +// Related ticket - https://bugzilla.mozilla.org/show_bug.cgi?id=687787 +// +// Support: Chrome <=48 - 49, Safari <=9.0 - 9.1 +// focus(in | out) events fire after focus & blur events, +// which is spec violation - http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order +// Related ticket - https://bugs.chromium.org/p/chromium/issues/detail?id=449857 +if ( !support.focusin ) { + jQuery.each( { focus: "focusin", blur: "focusout" }, function( orig, fix ) { + + // Attach a single capturing handler on the document while someone wants focusin/focusout + var handler = function( event ) { + jQuery.event.simulate( fix, event.target, jQuery.event.fix( event ) ); + }; + + jQuery.event.special[ fix ] = { + setup: function() { + + // Handle: regular nodes (via `this.ownerDocument`), window + // (via `this.document`) & document (via `this`). + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ); + + if ( !attaches ) { + doc.addEventListener( orig, handler, true ); + } + dataPriv.access( doc, fix, ( attaches || 0 ) + 1 ); + }, + teardown: function() { + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ) - 1; + + if ( !attaches ) { + doc.removeEventListener( orig, handler, true ); + dataPriv.remove( doc, fix ); + + } else { + dataPriv.access( doc, fix, attaches ); + } + } + }; + } ); +} +var location = window.location; + +var nonce = { guid: Date.now() }; + +var rquery = ( /\?/ ); + + + +// Cross-browser xml parsing +jQuery.parseXML = function( data ) { + var xml, parserErrorElem; + if ( !data || typeof data !== "string" ) { + return null; + } + + // Support: IE 9 - 11 only + // IE throws on parseFromString with invalid input. + try { + xml = ( new window.DOMParser() ).parseFromString( data, "text/xml" ); + } catch ( e ) {} + + parserErrorElem = xml && xml.getElementsByTagName( "parsererror" )[ 0 ]; + if ( !xml || parserErrorElem ) { + jQuery.error( "Invalid XML: " + ( + parserErrorElem ? + jQuery.map( parserErrorElem.childNodes, function( el ) { + return el.textContent; + } ).join( "\n" ) : + data + ) ); + } + return xml; +}; + + +var + rbracket = /\[\]$/, + rCRLF = /\r?\n/g, + rsubmitterTypes = /^(?:submit|button|image|reset|file)$/i, + rsubmittable = /^(?:input|select|textarea|keygen)/i; + +function buildParams( prefix, obj, traditional, add ) { + var name; + + if ( Array.isArray( obj ) ) { + + // Serialize array item. + jQuery.each( obj, function( i, v ) { + if ( traditional || rbracket.test( prefix ) ) { + + // Treat each array item as a scalar. + add( prefix, v ); + + } else { + + // Item is non-scalar (array or object), encode its numeric index. + buildParams( + prefix + "[" + ( typeof v === "object" && v != null ? i : "" ) + "]", + v, + traditional, + add + ); + } + } ); + + } else if ( !traditional && toType( obj ) === "object" ) { + + // Serialize object item. + for ( name in obj ) { + buildParams( prefix + "[" + name + "]", obj[ name ], traditional, add ); + } + + } else { + + // Serialize scalar item. + add( prefix, obj ); + } +} + +// Serialize an array of form elements or a set of +// key/values into a query string +jQuery.param = function( a, traditional ) { + var prefix, + s = [], + add = function( key, valueOrFunction ) { + + // If value is a function, invoke it and use its return value + var value = isFunction( valueOrFunction ) ? + valueOrFunction() : + valueOrFunction; + + s[ s.length ] = encodeURIComponent( key ) + "=" + + encodeURIComponent( value == null ? "" : value ); + }; + + if ( a == null ) { + return ""; + } + + // If an array was passed in, assume that it is an array of form elements. + if ( Array.isArray( a ) || ( a.jquery && !jQuery.isPlainObject( a ) ) ) { + + // Serialize the form elements + jQuery.each( a, function() { + add( this.name, this.value ); + } ); + + } else { + + // If traditional, encode the "old" way (the way 1.3.2 or older + // did it), otherwise encode params recursively. + for ( prefix in a ) { + buildParams( prefix, a[ prefix ], traditional, add ); + } + } + + // Return the resulting serialization + return s.join( "&" ); +}; + +jQuery.fn.extend( { + serialize: function() { + return jQuery.param( this.serializeArray() ); + }, + serializeArray: function() { + return this.map( function() { + + // Can add propHook for "elements" to filter or add form elements + var elements = jQuery.prop( this, "elements" ); + return elements ? jQuery.makeArray( elements ) : this; + } ).filter( function() { + var type = this.type; + + // Use .is( ":disabled" ) so that fieldset[disabled] works + return this.name && !jQuery( this ).is( ":disabled" ) && + rsubmittable.test( this.nodeName ) && !rsubmitterTypes.test( type ) && + ( this.checked || !rcheckableType.test( type ) ); + } ).map( function( _i, elem ) { + var val = jQuery( this ).val(); + + if ( val == null ) { + return null; + } + + if ( Array.isArray( val ) ) { + return jQuery.map( val, function( val ) { + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ); + } + + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ).get(); + } +} ); + + +var + r20 = /%20/g, + rhash = /#.*$/, + rantiCache = /([?&])_=[^&]*/, + rheaders = /^(.*?):[ \t]*([^\r\n]*)$/mg, + + // #7653, #8125, #8152: local protocol detection + rlocalProtocol = /^(?:about|app|app-storage|.+-extension|file|res|widget):$/, + rnoContent = /^(?:GET|HEAD)$/, + rprotocol = /^\/\//, + + /* Prefilters + * 1) They are useful to introduce custom dataTypes (see ajax/jsonp.js for an example) + * 2) These are called: + * - BEFORE asking for a transport + * - AFTER param serialization (s.data is a string if s.processData is true) + * 3) key is the dataType + * 4) the catchall symbol "*" can be used + * 5) execution will start with transport dataType and THEN continue down to "*" if needed + */ + prefilters = {}, + + /* Transports bindings + * 1) key is the dataType + * 2) the catchall symbol "*" can be used + * 3) selection will start with transport dataType and THEN go to "*" if needed + */ + transports = {}, + + // Avoid comment-prolog char sequence (#10098); must appease lint and evade compression + allTypes = "*/".concat( "*" ), + + // Anchor tag for parsing the document origin + originAnchor = document.createElement( "a" ); + +originAnchor.href = location.href; + +// Base "constructor" for jQuery.ajaxPrefilter and jQuery.ajaxTransport +function addToPrefiltersOrTransports( structure ) { + + // dataTypeExpression is optional and defaults to "*" + return function( dataTypeExpression, func ) { + + if ( typeof dataTypeExpression !== "string" ) { + func = dataTypeExpression; + dataTypeExpression = "*"; + } + + var dataType, + i = 0, + dataTypes = dataTypeExpression.toLowerCase().match( rnothtmlwhite ) || []; + + if ( isFunction( func ) ) { + + // For each dataType in the dataTypeExpression + while ( ( dataType = dataTypes[ i++ ] ) ) { + + // Prepend if requested + if ( dataType[ 0 ] === "+" ) { + dataType = dataType.slice( 1 ) || "*"; + ( structure[ dataType ] = structure[ dataType ] || [] ).unshift( func ); + + // Otherwise append + } else { + ( structure[ dataType ] = structure[ dataType ] || [] ).push( func ); + } + } + } + }; +} + +// Base inspection function for prefilters and transports +function inspectPrefiltersOrTransports( structure, options, originalOptions, jqXHR ) { + + var inspected = {}, + seekingTransport = ( structure === transports ); + + function inspect( dataType ) { + var selected; + inspected[ dataType ] = true; + jQuery.each( structure[ dataType ] || [], function( _, prefilterOrFactory ) { + var dataTypeOrTransport = prefilterOrFactory( options, originalOptions, jqXHR ); + if ( typeof dataTypeOrTransport === "string" && + !seekingTransport && !inspected[ dataTypeOrTransport ] ) { + + options.dataTypes.unshift( dataTypeOrTransport ); + inspect( dataTypeOrTransport ); + return false; + } else if ( seekingTransport ) { + return !( selected = dataTypeOrTransport ); + } + } ); + return selected; + } + + return inspect( options.dataTypes[ 0 ] ) || !inspected[ "*" ] && inspect( "*" ); +} + +// A special extend for ajax options +// that takes "flat" options (not to be deep extended) +// Fixes #9887 +function ajaxExtend( target, src ) { + var key, deep, + flatOptions = jQuery.ajaxSettings.flatOptions || {}; + + for ( key in src ) { + if ( src[ key ] !== undefined ) { + ( flatOptions[ key ] ? target : ( deep || ( deep = {} ) ) )[ key ] = src[ key ]; + } + } + if ( deep ) { + jQuery.extend( true, target, deep ); + } + + return target; +} + +/* Handles responses to an ajax request: + * - finds the right dataType (mediates between content-type and expected dataType) + * - returns the corresponding response + */ +function ajaxHandleResponses( s, jqXHR, responses ) { + + var ct, type, finalDataType, firstDataType, + contents = s.contents, + dataTypes = s.dataTypes; + + // Remove auto dataType and get content-type in the process + while ( dataTypes[ 0 ] === "*" ) { + dataTypes.shift(); + if ( ct === undefined ) { + ct = s.mimeType || jqXHR.getResponseHeader( "Content-Type" ); + } + } + + // Check if we're dealing with a known content-type + if ( ct ) { + for ( type in contents ) { + if ( contents[ type ] && contents[ type ].test( ct ) ) { + dataTypes.unshift( type ); + break; + } + } + } + + // Check to see if we have a response for the expected dataType + if ( dataTypes[ 0 ] in responses ) { + finalDataType = dataTypes[ 0 ]; + } else { + + // Try convertible dataTypes + for ( type in responses ) { + if ( !dataTypes[ 0 ] || s.converters[ type + " " + dataTypes[ 0 ] ] ) { + finalDataType = type; + break; + } + if ( !firstDataType ) { + firstDataType = type; + } + } + + // Or just use first one + finalDataType = finalDataType || firstDataType; + } + + // If we found a dataType + // We add the dataType to the list if needed + // and return the corresponding response + if ( finalDataType ) { + if ( finalDataType !== dataTypes[ 0 ] ) { + dataTypes.unshift( finalDataType ); + } + return responses[ finalDataType ]; + } +} + +/* Chain conversions given the request and the original response + * Also sets the responseXXX fields on the jqXHR instance + */ +function ajaxConvert( s, response, jqXHR, isSuccess ) { + var conv2, current, conv, tmp, prev, + converters = {}, + + // Work with a copy of dataTypes in case we need to modify it for conversion + dataTypes = s.dataTypes.slice(); + + // Create converters map with lowercased keys + if ( dataTypes[ 1 ] ) { + for ( conv in s.converters ) { + converters[ conv.toLowerCase() ] = s.converters[ conv ]; + } + } + + current = dataTypes.shift(); + + // Convert to each sequential dataType + while ( current ) { + + if ( s.responseFields[ current ] ) { + jqXHR[ s.responseFields[ current ] ] = response; + } + + // Apply the dataFilter if provided + if ( !prev && isSuccess && s.dataFilter ) { + response = s.dataFilter( response, s.dataType ); + } + + prev = current; + current = dataTypes.shift(); + + if ( current ) { + + // There's only work to do if current dataType is non-auto + if ( current === "*" ) { + + current = prev; + + // Convert response if prev dataType is non-auto and differs from current + } else if ( prev !== "*" && prev !== current ) { + + // Seek a direct converter + conv = converters[ prev + " " + current ] || converters[ "* " + current ]; + + // If none found, seek a pair + if ( !conv ) { + for ( conv2 in converters ) { + + // If conv2 outputs current + tmp = conv2.split( " " ); + if ( tmp[ 1 ] === current ) { + + // If prev can be converted to accepted input + conv = converters[ prev + " " + tmp[ 0 ] ] || + converters[ "* " + tmp[ 0 ] ]; + if ( conv ) { + + // Condense equivalence converters + if ( conv === true ) { + conv = converters[ conv2 ]; + + // Otherwise, insert the intermediate dataType + } else if ( converters[ conv2 ] !== true ) { + current = tmp[ 0 ]; + dataTypes.unshift( tmp[ 1 ] ); + } + break; + } + } + } + } + + // Apply converter (if not an equivalence) + if ( conv !== true ) { + + // Unless errors are allowed to bubble, catch and return them + if ( conv && s.throws ) { + response = conv( response ); + } else { + try { + response = conv( response ); + } catch ( e ) { + return { + state: "parsererror", + error: conv ? e : "No conversion from " + prev + " to " + current + }; + } + } + } + } + } + } + + return { state: "success", data: response }; +} + +jQuery.extend( { + + // Counter for holding the number of active queries + active: 0, + + // Last-Modified header cache for next request + lastModified: {}, + etag: {}, + + ajaxSettings: { + url: location.href, + type: "GET", + isLocal: rlocalProtocol.test( location.protocol ), + global: true, + processData: true, + async: true, + contentType: "application/x-www-form-urlencoded; charset=UTF-8", + + /* + timeout: 0, + data: null, + dataType: null, + username: null, + password: null, + cache: null, + throws: false, + traditional: false, + headers: {}, + */ + + accepts: { + "*": allTypes, + text: "text/plain", + html: "text/html", + xml: "application/xml, text/xml", + json: "application/json, text/javascript" + }, + + contents: { + xml: /\bxml\b/, + html: /\bhtml/, + json: /\bjson\b/ + }, + + responseFields: { + xml: "responseXML", + text: "responseText", + json: "responseJSON" + }, + + // Data converters + // Keys separate source (or catchall "*") and destination types with a single space + converters: { + + // Convert anything to text + "* text": String, + + // Text to html (true = no transformation) + "text html": true, + + // Evaluate text as a json expression + "text json": JSON.parse, + + // Parse text as xml + "text xml": jQuery.parseXML + }, + + // For options that shouldn't be deep extended: + // you can add your own custom options here if + // and when you create one that shouldn't be + // deep extended (see ajaxExtend) + flatOptions: { + url: true, + context: true + } + }, + + // Creates a full fledged settings object into target + // with both ajaxSettings and settings fields. + // If target is omitted, writes into ajaxSettings. + ajaxSetup: function( target, settings ) { + return settings ? + + // Building a settings object + ajaxExtend( ajaxExtend( target, jQuery.ajaxSettings ), settings ) : + + // Extending ajaxSettings + ajaxExtend( jQuery.ajaxSettings, target ); + }, + + ajaxPrefilter: addToPrefiltersOrTransports( prefilters ), + ajaxTransport: addToPrefiltersOrTransports( transports ), + + // Main method + ajax: function( url, options ) { + + // If url is an object, simulate pre-1.5 signature + if ( typeof url === "object" ) { + options = url; + url = undefined; + } + + // Force options to be an object + options = options || {}; + + var transport, + + // URL without anti-cache param + cacheURL, + + // Response headers + responseHeadersString, + responseHeaders, + + // timeout handle + timeoutTimer, + + // Url cleanup var + urlAnchor, + + // Request state (becomes false upon send and true upon completion) + completed, + + // To know if global events are to be dispatched + fireGlobals, + + // Loop variable + i, + + // uncached part of the url + uncached, + + // Create the final options object + s = jQuery.ajaxSetup( {}, options ), + + // Callbacks context + callbackContext = s.context || s, + + // Context for global events is callbackContext if it is a DOM node or jQuery collection + globalEventContext = s.context && + ( callbackContext.nodeType || callbackContext.jquery ) ? + jQuery( callbackContext ) : + jQuery.event, + + // Deferreds + deferred = jQuery.Deferred(), + completeDeferred = jQuery.Callbacks( "once memory" ), + + // Status-dependent callbacks + statusCode = s.statusCode || {}, + + // Headers (they are sent all at once) + requestHeaders = {}, + requestHeadersNames = {}, + + // Default abort message + strAbort = "canceled", + + // Fake xhr + jqXHR = { + readyState: 0, + + // Builds headers hashtable if needed + getResponseHeader: function( key ) { + var match; + if ( completed ) { + if ( !responseHeaders ) { + responseHeaders = {}; + while ( ( match = rheaders.exec( responseHeadersString ) ) ) { + responseHeaders[ match[ 1 ].toLowerCase() + " " ] = + ( responseHeaders[ match[ 1 ].toLowerCase() + " " ] || [] ) + .concat( match[ 2 ] ); + } + } + match = responseHeaders[ key.toLowerCase() + " " ]; + } + return match == null ? null : match.join( ", " ); + }, + + // Raw string + getAllResponseHeaders: function() { + return completed ? responseHeadersString : null; + }, + + // Caches the header + setRequestHeader: function( name, value ) { + if ( completed == null ) { + name = requestHeadersNames[ name.toLowerCase() ] = + requestHeadersNames[ name.toLowerCase() ] || name; + requestHeaders[ name ] = value; + } + return this; + }, + + // Overrides response content-type header + overrideMimeType: function( type ) { + if ( completed == null ) { + s.mimeType = type; + } + return this; + }, + + // Status-dependent callbacks + statusCode: function( map ) { + var code; + if ( map ) { + if ( completed ) { + + // Execute the appropriate callbacks + jqXHR.always( map[ jqXHR.status ] ); + } else { + + // Lazy-add the new callbacks in a way that preserves old ones + for ( code in map ) { + statusCode[ code ] = [ statusCode[ code ], map[ code ] ]; + } + } + } + return this; + }, + + // Cancel the request + abort: function( statusText ) { + var finalText = statusText || strAbort; + if ( transport ) { + transport.abort( finalText ); + } + done( 0, finalText ); + return this; + } + }; + + // Attach deferreds + deferred.promise( jqXHR ); + + // Add protocol if not provided (prefilters might expect it) + // Handle falsy url in the settings object (#10093: consistency with old signature) + // We also use the url parameter if available + s.url = ( ( url || s.url || location.href ) + "" ) + .replace( rprotocol, location.protocol + "//" ); + + // Alias method option to type as per ticket #12004 + s.type = options.method || options.type || s.method || s.type; + + // Extract dataTypes list + s.dataTypes = ( s.dataType || "*" ).toLowerCase().match( rnothtmlwhite ) || [ "" ]; + + // A cross-domain request is in order when the origin doesn't match the current origin. + if ( s.crossDomain == null ) { + urlAnchor = document.createElement( "a" ); + + // Support: IE <=8 - 11, Edge 12 - 15 + // IE throws exception on accessing the href property if url is malformed, + // e.g. http://example.com:80x/ + try { + urlAnchor.href = s.url; + + // Support: IE <=8 - 11 only + // Anchor's host property isn't correctly set when s.url is relative + urlAnchor.href = urlAnchor.href; + s.crossDomain = originAnchor.protocol + "//" + originAnchor.host !== + urlAnchor.protocol + "//" + urlAnchor.host; + } catch ( e ) { + + // If there is an error parsing the URL, assume it is crossDomain, + // it can be rejected by the transport if it is invalid + s.crossDomain = true; + } + } + + // Convert data if not already a string + if ( s.data && s.processData && typeof s.data !== "string" ) { + s.data = jQuery.param( s.data, s.traditional ); + } + + // Apply prefilters + inspectPrefiltersOrTransports( prefilters, s, options, jqXHR ); + + // If request was aborted inside a prefilter, stop there + if ( completed ) { + return jqXHR; + } + + // We can fire global events as of now if asked to + // Don't fire events if jQuery.event is undefined in an AMD-usage scenario (#15118) + fireGlobals = jQuery.event && s.global; + + // Watch for a new set of requests + if ( fireGlobals && jQuery.active++ === 0 ) { + jQuery.event.trigger( "ajaxStart" ); + } + + // Uppercase the type + s.type = s.type.toUpperCase(); + + // Determine if request has content + s.hasContent = !rnoContent.test( s.type ); + + // Save the URL in case we're toying with the If-Modified-Since + // and/or If-None-Match header later on + // Remove hash to simplify url manipulation + cacheURL = s.url.replace( rhash, "" ); + + // More options handling for requests with no content + if ( !s.hasContent ) { + + // Remember the hash so we can put it back + uncached = s.url.slice( cacheURL.length ); + + // If data is available and should be processed, append data to url + if ( s.data && ( s.processData || typeof s.data === "string" ) ) { + cacheURL += ( rquery.test( cacheURL ) ? "&" : "?" ) + s.data; + + // #9682: remove data so that it's not used in an eventual retry + delete s.data; + } + + // Add or update anti-cache param if needed + if ( s.cache === false ) { + cacheURL = cacheURL.replace( rantiCache, "$1" ); + uncached = ( rquery.test( cacheURL ) ? "&" : "?" ) + "_=" + ( nonce.guid++ ) + + uncached; + } + + // Put hash and anti-cache on the URL that will be requested (gh-1732) + s.url = cacheURL + uncached; + + // Change '%20' to '+' if this is encoded form body content (gh-2658) + } else if ( s.data && s.processData && + ( s.contentType || "" ).indexOf( "application/x-www-form-urlencoded" ) === 0 ) { + s.data = s.data.replace( r20, "+" ); + } + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + if ( jQuery.lastModified[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-Modified-Since", jQuery.lastModified[ cacheURL ] ); + } + if ( jQuery.etag[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-None-Match", jQuery.etag[ cacheURL ] ); + } + } + + // Set the correct header, if data is being sent + if ( s.data && s.hasContent && s.contentType !== false || options.contentType ) { + jqXHR.setRequestHeader( "Content-Type", s.contentType ); + } + + // Set the Accepts header for the server, depending on the dataType + jqXHR.setRequestHeader( + "Accept", + s.dataTypes[ 0 ] && s.accepts[ s.dataTypes[ 0 ] ] ? + s.accepts[ s.dataTypes[ 0 ] ] + + ( s.dataTypes[ 0 ] !== "*" ? ", " + allTypes + "; q=0.01" : "" ) : + s.accepts[ "*" ] + ); + + // Check for headers option + for ( i in s.headers ) { + jqXHR.setRequestHeader( i, s.headers[ i ] ); + } + + // Allow custom headers/mimetypes and early abort + if ( s.beforeSend && + ( s.beforeSend.call( callbackContext, jqXHR, s ) === false || completed ) ) { + + // Abort if not done already and return + return jqXHR.abort(); + } + + // Aborting is no longer a cancellation + strAbort = "abort"; + + // Install callbacks on deferreds + completeDeferred.add( s.complete ); + jqXHR.done( s.success ); + jqXHR.fail( s.error ); + + // Get transport + transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR ); + + // If no transport, we auto-abort + if ( !transport ) { + done( -1, "No Transport" ); + } else { + jqXHR.readyState = 1; + + // Send global event + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxSend", [ jqXHR, s ] ); + } + + // If request was aborted inside ajaxSend, stop there + if ( completed ) { + return jqXHR; + } + + // Timeout + if ( s.async && s.timeout > 0 ) { + timeoutTimer = window.setTimeout( function() { + jqXHR.abort( "timeout" ); + }, s.timeout ); + } + + try { + completed = false; + transport.send( requestHeaders, done ); + } catch ( e ) { + + // Rethrow post-completion exceptions + if ( completed ) { + throw e; + } + + // Propagate others as results + done( -1, e ); + } + } + + // Callback for when everything is done + function done( status, nativeStatusText, responses, headers ) { + var isSuccess, success, error, response, modified, + statusText = nativeStatusText; + + // Ignore repeat invocations + if ( completed ) { + return; + } + + completed = true; + + // Clear timeout if it exists + if ( timeoutTimer ) { + window.clearTimeout( timeoutTimer ); + } + + // Dereference transport for early garbage collection + // (no matter how long the jqXHR object will be used) + transport = undefined; + + // Cache response headers + responseHeadersString = headers || ""; + + // Set readyState + jqXHR.readyState = status > 0 ? 4 : 0; + + // Determine if successful + isSuccess = status >= 200 && status < 300 || status === 304; + + // Get response data + if ( responses ) { + response = ajaxHandleResponses( s, jqXHR, responses ); + } + + // Use a noop converter for missing script but not if jsonp + if ( !isSuccess && + jQuery.inArray( "script", s.dataTypes ) > -1 && + jQuery.inArray( "json", s.dataTypes ) < 0 ) { + s.converters[ "text script" ] = function() {}; + } + + // Convert no matter what (that way responseXXX fields are always set) + response = ajaxConvert( s, response, jqXHR, isSuccess ); + + // If successful, handle type chaining + if ( isSuccess ) { + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + modified = jqXHR.getResponseHeader( "Last-Modified" ); + if ( modified ) { + jQuery.lastModified[ cacheURL ] = modified; + } + modified = jqXHR.getResponseHeader( "etag" ); + if ( modified ) { + jQuery.etag[ cacheURL ] = modified; + } + } + + // if no content + if ( status === 204 || s.type === "HEAD" ) { + statusText = "nocontent"; + + // if not modified + } else if ( status === 304 ) { + statusText = "notmodified"; + + // If we have data, let's convert it + } else { + statusText = response.state; + success = response.data; + error = response.error; + isSuccess = !error; + } + } else { + + // Extract error from statusText and normalize for non-aborts + error = statusText; + if ( status || !statusText ) { + statusText = "error"; + if ( status < 0 ) { + status = 0; + } + } + } + + // Set data for the fake xhr object + jqXHR.status = status; + jqXHR.statusText = ( nativeStatusText || statusText ) + ""; + + // Success/Error + if ( isSuccess ) { + deferred.resolveWith( callbackContext, [ success, statusText, jqXHR ] ); + } else { + deferred.rejectWith( callbackContext, [ jqXHR, statusText, error ] ); + } + + // Status-dependent callbacks + jqXHR.statusCode( statusCode ); + statusCode = undefined; + + if ( fireGlobals ) { + globalEventContext.trigger( isSuccess ? "ajaxSuccess" : "ajaxError", + [ jqXHR, s, isSuccess ? success : error ] ); + } + + // Complete + completeDeferred.fireWith( callbackContext, [ jqXHR, statusText ] ); + + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxComplete", [ jqXHR, s ] ); + + // Handle the global AJAX counter + if ( !( --jQuery.active ) ) { + jQuery.event.trigger( "ajaxStop" ); + } + } + } + + return jqXHR; + }, + + getJSON: function( url, data, callback ) { + return jQuery.get( url, data, callback, "json" ); + }, + + getScript: function( url, callback ) { + return jQuery.get( url, undefined, callback, "script" ); + } +} ); + +jQuery.each( [ "get", "post" ], function( _i, method ) { + jQuery[ method ] = function( url, data, callback, type ) { + + // Shift arguments if data argument was omitted + if ( isFunction( data ) ) { + type = type || callback; + callback = data; + data = undefined; + } + + // The url can be an options object (which then must have .url) + return jQuery.ajax( jQuery.extend( { + url: url, + type: method, + dataType: type, + data: data, + success: callback + }, jQuery.isPlainObject( url ) && url ) ); + }; +} ); + +jQuery.ajaxPrefilter( function( s ) { + var i; + for ( i in s.headers ) { + if ( i.toLowerCase() === "content-type" ) { + s.contentType = s.headers[ i ] || ""; + } + } +} ); + + +jQuery._evalUrl = function( url, options, doc ) { + return jQuery.ajax( { + url: url, + + // Make this explicit, since user can override this through ajaxSetup (#11264) + type: "GET", + dataType: "script", + cache: true, + async: false, + global: false, + + // Only evaluate the response if it is successful (gh-4126) + // dataFilter is not invoked for failure responses, so using it instead + // of the default converter is kludgy but it works. + converters: { + "text script": function() {} + }, + dataFilter: function( response ) { + jQuery.globalEval( response, options, doc ); + } + } ); +}; + + +jQuery.fn.extend( { + wrapAll: function( html ) { + var wrap; + + if ( this[ 0 ] ) { + if ( isFunction( html ) ) { + html = html.call( this[ 0 ] ); + } + + // The elements to wrap the target around + wrap = jQuery( html, this[ 0 ].ownerDocument ).eq( 0 ).clone( true ); + + if ( this[ 0 ].parentNode ) { + wrap.insertBefore( this[ 0 ] ); + } + + wrap.map( function() { + var elem = this; + + while ( elem.firstElementChild ) { + elem = elem.firstElementChild; + } + + return elem; + } ).append( this ); + } + + return this; + }, + + wrapInner: function( html ) { + if ( isFunction( html ) ) { + return this.each( function( i ) { + jQuery( this ).wrapInner( html.call( this, i ) ); + } ); + } + + return this.each( function() { + var self = jQuery( this ), + contents = self.contents(); + + if ( contents.length ) { + contents.wrapAll( html ); + + } else { + self.append( html ); + } + } ); + }, + + wrap: function( html ) { + var htmlIsFunction = isFunction( html ); + + return this.each( function( i ) { + jQuery( this ).wrapAll( htmlIsFunction ? html.call( this, i ) : html ); + } ); + }, + + unwrap: function( selector ) { + this.parent( selector ).not( "body" ).each( function() { + jQuery( this ).replaceWith( this.childNodes ); + } ); + return this; + } +} ); + + +jQuery.expr.pseudos.hidden = function( elem ) { + return !jQuery.expr.pseudos.visible( elem ); +}; +jQuery.expr.pseudos.visible = function( elem ) { + return !!( elem.offsetWidth || elem.offsetHeight || elem.getClientRects().length ); +}; + + + + +jQuery.ajaxSettings.xhr = function() { + try { + return new window.XMLHttpRequest(); + } catch ( e ) {} +}; + +var xhrSuccessStatus = { + + // File protocol always yields status code 0, assume 200 + 0: 200, + + // Support: IE <=9 only + // #1450: sometimes IE returns 1223 when it should be 204 + 1223: 204 + }, + xhrSupported = jQuery.ajaxSettings.xhr(); + +support.cors = !!xhrSupported && ( "withCredentials" in xhrSupported ); +support.ajax = xhrSupported = !!xhrSupported; + +jQuery.ajaxTransport( function( options ) { + var callback, errorCallback; + + // Cross domain only allowed if supported through XMLHttpRequest + if ( support.cors || xhrSupported && !options.crossDomain ) { + return { + send: function( headers, complete ) { + var i, + xhr = options.xhr(); + + xhr.open( + options.type, + options.url, + options.async, + options.username, + options.password + ); + + // Apply custom fields if provided + if ( options.xhrFields ) { + for ( i in options.xhrFields ) { + xhr[ i ] = options.xhrFields[ i ]; + } + } + + // Override mime type if needed + if ( options.mimeType && xhr.overrideMimeType ) { + xhr.overrideMimeType( options.mimeType ); + } + + // X-Requested-With header + // For cross-domain requests, seeing as conditions for a preflight are + // akin to a jigsaw puzzle, we simply never set it to be sure. + // (it can always be set on a per-request basis or even using ajaxSetup) + // For same-domain requests, won't change header if already provided. + if ( !options.crossDomain && !headers[ "X-Requested-With" ] ) { + headers[ "X-Requested-With" ] = "XMLHttpRequest"; + } + + // Set headers + for ( i in headers ) { + xhr.setRequestHeader( i, headers[ i ] ); + } + + // Callback + callback = function( type ) { + return function() { + if ( callback ) { + callback = errorCallback = xhr.onload = + xhr.onerror = xhr.onabort = xhr.ontimeout = + xhr.onreadystatechange = null; + + if ( type === "abort" ) { + xhr.abort(); + } else if ( type === "error" ) { + + // Support: IE <=9 only + // On a manual native abort, IE9 throws + // errors on any property access that is not readyState + if ( typeof xhr.status !== "number" ) { + complete( 0, "error" ); + } else { + complete( + + // File: protocol always yields status 0; see #8605, #14207 + xhr.status, + xhr.statusText + ); + } + } else { + complete( + xhrSuccessStatus[ xhr.status ] || xhr.status, + xhr.statusText, + + // Support: IE <=9 only + // IE9 has no XHR2 but throws on binary (trac-11426) + // For XHR2 non-text, let the caller handle it (gh-2498) + ( xhr.responseType || "text" ) !== "text" || + typeof xhr.responseText !== "string" ? + { binary: xhr.response } : + { text: xhr.responseText }, + xhr.getAllResponseHeaders() + ); + } + } + }; + }; + + // Listen to events + xhr.onload = callback(); + errorCallback = xhr.onerror = xhr.ontimeout = callback( "error" ); + + // Support: IE 9 only + // Use onreadystatechange to replace onabort + // to handle uncaught aborts + if ( xhr.onabort !== undefined ) { + xhr.onabort = errorCallback; + } else { + xhr.onreadystatechange = function() { + + // Check readyState before timeout as it changes + if ( xhr.readyState === 4 ) { + + // Allow onerror to be called first, + // but that will not handle a native abort + // Also, save errorCallback to a variable + // as xhr.onerror cannot be accessed + window.setTimeout( function() { + if ( callback ) { + errorCallback(); + } + } ); + } + }; + } + + // Create the abort callback + callback = callback( "abort" ); + + try { + + // Do send the request (this may raise an exception) + xhr.send( options.hasContent && options.data || null ); + } catch ( e ) { + + // #14683: Only rethrow if this hasn't been notified as an error yet + if ( callback ) { + throw e; + } + } + }, + + abort: function() { + if ( callback ) { + callback(); + } + } + }; + } +} ); + + + + +// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) +jQuery.ajaxPrefilter( function( s ) { + if ( s.crossDomain ) { + s.contents.script = false; + } +} ); + +// Install script dataType +jQuery.ajaxSetup( { + accepts: { + script: "text/javascript, application/javascript, " + + "application/ecmascript, application/x-ecmascript" + }, + contents: { + script: /\b(?:java|ecma)script\b/ + }, + converters: { + "text script": function( text ) { + jQuery.globalEval( text ); + return text; + } + } +} ); + +// Handle cache's special case and crossDomain +jQuery.ajaxPrefilter( "script", function( s ) { + if ( s.cache === undefined ) { + s.cache = false; + } + if ( s.crossDomain ) { + s.type = "GET"; + } +} ); + +// Bind script tag hack transport +jQuery.ajaxTransport( "script", function( s ) { + + // This transport only deals with cross domain or forced-by-attrs requests + if ( s.crossDomain || s.scriptAttrs ) { + var script, callback; + return { + send: function( _, complete ) { + script = jQuery( " +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

User attributes

+

The following table shows the list of user attributes supported by SPID and/or CIE. The variable $PREFIX=https://attributes.eid.gov.it represents the namespace.

+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Claim

Description

Supported by

$PREFIX/spid_code
Category:registry

Identification code. String. The identification code is assigned by the digital identity provider +and must be unique.

+

The format is the following:

+

<Identification code> = <cod_IdP><unique_number>

+

Where:

+
+

<cod_IdP>: is a code made by 4 letters, uniquely assigned to the identity provider.

+

<unique_number>: is an alphanumeric string composed by 10 characters that the identity provider +uniquely generates in its own domain.

+
+

Example:

+

"$PREFIX/spid_code":"ABCD123456789A"

+

spid-icon

given_name
Category:registry

Name. String. String composed by a sequence of words, separated by single spaces, each starting with a capital letter.

+

Example:

+

"given_name":"Giovanni Mario"

+

spid-icon cieid-icon

family_name
Category:registry

Last name. String. String composed by a sequence of words, separated by single spaces, each starting with a capital letter.

+

Example:

+

"family_name":"Bianchi Verdi"

+

spid-icon cieid-icon

place_of_birth
Category:registry

Place of birth, province of birth. JSON Object:

+

"locality : String corresponding to the real estate registry code (Belfiore Code) of the city or foreign country of birth (e.g. "F205" for the city of Milano)

+

"region" : String corresponding to the code of the province of birth.

+

Example:

+
"place_of_birth": {
+    "region":"MI",
+    "locality":"F205"
+}
+
+
+

spid-icon cieid-icon

birthdate
Category:registry

Date of birth. String. Following the specifications ISO8601-2004 in the format +YYYY indicates the year using 4 (four) digits
+MM indicates the month with 2 (two) digits
+DD indicates the day with 2 (two) digits
+Example:

+

"birthdate":"2002-09-24"

+

spid-icon cieid-icon

gender
Category:registry

Gender. String. Values accepted:
+"female" for female
+"male" for male
+Example:

+

"gender":"female"

+

spid-icon cieid-icon

$PREFIX/company_name
Category:registry

Company name. String. String composed by a sequence of words, separated by single spaces. +In capital letters the substrings corresponding to names (e.g. "Agenzia per l'Italia Digitale")

+
"$PREFIX/company_name": "Agenzia per l'Italia Digitale"
+
+
+

spid-icon

$PREFIX/registered_office
Category: extra registry

Registered Office. JSON Object: formatted, street_address, locality, region, postal_code, country, +country_code. +Json made of a string composed by a sequence of words, separated by single spaces, representing:

+
    +
  • Type of address (via, viale, piazza …)

  • +
  • Address

  • +
  • Hiuse number

  • +
  • ZIP

  • +
  • City

  • +
  • Province

  • +
+

the string is included in the claim "formatted" of the JSON Object "address"

+

Example:

+
"$PREFIX/registered_office":{
+    "formatted":"via Listz 21 00144 Roma"
+}
+
+
+

spid-icon

$PREFIX/fiscal_number
Category:registry

Fiscal number of the natural person. String. For the format, please refer to the coding of the attribute +CF for the certificates, proposed in the Draft ETSI EN 319 412-1, that implies, in the specific case, the following format: +TINIT-<fiscal_number>

+

Example:

+

"$PREFIX/fiscal_number":“TINIT-ABCXYZ00W00Z000Z"

+

spid-icon cieid-icon

$PREFIX/company_fiscal_number
Category:registry

Fiscal number of the legal person. String. For the format, please refer to the coding of the attribute +CF for the certificates, proposed in the Draft ETSI EN 319 412-1, that implies, in the specific case, the following format:

+

TINIT-<fiscal_number>

+

Example:

+

"$PREFIX/company_fiscal_number":"TINIT-ABCXYZ00W00Z000Z"

+

spid-icon

$PREFIX/vat_number
Category:registry

VAT number. String. For the format, please refer to the coding of the attribute VAT number for +the certificates, proposed in the Draft ETSI EN 319 412-1, that implies, in the specific case, the following format:

+

VATIT-<PartitaIVA>

+

Example:

+

"$PREFIX/vat_number": "VATIT-12345678901"

+

spid-icon

document_details
Category: extra registry

Identity document. JSON Object (document):

+

Json contains the proprieties that represent:

+
+
    +
  • "type" : accepted values:

    +
      +
    • cartaIdentita, passaporto, patenteGuida,

    • +
    • patenteNautica, librettoPensione,

    • +
    • patentinoImpTermici, portoArmi,

    • +
    • tesseraRiconoscimento;

    • +
    +
  • +
  • "document_number" : Document number;

  • +
  • "issuer" : <issuing Entity> JSON Object:

    +
      +
    • "name" string obtained from the concatenation +of the terms that build the Entity name +unless conjunctions, articles and prepositions.

      +
      +

      E.g. regioneLazio ( Region Lazio); +provinciaCatania ( Province of Catania); +prefetturaRoma ( Prefecture of Roma ); +MinisteroEconomiaFinanze ( Ministry +of Economy and Finance );

      +
      +
    • +
    +
  • +
  • "date_of_issuance" : date of issuance of the document;

  • +
  • "date_of_expiry" : expiry date of the document.

  • +
+
+

Example:

+
"document_details":{
+    "type":"cartaIdentita",
+    "document_number":"AS09452389",
+    "issuer":{
+        "name":"ComuneRoma"
+    },
+    "date_of_issuance":"2013-01-02",
+    "date_of_expiry":"2013-01-31"
+}
+
+
+

spid-icon cieid-icon

phone_number
Category: extra registry

Mobile phone name. String. Numeric string without internal spaces
+Example:
+"phone_number": "VATIT-12345678901"

spid-icon cieid-icon

phone_number_verified
Category: extra registry

Boolean value indicating whether the user's mobile phone number has been verified by the OP.

cieid-icon

$PREFIX/landline_number
Category: extra registry

Landline number. String. Numeric string without internal spaces
+Example:
+"$PREFIX/landline_number":"VATIT-12345678901"

cieid-icon

email
Category: extra registry

E-mail address. String. Standard e-mail address
+Example:
+"email":"name@domain.it"

spid-icon cieid-icon

email_verified
Category: extra registry

Boolean value indicating whether the user's e-mail has been verified by the OP.

cieid-icon

$PREFIX/e_delivery_service
Category: extra registry

Qualified electronic registered delivery. PEC e-mail address
+Example:
+"$PREFIX/e_delivery_service":"name@pecdomain.it"

spid-icon cieid-icon

$PREFIX/eid_exp_date
Category: extra registry

Identity expiry date. According to the specifications ISO8601-2004 in the format +"YYYY-MM-DD" where
+YYYY indicates the year using 4 (four) digits
+MM indicates the month with 2 (two) digits
+DD indicates the day with 2 (two) digits
+Example:
+"$PREFIX/eid_exp_date":"2002-09-24"

spid-icon

address
Category: extra registry

JSON Object (address):

+
+
    +
  • "street_address": The attribute contains the address type (via, viale, piazza …), the address and the house number. The three informations are preferably sorted as in the specific countries.

  • +
  • "postal_code": ZIP

  • +
  • "locality": City

  • +
  • "region": Province

  • +
  • "country_code": Country

  • +
+
+

Example:

+
"address": {
+    "street_address":"Via Liszt 21",
+    "postal_code":"00144",
+    "locality":"Roma",
+    "region":"RM",
+    "country_code":"IT"
+}
+
+
+

spid-icon cieid-icon

+
+

Examples

+

For convenience, we report examples that produce the composition of a unique JSON Object, from +several attributes and in particular the claims "place_of_birth", "address", "document_details", $PREFIX/registered_office.

+

As an example, two Italian addresses are reported:

+ ++++ + + + + + + + + + + + + + +

Attribute

Example of OIDC coding

Physical domicile address +ZIP of the physical domicile +City of the of the physical domicile +Province of the physical domicile +Country of the physical domicile

"address":{
+    "street_address":"Via Liszt 21",
+    "postal_code":"00144",
+    "locality":"Roma",
+    "region":"RM",
+    "country_code":"IT"
+}
+
+
+

Physical domicile address +ZIP of the physical domicile +City of the of the physical domicile +Province of the physical domicile +Country of the physical domicile

"address":{
+    "street_address":"S.S. Salaria Km 23,800",
+    "postal_code":"00015",
+    "locality":"Monterotondo",
+    "region":"RM",
+    "country_code":"IT"
+}
+
+
+
+

There are cases, as for the United States of America, where both the country (US) and a State must be indicated. +In such cases the State is indicated in the field Province. +In the following, an example:

+ ++++ + + + + + + + + + + +

Attribute

Example of OIDC coding

Physical domicile address +ZIP of the physical domicile +City of the of the physical domicile +Province of the physical domicile +Country of the physical domicile

"address":{
+    "street_address":"503,Washington Avenue",
+    "postal_code":"12401",
+    "locality":"Kingston",
+    "region":"New york",
+    "country_code":"US"
+}
+
+
+
+
+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/authorization_endpoint.html b/en/authorization_endpoint.html new file mode 100644 index 00000000..ed3a6e91 --- /dev/null +++ b/en/authorization_endpoint.html @@ -0,0 +1,1762 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Authorization endpoint + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

Authorization endpoint

+
+

Request

+

The Authorization request is initiated by the user that selects the OP for the authentication. +The RP redirects the user to the Authorization Endpoint of the selected OP, including in the request the parameter request that is a signed JWT containing the Authorization Request.

+

For conveying the request, the RP MAY use the methods POST and GET. With the method POST the parameters MUST be sent using the Form Serialization. +With the method GET the parameters MUST be sent using the Query String Serialization. For more details see OpenID.Core#Serializations.

+
+

Warning

+

The parameter scope MUST be sent both as a parameter in the HTTP request, and inside the request object. The two values MUST be the same.

+

cieid-icon +The parameters client_id and response_type SHOULD be sent both as parameters in the HTTP request, and inside the request object.

+

spid-icon +The parameters client_id and response_type MUST be sent both as parameters in the HTTP request, and inside the request object +and MUST be the same, in case of mismatching the values inside the request object MUST be considered.

+
+ +

In the following the mandatory parameters in the HTTP authentication request.

+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

Claim

Description

Supported by

scope

It contains values of scope that are supported by the OP and defined by the parameter +scopes_supported in the Metadata OP. +At least the value openid MUST be present.

spid-icon cieid-icon

code_challenge

See RFC 7636#section-4.2.

spid-icon cieid-icon

code_challenge_method

As defined by the parameter code_challenge_methods_supported in the Metadata OP.

spid-icon cieid-icon

request

See OpenID.Core#JWTRequests. It MUST be a signed JWT.

spid-icon cieid-icon

+

In the following, a table that reports the composition of the JWT header.

+ +++++ + + + + + + + + + + + + + + + + +

Jose Header

Description

Supported by

alg

See RFC 7516#section-4.1.1. See Cryptographic algorithms.

spid-icon cieid-icon

kid

See RFC 7638#section_3.

spid-icon cieid-icon

+
+

Note

+

The parameter typ, if omitted, assumes the implicit value JWT.

+
+

The JWT payload contains the following mandatory claims:

+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Claim

Description

Supported by

client_id

See OpenID.Registration. It MUST contain an HTTPS URL that uniquely identifies the RP.

spid-icon cieid-icon

code_challenge

As defined in the Table of the HTTP parameters.

spid-icon cieid-icon

code_challenge_method

As defined in the Table of the HTTP parameters.

spid-icon cieid-icon

nonce

See OpenID.Core#AuthRequest. It MUST be a casual string with at least 32 alphanumeric characters. +This value will be returned in the ID Token provided by the Token Endpoint, so that the client can test that it is equals as in the authentication request.

spid-icon cieid-icon

prompt

See OpenID.Core#AuthRequest. The allowed values are:

+

consent: If a Single Sign On session is not yet active, +the OP makes an Authentication Request to the user. +Then it asks permission to transfer the claims.

+

consent login: The OP forces an authentication request to the user. +Then it asks permission to transfer the claims.

+

spid-icon cieid-icon

redirect_uri

See OpenID.Core#AuthRequest. It MUST be an URL included in the Metadata RP.

spid-icon cieid-icon

response_type

See OpenID.Core#AuthRequest. As defined by the parameter response_types_supported in the +Metadata OP.

spid-icon cieid-icon

scope

As defined in the Table of the HTTP parameters.

spid-icon cieid-icon

acr_values

See OpenID.Core#AuthRequest. As defined by the parameter acr_values_supported in the +Metadata OP. +Reference values of the contest class of the Authentication Request. +It MUST be a string with the requested "acr" values, each of them separated by a single space, appearing in order of preference. The OP MAY use an authentication at a higher level than requested. Such a choice MUST NOT cause a negative result of the request.

spid-icon cieid-icon

claims

See OpenID.Core#ClaimsRequestParameter. See Section "Parameters scope and claims".

spid-icon cieid-icon

state

See OpenID.Core#AuthRequest. It must be a casual string with at least 32 alphanumeric characters. +Unique session identifier at the RP side. This value will be returned to the client in the response, at the end of the authentication.

spid-icon cieid-icon

exp

UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519

spid-icon cieid-icon

iat

UNIX Timestamp with the generation time of the JWT, coded as NumericDate as indicated in RFC 7519

spid-icon cieid-icon

iss

It MUST correspond to client_id.

spid-icon cieid-icon

aud

It MUST correspond to the OP identifier (parameter issuer, present in the Metadata OP.)

spid-icon cieid-icon

ui_locales

OPTIONAL. End-User's preferred languages and scripts for the user interface. Represented as a space-separated list of BCP47 [RFC5646].

spid-icon cieid-icon

+
+

Note

+

PKCE is an extension of the protocol OAuth 2.0 also provided in the profile iGov (International Government Assurance Profile for OAuth 2.0) and aimed at avoiding possible attacks from intercepting the authorization code. It consists of the generation of a code (code verifier) and its hash (code challenge). The code challenge is sent to the OP in the authentication request.

+

When the RP contacts the Token Endpoint at the end of the authentication flow, it sends the code verifier created initially, so that the OP can check if its hash is the same as in the authentication request.

+

An example of a Python script for generating the requested parameters is shown.

+
import hashlib
+import base64
+import re
+import os
+import random
+def get_pkce(code_challenge_method: str = "S256", code_challenge_length: int = 64):
+    hashers = {"S256": hashlib.sha256}
+    code_verifier_length = random.randint(43, 128)
+    code_verifier = base64.urlsafe_b64encode(os.urandom(code_verifier_length)).decode("utf-8")
+    code_verifier = re.sub("[^a-zA-Z0-9]+", "", code_verifier)
+
+    code_challenge = hashers.get(code_challenge_method)(
+        code_verifier.encode("utf-8")
+    ).digest()
+    code_challenge = base64.urlsafe_b64encode(code_challenge).decode("utf-8")
+    code_challenge = code_challenge.replace("=", "")
+
+    return {
+        "code_verifier": code_verifier,
+        "code_challenge": code_challenge,
+        "code_challenge_method": code_challenge_method,
+    }
+
+
+
+
+

Parameters scope and claims

+
+

spid-icon

+

The attributes of the user MAY be requested by the RP using the claims parameter in the Authorization Request.

+

SPID doesn't allow the user attributes in ID Token, they are only available at the "userinfo" endpoint.

+
+
+

cieid-icon

+

The user attributes MAY be requested by the RP using the scope or claims parameters in the Authorization Request.

+

When the scope parameter is used, the following values are supported:

+
    +
  • profile: requests the user attributes equivalent to the eIDAS Minimum Dataset:

    +
    +
      +
    • family_name,

    • +
    • given_name,

    • +
    • birthdate,

    • +
    • https://attributes.eid.gov.it/fiscal_number (National Unique Identifier).

    • +
    +
    +
  • +
  • email: requests the following attributes:

    +
    +
      +
    • email;

    • +
    • email_verified.

    • +
    +
    +
  • +
+

The parameter scope MAY contain one or more values, with single spaces as separators. For example, using both profile and email in the scope parameter returns the Minimum eIDAS Dataset and the email. +In case of requests of single user-attributes or specific combinations of them, the RP SHOULD use the parameter claims.

+

The attributes requested by the parameter scope are available both in the ID Token and in the userinfo endpoint response.

+
+

Warning

+

If in the scope parameter there was only the openid value and the claims parameter was not present or valued, the response of the userinfo endpoint would not have any user attributes but only the claim sub.

+
+
+

For the definition of the parameter claims and its usage modes for requesting the user attributes, please refer to OpenID.Core#ClaimsParameter.

+
+
+
+

Response

+

An Authentication response is returned by the authorization endpoint of the OpenID Provider (OP) at the end of the authentication flow. The OP redirects the user +to the URL contained in the parameter redirect_uri specified in the authorization request, adding the response parameters.

+ +

If the authentication is successful the OpenID Provider (OP) redirects the user by adding the following parameters required as query parameters to the redirect_uri (as defined in OpenID.Core#AuthResponse):

+ +++++ + + + + + + + + + + + + + + + + + + + + +

Claim

Description

Supported by

code

Unique Authorization Code that the client can pass to the Token Endpoint for obtaining an ID Token and an Access Token. This has the advantage of not exposing any token to the User Agent or to malware that could be controlling it.

spid-icon cieid-icon

state

State value included in the Authentication Request. The client is supposed to check its correspondence. It must have the same value indicated by the client in the Authorization Request.

spid-icon cieid-icon

iss

Unique Identifier of the OP that has created the Authentication Response. The RP MUST validate +this parameter and MUST NOT allow more OPs to use the same identifier.

cieid-icon

+

Authorization Response example:

+
+
http://rp-test.it/oidc/rp/callback/?code=a032faf23d986353019ff8eda96cadce2ea1c368f04bf4c5e1759d559dda1c08056c7c4d4e8058cb002a0c8fa9a920272350aa102548523a8aff4ccdb44cb3fa&state=2Ujz3tbBHWQEL4XPFSJ5ANSjkhd7IlfC&iss=http%3A%2F%2Fop-test%2Foidc%2Fop%2F
+
+
+
+
+
+

Error Management

+

In the event of an error, the OP or RP represent the anomaly message +as described in the related tables defined by the Linee Guida UX SPID.

+ +++++ + + + + + + + + + + + + + + + + + + + + +

Claim

Description

Supported by

error

See Error codes

spid-icon cieid-icon

error_description

Error description.

spid-icon cieid-icon

state

It MUST be equal to the status value included in the Authentication Request. The RP MUST verify that it matches the one sent in the Authentication Request.

spid-icon cieid-icon

+
+

Error Codes

+ ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Error Code

Description

HTTP Code

Supported by

access_denied

The OP denied access due to invalid or unsuitable credentials for the required SPID level (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

unauthorized_client

The client is not authorized to request an authorization code (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

invalid_request

The request is not valid due to the lack or incorrectness of one or more parameters (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

invalid_scope

Invalid scopes in the Authorization request (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

server_error

The OP encountered an internal problem (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

temporarily_unavailable

The OP encountered a temporary internal problem (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

unsupported_response_type

The OP does not support the requested response_type. (RFC 6749#section-4.1.2.1).

302 Found

spid-icon cieid-icon

login_required

The OP requires End-User authentication (OpenID.Core#AuthError).

302 Found

spid-icon cieid-icon

consent_required

The OP requires End-User consent (OpenID.Core#AuthError).

302 Found

spid-icon cieid-icon

request_uri_not_supported

The OP does not support use of the request_uri parameter (OpenID.Core#AuthError).

302 Found

spid-icon cieid-icon

registration_not_supported

The OP does not support use of the registration parameter (OpenID.Core#AuthError).

302 Found

spid-icon cieid-icon

invalid_request_object

The request parameter contains an invalid Request Object (OpenID.Core#AuthError).

302 Found

spid-icon cieid-icon

+
+

Warning

+

In case of invalid, mismatching, or missing redirection URI, the OP will return 400 Bad Request as the HTTP code.

+
+
+
+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/avvisi_spid.html b/en/avvisi_spid.html new file mode 100644 index 00000000..51d16723 --- /dev/null +++ b/en/avvisi_spid.html @@ -0,0 +1,1384 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | SPID regulatory references + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + +
+

SPID regulatory references

+

The SPID System start-up, for its nature and complexity, can require interventions on different aspects +with specifyings, clarifications, information notes and case studies, in order to provide support for a better +application and understanding of the SPID Regulations, already issued by AgID in compliancy to what prescribed +by the art. 4 of the DPCM 24 October 2014.

+

In order to organically gather such interventions and attribute them a character that involve application commitment by the involved actors in the SPID System, be they public or private, the present section "SPID Announcements" has been created, aimed at ensuring a uniform interpretation of the rules, the technical +aspects and what else might be necessary for the correct System operation as a whole.

+

The present technical rules implement the following SPID announcements:

+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Announcement

Reference

Date

LL.GG. OpenID Connect in SPID

LL.GG. OpenID Connect in SPID

24/11/2021

Avviso n.41

Avviso n.41 v2 - Integrazione LL.GG. OpenID Connect in SPID.pdf

06/05/2022

Tabella Attributi utente v1.3

Tabella Attributi in SPID - Integrazione LL.GG. OpenID Connect in SPID.pdf

24/06/2022

Determina SPID OpenID Connect Federation

Regole tecniche per il funzionamento della Federazione SPID OpenID Connect - Integrazione LL.GG. OpenID Connect in SPID.pdf -

14/09/2022

Linee Guida Attribute Authority SPID

SPID Attribute Authority Guidelines

18/07/2022

+
+ + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/come_contribuire.html b/en/come_contribuire.html new file mode 100644 index 00000000..570c85d0 --- /dev/null +++ b/en/come_contribuire.html @@ -0,0 +1,1350 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | How to contribute + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

How to contribute

+

If you want to contribute, please click the GitHub icon on the upper right corner by the label "Source", and access the public repository.

+

Should you find some mistake, or wish you clarify something, or even simply notify something, with the aim of improving this documentation, please open a new Issue.

+

After opening the Issue and receiving returns from the Italian Community of Developers, you will be able to open a new Pull Request containing the modification or correction that you propose.

+
+ + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/confronto_oidc_cie_e_oidc_igov.html b/en/confronto_oidc_cie_e_oidc_igov.html new file mode 100644 index 00000000..1b709aca --- /dev/null +++ b/en/confronto_oidc_cie_e_oidc_igov.html @@ -0,0 +1,1374 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Differences with OIDC iGov + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

Differences with OIDC iGov

+

CIE OpenID Connect and SPID OpenID Connect are based on iGov.OIDC with the following differences:

+
+
    +
  • Section 2.1 of iGov shows vtr, acr_values and PKCE as OPTIONAL, in both SPID and CIE id PKCE and acr_values are REQUIRED. In the both SPID and CIE implementation the acr_values has been adopted instead of vtr.

  • +
  • The Authentication response in the Auth code flow of CIE mandates the usage of the iss claim parameter to avoid the mix-up attack I-D.ietf-OAuth-Security-BCP. The usage of this parameter is OPTIONAL in SPID.

  • +
  • Section 2.4 of iGov states "RPs MAY optionally send requests to the Authorization endpoint using request parameter." In both SPID and CIE id the usage of request parameter is REQUIRED.

  • +
  • Section 3.1 of iGov states " in the case of using vtr in the authentication request the ID Token MUST contain the following REQUIRED claims, namely: vot and vtm ". As vtr is not used in both SPID and CIE id, thus the aforementioned claims are not included within the ID Token.

  • +
  • Section 3.1 of iGov states "the auth-time claim in ID Token is RECOMMENDED". The SPID and CIE id do not adopt this claim in the ID Token.

  • +
  • ID Token in both SPID and CIE id MUST have the acr claim as REQUIRED, while this is optional in the OpenID iGov specs .

  • +
  • ID Token in both SPID and CIE id has the requirement of the at_hash claim as mandatory, this is OPTIONAL in OIDC-CORE and not present in iGov.

  • +
  • In both SPID and CIE id the subject identifier MUST be pairwised.

  • +
  • The UserInfo response in both SPID and CIE id MUST be a Nested JWT, signed with the private key of the issuer and encrypted with the public key of the RP.

  • +
  • The signed JWT of the UserInfo response MUST have the claims iss, sub, aud, iat and exp.

  • +
  • Section 3.4 of iGov states "OpenID Providers MAY accept request object by reference using the request_uri parameter". This parameter is interchangeable with the request parameter. SPID and CIE id only adopts the usage of request parameter.

  • +
  • Section 3.8. Dynamic Registration of iGOV specifies that dynamic client registration is mandatory. In both CIE id and SPID the OIDC Federation automatic client registration is REQUIRED and the OIDC Dynamic client registration SHOULD NOT be supported.

  • +
  • Section 4.2 of iGOV the scopes openid, offline_access, profile and email are used in CIE id OpenID Connect and they do not consider the other recommended scopes in the iGov profile, namely: doc.

  • +
  • Section 4.2 of iGOV the scopes openid, offline_access are used in SPID OpenID Connect and they do not consider the other recommended scopes in the iGov profile, namely: doc.

  • +
  • Section 4.3 of iGov defines the policy regarding the userinfo object of claim request parameter. In CIE id, we define the policy both for the userinfo and ID Token object.

  • +
  • Sections 3.7 and 2.5 of iGOV : both SPID and CIE id OP metadata are distributed according to the modalities defined in Section "3. Metadata".

  • +
  • The Access token is a signed jwt in compliance to RFC 9068

  • +
+
+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/cryptographic_algos.html b/en/cryptographic_algos.html new file mode 100644 index 00000000..3b682103 --- /dev/null +++ b/en/cryptographic_algos.html @@ -0,0 +1,1503 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Cryptographic algorithms + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

Cryptographic algorithms

+

All the participants MUST expose the supported +signature and encryption algorithms in their metadata. They are used for all encryption and signature operations required by OIDC core and Federation.

+
+

Note

+

The length of the RSA keys must be equal to or greater than 2048 bits. +A length of 4096 bits is recommended.

+
+

In the SPID and CIE id the following algorithms MUST be supported:

+ ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Algorithm

Operations

References

Applicable to

RS256

Signature

OpenID.Core and RFC7518.

spid-icon cieid-icon

RS512

Signature

RFC7518

spid-icon cieid-icon

RSA-OAEP

Key Encryption

RFC7518.

spid-icon cieid-icon

RSA-OAEP-256

Key Encryption

RFC7516.

spid-icon cieid-icon

A128CBC-HS256

Content Encryption

RFC7516.

spid-icon cieid-icon

A256CBC-HS512

Content Encryption

RFC7516.

spid-icon cieid-icon

+

In the SPID and CIE id the following algorithms are RECOMMENDED to be supported:

+ ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Algorithm

Operations

References

Applicable to

ES256

Signature

OpenID.Core and RFC7518.

spid-icon cieid-icon

ES512

Signature

RFC7518.

spid-icon cieid-icon

PS256

Signature

RFC7518.

spid-icon cieid-icon

PS512

Signature

RFC7518.

spid-icon cieid-icon

ECDH-ES

Key Encryption

RFC7518.

cieid-icon

ECDH-ES+A128KW

Key Encryption

RFC7518.

cieid-icon

ECDH-ES+A256KW

Key Encryption

RFC7518.

cieid-icon

+

In the SPID and CIE id the following algorithms MUST NOT be supported:

+ ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Algorithm

Operations

References

Applicable to

none

Signature

RFC7518.

spid-icon cieid-icon

RSA_1_5

Key Encryption

RFC7516.

spid-icon cieid-icon

HS256

Signature

RFC7518.

spid-icon cieid-icon

HS384

Signature

RFC7518.

spid-icon cieid-icon

HS512

Signature

RFC7518.

spid-icon cieid-icon

+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/differenze_oidc_fed.html b/en/differenze_oidc_fed.html new file mode 100644 index 00000000..fac366a9 --- /dev/null +++ b/en/differenze_oidc_fed.html @@ -0,0 +1,1365 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Differences with OIDC Federation + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

Differences with OIDC Federation

+

This section lists the differences between the official standard and the SPID / CIE implementation.

+
+

Client Registration

+

SPID and CIE support only automatic_client_registration. The explicit client registration flow is not supported.

+
+
+

Trust Mark

+

In OIDC Federation international specifications the adoption of the Trust Marks is not mandatory. Rather, in the SPID and CIE Federation it is mandatory to expose them. For more details about the reasons why the Trust Marks are required, please see the section Security Considerations.

+
+
+

Unsupported Claims in the Entity Statements

+

Since SPID and CIE don't need any additional claim of the Federation scope, they don't need the claim crit. Likewise, the claims aud, naming_constraints, policy_language_crit and trust_anchor_id are not supported. Any possible presence of these claims does not have implications, they are simply ignored until possible future communications about their regulation.

+
+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/differenze_spid_cie.html b/en/differenze_spid_cie.html new file mode 100644 index 00000000..cecb630e --- /dev/null +++ b/en/differenze_spid_cie.html @@ -0,0 +1,1399 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Differences between SPID e CIE id + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

Differences between SPID e CIE id

+

This section provides the main differences between SPID and CIE id.

+
+

Metadata

+

CIE id allows th ID Token encryption, the OP and RP metadata include the parameters that enable this feature (see section Metadata OP and Metadata RP).

+

SPID does not allow the ID Token encryption.

+

Moreover, CIE id requires the parameter revocation_endpoint_auth_methods_supported to be included in the OP metadata, while SPID does not.

+
+
+

Authorization Endpoint

+

SPID requires the parameters client_id and response_type in the HTTP request as mandatory, while in CIE id they are recommended.

+

Moreover, in CIE id the response requires the presence of the iss parameter as mitigation against the mix-up attacks I-D.ietf-OAuth-Security-BCP. SPID does not require it.

+
+
+

Parameters Scope and Claims

+

CIE id allows an RP to request user attributes using both the claims parameter and the scope parameter, enabling in the scope parameter the values profile and email.

+

SPID does not allow profile and email values in the scope parameter.

+

For further details see section Parameters Scope and claims.

+
+
+

ID Token

+

In SPID the user attributes are not available in the ID Token.

+

In CIE id the user attributes are available in both ID Token and UserInfo response. +Moreover, CIE id allows the ID Token encryption.

+
+
+

Refresh Token

+

SPID allows the Refresh Token to enable the revocable long sessions as defined in LL.GG. OpenID Connect in SPID e nell' Avviso n.41 . Whith a Refresh Token an RP can obtain an ID Token which only contains the value https://www.spid.gov.it/SpidL1 in the acr parameter.

+

In CIE id the Refresh Token does not allow to obtain an ID Token. Thus, an RP can not obtain a new user authentication with the OP or renewing a pre-existing one. The Refresh Token in CIE id may be used to obtain from the UserInfo endpoint the same set of user attributes requested at the initial authentication phase, for which the user has given explicit consent.

+

For further details see section Refresh Token.

+
+
+

UserInfo Endpoint

+

CIE id supports both GET and POST HTTP methods.

+

SPID only allows the HTTP GET method.

+
+
+

Introspection Endpoint

+

In CIE id, only the parameter active is given in the introspection response.

+

SPID includes additional parameters as defined in section Introspection Endpoint.

+
+
+

Revocation Endpoint and Logout

+

SPID and CIE id require the RP to request an Access Token revocation during the user logout. +In SPID the Access Token revocation implies the Refresh Token revocation, if any or still active, and the end of the Single Sign-On session if still active.

+

In CIE id the Access Token revocation does not imply the Refresh Token revocation, if any. +In CIE id the Refresh Token revocation requires all related active token to be revoked.

+
+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/diventa_fornitore.html b/en/diventa_fornitore.html new file mode 100644 index 00000000..16981d25 --- /dev/null +++ b/en/diventa_fornitore.html @@ -0,0 +1,1359 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Become a service provider + + + + + + + + + + + + + + + + + + + + + +
+ + +
+
+
+ +
+
+

+ + Docs Italia + + beta + + +

+

Public documents, made digital.

+
+
+ +
+
+
+
+ +
+ + +
+ +
+
+ +
+
+
+
+ + + + + +
+
+ + +
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+ + + + + +
+

Become a service provider

+

Official links of the SPID and CIE onboarding systems.

+
+
+
+ + + + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/doctrees/attributi_utente.doctree b/en/doctrees/attributi_utente.doctree new file mode 100644 index 0000000000000000000000000000000000000000..8b62e4e20adf4f853b5ba808fec90a97bfd1a972 GIT binary patch literal 101388 zcmeHw37j0~Ri|v-qr;MH%ctzp$j4}+?m2ahZP~I8XROnbd?rq-rn_dkT0PyJu5OJ+ zu^}N>J2WJ5I$2US(DCX6Zs&&*e(xoME+^t8(RReby+| zT5oG@e@*M@)MuC4E-ht;*Fa?vE)wd#-9sbDGr` zW{VS6MJHBQRjP(%RL>i&dUIt>pP?^W`M&(-{L<#?i~|#Xt&r&SiOIA!}&Y&1NrSoRv?2N^^gpjS58%1y3B??8T5RzG=E2a zDY$-#&?|8E5OJ2x8`*OyGg~e_rJ1w(i~%0g=^^~jzpSA{vOq*#xY&3=9Qy6Tg|2Q zs@ZA|s&ht}>7|^R(}h+yuNZ9QUttld#~^@78`-`vLFAtZl>#eon-orx6zV0H@lK_2uc1pOf_0k`T{GAcV2McfIGf%hjdj3@o(s>){b)iVl zg(AI<%tRZ~cN5Z9#mvR2JG~zZqB<^B+eLLpD5?=(D}lJ$A1a?ZXag zKWd|Pbtr1@4@K?jP}E*UsLkosl3AKb!RJ{pswuMu2Vzu;@NF=#XX>?@sm&Bk4L)wR zVrnqIHKPPKq?sk{m370a>6-L$`b9V=L$k`IvX;}404Z}u)uOLv4Xsoz;U75+^SmiQ z+t_@3@k(%<*mGe{thuS3^KhTEITXBV7Nx_h zmNzXII`ZopLKSV+&`UL~R@SB%v6Mv2=(C;H#^&+fX54asdR`4Egmj@=cAW>P)y)+( zy*gvK@ge;9BrwaIm^^qOb@plc-~TT4wF z&?0C}xs)2o45vk`LBXJOvdvXxGnb`wAj}R@e9xSK1pyrU*Si){Ho4Z%Aimim`K20( zfaSA}C)2%*ZaZ}{Gi%gzIB0!AOm904Gzf+9^oZZ+G_R2Wq^cEEWl@+14Cno}YQ-VO zm16$O%?B2Mh>tLd&MlGX%=pkb>_|6rsDu!AzE>FS3Se}jgONv}&^ADk9;BR9+uT$c zCzY*8y~Ar)OX78FBwl&K>*xci{rg>L=H}+o`V4B#O!<7;M8z=?{SBcJq1TJGp=lH5 zW(bz3jOXR*d`3Jd7H4KMP7^4j*K7H56>Sc~Lba;orUQU2FV3WN-Ghzuz=h#SsWyv4 zkOW7I1V`8uSdhts=>z4e;X;&TRDRJIto6aja0)@L*s+PSe-E3baQe(Q&zw z$*qx0PIHZMncQ}usGGCaNxh23Cc^8^nP!fI*#zW&lLvtmTF597t!YuB2N63NBeJbM znX4;@Iz=d)NC{VeBwV>5T&InysTa+Q>_n_?(emdK0P99CSm+P%l;^?9P9?BvOXWg! zusf&%6iTGFMI!ZzAW{!LdgheDab4Fid9ny#be$KY!d$Itm*fG+P9gyECvnl)-yJ$$ z!Xz}esYA0L=F-NdTMhDL5eE$!W*eI*X#7bQ42_pC3C-=1(98z4MwlZToJF=u{az&! z=ElY<%sAPpy~ZgdwToYmZPXo+7@iGcC`4dY&;i(m6BDM=n@2#wuJ^(wv`3WX(J(uW z04tEjh3Nk7YM+lbsbhCW;?r)!>r(~9zmo^g%vX%AjnipgE&+`EHe94cmm!tsLCJ5! zgQ;Acy0zhc3MEnlkw~@K@B`?g2TbL2MyXpv<;fy|k6k~{$UY`8y(i%yp| z+)J2*W_u(wm0%@1P&5(ClPXe3pXGRy4Yo=-2|fB`ze{`HxkyZ?BH?`Q(jfUx zNAm3rDGy2}ww>sv=d8W_Z6~Yc^CmhGr9uW&=;k0Osd8v9nw`!CXj?g=H|RIm%I&od}Qg_DV(cy0Xo})vA zNp!|KMyE$LYh0mbjmOt4ptA@yi!znyjCYLA&R*%x&cvEEp4u5#vw#l0@3GyXOeH!y zJ4R<$uh0n&>^N4}vC8AAT?y#W`<|oY4(9CY5S^X9vOCBqQFnGG*d5BF=jc$TQg?Po zqGNC%V~-F!j(BIfXI_i53Lv!E85oq7d1uP+xttWzuct&lUX&(Pqnx;qLu4y)+S3J2 zJ+jb5NHF?wP;lxQ;pB~foD@Es{C2u$IJuU3ZzN7nhU!y~EK$%7ZEDjauN89MI@tJa zkaEv+oc_2LXd)7m(5N}JyH^$n83pQByM5lBV1XzPZ{6xi)J&PmnsrwsI^h-w-}Vrn zHiVpd5&C;TVeYn(YZ*G&*_ts2epSE(;ld!_mkF>c*ad>!WK==mNUra zDm38|Q+8`Z^-8g<=d7X8;n9(y;oUu(bNf6`}O4k^gtw_{RHU#nIMARDUE^Jw~XF-7?r$c`!TP;I}Az4@w5x+HOBNW1ln7-z`X zJ>?m*lp*m@o!M5wOeCcol3;k4Bo7RnqMc}@aDh1&1>3`zQagH0 z&(9CzGCUII1=biPr)&?Hfyb`SX1qGP801MkeIOFD2T4y49!njVJmgo(8U5l#ENj#2 z)6-@a6Fm)@feqk>%p82?$j+gW(V?;7p^=^YhxhIo-aBN?1giCl+-wSKd^|X~Ph1H0 zc_HYcOv&L(BRM=u93I#oaAT20&D6o(@XjIpKeB6R1YBC>p}k|^Z>W9t_|mNIHP`k} zm%9T>+$9t#S)7byk!NZgJeoRv=-A1llZPh{?0;hN#PP{a1UfoA1R;)$gZT%BheyUj z1iC3#gl)zu9}^nE>!3`JaKqoaP;?;ZP+BAk4@RQE6UYxu9^8N0W!$J&Q$^!K8h^_b z9e;+3#*AKcqQFDPht529X6Rlln7If4FkAWj?PL2-JeWS3NkhvqRI+n7Oh9^gc=s6n zJ#_qmfSNDIx}<6>Kr7^2fwtMJmDPsdc`GmkBglfz9iC z+m?vkOQ4{ z<$9M?l@3dh(mx)_2+ut+AHXssszEM0BGzqR)n{VG66V*?l0RpKAFaX}9t-1ZwMZV2 zEImxy;&ypVocEVhv}E=~B(uEQh?wm)pUa3gj{xQGMd0paBzKRKPM#2x&)_SPd6YAP z#?ksm#{pK-rLd1iy{ebcJ3vC6JQym~K3o294<4TFr)lxj^!z6Nuy_IsA^<~&ZJHqI*>Y)Mw%1?h2fEr)FfI7 z0k)SJc<qCLmm8bVUuug5~bK0KDGj8QLyg(hA|kKI~)RZd}9KPB~X=YQ^U=a}AZ36NYr z9Le=5;`+fyJywYpRAb(C_MB05-6p6Wq7~v^=UFIQMyh~)2~u;$R7x+-(5lz`tQFA6 zrG+`KIkJDcOgeUG;RQ=}ABkj_-6~eBxmHKHR1qsU{EFonewzc{Y97JbKV4Rx!RUn* zD%pHAl1*Exo}gQ~M88yxQnor@q2=-IQuQ{p!K#1V?n0&NDOj@mSR}hggc2X=LaKgt z&ly2C0>;kyMM^(ikvhw^x&)X?lng!|$spUN2Osq`GrKI#GO?3Zt&XY0ZJO(CQG#pw z>9YA!X=fK)u4ML!NM^;fYg#vwI(V{tvJ0V#s+y}{zWK;-fYUzrrAMy*r!L=4AA&O9 zZuV5RyNx2f<8c$J{5>XowhnagrVH8-9F z$^FYCxi{JArVg^FNeLKE8(DOWAn3jSfJgZ30%a>suVNd#^TtqEYYwx`#OJkg#mri% zk-cFppqtDT_JMNSfX-J_*@{OmD4C#5;1@{dqUKbP1=A@(domKVF#_$>;RCyOj_h%3 z2NhhM&ZdkUZBD@v7k&=mAEgV_f|c^IJD0)p$YtveS??2amqfopg=o)2vDj>bGr?>M zz0}c!78WdEgIeRQms0Vzu3t!OygGK6H4jP zF3%&Edc;{`10U8Tg<>T3XCv9*txf`(Y+6=|dp}?~Dt;|;I!ofJneY45aOeg?HwP-2 z?;8&el+Ihrg6Ujv4*S4SF$cc996BXtdL(Atw=24e=IfRr`-)(3Yep`GKu;C3@UK(D zyTX*@=C~5Qh$Ww_K2TjuuX2w zV`i{JDW+NQMxea^=SrA!j&0>`tNG>m734PuusP^*bi81M(tXvu>S2(o$?ULton7q4 z_UCfzufkKymMjU|{Y#<%SPK`CCcn8bM}M$IXa3GYjc&2gC)2o^_FtH(>Xp2gly{xM z4rtTmVzE4jZRRxefzZf$zC35~-e^TEoz=?I8e!`pShMPtO1TOJ)~4opriF$k`B1s4 zVK6SOQJ&{@?6E?bojrTo$y0|8Pd?@>cXb(0V+6vU;BxjXZOuk|wU%n4Y~I_IHgQce zJ_GrUO?}a+b#_}TG#PTpZzVc~u)$f;3)^;OuB2>lS3#+*Z^Xh!tCx!3zFx6Z=ILLdq3}Vk%vAyyNEM>=>6VG>r zzr+`|0a?zeT_yTkyh<_~e@&lnE_@k(Lbt56JwUr!tjAX`D17y&qJTf)q=i4jAHUH2 zEMGM^c+jx2Rg*glY{mP@t3GGey0Kpelvi*T?@AU&XQ1$TkE+y(fX_*ctGtWb@k4 z45aPf*p|5~vW&XOUdG_V&R?Oq-_t{DDnH`Xsc~rw#LnT4-G605LC$vJ`Tb4L2I_5l zh8L(rdr#zz%}rW6K2DK>ws;lr>)1x<*kjCQyf)Z6_An<65$}NCsMIHU{EH@kP?&}_ z@Hr!`oyKPKr5O>fhygNR0u39$Vz>+)T_ViE#xPpWoH1*9QIq3oTE*VFpbznnHd{xu zgpFbAB@=tJiLeFYx=f`zVt8AE>|uv`H|bLx?!BqaCMjY{n;Y zsCs9|R9zcE)%e-7cZUdgpLUOSHzb{z%$?kKw~$GuRG*zPs{78K<+@pTyT@1*J`9TN z$}`+)hHi!Y83n%V!0m$!alEGc>j(Dm4He9aNAm{ulaK~S{&c|p4F#h7CEehZ1Y^5q zs#wmR%e=B)uK5}=e?BD^ocq8ra@Vg&4*UH^ zPKzjQ;OyD{wwSGdqJRJW2M&&mj*ai!wR_Lr{r#a{WB^pyUgS2FOk9iy73jA;#~n!8 zS+fP(@!G(~iz6wr^4HHbo^vpS<~t`_5*ZGZ$YIl62Z{@2~gRdz|^@9_b^(qx@o9|F02bLF@k|f?ga- z=IhGOww^5fnS!u=Vv8?e z;Xdh(!NF;L)-29-$uCr8S-%5%ggWie6j_2lewos>ngPRK*LxFE(r} zSa>V4OKN@k#1>z`!X4E1!9hL}FH@e*OqtbMzN3cIruMI;n_BPB)~y?JrJf9E}iobW$0x-C?Lk zOhO|_xaHE|V1EMFG(ah3%|nbnr4JR{t`Nat7)6#S#kN8`aD}!{U1(GU3vJ&5>37f- zM0bKNwgwDE*X|ldv@D5{W8N72-xVMQo#1fgo2ai@G&x}V%0Y@?WW45fFC2C!7$bP0NuazD3(du`H1C36aq=?FDxoGRR4+?mbPN*dFY6Rrp6?P<$<>o6)P~7;Xed*Z^QOHM}=9 zIv(DkbsTKifz$O-AG+wAOkkP<9J?>;D3T_*N5476_A53^@jxV*(-&7P^b|oBjD?DX zdRQz(FD^wa^!-7qC>C<5iWh)iY}jh0U?RIDVf(}uU%H!>@ib# zH?tX!h%Njd=cLIYkp2J*&y9T^(TjD&F0>7%9Z_}vPcv{gTLa0(U2(1j!JZ7cWqx7!(EW~uZu$7#=ial>|Kzy zzOP5&i4VC@SFbG1t-YtIlRAcNiVA-Mi3K}Huca9lTu6 zO(d}Caqhd2G|Ark4Fz^bv6+ZxJ;_kKxSabmK^AoGj}Y8p&YfOd3g>wgiOo-{ z>kZO{w3X@lky{D*gt2nFIe8P3woTTfhf02AB%vT>KSCuse&hysT{BHf>&MEi*XBZ& zlNM(1$MMW7_X|a5)8*&pHT0DjT6a=8#J(0UlgyW2I3_6gZl<7XV%NUZ#8x_*ScM!y z@ejBZ`;$6k|4_$d7eMwq7Do2cCnisZQ2RlbT2A2*`QeUvrA zUUS718>UwCiWE-_(UG@1F@);0uwj1Qj?(b0y!okX+()nkyX1!Pu=A$OJRnKoOU2GF0ZBZ13vbE{yG@U2)56qPdpC}b2D)yD z%tV@mYh~NTSBTqgc}0TudHTPeUKU-VF^-BL*?NV(lYB|7bv*#0j;Tf89sLCr;I z%A?F?d{ARoo->>@xxwq-5?%&{E6Y= zM~8=T9eyHwn#zYjlidgz?L14@Z2hzXZ}tS14={Z3_1SL)UgN+JZ#$B#fZv5)?#aAg zAjpCa^>;}gVPjnM;!=!p{X>u{8sl=QiWh)iY_G+azlH1+-Mlc~@dYg0&F^tNwCpSQ z8OV;@J!ZqmY8a83G`Cw~)4BC%{W=nJeC4paE&GtPt=p0wD!G3xp&(`VPbE4U8|(fB zZSey3YtZYUK`WWfctq@qzl@V6yZ;wL-9H~-_?_bXrQZF&z^dcU?@!R_c6a`IDA>J1 zYkcnfhO=iwqo>emAg7Rl?L)5({mQN0XA~&3-Q-CoD_-yYwWSfkj7n@Wqd=Iyv^PbR zcDE-s2{nqCRMSa>GUuYZ$B9rn%-9vcyaJ!L0O}nJpy@yoZ{(89l|N3o^iBPD6G*|x z(ZvcRcu}_D|fZyBg_|s;=!lmLq9W!^d9}-WI`ziu=AEXk9)%q)mfIbFos^Rcaaw^B8{)x^A^uMe)A1%M$=Fp6JD=D6QgadG)mslW7 zkpOk(S8<*gy68oJy)&7}A-cn_9J+s@W4eFDrTbIZ=~YfedF<;~E?JV&u+2veGjPNv zA9C3b&O@SQKofl!gH36JS-4BxmJ87EaldZ3PTws#EL>FtNdanKsp zLSs&sIaM`kwem@$WML7t5lCp3%9FE|Ge&jR%$mrOa^8<0PBN^f#)(e)DH9-*RZF6DAe0PbYI2El5+BNiF&zp{vUpCXR6&&tj0>5(_#8XU(>5KNc8Ipip)qrSc~rk>mbC$m=GZNFsFFyATj< zuRx{Br*be&$~*YAaiL;Xv3n5-SKMnd3#yayGkcHx!W1S=$hsg;Uhz%U`q_l4(OJbn zYL#l?B#WyQNEB5i*qa6R|KAeJi1>m$mS zRS1Ijxd`4W5R5F;#qWM~{Prmz;n%`<1HTD{uVV1KA>Ls6EB5tKi9^uRU9>ib+hiA{ ztU5>;1$O-){UktonZj2-kfJSX;a}h$3*W?r0%8A@NwNyU#zucnU)e?dc8FCNfJ>4N zIW}%<*XqKXY{=<|O|Q>tGQ57Dg)>juis3Br?Nxy{uAtt=ImH`F+mlhDt|vPfh&tUY z1#$6s`33slfO3O#k0&G=<;Pxk#gZiex`U{f1L}@rUIb|rVJSqsUB$bK(QZevF2ZWn zNLMw^jgE3z;{rk1j!pz4G6?AV&xPnaHr9~RmTJC2JaARB0- zRngG|4fTg+ANqD=83K(SfTVxNOTZW)FUK)NS`+3Ol4lXWU$)e-q=C}v+4to!MBLHJvuT-~M~z~>eE zto+7@z6u-MQ5kH1g96%q-Tei(G~a@_PxL!&QhS)wSqDdbt(Yn2>mZbSbUPo3mAXi_ z|Mc+Q@tvb%d-lpSq7@*sqd|mz3Y3ucKzX)aGQ>hUdj7P%^S4wkS$mOmba-SeH9V3U z9+lb3L_#$^NybJz%ksYC_;Q?MD?#=hE)M)3j$%YBKXt9xqwkS}s($BkxmPy)5`hG= zeWzf)9}k@&YVWaF^x{&iZ1_ZwDq7j#QWY-%e|>%)U%nUFCG`vY#1>z`!Y56naZpSi z1B6ch8t={+y^l!9gozEoETrdI>&@A93}0c<#rtDBQuu3zi@G#4_j`J%G*RL|5(-kD zC_yDUTBtHnLXa3QJHK-LFDS=fFt_o**vj$eoHS&jguhNdb*wyPV#iGuL}1^pEO+B9g7A_=%FiNL8CaIGi0;QK1}xVN;Y2KYrDE;l6Fd9u|=~Ic0 z^h5WqRHo_fMWN}6z92k>w=Z*tyP9`)A~48nn}T@V5>F)XM4rf=dq+6cJ32)D)dav){p&CbCm>bwX_M z1uWdv?e_br%z2}VmDNVBn@NILvhOv4p1h>tHbWjjbEItr@d1qF%mV)c8$--X`1o4Jh##`c0g&Pfx!;LGnXm$CZ3BqprE!|~x8 zG^=YaZ(vMHoFs-#jH-89+N{rG)@P^i8nZF9DZ@Ypw#sNz^E{Y!;-qsl_2L%dG$sBt zL7HR?{g{3NnEpx6F7d=!mQ@axiQZ`dm zVn=35kQgsqzxMn-wC5J)HeTm!Gj$UuO*B)lJ8BEPZ3)tXLiGp{qZcM}Z3YGH_brqf zSBD;F(JE}zuXDm^OqF$jN_2D}G-Ow%skSIIc|&$Via%r@@hqqb)Xg}-L2fB$`HaeU zu8`iCz^5mSCxSZ*yA%~IN|$whqRD26*N$W@0GS1XEhJtvHYM_HUyq9e{w$DmBp)lg$n ze#by3ip9$WBDp>)i3|OB0`(qqPh@mv?mq*KUdmrZi_By06*c;D_uA+Lnb-7h0Gkit zp`%dVz?WWJie4KlNEJCGm#R(-(I4Z>3oO+!{fnB zq>Ebbf8o}Ux3U1^71-{e`920M;H&7NlCS!Sgo2cf8me9x7R-n-dCBwn|iDM^;IY7%yeN8hrt3w3NAx2gbHa zOE_twReIe+b(|waBLtdJ#QN51xnySTgGlJa5>4txT042@fLb^mEn*pC;~?qKF#Dbb zQR6DmK9;LOXUt(v7!9bh0#J#L0))og$}~N`C^UIvZb6Da<{tNS#GTl(H)r)3!y2+GW^OEPou6stGf%hjdf^8NJFk1IkScPWE>)e_ych808<3r1ur6#~d;tr0ox41q&dg;n-!DUR|GMc+@*D|h z__C7j(m4{)``WEM|BFQ$uiLhx{20R+2;b?UlB4`wLP5%Ql1g;6Qzd*CB*x3s?nC&!KjKA6QeEP0J)JZYoaKy9wQ_ zwr~>dXTMYLS?*E*=hljUV`WwF{>!f=^^evPWv!+X9jzYfP<&kwe*K~lzN4=LCF+9e zmn;g^gMG@X+y%}17KP@}08v?OA6gWeyaA#h#UCKj1Uuzgk4nEyA+;-zTmny?Fp!Ar zEDZb-Ji<5mtLVD!2?NzULi5t^KKoVzDH!j)1`mbpiD%C5B>xtWd>6h{jI0DC@m_f0 zk=6FWL3<>pn_y~<=W7{1t+exV743rxie`sQKgIY2LMD2s6f*s4LP5&Tg-Udsi%Q5O zNQ@VjUmN}o+VCFcHeQG9km=o=G$dpStnAXFnI4r14X^@tOU`dw{6;ic6cf54ua-9_(XS^!M$L zE1L}e%7Tx6Cosl*Q55doA?90Lv;2!cN1Wh&6wx(1h_tbv) z+pf;J{0iJUF|B_Oi}VdIn1i*vs&jF)fwz3ZTcVf8&kV>gE<4b_1=SayCLxGGSR zRDd;}@?A92>e8peSo$jn%lMxk?u7V(^$ckW>rpbYV!6a)!B<5G+YKLz0G~c`*b{ zZ0RFEmsqY44_qX_M;%Ejf{|PUB&ADqa}pGEg67wO=J|!8c{3nNaL2y&_BX|(55@Ie zA-G~~qrXgv?pp6-7n%2|V@$;{#(ku%BCK#T62x=@@jnCNAL|t2=mO$a&y(T)s)FJ6 zub!u`>;Tj!D3#UopH{%tAMXB(Tbgh6{9By!b|*CZ^jNzY4Bq5jA!}#i;pnJdVVPZ{SMc!|EnXKX!Y~- zIYc(8{1IudhMu||aawm>NDsun0Xe6E>K$>S7nfqh>DC}sG~(n^6)yl^jXJjc3Vixa z(5=`pBIFidg0EvFKIutpOAZ2l4l7&Zy11IlvgM-HItB{Vz z6s^<@rg)TEdVb53t^BR{xAjRr1N;Nx>pA*^BNFm=9?x$-4wL;^xsh!1x^!C0(894y zmX7+iGFG-+!ItR4OI-JKYao9E^1BKDJb4$Y$g#PJzDtSkQsO%*HUF9X_G1Nt+AX(G zV+IQ6@kf>|ccXrl=UG#lQcJoi_kmNHA0~~6>DedTE+SJ5~%hj{k0TNvRbQG7pVL9#Ct!wp? z`O3QC-ClhMZ=c?08JK>9<>*c~gxK*My#N*70=-_u;16fX641~UTPf;U-YR^`tk&|F ztGt7r+Px6+r?VZ3+(Shqlij#vye+JRH*(l>9Ov&EXU~eIe$-ri^NWmUH*CnVaQ(g0 z*MvbL6=XvYEjO=o3W{P+KcHecmbr3=XQPHNV%GU2A*opHNXISy>BT4>r~9<;o@1ZS z2f=P?f9VqR=EWdr%h|IrDkt%|Au^3i-aES>?~1hhy^vPC4fZ>Pb!4TajR@L>(fw3W zr3pYs;9OaotYJbG9@n@=6{_M8F?el|7)*!ZBwq6#Zp_}R8c z1BK_>p5-GA{;wnLk!#4Zegton!ege>8j7)Dd28*cl{MJ?{~*u|42OgMRXmB=*tS9*}d>D zaMDDcZyX%7NAJlAotQj$0FH^KD}(~jcfA9^=J3y4G}a<*l9RR3ScRlX5tSc}>j{nJ z3ZMDVh_BgpAofKCj6dyD;fFk@#mJbX8~yvyllgfI2f-9^1_vGSf?aEDGtq}WF?p;< zC77s>`g!DAd!yC%M6wG*CTve(H^3tkNK5=;C)2Tm6ABvWSF0OHt#+%c)i@^&t7N_g z_nRHxKJlVzZ@=j1azyt~g6KMHZXdgaS(#4qwUD7HafOr&+xG9Bn$Sm4Ug=UuRJ|% z$1oUeRLiw;DOZ-SJM3}$HlWlI@0$|D+o4TJk?h~tsq8zj3Gqqoz8nz+M<l84S%{qZ`d$X>qUWFHXbII2H z7dx4b8Jtj1K!2-lKWWu&b*&obq+xZ;7v=qUa+J4ocx=a`x|N5YLX@WM#|S~)kfEAC z$Qv0Q$I0OKxTz<|JA!X5d@Nr%0p4+APMa@R&&d~ofz^jkdj?j&9Y}Qq{7`~`JB;%V zlk|^wDt#rJGNO>HjPuy0MCTeB=Y^Q8j^aGGxB(ogX^%v;3J)PvG~|e!_l+2k^AF^; z4DWbgU37c}#^rcata$_0Jzy72W`>3J;)Ut9e~$LNnJw zGNMf+^Nw&1G_T^JLU#nLRj@#chYL>N86s;n*LX%H!??h3CJ$-a1A9kS6rKT%py6#q zY985Jh3^$ls4VfsOO=FB0@Pe#Vc}KQXoT%WC10Y)ujzdGJrE1%HjhOOhx zRTfSXrb^ywZln>p8V+qwuTj}W=hYVqqkOzm$o)HO_$5HQW<9pyKjzM(OhRi znm8#TbAje0xA24}dYY9CMlR`OX$$$?B%WY#I6ukIf-=${oI_2o*V!L957vs2j!Y3l zn#Iv67lIpaQRUWq!^T$iiQRCy&NQdS18C(X6s$3hL@1(C>iot-i>jUI5T^&}QL(;dpeYympo8v>>bbCCF& zsy^rZgobY99Yc!-{B0gJVAia)j%~QJxxQjlT)Ra4tfePYXzpgHVl=PM*J>4OVrU4D zt#oA`8^M>-T0fMp%@$GE>Y6@BqA5?f*v0R#IHP>3Rm>ZCJWgXSp0#H};Z}Bt3;e~*9OE#~A9`qxL>IRe< zLVSI$UO^G-L0!$P0e@izo`C|Dv$RgZwF{fbQdsq=KssKSj>2>rPa?|5B0+7ip>Pg0 zcplQt8%7O~tK2HMjY z^`n-l>D3tn)(MKU5kx_?YA~wEBWFxo@G%4V!}%TgC-Rf|xqLqVZ2qsfR|=V0sN5;&XZ~aDk5Sq4pR5yq(~^KDCbLePIi`hu-;*u&NIJVr{29HGlg z>GBv|9;S;ymnphb=~AZ4chlu5x-{wX3|)SZF7Kerf2GS$(B)_7@*%qXPrCdPU4Dly zAE(P7)8#XC`AfQdi7sEG%U9`g#g(}HJKe3PyESyVi7waEWq>ZX(`6@JM(J`tUGAmJ z3A!Am%ggEVI9*J-Ow;8&T`ao1mM*WR%UkI3eRTN|y8IAb-b4aba^LTev~dBpvzCuGF4U`4(ONg)XZpB3eP0&2+h%F5Bp$(Pfw}DZ1Q4mkGK& zNS6ob@+e)-&?QF~oh}@6ahUZiMPF~G3x|vx5Wb#%eh)77=4#S!T5%<+@(YdpKQ!|H z)?oE+uxdA0tsAV;4OZs{t8#NZ$y8?3SoR@VlrYJ=6Z!7AEd^=zNHqw8mux6R+k2=N`uv;!79>V^=PnaG*~SftP%}YhX$)c zgVmtHD$ro@H(2xy7JGw5-e7SzSkw&`bAv_PVDUCsv<(((gGJgXkT{=VQ8o%B#%JpJ z8^{KKG5<#}On;gGX8vo!DqTU9o2}A%x?`(!6Wy^@8lXG2N;~O}tAiHvR_VXf9b2W3(j8l+-={maN?)Km zwn~3XcWjluL3eDGmQyuntF(#k*ecyhcWjk*&>dT)y>!P`=`h`~RXR;~Y?aQ^9b2VY zx?`(!k?z1dL`YlRr)Tv zW2^MNbjMcd2k4Hi(!1%7tQd-^{lg1;y(6z zbDcL*BlFZ;mo*XZQS1TdEuK(JF4Kt^#rs60L*#!ldQIS=lX|r;$JMe_ z{%Dgge>APCHEPRU8_dgov!vOF76W%CQPXG*rU=u{U*G`^)RjC(1kc|F?q1(Ih0qsM zP!UAi@r)?YX*hTv59C*){Wy;arL*#})27WYw@3$%t*}c2V|#f)jFt{o}bW$ z^5t1$s9GEQG+5#}A*N_NKp|pl}E0RJap={F9q~BXtfU z>6aq6DuvUU2zIr8=6u@7_0u34+VYrED0^W%6C4kzGk1Td%oXm#7Y=Lr0gm^L){!mL z3Ev@u6VVKAt5%>tHJw^g@yuq_nSFV$n7yS7X77t(780di9XL(+o<@3E_ z`PMF2en~sa#hH|zAkep|bN7~Bai?{`-AFrkSQ1e(b7}P681WK(zdDca?G=w(yWnwu zERWm7nhy8|3f7HkJkP(W&htlm#dCibJcm_OSFYR8J7r>W_eHU>S3Jvqrq1#gdd2d# zE?B-NUd)9#^uuD&idD1X`TbXQe!tNxesAkNzX+w!MavAw^Ly=0%2C87B<(1Qh;p>I zcfs#VO^Np*$~_ln^=yI?rUd|`qR z1^PMeT!~ljtUAkQd&TlV7c3{3FB)0_zvXjADW2b_)%m^HD}J|k!SCUCoz51qKCwoc zO~GWA9aTKz|4E(kR<9Tz?1J&T;u&X_Y0NL4+YhUA`+;6@`;soW-5bfRShFcw4Dr1F zmO8J`_lnmYUGN(1p}f2z;3U;nYZ!i6o%I)b#d@j>)^|mU8AGbsGVRG9FXR7EXY^aW zVl>?aqxUB>x~;6*?7!h=<3YxL3Rmcfo61 ze~ujC9Z8SIYx6O6W*_Vovm=Yd>{xmvp4l07W^=t_c64!=O^qip`xSV|G_Ov!76B_P2Y*?5;&(c4tzZ{cCk* z|DspS?(TxwyF+3N8YM!{I(qDQU@NsVooJ7jZc&aZmLO?QqKZ9>$Zmp>+M>?xjlE)b zZx`(DQIKvzt=+B8>UghMo#=v9g%~QeJE_(_q|WT|UNL)D7tE^ES}>c$?m2aK^SxsC z?k?C>lWjtseZ4xf-_t8*?^!fv$KrkMe^F=lhkM2BzC~kpJf7L-)S3PHUNL)b7tE^F z+QjC-AF8wad%a@!zAo5RtF;Lc@>kTE{hMAfyT1!&Lp&|bbk^z@w3)g|=Kz+Bgh9ZS zwWc!;oN=IE-h`QfIExE9Q8Q+79Qu54Tr7d)6@QXgrJGr_SP=dd1>HUC1wN zmJapBlLhs3#_x{j_9xZ3eOIrzJ=F!bA=+w;>`LhB`Bio1ez{l7o$i9U(ROV$t+I2H zal8aSr_SVOd&T6L9x<8K%e2C1@7Qoc59Qa@nfyP!V)EfGm<(}=g}DTSbCsqX(5yw$ zo&+?H^oqAyymD?==k1PO@%Cu1cuQy$9#H4)zFzV6Sg&|H7caLb)p>iOSG+ymE8Y^? zNptGF)q2I-6J78Y7Q@io+f=SnuEdM)t?Dd(f3H}4Sr;sZt-WLxs|hmvDRlro_MAG zqB?({?-hTq=p}y%b0hvmoxgwT6@QuD@P}x0Y-Cpge^+l+j$<|;X;0#qvt95PGC?{} zCr!&r2{U9^36(OX&h%ifnAUs4bgrsT*HZJ?*l*glMHqC%{?sWfM2xSg52!PJuvbh^ zb-{GVh=%8ow0ItMbsk@_FdoImZM2~m7Whwh!DdL$xQ9*qEVy`XU!~6Nh2C+CbLm`m zjpiC>uM2F7fxQ>aQnpyn8QAn}hV~!3Id;#9f#dkE)_OxrZ}#PAXFpz$)jCewQr4%^ F{})&ig(m<2 literal 0 HcmV?d00001 diff --git a/en/doctrees/authorization_endpoint.doctree b/en/doctrees/authorization_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..4d1e52d5b77eb799f40973cc43e11065f3419fb7 GIT binary patch literal 146576 zcmeHw37A|*b*^RYqs3ZmNw&PSB`>3~x@XmDd6Bi)vaH2guxv1`p6)x--RkKcdeLGq zn0-vH2{r>s2$*Nqgy29HlJFi0OMn1jhX4sl2nIhw0`HN80C7U{{&TACty{P6Qr**< z;Su=oRnNV(oUP6|b*k#rLvvp@>w;Mq(EsdgVU$ zm&TRMOc(HCwXM zqgBf)r@6vdrg|z>J3UH-*nXyvtLL{T1~$3Wn9Fs&^tg4ZZ3|L{(rk971cG%bY#?zA z*Q9;nz@|xicB5LDw0q1kqsB7jTp^bcQf<%bnan@8MpQij2JDlR?FwQ<{=Psiu<$l< z;V^NbQC5)0@}X+w(j}{2x2nmrp-edFviYVM(nmLEMEAvB_yZ|_eF)|KoloY|4^HMY z`RBWo&Pz%!38eIyKuRwmHPJ-r9YpEccp(=h?(}`oPt_quv=vo122wSowh<8*x}bR| zIONLiDvg3}M-IVW?-J~#l3>dM3HDeZ!IlLQ>}FOF1uL3jSt?*cvSc91!m1n5tczbf5N)*b8=QXTaJ(F;3T;>57Co55_lq-o`1_e+u zXH{!dYs^ZND`osg2BUDgAc(fyzW4m~;2N>_2N^MYMKk8XHfdEL@v1?@vtXMP@phI< ziF)2jSZ6b1<0Y%c#LK{{=ZJXqe4(aDM|M2{S0yoKWyML zw&6*aP@ga(6kNJMDO>F!)Ixh+JyRXElz#|2z7I4@AKJHjS90&3-Q=Ov$7|brdn@Bs zxsXeht$J^5+=6E$UL+xFWh+}xj#!W)NKK`j>`(Wlgs(x)pkrk11(iZBOXUEVbW*f; zuEPQcj_vD>Q|X&b>sR65T;bqLBN7hF*IY}M@glnZ$l>&uRnNdcXQqVo`lFx*QDG?6 zuPYtNtk7=*&Y5_xt+lxC@NpV*Y9S_9;+A1I(e$m7&xb)u^-A0WRRL`Zwi&ANHH0@4-(wRm*U#Viw zVbw6K#&aV+g3T?BCNmiiZQK`%4EH-?bAAAFh?58!CmrGi3CL*|g} zdkI(UMvTWtu;=;-cIQ3Ej#%vNwM{Kg6FyR{_L8c2re2jjdFUjI2s-IS6p?neM`NnV&9`nB4$IgvgZ7Z&$S}Q(M>1tk-M39mC^AJl{ z^ZrtbTX8+cXMj%SWt)ckE@kJdG~Zw})!7tfRLG z&Ze@8e0R1t7K8A2=PW&;biB_`N21`KYPHg~uj)47qu3>0iZTAwi-%0IfKpYKETCv} zOMA3YAUT3{gO?yduGOrGoq8%|8Yxbbkg;7$LORq^|nwt-5)4V9nwU8 zJ+z`pj=WmP{p!+2*FnZn=_vV88fbecO#;2<Wr)#L#Y$2fl#-D^l74yJ8s;O1qx|2a!a_d43v%{p}25lW{pDe92^+0vwa zf~3f+d))6H3hA1sLsF#l&P^>-XRtFq(3aGo!5ABabU2grAnMTf4*Ng^m?Jwkw@jU( zPElvbfI34l)S>Skr_PW|om)bw6Q+SWHaFdpYM!0C`o*Jx^!cek=od?MCIeK{C?!@sEiQ5~9 ze$sgq&nhZy_@d3-&JMIQ#o*v@N(g zlF4SV*SO3FNNC$|Az8?cqfEdyv=v;laW*;XLg5*D{58=yo6x?hfj8{9)#njjM`PU< zN=@2ooxTeMw3wC|A}SGADXjAdo-TzeiH{Z&Gm`{WiMk$oiqA~V43SlSo*9Df@)9&? zIc*)$b?2y`klvk|fGzoboEtVV7GGLxAl+(l|8anI8v4{Vrp)Ee7R}n}_7bNH( z2FXJPF3}7$N+`md3M0(sFDnoLwG>t zp}1S93G|sK`rc5Y^ZtlE2M7DNC5QS4lAdTcDKM*EE2JvbQEWsm6|nNyOE0i{x)uRq8bEV9aO-yUN6UMrbRdu8@~ zfal2R?V%*QljL;wf#j}zdvu{3%{=e`PRC^$BO`?@Hi%lZksE~TE#zQ2`#1IW5A+W9 z_4aSt*|%+L-?rY`sBc)$%Z(**RLDaI^+u84W-kfa=+nXQj!+EmA`Ex!^jWjeu0|U` zuWwT?{@=g3w;x#6D!tnVfnRU)CiL0aj8|RDKNWVnjIfL8(m`=wD2lvqWA|Ojqk9e< zzH8s!eY>mR1xA*n+4+b!FMXm(hjKe|&NCY3JDtMS1{8f>n z1x5$L;!xqvP%7{~^ga7_?>wpyw;I)C$vT_Dzm@R}{^>1QqnVQH4DLDDd+fxq-dk|) z<|h1yUCyVk9o%{7&eUD$6r>z0CY!cE1*H1=whYq0dk)_26Z5&)F_!V}r*mH@+@I}; z!TA8kA${a@YEwVR%QMAiCv?CRMz5sP- zcvmP5=|r8Pp%Sq336<^|i-WC1KF_GrUd|BF=pZ*A6K*^5J9GPmacc^dcmOyp8xKOLOjd+mo zzgNgy?oXnI)>F{iRtmc!**~K$nbtL~(NVK!}i zJ}VSmHmf+|rnHW6ufkVw@fBw_be#j->K?|*KNYI(n)K8ILWuXb!BrjIQqi3hwuY>G;p~#Be z*L0X9x%+VCa2re&Lp3*!ZRh=cK1{pRM-N~1w+e4JhG2}hYM%ObuzhwYw)c?i9%5{d zw8-Bg(#zE390p0(IM+08TT=*J3v3z1ZdBGvB+lq8^R=n-d$jxSFHlA_I9O1fu_u3 zw@kLuA&v6ym-V(uYo z7N<~(#X#xMYuHDxh4y@?MD`Dz#HabW`FUh}x{;@IE`k?W&+wOT5q+1BURPj zGnMKoq}HNHS;0zjoB;EiTF@(gj|Dp#DK6BQ-U+BVGbu7(&B2NDB6@QYUP%HJE1q}u ze3|RPLDl`+#qA|1Ziw59T-=H;q@Nr1&&R_1LVF=4bQrB>#`7McpST=3O^zY+nofI} z)FFYqYn*Bo2{Utv;d7j$4H93)k4zoQ^(8R4#%~WDPGE-$|0IG?Y)YH}PjylAM-F4b zIaffiLY5b;RJcNq-uWI$!k$EBgujb^0KuWd8v#$Y)W{(ZpU4bnpac}Iz@FKRz z!&3*B`I5`3h4&f&|Jy#`uQd`8)rWwx`0HrK8Q1n|AK4uVav;4#7jpSowfPYPxcx+* zl~VNuOqQGJ&)JXa)qbxbysvlE!b0%RQ5Mirk9x2<(Fe7#7vmWrtJBswXOKu@Z{!h! zA$?%yy$K9t{u5`q^Oal;1Ml#mqsK7n5YfXQx9`F4RN@|le>}xhDH?n3sI4Uq96x%D z@;TO^K+v?)aSvb_OK3@&dQx4@jdE|?k3pMvH*nxPaTIB;p#ywvCkXj59Fk4saIzlB zxB-!sI4MK*yYK-=X1uAYPNtQr*xVlF6fggZWuf>U4@c|;4q+XEnnQF}b)Mon;VG!e z`boK`=6TT0WhSXMg8H2=dFXUI8#Gome%MB@E1JbYH5dd!9P0Dt#v4aJ>em}eNfTt+ zpuadsFda&*Xck)4+8P6x-vHubjJoVv(Jb<+!63p#^RCALg!4nT%X=cmo#H$iRFKtD)-3dyk-Q2eKK+LFosmfK#dAuw&lYAn{Q252;2W(W3A=)@Hl z3a`@D!ch3gurY4IE@&!#xB|P7A=gY5<&3{p;*Mj-$Z2HfZX+wILb--jPae4PeWJp7 zt5OMa&gy3>iPM=9GA+A(kaejc4P&aS>jf&U^b6P}bvq=RCGwJ_3pv+t(cG7^hNUS* z72Y1bC{8*l?Go@{Wg{&t`WB<7T0>LR=CH0#ih-0nm+15*!|e5_DI zW@<#)r0Xnc9?BiJHCq3o+#ps?+Dgsmupc2Ny0Fi*#PBdC$A75~meLZ>W8I@$>4mPG zJ8EDq%e|^~j%yj&Y3hLO^l6ub>=!w*cfJRW0$QNjikd+7`QjMEuQT~|Ka=B7GTXfh zApbTkMDF*cZN8c!|DWC796i>au(b$sGwdeqx2GYlt$M&1&X4m6Ay8t zBnQF83n-FpWlFV*$H%p|Boo^)J=lJ7kGQmgT%*7kPh!U&z7eF7-g9vC%_oI=Txc&E zZj^B4Pr8K6hMsmsfSBeU^dXI8^<$o|_NMmx)C_U)x_LmDu7DaWqhhb^!hQBiY^d9PZklU90DC#~7YC2{bZkdGFAoc}*Vy zy{eeRKasPdd8m!}{G`2#g3-;<`AMGH;6PmLTNgN?pA8LrYwin@PoyGZr zY@t3m!JlcOgP$}hls9(Ri^OFw6~z5{(Xe;}LFk6q)&kh>7+?u6JupYLt}&>!j`~_v zyeg)sJx@s5q&+K1yAFz1P(2OCOJka#TB}8GYJ?ojZ@}o#q{=?DPw0@5N~u&iBQs261%~dQtbLTt&;z*xzcEN}06O;nf14;Ywq2yj>vX zB%^F{VCO=Hak$gIOg2Fq-RZi5Y9UF>s2F|Eb2q5G)B}SQ8-PM9cywsfqc2?5HLpHe ztu)4)KGC`#ZZj;=-8D@gLnGI?AF)yr7r*Vlm?ZHDA&HMO<%@5@KTZ^0LJ)>_@!cr9 ze@6$}XoiCclDBXKOQ}egAhW9#?^S~0J+Fcy&Rsp%R7D?Dm{f8~_#RwW2aT=G0E(X{ zVvrukm4sYMN%0r)$**et8dV1PK8vDJ8kI<1MJ-@U5#0=SchE*bZ#rQMo{ znaT-;a9N#~Q`#bol0zsji*%M9Iq3aG4t-fE-Rt^dMM_14}Ag%y-9@>&hco z6^x1+4#UhI-R#eom^yaf&(b2-iB<^G@Kf___-~v7*_xo$*8DCGqN)S>G7catC~SxC5CYZDV*%iH7k8iy(+R<= znHS+~vz-Y+aUZox9=zlHzY$f7OWz{80&F)vOTnct;iVf~nw3yopbxcS4^ZbRYW%N$sBlTC2dY-s zhIIJF&!f3G+pn=Lx&vv&w{fd&+20iiVqiUS(KZzQ9!@OZDQ4 zBP&tH&;z;%MdPTTi#$^57Z)4UlC)dMMPn`UQpWsLfp;q*X)Y}A!wTOM3loU zD7X<<)g5Qjg_{b(Puj-289%)!qC+Ee=G}X_`vOkXRnC+qA7(>?GX|5k;qegKY!9~c zhF>r5*{;ZCd`V}0xNoF5Y*0%Yf;1P6H3U1zN7uH7dM?bx{_q3> zR?fz{jB^yFrw4_wL*7;HK2QJUOb6XfzAU^GM|H3E?kDwtAvHDyb00y=*m)XSGD?)3 zZKtoJHl8ltrf)kXn2RUj*z;w{IJp&!y0RV;N$+&e#@=P7jDyi^{H1C9-{|BDp=#&7$fBE_hnYK3jM z9;Wy~G#4e!9(yK+dUOYxVvH`j1wj!2AeJq{i`sK&QFLj6T!k8!KCgp-8;}qk zhYJUBOjkv?tj4n`p!lnxxf4PWA(-NunqGCczE194;~ruJT5rR<*4}O#0dRb%3BR@i zk63NK6PbzZ;?7jUQ&!1M+FS~r%|whA7@gC&*r9mBpq4Z`$GK>%qhheg z{vcX%&<H3TT zVmgs=lSA=S2DK!S|BQ>q4ytXQIR2)7ZyX=@8J$ewfGLIfX}_quLY@ZBweTSS_n8RA zt(cALd@zgd7k8tgy;eo`o1k)I`?yBRAKRzSqhkBB7DdGNMP+@`vWjE-%`g!EwRxc( zRTA<2u+OeRT?Wt$g=aB}dYvrVCs!N+-3$W!w>tSoqVqqAY&uN=eh7s(#4pLc+@2>S zMGXZh1zJe#l0ZRXpQxxUy(fX69AHazu~QxN29T?@SlA5#RP+XIBVu9OP&In>{bA46 zTe14?$AlateFYx3ixgdodZ&GYn9&MTR~FRNKXhDK%=EOcOgsnOv~}+1;$`5pk3LMt zwC^E5R5a~VP_@D~T!&J8Hk$JfZm(F9+-N#Jx&vuQKPt>YJNwLF2~W`pQ!!Az(T?I9 ziS{BEHXCKs=zN@MAMG>BNyZxt@YRJIx3d&~#h{j?(j*s+wS<>>EaB$CtLmzrBh_9HNq28FT^5%NmidpN@0tDht9>A`8Eo*ta6A4yck3U%!KMnnv` z+{ci=fcC)_=yDSrK5{n1dKU_`P4mTLBr`A`k*C$4#qy(j+Av5A1Zybhp4s?InV$Q( zhOR;UBTkwgYMkR+8;tQ${e(ak5&f^U0h!kg6g`H^1aVf^K)CLvc!ZIRrpIBFK~WW2 zmC2Tx4odAHX>fv?f}N44i2f2N zOaIe*^5q@ld zfQ~k<8YuqIpjK;Wn*=y7UE<;$65w2m5{8JcM$tIqt|N}y28tIO)Y1@-Ru|GG_^bgr zWq?zTt4;+t19EU^D!8~`(L5+K#{qMK?=v8sPH^0JP~2-!OA>q+7mXcY_j~Efz*+=a;t4Em71N=_#!%xRyFjD#+Qjw!_iKHoK}3^ zfC{?E8K{Qo!*r}2~G97tqJxWJ-}HIHf`o51;RTrOF+sx`Va1Q&LQ zR3K*xr4r>`u3EUAj!xN07kuCD#IedLtDG3GR!$?5;2ysdZ=HKBHYRFx%?Ns>sJh6E z3b2r;4EObj4_IVDZ@>UK{wN!@>>w^DnJ+|fC9_ixQRqiCG(tIH3he-fr-Ua|aUIE! z@2G~iWYlPI!WAiM&5PwX3kaX!lFKk(0JIdQ0rD{g8vI&uSBh|LR$ za~5)e;R3hQ*2XR}oyglYmN|t`J!~ggAG9Rz_)19YpQwuqz36f;zV{1lp^e(9T4LO) z;@$vmo(kc@`WlWINs~;A+A<)ft(@36LF&Tn*h?gkWGs{{{5h~S^rQZa34^HH`eO+YnFiyFh1I@;stma=tt0p z>F^_Z{7{h}p`eOpfUa7{P;)MtGxQ^bZH(?<>V5=P{hg~7)5ts&=uPY;CJ1k0vA3`q zXm>C-jC_jS1{BcgRtDX68q|{Felr&h@F{e0AC7Y=yyxx9y!tFIk5p4gUot~nY3F99 zJVKc%Sv~PaE8Y9ZF}2Qz_fbO2Q}sUT)JBu{K`?v0k8AX)UNC`_fJl_Jl_-BQNI(6U zeENx$mk?}15*NA2Adh&GLB0$H{KmYs5avT@A!>w1tSh}5Ra*^Vy2&7`LCGL15Pc$D zQ^-=#Gg>+5qllWy#Ng(cd>W3TnKl}K3XGbJ#_!=}pwXZY(_u9J!VeW04Fy#zY#T?- z_oBHdk!)gHbO%#68X;GXXx?}6pNI=$tcKm?^DoQ~BeU^;4QQYX{PRG$?-|sRX5+hD zG}df96lXR(>+u2kytGS=g7SEE`HV_ay5lgTa?x^fLoO=oziqbOk_7Esnv> zqdE;0z)V}bhlt<)Y0@}e23kD&FdY`}F+Wsf@f1|8u&s`oV`$FM;t94zcQAE}7n$V$ zw~6{(XIkm5UJ;;l=i_Cd(xng6p>#L+p(3TLplXF}XHatvnln_of^E?qOkL?NMedhu zH7(Y20wYs#+5kBfX>UWm`_PVH_1cTFptU7QB*^>hcE9wCx+T6eJf25J+1G zrmd6xY)n|0Y+g1zhUFyM3@vUn!eW!iHJ_-BXR;Pfx{i-q8Qv3u%@&m^a=KAH+)N>p z&xxfmxYq}E-kZRB5-mFURw?MJnnb=Znn&G|b=oS?W{$Fg4VhFL00(nd3%4tHU)+p5-ib&)_gMV2T$@4K!JB5~~I!~)n8%^^xg1N1EnnYHc zr>zN-P-l*Iu^P!rfYq3O5fjj8OjGw^^D_zBROe@}C4xoG&t4Y*ZfmZ?ql`s3!V&Yc zH=}B+u7ewq44j{xgVJ-zdSV}RRq7WCgH}6nEB#azhPxstL^ImD>ZXXeaxz9tJYJWX zDVp(}MPH_&1F*Ff!H?o)pw~qoro-#{-+rjb>rzm)!nOxd^TTM)(CZRxi|%0RUKe&2 zi9`W`9@m8{U41uC6jPdc4!-#pU%Yc1kGFLJipF8Bi}(vctDlKQH?=WW@?o5H!f zI7x!sl5$wwYid<#XDSsviX6AJ$z`4UrIz5E)cAfoL6CK!wm-oH(ry2>&M{Qp3>((F zV;k3bGjj(Qmi(YYs@=q_xwc8AC}udDK>Mh&jv~E z!PJ!=#rNu%Z3ODPhl%=5e2+>gmG?_b|8U>Tqw-#9fU_>(F9xMvW>8B`Fkj3?V^!Wi zHmN+C#7TuGci@jTuzzbxTey$&A$_$eFh~3Sa8$oa8~AAwc;qnVbUBM=YT^!Mll>GGi?Z-0!B@S;EN<0L56@nOot)(p&u$T1PZEF z*!D8i{2ZEViEYsxOx+M5sTnRP2s8uBE_ThpY?M((UEh~{v2k&iFX5R3re~$d`HL=ycOTaolP* z%%C{zl%s9jVpE*Fh;mc^wv+6z(%!e@=cOk_{1g*^ipf8hsN|mj-c9*A*qri{xXv$AfSvNZiWM=DaV)0)KmFeF=O!dN5mv=M%MjprkhFvden$&Z^JgFxr z$VolD8L9>5(Sui)`&U5jZwLU`KcQ?*?q^!5zmmA+4{4mi%Rr@0AEra8|C%2vQtAq- zR@nAR)U2bqI3=gCExLn_DD^@n_@vbPi1xy_pN%p~ulym?ULP!e*^?{xzh{82F5DBK z(t8bRNh&?bMPrqEE=<*qT4hUQ*y^BSzxTZLrkL<0X2SVV?nBMWow|!s?%%=pP~|Qv zcUHOoi19ZP!hdGi^`g_H+y&;*gIJgUhavx;4*=Ldz*>|4nO5!_F9}fYm*Zuia;Fc| zq1|5%VBU@QZ?m-n}ZTgKE!pSY4-*+3@T7JO?!$&-_cT`6Vygi4Q?vB*VYI+)7s*9 zh>m_&@Cm#O)E4w%I<&=~`k^9ip`dDoZI7Vl<7m!MTZnNG-9bmRMWzvai^eyI_EKA* zj2bQ9WZFl|p41k9V}P$N+^+_e{>rKKx(g^p3jX&X(y?E9|0LZg8WV%5f2 zuqvRbKDNiW8C0u@Za4Q}q6bH<8&(zB<*}oNj(j^QP2$cbY;b4&gKc!H2>w&xhO-Qs zdRpK><>;n)0!meD?kcJk%_gasr~_6^%bRdi?MW!6x<*D%hCsXYy)d=GPtfQQt`81s>lx-%G+SF66Em&(?<0o$HUFJ> z8L0W`!*po=k{>G4{0gd8*!CLKydBL&$t10eX>5z`VCtG5yGa{`bg7cfl&oNPae`PN z3_zDEs^s@o%!z18ly=}12H5MO{wQenQiEEOW)E@ESoQykLx+#;J9Kd8U8w{zS|yJo zwZ`>Gr@ko0~QdZN6W4rifqutbpT2Pv2p{Qk_qaflqJk zIG<)(C4GkI;8#h1jF*8bi9Sq+O8SN$DpE-bs%VX&v+cF0`9IN|p-K|NE4l+sB}EsN zw+V@>1Hy|2-6r&8z|90L-6mAL8!b4?6(??68 z@GsEj%?>?10-OTst1wsBg@(uz>eV2o? zXFb)`bq~@iIlC)pzdjN$iMtVc^sI(pXUx`##0ZjU;X0-|fsm7p_>oIwtCn2*!*%Px z=$xJ|5fD?V#BAQmo}!zoTrvPN!lRZMlZ%MaXze5+#WE$h$Fx3t4m?7}DK=MZtsHJh zE~*m-?yLrR89~l`z za(iN&yA^XBEt$xPuVL2qi&6FSIjSVT^@Ul7+0JBi4rx^7DK1@22GYn=>_SnVie4S7 zj#c|q$v;6}tknEdu*8+WQ zBvc!iCpnIf<1CTm!;TC&R%qiY#Q3hhf0BbVNWnE(JPvM?FaFhHH|)y(Sr7nsB;GPb z|E6i&XhF7%gWMlSkXJOjMyj>ZHiq#HEjU)HCpq3Veaxu=HNVRN8mR$2?^P@34B(Y> zd6)Lf{LY+eE(j=j=?x{Oc6>btD!$%EeNgTEQX62+mmZ{QrBl$nsSRlQTXtLhaEH&2 zC}yNj>t2tsF%MAs)0O_k&!s2K;zOJ2E)7Lb5%Yb_JUxiM%s&rs1yY|Ms8;^iKm??> zKpnCtv#G7wh3Zp6KE)CKIRnV$2zMbLnVuPqAJtYQ{#QdJ{!oV}NseT6yj?f;_8kKT z>7)G(F7CJ@d5N6CrH2vIJvI5-NjJu^7BLRoe_W~7dD2}f40p*thch*6^N{mb)pCAS zYR)g1`&?zLD`$-)My-09rh(mLLej1lPmfucede~)vG&AGiFHQ@Hf>%fHpqGk(d53K z-%bGr6xuwrVS85s|DzxPZYaR3=ZlKl9S~Esdg=h6`HNlK(Z+LO+8r-y7G6HwE3}DwQrK;9=3GwmnbvH2qB*x;xiNy0=EY@jg ztlO@mwb573?awLbz6dQTC9|o5d@t%f*d<5yiC+wpUknqkVvC}NF7f|8hKXyaejH<{ z?0L0HqnfoQ?Y+JE%9zz#ZIrR$w)ae>dI~}8LN1vtSV_d8v&mcq5$&K?TGVkezdnDB zJr@&2H2Sc;zzIQOjwoZ0_EJh+Qo?`rbf!95n|yH6UW8z#Rjwd_S*=g*pGC_##eW6p z`RnC1^84TD+Rtc@<1khXP*mMRe=xrRchIX-5B6F_P(4>6@)78?IQ}dyUC2ArYyTFO z;_K#N$H6KYm#r3(TsJA|()>UF)%=D7vuV<+`ey{-;}<;}*7Eact+u;Z@w~Iwd(LI! zNM{z&2&{9!+9iCa+R2MvqA z#z)sp=k9N8weM)|m&NA2E72;g{weW!E1+IzcV%*8l``V}m9od_vcG#%MvFwZvemc6xL&pMG#MpD9|zW*Q&|^4I6P^BeXr!x%X(xfB)PBSpYW zbrr$eQS)xp^iP|s)6Ybv9gW6Yr`op~NMl5)VJ#i8Z8DG=T+e6_Qx`mlyG^Cl4_@>j z)F(dg4B^-4bPfRUXxjR7ZSNxnEYWH8n=Y+%3fmVe#g%l&F5<6OApR<2uryK*p+_{) zr2b$4i-+;e8RaKF06j@E>(@4h+Riafhz19#KKCBEFx}^dfRvr{=*=2|m1Av(1ya(C zq-WLDNQqiwoMy;YZhKc(5)jDfG+po_S5L(ntsgsF?ovQAw5BiDrLBFtcOFd~D3l9h zjj;p{hGLRkN2@e*L(3zXu|nxwx{S5n9x(;M%TXjwEBoFJ7pnDq4(rLP*mIm!1*ObW z7Ip_9zMd-7dq)a2?B+`22Ebu#S50&ubT%Hy>;wDUtOFZhEC@?$4C=lKM@1mjk3vAy zxzWLg|4hs2Eq2{^b>X@}%cBJpKS&aI86F0xQijE;CdMkTJc11y#i?6wW;?z=P;RHH z;3C7sUR04w-y5Z^9IjwXhO?GHo(%)!SW1>E4=`dDDp={TNH9z?ihYne5a4Ezxex30 zU?ACVR}S!7LP^q)R74_-XqN^yJKzGw%Ghv0ETcH)e@qAK<8&(&0DxP2CQ~hA ztZZiiz(rS1Mc12Du%i=neg<3N*q5L_d&K%zkKnOOT!p2FH&l_X%5rvDgP1HCa@aax zd0i2Z#W=w8j@7htM_2}__`^EMN= z=1JGBd5?5!R%>nzx3Bp%e?ThU>(|gOuXm6Z=0pe4=2-V@-i?}XK~2A3bB+YdugRuG zPrL5Twzfe~j>Df2rF?!({M6**Tq~N4G7wH3uvasOMs{?^CJxot+UR;PD*d&tZzO=OBU15**}(l%=>(JDGjUgYt&6^VB-iK7`UmvL_u zbX{)G+NkQ&%hp)*`(V)yZYsLhbx;Nuqfe+IMxb115jBzBMD&S_cjXH(t=f z6j?F(_sp669*4zdOPdV3 z8blermM}Qsy;5INM3->~x;8u7a`XZANW~tUKeWh$6r@MJOCZUX`jIVYz5}KdqTe1z z%I5Olio^d1{0#ku?=UH#Bd+oJ4S_)y)dkgSO^DtP&VEY}ehB|KUZ+h#D2I;D&t@vd z8|np4D@+wlJroyT7N~RQ%PL`XT#jmSbdDu{R zR2Srx0;vEJYI3-|shE^C&52p&FXfPGDYMM&MB%)JagK&w(rl2SC;OCA_3346H2VN( z*2_&r_bLa!pjo({h|*5Pp4kRn>Dq~E3CR!dwMjdL7mWgtJnw)A%Zb~uQ<)+hDmeCw zFlf2GFsK+NklLj>L6r!Pu?XwyTk&zA2G@!fVHpRa4oKOYxE5^XOH_Ul#^#j8p<(Q3 z=9t9FUfDW(G`%K-B79Vn0?=b%9}FJL_KQgFJVE~H4#T?xpvN2#MgKRqH8|dBPJQZt zEpabzBQRfkXo69*gewDzr4+~bN>5bRx6gvs!u0J|)-l$8UpseuWi+iE z(O!E9Ngnp?PI<1paVaW0pi{4R1ALr%jVv9t@6EZl=3Z*&>EiY9WyuLTCgOd#x*+HM!Rnn>L*NuEi^`PG>oLWVOOg_X=TyplqsI zNb~Lox#M=y^6p&!GlGYN77l}6ng?QtIo$`Y5j!n-& zSI;ZYo+;VqDe79=GCJR6)9!*Jas!4VAL@m>5A4N&IWAIC7MQ<~*sVeFY2SW;6PH62 za9)bGR$(I(C9tPUo!ku^4-o18{UJtWgRbQotvO;T*Q zH&r4VQ=y96rPQvgF1f$z_>sGuT||IKZbxy23XqD5Y3w0&Hsh#rI^2?&nS)|`Azzo1hbom~0+Wdr%tXJ4O%#&ARx^0@|4YByy0;$*@J>(?ulQY}@m>LaO2 zb+k8MA1n1%N3xr@3~gIq6St8ihmiYb0Q=jVI>Kvf&Y^=zd>K`eNFi%c5*?92hep8> zG0>ldgecg7M_aqepN)@+_B&k~gDD#JMhc7XpaDzWd2NaN7CvRex*-UBYEhyd5{#_n?8r?=I zZ^Z)w#lwS7GKr%7Pn`!}1`j@FP)p;1GS`kJb_{A%D3sX!CWEe4)B2Md>-p=0oZByA z+DO`%^tHz%QO=@9Hfz;tBMrKt7+G7{b@G`S#|9|lK}Re+%1bS_C@l}okG;H<1rYlX zVdrt}i|3;>K0Qv;WL~hv7Dd_p78XWx_ku9nEUFjv^z61o zW;nPpfe2U8l0sJ|jsk{gj~gJMqy4u)d(5C#YiKX)={f40=z#7I#QQOY_hN5h zh4`d7;;%74K}Y->K>QJdS{mZf>O!XAyxpMH4{GCk>wM*HJKIv*8CVOju^)k@KyrT+ zP)RYHLxmKXKaMYk^7Rn|)O0fc9mxDagIbczAK;>~!|Lzlk(wSdDk?wbEWo%AL+2uO$L{ z2>sFF30zoL;WMOk`k`JqMF}t~T=Y0)FW!mFkT?N>z+ojZmMP(I2OU5GxLH0sfm5lp zvRTCmDT1Zoob`m)GGAh>*!C2&P2aY4aS%ZqYrLYFSgN&u;MSrQrt}!7WA+$6^YcY& z*EJB7jUMZ|lz$Ua{tYHeGzD9e@|jMl26h~nom9spjGU&r}q+w3_ zp`rsi3aVDv_7rL^Kyy(pCOH)v+oC&=HsJj%4DEVH;g>(}BkD`aTspwcG|YDwY#I2Vmo zwr_7bhVHHx9Ttupd9_XsbyAT{%10hdW(AB>)CZ0qJx0o#g7j8bJ&*998?xgiUM_I( z&@q_|g-@FwI?RqZ*16d&W;LuXesb1&?Eg=obye8+31t@KutphAw<6g1rc3TUW_54ZsA3PF2=Yn!26H97{gg?3l6|v z<##&7&~vgc$gEb&?bvdzfNm!ywX}frkKly^C4!LNQw%4TBhrfO1QbX}@_|R(SU`(K zlxKtf-QL?<9Zw?jQk^nmP_i-n-HY@XrD0rm(R&M3yeZQ+I53hK85qoM+q!vh(_ml! zwvmyoRxYz`b2gL9S_4+5KRdX2>qy_w@W@bhlhwav)3)3u{FlRrzO8+mHfOhFhjK#} zes0YU_w@~A`m$R`GTSoS2KolJ3=D4S%Vhfd1~v_C-83+m*_s(aGuhnm&`@@Ga3pgb zd(bxx94|gFSRcOaj(hIjbJx&`!+Ve3xoPLYqs3GC+?IW%kzLn8^WQ{BT|2n*+JU|J ze?_21zknIPz(b@mEdB^d&fKNbpZs?vhU3Bh_a%Tk^6rWmd6ZtSI3Ign9xg7x)1E^z zGg<7y?*};ry`DDj`xusY7^q17PzKdfgIVb|dx5j#!n3W$`_5!v4ee-&O@_B@Pqm83 z*MUqK@iMxF#}Sd{4=(A(Vn|1mbGgr^h@$#Fn|}sW-t}ht)%(PR&O){yz8DO_J&S-6 zd0}ur4B&%bgAA%53Y8%*C{wN=RCg{hhGkDc-omkCMligQxrwCWQ~xK@12{{VMCW>8B`t3JX- zW2aRHD}4WemL$T#D}3KW0YkL^-T(nzsDBEypEjt~8rmi+d|g+$c!#X;Ek+4L#227w zl;UU}&Ho9+=Ni<~5RXw!ddHNsu#s;IRqlZTlkdJEni-Vs+OkE3dXn zG>V4oW8Odu(oR}}0~b)jW1^sU19q(a6xHsD!G#8DYmzY2Vc92uQBzpLsA2jAB3MiWL^>CrF`$J`!V8InpE9T>N%&`6G*$_&5DLdb0XIS#^vRt# zecu3A9Rbd9{tq2TV5Z0J#fgBiI|nZV$1Z)Cjnn75FZL4AE+O21JC>(mRFnZU%E{Ld4Zsakoi74E>0(UO!z>bh-7cEa zI!aZ0=X!E;u8y~eG6X&gMYRz4fhDu1DU5jux^5?o=?y{tjJ46BQ0UU09>wcGcj$Iv zn}~;YsiMkm>@$!6Id9p+Y>3v%x-wr$0(_f6HL1*R;i9oVkwH{+6fHSnmECHFr|>SI zfT1sF86cqJeKFxZY*4K=yqEO!+;QyK;RFrrKxV&EVZG2Tsc?SS9OsuC0I%bG3E}(_ zgKDkeY!V87r$Rd<6#Sd!n7`cs1s(HMg!x+xs%e;q8!2*UrRm#Y(5j3DO9j`dSnx$X z89teSXh*qV<%DytIqt>31aNYUEzt@qiTgT=#EmlPxqsCFRh{l@i0)rDs3z(D1uhz^ zUCtiEx-6D!1>y;TSt8fKma+j)&(_)Grpf%ggZ0S_iS`!M1LLTB%+%aF?|pq27p=SC z0{7B+=Zv!OjGW5)lJc5RC`d^4SlKUOT3FBB&j;aml4K04XU-KZf1IBS|^&(xbj}Lm&41znJImkj+yBz{7})%R6*5> zq^>2tWze2~1p3*n@h!RsX`VkTEJ{14DKF`1lr!>tp_M~+qXKkmkd=K4u|hcTD+8)1 z;eQ*mCfYrh!v8-EsG$r06-2~08B~)*d;=GawYAS7OXnPj5jR9BqL95MD~f%dbaK-9 zAQBj1l5LsV(_5z4i=y#|n8wp%GdDNeOzJ+$W_}spLv5z0JhL|QTTH)b8I?Bk8;q-7 zbcSrEB)iXM3R#HO6Z#;!k_OQq2jCT=i3|r(jLp1gy{kZiZ02%&j&ozA+E{|3aY|Ij z_$tD<%b;3oYGbBt=1oL1zs*eIWuVQZ57S{Y5BZ@Yo2j5`MN$*Qw;r??$8L>p(LGGv zW-jlM)33BN3qkhs6tO|r%Zq%)l^!2smgvgGKM1AJ7YwMN3;jAG-iSdpNxUoP2VBu1d1|?5dE3XkDTY zxb-yPUJ-zoe@M4B;9~6R*U(|aT=cIDSRz%-R}4VcF}{W{{*pnp)-axFyE^Zh0K57l zqBCEQinxq7Cj@<%4!gR>4;9%}1yw7OdM)woUs~l`bPrRvs~5R;Ra`X8YleEPcL+3) z!oI|@s$5v<@XbV~nB6r};0I7N&a==3{(2%@uR%2_@Ef^ktWCXhpN!`+E+KcYI(E-6 zdYf#iO+~*WOuy-|fm@qxAax&Q14r;Z)CP*mGiw7IOh4VQ`3-=yfzM-H^`bLm10~sg zHc-ey^tjgtNH-0TLjidCNzmE=iLrrCpu-3o_*Mg!NR{wr1JHGhHxR~eG^o}Z#xrdL zKSwn4&n-WQmw`5rK1_!V{H7l&vVjV!RwT8D`1S#`7iR%9zD4&ibsM;}2PxD}TUBxN zBWPmzQ{sV`ST6RKRT})im>IfS@ee;K?*DFpzb@_@iEKYHs3ytwuUs_N0`8%i9acM$ z$OwxrSbm}$xn;~B#Y$8H_bB7k>6qz6vD>scMYXlpk_b|JH zo>{whGt)0x>ZIM<&baDDXUOhJvit0wkcH^6t`CbO4U07ac=-ojYr`VO?iJBtgxxC{ zutX|?yaDJs#wo(sGN{%X#xrgAewAqEw|f(K8EE(D!*tlacln_ryQiRPMN)f-Z!brC zhIUUV@aP_?m1?G1D4k1Vf$?;vP@+TwK_>9y#13HsSBF$ndi@j3B3;?| z2c;YYA2pzgJ_!1Wm>)K%CI`WvaM4(6creI(B^*@GwQUyrTW(j;@!L$t^K2in^@R56 z^!GIzNa{bzK>h^ZLk*;;JhKLJ{&l1)q6JYJ$k{0BAD%O0ASKy-22uz^v{KMV$^ea& zZ!!;~NzmFzi7}9aAY_Dr++@HKsT=wOSmIYBI>v*9amt`tYZ%Y8fy@xi{08!FybLsu z^kF&-WX%s18At_HE0Q`yd^?Et{3FoMZjEozJxtv|uEjQ*@flWq-4|r2eDK<%jV-)Le?nGixqC&jgGXNog)W z&A94CXUJSivir=X5QbJ0hl(4h;rf~Juthzr6-F4apbHGUs6L{}~TAt*)uSq3!FMgB%2-BE*TQsfVF z(OAQ{OWH27fxx|%*n`_o`DzZ@yNdn2&h4AsP1jrT(LCHFrVfE@Fm6l{?KBh3XFkIE za!!U`;=f0WVUdkew!IgkRb<->DHkPu&J9|xpcbAkzG)VO75nPtQ3Qh4n_f>lkswfs zmR6mqJBX<@v>62vb>A9OV>I_$2{j?hLAxv8j?Zy(PbtPv7=W&0d=p{(xIwknFrI16 z{RN_#f1>kYybRRb^kF(Q_qY5|k>*xVwIZoE6W{&>?X@JS(LGFEbFaYlPG!pY5vjZX zi})bqeVMxnJ`h?>*8BcWV(XM z)M90i7KjM3M35^CZ4`YwDn)Yo?y zfUaYF8)3Z1pjvB!JJb65EYZxbuk&~rsITe6bm;3>`Jp0xt)OZ}Qg;#GEVS2>q(=8J zb$z`Sm$vfZD7vmTjW|r&4O0a<-R~fV2*JNJw4zc?zrk!W^1t6^KpA}?>>+|aVNgvD zgvYsPtOh?Ob#GH(itYo!9{9T2#LhR!yZhjcH2e1UTUTWLD3i6*8voO1b!r;_%hW=X z#wTb)HNHS4TFP~{?7;PGkBSW^wX#9U7)WS9Xzu>c>#{a(tpz9dlP8fgBpjvB! zKGPcisto}e|028$)cEvaIy8R2A1c!L3aVBl^$z0OVzk$iq(=8Jb&Y>HH2!Fzh9m%W zWGjtV`3Hz2Lh>&Quc?&NA!d}3&fjl98+|C;NhH0)pqd;Cd$?$<&cDY%D{Exy@mwQi z;?S=*=s=P16q8WfJ8#qN>WXc`HsdG*ZdX@tRSPw4!H5ae8I~H*louz}lmte*S$)lv z!$B`cuTwKNk5CIu#)hB`H8uj3=mDn7+kTR_JX0u|n61fMjIntap%!jz-i^LABN}o@rzAHKLh+dhrRo3^X?MVLFV>Klq^{W22yIMN$tC-#&)+42_M@ zjL|(z-Po*g4+S~1h01Ud2TFtH7V~;ssbA%s4$^BWrL+KL4Tr!S6pf>aJ_HUCDQ6i} zlSAM?nd-4d<^64)vgjbPW?pHzNyO z0G!DEd`V+fZ=*SJsS7q9S9y#_5I(B)AgGr4(RF}Zs*^#ra&sFnUYO`s4M;FLY}O6~ ztf`r`6VyVJStDpe&6+?ZdMN7>ewZZuYP1YCwTAIbo3*zR&HQHVwRjn5*671@n6>x$p(3-UplU@@j}YHpgZ5gI)aV{Gvld-+ z%Y2Y>RZ*lx3@_?r1fBy{6yG?H>#PV!YZjRiSmnk&nBQ;^scK7eRZ=~>h8x(jnHqv!ccxG(;bXl~Ehl=0`uY;L zWpW9rVtW#}Hm(i>!Z|-FGm=KC#xPxHbGXwWDee4sEUCKbTHXY)VXJ>_iU2~mIqn2t;gUcCplhCcNP_>G8;^$L6xfZTN(?wvGmC=i zuiIW^(d|k}Vo+_ecmbr$a<08`KJulfwMpA|iH_w-fLJWd;of|Sq4OJ%kh!>|i|%zS zF1i6m=SP&?yLgd!L%oSN-dlIR4R4E^DWPp{j=;Pl-04^7)zfWsZ_@%@n$JPL4|ST8y}+^FKcLT zt$1VM#2&p#pDEPy$Ss$t)c`WOlNH<-h(X}&M?KByNhkMTXm{l^CHK#{_HyfN0kqq12>3w^1KS zZk@C**FT6em+5?_oGV#X(3rr?)+gaHGZz1uar}j>S*tzeF>Fh z08lbbM|0?Q)Jb~*-Y2i^8v;p}BFnC?d3vLozs_ksI;ZL+#5psJL6ocKC-*O~uYg#N zrQOl#B9N|)laM@YFRPuyeDG{KUl`4o@E=5YPN_nYzZljY1&>^+Fx=7i!>P2v8+kD33r49KEoDG)1j3 z>?>CoBl#^=GGZ{!VT}Z_8N*$(7{TWNLf*3K=;V?tN}WnuV>kE2Q^^9Pc`|>Wy|_{KzBpqqtc@3P^7CUTU9j9gpR`v<{gss0?0hvd~tjPiZNjk5`&KYgV;do%VW{sveR z<9j!6Gc3~Hl_D)?7AeeJq)EBe;AF^!9P_>SdYDKw_e=OEQ@jG#SmTeC_$R{-75*T% zC)2R!6Q^XQ{8RaF$>A<7#>g(4&_gx6oq;J?^5% zK6>0sk7vE%=x6$MG>G3=C_%J>GgdU%z z$Dh;V>-6{G99>xbQ+e{)>KHM86i(<8pdjN{ z9*601fFAeL<34&6=`l)=GxVs_<7M=CF+Coo$E)e_I6Z!y9=}D8-=N1I(c^ve_!vDt zLXR)f<8$=*20i|o9^a$Kcj@tO^!O1y=FP@qHa%9-V;MaX^tgf^NqY3qV>>;z(BpP` z?54*tdfZKq3_YGpk1{<@(c}5_I7^QSdc2$-ucOCf^mq$B-b|18(Bs|o_y9fLPmfR1 z2V`H z_S54IdYqugae7$v7^cS+qB_B1I>913!Qwf=qB+50Il&@1!QwcFh5C5CRju!SUe_JG$vRqCRijUSR5W^QFxfeV1h+pg4sX8tbdr< z{xGxrVP-da0hb?cU<-uBSDg9!tx0Zgf*4se8SnF-3 zU##_Z(J$6|hv^q%E13vDSMJ{bH^60s6&S@00Y4 zwcc0g7i+z5(J$6|KcHW%^?pjfSnG9>8ey%sntrj?yM}(T*6XKVto3fDU##`^(=XO~ zC+HVzJ&S&^)~nJl)_O0ZU##_P`o&uB*XS2(y?4+r)_T83zgX*ih<>rw`wabJt@l^- zi?!Z&=of3fAJQ+@db3DrvDRBkzgX+7rC+S|y6G2dy-oCswcc&?i?!Y%`o&uBIrNLQ z9)%Nx)_W2CB5Pm#HG1q_fX5y5n6(Ix+4T4XkMGih_2jciS+btI zl9VOuN&dxp@`a=}Sx-_lg*^z4;;^0+zvv!{;u3mLcJ1O<=t22Fi*Kd}WkoCI=|Op7 ziv9GU1M$UY=s{=wihqhn!(QT@HjvsyhzGZaup6TuowYbpfl`E~#+Q&S(emrKfA{3RX*6J!U`SBa#S35Y6xT^T4C>j<1w&%*o%Pe~i*<;KX_Z{4Oh(aKG z=&JZ(ZmIYY{38NS(R4}Of!3-t!%K+yS7IIGKVs$9C1mnocmA65+ywG>=E(g`tH>3< zjv6j%`EE>(Ddx8S3JSfph~V~c1lL!`Aw~5JP41(Sea0NwA9o7bE89T!)(B+5Q3^cL zgc>2gLj7Dc$`@}m7T)D3+LG{w@%O4WP`;rV<Zb_(@m8>nv%MI8$Z*$Pr<##o?F`4D|wb;kw#KmYn20Vn;aKkF36sWvdaEgs|b z6;qev+dk|gkp5<;knU{*>1|<1V}%;db+(Rwt5)=A{!epU|GiVV_O*d)lrQNlc=V?R zqLE#bGD5$PS%1WH&{N@k8dwKG-Q_H=Q?RH%BA;26JS8rBldmK2OMQiW{@PZ;tHmbPCxm zZ6LcNz|2yd3bT5wDf2eKh!1sR8_1fBS|A&T?q+jz2RnuCjyBLW z<892CJ#3EbfleWN(|JR7Fxu7@&5<4L6tXv;H)MyRk$sstvM=rwvbVH>tl6lIoen&1 zj_$8_3f)`VK-X;4#(2noWRC3nI)&`cHjoXlw6yS-zy>thiDuD4Q!QGIzi5u?=Q@Sz zZEc|1)9h4aMhh{^dfzig?z^2rZg(5V1&mSJK#P+vr?E*EyNnaqh+4y9S2Qo@^%{Fk zvr)7oj>Mie(7mOZml8i*<=QBZW*o$^;W`@QggM4nbPD6WZD1U*@@16=`?n>B`UjFR zQK#+ZIBw|_j<>ggM2CCal#zcmv;))JKI1tV1*s4lbIMR`4)5R-rOnd_P2rE zP_vNoP9WX|6Tfuv0dq9p-zhZjY6H#Q2sER`^eg5VeyLL!9%uu@0BwV9Wzo3(z#O;l zcM7+IZQvHby~1eabc%#D8pEzWV+UtGigv`oIn)M*0nRF67>(RD=Ez;$DdY~ffm~nn z;FG&}phu%oyxAPZ8#{&K-EE+FV*rX2pO%N7oB;KfXlzfIV|%<)*dA#E+W={``Zvdf zKdR=)RXT;-(Ke79Xl7-hR@u6_uRl4^*B67NZI0x_okH?hhmg!>Dzxu++hAWz)b1VT zNWQgGNFHwk$pDjBJQJgEK4gyDA9o73XLSmMmJnJ0Cd<92PQaJ#P!+=6@<+Oe6$$%pZ1_T6TV z;w_y*@!4&l7<3kbQLM)B@HyrP-rFezpVJ0{I|D3xGM6e?$hJ{oOtF;!Ny6*rlEc{; zrk*y(xz;J1?{5R=WHZjl@vvo6|JG=seT_MOk8}#Z=XMgmnEe9pGRNJ6zkp4{1$|5+;a5_qA*&WMDF492PR=}c#k&Q&ub_2fBZ z;CFNp7UFP|W)jITqDSga%#r@rP9Z(q2GRlNT#z-!DwQ%xnL(pkNK(R?B(iTrqr76k z*de+IMW^5piBv!G{M}32z&b$xiYui1qEXyvj^c(6qS($B_)rvMmZ|odqqwVsD7Lef z9ExJhW}cJgDBj;e6x&&14Mi~~81R5Oif1~A;ww5i7Gr`sljbNs+CdbNnWE+6z5)9J zlyb$fqj4)KG8{!~pWime__sQT@qyX1+CX`**~6tgdf7sfb0)>a4L)Ix>Bl;V=~z3M zh7Qq~%}Gz0vWXA5wQLu(%a6;I+<)^Y44P17omGD=G7I-XtI82V6Yi5fLZ(-1l=#tDdIn%m4K>6AcVvh1Rp@W{sSliA@P+@AVB=iy)(13>v(q^r-?vB z@@D7GeVlXdIlprszx~SC+uN77$$w%dY&qOpE1S0M`8Ep^vD5agxXHXIc`JGNwd7hd zD@uX68v1cyu|#Y`4a?!K9WXDsoQP?v9&tA;r|l;~W<}ih^5)K%Gww`WPG+5w7>ju1 zvcfBI@TKR^oYDeTk6knJgEqd_82Yv#3$;R{(Ti-2r0HAtjf7+s<1G`7qr}-8R!uQ! zMp3}4afHrDkr8f(B=m&knqi1Sd>`}7ruw$ij$56Fs%c$?EL0~J6Omb`SBW#@9CD^a z$;hqbjEM2fI2S68-(-~__B<9;R{h{=C2Vn9w>Z;%Zd*E9g*Pjb<;<&?D=R$Y1~n=N zVU&nbmwPNZyCbf`5G5#Q)&sNU6fAft+P-buMTco~bJCPAwZn)t=jOC9GJ{BuTk~4Y z4>TTynrB9Fz%`7Fl4q>{oww!f;>iMV7X-mu6 z1uOEaka=lgak(trbJjTk|3rgCIUu~F64G3ahf&~r^}K@JMIYd4$G-UmUn(!UO(4-5>RI7blqYof+Mkb51z(XGaMu zoQIte%u-olsWW!zo0zRL1@HHRy6M5gUAL{(O*mhGK(L&iP^6&E(TrTQshOJP01zxh z2@2rG+*|S86*zApWZ>;h9ub~X43KN5wa^{BIS45vsJP&S^N2kvYiq5zir_<}B1HI# z8L@d;m*RzbOrajob5u4z>3Mz(=%(Sqqrf1?4AB=u&>K}Qkc<(t9BHb_6pSPy$Pi{O(51=i4)kQ2$B;il6X}GokD6M3 z5CFb31&^BFVu2b35}H5(-({VM{_X$R{B%&|1%T6|nJbF>H=4K%n)cspUOT;gei)2; zfiOzE_uu9VdAP%5!-ae4X5lVQUxfE%0h2qhCcRqYl!aw*l8@GW*Y#H^CS)|3#b|mw zo08ksU#{TGgJv?u^1vp{(E-fC`z1$E{vEKCE zRc=R4a&|u@z8etZO*qxpGCxiS-Y8k3-Rv#4>l%+#c93P(i(V2Vfxo)0T&{Qlg+Y7W zt4=-;Q$^IwX1TjCpQ;}YJ5~E&qwmK9RuJ!_()VD<4|)ul=PFTpFpLsd*+;ipAr_0)f7W1&GecH!{1IZ1koRA|k&45~&%^EXUkqm3L1J0qw6zUJs z7rxaf$$EX%c=JkMJ+vpBC~Ad|S1PNkt7Wr}O;O!nDf6fja_lN9HmjMj8&zr?D}+kG zT0Y9Lhcr|HZJn4=kGX9c$oC$%4NDoy;GWuJwd~rHR}5({3f5A-`78u%V-{-2t>^(U zltpKu`aHE68&toa5yhz7a1QE1j6-HDq!MA>0b|j|qcKOi9cmm`vrBMq26fgsFM!^) zJ2Q34(KFl^hh0~%*L5}5dOFuS_jKA%CuX*Z5=UIOT(6gD5eTQi(lC#nv|_r;%5B^D zH0cV}pTz%SGWQZYIlDc#M1PRTa_D`ie@t4g|L$(6_?cWv!LSdJy=D%pdjTMSW!n*qb{f)BB;b4tFdd^i!%I8U8A?ialw4 z@tZswU9H3LcgTV%hBwaPL1MSEYkvsKu=^0)`0H{W24nX?_?TSyRAu3lgxyOyb{C3r zeET^D92UC|L%^SIO2Gb#-x_uwxoB3I>zdlh^z@x;IDv;JXe*25Ph`ptsFmyg=S}GU z0QCRkkox~#*6Xu4edo%0J<4(2gCmj?NSVX_V%e!fb(rT zB%I&Q&WAzv+c};B`Ab^@`93pKMDKq}XX{4qFK!XN`wabL4=kTf>*~1!Wvk*_M(AhL zF7rcaPP{pVBlGSoK%@*1&r96vO>NlY6E*bnH1%c!uG&O&*kIxIKJ>+$!fbVU?q>%CkdS z<+QBV2g3h$1$Tlt*{6#G+#AqAEbdCUtJPwU7U{Ur^>7Dh%WS1oRcm*7{@P=TO)u{e z2wOYAz^%CNDjDS#ws$dK%O}TJEHCuQ1~nKe%?4k-yA~;A5Ql^s6L(vne&Ls$!CbqW zM$;3OsQfJ@s?GaSF@M=I(z^3kaOb_dC#|hXrI?;Yw~px6xvO_Yw=SbwSFs|aTgKA* zQ=(hjsa#Vs423WS8C0h1Ie^-1;?(q;?Q_;>uGZ~y)C~5|AX(}>1`Iakj1S)D48-8c zMWoKhx>IMNC{Ge^W58ik=YtUN8=Dfazv8!+Iv;$F4w$vmbikbNb(nTCjvPM#v!?4T zez?lHHGZ%OYaE9)J{Zy(@5y?7Qs$di)J=XyoGPe8iZVJ>54RZkbTXCiWtd^61_Lk1 z=$FNQ1KHCoc5DbC3#sOJ)N)J=)oPf0FjPkhwJ&c8wFgOtgV z>d-559zC1dwocbD%6SUMJhFPeg8*?Q51p>+>yC2%K&q~TIAwtTk)A=^Lx`DQNP`WA zxPdVlEcd{VxnSEX2`~=|46lV1LCs5ZAX}W0VdK&)J;L32M7tOj|LiLtbR0EYI^|Dl3uX%=2Pr z2&y7cArrATr^D7j|HG-54NmIkOg9F_G~?4cGv`IA&Oi|*#%qEH8~53uG&Wm!*rkRs z(Dzk5PNt7>;Nod_tAGkzT1yoVz_Z+g0De0Btf{nM)7n~dN6qNlOgL-L0( zk^}R&&?gbQUDK<_W}U&>HlBCD|HVC^pMmje*bKLhHikjEgAK-U`&i>-pAzn;!4s?YP-8a(9DKWdWVH1fGeQJTGQs2`uY{H1(aLR>)%8H`bcu zNPE~CZp)dxG0Iv>53wSHD9Fk&XAGN%#PXqwb0y_O76#4cy<>_oZ#@r7mBb2_M5J>64D zr~Bhs_Xtsw-1RC8%A7?tIR=8g;zUgsgOzX|h6s`@rJdpke6nfep_wZH)&Y6Q4Y4O| zdy%$n>H&rAO3H@pUpJ{?2jqq(l1c%|q z|Ax5NLanO?Ynt3O@FM~cLy1>^UF=P{p>S5Wroilm7-8N@0;m@|6_g-;;ffqoZsKMd zibo)|+Y6!KS`mI)0Jj0rg9!X$UstK(>Z2IF)$#}8LlDg$zRxxm5abP=KF%P; zHJ+i559s4P`Z$PG+qjQDUZ;;&>Eo~T@fUo=qC`DK?G{u6BU|=$L-uoB_HkXdzb@Ne zm+h{{&I44F26U#>XrIYPdzZe+(e~z}wX@M0AIc$j7rjTSv)kf|8A~3kN(dyfddhCa z5>*er0&i##W_|EN?@;5%sMmKbGM47r?P8R?4o u{4*CQ>8YRN$TdpiN2(jKE4P<XR=n2PmTYVG=YA#Gl6<;5NhirCStncmlUK95b31dl zyR*#9-sy}DrVL?3hJ=_62?U%XBv1iNARz@5p@0e`E|QRfKnPHQ#07yAP(TGLgaFBV zZ~l5_XJ+R{bLHT&-u2G(^z`?=*ROxJ`|Z;`zw^L*SJ8jQm1lmG%0k;%1v$#1RI4aLqkSH3Zo&MTR8zB70qe_h z-SfQIW87q2llm?^n$2d^$Tim3Uc%zTkG({@4G=P9rUL#dhsGhODT;o+0E<(De!Pm{yhDxjHekk$fc}19| zJiQm|wf$<7N2nW`il7S0g3xXm>ovZLPqf88al5$2=q)-l!KZaLJ3Ha3nnSR1!}?RK z2(wZ{(j>W|W))Ry8*6J)LujAqX_Wx`xr2Q+eQV$@`&19zHt%jVtWPF+0AT=F6R!iR#2bM88{yv$_;)k> zy9KCPH!CZ39_xxPYm5Ejtu663F)!{CcZ+wNSO*2{X$2HutS%{S-Yy0oxs!Qhjd;7b z22kH++7%$XACZ+sp*+t?Wx4TWMym5w0WfB>IryJGskuqHSeBG>O(<3sL1+}|fjY0u zXVrx&60v_#s%YZ=%)qe2Mh`v9@^SCwmTgiQ%Gnye288vwXu#sAUTtIbz;N4G(^90i zac6vFSQy`^NEP0+YU7GK+v4LYvU(pVV9H{)FGvyMBY|2VhiTDbdUGJti-AmU zMmN#H^gYP5+LS6$=8pFV{j3hzrtPx2Cy>>Ur(==W>r{u&V+IJ4g;f5~3L^V}>}Caehk1+uotD-Eep<)F_~!KreR1|5jdtU=!f4)$zI)1*wbCS{x#W%2Y8g!wGQvf^-mD2Kk;g-?UP1CS zQBqy%uwT!>P$g3r_=c9zLHts#^(ZdL#* z0;`c5T%nlHnqv(d4BDNnu|bw9Wy}W^vj!=iYtDcL25{8B-hDam#;*0tFuvJge3cq(SI^J}5(R6Xn*akN{UY`_qADJ_mhd>p;Z;fOIPm>a+=8K#_E{cf(J zlgl!s^!OTS+kD*|%9n_Iojl5ojk(k;E-q&IDzuuaypWZk;Ycw0%fTdqZ`HKitOV{R z2cAfV>$0*`G%wU@)oRh10u}j|CdvxTIRq7&RkJedBdn)Z<#?Xq#<}3qaNahXm8pwV7D1pj-NYwMxb$BVw#vDd>mcJax}N7Db|}9f~+hiLEbDbJ7dY%VJl`+ zb8CER#=u=#+$6OiridtN&@o%wgi+(oa@o|d6||=5OW8-=9?IbbKZm9Y)FvzdCg{XWSIL&)GqCGf+Dz*)-^Ey%mB%E@ zm&c{(aI)6tshe$MyF&Tt^x>`29E^XbCeAK3g~ZNj##4%qBd-rPbHb7#zK>za>%;xI zT%MBpaBmH5rgn!i)#1a(VTm4SlIMj+Qb)xU;p52T!^`j{APC>Y5ajXU-YhOV34J(Q zF`Jq@LaAx`8`*eGg0VcBA`a=xG#*IIQ9xNfvNCL=D^q@KR_?nQ)~vj?r^0%6rcZTx#h@VGfa8gm^#3N6q03T!5vWyXad<#R9mBIBE+D5vr1^nF|#0ZAoFC3R~8=+9HF^%TQt6&iZb!1q1Y3ez8JmVZp)_bA zG{D3H?f1TAuX+Sl#8;ZnV(jsN=TWn*1uTTv;{i4|Oj@wEOm3ILlb1!IzvechTqvXX zB}?&?In$ev)Uv!FD9cz8so0OWTBNT{ot3hyER%9FGWKNM%d+=eCicf=!g<`SgN-{I ziklr$PS_y&PbFD7>wJIzX+>U;U=h(aNS_Ja#1hiR5H;R@P=O z7s}qWYc-j1bJZ07CRq##S_!e;ki8yjEq&Mvt=4T^-Nxlw`0HC48IDT^KG|tB`B2#2 zWmao-v{=Xv#COB)BA@eOXEhTF@)?S=jLNCjQfz@6U|NuKzu&r#m4W+iD@tXV6$`bE zqOeSM2D629*nxt&vNOmPBH6(*QfCJXwb>b19y_?Qo(?-vOZ2ww3`Mg;%lxUcgB7#c z8C*6yDYdMj7%gikx@7@7E6}pAP@A2hWwSG!mhB98ZCOLya8%0zcJO}6eg_M+*%@9o zJ0oeaT{igN53*GaAZ{ zKm!@;8)By;9?quLYf(`?hPFFj4BDP~nDh2rP7b?Y=ge|gmZsv4a-xPDX0bL;dlT@K zl845M_(wku3r;&jp4jn^lf%Q4*H5R$lk2JXh4OSh(4JEAM1DWCt;3F3FXY^Hxbga+ z*elOb_Tze>{h^!$j+(jAv^)?LE2f{Mgww21L84I;r*4?4(1bZNOHbs6q z7;@T;)3Sge4@XW8$9kwr9+pyRS!S^|PxplK6lO&!`Jd4a?-OK2tnYE|GYok>PfAwg z`ke#IW@j*+G0g)_T z>>LVZC(Hw-Ha8v3cFs;6|H616@BGxs!L%7<|4?L7P+JeOX zBilw#wk~p2rxr}pqq~{b#f;~!+we;EuzCgSYkRE2p={z->EcNsP#`XOBo)bZ9o7m~ z&ufKOqaFn!ljnd{WS8O7yiIKKNUL@Gr6F`Yl+c|>=vdXyAiJf}*ZS7tJqD=#*+q6e zYbu_SYz0q**5`FtpPJmL!v5_Axy+Ypu#p|M#Di&jbA}K2Zm2N8G0WWO zxdcs>va(Wz9mF*WzH-dr1=#kSgZxAJd=dZb+ee=Y&@1Hf16lmPP#nqU;HVwm#_J1t z5cxt-FR)Q)IPYf2^j&ssw#eG-N>tCb)1#r39Y;HzxQ`p3n)DiFm4D(1IM&9uW@n`` zZ1fax2R0CwlPb_>7KU?$f!ts|R~R14@7tT-ms6|0X1%Ub=irPF!-IRprQje-L4tSM z2#S`CS1(IU%AP{pIl9-@-=4^ zI60j=`_S3kAviE|0RF*l<%Qb@$4(v3o-Ag;%HgY$;Zbk_*?fL<5dTh2AN84e4{Q$O z*{yTV1sD6Hwi&EMb!=izgc7reEdWPy9Gy!VKXt~})>o*%_c67F#>ljO==*lP^N!11 z+2#&i_)1mO=I~@Fhj-m8_L_Ol+P=Mf#Xl=ehV2k%lL*>3na;5wSx^+Uc<~ zE?t@|LwE#9&}OM8hQ6et@Ut3+S2!8>!f~*}nad9a?a^2Rw;1f!M;G;oZ7R!ri>>|X zP$0DTL^=w`kgx^0aLlo8=czskPAtLx8a(pnobba_IQhXKT)k#?pJwr5)>5~NvFpCS zZm+h%o(cs^r;QM7+Bnx@-53ShpH~3g=}>eJqfMSNH=jXY(H*0`BWMU_|FCcXC+Rqd zqtR0M2CNRCQl};Ywc2OtAG!wyvvoCVUUiYjURCN|4O_$ahjLIN4)7aD>lyhgfGn3=oWES#pFi^-B3fvUT5`3`N3UHr6X@7P> zfj`ii%P8Nj`%Gxv_hH?qW=`!L$-~C2e4bfwCJ?Gju2_ zqr!kaKUi!I;wpp+Q@nr`yG`(v%)zmK%<4hsz3!rOTyN3}*r*=}MSTWQA3w)xCLg5q|YQ0p9?5NA8jIaw9BIfzTZEea)$uT}BXt5{ck7P)3_k#$GbM;D~yhc5rc zHrxk8;ZnB>C)QlA6Z@^^Si!+-9?$Ul9KfbAinTtvP@ONMFYl!`%yXeIEv+(x?$~ei zYE@{Im8B*gkMGnfJJANH-gCQ`t5xR3Hr$6o;hr#!_(TG&dg0Cs{%!<-&3jdfA6=C? z$F>p@jBm67J{$^=eADrB%rrCM>r@FMX=yFkO59<&?2Hmn<3|_fG272x_IquxkA#9X zw_W485pLqNd^&+r&8Avu!hZ8Y-iNf$y~*g+d)3A5tRck4?G}&kw$VNsiuN4Z?kPfh zW|{h(gSarNHHU#{X%r;R4O8J&@CLJ93ae%InhSYZEjPLfHu}dx(M#0naud|ka3&2i zLKzlDV9+Q?#UIylp3+r~f-FGS7uJq$^D$Q&Zi!9c^6U?e1yZwu~wA@O&o4SgjmBx@^ zII!T_03WiX7_YIp zzYq$8LY??5SyEMwRzJXVG`&{jES5wyGtcu}J}`jLO}<9vd4}Nu^RcbWpU)-dh=-gw z?!Z%)Q%{>SK9ncvjCIN9GUl9@ zCUXj9tV=CzzDhp6dX4qq5@~#BM=TY4#C6#B?1liFJ+OEI-}1S)jIGDyMU2CRnf$GiGA&re0W35sK!*6Ebe++BZYBmKWqexYe&U``5 zGo>ZEQ{ziQEwgim`uUxEGBBIY;D!-ZrQ7Db6a%GM;fb;~v;Uu}T=iI zQ}~AhpE}xw)BLZ3t4?UJKbjHcR;@zJL&Vn#gv*22cy%~I%+CYyvXWVpRFQ5&a0^A6 zU7{QiEv`|e+rom-$fy#0*R%xT^fX_FMVQzU$q=n4BhNyl)Fz&NgnbR2@#Y*g<7!-n z&oqR^%oHr&364H~H7e_9>Nl6IsSQj!^lR!9W3#Z+$vl=%{0SyIWX`b8B|sQM+AjjL zl!ls_RpdG`KczvaA-(|zFzfXeg!ElPJxqYwYQVFi?lBvk1i=9z#2;-m0WZU-;B*Ua zS+P{?kb$NG!A|4~eZz=;3~dFL^Pnd5NfUXEiUx&4!*Z4QE04p`@7tEGUx;MOv_!#; z7`RoG7dcI)FFP&o?hY{VrqA^|Q%rQ=A~tj9iygbwgRga8U~jy&{k{|YnQ~(%b%n77 zhW{9xx@g6Po;EhwS19)Lw6Q^jZ3duw2)Ml!T)i1U8w`yiYeM|x2l*O=;B=fi^(@my zZ&d(i%){8a4If}Wh*3K0P57|Ud{YsMpNEfq*2k7ogHM|^xm?63*LWA+*aKBlmfFU) zSy|S=(+JGX6IU3Uu{&+F>cxw=39t=Uwm=jFsR`W>1@=~<$Q#WoLQTL>-)a%PQxV)6 z#oC59S`RoEHesKjXb?0QT1)%HYNJntaLM+^9%HL;Q3ASP*{`L#S9>Z#sa1v7ZLvan zLJmdX>u{wP*9Qdz)z*zIQlr_@V966kzCbD9}=%NVd- zfgt3oVR_xS8eD;_R3JP!_;dI^21XC4gmuto&q~NouT&{QwDMW$Vq08iY=J?wTy!rP zt6_hgvANQ!H(_^{Wp_X-U7%f`4Zem2UP)Jg*@lX$cP}+np;eKK5F8zHT_s#ZHw2s9 zz>8W>l7*DD;(|nR39+mq9M?xDh@%&?mh0{IKuyKi1b86yIV=X@+8!83i z3cO?!UMay4sEBRDaCR2LWi{Jeg1CtdnpCxoYcVHP0CE;J+yep)4#UC=P42e*5Ky`W zrm()^@rql#Gk1+%yJ>?t^Cf6R5XHQGVuP^*%(7l|TBid5HWgxI`b)-D>JkKzxmXlo zj8?;O8b+0e4TWuElL~>+wc^WL(5zJ;>T3FIeuQn1W!Te1f$n#dMHo7kL4#&<1D1(G z46EL1!YeSYKMkENH*g6ING{{XVAn5fLr(z#?0xwt$TGZ)Hyb0yyPt1^+0;uAHeA(~ zpbDY@0c0;3*OnpId{L!m$*r*59-f9i$!Cq^#rdPXUtPvUu?dev@*kF1S zXu@EPFw}x^G1#6NmX^?M^+(mGUj-14hDywh-T} zT>)bqwrlt`gQwuv4Dh0v-Yvc;enb4B_wQSd>zHt zP<$7~cToHk#ZOT5tO2na#WoaIqPQ8wO(^!DxC6yL6eB2(pcqFngW@!b3n;6g-MQMe#lmEu$AL*o?b| zzdiAyF8)v#f1#5B>twt-8Lm!7tCPX%WUM+Fs!m3#lY#1FoH`k%PDZJdLF#0TIvJu) zMyQhk>STO68JJg>0~@Q z8IDdyqm#ktWGp%vicUtNlY!`D96A|>PDY`VLFi-*IvIjaMxc`c=%jp|6t9!gbyB!a z%GOEIIw@Hv1?!|-ofNB+Qgu?OPRi6tkvb_+Ck5)HJe?G$lhQ7=#2Zje-w?k7j^^9q z&%_^_UgipHtmI|3V2ZrVjhG@Yvl~<7Wri_DUgj{S$jh9<6nUA)FhyQQ!W4O#1x%5b zc?MJDW!{J>@-lD76nUBVV2ZrVhcQK7=F^xWFY|d!k(c>8rpU{D7gOYAeu^pbGCkOA z$;)iR6nUAOF-2Zx52nb=?86j!nIo7YFEfKF@-i1NMP8o7%Lrj04` zGVj0?d71ZPioDFnFhySG1x%5b`4Xnc%e;sw@-jcb6nUASV~V^?FE(59GTSjlUZx*Y z>)A92flI`kP>I@Y?nn7?8qxAPjA-pL{T1=nUuC%eXSSMO}i0fZ2*Ha5@VE6FuEmU1^DK``j304gBQ{Ya!a`u_m8a7;CWy zf+6$N^pR6I3p9V*%AUZ_9io!v?u9@0>YfQdn33!;C{4jZZpIvfW_HrjE*$6InSq~z zfEhL{iCS}zO4j*RhPlV%gL`zj;N~8NCmd+vZu?iKcHlC{G6C)n2gv^FKs4Bk@xivz z0{d$Tz}_1H)(y}Ab5Gn984dZ__>g}qEyy<~fP7acWcq=CXmsz3kM2*>LYGN^uF#1N z*JR;z9&VY8#`xFqG5%Fr7;i~{aV!#}KX!jK=6{Wk`Crn)yfXpjpoZ$|6*knek@}+{ z|13V_|4IvTe*(w{qSeeq)sMz|&AQmV>Q>0QtX?&&}dMYc(d{G z-jx>K+Y;bC7OmglnE27qkHv>RnHKch6F@&04c%0=8P`4>#beR;yq zM?-!xKIEmeAn#59xl41#FFdT6^U-+U93StS(!zU30=!3}ZQ2Y@jh2mrNi$@9H1H3^ z2mX9o!0$`|{O)Mr1Q~<7N2C30e6)X)7TUWKpxqaWmW@RojrE)HvHn|HSob8r8s0;( zSbcHVqoMyYKJ@=d3p$qo`bemnow(%DK(AjPd(?F;WKCt%l}!NjaCe|=c=Tw{1MxxU z(gK}J06Mf0<3=4P`gt_glku@mrG+)00Bh8Gj{UtWL?Vv{I~yNtIW4e-6#@%EXrsYC z9UtsdX@MPB8L$|9JR0m<%-W7z~#Yv6ChdY=S+P+7 z-3h?PX|)tyIvVb4;=_G)T5#`405_g)yR_No;)DJDw7?!%F|dQtn*B(8uz!&j*n=wu zb|@O`7vh8chqS;RN&q%qtL-`+_+EUt|B)8ldlSHo*J`_rkk|Fb9!IT#tf>qv#u9)H z=xOm>p*P%ev>9jOL*0=U)WZp&2CU5BPIbW>2{{_;{`go&)51EQ0PCHd11OCC7Y*)g zd~o-t1#Th%xB!0?9G5v7ZX-V2`Ly6pCV+dWQ*zl;y>qiMlAmH^%zo$w&qZ#1@lijVCd)512D z09!zx*%{n78tM<@L;ZeQP>&~o8nB~}BKAh3>+6d>_*oBGQyKi6NPupr(@4EhcB5h5 z8Xx8@X~8_10A?-%W;DWs@e$sg7Q*`yAPn#}uz@`q+e7iOJ&+c*=>*sUwC4o3jYg=% zM<}O-@KgeX0fSXU7!A&d5AIT0;7%t1m+x$R)~;a)VjB(dUGX8lGcAbsCx95VO9$8D zaa%OA7(W_~_LK3^empI-XA+xNQ26TxKyfzx!?)cblOAFhBX<^f%u^o<&?ND0S z&ZUK|%juHG;$wR_Eo={^g>61sZwv9UscB(*I4x{yG`2U!$M%M_usxChThJH=_ug_C zmNpvVd*VZUcUll1O#m_I>?J`|y6EuJ@d17+Er5?D02pwx%NMBRK_sHbnsb$XQTDE zCqBMA(!zHk0lt6@(!Mt7iTD}~`bd1x<7t8B(*Ye705%%*h4`S)rvtR7$Nu*Z9JoZUaqNLUCl3G4?DUy0WhS(YG0>hcX z2*B(vWjmIu<9KAFdB~%jDv6S&ZJflhoH}ajI!9;L2(>XX`O zoF3PWd;0%BaPb-dgTZ1YN~(@{_YQDz@Be-GzyE#U-XG8OzEJwXCi>5~T&qiRZ7m~| zN;Rbw1WkjB5bv!CRWr7&)Tlc@ z7KP#kRa~Mp{cF|AVXZD8)NOTD)I@bfY&DENU0B8^TGD{DN9r;93pP#gYb#@CFI?5K z2v(_Ce+ngWNv_GdtkkrOs_89bOGU1UtrNYCMF4$`)>zbZSqBQ0nk%i%KCpK~Cc}MT zQT+f1^>FwwC+XG7zyQZ_cP^^gy9OA2J#g3kR4?5&@9r|JUnY3~VFXx{t^ul~_X7FX z!M_{e-;MC^CZKBTlA=}xlobnWNkh`j4e1ssC+(B=OShfa3K<+|1Y}@bwy3rQmJL2K z?0Td}x>f1{)VG^@1<3A4WJO6VUf|`TQu_cWSA}H}FlI7Y_@91h*;%Dfl+|KIEG(;{ zSS!#2RYARw(N>m`h{LOLNtX_DBjYw3z4WY`k9*dew@GCvXFWm%2pe$FfX0zrE#tD0 z@s`okQ00~}93L5GCe%uDNienA*gV{lp45=lQ&0hO7PA9E6(KzuSPP`QZMAS3YoSqd zB=1-cs#q#iL|qqEel4^T=Iv@e(t-Nu>|*i0!!3Ux^ZP=W_ZQxh3Lk7qg7kiyX~|-G zXCTw7flTj2GttKMoyfFSmrGIVj`v6Xtd23&c33?S$ZE*bu}JK20G2SXLEDhf57(-m%!7~>gZ;(*m@?K0-m&A4R~_0@Pp!H_Oc%dT+| z)o*Oo1$9|;#)r_4&jDwJg}Iq&{^;xsj!^Wvb~u|=>S9eUWon|H)#@UQjLZu>=vqxI z>im)jS_E37)cAZMmodj0I2dG|tg%gzOGQivf?0zU&oz6%0s}beU+-8?+1Rzd4&$2} z7+!3VFktzX-IED!phIU)7pkHzKnE?X3-r)gU;|kg%jCUA$GD0Sz^ip=%4T6MGVJ?9 zYTXvbsYU5~#<6uU;t`Co^S)4amObnowQIL9TZ19)#k4q@@Nsml&5=u?U~T|Kx|p(4 z4LPX_b}CDe(&KBQ#rV20lrIVSI(dwrnsTUFU0uxx%g}0;m6ePP4M&F2Ult}2LZhN* zmt-(ES+GP3TvybK1@l6svbqgO`3UQ+Ec1fk;>Nz<(C`FP zn~f2Ok;8?OW7-t3AagUBX+;$siaMEQT8sm7Xu2ZERqeE(!ekSM*WH6A#Qto2^?#j<0Ul<^P$JBx%@SRVSjmWy zq4s2suFQ7JP_U4UuDzjjmHc#_6;)ZN$WK!zq9tX^n~RUEYu#kQdVs4u7gts)ldHB= z4plSBsPak3m>LRY>PbIS#~(U(Mx=3FVwzl8_&B=8%~5$(SFMs<1X)Q;g1ku_cBYcC z;}(ojb8~!ZrodcU+$7Z?R~Av!pkcPS38TiFWZl%b1!L6Q5=u?guQjGQvdGzBtF+gx zM5ej1xC$~(R%*9#3P|nnm$HqzHI&2ieh$ql(CV-Nn4l9gO{F^zpMt%|O`EAbW?3!` zv(lJk`O-KP-J7iSd1PZcwl9>Qb{pPUEW`MBZsy#@x|rBFo%Q76Fh z^4f5JDu<_}Hry*AV`_gWQ*AbU8kXpRCgp-yOKPZGS@<~e*zh8h1O#D8E`mHZ+?&K< zC!q~@3&yCqEtHzNzmZK>WEjh%D&mm7NaKOT90la%Ba3r4x+0~=X62OaV$Dj+EEUSx zme!%~c(O(qgx{Wl42SagsGmn63LY3`HESt0&yToTkbQs1x{t!ZeWw+rvdoH^ zGNs6O$RmGyMkiCUs(x-%Bd4lVPi&JGI3 z*ct7bos?SESd5l67TvOdoegMNm?>jttZR10)6$*sjxB49ACGETzz*I|+3sMbjGghW z*_lX-9si3R+v?g@d5oXvzz*I|ogL?8&P12&jHhLHAft}DGv2}OU>>QngPAhjnG9t| zq=Ag}hS=_i$1|z*T9lQKp*{ACL1vl9d2i2Ur(pd$Z|37>X)f+4Cu+!HX3Kawn1H90 zEHnz@AN|-Y*zF8?a*u!P6dsG^(iGw0eC?~*%`Ch zxjU4dFbkC0+;lS2K0CGTi^~Fe=cjfGSNp~7PtVP84?N5rYryI!o+oj=H^mKGxH+5cAX}~D zhD+G8t7jYaiXxP>>_~1TpUq8XaibYeo4#R37;fuTmxN*w_6pbN00?gTm3g^Thcp4( z$ad3{jWvGRmcrHa=q}e-<2-krhPTLu)f*@;vsm|rvWZ)z3nzg9)R3z6iSQ{vw zR|~JidK8IFfd^KRT^FC`ZDLbETCLk}4WZMagziN`r9~{BV&_3(0foM-WCZA4~gWWfl{;!4JjOAE`$-Y5daw1v!Psn47s+D zh+L&nTNW4q*thyt(*0g06;Dzz;z24G<94Dp(cgN~kA{*?TOnrWNArjHvHS?{TINQ} zCF+`-QPgGFL0pmHm17n!z_#Zsq#w)W3i#*HA^MevULl(s$>9I_!bC0$NA2)7USG*U zkjn@40^7x!UABu%-(^Q<3vQj=2=SPn9t)-HIO^%lDSmox)~l4u!qZQ~u{NQxv?Lc{ zqo;^Fuz|R&T!KC`Kc3BxWJhz^{P}(e9?tle0D{`MGW?bR?IBO3aS|_+zrb_pk!C&2H$n4=%S(nWnnBF4`qQikk8J|Or3Rriw%{ph-(@6tJDSfldXu$Ld6~h z&dz7gJ$x>EHyoHb0{>vQ^2#lvQwzs4Ckq+Sa(GoTJ_#lulgmwx;@{c%V?H(Sh0S4t zd+VHi!NL9*Q-h5VhY@okl$cd)0XUN5>0HwE!Wmy%-=O~9$J8K=k!k(V_jbMgj>BD% zafc>+qXcCfo($y>kHR?|ItsRtQhCS3=806K&(-QY7vCb%@B}uU?`=CGb~loCdg_cr zm#!$_9zhoMCF+TxFDa?QlFs85UctR^JnV4hb7Mh!GUJ=8-1pb1 zXa;t{4b~WdLxUnXktm9#)``uYbAELA2(hOPdkc!{s!#TN1HhhkgY}?$1XXmw+=~WX zM`w&|gU}c(2EaN39IWHPtwuu?fIHk?!_UnGR`P(Q4$xb;Fk4qM=2ZuI>_w)|Vz3Io zKa_(-;s9SrV%K0VeT`=(rJmRQrl zzlNZevSYb}lY!QEhpZ`fCN2>E>kgQG%pP|th@m(aiUPf(6kuGtz|SbfL!&v@I|j*NqU!XbAaxcGjJx~NvZ9H68Qc``tKuRrRF?4&tW?!} z8rf4`b(i-fX%Twu}d|F4mMu%w1(H_05;uKvDQxqs{L+y zeT6cZ4~4?CYSlFck6og-R-wCAFV^w2e0#0B=iLC+dyIFzwdyLE!F@Os?g>+gPb8>S zFWd{FzZ(Hy7ra%9KbYQIVf%SL=R-Q++;r8e_o{>2UQ&pS z+sPiwW@sM^Mf(uy?gF7b(`EgZ!A*>2O=-Y+8u^TKyjFNCc$+Dg>aJz?H3xE6EjL;O zhW_zT^fGn2{0#Lpyh+1Zu?XuVFzCH^+Ew|~1+qzw1K6csJ;o!RDpu3ed{|>n`*`IXF?wJg^ zgm!Hoi_F%)Kg^QQy(!Ffsav6)tzLytq0x~T4sb{F6F#9~z-q2CXbO*aVJhCJ>FP!J z3;rF06t52+!IUl~b6s+zhvAm#)`t`-Mlp>0^Pw=v0g6wdWliI0O#}=`-K$0R5=vBS z^E}Vz0^JH-?`vzGXIwmBI(K99r*p_T>LDkNRq*6x%gHzsLOG)qUvmNJVnY+z3KAGz zT`ci1-iymw@Y8&5B1lQDk1Em4Sch~DWA-U(Qm0VHI!MX*TJ-VNZ}fp>q+ufSV=DDZ zTd@n;4{kSmVGRS`{W-UcYiHyoYc)vYR$cD;L9Ep0 z@aG;9%Gid3pUMhbSKMXX)R`DtgG^YW?F5Z&^>b^`hp@1H<)6bpCaU4>ixs7K zq3~2g(cMb^@blX@ZQ{AJX2ak{GI>r}A{FN}Nmylnc4dvm^(8& zli}vjQy!>M`_t%C4?PIeA%05a%0zIdH@Uixu4Yx$sfs`9g-Ibd>>41D$N)2jdteMs^9AQ*~ob z)d5i;^4>G2HSW~ZBj9cT&7M%HT!f7-P$QOG6ab}=l*kM$jF>)?I7m@fU`3B>XxLV* z#EvMLy;xHLwPZrJ0kl2H0S3Fau~wMuaO9&+c2+G#Fe-S{6b9;(-M|rnr#i`%5#fQI zaO4t$JN3ZXbIcVZ-EmA16U3}P?Er^OxB};|LE{zO*6NeaRZMhG-3IZ4iD^)z%iwU+ zR6@vuJ#TV7y>RN(?EK8^3;;L>5BS?;Ng*`UaG-bqXJ^zVjFWRnU$UDj zq%~VLc+11OGDUGWF8lp3*(Mb?53?z0PK!??bG)iVf7MwOFuGNQ! zeG1=h%q-nt=le~|hI>=%x^1Hrll8@maK#$BS%!mY2hdi4skdXzsAYf(cq}b#d@V{s zZCRx4fi(JaW#OdGw6!Uv2427#)C z*$O&WveKF!Eda3NngpAct>VSPqg$;}uPZ8a(;oD&!^Fl(It=bGz!ejy4*Y@F$EMOK zOG~&Twt%&ceJ`q3T~*NIrERdqsvuYJ7Ys<5m9~Ie8Z>P=FF+muz(w%POI8ryilFBR zDj&um5QBGG^yvaL(w0P)ohB1ymF@03VD#6ZSRnm`|6$2KTzFS}oh3X2t zV8Uj$3~$SDn1HGPe5<%ooU_^?Xs+3xw5vW^PqSK}PY|uFDHAJa(pcy|y%}Sj*}Z{T zid&B~ZZtDVnmLjgw-xGe@L*-(Gl)$Sb`cJiF zEpgZxuo2AO(G15tj_f6g&H*1&q^B^-0;gHnCIx1yVNQ-ugL1((GJIu@BeBD<&~^Cy zq1?p5^XA;7-`Kv`sDM}fLIp%~O=O%|Yd_v8fJ4}->$dS7Ce}N1JWuSDpMjZN5$?&g$;H378IKkXg z#zJ6Xxy!ih0Ow?27G3@l+_bA^&^vQvB@Z|=IOq94NgzNkwRb0vAQ`r?sVXad3(iKJ zXTF!9+~2&!r@an3laX$g54J%Kzd|(}tqh-qG?4T&l(hVZ@W-z9*U13-=V)*LDK}}5 z*Z6$%oe7nY;=4|8~w9FJ{PG;(WH4<@# z`4Q_hPEnR{A9HK=`=Xa|n9SEjEcRFh;7a37AR(+YMy8Il_IMlS^S$yuY>Lj>Bg$X? zHMmCa<#rh(-7hlv$>_$8z}JP!JyZqJwH0AUKJRpS?Q_CQdVwpzQvCC`D;TEKZ(jiR zV)`uTW2e_K-o^ACpv6<`(&C42*t}^ItNWnUJhlM#u3hbHZ!8aA|Nl9QTp=dPuz!Bx zlGH4x-*|#rTw4!M%k0ds^uRCY2{A?+wR(8WoO*cwJRq!8T+nw))vHdas|iZg-->qw zj>sm+Zo1?_FlLVsXNkMyk45R54(lFo-g}95vtc}U$w=Kg5?gd|rq3hmW5I)CO zeqnuzvt}>d!Qxl=3y$>PAqA+(>RTiWQ;N5&d|L%R+qDYp1{HXDeJb#YjHe+)6@GPnDts@zx(GC0*!9JG@f)CVQ|r!^Rago+**4;@V^p=bn}APf zmVdZDf`1Lyo7!J8NA?-;X7NpVDIQRBzk2D4%T(f07SYzV?OVH@n7;>ftq-1xS|7v3 zu!!ZQDpuZ`w#6Ypdn#|H08~EqAxG9#s$+nMsLs5dNc7_E?J;WE>O3&>_IFGnMbZ`% zrtdxQ%MtR(1{EpbW){0h_~jJ2ut7!Awi&xf_~jHSBq-89XAa?(Ht5);!Y`*(EkUW9 zGtTp7iQV+z*FvMe5lUT0qyLdJMQmSFw)R=PqxKn5-FaVH{qSAJ0aM?19d5gSeIZ6u z^^WDPho<(+>uYNN$5FF)-TtCs}sOqTL<_6`aH#-k(4a{jE?s zr|_&!zfi;V#DxhrzKtb=OzLy!SBC~ z>g}D4-wf*c;q|HKFIv@mshpDu(7<1~v_xb|cBzSF>(NVH>(Q;CM=!2VkLdNm`c5}_ zMj+)^KpxW*2kcSCcN5)Z?({SNl<1H)8NG6?B(Ay6zL5ozNJ!LEzy8Lgk6A-@g%KsMb z+b)b;o*Sgs?T5>redgQjQjr<&aK(EMri0D}TQj~*R77`W)&%04B)d1M(F5nvz>muf zPqdh{#x^<_3!Vg8&ly|ch%KC?Z5boX(M`1fF~|)mG+oKKwy2xDb<|j^$#BFQd*rvf}5TH?LEn^o<;2OFN9<0g14ET#^8CxGD&meYt zBab%oM*p%1?rQ|_@&#G+lP3*bsMg`fcC#cn+E}{)KL@Oz4YdNlcIry8um~%?WofFxAxpS{K|aZLugz|%%UV~Ki= z-jcZ3Scd!tR|T~ObU_ML6smBgA03v82&&aI2IX44p@R=ra5w^~0AT|>e}jFw-g~1U zs;Z)b|AJbnBC0?$idocK#^p*w56?}2^b@+OWrFTFoU0^l{GrXLx0JAj>tKPX(*ThCiDXdjd zovwgamf#2$KEeavvjXdd$w)(rdSOL|FXNDUUS5C`zIE+0QgL2>?G`d`Y3dRgeP~+QGVb%T#8oG;4vRA~~GU#DNuF87r z)D`=T!Ma#4*v<=3&>eUMT`Pg#f=bJDV1<3z;}s`++lyYbF>ir73yaW*O1jiKvCX&v)UsNzTc-^GK6->o z@|b5CWW(fbQvnx(wgDLB-hxLV;@OU{@gzIBBo7J_vrvj!FllN2NJw zRg$FVrDvs=rQeWVl|CThgP(jz-OW zVbw4{nqc039#YHj2@fmv%f@cYeu1w}4ZR-mpr6vK?U&KH_ct1dZ^;pWJo%eW`(fbn zapLW4#XatU!5eVCyc-!Hu(eOLOC^q11lq@R`t;9y9(4})tkxC(=t zF}MkXJO&vI?!w>>3{GHh9|jL&@BjuP28$S|7$_Kg2!jt`U|{eZ1}|dpD;RtdgMWy@ zD;WG^48DZHzrf%%4E_xU-^So|48D)Sf5G6#82l9mn=gal|6*(qW7{#f4ukh#upfh4 zFc`;R1cQ4qxEq573{GP3I0lbkAY-tE!3qW%2G3&f3982oDtzKOw~VDJ|h{AUb)gu!28@G}g4iopP=XSol9YcRM9gPSq934=Ta84T{i z;0_E4`c8E1|kNF80>=nwLAzx!{|p1)-Qr16Kc$FG^HOkrJprPft#efO;X$@ zDQ%M!wn@s`Bt>nKk~T>}o1~mgQp_ePWs?-LNy^wHMQoB1Hc0`SqbG zk~B#{nxq^}Qj8`kMUxbwNy^Y9MQD-|G)V!PRQXM+_$F0)lPbJPmEEL@Zc-&Tse+qS zxlO8AU>Irw7^V;_6BwotD-jr`5GxNDrVuObxrX#!w7K7v{tOJw_obgoKQ^t*W^Alv zWd<=uR^~d4k(JqxF|sn_7$YllFUH8qEMSbR%;Oj%DyM#dWqyD$vNAux7+INKY_?=&c4LgJ%#9c$ zD{}y2WMvLvjI7L2jFFW&i!rh?=P^cBriwALGEZZStjtF-MpmYUF|snhg)y=+pTQVe znJ-|Btjt$2MpoueF-BJA4UCbM`60&0%KR7}CWkSyGDk2* zR^~Xy$jUr~F|slxjFFX5F-BJALl`3~V_=M|%!?Q!EAvT=k(GG`V`OE%gfX%*uVIX= z%(pQ{R_6N{BP;V`jFFYu3<_sjnL&(^mAMXMWM%eajI7K!#>mRti!rh?3m79S^Ek%P z%8;8!T3jf?r9~ zzKeG1eov15tW3i48UxF92MiVXL}J`hnnLnm<{$#qXT2O z{s}OvA8DO|VJ#f%hXJxRRxt~-Ck5`y=;?J(y9oXvtL(BpWo6!AJu6ezD$XwBsVSiB ztgbd-l(z(K0^bDptoBOIr=Xr=9a-K}{vGUiB33GlUTZ?T+1P?T6AZ)W=8rDm%+k9k zQ2uSosr*U!<6Y7U<|lI>jpCAy zIlYA`%f)EOKZy_dZ_-BQ{PV4^V}jgNUcEzElpU=C`ii;tF13+?R*&>jj!>-J0?jrDkZ ztjE&AdLRMT@E*#I6$YH>K|9{WuoNGJ}%00)0N%@+SKKGr`-3u`U`)~NLy_AWP{ z8Hu)7|1Lh*ucZYxzd>NZFJUy;{~90cU!(Od?x6&555}n74z2c| z#fSPzT2K!sfEr^A#ZPu>wf`YL*w@kmdq)DWaat{a?F9F~$A|m-uy<`3*s*A^2jhbsPYdkb3Bbl{wH>DeXX3+M zNDJ;g3E;+SwH-#tmH1%gw7^a!02|QL;y04H#u~TWfKR#MW{(bU4Sqg8)MwLzdT#=# z0V^|zP9&fLB1YuVP4@4{$NExQSf>+U9c~{$3Co?p{ZV{ypGyneOagEL_6W~Gz}~18 zIO_n1Mc@;?ng*L|qU-V-@!@_wEx5A@;NIO{mli&et2AoM0s{``W}*@QkNAjxkQU;j z2@nVDv=M8g`9u6zeuVF^!nSQ^?BP-`Bu!+NKDugJ=uRX+H`cDCI0P_{6L)@1^Rf6aKbjWIlL=sEBVb0W=|75(@VC-J zcq#$H0BZx=nxe7&%lO#7kQTQ21lR(Ga(IS48r-+ygZtC8z@1J2F4wM_)}C6hGSLwK zXMBi1Obg=u2_OdTVZoJZv@fou>d9!dI|gG9Yx*H+D#MyH3D5>;tC*kYun=-N1@eIe zAOkv#@@fZzqsPbgR9e^`ObeSHZC-vMKDLjih3%oVuyvR+{ce10znvDghttA#A-dlF zReWq;Obgp1X<_Ryi};W6vHe+E*d9%QEocmbJ5%{mU8zS`-~Wma@vqZ@_*epnK_?Rl zqS~Pjuedz+uw^GCO=Z~fcmjZYd(RF|T_(r#2cs)+I6l68Y2kY^O?(~RqR+&~HSy#R~e j1<{P+%0@=j^w$1)_)l;Bd`mC}O6Um9au{Yh1I+wCcdb1p literal 0 HcmV?d00001 diff --git a/en/doctrees/cryptographic_algos.doctree b/en/doctrees/cryptographic_algos.doctree new file mode 100644 index 0000000000000000000000000000000000000000..b4cea5391097c2e9a3550cca45aaf888b95f3ebd GIT binary patch literal 72260 zcmdsg36va1nWk;2C3WktB-^r$Z73`slI*PNyCvC{-R^ElZJkK+B{1des_f28RaccW ztJIQ@hgq&NBrwYvJL?HH*E5{r<>1 zE04%hwlr`2tmv%Fh{*r@;*T#PBO@ao?0M(eXPtc({b!u3*JY)8A}^N9)mmB7+s2A= zt<;>Cs*Uy|?ai-kKhWM}^lIXQUTbP4scoEv7$sS$lr^c^z6%%EQ2d5c(eqXY%S*L+ zUwXO6xYRnQ^xgf+d_I5I-NnA|KlmQ}`_JEh@X@xs{I0g#Yb-q?ouIoW#C}7YtTL9> zMVQcN%d7Mm(dZK!4NaM8HUNQ4UZRwBm}e|6RYYCKNgVf7#d-5+MY&mbf6R!bW12L} z;`E-FuWZ-rB0*hI*Cbuij!W&PvAiM9QHr+QCvT9K7`;V@Cj44vvvWDl>IDK@t6G1G zWocHaDh;Jp)$^L(Xd6o_N>ys_>1oaY^o4qJMsFw$P*|&a;yUbuz030X-2F4!{W+Aw z_U$>jF<tF2lc< z;or+a)w0=|HZPK`bhEa+QNE%nUn%#?SIe8^&3l$1gKL{185rlxXl>EXhLUXYBv~R~ zB`*Q$YfQfavR4qYk}Q>u2}-F}y+5bSi*ph%=JN&o&wlBJsamn5Xr+o&oYN$!T4V|4 zMeSH#KR!o9Y+q2y4S9QRaKvGwho$xManq^hZBiM@*%Gk=!unh^@Hl2y+c;-%q-`u| zYD(MK!jFtH6RTyVESg?zoV}$jzgj0&_n`o$EoS?|3PL^_S_;g0J4)dol|r-XTAo-A znp7@Uq((#1gcFg4u-_@>8xp9G&yI`tRbKl;nZG)M`QXjla`Az-EXwyeOv@J2t3#Py z2xWRT$wUX!*AvrvT`9-8J6#_NvN~+Lw#(|Zp{z!v<|47zG0nr^u;aTMd<;4_vI%>a zL)hyq!q$co_HZa+YeNa!!308);u$MZ1RlzSP|Bi`b8*(kQnT_5CGA2VY3{9T);{U5 z_I``C^FmqsL?~lAEh2Ika)} zbtMP+ZAeu#Lpi0IyQeAX4KZi8apJvboTQvytJZR55fKoxENMEWnwN6bS{47O!BCDX zCTZ)8I~VT`P9yfYutv;S--$fDP1+Djo)$))gto~gZ@f~;HDoC#oe<~i6-j60iD=c! zL|#KybeB46*K_EqC(xf#ZoU^6E5S&h~@V}G_8w;iIs%10EsbfI2$p@*nm zV_8Gg<|Ma&h<1D$oD~mDPfiFsrzWX~(x~g(3x!%;sw(AtRcaLUx`dvQc|w4%Ri#ox zn3do~@S0jx7%2AV&AtY82JJ@HSW#2TC5i{btWJvWoYP@J2adI`*PY6}scHQV`Zt%^ zc&SFB!}5&Nl8IiR8xI{U&Pxpu4YYVlpf?@{8^pqJe!wp}#`!h@f>uXWHgD!3!@0gu zt2@THr6@mZ>^cQTe1_TVyfl)XIUhSaozg8%Rnf&gnH5K)0ghhcaO80)JR9Ja9;TdF z8{Jq%Czj<%+3_{nw)uKlBwsS|wRe{=KJHSpu&|I9=TK|rYRB^mDvpBQUjYvhVzbgH z%qozZ0+gtR^EK^c(L7P9%*_>@N1&qEY{)eY&m5ADYE>`K1_t5xtBd3UF9HMhb2uBE6TmBP0_n$%b!bt zte1Gn!tj9Sejcu@SSD8;v0SPqyQ3;#q0Q9BNTyyLWa^gNj~tR%H?M1&JXr)dy3os! zy3o+9J9!AQqL>8vqqyvhcgK#`Fq@hy_^BC(dRp9c>p`9@;;12=wz!F+#vkRBsqq?S zQ*&h`HSQ=-37TQd0ie#!o!zVCe51MMnq-wW9<;fzz zkx#=*xDyDXJ9!B5X}CX%%TAXX?lsJ&W^*Jp^#lPgjWzr^|jU2_zYSAeXX zx6+kZe5zLNy*;d1ac!j{J3HdK^xe{3B@DywJdkXO>zj9uVm zjNzxdcxbXBxEdu{5nOI=?2a4PB-^pBi6rDU4QQ& zp~AYH4_tPMxPg}lZw{_8HVxNC($I*Y0S^}Bzxz@Tf`l3p$SvS8c7MQ^)U0bE<05u{ zz#AJ6Eo7}HwoBpOQ=%|vxy`5$$tb;ZDIPGN^d=R(R68zdDF#T&b`rM~*;`a+;B2ks zQcgsVKUvrE-fJ!s+j*IAlDjt8xbu;?y7J}kV{P^dk?ievy(Twd4x-|3H)A7V10%K!*~7EeNQgb| zYF(zmZW_JC-@ri02rn6wveRk$BVqeTU9G{=;y`|oUxwW=Kj+5I;3hH(IEpi>D(Ke8 z?0_)nsX@;5jn;KC2G`wMl*y zj3m~qVPPb$W`P~Lp0VywrZzhxso5FLik;wl9!GT@RUQ^b6WF2anX}`*+Zj#C&PZ0e zgNzb=XCy&)D38q9p-gSx8H;2`VjUUlg|X8RkK{9JwOCdGhBi3w32kK_5&SKe6T@!T z1v4KnOVhl)oVYHBnXS#!)-HI;NTJD)VDHCa!Kr7&lehol#PIRt*Xhi7a+P{pBu{sR z`cpYjbDSfN1o&S$5o*1k(`9~nuW2f6bKmw>Q|>ek0mG&<>9Sc zne>_|Q@dte7s*bz0wHaN{B$tn)ElQ}fgvA9P7KF;m`OgCGO1Z+wl+`KNAeWqMH%VO zScm$Ad68Fpoa-Kj{K}J&7rDA~Luz)0vgrej<%c-x*buzKen<~vhpuPb2O`64-`SCx zo#Cw58RlSTIDs9yo;f?i4m&qSvJ<61nLV41@w_*s`CBws+n!LiP^bBqn8Dj9H0za`Sk?=J{euIA{;>khI}_L(a7+-RS-#q= zSSn%aaFu-zLbHGsK`GY}CuCOHdX}J$#y%8Ji-}YF$1vgib^fdN~m~ zJ{M%rJHs(h`# zV{g8Eb1 z#Bhl@7Ddcr0I<29isbsu#I=P)%2k@xInf4yX{=|G?u%`!1ZI^@Jgo9C?nLS^{mhfT zGm>;R6=G`t(7-lfcwkWQ40DrmNex}e*R(lID6S}YQa%SphIo3S-2&V1vY_vYI<_~ zunSyjYC=Uik;mU!UBsV4MVb>UPA_n3f8od-M+!IM`;FkQ}Vjfd6W0Go^_G zhXQqdk=pwJQ)^fsnT;O?-mZ6Eak(qm+>wMYmZ3I>dm}ldFXLPeT?boCtNeXp^8;0) z&r|DsC(jUR^g%ZJ+_&S4u^WlBgX4!>x*D|_R!dN%#w=@z(Uz1oake4Q8KFjV;RMWZ z7W#+7=4dRzB@cG%r;B>jc9oQOu}gn{BoH?DMA?O}lBfo`aLm4L=SO}DK48N98u|jz z`QVQ}%IO~p!_{j>50osO%v;6nVoaR(mvn0z?14zI?BgQ>n>Eg*WSge|?ca-l?qDRk zJIN;xn3K=YRwQGzX9Nx7=^q0J_^?jEvKmcI#79gtpGKIT3@z0@tNhVCcraUM^X6F> zIrpeivKe*>zao-@8O8y81EbbpEk5TZoySTgd5jDdG^tcLA{?5U z5T^2oBcP+uKQJIn<0&Bkd#Qx$9+dWP7ZmiMQBRS-ZTsO!+qaSJ(}xdi9qq@&t^R(` zfHMQ3*O>I`4Xm#rYURRk|JJckxm~5`H764fh~Rk_%+E2t&UPeNA`d) zSu1TD>i4`bEaa=an}oo%9iiZ(P8f&D%OW+6hg-%UdV{uDx|6j_{yK6 z`q25$yXYM0?bZMr^{tVp4-x8HZuh7XeP4}v*QH~U<~EzKx8D$y&SzU)5=?ir0p1x2kZIE`w|gElyS$yQ zU}3FB6H|#hJlFd~3Doq{g}K|-*;Br+4fbdxSaaGneK#UZ9;_YgqEOAMTCQWh`9OaF zX`g%1Q?CBAE^cQGfg87*J>AHsgYsR^&R`?5e zg=v@OEoJXH7jmka8*hS*{#B9a71rnqldPo?Od1YLB@B$9(|hxTr|?-5Xg|e?8dk+S zE)~L_<}lmLOx~!~m69$DYzun=xwQA* zw$ZQl8m(S}bq@n;E_iJB%omHzJvbrEGSoW@%yTNO?e5&JVv_B&o*4CWhXzIiwxi!_ zjxOjmfv(~ayjg8%C-E1{Jcjw-awMUc9$)jEazUWiWv=eS{EFi?c1hgrMdMq?fvtlQ z@M}fa1vVA}9jW_$${9L|t8~8fLVxJ$LYD@roG*=s2a4ydbHR8nIXivi@Q8yiFUL-s zGcl4gHqvVj9Gz_Hl09++{cT8P0o^`c&cag*{i9({a%tQhy^JNqa~X5Ko@VY8$ykDw zHeWN5e4R&CMQ_&YH4Ow6@o=DT_e+pHhsy3`7(H011+SuwHBK^mrqG=xbk@C@aeG0= zQfLLOiEpE{!a_|uh9$3P6+P?}JC7G|tXEr`(?l%DS|amm=5nE^D80sV zs66ZP+H11PJ@PVYPB-CV55{Bg;?lijTr@#lWIMB5@Ih!@Oayz$F!h0@XPp(cYM9Lq z7+3E@9C?F!g8pD>Px)%KNrzYl#UHX*GxPKBt42!^3*c?S*?_nX9fziiSnj%oVcoxg)Z4lC8Uj%2Cc?{tDt(e94iU zn>Plk%rAR&yrRCRsbE#e+|0=w4Rx{)-Pp}{IxAY`P1jjx{0Bkf6#H8_iv2BA$WB?W z@OS_#_NCQY!{?3_ltr#0Rp%OVt~Sex_t4?-93C|E+Z;DkLyjRaDWp-}1 zR;kn$uq>sw_OiMUA8_itCCuxLEV6Q_`E+V(uqLS^Zp^iNFtqEFT2qA~!pjmPPpbk;fSXnIy4iMe?2p7V+PZ<^$Pot2aNE&Q>)+p@s^@H?23`V8X! zJI;f(U$TTL1aAA~kh(;xd6%?y8STMK2<>D?62Bj=-m+!f9s=C5#T0B56qaznTq{pn zwWkN3P0LQMGkTpA&f=MBFD@swgv%+54eAp7NvcPF^~4&a>RBAAes4O!3#J47p~C_E z(AR9)g4a7%gJxk@SKv0b*Qi&M!6xQDH>wMIGp=)jzLLXyKWMBcs$R~KDmCas_R4yC zDCk`t&~8*0^fW){DGu}fpf3XGn>kXY1HBGTUdMD4b0%Y>7K(e$#l6}W+l8+1Lzg%} z_@Q46=rbIte9)yxbtFOjomn4#%j!e)O7;}>*Je~xJDJ|h)XJUWu}OWtqgHKFlWJP; zmMw=44~~q6^8P-T_Z}9@<@-^7zTd;aoS*NPfbVy4q_X&aghfq;de}cy3$=95IIZmG zIDq-By#&^NCUa|d-3?i@*ABhA$T}i-TSHX2>%EWZ(L+=_?k<}BNqWrcb(Zb)v>nD8 z|84BYf|Z_|TZN8=z0{`x6U!z0uEw<&#!|NFg!;cI-LvXTFnUEE{S^J&pne;Fj1@G_ zS~)IRYl&i~2L{#kG>WCqsDFcz+|Rk6k2z-rU}h&e;|t#%7@eAV)oaSmJ=%=&nj zPv?NB==u~R*~eoR;4L6ETgV|9@%k9t|=t(H#l|4T}2N7 z<9Ja#bud(QU!(#sRdZNKB~2k7g1yK)aWYiW z=)&ocwEKcqk)*j+r71S7y{_Jd>{1n5{0&ZB($>0?CPWQwyqgNal(kj1tWjiF+TO!T zBfj2S()Lac2K?@h_14vgIZ|2D_I4IEb7}iD2SmT!SO;DG^UUqGrEN4p+HgG}ZFYH4 z@A2EP%au0FLWvP=dtl-jO7pBb?w7W|#n~unqigA;jcofGQpMRrx|*)6&$P5HSrH;_ zzal!#O)~ut$aLX!NZSQLt4P{htKyZ%@9J2sU41TXvBlru)TNDv%LfLxPTV{p?2a6^ z9RLZIwypNXcExRoc#5eXvW^R8rBB#Qxv?8Zbnhueh#n~v4qig9z4r{NgC8SF7lyqf&rbX^i z;vv|7dn-{1n5{0*`ZIdsKLk&7A){05bR z*@0UCOZ$B1kSAUqf{n?1z z(%$qUw~Eqqh}>B?8zpjdEuF|=g?IJE%sD&LA~!}n1V!#@qBE=~M;A_q$V~^WB9U{g ziq{~&t7GYT^$KLiDRO32jlY3U{g4MQX_zCmQvU2tL7{J$LX;o z&`UGUwWn6;!W_QXpbd>K!`vUwOt&wYsoiO<`{m6Yv)m4*o#jS*0ONbv1N-((?Vp^Q zv~~jSob#4_#!gr69_D-Tg6=Q+AuwmMGpmnrq_W!ckF%(W?RoM< zwx^Jhg*kL0+tawt`K0zFhxz{MfyI~ACpc222JOyH3w^2ZYY%8Qs@rq>EkEdAa+vQ2 zjWw0kUvQ*K2byal+xdM?VMk45+khyX<-HzJgUv&*E$~CfGRf+>9I1TJquVTMs;rjq zV;qE96WJ_*d^_4jzZQ2rgKa8uC}gKgcn^!^`q*xMq9-{h^An8~m(_8OR2I=YSky!{ z@yu7VWin(2TbTox-&(AItcsai`%?eZGT#igh=Ja8v(a7ylQ9;OdN$gdC|$>FwEJ+@ z`=}6{hep?f^U(O-xjkaq=}dTttF!jN^!rR31Ml2|HhO1nnfAq3R)4W$X=n8W?h|JZ zRq=FAdZr&|zD(s5e4P0V(HZtQLl;iRc2|VHi+c2w7_e&1Ueh0^@)9NocQdtiEGZr-? z6<)tG8JOQ%tm>?ui&UKD%4w}VBC|C@a`_}ofL-pe^H#2RYa^7VW7@!Gob}4ASHkF8 zx)B*H+^k-ORM~QNrX}od;vpzu2XQh~!sx>3kT5N16-k(DRlLIZT^;LNtNV~$s$z@3 zK_(J*FtQ{0He%nJe9B_E9mzjp{Kr3QS`ub(VD>YG)v48oI8s>>_C^*pBMJLB2Qa_2 zSk_tnSmxGdBVk{GU1=rk2};u;VPC@8C<&u$=_Cy6I;&qmD$csVS;A*p!k#A{f)e&q zoD7vPx^OxqY}KlORU~1qRq+brclF&!`J=SO7Jq|`BrK{Iwh7=}3G?;Bwh%9Ty|Akg zHOW=|OkvGybt6YAOTuz2YDN;alLMIFTC7d2PGoLvHWDVnuCx-SP?`=2y9;NdB#f@5 zlQ1k>tsX_HB)>>k!e?5-+QdUp!d{P)p%O+HPKShjBxn^$m}^zM!uVYsD`l&%MRuu* zE&c|lE@3P2AUQF)TbMc=`Y8ED;@|9tEw|#iJ+Z%GWx&-F`vM1UKU-KLTm4IpRF;$f zcNR5K#)8w%Eo{Nl&MUC*aX|FjjTN!gf63hLYy|BE*p*h$maGmFw0}cRQG!O-(g_+C z)>eO=IcKXnzGGbcF9!2q%O_$a7cV6W*=SgNUGX~-*5g($K}t@!Fe|`f%f)&}F0P@e zj(ctoRgGH+u&EkrEY+~0yW+8znBwaL?dD*?&mGqBR;M^pS>kasi<-H3$Q%&;c4K*M zRm$A%Y{cVruq&;2yoJ(q^oCx8vr*zf*V2i{VQ_XoQgPN3&ayre;_(^6?(G4QczgsW z(~AdI30FUqmXy;e9+*NHAs$Z>;GlT0=&pD?MNILD$G16H@K-{tHLiY>Bb6l{UuRJ> z7mw#SAo}gbqT%Y#Gq*b%@mRSgy?C5QX*$GXInG9j2VF}i9$0}~U5Zqk;=x(gXF@!7 z5cZ&Wq$Ouf&Maw`TpvG z<$%>MaimHO+MRS4`n>dG4`?^4+uivoKjxYkuB}bDhGDnxEH) zD4gZJ3{jKXaX<7jpfBM_<%1sGB%$@S=jT1jL8vu9&l0z+=I5>0vZab`6+-=NyURCL z-K|Qlhh5K4^HvVR{4`6Td4waCMe`twny4jwv-9rY0Oq$A%XF)^W^QdZ-Dn+lrF{m! zkJ5B>qiZ-D)s3cW>AKN#;H-jFN!2f137_dV5+5NRyj^Nq;P+iP8Tv+oE}V`x5}yrP zMWY0+Rq^uVcXb&lA3=7hiY@*I)*Fce%eAYiZFnPr6(WiQ#gR}AdkQ&Q9fajpJXgk^ zCTu2SmT!D(wD6=62hH zc4~`AtX}ICG`>Y7E}%3WpC0z&Y?PqUwRD1Z44f@PD$bh0S=MJ-&~73gf`ZnMlc9n} z7fy$u9ST}Sg63KkuQz^IuOOv>>{1n5{0&ZB&@fjwdhv)Vv2Q-(^{`m3nAI8o@egg5 zm{mA1`tQwm2aOU!0j)I>4k>ysHA!2H%$VeLbiTWd?$sm;~>Q`nWZPxct4>FASv z2xp@tjIO1Vuo^h~08(+*1`E(P)0Cz|!fwFXC<&u$=_E`CXWNk~$uH8C@R^pd2JsM- zurf}DN*G-@9TN7&pj9Mcu2u00<9GE2Qi{kfRk6k2AR`HjnydRkV&Cb7`R3|=nDNim z3;O^EW=n2k^5P-YD{%LAn~aNmyG+t!?7TNA5546>NC}>qd zQr);PG$OX)L^QI|jMj`<92r}Dv5lwO?C#VqpKYwc4$K-h4J%rg_8Y70GZh8zP4*ir zbg9w6#&mkyScg41n+>I+=V!51SVO8}571?|iIt|LJ6pf7y)XA0y>k-w`xLRgF|z2z zmfYBWRh+Nm$4c`~MPz>rKl`koO|61os~fdaaYig1qpKjFnge6~Y^~Oyy%RlG_MC03 zroBI_&H3U9Y+^az#+fzP!c3_b%{>nrI`X^3JR?=4d4SZ53nJX4maVJw{JinrY4t(z|%HXSH$XEQ=F5)b{W6V z!Fo}~d9>f8RxXw$>@ZZuZ4}1xvQn)&s}MiEO1W5vrz zMe^8VlE(IRX7@m?$KKZSl|mctEY6@3l^b$<&kEx*xaEA­6574_xbV^nZ8B)A(&w?uZSkHas?RyVNB zC`9UG*j4f&ct;I80ArtDO9mc-1Jz1Obrx=5>%w|c3cWcKh^Nex|5j?ESs9lyMS|PR z&tM;9y>SvI$dc5+O)e-Q*0G{AFDjLyST190DH4#DvCi6m82(zBH6`sKV~JEf-p0CU zv;`I0Rhj&3tx_#x^IZ5|L)7LZs1qD#9gKo&H6W^Ro3b>kL(MnIJLPNTqw=)8Aj|T@ z^6TVJ$nTdQmp>;zC4aSPtoNm%hJqzB&Y98L@=l|#Buk}Zf&y=D%SVk>&8qjrg3-%% zUp6m4jM$2V&6v%fpD@;2`XwM!9pnh`Pxl(1KhFY(b^N;`u;5M;M zy;NFDMRIp7q4Ts=fJ$qZsPy%}O5e|_^aYwqUu~!~`&y-0lq$UgR%y^trN?%aI=)U$ zqwEf}GPg=A*Q&I#qe|~sq^7Zq6sAn9u!ixjHftJ1-B?b>npZZ--T(J$q~LrCuB6~{3I-`CP;es!*Hf^Uf@uowq~JCRW+^C9pi@w%;6Vx=px~_( zyqSXcQt)mH{*;0bQ}8JYK1spQ}8SWzoFol6r6Jof6nu|@=P39&1us(YJOzE!8(U7ng%q4m!4(v| zoPq%g@)Yc#;5rKSP_UbVJ1Dr70*Qhd3RowQb@BF6cW@d()958%Zk()}wO{^zOMb2; zzu01~++uFrVlLcb?%QIn+hT6pVlLZa?%HCm+G1|nVlLWZ?%86l*-D1VuVnqywQ6^xRg;cC9R-`RfoGn(AEmn*zR)j59d|)1> z_E1y4nDqU-@;^X$ek4CH|JqcYv#Ihj)mcMFOm!}$Bc?i=>4>S$C>=4?nV=)4ItS^9 zsm@(=#8gM6Bc?hFbi`EW^>oBk=N)v!ROkJ4#8l_c=!mJ#XX%Kk&f|2%ROd-LVyg39 zI%2BxGdg0b^E*0Xs2z10$XFDA+)!9WyOm&XX5mOzJj+p9H z>4>S$eRRZBr$t9hb>2xwOm#j;M@)4dqa&s|pQj_HI$xtBraDj45mTKX&=FIe=je#3 z&Wm)!RHu)sF;krj>4>S$6?DW@XMm2F>g=E+raF7*h^fvUbi`Cgq9dj{8XYm!c?}&g z)iLOZsm^=oh^fv;=!mJ#U(gX#oiET4Q=MvNzWQ>VaCtY_u3jiuBap@%=cf9C;uX!Q&>pxaNQ344}d)Iog~8DrGR+}l(AA%6LnYxHl~ zod%{gvYjT0!_2btxS3gksIkmY#pq;4JqziQc`-NOlZ^Gw1Fr2u%(apTvo?ueXUvYH zx*cw4O?dF^$?ds zdS25T?mN(p{0!z280_$>5bkVO!t%=rKIBl6-whAd=sC}>T$eNGvr_r;oTBG2$dq%Q zV#}W0Yp>^rw(ZoQ$(!uDa#5B6|YU|-q=*qdU&qC{!< z(HxDz6ZXk?$aQ|m^I1WDSr?G6>4aRF6U2l9eKSA0H)Vw`*9E%qPIR6zg^d`uRpv3Y zq|uX)q{Wx$hxsx8NmiII?*em}6T9Om8!@D)h!y2t=E{0Je5f9xgYQ2sJ3Msy#q~S|!iMAEm?^ zs(9cHe&F|H1$;{vz^{u3&LGo^+IX~Y<460Jtk7Q51=?+qXf24( zP6oQM#`{S8TYk{L$_jL$3(%33IEVMaRkXzTt0idvjRJ`XkZiE_yj-L zW>#Q_7Y*!4yc<8v5BBX@fgM>iu%q!{Kh6*KV_AV6T_mt0Np<$i{9wP771*&Zz+NBH zx1d)j7-f=E5j5BJ})g1fB?xLY|&H=)*^zk$0C zwGL4;=|gSr0xCxzN*GJ3wRwK9*JK6ux-P)-)LMW|g1eg^?o?KAukQjbU)d(q*%^MY z#jL>IuxMb1;@jH$`N5vd3ha(W13MfK_Fep7AIS>rja`7{tF?)b1OJU5?kBQ>ds7#1 z`D$%K5Bcl-V84ux zaC{3Dk9aRX;_0jq@9YBcKqq3UIyA6N7#lrVv^TtC7ZbV$-{MF2jjYh^=>pwwr<1aoxom1`^81<}^TT{LE0}w`fLVxv z8Skd&T*Tcq_(N6*_jQ3VL~Ss?DIVLU{Mar=)J(cP`@6svQhLfx@Bp`-B-Rep$bSwVb77ZAgy>(HP)DX3>u zek>mC>-o{XHY>D;xJ?OJa?_!`U{}pD)dglDv^O&}Fq$xl;Pd?WK9?1~ySu;_GSfCt zri!i$rW;FoLZLp*5Bl%20xf0(x~z$_4dG-{mu4+r#@nlgR2J|>Tf96y#}E4FS%IGE z0(96&RkP04xGK}4i3uXrhj%KRiw`VE)KlpEm@Btgiw?}XNF`&X^Hn{Tc))6eO0`sJ omT4KVIa-nHWl3MVZ`zOl8tpf>MWe4w%iXchBHH`S^+5CgAK@68lK=n! literal 0 HcmV?d00001 diff --git a/en/doctrees/differenze_oidc_fed.doctree b/en/doctrees/differenze_oidc_fed.doctree new file mode 100644 index 0000000000000000000000000000000000000000..7a9294ec26bc8fe19e137e89232ae49c30b8db9f GIT binary patch literal 47614 zcmeHQ3vk@Vd6p$n5~+tR$(H<544ZKz)56{HEyr?jKBvz#eWmrJO`p?rlD293{Qn4U7~fQDM!`*BYelOE zo>zM8d);el-<9VJg~H`4<-S*6ejoh%o>yOfe_Pplxvlitn=i`O@U2~9zqO6IvbQuP z$b#8cb{O-L-6xr*uFkhifPh)vq*e{cp1rkFlMDkcLb#_P)t%6`YOCr0n3pP7b$Nl} z^j@piju}k}p>AvHvLWlsa=T@3HKj#-qOJ5P`;<*~Z`q>>er;jwJOEdXB7)T#?w@j1 zUQipVscH?Qpc`h}-ds}~a{EkAYaT%FH(K+CshU8c*5KlL>;roT3I*Y%dHp2;%Hh~C zK{4yKzCJ+^9-Y^VC;AwDo8T`0R1e*D?(VkTUk-TyVF*}L_5)SQT|oXl@b3WpyAS@| z4^(Yg(Db^5dBvBtm44;5E#*O_q#RTZDG#050tp;$MI>NvoY&hDO9meq;2zneyiVB! zs2_Ip3Xr`4kyRAAa#d6-TH_@_txJnCU@R1h@IU=Biql%TqUx2JTwc^=xlyJE>XLr7 zU@R{p5yw{4s;L|khDJR$dgxi6kJsO9+76YmoNbb7Kvt&5&aKzKyeE|l&7cs)#>k;-A zm$2I+343=WVYfvRc7hCqDkn2m!3b$66C){$dps3qee^VyXC!I+1El${Vyu0{W94D7|0X{y3vO%hVaIgY?zY3+BoStG)}T$XbnxMN)Q2JR%PA5r|PoM&>HX$8w_<>bx7N7 zKf8W!@EWm?M>S&ho=)V^ZPLC-^7JV3WN4dw@+N9E!Bk{Hz9!Y1HQ6BYBxu#ENS>*v zhEE-~>jJncLS2>`reJEqJTWFR#^gS?(b{d#=9_TaBkI%Xhys@`Qp@&pMD^NROi5pq zeg6>J@fqN(d~RlHQam|5g&vC8G>#RET2pSQ)j~ryi$+rh&&atTg03~>iYYG0phciH zT0IJ8FV|&Lf(BZ;DbW3Mzy`7~QWy*x9s71hfT%a2DmyRZ$nfs>>rF2+ekm${ zWuLkUMgkdQ?7SwHoy7n6u}Z{ za9z_^%g%*bZE>;eb%DxK%TzQS`W&(W)v8%t2ocs(TNEXU`71Cvn1NU+PpAJ-@BaDePzn6i$KNjQy z)fgXS|71;4>&AIWht4Lr*J}q&h{MT*%KsjY0TFu0@J8rOJ8$F|aib9<{hiT#U721h zL(!RJbUhGDS2ax6oUE%-O}$Qyh>?}8U@9T9?&isY@c{0999M2EhpUcQK2=lMs0!tf zG1VW-)Qe%JPG7osK_3`XUYnkp z2{4x~H(51^OCpIHG|VnHanuB(+%z?O#uzmZ#!^!cYmH-$TyoagDm}m}kz;OLuA+>S z8=E&y5wU&#a<);gi{%mXv4#?e4et} z@L&!ZQ-@-i>agLHFhmbDX;Y5frfD!6-gE8ErV9F-FZp zvD7rfm29%6f-jG%h%SAF{DI6IMWhuXOW-SAh2mqi^54y|=Eh}~3iH_!*Qf7vwn`X< z-|K-4#PaxDm`7xATGzGAo~M^Uh_O3(#t1*Yg`>%h;M*wKjo@?hST=6_EHTA;IF^v7 zIYKVTi>hHd0~G0XN#~x58`jwClEKI2sBmu=LbrV)j;AGpPr=U&qv3EY4Q31t(6K=M zeR9pC9+4Rdr54f{<_`oOb?REgKnU{(_}I{C!Q67OeG1Rs6ouiOGe*T&M)4y{`JB_! zn^KL6wk+#w7!j$mNBmNx&!*l;*=?>$c@a5%a_<%Rdp;A#(lX&a?&pEwF2v&IUCJp2 zqW@f$k+aVC_n+6bWfcYynL>tC=-x0Xq82%d=En00>epgM)6Qfkt248Vy<#kTv%b~{ zlg_9q{LL~L5;YRS%n%!ob%#FKK&yKjN4Igf7XF4tMn=<;flqcSO(_<3aG2E{9W4(Q zhSHm1e~{06u{W9t3568J8%7lkcPMsH9O7z_cfa4gkC}n{el5ynm=zOcN-?-bc7_Xs z`LF{Cb!BH*986>f)5x72Oq8)Rv^I8dWIZ2tl7{G+?u;a}L&N;Jvx6C9>Lm?&dsWXhL3p;o}cXs@bIb&;NXEZOn0||B2ozX6K2h+%%9ZZzz&Uh?4GC4Bt7hf*Q@^m>;pK`K9VLP;^LyveXZ7BCdx z$cy1=4`nI9QZ6;iNtW^SXe>{0T9lLh8Sk(@QCh^?9`8QKP|)(^q(#2nIlg9ghV$`( z#tXwK>ew)72kWFqv4i(>_JJ^COm|MKnVpfm*cnN|&PW$_@P6*>jCkxk7RyeY1A2K6B@1ri7=S5l*#W^b^;UaNkXF!WK@>W;4iEnmFMSrtF%8?*ofr~Rs;T5Up{h-qYd=*iYKanZ{K zSM}(w(7GlB?)nvPp1IZQm|teG9*<=cr%IR40)aAdDIuvyu5Yl`F?&HR+>7NX6Pc0- ztRlM{pU!P!Q$kwZ+g~3-Cu0eH012H~3^T}2X$;lA&3KOk%6|LE?&MV^kP<84so4Cy z4f9je8jCQ0ds(YU^EH^r4pZVmwS#5Mr<-olB^Fm1wOcAX-xerL*yI8J7$`vCXa>X(3Me4}<*Pry0v82;fi0Rqk!K32H;E>1-bED;wO+zhc`XbCA zuBq_Jv4|I7+H(=&kCaMf{B!gu{ThT;p;#I!;Qxc=u~HG1+Tm@yzFY!P8jNZMw#yCg z-5i;r%f8N*d7WL4>@ht(6-(J^)YGXa#mSlJpi(YM*RR8}HmS9+pjKd_r;IbOfw-bt zg*J0=v^Y3a94-|HM<+^0kCcuUjm1#4-cqfLu*Qeu!N1~DaDt~G!#f$mCt?wvMTCm-YU6)rfh%>PeX{N^1 zS#fUq$@6DtPR>kDJU4T0c4jRFI#en`Ar6iJ_*13Q;BZ8N?y1(mHp40(6*Pj@L8)Bf zM&I?RSVKWa=7q6vI+g{RKt4S)H8JM{ms`46ldl!vuhx{{Pq8L1N;S_5oSrRSeCA^D zF<3Bj9R9&<<>d#5C(fNNoGlkX%i&YW=s1{wLa8)9jDM$RPleRH2PTI}{M0$`f{*=q zrUvVg9Y)NVSYlSN2B0S=(z>L{a~DE&eVy9-5L3IzN2c+^(AV|OJ3e<6#vPjQ^~xyY z@N6uHxD?Lk&{wea%vI1Qc2=Y!eO#>zT>LtbhAXgXeQ(DSvB!|K^Ai_*x=c-j?GaSj zT%eX1+LEd+Etn!+5jC6(C&CP8u{07jM`IJ*;;_3vebi%2Ro3_xR{FECKxpoXdJ2{y zVGZ)(IKFP@sy-D~EW!L5T=M6w@WWL&rQs-Cy-xH{$>PO=TiiazuJiu7y_$hN7YmkF z8zI=dac;)EaRtbJuLHXCvFM&fojm7EK7+QRJ4QAmXasuyFmM1X=|tE^qoqp?7#+Yu zotcU()jqfUp?TmiyH^X&RUdikQKjzLU?u#9SPtfi1N;JsZGkt|HCh-?PY0XF#8#F$ z>#XKXXF%%bLQQ&qcWpHHAiBnqT=x~Yqs6dHVB#p|V*_yApbKH$0M5X!{z2M zjzSpF#fuoR+W}8$A}s62r~!1r>pnWq^k&TfL;X}N>I;ba^d-(J;eu+IcU`$E>wdEd zxh~=galY|f(hON#f_(|Z6?tBiYKyq)RjC^xjoh@f!kZ)arw`JzLpT3o2KVV$xYVq| ziZ$Qrq<*X8D|mRFQvQg6Xu%_mO@DT{F_|42Cw?Ky)lH;xc%hu-3;yXv1l)$?w%vG7uHz5ORz7D z;r3x*w=~)$&flgYSiswyeCd2C^VfXHYpS`)Szzd2h()hbqbp8POCvfo%*hoP7y+mE z@ky@msR?AgI7x?X@RsFbRBsMun>ml0T2rkU;^5J!9?(6i2>U?!eL(N2`AU=13ykLE z&EYQ;&1cQ4AUB;)M%v|A(uR?=3nwSXM+cAiwF6(QFH}UiiknlA#|1x&@DJmKYQa`^ z*`Le6UGibQj@A1vsk2PKm?qQQM6twV!!yC$9P-n@xJzrzv_Gk<9Ghv}G7LT2;lZ&` zromHn#uE%p#JkYxZZ%AO75>6bj!_!76&}HuoOW@S{M>_|-q-qv;UMxj!Aarl2k_DdOc))mkEepr<$vGJyCyhA>q~+z4 zaVEubMq|6qP|<43kl9!fSX@)Cis0y_y)EMr}A z$@rR&<*Og7N>yE0kYQ)g>oWF(%Gd=j`x7gV1&t7!MaA3f{)SmYy4zzEK8)G zyq}EMs4n=Ku`d-B*bS|yw_vrDUR=@itFY@8j)keR^E~umjHpX=9X`qV@AR@wJBHFm zplVany90^5_VK&ME+K|JB4w|0vFKd{@Ua&XDSAnX}RD0*=#hecg#Dtu-u7jerp z7obpsMYjg+uf_;L4D+(N0-Jx*bK)wdw*(xfmG^BOAFn7RTfIToEEY!3W0TiX7nd}8})hXCR%5MAa_#AjU;Vu0b zfrcux1y**$6bxPs@9&yXM(lw^K>pi)It9f)h1~9=j6oIIZEtbd@Dp*ey!26??XG08 zoZg$nssD~&&5+UkaRuUOn3Hqa+s-d+ZqZ-_wSN~d!IZ5v?>}kpbyNZ-Zuly}HAe33 zfX2XWw++Jgv>ci{4HIf|*IL$hQEwTh@FZ+H%$Vgbd5Hfm1&?l>`T}MsP^b2U>eMrj z-?CxDOe1W$Y5z?f`p_^WBGq6Xm|UTc)A-x5n^IMy0TV%6AgkzS-eC2ojsu~%gIqzl zAi>5J`eA45N||QAkv+wF?6(&JR7vNo3w2oMD^y`~0N4*) zkmj`(Ykv zTnTO9s&Ase5FYh@(}YEE0m^eK^uXln*QFCzJOlAe&;Qd&E`;FM`>&9`DjVz_@NuXL z+r^fz0oA-weDr3xcj^ilTeU%(p8F2U(&ipef86VHx4l26VEt@vgUDgejzhY{M@2c)JeU zytbG2LR$7#xPV&-!PegRUVA%8W^LOR-Nv10A&8H^DSg|+lomsqZ6>LeI^<=5qDJQOsaDgDm-0HV@c6|b+x1q zKhZZ>z9Nu=g~Y zJLi#sfeMU0p;vTPy(+K3{2Yqy+%?FXstybsh5(#MfK?VX3O<*>S31MF-qgU2S}oV4 z#$pR*pO&5U$fyqtP+^zhLoRF)T2>(?+MPJ)QwbA*1#G*a;&fR$2LX{g%?a3NXLmNp zJ~-z1q#`ZLsV2DDk`Drh-a3~n}k*>EI>}kL0P<3q5 zTQ$yyM^|s*Yf}<_Z97f66!gKiv4UbA!Di&yf9668{d1i^OrC1^{+L4dQ;o{WR&-pU zBw0o_!7u-bYKDAlJj^u`QLo$=t$i#9dpcFq&(QLEWa!R;foQd7S-L&ywx200L#BGD zO8IF-5w$m>#<48j8mfzaO0Q(d%?JMvRb$`++lxrr$GulmZl+u#=}Q+$QGDC0pl1Vj>U8gCoLJ! z#LKJ+4?f|H-k={Ma05{M2vyWT7q~$kIb{>pydfF;F7Q`iSP8o0G-g(TV?E|q%XHAq zo7+pD1SMQj&_lHMM@EE^GKhwGccSsI85oug?~ojNJ2*PZE%q*O((w?VvU`5cti6L> zA$M`s-e$mbY-r=)V4~gNn>hy!EkMT|PauGEYMz#Aa8!ZkuhQ_-tlhgP!w?*HZ`$w! z`Z;)-LA?n-wmWYsL-JSQXP^7CrPtusPE)It@iZX33vcX!tm&(5d(VQVnb6G1+|4t$ z*gLUz(rDGo*Kn~^8?NkvW>{@PanJ!s1|)fpb47MWqKq<@K8%4lXA;31-3Po2J8)}n z-GswcmgQRe%tpIUfn#OZ&mMcXd`$(qK#yC7f3>G7&$kxgb-Uc74?}bT9nqGxt zl(07guYnEFfrBmJAT6lKPp?`ngEzCFUTZ5`>|HpD11=D|WN*Zw-<{P~y$P#WT)hKQ z=>n~egZ?%qcq?52W*Y_;y??1`$gQeYhC`$v)@@Gr7#0J;x;pns(h#U{%PQ^Pj%h)6 z)xcFrSc{!pZe{g>s*1e>@W2sKPKO_!*y+Y}_I}5ct@hzA@bDg($&G^mP{5dA6-sTbwotQ)qs0t+r1h2|>k zFW;b#Pi^}Sj7b@Qm}Ri9P(mghpCvcN2TLPB=`Q%x7fK$l_{n?U_>#YILnjQT+Ce3P z)1KOAw%G?jE$d~kc6wF}7GL2BUN`L9j8z!_y;fG#MWqJ+==3cd^|N;v(6KSgZ)`!e zHh`$T^xOFf%f%|N_Ja-tJ5W(z#JU0{=u|ggnJC0=QL72B!1K>&^xZWBH$Z{33NE1Z z?ZO_k6mZa2C>|X~122=D%82KJU2TKf)aStt8|ErxL6PC0jT`nI6^M1UEJN?JR)#(X zd@zFrO_1%~m@*c*A=efht9HZQBsZ4Zv#oi1n`2F&3WGMP(7%WJVV0eqD52XOK7EW% zPg71Rhn45xfTYY4DDFowh@ybv1d2ycoI&vfif2$fg+fL# zk3vVGq4-7=FQKqe+(7X@6z@gxLnwX##ZRI5Fp5v2_<0n+iQ?B#{4t8pp!foc&!hM< ziho9N%SI6YjiFr_+K%EL6nCOHgyKOIqbP<@JdWZq6z5Q!MezcPXHlpq7EmmsFi^Y& z#mgw(h2otk-jCuH6dy$K!zez6;-e^j8O1N4_#G6#h2qaq{0WM`NAWi(zJlUkQ1om9 zu@S`{6t|+d55>JG4x@Mo#ZeSvC{Ci7L@|frJc=tQE~BWUSVD0f#R`hIq4;JLZ4}>* z;`>m10L4$B_%Reei{fWcd>X~4Q2YUk-$n5%iqE0=ClvpH;y+RRJBnU(gSMd9hhi^^ zeiQ|WG#XIE=H+3!_L`J$!#mqm(hk&;`a;1(&jMT%{aQd^|Z7AdnuifoY*Tcp4iDX&F} zYmw4gq_7q#t3`@xk&;@ZpcW~oMT%*WQd*>t7Ad1eifEA%TBLv$DW64(XOYrbq;M7~ zn?;Idk&;=YU=}HtMT%vSQdy)>7AccOie!-zS)@P~DUU^pW0BHWq%amKi$#iJk&;-X zAQmZyMT%jOQdp!A7Ab>8ieQlvSfl_J6~09UZ&9IJRNxjBwnYVPQ6XDYz`!1qm$ifi zdxHw~1{LTHD$E-#jDmN7(D>Ma-|EA=i6k(GKshR8~N5JP08K87K(QooEL zvQoc;A+l0`jv=yAe~%%uQeVLkS*aeZ_GG2@V2G^LeHbDubr?frrH*2Vtkg*ik(HXm z5Lu}!7$PfG#}HYm>lh*{^)?KVm1<*%tkm~mh^*94V2G^L&tizI)Tc2-R_YHhL{{om z43U-kCk&C5`cDjzmFmT6PgZIlhR90wV~DI&2}5M1j$??d)M*TnmAZr>vQkwHk(GKQ zhR8~N1BS>-y#qsJrM?S8WTk!(Lu93X5<_IAK7k>!Qon&AvQnSL5Lv0e#t>PlFJXwR z)CM#oWTkduh^*Az7$Pfm5JP08MleKHY63%KrDiciR_b{Sk(I(PYmSwo5Lu~L@ETbu z9C#)xMSb^{y_5Iau+g@6!iQfP=0i`>xq|*Vi|6<&{1qo2xWC}#)#tUE=Lk~N+d~(< z*u8-id)Zs*p*?~0p_`?f*sr@IoR)iMgWU(c2by+;-K6amtyXjVG3Y&Roy6%_aQ!`i z?yc<$;0D9w2XLs}1Nod6dYuUVGEV8(Wvs$9pE|qjb#d9WkHFV=XJ!Bnj7|V$b1Mp75Y4 z@HGqj740(z@Egz?0UnD7$R7)r4E9^ogMCL{U|*8~?CTT2`U7Op>BUuR$&h~}J>(zE z3-Wy#AV1s*nNDy^M)!;9(S0H>bV3GngPrJ{RfKdDL^8%dO^@-jd11Ui1ICF&jN!x8 zk}>~lddy$S3-bdRFh^BXS{>{h@ew>EEgAA{TT{0(J0a?tTA4UQ+@AsR@#JFWjy+4p zJCGjl!MyO|3GZudc)H*PZ;BmvmW+2QJ>H4D@IIIU?-R-8>wFduA48T5{l)aqpU(^W z>oPz;kqq4_YUkjwWWd+b18(I7_+SRW-OLwE5J6wxIYlfP^1IVR{ z{7T0A4E=JUcd)30DmMII6=nKx02ER zMS8Shi9PJ>URV!jz#88|@mNC#V0z0@)VBwUIWU%i|5B5EIfgM^Ouy{IDGT0BN2m7JC zzz(k)*e+`PYw5xMYF=PR)(z}va>;%^J=nj@3+(8+fgMW*``_uo{zqP5$JPlf9D(dMd)mI=4qzS9?5^9&Rx&xJT9zZWkkUHa*;#yx<z_m%W;zcVkm zk7j_Iu57#1*^j0N`;olB9$z=G!^tK4Tj|06dR|~ptQ**oWUzme9_(M`1@^HFVAIvw zuHAu+eW_iG|H%vP>odSjS8Ka?$oHlPdly8_#gCfE05+nf#m!)X=iwx)@mPAO!+Ak{ zJOk8-kr|xIA_tGENyd6UJ=Q1l!aA7&>p-Uih1;_ygIh`uZZR)#QyIWT*rVu!bCThH zb9%Vnlo#CT3~(RoEK7DuOveE*$%sFY9`SeQh4^F!#1S)XxWikLG5$0 zXY#^!H5r?o9@~w)usxd>HX|9^52eTU19@S4E(5kG9|q^%ig<2FGQ>}&hxqe(L3};~ z#Hh8G1X1r&hJTzM;Aipz_(BGN5i7ewM+v};J?AtKIM*Y&P`{iW^FQZ>`Emx#Vy8Fb z9_EpZZ`aP$j?8w5nu{azVxIWA%#Apd9^Zp`;Vb8Z&pjC=x%?hakMFU(@LkD(FJgjp zs7?lsVgc^*mN0Nmk00u(`!Ajl!X2MA$y?{IfG03<_ib-50ytol#3$vKwuytaqL35Tk6EwTh+JyU*d_ z28!P@Yj(j)V0F2%7<%6raqjT$nPcbQSSS>pJ6{@mHnD1$`>qsp5u&OTCDA}n;Jn~)3kJ3w=U}4wzImWEzlcXW6aoWtZ+t4k|z9G zCD^$KckLp9ZPdL#rHVdp*3FjLsM`h0ZgriNHM6dFkB_wH0Qy$DJ!iMf7AS1g192t$ zU~g-opu8|=y`Z2T_U%)Q)?#gJOi`4F=d9xXF+tx7JPp1z!jIjj8y)YLOCBKX0&B*t zpvt%nht@w8r{@o3#R?Ro8MUBcznRShA#=ULhK4aW?z}Rj)czhKS*x8Orz`0@0 z>S`hxdSyr8l@-SQ#tNW*jVo6`_BujVHuUlZ)hsvaFDT}swx9!Jp-{yC{L3yLZj{QV zRj%o!1xwfKC4OO1vn~|uiwi`=z9qBLGWIFErX?FA{BDqs*IsMdE|rO#t8+M-sh1Kf;iRnQM+Q*eKe<%AuM3txmiY$~n2%=OHA*jb z4b6D7WZLkUULVW!QY_Q!Nlo-H{V*|YH_b{vai`~#QC6pfX#1@0jAb?9?NlU=%Ay4r zoRYG;ImDpMND%h3lCZaXgxwTN*!yA$yD65i{j4BNy+31RijamfHI}lZ*Hdve#&2_d z#*%hxh%`Sd!P+M!YajAhyE&G%kH@lhb1Z9bCf1fTt8Ug8RP=c^l&WgB(1Ga98u~UU z*mLbx%TyL>rh-0hv1uw$zb(CvZb&if%JXgAZfT0>+&z`_xgtu3)I5Eb3alrL-E#95bd0#`H0-)7t2q%s1h#BD26@gX)pPhiHV-YTEmX#YR)Fo0URcZx!vP zj**djLxrr>^>Ry{*C9oannqonD2*4~u?7tWMJMa5X_%EV#Y4foK}zVJ9I#*j$NlR= z*OE7NtzX6XW~;zUEfNEkKaxF}76iKO%<0mi-qO%PYu5yN+gY$dEKC(9!b-<^l^{U1 znrO;yW&twf^KDjB7RIkdBYhWZ)Fu~59iR>(d*f}C=w{*CUA@1e8INBZI=yu6b zK%g);K$ZcfWUOs|tdfl72~vK1?d}S`?n>m#AihovGAxQL8O1l;jksq_tZ{!@`_Hx6!PcmH7x^Beexp z(*oSc8$J!s39(t80ts@IL~>l60u3^IsBo}h={`k+)Jhq#Nuj8_X5w_pTB(IBJ-~r? zyFhP;8qglW#L)Q)kas77oaYwfgWPtorkRWOY0bi96T|D_K{MiLGLib<5@0~Z3>i6M zHtpsZV8n~YjBM+T=F7_AVHt`qq@e4bM7kvFg5(=iaB{KDeAyTs{{p-=tm7HW{;aBYQj;jnVMk11U2_1QnMJ9 z8dn{8Wovz*vI!Y`Ad#P59p0X+V*ERM=-lO|o>@7a4W$y{ zD6GTXm@pYqegT%kIy@T7=P9cW50_9dwLOuk9vyxVCVJ4+xS-dwDyl#d5spGSyo{Vc z5akpgD5S%~QG9kX>hNH}1T_yPQqzn!vV%1fV|fxq8q$|}Jdl~An6x5fDZxfp=J?dC z{JaCKd2xlNqH^}c_31m7tr5oImotzZi99|N<&hXXY*~%WBTtz?gt1$Kj4^)7B|wuG z!Pil`7s2P|(QMrKMG}JbnnXfgA0Xt6zF^ud*Fce8maM>ANoI|kJu-rE15|jA3z5e@ z5s#!LBA9|-7(v6%L>gKNG+<&u^83WlR*%?%L{f`Lj2I7uUUl1Aj3Gpf2ZFINX`#{v zV*3=HxF!mtB^QjUiHy=BOX-w5(>r9^<;F$b8p0w{5wG~Q$jheEQg)LkQZiydp1fy; z;4`0zeQBAHulr>XxC@E6gG0(g0>rjcSuAJ0`ENUIH7=SkA_{?wh|nETQq)GQ70rw1 z6SS?7U`;!oovhx%3igVL?49(bMmgwOP4PF2F(l3sBGizu$9kp@VQBRplXaWSwfGyc zj7+B`gWl{Fn(;)~VKb{|9W6~1cBNOtzL8I6EUlSHC?Y7*jH=q6DRx5L6=*^7`8Mx4 z6$a1!R+NjGl@b*~F)<`NlZAh1yT(DU5c@fUM;56RASUU~-!4V0bf0eXkh z$ekTZRLIUuB0D+{WV{t(*%40{a_hA?sR%=x<-(xQ%+qSP=aMl*zplFJ1X-F*JId)d z;u#*?q9_a^f6T&z6hq=}+>Xj6|I z1+|cTD!B>kpwyP7SV%?GqS0|n=(uTA7BNdx6H z3!A}YCu}>FZ79G||5+HN5#%Q)4dl*3c?;ao6~+iQ@Q7kv5vCyy+V|!f0EsHLsP+*ehJ;10b~R z*Hq0)6LDg;k!|8P+n3Y@S&Bf@dd7^ zq!PKl!dk}Sg{AOjsz;s4)Ksua><0LBA2XX8(ds?^@eq12kG zJqrL8zkOt{4vI=BB~ihL63g>$Do?FZU%>wDi;c22SHnhjY>9_xhwC_)Zn{mER9z*K zZms05Gn70_dC9DosCuZ)Y-?ik{UcK|5zw2dNUAIn6b~0EKm*6Y$aXYXGAHGy8CIKHbu|4)>5 zj~8*&jvmwfi{l8!C*pd6wR&CV9UwDu+n3o=P-d5-ctTE(CQ^2ccQE=VWC{m zu3W*fHmyBBZPu+Ag*Xu&}U9e7bkWVC&!Bu(+9@)?it@(v=<`HdR1jn#TlOf z5B?pWg8e}XGUO=`KAwp11R*?lAkvK`X0^};yz%KG{-4-goB&F@QQSKTe8t|~<15Nq zP+faJeRKy?p&O8;fH<27k#}kwI-#CD{KV-KvqxqR9(ZQ<)XCXlDs4!4S$L?eL<_qQQ+Z|#dA-eD?W+?GmqdOb}L`JZ}PyYV}%o?0;C*ECDSud0fq7L znMwM4_~g-un2%s{m=@eRCvW)J-zdajIf^5QIi5(&614yt$*FuU>ENj|k+!}}{e6U~ z4Ln9>`(b2tz4wXFU0HBPDtx&LDmXlm$RQnt^EvbdY&lC69uvDKQi;Ams|(%yF_A_m zu=#v%&k?aliL}!P&iHh-8V$HdF!k0v_r&N+Dwa0iQt6J`puKP^b~vl!Q*nDVR^U+p zyZ6&ay<3RNkhzH3KbZ)G_nw$XaSVxCkPpWl>-L`NGjU=G`)laPpFH75r*Ot6<8Y0- z(IYiWHw#{M`xpoA`x}(C0DCGCET1+auzBNLNo5OEp!mHE=uRi1djrYjDR=W3`ij9A z#g3pU%>H3Gz)3n4el*&aR)=+fDs}cyY^{!Y^^fi$fZ4lSaPRuaQ(Kh=7emzW>k>Jb zV-9EqlKKK^>zXdiq^CpdV-hFJ+;diETiTpiqtk|A<#mfx`_is7tWE&X9i(6SoPX1IMmRr zN^xp@&rGbkU1!=2nMeRc^u7<~0il2gWh79XOGH8LP)Zoco>C7r%6lir1B(ircv)+3 zT{PQsHE)l*T|`v&*JESAK0aA$PLdVE#uP8cVz&-&HB=nyr>G%x;rl*1sd}>(K%jmy z5%n2Dee9`#R-yyd*mqsNpj&>oiBcEogm|#?tTt?2t->#Xx}?vkT5W+&y&8*lL?TyI zmxAiZ`{{#}dg$6S7I0sm2$#E6oLKX9Uv4X_w9?uBt9AIk&D%ShyLzRos*OsY( z`BWlIuT}$t?$kMkYgMn8t;Z|>_WIo>8D?%^4L~Jf+cf=s@qg6P3$+H7>^(w^B)H4HGJ2{Eo}&?ar?&Pzdqy^ zWs*2NbL8O6^u!*&u~0dz`Le24$X5jq!0@w(e-tm$C{~Nx{?>-TEg$9mLJbT^U0`@q z5JOU-1N+AMCL7%t=9MtG8!T{Z*h2ezyh@3MCJ$mX(4Cyv9Vs*huC95(Zm9GWbMSV( zWnIQ!IChK^z}0w#Vg`gQaLX?}hFz{d9~P_>*$D2>C&FOQClSFmZChny2oy;(EJf0G z(y!Hp-dD$C{R!O>X>*}>0z6Q>V55u1^T|09A}5V@2&E;71DUq=Or4)S4CGrK&Ygpwm=UHi8 z(a9EEq7|R8;t?CE#7M&#fttg5w6m!qUu7FEE$fI(=lx8br-}xgpcSn)4oO+XrG|9@ z&aTJ=X6h;%05EZ}<8JYNti<{G@S-t%UFz&86v}GUSq*j1V_)Ho)fh2WQNOw!4@Y2_ z!3w7T$hlkKEyF9>oZec3zf9iGpy&#)D*(ow^2RhVh5NATiz~0YF3y9P;0&}>-;6lM z=ISN-12><>1JyQN!dWQe7$qML3zpV2g2g>}j(nwg5S6BTn9pY4YK!ovrU+_!&|n(x z;VB3}xuhi_zb6Icmk6N5xh8-fC;gZ3P`C~AYOMM~;GVN4d}eWD;D#*4hf8FargyzFdGxeBXw$;pQdy-bHPIcp!Gh}sEM#zbk;6<6%UhsK+VhB@M?hDq9m(4 z|9jQnLtd;Us}JDn`1O9i@IlN~9c8lm8;B@ciW8u(M-qDJI}@buYXmb$AD#|JA6^L3 zNAIVj4}zLVpA}CZ-|nIB&->7K16qRA46YRF(o51U^%FeOR)vy?YKEP>pRm$E zr%`XTTm``mJw`!Dg*)6!vg9|64DL+ACBLyx$(<)~w3yD)@AUcuY&d$pZDI%+R#eIk zcdr%orLc`+Vh*D=JIW)kiAJMhm+W@4*|0E{+TnTW^faF5)Ke$bB^t#}WeHBub+>C3 zy!nc1d)iX@6?zlX0=2RRyA2G@HtnER**Q${MLQYd9lsp6r>LG+BM$0>iVTIa(b9>^~t}Bd^3F)Su9kStii7Js7q#dr`T3vbk z+_}@-f-tF2G+SAu^%8P4DFhyaGOrVcx0}oC*cK~8?D4;%SNs;RwQp&BaXZc&RByu{ z*$1o*6jqQqD$DP`do~4so~TkbEUM8yC@%jSBjkuOtPgSKmqX7`j>mIjT#Azm#cv3M zy978ut_sPDiqo(ADlAmzkPcUHB8nEb$uy)i=2`LXz$|x%BFBj=OK?cKz>b*|Z2_Zu zNEkU$UNkSM?WO|nrC9K>mGiU7rnvK^LRjO9GAL%t7rp)0R&u{yU*viX%jO6J6B4lk zDE;{FOfLtNG|S^u7LNQZy&{H&PWmSKP()o7v zes_Q)#-vn!XANYhQM)M2iW{9R{i<2YyNi7od4F|C-u*Y7&183ynp_p*gFpuoj)4h} zJA&|szSJ#Z1qP!s9`;kp#*D#H6xX^i+>p5QThnavqu`1f=?kpby!LTCLDa33syMa z61NYQntkVEyAfA~DGz(v)-p@1O-kMXldCgP#&ym*Y(K0(vzIQR1i`uO zL)TCww?*Td6lR^js^y!)tIs22&(CzaF3tX3wkcK`Wc%(`--fiD)re0sG<-jb@^#iC z)Gy&ULfLF}JN%eFcY;eYM|xl8a5l$RA)B)nsie|s4PWb3sv>ThL7nE-+c08DN%=a> zf796_yKh@%iBd7E^!&~ThFF1UUbjyZRj-z$sj=@ki^eVk$60G;J*&6q4*VOkQGOJZ zq#Qwgg!l}Npze=q^!>BmA`Ert(cuz(8-|T;7tvPPjP9v(QB1el!OU{4$w+jcNrCPq zGL1+vp_zaH8b$XGp!014vG}wgHXa!YaNM0ei4o*1jvULmWns*p!-a=&#GriFU$u}N z{bUqIGW~_2nTD_40Mmh1v<7R6QHRX9hmpAJq&baQizIVk`&fTQpT~^MaF>QeBZ=IV z2)~g6p=ZSUdQVF!Mr7&fA6|dmbv#s&YgD=tDh^FNP)H|#pPCfD5ZXU}-w}zoh&Uh#tc(499ZD0nA*v?~OZ<;- z&0k|otn#HI^+ZyK6<)0M`J4k+yf6JD@nh+}=kp&n-uX(Iexb^`L?Mi4eOxgK|Ms zhWi~qmwf;@Xn5}#d}NDUBTSNhGW5)z3!6>g7BT7y58}gPF0sHZHU>0eh6DxWoYA&-(kKDuVH!5jq(%%KF!EXQW(Kgd z(}_a&6CKJD4LxX3kHvLZF0j2=Un29bhTUMgs$aqf80aUqnNtSQ!61~YH$7O?F4KoK zF}b1A2|INPSS9n;s*H_K|9|5DzKNIfmP(4Y_)=&N z45!*jEyy`M$ROt0xWdiqVee;&_uyr;uUU+vT8Ao<3+VTz$&FQ1wH0`;`U2AOOlC>b zy|={Bw!QjRq>|P|b_FT)?ev9-tm;szWY!WEu?}8MZxO4$kKV_kJzz~r+slt z*Ye@8tJYMX1LbVkU4tr!)qa*N@=^}`e- zc;ivZfK}D@)F33+ZsB~n89Zu)uFw>?Cld} zZ(6C~R4XQ9a)wi5XoWE-M^2v}B)w~r4>fOBc6b=M0o6TnCzzLhx1DJO4k-fRw4{ zQpi+zbOgt9RUuwcnfjFM6ImjXDqb27NCGaq0vB9h^44&u;fVTYiSh)MWGYEs@T#}h zAHy^JsA<@}@5ziiq9$7a%mO507sU2ttfc9;+pHhFR0 zZP@{nVIZbdpWG^C%rxtd&`W;q+nu|`9tfx#)jO@|x}(6aL%eK}F{_7-}$%En&*&9ds|vT`ut%fMx2p~KG$AAdK+kK4Cq1(OV<{0XO!Fu=>!Tp zW;U4hX1j#}CQisB77(`KkZ(`dxg-3b#9yK<8R&#+x&@l4nB`X2xe*w4zNXa|+VC_Dwk!C31H5uMH`B=st5T}y zwDk(vp#KF2t6+tkH;JE7vr>YYb>6(xHC8zrVA*WofQY!|+(3cl3)5j0XN2#tdt-&i*tGfE%-8uVCZ@ancPxFtP3UH1Y5$q6Z3UaART9; zH^GFw*5+NUcGX#-*DrQYw&&=a0Uz)qIlIZkW<<1)R>|En$LKbqP!O#a^eV%S&@ z^zFtGW2f5RthVee*?Z(HA4;f!DK5Km0c)9It3cW*p1;6CnFlTj*BhFaa(90K8 z6Vlu@o^jT->%kjKj_b?Ref&PeHsM*WW1j2sxem?d#b~oaMdpqR52%O3gVmIh`((TEit$b3yT)G{e`ox#I)=rf>S_vZ zrQlT*+)KgT6iiT1pkO}*4^eQOg2yR%nt~@O&?%Usz@nf*!CNVKfdYqus}%eK1wTu{ zM=1C(1^HEm)nBIIk0|&G1s{dEt@;rPZlqux1-mFHQt%B5zD~g`Wpspsw@~nA1Z`)O z+7RvDb@j+A9pk$l776)L56kKI7xXL1MwQbx+oyRwg zuR(GCnejv8`>xi!o|F%3%?)(LT5}6svDVy9SFAOs>58@HV|2w@^AugN)_j((SZkVe z#ai_E}?xZW$ntSPrwdN7JVy$_Wu2^fHrz_T)i*&_W^9o(D z)_gZzvDWO;6>H63p)1y!pP(z&n!im~tTkVzE7qD{p)1y!uh121&A*~6)|x+}E7qE$ zq=r~)Zl){Nn%n4#wdOcovDSQqu2^dxqbt^$Ptg@?%?e$y)_k6>SZlt8u2^fnL|3de zf1a*bYyK)-vDW+)U9r~u9lBzz`TKOmTJvjk#ai=E>58@HU(*$9&FdhbuGU;nSFAN} zrz_T)+v$q6<}_Wg)_jbvSZki5E7qFN(iLk>^55fXO}=8S`2o7eTJvSPVy*cdx?-(K z2Z&v*Nt^#&tw~$OU9CyWp{~|kMQW0@=7Ume(!!goHOa8cT9XYGZD)OO7)$EYS&tJB zJm#mNvwMdoEFzvefD7Jn<6%C4VejHxqb5hj9Q9R^n=&f4l8%`Dp_x^riIZI(eZ}GN7C2MTb-4_{v0qeBSr3!Cy^}@t@>{@$L*55A?;j%{>Gs zm(}}Y{+;xg|5aX?@5z8UuA%z%iZ3Eq_yU*bT*vMY`D^JR|EIhlZ_5Drk^a>TAD-T} z(*bz@Iz8U+=7sm({PAKm1rzr3aOTkJU%%_eQja3W5Ot_gL{dk4Uk1F7_pe{K8GDFR zw&n-YL%%mK==W!UzP~?ox2j#wLH+CcKzhLY^8)-p2Ec>V7naLutY2aKPk+d7Ob_|# zydZDS0C|A=qNOL`rSqu$@wU_BwerIIU9KCl3+s3Wto`gcVg-Dnu&ckuI-DNtV|js{ zSSGNOg^B)POXt1YI7x-&1R`!YaHF@{oS z2DRGR^k9$V1@@r~VAHf(fE@(4oF4A^yx=~Z0dBgw9nfZ9Ob_--USJ??VJ zJ&*xxOi#rOO#xy;-oMG-wm$U$ zYBQqdGJram0qc(50TlTs>kn=+J-G3_z#Yl}E=C`**G=~jA&%IHL%99nK9L^ovAp0O z&H(q(-n#S-8S6@|U0=}nSZP_C!)c@bh!@f$uH=RINCw0)J8ks(($3**rY7c=oBX;II)?dl%t=YdC|9yI>zn>S>V;P{v?C8VNx;9`$@L$uT`_sJ89nXMns#i#9 z2;hD$cknXJiVdj;1J@yHE`xy+8DJLs!0a!kThk-FJuie$WI!0BZLqDWKen0l*rxKr zb}|FDnA$TJ8W#(+HM~E<*QG~zGB1RuG9Zi@tP;Zh;4Y*GXXFL$bOvzay^YV?H4Hu4 zAL2XHL;MGML3~{Xh;h4g$QDl;G+>OM>5ul8(xd&wywIM>fHp>2^@-gBOg*1X5AHYf z0(Uk8xLv){iZ2B0**!j??iwE-0P+vhgZvM9fjpNJ$gek(70Z^{$jfPDgAO^@%( zdEqPNgAXIK$%)+q@O>{mzWz6EfL?iR^29vFMszJ+O;>O z9>}ag)LaHKT0WpFmNwr~FT;_xz>NhsxRX?ID6c>0`_hBHCoj-*89>LGPtAGuba(|d z3;WwZEBK@7p+0w9$j8(`%p65u8Jm|LP3jYUsQmbwN literal 0 HcmV?d00001 diff --git a/en/doctrees/diventa_fornitore.doctree b/en/doctrees/diventa_fornitore.doctree new file mode 100644 index 0000000000000000000000000000000000000000..4e2299e75f344b77400ac4ff0ca188c80179f2da GIT binary patch literal 44963 zcmc&-3zXbedA4J(?Oi_-JBdSHWa1^UomexoZ`+COtasPW+RmRfPVc#T zZLiwo5$d|8BB+A0AhcV?T8*#Z6K%0i+$ydzdJ7Is@N13D&NjHJ<`Ashu>KUv!kpBQ zG)Zo#Sw+>_#_F2X5ZXt3T15bTmD(z*nxp}Ra)XKMun+8ApUq}oQdC}&fqK}xHzR8G zT3=r#lexX9{C5-+q}Ekuzs230fa$dO}q-I60ZjGuZ4ft!@nEg-;F@k znmJji^H^5QtS$D7FKUT5iFt9mxI^4|bPXi1s}+!daY<2W^L8@$$SuqxtHhhdRe<_d zQ?CHo-H5Ct3Z;2YD#?wPWTZM@5ddR0n}h%9mztZB3nfV@)r3Mt5rjs89;oxmd{$kk zAQ5{PrLrdO%?yq>Z1m8xEFX7VY}zK3p`5MaYd~0^iv~1~%GEY5860UFt6GZGHg1WJ z3=`uUWvR@YT5YVnr7b?JBCB^n1x#Da_61dh_&{JSkn(oa!f~vHR>LiM*LqNda-k+@ znxJs!LMvg$spfrMsEwI7zT$O-QDV8(8jTA=;P{5DFfzL z6B^JBWu!*t#VtYA_>A4h@fVVgLt2nb(l#6S zFJBH$C-#Y;PR!WSi9EPZ+8Rin5=5Q=eUnSxc&(PvL?I)bfT&VZVC;loNWkNPHhS>GBPi4plc1Gq;YcsXc1_Q z+~5WZ`K&qCz`>y1$r|fqsa(Q%P%vwd;<@GwSYQB0{p)QPlQ(v)&%*fTg*IMnkuYHS zn$wf zBBjUIXxrv16Uvu}d>uQ?jgPz3EG{l)`3kg}ioB4Opy5a``pdy2f^XHd+?)jFCI^;C zhU>C&zF=Oc)hd;OGX*N}Elrdam~#j!G^=KL&PP~Jt-|p!h5-&{$dDto_Iw>d;Uz09SC!!{0%bSXitZP`ZU_F4zkKxLSWpdRK%cW{E8CAX# z+DyGDl&OdPOdUCW>V!b!y2LawN%%Orish)fs3}%X3_(^DlOS&tm!0us?63v1sktdW zHRE6|EpC!(5R*g{HE5VEZo;VXM!9He*n-*A+#E_x-LEyKIkL!EW~;P~RU*^eSX>1e zCo48B&>)n?hpabkdWGk0Y-QH)Fz*A?C-heVQd<>P#Uxl8en39 z`g_-sS3Lp?;!Dk^G4^=C^QhU@0v1B-@clEsjql@Qwu+3T^^(ucj!YTd@wZCtK}zrK}`k+@{wlbuR45DMG7%xbNU z76!6|@y)Qi$meA2tY$(&K1FesQ90FGiXGqvnHJ>S@3-z_Vc@>oic(o-#YAnT7+fMd zL)n3J*nxz)vNOaDM6!cvq|Oc|YO^!6G2McDiGrVMW zQfgVlF3t&>ChwA3ORQjZoD=q_R4dV z{-JD~f-Mj{n<76Q3_0z_ zX<5LKha)G3qdin44@;@EEHhb~r+uM3g=tYr_Ghfa`UGhaYkQpg3`1Valady>c4z;R z*%?Y_3^bMa^!?Ki;1!Cu@7QCf!tZx!BBQC;K=9X@#)FTJ@;h}w_x=Xzb9edo8pEo+?;LiAX{wWhD+G8 ztL0kFn#`Bg++coiAeSG@;YKr#Hhsg6Fx=Lw%<-iX>=ka%2OzlZSK_2{6XFDHBilkx zw$5=CrxZ-nqq~{bxs2zo+wh9^uzDHGYg?>|P&RR^bm15fC=i!Cl8WTI25T9M=hec? zu^t5?ljnd{WS8O7yiIKKNUL@G`5|;Nl+bNR=y=7?AiJf}*ZNlDJqD=#+eP*QR#iMH z*%dq$TAo*7d1`W_0{gcYe8GIrP_S0Y3sR$i z)q`!OzX_Y~_YIHvKySq&aZZuI@KBK$8Yo6*p&^D#%zPLz%K^aV`cNp>uSTvdBtoXv zYE*a|0PI_RKIy*NE)_?mvWbUMF^oHrI*R`MlYTgqblM6rH8V7@hZ`OkTH44+2tsnt*3W}Qg#IObn-54VtUG}lokHM1^BFuZ_Uj~CD`aG z;0|mcE+>_t&m0)Z4GiXn^0|SL@%*0M`8_$c;%nAx%5@ID@nLvyuecQKXDLXKr;Ttr z6yY&MI5F<)#zM2Iv;bayBnSTwjOGRar7Gw43<17e=kD=UC7w0c)=wARL@ab&va}%{ z357^IH71X7C#UW@er)>C^u+iB)3YLw3&gTb)0xEP%xdyfwzVeYk zBj`IQiK*P+yDk+=sOZ45*eo0kWq~%3PfbsbpLBr>ErqKI=d$ouZu0OaR}(6H%^3ww z&E!tqcPe)PKA71D|6sTB!c9Ztvq!SW3R%!{cvUho1|}ez&yNk^->I3yJ~i)w&0##d zb$9gXJiWP0X=SVivIl;7E?6?~*2FPx#vUGWGX9rZ&+Snbr?|Z`V8TxZIU& z?$CrUS3zwK@nd58RJG%4C;Sx7<HIt-s7VGDBMm}A|}ulgkTVhQ%w;3t317k>B^PJSo|SFah}SF?CAYgM<4vFpCS zZdu!4kB5S#uZ<9F+BjEZ*_aBne=h^NyF=04k2*PPZa#y)qB}-=N6;|L{$b$&zNF*8 zk48)38?ZWnl{!5cSgUl(?9 z#izsG$7Fw5W`1XNQsawK4Zk+@8m}uIv+t}cjc{WOFKz_3I1s_5DE7iqx1!kuoeU*t zHxe{8FlsHe!z{rEd$j=f8I<;K z7Zlh7t+|Bs?XsT=E&CoU`}E1#-J^NfxRuW{3(f>WmC5v~8aUM8m2z%4zk4ju+-{Im z*-3-};lJ*J*=`%)ZW-Aq?g>SK?obLake%fw<PZz55GWy~&wPD^D3e&1pX3!lw zM{lhPjgoS{iJ!-J)+#&E2B_Zeb}zP8nT&0?_lLqgYAW&31hwjgJ1_XV5db#tty28y zR;lyZRziX?M;qV+p#aG?9XZWRGZSW~O5jOLYr$6H4$Wm}lzf(0R5MtwYlgGSmv=4=%J&n3M zOK49lv3{%I7e=+_FyJkXoW!|qD!diE&McS0)-rp|g}kJe8(jn&{h3ho5_P)VB=t0$ zNyAB@1PdcD=sh^WR6ccq_AHK9zzyDlkPDj4!EQ72aZPSYC6yc46Ep+5R^q@9lsgA> zo+_4_j9y?gvuq}RzGyCMP6N5!lY6UykEf<|2M zGY9`Lp05?GwJ*DS8JJ5htefq2-z9as(1kdKW;TjNChOk`W|ffL{>5BcYN6dtU1viJ zjV{A*WIHr4>MJyiRL%7SRp#(6OuAbQO*s#L!INW<#;t`%Feam2%q6$d;W z$j0WL4~0RlPJEgysVYaSA7D9}UM+GKOQM>Y=Xow4=s@T?UnBE8!|;Id*jDC`=aO^C zLrxrX;7Q9Vr_EV0lrvh}HJ6Icw^YGiD*}tF31tojdT}`mewxdV1}VvPQ8}`Vb&2OP z=6o+r>J-XYmr~k%m3(~l8f(EM()iH!SSt32Yq0Ox0S-2MVDSRp^0~K+s}Bm~wv31O zz{-MD5;9HeD>BnUZH|gzyVR=6t5>WD@~UNzSfIGoI>ZsTR;&02TwjXYjeBw;cudPF zE%>5J$t}vtJb1>!^)gA|Xte-lIcm@)x(=`H%FyS)_rnF)p8-xq;j=38DGENTOn0Ka z=qjP2@J*3LJUVN=&&t3SgLyS0&yo8w+C%~q;tae8%gBwQ3^QZ!7?)AcgM!u7tW8JK z#~rR7jltDRk)-X_NASB3yW?Wj7Ki`UcVp?dR^JJKJl^ak zQfL;YW;&lC_lxo(r^#HAY^=Gr%xWNGi~VD30dG$s81amR0-|Y$)3fo&iLj zc5uSm4pPW&zpq(r^EM0Y?ju?S#%5Xt#E#V{zK6K5QB*$y|&{idr;LXx|thSTV{ukV%Lh42^jx5mIj-< zh_jI-Pf{kFyN1W&QCE>;?wU@ZVW)fX%$@iWE-`wDLOY|j|$RM>L_126Et zzZu4PrZ@dLh4$>0!5RC#d=32ZIvp7eD`$+}iU4Cs9>#!>L@z83q08QS6Mn2WbAmxa zV;+9?SwCA!4SsFZw$^NLUt(C@!mScEnB0yyv@$NP|@^?-9>1NyI2U=SlL2(|Xn zON>4de5cz#dyLJ(ISJ^3cK|Kbz1mY2imeJ{x5@JF3o#UdufvsId|4nMsJ3owk{ZpH z2Jb&$8VsZY!WO({-wnqKcyAQQzf3`d0dP%FfMzUa30$~eDz~)Y6t4H(@g-5++p}VY zvB^v~Ab;---^0dbSbh~q0uOQIrMYcvtnrOX3-*r!+hsVB;1YP(W?T+$;$)=^X9d9f zTzEMP)&VPF4U87&B;==8Di`4Bf;s72TU=vof*H14a4#8`z-C)xW4Tpt!d6X7?|@Xg zU=C0D8YXxtT>)krDptLFsi_LBvRr_Z5+K%P!a49oD!`6c9N3yql7^JD!h%FjN-?bh z`0l{1xA<<#Eah6eJy26IHUJ(t2LV=waiJfS#)@e=IK|@|wxX+3$Or5u#(@gP1j|t4 z>*3@B=O<|BW^7lWIE@PEVNI$_TKlfcwi}z8LbKqE77)({yi(+$_}DfKXPYrxR=1|bEU^6s0lSOK;FNrX1EI|#L%?(&43h|7ERui(oLq2F8ZJB|`L4o8F zekI`Ag)L|);4}+gJo2~>nek?0#KSM<+n_e}BAg+hYUiN{q5$5cA2+TnL9F?LQ0Jvu z0S+XARUz253&q}S&F?{9YjdVmd)!zhG#1)3t)j8cv?kDmK^rAFF9F(zRxo{36S~d* zBR1%W5b=<>OMC!MQCJj3@%7?k;*;V##HYkhh|h>mw~Q^GXUwxg@LUl*-$Fd(Ipslo z!0;YEATAn=BYpAp5ZiHJ-xi+?^iM86)p;3TtUuF2d~*OC(I$_;(I$A&4DS%1 z6TdC~MEs%nYw?%WzLhIhRM(=o3dI#DUWDRC6ay%-DE6bc4aHFuccQot#XTql6h#yY z3K_-AP`m_%f#Pu#Z$|M(6z@avZWMot;!jX~7R9Gf{2hwFLGcX~&!YGqihn`zGZa5X zvGNiS|BInb7+R0wS`;rpu>-|TC`M2WqBw}+0E$@@$51?k;(inoia8VuC{z@Wp?DO< z6DVGT;_WEjg5m=x-jCwrDE<*n?se#UT_EC{Cg{j^ZqeGbrjPswgg?SVZwE6u*O_jpB7E-i6{F zC_aSZgD5_U;?Ge$jp8X3Uq$g16wjgfHi{pk_;(b)Lh;`ydSMh)U4vpPipx>-qsXAh zqu@~NL$Mdd5fq0}oJMg9MHvN;;tJ>^tD8}L27mq~il3tR5r~%2i&||uX2ip3p3}vj z=;E(+Qfi$PS|?@JNs)C@Vx1INC*{>iadlE!ofK9lWz|Vhby8BD6jUeW)JZXQQc9f^ zQYU59NfC8YLY)*)C*{*g@pMu;ofJ+dWz$K~bW$>%6ig@O(n+y&QYxJkN+)H~Ns)9? zBApaSC*{#eadc7|ofJkVWzk7dbW#$X6htTG&`B|LQVN|ELMLU=NfC5X0-Y2gg(M7-6sbg+7iUvO-_L5LuxwV~DKKw=hIj=m!`gEA$HtkrnE} zW=&RT3x>!F-GCvoLc1_TR%j1~$O;|85Luy<7$Pfl7DHr(>KGy`bOA$TgPd zaSV|an!ylRp$9QURtV>jrWN`ahR_OCzYn5iY-Gn=)a7n0NiZqF!6$UX<`o=W+wsiN z27ASf2O}&Pqt%OY%^Ai~)GK@!o!Gse6npJl>7gy2^kI^uXgDjo(w~-fXNA!RV}E)x zh?AW4B^lO_>1_$jHrGzz8$-DM1{hGhqJ07evGD!?hQrpGF=mF&6o9>qi>#Z>7X|iZ zXM$?Ke(|hJnM>5L`cxhV%1&xZ3raBu9uSx3jfnH^;g6uJ>Gqz6mIJp|-v?16m#})Q z8S6@8HFi;OJlgckp;??dny2I0v;OLPD5dIq;g7vUXyOm1Bzq^Mrr^jpV~$%h+vsHw zI0V_2fx~2AS`OdQSqs|btaGkQ_4Dz;eRiqfs-K1@9BASW``o%0;@Zd(0qzY4$evpg z4fdbngZ)NYU~fnO_Kpa!u8S9#u;RArXvqH+AM(%Af}BYJ`PNRzbi_zBy3K21H_c5D zbxBP#OnYxkfNr1@ow?1Od=*Dyyfr??9cf|QmH^{;Bu4+~AJLen;$uFT7Uup0n1dQB zeZFG)poWDe=B$rs$c6ZjA4&@{9?7{>L%c7#nwfJsqVb-Ok9Q$0yf>wf7sgWdc^uJr z-w+?~6KUbSIRV}~qw6>LRE=opPsWG-fwZ7+PXK*?G<377&66>r0snP;z+XrU@Qwt4 zyO}S~0T$7a|2aP7Z>0r!X9CDw%on~Tu}-as#`{0<@%|z$ytgF4dnj6`P51Vw**KUq z550&6e&yQOL#{0lHI*UPtqFkN77d&rot^{cJgra3nGl<4I9UtqV zw6Jmsu!i?gELPvi4bjj`@u8nh3wkyI^wH32c1|{k2Kq>Rpcm2tno9umV0WPG0SnQf ze?LCxc3PnG2|$N7V$b;r(O5qmAM1zG!a9%uYt(v<{jwI$GKdEIxADO~ofg=^WdaLs ztfRqxCqCHc(gHiQJYezof@rY+7a#1e(gHiYY+$>n@zv{M52?07)KrF4Bg+PMB)VpY z;)Bhn1$K1Vz>Y?Py(>Q0BWZyhTPCpJr9T>MB|g}4T3~l40DF7D*upv^o^hhl)gHe* zKHQh41$WOf!tG+D-Wnh7o6>^2Hv!z;F>1FTL<2#u!7P@BZjk`w#KK zelabuwWw|HSOHN}8CdLJHn2m{HG6%0 zu-Bvo_Q0}%9gYS&79Z?zT43);05)E$?K&N}J3ic*wBU{>fE%yXb{Qeh#|JB>1@>S9 zumL?SeSPO~*dDFMuZR!zx6^_;kpODI$_#FA7regIqp`j-KGwITg>^Ck)>}FUQ0PB2 z8r&!1gZo%o;HDCQ3$RDQp53G2{$qT&UrGz^p#*Rbbk?Qq#=OHrc{Ji5#z*{bX(2wG z0CB)h8^*hMG{&`kv4=~mA!;har8^T~+|^mDrql3fcsIs}_rkQ`O(%f2vlAZp3y;Qj zTYPN0)53Nn0k(iXv(r6zG}L?ILp_le)T0TY2JGk~pWo5wl9C%1 z+I5SbRHI=&9v|i_(}HP49Sw2)`q)F6 zbr3a`q0ET{5QBE<;95LdP-ZcHEE?@i@zHKe3+>4SXalqrJzYnGI}jh-?P-BKl>ppe zr?#@5u%kiVA0OnsX@R^aC6J8c>u8W_e2~qwK;D}GWI&e)?ysY+0zGdtH2duT2Xdp8#LL25DcL^!SX92K~YKp#Lx}(8Y8>N4b!W2K`ig(0`Q{ z=#mRsFxES65yf8YOo%c}QYcG-%{=s)W!v##mYa|NYbuGY$`*|FA^ zYo*qrT5WdT)7kOX&Ko;}*1CqWWY$`ZlG?E@gO8G?SIP~w+Ia#WHnEO}xbOs;aVRKdmjd>i&;8rF5pD z&a4jy9le)mB>TiXKh)wc2IpHoP^532d$E z{3({zdA+JP^;*>|G|Xnlx}u_2)z0BntvP_c&TP$@O}z;UYt?{XkA1LrbDz50m3e@rdQPFjreyn z{@sFqw}PtG^R>pJLV2acI@&hv_Lg>sHll6U2DKfBS0jR*t(XX`%jX&$#f^r73oE!EbFp^o-?lUO~90+?}_9f&Ik?a|m$VBzg5g%eZ?t*W2% z%yMX`=}o!t78d!cPwF7#}c-W6@;#)GgcxGB9zIolqCfh;%tCJb9u&+c3p@xKPi{B zk9(|r$YE_uENjolvbH6bwKouJOG=}vR~KZoc_x&qtT)kssPzikHYnIrt!7h~7Am@g zHg2)5OHjW}wTfm)(yP*wE!Au)lH0~9PoZ&AC9_toNo55d;IphYObWHAO4V8w|ER&x z&+0a5o2=I@UkY9$_Nll=%-Yi}i|XGI+f?W@)U7r;m;V=g-k@2lwfas(+qzIJz9zHUk6OC!FHJRna^`P3{eEftgn)S89b*@BLWqoemXj6sCb zsx*h^b*P(RXrdb4*Ba-G_KQkoVWH>^fr?72snr@7bEqb&RlPhPA#7D;K~|IiH{J`M zh9_LHS)L5J69xyE!0p095}BF6gpIa z?sA#vIb9dzt%)G#xyJY)x9zVe`l5M4X<)F4?se~=8F4h4NcrCwU_izQ87X2kZKoJu z#PP>CrR%mty2??yX4QtSRP?8~5i$E^D;!INtXBld!hAp=y#QB^ zFPp0_Up`d_`lBk6Lzk&-iA=pd%G9BUPn}e`U)MKHfhZyzT^HoYSZX$$lmY}fUTlKG zUVL_@`eP@UF_)U##i^Nsx^%edSAqgjq)|hP+2JOMny{A(rY4v%mzp~gsacFljjfIx za+X;u-4+xgTirNZ#VIGpcThRS`1bkBSx3Dpk;Btb4(%c^>zDxSqY<-JWiXD2fL$M? z&6XZJt$>6%er&QLete4V@2~cS^5)9e_C$WVb$DyeK>v5=E{>+q;ApQnCxcsPeHQ-g_2b?NZ^n4$+wwKHn9Uquy&BEnHfhnJ8N2%?k% z1ch{X*o)6jpE^94F_)ShiPY4im27`SM_-;qk-GFH?ho|MQA}JBvZP?8E3tp7R({$6 z)*QdCrlNdy`Ss~L)L$ix!|#nih7x&vG|D3}INfN}`tEsp5kwffHpm#`r&IzoIUal+ zr8*vbZtm-k8$U~~VBMKW$ZG?HoKzQdvuRIIh|5wV5GrX}V~ayZ&~JbW=W`+Q*(c&& zQ6hpd_?dBO*qKN}Gl2#SEJ%Kj_B`tmn~_Lt5s7j81EHXHU5l9rar*;7-x#z|ZUer3 z3Xfb6h0&b5jLM0O(jrUoxINN4pqr)IS+&u_j7ZrH;+G;Xn|d>4S34r*c?`&t^Q{p4 z<}wGBG+PP(Hwt1 zLECBxvuTI>C#yTNE_=g?>>cx^M%r)Bn&NLilOb_4A+8#7=VP6z4|k%~`AoChG+m3o zk(rSRQ8FlGx6q6v!VXWfI`x$73+yaI&7w$McE)>VXCg1znaHeJq00J!ic`k-F?m^vurgyx55@?08z&)5_!W?hJP5d+zM`i#fY{WM?8Ty@QA{WoIHo z?@%1MvqO=(vNM^;j>;VwXNA~nh$jlUwOSligrTk8!l0{}C**L;<@s>ib=i(5$kL2x zFDI?bVMpuobXOld<)oo0BhlWE$AVYSh^Jux$MX^5DXgb+Twg+LBcc7Y4YQ1puLHl#P*uy$-FcWB8t?nZv8x&p@ArlVBN~4*G!SR zHS6v~cH%VY5sXJ60kjOWG9 zxBxrj8SK#a+}RoT*tsu}og@vE+t_rn&^Xn*OHivhO>>3>&nH;8#W-@R3#*Q%B*4vm@N+s+S zuJQp8+V-o;6PGX{&Vc z2nbY}ONB@!a(#uhjM)oI;T9@KmC00OuuAL(__RMWn+nnDe7-bRzeE7ti zNg`%B0JvOFCvyFx#I=J&l`5_3g5mz| zE5!7%vC%#9_~Qlvk7_VBM!vMXL^5j1kT84Tq|&;TJ_QnkQsUH%WN?yv&)e^S56;Dr0fvM>4Bs2 z{+a2pP%bD>J%wX!N^5>zFJYsnN;|MY+^}9on>ji$Ji2RmY-D(JVrpd1T_byj&4oy{ zUR_?4amFXWga5{-U|*1eKGJj%KA4E`2qD}*6=}v2lUis2-pIr-{vX{vJPMR%ZFtWZ z@C|qG9$#5fg6i7&>7&~(gf1gV7vfAJMBb@!;D|gsee}eUnS(R?ryiX-er%?f0^Kz- zj6xh82lxj@Mn=bC3UqV10^N*LJ~||V&q3*d!j1pxQ_({~$L7Ul;ZPzAyn%dr=D^gf z4_s|EX!>1lOHGCfq%-oBA*sXl_jzF<*tvVM=i8ocF@V{+KHU%aI+In8S(0EKv=ho}A3*lJ*}z z8L8{b)ZRy!+Q@xmoZDIsvsQz71YK>;b4!f2q})*En=-wTYqS?m#tvtB zWIS$<#!7q&V0V7{sCT=f(qk%a=^sl3!h28j2XG9DYLE}d?(24+>eF#z3Hxj4$e(w@ zk51u?jK$$vXM2y7EWIo^#qDFv-1nE2vleIX%OL`urNeY-58g8hi;ZyR->HYF_ z0e)n36h=lz1RJ+TMgkMg z48p9j>NT4%sG&5An4Vu%+rW49imYBG-Xlh+Ws z@OvMfr+WL%fQ$N}MARn<^`VCYT8R!+W8Zb@jN0&7ffx*oFJrM7Z3n;>4P-b%ay3`wAXj`*=oJ=KxzX zP_WKVAF8()ePM~ZFdt5Y>6B`q(=D80xK!0@sd2te$K$(8H8{`))bP383oX?^!Y$3lHA~k5~%5?5A#7+&t7o4F4#vC!P?ud>D-8X;6&|2ABAdH)p8yC%|}NfNC*6n zfpQJM^>KT12*SAi=qYU%?PG~(A12v7&S+2eSiT1A!kEq&2G-KpNStq`B3!_0?R+(Y zr5t?cL++{Orf0!L|9B#Lof}>G0Jk)^XZcIL?UTp zMB2%N`zI$x@A7L0CES=V$!eL5Q*e(9KZo&;{6%WP8uzuomm%=VhxIDA-e<(_X8QFa znGS3eON}R~DJCQH() zStz_b5^F%{rbs0Vg$eLL{(`kE>dzj-DuI@uB6B-El&4Q(B5a#xnf*jCtp!S)39X%gCk6*IXiBH&9iX=Gltk{#tcj zU%-R~bsYDGRgb%O%I#cOt6)6}OVHLe&Qu2mP<~*q0iE{~wjLSQVEJsg(Zb27#_&?D zaRwHyXx>X#Wghiov|`4+;`dm7vs0p>nx7Jz2W6|EYoO%0$Lrc))mCY%sWlyh$22Cf#{Mc;Fn-V^{rooJ-uej{8IO||8IiTHm3VyV$#uEL32~Tai(WFNh z0_EJUBl`>s4W+IHGxdq7sx&kdmosT_djF20Aqi&E6zQO6B}#G+@sSa=Lm1gfwiVKy z5_K72TW#*Vq*Nt4#sLiEv9`Q`!90xINqW;%EAu-g9vPb&JS(uZ1`}-<7fLWzSFd3X z1KBAosg;U+rdnI7y2i--UAOqmqz!7Dtd+>UXFtubm?Ut&8s~wra392Zb1F!;6mCc) z!cXOWoJz7;Rw{}P5xBspJAI8Kb4>FgO(Kq zKfIkw)iWv=t^P#oj}on(Sg#ETd&vCT2GTI|I!qlFr}t-Q6{CSTt+ni1R!g25sRkl< zl7wN1vjGmBs&2d?@XmT=tN_i12UD9ey?OQi^N3uq-v1uFhU@)Ch)R!ZKCAQ03o$`6`yO;tgT9=y?C?t^nRL4s6km_Iaiu;Cybk7`CwbE>&?Og*G+j8bRYS0oj)y==Bgti)gi$AfJQJs#4 zwHl$(yn4-exN+^kj5&Q@gq_Zg@m)k_t-%Yj0R!92l(2OrT=g85`b&DV)8@})N)(S2 z)UkSLZ48SF)obH#D2tx@fGJypN}@H_i_)P`ZcVd00gfHhVDbIhDO8<6eV~dU%|3Yi zp(6*#u4q}Ght#WR>gF4@MXnsQcE?A?B^s(1B#NK{Q-P=)^ny*3q8HK(m@ic&4&*k+ z1qp58^nTaKsVU9XQY$9cXsY7jShz-ow1#o*Do=#|e+K61)a!sJOQ(ignrl$#TM#Nu zut~r+5mUZ=c(QgZC}V@xD^c_`Z4v5L%AQW{7@vb!s%``5`KO}wJC5AlvS;X==BtS2 zOAU4iTO{vs9m0*)4X8oTxJ9Z zCek$C9@{j^Kt*==CEJvk+v^bX>=o%=fg*Lf$CFe>q3-eZT#r{_c`(#px7&Bps?CK) ztyK?HaKD$2YZNMEG`H(xVm}5KGt?@!#reb6kkFj8h2}W^fW}$;aeHY_4qW3Qu0Xg& zY&-$KhwsTDj_!Q$07g@>h0JeDJVI7BYQZ}Ud^T1=up8&Qf`rtGwQgvL?bQvzPCgo@ zP`}i8E0JM0SF6~U-#R^mPg&L0>36>wUbE_IxQ4@8uJN=$sHZ4@s8a0Jcmw`~3o8uu zs-d9+s#$92yf6|A_`?*T4fx7{Umx~Q!-F8~|IE1xx8KobIt&{|Z;cNKgz63U)k8zG zUT1Iad@SzY^l`5bdiH_;mN@Xw2tWt}mjL|J0--{{)B6c6LbTOr2*g^qz1mfttJ++x z++A-5jkE9=7O=rgp<6RFgsH4p(*KFlwS{dZ{P2+aVvvyB$_K+v=GQudVLKS z8*KC%+Ywz)#g?9cqY(bymghdJGA@@vE}I+^07JPBS?#fH%w%%=H>2 zfl!WcpJuO_Re4WxRd)J}m>^iv^pb`dM4CzCUMp^d@v8O(#Nbu+9}yrf%mys<8qeg; z#-*<6&l3;Ps{TQ|jIHYQ;bK(v&qQ-YRo%~3dQA)$8;k-Q??-fkRoxci^aOIL>bla5 zt?GYC+`FwduKV&N_OFex?fCJuxfv| z1Vf-cFx<(b z4;Mr88_`^m=J#{eOR>RHwK0w8qJkEbFp`UqPD@W97tN13wph*oBgDO<`QgV`H*Mx# zNb|p40B=~hVTamyt3W7+r8lwHOwF$(DPjQA8|Njr0iY@AzEr-yD*Vv0B;~XJGt9nm zIsSwP=VDsk*oc5h8Xm@*q8gr(OVjYbitmXU-VSWs6v%5pQ}?IVe;1Jns`cOEyoUwV z*u@!MZmsUn2Bj5PWwwhhy-J5`1B{RxAC5thpfdz(!=+aBE7r!S`hNt>SXECSE{3Y# z63rE-*VoOip!d3m+p&{%NkDr?x26ji+UqPOHbu&t=#9ZSW=*+nr zPGoq^YTUx&4O8gGkU%I$*>7jBnachbrldo&$B#)5V_(l<^*mPho6_K+hY!#0zyiP1 zNuNB8$vW)+!8K`ggLAcM^5mVfcL1A}n(hdIR>o*PkC##HIlcjBVgTW3woffc(+Z{s zkc54=BefxiVL_xR9err_l%y$VF@!`C0O*O*3VFueTw6>fu$^SxD013@i-vq}{B z7;J;Echx>j9b8eO{YMBlU~kKEx7^(0(p03)#QRS3mKv4Xp|eV*rP@so_WLMyV`yh2 zs*(n1z~jcaQ-Wc)n!Q;TbKb#El8LQ)i;A6l+BSKFY#bI}`L#cmIG zxMRICoe6to|K&gkG%m;2Xdh?L_-8~Qy7BA>8S>+8JTq2eLBnQw&P}#?9FT>Rb1~G^BoA&?G{>h6g8eX$wmtVSi3D-x;`?u{%_FSM0t@E_S zjQ1{uH?d1cr(Wl7Jd+l2i-;%C5~g{Z>LT^-c1m;DE?TQrPy=yIId+ZPgt&Ff6$)wa zo}nQGzz(S*eH$9u7wD!fT%;`cqB+Q-8SX1#V@D{5?zSbE)AI7|$1oBj+zGmq5@U&3 zNua$VwDZtQ5yAp~Y!Tjm3hG9wRBB6@GbeiOy@jM{=4AC*^lw>0r>Hr0l*Hl z@!W+0cmM-iCPPwYB|MAf>~ zBcy*M)}te&uMqIKl^FVPF-Ax$2O_zm5t5&)^a2R$oL3{{myvD35t3bO=?R2JNa0yL&r_SCRl7wZk03pJ=A7tK2QUro4dD=5!frV0N2AKWK;cHyVG#S`xc@_Jk3$yBg*ZVx#IA3Ax& z=`DpM+K^Fpq>|~>+zpB8_&ttcD(ks$uP3y#5b=cf5bov>=}m|;LZry;UJejtrs;2i zqBKLBogVBX%~xh{=czuMf@JZaat%v0>@6F2GPZOYoO1%cG&m*3CwFtA&XZ2dk z#Q3C)gT{1})h2nTTOpl^13;YT@mvs~JubpN4%(~2=XB7^Hfub(_d3>2gkJypQfI?s z_ss(AhD99~Uk#UNusajbV|It#IM(%Qu=mpq!IKH^;+oZa9KjP3{l*cKk0-nE^|f6) z^*F?*NR;g!fAl!S3j#&vsM}96ap@{4T)ME&XM92+lrtgsarPQBAs4Q70>>e~gqR$_ z@y8+l5+1UKHxBGC3IGVhhSfdePX$8t23zDf#P@yN3CAJ+RUG(t1t5fh&jR>&1VV*? zr?-qwckE*Vu{y^goVxjUUG=KJa}ZmGhRAFQ*_u0F)Ua(Ve%qo)ICi~p=Ja^Ijf}y z*=xA?_lOmLjMT=I{u_}%cjMnc=^#*}ZDTO~PSopoGo#%obvR_0lyT!tL8xjlmEyUv9OtDDI zmoG4%MDiCVFrUbvIYnT86G1OXVE7*5h`_*xs`2rRJar2Ug?e5fR7hZwn`Yw+Xj+Uf z(%K_Bcj3ikQcU*?B=u_ef!D4E`p?}a%esk75ZWs;VFPEyrXpmK@H#tiWbvn|kP^nx z%^in-CzJtRKnhx!vgFtZD!e=+V>g<8k*v2o<832%14b5-?0~%NfvL2>x{lb260N{w z8c)2HC!Wqn_Lc?5ZLGXe#{_(OBZCziy6aJJ)I(z6tQ`G-$~CldG#_0#(oboyiU@;< z)T6?@*iH#%*2sjRhW-_eWkcqy*q1XTwf#8*Q*V_BlX2+JaY%oeh)lkDi$oVOMUS(q z1UL(irZkA7OW#FW50a2cBy~X+v-*uAxE|!haWU3|W&qilBZ#gC9Tq4uXJO<4CN6m% zpj!u%HPizFp`5Yu6no8_6B1Yt(h-vbIDS3o3_L_z$!P6%U@r&&2n%%$u*(9WdV?*p z9`vk_J7GQOIdS0c6o3#0UI*~E3xo;*Pi}KbpqxSWK7m-B^&qES<+UCJX~VQ5EJMSF zX2M#~3&@-+Z2`Z2pX}G+K~UO0B>*%``ja62e+YzfNdFb~8dJ$4ryzbla5R9LsV25J zkWIQdY}4>3U-xUE1vW!l)v~>NgU`)5^R(;_)<_Yk1-lzKNTQs>KHH{NtfCsq-i-r%fzf`E&J_OD$Nms!7Hz8_P>F#n!{#Vza` z68-qGuh=N80w^O~?2Su6mM0`O9lZ!i%M+6HP+5v7y!+!)&y4S)f}_z>(1hJ>co{o0 zP9HAD%=m$5u4rc5&sBN>gzNTMguDgOrA-j>UBw}$_*HO@%SK4^zFvTjFpEo|<}ra#j_^OiUSnF}u<*Z! z8)19#ll7)+xQg^98MX_|3AwvaNO7{Yee_zeEtr-#nHJn*($vlm&;crG1iO>cL`4`tpw_4Ou!!VZ_1<3|4kO>FvY#CoP8rhvQp;4zmK37G#5S|vvT$(Nc-PqRF;6WE7sF-Y}KJYarZ@DhZ1V+4{Fs1TZRUhU>_q|ecvn~(an&W=I8t;z9kbTEZ}`TTW7b+2%W0x7VRo!d zxSyrf)GKBI_mg0oHYP^Pphm|Wp%E#fcQ2#cfPW*uFGtr8;KL$gt@)>}=CmtnOO zjCQP5t>(OZSI4?3{Gq5e8ns3dD+lEY&YAMHWf)3#tgCRbQhW?IN4`X&Fdl=^ANdr9<;DH^|ic(!@DGMstF5~y*INWA!!7cMJQc*0cbbk?&K~EJN zthOs6v7wiXI8HOKpMy;!Ya=?ewW9yZx}0wD+fZ&T)^Wtv5jv2{FL-eY<~=FGtN0C= zt(sKy{;RsFw#v2QxkZwtt6@M8*U%M%Az4Cjy~$bKq&rS2u3}j?>4pzyIS#MZxRrtH ziM1YhOw<52K8w#A9G|#JtO9&bbgZrPgmiE&m<|r1fGNTH+*x_{*g;lT}1b%;B%PZh(u-Zf;3*Jh!99^2Qee0ylex|V!$2H>-Z zGw>*(CQ4*2-phB4jDymRFs&7dp5FM;dzZAP+eyVGOt=gMm8jg*I)~R0{O7QNc( z-5FCf>m(%4T34Irv9tUfcG)jz75sw;Us0h8_^kCNwz)QoPqt94O%Sz(f7?Hcm0C%0 zsJ*$Q;da6j78dR529}vZ+9ZpsSDuA*)Nt1#Zd7#Cz_SpbT1l_YLkwKKu$eRk_MS)l z>5C-4m6~E##w%DOL2NK9Sw;;$k1S}a+C(DPmf-755oT8ON)hM7Fu6qvq-|}Yn5oF= z{z6-&J!`F0t7khnvS+QewF#;)q>%=8s2@!FMP1D}3J)=FZeMtLl?Ni#HYA?2|&7m-KGY`v>jcwSO@N zR-i#!L(X;NTtm+7AJEfA zdb*OF8_BtzoI!H#AZLP{UF6(P&VA$@C+7$`kCXE{a&&U$$vI1oNzOCmyoH>1k@I8Z ze2|>?lk-t>{wq13BCkaL=xC&*bO#~|k^a+b(>Cpm8?r$f$vBBj=CFd5N6ACg+>ve1n{SBj@|%tfTJHYI3%cvxS^( zDCBSljQd<;)D;_H2R%gl;;UhL+DXnCY~nOD za{iS%j^87PJC)pz9Hd}(z-d|Qs2=bXIoJP}+S<3;+P}BC8nn3zv|0SyEc$I0`!JF4wpskzEP8DgyEcnlo5iioqSj_HYqN;8 zS-jdTT5T4qHj7l7#i`Ar)Mhbivk0|WeA+BJZ5Eq0i%grvrOl$!W-)2Ah_qQe+AJDv z7K=8EM4QE-&7#m|F=(?0w7K}(T=Z>&iv3x>4XtfZaX-sN{VW&rvs}dBjr_E<8%Ux5 zwe}?_wy$abqJ78KYAZ-NuvXhhPps8$q$k#DgY?8&ZGxUytKCmetksUw6Kl1{>4~+P zPEV}W&e9WWwP)ywwc5MriM84X>4~-4N9l>R+9&CWwc2OtiM84v(GzR6FVhoiwU_CM zwc7XSiM84)QWLDzHq#SpwOi;3Lq$k#Dv-HGT?KC~HR$HVe)@o1D z6Kl11(i3a74n46}`!GGRR{Iz|u~vJ5o>;5BNKdTQ{*0bjtGz@|tku3rPpsAcjh4~-4FVhoiwa?HKYqj5}C)R3Tq9@jBe@joS)xJ$ntko_frNmlo13j@; zdj&nQR@+WbtkuTpiM84kJ+W3hMo+BO9-}ALYD@IQT8*DRM?Zg$9M)?5#9EE)6!1L) z#%5U5HOSty@oVIe{ZXSt4(mMH563M(?*w9<$4@P5L$LEmeFtj;ZtvutHg#C-H#AIe z{n_27;2YZ?dg177F3!~|UVoImUK4rg`Cb=_ah;ng2ihEpAEUiSlZKbqM&ok6TxJbm z5L3buIl8I1hZIIXDt5OJW9Bvco%ipdn-O&=g~Kb%cXUpoR}Oyr#|RTC1E<_zLR^Y8x?jm^pUvI1Pux(-_8!9Fy@s@yDGlb!-g;XCysV3J)T- z2KDwOyDu)?Ms^zId9{2SR!$^LHDLMLz5g;`ZS8B~;QpppaK=jr;X%`Iy)KP&I)`tj zxwIYu?o9@`tx<;zH5D4@rGs5@wQx!PATO}5>;vqpQ^2A`ol9e!O$zCdZxn}oJ-qfL zyh-JIOCON$?1o%fkd=%Aoe)R2D=&0XALvHA(b*>O3Yc6{(@XHUIL0G+VZ5~uj8mx? zx7qe(&_2+xKy9RB*2OW;=Y{#UJ}}2sRJPE_<+=@%XS!0+Z4-NDI^<`>A-^Rr$lLmW zd~bR&8%vlb#_GG-%)t9WalG%(3-9gu<3+a$Gsp}$y?j3@j`tIJ;k}~|ybq?AuU(BD z#DcZ?kHn#WJ}>C6>I3?|bm(?bn{{ka$xzuZiv#|8UVyjv0XR#2;lu%T`pZ0xlP=z? zHVJpFE{E4#`Wb_LK+aHKwDJSIwKHlp9q%pTcyG!J?~Xq39!!_%Qbor~DM>ahFynSX zOxmXd-y;rucV57U`T%}+I&g+eOOokmXT{N;$P4YAeW2Zwh_<0F!2Xea&15>(MRBY~ zURZbbfi<~>3SvcvlSEr=VE9gP=x@&py4(l!-HFAF72i?~7M#zgm+^|AIK^U(E~ja37!(D>3c2siGyu->lK%pNV7rPKF3{vh8>1< zY5t}-*l*+oc66D*jul4J!LHjZ+{0Q8uetQFb}bKBc{~g3HgT|0USP+T4Qz%O-zyGw zZ(d->mksPhx)?t!4)#=DU?-Lh?Cx~1Pl|)B<^^{5GJ&1Qs|^3!AIS^seSLrxtF@WKftEPjMqY4V z-3MGTLC)wQ|F}3>ivB{jhUGt zbSeW?2r(f~ud=@-j`cV4!n(f?tV7)$C}klF++T@<`-{B59q0pGj6R~n8`v9l76&wN z!UgxJ<3xGZBFJ~e;eIDCxYK>Wy|2409ek=(X;l{#7dQ_4q)YFnYlQnv8{svVe$&A| z5XbDaQLAI4d*t!aU2?_@+nwSV2lK-CKpz-)c9&{-QO2>C^dg)Vhj)Ko@E+^~-i~f~ zB_%_-7R9kWo)@;6KCs2KndOR1mWL~3(?WR)sz*;R#`EG(&*la7P#;iZcJyIsUCHPX zyhj|}yYfPJxDRyW-9pNz(0JEv_A<@$;xIp&7tAAlz#LA2nJ%WkD~|B90fg^;;rh$? zKkWt_I(H79d#Aml+ozLupdRf5YK+>!{-$)0Ul9lS`niGA18|kiv&h}v_)O3i$;t+S{1@Sd~ zK#be2LzD8PN&~a51(8frsI=VY!&Zi^}?sQ(@X8QoQt6N%ivv$|+ zkx_Zq$VdjrH;RLNDld?yaspXWYBCP$?-?7(n5z5{j_hGieYc745NBh7Q*N34^xN^B(tEU&=m^j3dydXZ-2gJBTm<+LzQHDpw0UpW= z;NyJ&j5*?^%jJTu!sJtpkz#4GMVHXZbES+zT@c4y&I|JsePEWmdowUJG&wPPSGv%? zRUF@&^1}D}Jn?00lK4;J_U2 zPRzNEyXx~W=MdM0VujNz4fwNz=9$!y{RnZA@Thhq+_Rs2ud l)iI6PvX9Ue8fLRIcntqFJ3rDn0wH-o2w6zNE;jYL>%Fc{zwWlHJ1>DC zFrqfvjH5QE|YQ-L|RY3%7@^m}vK=T^2GX>Le;3oW@Sv1GkuQ}OTS^P0L$nxmMbnd{Ci$xUx`r9GJ7uURfSXTV*j4}~oi`9JBb zHDVX-s$D8Ny%ne0Y|JRwMXR}eW^EXRUh33_ovK|02unpNt%p9KcS>)sad^0L*Z@6j z*kI(UV}JCuAHjZp}m?CmFgld6|w?zxPQ46)A zXnCX_DpodKu&Pz7k~-K{2|GPCUl;+sx;QP|=gI94MSevawhjfl3 zeM~6Qi?wW0p}Y72!V& z81@01fwrh|{gJD|3u2!L3u2AMt&)ewq$Q!?Rl>ltAT|l`HWvy;HD?*tL36BJup9!< zgs7fH@Txi65zt{=H=wIxj9F%}YE($55wp5^&|1{knQXyL52!Eb0R>&UP%B$1 z0oB!*RW&Q4mgpZs9Nz|*rFU)Hx+Qh#&{piBRLjnWzP?h~D%#oJqE+p4$`QzI5w5m-&Bm>Nj;_p-hQb_U%b+n7_bvl&bW4da~@-#xFx0v$MtuNO?DZVauD zL;vO!S6=kUMmLmgL0>Zit=N7P^k1Iv0-Gtzy?oE^^q5sOAzqsk!eIGc00%)?(>vhj zpvG}79;r$hJeyS}VdFhtUMYKx5lYSdsBzf@0P;1=1?yB9EFU_fK6Ebil${la7DiL1DPiN?5HQ^2n$3}EkPD8{792(~Kq%X`_HHRvECEpz%VZ!m@=I#< z`Y?)_>yc8$k}%-6doj1qfzET0h+VHMZQ;rW;o56eY_nkBLNUeZ z6fJ)#0kBS#!Gh@lsXhrSo{C}Bl1f0ewKJ#!Ep(Au-WI8s29dhr+I@R0>gII}lT<_i zqop!N`SEIn*CYYNlQ4k%Nd!8ZJ3~iqmafp$)7MgO<$+i@1=*y!iVwXNc{eg}#3Mnf9 zmLWS`hSH;3iMl1!cv_dKu$?Vw1$g?(-x3xBtZ69qqb9J^A-BGRFQJEo8>r`gCVDt zpx}>t1CIp|7wQ5bmmnJB!f&yNIURB8u-^(!1D5Z>#NON(Zb;j2V%vn?-1m-lBRFXA8MW zc?l(Z;?H{JX99^0x=480MH^hXd)vw_cPY2JLM-3a$;?@6{mXY(N(XG1Q*;e7U_vJc zK}nTDXVG{%0nqYNo7uGOorBfdSQov%w&?8?R%2{olc?}-CzByzGa)Vwxzn?J>cgFP z<&SZ)8)t9f-@wesT3s+OXRFclw-wtz&B|v-(*wP$^=Vj4@_7||vzbs(z)-wt)Re=g zVh2*IB@gnRFXzv(G4Nb?Q6kf>Wr39VjRgox#+A5*;ifadfay7oF8I zI=N?*)AZ8pdNK&9rs-Y#S))dXruq{{2pi@iG$j0;O7#bTABMjnOnrV^oNfxWr-Ya&$U}=;>_}!I@2Q84pM$h#pH=oF7-&OVOu}RP`lJ{L3JUmF zD?hJ~U?40*_N_#E&RD4HSr@cLC!B#GZ-V%=AmsUt=UIS|4>u?9^Vd&uV zg!@3)FxPfA#YSgMQs}JFKxa(^I`}+sbk=z2T+|kwb_@g~x5V(#Vj%zcG>n08Fe#&y z5Ch3$)Qj8V)Q*7?8ilQg!H$3a)bk;UrPZS_EJMa8AqEnou+44JxdnSZdv|Z!YFvGt zaaj#!KyizS^zIZFZQ*)tcNN)q8P{OKD&A^etz0OXS*LGx|LTFh{`Gyh*epfsz+qJw zuJo;pn3)VLA1>0K5L^jtr|fJQ(u6D}TTD4?2UDY7Dwx9}3xl}76})9hVCn$MP}?P40$gFdso4D0bPT(dqP^b%}R%4-r34>d`G zfl{Xg)#K<2Wlj@?_TjKV77f(@@7`|t)VeeQ$wYx?`s z_|N(0(_aG+75e&D_u~Ht((C&BVD}w9#`_2Q;nF`476s;7MXzoN%)o77vuW98k3{oa zJH4zeWLKb_ZrzdEvTew3l%wV?x4=#}vo_#T-@xj=!T!F1 zwVV6TKd=A%K4&!G*0Zu>DcJTS;UMk^2sX(ObWo=&;pJ^5yb>kcvN;gO+Ez7M1M< z_QC%L*7Xg5luoJd{6UbfuXP3a^o%LfHUCpcw?#|3h$>wXx3v|KR%>j%GPQST$L=e) zUAk?{<{P%{+PN)`LRa_qff5JSfbf^~_YVw)D0FeQ0Ne~4e{8S_+8Sj`$_;-ipopR9 z(6+cJT+tQ-{>SB0h zTMTh`oWM{R*pY0Nzfa6IsUm!m*ZFQv5oow6o3{Mot})*m){79d-JACaxT>WRoS0x+ z)e(xs5KFQZbEKNWJE;<`hfBdK=T!fiuyq>K;gKXe|5Hf4&NY>owYb{f*;Wu*e_~$- zTanO%ggC6P+q%)uhFwdr#s+r*dYk@mCrb_Sl~Ss z)v)$Dv)`(SunDd1!%gFI@XVJSE0u?%3R2_NaLO!<;?CFHm=mzb>G^S)j`*KKNRNjm zUa>3gHEqSEunN1@1nX$m%K8ePyljhxpL0OAs-#%{rx4Y989lK|T`{k1D<;>f)all) z(XUn5i(ffZ#x3%#T9pUdAgX`w?nJdJRqTp;U0ZRtGb7&KfmZ$E?ze(r1O(gfS1JA} zRO)Tr>JVV8(G~FewgM72U2&~6%6=K+SWI3AfV)?WVS%4I*fJF5R+z?ZA1$JFw!)NG4@v@qh~I zalxN`@E@iNc)@J29N6s?%s`p_sDR;7TywLV5X@bSrM7#iFis z+eYIlV%W1C99S1pp7yFyrib2Pn1T5KhoD|J|0CSZ6R^&~VsNBq#Kh+<4rqIa&C-dczaKLo3mj%-a za4z+MqeBP2vb=V>n3-)cqq$u+RdlH4SngaAFmBb#rl6yzi&=Q?RR6j#BRN@Bql{QY zI)RwCXPV5ZEn*R^bnzN)i`Vh!Dnm3|k%lpO)xwiWH~4ACT{q=+EE+T6z$bY9+*rt` zIbev$GJ1h?L{!+=*O!As(E2Jh*cDaj8!uJ%!(mrA-(_1V8tua<#RbnFZs z69?xVfS?8}A~A+*aDFTtO=pdYf(PWjOR$k4Mx#`hu#@)-`HGqErzVh$-#ktW)balZ%+>_W+;G7 zk+t}&4DhNNcGWR90Gn*M`BJNz$w4{L{fDWujYD+kVkteebM>a1d%MwIoLU)969V_( z+S{@DdV|gmw#Y5qEv-hm1QR`n$dRZ*G-0w}(K>XaeLK)8s0~KWbiliu8Z;CA&#nqn zUD`%EVJ#1nwdCI&;ny+#oG=&VLcx=J~}uXr`wmXDaN}b84pb zI8Kd?cOw=!^*Bi8IyH}?`NPt^#)&Poxz|50u}GQ3Yv~J6sAfR@1ETE zQjYdMA%!L^oXF!8rPQKq-kLATIv?Onp$`hRJO3|IA^8>15>6P#r4c2G=Bx@4b!GlZ zC|H+3&LRZbgXIxO{>NCVOc{faRi85Q|AG1EFw3wq*bNR41)M{i_Y^Y6GaSz+81`|z z7fW>Aqc$vZHcqtI%SW%joD$QAV%~tKGQ3pOb!3x_-V`FraR5Y&ExtL)2T?x7oms_95)3Y{Ny|V=w`O zeP0&;p%*(|G_p3l!K=z$W9M9B$JKlHQNI_v3R zG_ZUvYS;^DCxEhDSZVMw6JFK&#!)OdVCTC!S}E1aQqMw+zThht1w7NZ@1ozFZVWPWonKm#Ar$n^ni-;(@$DQW(L@Q+_veo+_n^lY`9OvR>`RG|Vtf(0^x z=SpdX*pEU2O|id9t!f_#TE&JVX!Bpv$Q4iQg*`ocYh~X17(Ns#_b-Ip^W?-r@MrY} z|G9<;etpAXviYBC!m-O@}lB>$Bj2rjeZvN#pqz97mf!RU;S2`XovkDQ5p(*qC#(d)WNV zX=5+%-@>^86yCg<95|H>ze_}HgVQoIFsG1xGszBGz>X0+;9X*{#$2fmH>%HZtL3G@ zVU79iPz)S_FCM8tYRsUo2<7);rXS`09X)d!{$7&D<}~KebkYHfpESRyaeB0PUNB?= zsg2d|4R9)MeiPKIYBDx4o`#mmpEx-zzK?O3Yr^}4N$zf9K=;tHpmR0olRCLKxZlyq zxgXI{e~2W1J4nR8s=>Zj1m70Pmk?$4{h>vTqa-uH2hMO#H0nJ%je5vy)WiJCJ`o@K z$iF_=D(vBkR>e^poY zdG48q_6IfO^&2;w$(#RxMlP4?De2_V&zDK|{1xzz%ke>+I|y**jyK8z66Nwi(7uezw6jbjmiY{c5Z7D+EqC&hLU6qtqBrAydsZ_kct# zeVf}5>#)8JK9~%)c_7#-WE;_{IBJ8lnDe(lak12WqX|VS^y)XgN;e5~1HpL6fZYIoN3TO`O=Y~}hwj<8~&FsN; zxN|@Lk!zlEs?p9t8o&)Jp%<0M_(Te}qBFKUjCI7FeYy)X`PmX1*(qBx6xCkgHzzpi zJAV_wqDC;DIZZWNJ`57I^vxbXti$?d_+T>F^3%aqAzO-8#ZeoaL7sm*6sO6Sj0Myc zOq?x`?dfs9=#XY>qeA;>|B8BG#JM1lUU=eDq!YDG@;=*>8aVik9?mGwKcSI}8~rya zX%vTEx8(mOsidBAxz*U!SgN6{{II|;Rw%@BXky$rgwD^lICJ2e@MbM$RX)MINxjn z3ie);Fxk|!%-{CW9{i zKG-Ux3(+dIH~ZBFr>N)O1jT961v7kg1&PoFuKR_f4`ACs_>{oor~^(HQd&V5-zHsX z(Zx44p0`u91t=#Uqq7k}eKzs~Wfg0_4H{J;W0|JtnS1w6baF2afP>wWsN; zowzxOcQFAfI|H59aoqbr53#rE_W0ROAlfnk+l_d6*q7v+C&XfrV?$aXApI>t>RZCr zI7Qh&cN*b@wnB)~U!c;p6ow6<$%V@kL%?G`CZyWJ{l)-C$mf4WEmAi=o-s@{^YwOz zFyEtNd_ZOp(W zx6SR-aY53pY$4sjkTrLW1@1aqCp8M&@$rkbr@+EeX$j~7mfKwhoLjLow`wPN5iE&! zEXyo7C3za~#*|oY=6My0yN3fnGxlD1(Vs`R+A)LWzGZx|KpTaua|M|*`R z;TzL=ccB+`oV&J7E{by!E&(`<1iR<1M$ji0%HEnD+cIzXfYUnB{FIdGD@o--vq`z+a`^ z1`#FR2~`D`GsN3KazA0x9(2V9k_RDc+zlkhNSn>r_gMnFNZ<(Z{M#bhgevtL0_M6; zBbUz*6g)GF`C_wiREl=G6rpUfe*n!cuTfhLbBV169>+Z4S>JKEH{G4$O7Es^oe^8p z^A2vr@#Zg6Y~~DGnR^_1TW6-*S^S2B`<)QJzg_H+foC#Hw%Zwldr%^G z#w>6pGniy<|EJ}?*WLIzAQrUeAanD5F+W9cVU|LuWm|Ax%s;bX<>q20SE}G#X4bb6 z#xYjz-R!Jl)0MpQ2c1Jc6$xJrh9lwl0M)L*lp{_(5xL`RAZ$A|ae|b0OoJrPW+*F^ z9cMDFv0h_ePMU{hi14j8rUQp3!yexfc1K}8(ktE@-@X_`@wEKBhL-*Q4F~$>U4`pd z-U+bzDPVjwjj(68YlDguUOVT_)waeiNb0vn=uG&+LgUS-f3cG)Q!wo@$D1q1Q5){; z6ni$kR~kJAo~;1G7d``zv+q6ZM9p*sx+;gj%F>XedZ@=3x2rjBlH87IOhj`mn+-T3 z1U5R^w0#{X!(nIGp50=+(-*UaA`YEMNabyqAoaMdTL|ESJ_m#_@pJ`|^9&7)`Abx+ zgvL3?h5#Z;3~S5MHh8%W<6oK&z$waH(?KiOcBTx^`j{N;gH&r2gp*$Lt|6kAv}_>B zA8xs|GXAbJdB@l;(#e0DG9GA=ucLMB%57=~L1aGH65OVCi-wu-cZUZExc2?7R_(%} zig`yP7av%cDQV;^%Sk;wyWr3XwxJw$kN3eo@@q_Zi|0->t@O`u%=f2v9jIFrBE06U z`f$97S_{44>CggE0^Sbp9`6n`5HihTEf)Dc9Jl5;ZU)Ca=HE!|RjV(aB6K#+eHm)y zrq^cU+*kDl|DuKn{wNH`K;}QEk;^Bz8d*L^Fs4x|-#Et^XDQ4WxS@s*kvnpA)k3Qm zpj901z(T7(!IP+dDtGkfHAM5n3V1~nE57CjBC)Xvs@}zm>&Awj3T&XE8 znRI!r6M2_YUbVyVegalQ{RDZ77pprr;MvR?m%}#>SNb-Iiq=L{)R+Z5Cz$1F<~BFF z4vrNzIAt>frl%I&-^liMvY=TvzqFO z*-=y%LNC9Px>kl>wgP-G856UIf~~@dS<$LEYJ<}@^ZTH#bOIU%im$`Z@~vdr=4cm6ViLINE)r3$-nB4t=AB{C;DH<396$p^=NDb`K?u zdnWOZwB=2s&s(&kL8(c{cTe$E6$h4F;Ja$FeTZcJI+sti%u z_afSlo$(-0N1q$foCRT;21Os^GXT+uU&U>N+R6R?04K@jKMECSvWTWXOf~tRc1#HQ zFMyk#4aww>4<>{B2ZF6a@)xa&qc%7NHa`!Fi={So1rsNK7$MqOMqg=m7$?k|IB>Y9 zW2NC^3!zJIcc4;OG&ot6S-8V4(w3UMczD>Zfso%F;I!EMR1PA0FgI z4dMe8{IEyw*f#fA3-*p`3x4pRL}#qRd8(Ve&srE8;oL}e;tJyL@K=h8pt7H^?JTG` zlvk}6&XrhAOHg5TYXp^7MpUF7RIo;m5H|XQN<2LX>*NT^Z}=Mh9jVEGj@(?f%RsQ5pL#u&vQ@nB3yWW;lQ&Yljc0qbVwS7liw-eg!23}ja=L*ULZxhc!Jz= z!nU&@caDZ$c#y+tT7n#_TO-I_7*UaSki!~1T1Y6!aRd_&a(l3?+Cgq#2t@IM+-@jA z0C$t9IV%&O69?+r$t+mi zx%7i#L(ao-K~bZA#6t)~h0sCLgNOk03uOp_{33)rgjnjGX!Ai0oc!qK0p0g$8{0>U!Foeula3n&=e(+3YH)=BT`!nYHT!bi62+{QCsR$u!0o9feau(c-A40|e zlrtcwO1~|js8OGI2!Tm9_yP?qARH-aPqJNw;xnf>S(RA?kG+VZUhvqZfso(Wih%2t z8o7Az*hWcTJi((x*mf2?#wo8>@W5(Xf(NTxBY4~$QIU4=z#5Yd9vs2MgU9{YR_);N zju43A1&_Bw2`X|?j6XgES(6`sl)y8Y-Kc5I@6VX45Fv`hlbZfK)st*bqI%`A2<~b9 zGTij6S)OFW2a_?$_VZw?aD*gU6-R9^gPdQ0;#3ycqBeB}6Ay1N$>v3<@JX`J5mMJe z&vQ?U$S;E2T*#yuxofbk+ClER5QyRhxqVQA%5@Y$ZWyvAALJbHOlCJ~ zGV}X0<~lP%6p1Z0{duZ`+#6B7!65evxanE59OUr9WCXeQ23v(ePP8hH+G>#V4k%7# zfh}rNS8&9GT)Sz&PorL#=PHAoZyNCbkj~U(%9l(0lLk(Hr#JxUeo`YB4|1QNq%WQz z_Y`5x%rDcSJ7B5u@F)R zJA(0o+&m~jMKOvXcOqm>KFE!OXEM7{lbPS2G1qs=+SG;_&!49{$ZbdU27}xMaMQD9 zImqFI$p~^c1zUwdPP8hH+73a^^Po7D1xi7V(XhILi3hn;;V`q(eya$F@vsjYr*Wli z8g_c-O4-ms+#ys6i*F~k&nm`mx00sRmdZohxCT0YSGWZ*t!m`ruJAHS8X4Ly@T~-d z&z`s0X@jf8%N6?oe3mf{hjFI!)m79c)Axzr%?ID{3n z#35FzMjZNBL`B+h2y65_SG5*A43I_Pu)^}|1p&MTM4yRhIl7h)BDHJz?d(>tvnBzn z)Aj@oX6oc|VAZR!dpPPuT(Sf*gZ z`L(brZ4}M~V!L-0dvQ(!Kse)`&^D)Vgwqi}y|+TAK+>piI7l#)gg z?%EiH3-JlQnqIXtkyLvj0TGvKhbWiY%{h-?1uay|YSp0HYa=Ssrdq5~i)zCFnTy+Q zWI%yryS!V%s`3%7mFShhqIM&{RoxC&wSmA?;~vkdrkY;wL&$>k`f6EOGQHx1$)MK{ z23v*nDq0msZFfS>yP&uz3h}8;U4f5Y)k*oOb8JU>`=nu~&RrR@KRcg=b8XrkH0Pen z;T{4ds%xB3HB;`vDEv656znlhRm##qO^`^OV9Aem!6RHKQR|6K?qNCNbR;~FCi29l zcBkU(-RyQO6)C*E$xo6YsvVJ^;`9V0MdlIhd}Z+5oZrPfl|~#p6LL(9I0t4T$L1J& zH{)?maC|7&gnQzBhMnY;b&sZZ)#{#{&p)>=PIxj_!UlVDbQDjUs#>eubWlD4j(d1I zKb7Yvqz8Za(mR#sSq%;H5Qddd2veWR6V{d`;o5Lb?YL6eD#B8FIC?-FaU|l&^kbuY zDZw^2iWXPbr<^2v!I0!~efe(l}^+Py?07Y~mYQPRl1@{v69$JU3#qSgYz`H%d; z+npTwb8Fn1ewo#*0e&i2li=>YH(Kx)~E6_NO`rOdNE4~H^G>6Dv(h$@S`dS+R?`wxSlt>y z<&zN=X$KXo(IbR}R%37k6JL$-D7IC5$>C!m5XD=K@d%WlA{WJKjDLl!$*;z^7d(^M zjhe>%{*1XEh!6#Xcszfe>hL!I_>l1SM-bDqW;wj!gUJYQMzB>F-bAb7sO>(;`Fvcp zsVkUxcn(&Ou%hIEcIR!Zh)jJPet?gJH?v;-Srx|xKpg5q%WQz zcLQPDS&$p1yjnpHt7!>xtZt1USB&3E2y*vA*5rfSTfj4!-KfdT@6VX)+6YmkAgAfiQ?c{-bEr~z+=e0KZ{Q}gV71@* zL3tbG{CHeY)Tkfv5Yled`qPL2^9yAN@vU0_A!4Z)LcXVglONr;1G@jJk&B0r?@-bg zPY9W|1hMTbgv_D5YE$OpB&?<-gs{3bLdb~`6={bMtTE{j!Vye7g!ExswL{222t@Hh zND4~mFoawHS(6VTe+iz+>_$yyet*VXFC^~IQxQT6sM25vc?sN%A3`1gP_B>AuM}4q z$;qhSJ9`>@jSv0@-$x95BXQ!fq?1!D>WBmL4$V_6UW0JzMUhu&K;^f(cL2bz(8$H3 z$Q_jQ#S=x|N7!~2MLt4#wW0`C(-K8k-5OEkQxO$uM-i+s=_tYxOgxHw6WgjCMIH}< zC|(qK3`*!QihLikCLcxK37*O9M&`3t8uR-z=6ZL8C=y|6`twxJwk=*7h$wi9#nEun zvu1g=4IfO#Y}=W^R^d=dv?`9;-VHhb6jyEP3ML-jIy}YVV$=&CDrui$aS7>6O{V;n z(k4i%@>Dc$zf-&i(7iw-7Y}mhQPLMrkb5a%+gXqsp}cCn@Sze`(-P!Z-5NpeU_?dQ zK@My5Xd$85HjZH8LGB)Gt9FokT?j<+g4}DN1eNP3X4~EZS(6WP?*-3fcB3XUzdvKH z8zV%Kf}Ey5Pj!&{5~>%P?fcf#|Aw2MHOoN`A52D&`);sR8018&;;8NYkn?Y$IF$vq zs7+nL5f5_h<^!KYy=VkE-+bU7NM~v?fbkElpH$YG5hEhH4=ID&}>xgl(;c96R)1fqCBZVQy4 zq8LSxy9%-Np!yTXS7 z(+4$j@zC}GN*Wp3j^rs8Un4mD(J1;9i*HdbHHbV8VFfL5h}EhQhkhJUk#-!y8a>Zd zonjFNNGGRQJRi|=bS)o5YS;4H*+XDwUnXGHI*4ayQ%$)mPY9vhWpL9|oJ_g+U@|Co zL$FmyxuR8Z)b=psJRXYEq+CW1>Ix=Kxv@{NxCS-C7+2>Mi|a^FYCGkGyH5ifzaxAU z5WPwx7k7l6lr)lXkIX3+RRSU|)gGo?YWO&hU47p zKvHBLaf-#?1W&Q}#MGW*0rFZ-)f_I^PR?=&4YLS<7>Wvw#6c7WLFtb` zdIwRg)KCJCLRbk!A@xBNVQrb%K@=N0Xydi2gD57VEYEzIobCAl1C>Ae{2kDkYsr&z zmc-Shvx%K0kzg5w*Xq3v&lHhF7dX_{-yNT!Y^yJ6)JE6ziPCv;*dj=*F z8>eQ%lc=5r_w%D5X;in;kMgGhR z+xHr9gcBTZ#+FjWGDNZ7c~|qqy$yx{?Q{ao--pmWOJbD<;Jg=s)wGOd zS=}0A*$W~n(jLoVjow&xsQowV;{fb+4VXA;&+;49KZ8-7O2}w&mZnin^}uutwG|wg z-XtS04@~jFWDHDi54H*irlM7G)b<(3c>@#|#UMT|P*=bi_c;xQ;R92~xa~^~8<_41 zDPB1+b^EPh15-!mctvM|$1CE1FM43QFMMFSOAJigr|{hOV`PYGN8|(3k3drY!1N2j zf$8VA+J<9|*6eD@IA9e=OU05=vCE}O6^_U?Y$H=J?J*;hvy81n*X-K43&xS~T}sOU zns@B1g=Y^NMXTVRwOA<`(gBQF+o(cWhI`Ooxl%fSnR*PfP*`CXt5yZ7%UXqk=^mws zHQ5CNaKQ1Z4FlGUWt6RoQKRvyQ-kz)ub71ckS!X!R;wj3O1&y^c|;8QCqmvIgY?F+ zpV!bCk3d)nMW8Maj=`sH!J-y)-D!>m`~*c8c2Ul^J7~{U$t%sXX@+cjl4u>RehIkE zHSb9pt^S5IGqKTXf@Ms`X!Vqny-sX!w0asm((J{a1WBV}kiWz6FQDCJ8o7AnI-Zh7 z_G00c6Ll`xf$7j~H~L_Q(lutGX1RU%mH9W#m^N+Ioz2^tD|0g&Fs$=s^x>$ zV|=Lv=oNj@iyA`sE%ECh`hJaEKGD_K@;=mJjZ*ojm9s|csC8xH!`62}t2o|)Ve5O~ ziKfH9Lqjw_%#Q)gf2om+!~9lC8tL#Ovh!{*dfE+Kp=&dQJ({Xj#J-KqMy=2T0YI#HCp-U5?I?PPxQ`UaTSKM*)-9OIeSR1aY1odO;i9KimU48A;o z#RroyfIT(XDjdLyR>e`51+}CL0mqh*y(*0`WXZ8n5g1IAFe3BNum-)s!@ni7)gsqx-!o0Y;CG(`L7VNAT7U3R-8=B_+T<<`7^;* zAuWqm#ZlXLAm;;6TokeR)TXXr;bUYZK?N< z1cje^b^ErnPK}OaoL#V*76N8Elc7;Drb;4oNb^$1KMn$5t!giW0j(ME}C z85nAp^4rvR!KR)k2-QX#&!(oDYOh1cf>e7s-1Jl=Q!PH2464lsTZL3BS`|la{{}gS zpg2vcWmKT9VB%DJTu+aaDV41#YJC+df>G~5LXUXU(Uy?kLx6Th$RDP>YGrUj#%fv!nboa9$p08o zkv1V?jh?qJ@sA~3=!LO`VFTj?`qC7Ob->HB*xw@8qY;gjnAt7(8j30E+j1$`%mnb-_d0n3Ex$TWcZ@e*{5mu89Zei z)hqHdVbvVzCz0;~iM$g;)g)m}5}E4Qc^={zjGZgtrsqv^?8FC?5j(F4whCjXXjL4w zJqp=YtxQOAQ~7epo?E^kcPZM8EqZ zD$ zrkZD;MjV4Y`*m4wGSA|J$>7=F1Y3nXD_RvtZT}8AAA#aDd6w~lx`JeRb`0z~YOJ!* z2;td4M&TQaA+_cV{Cr3ng^b?~o&h}PYUJW>Fo%*x^6b_C&nm|(!Qk%MhiL?I+Jw4KQJ0rT- zUqNlKF81-ExrA4Ijr5~tDBi#Rk_IMz2l&5$MeC5`0$tK;&1#TtQuMlM|~ z?YD}^{bsG2D^=`U*b8sn9{5iQs?GwzuPCn?W*!KznwCJo>edJZGfr2>aqU2WHF_Sc z>W7EH68CGHOCwq>1q2TsUqA?JMCV^1UDZKz5kEp zt5(a-hQ7Y>@$p`#Y-f8%O9y)GYTsV?edPdz4~=B2^^y(hj6dE-z;_mQK04tZt34^Qnl6w8IY8=&^$;>}WUbu_MwnnYdU}{2Ge1BX^i`s@mR!1O9u298!$L z29Yj(F;W|`=OSwAOqmlzY_&J5r$%hGKy2b_8Nh@BEq)07}KsEOF1K&(GPjxfaJ zjt?_2b%66T|1W|0-%aMKW~q40Kh+%{6LAc7e6E6<9<|BdfDb04AL#z5-$Rv6yE1M&TJNGBA~5^`FZx~7UsEnMguF9?6|{6l zSgjhJkrU zeTeW?t0JDUO*P}rT^_=?&&&Fg85bW+2IHO*Y!x!DXjL4w{SI+*liGS?&+`Es&cA1Al_I?60>o8szsPz>8WpAd4)ULX^csy^+(8B? zX(SuJCcwtZw^i;kuWHVM<#VGjS6R)C!MS$U2rRP88nBKIpX`N52Rn9*4KTsE;pQ!s zL*;4-rhCgdJ7a7Xxi)%xcThLZrkjb5l$%ekC4Bt^ulvp`O?lPa!f76>X`y*mw+79> zETST9n#USFnosD{3LL@2Kdta8Y%5yQInhBr!m*Q2vIQ9#`Ec^4toCw)f*gUd>n3i)+`4-d@vb7@0-C^VbBw;ileqa zK+casaViUJQJcDgi3h!NrJx5N`$5{peUsX8?^#q3bK#X<+>0nkxb&|{i)wo11Cd{7 zAm?|J=K=4ZY2@N=@)Jt>;tG8W&O|TiEc7j(1+Eugg#ccM(A4=QIU4&!x}xZ zNGSAi1QQQ^o3O3gq3_}lh~kC5jZlJ$cod=U3dov#==(45PG&c1iu3z4=9(8Fio~Is zK0Vc;?^aZAF!b$*o1Qhxp${KSM(DdI*eVQtqE&I!_D9H>gW^;c*rGOd1xGCOLGaQW z@_i5$qzHXs1&Pr2AZbxeuRQdDYlOb+M(|`NFAIV zi5L2Q10|@4M-lptKI;gCz8%w!0{3KwqvklDQ?qQJi4aC&QBAL&>fkpB7`Ft!<#5xp zXF2%cgUJYfL%~*I@Dr_yqqn0`-3FAWGQt+UscV>c^n=+>@9XBVXFE+)4|CzOv`P_i zFGC7cb1RQ~X${Q$E;1dVeu+jl9{8@Oq%W?(cRK;xS>Ss$^zW)tb6Cd;Kn1Sxe3`b3G zey^r%ha-fM2vpOnr#kTcUsNzO+xNlrC*h`N&vM|y2a^%_UI?}d1D|MB9KFp#bw2^+ zsf@5iZ|WK*9{6C!(+gP<6P2Myo}O^F=fx{^3lib)B*-1?&gM?JshN|$uf@aPQb-zw zoZnGqBjCqrWaHs)5hZDEJ3-pv4{P-3BBAid5llS%oeDzhhd(0(qIlu&WGF$!Jc{tw16h*~ zfAi2inc=8O&hOQf?Pp|fYSWD8)l(h*ZbStK!{2te>DjX!{_w$Mguk(1t1$eDR>jfV zd{p=4P@c*NrSQktSY5-!!yin0($48Le4?maf^Qt9asRaDVYGLndib=bRw*Lzy_OWH zHeeq3Uaf(d-$fQ6)OTrQ<1TV1C5;SxNBUIo_Y)@mSQWkU{$a|cMv_MAHzHb&Ugv{I?R9=*TZqQ?9zs^Fgm}g_)qH%^$`C$& zR@R)%$M|3}`1sghtB{XHtK#TwG3xC<;_6LZ!^HV`O*kLNek0WfKyhmB52I#Pfr6z6 z5N^Gt_$f#l71{ibb1W*LMTvi8RB&*3@Yx zK*#S4OA*wkHL~##_Y@_K3~{Ri+s)LQf2)<6#ZC)QZVQ{a3T@UOilRp!$51Xce7QNG zk|lYppd|>gS~Y^uX%Q7^2O+G{b6VBtBMgvPJpxVqBnJK^Y-x2w8>Mju14HdTep_0G zwsbUMsD?Y9EloACrV+CsvF?&}Boiw>m<(clS+G?|tfEzM^mZcZ?Mf(5lUNxCsB4%w zv7Uwpd&41`PF0&(??I(7W<5!fSGdFLNLgxQ<<$CG4Sf9Wa1z2=*T}}*;gythYN+)= z0wON8ew=ct;p5bb6|_(*t5t(qKO0ezHnn1nTGSc_h?-iTh-jlktqcsc1Nm*~WVEFZ z5Qb{F(XGWkXl8n;^^&E)Z4G(>P=n4#Hn>P9MR`H zgVg&Fg6-({V+R2y&bGbriW3C97NORgz8Qd|Q31;DG^Zi>y&BoL)0{&|r-p#9A|T=t z@b#2S%?O-;v4R!?X0>V%@cxL3v2g@twI78t%{?!Gf;1DhVr7Q!>2cO4HGBe6*y^N zTktNkVvX8Pm3>4~>)5bwqjFducezFxf@+^6<*ALA_jMoFz{~F*%Ms>pXk_CsKT1g> zsW#pjVi1H%V{oW;Mq@7FKM9SveETQLrN)r+EmqLNx2#qTzFl;VIxcGSE!L>Tw_$+H z#cqNODNHDIdAEdVof*+uiFp|;YX9<^)|qHpzacc$z{fMKsb=1*5VIijZibtlwq)kT z2b00PnP97sc}1(@=sB4%w^TJ*NcV+u<+_-Z=palDBK}K) zBrXxZmvX6riC0x}ih-Yb2P09a>m<1{M8Ch>KCF6t1pyaM|1Fb?z7Oje-w;t5n z598`hUBkpFd3{?-RxJSuUFv=oV8z*a(DjS}&8x~3?y~|x*PEAE4oRazoZo%UK{Xf} z*|__hLP;Zu`hV22k}U+VpZ0Z^m29WHYUbhOkJYr0KdW1V{BMe=NSpkzMvwdxT2{gl zOng~M1>4GcILo4sc&vs%6mMBc8A?$3k78NL%OPv>%Sz5g_hg2nrar${Q?`pEgu$>I z&#R|8C_an|4hF>s;HGEKa!|wvlMxg@9c&c_MbWA_dh11Xza7d`8DWdw)HV2mqB`l4 zSpX#ra8JSpv`^ZAkI5FC=Jx5>l3Qm|o@XhKp9k~V?rGD^;Qr(TEW<}21F9{zVrOpE zPB^RHhQzDxY~I#fnVZ?TD8-NR-B~K8itw>Ym`XWd8P-8_tX!}hqcmddu&QR(teVE| zQo+s~+BoD`V`aOP9@@E{pX-}1Nk!&nA(7;((yhjY>^!0g)zO$Cnw@_ZZ4s-HnNZyI z9c1LDg`V>&?G}h$!SBhs{eZ_KyWd6FnS$)5r{a^{T#GBnDz0y$<$Mv4%dN=Q@SjyX zR-@_vI-*IK&Chg{?H3x^98f&e@Uw`d`9~mK{$JpNbrms_zllGNC;+qNSY1IA7ar9( zp=zdJkWU7jDw6@H;On5NQn_j7PJ#{nu&Eyt8EztjB{Cq9L5ZXt{|6AkCHbFXt>jT0 z)9qi7y?AB*`;ee9-OjFVT5cUH8w&z8G{qhGKrDI|q;9S3AlB)tY+K_5>tGqbI00vH zTNT*JX=T&Hhtfq@hz4GrzW{6||2Q4W$M+a}zZ z5AO-=aynBQW2)HMIEme{3QRfaaX6) z2@It%pOqU@zyCoXb7LX4-vN+v08atrX*P~2n8neWIcfpg@CoRxMjf9~?tlS_uAJa;&tRlPmfjka)0DX)U$~}gsOpn+Q^qWA5OYj%e<5(3sY1%4cfmzV_+=@94 z`euKEg)Ty;0>deef*ls@F}vE_v2aCWe%UGufB?*99$hzg6kA zt?CHX0bbvitBw_*vaYH*3{I4-=9=5*G)@7t97}uN=`n2DDWj3x-B{=xDpt*d>6|^9 zE5LtX!ZQjbwETI_m1f3rW+g;K`k(4LaX!J^>|t{Enu1e6Iv$i2T- zhAQSm>wtm*e?|j$g8`K?c5wvEz~zO-$Q1BBhd?@e4DGj2GMO{ZAVvbS85@Qe;ZzSn z6LOYSg-VXkK&t&|Ys|C@X)~LJ)gVY9^~NGB84nkCtilMRw7VPAt>S?ubRHXX7@L3# zgEiX4tPTDFpFT1xqZR}TFq}pBkqKxOkSde`UypF8r+I1a+}sVhZMpGWF87AqD{>Fz z?$3QT_lev$a$l%57W?vG9HUH)qlYWa+@+1~OwP*ePuXD2&D;%*d9|W^W4zIYpG@SB z-vFs?%lq@8#$wK2&UY@|qkMZ&&y!;j~zrxGWN5kb$_-g_FnunK@@p1xQR^jDrysX2^AYQiM)=8+=Q1K@RG;NC|<_#QpL+%c)1fVugA-u8@ z?8D1dcro$vQoI!LvL7$E;^iP->Ueo2Uhc)q8}RZjygY!Hhw<`ZynGTbpTNr(@$xym zdbyysX9~eQ>EYy3jYOhsul}a!=QD&(?E)tdnch$t~*S5_NKiI=Mof z+@MY_P$%=Rlj+yV?CWImbu#xlnR=bfyiO)wC-bh8Y1hfD>txb(GUqy(a-Gb$P9|I@ z^R1KV*2!$^WU_TK*E*SMoy@dOCR!)+tdnWh$t>$+l65l2I+SR)NGN(G3Qk~4GP9{_*^Qn{R)X8k>WHNO! zmpYkBoy??8CQ>K!sFP{b$t>z*5_K{MXb))ZZZd6V zch_+Qy0 z#CkX3FJiqs{vy^J$6v&Hci}H$z1QO}V!iwE7qQ-h_={NY@9-C~-e>U_vEJA57qQ+` z_={NYXZVX)@AvqNSZ@~62(jL=_={N2z+c3ADf~sOw*h|<>s^Mwi1qg2FJe6te-Y~y z@fWe)t@w*rua3Wn_3p)A#Cq?-U&MM3<1b>pPvS3Py)WV~V!dzSFJiqP;4fmmU*a!f zy%+Eov0gXQ2(jK${6(yHCjKJU8^B-0dYkYUvEFw4MXYxn{vy`1@E5UO1%DCi-HyMA z^&0q#Snn`8_Z$30talWW7O~!Z z{6(yH68<9ATZzAj_15AqV!cc77qQ+h{6(zy68uH1hvRg{di0A}?+CFP`ZNgA|_7;BsjW|7V8;HLBXy=v9JQU3M^R;5|52u{TtbZ?DXC z!HD^g149P)wl|8;&Ezwa@dnA*f#}z-;qNbjJ{lH%<8MuiZJBw8!uJ% z_faPk`j#o`=0S(t3A;u2tzutrHl(-WRK=X)4?(!7H;pv?wj}?3NUEBoZp`EZ`=emn z7eq!Fj%?d`=`I{$`)5Y-Pfq;dO8;Wju<7Ce_X` zY{!6^48t2LWu;F={!w4h=i>^R|2^dJ#LTUPaTreTY(Eue24f0)u|inr{^PU{IvUfe zTI6ND+PXa+lE%_)JCRT8K;&~;MJ|k{Oj9l0YJKVYl9JBoK)Qie=}ItzV`qC|I>%DW zc%{CK+me#;^bTa)tdtQJ3gZrCZ-cU0<`I3FGfByOMh7y7IjYbrjJzwhS+H**cXiYv z-=Qz^ZApo|yaSOhRI52Z4imGqWimqEx9ZD#UsCd(nY_HvqO5~Lth#Wy*_^t)yE$z38YI#rAm-hrnnn=HDRR{83sr1;MDQVB?K-%-$N-OW~Qp=jx zmvuBLSkZ{Y_nz+kH zQfqr*0f}0-b$xMPnUuKa9YJv;Na|hs;y#d+xaW5u?s*#8jqut}>Wlh`q(t4&fv6hY ziq!fjGyayou#Y7r>;)YNtK+pGY?Qda)ED>XNr}6$19A0q8{xCv1KPc)*^o4mUetw0 zOxQs+AD^i&?CD7fyXlAtyGAYSCVgQqNJ`j?IuKURYa@pP*XfIUbyDJ9+<~}yUK`Ov zuILL}N=n$x9S9o|X>p;3Q9Edi*6gf>O9CP$(i{4s-mNL>z5jaZH2NQ`g<-2Q+P%5I zqyw2lW-U-mizGHtbc8_dyYJH%`rVpBN6NaT16g}ods60TlyINY7w#XD5^ie;!i5kM zZY6-FGzVb20PMFgU`f6M3s2O#{Eoi3k0&MWPzT~()T&D^pJfzk#Zl809JZdQCH{@R z#Lp%r@ueL|9I^_{upIS4pIu$Xro4;DS-!vDJCem-ZtOFU(ZPjXaECmbY)GA!5 zFWy;6iFbJi;;m{GFJnfK>m~ZKU6hn;+d7afBzR^EDcn6=ut(tCagNE>3U*1)=mIiE}Qh1-&paCN=;TuyaMnjep z;go-+FZ9Dn32i1LbhcuSR8xm)jy1x$2;M$ct!xT5>8U;SEBZozF)5*kI}kc#Jv`eK zEzS#63;OT+g8pD)g0iE|_@?lY4rE>1%DV3627Z*JTGVN4wYv;2Bq-_!g{W3zu6IrX w9oaS4E@ld~EFKXyil=p*tURw^t<8 literal 0 HcmV?d00001 diff --git a/en/doctrees/environment.pickle b/en/doctrees/environment.pickle new file mode 100644 index 0000000000000000000000000000000000000000..d2fd9de9f819a812bfbea87f9d8bf075539cb883 GIT binary patch literal 93793 zcmd^o378yLb*{CIX3=aKt(KRT2V+^LXDp32o6SO!Z6RxUgTV;_0x=K>5SGCE&$+ki zR`oJ1-R_zo$DiCab?>cn&pqedbI&<|We(OTTDtfkC^lA^F#UX_*R3^-7#YF|RSR!F>c_7=C zfR-p}7b{j-yx08UNCp9@`D2lk3{`K=Tk%wTF2Hw`nq=4&GjE$lC1(|^n&tQA&EkBO zzgkVL9jaJ`Qr-k2M#-$?fVtmqglRPsRB)^1jAeM$xjFkn%^%3P`Mi~>a6A2hQ{}8x zwz5a2`=;V>($5N+`A3c&vr_NaOZr)0rwK7FJlS9M%GHz+HY|rOV z`nIEX$t+iF5=A#vvdXEvnL1lGy*amBFfRgMD|OVKCwkz^^`IT`3PhHF-HGyoAM49j z-ZDL_mb={_u`Xot)vQI-0jiR>eG^A#jG2mC2Be-d#||Goc?`&iKd9Ay&%^?H#%?r~ zddO}NeyFrKPpEl@S6L(sdIB!@lQ>HT<*xOI)oaL-m+MOPM8&-@IZM5AGH=gLmKG~H zw>UL%XwtJQR=Q+n&OsDBuz6#oR<|U$OZ|3prs`GPf+30I8M9`VL~iZbauts;k_NNn zSw_)Zu;)$su$FsK)gNJaUIi(cuo)XBCMNMuq@vQzTqqAAFsh|2sGl|F3SedL&DqJD z3zIkhXw4s`A~`ExLdBj{G$F+P=0+{S5;Q~%ykLNNOlazq!y*aURgs3CncGc0u3pbf z;L}>}Ik^eHr(hPVX1-PdhJE-O=o5{^m*~~?U*f9=YPkvX#47q?6maa~oJ&F-tuuF) zfaCw?_=6{HFJpmjMa!*vTu)E2S|FwKm_OhZAjJ<>UC3f>$se*x)mbCsdB&WbXDs|7 zrdlj%kdvH9p+N!AVBxQ@3SRGtZi{|5BmPR=OsW(0R!NZ8-)+xNaMHSpIZGnidzPM@ z)Q`SvrDyYQ<{ZAi&-NYA@$P(XX!-&lTPC zkPMg7M`aH;BE9z-h!iz~KFp;-s0I3CGIu+FlG`Ky@Yg{Pnv1nuRe4?hIu{;)(pHE%%` zT&NgkKJT74=BgJjE*h1xS@a-mtQMF2^|A~%=hobAQDrZIWo;)@a;e<21lqUcc8Nds z=B7m94Owf>tmZ3589J{fTIX*wv*;t$BI{oWW*HhKXL+FhW8$k3Do}8@={CY$|6zV8Z@&8b;f1IK!Dow zwwJTYwV=2hAVNC`s*}qPGi(^A#fm*=M?Mghda$1`mIhFIxpdXeQVO#`;LA2wrouz(qjrdBmhE*WCDUFSGF>eNn<(@D8cwz1?so8kMudq1z&u?QWr|L}HRA8G(dyRFawAg?|#potnVcrU( zSL*pbMjjg2g<{~!H*m@vY)DW`CgzOXkBL^BxmoeY(cCdnUKq*f;$<_iE=7rZa`%c7 z!X)w_tFtCF0|sxdNSK@$Btdz%Xy&DH7i5ny9zxj@m+cIXp!})Gqwy8aMFCz_@f<{C zlk~^}9W+4@U>L*9C*uj)x>PpYS@vkybBs110_ZW3zKIb~=>`+TU;X}f$OZ`OFDisl z?v?U(MM~$A04Uf>mX;y>F!UV$Le#{lHoA zEN60LnMDwyejR)(SuGHv%IY!%I7Ubrh7#Fr0v|F?L_PSnKm&7ta45YfAVy^QrI0M@ zgESxnd=`y&tCdm}2131KDq0|1A{Z7hkYMn@N?`*x( z7go^?+)!r=0y@$5@^}x+klgxmFqAXoeFo_(BudGGO;gD^P^BC=@SmHjR7&2RlarZj zal-MkR^DDHPZX`nWU*A3lx6RlnzX$Ali)?VP{^k!AcpRh`$Q(cA)O^)k0BP#L|7IB5QW29UsX;p_p4nJ}(S zN1?K*7?Etwlf)5uG62UJGM0gXIs^97_$AAuzr%FPoU3yZc90?v8G%g|4Duu~{BfiV zyRJ|o2;JFbP%o@tNWmeyH28G8N-kRu!rQMHIm?8O2tOQ+mVmv3ar49~t~QcG(K#qx z$)!jJ1%CX+}VnOy8TRjdpdh0ZHrTnuWz=dSV} zvpr8`b7yih{LLVRdX!WMm+V?fESTpohzS{^a032vG4hBKV;;mVZ;A0Kur{1SfmY4^ zNbV&Jej~aH$Aua@!bp%6iCpnFTY`+Hf*eMg6w-cg;NT06Zw>$y5s$JerkzI=tST|z z7G!41E}ZKyA`sA;;8%inXL4jk`RjK-KmCfEZu>E*f(E%r(K-)$gW>+#Y7ySIP)}o= zN9IyEPKItZ;l-e(D;gU=h5K;q({ODG=R9u7h19Bg5|{hrCiP!?PR| z;Y$O(65cLc`%12iu3&I@3F8c-Ka`QtAvD2QmHB^Jx~^qdVg!CR1)@E zV?=`ik8**gWY|Pm%Mb#&umP&`z|=hl4{8Zk1t~rHOk}Vi(ezA^x7`D=ONK|pLhCIA zVKe6t=JIkui*|~TvOy}kT6_?3Q}Q;mMrE-S1fZnrwHbnse!`*LYB4M0Q#F4%U)=8t zKVqkQEPTaq$uKaQPCI*7UvmvLWs}OzS_>2?fsKzCyj4si&Kefmriw`@furxQ+M|jM zsbaz_2?0dvIX4R_MYxUTD|WYzDx~W?FjdQlss*q(I@GM5vQ?n4T|9rQ`c_220%f@r zg4nK#6zn2~`EtR?Tg7>(c15=cSrP0niGGs1E(8+6Q3O#Dl?XG3RSnW@d{#Sm^j-*o zqQDLXfUHy!Hgt4~TcGbNBqLl4i-}m>0}9p_1&b*H+gw7x*KA75gCUi`Wdxa@7lKdPIK1F=UPqOJEyhhKPLm>x%HA7Xqgz zniny31jtb`bJ?09YZ`N<=rZesbt9DKCMp1{#VA-DpoF@Hx8ZLv^QD|QYr!_8$Ox;! ztwB)%FH}%~Sg1aMF-={f{s6fCKe6&R(7y^%H1=WOwpmD=^ks&O5L_jGdTSp64q|mDH>NtwQXm4wTCntLRbx`6M zmIRb7K{**Yw=rau;UNTGMv!e65mJPO6jC7^skaA3Fizp)1A|Jc^L!8CE)-C2?Rf=Tsg+*p-IO`#^wgwab()5+nJuH$;xb5`? zf(av4qyYx^BVkiDhf!J-K`aGhIIJd|;T81R7|Gzt3L&`+x3OZZP_POt+I0mu+Q4oG zS(lJm&c8kc?wx~a0xJN04`nJ%je3?CTsJZpqF(z(FF$0Vk| znPeVX9DN$LP+$SW2s|Rx7JB$FrlKjjXJPKspydvaiJ69Kb=DsgF$4+#R$z9VSVgns z6jhKZ!XSm1`#tbpNnuRqZu5s^95Gz|u>Q1M2NA3{$@S*?Xu{C%MU%zc-fMyF^?B2n zv!E%(8VB@Gtj`DrP!qGQl`^LAjUv`gRBREH@O#KVhacvT!fu1s!*n&A^O6g}h6d%4 z6NX{dp5sZviwN*xIS$oQ^KYQGV8st8#EDp}W5|4a-d%`)Mw8_RN?_TDz=B8(@{Nem zoe9E|^(bI2EZCln=p9TtpA;8|!x`ZSa$A5R+?A5_#uV0r1^72uLtrvmumxomg7j6m zfouzo1pb3~B$3r*7j4W`q2X{PK{wW;m~UsoOVE%ei-$IH zP~av43D2FUPzyetpGQ|P;W*OQS(_LSzPXs{6w639z)J$ISYVMU5ryJtl!3-r*;Knvg1o5<8otoFCnC+4sm z2^CbRn{2Jm#9AFDE%JiZR3S7hCp*y-M&E;EA-X8Py$+URE|_A#B{YI%RKaHyUZixa zEa6pcLAr2mYA4n-)K7gLAJn4-y^rMF7Rao*)@tf0gFL|npUxC(tJcy`LOl#76kKmw zYlQhi5O@h|c~I({VPPgaZ@@99Id!P!$NUW?OuJLunEeYM!FCbJMY1;`Xh4y`Nyq?| zj6@2i{SD>0Oyt{V2j5axL`*V+u+D^SRpuA~6xSq0N(d5t7lSlp7h}=*9GZ*|*r_ls zkbOf$qd1ILosFlC2GJSM%Fl_I_!8#ROst;Z2qA`be+!$H+`~Lw?mB-1e_+T(I*(QTUKnm{JQ1UuFTfqW=kVX3+A{t1 z=fB?hZ20!w-#_I1Q~35DzxpQU%i-Ji{`!}lr-HXrt0!)Cz8k)+`@=UnpAO&F@BO6n z58+$yr{3uNYxvfG;A!Wd!?(d78FW4qzHMIh6V8{yx2^x}>&~~sx9dLrTh70SZ#O*j zL(VtDx76e-olmK^Kl-rqx$tfLbx<|ks?v;5XF?citi;6C>^b*#aLW_Tdksv zG59Clf*^1f2Hp_fW3QE#ispaNB!!&5ZqeZfhr8swKJ!{dPWUsgRTNBk=Cz7~BG0^5 zQE=y(*D4B9J@Z;c!M0~!t0-vr%xe_|Kc9K6q987{YB(}KD1w$(7D$y5&~S20z=+%7 z{~00H_EshZuK#OOfP(e^wJAUo6#um;K$9|^QeYzHW6^XfCVnw)yKJU00V zM@zU^q#l|pj$JWOP#lJsCdaxFUT%T)(soe+QJ&p@nvPK@2n@wqQGsHch>kxVYi+np z0BfIkoy{Ucxx`ato${zP$*%%kjhSG%$SYfOcCESQ8s|3r#OMEhSobUs%!PY_Gzy`N zPUO|pTwQWC(0ny9IJp{v39RI52qv47t09;eO0I@r5+}JDf(e)8Y6vDrlB*$@$Vje+ zVA3JE8iEOenJ#LLAX;BbupiTEl4LbS5ROld_Ce4(xf+51a&k2Uq1ohW2*RYv)ewX% zldB;JA0}5r5Xwugh9In#Tn#~pE4dnia8q(M1fiegY6!wG$<+{qL{4^NOb7!a$&Ci_ zwcVF^C0?>)Ll7`Xjt7B5o?H!q!<$?Uw6ZZ#K2-fd93nxRW6k_|bJ4547Rw_8?@>BP zx57d4*UH6{*3*VIUL>mkO~*v3uK)ODC4{aKS0!3#FN$>KZGZ~e^@+zTs&SS9zV&C zs`F|*12kwUWE(VilVA!#ktz-~z=n7HDbI`x=q6BkJ-~K?3OSW+P#L|~J)gp)FF zcYjOH2@KxcAqM1hw!z@qqjED04g^Y_w<|euCaHZ7w!B37@;e=(Lf&Z`RJI+7Zo5d) zwhQdt%V7^y6p=sb5D{`>+aQADRK*6NI8E+Wdt#ypeXv7>$meZ?(9S4A*f4q?tD#f0 z898O8=one-mxyBY|2o8oeB?G5ZGRE%F|$%;iZ)N;^ph0!cP(Idb2)~|QypSLzH}Q* zHXY*))u|)A6)o5g6(z@)Iz)op?KVh^N+f2mH$)!N8pYr{9b!Q4cpD6MDCtb`9|cE}M(V!sZSuCeOP~#hW5TI41Y~#kI#x9U?)_c^f3gXp|GX z(r9H<>TVpS8Y9GHhd9vswKh0xRVNi-QwQ_}dPfl(jAD2^uR}a2jL-&;Eyts~8dCvJ zVrU%i5Dkhov_WIX*_@R+&Ig7UQx?dfSCzm|`JqD!%zttUso(7n(=SkP@j~r%vA*BgY#%#ERl4ZLr#1ht(M?zliObsna;I zTQMoM>r5SLzt$mY6nJTa+U;j)+A(#QPs>W}I(zum6m|ippjWVW8HapfyiM(zL26Tu z{(grDQrxBuf@5dG-OJ7O+j~32fg(F?aM(IyWvZ~17fH|4(V$|kH?G_MqC-3={?i7J z%`vvHO+=dsqnhSp9b!Q-qBdCcpK0#T{Zofk(|VOQRc|~Csq|Pv57VCd#X9HZs~w_1 z@t-y*44tLj?9D~-`yEzK!J#(Q4~YJHlFvhkGJZo(XLcurjoQ?`G0*|<=;2P&85S|w z+uk7x6jy44!YBn|j^o^k<_vgtXBbrd{=ADbuIO}R6-VOWj)=cd^n|x!I~2U&y`ByQ z5qJx>Lq0rjzjnxp=B?Kbd9S?f+99uzw_H2qwefaqhg>J#YVD859tmduN4jH$+t=b{;lDAYlWa064YKQDA-b(F|p~Ks#9kM-m3$;T7KX0FQXe8#X z(+-V(ylvW{!G^a?JEYZlyR<{PmA6Veq}_O%v_l$(w@5qG;W;SlP`~4?(GGP1-WKhU zK=PJohvb6ScsRtLD$ZEPiiB{-y9l)n%vN#yh&V1c4A9jDxi}`*M+fTifh;YGVacC7 zjR8j$$iUwyoM}Fd7x6li&z)%Tu|TFTj99fQ#__fmQ9%(~I)25XNNYea>f$6YoGs7; z6foq}L?p9cEV|)tQZ zU2`8chi|SdBzT!b^ZUlb+3N=KS*W!`^3Cdkcpg3!Of+;s91KASCR$e>+*MfI(Fqno znEHyPXqTfYMwb)velwcX4WXg~IS}AyOSx4~{3TuTsh;@r45DRE+~u_DirPe6e?}b5 z8yn2umlW0f-f?*paIK*yzNd5Yy=!^$wWQvaOW-as>oNc@4ih!d++He1!A~&-#fZ{_ z^`WpV;=_sGw|h5VKe2mvEjE#}PFzY6HSa!u#q5y8{VYDjond^H8ZK9(V}5XNj!-#- zA^I#UP%1Je`2D+gV>Zh!c=c%ah~yZI?{^9_7G?R=Aed888j2}LC>6c+Db zEV|gUghck9vAh!eZ7U{Fd)FtV&0!+oU@K8!1G^_tYlrN9jxLDHCbaedFmjAe_e`Bs zr@=*4&;5x}d~}?rQqqyBlm^P5(IuN2QBN_5mLqD{1$RJ@^9V0Gh*Gke7$rAIO7elj zjpJ&$b0WIBAe8v#bwMa?C0N-7ZKVN1VIfR34G@YJZ|p>KW6b7t7*}j(U%8PZRPp65 z>3CO{1e{ve&eVQ~t~4pd@HSl#ijQyA1wqmTKJp@#72{)@^)R3568or8?b!E}F5wjW zp40`Q*!P4k2+2NP0kmT5yWGV@!?<>^8y+vUt{opYpso%rqdr{_ijO_IAS54o`P7Q> z@$yz;-Pt8BQrp^b@t`jKRBzm;3qo;mk1hzwMP7S$#az@jo3Csgo7E+DQX|{3b5@s- zik$|7XlXRJ4nyhM7-L6xH!WS(9`2@%d47*1ML>VkxY)^?j_%}bw4z_tIaObw3qp00 zhXi9)VXV^n`jVpJa(=MBa1{>tYXiT!K3lu{!6E4m;OC-!ak7wK|pT)1In zQ%5+Mma>Z}tZT!(CZ-=3Q!Q3Hekd_+JZHSBaFSuKv|UUCr!=j$t1PCmq+2E#s zP?y$DXn;^yyiB(tav0+k%PTjGUE%8I)qUMDE~%C6#>P-}wvb)H5NLt4y^m`{uoS2%N% z)up9khp7u9adz}#@ii|{i_!k^#Ax3)ZfDbcze}U?c~qB5iqMbff=HaugIENK>7rZ{ zYX44R)E>eN71!E|U`!$3=_VhOF_kir*%Oj&V(D9tc2&$w#kN*E&T}@>Hdw-LBVxm zAt!jLguENB!TuQoE*%=7Bf22!nWEv>Dc4ZA5*i>B7T?l!Xryb%TSu?hHPnp>UFI&- z=`INyHLjgUctTeaR1d#b7ldNtFq=vO);esyl6bn5D zv4T$h4Kgej+XbDP3GO$KS=(<)ik8s5G7^`GZpKclTZ0>P?;AR&_3Ly&sP6Jw!LDwH zte@4CDQTScP$*#gXOq>4?@o+03?rlwec0&61INX2f*nLy56qEn=~I8nxmDT|z0XSk(n_*|gSnZHB`=$xTlC_~pcC zJrYj3rAy+Jkp|QI7j%iH=>8@Kv4VPJ``N?cK@alyloT$|PMtX&li~L!M%Qb{D`q;F z&y=K11A{a!vTva9yE~`wJ9R-Q$$q!>UCEYi5uX&ea&FOOpE`K1O9D^r zYv&;4bVX9>dW%7{G;F%RR7f32Cr@t_8|9*#^Bzx%g#Om?x$tPywAk_3VxQilos;$v zT@b31yh;~@>Z*dl9d*^&PO!kvDn3Ya<+^I~15MtKMs#B*4mGA-zkHuA!BoF|4})mg zFT20!|E6QpsXY_HqUZSRO0!cbo=S?I9C1wV!HhO9b&gN4v^=lk$<9gsgf0lxUq2?e z)@=`Dih0wTJ7TXq_G?5AGmQBrYX=h&et!zlCNQfdy98?3&cUdqak4{YvC(N+1^ha- zlz(8kx1YJUw`Jdw+@q5z?QD2XW{iKgB*wq}f`5BkbvMaBEGGqW>G0_5h6up3I_Ka{ zT@Z=)zrD=CsdgMxXF`_aXWhOyG4|~h?3-%CJ~fjD%o=!ik1pZWaCKA{#0v3lUpwBl zoLMU*&AWYVc(?pao1;s3#k+Z35Q+2d7VdZZCsKktbkt_b_Pi>#YRxXD5P-mi5@vl! z^ipCByG3-i{b|7x+AWtB=%i;C(}+e?+_c#=KKfI-BvxE{To=R&ap^!CF4aX#-XKM->34KNtPqzDw%`)ts?GY+N0a8#!RA~-khNuB`iL%x6_@^27ewM* zx&azbS&C{BxtRy{t;Cpf11Y-DBvkXrExoUA=n_=%O6Y1u`63Z%FzvPjn+_eTExI5QXUujmMj7Sz;j99>iRGt$K!` zOH9R&m+68?oF9|m2V5Q;+vw&O8c#9^k8E$+UtXOUizbOh`_M-it-$Y5dMwzv+qxJ1 zgf7Vy*M3|VMB-edFvGqH^rFk*Ta&)^8;LQF!wmZn<+~i#wd!%du1k2uyI<7>kvQ*e z1n=UGD%lBDuW1kai^Ld3`x4SI2bFqP)ob0O{!EvoiYxy|7ewM*p-GMX)T1H+gpe;y zdeD~=V+<{$24nU_{hg3Ct$NHCbqT9@^LbqmiSuR$c!Qup{HD}q_S@)iQWiBWl}#T= z$B&O_X~7Kvj}C3=0bLM@b7M2Of#AS$YdH5M#)r+shlBO24I2a1dvwXC`on}Sh`I0YYK%F5USqxqgN(nY`jjdENc1?eDA1cS*XaUG3)QZCxQyax|w4LUAyo z3qo>`Z|Gbx4z|7Q^Nn3%AT_HU18cgZQw;nWT@Z?aKdlQwGLWw~y=@Z-l|kk_53^zCN(R# zuAPgHilRkp-mTz*PGG>vV``P55yUh^d0unqNsPntgTX!v!?m*+F1dLwU-dlKfNe@h zW=w7#XKjhutMLkk_ynkU+GucQPCR+Ul-JbS2G?N;;IRW<;$MuZ^G4zsJ@UX2V$)bA zdbhnnciRgp4xtc;S~TYssmHSN{`rfR;g#&Hk+B6DHxRSH=8DTCp>)F%f71PN1Tu(nY($7x%8K<9{ z>E{;uxs`ryqn|YWOw!LD`kA7i{q%E?e(s>3=hDyf>F0&`vHaeGc_C|+D!JN;)&Ba7 zSz?jG-9qzuceb|V_vGv>x&rcJ;?P$3hHB9bxgVPO!j|TfVV;yskda(BO7>YRE%r3*q?*N+PZbbBpr^Si9xkrQmI@LP33Bu?m-cQ5^YVzh2^_tHmoX{E^h5nT}VlLiQd#W~%E zNZ<7dXyKO1vHNbMOSh zCUtuxx)D5>v*)X2b{r|BK(`Jk!HzLxCNYMj#=!}N2Spg@rh(fIoLESV6Jz5!_dG3pj8@&SkjT@eoFaZn7eqbrHHIKHiV5AP z0YYKXtJ@GcihX@$N3oGJxSSZ#92|+)N?zj>-wySa#8@*P-QS%HQAwY(7O?_`Z?kH$ z|LJL6%Bs%r1ziyJ%+XMXN~4M{sR2S^@$0$`ks9@rS{hY%TDb=*!L7#UV0LZnjt4+3 zX{SbSMqM3x05|D^P&~U)7lh>57gv;L*BzGg4py-C2bXLG>rP^p)=ZZ;N$qRL$iY~E@8qqXY z#@vs)_L^%to95&;#iuz(Vv~OcPA}rw&Uh*gUE|5Mcq%5bu#b&02Eq)J5}Hk1{SUO$ z`E~kv3;p~ieqs|yt5$3R>4!RVlBm{WmS{Y8zE!O)eLT>D`$wagf^8j)SLlX{R`Nl0mezuev|Q(R3ocoD|WPn@D#% zr(Rwcgpz+-FreE}pXL+kZ%B;J%T1)ePM1nbOkb-DB5^{?iS)*E65p8^t=mkbzg?GB zirjyo3!L$4g}~!BeIc%_(!< zw2L^Az?{YM+xQxV;Z5B!!5WC_?;7U?$(WqL+U2zAr9*tu5}&lhr(s%g1CZ*_R_oIR zp?XsfgJ`*aMAy6BdD6UK7pjHSG%tGPsUvY`bY;=VVaaoxL3oKUT;tVr$gXy`>auLY-Gni;INs8f`WB*y*W@mW-h^DKjE z8#>*qbQ!03{|W}Nf}_#FnUa;Uu}JQsU7Y9DL}3W1EUtr(%+!{uvw1s{!qjM7`TbgA zL_aj{MeyTQM&Vkpvc=QqYSmF%;73!pP40gCmCm{I%eo*`pZEpA;8uM?ceJ|o{?dHe z%n}d13d}QWelb`bCi&Skvh%^j7`J=88eo(TFbdX*Ne%`f`NlPTAJC<<>PUa03!KqxGP64d}9orSL~=PY#HYTB$0w5`ZPglKbKbbS7Pmt>9_*3LipuC5d) zLHd?12*tv0=z@?e{Kj%DOu*mkKV!{dn^&=ZY~8)NJ5C6-ryb{RL0ujC7SCc3EyvQX z%l@XbRwh^Ebxh^v1U#M;0sYP6m7sF0S_-+>V4~dJIa!bBf>0geE?p2xvkK;Fs6~av zPR6387-*ZPJEu83g5_*heaZ%(5VCtG$G+HI}aRbM4G&>`%aIy(;MImT3)P*af1bep6zk-T^xm z`&ktV%l5)IbWY>f>4H%5|60MOZkwW`M~)v$;Z}kcgUGuRw>5!y@vKu3Q%-14G;(z~Cahij;eEcw-=df6a8j4C@c>^A6v zP@><*AX>_(?m*PrR514^M&-V7KG}qNLW8E;t4k#%qLaEH5+^imgrg%lurEevglV^2 zfU$#Vim|&>IeC5FYbVtP*0H;OmJI zdk~{NRf_$-&_j(Q{#SLWr3n6IT@Z;AycZsRBeAz_?T!K4pmzPfad?s~2)!A#c4)(H z)CFf&b79p`5|3`DdFDFAX*N3UH1lV`eDqgW@+8j zX{&6zS+V`NHFaN_7Gi&x*)d(#}w0riK_uZVezQ$Xej-Ye_UDrWFWG#FlLgx zze~bI?P=$nyib?;N`BtMAX@6_Zbrs-IiJJvw2{4<{^s4g)ru0FSxPrb@7`St4yyIA zpVJ?0C=ny~XRessGI;Y@;KB!HPV*_3)56hyN|1wV9*A5^5v!95d9zm{?S3y`@me(V zwa5G(3|Y-}AVJV0awA2f75XHjYdV*Iq_1qf5`ZUkL8z|#F+sHM`B#mS zvT^rrm(JBSXjNdfoU!V~WGJ2;=-Mo4f(7m)(9 zUV;?MO2{xH+mVE9&;^m8gb3DP^VGNVgB#eyHx1(7%lwnTct5w}osJ)6&&j?Ts} zCB}oT(Qbf4y2I)l`oU{-DX5t6le!@4nQ$e8w`_>Ac7@HP0YYK%F5OXATDzZES!;J= zu%Z>KJ?P+ZsJmDf|C26>7d5M$(feLq8Bk*MZU(U;Mz0vC5a!7*(t_dBIJGc-+SaF& zBAriR9PxnuGxO27GZO%pg~^! zk>LE)l02cKaWJ|Dm3J7?{Er`4vfm_Q^*EuEj!QkpJ{|34R7aS`IPvVnI5Dmw_`H`v zx>K>!R2!Ky-Z^tpx*+QNgvJP?1}UNAG(adU-l;2Pa*%p*We2Iz`#r0Cyg27JpEZ7Y zmn4l^)ozS>sjdj9G3q4@Vg<*jrnANmCq=a7W{od)PQCNGAe8i11OvJ~E;XMuesf}U zUT)U-mvpJ5#PsKNK_pJ-mf`+CO^nuU!u@}&ODje0|E&w6p4=J(gBn|eZqfjuu()5h zA!2N)`op;8%)l;f3LEoPNOS_=7oeL@tad(2j~?fr=&{QAvUoft9^Vy@Pt#+q^AGgs zbN*E%{xdz+IiI0Nuk$5(taiRlk1>ZXt^_c;{tyqkKM#3y*$tr3Z3KAG$<8O%ICL^8 ziqNr^c+io8c+e?oc+jC+c+lxgc+e3)_>K+=II-TLO;$*xy#+vmmU$wNCd+{fg^JN4 zvNw@PL(qw}RUg-hWenV=B{r*jI0R87!Pbf-jmZ1p40*>CmD|NF_(8ici-|=@H9HKk z>W}a>Uj{B6D_gh&ET83u(2ZZOl?}SYSAVHDx&utT(Pd!jjcx@~Z)34Hx+hHK(S>2^ zjcyK8Z*+y2dZW9<)EiwYrrzjwG4)2*jHx%eZ%n<>#bfG?ZXi={bQPI;qdUpe8(mJO z-sqMx^)?lIqkGF#9$jFj-smPX^+s2ksW-aYOuf-1XX=f3MsFnWm-r-0^+rcpsy8~@ zGJLE0gLE4jxXPCndbQWq{81sjRyLN}pLGj3v?FWc;y_5SzbeCzfwJpX3~#Y8>*j0D z_fWgvGb7$!Uz4*<7ci4F?QigG?5Qr!AD(p=ES$<2yuZlGyXWz~j_)O;<2tieCU1(9 zSMa(XH=`BJ0zMH_MgFkuoxuess?3t#XJm4aNbKapHFW-6MJj^dU4CVy4z zq95#;*b{!TC-%u!^~r%L?0Xk=7*k>Ky|Lnhs`&mrcZ7weE~n7GSfT4fNCyt?yCbL= zjoUM^H-hbcosSOad~{IfqeD6$-El=9VZxN|Q{5A1bvyC}UrBCTYyv>a$OOQHOaKU* z5F5qRJ8nO4C}gUv&~(U9z&B(l;6a809%LxsL52cJZ9SxeQSpeQuBwX_ipyoJ(7_NV zDUB9eCa9h)6FkT=!GkOlJjgO>(m3iwA)v5vWWV4WvS08Z`vniOU+^IN1rM@cR2w&i zf_rG+o_*sbToan!R}WXxWBIc27B62m-VK*88}E(FmyLJI<;%wVqT}lQW7j_aVxAn4vf%S#Gfj4)G=v91k+V@gNf% z4>G~=AQM~>L$Q4Co{08u)xGx~*rPgJT-X()si`S7j>M%rQs|CD3Q}CWRiT5o->x9V z?l|Vx;?GJl&T%aS6FvNz1;*uOIq?A`&gky!2){V<?2WZYve)8(59+PAGpC{>gRIu%uuwB3V4Bo7?i4=p6w*9yrPq*gK*gB0(X zissbZrs5Ts$4Cck?x-atjcqHIa%oko{%S{r)b_(0MF?(v!Od3bKKj7XUyI$cId;os ziNT!d8PZM8fZvlhXRSPw%I}@GitHWMoc|8EIYf}WQqC@3n8>@h*bE_rQR8gcEXo65 zumIq~V(s-n#z$#?*vOj~7Y!WT#sw_o1165z&DZ>O$I0=mRcf!QIhP3hozBnT z;k*t%kK*o@*+(&Qg2Ms>;JcU(-*EZNPovnb=!gD>lPnIY7I1$)0=LJr%yK4IbKZ=^ zroaYfxCGXb%v+5({z?Q^3^C^|4A37ty;#ZNdczn>XwU!-!7UqzXW5AQaA-y(rDc*o zOmnL#Gq@VctKp-Kk&g^7gOhiHZ#hSPo0d6#@39LeqDv@*Z@1tMO+?fXxffrCbyGYj zk}JLr(b&O(DLTa0OEFwN_D3QKu!A^-8<&C_IONwYTOzs?B&KDeAG`S)9}RicQpqh> z5N}-sI}1j!H1tdYC#7=&4i3j~$sJo0=}}0Ic3Q8wUg!Rz?I$ zC~Qyrb~Np5YdBGoZL#-4MyM~w8(?ZB&38q13fblKMoHas{1dtW=) z^}-#a`Tl0GVXfZ6c<-Nx>|99Mo>#T9soBNU*~4_ZvPt)~))V4DGk}N&2!IFL0Gv78 z0PtWlfQTFjfCpOuoQYu=5!XNtf+PqTq~HcLSII!wms^M`Md2GnbuWo(is9@DgXT*n|(pOHYCA`!4Gf&>`00}#Nj z!&MjqW&0wVp;0t~(r87%q96&a0E0FI0NB$+!Huaw4`0iZyV)M~BUykVv;0jFO>|7A zvYy>Mm#=!BYhbSnsqBn-5z{~z=_tU&$3>QD`)niVLCwL}~oI@{6kgb4+c!i13^5E{bGD_}%pWBmmk0>q6Xj zL43B2EG$DCS7BHeF9KV>OQEhvI%}s@5x?cl834Y?bLZ!+O2szJ`FR{1NGBI!10El1 z8|L8-29@WxI9(UO2IW?6Oit6$5bOqpiE>N5U$?OzpKa#iA(4cQ3Tu;(LlBuEnZ%Io zL7yBWOEwh_&i$2g)vG{~%jbgqgPg)wN}#wH5Khwl5-j#|Lk4%9NqpXR`o-^R|G^w?fgbKV4x#Q8aPOYlYx zkMw%*M&62aS@8B-^hW-%^V|3f3BMaA{2nLx*H*|o%$tVtDsq)d2`E1(eSn|@Erl0; zN193i_XpwAIe$P9$@OsFCaQQxnDB=p;g2YRrUadLi-h-50!T6O_QWK~9Q!WF5V!_!4He#Bz(K)8dyg;e8qN&vISaWy~zcXC5zq zT8@KHXbO=M526lH%*SS(<33MD$f! ze;@>k77z$IVcB32V&SAYMQOw*v za3`#KEcJuUkFcN(a~%UY&hw_bHeebC-wemT84-q&$+xZsMfzh!cA&XN5R?$bvE?I0a^(jaR2}S literal 0 HcmV?d00001 diff --git a/en/doctrees/errors_federation.doctree b/en/doctrees/errors_federation.doctree new file mode 100644 index 0000000000000000000000000000000000000000..8ce281d11579dc26855d7a7940271091ca8147b8 GIT binary patch literal 56174 zcmdsg4U`;Lb*61;B+ckwLb8o5-1gX59=p1GG&34WwruO)BgrEn$v@bbc1?H9RJD4# z+g05&8ey{rme7XUv#jZ5lkk&}0GlNXEM!@h&E}A7;NaaQ>=Gb^Z~`aZCCP>m-~b0U zA=&-zt^ew(>Nlktd(ZkpjrKKd=*h?P`TP@4mWEz@_LuPQy)QodzOK6ViLN?muD+mLqNnyr z{njqk%3RZwQH54l-C)ef=8)WK>Do-Y1qf8-Ra(VB^~|;9nrs-ji1xQsWm9zu69HL<~1{VS9Xe_ zEF-=wtJGJktAP4WORj+IHH56JD&>okR&Lav&S~@VoC1vbd;$OSFQag*Q7UVCxu%rn zbVaF`IK#ZGU(6c|b40{}MXl0O59IbtxNHn?UOylAUuoGEm9dzX6t$fz*6UePMDCDrEDBVG0N2C@1e8eqz1b||VL)W;%QfrYoH70yyC zwCi5Y`?iCwR7y3a)lzinQfwnkyUl#C5B15#3Gu$cU;jwvZ;xR<{P3Kk09 zRh#LJkxVZ}GQE-1L=V&V5Yt9et0aj#-5(3HI_`+J$Ld{?tj6RPB5}~InvcP8S9W&> z7<3=x5cY1Du(#NRZHXl8`AEXHL=tu{D+oR-cnF<{40`lGefiqBLt5+n``Cv|BAL zH&@eg7~|%fS`O;BrPMJD<+OV4skUOYm!7*mGqL2Iiyoo&Hgm#7!Sh=NHM zDP`CCh#EB4v}Aow@$5s4<5S?QbY|-45$X7`qhz79n#O@bq0v<8S|wjsS_Px2z%sHf zNRYLOQ!2$!0$Je{BW| zejWDBE(b65NEj@C?2crzAL#J8v!!{ZC1Ze=uL$(;d9Xn&jORy#O2>SKLx7|=(Uq-- z`N(kZ59>|0GF~gH-!V^I0V9EmIqbYDmYul(JICGDEgh@F#9hjYqrD-HUg>h=6DZ6L z@JJt1ZmMA~Rmn|d3sQD`?d>{z-4x50N_?F@Asss8QM0(Xn3w0!YvvjYc?}&$gY{Ry zBtmZ2T7_8+>ZSlq)WG$IzErX<)M|5cC3gx`lG`n{p<~XW80c2b%4~?Rf!drT%RX-0 z3my$mIAXIh6>`YQ#gb#`6ljpCqxmBZUGXUDr&h{HO$tTYGa02**1K9rS9~1Um-Cc6 z(1G?jOf37k4#=BhLC$iI@jwnAsma>BaaPtb*@St$e9(+ITui9_Z}2f7VTOz+Vm56( z(Z`6Lj2Rj3P3FnUvE?!pT}g+oTVm;|gy}l3=$c&9F7qH_q-85uN{Fmi`pLq2fbV%e zuIyA6S3Rjbs*a|kDpW&{L3R?0 zpkNY@okQu^@mI{D=2mfP4nbYo+@zHtUlB>vkYcvEiK8Z%?&|zwKEK@x?{0NrlK~v+RQctU>d_{yf3h3}Mo&7;ZN(M!oHmk-S&t$ zC`yFC1g|m<4R^)T(2Ah}6AO~x2baC-5m}K?X(5Sm?14a5tFJ{YggEwqKQ$&TR9jza zkHXVeL}9q*4x>^mqx6!cbjF(L9o39-V?oiEu_97&vUsh?uT9;RvMshqxe0ypWZ%pC z?|Dod5M{#6?$yD;osY%sHz|)gAcoJRSvl){{_t77v7liQ(Gkdy2;CSaMQTK@qS@&@ zf`%J0t7)gwlhs>UhrL29d()oOLc!`>pF`(Sr969t6?#a%{~40|bdRNCX~LGJxw z`#x0$_q|?}$ucVy>IlW?GT9l+k7mOT3hK+wm^7Nm4waEPJ5;E{&YtD5Lo4gqu#>bz z@5s)0GCRD?pE)~JF^8S8WwVn}&l(r#S>wq)3+${w&!R#dcE*>@&O}zSGtswajY|_r zJqzs6{fzYv73#1vv21qsX2nkU#g40WU9CJW?d`)3-OrpI?`6*3WwJAomEJ)?ePw5& zkKUm&GG~Vhb!2BUmK}u+8T$>fI}lIgGaI$Is1QRt-4}z7W}c9OBbS@P8P_GN96w7_ zqE=3l$zc`i@U$-lPZ?=wsz})SaanNt8S&(|f7}!So`QNhGoCz6y+4+xCnDu3BTW?6 zL)&`f$ghRmyDm3D9VEQ+oFqS<209SSNu<>*O=hKmP*A9U_3G!zJ{pM1@b|4utY#|I z=~;KjvJoy%nToIg8tH22V>xf5-ye$sgo z-+NQqutl4*ogHM0P1(yuFav6Jt z>wEx&w*6|7R%s$l#5S^RoU?sNnsaO6>w0`Q*S?es-1R!%jAK@>V0|5pbvTwy+A3W- z4FVPBQYKP~Tu))GVD*AhxSiTjVKQY2tP;CEKCRo#rcAWjw_hGYkHivs3lVx~F3g~R zOJk__t)_cEpw4d(*>!$V36$hC@X^@%yp8HpYt-kke|w=(mS<|%$c`=X5baLqF(>NCSlY`#A@J{bbNld2@SRf6K-D*0&O6up&33XhnJ zam1_y0Eg>iv0T5MxVDifxmvqECp!SJZ}sJ*`+BEV64%Nh9<}l@?k4J~`pZxH@mSJ% zE5xzsvC;j~_~;(Vx6DnNOKBNezM;=y2XRfqE5`y|z_#ZC(vKI5CHk{}KmQuVs8A^G z$}y1r0EP#ldK1=cHd_t`!&Lzg|7E%{}3C93Dh>4{j%PLiA+eNZ|w zbu1{9bMocOIMyb&XJ@rCHhL8sUwFTn>sT+wVVdsQ!Jnn zN5=vFM6ozJ7SW*FDmCb4obu5i5qu6x^EGbtU5|=oG<0NL92QQ-vcMb2k4+stblwB5 zv~{VbT*~8bqbcK0p{C5qHP;F}HeI;z=!L?4I52Y%|FBzm;kL0uXHMo%m-3KuyegTP zgbK(Pi<4vY_t^A_keCl(bC~SkI_F;Sus`mI!AexeA?8#pF^kj#$dZ%zT+)#<=R$pb zg~t03Q=8aE=JmtS+x6Z%9(QGjJ5u2*RZ)k-)3F@VQ8$!DoxtYvy*)?7?jzF99y;gI)oL{09zj!Dvpf=GEUD=7Y)hgmQiJxwN!Z~m7009Y zXsp65A9nkvhkCCgD$9I|)B4k~KzQ$ob^^zcs0Vp)EL*qtRG)?uOW0pSNB-Osesl__ zI2MI#&`KU^S-P0Fo7=}B8#DeA1Mg%r%oU5sBz6NxDuK>EUvFKh)GI_?@ ze1@^2KSpOq&^TuQSUA8*IthL>+PYlF>HszB)X~UR9kSaW!-EgAeKl`g^^gm%D)q01 z)55Qb&dDWZM)^+N&&Sq%Kh=He{F!}wi`ckTEczCl8HCYb z)oZliP(#)$h4JFP$w+m(K{Fa|AwCe{>mHcf9R=L)K@N%wu_(wLN(qMS8R=-Fynn3d zd#S*Mm*obxMYBCqv-h|g1tevEJq8T+;#jFUMyn78rg#x6b{mkZA>mj*B@LhpUiZ+s zsyA%~9MliRqCQ8cPd?()N_3za`>x9u72O*)QR@Po5cdzB)rO%+Rrn>47L^%EuFcV@ zS9RV9N#v^PqF)`^KRuAH9=h@eJ8&P4h0DV#PON!aNBF6ht>EIdj%NgQ4zRU+4Qv1O zpt>)kuk4`?%tvBj+O6s{x`m$@Y*nRR)|Z-eJifP8{S$3K4W8S*(pL37*n#_KEZkF; z5T8oXszJCHmGCeEU>Ac;N=i%P0sB}iSZmugog0yko^6~>(Wq8etu(RUe6$!sI^^B-wQKOI zhud945XS8lPtSJHJ|2tq5t7|AjP~3z+qVk8For#cfwwev66d+82sZFKt6sXlmHpQ| z$jj=v$yIRBzb+QN#)GbOlt&uLqT#$!#=;1U-or^8Hq zw;D~YY)GT~qh>%iXcGKDd2>KF*G#$TlM6~_)y?8Bl+0tz?I2fNPlvQ8Vo4h#(#{<} zGC482&+8rZV12eMDHU=~!4?;O7VwYKg?hnS=d!n#!FS1n^=hZz_bJ_}^y@_`?b|4p zSZsJFm|a8v_AlS1Z9+RIT*{qao2@3TH4@;83V;t_EjD^9jPC}Bb8HU8GAJ81lpcJ`_B}v^ZkY6fB zIuN=s)X4&Qd^}J(e=iHC^T;_KAV)+U1j=&j>2M~;a>i@B)>6?@+fbafB52%}QjuWj ziE=l%qfv$yaXG7OyX8ALwf2J)QlgbdhM)!0Ds_*;6wQ1I5)Fv z;G8H8msI^Y(w@2}gED&S!Q!ndc(3S*w@b(>z2SFk>#;EaVbPa*vQ*#U17!}5jIa}v z5jan^{0y(bnQm;p@a3z11v%^vGr*}`*Ll^i<5s_}@iof6v-)NHiS*rQt3skKC>EQM z>q`Q;zGyw*KXcORAK*{0(SndSkBl5ujIyrrtl0)${Ucwl>QAUZqGPMM-j~*c{Zk|m zg#9BVT^?-s`mFvyAlLF>Zy6am-)=S=I!4Fb%u*!o9Rn`z4gSO)@N1Dm5cqZ^T^{hQ z0KP>aR{*#Y+qp@gzCbOxv-&v!I{%ZE)av@&v2!V zRt-GW)&o1Ev3NCH%tK|-JFM~)o%68D9K!l3*^NI-nHqe=6Zz6C2ZCxYprgFZ<8}vL@BH7 zx755Yu64-Zt2U^n?!XNPyH#qM_Dpg&49Xqls`Pa=!{T8yr+ucc3`Ij%$fs@&f`LH#zA&5ExXzva8~gnyYE{);+a~RLHMbw%B_k z%r}QGXyV!qpgrWOCnVr#XF;<#CDAm zwJh=sKzmi-fZ?DS{`JPm51$X-KLIN zdDwvzf^EGON&Ag;LE!LLTiqm(D*!xxETcil9wC22fKGem!B&a~Fj2%wd?YNtkq~))m`dahx@8*XohbdT|MTt#I-R6c+xl}&?qOUz@6120`vwO z1x|9S_Y35*8|5G;?W=c27nNE~x>#>4)^o6${nPq7HY8v(Uk)EAY1ef{E~`YBYfPue z>Dt-~D%VeXgXrP-wmOqJ`duSq#XY&>cokY1DU9HVQ|_=_$=M#PEy37beE^SjB+y*% z%i+9D7<3EqMB!NhgtjO=&9Jb@b9KSXPZy1u;Ip?z*AO{3hpO(C^Zat_k=%`gjRKdu z)g`Wd@&LL#k$kx)K%XVb!V{p6<6`6lh;FJ^?ra$O=anA8PVzs_&P(SWcgvWdS9ReRKJJfZ3}2qFtsP}-zT2>tXS9`@4EsV z1O*G>f9P_|lsdKX!rSKB7Ug2*@Sq^nc zBi9?P9Bqfd9@fiB#Z}5#6y<8^_3Qdm8RQ2(f~)J0OHi@|`RUQQL8-VE545EsN)x|Y z0EI0Ow+K`{2pBGWt2YVcTAo0>+#2v4Q5M#KhjB4d1JaF`LIYO9wIU7Z)hby*1)B{X zh^zOZxMj&{@&m411MV1sRqA%>1U2|9wS+bC-5!y}(}i#5mPsC)ZP9g;$CED{r-^_EIap#&1yrx-#e*gm?wle6$d9rttbRoVih&MU( z(L7kO`0^mDP+O@!h_An56Nt`5+TZ=aTi>SMpbuh^Hsz1^BJZMx@A1(``4sYFJgd#& z5EJdOarNu}tJQOL_WK2zJlKwKtXzFh=Iz)=XMY+GOwie%5kO%J?xzH*9s~?u$<4Njb^e~97)b+)B%k{@v8 zI(w^Ywc2_m%52>}=nDI0$85Eed%AiD5((O^TamOM3qkJ2z}+T+T(-!s=cIjg^%U8y zHW1RHTAj5pK1D}LxYEGJJXbX@v2M*_t2=#&9sY=vGCN5i?P|E{HNz5JjW{YmY>+Lu ze6Hp*XDep*9<*go;<2_~jGxn=7C>Zc#|H#p1i{0jbM=@&uH}i!%dH(R5oKZRsN!Oz zcBC6Gg?4;zJuVAym)pS)sasBi{pxKfiaOK)@{RsMhX_lAQc(E)f>>non zEjxD5P3URF-{4jdvR*$ZfIP?-oKIIjAdt)E>;0UxuSOhpG@^zN#gnzlXPlh*IuqgQ zI-#_#7W^uyTdko$#o1;bNM|4C!2S(9l&XPR z`9S&-_nujC&fxereMUfZ9PhXXP^u3C0c!XN0a5Wlqk6`=LQl7@`0MO&?yzUBv9x;E z+QWj4QdgUsY`eB(-W5d7x8n*{@K=R__eXsD3@m7 z5`pd-UEVorZkug1S{P;(-Kb!Mm22+L0kqsDtyKb)R@-nA z4VVKJWu`rc@;1>nT-wx(aus|Oj%JtxZMa6-*EMep z-mtnrNyXxMP0_(IRkPgcnwuN#R&)uwLU%$%RNn|eF*orhr>N%#Z-g?NTd4j9NWxcr zn>FC+nj33!eXfmDShV{JzpugmEpt1(r!@2mHe}M~ZotF|CvdRFT9G0)@R9^8RJ8|{?VN9nsybfNmN8i(h=#T?BFK`<3qL5r`~|~(^`ZF+vA%McT}G`hUvP7#bqPkT*B*8f3Lg(V?* z&fH=w;VYn*N~$)e*6fEtU41xk{-o zbg@s-TxV$$bYV!NhT{(CAFYzLKcCTUMWrBGEhtrpO+}eCFaqsXkE?g7kEv7YqN=LT zt8Y<1s=ijWtvZ|CXN*biOt3GCKXxIH07EQ~m zoOSzoq}Jf$&`$kPbDOQd;M;%?Axe->_4B=#$r;jD+k|h{sQ@2o&?;OP9u1%9@`xn! zfQlb9^2%*vLBV+>nM!L<~;f`VHqxS4`c3i1@(OTpa~ zoTA_X3Ld54Aqo@1pXi)HvD0rFzlY-|c_$3P7O~HpL_;m_?i-Lbc!S7P=I~4o@ z1^1{DgvmRS2%3U>gOSDY%J(8!5Ppf;%YKPr+Uaj#F@ig7Xxd zrQk^lo}gf!f+_`#)dmSll`+Y8@7{4vSca#jC@j)nT#fut;@SoH{H@9TuYwi%^Hf zr^BMtVX^73$aGj-IxH$37LyK(NQcFv!=lk)vFNZ!bXXiZED9YKgAR*8hnv5{P2b^W z?{JfMxVbyr)E#c-4mWX!o43PF+u>$K9PQPqQgc4XP1&hZGd|Z=ucwClw)zbyroT}C zR{gQ1m9D1F&01*_#aJudKrz-zyD7$6X@X*`l@3#kwbB`iu~vE=#aJt86l1NlKrz-z zZ=o1#rFT+{wbJ`2##-qk6l1OQX^OE{`W(erD}9+_td+h+G1f}or5J0apHYmp(g1aH z)=Jwb##-qnim_I@i(;&m_EU_t(s7EhRyt2H)=E!OjJ47{#aJs{rWk9bw^59>QkP<^ zl|Dc*)=D3v7;B~9rWk9b7bwPB>1z~Yt@I+rSSx*>Vyu;ZPBGR>gVfDgEA6BhYo%d| zu~sTljJ481im_HYNio(+k5G)YQiWoym7by)Yo#|*jJ47`D8^dp7b(VC=|dD_t@KHX zu~zyl#aJtSkz%ZszCkh8N`Fo<)=EF37;B}gNU5+^+DI|hO0T3CYo*&M##(8dVyu-8 zQH-_HG{smeJx(#!N;Dm|v=YZyE75G7wNjO0ZF8gFQlo*|+=v5&Y}S%>Xk8(j+(~EI zDE=!}I@o2f?B-`0HP`s#q^}5FbW;xoN*r{a%9*wW%E#17Z_!+CN4PBe&Q<0R?X)5v zFf=tJ6pnGfg986#MYk(2$I8`8%a+^DG@Lwk16Pt`B_#Byc zF1vGD$3I2j{JDK_f2&zJ1j^30^fqcSi*H@8jOPq@J@xxgQvF`H@%q%x>R%&i(z3ca zV9#@}HdkBcOIJ@#A3sAAPG0_X7YeF>#U)k0i$BhWQu|2BJ0N($OW4(!e*mXdb+V^( zmbII^g`I|A3FQ`NP1&6-U=NrJZg9OYxHU++EO6D;$l*d$ai*7M65Ug~Xhm$901w0i z9M-*WYA1so76+Tl3hb*=fW1EfthXqJX)b0mOUaNAibFn-737;zK)$mVGCmz7%gN{- z5l43+D|ERO=tg_dSq_c!sevEIR(Z;i5Q2m2B^(rnL;OPUD1;-gA*c9}eKK7|GOR&x7(LmclPWrg>)6nGyPqFdRGdp@gtNUD-2EzGVL4-NN(nT zB@X?=SwWXlK;IkN%y_3-Zs0q7eWruIFAnr~vjUn=0rYTxpu-K(Y5$*!gZ`7OKo?Sg zj_t&B!laIo7=QcC7Jn*^^~YIZEvCSlw4UR<;vLQJN$$2=HwxQXn~*dUJ8N`>z>eid zlfm984t94|VE3#HSP9?jP6m5S9PHt&z>cjL*gj%h5(oRbtiX=17}$yAmR%ADyO0&w zi4_C8HyP}^#KFEZE3kW42<$|^KKoH|uph|^>|_eC_e9th_*@`)BJ+JNt*<`*f;imI zWd(QN3c~H9r2b4C?zggnyFUfoeFCl9r`P_SIMknI1@%A*r~)>WG}*7$?${)3Lv2IS zOl+vTQ-BrewE)`>Zb2OGU0K0p-}V{4@3ie>v~8b0J0%YGcvfH!rf6F+K^{vUYs=zb zpUevEy(t;$T0P71%>5 zz($O;^u?N7`%-SMjnDhiW{*BE0spHw)EBaXdN>8th?N;ar!Y{N5EJs`F8dvEtS@GT z^+*b=BfSO`eJMT}-2V{=_w%g49Zdl)LLbrb2%NuNz!3j7Csz*z1#`lOr{l%=Ho=gEXVn-idt;>BZf=`K~`(#$=PNhIM-Yca1 zxjx=?+y6Dqe-nrK#jIeSP64x!05e%k|CczzKhFx`gDDV3Xd7&6O2)Qoi}3J&6_RE$ z{7c0PO8F!X3L z#Mg*JoX!g3Yf?ar+NDEl@uWe0i}91mXfKMRRkK2SE(O{MX;nt|_F3wAt2nqfX9ezj z3UGURr4^rr-nX|nD(xv2`+)ovagguL3gm^1K$hi(gcI=l$BKPcC_f_(^510z@}U$U zBZkE4VjqR`6>)6;Ju7SvXN9fL*6r_!WBaSDusxC$wmy@>wOfTvnbk;|i7E4FR@g2k z4+}SoV|!Ir*j}3zwm$QuyT!5X%L?0LDX>M^Ftqnp!WToD$<6nWIK*>VL3}&~#Hh2E z3{mgXh7ECmwX6WXE(O4dlU>#Zeerrf7dpA*OY3t3@)A_Zot z*P4L`pUH{QeaS-m>*Dx+H7k6t&k|psy%E17j_*HYg|CziK3Jn;qkH?{`?@&3uV#hs z$rSh^Hb{s1q-GeBrG^xvPpAB$IOxC03bdRJ=!!1Swxp%Dp*Xq-FCForb_oX&lY8p= zZNiq%IwZ}+@|j5ida_p&vGX{?_vy@Jq_>G9z2(Y~TK?PYWB#)#z(yRwBiDUpt@m@G z$(ZjG$9zwQn4j@5E9QFF?*%&~TMwt_wRVLZpv|$THB1_ff>JM7&FOPanb(b0clR{@ YYjuC2E1N?Va`VSWc)HV;6W9Fz1tBS07_tJ$?6dSNHTWeaPcdR#kRoR##Ql zWLEWM$!OO$u7ScBtMFTRw%=n}%w@Ce!bAAtw7tfx;Th}&vn&DuYrh2+1BSJ|9Q%J{ zMqZUy)nrS;Tl1votjx&B_&@#?KYsjp;qVV0y6Wny@L%%{a+Mb7e3hHue;ddk2SAd=63O`9<|@q!d^9x zR9Wakt;OFUXW3?mt<@wUTdx5K*yTe)UWV>9ugjHKS%#Z%eYnDwm8+xqdR70CWpi5+ zw@K<8+bx&Q$W<0WJzAAGnUl7;R=s&$jV<6CEk4BG${%VT%V=nVUq>i*`rxh{MPS8> z`X`g;Hie2%6U2%fk>pydd2LCkaIJHP>sbK$Ho2aaYeEfBC{_%0HS7cS?ukUg&t;|O z!Y~eJ&V>0|xfBY8!{NuXQuN6XMc*NKYJBT3d8|A=(Nupa$O8}(fHnR$Kox%nApb7- z{~q}NUikk$K-G~=Q7W_8SNvFuKgHi)=O5r>{6qX{{^4^+pn=EgHVrhd$x1DjHiNG` zVtC~c{~&(|png=LD}d}gLYCvX+!iC`#L9DFq0AOIfH4w@!hhtK932-kIYG*mxJ*If zxJrh+P-dmAh`e1uM4Z_X@-_ZUIFZt@ahSYo#K+TD+O~p9N1PpEOMtMD4h>Ko=~t_H zO(NB59;!=1tNDn3$gnZCk{9xbi7|US=KPY2tQReizFPw$Q+hja# zk#?I2Y5J!q*8Y=*wGXLSyV(|NAGO8W&9+#38)9vTl`2A|z<|z^L8vl94HO7hErD(W z0lQqU)r4@NB!of7m8(J+#BYtOfEo%5mGGrHC)e08)p6`TC?_r~ixn}PXQ2Yr%yW{A zZ!e$4ktf+9j|1JLBX6Ws3fFip z%tO7c|=}~7i1lEsMo__s)WlNTd9R>VmM1M#!!rLAysLeXr_a0xTPWL zbN&zoCY>#n-DW`4vF4E)D-}51J_J2J4LHlpPmhf<6XRoOq13AKnP^n3aup#Tsc^NZ zT;;$rQf@FnYZWe6V>UUUBA^CS#3&o?2YUl(`xU3YxtlpieCUHV_N_k+@mtG~Y-O zz(`eKW#wZAWN6P%NmZ>g`Y7^$-kiJwjF>t`vGXQJ>=aDcnb1ZzGhP7`cP}U$4Onn= zr-mZ~LBZSrK54*|R_l~rE2Gs?2`M;y4YVk}?sdc$kNBFMWJX4G)a>l+MA!mwO+nm_ z2*5Z3SbtHNM6mTzExIXyxQT)!65+lm?PZi3rBb1g(WXEdwqD~!3FaJ}3~W`+Z(0y` zxKv{qntIrW#c`Le>I7whj!ah+Va<|wrw_-uo zoknDVKfv%k1FqCs3a;8}>8Kj(4po*OQcRt4#ME1@n3`E#UgU^f*EO09O;~Vrn-NFF zotmV6$$%iWih>|>6&*Vx-C@VrF^Zb|{i9|C#HEUxZYjvngd1v5Fsrz6LXEk~6{E)3 zF^ZZ898puYQjH>xROB46RO&Mlks@wXT-gaHwYE_>+0@qY7qE8bE5tYU^EChDD5p4?fDBm(rm|90cmZgr4qO;v`pQ&$@#vXFSPrD4SXNzF}PLD0` zRk^N((~_wb3y#b(T&W2zL;RirOJ*5vt)=6sTN!TdA;r{bM@+TJ@KJEl1DeDwuF|cb zGBjbqkx7Q<;7foY{E`7dCK+z7qGP8^8E)(tMa{#GsHs|+Y_ueREsvy#CVh_B16||D zrY#Gy!bYack^0D1`nL^OQ|nSmh5c-+tD|qGJ0`S)Uz>qE;)ur$D;^Pp}XjLDhcN^Wc@YmuQN%=(vzS&MRF-Ne?ZdTPhnu$je{>8BFK`M?+`o5NIV$qKtrC`NiuO)>|h&#V+R|h z*hzGT9rUaRgB>>)J*Ay~ckB>1f8f}`j#2C+JH}2xoYn7xv-;gR3$SwloP~{2?DThx zom5b?lk()OekSF{S%4jU9H^eGfF!~EKU2ha@OoRvz!hLPr9TY zcEr;~TY3se5?STY$u>GNN+Ip3h8wdC^6hzcqaR%YopHp8t<}s71|@-@Aq#)C%jZE4 z350DJc`FdB85^aX^=3!x*h?UIH$eQfVMyZ}jk5qlCLC!sH0mK;GGQqY&QhACczWCs zPfk=6ko*~JlRkD-WRyMHa|4FVk|!W4(&f$*9b+dMj14pxN&4WiBv1#Pq}yQ!p9gFM zVaF)#JlQdJ`h&twzYpy6dte8j2acV74LeUcV#i4W1vWPwjI_^AHThzYK<4?WR>Qzw z*p3lP0ZAa^9QA2OJUL0AfM#KXFxfHtPBk7f;K+RzhHV(}6OaVbXJI3b*x5(RXK7)2 zEWEN7o~(oS6ZexC)=e>B3xl(11ldj%11=$Cw-&8eOCp<>qls7|9*qq~G0==5LEjJ& zhGD(ZCY#GatZ;>F0Ku?dff4dmsACgGc9OhV-(?C~FAS_lo`&nYVbfEc@v_vcKEVD` ziFMWyn;0scnFR!L1eYu#6_Kk8tOM+xnF?>lapVXxSq89**fro&c}%d$B3jkQuMI*+ z9TD1x2puU{F=z~Fv~b_G_{;z({jEcGyOC5(EztoUbL`K%u|FlTQh@mFZ867YOAyEo zA@M-k<}o(5>o4dMhbx2B&1RH!hK%Yd&j^(a4iECosVW5DKhZyE0s2<#5~Fnq1P|$w z0S%-^d#9m>j+iYc#2f?w6xZX9xc(l*wF(IrF4ZdqmI45AtFI-x@1VV6NUtd3p;rcs zYn9r%{@Npb!V&2t6kol7&((FNWkJ9O+ zBg$rwPRHh$(dltBQ5M+!ec0B<);BkW90YoD7=aCliwb$rnekLKo`@!6(RgYkHarv? zj>-iKTOY}n8Q9}vz=M8AN5PXu6m;=T3gMI^gtG|Y=!iv)Iew~82k>I4DEt>6h{gd* zS&R-R0lsK^^!TA1YZTY&PaV2ZU(k7cl7cwx2qKBp7@K95#^)AhrzfUIM>eMC)6<;{ zXd)JcL5%kU@RPAvJZUqaC-Wtc&9KWy0E!^{pajF<+CSA%(ZN95_Jv|$#t{o7fP8#< zY-C9XoU2PriQA39U$M%uK*wB#7FFKKjs z(ZcHor0*@5I!F_Ib^wW-jkk}Jp61E{B2kGD_wr=~bJ^^+tL3|Bv`O|jz z;Vzt5(hja;N_ES~;?0OU+&YY&aerQ)rohfS0!wxqA+SNic`f$MFo5*;0YJCl2;Dl; z+53_%89KcRG2J&dsCAI?I0UXrnG22lMspAjo!2q**H=^9tA@}W7 z^6my5;q#6-$Pygj3MA?R&DWKR4Eje0jboxa%anaqOEoqtlyJA9S$N%|iG9tllwt-A zc+o2uy8{(;6!~^6d3B8^Lz7J#HrW*U z42ue+@f<6Xv8dLwB{jxfjzU$EuSW)hJ(kQ=ljwzzVTxztvAY4@5*gUmk5x_3neXe+ zX`;8=4p6999HCxBsApCUQVBOyL)>+4i<5M<3B8Wu4soOMEQ&J66d^AGv%_T>wp74f zuY6gyP~@TFj!_(`KXo8AIdtV8rr=(11ed5)*s-Qd9p7J7Yy}NoWqXEM<^XIp!@#OP zbx^g%=qvju1#{IAOm$QZMz`-Tnn#tZYaB0l>D*LyAB3A=S2Rb%|j7A_Z{W5kMlFW>yW;%q~AC3y?{xR)rOyGix3amafiAF`(l-TvmTEfIGzPiieo~}ebVOPbk+wK7 zI+%(N>D+-ImNs(?m&fE3#NvXVQTQM0S-9XjdRvcWFx=9?dXVzHN9(lHZ}rn@L!g*z zv(`v3wTH&=FT<@)JFN$GWgI(=DZ|jRO~wZ-od!!)@h8Y4gHK`7U9Z%nJ@^Zm9PKFX zI(P+Z8mP-~OYc3{SxN#QLPhQM~i}(i;Tk;Pz zXQDjhLyJmv*e@kTcSLCm@?N1gOyC&e3xGL{Y0wkxkDprl%>A1V`?%? zYBr&zZF)!!L!P&)2-AQ0F?hz-NFp_6{vqj3 zwNZvW{NDw4wS-_5nzBvDBVrjc3xv_G5A*Cc2N~bEN;uD=qY>1|{W*hT>QIvl{l^(=qmr8hFH%OYJ7qY~v*RpqLp? z$IqAz1RCK;S+02)a=byHNb`DyOGJjN=yAVQ!&iV4?YDyGJ@_wpnIQ)nY9IC?QC!wk$T#7$|mk+CH zgKq?PBc#qNWwIqPw`CLzPfd<5hog}lu2f>SD&kIsCf(Dc%fnO4%L`G6dk#&BGAI$L z8c}fr-aZP^6}O{-`$-RQF}rZ{Fi<=sUB28rT4F1OI>gLiiswDZV^(Q3kMlx-FTww{ z45S{!49_TkKaL1_h~nisAOMOj6PcZ~kQsz~yAxXR!_aW^Mgx^Wz&6!BZ!>&G{dhgg zX$cEYH}B&hnIVuS@tK1sPNx|NIwAR&TE!oS4{(&ePdEEOIslz1@8E7*{T*O@9k15p=VU?u7|Khf;!U5(EE7eZo_l-h_Zm94%C zRn2S#scMU#fV)(%ubn)0)m4;F!r)O3&z}p;vT}`?6Y~%Yz~#?`SGoLS;Y1=lQ!hb{ z_)s`Ld?ubclNtz5&Mk*PUSP~6gIR6PgxM;D5GZL$z++B`1Dw${4l|`c3Z`5r^ft_7 z9qt1sX5X1`-{MjtHPH8%a&Jq>Q`e{gP?p+C7TiBEWJAog(QF!MW0y*BnfBJLfH{fZjwuj9xE{&)kq)+f~ zUj?6~~tvY*&NB8YAaN&e}cf0^z3qKCk_{NUok&@kujLz_)df)XWvYq=Y3h zVDAyw^cn;t0|jN!zQF#2*W1$lJ|*QvMxhwj5uymAuNX6DkT0~4gVK?DO~hQkxjqd_ zynj)FQERnrXtgJ{LrkBVp{957ultbGntd=+Lezkp(SjOUgS15mB)-ft^0)(q(CU3| zl%iEqDQ2Bd`{hs*@@P9c;m|t@0nuM7A<>_7=un~~&}sOK<|136Mt>M$|JaI}Akl)5 zK2S9^Hdk{PXR#_jZDMWr@rEf%rRGLApoG9k<}+m3!qOE4s1JPsuz;f^bA(l_Jm>yJ z$lNZ#vSclTK}-PtGi@k!5K%Z6i%QjK4(3aE`a{&~JBreB1J1j*AP+IknZ~_Lt=q%;@DN<-?5MCRmFzXCF4r=6D2164En{X8%Sx)KJyVF65gvy182TixLzk0yFMvMxEO+i5imXXiJoWL4&WcZA&dow}Yn~n}nWugS0PU6bIuy*k76~6*N8T_3|;_r0!c&aW!wUMyW zh~|(*2Po`L_vZq=sraV^p~X86gA?<&;aV>KxpD_PrQGr3)=Uw%X2NkbK2L=nXgSoBb@`NxwvN@O@$P6w` zZC~1o&5f_fIVYE6B$TwQ$uLk_=4H4RVU`I-+<5g{KiN;F*JI1l$jz+2c|w) zKSW$`evv{dx8VcatP-Y)@Y@Ql-_{VgA|w%y2kT^@OfR)HsT>}Gj&$Wr8{_DJ%Y?Id zs@>c{Vern&Pg7qSq{09Z;68||1HRpxZtR5}jQ}nC@vEb!5sp9w*Ckg0mm5r)c`@%v zfZjBrt~8Rvqj0@QS*)^c-^{s$z*)(b@X0gUvPc}DX6#`FMSS2D{YXuZF=AYws>b?Svcb~-d?W*I3(l59%KX|%LnevVOT!$ zAtA${lZ;1-fP!&;4vNn#n)zBXf0 z`{H-7<8Wf+)m>JF;~C&+ATK&pM$0llI2?T-h%lK`29s$4^SKhA-D;K%9jHzlSj|!b zNbxl$$CR>m3tYCVc_e2TS%!pnBcW5cQV7@jQ7(OFY-~UflH`CcWsTQspcl#1J0 zV~UWq!P>Y}Q{$v5SB9iBl`EX-+4PFe0vXg99rvNznV?NaM&iQ>Wvb|a@e$~uQo#Z9 zIN6*WowFM)Y~1M)G>eb?!Ty~`T2v${Goj3P0D#&^8m4W=$P^{=u-)5Zh;MOQp0Uw4 zYV|hNa-}-YDTsyYNSyeaS*g!nM;cz}Ab`dA))g<%7#cJ4nqjW3xbM_qqu#e5VncfF zWpo$nk+VJbvR}`>CQQ)s>A9DC?&Y3)xh<@^=UztPVEET(HmWT84l4HC%SLQ@xb1rG zW!O4zTs-Kxm%*Cpxt9$rL@q(<7Y=A-+CE;_D$+U0Hl-%P6A8sw>TCF#s)dgnhziguOr` z>=&RD#iKYhG{PRcrQGooVV@uo_DQb@`)NF-tPDH9SxHTldZO9Qs~R<}VVC`-4OxMz zrr7$qJFd0{*MA7=yw385aOGsKT-hj0O|MVL=VQaM^uXEVe06YkWaLtDNGkAi{O)9V zMy_3=JEgk`u205?68*{onQ`?4@`>oT&B66-p#a_$7E(o$b9U6#wLVK=y+f_GIH*@G zs6O7$u6o4OcY<+~>!7nm55pp=(>kkrY_lvD3UJ<$__P_xW}$9%XBfV^$<=baZ3MWv z!6>QNwq$E)$xTaJ+HzU|Hndg}U^Bkm76MCCSg);DP7A>lS+HB*NVnESVVa9$NyTk= zM6Vvs3t=^{l#XNL%DKLwKchtlnxn0ai|e>fT*p-J?O7kpeT*8~RbE1{=IlR00~W6r1RQ<(M?rvV*?2_J0Ah6Iu@b#kBZnc6VV_LBZ)dobUj)4g{? z7m82eu+Zrqc1pS9f4bN2HQigryh`DbN)C2>(B0I^bg#2lHA?z^?6SYQi*rwX=IcI$iYL<{WuA3EetT1dv<+01K_tYY|c6w?N**NU5YeeH}qlDJ-DFlS`sS(s|J0&3{rsTE^s{3}#u_>p=uFk!k&)`$ zk&&VYU(EfB@jEV#jD8PC2C)elI7b>M^u-qd9c_*bnAy8KGDsVcpiZrM(2E@00BE-Gqwu> zOOw_Ko!(!3`+hh=SGT#9*@T{;`a2v*jWoXGK^j(ZaxESn+;Yk?Irn~Ka!Nx${HCL> z?p%f014oXfLgYhU#=Vlr=7HE%xpJcERz>UcpLz5d&$Lkw;8M;!n)^{pw@e4Myma+d zSE&^3kX_wES3XF!&qAUy8&Q{ST`~aTSqaK%R>n%|M$pvY@IWFSABd^`E|X`59_OLv zdQhv-JWqysaGy|RmE=#r0r5n#UppfP4NF!OwTCO4n;8fYs);$VR1y_NQJ6&C%mEFM zT^$)w%0TipJn2E(;M`~G9WH2}f@ko?7*`R?LWSLj+#Vd9XjTHbMtz8|A;QSjG^>$P zH<>S4xz@@f9t{49g3nKGxI$E`}Aa{X4`>Y z1D)G7+R3YP4_spqdA4@VgJgjw#Ss0&;1LguqTiY99#dnPn#iz>RBaVs0t^_8nTN=# z3>XIF#W22TFbry}Vi>@SW(y|e(}HPf7R=2@z+U+%qMuqY*c0WBe+y>7!-82FFT9%d7xd7l1#>%8HCr$rZ?jKpTrcOszjN)ykc7dH4 zW6rmz*)oGe!!aMGiV+1}87pGLcV1?Eg|Oi5Bh#XkMlKBk(m zn)G1&4u#cknx%r9eKXj(eKV-}ZD!EEp+eEcz8P@0Z)CPrya6!KX5WAr;A-E%i)Q;~ zz^8rlam~Kr;k(6a5dGA?!Ja60{M$E!4))EGgNMdPeT_D%*g1b5nle;1+cz(_**9N2 z2>Zszv{#vg;L4TRLu1kjS7g?F2STP1!P`BEphE%iCnz8&wH%Z+^B#{rw_7v++tMwQ zHS=Pp){GCLbR|Z*RByFnUTt5@@X+8uisr6--TGO2!-Ep;^*2142>E~qJ9a2SzHa7K zgN<>M`A~F!X9iubABnD=7&KQ!`+|xo7yDw+-oB6x{u36UZ?i8z4cpomvXlR0(5HRz zvSwd=3cg!hMbuOK0(+v|@nc`S308pglYy4#vEFdTxpH>9a%N`JtC~gypTVy9vnGBG zs+z5d!`DEUjY7FOJvqJ{R(4=L1!0y?XmLc~uij4Kx{dS^4Cj@M>yRudcHEXl6OnkQ=5>OJYv%QH#_!mY|2^P7)OPe@ z1RXi^9gfISh@oy z!y)Tu!iHnlqspo@qYcWVkTE+HQjK-U)`;sLizM&Ax`fk3K(P8|=MmWhiDasOfUX_s z=|@wsLH)MbuD9cHH;YP_7Su~}prP0)x&M-IC4tz9smj5eP^)Ighw)YhAI%C#nvZ9{ znWIomHApRTv_RW!fa%Tw@TRN#n zEA(U*jHoGTKu=~>Mu%%fVU!iN`PJDAD>KQF-JQwF{mk%CeQ|=lG}m@WvO@XDUJ6%I z9-yac_hc60hGIv#Za;0TC$m5(lU?|ZGD|buLa_JE&2a0`WPc-?($vB;ne3L?s=p*W z)J}$YL_G!1$Bf^wHP<2Z5X^P$fLqPh1A|?)aEpHhR;a;Zhd01tkJFe%?F}&5)i;a| zaH#2Xf_hT3+8+f(7ylH^WNNiz7nD1GtoA#=YS$C%%tEBFb#CfXLmTd-$8e*sunfjG zjA9I`n(g$o)lOHZrMUa(DaEcPNAEnLT2VB)QRmarKw8v*9`OLWLmFQ|`lHw}(YPh5 zCE5A3G-;TYe%AOMTROiT=v>=$j5yP0r1t~N2Kv4O=v&`gj8$zXqkgv#r!}(9!gq>y zB7!MdJ; zg`Ux3XBBSIQh_Ofhk9r&iNdF>M3&0Y5Dj0Xv-H<{H?`r}^%$NG+3+H=2OY{n*3KegNpuVpdSX-xSOzsev-M$95!Mf_}Qn}e@5ev_rS-B=Mi$s zANYCYjvxMr0)Id({URrerEQLKiSDx*S2x#Kl|jevX~Xn>?5sa7dJ(FcxrlG$qHW^2 zq+5GT&P#>xO$T#7$dU~Kx_{HggBk5apS)I|*UTqxq7 z2l+#)qT(N(BeWpEZ5s8-A3-nr>0-rjkL3O9j{y7mA#t->z#I~tzN(GOFMEuO!4mpp z8=1>iGGB{8odePruS1WeCAQ$oeUSQ5OUYC!H8iNYK;i6Kn99Tl`iJ}Dv1EcKrFgx# zgls)RYS-zM9r~|3&V2e84gP9kP~&tC&gZm7ZK%h{SawX9R)id0Q3p)PYlJ%&%)5u^ z#2QZ&^K+ben+I8I;B|AJEtpIeT+lw^-#)jLAhcqix)P8|r_TGU^i@Q&Tl%8etK4Te z;u)y2-M?))Q^Wi=!beZ3+gFIs`xI6<6dX>1&DHP>SO+q-Ukw$7d@d?gqi`yCDa+=z z4Cx)PBUZ>j{TWV=wFl0-x8SZXVrRAOK&&9`2r{Q*RT+Hh*;7PWj)xQtrcWyFo5`Fo zFU%~h>`%wj!n8bHu2nZirw69Xay&iGFXqP=tLv50)OvC*wOY!rF0XDR*cHAUjzl5` zDsXRWYi2!P-q_1dro{6r@%Ylj^iDc4ap}Tp{Oo#cW-0KthzH%^H}7dq>z;3Q={nyvioLjX$G#7$9s;8$p9kfnQb1Ga1D!->WUscViO=7>GOk#iV9WPx) z{%JliI=812b*q=*NOiBqyX_*cqo09Jd`*4^%yrohiz}+Tz}3^B&ewHU17^7-Q+D-j zS7(FvwjXZ;nUZ^Y8}0>{fjP|sy3*>h)qUn!PaA@-`S&CId7B^MC95By`FjiVOAzU& z&v4a*ZDHzMa0%^miF(>)c6N4{O;IW{bqP{_p&^?Og@nA~X?q|!@<3wZfrQ;e9v;|5 z#lUT4t28 zzPfDV;JX*N&b)_NsoJ4Kk5H>8i}eu}1Bc$So=ZhzGL@y(Xj(s2HN2iU>f0}U9IBdq zk)Lj3v@&I=fa435)t$HXvALSCjcx^CWsYV^Xuir{)sT0u2lA{$>8T&c;v~hhX%W=2 z(C=?!zhR+Y-`4;5A<#ke8#W7|&HD%k#Entu8V_j7gL=992onHZ64|P3<=5CitL;bC z5MuJ=gS&taU}N1#9Tcr3DDDocnsKe84c@rN;2B)iXWJewO;}8OO~9#cga7cxk&XDrK*zd(~zR?!H~&VS=VWA^Ts*~@>1=s;a%Dfgk=>e0b zP35N+lhw`nWj?;LwZZ3B;uDK&bHe8N2((?zCFjt6BtoT~+`hOyn_S$>ucc$Ns}uG0 z1izhwG|6meb+I_Rx>4Ggys)>vwph(3`s>+5N@iD6rP;)Abz^dFJ69Rmo)&h5Tq3=l zn_R(0;qQeyyLw)j9i7?RSX~TNbL9)g{KRlPSKjjes?$e9mancSCgkko48NX`l`pNO zcc6Fs8yALS+}hdFbWs%66T@2@OXwX-ZD-4AycZJY*Z9ivYOX&$Rh5?~n7F>_1 zN;bJ(XV=beuY~Z%_|6{UfL)!yF7Bp_g+zKemzZCkPC%n2ZfZoBFODbX$JXQN{q+?5 z1+c0y77<+>*_|tHgi45u+0~VujpAG_JvN@4+l!^r`{T*k<@2%h{>t85c{-8C{|Qbe z;^+Wf-Lp`2$V%2u1ZJSGY*L|W!-$3GkadGt9j_sUkA$@)LLWT48V96S2dB%Wt+nLh zHk-ImSAOS#p)b_e5-C2r3Vc``eG8roQmLqj{(N_w5Om^=*x zx3M-;&6YQ|wGV`hUnr;I*~uLkg$?*(N#-sL*Vk9$z%$i)esx#IQOmAQRI`BOY~_NS z9fi?V=q`jL&4Vo2V^?PY)(iWymGlmXfci#aI5Ar;#by&5RS*$;c48PBivuXr!aVul z?l3}-o0{3qhSts!at5xg=Kv4+(X(=Sma%dBT69~rLQns8Y9G-{tSJ~CY zjoeDQHn$qDZ7k1(rgAGATZ$?WoGF%utN%FHH)#G$#7 zxpHwVb#|T+v*SbA%#bvfUhl787#-P5@9d8bq%Vwy)+&?d_sUc8m6_G4?bXT2m5I#m zJTo+NA-l?77|c!12s@+FCcBoLVm21`CeBY+re^qL`uuP`o!H)DCN{RumEzN(y0m&> zw0~=*%JoldoSRx>5);KmF12;`+|I)2PJ$bqn<=a_+|p!he|*2bwKuh&Dka60h4c9> zMl2PQ1#u^vE{8_W4pg>Q7G+`P(r!JTD@o&p%GfkF*T0vJl^J<_a&4C5m-=JVm-6yp ziW{1q+gv}perfc4Vz#g{ys$HoDoBG|NLV^QHZ&4aC$4m@Mr_x^T3m-ZS?uZZo-Xg{ za(g48r^`(iYEPHbjPT^jpv|hXTFVZTA(udHh%mXOq1JZ*`-Y5k~-Qc`+O)u zH$7`U5?nW?<{5+pS&t^6VF@N@3BH5A4*HO8jiq~B)o3`gI|N_ya-q-$&2OrX6l}n_ zN4p|cawLRn?(F{LrM=DJ^Lw?i#1L1n?yd4mm*$FtL#ydaFgc;ELOgxBO48xNc|j0* zqju96Yvh3qEvzU`UuJVsW}7Y5NiZFa`O^>z>n{pM)nwaCRUtnc?>ke0e04NR%Dr+z zsZ8Q$X!uaB#0q6xpVq!tmmxuKWm7cV!)4mO0(heO~I; zZ`D+ut0mtyOLgZYKK{}K8dgj6B!Tb3)e`Czw^=PY-MkZ)O9mM9i)#xK+G1gG7+^N+ zih(UOxO!o#Ocx4T#{4CIQvrTa+Yr&KWBW<`u*Y(Px&!iKP}RJQc;_MOV#?Ms&xJQJKl_eQDQNMyGB57P zaAbtmN#zuvuuvhn_tnjAxGYLC$%NJYUF5h477v_YD|tY737+Rkj_Hcw^odvXn;POi z?*nn>b(*`8A}JEB>oo6$^wxbeNZz`y-8)Xc&nD))k4BqQWvIp{nNnz&pAqfn8Zy@h z3KdNOStzKAUTIZro18akA0p=(R8Eby?t{snH^z(`eyFAafy^AOZ3f+(S;Q_Z`?0Vk znp^*(@gtBgr6z8HaRDf*aF{$rSxwC-cB7p>CWib6f?eLxO{XZo)|i}YPtiJ z;ZEm0gU(uvG%(W)=)q5oo*iYTC<;d4OUeyIj{OIz`S;olhSr1E-C(%&>_7%XVGFu_ zE`!Qcw+5a0qN*g{&VV?}Kz1sJkyfW|wp)3e+lD@$>wJayDjZxvu23@zK0>+@$B?X7CYVKNqzMu8~Wiiuj)57ynf9C zujtn`PjJpz5NC4M;)eJuncy6p?XEiaz}oDY?mg3;I-h|Y+=Q_AWbPp6QEol!neNZ) zrh8B7(Ajd&VbIre7+jh6rYCiL8>Ro?VLWwgl+IaftAjU6;Six$-Rti3P0c7ha?E?V z!fcdQEr>H2rH{kmE>~id+IZc;ZupLOus?70koEA`K~iJa+3XuV2)tv#AzA3(Bsfa1 z+H&3eLWC|!zPcaPM92Lem~EfW{#y&`OroQHeNS}w&f{$$dBgll;cPl9~C$BZ*sc8Yy)RvkX}502JI|4~yAy4f_te{G>gH4ja5X zZoLg^Nc7k=|6ik_fDVys0HA9PvY_i)Bk6z}09wnT<%)ZQL%vG$Y}t>e$Yj;+oEAhUBbmK!ewU&yYl7h*LIw&lfT#DIN5da)fp$} zm2KY)>uZtQ?mHM}^4gMy5_OxYvJzxstZ|Z05rUZ@97LYFB|OL`O`&^wP!6PS4e~3F zQ3yV9VjGWOGMUI;c@jH;iEvf(3DC}qdB3zqu`3e2;xPn>H^Y}Yqc*d?zA~L*opbgK z@b2cECTi*#;3P26Os72q+;Q4vMwD5mD*Imi1xfY{a6^#jYpcEOtlKW813d#=35z1~ zu!7jh+Ecd9SZ$fKyZuYBTHWfDCZWrJnF`sdv0s@lLbH z-FS%68)3KBAVYV^Fv%#nWQ(qr*^V4{mu?;_a1~BsYoY{A9D{vj9PD;2SK-I?%9k?G{1*HSsXrl&D*U>! zCgw7DxBxzdFCK=jNqep4$xTtLRm2)+czEvW=8ZC(4N$3ANz-MB&GaLpi7;)bWX5TvQoejaX~ z;C2N-7s(AuD;;hg&U4v%0opsh!%D=R0_}2a8SWgbNoIXvS{lYOUrQ#CpxXg?lVdEKL-5feM?)m3D2u zZ+>8Txp@=zUj`)cfSwY-(`w#WVk?C@TYyA<;M8w5ui+}K=FM=lgec`Rc@9o~&ckN} zg5@J{hUlh%_&EmVVpZZch20i^qc)J%T+L{72S_D11Ry!7!j^E@ z-azgEW-Brdy?(1IbM?HK*)1bE-2?~Th%%QkzDXzqPL$XdWI-X%H)QgH%w|gnh}z5R zC_fNZY2E&FypmEC;{1&v#{q)uI)h=c#f;V zM{dbMt*s1MG|Rv_-LOK20;JJAfi2^Z%Uo$wk!qKlhq%giD_zevk1EmxSQw~LsHjJ; z)L5y&fph}GIe{7$dIfS7+Q@U8atqJho8TYgH~49Ohv)hC@$cY2%72Le4F56yOZ?~R z&6B2gD&RCFFEy{pN-ch(8OrfoZi^9snp^xv^M*Q{0jJ;CX&%E&6zb#mL2ZH4etxuh zQk7qzDP{Nv(N8t}!oK}83MSi@X{MaTxUQ&L1l>E2>&US@&u7N*nkyU=Ik{`dI{P+m@fk(hX zH9QuUE#kqM@BR6 zPKy7GSI6<{dMxh3;&v=fWAOkMDJ&9LoWAi!v5PEcUV3!Q$Omyc3HS z7C(T+k6`g3EPe)ypT^=7So|UupTpuaSbQ0a-@)P)EMCUqud(<`EdCLTZ((r^IH7n1 zi(9d{8H-a`gt3TW!C>(O7H6=S!D14NRVX0doT7RZss@5bUCSo{(e$e6`XVexS+ZU+7;B7YW7;?*0l z;ITk9Ef%oIWAQ00kXwtN#NuOEd;<$)+T!0~@pUZ7SncgD_%)Fkyo*V1qDUgD_r$FkOQ%T!S!MgD_fyFj<2zSc5QEgD_TuFja#v zRD&>6gD_HqFj0drP=hc}gD_5mFinFnOoK2>gD^^iFiC?jNP{p(gD^&eFhzqfM1wFx zgD^saFhPSbK!Xr}gAjg$5dCFB@C`!jmkFUa2$5eV1P=HCD!ohyyFrNhG9l;&A?C}3 zkO5Ml!OMhz8-#c-6T)o}qP|8bu_!%XR(^)b}s*Ujaq)RsP%jHxw;%H41B@Wsc(&(K2`8 z711)M@rr1f6kZW6a~7|NmYK&ZqGjHKS47JQcty0#HeL}e^A5ZsTIRiYMYPNZ@rr1f zpTaAmWnRK7qGdjfS47Kv5wD1r`6Ij{TIMhCifEZ{;uX;{hf!=3EprmDh?cn*uZWg; z46lfm8OAH3WhU^7XqhFvB3kBIydqkrj8{a=jWoGb-Xqi>KB3dSoS47KP!YiU>-i}v9%X}|h5iRrY@QP@eAHyr6W&Sf>5iRq} zcty0#f5j`JWxj$}M9ch7ydqlW@9>IfnX6C@5G`{fUJ)&GCteXP^AKJUEz^%zM9Yle z711(jydqlW8N4D|2Dim1TIMJ5if9>fg_d6Nt5^^%L#~LHc@wG&qGiYx(K0J|k7yZk zMYK#4?-4CSu85ZTb-YKk47nm&=5|yZM9YvXqGif>k7yZkMYPPX;XR^d$Q98t-@kEE23ratYAgU;AuXJmciph6fJ|ND-iRNWDZia4CW9b zRwl{aLbMFIsyA;m&YRF|Zr+#^VD^PG0WhVNJ2*q8^^_Td@s3gt<`FQ@Drd!#HWedP z-)On1)jnow@fiIodFiC7eQRIw@>rOz?-ut!*rJ3)|^cIVdd;&(?JZ%EjUhL zeFRXp1koWdFWcNZ6OQs?nTtyG3V5WVJEF7|B@-Z+_b_;-B?FU1+3ps(&sCzF3^QsW zBFQy9Y2n|4?Dk4~MD`KfTKroyD_k-pH4m$0Wq8lC}Q_z}(Q`)dH;e>!tgm)9-VZ(wP27emlL{dEt`G^kO8$!N;y8)_p1Y9u$ zZ)l+Lr@$?hQk zw11F)A}Ekgbpi4d?!yd8m(-9!4|qT0AKqUJ3f}vJhZhVeSSBHXmhR*GvVVC0FerE* z=mOp;_wiNOScTXpH-F1N=>HHD=nr-Q`jhUUD?_bpZgC&$n_<6~PmA#;s2Ye-^-vc8 zdx?dQ zFkn5%nDY;8HYi~G4-D9p`^bKme_)>r3fR<{?|_WeNtJ8(e2ro4Fe=llcv zvq1qn*afhU+t?QBS_ydUNPr)cig?Q7FZc)d^Fe_-bb#P`2&u372lvl{0(ZCzaEE-1 zt_Rm%eWP!);-7;8^-LF_`mmvxK`*Yo%RjKUL)AcRs5f^3tRJogV7@$1?&?C25iz@*9!iD-3$uYCl3tRes^Hs;UCx+f&%ubE`asNwVu;~ z5Bdl9hl2w5=`O(a$F&|7@=N}K{rRAP9q9sC8%>MBHsShixKJ1J90q%MtQvgLKd8SI z6sTvr0M*7bgV1pVP!=IZ$lY1?FZ{#$wV+@f?E=W8r zz}d(n+@S=qQJCEXwsD1Fr;iN5HSS}1uYYjw4hr1yF2H@NeJoY@xNxanDX&^B5k-zGCs`o#}kZ)(`m^+j0-`*IN1e^kF}3#zRW<3qx%q+{exEw z3cRT!Pf&z243oxTDV7im( zU;BsfFN1<`t_uilqz!~Mxx;qs4Zf|NBTzLEYbV_WY&N4O;2G*jr0x)&@(*D+Clbpc$WomvH192$tlnM5q+0pySQ2lC$s z1>|x-K;~Ex_Z1B%V;&yLU-l2=CxZfVr3)Z!RAO<*L*RVHKWzUkDA+Cp1zXKsy!@Si z*uEYVY^y=R<}oR}@h0D2VUxIN?_w)=yEZ9OR1JmyIw{$YDEDA+c- zfX&W^!Pr|SUlptF!}pAT5Z8hN@tH0_wA*`0K$JYjuFf;Ae3?$JSOvQ)XiS{S`!}sB!;CpM3@Oi{W z{JMYmekCaQGQq$H)@U+5-~r$N@DJY~1O?x-UBG7(AZ_7EIIVzD#1JQYFy;U85A-*J z0-6m5=)A;k)|frWCcLT2B3N{UQ=k~wi0IC#Cr<598@8gR%G%kO+is@UM0OX0l!2D#;iKm|jaa3m#C9ke-ZxK;IG| zpkE3eP>;#-o_|2Mg9CK#omU4BsfX|5MgNe#H$X^#^#CCCh-~?&e@K5SKuG`P03h`+ zBmRqjNIxAQqz_yZJoS3`UjM{Dq<<73q%++>>Z(dT1n>X#59c=ngtOWWoUXdmGYsOE zlfDh3lTh^v3?rk_F!x+Hkh+ejhlYvzhx4%j;rv)PaJr6Y(#txU_7CYqfRKK+8%SM8 z)I;j#{KNTdfN(y3s0*p<3a5w6ecnHu`vJoFE(4rg^Lj0n8_9Tmy->-O>UqqtUBG15 fCv8%yole8QTI;)8Y%`R{|i{=?2?kz%ExvC$4Hylqo%fF^+au)r|Z~BPVLqwZzXnH)cQp>yzLKJ1CT53qO)-`yz1HSSd7HK%nth_KHgCO}Ora}*6crplC-GQ6kSnkTDGC-Epua4sY$K#J#z^(?ayX2 z?_OxUI|Jo#@?=KVm#ck!nM~%Km#@6IU8Vp#%=*=!E}r(arbN-Y$XMzJat z$_+`X73hU!v9XlZR?0}k$yKGK%O^9(MjSSJ=v|(V$8R-mi^@>WHi%Uqtj|RQ8b|qR znd^^@w9F07hSD+z;v>Vz#9B!yiI!HI>jql#3mUR|5ei`1X0|V=Amrx)OM#TPtrRX{ zDKu+t&O4SvLn;-jlCDb);YMg7%s9n-ssr`W(Z%9@8=wC`<`0E1?@zoX7hZ13qWqG> zv}`lIJ&@_uK&H2&nP_ABQDj=HE2SuP$LB+SR)?8tyR04!WHsdNSS0p3S>qTSc64{I zhe0PHM%X`e2z#$h*v>%0J`_mU&OpLWlYvmAXvT^dAP!|hAZ1~%$KtGy-lp;lByFFE zG&d>6+NT}XUb9)-9mv`z16kW0$l6QD+N#*7DYdcyZJq{3RZw(jK%{yV+BPt-^G#h> zGUck0fi`Zru4KUc>QW7wp^Q??ysIf`x|m^YocJO%PEtlwYigz>LI4O^k{TMmwJc?7 zY7PEjgQ2V_7HR$Fvul@v(};a8s1Y-FwIdI1llBIZ*9am{g0{&eZ@gN~=(3cNZivhE zs-zKlBDCryBu|$W&7}_8^$c`XGRu-!(=)o7Ss=y)#+cM+H(LGXOu7-b9HPDuk0|KU z1!~zoj;LO9lP)&OlG{Ioc6=H*E6h$$P6%hFCb5U2*R_+moLZM^N-0~D^qf|gpl4*= z5J1;zQc)KcCD0IpAi?_tV!8srYNg2)# zdTo$-2jfF%)S+fuiE-RG&kr{0PG;OfmA_%0y#<0i8DnIgsA% zEJGzKt1DRr>X8DS!5oY!#Aa2`Eh=Dra$uNLxUV*D7OWf9YPno+Mnna%smp2uh9Hs# zwX9xR^byumEeoQ^apT-@X}HGJW^FRW$jO9~W0@E*DASYK3AG`)6m_yPMF@@dML0GV zWMZ~DMyVlj9N4$B__n749cN5*oh}1;e<;XBsxdCegA-LzS=KIz4H$buZ@YWYgxDXA zul(=f7!Y8<3@O6k+DegQ#12M`9BdEf>dI8N3!iz12|G|Vrb^&!JTWS{?j> z2^ulWRPu576zoo(HcNY~v^Wj3!&qeb!nhPYk*xN4^2T)RP$)m`HoUn|f&TCGu1Bp2bh|5P- zhOcx*3Xj#wO`BuQ4$CYR=CduVOW(OX_01D;o{x)$IFVf_I< zGz?lWw_IqK!V9-Vp+D!0Q6ZF3{N_@awMKfAidIxtq(&DWkrI2wEk*i@>Nw7J+A8G) zK4e_R(Pfk{QW*K|AQ1)hAt;tMSPE`1t#2FIg31Mc4xo2(H2lKnykI~tU z-dp(V^NftdB?I4VSDJh%Y_FTu_Kp??v&Z6_Vb{s$BtV5E$lW8JZXp7nIt ziE`01-5HK%hur+Bvx6C9>k2&KlG#jFho6+%-ERY3a^L$C@=P zj6~HeUcMU*HWJd<>^|WKBZ)d z{B~$pn;!92$a(5;D_X|WqoF*7X;Dh{XROWo z1Zfd(dz|MSLte|1k`}pk=Tz7145iZt8p{sFsAEH*9c+*u#11}BxetUHW4d#?Yj%dy zVrMu8JHs8=!RM*7GwiVQSSUMT7AUo`=~%XXbn4g_&H{PIr%nj2eqlU3ODS0(evJBf zC{JM)D5X)@7z}p2zEh_TaU4aD!Y~e=pOh?+I|>^QW#>ig`OICKp3FRbHFLHJ-cMX! z!hJWz30pWgSln8B;(n)RwGmbBcl{IS7Yek_L*%>`q=)JTb8Xo(#>;_hEjjYOM^@xmVPpxKM?8?Jz?gRNGs|e7x}{ zU1D(+P`kx~^_`($d&&z+t$@XYb>?6l=Hj0k9`k|Ti&+w!EP>&nEO9hYi1tiF2$z_p zFk;pM0ONWpl#~j{(Y0o(bKb+4O@Xv`8^lK1Wg(-yZo4{L;B|H_vd8rFY$#>tP){c>3KP>) zUZpIHFTMz?+{EVMqEdv3o)XT$2I6u`3EIrTk=)?1+)zF@I5M6;aXfz_rZzmmkT&|AV8sK|ragxf4TxFV{YM zd_z&>&9(j0MK=)(U56wY#OY9oG*e^pf-pCA@zRCqGt(2}&rQ$HOm|bD$MQKS#KBR^V911AVU8O46W?1y2fJV@=D1|HB;HNGXT@-X+UKk7KLRp{*so4;! z(v2+qRqG=B$yKGYSao`VQ!}~wtMj?XVExP~_y@C5vwF)#ty ze12>Q|4z-E^{IIeOb!$IsdLT^7yI)}4b~z%jF|JG#H?Zsz@D5y%akT&FZ=5H8nyR6 zrgl&tnf!;ouj}nkT<(gDJ2c^Il~Kmwg-{N0Wt_{Qt6*!HD{r6JTA+&bakb8K^KBvx z7i80NUtBTfSp@YMl6GnQvP+k)s<2yvBI%3N5<^>3YKV)vfOiBH=fVjv!&%4=2hGvg z0FOBA_D>h}C{vX#Q(>h)6AFapo+xKw84}hY7mn4}ZC~W4z=|c9UxOr_InM`T?$3_Eb8Q}HTewM ziq06>jG$o{{e$BGR?-QutwysU!lFo=Pa{lE29|1{UH;HKaG348S?jKgJhoSOl2XA03C(= z;Gi%KqXZx9jS@WPP_o}HD6j{5y^Hu+-seK|eggA8JvV!NG!GNE@_EkTOdvFsOs}TH z{u*MVlpD?;9}6_M+Z0W8BH=*z@4H|QF$3HwA%dl3!J;zA7}$q@4DSvEmbaI2KQIpKg&l%eE2{j43jJ&xQgd+jQ;;MtjD&+f;Z9c#D;<24BkjJr{CUH8(m7 z4E;Mp(JR#G3X{~*2o?=@(CK|*f-8J#0@)}|Y{0H~D^f0KGzYWItk-q5t`s$4 z@I=rE=pIFYZK2#Tp!3#3vCioQ2D9>J@#hQXvgTBfTh1pV?OG^lLrB`?GZSMYgU8+4 zfeAMji-J_b%_*qI1wV7}55xIt!De>boy)-8a$!Bh>V1dUS*BlzlWA_ESY)*RnP7Gf z`RQNWt!^{zPU(`NO&7obiwo#~gU#a`MSI6GJ&8->&53wCTm{F$*>JtuF-^bQH|WH+E{|^uF&hHNCJ)dVXUGB-J<*O z@y$)h$s}zR3Xa5Hb2C_Y>h7}rSmhph6E>xX;b9N>V&J2t`^dcGjI+;DX39ov4}khZ z9_e2f`1IU7+cu5%Qd?B3Rdp3MtjjR2HM^kt&7`k8zx$LS`tqMyub+yL!IdjW(VBln?4E+O*uwEw`ZsHQY zMWqaGG%VlDqt@Mm=kDq2g+k^qOuvDBPM2ZXT&4tTZDF_FqcCeh%3NoAu3ax=<}5YI zj2`L3{9yO1x*~xNpt~*ut`1$oZFwDfy;*`iYQ<`Xt(!bb*_>}QH9a#S!_IaYaFlTO zF2d%k8srF8*Mj>53r(!4u-?6qf$eN@_l9idjM|8qVVDAXB)CI< zBUn9jbg8}Cm)~tT$dG#LAfKSKH90m zejJtGz})qi!NCG|>$F=tb0cjU9r7mZE@wySt@GH(RDRvZ$eorIXxBkMJC!%!O-J#z zawdYo-NLK}2l0`!-KIf zFqOT(V{_)JRZmanUW{#T)jHQ4i#BU zVje2rg7TpaPW#OrPKBk`*`L{N>g+bCh~K4(7{1|rTb&J0z}#eY5L)Isfehu3Lfme@ z4K2jSW2E-6wzpW1mU?@e?LCC~*5xM!>H#rLWZhJ&D?2kg54|DqW7abB7q!f)tQ2M1 z_80m^nHAWRu#^#D_g~mFSXW@nWOdPwi?-l<1bS@vC^%|6S`5H;5`>M0`OX=159xi@ z`J!4=c^x1!vuAgoyr%GKc$&8c$4Z~?097ub&f(U+{pQ*w>-6_8Lu#D{GTxS@AM|Dh z-iq0>oTs2(IxmFNnY0K!6qa2I(@n~uP3fApT|k@EEp6eIyK)NRs+`6Mp%wSmY%HO( zF_M~sFc6egXZg^Kd}IbjB|Mkr`=((?Qv$yv4!mGbZY(-(;LPf_234}IHo(6EyLLk@ zldORebr*3Ii`5u*jf3IV{P@5?2CCt}z#LxD@V0L4MnjQ@4sQ=bjhIO{H?FldfD33^ zJPq$AE3>R+T|YnWhW|kdA8n`YrW2#4rgJ00cB2SM5?OJQoa2&wJwcKW#pKsfY%5dY zde`35+{395D9?{@w)E=EdTYqPDCuD2BL~=4#kWTNQ*)?J&VV^nQeYB=jw5Cj$Ivi7 zcSg@Jw8rtXx&UK++{B+$Xlf4iO|01|9>oTwDv2;eS9FbK!nN z%^dD#G(HHUar7YQH2lYNR>*tM)I6>O5#2SKn;oh};EK#BkVj|(F?l%H26oC9!F>ge z2*3kvVKy^Q4IQ<6RE&TXcEs1vHDOmoyBPz}fKV2ZHN**(knYT1>=Mwh4ahDj^dInk zCUk`G<%G{!1I-tXQ|qA+AqZ><4_4tO70vuO!h@oj8_xosuIL_O&X3Lw_E!f6)==l( zR*h@#GMInc(fS5N2V)d2v!M5NPy^Q-e=)v!eS=x_*Sz(i8@u&Z=#UEzbDVVK^hfY+ z*CVH|<4fL=6Xqdo_Tlqc zg?B_3ATtPehd0))25#8Yc~oTg?!HI51YOftPiE3<=~Gh?7ZYYQsR`Hvd~|IB_Tx)l z6M%ULGXc=|@MpFg6L2?}fbURQM0d(0|iPP52n5 z6fJM4^~u|IgM!EOs5{8B$5i9vS*yxHE3~T}p=xoDZl&XVe<}miiI;rM{8Ad zaMwuebD}4da9mN~Rn6QN7!YO`K`_ju6|A}7Vq&>w*>DaQrqqEOd7Zff=9A*##|8V`;Tdxq zyF+IS&zM^@Sho&N4nWxtvy7|*nit_~Kc3tO=leb*R^f<8=j#T|>X|Wn%M#3B5@E7t z3x2=^V>|_Nxeh->7NPln@o+0P!cU%H_HT`&ozskwK1O435J49V@VKleb0 zh9oY-onBmUA|a@jVeU|B^`;Iw0#hl0R6y8-rJBd#q-yVj0-aG%kYTb+RcZjun9U-b z3VgfT)PrN#?|b5lqVgx8OXdzM-hlMI4}341J2C$nkOZd;(ZQcBb9+^+m7A~!39wy) zL$24udM$G|I3mFZ3CB;vnm}0K2NTz@5H`WeA()?pY$&AyoQA!q+-S+0%pEXGQ!Ti+ z%=I{3ZhNV@T!-yGY`p_g=>}~h1apfp!rSQ%Fk92G=-pd&O=_0Z0vx^#p>{%@frUJ< zYYO<->^Dh6pu(*vbkH5fRe=59ar+ir-(=--Gpi3&Rm^RG2R(h%)W93t?U2?Xd3YlD zUOX-j(t*!v_#pra7$Yn}iEo9&w4I-zq5W8|Kyhki(8H>-tmv(aI}e#V>Qdb`0*GfD z-dO-=WdZAk>1NOlN`;f~jS2?6_1H9?TB|r8{6w zv@d$R<3{gHhK^ng&;oT97oZZsDcP;_Tg?5SmdgdFb~;uJcB#RW&p%-9)NaD5BsU7O zQkJXmk4`PesY2#94IIL{H4RP!qIT17niU5X3pUh&0|}AZ{Y4oj0v4eJt?C9W6NTtb zZq^|QJU5;uFWP3{1E4@^5qFw$?ZPg!6ySpOg`-1!Au-XajCh{#{4*7Tc@ z1zD1GNMuhDLM;`fWtcKofQ}G+V1=DuAlv=+q)O1&>Y`=UK45N;YAY@HRD|JU`&_sNT zECbwesxYOrg7bhXIIEz74zdakkt^7Lmo#$|8h{dJnwqX_Eo!_(&D@M}Sx*kjZ^~bj z|6KmB@?Xo}sceP0k(Dhd?nJQ%#e*mgpg4vihvG35kD|DMVj9J>D4s#Fh@yx>Ls3WZ z3W}Fe`~ZsYNAXbQM`uYV<>(a#ZRF4EQ()1@dk=tMe!vRzl-8)DE=75w@~~UioZhfKT&Mj0Ad4* z-6(dV$e`GdLO?Nq;v|YO6lYOPqL@eV6bcc=3n*$RmQcKe;sy!>#rsjbisC~kUPtkd zQG5!;&!G4`iqE0=B8uNY@nsahkK*en{ymCsqxdf$5w zNc{{_J%iNFAeA#n-3(GSgVf9*6*EY^3{owF)XE^0GDw{aQYC}b$RHImNPP@a9fQ=y zAeAvlT?|qcgVe+z6){LX3{nk))WRT@Fi0H?QU!z5z#tVcsQ3*kdV`AHpdvS@xD6_5 zgNoUpA~vXajmkbK8H0+|pdvM>I1MUFgNo6hA~dM@j0zUr2b%I-SXf_^{}2q%H|6ih ze`#5r^;mhy>fDZ3WOeSvE3!IA@QSR?C|;4(nZPTuI+yT@tj;yOBCAuuE3!JPctuv{ zeRxGy=ZEl$tj=qAMONph@rta@XYq=x&Kr0|R_9B2MONo)ctuv{TX;oQ=dbXJtj;E^ z#$YTUR>#CEvN|8ZE3!JDz$>yk zKZjRjb$%JI$m;xSydtafRlFjr^PljFtj=HH6@li*+3T#_VSFM@9RWJ_uzGPK^r? zG|J^@_Sgg3b>>EFlv?J->6tULII^U*wJqipsGOsiD(B&kcg|lhDJP$V*c#Yz&RE^r z%mG@d1nw06pu{`1$PG5=nC%)gTs<^u^Z2US$sK+HM?l+AvoCQ*xq{Ga1P{$^T` z4<>+oD!Q1tlhLE`_H2pW=&XmJT{Svkw)lbc@j_< ze1p$5kA{9CKJ?MFpg)uV`srxsR#97LlSc!dix2oxT7VBF0NlxZSxaN>gT|vFFUN;m zNelAf1duzJFZ{+}pBo;H_xs}GeP3F5k0ii*CR(Sh1BOwvu`_8MJ01=EN8! z34lKm4V)n30o~DP|7Co%pG^zx!wJxy2t{kn{kB%@M`Qgr@v(j>Ev!cqU=44fc&xs& zv!kK^xA@S%l@@d%0rb((Vs_4!jt1J>8@t!F34*55>&hko`b1}-{1MmDpby3eokhMq@%%Ji4S%@EwF=Y1QrewjRyO!_+V>k zfjzc1VDSLyXs{oQ57tNv?9iHl?V!d#79Z^EX@MPHGq5AkCHqV9!G1n1up?^*b~GC7 zAI1m!<+Q+#t`S%`CpjAI|A-Iv+i8IvO91xKfW8H6<1gT+1iR_6PEn4AyS*=VSE>(! zrqY!f_gFm)EIpzJUuyDjh~MX_G(&S zA4vc`%rA`-!x`o?bJs z!_i=WEk4*^P7CZ~3BbmywH=28e-a<=SJQ&~cmlZbYHf!e^8bnt_Ak-`JDvb+Kue3e z$a;^=jaK9St+D%1J0NH(eW)iAKn?KB;Oq{`dzx)D)`#O`J)9QSi3C^&+B;Bqf?G7W zsrcZYNDJI#0&oHLDEMsMXt;&=aNn60+^Ga`A8Rj5c93k_8L`obZ^lQwk{04K2@nU& zwBgQojmG%l_!xgMEsSRqU_9Dhs@Acs(eOSQAKp);1@FlO@Q$>@gA-e$vHfOzY`>ls zw&?`e0@}>>16re@{)hNb|6N*8&n18wFr$x7U5!Tfo%rbfcUtJqCqOscuB6_RQlnw+ z*%rIwvkQWz(($>F0A?-%W;DWFe1u2SLU=I&!T@UnQ@o?GO~=P}CM|3;39to}o^wEH zG{RzhgxAwTIGX@rKxY*ZMuU4fKDZat0(U6^xO{u%vu6#%L8Q?Te>gtGR$36BN&qov zmJa&j@ib7*89x?{_S5mv{xCAi1MQqd|TzKFI%@7RaX)fDC97;Q-QTY@Ms@gJoH@%aQ0v+WHZJ1I08;4j1n_?ff-zB2*9fR$ao(*|MMgmqvj z9Q_%M`FG=E{_V6dUrT^lXfIUzyw7NSe-aQSN9=a~HVB$ZJ6}i# zpM7{}bouR%kMHiZ@Lf-UFJOYSuTFYS?TiLJ79aF*TA;;rKt~8-!l63xC6ZvSR)lZJ literal 0 HcmV?d00001 diff --git a/en/doctrees/flusso_autenticazione.doctree b/en/doctrees/flusso_autenticazione.doctree new file mode 100644 index 0000000000000000000000000000000000000000..462ff7ab54bfb6563ee42d626fc70ddfa47b9d17 GIT binary patch literal 54791 zcmd^o3y>Vgc^*jM0NmjXkl@=~0we*RFuQwi03=9)hXZ&32%HY!`>~kYox7RE-tKB< z7Y9HO(pXvnV#3q?9R^3S*|jR=Hfd3|Ni^$p6;HP2R{1NSJv@=<_@E-YSpV*xm2pw zN{Z1oHHrF9VQPnCXU8%NT#LexLzM)l& ztewH8Vr|*?ygFdsX@y5%aXserEY^#IjhKtHoDz!)I z_q9nXb7NhG2#vP7)mV_tA-U1ewS{H_5J=?pTFHQT=B8prHVj-ue4r{XTd~chX5Ia< zAQvy|$|9#3yt-UDYSd+dy1A|^hN53l+D&s)LtdgM+Uk(HS6y!o795)JYolOiAFdiX z0$Z!ve+ngKQLAbVtyVR%y3uHx8!B2=X`dNrE&%i`MsvYvXbn(Ut9sHp?1R0#vf0eL z7W8*zP!C6sX4J-VWoRgq$vm{6=N=vs^sUET?^6SO+q%2Uw0~LT0m3L)Q*QxP>TMwZ z4*a_d|L(@WdqCC3#hSh>ldM!&TivhT+f?sU^XdWhp!&d>jmY3oGb97^#s$4Ci)`qT zVb3G$)%(@;K>apLuYm0BgsiA4#mkabtX1EY(U#>U1sJp09RBBDMsB87C~A7Kq7;^N zMX46}fn{00oHed25fMjMv{FMoni-vN*cjkvy?i{n+Pp0)BRN|yS3ua1iv}9Ua<$DH zM zsw;WVdeD_pp`tVziY{G^tb}t;H6QCiefR8Q@xIk7e<r-c}3mZmY8TPKRmL zW_nvF(<`A&ZzD6&!SqAKv{Bbe-PE1#j|EvB7pm>DdMK3Dh^J$bIOvGxVQ}2h-Mu~r zoq_~mA9DzMuT9v_P{KYOO4!a&!X9P=p())ND^h|ulu4nKMLiyivmt((>ob(JTYRLs zMG4k^$zko2HfwuAS^G>VYkNXjdnd8BBI{MHx+I~`GhkFDt$_|isaMdq!N6W@HX2%H zsiI}j$1T^j49ssssiGUoXw}R+nu^hoGop`^ucLEPGDfXh%amj!K+2M$8}!t&lBw3J z_(vUvc15#D+hsnxb|pBS*yqAJF>`k(^6)-sZzy?s7Zo7Oz*WgCD{{4wY1A?c%$Ot?Q-kY)Fd=v-YON*n)07thw9C;K9V*?cF zVaiFh-%V9;QrU`>9$%Af!Pni9e5u6O*;CT-<1RHTD=S%f39V+Sb|tH!;b`#wau`I& z%}OJ;sKMOiV2NtDUem7?tP7RO(o(@00u|(DL#^o;b0`LyRlT$rAZ(zrB+0Ue8|Q*c z!;3;~)=;grfhMnkgj+*urFunXrz^6yY|P0z2AgoN`v=X4gV_Y?{|*lW5=O`<5u<6VL=Pi& zGG=6dXEIk;X8L6)Tu4FJzDT-CLAov|x+Yh&>)eSLN!jw}5+Lh#FIkum@RaA_%1&i* z)sf1j>O?ZC0ulZMl4_7Ai*D4AVYa!6qQ;+O)zo+e6V%)nNzHOlYb$Sw5r;|Z|v75b&F@7q=LzA7rwNZ+lz~$zV zWZbwS3B`I_Bq2|E2$@%wG^1fnP{h|I-Sbq`w8kEr3~yQw7543H;I>P|vA9Hdb8v+b zG#rYgp%Fm?1{S2hPxL+O5h_R^w}8e7f57*s)z(5LLWDoyO^rbdN$W}NQh0V%6b2<1 zj7pJ=(o2@Yd26J1LNkiBD~jI7j7Uj5;?^R+Hg#socG@cCB=qQ$eJ|_1=Q43LE)&k< zt_%WqHWIhjr92@(>_4Am=B%^){d0QliiSxDM@HBtw z?2urBow2^zNvUOx$7osO-CGveS%a2EnF@Bs`(|e%E!~;u*|Nr^iEb?m?9ly`?G9xs z*qP{?oyoM=3BK5Itgd5~$EC?0?9lzx*>PXyO!mpnL|S$S8THhii5_-`@<^Q>%2epi zR3tkJJ2LhgVy7dX$fnk7aaI9__Bt;Hg=L75xsd&wlsc2abMzRxbf$(gK z{B$tnv>T^ofgvA9P6|hRSR@}yskAIBTfx&qkvv6dQA+k_s>Aw(X_43VIQKma`7KXM zTIAZDV|}wTmW~fJl^u)G#>Su>Vvruj4&6`L2O`0Q?mXN#JL74wGaiGT@gD5Z{nXhR zci4F(lAS0El-k&ID%&|ab?l4B0{O?MP6|)^qI|q8rDTD;W7J0@d5W??DUHIWFxc_W zojPsE!%_E980F#RCnXEyj>3*dvU8n0p9^!dCo)eylR4GI>?iFf@w_*s1zWT@TdW{k zsndc>EZJ@3n)OOeE*ZJe{OCw7Kb50}W)d&@#)>dn)~hed#Uj=US9t>nE&J6ZtyD*v zkY!}M`N`&0X~~ho)Aaamrg=5vyX!W*1>sh&p}fLkJr>C(EtM{u1%V24DHEwgu4}N? zP&~gD?xA{Am`qs$tHiE{PwO_bDHE;s?H>-I(~*SkBSMca1sU`%X$-W!4Rp@~RQz_4 z-Re~pUrwTePejV|0g|Uut1e;v_LW*uUZ`LpJC?*lwf%MM%{ShnORBB{X}4Uk-ZK>J zneu{GEl~APo7rE-;`?LcQvuL>NhHY;35JJ7^3cF3I)z3Gmzc{@#HuFe*`I=dF)2|Ya(N!e-A(-Tif)3Y;vrCgG)U&ppKxw*Kg z6|vA$p%vI5E~k~yXO2wdMn-dE`P|6F@%)j)`6D@FDbTDpmX;;#@$vBBUU4aS*h@iz zG6llNBN3h@gww|Z-B@H%OHIJbPvr3b$YgE=D2-a~$QbbDI#-XcFUnqXZU1!9O~*pl zqeua9HWDJQ)Hrcgx-j#^+}YWav(v|)n>~MSwx0?e&F4^wBjW&nDxV)23#riEr3!2_ zcKK+~2;K*!c`7&ju1iH96&)&zVBvHm3%r1QX7UScKn$lS0o)~>eNtYKJ5?zsMv=&an3TG)l9=1kfJ#Klh+do~@lR{PcEJf7* zxkw9n57aDO%-YrMV(hu@ zuUF9m?Dym*@p}!>%|)VnmUQyGwfGEuMQ@B^MbJ1#|Cl(yPC5za zXf$=XirE3G)Y%iEwK`-(@!JIj zd(f!&k-w1rLZs|RNcPza=MPWjv2ZJ&_e?l52&2ZP*J$8C4OuVc#`A}#Le1?~&8Rt< zct8ZNyI>9o1Kg`1f#PB$3OWv@07v$`bfQ)~GM4weRN%~ua*gYv-dw2IYut?-lJa>y z1|0VMSfM^fvk(S`cp)=(Tk%v)!nS@&>O<$h?xJ%{Z&CpS>L(*n&lBp?PkXEqZK%e& z>*8face_nUoueJ%-p;dJGZd+ea|xssWkHfFOSJ1%T{Z$5xxT#OHAnVO7o=l{R$s7y z`&1-c?pCp5&9yqQOSOCj2d}j~!*6qdt>LLy`=<-lc^SRBLIupHBVpRL>T$Ybm*}rm zrCQXl)oFWtXRUe%+JNfcx4YU}^%N}NJ`)M|jHSe964a_6?qwy|jR4qXf0fctw@RID zTL}rK5(U6#BLT8)I{ma~n3=FRL&Hg0jV6{7cWAD6L2U&CLVt>~LIvd$Liu3OO|bLq z^onCx)d6)Qb*Kk%YUluFWbo?Jy=Cs9?%R@?p30o8)K)CeyTb2@v%$*m+OTe2*zsV3 z9PnPgjx_4t@(TUI8J_Baa)Y8c36y0Wqyrk3bh)m2M0)0i8`rJ7h*Q$2iF+h7aL(ki zY-EOq_szgu$+W$Umt5={9?oER?!SRobaY*#bJploSw44dc-WfDa<;?~cntllV_W&_EQ8EA`3+}T2M?;d%saZMf^$$^ z*<@vehHu2iYpjs)=#zOl7hEMo%eF_&}bZ&%aGkXEV;@b zMKb3sxII33EJYRK?C^*~cif!*bpmO21oYp{EljTA_{~Fzdw;z42W43t;?7Lqy6vd28* z%tA+X2XR`rvZ&x_Y#d?j=^r*b0#F~~S7iS^Xuo^G=_P&;pY!h{Y48YBb3N=ToCohA z)0=t0VO6fQUokg|^BYHnch!BgOJfJHY56Zi;hR1RcbT_FS?^#)`>EI)Zrp_;?)KYF z>S)~jZXf8~kp}I|ov@pc-G-ZWSS#5&JnZ%=Lcq=9lKbqT1Y!+vFXiSDR{l;<#nAji&N$LMAkCep5sepAS_&DWp0xy&UHYRK)3-HgJ-xg$)O?7mtEc1x#5 zS-zXo@)i<_=(qyiMO=-(Hxdcv_#i>S(CKf+LK{^!G{bATZVk9wj&mU>-0P=M+;{VD z#SrxUNaI@3UFIXJbcNi~!!%>}@Nm#m5@@#jZ@Bqvk1|h=bhgamDJU)SeR_ICE)|f_|UGALAKa$ViCr&vQ2bOg7p5n0l4U}3Om+wD4 z+s)oSJ-hr{L<%IQ6Y(8c9R%la;?_?BlH;;nnx*5J6*&GCIQ8hD5Ajb-mlSo4-!T}X z-r4KNK)Y@na{ZQSb9n*hUgMPK61{&D=RGSKO!Lu{w&m`k2VMJu9Q*M37<%Ea*Igd2 zc>K0yp;9YeF1({zYj~Z8XU>4T{n-q8?oVQs*dgn5YmDeDyH6{d1zqz>Dje)RFz8%ky*Dp&?u5`MC@};eoL!l44xuHxu@mhV17XO0|Sa<`E~z^wEzHV!C7tY&nFZS!-7kQ#$e)E{^X zpeH8>18}SQf*e{W4f-gz$PA&;%E(~^ZVx2_u%In;vkSQi8kjSCC@%b+h=Da#0@QX9 zN3{br8Y~=}&e647AXLT{kn%5OuHbN4c%pW-20b25!bm-?7`K-yvat?Z_11i66%#;e zTC>=2;|`lSUsNzm4^2@}34S%V%vOgum`Q1Pj-gjFk6*kv7tniEk#Sy^Y; zx6M~Cq7)*mZ(FoVLo}S}*9tM(gZ}^&&tlS75E$+@TJn9I#SOv0POhGas{u5;2KOd##uJqCM0 zS^F`X__9)2XIf(UL19Mo3~2*8+%(3SAr0endf7V)ysINmm&4C;4f!=Pd42zS{Q9PX zSvzkMLtYxTi7|P10e1$6>_QnMXD`2$Krrv@rA1Res)o-lm0x3wiB)acHatPJAZ!ih zAVQR}@((G1qpq9mQe7SRHrJkCN&DA<{}W#as6bZEZ9c9$B=WtGkNZY!^QPWo5_=}y zkt6s<%x1(_e!p+TZciY`%{1xKF{9O;m;PUi9ZDdXx3yaA^wV1LiLCPfUR`Vbwryqq ziA>;yn2T@ylVZTJSNnRyb{oh!R&D=V|9%_pQ}LSz6~~5b(3vdmE=yb^rY4Xf-|yUX zhp4{s`<{@gYpxW`8|>n^j?@pz3Z!0&h@Rl8q_ zQJJ>dQL)@=w|Z%CE6WyZRlWc3#1O~UEk~Rq$=|&=vm}=6{U{o~7gv6j8R z54``Ok8icjjd)49pcN6po7zR~Di+0I=_eh(bG2>4qoB#xuUHd!U*^fz?h^byC3R+Z z>CJ_^e!&&!pt;90Zo5jzqi;*jXYTSYX~(JnQkwOU|Ber;>i ziiHL2@};{dae$UjUTd4X7i+af6-yC3H_zN)ZleY9P@KY5I-9VKE8DR~SgT{Z^D?ar zH<0BW))kD-_)39Re;4p6K?CnnsYLq$=K|(<>NOp&vy>}JrG4f`b4Zmd&d&jJmvU7D zUD%D>G(@5SbD*RwG?$RycKb`?NTDn8GOi5Lwq=DtwOi(Pty*t3uoJsjD}huXY~sL= z!)^0U|BV8F>8gMg=%tFHgJu%5*l3$OYRyJ?4tE9a1hOdKzj@s{bGwyqNcsL7frrhV zB)By=2}yGDQn-AY#$uoMK7jg_|P9C(P!Mz($pyBn&!*Q;&bOet9aq%7d|IBE#1 zcFfJVF5QhaMmG| z9;Fm%`dhYcm)bnE7EzTu3gwomcnQ*1k&+}H54XWjd24T zC8!OSbd}J8uR#P=!FTOnF>fv+)#U=Vsc4mgTqSxqXs$Wz;r~aY(dehwPdxrW7e#pFWL2s)k%^`NvBn{f!R-ZGsHmlwXE2ec; zl6CvTNUh=IE<5#S%-y#A!j4_TK;xF6pXwJoFVhhpf7m2^i$VZiv8|Oz7VeR-rkuJi z*)TUz66?-E^$qo#>UY&|seiA2zdUpUI<8F=+(N-k6x>U}Jrs;kkfq>Z3Ld233U6e;6@5|Q?P@AyD7Mnf0f1s|f|XDRq31+P)?X$pRWf?uQHbqc;n!B;5w0}9@t;F}bD zhl0PP;4KRNmV!ZYgEmsImx4VM?57|@L7oDMf@2gMrQkFLrzm)uf{PTCD3B>&?~8q_ zzau~FP4aimLDFUGGqKcA-)O1dZK;3XVpVRj8n;-5TdckZHra5#p>E(Rc*1F zwpc}5te!1a%@(U=i&e74>eymcY_S@)SOr_Gel1qL7OP#0Rj$SA)?!s_v6{75#agUh zEmo}-t5u6ts>SNmVpVFf8nsx3TC6@TR-G2BO^a2g#p=>xRcW!Bv{*%2tR5{^jTWm# zi&dh<>d<0UXt5f!SOr>K{VlHg7FT(YrK#RVmGw>ak6?KIO#Qz4Jih-8*y_AVF}6Ab)Qs8c?4}r7ox3TVoF&N9W=>RhK7Tb&P3jIB5;FTb)5_#%y)=QjD$6eu}Zx$y1E2&M}Iy)j3TuwmMH!jIBiR_8dy*y^047+am^DaKZZ2C8gzc*x3o zy~^LgwWhhv>v2(sYi=uQ7?O|=fgahqLcX;~XZaf5D^@yqAn?$Z7ity9iQ}X<1uixm*RW83SzLC8r((ynZ^FsmRJY4ikAt!c4ZR5| z7V#z4wcF3_Ouc*zqq1IGt$BgU-ttF~wA%_ebHE<6-e7L9rcyS{o;!J-29N%6fB8e4 zQ~AUABUWBn9E8)7eH;@rI{C&K%X7`_|yp zU)YFC-hPSaQo2L_z4(y-V_J|8CV$M(^$er=g-iD;9IA3o|fc8iv zT3uPfmQ1|o?OC&v@v)Ajh4oMZtkFG`7b_f2Qf)Y!GQBVBuGDk!p+AupbSVM!$;fKP z`_Wsy3$>f zKN%nEKTiv5J^|Kl^Eu*m?MQaCJJ?@~5B68m0z0xsV8^l}-NF7re6YWt7TD3X0W0B) zvfaV{Wqh#zD=n~NYX-K58gJYZ+of8Mq^UR=<7)I$|qU_S^BD8Z4MyE+{CleqJS!ttG$3~7w<0GR|k4dNR#mD$pX<$;cmjA2biymjJ?ziH_}K1C3)^f0Y$1JSsex$KpeMBrT|?6F?1F(T7*-au1K-h4|>6O$*(b1n9;)m6Sgu#j9?6zoxkoAEuEO z%(Dq#=DNV_uBIQ1kMO6`Lij`igdx@j%bL1ldo@0`Uq}nvxdhlkYLC8apCu*jj_?cd z5q>@`gy$0=3~^QoVRvxfh!5`TX@Q$d050Fz`0Q1~u%q1}z8N3l-=qcc?Fk@;t@n4IC_cCc(gJrO0l3jlZN-O64^QSt zq|to72gsB0K~ARy@?uILi*ilEZuTQ%`5rTrm*RtbF)ff!CIA`IC6-ru7@X_zv8|+q z?Wwe|HM*OZc6@9fN(^!d>CMpBD$@xMPsa!S(X>GG zcU}721Resq+vn`NgZ^xM(Em0q&B}r z*Z%l&cZh!)AL9Q^5#nYSqGE1wj=SLV#I|VFVx?KaVRE%4I!f#wj1!HVQq5U47&wkH htK+L`2hZWZM*ID3*&Hg-NqzQ-cIy4=`sPCR{{!2LECK)k literal 0 HcmV?d00001 diff --git a/en/doctrees/index.doctree b/en/doctrees/index.doctree new file mode 100644 index 0000000000000000000000000000000000000000..62363babed3727347c07c62437217649a8d05886 GIT binary patch literal 10881 zcmeHN%a0sK8TZ=W$LxE(@fzgVGzo;=WM|e<5)@1bIDW({E9;eQMV3&~?&+?Xs@b0I zPCs^cEP>zYtp60xrDmn&mj2@31J9V~%epZRW-457MP?r{72y zWhJz>B0mXjmdX?8VRPX+A@kBVQaMfCW8p@%Z2V}%>{$3-F`N(c5kC4xy2vYXI2N(X zN=@?I-SyRLD_2*q8@B`ItzI*(`kn_0DGkAh)A!gmv9f>1w^QO$jszB1!nnDpZpm>g zjzdvTVl0W4a7s84u{&zJRurKUzlS}mt$&Rr_(5`YTwL)eNnGm!x+8&qF6pJRr##FY!1IqRT5QTU%Q-nzGjPH)|qZdHI29 zSe|1%AlVA1x1()^u_YYHOT<=9crgn-zh`8~jF>ZHHMU$~dB)vN6ti|@_zhz{sk_29 zu8Ahby2h%e(y1BuIO`ae;|H-C8pW923Z2M!(7UzRVo)y__p$F_+hZ~0!yqMHQMEM? z@PEjv&zhHNJZ`&K)w1zmRWWQ4%)r5`{wCNb$QoCoCWVOV8!(Xd(Bl@CI{OsQ4RfntZK|VqAH}HKh!sKNaAT0p`%e zTs!%&eBy8@XmwhUrwKHvR+&Wr`UMQvbxGagk3&`XMd+P@zbEkbIs82ZRXMFy;45+j z3?!jQ<)`+;U7GMk{v1fJDEyAZR@h`+V}kk4cg4O7w3^SH4|$ppomx3R#dpqE&JMpp zv%V_F3;8(dt)YyG1v#uXDO)zxMs@zYHg4eOg^#5oxkN{_ewAeUb8L85yeiNIzXO}^Cc+Y{@?icdy))rEFlz{YO0O|PX4uZbpn+=ft>S2&Q z#AEIQ-d7F>?;(WyVSGbJHCd2Qg&)s?gen3+9VAo(9VAp0X@m&7Jbm?23HdjBC>mXg zMnTcYC?f1Yvkp77Iu-hYuwyTE`PpuDIoNBx*>47qH|EGy;KJ>mu-xdKrG)EW0oR9g z9t5n1kN^U|d>8@`2&VQy-^+)i?*O9x$h**IK+8d051_J+1vI)HDQescC4bnBlA&6U zO=bHAaWu5bpXSf-c=5$2|0tCN~mK zyp=E`>uHAwm65(!$UGHR7x{vm?p;7vFdy~=d|&){E6Y`4wqGtKE%*ppu)BQ_;O`y< ztQ$Gj_Y-&l=nt`z-7xUU0k%pnrwFz4`4IuCw6IgMe0dvU!J@4{B5aKyCoRL1I9iZ; zPyfq!(D@B8j(s0YAx8I7i2F-e(mgIBBhUGDN(Wnj?Ag;x!$;)1!U4t|BW5=DgpH(> zQd!Z!PfAjwW$1W2piCOMvDPjx^GrrFfm8|d=!G`XCI!)PG}{hXC@9^d#GBj?P6CJ^ zek=94y?X7cq0RwF)v`>#YobAs65o9^@~+lMN|i|=!^l{?v%a)kWc1~R+v`gzhf)Di zn>m71`Z^sS2x#)+-78C43;DwTg;q#&5TWHzZCwP`aB?+}`L67RR{7*Afnpb0JAPu= zIKpY*i0N`}!v^YG@V0ye-X==CRpdn7_3aJwt;CPZM;7<5f?^c_vv5{O>cX}y=m($# zoWI6m3+iMo_n+8=3=SZQBZb6}MFBL6MYZv&ans)--GR0M?`_p?C9&Uzve-t*nj(rb z#Q}X%hdb-a?a&5?yToTz*G`t z%IrCT4;@x(q=~zFYFt@gEw2N-b27BB9&mU>0ZQ!mD|&5wTyH0dIdNSUn=TewIvMI7 zyjG~i6ga~xHOm{vvjLimB93USVsq8;?ZUCmP(bn45uiB5&$nJh|AX8wJXY&E@q51Y zit5_Bf&Yq-=(S@-R==Pg(8P4ky&#WyqC#GEOfjfgnT8PFR6;n=3>_q|S4du;Omq5$ zwAB^TaZoQL(>a19Q4cKdtEskomR2xcaE^?S*%(f&#I4T(F$84 zYnj*vB%p=1aO7cye13Wa`OHB+KRK#=_K!#9h_>RX9I8@W-})M8X9*jbvX=&!>T=JJ zBFCG^4O;FIX7dU;yGl1toE)j!O+_+m z!9;MZBs!{{h{FWFwrzzQktPuNOe>8;RhViHrimlK34Ka_h`Zhq^C8>xbwbqJFyi`6Khe^gx5G{l`|8G1 z*rw$+eJ#albb?SltJxLxydxUwKI|bg>88lUeT8DWp!rV4)ok3EMn~-+cQUOLZpC=A9?~?sb`!8su^KKT{{a^%jBf+Y&UTj zT}3KbwmyVPwEjZHU#a*T6(3RYcPjot#XqU|7Zv}eV(27_Q&bF7F-k>+iU}&FsF1TCdb;=w!?y$r?*bxYTODGq}Jr=rt8` zCTB9uuWsS88-YBIA4)fnMCDIJrQfKmC8Z2s&MHe#^&511p^RDg?ohXt4P9|-0qT4_ z&s)02s%xs{x$bSgx~|S|M@okzs>=%9nCbJs{8+Dhj+ak!s$>&!0=Iv#RlG0Y&(PQ* zIc+B)y>c+KcL!^7GOtmO2G-WU8~7a0K9kVJ*AzC)q_+~(is^=F&pW9+)A0S+L%vsP zyfq}J=v@dvV{TK5hTB;=jigKj(3v*b&IlyW>l)@N6_3m<5py$tv4I)00ofA{EIwp` zA0q8xo6IE)k8{f{K8NKT+ZK=&%ySauordMG!|F*B(@k$#P+_l$9wD>ZsHq@Lv>7cb z-I3G63z8V7%Jv=f!U~hPQGGF$kM}m1$|{>UJ9S*(7Mq53;RTDFfl=F=!iBz;J`$}K z)KgAtx_ivu+t4>y&JzC-gv22p7wbvolxum-1f~|RRhU- z5p8|9Du`I(_~v$-;53WFE4SYT#n|-z@L$mSWE=? zYhMb)WZlf%0LumXg-PJkG7m-69BlUl%oa9Ve*&I!q)|YP*8~V%1PpQd+UytPbie|$ zcxFJ0nWUP!1>Q+9x-TP89o2#koUK>$!{$mV&r(mt0D78;8L&M#7m;JAuYUg0^N{Cs z*s%M^Q%#rrQ~8lF9gz@RH&|E`EN-Ydpz%-m$qT?_8$K&j&0+!Y zn}m=@ayII~t8JTHG`WjE^$^J?*iS}?Wnz7X6G2e(>RTP@K&#-u}|Ha1@C z8lBmN%$CI5iG-D}KwEBUNy(3u|kFzR7UUgT^) zt*ix62?c~mGyup{PS`#odli+!SB+lH>VE(^zMbBI-r=1cG#C#8BOpyrSeUGGHC|y& zN9r|PUfXr1*-OXnm0Fg&EXey;Ag;Rz_rXDT4ycH=hrHT?!u1tYEBYBH4WWQJYo&O{a{LRXvg$a35vCzIJ@edAdB E51&Mu4gdfE literal 0 HcmV?d00001 diff --git a/en/doctrees/introspection_endpoint.doctree b/en/doctrees/introspection_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..b7ce38bf9488b1fdf4e7ef9bb9b3d23b800e85ac GIT binary patch literal 63010 zcmeHw3zQsJd8TYVXY{Zn+p@tnZX|5UV^u%qsS$pS<{|ZHUYZ$cX5>e^y1QnoYWn4> z?s*6U&N>M#Qp0CZ7s1uSEFq=bsL4KY%plu0W>uJSk@9-#O|DWiss1a_zL zS=amGPVG+Pp49o|qv3G)@h20VFFf;h{QIRBo_W3^?tZ)?c4#~1g$?>@lh{93pEr=IH&_#I16ATnK>i*0cNhNM zjejo(RlAn+N|vX*(#I;|G4T~8@g6ZM9v4rD_nqH`1WuMb63}i;Diz*LhF;6WETioN)%G7oRrGvo(@S_enkMra5#eh*)KIRnop!8C6y5pD~cfG66}R6 zudIgEwG|@b^tzNTil;-}eHI%#*}G0Y9=X=Ebt>y}ww=#_uudBdB#z~)qTSftSJAeY z6se+h`A0^H@wv2==5?voZs@9rPpHJ|BnlvIFx%->5aMOeQeeVcQwlRw3Z8~U+o)RzQ&urQ*o6AV$@$`apELiS%pb4AeD%jGV&c^mkr!WOF)bQQ@AqVS z-IMA4WF~5uet?)(3sSm~xYP5VYF2wq(Y9GV>B(xHw|$Y=VP(z1V6P>+M_deAA2JDh zt3}we24M$1346|yu!Ek2J;V%zBs69$MG^c^#(7d!?{#0Cb+Wfvd3us|n~OC2QzmO4 zvRHeU!P?E9ti9ipwVORzdlj*^&MP@7x5A;$Q(;s&sfY?hC}dE#!NAU!ibW~3l958F z_vC$D~p%e@1=}07B5OPvFoD+%>wIHBnq~G8mYdIlR z{fpvPus5?P_hqk`tI3G}f!ut6;JhGTA{qupW>z$pc&vi>m#8P@Y- zO2NvEU5es2w6oX1h$~|zJ1?ut&WekjF{^YFqd7EjH-qA+zlx)mS{yk93Vj27(!rD! z>zExYVZ|~8DLB6RD<)re*X2tjz9!CcLqj$->+9=beg#^yl3xo;P#g)ZzX&=Jd?{0m zEK4vq5m=%;?&p=wgnlEFSy@R~U7!SCDvEgpeGWl|S{2gERfO%#tZ+Q<;KsUP)9|<{ zHd~V+lbldpa&(&l3lbj*59bxZrl^@&Ng*~F6s~)~%cktLtdJr&I52L9>1~$+oidqd z`MV~_m)8Zk%rwRZd2BetOIdY>SJ2r+^SX7=3~_ZbRpoz&g8>dbWPB05Y5j{1MvQ2T zkz=*dY*`s?l_Bp;nsgnlOINy@t~o)G_>6RgRU&G;Y`IgZBI~72vM?Ut_@09+BbLrp zO)Q(Lk@l#n%Av{BvARq>QO(r&!u+hj+I4NyzMlBZ^LtJBrQD zPlW~ZYrH=R0-JaPTF+o z(ZA)8Fe8pmR#hCEqBHGjpDS;sj2*AbPpu6vC1tdK<0JE%1)*)@H0MgCiX*oT*JEPH zkiO?&$!)`{W7#~lYs1|+G?_Y4m#G>XK8zuH(3D>la_t%_M-o*Wxomg}Ujjk&B?mz+ z8}5!`v(u&xcV^6_=Dxbr6snbMI3uAgPohXo`V?yqw9S!6T2*9)oJyBs@ky=hZ#!5s z;+mF<@>vttrfP!&Q%MA|CWh zgfj&@GbRlu>(WrHLjyV%B)^j_k9v4!q$;&4i80#)u2*$k^B4#*+XK$n=(JF79kFc+ zC$5RY>YSU5a&;M{NtVR4-qRbA)Kq>=P+AxfNt>_OrO2jDt&y^WhDccv9r9#63p=0L zOq}-1g!Q_e2NQR=E^cR&a>N92Y`UG1v)b<;n^E#>5(W`XfvggtJF7|I@}8q;Mm(FK zWBEFxY3JJ~t2VPHdy%^AP1#Zt8rDZm@wc795U-IC(+rv8vBuDcInZi6rqOL0uEpP~ zk&!;XWYC+nLKCeE+da%`jE*K^;cowC*dFAwK5UIOM<+}5H%hFK|5Qz&9BveOfe1;Y*!YRXOz7i-84r4cwgl&Hy0cWdm>$a*mBG#a8e zWv90>J8YOgaCRtTCObVXvlEbJ_4?4P-o}~*cD6vXC{dH0-j>1$$l zD2>3`p+rsD8K}#Sz#1~f46#)a_k{ziwOCSB3>~p122IP{$GK}RD~4IGb9y>Xmg0U} zIgOeeda@=@r`q5tAPY?ysc!vPELeI*JUQDxRty(UZaWX@#t(7B_Ai|CLi&)iIWBy@2xbhd=iPufr7 zm^Y;bTeLXaTtT*8paqv$vRjOl3Yk2gRwLcf?pP!`5TS);99#5_6=AfjS6Sv$DXbOF zu?--!>{sHXbOCWZmXRH1ZTDZ?EN3d@_TD>{t>H(RP=yGhKg+ zE~&T@B;9;MpJzxIBjpJxm!RSyojF#(;`;}C2dY3Hp)7G$mSA{TmK-#&7`2&344atM zdc7uc;w2#xD}};>n}d(V|7Vq zOCd(5dSZiIZ>*bh40Ds^5{jx6&MPZeL7b5=LCg-EnJ zO#jCc{m}@v+RMaa zw@|L|SFT`N8(&&pmQq;gDbNaR5Eqfss54`Ikyv-6CmM>)@W?UBL{Zl zr;WPb6qOdgVwV0?T_9}jiF6j*kVu1UIC@*Rc2}Q-9ZOhWLtFl=9e%V6C)(qMt3!`o zRkCz5Y!tVRvFW?8+XI{T^qUYQKjbDFiZGCT@I3r z1Db)Py1*Li>I)C}r^8&wWbQ1}_gT#q`J|Mg-G*-Cb*p9et#PG3Zot8d9l@C$M6fCH zJ+Ra)YbHUnbqP8}1dYb}jlo*%-z7T_*Cb(#3`G`Xo;y&Qzim*k2gO1Q>6>|}nIaj?fNqXXPp9Re_V?mw;Ork{q8|p`FNcTWi)zRqo{Y7`F3b~ZBS)lFlwWaFpXalNy-|n@Rs^h~Z+{L&;`)Dx{tELr1x~@7lPnF$CYZ?d0j( zCfY~qqFo@_on~lfTP$B0eqmIj4+C#$%t@T>rovsod-QxM&Qf;Xvmv*nxs9`6qJOL| zdWluK+z6{_IGu($A%%evGi#9n5&a2NtRTVW1}Ci90j)&S%W2w)Xeoh7xi=?bZ3>4x!!T` zK=GVfRvphKXUs*8A9LVJ%gU$88DEz(Hnyt|6>XMO!5k}s#VrbH4h=oOoO!>^Mf<&k z^&mV>maF_ zEGVXZ?SWQnbv+h(n~NqisN&#c~?9X z)R!&ZKZo!5f!=bO^eOSaDY*2IaNjI%L!0EBttd2s5U_KRfh4PQ89z2TOkp7p17fw1hlv1g|IWM?rC=Z>PFgw`>X z1`Dt6_zw-iuq&*>EQ&lVzg|g@@uB$va=3vdR`jXa8T>(vEWZlRm~_X;i)HkGax-X^ z$d7%Lh+Ak6K{m|7sVzz_EJ660rhuE2^3v(AQNE5^3;^nikLQ;zNr_YVYE-yyI z6PGq;M`kXKXQOk2PYvXy#njTJc>Jle3ro@Ug$tRdHrB?@E~)DiW2a8N@XY%<@2$ya zf_w~Nkwp#*ET~U|Kg^kxiVN1A$6p;A&9CX$IC=;7(ZEj%@EogH$x3P6@dqB>(>;d& zm0E7^g#x2V<|JrNCrBqGBb*zOrsdJ-n%azIrsT9dnH`rWM~1FUbuUSabL$enICUj1=OzB! zY&3OlvVU=SFg4LVc4cDmvN(~w)Vs70TTh<7SX$~HEG`b8>Lj+GN}pY&qS>5Wh;K~I zuXbM^j`mJ1T(~kZe*pfJ2xQqCevf~sE zK|Y^NFApWh*QRds36h!r2SM@zsH; zr+O!%vF^o0Y`ixvtWRH9T%4Sk-(0wGA#o;kW>QWq^h_3Kl%?2Eemb>$W_o;PBevQt zuXoO_E)_Q~%}*?3mY4hI`c}@Tq^0GaWHdRHmh%@z&!rRbHC2tzoa@;rof%)v7FU(| z%<{r)^g^_dE(n{KgqhXJxp?=f#mj3W{Mp>bP_I02A>NnCUtSV6ubiD7>=Xy08y6-n zU3qGKJrkRWa$||;I6pErIX*TW+sq)l8_R|K<;&`so^#?@_u5!`qJJcjnGnv+Zl3F2 z>7Kqa);B0j#?{Hha7yhx+dFWozk40BZB$-ARsNqU|4)_w|2yTk+C|5kv_a^k5N#)_ zZ}j%AYI`z#Zl#3v@9ZFvVxgiP5Tz9{gMY;YoQTs|E!4KXhgvOGCmPlwYO+4t8%@5;AET$KZ>dbc_c(6buJ>u!BB?5YU_q6*47#q{Ep2 zjdxpX9Zq&KtTfR@p45y{84E?o5)3Kb)uj)VoDdH!-uhF%y!o=VVCOE<0#{X~?RU{> zj=Oajs)WskR(obYd%Lk+HpW!wLm1OPq}>p<-`Bt1*!sB58(eeAH?pJ}f3+pW(r$O2 zD)qE|B+=6h{0Y%IHA=k742$VDvSzH5onj_FXC7T9n&*}^KKn_2hit%xe#1CSt;yL+@=SHEa9oljSFIEqJR8aPBe`Z) z)KzSaKVZ~Kf2y0#cIuOtSaNO+9@B-|a;$tB%cr3gvJXz& z3IN|n@`{hQ3?|boYO|U}yD*3IA9E|=5ROpFucK~(DaIjIr(sz!`gWSe-cIWyZ>QO~ z+i9Hwi#Imtb{a!&oId7ePzWQe-Ci$go3Ph2!rVq^@Y=qN5BIf|b30ehv0V8oMgmYu zHkMa+F~T*I{5tkl;}5h}j4!qw`y^3TZO48CH$CkbJ-8lr?2Fa8B0Fa1s+D4c_bB<- zk(^IErfXm04_vz)^Qf;~x+H&>N74o-)Sk84G9er`x0=hZ(;^HN zX;7oJbIdw=%bIk%ejl_NS9^DpdNeK;H`nk=CGWvoKBdzq*DtnF=_VekjmlBn^fW5; z;CdL9k?LHLQL%H?Sm)iv28U4c-AJybVr%??Yd0zw%wjWPo{ga=iGAIm>}0X*S~JP` zZ!EQjF?qrVW;auC4kbV8<1NFOEV8IgjmaSOW*Ll-zAkHBlu{yD0-B9q$GMZNA6&bP z%d!sFkbi!no^i+3xa6Q!hqt&@0b+>cXSR38N z2H#Zjb4bpoy6ZyR_yaC=Zyfbc&|g9Z^bxxHQMDa3{$Dx29VH<@tiSUB>uR}GTf4~| z^jEnREa<26ZX8FU)7z)@x6RcZ;&FZDkNs_Jx3R>; z?U}{+5gj9C4r$moEG_(NCQojR)qsq(MBhSGl1Y2&Wwd(b$~ak;I!i}sFe{(K*qE_U zXnbyZDm2Z`atg6S@6iimYe3mjABQ4!%^sry*@dXhw8))p_(O4K`(B8qISQ@a`l`+l{yWNJVe^`B^mI`v37t60 z-01XsKeZ^lt4X$LYESON_pZwQ2(=xw53wSj!nM~d9z1h6Gx|zLM)g@K`H`AiCt9Cl zbIy-N8Jn%A;hd*yHw}+`q-yZBHEGarQf>*5&2~)Hq}-!T%9AXcA%+W#xW+caEr!_5 zE6@9Q%V@`3U{Ra4V|+}?Z6YNDu=k|gs}RAb_O1H>;D(J|y>ijVTdl$NGb#6W8+V;a zxp(>p{x%;F+`zHVSFZSY%LUx7AghO&N%o8?f67Oy#-yB~n_sQbtM+E&I=i}bOX=A| z_ygq25VT!-G`oxN1w8X9WB=I)JU7+YV=VukkGBk}Kf|InRjp5-ffE{>K(CLB>f;Df zE=|iWjR6O}|6tBwg+uXW)`8G(V~_zmMI=Q?pTtIvkcfIcDPZFVIWSyBJ&##8sn|)k za{|1~=?}5*sf1_dlw1l^YBY&w4PBgMAE?v1U^8=yfQ`br&@#4A2v!5){{<*kt@~F# zM9D25*rF|eGjREMu{%u%JD^f93$6*IZMf;#X`%<$qtkS>I#<+bvUAngz`2VJ+ppz+ zZnfANf55PypVBQrI}=D~Ti_(Rg5YTZA0qaRF%lNbHh_;X{u?(KjJCxCh}v2c7hARE zK_71!2C$z+ZE67fCa}GUCiWQ=m2FBOduC4L)Ao0G57AE&4;foFESuBj+m@O?=7TV| zykPIOyc9SKdmZz{ddFa^XNI38T_tGEudkI0Cu>pr5YYj zEV2KD51{VcKZ)FbEb!c4f3g2MA+HwuFX3kEVvh~t@)ujB=DNn z`y27Vr`Z442VS?}U|YESk3QZq#QujYYE!X)t#PclJv*o9({gMTnj)Y{O}nR!#bEHs z&(uVZf}!`xi`XWG_OP@}+pDoDj)vsf$^@FWqaQ3CV;i1FLgwJji=GclrC;Ww5Zxt{ zLdo2Lx0zPm2Nr<&l6U?KJ%J|PZ2-~0|vz}RCx-ZF$}iA8Oy-g%mZN1M=?Dbvr6#%6U(qwOQPTGeSIRhpQ$I=oh$dELKj zsqbrj6q1|yWibDA;LKlt^?e^9uU6l;;%4jWy8=qy+$tqot-ff8V!*|-M*cLRG#a9a zW7o)^B~JXQ?5BL-bqkINmOkO*Ekk8L#-cV=*|%WTwzX6yjc(iu`gPtaOV#qloJ5<6 z(V^3wlZ7U51_+!}g-%?Yow$$2rm}poP2EOLuyjX}gtVpDKcTs^)c-Gh6u7$-C6wZy z1zw8RU;TIQ^-%wR0I=58Uj`*VXqA%dp#FRbn+I5n(LG&x4A4#WM;u%I?;%e7ssGCn zwOIqsEjX)S>196NGSvSL7PYDRUqGu`uTMkqkv8?#u9GPZvx&V0DO+kczDpoAiTWMmh zOYm4}vPWNap*lU^I`8>eYeK6$nyxk3JE|zCCWpzFps6CRdzNs&gNnF`6){$vyv-bgv8_HU|6#kP6B%5n?WT>Ib-KaKgQ#0I|L*chvwY~_>e}M>_IH z2&~@fI^fQ~otxkG;O>OBgJntEt`^f3xDYF*abDGOMW|lJ^IP%LcDfeVjE>F!DWu7rnHU~0e%XprCh-exE{tHNj_V^kG=Yr;7BgFil3dvPk8IW zul>b*Dv^Zec6zE-WUAb?!^`=6F_$k2jwk1D(Dswt##||z*q~N;1$Pd>C6ZKt|N3ke zkW{31hkgg+Z0t^gmYO9}8QQi(kM|odSU2`50&Q+iWH1Yzshq!2!<=-+`ngj(By33F z3hw1gsu^jgwlggxODjn400}kO1f(nQS={L$KlB12f~+5qa)nY6@(t-htctd?gcDp& zRkS-GJ#4lpH4Vk<3l(4w%iURP^?(f-02K z`NT$+Wa%Ib4t!JMFh%=KCLyU}VokychfFqaN~9%~{6o;O2YN1do65lSMB4{EDl~vi zTOi&2M$E)Aj{j3DkHap~6~1FQU;@FEU>YU9SK-&KpODZ)q*M@`+zR9{BV}O?Cl4Oi z4itn!f=ndyb4YklyA&Yq$UZ5CW}RS(+iJM5iMhrcbKYCgZl#zk1BjV``$d#c5hbz* z_qltby`b~}d_q>q~mUdbIaCjvN$yM#3 zx(Nqy8wty62ON3O!Ic$lpPI#9?Zi_hsI>~BZf3vrpEzz4Ydv&o?@EbqNt!|l>gooT z8HIRz6^=WuLOSwTt_T;ch8egD0m`Sy)u?S34wI$8R6)4u>=#_Ht18IhAfMvrYH!n-Eng}TzGX85td$_8DKFY?x~X5E5ML0#CVpT1 zuK3U5kK|75N0)a~a2o};Q1A*0UQR)bf-nUSQSeF%&QoxXf<+20QXo)}q(Gq{Pr+*` zc$xx@f~yp~or1Sg@IDHDg@O-L@IeYbMZqU1_yPsLPr;v1@JAGUi-NCH@B<3|mVz5@ zMDSy}IzU%@DY%1z+bK9f!95i8QP54n844bzV48vn3Lc|ii2{j&WeV0PP$_tpf@dgr zBL)AGg6AoC2L-=I!M~;8qZE9Eg3nU$A1U}E1%F7vpHuKv3cf?Zw<-7`1^ z-$=n>3T~p{ZVK+C;3Nh2Q7}kBKLukH3{x;i!3+gYQt&thSqfwdu28T}!RsjaSqdr? zyorK$Q}8YdK0v|0r{Loh{5A!jr{HrGe3^p(M!^dde2s$dQSd(~_$LbfHw7J73@`7Z z;0OgbQ*exe5Cu^RI0_!5;4}r}6r81Cfr5Do(iHF%{0&-^@^>isIyzVKUs6z^pKqez zn-u(a1SPG5|GCV>yUawp%*49PM7qqxxy(el%*43NM7Yevx6DMh z%*3|LM7GStwai4d%*3?JM6}Grv&=-Z%*3+HM6%4pvCKrV%*3$FM6k@nugpZR%*3wD zM6S%lt;|HN%*3qBM6ArjtIR~J%*3k9M5@fhsmw&F%*3e7M5xTfr_4mB%*3Y5M5fHd zrOZU7%*3S3M5N5bqs&C3%*3M1M54^Zq0B^~%*3F~M4-%yzs!oh%!<9tioDE*x6F#R%!;+liu5Wg&a12_ud-siS`uGEcJ^!HS74aFCH_eKfo_#T0Zt8@olF{^Zfu9#Koqbp{W&d?RJO4D@3tkPq2#jKJ63KDtkQp>D`u6xLRZWxeUq-3Rr))+VpeGz85L%g_R|%!N-w1=W|fZ96|+jc zbj7UF5M42=G(}g;Dm_Y9%qo#Lc-<;}m#&yqqM;sUl~^aXr0sXM##m*%A6;(Nbfp%c zeuvuKW<0$e;=H5BL$emGw`?+>u^MMd0_t=Ju|6g$kXvX>6K(nt46DN=v!*6Os3 zC)>16^a|K<6x99Miyc-Ow4BgJLML?hFdb8Y`)@{5LoJ z#u53oh}v)nXQ$Djy+PZd56kR`PmN7e&ypRvV~q&NuVyL9ufZR4Uy!lg#_1#4;w5|z zwV*-`=aAm44IO2N5n$f?C@oPzuN_ltM!yErTo$-r@(=Fqt%8%^hBqu|BF4k0%TPIg z7md=i2=H`$fX9>qq^QVKpQ$m}-|`Rk!$E<4SsP#?@qI7onw`)pi-JNElFKQ|z1OXjDZhQ7QF zj6)4E9>ZXtl*M?2LQQr-X^i=0{xRPX6y~FCVD?f}c5rf-$`yyfDiTgg(buA@jUk`% z54kTW$j91%{9xl^hUXDUMVQN_q2ic zT;uZ9)!0DnQ=5O@KlEpVf_`rs&>w0HT`y{V<9_3^{@4BiKOYp}<81(LX1*||OU?Z> z8)9h;`D6Yee>5n_C)$AA#C*{t3h>hOXJfoy@{jk6LE*ix4ZLHGWm;c?Ly}F6N&W1O z#=!r^Kk)Aa1-z>b;IC{9oI$2(?Z#;L9Pr)v+KH%vG`{X{1MOg4wEDtI%mAa;-Wcmq z|5)!13hT)>u-31koLJG|lpxdoI))GUhdvk-bgm8P{dJ2Olc%XXcBnMz4qoyPbS@~M z;WmJtX%6&Q-fy?R;2(50DA18MK-X1ba-E$+O^m|J@9_`z-9dqkZ4ua>aI7)d-}Mjn<3WM#-Wsr6Z!@re>>uoxg96*LWni0#@&EJ> z_Ip8r?cFl4eT~I<-%Y+-R2_&KNQa8GR^+$Kh<=pXJ=LBSnt1MVpwrQ1Yn z-{2qWF9ZekbQ@58w4u0xW?K8J{=vRCD6p?=1FRpd1=wbAKkXmxCxe2^{1OH@-)S1D zfoARFKlKmxD?x#Mu#K|yC&)dG>)OBf5BBeZ0{hUGf$eP!_TWL^t*HHo8b~YZ;Wohf z)7qxpfiC}Wj|T7Sv{J&>Zd&ZoWD@WR z|4<(d3hJ3Qpn8nV5ITVY+K#{;`&V!aCdr)~?zH6dn297~FII!TqbCz>Ty4 z&chzjJ_zRjGDVw3LfB8BHXSPeb^mbxT~KgG+kpFUZCM)lgixlGTj5RM*f-O-fPc?F z;?D$yc&rV?9xH8xTu*F}>y34DO-9)M!av483ku`eHZY#7E!A|E!w!%b0(?0@EWkF2=BbsP_j2 zb-WFz9xM7Vwazzb5uEdnZZs%#=i5NnTPvj01mM`J+vd|WN&hetLBX7817@TF%*JB+ zw10$~K_Q%M1EGht!Lp{t*xu?N+na;JHq{0;kJ6J?@@rud(#8ls=pW(xgF-mn211X< zDj{qP?)UwJ`%giEn`r}Fv{w0yRl~5OjUj&BKg7Qb3gU$}AbPFRp|N;l`K&n@KhPNM zkNu2n)H+Y&_A|62nyTfHn4fM zVQB3wmoDTBjf?Nw{vm!ND2R`?0nuykC4;CmDZ?9Y_Fc38pP&Ff)&@Y2om~=_4%1oe z96N*^0~l~tg}sPeGS#F|@AQxPC5ReGYv%DbFmtu78Mx{h=!>0dEVTXp@%03S?};Gs zHCY=m;~(E-Q1}wT;6rP)C)VEtpX?vsN>KQoYy+Ri0_iH9go9{KH$ynzv$4?rtbfoy z6BKAZ7|>~jUoLW+B~>tO5hfjrLYl)y#KxfCx?MLe9*NqEDelgj~ei*<)Byi??`)g6xa%OwvG_JTFzR#0W! z2J&ymzdP~oF8q55sM@e-HESBxl^)hLb{hAzjeCs=<33}TvHRo(6tJfqQ-HH(q1n|$ zF?7qgbjw=frN&yIzTcHAAbS}hD;j$7vT7Es`fC)krj>PI%;oa#W&3({n+V ztaCXERIem9!WqAr9~?k^|Kd{dzE!S&Ec5pzFduz**C@QUYiP!+ zeWneM>20x0FUK;yjnqUB(}#&^yJ434i921Nin2N_L_1)0Pb{kmcc&t8vtKod!D(N1 zZwWEzKS&Vv^FCp3@Cds;mawe;b_KYR% z)(~mIqXcWe?z8r8kF^_PS$lshYd6NS_G)5nS!>qKdRfJoXG5u~W(xy|-l$@1gMz)- zZnaFMTs0MpakYl2K>fD#I))*|tShf->vl_1#2BYNhrvl#Y^!c5B@G#nv!pj|x~rxu zb*qklG+>xZrc2rm=jE&S1b-0wP~0Hq+|Y|WeoVS0mb_*hc{;|XfV|miRcRTzqF>Q! zjjC=lc^XFb5|P(3Ogo^C#&rdzic-_HdP`|p$^tW{3dZy?Z_wJ|oXNJ}u20m*(h&ud zE>_BJm5AExY-nlCvL4un7{}+qS>f#b+)?%Tu{p9(S`GV9K5sSjx>?HA^;X_)=&+33 z6Dnk_t`}SCq7Es7)L3mS3uxl`b!9_fssY#p{{5w$pZE$o+1`vaRMq5URdKNM0>~j!rgM{F z9pv03_)wb-^lbNG5;y+!oy~?{nV?aPFFPl$f}l{v1X({LlNDm89Af9V-`Is?by&PB zS#h*4!qJO;jwJcQQ~{5anDTS&4009xT%KHI$Jf5D;OnkLz6|2))CqNVHlSvCc{!(* z(TU2|QqDv_GGPqnF{jYl)mDDdg!aipF3=zT<)mV)B}nJX_+E&lYUY6?vGP3 zTYRO|)FlqQ(>c03)PW8NCWd~l0Qr(ckc-@70+2h8RyDI`pVOL{d&1ft9yBA4787az z+a(56OqlUROs?H0N{o2fn30{m*#cQPHY`K&l@xT{ok&+HO4kLwX=+vTIUZB&QP~QY z5+UowGFfmBNY9hF@^ZOc_2deunj4L(NDT#3I}@3DCd$-fPhLE)vza$CO;QmNj&7AX zsw}sf-jgJPyeuw3;Vc0=v!k&iS4>cIPkL%*p)NgcMwK9`hs;QAH zCaAeLk(ydmYFu^Xk+aHL>26twTy^7d6{noM+_G|t$sO>Qv5tCaB8SgLIdq%AZonTn z!XW0VO1X@PfW1hj&6OVaS(1c#d0et0c>;Lz6DzC?a{b$ENB0{eG`}t@<fWlK(MPan&f>AY*QF`Z6IP1>z=1jY2E$Pi6JR&7=OVEn^7S(s0UGIsM zpHY%0?^;g27BF!rEffCjK^+9{Tq17Sq?{8VcAg!@bJqL(o#&d?k_n%p5XguK-4P{4 zwPL+!UcP{!omPT3?d0fW^;TA}mrrExOdvJNQP+uzzoR%q;yfWj4GH(G=lT$SSMM@8 zyUBZtzY)*KOj_3Kc>zIV3w%xyfwUK|urAnNlbFvO{HL&JGnS*x5TAJLFl< zhMj&cdLcX0{n=qRf9C8^#RNN3L$i}n&zerrv!?s^EU>c*J&Otz>`V{M&P-OaGc&Mf zO{+8gdKTEB>ly1EDpasDGc-H-D##5lF4<_>TbgVpO zq=}+>=!PCSlC_Y3)#oOxgHn5*`^itBfes~d5^FW9`?JzOC@9judiC@E0UC(Pko#69 zRx=eUde#Gp?8Ivz+?ydkJq-E%#_w5RD8!MU!8#k9PQlLf0Cwnl=Il)S>^zjnPLc-7Y;L+g*E>7)^^2r|!t+x|+; zeK?V)Bn_0&ENnj}J7M3c--jfQ`p?3s44I#dG*B=Ln@wcrIkJ2%oSUCh9>1iVXv6zS z+e@VPrnF#-)@q9tWXla&e~A^mt$e#twX~9*-#f8)GC#3DPYcadUIUI5VYJG(xu_M3 zSUOzi{UEdo*i_9@19@VWk=?*|wy&sVzZO#0>ndQi3!?yngmq*4v@V_7L`y*qJifU>+@!+Pt~fIv7CF!DryT=tZT;#d5CtnjpcIF zExM%UDv)$*1@}Ee!Sj?C%zA;Ehx*LU2G-&~IK4jt`WC8^>Q@PhhpQyfz&Uy=jT`|n zmy?KD4FH1cV~Je9g}C;R=t{L+FKYq-)~)_1>Ap?WO66J!;!!J!aX(W})qnJ)A5SEm zmqHvnGc|coou1sQN^Wk_Tzbnkb5^sA6~t8&uN?Dq0?VHB$Ui+XQJ_Bu5Av@`j0*XQ zy*c`SvaoL=kDYgPna(dwAeoqq8wIxLb^qBCnUT|h%ob#sU5)AqIX#g`*<&Q9bEnm# z^T)zMS=OF=4!hj6_Tr*h#6nMWiaWHR}Bi(vK zsitDfkHkZ8CZOPmOu-1x6bK(pM0ko29-WO0V~LL{w*hZrCXfFo_vI&n(zfykr+_ct zyLx%7)Z2B=F5xgzRlo~hwYCy#h4INt-!NOySEbs#IWAk&f7XsjV zyQx<7D>?kN8XErOt9n_h`c~kvGx>{`F6JM?{+S2y537}z?wy)F`&jN&AqOePtCE@h zPyxA#iTzXb_t=>e5iwtn#bKJfbk08!V1I=WgVm^xAm(HuG0W5g$dXfeo6^y<=OcZ6 zmB#xBQ`^}_X8&R2?RxK(fV-mLj#T(+Ra9_zDv?9l85eLE2-s@YDr^(G8&rutsn>;0 z{)kAU4cWZimv)SWHbFf^q@9~RAJEmZEJRB%_0}Sf#28CTO>MEI(izpFwQwp{II9!W zaceZz;*x~j`x&6#Cq!k)r-;@+lL&;@o|q@F4T*YC0LQg;dpG%+*s+B5HM9fJ-|$Df za3-eWaBX(8M_QIn=Dg+(Fb-VzH|Wszc{!Pfv$f$0T-^x%;dxw6q1YO1lli%Ijud?fZVE8FjzJ zOOQdX4l)E3rFJY0s+u6^d?G;yh@fMW`#fhYw)2vnN2HP*JVW`WUd&%q&mTLg9?Kz* z3PWLHa#EegEFl7WosR1gO7S}Y1%1$J3{k$Q`-Q~1AEdg^UpRYU-vkzJO-x7*X9i(g zta|Mh;%jKlQhs{k!2VcuyVbNUzYqyT^n3v3KB0gIJxHLqn23U+qZDAso>k|p;=!p2 z>7@b}UeqjZi$;5)>aB6N^T^8Kdu$l&6H|r86nP#mEJ^=2?^qSkrZFfI?C70cGu3c?hq%ld+GXUx9p{swefcr!uTpm`jV=d4+sh{fF3O-(Udq!C209#9HSnp>5 z)qfd%bq^IVpG<`5wW?%vr+#9%Rk07hxzeER@x84oPqYCwyl?kvTUC0nfO{zs?nzgO zPma*4VYrv|=r96cm%~j;KZ7Rqw{49`Fg;NKe0d^3)=iH+DNQp+e4K3}uvV*$rNljw zE6*r_ntlc_9~FA`s-G*sK9va8U3N|TM%1};*0~WH)$OXK2G*NTPDGH71sA1u4WA8g z`#yx!xP#*9*#hk=645?MvU`@%o*%M(D+m)~dvh2BPve+zL70kg18;Kc)s$OVJ{Le9 zs^|8vfx0VVndP(%I4P1U{O~gvCipL1a(7 zN2HU5?vZ$)d~z>~<_pL<9wH}=ItZ2J*Hdt&C342TUDs8#(zbQsD}u&t=_M70URuuL z?^Y-F#R}-TeWcyGAFg4a28))p=g?O9m z;k>|GzTlE``$a_Znr|U&h*npypISNY2P*O=4mrH(wt zEtSjk2hlK%`y4HAAc$JN*~YG_W`5afUPiDi@|l^s${qvEbnLiOd>*gvs#?KaD#}sX z5JR+zNSU6WM&pp92x+wrPRY&AW(u89ZfXrfV&Kx#*IskYtTJboO|YQMdmbK%2L%Dm zKn|9HG&SsiZ5PR2!%rJeQI-v}Xec$UzM|m8qE;8tSN15&n0zTEbCIKGwGa}mh8St~ zo-tGcd$P?2;##`#((no%(Pr>&xZJL46vs%xgK9c)p;Y=Rk2%plm!dV(MmOhS#|g4F6lVAGKRRS4JwfC#3Xo$JXe?t14>Cj05d+1^(_bh z3E*@IHz^e84v(y1i<&~($P1jrH?{Eax>dExm^WAH30ld*R0PEfPl8R=;*~S-d^J5k zP|h9dcKnp+RVUi-i?2`77hgx6@V?65qdy$f*6)@G&G0HsmAqo&5h+VI{m9|a7h?~r&VlCIv z`P@D&ytaGL$Evz!>!mS>x>iTW!IMIT`rY3zRfw@41aTV&4|DOReNw_cFD z2^K|_P-{=l5k3@gMOi_T9xv;@aQ&py;7ixLhL*1D`bgIYLoH6CRMav0E}Cc)QUUH5 ziXS9_D=cr&bhKcPG!Zo>uPqIP%pC|xjNIWCBj%zqPisX@$gFn{R?zgzdU8=xZdxR_=ZW!uv#I}jhvlNS# zBJV5it35wLfW$CXak#zq3We}RL|>R)iwK=fT@@BEg^1jvKwp^p5=N3S4LPcE(eBVk z55*8xY8SoXMk!ksozhTH5#u5Cb`zS+wU4ZNPC1SDm3tA(U|F**VYfr24QWN_R+7 zsep^a!a99Ur`IF}vbQ~BnjUlHSyv2q89Oem`6=z7-47{T`49^=%_;owxYC@$*&;QN zXZ|{yM4Ne~AkgQ4;VbkmoO|3MR~-=^bRxH`@z@;O$Q zbT3Zt4rfP?Z1e!Q#@UJ&;WWD_Tmcdp!^sQ<$>jjSlg&DR{vnuvR{n$#P}Jic&OK>_ zHh}PX+!>v4?sC>K4ri_1D&YedNU^+iv8&4;cp&2b%q8x#_|up34Y(Uq&8~B2--%|I z1;L%;bt_*(sm?~+NkP@{?E|WTvjwSs1#9PE>~=eRnL>5rkYvbL9 z?!M)Iv)BHZ;_h&+%?13pGOGLGq{S{Nc|snZ1W-|zsc`;MMWup6F$wT|2o*~@=iHX4 zYK74E$>9$WTi5rtW3;(E$H8V~bsYy{-g0}?pnRBy{HU^X)iqRM?>t^iq@j#4K{4$^ zqUu*)kdN@iDG-KR0x`HN0xbJ3wk%Yw;^o4t+Ez>U-&~qqd(AbfGCn@H0_9*9$H!eO zmwf|pOTg~Xm6Cf+t5#PK?_SK?N=gZSd3VC3ESmT@i#+2Ze}ET4GKY_h5UJ8YDw!$> z1CRL2@D{**RL3hGShp^fcDnj^rl!^FaaTRcEZqo0EBzhJ&+;vJZdryQfjHMoT_ zpiJo&&st}jNjBE0`A|2h9KRG_`}rn+1H*Z7WdI(0bp$gUGalmiELTW zc_r?LZaKsiy&%%7D=?GVP1LbTmeL-+Y0-B^0&$Jwd_yqz&@&;;Y-Ew;4ki{bMZ~ur zl)AQLmbvYar>VnH)iP@&TZlDlwaW$nkq|7!QXK3Fp7dntP!Yx$6y>!-~)oD%)rns zY$B7orL#rqlVVWc=#7(smGn@GvH3wVJ8r2Q#2>PN!-<-Q3< zZD%hGV+`X<6_puo@#Ig%ku^T$3daOztxV&Ou$i4-_@NE%t)YhYUgh`WUDaKcBQmX9 zWm-kg-XzSZplj>6DLO%nPAt5xt#RvN0`=BawZVpLCSQ7~dc#RCBK}vNW>6zb@0Z5M zSKs{mVHke{O}~&G;C%5X05|uVNVmE!f?M>gEs_)jo$IaXJJ*{<=lbNT%piWmA{0=y-T z0SCTWsz)8lg&NjkRmHa*{qL4ePE6eEO~FI}=cud7|CZ=F$}GMnN*_tZ|6B)mjY$8e zdLJFE{4Vf`?+*H27N4dwQIFE^jnA^HURfajyytMhS6wjMgg&Q*68J}&U7l73?{esl z=*tScLfC`11~ijzH{7Z2*>hAJoC=1vM4!lW-zs@ib4+mQ0q2p&d&@Y+FP+3?zLTfL zSet_Ru~x>nV&Mlsb*YMUV-BBBb-y&c2|IWV%{FbxSgw4G+T3-+e&p{2+@M?jCu;7P z&-KcF(BCKcw^TlgKmFXnWbcI?b%=59i%?s#FP+=)`dHrl7q~K{Wn*3@T3f+Er9+uK zw?948B&TfPoAqV&B)LBax@qq^8d|#HNpK*oLeUS*=i4KHk%CgsW&0Ikme+a-m+fS< zgMHy5WE&Jn%S(FdNQW3Z7PIX-A$#r&+?QIoIt6S18tnz{7O8P76tBi3rwfVVMkZ^P@qJYy|b_21y8vrrd1NALOwwGU6NbNWXq#hF%nmz??*cP zrGE+kiTK!SO|LEBW4g-e$1hwID|o1H2kI%J8WwcCUv~#we}xX*yfmcITL@l*voglT zUDovm6avOrwS}F2JRZ_IvJyHv9Q8B?x^A4rhe1ySi-cr#GbX=;5X*alwLyN(ypg-6 zT`_Czno@5Q+NkFpqk6S!Et6u?Tg&*!JL-5!*A@kwu%g>FK91rFtdOdDz1%X!$9MZ# z~su>891lINm1jStCV&DHog`{xVvU3t5}nVL3=^%d8p2Y%XSVUujQ zHVeAqVeX1ykH(ELO)9$hb&9PLrI?&%BP!S|}gXRoObCl9W8_2hncF4T1oALFl$TZLn1 zCUeu$`Wi9U{V}q`dMTRPf#C<*sIQ)Y0~Cb0SjE%y7Z=_JmU4yP|%yd#`MMZ<{|1E)0@9dWV>#rv{RSw#5Cn_-TE(4!ieL@wHt@; z)?1`;B&Ihbm~n;p?di=f=|P{2IzfBqSX7h{->A%fnnZ-RZ1Hw2niz#QiDCS1z)FD* z!g`@4I5TO54OYK+Q>$RD5f;xCu_g&?a>h#fBI3OI{ugQ5BvypcHaK2dUk_Q!yrgK) z7}n(Y+k4z^6Jm(dl)AnwmKD*^hkxw`W^3eM(Xg&s*RNpN4gJFQGCU^+M3d3p}PFHG#i>GB5EV)gk zMhlIPO49fU7q8dgV|E*%*KOVqNQIw`s3Y6<^}vr)m3-C@4$V4(cP6s_eqvo>Go)-I zJvVHd5O>^MUjMov7NL?;jXYcI!w#38wx7C5ZdkOe7B&Ox z(#4b4I@@T54S#Ln3Jot^oY{^whGqlrj%u{v+eVSMyJxWIn$Hwyp>?5H#TIDP8c+0Y z@K0=o&1E&Qz?gPRcTcWy#tg0M|6K3vfTaVv&`I02$h6*BU(y%aWt6v_HjJRhA_tZ> z*KlStMTXM}6!wv9H|vdd3+@ZVJV7oXY$K-Xfv$5$_(Fj{CSJe})KXP%f@Z2_vDJ01 z!=|+O67Gy#i4;-kpwBql-Ew1|AHEQ|*}0zTZ-XQQ^i+YT>ujrHdu$sY3jo_C{9c2= ziq4I+54c%Ej0f7YgvVg3065s-4lcw7)*ZlHTr{tAjSbFrxWX-jf)J;iHTbfEv#r#w zH4vAd10c}t+xY~xE$B^b0;Dt7@fk2%x2fraQw>{hm#o5-8i~{O?vhM=-XOS>C8XFY zESdP`0E_2!1#d3_fY2*P+_+Kn2kt7)R^TD)mRIfL@-{DLVG#lO?e5cE=N3A`bFlTD zR`#QT*`1FT-_q2U{hyG~9n`NNIP_8gouFp6x~H$d&)MG48wJ{agx-iz6%WC#uLi{3 z)(g}(9RHgVIBn+|E7*uy=Wse*=Vr>u6+q4cR=%T!pv9a`IIrG2F%3$$BY07ycsdgl z??){{U+oji5Sys5IR%}l)H1p!H#v7gENcb7clrSEISCSy7o6+u6%1lm3WixWs`v*H zUPqsj=sH_%yvb;}+huGJbtC`g-81M|`0|BE?VZ?%P5UD*`cwGt}rn#MQ9V;b>4c-8i(1TY{1w+?cc*xB~ zYJmJP#roACzY{l>eEj~E{^K52Zc?c5N$ zhjtwDP0pHyX4g3Gj1>*Ncv&?e&0XUuXDfEkN+*^bHypKl`EAH;(s<3GF=%y-kMy3VD5{@q6TU@J0cR6OgTau69>M!2HJjaWW{K+OY^03t@h;;F#^;Q0 z8von)f$_b{7QDBrY@*~vl-x|oy_DQd$zDqGlsrVqVMGEd3NDS3jDMM{d4*pxIV zd7hHjQt}Tdc?%`KNXaiyLhm>$|ALa=q~zBr`E5%6Jtcoc$sbVi-zoVtC10iF%anYZ zlK)G|nl(uNA01ssM_VbmgOb}Q*-gnyDcMKK6eUL~d6<%Ol$@sIX-b}=q(VuVl4VL- zl)RCW*HiLyl>9?V-c89rrsTbp{0b!>q~u>y@)1h@BPE}p+(XGrD4C=rN68UN9-!nTC67{aiIT@D(J5Kr1mk99NALzPcb@)TWo5=q2|g^uyfj`4#Ii+6`byTfALVUg~zICof-J1oW> z7U2$yZ-+&?o4&)%-r*+iaC3LK zsXN@v9d64>$`$LWZ*(x>Q%wbB>qh_%u;=!mt__vwhW(inAf)=Ib15o@J;=!mt_ zBptC4Ekz4EK{+r8W{Mk+dgtE`Q{zqD^DucaqlfYA*)i?|{RxA7n)aq`w^!f=t%=kA zbXG*>3vEAeH=Dv~*_Z`o7qDIewOCv^q^y3RJl_NIU8t~Be&<^%e?_BHpT)J#dT*|K zt+URJhOln_%<;1{=?wb|D&OLgD&NK*v4P6vBA%W@k76)vl1;6+7O!%*un>1P8{oR7 z(QM;xS~!ZyJ-k%j^rs}P7rAj$YM|F6>rg-|+i`~v(?Dbjnpt#D{tS6oh6MX?AFzQJ z2QxuTL00-hR?|Zs&kFKgBS5~t7cxG}sSRk*6Y0^-Wra=|0o`OTIxHE)dhr}Q9D4s2 z)Y4;oCM%3D83E&LUyM89CNpakTYwB(z1bi0tJ7n?k`?B=N5CA{QG<5HhfNUouqtAN z_J{nA^pM|{737^GKz^`)Gb1vu7e~bIkM{%V@xCuBy!T{}7iI_Cn6HA{y44@=$J68e zXjXXd9Rcs7{oB{=#vbC7z4?pjp?^Lr=r0`s`jP(7-KKWedG>GX@23a+H(3F`Zv?=D z)E5?+kWpM>M?`U;SNwz|0O-#KgtU3!4cpd zNYT0jdhOTJL;Y%2P!Ej&HH8hO?jO`^*KbK}L#;v9Ow5W0MgW_p*8=PyxOb(8dq-Aq z503yhUE2=mvj@|I-Io>E2UiX3RR6K|LVB?0vI2W#)xb{o2U|-IwvrXtheiOKuGbEn z4!k)%+&5+g_u&!Xrt7r>EaZQl9_+ib0y{eb*qD))LIEo6D@wVI*j%*!VZckkf0rKW z2eX3u$OuqlJTrt&XP_D(CglCQ?0-v-^%GfPJvsu`@m>Q;D-Qzqf6{~ddRE}(MgSM1 zk7x%0mJ2OmmjI$B;qwHxJ@6&S=B=rXrVYrNiP3ay1h^0Nwxx#;pKxr~%bEa=9Vh*z zcV~LUN>+%EkAOI4rHx*nnmnjZPwrI*c-S6HkMU4e7*C9VaZhinmTL3~-TqDZWO{fP zvx4{N2=I3I!YgV6lSH57 zjaku$SL@mUi{O{iqkB(Q=uVD+Zn{@U`9s#cD0T2_n*Wd<=7+O_d1?fh`93iFi|J?5 zBm7iW2v3iIFh<*8SyO*(f0-WJH?qQZW&~_8t!I|4r5p)qe}vn%r8aQJkTnwn=j;dw zV~kZo*dN?|>A~HT6}WRFfSc&;eBP>I=+XWVXVXJGk`=_4jQ}xjl@9shNrOtx`2GFS zz9K!^OIe{kKLXkqY1Jq94RH0e(}Qbf1@6KK;P&=Pt7%&Y_DxKxdnYCafc)9?Af2p0 zUd#w&QA4m{t9Wo~Vt|M8U!@26%UOYZd<2j&Ltg>Asn?LSSA z?Xy{7don9*115#vNssMYSz)`B6}HR$hlL&6QyVecku?(|=H*#o8!%70KRvcxSz&u> z1Z;6O46VIY@$J|~|K>ZE9^xZeL43ss5Oci)pT!WH1KO~V9^fmp0{F@i0LJX>GSyPf z)DdpTMT!-B__%OuMO`QkXw;STn3uA`{PYNz)!s%$kemH8lLz_>?c3Ai`$t*fdnQYK z1J*{oKRv!*%?e*38+@=vrzZCe!1sIU@%?UA_?{gBU(5pONT0-49aL8hAvS$~q5bpp zp#Ll@&{{U2OHD*BRae@!E_4xII=1wZij9cPnX2BN z?xw1G9ugQ~z_d`A1i48}0>tqFLjst?!^YSgC+0*B987FuY=g}SJ|fs8b}+_3tPq@h z|6i|L)m7cqJvHd$Bs$tV)m69d{lD-3?_dADb?>cb*1TK!);0W}wZ*8bT6HlimrB)I zNika1`ckdfm{Y1|>la%4-rRa)Yp*q+%L_)Wp%;~wbq#V9RjpFem1^q>E^em$rdBbs zP66wRwYk9k>Kf}d=bSe9w z#jCn9!+8c4=PE~xx=c{l*LB5E^m(P#u-2LKEZxyk2i2YGDr=zN(S%=XU3PZitdS$I zwW{-{P*P^Js%C1ns*%+Vvt_NWXjP?kYE5Grpl>u9(}t;;ps-dI@_Oupz1y?d%p0cl zH)NoPBS$i-Iae7R%w#fmPwTm(gD!oma80IaDuf-3c9kbf)w z-Hv~+#J^X8ssj`;3TfL*9-l^u*J?dU{->J1IV1FZ`0PDJGy(PQF&@Ds4 zEvwYK)Kx(JYTK@W?6rifs4B&)l2)u$-;mMf^kPLR%<76# zE$|IrB#g!)*d7T9>(v~ZrZ(5U*7 zch!TglnNEaG!6#)_0731w0wWpTGB;%t!bW_?DIc4L4vzbcot zPk5}o-(hV>Bx@gwWNk+zYflqv3$k9-s5s`y6_ z3~gSsN!w;Ux^gvm53$ciJ;bc-?Z~5_NjoFS)1$~!@NDwQo2XPWrmAF=MR~4XQ4A(e z##6mSnqTc|?678Bqx7BCYI3 zfv5p%ttsoXiXR{1IX(r>3g@PdO-d(@AEOAxtQ$vixmsPRYNc#dF>^*;L1bi~kYH<7 zrD#es3akiLQ>#kDg?!eIH7FQ#AF|f^npP@OJ_zOnDS>ldz=8mdpRcc3PTllq{Zqs@ zx4U?$MOuR>TS2T@gcPT)Mf~zL@4+UExOZPTUzk%&8P98ZSsd)X2y%#&(d=;02U*v< zd`Nm7E!(b4;KsYYTd#Y<_)1m3ZJk^OK>@*BvR)yQ6<}vJz|ILz*@fd(M7&FBada@m z(JdZFf_(eV^`_%b+F~~^~zYjRO0LONoiujr)FVcAuG?K5zW@- zvl`lwhF~y{5uGy@NKrT6%SaNI^1BWtoEIV1#6`!JRUZ#lLyN6Cgf3INW0`s)%+!OAT)LoenAbN=LJ=X3ZWK8xFPOSh zlR%J@#U?12#b;-tKXydHTx#w}PR#_|rNd3X79#0c2w!A)l5BApxqwsq@kfB%}9}DwH3?A3@THleUS3rod8$`w!Kh+}8 zP&VOD2!v@o1KklYRXgM41a-e@KY3K@zwj4BzozS%H>Cg}UsF_RP*$TDCLRwPlS; zW1U(S*rDqw`yDFOWoN8sb`GY+PWZ)+=XE`=JSrXR!VXRgw5OCj zQP>Y{Z?hxO3wc*PZh}52@yK&0`|&-{kyuV5qh@J5Ef0i(LhY;FKaY3uKvagu@{iQS8w5lw%+g%(b1PJ+m{K z7CWN}*ct7@4qZ>3ol%dSdt=#&^FXQfO~2p%ZdKlO45?TgA0SxU(RiG9@j zVtI=5Kq>XY#?jdcj-7gKNZ_b*FO13%`ANwG`Mt1-SazPG$minusbiUkE@w_QF#1W$ zON95PG+~S8YP&PY7V0$r5;J(sT%%s8$t5FqAb(&ummkm3L^Fx!fMZ4&&GOY}fvbMQn|8zM6_nTYSog=WNi(Ml zr$L~?T*^c$k?T9G6%;RMg*!-(3X>^IV3pVv__QxGn=;YrTz+{7os1=P7ZEx!8)i_P z(im!etLd5m)cx%vyGb;aKuNBGkHyOKc9N%3tIlFN_k67=PggLn9W&%%+Cd$Qkm9s<3SM3Ov_;CNUhfd@&~f? z|8U`8K8KZebeYc2=aJ-xqn-jAl&V*^KxXK)Z?gr_W>-Qy*G^ByQuZL(>9I4?)a0Ch~_5EiJ-=TA?an3|k;Z0g+Esa_O%AfJO0herYa zWIjJU5~0xTr3!pA7X4_j2woPY3CfMW>Qm8!q9bK-S$Hs(1)e~DeCpW5MIX4*(4~s9 zn8n{(UB;hWMVXZ=UKDuzZ0^$KOSyZoe&!zh!))dGJ4YtYJ(xXR$im9;s$^^&E+CuF zkB`vb<7ZEX%zOzUiaXyE>fvu!e!I;=ypi1-!tuAo#Wg?9h zWb<-gS}_(_1a&Wwc7Ec5PnTJ%VYdWLF=zNmjAuznmuF0g&PX+y3nyWQvy>l=nxnA_ zmjvw2PapL`*Hn6}#nt}VSRg$2L_3LPNYsLSICiYtzQ|9*iY3gip%sAMfO5 zcZ}|gpi%VxF>rvDbP~4JXy`H)Mbdm4Y3f*{RtFvZ>6=f{qU#bOvj&oR|DOb}GqYWGJUA#oQ(7!tqJzcoumi1Pb}# zVQC7zgb?i23a$$%-QPYa_ye=vL;0@k7h`2VOtMd1Ja_0|9uv3nd11hrK^Qf5y@rYX zHDtY%8_gdYk94;iHKXPgB7g{=_rdIO9dNgbTojjLQPA!v1q8C^q+_+>;gP)XQh^IE z$~D$Sy)j*J=C~U@HHlPOA?JifVLd7oJ%dv1z*+zV-53L5_ zURA=65dgayR4M)RRq8F<>XTrq(FOQuEI{^64?ZGvGyAO0(6F(V*}zodHp>-zlt4{C zeV7lpes~q_VHM>kC5%2W3(4~)NdKv#28K=2Aikxo^k#*6+s2Bx8>4BEsN)T$UU{(&LX(z zUl)sBD4Wlk*Fcsnr%T$ESkgv_v6QliZ%IO4+39R5+hP%BvHp7!T52&a5lce(ApOX;rAPb3jqm?+k<*zim+M?!J> zmvE|Aq5Vl+g;=3!2Qi9lM}`lEghr%lk0%&4iLRp4-Kd)S68>Ui$0&R~*!ddz zflj=*E#iW^A6WT~tFO5xYD+Me2#{NT8hO;6#9iMUFXglEZGJ8J@e4TOL$FfVm~+DQXS+Zno4JG??%ZD)15a>wdpo?#M+wXm_Og@BOhu6mY;A}99$81Q zL#>n<8oH!6aA{Hnn?pmOwL%DJ7d*;+oQD!K3#wLB{i|5oIPEJhHSNkFWOs(v}aXKp`ObUM~W+iR!VD`B$?#C7E#Lk@e0U>m-p zf;iZ>iJ#z-FyJ2V;HhDqNww=2p}IT3rK`H_?UniP?_$z}ioD)aq|kkI zmAKVWqIbzJOG>Uls+JYF$5mjL?yX;oEpaaj+YT-4;tKm#*oi=k^RWB9^JKm12u+=V zV6LV@jqDurnT~EA=CV5DcN!N}%eu+Bx=9Gm>lWF9_o5+LLJhc>l0prViq z@{wfi4uW6-yGY+i)g%`0Y}t$18ubIo`s#<5ZPJtRr9&zO8#sDeFVcWe2S#} zYYFah8dVer(gc}5{Ua<lkQ3!dEGi*;j+vR%o#we>v-M08Z`i72YtmZ=w2-vm`}X0&~)I`8Qrw%v;g ziEQmBAp(auK^1RnE81mplT&24ZJ$oSprhm|hTXYsQ=YJrHwP`-l_G zQKhy7y{PnNsPs5v>szHq?O-Q79+z~yjVTF)PvxJ1Kru1wGd9P8j^d7p_bD#XTS8*_ zE&S~XxOS9Jm3C|4j$nZn-kb8@lRzLx`JO-n-ms+)%$B4VBe(@d@CL@%w-MYQHiFpZ z9a6}UkANc|@l8w16pW z6C`t<*#ry@CEh~6nm{baAUv_648oSD7lXJJ2Jsn2+P6X6y__-l2%qo+h{L83RQU~& z)wnv});2uvEB&Pe>^e&S5mV9G`BR?dIsXmox`!N&x;=rS)NM=Bi@I-vy1&mD`&Rc! zyZwuNyA3cL3`e}1@q9p3XWAJnS#Hs66A^uFiD?g7)y|+*xky~I+TJdUZ&zap)ack1 zRo%^*IN}AI$&LsLUD-OB{K*8OITq%L7G+_!OubkbK2})X$7p-7u=onBwe~AD^zbF_ z;eRR6ZKwAI|FP%JKHX)%N{_Et=(RA)+I`2z_3%O9lVSCFV{%O9fS z4WYB6AyE5D<%5Ur-l!uE-EFSIz*onrwOb))vSnBS@?t>&rizK8#+yFa%VG1 z85xsvuz1P-kQquVDLfTP%GjSUC}<_;ciGgOBTOrGj_^rw_nd4xN6KQ|Zl%F#dK-kV z5!+_&eP398mY<^T7X`wvk}Uq-wfemKk!#ic!gc4b1ef1U4F!6^H>~ZCiQ~h+<+tIa z{jucEHq3Jpy&)ugNwNH9w){YhYt6qrx^vyc%T>KM(C|K@IO6N<;_S}gKm)!==rSq3 z1+O*8L~Va!|EhV-m@*P{CjA5ZqGdO9ohDFYiBM4S}lK?Y{ZW1 zqHgfe|9a2p@!7ocC)tiVTc0!d_HoV{d`mRowaW;}zvN3UGZ9 zP+NqkFZ!Z#4o}Gc(zB5GtX%momMJ8xDniJY1R*JhC*+TN782iWEB}vW3JIf+5OV8! z&s%`q@>Q5lxkC1XS0TYbiJZzu5?EI7tq9#^KhlD= zTG#twioHXlh5!P~FK$Oi*NKBjhBu)`6wwy!Ab>)wv(EW4x)A7G{!L8upbmx@y|hjC zc4oyRp0Ov!BcP#){Pz5QJGiOVXdbv>ASlB8{sW^KL{+A0&f zxieVwi9kuNa6!B^5x$R}sq5OjTwFpmvklCXK@KCEnZO>DRIojfn$|sflg|-SnYvbV z=9FV@G_NLwcy)Z9p1xC4$!4ainVOD|0#N}9f-VGc;126NX!bL{7HclyqxLA%U*LXYo;Zdx5ee17_so zghDU-M25Y|^QBrH!jq7uGD~X=Gxpcv@lEGO2~CoM$vXCJQgr%!vxnQpQHpwDQ}&w6 z|JUvR-MaN0U8QG7hflec)dY@ihKwcJU-%BlqV*oaaww@bBgypXEcgKY!>8zlbzr#vZz%?Sg+H4mC>#f-bdv#51^@`%T$C*Ii;`%!3o`44V5IT zNBBDu5bmsxdOI;F_Ek^iA-VVfyZlDD*q{^QZAVRbU2MU~JIQf7hmY{q+xSagrkCu6 z9@PA?dI<|Qv^x9(mdCgYlza}zDWh0T&j>RX4ZEX?nIY_Tc()Kk&1fbT(fGI8n}}qv z`ah#GlS`Ss4?c1V-i_Qfs-nF+`2&bc@cSingy&_gVgspVWO#T_xGGAX*JSP<59P88 zN~I!Qt=1N*IcGZ{zgo$zi?oInj8}~zxKFH-#||^u4E5q>8anX6b;BW7S+^xxnNW)rPiry8Mycw(iYhF z&Ea7gDlFKy$EVTCu9Jdinne|EZ``WDQ*y*+W>k5eA`cUTRtg$BRtn_uwBS5iUFyA=PYA_*^;x^3eIeX1HYK**t?+Oaaywp{eIhw+A$O9; zD;`q56nm|$i0dgF#@0!7dl7Nj#FJTZ%}dOYadPk~X<-F(OA&h__JiHs6wzBdY~745 z96WWwYj35(^iqLa#2Z`XAAs1hhMEoQ#>k9VosDcHo1IOB;R@@DfyrvT14)Z(hfdUM ztkVxAi^r?cvbJHVcEiNeCJQU4E%UK7eC@+>rGf8+ zyDPAHo%C62U{=90a2XK@iWopg0UZ;0u8toY?3%DdrFs=V2c4e{y@Fqx%v!N9jjgTd zDr#H<(Gas(+h=Mu6RlAZE}pv9+C)pkF+Z=cNJGu=57uVt|J1R^*BmWDHBjWO_8FzZ zi&BjOJ-!RY3ij)R)Tq(9!8@@LU5%QKB{a&sQfZyK&KgwZiuZGkwM|*nKo>@;8-|-{ zjkTtvOgCmx-e#vyi5%zw&Ed=d?bW3as8-Y3tX1m`6Wfnr3>%~ZVFSBd9%@;)1uqo% z^UekIx=IyA2hAjA(QH{;Y7H~Ggxf<`LPeBcF#u<}*)BJt{@{hs&DK_u-vCJ}=&1lt z%i2`I3h4%R5&+vJ{Jsub-B~-Z5gvM%g_45p6w#x^>VIN+E%z{qp8>5@@TX61#!zPs zqxbG9>pI$QU{k3vSI182j@^M&KEYpLKo^+`+`?yg6*sBgKUFuBMyXaOL!qt-4-BHuxtadDhx$Ea8Lh ziv?AiRV(-h6JAZ5`?su(#vHMl!)ZUJ<2ecq)&~9#EnJL8G zR~vOyu^DcOw}Einz_T!*T9Jkqe7~@rJO#!bL;18hvS0e@2RFvm?37?ObJN&Yz%Z8} zf~qJcD!HMETvrRq9HQ-lTq+?bAqUd5wmI8Vz+NjewpV-BTBTIyTX?cj@Iu}MO&HdQ zmtPv%hgmRXeHMGWli_TGP%teMeidd@Qf3S|^u6i{b-((UI;AeCs`|Y87WHH5`_&iJ z&#GTlztFI@2kxO~1>a;{H?6nS6V_l+Rf<<79uZR?vo@XfdaSnGM84?MvEjAKCAu+}1jRwDWMDTNF4 zIKzc?benx;ull0;P4(~8@2dZ({)t{ zN}iykO3779o~C4xk|rf@qvYL`JWt6lQ}VAU`8XvXrQ~yze3p_gQu4c${0Sw0M9H@( z`3p+EN6CMuqT~TeE>rRlB?=|e zlyF4G@z&o{Z1z1$-b%@vDfw$kzJsJ;4Um1)!U4NMzt~j&uBrZGlg+!yrrl(-Zn8-? z*_@kf%1t)oCYx}R&9}*>+hntCvdK2tT$^mFO*Yden`o2Gv&p8}WV39tNjBLWn{0|r zHp3>HV3WU@?}`7EpP*@k*EdE#%XUx#D*j{0Nu zhqhO`jv6<6r7d*CUgx1|6|idV!AED}9BI*eiXLj@T>x4IQypdWnwME3Ktw z&R%H;9kEx+&=GqjiH_JS9ib!kN+;=vz0xH*Vy`6A5qqU79kEw>nvU2jHR*`G(!1%1 zz0xn!5qqVN(-C{6&(RTkr7zMEd!;|2Blb$)q9gW7-=ib;Ng@(-C_mg^t)O>2$jErz7@C=je#N((CAmz0x8bu~*_F_DavuIr2(8@X@d~iSZh_Cu>ttv!~urjA);s z$lT3mM=IhOJ0Ic~#CLPkwTc%4a@OlZC%xPQff5JYTKOiL#o*OQ9W33X9^DP$vYac| zScB*{@TPv$LE2EnzEp^<5JjQixNed*`@{KP0J^ueE+7ELa4bS;cR-m!ukBvn zify)EXt}4o&aJ!iSYSNc*>7r_B~JjrMN@A;ikYP&nHAU&%^Rorr|8Tj8mHM={&{5W zG&p0eak{$KTC44aZmXxxo;XK+&fsuC`8h7BY~hbPWM+ep=Hti%c>3uSQfKUdH?zwP z5O?c!kZa1++1Q22GCb1ebsq2@&jb2zlLP%wuRzNm#2p??buW4*H0E*Y6*OMeBiQ>o zfc3|;&=EweztkD>e@G7bchZ9V%03{!x*amUlPGsl=zmU*?$6Ugm+1rDa63BtbxoGO zCD2)e|BxKx57WZKd$?;xE3-6tM;C-O8e(h%LAWqntpGppWAuZ^4^#T28XXv)7?L`%xb=^u1 z_+4oM-qQ!*Zte@OG${%$@yJ7G$iJE#@<-Bwytfa?UECMFeE?os)!iBI7n0+BAuYW7 z`oMdlvrXGmtI4t{m@M);iO#@ZOb+~;X#pSV1Ndt?182y(Uh5Kw{IBF_UrGz@tNTEE zI2Nt*?mB^HcWy`=bnQUaRD!PkePE4$LWx)raAInNnXF@&PYzv53%b+?^nOb+&2X@MPGF|cEu&G?#)iKC34qy=_t#lRly4EC1fU~fd$R6?qQ zD+G3|TbmtC4t6*#u;YDzy*nbdz_*bljI0aahVAN)&nAa^DlNE&RuFC%C#5EbtE2_@ za363FCD3k{R{OKbp}r|Cs7LyMnjnUf#=EuJ_a+DXp0vQerVp@5S}nkKgZt~r;eIMD zxOevfH<@m`wAnvM4))7wfxTzNz>ai&*8aETVE-yDut!%6>}Y4Ot2ZT%qOL{OR04~8 z`v9A))pqR;ydpW=ThoGjUmtLjwc0Kb@}cBl$I=2j(FfRwCoO%XFVk4e%r>wBoaR4t zc?ozSIn;A$LA}2Zs1YMGgic|gG9f19ottbWIaVz#tdo6U9cmAt8<_XiS(m?*9Pazlf_uCVxc9c}(!q!C3^uB>wCd5e6X>|C2)MbS2tI09`VOkhZ_JMJKyH-nc^ljA6 zD*SG8cz>N1ya)P#x33*uQSRbg*KbZ753NDgRN|qjKCneRGfNf8pjB49SHV+oJz8fq z?n(~zm1#kJun(vaGy3pqUG5SQ+?^cV;k3}5>I2}4EtseK zfSKz6v$L7jlOvo<3*nhQ5Jq?#Ol#_l?H$Rny*({#XZyewp*?N3HlHOU?TqjP$r1kR zv=E-_17Sq4N(eiH`|af5ek(0-=lcMcZ*P3gtYP@k&Je$r9O56R1@X0gK#ZEDLu2ve zL50Ei@y=+!pB(MqriJ!GA7~@2RT)0mWvFN4mc*gW0J5eM+Fa}d+<|s$)r{JqgZW|U zKtA6EULEo@ynh3`y`?YXqDT}}(z)y{hRaB^%PObgqiX<_TqPx^dv zZ2vATY>)MUEh>hgxwjH_qN{gS-#3y&{CZjtAMXQVw*A3ZV~Bbe9sVdez`sum;OqJT z7_qWTlS)}l!EQq~Qq0(E&<3m0bg_$4w{A@w&1^!}RHB(HePEW_m5M!X#>a*abvD|e zoayd?Gn{JpB(f*NelFJAD|;f8iQK~ zcXmi0O%C(lEDxr=y_vJ@ea1(sSR1^}5qR&a4O+EWX_RQMtXbMS;TH6sjGR)<;kU5o fVOBTH*50%D&usl%OST3}v>lwYZJPZ>lkEQii{r2I literal 0 HcmV?d00001 diff --git a/en/doctrees/logout.doctree b/en/doctrees/logout.doctree new file mode 100644 index 0000000000000000000000000000000000000000..b7f0353e3aae0e2c39b941c6452b84b0a3d250d5 GIT binary patch literal 45527 zcmeHQ3y>VgS(YuGq&q!q$*~;2@Y-ivvaH$N)4e3wl6|^6$*0GiEXkJNtGV5|omuVe ztY>ELB*zX8cJP=CMM##AKy1oD0vK$_0}@xD5{jg7fe9oe1SgfGaOFiMR6->bAtb>6 z|1&+)GdnXoH<~M_sJN{EdS`mN`}_LuzaP`{_v1ak_R0rV(0|rNdQ(;!XY*pE(oids z-nQ0O)N*THY8dTzwr_e%`?2;mt5*{jb+x6HrM9&KVw7d2UeTmR`$4$55#t+5UC%oS ztSPJWzUSp0>ni7((s%m)d_Mo+=~CZokG}{0z4x`ppJ~f$9&F3K)~b`zS!Pm1MF{sa#Cbckw$f^PKW4@9 z8BLm_IK5}*>wEO3h)~xyHA$DW1*zS#))-Z{@)mie)mw6Df?ul{JJ-Qgy?|iV zhV!RXk>-?!Vkl}u&uhBTwpP`ZhSWaX)0zd)m+7rp-B1jmP;GE=UG{;!tMmEXqqEwh zIjDy{dvdZdU+?S7<#M;qYK47$jJ}m{mw&2tV)0}pD)1w^h+;Hs-?1`mFrTes!39# zL=Vi1+L^q*P(>p4EGiX4-jmxo?6T2A&+>fSe!gkjR7P^PQmg}EeI6RnI4W1$x^U-k z+gjPul(w}!IWkO4Y*dtrXlu1~!S=TNkdCY#g$kH*nC%Oz2>HIyS|H`^sD)!#3$2D% z@~-uuNtIGvG7L!*&PG9Mvf%5QR+mK~-y zgfhJt%Jc>_6CF(7icITGr4py^cz-a+>JU?HkJTNatVTSYh{RsEXdHt>uI_H}G3aK* z2z!@H*b@$67l#t|j!?ob4kc_K83;v+XRM47l29guQWo`iBF_5gX{ygq(k}Cn=4HiL z`+&>Zvkq&QgtGQRC~KF5vi2rqZBf)3N~0=3pQnRS6%+$H5UE**z6}iQ$(CU#xoTa> zK_55YRB~W`4XFX$P)=#&9&SmxA?8>gCq4q5la$ldhMKF05CLLVBu&Ss=A~RiZNNY5 zFq8$wCT){-@ABo~c49Aubz;`$PUPWz(w0#2v@r4{=$kz9#_IK)Axk;wtT^ASOFEG! zLa$yy@(fwgJ?gMu&%sb7H!q0|BWI|&Sz=6Jj7fb?r?ttN&Nkt;OVrEBh=L(qsFq#E z5!Gw0Hbku|dE-Oq$ESd^(#+JvxNu-{0!JuDQ{Pi4s7BH5|>*g4?VZfUXsL)>#&aWoR(=n9u3PN86K09kTO zxv~1aSS2@>qe$8DHPU8$T@%TdjC>tAD2$DH)GRJ8=EW+snyR{xSD@i2F#0RNBtmS} zjl!G)=B5CaNQLXFcCKV!sMo92k~;+|i7i7`HJEcqIy9?hWiCKiPrWLLBFBw;!K2|p zrZ&q{AVy9uk{sKnfCZVF$d9X<nLzzt$uS_n3>k8S*|eP_$A}Y+ z80qhf=IP4hQW**_B%|xPNV+OPx=u)%BG#2hs1woCvgJ=DK-LvJS+E|!<;QX5#Im{S zh~-f=k&dcB2^mxUkxV@lWa`kVlgA|**QKV3OCrG0Wjsfxlr-K~YRiHOv0Wd`;W}8Yrjevr^k*Cep9y>2i z!<;xaS%EknMf=mWK400Gj%|(Pr_+YFW@|A1otij#t|_H9PA7b+1UT~Ba62X}8Df4M zOMV+3jOFo^)`t5_$e7v|$yA38ABQD+ph-O=HPRX?E{Om~J{w+!oPZ$Ai6h8o!~Ib_ zc2e4KzF>@+nLUU4gMYsv-{Q%QPNH%~42N0kU#@qbpNm1Zf;A* zjaMY5ST{!!ayLiFajB~4hP^g+{e8# zFx>e_-29Mof`RCtNwad+nScK=Oda^nT z%h)SKvN!E%O>W#?HHE)v7DK{TLYNt1>#@$#2U}=$ZsY1UF4w}}z{<#QQZn$#PNgYE z!uBt-I;*3lf&9+oX4qTgb2D~VGa;dXqPWYbg6=HE4hTEB7UbUVckW|h;J(+2GFfKD zM43_yERmhT{6IGBKtf&F859O$*}*h2X9p8y?Ce|`JGio*4Lfm5^h|e#;@P2P{><6I zf-!amm&{H^Eo&%2%NmMrS-{RRv@A@Nu`{$}c80Uko#C!6Ye*Q5Ygxb!-p|;oOrTBQupPRQ zy^&WHUrMZkCnC%96qcv1Hmb0HdqFLWvvt_W4qM_uwf%L>r<-ikC017nwOcIN?-@$Y zN_k0Xl(2fR&Ga{6^ZnkT(E#WzSR}zM5*QvT5=R5Y=qxnE@Q67RMa*&lU|df|a{Wul zwSz>;)mx3K$N<2;)z_2m%UP)eDitFhO2skmM(QZ~>reWDNYZI5#N_ngz;0n^V5h(> zbED;w3|+~qS`~H>*A;l>SilRg?YRK)hl<4#{@J~oehomcP$=%qLpPoX zU6(8w#HmP#v{Pf^h;U-^=&>VH2d2iy?wgvKo?1$U?kpCd5(kC={J~;zU@)XYH&^Ol zo8c=T1vG-bgHpK44ZrJAv4n~aEem7eP$UbqfqZgmV(f$mTxw}TT{@eGziLy2KZUwf z73=OOaB{kE@}850+u(zlz3>lqD=*wII5u-Af25QLEr(Yn!=qpV^2OrlApV`4J{VB* z9@rcv@>}QJ3m*3SnHnrdaTqa&BZ*nW7Jwr;fxb%`pE(|A>&w*N2bkJOV`N%C47^?M zyyJ0KX566(U#@~O4v$1~h@ZlF9C`}2oTc)QiR~{^kv^`~`7XXrq~RCX^nGu~Ct|lD zX~)KndvqD93hogU$(W;_82XZmCe9fGUJ+E>3n#!1XQ4P0wnt+n+~Tl1KRwhVOjVYc z3#1!hdn>Ef=ST?Q#+3#gQcPtX!y{MBj_U1F_E4pK3JA#H__74jO z@Fkr9el%K|*nrgmtkkKA&|2+t>L0oX4zqJLZ(sG0Ctg+RUJO>lcSdqBOB~=ENbC#T zwXWg(XmUE(J|^~Mnf;yB2}7J!>iD&x-*{c>ntgX&X;>KLc=00e#eoPOMTr-dx)qHP zbUc!vT}aU6z=*S03*Yaeod?$>c~}`LXi~XwQaC<2E==YjjsOFN;=q6~1+#{Sxn z=TNfW9w@K}Mso@2v$CIvEcWSIPA11~}9ZwMt>AxN9`j z+^$!2)lGy05xnk!*~$!Xw~QEylaVOU9ZCrXvNOVjTHZZa&_l` zy#P_kUylw0_TpfvIf$zeI!y6GR_xZpQ>p-;^#;1}Y2=UG#ANvMHe0%1{_6~uZKzj~GD^?*jMtS$29$oc7k zbnVdjXUyQ<9SN7ZRrq4fvpR`$wZ{rBUi;1c06K zS1JDVs?_~#D<#30BLjGEBtWuFhfZz?ezp*74R-hx?2rHI|qNklVh01t${}{CZ}E8C9m`_&axf& zkR~O_hH-y75(c?C323sS>jJHQfaPfVwa8s8iEC!Q=Y?XZ1EH$|jm-B9#{q@0C6Efhz>l;ozHDD5He8@bO%02RG?0dF>gUudTynwfS-YskO5w)te zz;h^in%d<4WX`f`>Z%nh!u(~iu?Q5THV<*+Ewvi{0jHMoR_jnf2483etp(poX@x~q zI|Dwia3xHU1X>4x`HLQQiLS#7xjL1KT!exPs#WA2v`?&nCsA@9$|1OC?!px-jvv!= zN5}33_ieEHP*-#rT#r@2|5~Lb*4Ybg9p1jy!Fyx{-Hu^P!=)VfHX1H~K52SBH`U0M zMR+%wTa+d6QKq-b;pw0QGo=Ap!4eQYK6{QFpg|#aut4tUT_;ZFn)U~IcKW$Rn2qJc zoDD5E2R<6Hp1@&?aV`ftOz6>OO9O94Qcj)A!8=OH0H1Yq-33No)q>FSeG|~dI#HeU zn=(N07YARkpOJE+w$P_0}1*_L$gvI}&qk?<(x+IO44* ze`Q?y-GC2Gx`OH15s@S^=DvR>W##4NbmTghUpOJHXrr<&2}2z#9&&! zX}UG*rRKI{Z`p&jY*+SO;8`b=BBRSD)fA}sT? z;Rh^D;&6Sw2|w1^Ih7#!Gw`#|`PtIy@N0vimP>fx0^Wrjd!T6Axwf@=PE`%G2i(oW z7g!r`X4h!Vm(JpT^fp}C2o8CaCcNUJGbVIM@=E&(Odasl3B81KjuN6!4{p_(eNoN(H3*JDrbnj|UMVf6@A-j!^cWH>BN#ZBU!75`qE?yHRO0TLu_ZScCym0bvU^dF+BiE&Ml1NH6mpS^X_dfp3~v0!H=}kb*Rb|LO~qOdcwjaN?=x7)6 zfoUPefeOY1D^TO>;M@)OCuryw9hMQjAFjfS4r%w!xKuRrf@@X2q@hMtEqwH z@rswcyNnwD8UcnEu$};o2oBU}A6{!+4Qe@Ga$Bbh0QR@zAt_H=7whN1pV`@xtW@PX z{G$U-U~hZdTCc+y9Y*Ql7Bp)eh`NM++dpAPei^pc(wQq)!&DYp5Y(XE+<;}G5Ks7M zH6aT;Vun_695e7VD3DslZ&W`l(<66kAv&bDe#TPvl;LL2P5wbr&K(1bx7 zaRmn2hf%V}ScGm<@PHROphi9*?~w0E7g#3d1to$kYCHZsm%PniO?-~1~ z8a&koPgju-_|6!S@3Z_zU&xCVcZ`Gl4v6h_S1|Jq^Nufns`D~#>-by?@y)RU&{z}? z)_DvDws_GFZzbb!E{x|t2@{ekLFtw_!L2((1H=wv4#kD8~P~=hULvag=!zk`R zaSw{SP)I0dQD`Vs6hDvRQ4|)6r%}8I#k)|vAI0yW_z;ReLGcL`e}UrfQ2Y&wFQWJY zif^L$8j2sF_;(Z+z{*2HP$`@ff7n zO!<4J{1cND*d*mONpVe5T9XvkBxN;8QB6`(lN8h>pBxNy4QA|=2lN7`xt$jW>KLu6$>i6OEwpTQ7WnXh1otjxDDL{{d97$PgvgUyz# z%w`OcmAM8(WMy_>h^)+R43U*NfFZInCon`-<}`-L%FJVktjr@AA}jM0hRDjaF+^78 zISi4Nc@aZoWj=->vNA7Yh^)-#F+^78H4KrJ`7VaY%KR8ZWMz7>*^-snf+4ap{TL!E zQ^XKinY|byD{}}#WMxiah^$NnLu6$h#t>PVH)Dvb%-b+TR_5IpA}jMg43U-jAcn}w zd>lh$WnRG$S(#TcL{{b-7$Ph4eGHM6S%F4^tjq=sk(IduLu6&PVu-BF5QfOgjA4kZ z%ru6`%G{43v@-O9sAX;7$4}IKZh)m38f@a2&Ax&oWfspKIq+BPcrXx!@z(sTT6c$J z6!i^(i*D>*Uy8jfS9)l(FMXKsXa>%(E)AyT+*x7u!8o4YG2?_~T^ZgMz*q+c!!VCq zGmh_`;rcsaaPZdlaTt)o$~p{fozsWx4Bg>8e;HrWZPd@fJI#4^*_~{%7kR$*82jBG ztVZ2C29%vJv=)?N4t!~5_y*2hZTJY(Vz-xpw8pii_F?Q+LJq}qUw-sBQ_c&lRrYe- zs;TJ%GdTCN4_9Q<_Sy$2rP_z!4_mOYL5K5@zXKNkG#uLI?15+QI(p*>{$#GhB^a1j z!#f^l=277m@II3q+^3fcuJ#H%;X;#PT@(lP?Za2&;>HpI?uiD-AA1uI_S?z9ek&`m zKbHdR?J;0I4?!^F#9jIEkb71qR^AIC>XMWv)X2lVcpo3gfjYFpkAy3?3d6kNHG$%*V3Ad|e96VGWhOezIMd!%7i% zR7^bN`Q(smSwZek0eNqHHFL+h#N&M`Io>C;!iy)^F16$7f)@r*>^PTryw4@a`)pQt zZ%Bdnj`;cwKa?dN`p1$(|7cdwZ%hGwUp#cXs_lbS;sJj?IpEJ`1$b);z}?K3@BEW^ z$lpy4`8!!b-j)J#m*$MGIh;dJ;_>#bNj$Dv4N)^0SKX8X?}2!owogYu&Bno`y%iuH zcz<%>xvYS1PXYXvc;EyXPZxIR)C?k!bnDFygVEN{;npR#wvZEE8Dpf*ud{`^mw6 zFDtM+mj^7Kei09L!`j5dt3HUD$?$4$*}!&D99{);mxK>th zcP%5_E=KAPlEZy}R&aNxfV(R}?RIIkf0Z2SC$fUNCk505V<gqIXT!bW(D?^ z6kwCIS~}k#9`1i8hx>!9;NF@7ZnC=V(q=dHCLTp?gs7Q}qV_Hu*unUky*WA9ZCQcc zw`^dC;=xWP2fIHju(zcEo2=D#oeq?e!+jttxVNW(o2=D#86lrb4t60cuwyB}hV-=f zxx3%rf4myMGda|^X9abC3aB9~Gq{yS^1I@X$NEBYtj}kKbvy;u?VSTCbUzyp?yr-B z`(#$&CQ^V4u}9$t1H{Aqm*jB2k`>&^6mW0rtV`wvzr(?OJmUXOj`)XJAwG}-amY>^ z&N+QN#!LGW50^GW)J%p;2UB3&(OIju&-r+Gh2-#dWCibz6!329ga_{Cc>JZm3g9{chglVg7n@ znC+}!9!UYS5CbzF;Rli#Po&s%%wxXl-cyLFPgFBQJxDzSB?d;T6-jRAd$ZB$s zm8?LX%m^gsH$5KYTatr(b5~#{xmtZ4`zk! zR94uecx->49NQ~dVY??QY-i%J{cCb;-^dEvy;)(?f{iw$O_{9DIkV@dr1(rE_FDX9Ns6jI4h6GcP2SLIV*e*Wr?rL-iWs*$M*|a;VWf>&+&X7Uw^-q z9N&Ah!go3azK{*lfi~%LIUW!CrR1RhEGy7rHlX7?kjI1m$K;^@AuG_c9%#v0=lVh* z*HP<~M!DXqfZs5+itffXgM%v_j@IJ6f^VCK|BUu8wneM2f?n7hZ)NC!yfvHuKNQm| A1ONa4 literal 0 HcmV?d00001 diff --git a/en/doctrees/metadata_aa.doctree b/en/doctrees/metadata_aa.doctree new file mode 100644 index 0000000000000000000000000000000000000000..2002808e37cbd673f6e6583152fa5c43e33273e7 GIT binary patch literal 79586 zcmdUY37Fi*btWlt$l>rNMN$V9wMa`OM?&`u=is4pG(1F+B59JkEj2OSm;u0^MjJqL zNXfF5IB{As?0lBn-X!ZI$vRH5wxiFR(}{CAE3dtYvq|j4XV&>-%TBVn4=0YV{a@im zsnPZ+E#y6t2Ae& zy4ikvd(Zc`pK0&5R_WrLp*8i2)V7u&MnzU?Rb8sLpTNU)6yH>8M$yS&Wks6}rI-7x z?an=A;QZsoV)2Rd<$;%<{W1J|*UQhoyDhJLqAjnomYH?7&^4L}0bL^QT;urj@#4 zDq7tr>W102me-WJ)IQ$VoC4@=MsvzA6%!O{^*~&YeXw^!u~>NBl>WK`Pm&R<(=}Yn)1!^ki1LYE$=zL0vX)ajLE>dYD#a5ZZ?!;Fpy-Ke2cscsBg9P z3dmkf$SSf_xgaPNt^T@#GAqtVz*sDn@IU)yln!gBDJ(B~O2s)Ayo1Cbgv^ldP(=bEOe6lQ8l0e#$TLn*-gno=Fz zP(i5|UfYxmQ!KcBocI(vC#hg)b*)ep5dkr)l5S9{S*cLh>i9<;hH_D{N!w^Wx^N|U zo!Cd>Ix%ZgC-V3{X=^NbdK`HY`X-;eiCV2-%2GkPB+fQ!lEKIm(W_U9JX2N-pE~N- z3mB>tW+kz17EG-$#TXM@#-stK)7ogA%s1nFhzYv^2dkh z$B%)t@~LBoCWRx1577w4Y#0YiC9NUVm1?mrnI)qkVPs_A5TI*ysbUJ#60`_fqt%7s z@=(zpYtUfO?PRTfO{rEW9xCPxQbPB<0Sg9jtbe_IK4nwa`dN%`zR$%=Ez%l5-V(-| z71ZMRQjA|d=XGpi5ckeAr^~aFDWbm?=f%O!vml2^87&TnZIE@f%ZH#h(6a5q0^E4d zcj^tVGQLpdSFEG+AShHZm#iCuWQEw739)m;6L$G<9V6b$d2uuz;pjS#qkw+lRRKi? znDS!n^kbF1SdL!h$Jcn<<*Sg$mrQ(}I4Vp`_|(kJ%@xHNG@=>pVo^amQZN`S;hjQk z*38nh0_#(PVbXA4(=V6p8@1ZZOxb%QDvM21)^xmrNCsM2qdFZStgkjBh+=>n?}ksq z6Rz4UOod!>Zb~G_HZd?L#|{-IHC^&4%Ca&Q#3uV9?A;e5b(l`67h0vml$Bg ziN+Y&*%{5(mBZaK6kkb~uAPZ=RikvBm2^d{DNnIJ#pso-a4r$Dt_zZd>489b0j``_ zHdh_7e5wxhMpdMSE>o{cWa`N%Q};i7?u^8Sc|Fq<$Rfhgwjf99oT)n{1qgDY*aU^6 z`0Pyd#!j$eE;TpvQ!@c`>2TAl1_iQ6qlOH#!%Y%3;VAQ_CRj0-np+a7nT=|VZH^pr z7T7B72r7|nZXB-SjFS^PXq;kV`~2l>qjn{7cs|OZEdrx~`M@4JG22uI^N1+eH9^{J z?Xk-WXqXenCMy!hr|90^T3@Jcu8!?aXsLe~%qHcex?;Y@E)9a*1#hw&8Y6 z%pg*E0hYoxJQ~aAsaG2wuA$4+o_L-uL8|v^r~+9;I11VD3Q7V&R8oMT zkPQz<@!9Foh6gL=QZtxHO(WXKCTj}D@}!D1q_42?K+hb-Su=WQ^gbQUWwN5qujZ zIT3tr?(U5nze=uR-IhqmLjgk0NHdCI+Vd6sx}*nECCzedcE||E4N&1cE=C^vMBK?s zL@)=xGA<25A`NB&4S2C2{e7V8S&!I?L~@I0j5{6(CAHgH%tVMg9tg(9OAFOD5ZkBl z#Jnhs*4$;Zn8+x7b19#)-}DYCMn$_Q>0Qi-RNW-L6xml)Z{lo&qf%bPfId0Tios_- z69;*j@RIv=aB-IsaR-N#hg=XlPxUf$)>;0})4Fz1!JMM2kP#Ky9wkN4VrS8ucs@Zp zwS?KU-n&gHbw91 z&S*M2Y??oJcBo=5JEL8*lT*tY=`9QFEI`YmOkH-yx@KoAFWni-Y+0kiSX#>h zJM=tfyF;0}?2LEK&UjwzL_h3!R@bx2qr!LwJM=tvcKnYy`?_RjEHAr*j52j+EW_?l z9=WqanYy~OKam}Y4P=}T#$HD}R?Mx}Vp&BP+Uk86bS?9k5bn9W7;e8V*!cumI>tN7 zNgHz5*}6O(=z*u4EHqUlI{NWg@Y)&i6deC}F+x0r?R0KD`Ih=%B2Q1m>QhdZC~Ai` zb?8yh3VBaGZo)Q*d*(S!e|!scdm<;Xqh?`WUKR)$McP-VecqR0fhdn)+sb9sOqseZ z>yAWr;w=!;=EzS6LteY_S{4`zapcADw1-tG#8NIT%g)y2>CQx+lC&r%`?IgZ`ow8b z(Dr!G0}O>NPfl9o+nu|*W@jXyG0?u^2uB+mfp)kr>2d7P^PI;(R54d~?(UkM(Y)9h z`TA`h2KxT7=iXh`2<LcDPRug0O)O>ek}%`dBGB~M(?au7A@tO5cvJ4MdI9U}TCB-LHfiN_ z`2+}*7?&cEO62+mYXPel*22vsM~RUs3SgDk4e)6{W^9T?tMmBE5PB$)&>ckR#7vaI z;F88j>swCG0zlp0KC)|qsuIe{74YH2`us4}r>50su$=p%RuQLaSl5mf@=)!tjDz{| zExIIel}WqBvi+T*?97yxm3o=PLv3bf18ec`9NiZIy_KpYcvXVoVO0vyz+!Y(8Zmrg zE+i4N5CB}Rk0f&aJaO$HkqWhDeMWQvVBPAKr2AU8RsyS)OFU{7VBCw;QS~cN`q4zv z*;0tZCr5@42&2P$g}^j7SuV*ml%l53UM>olZE~7{n;{Ayb*-DK=Cxo+yA2@yD*pXwC6OSD`b@Es@0^K`Q zf)IyC0siRF(C|o%KsQxuu+7-?qd+6rwkRba-1w(H6rp(b4_;;+^a@uyUiX2hB|3OszWbncOJrMt0z=1%;>YUPVJk4&7pzj&ftgqGt| z$=E)afa1{5z7hI+_~g-un)hLGm>66-=iTtJKkll*LR7~k=0qYfbJPN8Bqy+KN|UF~ zMB4fS_4g5`*0C`%n?HBNM(*6?HkJy~S+jDs6rW?dPGLaXyE>f-PjN z!ee54gDTM%Xmz2RSBSKeiKN|4q@A8P{!D38rlKq zZTO>II71_GxK`QGBa)??MMvB|#>{npSw*{GPbY$9yNw8J-Z+<2-2wu1e=h*KS0|!- zlyvfxz4#1$MK(rvMbIeT{xNZYopb`+YBY5bn<8mFjd1KxtW*aa`J;OXV0P{n?Ylm5 z?pdYmYPb?UlgPmoy!Q5tu+0HB zGay*!rw`Tp7(Ks2U6_v~!gQn>7<6-&7?vvb;p>+hv^~C4s=*g+Kn?HPov%~_1-oz` zO@w>gR^sD5NHq-if)wpW0PI3or1aAlskd#bM}nzD7vN(-fb!QP-Vd04y8q$8t7eZy z8Va0inN2Jw?$F-gTP2XwPao=iuC1MSxh~+xgMdRXKlajV+B+f~I<1}VL9ljntv0ac ze0V5=bijWYkZt&`kK3C^;KuD|Pi4DkUlT;zA>M~chfguYXS$TJ3U@Jv^DYA?YRq?> z@2(;&ki#F zI#Gv*yo*vP?#&J>&+O!;)=(;jFnl2HZRmPMfQu;qeb7raRcQqDgQD4WvpI}J^O^G+ z%Dn6868B_~xKKkGA=1tqncO!vyx(snRIol>5u_?Ps$iop{4C)g#f!9tmF{hST|?lO z59=1U{b%IvR=Uhn>A<3~)NG@x!kiigmx2Xubz5nFf!F!ON|QG+8s&}*k4GwvQL8<- zU}yq8#S3_|Zt9ou7fv4IG;Sr5P|SdK1#bDZ$C%6Z?ZY&QqZpTaF%brHdlJ!P#V`am z69Vhe2y2lyagx@|Lg|H}Sl>e1BaJMSCcp#53%0UoJfEB+A#!-kK`1Y;o-SuoiJY-{ zUVGZ;a?_C9c_Ua|Q>qFW^zm{QpIR6ik5iKEX(a|3%ZTSQ=Ixzk>XgV>MlD^wDiOX` zSu0@@*;vtaW-9l|E2#h34d0u6n8?5vKmU=neZqAkTA+T9ULP(O!kfu9W<+v*ZmEss zOP0jB-Ezk-sI*!~9C@pHf&RcZro78KRg&RSt)w@x$4W2FY5E1Y&Y~GKMH1Nj0p5Fz zxLfQ#KIFN(8_S}|+>OGWmF;PC6}e5A(Zz-wMEvU$^}@tN;eiLwo-45TNJAzcW{PPP z4o?=u!l1tj)$xur=n+!D+cW+Z23hY@b~}1M!fgd*nmI~y9~sOOT0_@Nh=shRnRdxy z&CtB!{T#^xKnAuu7ko*EFIL^py~uiv-SS53#taaiBQ*8 zYj;f>t&JT-__@BBL)6dNqNWOugAIas1q0>;c|@2e0U7WLH!2oX)vxDT5954Jb_BrM{m2 z>^Z(N&}JdbRn}Te_ra50tvprJDi?w(^)pYCgW4T#tK4yr{l=XRb@Cn+;Qh8psS1T> zZnOXHNG60MncMneqf!CS48Y?l`Q6)S{ims~XJ=K^k0#6fzd{0s-(1f~!)?d2c<41uK1UMostt zq+jkx5^fZ$1_zn1s6n`_hG9`(fhM?!)qO;UZEpHlEMK_};8E6~$x*H`M2+>7>x?dm zvas1MKppmSq#C07ZB+#pRUO73x9TOfo{_M?cv z3Hw1-t7PBpov`6kQ9Z+vsyo;l1_#eJ8x2jTaop79Sln|y?lr;4KJd%@z?&Qp!t#cn zMOEiW6#|}aUv4EtTh-khx!z(&wVOO^YExRZv)$}gZ$reeg6+;!x-El)Sj8vS-LWy9 zO%N-B4^S;^)!W#S!k5E`5RFp-e-2T*Yj<$qsJ@>gl_Q7$#-e6YaQ#^<(mwAx9X?+! zoV8!|3Zq4PK8bqD`AG&7!dT_`^bHs?Yjq$yw=?W_OK@_5Co}ca$Oc}I{YPnh zSj*YL5$YEy(JS)TsDb_wU2j#XI#xdo&uSMX$GPxEYfT7=*ZtXbPgl>d{=*%l`f(JI zRy(Rqcf4N{bYTBF-~0LNoZ*S*pk98CDPB^~X0ZbkdF;RRa6^? zAlRo-z;nF%uSBSQy2M6nX+Yxiz?hQ#O1+P#QXldv^`dibLxvl7_1b8y;Ft8T;w zSC#5NcPqB^0vxmT6D-%B3=YgaO-#`0^)e=~V{OeCIB;yunqXwV{p}-`V$KZ-zG^w$ z`v{_DDQ;NZ;m1-P;z;G1dlq#;%*t=R^|0XYn)Y~2a91zNd)%zWx$W>Ta@2ql1Lv8I~L{FIM9bx9lki# zU*SmQsQNFms0(6IzQADiW>H>7+O93iUs0m4MWH%ySQNXe>6#O!8Gb$0&mwb9)#Rl4 zN?VjID`PB5A8y846nd~27G+noR%B89T6H5fxDi#aLUvt=ExmyGTa-0}gEehNOSC7G zBmmo<^t%y#YjT)LfyIlPRjcX6b0tjX;xYNjDn0%0-}y_kVUk{jf3dHVpy%8kJgH;mS3xG#0HnF>T}4h zE3u^)kc-t~9|S6<5&LHKzexa&)p8^H&FuG?6u7L`CpeIY)f}!|)t5L@IacdqENZ6J zdgxf)JM~hm6)KW$Vn-cj5~W#DsTFV>DP~2C!tT?DC-;P{8=vvId!G6GKO1 z_ek5d4f{7r6t-bh2M!x%S2bN%!@`B9S@jiU&e<3^g?puK*v|eK8@3rYV{I5cSPUCB z7OfT8Fuzvahz*`{)eXq5E3u^)Fn=4iXE3;W!ql6FS*Al;%h+XMHfaX}mcC-^NUVW- zHA%-da5o3Oj3?*fH_)?8eq7e?6bEPF1_H0U>Isfij`cgnqGnpZM``@!PFEkqRP@2~ zN4(R~3Wpt{3U>sUaM`=-JX>`Wn5gzL!o0V?BxX&p2%jvCktHv&)?oKn6T4tD4oaBrUej29R zQt+f=n!bL9O4+Jj#-FqXVXZ)FtdeS5tKHQYSR>VDp8~2Hx}ADkeI9vOD-n-A;A1|T z%ClA@lrCY*cSSMVE%umBn8YQ0MQ{#7v^K{Gi>)M>qw0A}M@CRn5(4`y-p6F=(_l-d zx4!15sF-fQN&I(86z*%N4#B==ZCJm&&k=TA(~U~FEfMq@gB})iRG!_nr7PXp{0R_s z447XcUgHML^k6YMo3BS}MV*abt8T;w=h5oNkX>5a3VcPfO<;Nf^Y3hK40Sfn7qs*) zX4xvp#O`9Q546>2TE8{+Apz&dilvB}#ZR~~!0EL5U4B--#iITP?pSVOWT}@>Pw$gQ zZ(WJ{`amA)t-jRKyAUBpTD#TfkQZ+UvL{1`UI(JSlX4~F@Aez}kd(jQP~S!AIXeva z-&Tp-*bc*Cy{8XN4E~^+r56zDFw&#G2cJAq0ejg^ za#U+ME$V9@Uq)TmGCR!@{E1fDTJNspGlUsz>Z0?{Zoo>}z#_Bn+KU}8&>x6U-gQ#m zb27S0REsXzoWss!S|XaVvNxBtqFZ7M_ItTsV+s~ppl4;)%Uv9^J+1nF86RV1q&H&s zBOOy5tlY_E$*2u3Sqn(`VVeV2?7@}3-wUi;bQb?DhnBcqoU09`SFwqlRPqANiA@rZNOwH#5S?KRps!_tMTVs$A;D#tW^ z*Op8UD?o4Y0mrWZ-OUgCRU81qubQ+2b*UF=n)@x!V1v)_<TT)gz~CTu4K}e8DsFA{C75aZ57SBg7d9wmkYMbB79vi*d~jK34fL>vOM&ij3CU8^(pnLbSW?`W*hqC z_5LeqQ9Md$V`m|@Twr1i+YGF$u?_n60)j%I@|enExeM?Cu;L`Vb5JMr9+V6MsR9`2 ze=gj=c*Uw8!gFs=bYKi3f7VMJo;_M0Eu5@wxU-Lqf)2RjzBl#rQASg`?mON2uQEX4 zsF+rpCjV`LVU*R+yiM1|8n)=rJRO!8wygv1cG`3|2gr@+WgAu<1z{6!&LUff(~Z{M z^VJ%U09#Me?L@eBz~i*~_82aLBm^c=I9tb+ewF!GQUp{xv=sO2xEcE@Lk||?Rc6)d zNUi8q#;;X3VuN36^{d^AExiDz|CnXD_B67(Zg4QXGt&Jw5ZfW#3^tsh*4FrBeh0CO znB!ZXyAx5n8+*Ygw_4yx<#Z4?u&9|G#K}{2n0TyfDa38vZs^KI(Zt3&Y^!rV9G^HU zOib7xQDXWPXAS#CtJGz_K8cfzMC>tG&$gFiTlBP~!+B6}+nKfUyj>6XMXHbe^fP&Y zWfHcVQCo2walk2+7dts*S44d;G%cY&iEcKtg58+<0VK@m!f*mmvruKpQEDu=r-u&9}R&bEY?60h@! zyjCn(LrS-xhIntMA*NE(-X*Ta^F%{zCtd_YypwUmCH@;3pm5a1HN+03*kKkh#I|(P z8(df`;iq5yPVQQHr48{DB*~~DegHRP4KY1f3`49%Yek0GuT?iCul`y2=2uzKTk0`*NCsT`yGMiw>G z=&mNCd;b21kDo6m&fokTgB7+~E9^AxKzkW-aCo2{Q6EMMd<128)8y)I;{6E4e?|SL zWl#f5+c;AURBrGSXwW>^bxK!*Fn>72Kz%=QOsfwS-W`8e+B|#}h&s%}XNbcK&y0w?T7*>IgT#Lg0ITI-pL4bcR? z*|-|9IOhj8AZiv9VYSB*3hG*pRF2vYu&9}4qua6C5QDg&V>KM<8GUJ{Qq#t2hwwac ztY#+;TfL6S+dSrd&oXYfdW};IP&n%1j@2AW!(%mDy6KHBtd%$qLlt7cM0?BbwDL+D z!CKuIG=SBJ>9L$890nQRpf0-kd!{;xssJ$BJ z+mc?SKhGd8sBy-L!cpT)rKTC@zrpiF<7_8h1mpZ|#toPF|BV3(M_pXw>`)5he4DSp zwsg}QVOT41x{La!F<_!<-BZ0t-2B0S)|;F z>^P0HZA{V&n7?tpc5o2RaqA|RWv-GmY|FeQHkGf{(@Z|$#un92$1G2Aa1w3+H~~j3 zbEI+_z-w64OtZWzetwf}R&lfpZFU70}S$lnrR%_9W~QbYMPmTC!QyoX*=;E znCYKp+;FMGPclH^sEcc+9ZEM^(Tz&ENO-NkItJ?GEsKF){cc73``wDRpDl}_Qaj&^ z!q2b}#=qe$0Qn-n6hAu;DemQ800S(x$M(RqlqbI6e3UJ^bZZ(mGB}`0eM1b2s1@tZ z$Xw}OcFX#hUbYW6V|!V8uo%7Uu4t{Om-TDajo5I)mUS3NZD~}0onCl?gR^i0!Qo!&T^y;L268)# zn%N6a#`nU-0xjtGX7dUc#aa{oT@0+*cUHTUae`ABM?ee?Cic)GqhmpPXq<2#HRDuj zS`XdC^TZz7PP_;`^bay_xK!m?1}GeLaeHWo(v8-&iF)BT0!QjWU(D9#7`1V~m8_2_ zl%Lak`8o1x80>`Xnxq?>a2vzPa_W;YbVnO;cWvxScS3(iJVxi?ej7JqJ0W_o7@g3| z(OOX_?OCpLikGW2s^Z0d`qmp*l%c|J>jnbM5o=Y3u~8Oz>_hIb+;Y-u^1wQ?J{LMxQwLf z+rgg;xDm0pgGZ6jdtBIc2+pQdJ#K@&sZD0O)eM^j%Iew-d{lw%%)*uKP2Wv2kM^c- z!Ohs-lpZWbZ~9`iR@9sNwdzJ}IImNE9@%mBrnWUtFJS(?=|&ty&?x)9d1KcX{2occ z?kd-YV*4%jQ%oLV!xe0Aq>oNN_(={9!U~UbKGlzNq;eGgcUjcTez4oc1%JsPE@&5b zptFmkQq#J)@8Ef27iTA4gf4E)M($xyKcYsPz~Xjs4yED61-5k4n_E~bafqt=H71>O zweL)jI)dz?IvBN9A+e2;66D_cvIMo8%M-iuP>vc{m?%38l?#us|7&%<> z|1bj-j=JC$m>r4iF1d9m4O?Jayy-11td=;HSpAV0FbPeWQ!THw1^zpdWYhwG88>4s zFg;id3%qnwq*i2s{aSS+HXMwseyLlrr57-N3w-n7AUvEl%4yR+v4i6qK#XIUZ_3QU zZ?88JpL`QX*CT3HZxwDBI7(T)h9i|@ueY$Mnf7`gO%Rmj6#8J(m9mAEwdd?gBVY$zD;{!Z{GVl{mWq zs4~G_04dWSPQ81Z{&PC0d9}gpkR4!b1s-52OBqYs$`lAYY z5pU>7!&cuWGre_(m7B8KpMj4A+nsV>X{-O^K-6LNpU2Hut4|LW!|H!9S}U^peyzF@ zn}n1x3sQd>H$z*9UwR0Tt>%Z&U*+I z%j`ie-r{T!$)Y6zg$;=UjdcC~!QARPGsi$2=LO%5oSYs$-do%RB5=aKlLJ5) zb_1{va-`}GHjlTsvX48#Tb#%b{0R;SVc@R?@W(h(g@C7<3#Wg%nj=@oTb$FbI=#j9 z*Kn7aV>s81lHndW)6g{&XA0v~8kZU)@lE7KMpgJt z1jh-pHyx^n+wb+ew*qe=zk;;P6SEV$oo1%ocaYzrM6amVh2KG_8o_sv)4AjKUNLOM z>FOVrxB-cO5EV>=7Z|^BO8iO>yZ;J^I)>d}AnC+yY^Dc`G3@?!v{p3i_G{IR*i5AS zEVAoLZ0Q9!X7NoNxjMsc+bkyM8aM3zCpJ_H4HN!;uQk%0)C?vG+lWs97Z#z(dz5z=bqzz%_+ZFH(S@$BV0?e zfpnY2Mq81WTI(uJ9sb44vh(PqwZ^@}&SN=g^&66DVr7%jwl?Abl%}cFjN-Je)lHbZ zwzc9RT0&}g-Y(TTYI4$AH6zs}T{JbljURBqDB&QV*#>^Bwo57_`wRFv;QVarHT+s@ zYL)VoSh+w?jW&CSwl+;`npuZ64Lmu%)LLu6yw;nu+L&IO=5S-0yrv^N2Yi&)e&ot>gZ(zaitKi$*+N?_zO|O=#5}gl(V#ufINoxh%tWGP$&nl%_ zZeU%PatR-rt##0Gt?b{ju2P^-Ypcy!OoO^g2U6J$*TpAgxSrhsvvq?+@84<|QnRX+ zFU^uJZNRZR8aB%YQ!)*ynB|L#q1d{)zFbudajHf@oLa7Q8v|=6)*9f!adUOiRJ1zs zUF*awPb)RxL$lpVS18AzgXpw61WXxLA@S9^IOqL@hHj)r1?{TOKo4umEY1XaV8bqJ zT|;X4uKoxQPFQL{-BEpN7}hoJUJl$gijB*#A@!oB&y?EM7K+I#fS6@dnuUZ+NTeV4 zg`0;)LFqa;IgMmbcl_*cakEeNm5SqzOmPa0sA|gXBFMZPK2zmPz%CZTRrFFeoN# zf+h@Y#0NeF?E_l`MSVtsb%Nq-M5Vlw454PzM*EreZuy9OoBWu3OrDcv`33on@`vR2 z$S=tskv}7UqG@dkrKyXvs0b2SS54_{`G_@8k)_H7L4h{6<;Scw&3f?0oVChmC{^e2 z3y7^q-p>zNn;iRvzR55^jsX3XU+TP##x8%RN%*Gy3iNAAwIbkf9CBl~q!CneV6x>b09Tc3P z;1~suQt%K3(-c%FFeqqH@GJ$-Q1BKCo~Pi)DfllG{0s%}qu>`Q_%H>(L&0xS@COw9 z9tB^d;ByrG1qH8A@GlhnBL!Doh2VR1wVtllP_UhXYbn@6!7UVwQ!qloBn9_SaGHV# zD0qT`$0$%Kn4w^f0+WItq~QB0cpC+8rQkgj{8tJ-K*7&a@T(O35(O_&@G%Phn1cU9 z!Ivrc5(R%v!CzAFO$xq2!3uafQkPM%nSu=z6ezfX0)c`-3Jy}RkAkBV9HQVH1+S(+ zq~J*k>J(g{;AsjjQP85`hbVXl1uszWQxv?Hf)^?HAO#<#;3E`#l7f#@@TU}fnu4!T z@aGi#Jq3S5!FMS5cM1kDrcqZ?u#JMNDR>nHH&HN5L6L&HD7c-1;}qOS!6OtrNP$Gb z6a~A{8>=@XXj-dCgPA`E*7RR)$^X!jzuRI8++xbxVv5^hO50)z+hWSvVv5>gO4?!y z+G5JtVv5;fO4(ux*<#ArVv5*eO4wow*ka1pVv5&dO4niv*J8@nVv5#cO4ecu)?&)l zVv5ybO4VWt)ndxjVv5vaO4MQs)MCohVv5sZO4DKr(_+ffVv5pYO44Eq(qhWdVv5mX zO3`8p(PGNbVv5jWO3-2o&|<=GF~PT(&|6I4Ehg+16LgCSxy1zBV!~}P!M2!CTTGxW zCd?KSWQz&0#RS-5!fP?XwV2SJYs%M>h5oYqc^I0%kiRAWi*04DqQ=Us%zCrz>V1%Dj!Pn3Z`CT`?>3 z0lH#V=2z*8S(%sUidmUIrYmM;zD!rl%KSB5F)Q;;x?)yl1vOh{Wj50lvoZy`Vpc|= zD`sU5(iO8ZN9l@LnR9f-tc*xk%*xd1idmVb>55sI7F{tb^A5UVR_3SZidmT#>55sI zkJ1&hGM}U?W@Y}Au9%hi3SBWP^Y?Vctju@lidmTfYPQVEY@;h?WnM*B%*qVY6|*vT z(G{~Y$LWe$nMde~Ss970n3d7#idmUA&=s>X7F{tb^J8?ytjzoAidmUopetr&ew(hC zmH8B1F)Q;0x?)!5>vYAe%sK%*u?>6|*w;(iO8Z zr|61Vnb*)2SsC_~fw})zUxe#nmAojcvlNgUPjxE=Tq z_J}BW$Bu__62_6UQ(Da%YO<(TM{attSA}w1<(A44Z3^X&7dhReH^(i}yqqUXtO2~A zRJ11EcJU&%8pk=+>=7SchgVKI_umfF{X^|D7-%;{9Yc0!^kf(4y`}_j?}mr(b;e}_ z!*%zz_XaKZIcEhu3;9KSZ*R1ooB(BKakMSQozs^O7D}=jX9)!(iBmyT$HH^^!ZgfYVHix?%d$xBnB0lQn(IX6Ux6ze7D)%32bu&v{i|YAv_V zMqPgFN0upkM43sQP)N@LHmYTGYkx~xCJ5BR0L0PpSraF+SP zQY9J!SJ|XRI^>u6A%8h9$a{K#oMFD`69@2W7o>VR-f#2c{bpWx2YbMKBweQ~H3g$c z(rg+`R#-=s4t(oY?jhG^M9pQ$b!!j6Z%+r#Ak(+EbhJbKXobAc-qr)!1BqyLX-2_E zMGnc{&yV$JURZ@5uqO9VL97^Xl4|q47*_eAi+MpW_5gi6QOx+XS-m8` z9RT`{KNw%a{*$l8`UPhVgSXfq`p%#9=2Yqd@x9rIcVaIMpO}A?AN@N5=;sA`s0YxA zt+{}2eRXun_?z|G_&@luzL*!*;U2K2P3*XzT!)K$)6Mkn^Mn0lUSRhw5ZIC8a5~tp z@q_(JUSLNS2COie1$N0c?%~FF@&Y@$U|=)U_&R>D+YmLEvDMgufgMX%<57OF!+C)n zUof!a>0nRtgFT)X*nJBGb}XyS%KTuZyuj}70qh+yV+&_t3#RVaY9C>&m}!rHfFJG~ z@`8I{0pVsCsdw?i{jt2@9_#_`eh%qowAx?hhx!Y7LA|{Ps2pP`VP96O{X>4RpUMmD z9X){MX|({G1^2J`;eI_YxOesdmru4CZFc!J+@q+ah?>j5;;sb)JCfelejh*B>+=G8 z_kw{PO$WQ5AM99OVDISxEMKe5d>uH$5BF4Fa3^|z%hzf%M#wdOuu5KF@9hC>OixQI zQwq&Xg_$O{&e1}MjIV)j;)nXiyr53@05xW2hR{h2s7Qzjd3uxm34W~a&I{|I9hKD zow9WBNrhUoJ|nuovArc7@!#?z{(pHPKH3A~m?bw-ePsB6Fgm4aAiGmPsU{MZiUh3)1z5ueuO`n7s8W0AdIm#Sl^V6?Kku{0RRfFNCLiKo~PvC4}kV{*fQt-{l4F)jfb4>TG<@@?qG~bck!N;~vVa zLeyM_GG}^#7`I%9=HkhM1}5Y8rK7!tAMMV((4Or9ZH%@`!{ZrKJ@@c~yE89v=XwCQ zw^LgcL)$+-G%V~L8p;6q7(d8|^8)!`P9Q6yCSbG8fsvt%8A_8M(uHE#sx|WBk~DD=%!1=7lZeUE)jp*gl^Z zw#R$G7PEy$5voN+g6|mHI|4pSH_$20I9;>S0U7e28Ed@&19BW+SK z4Cd=gfcL+QM)@Q^=*RN{J(UmWsxD5O!sVtRxwZ%&b>Q<*z>cr5+P>1KK?sD#DC2ZVlOiui4ZeZ1zf$Id*HJXQRgx6 z37MN-UXl|bW{eGr{19*bj|wqkrs_U^h=+58*vs2wq7*Ym=u`X<%Q-^q<;5!z;(_$8 z|8@KjFXsrcm-nn<=X;iW5Lr6Lck*L=dyW_bV|B?|?YY)r9u`+C^-8T-C6A6X@D^xo fOLB3u`y~D|+iz;a=U|mQma=V-?UT04<>LPb6K02{ literal 0 HcmV?d00001 diff --git a/en/doctrees/metadata_oidc.doctree b/en/doctrees/metadata_oidc.doctree new file mode 100644 index 0000000000000000000000000000000000000000..107669dcd69ddb7996bd3475e861a135e59f384a GIT binary patch literal 44709 zcmc&-3y>T~d6q4mq&q#VlWYlN3$G6x9Gog2-?F6+PEnV#`5E~4-WT8ezP7yTY+LR%SDcm>FxM`zA8%u+ z%#}?MilDdUwc3nm_KCW#Dl;t|AYhS~D`gFeXRa#ML`{Q>5bmjqb5>||xz%)k%!s9P zsx(V+dKczu2ehV$P**oqNt4v`QoCiY(!~ls(U$w<&GK@yx9HFWzg9AKw!u{`hhQ6Z z`%kef%_?<8R~mIKt7>}NTv1c%Qu|m>YX(4X(ONT_uINBvqt3;3*a!BuX0w?`XVgbC zP!9(VWMqA=*4LNGWNw*Ja|inveaqo4|5Oj%w(j@|8gTRq$^s z{JRGJT?ss>la$des-XZTiwh|K9-3my+ymUrwi!2#@WEc0y za`^^%IiSAD(knoACn77!Qt6zalp6I%Gs>J;kpN>hn}h%9mzEoE6ibR)s!7F)DoOPs zJuoM#=d#-Q3KDT(UMcJHfy|yEhm9V3mgnR4i%r|2GL*CBVhsrEbJ2jtQMuaYrF(|j z=JJ-Rw9Q@dkzrzDy{wc)ORLRGcD3aPHDvV!RKSGIY+q1C$Y%m;ft0tS7EWR}iLvx7vhl2qf&uK*BZz5_XUbgd#;VR>BBzC=&uH3wt~kXMOZE)n_1STRfz>Suxf= z<*@dCo3%}WtbHPowM~JnJ%X&wi)vk|R|M$uG%%`yqC*EFHEYnffq^~U(sd;%4@2i9Wwb`UktvH10b-UVRl}#|q)fe0hkw{% zDCZT6w0`rxrOUzT#GVc6#LSJI$babtWz)&SKCy8}Eqc<`$#F)SslltsVtKXbVH{rHJ)R*HC1w*<(E!)Bo z)oZTQMYSTi<3s4jCxEl!)Wq1RaAB6i8S_E3ts0)Q+K5LCNa4^U^S#xzmDVH!F6wDr^c&<4E78t-$|9bPqMFf!s&Ge19{6)VtcDvk451saY5qrV(XBE(ir z&&?`eZgOCW8gRX#UMN}@YPCwG=uCl%VoR4BD$F?~4VqQ6JnJK@r&bX}k>kd>;L>oG zsm;<9h>?>CCC9QUU_mCvvZD=Eaw+O&R!R^X4T`X5ILM}~ajcLkaU9r}v-q^90qtW< zEIMBX^4d_4v(#c-klROVqB5tQ6jhjP!ti?Wpb4=*8DITh#W5hj3>k8S*|e1-$A}$` z7}?$#&DE9h#WECJNJiJTP`b)~x=u-|BG#0LsT0wXvgJ+1N7n0kvS2-c%a7yAj%9Jx z5zD1&EE!e45;CT?hcfk`pQ)qwoSv3wT$h+8E(sq;TX>GD^SWy1#1Ujiu?X@;aoHJ3 z#tvUFM$L8csTl!tX>*fQgSaH3s6oSQa}!35H_Am*!xxNEbA2c^bAGL{%#lsb5?iHh zyb@XF#^x%>IN7mz;}j6vY3r#7paXRHm#mAA?hFdXV$q@77 zSn}F%e=L`$q&D1JLdMjNP^LO;_$VyV15J%{Qa!1m;*#)jDB^8d|gtxr^1#sHrZtGaXBjN+gaajmxx>A62Yh77KYKV zo2S9-gEbTh-l>&fwdL3)o@Ea`gcX=)pgNye^dd-LxqPYl6o?HEJdavUFJN7S4G;L( zFo(g?a1~J`}ch@zq{4Ef%tS;u~jo>Ceg7S>uF+ ze2U^Mt_qsHKwA*@a1F`1zumr%g@OBSV@hT56%%DjQCK891KC14>_9?Y*%=TDk?dd^ zsk4KLGIsVXjvZWYPluhTg?pwugVF5J;(zMwV8IwW1B+%SrIs}qqh$?7w=7_130f8= z%GeoPG&@6S>CRBsmNh60MYSwo2k)nBcQ8@L&d{RS*_#$S{?|Q@)pe}$ps=?KJ9s~J zcHCDydl$*hP+E2e66&fuLtX3+rja^3m?+bo;ZSxY8pzo1jh&8oD4SZZMM?P>+U&e8 zWR`hI@b+9z4A!p;RysUO6LCj5Q9}+ZS;o`81U#i=p|K$T(T~G|)6S45e*ELa@bKid z)2Z>~TI&6wJe>{Hr<5#_-wti;&?DXoId>gyyf!HIdUTZjxEAO@C?|oVW??uj3j_)I z+E=H29`0g+Fb%$Kr7~*9L|MzaIh37X3k1)m$WI4DPP=hh7BJ-D$cf=-4;9J7QYtOW zN|y0-ODIoaT9lIg8Sbz?L0ZJy9_K#Ckk|60q(!dXxpmR(45Tv#8qN;HXk!DQ9c+>w z#17t1c?^UFW4d#2(d-PS#m-<1b_Tn!gZEQsXV78iworD$EKq85)8TCA?9{O@oCWgE zPn{TC`@(d1mQu1n{2cZ6P@cjpP)f6~VVLZAmr$KH#Bmfo3&S*cep0eP?ksF1l%0oh znV%Ma&p z`Hqw)=1)<`Uf@^woH`7|kc<#Cl zZ-x!4m$1CdV%-tSCT^fE9tQ#?;!;FXkzChcEn)GzTDS@8Q6e%$0a!(LIXStNVPT zB+k@edpm5D2i5l0F`sU{t(aI{MbvJwXuW4B+AHNnrC!A9!8WtK30v}S9US(7-i$>O zoFakYp(1fKP>jw(LkyRgb790R1pvnNcqrFzN3LxoQl{3bS40K?cC)^gbYICzB~Ymt z@lYy`aVJto(O-Mg4~3FW8zjaj2MYUz!NMMaTjoZ~CFz=yZKxI4S6oxz&0`KPz-H(i z#2?J(i}+{%e)?5_ULlv?lg0lF#l86)9Kgfdc>R1HM7|Kz3#^gqPTm}uzRRx87I~dr zisCUnJse8eQPk716T;}kxK}AF;=>QaVK=cgJFApn`=^BavVpjqQieXWFqA9o$qnRl zg`tuB{(brVIj!Pr)+@_%0-XHecyO<{6ddF!NRTH(cqA0zaYQ&e;_Jpjv#PWJUVbPC z{}=Y=3V>2;2<=JVGN zj7%NP9xrA=%i&eY&@h;QY(76cfPcp)5Bt=-2eyof{DwN`f{XorrUpw<97fEsP-5n> z1>i_dpwmjDQ`5e-zC``KkE!)EMyB;c-`n-hJ1%!6#vPjQr79@n@OUVPctFnO&{eRd zER}amY@Jg@`nXo-x%e89hUc>B)NjYZvD=WelOxkEU3#MdP7@SKpQWA{`jWCL&gueQ z5gNEdPJn&SLVhr4kH&Ji#bLL9x~TUuRas;%toA2EfzaL)sHv(TAh~QEbdts?t(HKF~p#<$ig2oGb?ZsL+)r)o>9F}BZWhkdg zrQB&@dVEwE&q5pl1`7E?L70G9f)Dlz3GQ4vV*aN+}i1b<6Plc9!KbC#s)YQJc zdDys>&vOgT1VU?&>D6>_vmvVG++cp+aG<$et7r`;5e|g^x(nt;W`Mh8#88|LMS)II ziZGC!62=;({R4UKr2-{h5*t((&DKoK-ubTOAS!wB(O|%yA1F2la1}y>DPF*e-CB66 zA;4jOjOsz>z3!rOOmETxFw}R2qMk<7NAKaR5+1XL-PomblInJwQ0g3>8|OREYD1HR zDtIdp=A{`ytX1$VtURarG;(=$o;OGKPZy+Phb}&22KVkzxYVt}IX2ho#Lm?kD>!(q zLmOV31K4z~V(p(UROe;%#bwH1-V+Mbu2pW(9Xm&Ft->~S^+FR5&3D!+KhXxL-qXAn zTdQ2g4DP+5aF1C^d@Mn&df}dv{M`ruJLj!Z{OMMybC@e3!I&chcwZ<$vQ0N2SIGLbQt)^OT!hZ8Y z-iNf$y~)+9_o|EASwo18+f5$xW@zsZMSBnG?i8V&US$1N!CQ=G&tbra8o7>homY4( zc(qk7m9J&~nhSYREjPLd4E+P4=oRX8g)!=B1dE1KQVAADV9aeVSmsJ=qg13?@;a>(0OX6)a3L6qgiFM`13_`S#ui5MVFJ2 zb~co>0VHku(CF|`VV~PNFk^MLBuHg+SwSN%_?d%$7|+)VRQY&NfnHqBf}a-hdxMnZ>Zlxf#=69F8FNlilRAYm)}@q;ubEK3Heyp@Xa0&f z`99#aIc(Du8&#M+a1avSJ)7&;Qv$6$v8-m@tjs%eGI&7CsVz7QrRL@v>N)Uqg)3c( zL=WMtN(;I~*Wra5%Yq6<{z2iSSFgDW>^Ti?nG;sIM_!2?=MK2p11m4^iqgGhuJ)dE z>*p>oA7ItTRxDc<;Ke)m2BQ}#h*-;5D^kwEHs^R? z2Hrhnc06P+SUHy;D(<8_{f}J$f2~R>W1UdVOmnAly$SJmAg$dQcsY$F0%vwo?Lr2& zykw?MQV!E6v!ppYdr$%F|v9d14|QO`KKicSmhN5*NCD!ck`gga8ks`@%s)#fT@2S&8t+!R2Xo1#^!>Ng;^Q-%E!s_+pW#ECkQ3AhGe79%cV`tv|?L^+} z_TbdLf;(_fO%=T2q37~Ra|5eTx(mCt+HY%jTve^Bo4j##v8ag@eT{PiJnFrzEtzYT zda2gJ<^!(!Fr(_ao@L9bm!arKu?d7^uAUPY%2HF8!Pf$~DHpA^tVwf4rPi2fKVhzv zl`_0!fzUcTLFdBidTVY5JT-t(U1s*tU;q|7YZoAHA2rdODU?!77D%SFy1I41N8Cgj$bljdY=#;x@ofQvb)tm^QD#A=1VYeDJ@{HTy*-qa&hKDk$RxV+EoFWRp3$0+!7cO26PY&i)2OPOU=s2is3kP zr`!R&e2KXpChzEQzG(Y;pETF9E4V`w6lb*tn}ooUf)o9I7~WY<@n^xb;8+NJs^2Zv zz^$&M+cemkG`(78AB4iu$qIOcjub$V~v$l5t2U#Kl|*TEwu)})@oYL1qJAWMf;ZKUhOGM zGp!0_x88Qs3o%qloP#U9xVkSPsJ3CQSL)4{4lgWV-U_4w!WO(2-v?g@@ZKnro0y^u z!_FG0Em?D=1fJM0Yqa#>6t?>A_>!pJ1G;3cx6%#B-+RONu(<)tuK`Km=#88$!#tuU z)+;U8@Cj^};ll!#LbEnE!K<@|S_YT@@B$VZI?Ncb5>~=%8t5944W(R!FA&Ts3vGF& zxgMs(jiP(Wyp(1r<E?Dn>wBn^QEcU~c1qnK6^oNeG+G18pHln^!)COLkPqxH!Z=XDm|z)dd=1zx=O<`rKej7SoO%WHu%^r@di%tN8_o4i zsp%R4#IqK!%!p8YY#XMtFBmRs+2#fCg<7X2k+yjS#-sv3%%YAvxS+w|ryiuHaD9Fd zn(2C2fbu1eSKQ>Cm8a;H*EXoLI0KCczD&?Qw%XhZ&26sev`)v0!IohB+Qbv)2JHek zhFU1fN=2^0Kl)Mxj!Vq78hq?PFTSw_%~}JZHqmeECv0La!Hz`wc*WL|4D+)R)S%Ve zfMuc(Kb6pGLKgU~4(cv!GXQ-HT)}Pqu3gxOmI8)zzIfy~9WoQG#)#jrIM)WXfsUvQ zE%*WyL6*QN^b_V4C5UydD9wpVtq9*0ff)cy3!&Kk_M8^GbED@O>?^F#gWzW>7YGd6V;pFFy&f9Y6GK`4fR|#^vWaFXNl= z@3au#tXqIi7d&U%Gzk;UK<7_z7pEy=%Up>j0X}YGcV=({dp%JzS7GYbogMOv@(c3I z^3Ua0v{Zo<{Lu6dywI85EyF@kJD0K=E}HUq$f)6yHbjpD12J@hcR+Kym4%Aby9T z%P_PS#nmXTM6naa4Jh`a7(g+K;&v1#QJg?=7R4D9RTLEz^C)x_e}LjGDBgwQohaUq z;yoxnhT@|rK8ND7D4s*{B^2L6@eLF&p!gw*pP~3Eir=94HHwwXK`ckH3B?8!85CPl z2q<=;IDldp#bFdF&@naM}Lh&++pQCsc#VaWKa0Imq#TFEoqqq*mwI~WGvM3IsxEaMU z6h~0pi{dU65{elVG;pI~*=`)d?F7*>dr_Ay_l)?7nimcEWkY_|AXPRAXPF*jSNyDgVe_$)iFqI3{n|`)WslGF-T1e zQW1mH!ywf#NG%Lf34_$ZAXP9(4GdBNgR0-4syC?G4XSd3s@tHdHmI5ns$yUm>I4`j ziPZ`Wlf>!-hDl;I0>dP+`iv@8-4iYOO029Gk=0Q!L{{fKhREu?6+>io{uo1Kb>4>|vN|8b z5LuniVTi2Ga~LA4^DPXK)p-F!WOaUqA+kEZ!4O%UmDr5Q>TJRgS)B}q$m$3fBCB%% zLu7RhV~DKIX$+Co5ivwor;Z`AI*(w8td4;pvN}&;h^)>BF+^79lNcha^LY%B)%gmB z$m)C-Lu7S+j3Kf*FJp+T&Z`(AtJ8|Rfb zy)0LHXrm{6m{X}bPU5ccr)A%PWdWEf(3?M;6RjyVYBd;60S1^Vt{TNRf^hxafbQ}3 zG>my+T^~lz_LpL;44oMRe;MCCtk*8Uo2EH-*_qF>Hx!=bM|+8;-+X8UC_AOAEhxn- zI66%Ky@|6D^;IxN-ClIi`swECm$A1A_>P&g5YS^!ZZ9!cV0Q!`M4OmAG=;NF>w9=? zfuQ<4rBwZA_`}xiEbPH_WRE~u&(OwT+D_6!=-pvqoQOX-uzt<#yd{ZZ6`lv`Wx`FuU@@b*VBtTc_MAx7r4CI|S8smxh z7>}lf@!A9!M0Nl-dc|KVY4SD&h*yD_45H*!? z#*PG#yEJEfp<;ihA{y`3_;_ER7T%o+@E(fRY0HB>YBmlgt<@`hJG$SbU7{PLIUV_gjTfU$)ESL z9}W8P_@IA3Ezr3Hp!bJ?_PEiH#`=NySl^o#)_el2QB!~R3J_e{M}vJfKG?rY3v6MD zz=Aj9Xt3Xo5B8gBf!(t-V9|?xG}xcV2m4=XfgM;fuwB%6)#}*8tQ8P7m0{N4l7StH zuGwqjgMC9AOX}EV<>dt9^GpH zAwJl@PYdkL3Bbl_wdAKf8t(Vv!~ITLaBoQfH(uR#X|w+uAMF361@_h@13M61vuk=| zkD^vX)Ko@M2bT=&U^Lk4aL;TG%EMU<>FoJH13lLmiC|_4c%&9!&r>VDlHbevU?WHa@yDX`wro0Nr4x zl6u`WN5hH@I(TH0oDdKI!9ysSbS_BO$*y(0&D@b z=XgnuM)+KOgkMSv;Zy>I0fSXU7!B@)_~3q+7PylMz~ws|pS{5pydg(J{7rm_zfKF{ zoe3ZYZRo(Ycyvk3EyfQ=qusP7_Q+-fL``L6Go1i!fVQH;<7jX~d~mzc0(U9_xILZP z$~#1k26;F>$g#9Qo=yoQ=l?hwq!=IMgK2@hD*?!WE)l#SM`L>=KDLFlu-%;&Ha!~K zQ}MAqnHIKt(!wT1WBX)$Y#&bx+r4RFI~R@ZEAg>CpBA?J(!!=iWBYM@Y(Gj1+nEH| zg2phoO;bSs#?cU8jSumav>@J}0AkQFJ%XrqslzR6V-H&{hp4FxTOLRNFyIi7&*drX z*t5JAga6^^N-f04oJ|Y!*#ww{&e4qRbT}H{vH19oq=oOnH1T!W8zIHVH@V~NssH`Xwc8Z2mN$fpv81RM|l#C2L0*yp#LT<&@%}@ z4|G~0<~@(R2S=m)T6~oMa&agv-(KkRNopUPb%9Fe8plllIc{2GyD9`nQ5AIdb!E7l b;~kUmpAH@qMYFGruF!0kVd!_bHIw~6E4=tJ literal 0 HcmV?d00001 diff --git a/en/doctrees/metadata_oidc_op.doctree b/en/doctrees/metadata_oidc_op.doctree new file mode 100644 index 0000000000000000000000000000000000000000..fac37d54e105a18b45457b976b1506dc0488d2d0 GIT binary patch literal 94308 zcmeHw36vaHd9G!xGg?Qo7F#whOJ1b0yL&dRUS%!zSk_`mUNDwhHQhB+RqE+#S9NP7 zFAuO;+N6>Y(+0vG$U?$1JV?la#EBD#NjStIfne4^FmVrQpm-M;Vs_q(@l-Q`sapFHopdFRo8=1QX`E7h}kv0ScdWyxrnOUhcQF)3B+ ztv9u{zPj~DYm3>Vi&KWy&`VOwJP$rfvQjDQQnhsw4_A=?x>7Onb_9z{+GHTSywJSZ zzNhq_dPP2;KY6Oy`@*Y!8UNn#!mHldk{6$B$vx(R6Vh2qHO2R9Ta+tvQB6b^>MePh zF(#V5V!f^_V~si>P?qN_WdqqW7ndrcVc;gN7gohd>uO24QS*L`iKWxJG|v3=oSm%f zHfkb4T~gB}L(2L0mfS0^ljoZ~MVBW0TI8^^33rVGfz_(^pJG`WSE@=~ z(W*vXH|i~OK}D%bt%D02V*tJ0Xp9+kr49>KG?e?pBEk;(;pU44!d^?a(%MW z+bamdbz^$rhF*uh`FQFNwU9lwp7xpcFN-`t7y@hZdQc@_2=X`L-zE5WDgIpssuqoF z`lLvCrNmnDX8H1le1$w9UnOsmw;o)C2(D>FL|~pjrnf{V8Vb_y3o>86Ql1agS6g-k zWOop0wo*7srO>E)IZrJIT`CtVQoSze zxwEl_aM&&8>r<#tj*g4>W&Zp}GJjPJ^Wnr>a`BOtEXohLOv^UY%Ojbdie!2@$wV8| z*Adf3O(`dtJ3Su`vpV9Kw#Vu23 ziezm~Bx?^5Yg3|LRjLy?w0QqTsY~;)7_MB*DKj(qloR|O>L zW6Jfl+4EI&ec5)E9bem94qunX@+A{rx8IW6v&W-mYHBJkPM{J^XlL>Y>XCxZU;*zG zVxv+oj4M!|0)$D!eN8`Cv~E-?6B9-Eji@L#>awQe6+|*n%WCEE5Mc`|6FE`zapT_b zXgKMZ&CF!TAxDTM$C4Nb%ILoQUQL%giqcf31mC1DxuG3V60_75C0+7yVBgMD=s*S9 z=`hi8x(>+8VnL3x8smZ7ytg7Mlg3d|$Gazb+ns}Eh{Mr@%73GefgE0#ks@BMtrUHX z*xnc;o7=s4wz9udhN3g+(6uR+u5y^JnIiFv(2wZ-)-Gh!YKUi8%TdFkN1XoBnJ2Ey4H2i(~Tg+*jhhh3_qpfqsjK*X_RDp z@VL3LJ8rxzIfiw0EFpLK2stKAC`R2Hui&>O-4`lulw*xehTpG`3j1+B^w=ZfdR`*@ zF?gAAXt*YphI$MQc(EY+J=F22M`T7qv4t$g=??^gT6HaAAjIhp_vij?NNC9 zv?vVc++j2q%P4(wDIT%j^!6!6NjoFy9gK*SogiK*vahJ_z}YI>q+E|ad$OP9{m(om zcJngf2KVyd;LgY5_ID}wIUqJ4>1O1tJ^jr`b?uCTF-6B9Lnd@_n3S9rIf`cc^9b6k z#f+vM?4GRl%sT89{Orm95E^ql>{*Vm*BVI0-);s(qDDg;DRPEr?con+?A3lu1Ku=( zi@%}Kk!`$$P{?+}8Sq073?>GLTI~_i;$VJ=Uy8kfJ~v@^L=zE(jKv*F%^CJ^>|k!l zSBu=|o9*Y689euDQYJ&K6scnvgB`LnoFB}F9YmDM&TwupksXR7b9N|Fhn=C$*rCz& zY}iQ}rgv;-B$*vH)So#!lre{$;f~qKsAi3D)U1)@ngw=dpk`5|4m%?qv$HKL+u4>{ zvqo~;l4=&%q30Rv4n^v)v#n!xwr9mo_~VYNx~?jZcN5=kW>^8*P@|m?-EUFMg>)elnjxuk{1zRrHhtsa- zta$t^jq>(#lDZsLv<^=@yWlA!g{F*zdp|AeQ@jW7&yTAcW13pEicvdgInCFcjd(_2F6%%Tj=)Olp=Dt;5rGu{_0DQAYZ+ zqfLFHtjMoD?sFeQLFLKFiag!9zGHTVv*`ov$PaVWv0+$;^O7FL4n5Df4@4PrZ0ClK z*%`@-oe>UpMpD?J=b5uJ;<9sNEIV-ul-axKj(q#usjDwO1q!~Ox;}jMi{kOKl#v4Y z-%)Rhkdeg;5-Selk)Z?=5UkEISWU&*%8j(S5?5_XxK% zFakrSxR?lF59mTpi zmQ9*HUA!FxN{ma9NF{PT!J5JB1+8!mm7~PS6mwve*!A&gJ!Wi*M63OHZV25QOXwyd zbk9VXLI1SIQ0-el&wN0g-yX6Jep3m=9{O6PVI{Mk|S970hkNEP0rA zu#Elj@=d&?;wqALi$&{OL(v{7FDlg{6%W;!%{9!&zkXy#2=qG2QqIj1gokCxM+5WG zo@w~-h&dfc%uE1qxZWSj^&5z58;K-T8r2EW0f4!yb4mAwPOfq+R}S&Wm5*`PQ(M;O zp7aB;q_gP|`wtHf?#hh}4&{8q+@xGm-B9wHK7m=p6$PIi3v>fhp9}CmGB8l2Kf89Z zUxR2B3IjuV`hT#veV~BVcl4O_IJ`fYY5vgg?8EwPl{ zMs~XIP;T$&{-9A#hz~x9m2P5Vd|WAEvZq9|ut8iwDWlCC+*TMIDhv-42Dj}Q*tK(D zSHYMFRqI9N$sCsb_;~Q{cof{=r=W{89fY^WBD|dt?%fk=#$uD2XaL^8wgUbi++G+2 zN<%B`8V0^X`wa5=CDAX}_D>JpUM_SgNjeZmVX92^1oTLuOOha(Dfb-4m<#=;*37QvQADZavue(F)tK|x36#bM#LSQgkM z^8KUx_8j+sOAS3&kaK2V#VzR?mt{OanFgujaWl-J^o?F@|i1!_Z+z` ze|s?xE61mjZ95eNWy0-qYj6+$8t!k<2(*M1DnZQ z1^dL-B2}W#SL*^d=ZG{~l+Bj>(yFn*+=Uy7w4-~Dd34n^4Lc?%Qhl7Y#Ar*(x;S3X z(Vd(|^Wk!s<(wNBiJGG^ACG+4?Vld%?T)E*n2J;Shhu@TxhKjkSc*h7$b)0`b=w#E zDOk0HIX1Kk&|UOLD{%&fqj2?D-a{ozH}iIJdl*ya{-q`DfISimmaRAf9M_j0nyBh~~ov=!+Xof$zRc>Bk|0anxHu(d`*7qKvs=F{Xx_eGX!uU-CV z9(~gb?fn5}x}|I=?+o(1UudgZQ1iACJxZF3S7p z@gqC84`AZfz<_VSnSn4gCcQ=-du)h$xiB)Yb4R4yE>jH6jl>5ceBT3el_S7u2{|ZE z#G;@bQi|xv9?9*~O1p*!d><89;uEa+Axhm77YC z)mL!wT1zy7ngeWgU%}cxJ*e)-=;;m3)Y%;O>0MT`;KZyyC_tv zs+Mb*b3Ql_LfY#+^p$Jyu7}$lL*T~kMNervXkQVF_HMG>BMj}a4$D`?RxyVC4ucKU z*uHVzRu#blUSj1-_m{H&o(H+3nwy*j2mO7q=oQxJ=Jv6cCTG!bTqTM3Q&8*;ct)`TW+~BULH=vD54qHQc?|^Qou~N-v7v#;#o5f$q zo5z}4L8hHghqRNiqzw~k#}4e>v2AdtS34+SeY}*D%CtcR>v7>{0sqKfs1_`CZhLbX ze78JUS331RC3Yv%_w!`hH&HAx+VD&;JBR-1U%p$NX4;$7RgBFv?IK1!+u_0Op-iKv zYK*w$nn>$8X++qYFpFZpI-STpeewMYT53?kWWE}2K#lm3QorEk| zF^n7={eW`Rf>z`XmLyfPK=|B1K_D(SpAKhY zEN5(N*BUB1*Dxe!tO$x*m&!SG^msXo4xJm=9%UpKC#C3TEXAM4n7d}0nNuudDYa=<5Mx)85CoNJ?3JFIqTUv+po$CoOfQ-)?p4|C;;^# z_>tGCXXy|2_mrO@MpJ#-jq?X_Vkt`aD;YYnD0)f_uGW5WU=Qq2^-c`JX;@YB>TglxU zE?jwugr6f4TmxL>&VIr!p`T1CHrn;qT!>j;*bMn`b4f+4PBbua z1)BoXa6`*nAuAJd1^?jWwai9p628uv6@z6E3M^9i2MbvgwanVx)j8u&) z6L=SltlIq%1=4RR0Rq;s2csa?g^DB^*lH2cyS2P`l7{(ck2JyEKF08>{7~n4@$CP3 zMkFfzB5V(UIXr&DTHha?WvBetL;&(){@auyBEr8;gs)R66RhIzVimtDHeA!N5Oq@5 zHUtWqHB~gP%14FOiV;io30-T{+8$8@ht0z)v{hu=!`Nz%?Z~x?wa@aw3y6>N7cxG6 z%J@*{oSO=Js*q^S;8y{ukCgTnXha9ox6R_J-)N(=h}h< zt5HvXKiih6AGGf0TLpNH+?3Yt&=F-p>BT08 z>NOmp`YC_w)T@|R^=kZavTm^ugu1f7f1hNObcK!mMFPHqBD4T6_4)N+ABP7{*hg5d zlAGNiYyntq=Lppq>{b2!#~U@f`!aSe688fh?qz<@9&m#nxW)k?2pn4)suhk<0pQ8{ zas?q;r*7hiRj|BTRi0I~F|FKQZ?>pc!eh|Dwxk-}+Wvk_mJ_S?u7X861|YHsevNWr znO*)f;Ucx2^_WbfnKXD$mMahpFY@5$yFw14cpsQwX>NXi}MrZe6* z`1gu`*xP9QVaC`N+1(3Xew-OzT+3#%vkBxUoC67D=QM)k9o^M=i(snAHqINc4t~HU z?drb~q1HhTedau0iPHmP%$KQO<;m1jZl*qDACZu3osV7!dtgI$m zPmpHpDyiOv$kPg^Gn(gGRhmH5rYdKN)+kk>2eY9nZwu#&RK?3xC&h-%F4YF2>!{e0 z6PUiLtmyBrX_z8%E>=^1mx{pZzw~-uJw^E#D~aUpu&pS+!+}0%>eSYMm?M;J>K|lY zXGBr{n!)T&QND(-9V^P;QJ|orP#!oG#mZ{3&X(wqo*b} z5<7hTlWXBM&0vFOjtxE4ogATTHQC0zrmD%2JCEH?qm?wUXw87V$`AS4ZEMJk0H8_iY+;T zOjL`FjhE_1PytxIAdD>IlL9Fu`#uE~sU&Ai#_fI6S2Q@J*0&`2TE+bOb4pNy|vbNFpO*!gW6U z4re!CRkOR8YL&qkIGCMOVRU6Q@N6+_m@fc4ol-mAHQCS|k^ z&ZnIG*qUwf-)we8(ALbA&P)s=H-UNZbX1J*P;mVhi#fCfOc?rG%Lh-ZX6@Tw$`n#G4A0aZs4BIkG!76b1bw-{cf~hR09ZZf)s& z){cM1%{2^o=W+OF{&X8hL_RL_eVVc%cQXwkahlJafNb{&!qa^2=C_#RjJRau3YIRm z3{{VEgtD8RL(FSxKaOLXPXjU8fTO4ROu+-^@S?#1AP5_KfvPo*P@Tc%ndbAPhdXAP z&s+F`zlj4v5IDB^RNu%EDgZoLF6{Q|HjY^BX+Cz{{N=WK)!qD_-u`~9#%M@-{6w!<7U(G`siZ;!jL_`q${r4NE zOO@NOTI3|xl%Rdw1h_9CKS^jP>z&!hT=)2eUQ{V$J22yD6>diM`02rH^!SIuxuPDw zm#a>S4V$>C%Mo2i#g?3at)NdcW9Vwe(MA3JwCD~yC0HjXCl4hZrsA-MlGa5B^Ca>p zE1~2rh23Ahor9HN6~Gp*>L^Djy9yj&UQ;FVavq6v2ZTZ*S7CT(R^;kPBNLH(m?CNu zIfCF9xp{f7I4yX|<`^s^>_FYIm>9SW$HJ8s7~sU#3>~_p|*?lI7_OR1B6ptq6Me?D&hUM7U(>^BgP$O&*)! zs(;B5%9f?)nAe$=rGIC5XI7S8LK>OK()^`SvP2N#WXXb;Y<|Hq!rr;+_ZacXM$lOq z&9yA$!Cadxy^QFLk|laD8?tm$I9DV~UamSRHtgT4ZbWpPvSd}Q5LX4bN&RIrtElwW=qBe2*HKH?0oan)9h|`~j zb4B9h<*Jin!;Z}Adl6kn#g?4F^u-CUc9;^NYqY4Awv|X$sBckm*spfc!91CIk(Cga zOnsAsm0%UXCeG^DIYQYo^;PCIRi@U{tKDvFGPL{D&XK_pb`C>sSS5i#>-u!4@6H zPJJ|L(}R>j0c8N+aK7X$Z3!i-ZoqSQuO#2f9{G!I;GnLq3@1*d9sD>I=>_Zi+U~o9 zS64BbxGZ5a0~GX%sQ}}&m$UC%p}7RsC+StOf}ICwf&tb+wai`4Hap4No*_1(mu+NY z7crYGU=QNioMP>o@5REy~7v`}o3t^Oo)3!Q6`9;2cRkG~zm%}9}^2eTp4^>D68 zq`h2qQf%0yTRnp4I7QkLmgEGcFVff~!aDXPU7_DdWnn4wnusu-JU_w8CRo$_Rg6@| z?nV9r2OmM>#}47@&vAsZ<+;hcW-iYkWDwO}{D~3B@D>lIUzgQ&2$-VDINma>$&_l6 zCVv9YV>Q_dJPVrqSI7nDx2fkCprECwI~j^ul4P6Gpd?$Rn_TsRR*9|L)el5~37dUq zRyo&_ymWblB)~sUy}2Yl3b+k9YxIc zk+rf>G@MO2BEKB(0zo8k+O?iiP15?) zcpj_uR^VCC`Ue>|K>-hIp54@+VSs{OXIJZOO8d+U^KoY3)d9QI{aYHDYvQbi-cdsK zbXs6pD9>+9&aOFy~w2S zFLVdf!e-}=sNrbvPA%X-rxrkCdO}+c+K1KR{h{58e&`Oc-N|ndcTB?|IFA*eP1;e> zt?@N`x8fXXyMK_)wTkm00WJ=!+>2GCeU#(Z-X5=d! zJ(!JGx?c(BirRiJSDh3aj=E7FMs#6m3ilWSZBudr({KAP=YFM2 z>UQN}U7p|~WSj@4y4L9b#AtDx+{gu60gCENtdb?y$Ie=Tx$gWtO64Bz{OGtD+4-Rd zv(fo!g>yxnA1_y(6dMjqQ#C}FWSaE#El_O92~5B9b1{u)8#NpQDHUk}ep)B!|4@Ng zouCbI0lm8X5mrjcR%&;KKFGmLuo~b@HuVD>p=>_i&%CB~hW2;c8L|ehX%GmV7$$uY z!_|Mm2$|V_$MZ-dlYYn7DWbN12SM=nJ9x%xZPt*aYXMd<2M+>F#!dN3QhnhWQObk)mM zC&h;I`qU+ej#F1H9Y{_fTV0)`L)KEh3XW2NgmpC((5o8=JWQU&wxY zDL>go%6`eWQcbSfL0iWOkZPHMNXFZlth?1B z@^n)ddGfapR(_IoAXq(c;;Oom!AoYMv+6O|?ZX4aW4L_~aWk@gpa-+jK0FrA6}1mu zt~x0;9Q>-@kLWnt2TRqG6PSMcumP4|(u-`CTiWZuyQwg&=HY^d5vftwgh)_yJ1?*gLgV(Xp@CMU{uVk;y;TtGEw~JD55sS zCkUL1zuU6`3wW~q1`D=~g8egUupGD7zBe$Gk=~zQIZ` z+HKowPs|q;eM&KszHvOtNSWDY_zg%SlVA`F$ z>^H-?B8ByG)k(2UBIMJEj#FVRO-N2)`U<-hdkK`Sp_-zhOjK!~d$BUX_onk>DjiF2 zui%Qst2IAm<(F)~w)(!r!CA0^RKfHQIYQYLb<6Zt z1nKn>xE6lGuMM5eM%sZGlB#RMY^41Nnmilnao^Dh)@-CO5~!gXoQb5tvWd60R>UGR zSuKKC5R=)r8XB4#*O)QWhy>ZI6e2swf1lFYKL z*pd^Nek*c~uN9H1CH-8D?Rvo7ki4G?$g0g-+=e72BCnqR7Ar-rw&d42mZzCm{^%>J_XboTIe-BZS zpxIFodDV0;vCFrN_C^lof_&G(_jMehY|Y-qyrydQF>cMKlWDM7SogYJWbDkWZciYM zOmthLh}v|UAoz6~!!X2O1T~&f*s#0P?nfvaDcb!?_z7EGXKw@#A%>)CoS@y0BWU*8 z-GHqVZ*AIbk(sO_!D>TM-Is#TCsUl&W-he*4}l`^7C_qlLEP+IyU!rx2RbDsnf2*w zH%4t};R@THw&PKouMiJbMY)127O#SSjd*5|E7nPqVZ$`XpGO{@umU#t^GZEUpNY4kcuJw>B8z)#r5 zI@9P25JQ(5y$M0H*XXmbY~rm=qb)L%)go9)D5@W@sFFLNomG;#9<{lf${bBg;E0%8 za5Hk$h91nusErcN6}2K>t~x2Ua|pQ)(IuIsuW7ZkEjfYdw;~v|arNIDV&EVCe=QY| z{RY4rk=K^Io|R&<7296`9^+sxSWO-T->>2bWml6&nAg;{WR^y4-p81k*#_kUNF$R5 z<+mxKwg!bD_#2e8Q5zd_cdg1FQx;NMl~2OY^jei?5JOV+P3ZYQhoITFDi6WNiMO^^ z#Ue9VJ%ZJRqIypXKA${sR+qVMRnA`*(W-nOFe6(PdN3QU$_3$EQLEzRs*_@S7$N_) z(_%|bV8&XNsNtZG2>8C5Bb42$Y++tg zTa{THS31ntnc0@*E~Jr3%W^+O)Yh^P1b@rIGp=OA?yhyIP&QIpmn!^(t**0o78Nlh z8Dm20auz|eZ(aTuY@K*(Yh5fdlT{>GZ78aPDfoP?3um>N>(=EdAZmMOc_(g0wl4Hw zHd>cw!nvZ>#miME#r8^sd>f)mGRwANOHN?=txJIxLt*KuQ7>xN#L$k%zrIRkWL4;^ zJBZ6`WB!JfCD)tFmpS+gR+d+R_2)T4*=@|{nb*`dX68r1e#A(b*`{UQdX!uiqhLK0 zQCrhO5d2L`!YG)Hw!0Q(J*A$~qFe|+-L)uB9<80n{!^#0!x5}$Euu=Q!wF5xW(3W? zX?Zm=MFh4rEf%ZE5)!N}6xDySsFJH=XSHRno0fa1@FA^%;jmkAGqP!+2eZ+%sNq~u z)8gf-lVW=mA@?J?B(wB2Etbe7ClF{_lD)nar_3V*)|vD1UTIUCiqSeapK|i!1uV?g zh|{^%g}50w>WBjT&%qqYSZ>S-cUJ34MbPT9#1p2;T(XnFm_JZ zGcmgF8tem!0|E}+dHjTM_{a%i4Ce(@OO-}hDqG)H0BYLtxai(JEp)F5pj)039;W4V zIR&4uA9mIPgzma2KQ*nCUmHj{wUDFUhP`c>x()7P`Tc2Od0ha@w9D3RGp8Moi|*6Y zLic(|ov$vtZRobr5B z<;kP7F|2nqOJ{lTHoc76aQ22%0yfeK>{^@eAXha}7jfPI_OErPp=VN>b-h6gwRm#k zv>^WvWF@!*guBV0Vi?8b+*v0$?iw1{;T|?Hd@3)D)`iK2QD@VJM5QY9Gg@p`N{ZxY zvTe=k)M@Nl?6Z#1eS32U_U}7YMBQR%WeOwtA+`n8soU;8c&f<7Z>geSHdj%XCKRKt zi)?Ch+kT5_iAL`5Ypu%zY1$;BEp=GlL^d);tt_1a8gc4HTBbli+<`6Oj>+`$#w{t4 z1r}aI5ioJ z{4<%ZX*%8m?ZuDDGVS)wzc{VF`TNl~?=croi8`%l_3uye5$ZqFfi|`R3fj0pjXB=L zH(49!7qLnF8Ko@go3MGAbQarIN(MW^fb~P+&+26eq9LG5(5N`?xJO3!QC|ZuwMJbM z%ZRua?X%zyRm7Rch?IqVprPn^ITq`w>SHZ`H1Xc;jvf5}ih{OP-Vj#;-U$0Yv%(La zVZAo8fSi}{zP7^iV*B?LQ=;J-d!`X34Abc|*F==O7h_cZuqU!*7*3WJ&`&SS!VT>s zy5X}^!nw$IW@KJsQ5nRB29zVq2AxbUac+5G*LRW8RbiX!ze*;1yk(v2(>LhJRX*wA6P1 zj;bK2VXlw#sFcYYW!Cc681tYyxp%T*E;6)+UXofYb+9GRGgp)vI+Cpy?MH{rWzHQs zvZ;00Tw+M|I{G_C%j_#_r3MD%jr_RIR-=_$=AygkkY2;B!0JQD%VD!;LaIs_*3fiB z(Sx@_d|Zco;Kx!cC5S@xG=BElKO1@lzn0gvQgKWyou;Qoi|rF&t{&I4dR4>ezuuFB z^UURR`ct(rSv*U7R=03x1x8YoTCt=}P6CpF_%>R1q>9Au6sHs%%Z$#Gf$kS2X9sX^ zEYl_GR~9SM8L84bc)r<-^FQ663(Y?1tOBm;*oeb$JS{XAmZh=A1mas^_YL7gm&8fj z>A~1eNuqqWn&t|nT5HscC}pioJxFt5qduP7*)lHVH$ajMdMd!vGM87x>O@1txv1=r2J?KW z+A`PZQc2Ux#j=F+zsg8PVJt5~r5RUPNkb#tG4^WOu-9)u5vHZq*E_QPzrQC&`vpS>5cSKP0md)V4E>|8E(Dg&!0<}%yx^~nkn>#2)ls6^$u+&Z|#yaZ-BS#)csD`7>WMn>|uxym?Kt&3-i zvN9o8@DC=uprVoGFEb`Z)UyW~sMZFETEl)@KZ_NuB-+$of&+Mw9~ug0brLKy3K9Br zqlP3_Aa`}84*o3}cpL_#mDnOSR~J^3Qef}4kUwRT?6;zcR%Kkk6bWWCIR+6n>gSLJ zS(55VWNit)P8ZpETSc*4#uzjSNYm`IPoRUnR>mz!d)%BaRnN50p)!|PYJw^ZYot$? zs2|vLPShtPs1ppQ51E2#)gh`FYb{IT2Go3ud_cZNzE>WVr({`vLViqsN`9C8to(8L zujM~$n5zR}sG(qi%=5?emVChMEy+^pH2bL7lJ7N_HLCs_Q)Z9*&9Nmv0pIR$cT0ZC zTy5(YnnJ?>IXT#;{A~MeRCf8V8-#D%%fJ#%DVK8Nu=|s(E$VaVnyYs%g7Yoj$XQFy736FpXNa5vIX9AX9XYp?GfK|O z$+?T1adJxJ806H*c@;U2kn{88yn&pzk@FUEeuJD}CFgg@`7k+uOwJ#Y^B3fNhMcdG z^Cfcrk(?LF`2jiKC+Gb0;rx`YR?^inaxNz4LUOi}b0s<3$r&bRFF7}nbCjGz96IiDrx8{~YA zobQnHPvrcFoc|1g$;`9KOtZ<%vdK)c$;`3IOtHz#u*poY$;_|GOs~nzuE|WU$;_?EOs&bxtjSEQ z$;_+COsmPvs>w{M$;_$AOsUDtsL4#I$;_w8OsC1rrpZjE$;_q6Or^=pq{&RA$;_k4 zOry!nqRC96$;_e2Orgolpvg?2$%?o(G^pjchMD7 zoe$6zQ=N~|6;qvO>58e&=je*5&Nt|asm^!kimA?z=!&V%BC5trb=J@oQyqb>nCj%{ zimA?Sx?-wx3tchQIYC!Ubws*is#B#araBMN6;quiT`|>plCGHQyqB(+>U@ZrYoj8y;O~v>a3?LraG6?6;qu-x?-wx16?uI zIY?Jbb?%`nraBT`G1bxOimA>k>58e2NmopDewnVA>ijxgG1d8Px?-yHM|8zh=Q+A! zs`C}PVyg2Gbj4KXKj@07&O8zgraCL=imA>1$ zx?-wBuiH#@*qknP!!rE5h@4N5^C#q-#^K!RBsr_75noLXouRJY3a4Q%_xB>HVK$eS z6!b-@UxZ$Ub%)*;9Di2-$$!W4hh7zWos(l)#qF3fuNQ=Fy1sGZk@a@Ty!AM#vR`!g zgqtG0_UUzc&s-ah%YJg6*^9TClGdPim6o{_Q~fIF@c{!~o)_=6@4pG?UfVi`ZaHQz zpo4GswX6i)mm2?V+7^9qExq8FHBy*G57ji_7fzEmwZJ+vbEE^4*Bj*&h0^UAIZ(?_G( zu;n^+JG>^2fi1LO!RMI^s13u5!|34yN9bKRIEJB)u$a_s_~Q%(Co!`7R>Y=LS6{F? z;=(4U-?~}%x}clrODx75@HNI6m+_rXf1Dra(N2M?hY`YsDR03W6Ai>1d>IXIbqMyR z1hD9+(*O-sFq-dCKbH)7k{_~~73531fP8g3p%A%B4%^5?RGytxa=*C!XVI)x!rwk9hD@4xcn{Z3YRX$pI%TAYFxJq?Vm zGQi2@+j9|jBfAJ*J8ER(+MX-AzP%lnfLA*$Rg>{Pz>l|@ z72d5~;60FR)7ErmvTSeia5C_p;|Jc%3V44Pz^_dP&LGq0x@5G!#*g;BS)skU3$(jp z(fVhqCu4nvAM4XuVZEjctnn?BA1gYXG*jPs^G$~SWq#<-X9Ydi1@!H)#q55NNe24w z{6N2#70`SaKx6IMoyn2@;JgS{auutPHgHaC(6_7(hK@5u`6@Qi^?G2;e5SUoGSBQpkeTe2DdB0pF& zE3n&U4D9w~u)oO<_SdrlyM2bhZcD4PpX3MoM_Ga0(FNG+BKi~dY!G+p<+gmP9{&wL z+^=K>cjpYkO%bX8;)nYmS;5`a1>Bt+rJGV~`!440L#=?42 zgWZx9*lW80%TsFsHVy86ez-Sh1^2ox;PRDiN}Vn8gS{^+u-DHR*x}^1_8dRhGg*PX zVaC9YB!hhuKiD^B1@^`+!1C4F)YpNh_~HImR&a0X0xn;zP3a;3DL>dh$qMYAF2F{# zv@}6OXq*)$8dyF`Qvp&2(7(wK_3K$dy}1jh5hF8%PGUesLQKe$tL#hsSbvxm*1cU| z?Qicui4$qy)?UKhWm*ldnRJ=O4|IVzV$z9J9Uk138yOtRrHrtZ_%WW! z3gazZV7#WiRLhe&%!^Ad!bkYwJ(v}|Tf2a_wH;nbOcB?&@MCLbg>AG8Y!Pi{xsszb zuN7q+`xre4=~0r4@x%O3KbRHN+q!@nF}V$2nZ=YI!Dsl<{aIG%4t9ZVq}@o_>{K>C zGyOBoi~KNO$O`7|UBE0Pz)UvNpYkL8pR5ob>H=Ye+F*uHGPVm}#@*Xl2d|m*b`E!e zEu!?43GGatj5HbHFh9b9tPmdQ0%1gFl@KO_JH!v}wyeM%?E>6Dd*!ny&_YL(Ax`i^ zEN2DrjxHcZO<19^czY%(TaS?2mfw+#_SO7o|5sLMk9C1I!dj)l?I}Y&Z|4X1)~vuC z?*iOVyR|BYwsZTyU~Xt&AO++{`9XdpE08BL0$CEZ9M+ud8Xia)q5LdA$Un~typB1*dvcgtRmY4aLayR$q!D}YX{oPq%OL-~0gdf{QSz)^;D{QBe z%WVfgwvnu`y*w*yDep;l@MAli6}Ef3z!ueqp=qeOa!sox7vE`qh;mjCU(p4`e0#&E zF^GCf8NQYu;G=)*|BYKXR^_LoFCusW`*zmEb*nxjrcr2zQ4>0Uojhe=#35!ZcoAYU4DGu&I;eD zF7VylZl9q#i7n@ImJCToN~K&ZaCdMPz-uNQ95EZvWnCPv=g#5u<#Ah!@X--_?dGs1 zFS({(#t-^sS%Dtw0(3+R>dfy?YeBE&hq!Zk5Ut(E?A71nU7(E6TWmrloy`p-m*SoL z5RYXDv752fScoZ~r8Itsl?)+vGaMHSF=e9Csq4OTc+(H M?QImTQ|I#k7gf6mPXGV_ literal 0 HcmV?d00001 diff --git a/en/doctrees/metadata_oidc_rp.doctree b/en/doctrees/metadata_oidc_rp.doctree new file mode 100644 index 0000000000000000000000000000000000000000..78a78068b02b577d4f61823652ffb81bcd83cb12 GIT binary patch literal 74448 zcmd6Q37i~9d9P*NYu&PB8{2p+`B*LPnO*I!E}vp0*=xy?kmLg!G3uS^-R{=x%(%Np ztHt&UJgzb6TxPhhghvPjc!WH70YV_aBNs0rA%u{G#0iOClJ|0v^AQp||F8P0?&+gu zws#f(tlFOLy8i$A>iepztG;^m%C}s8*|N*%KYOFuRJHoWqFk-k8&$>Z*lVhdN^4fB zTb(y|cD<(aRA{U$}Rj@kh zI&(_42V~1Kw5gT_2vp_eTGd4L?A4W;Y?`=<>y>qR*11|!Z8d`*Q*!0Jp-i(lYcI~$ z4wy}upsr~eim4bElupZDZOJo~qN5I|+tuav+Okg*ey#G@*@3%eiNH4M?w@j1nbzu> zr8Vki(J-x!y`rYomCn(Xtto)M%4|)UmS%y%MxBf6vk&&JFBS_=P8m-Y&<+O<6jW=r zHZV{q6z-TZN_P!-^ex9zKGjP0*m=6yc7HkK0m5#urd|cA)N4TgwfJ{E{@s9oH-f5F z(+y)*rn*vL9d)OAQ%k*B9ae8u2i09iS0RJjS}_^emrofT*~^BK3~@=8tGB4jf%+wm zTmjk32w6o{D(5Aw(x^XK&}QWs1sIFP68>ku%+ldTxuO}Bno^!I6s2Bf31(&Ee9^ox zLqr^y)2fzwps;(~XJaKx%ky#1Li2X0Oyq32TmxYP0UAggt5?UqeD`?AUfwdajy)uf zj53q!Rjn#JQf)6A>Zq?YiPZeo{0 zFhd2cUUD*HtLN+RYnBFtSW{{sb-Zzy-~+MG8ozg%^_{G{qn^t z!8c-`i8EsMmTu(nHfeh-c}5(03T#tA-oaX}V5v$$xhT&zYl_LplVR1XM4qK;WhaL6{}=66^x9W8xmx#u2d{(T7eWnY8rKE zq&!@7#u_vj^o*>%rlD0U6b}`12PvU@{(uDoIA&jOUr5FNlMkr$G*pGFBW3>md6|j}OUcqGvmWaoqUN zcN$HlpFQ=f%;U2uCmSIpX9CuL>xV zW6F=UGl*68W4UsbA76Vq9$z;k@}&}A$L^I59t^0No0}`jGw4J!jSEE${Yb-Lu!MIC zxmB}D(;Bo-35uzK`we5h?A)l;W@gI%8&O$qS!%<;D~MvEmo=-?5yDp1W+YkWxbbfU zG@SLsW^pRykyA({$5Am*D3gbZ6AeQND9X|@6~rd}BJJKAr(&+~m6D-w9JsfOlseRb z_IXV7T&@T5#zc_Qtj7c(cTUt~ZPq*~8+iA`XuEgN3~@A@Nc&&QF(BcE871Q7+9{D^ z#Er%n+1VW}kd?!|G8A7)kFFhwbXB8tomLD@u4%7gHpT3ht#B?8vR=fKh3NsVJdP_j zmcvz7tbnRR{ZSREp~uwDM5bODW$ONi&zw@&Ft2Z#xGW+ZUBz>x&sm0B5=W35#UUsh zC1B@Zf9&uT^QgH=oSK7Bmo7K`N)VSt8a1StU2c-72}fBlHGIW9YHm)XW;QA{jyiJ5 zS!AuWgBK!4-MC!EDJM5Jubg6H2mIx%qi#v$@LZHbrwPm^<^%gMVvefh^N0x8)jVyE z^f+a466VHn$cn@XD0*psy)RTZPsVOdVKn+4dHNYd7~94(#_&@q98GS7Ku0NV zgn*m7`{O34k|$U%NhIVUj*wHzjAmNSe1*6y8CStG~CA1p#FJeuER>80xuUN!w>X4^ATH_NNy3S@x}z9q)vZ}nGEs91bl3~xKM4m z*a3~l7DQvT<{qn3Dy#JErF_D9<2$68mBt0d=wW80>Lm$UlYLF~C(t&zqUA^A91vy0Paf34!(QaEhvtU(q2(bD#Lg4_%%F9bzw@NgxS(Nf(G$vu7+n`7MQX&( zrn&I~f_63%X4Q`NPgZwjJ@!h8>>UrJrZC}5rs8iulOl05BAz<(rfJePBkr|S4Q8FlHx6lkH!VXWjy0fI^k>YM~bsS9g`33v4n#d?3DE@S+WV%zbBhqfJ z2l>x;y3eUHcpmhkT&7zoQ%@*HdSqv`IFb)L$S9MYQE4QV9m*qjb|_Pio!z~$Lo@98 zu#+}b@5#DXgb+<0;V8`xALO8!Jya zX`-ke+R`OQycY7G`rL$dknjw2n*0PB=s+STv7=^bZ(bS*8AbY6w|?H6p@Aq5zHj9+ zYNkxRo^^X7JMkI_X>;VKiy^{~=E+Hl0=;u*&+LrmGX~mQ92MweqmT~oB|VNEdY1qWw1lfb7yDFXXoxjc9JwuZttdhi`{RhzJB2}Q271SkHPgX%7V!nl-)R3bM}Sc_P_uoP~kc2pRdvIJI%U5-!ZF=JCETHVK&hR}&bLU$0M z2WO%T@=F^dy>A6Ql3yh#9#$oe1{R~c z(uffdb3Tcf#Q@-OeK?WpHxbt^5~WaU)n{Z60M@TwO1iJ{Y9+B+dBmeu9OHhZuBu;p z(vKvP&XzqF+w(0NsQTx{M+{h?9vB*@}%r$E4GTA2@kz^2p@G!AB=g9G~o^ zL3a*t&Qu+@Ht-TS$I* z^3cK40dS>dNHyhR5q}#^8GlMOWk#;~qrk(*OJ^QAQ@R`bXzs*6tXjTs^XS17_ZN?q zi;!}BDjDAk6;K==-aATv4tD+u<#}YZD9dZGOfq*S$t-@ns zXQL|7$Mw3<%}YcYZOmrdere}eXu-?fMB2%NrvkdHMgv|GG{u@`mKe6AYRJ=;M0cbH zt%;Mc(pefFi(8|y9FI8c?#}@A9#2$yEX8a6Fmv`>ownpDtwy^J!^&%$ zulD_UrEzI5$4d}_uMQ#v6bVl(WmU~1=u{#>`-q^!BYWJ*T5RhjJr9p1Ma&G945d;! zBb_=tAssFvj)Z~2@W_ZXiMNCZ>=g>0b11#v0VwDLtJy>TUfoY8)_p(Kee(2)eS3zn zaBFy&n{Z|z%m!1vrUgG6vQaIK4e#3drqr==s1(tb5Zm_m!wx(+CT6eRAsLYLzi2?iYXt_B`vk)d;@nUA|)*)3x z!ftd5^Wfb{jy!VC7`K9mTTnN{pu3$%`Ksm@rz$Lnm< z2!t~1i;RRo0NVAP3mvo>XTq9(F6E$9$?qb0H&Yrf0%pK z?6XKygOe?*h2_Lu(#yY90y+H*px)={+69;E0e+MR92&<76KV>vY#@ z6Kl>#h9gJ^f`?q&hVKTr{dojo+(GtKwuknyM6?f+{GMQFPxaWoI$Xw>?t2UzsWJa? zfy;_;1Fv!FW$>-c-wPo3)O*vb;Gus-B6^J(Ug;3CHj+cbX{Cb65e$4^I>9wQGlSln zoNT~D-UX!;_eO^mXHIgf(bOuYG_pVLE$CWJf{Uo&Jd3_2@sWK&@1TN>>58OO$x#Ixb>U|T|0rIh7p(Sf2kRNQTLG+F zyndgNyI1K~id33gES8#WbTyb;Lw*SucdOS*2MfE(iIpaAVl=uP9oZA9G)Ak=oPybq z=qX;jTXoBr$6q*kjFY(4NJ23=>Edn$wZ~Y?@$JJTNuU^y`*VpfnA?+xBx|NAu^A9( zj%HYj{0Wn^ZWc-}4afQxx-QbmLTNZ2C?4O-qVWQ9j)ce&Q3s*C{Cawv$%&k?`CVta zXuf4C-h2@>uBB8Z4E97hi%%^L?}-zV>(WZ(8Ow+lFy`-_X5y5{SVk>9zNQlS+DKi+ z+YNT=v78PHvCouLI6x~IE$oCcN^=e4JRDuo zJeQ_O>@6Q}CuZC&b|0VHy!^`)yKFR>hfs_+*4nF~%-QJHbHl2xR9BJJ9K^$wn0moC z%HWYb zjVraqTZsAXtO6i^vwd|EM?tnuW%airrSIr$`%o-}UM;VTdm7~U;XW#Qt7!B1qUqFI z@twy-do|JVgG7ffk83z7Wumzr({=DjS1V7|8kO^W8?~MwN3%P;{<`A;`;9wY?c+Zx zz>95>QWXkMIe**@$zeH6jQ`XC{E(72yv_C{D&42{%NY$w4ub8KSR4kw$xqvBYI1$1 zh4n4)A560n9eabS&8Ri}v&!%tNG_VGF}@gT4EUz?RR&yR*m&rRpLPb`7EeGsxSPxi zz7iOUX@H?2M~%?(Hh5($$X21I$R?aGBA1|p&(fqHc}**jLPE>Jqh-+BuTCm55bJL; zR?w?g!7TvR?eOw))lhuRycXRWQ|}<>KhEHr*!v@5Z@W&FU_JZ50zmr>?Lg|K55YGi z*KEu-(PAo&3&(5`P1cOjXf?YYkwt^o@EZAu?0T5ko#BVPQF9zDAH9+YxqKxf^nZL81r38!kuF6 z&=B*-Gz7QMP!syI0PZ2yM~DnZd8}ly0^u6Pqbw8d3RekHW4+P3BRHZgtWx1RQ@>3h z)ezNhyM8N+s=ow(ysA4agrRO68akwy6+>eaezAaGMj1MQui)Yauumg`AnX&YR_TT{ z3>!``^LW%~G!kqzVB~*Dp5{ zqV4()fm{ntRHw_ct~S-EcK4e>{T4(F3)o<$&}|zU!U{RL?z$5!lmGwNCiqFJg(G^K zyHW)0@KcB;D1iSBQG4rm1u*vG0;$|~cn^!3Nx`+Ju>ks<=h*jLxp3NfDJhH%TxbF6p>ats!eaaU(Gv- ze=_he{v=~;Q1zX_t4}k*OR{V>JCs0u#yg2X^^PG(cjc}xTLn=?wQYhbi6gBezgQ@>-(CsO9Vcqf|()O%d&QhYVZlOBpe~20|S6PW##i?q#^n_`K zw^IFnWS-SHz0rKBwMrX^y0pqgqBTyd(1WGWD({TeinK~lt6rK7o>cV~vg@hY(hFF) zR@pE#)NEi~$b6zs`JdDT&iG{@h#F{=PqUUt9}c@3<&y&F!=et)srn}bQn{l3-&xc} z(J0?wF#FRe-$vS=HOik+qOeAxItXYKr>g0a6Q&ssSoPmR=7ORrNb{xEC>vMDXp|R- z);Ntq50*ls+!(DDX_TN=y)+w*g#WGAW=k(%;TmP#&`_;0(@4}OcLKkwPu6%518s6Q zu_HDwr8z%o)U$%7S%yOYdKX-m(Fl= z!c(pO2r|zSg5H|*QfsZZ0#VmE=nX_`oYtZTOQE$s6s;9$t)N!DG#mWs>aRt1JvCc; z0l8=`_CcUxnXzwH|BD*H83kcx8D9<%G3aK$#9BdU4D=-d!>3MVR@Q0-9Qlb^5wkFO^6`hjOrku!|?H8DDDJ#NP8FnX{Q zI;<3}73r{`R=qSETo>yD$gZbmOD|yII_!oaeyM;vsfpDOSWJq|7_n;YD7A^B)~@Bg zRY%hXo$&$IRzjL?Qh=XuXMjs%{fIy+SJO?fsF|AXI+WEk_BmQY)g~KjA zg*!O>9%px*V+$gzm5YQqjhQt_8ojBYtVoTr-}MAF7Kvd zdi@CT0ZJ4$E>s8JxU3Hgng9L4scX6x33n)hKFy$qTRYmQy>+NdZC$B86xQWWqO~IH64a`fW`h@R{d34Jt%Gr&jT}9gUO>pYq(^-_rmRr`=d)>YRC@(2 z%IF+jPBr;=XSvD0vegw~S+h5KD=|!I1`FTmj2P}TaZ3IFoz%gSz~kz!h5aHd@JXnY_gQm$e1st1%`D$AnNjB4iB+mX ze#?9uK*=pnO%~QOaR1CL^U=S@tu=8MY&_p}Yq0l4IQ#;d+Zg2D^WYcq^qWUaJ#OT_ zG`W!bSyhm_YUe>fb`5-V)y~7>vT~Xcmo8S})`fdi{iHxD*NQyAqGk@u1Xk^|kdq5I ze$~z#A_&eFngRgAu;J}gZwjR94ff{fs-3v?S#Jq|ujiNT3zKskL1LmKkRo{ zOYdD_DS|gy{X3{u8Yn{0n-pE@VSix&9S_wGEj!wTo3X=wdaxA3{@u}9(Xcf?j#C>rlSo%^aRZfklC?$pki#9x z9uvSH7Irwj)h7i~xx#*gMa@*1kN2Q5>BYqKSK?lfYc0hr$Obkc4bd(|xR-E_oQ98$ zD%Oay83-~))0k#c%giCe&`_e%tTFPIPH9>wFGr>MBxTp7Gzk>1G_Nfd5?Ku7$fbf` z%5HCuC)qO?Te@2y$gj<)6_QITI(7mnu1;*I5o%qpIv7-N_k)_evyYlAD+cMETBPfO zaJPYXV_jpQ(((7!Z7#Kq_$u)jwGls$o3S>69xR28_`_(e$VLRU>ZRG>Ls|bcvJCjQw=!bFIR^2p|rNH+(zm|0s~k74Pq| zsF_w_T-Yi&-wp16_$bEItn?w62GO>>^Gpi95wr`lwFr*Cs4d*k50J9fnIfv z5#=e#<@n`_360`MoochYX=3jU({Fd`^$*L@OM+o~v|haSbn2AeOTyv>ch>rqC?~Bx z+z4Axye_r&oCcyU?fDSV88@*`50*lEUX0d?v}aJOUYZRKvGvo)uBT>8FJR%?6T?KU z>I?(RftX@c3payK=FEb zQ=S!oamIpx1l(pO^d1M|0$H2nkf)7%GU{jHQfiiA{o_@nZDka*&ay%X@Z#33_XXM{Ts zW%cn4e4H&2>^zs+mTX=ZV@sCdW~?ot2TNf~c1CMOwj`)kFUHd}fD3%4aZ zIa}hoA`~$vcT>AKo%jadoW!ROdi6opWDdu0`3)qGno@ zGd)@qcsaz9ZqJouk7ng8<7es2ih}ZTG%K@|U6)xQP`p{$=9rZTQGt-SB=l!no}emZ z*p{adXJNKw9yz25XNqlkBa-HCTW~&sPP}#57KhAq9TM(Fl+~jd_&D1l*p1e8Z8~23 z?Y*A^iqN|WY3`5Wrejai)lireoL!)QxK~orSzmO`4J{P=BJeF@KtOXNeb6a?pSTp; zWb;h{p2FJ!tMTD!yRSB7N+};ng?p8p`7>d;+c(8ui+I zL4&g}71Q(?CU1zoh_aUBA^5M}zbU%C5^G5h&gurObZ0`1{k; zU!c-6H1!t|Cn|frY3g4<4t;9suOeywni>b@=)_ys8;V0_y3Po99?I&y8TdG*B-nW_ z_3YPW8zNepTqOM+V8+gV(SxO!{n`?(71@%YR=qSEP6X2by4Pk)FJR%e1hZehIf$RV zihYMFf)?)`DkFVhQHF_2F^h5=qNa6U67O)QI1P4p38Zo@$}KEvrbRi^!#fm3jZEtF z_MUT$@w0ShjIMIZ(DHEl}@~M*%pV)bR81zMwHcL20qTV2zH}OZCgG9M4>kVvMukz%~;z)50=8V z{6e%=WLtt-_0nuO^-F&{vP%=ou4YRwV9{+$()`@-QM)*u_=Ysw5}Kd;1J-8gZ?5jj zsNWUfDcmV=$e8{OfmE(-`7IVT)3!X)qiuFmo3C@)9*vU(%3>#{Ed zinlMe1TCFe`Dv7wqgnY`%C5_-5GdZPTPq6qkq4R*S7MM0%fHHby88 za{4@DR7m8g&@Pqi)Fi#@h2;>(GwSbSS*4fSn;c$hmHfBFV^k$Si<_}3nI0^KN?x`p zQY%u)L9KdeHk>o5f4kRaOD|yIDtZ0Tkh7_^ti@~K>p_64f!F#m1L?nk_z{~Xx)xEh z%u!g-aWuwKbhj1|;cyxM>w=tM}RazLXAnHQYg80v{t0#f?D;`Y&c|8uOPdgnk~J6g)6!1eI;jb&H++({C|W9*JP-!H&TxFg^MRQ-Jdsaz%aZWc9D2_AGtos)+qq$7t9h0Zn^Ng6$| zov3hYW@%Wfm8k5##K;IMJJDlLehq1%)_Obk~W0hz$>zwIFDnA@PhVqA%q5p zFqC*%@z8r}daZviNc~5Q03m6hg1QETPU-1=A}k{3AR=F2S*4fSn}}R$UAb{{jIMkE zFk^KkJy;4|d1JIzq$`73_0nuO;8y>)UYjkwfQ9SIEwppr-JO-}65&p;;LWRrqX+%q zZemJoXm~rKW?77|$m6hEeV;%oSLDZ8)J(1T!TV32I1bkahCI&}Si*xN^A1y}X*fWU zj$Kr765~NkS`>B{hw&=T5mj&UxuOoOvZjjq@hCE5?P9z7jV@9Z2GsxfS(> z#UD3nzk%imA3QbbtPqC+!(wo}$C4I-BGP6tTNrZuMP4KizPupUOwvGz)G{&3as6Py zKe|$!DHdkupD1PW=FS6?38lJ^Q|o52zuRu zk4?opzIM=d59KC9O(|hgokQPQ%7T}&FlaP)h0n5A_`~2XFyE{=ryVcgfluXC_BHU& zOs@2>(^fI?^%~m@r{>uym^i;#e*xfh4M|P=s@RBHm7-CNooGC04}w<>oS@uj(c#gI zAyU=L>Vjs8Hn2Kd#Tw!+X&2U8Bvb366oW@Da*cJj0*Q*|4 zewut|-0WQXrL=hZ_So3(qS+i+}S{5ohIBv&CUXniTtj0?kF{d z-6_v$_znd9WSR;+UhgLGZ>)1psxQ}+3rekX^m2PZm1~ywbEUmmxu}6FOSW2OaCc=@ znQF}-zYXMF8(blVp~$niv(_@?ib9CsbbEtVZ?-IamBI)Fu{!q3mNhNy>)6+YACwit zXc%P`M`za*0~}K|D^|ze*l1btIb0uk63Idz+=B1F8=QP&$`3z?B(^tE{Y{Xhf}R@i zbnNxs>Ep~9SI52_{)p|Za0&^nU9KwRrya#$&JrA~LeH7jh@Z9CA=HGVYZp7}DtiOH z)M7r^yJcSvX|~r_TeHowFLWT4-GJwP#i+x4Ae)Ws4w$W*)bzovrm3{5jq=4=lBG@P zFb(*A;8QXQL2tXDnVKV;8_QMAq_eaE#I5COuQRZIVy^=p9Pv?S76#}gl?uz1;MG$Kn`o#EZnj`u<2HNLsMx68i4S? z(|r@-j_Om#u&-7vt7*bA;O5FMD)UnI!hSViYySnr3C7*OydlwuZviTJjV+QPomAN7vZbLo8>@ ze(&^ESlMinkUVW~GUsu`%f+&PFg?zyuhALq_BwM`HmvgFEp%%WL~UiiouB1eqawT1 zUSCmhY5MCwMuOPPPC*Hq);y}9DvE_dwp9@8e3>2TQg)AYVb$JDIa8C<%ax&OE4RR#{%;e^e)bdOEpY(#h|KPP?>q z+LWi$MhKmjt?IP4NT)BsioF~@vXGWJJ(BIMj`0r_L{I7ShTLMyX0$5N$Sf%ykja%z zdo`hRo(!trQJ+=6tNxApy!w6p3VhJe*HCaZ1=}dNnSvb@?53bZ!QB+xLBTN!CMkG1 z1rJd$O+keMlY%A%ucqKB3Vw)!H&O6T3f@M+Pf_pz3O-4}Cn)$L1)rzjHz@cj1%E)n zw6>NeUjI;4B4? zQlL{XL%|#c76q@P;58Kd7zIB}!Fwrq7X=@o;6oIAnu1SJ@D&QaM8Vf7_!bo{cc-*zRg6r&BVCPM7Yhwx6MSi&BV6NM7GVuwarAe z&BV0LM6}Jsv&}@a&BU_JM6%7qvCTxW&BUI4&BUV3M54{aq0L00&BUP1M4-)@zs;Jy&6>TH*nz+rHx6PWi z&6>5%nzYTDv(1{a&6=^zny}59udP$lJ>62TA%pO&`g>43f1!R~{U=B3Tuz;rX`PL9 z#k9_Kbj7sJF1lh`XAfO5tusMaOzWJaE2eeM(iPJ>I$bfXGe=iU>%5MxnAZ6*x?)=A zy>!L2&PV8qX`N5g71KIjp)00!zD`$6>pV+WOzZp=T`{fmJ-T9AXBBm0rggT`71KHe zx?);KqAR9#4$u|TI``5Q(>iD9ifJ90u9()T(-qS?PtX<9I&HdQTIVfv#k9`*>56Hc zkJA;?I-jE}rgeUmu9(*OCS5VD^QUyhw9enr71KKZPFGCp3{W>_TIVXdVp``Wx?);q zgszy@xr?rt);UU7OzS*CS4`_Dbj7reL03%c`~Y1stz**_(>m{56HcWu!Ei*4aQ;OzT`rS4`^+(iPJ><8;Ne z&P(ZvX`K^v#k9^V=!$6_dKYI}hrN}z?DhN*k<6^UzM^5ENdqSgA)Gt(GT_B?21ooI zCmzPy7*ftoHERB-lSREUa?_8!Hk9L9uT++ZT-y32(mS1D(M#mEXkPA<%j^NXs#F>+ zdJ)0VN;r+B<_!MuX1sdBz5iyQdwu5=#@v`5!06o_NI3=iZ!G-nLCmggFy~E-+`ZfW z%e1=EJp;oAqn=MO=N9IFDhC1Jv}Lp~1f8BgP$*D%hP*jNukJc$j> zFfKOZZn67Hz2uF#yaT3+hG_+JQ$LP3$gIySYzAk${vJe4n=n*&RVyZs zA2~rUy5R{5{aq|4{oVKzh98>p^BFmC9}d4VXdGW~M%jfO-k@}+(WC{SGQHvKpbsXP zP{34bCA|gLY!&XED-pG)-kBt{ zH}-+?U@Atu{Nd99W)BP+t13o1<{jdgZ^#Stjy^EQbyQ4{Y1JaN>rV38AlF>q_GUWd zJH#RH&kOR-J|N$j-pp7#PK%~7t(JlJA#uE?^TK;m{&+Fcz|<)NoZh}oalEs6;k~&J zy!WNIuhWfP#Dcx~P2$ksm>2Y0`hb2{I&`P0o%I^&ZT$gpz(0`};9L6uoTa{Sz#xr- zt88u|9rEYJA^&_{kO%vKoT0vG0SWLn&MWnFyx$VX`#X8z-PH%)Bk3~jOv#dD1aHivv~~%L4l$aj-v`7ueB71Dhen zUlIrVg}lIyEgIPIbTR(6IN0CI3+(u!f!&i1_MgSU{zG11_bd|F@vJ_(X`ApMYCWRn zGKkvS2iQAe%&fcc0aH0_HHb7`%+$w2;&5-x3+}!}gqxwH4vE7(m>1mreZbu((7GAD z_LbsLAIl5sfj*!LjG?5xS-tk6IM`NRU~lgOtVpi~*etluh{OF64(?k%yW=wUpL)&N zPS>*B=-05M`Sv^dz%ACu8J+i|;;28&pA zgZ;z2z~0>lSh4P#`Cjm^;&A^ZFSz&g0avWoW(<|D+%7zz+Ki~V45$wF0XD|u(z=C0 z>tbQ11?Ly^g*@XkQBfS~OY(yH(mtTZOwkZJg#ncbF(FUyviFH&J)9TTi9WCnb&sUv znJjQq;^4}8fjiU(xEOsz>)NrP`-0p5^)y&4e zJ;Ni??&0AKke6RAZ1!Ks3*?!cKvv|2gsm9+M~5?JD6bO-c@3iGGPZfJ50Eh?QJ>3D zID5pgjpl{zp}eqJ>FVXAIJO7!!uD`p*fL%Ub#ZJnd0~4bFKij_60Z}-_L{t~J=zDh zI6F@(7^P~n(M%W3_liS&S6&bw>jPr3+c-2BL?fdOKP?XMQ+WY=MIQiT_Qz;amHFb3 z9Hdxd&@!;2OPZ==H0syIF@G&D%xC++EOj?3+>`7bAK8~Kw0|Xz?=SPh_sTr+Wh^9E zb&c>~W;vqfV&}{G;KPV*bYxEkzJfTu>+`~Qt`B@MtBE6hQZr4-QA6<5nJ%;k#6j=P z3$&aM=&B)4Thctd_f5OH2p{Gwr7B@NS32l3;-Fua7wD-zK*v~6Z_lui(XMrIi02mu z(eX;ryv*4<5&VR_6^J*&cv1*#?}q NVG_A>+;QJo{118Xa5ew{ literal 0 HcmV?d00001 diff --git a/en/doctrees/metadata_oidc_ta_sa.doctree b/en/doctrees/metadata_oidc_ta_sa.doctree new file mode 100644 index 0000000000000000000000000000000000000000..965ac4e9d3819d816bdb17e7d3993ef0cb7fce89 GIT binary patch literal 59001 zcmd6Q4V2v0b)NXMBzO5wN|a=Y)>xFplvc|nwIW4Q+||FSA$A5k0604s z0T?c+pGG;BlaYrDHVZcc^9%zV5_R)rFtLgt( z5G&_(X_4{_URTI0E#vLx0dz?jb$;D7pM6lSz?MbRsDsa(?~ zsZpi^OQL>0Z(OJ$5r>wQswp4J?H~8p7@)E&ANO8v-8Pl6oUIY-K-iFv1~iV^)v;FZ zAMaReTDsD)M);9oWn!bMR7G2>tyLo(`6&ZgeGmjN>o7YMB?$S6NGXu=c1hthN}<*8 zTi#O+x>POKCDW92;bN>1PI_X#y9f2j)p7B@iEV!*^Lt~M58u2am!I#*qWrAKwCpgw zIg;t+NTxTVndoBrE@awhD%B))$LphER>xe`_F26nlGT{fTqF*9O=B1w^K^GtfI;s@ zE@AKY2z!S^*tST*UXCPeTO?tJ$v`MlGGi6Yz(bi3Nm*QRF3yIiG|4lPv}*&T`L}Xe z`?$y2s}5^BBUyVblC_%r!;a;w{C%r%-Ye7JlZGiiX=~uB2NO}{^DX zL2I2U>NUw9AA%pB19Gl4E-gD-3c}X%w@YmvHaj<6&$U#!Z@}-~+vaWXd z5cDSWZ2M*mH{SIlJr=PG--9KFhpuZfP!*G;i}$;j7W_2+{ z*g(A|h$6#{cfzOPtgALF(;%0eTr4@Zi2;K$dn7-t>5@-TFDp}l+-P5f{gY89W}|16 zbcx}>Ii1JSfev)QWuouc3v!Wqj1O|pbX`=IjMJhH&z>;a?jJNE4p$SB{|yWS z0z5Fo9pT~Hz9YkklZ_bJ)1A%Nm6?7Sif*J!*UhnXRl{`6NxCA|m1oGO7-`uG))FG? zEi73uJ;2~hDK~5H%pkNlCovC!}unlvmxrLvaDKM7~H)%D9sUnFQG|Ub+anuB}TsAdq!(3`^ zjiqKOtTnbda>!X>t8_D~M7FtcxQa4PPHxsXMdbGR%h*QU7R%weFo(7Xj3&$nrf_1m zsbuR2DcE%^ZMOE<_hK~6$zzih%HvaXU%K8GXq&5Jdt>?Ow&AS>6~@1_N9HdzrPRi0 zE>KH|qo579bHWTF-j87^Xv4#~e4f(U@L&sFriNpg>ayX}Fk=riY3HRzT0_ND5#lId z!z*wnAPDco5EQWC!7M&IDQ!60FqfKrvD7rfoou?Uz*rtt5r^~@8V{uAD59XD~cL5Q(ySjGrH z-i4vb$>7^4$;sezb5A;M{3f}Ib$cu!k1&Lsk!p%z+Vd6sx}-Cu;$}H^I%KeU87iF1 z`Osybh`V`-U~BLjMn$_I>3z(IRNW%J6zMIhH*vPjQ7JDY zqfgGYJbTS&;t($rUU9z-F7A9RZgxm{#09bERGOKy?)&dKt!oz)m{W8WGNeK`hDi~$ z$XPTepHI*pEoL_DczUwB8|$)Hh-L4juQj=8dlD7?rkM-hJo6UrZLW<%|qY8#I6qSPllqxn)c>_A05*%=i|iR@qasJ|H#_55>CSl1 zo;4UvgrOql4w4qnfk9sgy{M4#-8XJvPw zqMo`l-ox%-9htL(mAbk!8Ox4D0~zOqvFC`#^O<=qsw%|LF7L&lYnjJ|py%>(xPD!* z>tR`%ujSUHpemoYueug};;~y_afTy6H&WtDDQXh=v>1?Dv zWn_uMc4$YJ9E0VtIq&n#~w!GC#`E$3{Ur+=uiicJO+}V<2ppt2>AL zW@jubcE&i^8SB9gUeBDJF^`>lV%dqaK$$(8PUgFxPCfg=SfJqZsh5N4Usw;zQbrbt zeMY@EmZvxil+jbzBs}Z{=T5yo#Bh}S6oz%M{A6T-{HL&~SazPlkw z6e|^2I^3ZBAh-%x5tM2Z@)C6o6G^m*LaCOl*ost8@9v5IP-8=*>vz zR4vRPyQDGH`_|$$2B`bnM|K^nDuJ3@0UwEN&o5(p>RO`)%egOT6>*^s>)K(3Jg9b1 z#%#TOi!M=IWz=r5Y`He zUZGIjpU3}8<%wbecHZG-Jb$4GNwE~=1vW|z@7@fVq0_$3mRX%$iRQU_dMuW*2T)Is zJSa@h&IFaRCO-2F>~a%Zi;GGH7J5p!0vm`cC{^&8rSU>(e_^y(D2-1Q4<0BUEEu&= zw_aCW5@5>@!-Idur{FM4L5h322=9+YcmfelPleoA?5%1ofL9zZ!2hL*LJ3eBTH)X* z;45^m9$!-tS#$0D^wCXoq3dx=7vgLzL|UnFCve+qS}Cf2=C;LORw{A2Tldtm>}-S7`qD_^*Ebn4Ut`4i$zvfkAArSSBD-|XJKDlT_u!dI%HE{7*#ImDfDK8L=7tz@f$V`6)QD$>XF zy1>aRL>g|$rtQACV=S-<>K-KR^wb%jE>qJWT7n{(i{y#HmsE9e(G>8Epy66L0aiE* z#j&V08f)MZgWdV*qn>b8rO&&#(mxpsgw~!Y$6y;0_8=dQJ=X2s{6 zf4B>$I2wg((9Rx`ES}6e;`TB2T=&=O)-Kpnv0!Pp5rWMc=UQwVBS81}3ZOe3i|%pM z$y4^?Gw>C?F}f>)#^C86CJtaHod97qTDl0EB5^&9Fnc6YszZ+a!96gTowIrStdE>~ zR;hP0TnRrE%fSM1fNvnt7kG1BSrw&XMVc}M>$V@mB z2ty;&YnTvUL)5EyoedQO;Ab`V3$8;4WJ92 z_tAN#H*Eu4)DOp^K7*(qc$Be9xS<->U02Ray6-lj)dk!z&N@$3GbBNUFa^T0v>=G} z8t!_PmyD1`u2Gj+bL9N=L3(!R@^9?IeIynxxmDP)=35=^yV_#~53jvFBWQB~o5={) z`RPOTUPfQuO-@$_%=>?--OS?8DbDHF0}uj-aYNFWnfPEux@kveUIARMnA>VXl9{U zVzuFwU``9!MF-J8Y76|$ab_e5o$DyRPFf$Llf{SJao4jrhW+EYcBT88A#6@kSyrK$h} zJzmbDOAEz`C?&Zu>5eR8J@WaCdHbbFonjg5(Mp%Eg;>6}Vpnl@g3V7I3K|@D#gsdw zum&K^6TEn~hTQ#ursz4#MgJz&qXij)o)z>K?1It@%bI>3f?MGnmm&%Dgbz<9M${=f z53kzX`pcNRY>H(=q`;ssZ8&JH2YXI~TQ~ZuJRq+_$2kla2Vmv}UQzm&tm3@hGR)i* z1aH*z-0=L=z8pN#=4Ns2#uC_F2pyRlo`bV44>k$gQxtTAiK)-8z3Qr{cw#P-AQ|;p z$RqDkFXA5v`YG>KTX+beLkZ;|hH$9qVpC?p=u^4*DQdr%o14l#`0(6(j-G7|*^a9w z>yosn+;dt;qH($n7p_0MNVL+RKaH zld0Wy$qT#|?j3lScjH|=L2h8gOETRIQ(h3wtzKTJYnAgX^qFTdNbAk6-rszPe#4nA z*xscaM1aj>sa)=P{PX+}#N@=taNDhnYV)9fya&M;{MH(P1yB$Z_$6yYU2N1^u!aL- zU-nT`D$$`ozKXtaz$oBkHG@ zTpbWRnQ&Zk#86>dcVx+|=~}DVbqNhW#MG{11jVk4u^kqobZd1x{P6Lsk&hqPe0-ny zP=5%2Tn%(u;BFlccYXCIkoWjq8Pw6;4kARBU;%;e(>y}f=o%Z)nsI~h3PQisRV3K0 z21iCHTG0puO$NiEevv_}-ZTKpVVjcy%H`|U+u%|!@8;;%Zpa!LtJN9nAZ0}1! zTR2Kxhwa;?UPD>c>)}sOSV5>;M@EiFMnzX>S}YRqJy@X)cq5b7hdl)uIAPyStxEPt zLD)9}mO~t+`h&e~WMr<@bUggRrAXXmANM9UvkzS42Y!|VLJ&9v5>=nzC=~#nY+rUF zqFw4Xj#{_aS?w-QU2Q?DcK4fM^=il%RIuTmN_Wl32&^L$8&0sjGDgRb6v6wj6}IYa z?<(QT;T6cnsetc=to`*nh*7G(hoh7uhj&xfo)p|L2g`)dxnXb5m2-3U*gZFvw`VtS zV7V4E`7l3DFhLlDUQ}7ekXaj<>ReyA!M%f13q*)ge;=xWxV!$PBtERQ^yvci53$g< zd*P{x1S@%hGj2Ay8IF;UYuvMC}h9yY25GK8KzSsZOv}rz_B%(*vx+ay9rr}_;LmN@ankt8z5^h#SN-E1a?)g z<0$2td&;^ZX68ThtAa#a1-DeH<@ zl+O{&bQa|cP_}Q2@?|U(v?$mH4vS(pHCc0lG(!kn^$(zOPSxb3`AS=qp8}#Ti}HP> zHOivkg*U^ZY+WB}6nO-?aA$c-?1kf+>E|8 z5s)3e@yR~O+Dl=BY7S9&)!R5qIo4zkW$kHAPCb0)1Wm=u@I@3_9J<%YA+kGjifPZ{ z!zWK*Dst|TV=x1W--*e?14i#hrvqs#_UW7@I@4LLhoEfVR_k#r6tr5{1`exbH#J#1 zgW|*o!J|-lFD2+toLAavy$Fc9td@ziMp-Sq@Mc)8_lH}BR?BZyKVpM0#_H2hU0-5L zzCk8di{2PiOe6Bi>R+J%>`@TREW@h>$mn;oPmmP2#z4Qzfjp?@5UyB#jiZ#K=D$T* zds?kWW*gpj7sYz6BIzdV>4JBK(vqmubMQe-m=!T{!>4Da_XVvRpYgiqGVAxr{WBsr zoeldclw?s z-V7VIJKQR?VScOn5gUYxR{x=2u_fQ&@@?4e5%wMXqGVQNSPlS-E@8t$q)|Hvgg8d+ zdgfhpu%zD+??nFi#%7a{wUwF>IaaPjS$kT!$8ntHPD>wxDd$7yj(XqW z%FQ_Bro<0zRKDJ`;4lv=AwKNZqLqj z7yE6GJs}QnN|gqELf3z1s8--^jwE+R0Q8$xqh%R6r$bZ!RSn!sqoe9jm$e@9<3bjgf5!V- z8zGf0!Y1R2Vs_ee8NX==hxpdO`TU->GeT&z_MnW-^cHGBEN&HrL2tnaNTxm=wv^KO zmUrQ8`h5rSG8PK@7Hk9STQ&#v%zOP{w>8;_1p5?1pC{-+frsVVU!S_t&gI_$qOJk* zYshPqbHNL5hI9GTaI4U{_^s+kY!Lrk{Vk|2sgE&ljcikxe1pq(E;k08OC7!hk?dQ( zivqC+%-1m;HBiv+huR}8djf%x_Dj4cBmmqy*(GA{v)gv&A#g~Zi1rx9z%T* z%X7L4h%v7sxsk5IVLjC=rE#dVZ&z_Q77DrwYy*$0u-lq!5`ujMp|2z8L9xcT3eG-q zrCo&#h`LDYebR>p6{*Wx>oe?sz0)?deobT~K*c92nE`n?>b z94GP~%KCHcL_R@eW$#2j1NCw_kj;=Exl@JxljdU0e>!}>ZyP?v)9me~xP|#su8+aUs-PUBo5bPre z{p|!jUMP&i;Orw;+F^VK5OqCu{0{OO_0)kE-VBHFXW>?%!|+?xkJ#XQE$T<1I!=dS zi!J#E0f&*C^_O5tB{aZZ)*qkMT8o>8I>*Dzd)Jqz@KoVt*!1(Aw#G^2m}1W z?{3&>$82Kxwq4ra&3RJZcM`fQSOi0o#JZue^ZN5bZswv0F)}6E)7J1dx7qXku*LJP z8H}N+XyuucrTm!lqJj2&+F4-pXCTYy;dAcX|Hg$@y)Kz$oJV7B>TMbtqzN|IiMYgE zwa%_P=o-5u8Mf-IVnmZ-Zc+-IvBj~8G)Ibj; zSZWRAfvi{c$ZD;#yK%=_C6K^>hTg$@WrcV9F^7Hq2Q209td;lLcF6}eY~4Wz+w0l#xnTp&y6^dd;R7Vr zh+ZHg>P89m_QPA(!<#j$ZhN1iUU?_lQ_;N&a4U+WUXf8mvhW9|5-*ci;!?HHI)1;1uA;M*B`+ z!W-w|=aBQWrPtxtW>c$_7a-OfUNt(jGsxPpsA*w%7SWAH+mK6YM~L0RjP4jf}MD`v;qsH^5OkAeBx~r)$7q1FG3dXMov; zfui?MH4Uj%)yfx_P?xqrhk=NI@c9J@OyHCx4T0WvL4j`~kZx`*!-u4CQ#J-lguV7q zaJ}0ZsGnGy01vDcgD_WvmI*}9>IMeb~fe#0b_+#koZPjT=sr~ zhHl4B1?tqOfgaYCC3wOA;I_TimZsG7Edb(yWfM(McW6F#49olG1)MhW%}b`NH7MLq z$GQe{QUf4o8Ad)JArmCB0nQ7z7RP|nEf8EOR6U;YtM{TRB}Wy5wF?m36gpAWlsm^a zSi3Y`(9GGI#FEI-|XZfyWjJL$Lm z6F$&UfoS_g?e2;Uu|g^!LAw(I%S0hgsKajgmq0r-h?oL#Q5-Yy5-5;X!B5usc3}rv z3Zu0U%BL*hW-|N+4t2)0WRXB^mKMMW8|Ecwf-FfU+~k@HCQaZPH${)<}&D9T*_v&Pv*!j5cta0?S~af0z*RMX$k^4p4EnL!-Q9h@fVR7(ZfI zJ}TcKKOxV`%d#xLEWbm3O@38=UH+8(=kg!7tQ~o91yr6(K zcjPCmO)YR<{)uJF4wr3Tei?Er5WL;V{hGDIv0va44Fkv#KtJWzyH8`3*FSF|zD2hI z)&`1x0~1dGY?yYas<@R*#oZq&E~Zv-HKK~kMpS$usN#gKiVx|MK|@NVia^Mh!G?Ww zdZJ;i$NKFn!}2%eH{>76|4aUv{1bKKDk!}Hlj|_K29sMcxfzrFm=rL%2a~%nIf2P6 zCXZwC2que|R4_3xX=3sMCeLH?E10|slV8K+S26h)n0y$MPhj$KO#VG4pTXoynEVMQ z{|%F`V)7kKzJMlqSjrxh)ElhcVhAiCNE?1AxwS)laFEY+n9VBlTTstc})HYldoX%pE3C+CSS+o z2bg>xlb>SpV@!r{0JR>IYcaVRlUp!(8zv=8@|YaPrfwgyp`aiN#p%fHceePzYm=I_NyXZv zUTspXHmOycRH{wt)FxGGlNz;2h1#S(ZBm^!sZEpyuzD;6plgQg7?ly_KO=517h}$IIHi@=PVr`R1+a%65 ziLy;%Y?BDvBtGC7r1nxvz8+2T8}eU(;rWjI6Z!9KtFszAFIk`vk#BR z>P+AfS)FM-BCB&6kI3qr#UrvhDjt#5S;ix>Ixpf8S)KRd5m}vA@rbO>NAZZP&L{DR ztj_CrL{{g^ctlp`4Ll;N^F2HwtMel~BCE3wyD?dvop?l6Cx=I5bp$*jt8)mC$m$%! zBeFX4ctlo5#3Qmg4Ll;N^DG{b)oJ4qS)Et#h^)?s@QAF=$MA@(&ZqH+tj_20h^)?6 z@QAF=H}Qz9&JXa2tjKc4M+S*WwXbom=pTtWF7!$m$%%BeFWj@rbO>V|YYX zN5UhrIyxSa)%gWHBCBKJ5m}uN;1OA!kKhqmo!`SFvO1r|BeFVQ#3Qmge~CwAb^Z#E z$m;wp9+A~qg+_y{&K5i(t8)V$k<}T-BeFWbxC~$m-x+9a$ZU zJJqr_vx77=Kh|bgTuLKa92nYXa5(Pfvxg__89N^gT3}GOw4l|!aUW&9I&{*@Js7BQ z(7h`a+7YN9o~m>cALFhG*X3Nf${K=)1&V8lPemJH;<9cJzu?(){WQkAg!AtMbnon( zfl)7nwu14qGnBD!=sh#Ar!mCR7UL4cQCxCQGqZ>G++tv=&zWxAZY@p$Wpgk~0E58A zONVkR6&ui71iN)p_k{2&D*2HPN0q6O3m9^GheY|$|BWwP=}}{ zbtC+77u+S0a_D|=aXJpBbM{a-ce6V*+@m*vVN=A%jGJ?ck%Omt2-D}zeB}Kpy?y*Z zZ|fJRdJB~BV9K!m8y_h;$KQ(V^$GUg1hC9YSbJk+GURD~$oFOi`KA<*Z|{Z--wPFc z2=pvJx+k(imrH@J)Q!&mib)>7sgW$fWqyoiRv6!w0^?L7#yv1UrYylDypF?FNl(W7 zUVhB)$qMt$DKJNMRQfs*$rZl1qQe*doM=`?GUSi)L;lUIAn!>5`R-&fL&#uVdK%_# z%^rAP=g0fGtnl8FJzf}W!2BfvPL}T*{CK~X72aD@;JrUtzIHcu5OenCAMr!~`>def zmIC_WWazf2jV65hriaPixtV)FwGFcNHK2+cXY5S@xR?2Yu(CK5uF~{EvU&^rkVmqD zJe&e@5A%iZ9RRO(UTP%cJ;smsNLG0FrNDbMS*I&?1xAsm**KW2(6d`IaFHMQQ&|BY zNdf%MWZ(o@*R>u4k!ShQUd#&Z?J3Y6j76(UHCWaHFHPZvLb7CE;m7)NR#@*yfi>Pk zu~=ciiK@-_VE8e9=)av6bRh-wiC8hi`^Jg}AK$)|EaT7f1O20{faX&Gy{|XWJsR(0 z|2O$Te?2SEg%qG;J8=%)yEVWQ!{1&{i$CSZ`s1vy7E@qNn$K}xf0pw5lePKUE!^X* zt08M9<9S4zCSCl6DtIEyjP$7J$|sin-$o}6kzX)7+b(slLVMq zXTFi#(;k13AMO{jf_q>E;r1|6f5i{?e`E#sU<$YgIHcR7*RI;iJ*@ayR!|S6fXXq3 z5+-}~+8g-6UI$q-8AIKf0xVCj1+cx~j`PFapA}sC&P|`M0QqFwqtBk=2YVtbuy?1B zEg#s?WM8ZBgI&xD?BNvyJC+Rg9sFQl$O`N|DZuje+MbUCALNJoYgxg)Hw9ciMeZ>| z{x|$!KamyKsT5!%JS~2-GS|A8tF@G>gzF!AyafDD{7}D?71aAuK#iE0L39!U6%jEa zPwukc<;VJ+tgud}z&g@BfD&uHzzuBU9x|C4P8nR`Bjm0dHS7yo%Vvxc)LfwimO) zHk$%lgwL$j1>CD#he+WS@fk2ZO0pRL89&rlvx53S3aAk)`ry^N*keTS`~2uWnH9R@ zDbS5|D=B@kn--<^eogaV_+frIE0`xzz$_%dOjgss;YawrtPnn!0%3%;fn`m}*ao+A zk9O8U)=Wk_CsSaHke*W0F62>3lM(LWN0`eB;i(h|BL=I8Fd5w4{NN5{1@3eTaK-M< z=d2nAJDLpfQGST?SwVa#1;nUTIye`P7L=KcpG-#kG(Xx#R%p+pKpUa0QfZ>cRL{Hl z!L_pjHLdSF*zPNLJX)Wb^WW__6&UD{PNug{{X!;pQFOLzyASn#oY+ zv8=G2PnO$Wer&g7h3)aIu=RLOn&QWHI4f*Vq`($6hQYPB0)(q>CX4S$eu$4{1@Xxg z5cA!RPa}wW4;i-j0qR)+e0vIj5j(pSp_*4Dh%;m(g%x}7`E2u&uu$nC)PKy6*~$v@ z*%X+CZlOYSo5}Igfn=rqm;CrXk`=zEvc%V8ZNwk)B3bdFF=&CL*n!=@)A-T2)UOJjmRe+6% z$vt)ZPVSM<7RZ{($Y&u1=m-z$ZffYY-~D!eh{Kl$(GF_nY$|@b$3ly z^>lZ&y1M6uh(!R?Ys!H@hXfMvM;sF#5jMe&A-01_jKgOq&S!^*!43og#(ai=4M`k= z?fmD~ySlo&rnd%}7=7A1)m67{-T%Mmo_p@Cb5Fg{@sGaxCpWPF)SHx|C>1utd^%l_ z(}Ge{52oc*B`*}pwYS$EeqHUgwQluLiQiDHclzbxgH zuwKA{l$>|mFLtPR>*u7-XP*p*!%sh(=zQsgcjDhad+CLD*Te%)*Th5Wjf=u2J+(#d zH`b_D>i!~+DwJ#D5hcm1oqV}ml9H7&AW)U}NofVuQxBwayrSSFjyno`UOPINt`w~w zNj|k!5>{EBL!0^B8KuY*)Pu#6pa`XPp;l23l=%$ZQ4>4Glj1)0P{O1MzxEsK+>f(L zguu!L{ZAq-tV#u`EXf5WTvEz4^~Ri35Na1YDoKF8U8y9MvQ!3za>16@WFPF^6Ap)- zPnMn!p&ibg35n%=uCp@~3O$xAMb35_^zFk{`&}LEvUc@^s{hi+1B70%Cf*LJ#5+O$ zUHEqo{@sgz_kpVYt8yvNQ(fs{HL**4RYiP2jEWD5-QvR+_oIMQ6^{bcy~$FIH;SQK zdTh7s6CV`!0rexATmji7LY5MR)EXzH9Tkx)H`6Z(ZTMu^YQBIEnB0qA!qye90=>Q&_Lo?y=v;- z-hrCBuTqj~YL9dbR=+-nv$pqgJRC zteUrMhmw#^awkGo8YfPp^ zo#~^VOmBEHeU#Kh9n+5y(@IfFHxqZd-sfhu-wrd%aHBaZkeD=1JIbPr}YJ1tAH|8B0+HKa_Evlr_5D7iXR9Zq}Zjq}}cy z&3cr<+DA;*-lMa2izjO@da`zlCu^@E);9Q3K`LZ8jCl%_DkqgOfC$AL#x^L}#Y(v> zg)%uQgfT8(ltNIyWubs!C?pj^&s7Aa%!iCIj^D=MB!m>XAcxXCG9YJKC@FMTUI-QB z0{+o}A+1XqX(!Z`-Ft#Lh<)5^5L0iiNA5i)o%AHHJmP+1No8DpHmn9!*YS|`+*U<UOs~2K>&Rs|p0{yhp0H?m z+7O%FsgOZVs3AF;PJsrAkA+9&l3-EPO0A@jn-mJyJLIKP4x3u2B-l96PlxGlM+Z7> zFtOw38X)g$2y&J67zbhv`fQf0jPH~o?@AhU-QSR|w41I4p(OD+X`2lqO1o@1OL39)3OiX?53oJY#+9B+ zj=f?AHLvnd%?Q+`&P}@#WGkW>HKdqzZW>YJ%yQk-*ehmG^FTvt@@}co)R9ik zE^DRx?Lwrf8=WgJ<)r7fD<_ZK7JmWjs0SNz_^g{ltqGJO7698A#57fDFT*8Zci3su zq(^&}O~Uj%8dwS*888Y@zLw@RYcqN&I{Tm-!+$sufE2jlVDK3tjI$X<% zB}00ijU}fJcjvNrYFCFlYiKal-H@p|9X^UBde9`V359kQm8}RDM-CmH!jnJ{J;_Fp zLx(%FSnRZ^!|fF_sCl>{HAQzP8_h|uplyyk%5sqvvUj=^%TL|PdbW)< zJ+GmusGfCsE&3+g>x5qT%^65fLmscXc_aqMOC`B&%hN2t#n^3j#u$Ejij5{cgQcSc zJ%h!~6YX(hRml*nM;a1x#YV`ykdc(Kwm{)umP)p}8ZB$wqLX3IYokKH9Clr{hXc-6zRBCgV05@Xl{j$5_9=CKfB*aP<5n6yxBZMiK9 zr>=`acg+n(xrU6=OP0i}Hq#rEl$5+Klymp@lw8@ixEo{GL zF>%H(6Xxw!9Sq#zhPdq}<(L7YYqp)0v-;PsKSLaTn6R<~)n7JpqU zBLjZPpgZe@CfX3TbD33N9Zkf-z5dm(wa8~a*j&v-K`uctmr*%IUy6-!y|x}?UhmSc zQ)O`7>P3Mpvr?gkP{ek~PG2|{3_B>OB|CjwtSLKGM&RsFp$0p>J7b4d)`MZE*%G}W zJN?bsVaxo1vqKd#*y-CbI|22qejh!nzj@CBJG;=cs8EBQ{vES35R~i;wCq{^+(5IQ z1$O9qzzr1Oou#;6 zE2o*sp%rWJbh-_m0@Bb_5x4bYvS9Wz;>m9Rm^mCgIrVg4JXxB0xFJtZd&*Nln#iq( zZmyFfyB0F9n%p>bknfe}X7Xccpfe3Q@wA$`p`bJn3Uc+Ydi^}qLIY75_P!N})l7vN zJ?qhi?09P++#4W2bqtyP#_U;O$ib1B!;~IYB?n7^^enAdgQv$D^3+I*0@6Q2b=t>E zitM__yl!L2sd)mDB1`W)zGHU!g0X>y!hJsaSRbUrn528LL)Qbgfv94J?3~>(JN-ei z)9-_w{ub=e^}yNbH`#fjAv=vUP+)V@p>X}|)YLCF4dk4knmKI!i^{RH6p#k8&rx69 zkf%l(D4!URkA*HTht5~9`bqmq zZ0}9UVT+uz4G*%7A~{^bWw#uu6mv44RwBL8-dH3$6d^}5jyZk9BaGa7ORIb;1z+I; z+WK~Mp>`A)nLGzpiCr6?+GWNjPqgZnUmik78xndy5jv7_GiY~d zboIU)>6#6w@!LXnhh0=0B^eDo*04TrqWa|ILI(cZ>vD=u=HSQfj&u9;>;>R@vth{Xka<&D~%i$F>8&8 z*$n^&*W(Sj{u$z0MR5k2{4j z!*6e6TN__lU6oRB^c2Vg8^lGVG{(%>KqS^1>5E2U10&Jl)6wCGl5utG{pmc1Jw7%b ztTPq`XYCZU@k|5Zg@y>H2;u06YZz{r*}#+5kJ-5G>nmL|}u)c_Y=$)_}(ET|hV25ZwyND9vjpbYq5Wq^gKe7gt0OdDG8~_A~!!i%8iGShl8OIjm5Y)W(h9XHww6J zLuvfBKtUgri#sUasQW_0x(`#`;|sH=2cvM@ibib<&J2ViGu5k<5m19Kr6c{((?g!> z_K2j&W+65Z?(-IyhYSVW>OlsI#fB&-97+O)>?}7Xr-u8YwwDU5@DwkzwkTGTIo-!y zi6ASB*Q3B-kM<>seY6UpV2bClVs`|0$sD%zQ&tB$=XndAse0S3fPwmQL)7zxdUDC8 zm1sjX{H{}LLdhC7QR@ip5VsGWSy>UdEaDPy8$y!fa~az8D&`fJMDELO*wvB#(*kMg zq3eIJ0ryHnxNKO(jx|f`_wBmHbEzRry;W^S zx9=x9TU98eN?S$R9$(+8_K7y2I`{2fZ>!oKY`|S^2=}5U#24FWRVUmv!99!s*qXCR z>8I7C=C-Xi38p6+09P6UWV&f`$u`Yw^KpuVNLu9zT#4%>*FK{JYWiuxykO|r>wc~Q z_G&}0n%gz)8{x+0!Ph)oo6lF<{E-;+*a}QYy<6+4bd)< z?9MW@^E+(cEaJi_`Wyz)(pZos#xhSO+E;j5n1G-D%5C_Vd z1DbawQ$?FxP&Tb@8h@^A7Heh)x$b%zq&?k`v_2wjeqwZJAa>g79rWPRYKjxm6r6%t zT=*HmKg#Fo1qY1NmM??tlm+WSqu;kE-Kg|4ekyHq6l+?n+Y?N$q22wwTGRh1@K{# zt>Goxu|CVp}Sq3%yEy62g+yfW$t_y zITH?Y{HOy*S!O*A&iIC$v9(=osc5UB2*z3wG;Uc)b1?M$a^`(E7ajBxlDnHd(au*=^(zPi8mh52AO94`s`Ah!~)(u7@ZzL#D(RMSGQ&Mhc<%xzO~; z3SR%Rm?JD)nuR(fuZH+SXav3{iV|WQ+Cy?F#E0gERVV{dKZTA{K}@ye7G<8D3mdR@ zt$dRj)dw{{LqwQ-9JH~7js9=OMKfyH;39&>&4Q523ybW9_?o~7VG}qwatJBBT{42l z2?l2-+;(p_(Y$NNXb>pWY;)GooqQTGZCMywTT3s0ZO;uiEMeO_g99B^3gzUC5|S%r zYR?V2f@pXV5f}6~@SzRN&{=j!h_G3d(B7eLcpb^5G{O~9fIJGVSCp~Bf%sLSG{{M7 zLO|!|=N>k0cC+b_CdA>B$_k31=)dIbaVjLO;#3H+`3iDbe{wpsC6vRRolqP&iMWV} zCQEJQD9R?b61@mSrRdZe)t1*I0XpPX3Bi+R4Rr<Ut^c*!?sAKTF*3NlZw|IrhlErWwCO_w;2I)MI$Wmw;z_N(Uu*n2 z191kL^#izO8bL2L>vL=@pP5}m0Qh2VYe(ZNhVS?)8@x1gsz?F<+1QJ5&akCu*mqf% zr`SCnRvFDk$pT+@*#W!~+7NO%+t}(J)mevkjgm*6XEC3(fZy(6@?ZEFCSNp%$zRli z$hU|oojuv%8Yiid_v7Tw$I07p=U&|D9w(P~t2K?`Yxf>tc9vHXO*mukArrkbqYwKLuHS-Wm}FG({kMUk(A7Ca2`x)DTIx3*yn z_w*D?(mFoHkih$r1QuU9OVr=7gR_;iZtwC`Cyqm10pYVcn)DWJWWj zVBrheTt9RMYY=CiHNx1?WbrZM$L!qMXCL;kB}S=3vt@x3>iw+&n9;zq$I_cfAR-rn$8`LB4#G%P7O~x$-K5%R zmgQkXav(<5)1UW%)UDpgs-W&u%2)t9fE2Frt2Mzr%5Q5}*YU^m>je5@pSmA+W0A|T zmS*;d8one%m-7gfU(3D;WvK^ng2FIj0!YtQ4)kIq(#wk(K_e26Y25Gg!wyQ+2>E7h%@ z;GCoUTVj(W3FT6A;4@439Fn!-m^Cw;@b?IF2>2vQZZ_aD@xhz38hZp0`w6Pc$?UKD zXai@cu$eBAYKvrtv#_NKt80!5)6&NUN6ytH}2%iw4^3) zD6ACC_mCX#*=0O~23xEfvW)aREuUUdbHVh-wDx9O{=i3DI>j9!owG)>y4&(dPtUma zp^`H__<|IAc6J&MFeYZ%&i#6SKcOBpGFnRW2(Gr0D}87`h^);<2NFSNwGsQ)R&6Mp zqj00dCqZ(FWKK@4*_6)mSNGj;!`v*^&)LfpETCUlT%3y_cths}S+TtdlZ)EsSDV*- z=cu;*m7@T|XF`0D#up}1kxdToq&V8_%2i4^C_214O?P%`aU&BnlVpX0cFh7tQjSt4xipy6|`@;J2?v)IT{%`;lhYCn;nl% zFJ}6t$Kv>VNr~qtVpqZ1($-{dW_u#Pl1*)`EJO!pw&(Lxi=CG?rpLz1EBP5|W-FGP z$)>Z@`N{0`*vR%w?~1g%up#lwGu!d3Eb$lSqp1tigUh4Csj1$H?WyIf;#B@h|H@Kq zBYFOEWuF=CgoF5KPERU7Px5uWEix;*hW=itX&_?gj z{M6b&KDtpXO{`8_7!v!F>4}Yj)%m{ShV-0}y_iq0jwC17XZjLbt0VH-x%KGahA=Qc z(m6kQIhoGpCni?s=a+i>Qq#%e`AehmwV|2k`lq6?-sMDWvOg|t%wAevo}OCVTDo*8 zaV~XkI-6SRn=a3lR$?RaY-;t~?Bv{LY^^uD(K)}iQr^0at4s6IOVMJwC~RF3=GLYc;=QMruda{r z=L?%7{n?>Q@qwItbw$|PK0iO)DGo(9FHK$9er{tU7n_T66N%^~KQ=KvIWZgC%AvZO zt3~}?ZrVKewXiej8>DInMrzDOuBiued?8c8&U*HV(sHq;9uuXEn8Uwv z0-qL7 zvhVkCmjih7-$Z2Hi?W*0qbrlbhq~OxaTaME$|hp zgeG~%-8WdR@KxmUDSlr@)}8e_glftDv5&j-R`>$T+KPbXJ#a+ArkW7#F2LJA%gIQ{ zZIPqS9A7GLJp_j!Z4n>7EnBCI&vw#vT3Ar<1vG07SHbdpDpw)jBlb~GL3c_U*B$nZ z<&iM+7{Y=*bDLowQD&tv#~JvLGha8|O$c6IIjmXe<)OZ(m`4vi+@760m&|Pv$WrGV zWqhm+Zzc3rl+rytx|a^t*1z|6kP1tD|AvXLW06BW>R`%PMmuD(XWf0^fN$Za2eEe< zd&1WJ+S8k>4X0j0K%MLlgYFUP9X9tYd}Q7FhB5=+E$+6n)@kAqc8bGUs~ab^m(Y;X zJt2!Vx}YR&mD;6O#Zu(M`*x%Je?i88mI`T$OP>M6SL zqtH{o>#h~)DXUgHX*PsV%DxZ9`P5Td?`r;l>(^5rzh%D2 z+Q}{EN=nB;64B<=IPoHiQg$!y@+l!c@xI(0`xNou?$~$Zq-V#b3qOjEeb!wo>eyDT zn)f?rvmtO(_D&SHqh@RVfa~wrSm|MJg**+8tHi$6sXJIMYvg*0@!wo(^$xx41GAGU zL~F`k_Hmcqq32oFmL2+$Ma9u z07sW@p7k@Bcc22=5>?}@>W#DjUc0ytEs-78?iuu$zp6JGtKJHifjhN__jtc{x8b@V zKBPIsSkERGFt&rxw)50>O7}aXic}gnqF*HEmX;1S2j}7SOmIka7W-t62lc(k? zN_VmO3bK++TJIj{`^0ayx%sFcCGFwmQ^OaO4WR^Qa|s*ecq~$-HD`wq;u>Kw2##bh z6XZ%p(>D@43E|AZJl?UDE0mUDMre-daLl1ycyOb{T_vpRZ(&y#vgi&u@V}&z;Br%d z?~NYvn>pG*fn~69mTks^>uX8K2|Rr2A2zkvk7eD>cKiz;?da^52ws#mn$$jLQV-H* z0VXz96a)J?Kk`YE(NaDSvybvJVbG%+olqU;Omv42k=FAir3aDKDWxlJDSd2&wqUNp z*)+{I32F|ii?nMn1ph0xNBXhF*^A>diSe1Sx!L&4Vq$!Les+H0?6aD<(ERx(S1H!8 zeLhpmC|s1jo?=QuCLj5(*3tFL&Nl?O|Y*cE9@nw)BP23Ub4h$-NK|swWV6!uNFy( zI>nxfGGxRd_J`TiwLlX##jKsyh187Q(^NS_;H(;TXBB8jb)S@u!3A0W!b!J%U%n}G z4Lpnm`;I_uL@>g1nj6>EJKTk2tHrLkHgxN z;67Yf!_Q9rCp_Np>u6a{C6WlXMpuO|m5Y1SqZFE;P{}7Y$z`sF zGsm!nKq?~STs{v-3d*}nJA*NUok`FzmPqAjnT;+V)o(CQ94QI3Ga``_)`eW{;$F2= zXRVIboer_fp`Cqv=Y%h`{~2(1BETf_)IA0D}X?+{Dg+*@8k% zZ=EVCLM1IHHuEG)$I)RBk`LcMfETBJCzBBLwsi>~C1A37QvzRdCdUhkRH)VRfYBLP zKT(eW4>qnNP8i&RQSMPaXJQo*`;{7YC!VAuJV$qA1i@5b8ZCaf#BZ2CA)zOzQ$cVF z8OUKy%1hM-9Wu5@A`FSH2ChMXIpqO3gk7ns;RVV z>OP^cUV|q+8Dwmq73sj^WE-P@loQ&<5r*yrDh1IhL#ZM}3``qx73vlz#8cu`F)nV1 zqWCuP_2P@-d&EzP9~VC(e!8OG?6`*p3U-saH(9EQ6KW@W>C1L_*2JsokxIdSVnfy9 zRkQ80hSrp1Z`G&(voNGI)rAd5aO|dW zi&xYGltsJJExsgvS^Tc}ZSk+fA7nf6nml`elG`b{m6BIcavvozO2U+!rQ}gcE>d!V zl4VLRQzB53q@+ZNOvz7C@;oIfCD$lN7*^A__>F5|89j4?iO75Vfo01188K9(>l5>8|re@V&zq@)AB?Ag7P+)T+$l-x_n-ISc7f|5~67ATpc<6QSw7d{tqRG$OhU^$w^9Xp`?qF5G7GcI7%L;{NaxtEeTN~V!i)I%icdnb205z*d>CR+*qynUGeQfL57sR+(T{ znNU`lKvtPBR+%7HnGjZ)09KjsRhi&bnb1|4z*U*BRhghwnUGbPfK{1rRheK_nNU@k zKvkJARhb}FnGjW(09BdrRGHvZnb1_3z*L#ARGFYunUGYOfK-`qRGDB@nNU=jKvbD9 zRGA=DnGjT&090AyS6RbXS)*53gI8H&S6M?>StD0j16Nt&f^)RmHP)!tSc6_;jd`si z-bq^c%iWU@rO2&E(^ALih-s<2=!j{lZaQLGYJiTImO4jAOiRtu5z|sn z(Gk;95*;xuwN6J&OTC_sn3j4g9WgESZaQLG>VtH|wA8QC5z|t?MMq3a{XQKrE%hZj zVp{6Y=!j{lzoa9kr8=nFGc9#99WgC+FC8&0b&8IdmKvrbrllt6h-s+>I$~PtSvq1` zDo;mDOKsB;(^7AuBc`Qlbi}mOd+CU2sSnc;(^9`iM@&n7nvR&3`YatWE%g!|F)j5S zI$~PthjhfW)FJBjOiP`lBc`Rg=!j{lC>=2^^*9|dEj39;OiL}%5z|s>I$~PtIXYrm z>hIAJ(^7AyBc`SP2^}#l^$T>wwA8<*Bc`Q3K}SqW{U~valBKAfA^Y6Or`ap^Gg>~Fzp(Q1NjYa4f-LK; zu9If&Lyi&;8Bb+5-RvkI)2vdN=5@EZ%hIphpmt*Rz#>i3H0dx_cyq9@U`t`LdSH|y zP~!aC$s~Czy86XE${TC*Fo)rI0mE9iakK}UlL`B2ig9;L*+PWFym8u`=NfVF9P6mM zgYpS=bp+HcluH%VW_9aKXt!eYnG0=y0er0%+Sq!^$?SJ%tZK3*r*`PG-#zM$G?>9= zkIziZ(lpe$e31P%D=GUw@W<&R>P<@c0!k~9l^xP-;L!anKp{RgeZLV3&74CZ%$Eu7 zNT+Xbhmdtg;IapBhY3x@CUlx#)GppbD@8j5c&0JHu2PZ0FR+c`&A~qCA8c1pU|-n= z*jG0JYkfQ%lV8klwwgnJwSUNu2L<`wHXuJz4;h~-<@x65uKGu}6coBp8|Y&7=(G>0 zgz0l0%`uk!V|*?sjQ6#Hail56F02enc`RO($c`6E%`yK2|Crw#6z2Qe!0gpg*@ux> zyW(RnC45{^+Gb zTlVIGfeVc!*ZwU(PsWz}S9--`5VQ@;AAo-gZ{wx2`KM)jjt_|pe4VxKn zT2nH<``uzX_}l)0{)eD|hT8yot~Jmu+3&RfzxxOM-+}@iX#;e_PD~qE3mA#X~*I2h6@oi_FK-NI)tk^Dr?F+}6gAMx!`$$k=dv^yc z*WU{41^-~jg96*PYhYW5ane87L{MP+cMa@7b1{D2KiI9Hzz*yh*umyt-{BwZ+k*l- zxJzIMTJ_mq@(=dKpui5b0roKu+X9~_=diMF`#f_?ef&HA;r_><;GW(^xGj{_*Zjl% zN>Ffz+kku8N9(rewSVm&>i-Q2>X|m6`mmw6p;o>2j-$S9sN0Y=5F6^zHo*GnwE)`+ zZm)m1k)YtRC|&`+@6_#Mv~7z%JLMm2JSeb_x6!u#1i7#ISi9;UY$_>1FFZ$451SkP@WJI^5$LkPyJ*4dQezL+rZjWZ$MFu z?dIV29`kKQ{7q2c#@Ybqp^s?O1luZ`qMaqimld1Cz1u(BJCQXIqiMVixKGr#rT&>r zA(X2WGQ0sCn{1jR9`uj6FDS$lZ6NmWv=It@v0<)1*2}e6VVm=haXKiB=i9(|s=igz zdHN`E^CrythnEQo-i0>cJzNhj#kbHuZ}5-pbwOc^w}H)L%uMGvg?5(V)4(Zy8*k~P z=FRvX|4{#FP*5k^fa>AVhga)-3ya`m{?YwPQ0OkUfv&$^NZF^snb&RW*EE0NALf4v z3g%QBFe6Q1HW$-x`A7K8pb$>CfzU(Sz^$n{w*5Exws!U*Yaqk_OdHrdT2IQz>tPbo z<_JUn5#AFN!r3+udKjyOusOIh{=p3e1#YelaMAkCr+W=Uk2Z(6=pW*xpdemq1EQCg z4z0zL2DL554>dl3ku|7Kp<1R%wb>ra9^~=3gxf+2l?@!KwfSGq{on$-Dsh3KIb3Xe+>%T zm7uVdo2!@a`p5R|ps+0kg{{S;u=BWYQ|17&24c!A2Ze2|dAq&JKeqdV!nP6=wiffG zv;MI?8WgsxZD8}VVaWHELrAe=^X6Oj5AkwP5T9%VqSxL_2C>wl4NLw3%0U5qsttf1 zJG&$<9i~9*9E-4y1q?*C!d^r!nQGCfs(;Mag2McC8<@FzYlgnnI}khFTxj3tAK%Xh zh3}al@wM=c_)Y)#ej_M+iD2--8tsb>w!rsA|M)&16uxKMz~|v0?dp?~qHvlTLg>oo zLi>IHp#MB5(0nkU(4+$)95y002Yu{>Z_DQ}vIb)LB-;S(@$QiV zyJ{b{<&4;z&9Qd-$NIqaVb$Wg=^Oo5Ex3Yu*o*^#z!8X5sDE_{LBcW==C7I-vV!spPtXYgOS_R}?9?MzcJJUwWf77{xA{{TPwxHJF& literal 0 HcmV?d00001 diff --git a/en/doctrees/seccons_bcps.doctree b/en/doctrees/seccons_bcps.doctree new file mode 100644 index 0000000000000000000000000000000000000000..8220e3874cd242fa38a9ea642b17c010c9dc0bf2 GIT binary patch literal 57065 zcmeHw50D&JnV)QF^=B=~mW*Zm54SCh~qDmgBJz$M2e+=Xy|Qc&?-j#Rin0Y?g|oNy!|2}j^k z+!dtq`@Yw&yQimTrgzjEUtO8PPrco*U%%h)eeZkU``-87yld!JzWwbD{6Ftzr*4?F zD>z%Fr-ZooXajb@2)LY&Lu~;^h1SwiK;u+xy0lcej7f9Dd>XTrPL%g~IU5@A@$Q`?Z(f_0g8G1M{ld~PSymm$2DD0Xw@Ql1NOn* zJ-M9njs^Q23fkf5QN?hpmEmDUQ65^b^N$Qm`ZnTe^sOO&ES~Q2{J#WwfN&738MlKf z;|`F27yi2k|J{rK?gLeu7cIN0QC;a{En~0o`iAj35H_8SkL+Kd7YG!hE%Zd|Zi znk#jI*&9T;=DJpRvrIr-yOp=jF0 zie4z&x?U^r3sud&oO71TM8we*v*a2_m4lN38$%x5e<1M4`&X%DW zZx5I@e5Q9KGQE<>^bS%J9ZWw&OgnY6)Jxpy`FNbw2`Snks|ONU?ecai61N3ai!eA5 z$nKst27?bt!afub_M%VNEs2DEFp;oZ5(#^R6@;nxW~@jV(om)*Qr7MDRGba-+uWXs zq}|>|TKFl++CL9i`NN~Qidj?M*3cbSQ{)(@UB%#}D~?sOl#+%F$XU{Dhu*5{ zO3kX_KN>L1WmAy0%X@bHz7Pyzzne6OdAmE2Cyz;c63MfZ$kQ=4h2%|FDvE39ihf0_ z)+@ThHlv<6evB*>x9%Lx=dHS4GfTOe?&h7k4$DZ~ zP$6qIz38foI;03vW7X8L!e~y|8e|O0LDt)9nWZA-L&ba}rR`o|u)u)h@%2sD^KBYh zzYhE69*LKFBn*~s1S6Ri1-kdb`9f89H4M<&b%EYH2R4X>iQHJb((zs+2~h1iy0Z9K zgpA<%Ub`MtCTvCHyWSJm!AM)hBs;I`%1*hBofARp7LM0o;;v@J(V-YecLp3q1PXHl zd@{mRkZW(4s}SV!1t~ke4z(m-_jcvWAihpNp-xYS)U2$m;j;h5MGhS`arXm2$ZdOo0ko!!;}$a}M1>x2l&GV}uP=%BrSCxCw5A zG+dHmvpyA)AJrwU8Oi(bGmJ674s?&BF>;}wU-hj>&_@y@CQV`7vaj! zCAjLy6;gFOP`xTB`8uvFKS3J``mP+rajAbQxmP2q~?LH)KueABh-;k z&N^$Q`=df6)Q!(ol5+BMN0n1T?vTHXb<`WWa`-}=L(v3I9S*<&1~H*3qh-Vd?6pza zg!G7SMI_A6Bgl&72`PGfu-?~JHz{NLy7JSh!y5}ruzzQd&9Bz=ftAx-TPZP)+I6_d z36~*#FTzs04v*&wc^XuQx7ScIwZAJ<9XfmlE_%>pUDj)ZDym2kF^<}FcoAO$LG+~v zL2Wv`Jxj>WfI2){F-gsXU8$+ZJK0Rdge^~^NG5%e?SX+gN+>HvmJ;oBMb1y%D*SeY zH9xP^R8-H7ydixj2kV4M_=6e9NLL=8i}Oef9=C04V9PToAja5jQN|cQeI-JZpCQyy zx}PEB=F!2p39BRp>y2Frc{)PK1-)!Ku5eJKmnA#$RyViCtv(siyb&t=$GOvE;L|bLGpWM&0dehio{BbNsP1y+FliXEx{2Y?SW`+Oj@Y6k=!AL zr>~2`c+DlFYF9>Sk)?1>%=C_#PSIM{?KOBrO7fMk6?xe-@RZ%+i&T&?B2WIaT=ZGU z#L=`&1h0p6khpVQaYs$cV-m#PbAx!!I={d7ylpL;a3V^9jET_QaZ*$((TnEi3klk5 zb@8U18l0@o%1ZX~UD-PuN{uojyr%ef5NAk|Cq$|t>5uhYAJWn4KPK-sxoh!n%ri2X zmJE8cQ)ouJ!fto7`rgsPSngnYH5@wmf)5AYOcWFol)#OuI=(A*Og$LsLBaFA{&T7f zo`=0C6E`arDurTfjqHr)#g-UiN*UZkLtk{V!>;zgj(8?3)p+4-;^UT=^7jq7+k)6q`^bQK@D?5{Y^bVDg zIXhISl%1)r?C5OB_$$Q0Ks=etY}DeSVhrsG76zqeo>bdMt{{gT*HuwYl%?6UR!%RI zLli4{Iy?YR8EI&$NZk4fSP1$V@f5Xxf*fr;wd?83cnUT3k*+*lN|dLJG*Mg+?e37H zs1^#I2Hdpkpwyn{Uh)%aprc(mNwk{PsjM^*3X1iwPW?R9M*~qA(Y}?5)l7xTp7o}# z>?CU-yqh6E9SjBiCg@pUsEwl_M<6|1r8br_=~<#!$UBv$27ua^orb*f^v^PSTUuq30RfKvXd)JCCfHor$d2nMlFT zL?3qOdFJd)1nfN8m7Q)HD6_fgRIYP&8t9jZ25O(5200@Ai^_?zl#vFC&QTxh%2PKD zl+i3~3X`37-)Yc?A{_Oeg;5z%elpTP;Vf*rD?3-o@|in7drW!iqVhxo-cQ<35?ME; zfGrBnmJwttbqcsd$gZ1j)GL-&a`Fd9502$Wr}7kNrgG3XBEl%F*Iv|$MZ^l%cmoK9 z{hF#-sv}QA7};)qvvEZ&2epWFJ$|Y*t|)C!!;ZHg&FXcmuhdwNcV&}8r3^3`Rp5W4&(^ zJ&OR9e}~9k8x@tdl4JuP>sp`pQhh2`t&I5XWvi$yR1nCHka&o8dmBf~O&4@Y%~c@j z)(T>sq2PPU3udiA%|m@=Zymw+4^K?RK<}X{sX>*Xc(_Ut8aPL1rI8~f=5jY;)&qd# z`gm8a-$z{gNOYyrsFgJd0CB6YB;9w&TB%$sNjz#5VLZsxQT11z^b=i4=TL~_XUE5m zs1suc)rgy$G?(r=X3nz9h#;<*SaQtM4TL@Ck$+-zv_StHIl_O9VN}SE9?a4I#|no= z^Vn)fkLmvMD3Z~!q*34|y%u~sLT2oCD6@sA%&tfEq?|s{m9mp0r^n8yGqcCrg|e(& zy^3vZT4Qn1EF#cTrwD8imp4loGshCq#HM~~#4a;#f#E>%_R@rm#d z-U%sqBuc>m-;@ZS?27O-A)J|x4P#wDRc-*@=wu%MA3KyE14_rr9~lR}d}s9d#-bKg z*Z!X&x|vky`g~GCob3vcBQ=hlR_BhNIe&Wg#O%!UbF=5p&aS0F502*1h+`7~|HSC% z*my#N?k-iJo3YEsghcQ@C^OQy$xlNn*3i(2b&)Kb?8*WMkRP8tHa!;t*BiE4(XZt2 zuT|IZPrjm;wMt+G9zUC(zc`agxH^#Vz3_7k;I(pO3VuN0J7v%-j_6U?n11uuhV!RV`?Yc z$m~Cit*&=I3Armu?ns5NS4AaX4mup!#9>LVzMIMPUmXvI5(N*b=YEdkliU?sn^>!0lkgkw+4C$J5PdQb>Q*t(s&`b_LtLVOKv`3rXV(Jq|P@g!W^MD|$A z(#@RT+#$xkaew_jEy14a3YK>p5!kG8ZlbzH8c_bd4(QHzMfWVpL5c%QEJCh zzp6=sE_5a6FcEZo?2zxQ#r|E=^EjF$2hUL6){FUh^}_KP^>_|>R2T}QV`J(pW(hIa zn{+&npp<`ypr8-j`WniYb)V~6_ajvI*|~Fv4~-&lYjiZ?aApvW#j4kFaiE4~m+}*% zho=(N?RL|#fmQ`RbXeHWEjkxRLW!(;kP1HJ1JH(@d=aS{<>JrW+P*?N?RjZU~*Q-%=ViLJ=X(g(T z{69mGfgZa44@#(bxA;3G!c)_?@l7bU=Fy8>k0bn=ooD1Xla~PbK#)rg($5ga8@K#YTJKD<8dm-dC_1xZ7km%pi z6}`!Wu6m3|8dcCRrx)QEfzkW;Or-I72$Zup&Bif!%X&U(Hiu|4@w#i(&7z}@9Z8x2 z-DRpc2P&Kc25&7C>k+x2Y@%+0zgV`AwV;DscReL(m%5TRPNZEpF*7web~x-E^kI9k zsOlv;oPsSb{F%pplrPo`w#eIIEJNg02sf3(63nk*H2f=a zYps#iYAYbM009i<2CaByI~{p_~!virflo z4?9a7;KP!X;xm%_7rMgWqfTOyY&wq0-VbPwdb<<_&XQi;tnGbuH1PnTyJMZK?VSh@ zlrP%L;`u^yPPCDeMjf=371UF5rgi0veY?U{wAyfV=_`W9b@h@8LoY37$#1KphmwTk z?p|MvGS(+w$XKvnn#HLrV|{8V`C9187fy}Dq6a2Fv?EOT>I)^aFlRy=>sPO8N82@! z455-XhBt&mq_7h0-9;0qune_is*Wrp7)}?%YIx`K2F^jt+YRiKvhypJeHrInkr&L= zRrUd3?&2if;`>;PgHGp38#KQ-B$Uqv-GbX}_sWx4jUi(*jj8)_aOe=6GFZI~A9=UW z`NIzF6chEQxBbb`uI|s}F=0#Z*tB6o(n(>GAvD3#Rpc@DEUnN#IL_19x8%|#4h7{p zZ=@iZ50vipjeC17Cp{hMkUxH zdO*P(p{7`k;LJRo-qP&V;eZj>g^vJqnN^&;ry(OgB&|>uq(+q|jyYv^5%p5eomU(z z?c(G@`U~e};dS}m2#rK=ABdxbMiiWIShwK#3h?;ZSw0D-=^jc&PH7N6!!~g)U8`Ejyo&2phfaB6JL%?)E*FKSLuT>E1MrBiPHD7OJA zprT%aIo3z}i;AB;H$O}U0uCI7#mh29>X!}|tGPhK=#WV%+B$*4L)xg$+E=PG=*hit11EF`h*uPT zrKe34xCyDBG=whdG*HQg>1&7GcSgHnRvT62Y%r$BbrE~Dc6ljs20U&bN^MwgL)LcN z>-Kp6eh&S6maSx%1))()JZ5!LN+?+DaCYpc1@&U!f zV=6N^<5a;&&96eaG;k90+Zr%uAkSmS>+)I4^cXgwRfD3S)2rvE>ErRrYYKl`8m;rw zp}})-?Hq^W)ScYo9V1>x69gk(>`7SC{V8O}AAjkiWKmqa4H6<0?yHSUmcN*hP~!$& zQZ!Jgp!yHFcR;nt-Wl(bKLO##A=s-zoOod3Ra(b@JUW}UO z9t@h1m$;kiAV;gL!sw-*N_sj2af zrbuuzU=mk`p2YFs_^=&lAEk;Dn3P5xhsBp1^c9Phgik`d(qlbBN4WcDPjJXPe?3$f zXEK$5P*jg5>yi!u33N&9Nm$b3>2(Qxly%9S5bak*ud|;D(F?iFu9fE3-b&u(|DOUM zC{clVElTvR9!m80AZhbZ4s=E?6a@Sg2{sE4;&sGhLu0c2s)t=VqK=^R4=4z-M32Y3 zMu+{vE)wXuuypd1kbjA^l28)!(_++I+cbrzC|13$mvVvYm35YHzL08#BD`=OH#K)3 zlqmG{f@R~QG;0x0VV?L;NxhTnDQ9_?{f~km(&NeTo#QzucqK35t z_+pg#Y4~eueo553!(zgTBzx+iV2TDlTGiRNO>ep6%O-b9PC0?8B2UQRctQ9bPrC3W zTBU4MSdoRx0_<)tS#?YkF{Ko(<0Wg7;j^y4NW!4=TDX3j=hZa zHlgY<_d}hbg3D$4kr@mZ;dhdaNw&um*(_m-iOOoqf>t6+V9_ii7Mj|QwKtpP2LkUp zf0h<25Fe7f9uerth4mMYuzPkMWiZh?J{9H^?vPQh$=*|ZuC{A>P_E_AHOIAg%2Av!x1JWM`% zH~~l#Ly4xgu6d19!!RV5BQOS-aQGci8a4b564~-m47lbn0#t*SKs6W?bpEqKZHa&V zka-MgMMJBZPW1rna2n(sWdv&=%NQgI2!<^nvSvhiKG-&RDW^O`E3*xU2A0m8G>i%_ zr0|JrBBkJ=iSj&j>2-Ys^7-V{TCVH_1hg0JYVE` zS8RyIQ|MED>>L@O68mM$OkX_^3>1R1 za3JjO*TzrTEXgsWu@JuL-2yiZjZ>-|B_boHd=`u#c;-j^^<0F*P!xV)KYspNhDy_V z7029(n6)Jb-Bp*Bk7VS9tw_drv>rwLh0%I?XQkw}-5_qwyF6lwU_#ZjRu|Qo| zSS|3+eZRA{R6x5e8MF}U-JX~cA%n<9^%dFDm;gH;C+GKh>~X@V6h?K$ZwIYvrVt)~ z_+LcU_Te8t)!i1n<&Dl#oRJtVc@onRj<>+Rd09O%%s`#3{lx&mN(uz+OUd|6fh7qh z4X0CcG^wUvgA)@#L=EzeS3WSGC&b|tR}ow26b$!4NZr8i2N;_vF#4_Z?v7SE7;hzK z*5xTJ=I^vn;x`7(LuoP}0f4ro$u1Ts*sVYezyu=WiL45D#p0z{Ug1I1q?os2$zz6= zN61eQ(h@ZEEAs7t#}B38v0YYhr1z4fG^$~|selp)g$h2x9qRZ=0-%rn2(92$WuXYe z5Za1hO2sB;Xd<7$#V{~6(kzJ@Q3`YzDN60$cgpbKQ*{K@vS)*Tkw!0LQClq7`9d!3 zbvZPz;f;Xz-%P=~FTek^Lw=`X@_X^aY?A62!r+Bx!4tcr6|G9gaS6u~!Xyzc&0hH+ zbU{KxdAqe!F%TzYH2Oa3D{$LOXBuWS(U;$dDGtpf%6OR;d99V2BI_=uP52x(WndwL zMzuH=={}aK&qSqq2FSYheCOi78jl?YeO>Ly0XMQ0?&urI-I68YtcG6hS^!|9d zb4=05bBg)1y$pi{A$L|CV(Et?Q}8{H7SZ7Y=7U!9eXZ~#>nm+TQp9m<@z48Vj*We+ z&InJvo}UHTHlL>i$9=Mb~Z(|_?3>!Lf+M@DR{<>4>_w}AZuBf$jNYrG{#*RE)*(A6EQzk0C#fDlySzHeJoiD-X# zIeFQoBP<6~06&JGhkD0=V)bXvSX?d%%in*#)IDk z$4C?g-l3aIJAzg}!tSK4JC&gv{Y-S7w&?IJBO}bT6v2)7D|};UOMh2~9}`D~bJzK% zFcRqKjK6J-77P=D$+h$-oOB-PQQ@23gAHkMs?y>lA36k1TF_PhM*t&Uf$$}aAP~if znd;ljk(WB%1)at*jLJxzcG64;;p%eM9NOsoB$y*b4h{&N5%GCHX2oIAan<8(7JJ!S z>?J@U#tq(1>`p_6-CXT7Zs4v)l;=Cr(B*xJ{Co#y0VyVBvy*jKpu zX^K@1x0moFZwS8H!v>L5yyvk;$^+kI(4HrY-p9>&mnJ@e#Hb`*nZG(WTqi+ zsH876$|!FqV()683pucYTg9Dibn1&vpju6Dr&+5vTpVPB{mjS(gbkdRcDUu;-Tt7! zKNMPkAzrHJHfW}57TuP2Gt7+S67GpTi50PQ9{R=GDauXwe*1&i%ib+ie+MKXjHzA$ zo|d}ZX2LXfa68^pshbDQq!iqry}-=&tfhpzA)*qSsNp@FHu5?cHwTU!bKgoN&*e&t82qZ1(dp>^h#ecsNx zUJsphgl9Y5S-{d2jKWIG3(kwiZ6{Y>MVMEOx5~G?+bAbj067cT;f5A+(IQ)MUwvS7 z0+jB=!3445=}uUDa3VqP6FFKCXKewUsN@>0Q(L`zAePla&^rTfBaVtDA-U$=;;bU7 z_6jxxmW>Mjg9vY;Al{a@-N7aZxA3+Gy0rtMZsotlpE%qalUPCRJ(!M?cGPXr-M}(a zNLwfxb$ntc)DmwT_SL{O2#{5zS=x#{V>aX8iTiFznllAovK9h7*KT%&}XH%lL)my4=DKpC10lGk16>xO1@6X z_bB-C^IA5wAyLZO!aFJ0}VtD7jfi;~w;vY(O%D4C?>ASI7e@+c+eC^=2ZTPS&! z5|ffeN|q^cD0z{RcTw^IN`8@&k5cjxN2liQt}f@{*scRjYw{!WH%)@Q*tjQcT;kJk_Ra{LdhXYPEayK$s8r;DS3gCOO#Y8 zS)$}BB`cJ?my*9rNsE$SqU7V0e2kLMQ1U5CK2OQ-Q1TKbU!vq|l>8|rFH`azN`64e z|Dfcjl>8MX+i1CBGbMW{xs{T=lqi&pQle7wFeOJRIZ4SAlsrSpJS8PcG)j1tgx5gc z3WIy;c}g~86?ADMC10cDPbqnt9?VfPf-!b!A0_{U{`>?b_tT&EB58Qrs2{kibxA%xf?XO3p82$n=JZG7W*cPe3Qk!$)et5F>kVnH(9)!EZR*L>n4kIlf}8o zqTFOLZn6kBS$vx;x=j|_CW~y7#kI+z+GH_pvWPZWJew?A7jHCeoxELu$#t0s$7lf|jYqSRzDYO)A5S$vu- zI!zXvCW}my#ihxj(qu7dvWPTUJen*TO%{tLi$s&fp~<4qWHD&62sF9*o80uxC2IC- z+~n7|xvz0kU*l%J#!Y;UoA+A7xP!FzcZ_dBv3<|@Yvad4tKC4#fwkIBx?-(%7hSPd z+fP@l)h6kRwc6u!#aitgU9nbs3th2RGwF)8+A>|SR(p}ISgU=2u2`#ml&)B-eUh$N zt9_2HSgU=Ju2`#mg|1kueVeXWt9_rYSgX+nAfeTUNKLR-+f7%j)$XM$)@ldninZDi zx?-(%g05Jr&CwNWwHN4$wOW;~SgT#7E7of7r7PBIExKZ@_Hnvmt@atZVy*Uhx?-*N z5?!%Y`x;%bR(qMQSgZYju2`%6l&)B-Z6h_oT5S(qu~yqlSFF`W>58@5!*s=3?Ic~X zR(po7SgV!jinZF?=!&)4&(RfYwfEB%YqejcE7oeiPFJkeev7VHtNlJ*u~z#Nx?-*N zO}b*O_UClPTJ1-4#ae9xDJ9lwJLrnF+MRU8T5TU)u~wU)E7oe$bj4cjEM2iyd!DXX ztI>8+q1E_`wc1DM9&5F2q}o`k(L%b=YBZS@T8$Q_SgY|&yW#DK+JIyNcsq)wI6Z^x zPH~5KKhZlPA8aDnjMW9J5}1{o^)<1ZLGEpBC2o^n<(GE1mCt*wX_k0fye$98 z25%U15k7K?CS5lbtx82$cbJQAnW3YoaQ~Nq?%k~mFsc#e0rT9ql*9*vDM|D;oo%yI z96lj$N6sw}XQ#BSW{X=`oGwg*vN_joz{Xr$J*s4WC{N&K`2&nl{m#i@$K{@-FVJAN zpmp8Z?+y8r=Nr6DG}^)BpFMlx9L-|+FulM5vGjQ^Y3X0%A9;pCFE(;dqBNU~bi{3w z39a1EM-gGI@_zCo(#HH?3Q~%AW&bQaxUa7j+|t+ZMgYy&kNFLGPEOrJZkja$JlY-L zUb_z2aW$Hs^#=Rn^k9FO71-Ae0QRvSV8hjC%$+ekTI~&a=hoE1dlRy*NqD=p@4W*+ zeq$$O{79MBr$P6pNB2Nh=#&A_jdh|E9?~2|74&Yw$J1kcG%Jkv4S;dFC&s~@CwsTA=*B+cl)d?j>7oB& zR?y!t0Q5(CLl;f$)G4^9cUyluJ>YL;1$f^8fcvR0M3Rt^Ut-5hZ^%DM5BV>%g1mnK z$bHloE!Y6Bby=_V#=Co4YP;%YWX;5`dT;=|Cwj}Y*fK+sO~z!A2ddt{52OeFU{=6K z1_1u1-oP2MZCiG4v?tP|oyiLA8wWspq$^rmFN;7CtfKVB`a*iFm$JfoU;wP$N2n-P z7@V{lEZxNLYI^7^SwU9^fPScJGh?B)h$C+7KGVTgdZ53Q70}!OKp*c9bgz|m+W(pK zpg)xr===bnyLMs}0<_`*Z2RzCA0jQv-l~D8aVC50lc?u*eTH z_SMI~njY@2WCi!|I>POvq<$+s+~3R!?vVlD9!}A^eR}Pmq=))PSwTHI0MryVlseU~ z*Zz5Wu>UzLux}awY?@vRu>Ig}xGA+^@w2SpJ~RN_bZy(G&)%6H?Cr>!i52zmx`7?< zJ=RX72RoJ(*hkh4>_l&{XVZf{l@-`W2LPL{*Y=$b80q2aS;2j50J!OTZ66Ey@1zI& z^I3tN9sq2@NK3zir8KT6fmOegRsWfV3O#;Uro!-*BX?tqB=>}xY#FRKO0OEv58@)C@c0`>R zJE->Yu)Qul#=Ek@_{0Dh4|KL_sY*XT*t-c2r-wJ06}%@0fcIc0yrR}exn4+*?Oaya zW(UBQFlLr2szV#o_<-Q6P(5bvW~`)#YGwuX#NH2}Ja zP9fzV0p+OM{y}~JAU({FW(D)~05J1CVD=W%f0Z8L=dwb0W&nf<+6G}wy|H~YJ+`l8 zh3)JB*b-XLEL+Pt64KrX|5tj1-_Hu+xd9L+7^{S^H@K}kQrj{^$eM{QbAAADqn(}4 zj~a#^?G5q%^bqgO3gVjwfS44eL%w*@pb=;MRByBorAK=tE3_8|K${?~`q-g9uAZmU zgPY3=+}r@*4t7c_et`b)q0uq*;OJ-{koEK+t671Z&j@5uvs7%WKQcbr$3ywP^dR4x z709Os0GTi(F0J%YIR7X;wvT6p?dhzrxxLlP@1@7~`K+)#lNGi;lfrML$M&_XuwBdw z+vVQv_P^6(`$1ONp3MqdpLx>uovCe@ZOEF54fEUp*ph4*ioI3wd+YVy&G&}%5cg&U z@%aHDChfgsh<2Ygd@Mb{hqD6smH_}J?CdhtQqI(IK$FEt5wVB!8Szsa3&lQ-`doU< z&t!%9(g2v%PHP6o0!>Yh9qui(ZhCxg%L?CHv&7dYHsbH4$M^oM@D;Mb2WxbE>`)(k z|2RFqU(X8P3j^Rw2#}8TNz=hEZmP|GH4TRp9|4(|%Ke|55;&?cJ z!~bFkTla1X4uasbziu*X#Y&?@XN{HV*ss@OD&^$$S{`Ex;VfWCadNifw)UUJ|J>Gl XTADYEA1=4VnXav~^z#Reh1~xGwb{=t literal 0 HcmV?d00001 diff --git a/en/doctrees/soggetti_aggregatori.doctree b/en/doctrees/soggetti_aggregatori.doctree new file mode 100644 index 0000000000000000000000000000000000000000..c2c305413a48d1b58e3dfc1e761044b42522c757 GIT binary patch literal 53334 zcmd^o36LDuc^*Ju0qo)+4idZoaY%^7Vu_xa#qQ!F0dk3pi(>&{K@vQ`LGMiObPr~x zhut$+0HQ1 z6~XGFTJwD`4;kC6XUfRs=d#)CrOSnpH{bJd{QH?V-}8x%y!ui{9yV59kgidxJwpFv zhjL}CYKX`}vm>w5=S5>gY&JDzzSRT-%JK@Oq$7LA>S9&Ybv%TBs4mt_-Pk~l>v~qxn;m0iRjEszQ$wwJfWAX-&Ff922@2J^C#=Ih*xR1XW?q`t zUdo^x4j#j`W zw;liP#lQPN)v5(mtBI6XN~|OAkl)^tACU9%PI*+`b!rtN*xd?=z_?{z>xgzV^vRg# zlNIuV@(Q4S$doG}dj}ya%2M%)pcK{mOBtmmmL*`!W^?$Tf9bhnYN4oT#i~>&Ym!ti z@CP+fyOPzfmWhaii%O{}AI$8Ta@ZK+Z@qjxcC&GtR7P^PLac(Y5f=?4j`P(qZrL-{ zF;=uRrDKdGM@Er}^^#H&O{q4Pk9Fi1bYk@k3Sh=!b|kDImgb2lesMCE|UZH~*o`?~GtRn0QAnysION@;e=-WsB+c zp-eA^GQFPEL>JSK5Yu`?DaDC9y`KoOI%$ix%j)h>RwKSnMB=cMH4lT6j_hvrG3X>@ z6ZTPuu$L{uHii=Rp-{p$h7xv|6@((iGghPkNhlLSDU13%5oaU(HJ4{7X?OTYbCa@J z`(=lNkrd(Ar zXya-PB?I-_lQfC)l5l50E8?_noeKUq)c6{;~zB` z%2mZAZIkiL(xu=uVxJ9b#Ei||$iv&Dt)b*;VdP0@n_TjytJO?XmNL>cvDTZo1Mz*Nc9B(dJiG}X*JGbY%KNh4OHwaJ)GH{y;%)a%KJf=L%DWp{Xp z8a7rnMXfBk_95Ew8E{rOJ9G4iaQxU&vQU~0{a`MqHl(^z%GRZ3PH#xCjLZiDWUVe0 zo5F$wDT36fbz!`a&ziOd8H08sYphX~Qjx+TW0sNPd*&D{FyOd-efVb5rl$1|VBc)F z@luV1!SaVrOD1}O?l^z0P?MS>8ffvRK<}6X8^pq7cHFOYjN5Di1g(LpY$oO*!+F0$ zYdD#4OHuwW#)+F?#FsIfowr4@Q}(fQ+$r6{u{uoL>uGVcH^9-|4o4n=Lf-&MdYE!T z?QlaCoKTh^rN`Iaj?LG-k$lO-*Xa|&^t4OO;^JafETh(x)vH+r6-R;fmqRB)Y*m}N z1qJFR2Ti2nxvE_+m=CJea=GAifeK=)DXSX#9FmS|)hI0l2pg)F1yS^H<2-O_xMYjX z(qzacClg7IsZ*dqW{zf$sG8(b)Jv@t5t;6c(Nk$_;Kr^g-G3#}XjxZZBCF5AdYt;mQhSa@7^e zrRwNlR0VQqGqodw&A;=11666o!vNJsx zJKl`h)Vw`8HPcX+7B_=RkSB^bYDh6#+(c314|3Dgcr#{G^FSmuwV>3P>c}EziM7)G zULi8ojm1@%a6UJi0-7J=Tt0N?wa=F~TgG-q^3$!uTk{pzzcWWKTyIDNE2lYMECG)EI@}D2Awx>f z!;)Wz2Sd3$4XVTaIkcG?jby4zhabTZJ!n#|NcBM#l_!b-M?M{1L`ootQt}Yw)8YOg zE;|G2aBs$JYIa3Z(+F0wBUJ^qJc%Ni^hLG@2IeRvt^ipXZ>1}8c&b)z+8)-du(qb6 ze0GI(={q@CB@Dyw^gzZUd3-j=BQbbP)6{`2PbY!^W4C)5WBinghbAk4tD__vf&?NWI9rYH>N z+-6jWWRxaZ3TMrp-cdy_s#hhgj}eiQ{fS$OJZ*$FrM9$Tn)Q}d``m7XeJ^G2#Pa|D(Kcw?6|PUQ-hrMJFNGV8N7FE zQ7Xf%6sau~<9)I-ksVKm9YoZVoe5z)mK};Cb#^FHo1H!Vu|p&4>97+wL~qN^WIQ`O z%%3_tlrfu~iN4uMsb)M1)@J@gL6kvcmR zsVzJEBH5AHkg;ZnorZWSn_8>IQ3V*<>P!sUnt4j_w_HvLyImK|c)TplB(-wlOb#!8FV&vEkOYM_IWoP=7sp=G~{ zpp+U26S9nKGk@8-CX}6Ac&Z-1&9ts%d~e-~H*cHOOPF6X|ut=Df2p+_PKy`Ko3E(aO(E@=$ZzLoUO z1JwTQBD>QoD!!QP0zMjPP@UP)z~cKulluaow^Eh_CreN~oFxwp9HKkZ2;mZQC5o7(0AO={ zERyT@6W10JDN}9L%c2bc>sH@Ny6>`cC2+26;*l#4<4&NitiSc7ACDxRmqHwyoftnL zOpfmnJj2|ixumA9WL2$<6~t8qQ;s=$fMw4)grCgk3-sr}0sb|PRw0+)lcoR13w!f9 zY_+4;^!#cbPJTSB6<90PowPk<1|GXITky*4Qe@AT(-V=Dog_IudPX=hbIdQ4W%0%h zY-A3GgTK`SFR6 z0^MAyLN{ZVj{=F{eNc+0aKqoaRP<5Mp?R@cI2p+TFCafQb98#n1unHTp(Ob9g$EL)r@Ga_9=!Qs&BU6Pr6yi9S!Q^F4fvNTVItyuY_= zi`b(?+PUfTE?rGk#qkJ=)Lh_}7;Q;O6Bn8SJrPt|3nyTOvyh(*Tcfc8uRPeTpDyaX zwy5-(ie37%kwAFuiE;wlkf;W^a7?Vjsg79XkLJOH*?O8apSs8sk1F-fhF!w%h~!|NIiMLx zY73mPuBq(4*0O4#S&#SP%i4g$CoB_3Gn zl{K57^N|GYCxVWR@3jVNv45BJJdP&GVq_?%NyXd+;ry{9!m%vE2rv}#{;QcT0Ah3_e?5qAPeFa?{LfuBT=6x z)F+?zXeHWEjdj<>E0X3mo5*#Jc8Gf$&x)!`LIvj%2#eCZAXdw?>s7Al0f}5uS@fzS z>!%CS(L*<%unqUANVwdrV#k`RbrPp)+6oR{b9;tg=Kx#NQ?S-g7pgNEeRGN0FrSWu zX_czS=uVuXzf`4qQM=xt?eX2E>g{L)s(;_^&6cVsVH@tnNVum=AwD%gsrunwk%G+# zfL-wyDgAVd)Y-N*AiDOdkf7q>HpkQlccJ*91< zeJ&F1(-aaDiH|+J5Y=W$-+5VLfQq`yR2|nSLQjracSAVxtYN1haDJUH;{H z)NiKUMO}r+Ow*BJWZ6!P?+s)cmZ~|PpsNDCMW?$}Z)(@^7biJ}N!)6DLLoiU<$2`h z9(I;_fDcPjf@Ey&FGs@QqfP>ntmwMHqaV;54ZjpQgC%j*%=f*J4?RF=TcDEpzVYxt z;k>mh7|tccAJ5lTVv7F_JSL+ck%ZuD5i_9xH;zZAv8phF((6!oL>sd&7ie zTU?4>#(IQv8FThavp7XE)+3iTU-OZC-9=SpPA%hbs-{v9%Q!8vEJ6_}2mPwYUOQzQ z7se1ykHQqRahq;^EO#>r|Ho z_&KKE?3BFO@@(4 zM&mU&`o{#lDeA3#I9TPSmCKfeoeyTy1L7+;5JuiwS)@NW#8ci`X_6O5fpUI_>4b)| zCN^YGwl3baeA%+;dZs&b*E6GY)4MV_-4fHow8vJ`GB|8ikgmaxGwU+v&*?ZuO>FYP zX*gpJ(=XQHX>{zGeb89O?#^daEmITqEBHoIv#p?b@Be zFoJp18!aY4f4ju-Ar)U#*qwOoI!AK6g(Ks9ad7F3%A1T|{(p`l=Ulmp!J-41T!Sex zS=1HXQ~t(!AD6Z`uJsV?#`IB+Df&oS62cCN+*VE$Qn$&tB{S+q;ACYLwrpcknT7(N6{_dXabz|h_f8=td?bps4B0dv|V7| zVq*Lh4?9`2i5+73bHDoY+VIu3N$Z+zo(|QDo?BY7K6K1KAj9G;y zYS6=FDKp=~VdK;$ps^rhk!B;z<2_gjyL%@1SW;TQ2(^wQH=*~%>H@2EZWPqTy02l_ zoteL$Y3UR*#tu=aX6Mz@?zHrlSgl^iDW5oPkB|1$F&RQdjy8s(E2%Xc`kBpKpaVaz zP%DE*gapp~B7-%Q8A&Y4ZYI1fliBzzsMV^vNV#xwU|K67^0aD*8fw2htud?Y7>;ZES?@>I*ZE`}t>fDHs#?5Kc(J86 zeRkWc0yI^2QL0vjD|JYeeLkuy)MI12?ZahBMj(5c(~`KbQ#Y-=>vSlOrB9GQy` zj|dqW#(~Leo`?slq*|r(?K3#Ax1nMlhlNs|Z$fbG2&q;f5r{Tw1f_8H9N9h4a0(`U zngtAHz~;$1N2{-$hlEMZLKViEr$+%9)Zg zjow{ZHv%&g{RqdcDDjINSA4QQ;fPMaSY;}Mj!?@qc>;v$ukFG03N)2L2Dt2Gq{BUI=IH?@lt$`SU>p0 z^b2PWU)}|~#I_sQ(rAcHd3R<}R$v%V!Y!>%okmY6^VFh(0t=J+z;=!;6Vziv*p0yD z%a6=W<30e?d8Ot6L^jaB#>18<%IKJTzw2NxXCd#XL1%D+Qo#%equ#e!Q~ zC}CqQTp0CObfGjmZGKIc48TjDTIb;#8)&2o2Xk}XZ`N2Jex9=EjFxReZXNL}{cWfQ zmuX7^hKHSxP2j%*YOis`ZxbCJ4sN`43d+s6Rbl@O zd2=kF`~8H3=`Wj@w|R-_4(O)y!vP3d?rH7Kd`36M-2){gZxJo2@$L)I<*wq!8aC{V z!cZo44RqY~VP5RvUQ^-Tc0v7Gwbewmx4RG}WdUO%STMl@uFXZ<(!|X!saADigb!NH znB#0Trb1m*YfOIATb~c7r?+KQZvplXMB(}s55GJ%Pc(XJmf0)9n^n!SrnVYguV_Rc zSEg0zf{d=0kybx0VNmP}uUcwMR zcPp%jc!GvV?*Tl8ze;3^Py(&KI(PS=kYC`h;uGkPko6WJ=J*>cwlF^48^T8~!|bP% zvq91K$Hq3W@p8Xx#4FHQM2A>UC5Uy#3~JUnmi2kH)GfH9m9q%wua2XYUNX9VY|QBg zSfhKsVU5a{D0OqpZ`cXx%I=r(x>sv#8N^>i&^Y_4yIsKrIhD^R_{x&P&vMY7kheVV zom$r#wE50%WVb8}dFN>EHxhvLYi?X(Q~9IR5p4G%&_zPv+EO-_?LI7Bp&V3y)i)|! zHBik^+-ep*7;Ska?>{+!pqcTQ6QuK#o-}UQ57;UvhA} zOXW)mzOw4Y7dU9odXe`@jw$W&Gfoy2d7t<4|=gEb%# z3kQ8H^cRK0#}E7F1NXC3zTYn&eblM=puYyY3mGu`7|}tEl{AFVIkkdp^#{#wc7zy$ z#;x|afi9G>e4TE0@m%~(U*BhbZ4VpCJ7?uxv)*pmsBt?clAZO20ro_o zf-(>cEuj_6U1sSUg_XSP4O@uGU2f?tHZ<dvWy8F@KIcw1QcQ*Rcm3*Tprb@me;1fMn5 z=(PB>Ue-ItCJZ^_K3#16UciDhx-u6Rt3M@Haks8BxWNl6XN}>qgmt8}R<(m4*yusm z@75alvDQoplkN2@_&H+zY-v^eTHjQQ1)AQcw|a+1L5$4{s@kk$rGe+ospZCcT2fkX z)e6_>Xs-^QY`{V}rGeR)S`CnN#CMPRM5;>sq_Bw1bOqeRrQ`G*O3wPgc>q(rp=wwO zAYGNJom00MBUp3e{2VeiVL>Oj!e+jfZU-7NhDy?WtBm+ISQqsogeHkKJQ=24e-a_W z(E0|Y-e@(kkrDGnU=+72x3FJ+f5+J7e^KCzVhWhwDpe&798)%nxQqQ(3{r;2us!f5 z5Jlx81j*Q7#v78p|3%?a8Dt@>bScB)n1Nli%x&a$g0@2eGH+pABO8ky2%qw9~9hIom zlsl)^7~3J1wSrSS9TkS7!XWgWSB#DNb&S4WE67-JT%}dV9b+XO6V@@-=`|7cj295; zAZiQ$HhArZp;j$mMjk8M zNP)DCO%yW~xh_=~OqKSEu|ld}?Vy1%)|lD^RT$EU)pX|SBXe?%(QQJeAX-f*Rm6eW zc^%q(R6Z{6mYL5e35Dkw1jc&Q0_k`PI;i#^tYcKc*e>UuzM*1v>*gC8?As zFWekm>TrW3>c(mcV!j!b-<02w|3dyB@{i>oR7SA!p|YBsJIJ|>oVSy6A35XXWXU;9 z&co!KBIgNmE|T*kITAVZ{s}q%n4DiF=a?I$@xoi{wF!hZ-MhSh$oUdE zUnS@F$oUg;{v$cxA?MG?`93-So1CE)aBd-IGdZ`Cb1ymD$k|QKE^-c#vzMIX|h=O8&J$vHvJ)8t$r zr$mlO4x3(VSY^owdk9X;7$#Zf$v>{BZ?@&XXv;rtvnaP&jN2^2Z5H1)i*B36w#_2j zW^rw^sJ2;5+bp7O7SA?|W}C&b%_7-macr|Fwpk3@EP`zozc!0ro5ilpBG+bdYqO}e zS?$Hj7r9#j4FB)n;*OvnaJ$jM^+hZ5E$4i%y%xrp+SLW^rk=sI*y3+AJb% z7LPWIMw`W=%_7leacHwBv{?+=ECOvV{x%nVn~S~8Mc(G(ZgWw$xtQBr#BDC#HWzK1 zi?z)~+UDYHb5XXr7~5QgZ7#lcg^KQ#mV6g!)i>mCK=FKA{(=0Lrq)?bm6x^72J*4i zxrcnLbw00kG0Mx$j4ge z)8u2V^BMB7)_IM5taZLhKGr&aLO#|y-yt7so$r&6wayS#W7ayG$;VpfUh=Wl*-bvy zItR$dTIV?VSnJG@kG0Na^0C&bk&m^`4f3(pc^~;$>vYJ+TIW;bW3BUx)+v#Xwa$y=W3BTO--$~SnK=>`B>|Gk$kLmeusRlb-qD9 z);ixJA8VcOk&m^`GEy3>b=H%Qwa(q-W3983e5`dQ$;Vn}ntZHvX357|=Q;AR)}ihy zYaO1CZyD>ob`~|W#(J#XVWX66JM#%y)OI-2!tg#Z!@;V8T~?b{tB&c$L2nB@bV3jN zVjQ+p<&QS|;z!3wYf?|__F!Drn`OobuMxwxUh3GaMc=(@T2Sa-u0BHBeewLmK=+fK z^DtboYYiqaOdK6u4KqQ)3Z!vmZM>QhTSNZ^qo3wBKZur$O0VQ)|JF zTfp^&OSTQt8L)XBI;q#Z4-a5%t$c+Vo%!f_abw8ps4h2Fnyb53&deS^OFc$DxS(VA z^ebQHm@2Q~kAL1aoR#boSSzNHL7Xwo)y)082^8!2@29n$=#87ZhG>OM$+M#8&E(+T z=oeh&kMV^AO~#@+>I!sDZKpw=J^>z#2Dn3WZ%T{@`=jJw|2i$OZyNyYV=-Xeof+t- zqAPMe9`e@V#KOA;LHiQksPesc0LTw@L&kydq8N`ZpB$Z#7P`y;=*GLzna9-eUBmGh zPbSBBA}x&f4S;bv79%dg6_pz8Y9@nR(&90fl4BOr!hHV#n8PY6A3tf{A&v1R9N}#3 zgwo?7|3q@g?@SBwjsYMaiZ5oI386_ZVt~2X1MkO@Aq-hrU0*j2j* zzflnp}KAslvu>pWT91ol!Yns}_5SdMm_EcJE9~uDdfk?FG z@iyk}?D&$ElVg?A!n%6^tkEr$7b^@-1u_j|Q>000-7BF=;OVC?og9<`+q$-=wD3>bZ!99k(HP>Mb*&~a9TXL}Xqy=_jX-XDgdx-J=>PksE4lEeK(T5$I-A>1BH z>R%;?`cIn=MF1@+(nP!rft0`6RoS5beS9PD?}0{id)V3X8Z zzFfoow6t^rx&OlT zcrpIj*vzKdSn2sW8DT6-TxU6?hliL`+8d7 zjt&4WL?4CU%pMQ-el52e!w8y+-E@2a#33tf zJhy|#V|*|<#vN&4JTU;q-QA^XUiuvm@3G|Y4y6U}i2>m4>V}8=zT>eyn;hHIX|u!WSKbG>yu!oNz6 z@Ox9o+E9{_ELw9-x0@!(!a4(_?Mz|9Q+Zcn$gdT+9h2YD?y z$W~e)FQf$0b8&S%$PXn4`S;TT`Q!i~Lz+ZfUmcI_pC`xm3u$3{DlKfycx=Cw9NU-E z!uE7p*m|rN`cKKR{c&2@E~bU;N_@HfAUU@GlNPpT(!$nb`^0UxCbnTVA!sT#%(DYv z3$tNp?X5r;Q^yxyHaWzH(t`Nh01(6WUNS_jM;Shm9N@9E06sqez>u9?fxBw4uFJe` z8W%^$7wUX+%!RZtUm5_j&~43Fw?)U}dnq}->uKS8Ax(Te)<%3ZIld34g|CnfKI`h~ z`11Ru*wof0GtyF&)rxS3t*u{$_H}f0`EP`2j$O z%qiPfH+wIMjtBcU$-(~c=D?a~uvt6(7hJrOvDP^Wf)ChQYu)UG1HH<0au_bN#D&#y e7gLYU;=g9+y&cgQDbdMw)(LNPA9QOz`+oriy+FJG literal 0 HcmV?d00001 diff --git a/en/doctrees/standards.doctree b/en/doctrees/standards.doctree new file mode 100644 index 0000000000000000000000000000000000000000..cf1d9bfa459c2e1733ef54854b9f08885256bca5 GIT binary patch literal 91327 zcmeHw37i~Pd8ch@bc|%#l5F{sOj*KMlBfEZQzP4w$1@{oq|t$9e1hGo>8|OnR!?`+ z$Bf2cuH|S$nT2?Oa4du?F-JC#g$)71Nj z)W{^e{#kFTU%l)5f5$uOz3)B0>(v)sbn!*>pMF`joYRWuVoD}cEM?T{lD;leO4sMq zVr}Wsr9CfLdT434zP_R?R7>?rT3ymFLW*=wD`YBaap``%+(hYXTA>;<3RqiJ(>1MB zwDRY=a%*yHkv6wp@2Y9Ff-1byyHBgLDhf-Za!Q3ntEbg-RK4Tfic| z=IV^1cPq78MVqPDkeOP#O3PHyDt&Fbpj4}f#B*0snd49EGWD|kV@64zt*EnTcxitsXrdimFCoVrCuzmmH0xbayDKqYZ*DMsd7onq-Er) zx<#>gwHU9~lwwAyWU8@BwYH?ME@(w{>DVRp8IZj;U7B+MpX<`M8*y6qnPoZj_ z9O6+b3duzF?}){u=gd@|BSFUY@0W75xk7ihBuTfg?_S&T1_+=4# z#Fx-Dv!%+MLf}(nOS#)}2Z+i;xxKlAX!;sZdq>>`DgBa}%93K@MOkhavM_)^^$6D) zuju3YFg#ni!tQ^bXO(QbJlA1Z1lRZwd+ zwIZMMWJ1Pb^KAjp`xh4q_l;uvU6H@Z1Nr94mvZ%omU0WZS6N6u*FgGGSEL_tMfy@# zq;DmpnKkqgcY5E~jB39r+BT{^uBdwC4h7}-S2;klt1?mhjD_0!4b--} zqV~8eYFk}Vdp4oApj3)lF)O2EufnLxS`8hDS}vgXf`Of`*J_%SEoc&YvAMD)!Ti?L zBDx_-D@xC*tLTL#vwv3}MCYVR)l#t}WfUYp%8Xj6Qm#2wDwc})M;(SXuW`_}>G!T& z4OS=i1-DL2-_lCCd!Mw;6}*ZYcq;lP8@!Q1L8|3cNj;~`l?!T>fu~@Yk|FSFIjw3# zNBz2l@t8EHD#e;qD@ij9G1){+?KV2CZTg953tqB-`g%B^FkE$&va1B3*6V9(N+qk> zV_)>+6TmEWa$;;$J~Tc?Ba~XXx<4K-mDQq_i51lv#(OG8eLO;jtQ9c;mSzmN%#qm|j8a+uddqU^rmpoz7~eeAq?a^O??%~t z^qpBcb}@R+A6p%pBGSF<^r_UGT2s(pE6c)Q*A$-}$o;XT(+25Rn0UyQGBlf4CSYT| z-&HAFjj@@UJFg#J20)I6nPA;0g5^Lb>p%8;w*@ET;(1QM>NdE%8Lye1FJBO^963kwS|B?~3WmgZv`^hm>CFplYj zQZLlvvl^^V9EPcc_)=vt#Ul!ZY&K<0`%+51mMc{-`%tUUvT|m&39zn0R#p@N8!N(w z;eJzWR;EFwFx}({4mU9{C=+9`(NaaVAquiGX{09mBKHotnV1chQL3l{21ay@ayt}g zpNT}<^_oQP7KzOLOOs8RWm;nsx@)wcXmiz5N(FOojJVq;oKf9eOp^>;C!io>WdJo| z6@k|%pkgFrsO)M@X3NWXyC}Ig(u8b}2${pkWSZfcQY)HL&>m#{O0`q8oTW5@b*%^% z76F9%1gwly9IKX8HdJGsLDkek6REwPNIlSu)X}@APpfRG*D*{&5lt9fC1R9cs8x)b z1b~br93W>B8=aBP&=DJELUVI?XhvW%4Qx7)#XM!K)rQw+@)!e8j7=|=)sBtR zl%td;jGQ){r^G5E)hD3jwBgOEY@9l^;m#JCNX0#oYO&#?_#y$AN@vw#r-n)>q6s61 z4Ns#c07Nwj06A>9Gl`8(hc;Ynm=QGYJef86`(L) z$C_T-K-?A<2(bjaF(wRsA`C5albQzfCaV1+s*a%neS1lrjot(q>)tCcoZMlxm=o0IGVv9*A9 zxgl0oLP4gCcQNsujl}-2NLbnJHkfn|h;+9|lQ^^-GYQ#svXfP`);8=qRVmGDSYI@S zvPq1#Hv=P=TvybLbT&x4N**g~$2teBwXr6GgCc?s$vI(5jx@>_RPncyg%P(^5z`!* zOSQ%_h`9!9yrzY3TFJ%Vrd5)GuwYQmR>2waB-^>mW&1+6cmU~pPckXhsuZ? z9V*mBXSh9dXq7!0bo`dM~)6P%tU8@+vr53S^Xh2tKVO7SN&h5!)Rq)I{gjw$T}k3Z3SUJeJk9ta86R7=RAFj~pHQ z!_IAOqB9Vc-9bTtvNI51cc_fW(V;?3**V~ej>-ly#>Zo;BOZuF)@!k%nh@G%eIzt3 z^MLH^xvUgszb^A~M3g4Nj&l5l9K2W)r-L2f6p@9dhBS|UEEFs~Bb>zXkCnoKlhaN| zhLdfnZ}-IMeph*l$PzW%p)DZp-g)*v75IRua^rYB~y*}CVG?c#88|zoylxJ zICh88j^E0xl1^hAagm)3p&h}RtYykb0*{tO-vvX%}^B5&)_UONBrsaBYLNg3WVE;a1|K%D_})pi1Zpc=Fc_O@&}JUOzd2 z9`yutCjmN=ZAMVs-q@sltLdFUsQKHb>}pX|93`0yKIYk;mr{EQrD7IayXQ-3Wu|~V z?$|94(RT7!EH~T+Ok!7xq+3bx?+htpr97n-Q^X$9nO$Y<%fGFEsEO!p)Fjzz5)2P( zk^los(b{OFuz@-217U($A_a_o5 z`ZGMtekIW>#1p+S`ahW(OvG^tk6u&!d;&ot>DCKuP>WXG0+>zFw#=qPnO%wInR0qU zgskPeV!;eZH32X&fMp7f=1lBgUVY3j~AtIO6wVqzeU|C599 zBq*(x;=_HQG2XhPd{tTz&9?E=rf@VAg#lHXWS;URlkMIZo0O-HI5aUja^J+s z6BF$)wl@(6Gn4%Q;BX?5>~mr4mP`S58i#>2NCrDDr3p-Se`~|h2E$$3Vj}T$UnJPZ z^6`nWktv&awO)}6>bV&HmdXnL#0zRxDOjVz@e}dsd#2+Dakl0*{KGEh`5XI2P9BX- zrectId^#Bzf=P%a5<`9Tcl^ZRCXw&LrZGj_QfEcj^gqKChm~lK3C?L>a27}#XmlsD zV@#tbPdDlQ3XK7p(Avbt&1_Av>5F^o8ymm0i65Eum1?MofTozb^sD#~n4rWmS?;gvwU@zbVy&=i$6YcaWhrzat7KZ@+9AwhCU;hMsuf7KUM{>pn%hMGW?6wD+=6}&^{Y^V$7AZ-G&UHn-FL= zVq-kkrabg&Q*bj(F5lyc!3@KIzD!boV6A}-#D>DdVeW4-PoME~SW`7+Mk~;XM5h6} z(lY(ldeeYBB;aBv5SxPpHbkKpoPwHW0(7q@K>G-w@#LVfh>Ih?Wb5J0B!(5EctuUe zr{&Y*qw;tRX=Dr-63L`If!RY7*{fB&7pOFU+eE=8)XHs?Z?^qDvF$A?JWTDMm^!&{ zFo8{7iG;8i%?PQMmoWyoFMKtQq|A*`6$AN1U#i?ks}xmC0bN$~HX>Jv zeD_dN2Zhdfn?lPBciI4x@@M)|ewrvhdbePq=m0kMXs6Gr6}uZn%j0ywTKcKB9FxU8LlWKjiUS6dpnGbl9X>e5-gom!t$yIpGsw|et$3TIrR&DN5K-gI)OX;Ugr**`uLx8D9lfW~c1Ty<{ z^loA5*399L*P395P-Y&adlUT)*SiUuz&X~w!r%IH5*>gfG*G#%B$OR?iZR7Yg zC9_ep6lB@$G(pRVptX#>`Utqwhen46lKX58p~@?>X<5yXLkl+g!p}JVQMx8gSZhYx zdme-+o3y8yx*t%w*>F{CxTE(K8ZB%n^DVY{$C%MVahsSB)o!Eh&0n*gjV7;SG|KHu z4mLF!qgKAgP%X*y78CJ$u~u2cUpTsSle)FYLMa6a6QbuB&(n1`D)at7q>ftK=pjPmWxzmop+9D_&C{73K@lUUUE{jqRRrFu#)!S(?Z zhf@ELm74#r_~Qg%cOWPm&seM5hV0}&EfkYq*M%Cmz^u1Y3KG*z@4Iy2ogdRok=abS z&gWmc3Ou%@W({KVUq-Xgb`lN}PU4bZG6@^UB&T5Q?2%5UYo!^rB4KfGU(A%O$jY;1a5o5PPX^(^HGgBf zNUgLCZaQNu$&cdLtg93rMUxFF+#sYC)+KN80I>RCctQj2}dHq@Jx;Yb3D)mc(B0dM(M$1DN(Co5mU0 zc9CCc$=+s4_G!UchO30@Xu2WcTMY>p^9Yju3QF0fyQcCJJ5%CcP5IB~Kkk(Hmm#(z ziHD2h{7aG9uWCW!U&N9IO1$PH@g&yAW2WFYi}ctcMkQKW;?6rH5k!*oo}JPOxTBae ztaHC5>ld&_OUmB^Fxr#y%|QE|?V`QXQohxca?9U^tB8Ld?KVXGazn(e41#=rk&<=k ztx5bO%oOggQ0DXb|KSww|AyF(gnJ9%{wy;4RV@hjr&-cK;XdOd+=4kLIUk3dD;R>b zNV(}*#8;+Qz9LJMe+<&w6J>b$&i|lYY*$*8H|)pi+x|1X$>i`EHg4OUyGZZS;28Xz zFpUbB4eD!Y{szaixM5^B?ht{)a!hCSOR+9^i-bU;;&E3AD^|wLW6cSCpCUQhvIgRN zU49e(h%0nW_2qBCduw&joXsLX{5+eP9iw=ComDGSKuo0J?+F{S1)7@EV1j66vbfxf zii5bE;576w8k{p7%y?&M6O(xT$U1fmqo@>?9@Z^~*S+RClK=WXN+T%wDh=UhOg}k( z{<7knab5x7Hn_A{Y^tE>>sZo2MW3aS8ZM0Kk)|+G+j&e~lyG%SrphJ_Sg|6<>HxV) z4%8=bDF)oRspzquRo5yiT?ivhs`F~0iarZ#?ozV9$C4fl_-OS{N)8VXSzXwLs?HLJ zdjUg`I5=^>5;))0F3$dpT>c!`RQkc>prQ2nt!SfjD(yKBcW8V5Daa^lI?A*(9mk2A zHGPp`VLM-M*7S$*-c!?gW;aczT1nIMNr4VSq0M)+1jIC)A}p5vHZlaU)X?xH)^?|c z=SNwCqf~G-uSLN*<^FQv6g*suke_#Hu!n+IS<*lSf9oMlEo5Ndp_#NufPM6fn0wK@ z?06|#FYw1hmBngp@obNDgyI$S2RL}vBTeGhq^hKIw5rg@UDj7J>k+| z55w|RmNd|?l#dk_i!cC(tyP>8>cX5-#3*8n1_?AbnAUJj4enu~OIs$$q~J;t+<}8w zZ0(yXSFxx=_MPbLk;YC=NXbMjIn=*zD2`|zd$e9y#F7tAK$(k_7rtUkLUyffSLv?- z_7ZZ1oSt#){h1q`(hu*8d^FLAGA*TtPpPNlyVf_J-1gFTe~HkLF{>63RBH9CimDFEL! zBu%hQ=d&6*{oQw-p4hV=Lkx@#u)H<32=B`0Os(x8r^Ta22p&19zYf&DxLxY~;f+k~ zh7yU$`&uf~QagC$XjZ$&7#7}Y_d&e(R6Cy8MeSIv9%^U3Gu4hoSSUW?js%KhcSDR|oSyYyr!Ll?hc(@3pHn#NFk3~M7AKDN-T zeG1#wa63`Dj-fk#Vnoii!$~+aEHMxD&{jHUPn&VgK{$~seo^VOy4MR*mn8>33Lyth zgm(bpe{2_Fe-=ik+R1_FRU2hmstq?O&8mIrI{%fp9eD4l+B~zHYE!LVs%^frRGT6! zmiC~+pqY`O+PhiXS9*RvgyyxVHmBTQE}VjQJp`}YrNJJmy_O{nRP78F;IMj5It|60 z#z6U~GOtXfD_XfGon+T>;BycTRzP{B-AAWRp4cN{e68^DbULRLv#NB6-2!RqwnPM* z%Wv$ou-OS;n93|kI2}R~oESd^7@uqxV}B+_r`!X{fv6YXu(=l3yc)~w7{WFycZFf$ z-EY4T?>&{9XLeI=s?|%m&3Be^Q-sCRSA}4yq1=zS@NotDZ8Wb%xjE(ja^Vy_34&L0 zX|RWK7g*9j<(?D1l?huS*xdL;OtL?+?IgvP?p9}{Df65Kl>P3hJ;n@~x0K*PIPtwookRQf9Pp!3gd7cYN?M5(CzRzOkrS&EAJX|tlfg<;{XsPDsj zPetXK-4&IefOA(=<8+*@sQc{U^2bB4)KJuqxbSgB6m?(AaG6u?FBeY1!)4m}H@P&} zLs8$rk_IYj(p6DMEdKzcuOqJgWd}Jewfp-JJaSTx+p_cDX_tC`c%xLi=$D`dXfqhL zL1B*>I~U!ocWb)+*PyoHy{F#s%IJOP((_{> zWWtFyZa>c-X%}sOc1Eb@y?xPluf2V?p1bS?JIlcE?q8pc_nvyrGrQ_Js`XrsGTzzq zQ$$!ieOU;e8vW}_To}0${cEq`ZA%ykbISb%!zp>VO+KGrgWuS8o5Qi7&CPn4183HFW2ILAQ0$pIPv(8SibCdVdM%}4m7W2gup5H7YwK5^+59e z!ll6;mg93QX`tnJrM*<$biB`8%O1%pl?4UnWGD81mS!cIUem!-x=dUeKWBWXnpu?i zx9L;NADVFl%G?Jw1PENF;4F4ZE!V6wQTF-2-@Jxd5_aW=;4!F^cQSal1-U}5yK&z6 z3rCbzBl_w5U>~OQ=DfmXx7Yv!!`o_%aS4g7Ox)+!D}aqaiF-+E{gtaico(Cdn2DO3=a0%`s=do?DY%` zZ~c82-h1jV&+MwdsMfRBH{RL3J|Zlh{&5JN8v6SI7e=mx{touG^!l7~f5C7{UILQ$ zT9*cU=MV54!jd1&%+tAgLBUZl+Dl4@IN(p_2)xrdEP$U21M}>cX%c{oi%DRy#^DZO@5*m} zLoEp$3n76{-u8jFBQC<|VWl~5{e>qwtFkYVh}^26OxvosY;VgjFubiw4eve22RyTz zRiSFVtcv;0vMLl|@$^50;Hfb_c%BO*SHP;Ec`a6jQ|>PqPRZ+s^>SkgeN z@@jV@!mP%Tm^58Y=Ss7aPi+_#hEcI8uAn8)}(-~I#%g} z-*nab!T>B>ED4Jp!L*@3+u#PRjqJant+Qn9ogrk+$;AP1@ps$hqQ96#WJKd5;v z_JdRIFBneA8-(P2+NHrB_TzDuG|+xLYf{x_aEOJzKfxPb94SvL z@INtMl_pCI#t-g{f;lH)#^Y{sRbh-Xh|*T;z+;X5JGLK+C!uCbMmAjXiEg5i|BeUQAHT^j5mdAnKCK)rviFm7_eHhMR3{q_b3Cy+akOT?>#L7&+KLqs9G{SyPjTaVXm^3h|S*+q|8wH|tGy)*Tg zMOZw&3KfQ2XWWXU%|o>4^_ZI1qQ{(af5C7{-mQ?lUxb&upRuHYdYp!DC^&vf!wvOa z&{^>_U+_Mnku(&z%8#s@XIY6_@zX(X($eS)QkNwMw}p@cC&IS@;r%Wm;bAE`!u~8= zzHUF|%!GMo4!@Vial3`9Q`8h_Al-p}Z1>A-^nJ8NRiP|h0m++HMa0E)mYSo2&gY*+ z-s5fOiT5M6BWI}x(6;-K*{^EBhvMBVX`s-*YDz8S6gW#P_DILz%sM9B$9*E9Cp!dx zYmSw3*J11gF6_i;*7T*qchI3L!~FIvd0@nndKOm|z;B!BMM)l`yJ<1jWmnYVZ0J#? zXm)zGtEAt+mRSn*Jb)WySe*)W5ZrrCyWCr8g}UBWsMbrUT=nTKAi>b5>nwe0%`2$W z+bBnu?wi_Aq)lyl7nO59f16XA-i+9ewCQ&6P7*$z~$IJ7x^Oih~`%Y@$L$!>s8TZrvQ zRqg;wzK+a(RST-}1WOvIDn(3?&gSHM>1HYJ-qV;kkwT2&ss%XUEs=*l?~&Lz+|0wZ z5M1?@&Zv za?(}uZ$y&~$=@KP6$JezN`cEn#J7G#nsObZeCP8|ab9b)3$Y!^^%(G#klC+lL9TbO zq=9mMXuN=3MdaZMUgS)F7*+OJaiTbjYi??ldYbMc#RtOisfj(eNTZl`XtUfqH3my` z?M?L-wsM0}YgENqaySk$+B3=H!0C>5aaw6PTziJD5O)>8EZS-a;A%=FNS;Qox^y1x z$9GfY%9P=J{=-g@QxV&d$Q=TdGsx^$wIFgSmNZc0%6wqW4yxduxoH&=Sel!w)3tNV z^%5K(!h4#ulU=C}AEt2Bgng>;XliERH+)OAmYhXwYK23@Vpb{_;2w1+eWkY7r7nEM zmKeVj(6lGUhk^Zz+QojQ#rU!_;!X0d;`~mu*%0TAVq!t8-%Uxnbmwb788gNE4=LmM z{GU0+`}Yvrk$4{g#BWDtzp4fCehW()DBkaOiucJ%RwI z>IZ1ErBp&k?Dz(Cq^cv(TTezCZ&~+EOB=z z`O3%584?h#Go_+)4)aitoHUL*m|15-UcGv{PvLB))VE)n!d7cO#=*-f4pz<0k!$Ue zq!bF$@zc{|^znnTmyWE0POh}FbW;yRw==uyiHznNda~9? zC#XoA-gfEM8$ZHK?HHsy=kpoo*W)0) zJ>z~7*dA>c+cxCYKk0iRA!q=J<>hY1<-V8TW-FijsBbu7j`?ZqGG4Eg%BoV7 z3Uq;DfxR+CGek;Dwq6k|TkNLlmm{6f)^)fB`nQ0#^D3bHYg?jrw|`r-c;ob&nGm;M zhIr$&QO5gR+SbX%z-!Koj*PjQ+>a4P{FBuxq!G;RC+JO=&SIOz+wB9?pHcer`C;ck zg94FCY{6#p{P`}64FS+eS1tfe^T3EY0x(SSUBs<*g@B^eyv@0*hZ%Lf_37Y@qPCF zoO7MX^p$7ECgrK|uitp6My@n3NmgDy?~Arv4vi2J12MKQez$mY->6yUg4#S)=ZuVgW* z)+B5wmI{hgRp-hDHjL(~ph|_Cv|_O|@1h#LiIGJAaBp&tyO#9!?!%3Da$*=-f@UZM@^^VyOg09;bI*x)JY3 zlBv6sl;eDU%Bi~}h;3hY>7LmG$mv(F0Oc(#X<+B|4P1VV(}vu+{dj#3T-{5<$wVB} z*nXM=&=kQMU|}L$&`48iOrwm~qosN=O=o}lOcQ{tJE3B<5Nmuy(2PrJ1lL6Pgn<2n zRcs@sZG+5JiI4$3WwANY=mqf0-QUqGbe z?pV?YV@hO?+xe8pZ-#O0)TxOvOn;bel(3amn9msI!7qu$j7Ni+!R8dNL^?jF(67pr z($%Z7u0h&>C+>nF>k8y+hnt!sbv9ZISEL#2+EOds3I@IA_aAC`9S$%71s+M`4g13=x6K&JR|*v@@-0f(T35%H zb@)6Q$%37zmXWS0#q=W8y^vFCXaH{Rsc85L-;IQ1X8>JHvaH|OsnO$7Z@=h0!B`^S zjZd4a34NoFfF`|_@!RR9_Od4Cm?mk1z%sjpcLhsK-q^NIm0_a1?H&bE@c&u9(k!=> znlstkT9M5$HqO0;^t$KRYKVrZ;#e+lsPJpRya_=eO6=268f(gnQdWUH(xMx#ab~@r zrJbY=N)0!N&(v|%BT~&lYw$6Mw&9avkz{Md`BDM>p{PalO;xM0F5HlIBNd8E*Gd(u zvlWE12kJ;wEK0^FR;VaW`_AL*Q4doXrLS zg&smdahDcU6(6365(#@>>g*e>0xjoP+%bw#w*A2hjgTsJY%SpRS_@g-3b#+pyfLlD zmDs8@r)6_BYJ3sfXsT5@l0fE#N=cV+ZXsR69eHFiB`hFS_#g-^RA3lNn42?2B_;pD zzcc>W*5;Eg_UdXc_L+w33ODZBWqvNa1*7W8g6V(oZ%s5TW55w?#~7^lHU|3PX~?Fj zPL_CcnU^%`wwdaZ1kaWVh0+4`gG|>HQP=jHtct8Wi{5XC;I7m7ZFJJRQfsAGklB3$ z21lsw=S;5JUn|`mK^d*>$gS7Az%eDW^ypI4Dsd+(R2xOJYBJgxX>n`&mavn7ywO$B zH1itd3OUW(#*zk3GuNM1*+??2nhh3Wtk(9m-CCNxBqDF^YPvt!Y$*R>wee`%ZM*_) zJlt*@{SAt-%(*p0shg3;)`+N9{&!4H#t!4+>62x(h>`VZsfaF?MjXr-na~BKvM{Z- zjp;U!R1QJ?hqyhMV@U(0^d)C}$&zl()oSJH{&;+0VIihuF)z!O=3`ndUez$siD%SV zrCzAT+2+SMRwhb_$K)}^Bd|)LswsF_$S5g{H;P&&h4o0nEu|ItG_RbQJzy+L?RK1^ z%j?8OzAhCCRXPOp3d+-^2c-8?bYmSWsEFKoJ$(V7St9HFDbCTCF^<~D6!qB)!yPW# z+aFrmoxA@2C4GCLAZN2OXQyniQ`U+y&Dw=;syhmWST-A@aVGdq>(HjY7zvG!q52vu zG+-ROlz$Tuh)<(G%Kgi+i@{7zu)kSw_PbXh*Gm~p&bt-FuWW>9dpgqH+aFIRu|C+# z9miqtCPrC0{bAG`ZW+q#d9Fr#KiF=2{Q)uTWS*6p@1(QcFhZ*^^tr9yqSp~;5&T5k z1k(-SUky+2mpBzcUt|9CjL>9hz89ZGCa_O7Ykqq4HE}Umpk*o&3AD`Cu1a#TKbe~E zg?Y2;*HVQ76v4v)re>)D9wzXAfqugT9$Y4g#$<(z$n(80&6X&tvY+vmA&7zjKgi2rc7Q9DSd!#x z-btoWREvpUv(;(hIh_6$&1vGVg8=`8F(H(R4{1TV6NB-@0GW91<(Evn5M^1sU1)!M zCY~;5mx$`7eN7%+5^t|RAj>!LJEj%7heMG@jP*24!kQZ7M4C^=_`N7VARv_m%4pl5 z(6!dLhX>_0mNalI``DRQvW(&Rh3*k*9N(0=Ua6(#V?fr&)ISq68m9hebYuut{{gC? zOOLW}Kbbbi(NWfizTlo^^#wj`5smzPOx^?||BPiCd7pX@G+FP%Mq1et9dm5mu^~Td z6ltxVYcy-6ei3T1e4Ab*w1iS)tC#UT~n5gi*v!)LIddUxAU(WS?ag@@`L zENP&n|M?kw{KWSPoP0~;v>YuU;|mZrWX#r!w8e^T*eJ1mhzic@6Xks86 z0<>m%%Od#5UMlc5vRQNU)L_=)RVo=v_;eb73b>3;#v+a}oQGM(6rNyfLASjL;a~voZ`*uP)PG(7Kp4MN(4=zqzr74O1z4?o4%KESFq`4R+>jm7JL_9Z!^V4HkrC8(`O(qHo_tkOKwd}uyMzb0c->k zlea7+9UwXdOUUW=SA3@>qzkogVrYf3gdx?YJGn2O7;3VFc9f;&&p^%XSwdR5y{Fyw z`UB#yg#Jm5U8{VTfp=1K*Xk-VIIrQ~t$xaOCOAR%-L-0N8*@3xcP*1H^vkq?8{Zk- zkMprq9$Q(hMM;t#9Ky@ndt}Y8G66^NHjhq>OPD)b-}kLkp)PMMhCdq2aK0@T>4c+p z*IuBbc5i2r)&BMo@u;0qM(YRnjy^-JKQne*2Gp)+7XFk_;@^hX@MMCO|1`bq(#;nk z40--9D9ibLkMq>RClTBJsRddc_!x5f)hqPJA7M!Y`{P%QVM}hG=p8Fb$L@NQ2|9LE z%HTvm?eX8S$Eq1kQs=N67_(u1AWxA-vCCJHGB?2tW5YA0#_0nXYVvuc(6PMaz(`_v zUt-wf>``B$SL#d1@E}De{;h*}zkw~YwC=kAH=LPe$MbFg>%P@4>%6TYaoMo3e;lGz z!^Uzo@-Ef1vEs?;x40DVZ)1^xo0*ow(wozoD&vEuu>arkVy@FmGJcMi&STAjMP;DE zgxSRCH<-?gWbEgaRpTJDEFNUGYqJuwU9M(g$EoLLd+sJjpESYwl7C zb+u~mdAsa{z8)t5Y2mF@LH_m3{Y(wlpyS5|UQG&RpT*B^<7d56z^_Z;(Kt1uq|egZ z>Jr6)fpMAh>f(Dr&3E5;2)%bQ~G*$PAOPFyY$U;m?DL93AK9FOoVe{8Fi+f zMR}VRlu8jmAqBQQ&mm?#jyI)MqG+k1Z_O3(%r5C&_1dfqFWuXnFH&ly zQmUkK5S4;j0l?JEbZtq$tW>YLm$0MhO;Zv1(JL>yNZ-WEb*bO^qA9a}Ikg|>?W;M! zQvf|n`lax%m8~mT6=-Mh`x1C4(6?fvHI93vGB~P*^BXuT#!y~^O)#?>;j^_Eh0lzs_z(&(3F>T~6kC2;_iMbLshJb=M>!U_E{7Q+sX5$o-!a#gKo zN~v>mBukg8=ddqJWqT6LoJ>Nn4U5j(aM`>pmC>r?C5Etu`bRM{xRNJDTA^QUPNNWAjg=Q`xl%EP!vpap{Ypy78i153>~9Bqu%S_3 zhj{tML_hG{RGCdT6;CmC@lP|0hn6ZNu4mOsOjB#KtPbdVJXf15ptAM&paKob)N)J5 z*6BMSlXEFcH7x?Lzl|j1Vg2&zB0Nx?OXaXPzd-x*m-N+z5{doBD$e!QQqQW>sUZNh zmHp;FQ-u;vL?9Z_?y!zIa9sn+3_>~;STCcBO=umubl}fzz{8N9Qko7X*+yXtnF%;E zX-cQfk?#rY+;;n3G{Qv&^kC~7#zM5ho^IIWe1OI@OFGa3cas==H>Y_O%Ux909UlMrxW2_OUNW4*Q~{0*`OH1h8Vya){bQZz zo3$ITuB2tsv^ELK@}I#BNP)7`o=J+Qxb7~B+rZZcV=xmc#ZI!=twt;+ILvbb0YYzI z!QNhOyoH{oOE}cMNUy%gUTxRp3=>t^#lt!!Bk$;neqB>C@C`ffYK!trx=g9a>9Z2x z$rj1T<1I)~i^w}b(MxhSpy*xTp+W+cr&G&{z9us# zgRvArGXkZ~b{c9Kk}iEMag0Cj&Nona{>2D#|CIYhel1QXik%EUQcnJk`7ApTJ1#hF^cPMx-1;0^9f=^KJ zQ3^g!!Jkv`1O;EE;CmGO9Rk*YtE5J#D05I|bKJu!n-DQ7}kB9|fZn z+)lwM3XW57KLz(ukf$I^!2$&}3SLCP3n+LM1+SpsO%%L=f_GE!7zH1s-~$wVih@s4 z@K+Rkfr4*P@HGm4NWu3h_!R}eq+kt9Kzh=LlhjQV2pxk z3Z71ZLcs$R6e&1M!LuniN5S(+ejlRXdW>%J*HQ2YL_YsA3Le95sr)-AxEu@V`AaD{ zM?sx}Z&L8L6da+%;}mS80=6Qk>+4BRYKvvqd6-wGDG%rVslk+_!4#yyl%v5EqrsG- z!4#swl%c^Cp}~}(!4#mugulTAzrlpQ!34g+guTH8y}^XM!34a)guB56yTOFI!34U& zgt@^4xxs|E!34O$gtx&2x50$A!34I!gtfs0wZVk6!34CygtNf}v%!S2!346wgt5T{ zvB89}!340ugs;H_ufc?_!33_sgss5@t-*w>!33tHFe-!33(ogsH&trzd6s_s|owfP?hJEZ`_T zF$;K#o|px^pPrZn%+nLIfD81*EZ~diiCMr`(G#cp(KZqTnAW z_&x=b>k*uw;C&SQ7Yep@BedCL+Z2rBj`aLt3f@J*dnlm$>hqf^pgX4X z^Ayl+vH2$`p!*~9w^Q&o3f@5h-8_}=rhwUWTB_zYotDVCO@A{Pc4pJpS~k68+4Qf_ z6SL_D$*_}6&%Y8+b^TIt!or3`m!{#Liw(gspye?%FE!Kgp}H7DlPMO93C`S1sbI~4 zSmYH=kyh&UjuO|KwX#fG9OW~Y4z!+eWpi1^n~U^rcBBYb#nbY@2Dl0&2P_yhV})id zd1;~eN6~e?c0&t#dD=OHD0OX@Jl7WfU9-lZ03P+smvw{7y?(_qF6jUVt`QQB)Q7` zVOZ;$e+@>4TGzZT|CiK{`)oeeyNorSi}lsi(PMHtapKTPT5J)P$MRob#pJ(;KTQWZ z#iRWe4*QRwD7elko|X7a5AJb{iP5e~8K4?>Xu@HIgcU7&JuwqAR`RhF`{VFb{-9kd z^WR4fo5q8flG7UBu^Va8woPJh_aRo;%f(jR7kB!Sylz`)#&#iTTa5K0`Dq=Hd~++w zg{-V7{?zRZPu)|ZqVA>+s2gdePMELn!n&z8ht-`5jg8fcKh3v>r+GLkn)h@-vzrjJ zqkC+PVi#8RG<;)vko6E%f0FMCPx4e$B=7Bj`UkjkO9G>2}sOY6{ z7VX-p0D95)VqKdN?9bnqg{SwWQPJDe0li23`ODSVpg5#9zdbzZZ;6U@xdYM<_><0A zT`gmvr26yvqu~kua8v}xIv_a6d|@92jSMqvEyJJWuZAc2OHq*=?||e0b*Ar8pqK90 z@~8J_;pzQJRP-h~p!bl!Os5MPMpz`-G|)2cv-BNoZM-VQ-xd|={T+~ghbN=0Z$7(9VP{YG zg(v#%sE8iyfaqZ_qAi~h^pVV8wrk;OeO6So4s}4Q-?Z5Lh?e=R(*e-jn4x2zbk1O8(C z%kaehJSt*uT`^(@{fWK&>d@n=OOZ5^an)@rMC?G2&h8CQ>`hS-d!PeiZ*}Qr%@tXr z>yZcGq9DK?kA)|9Br0+bt{}MqM(Tm^)Pwd}DMeO*B5!>%i?EeW*?Ej96*h3u<8%}Ejrvq196M7uA8A&4+q)?(TrNL@VQrEkih!;!k34coO4Lk$6uBB)WZuq!lExFW4W% z_FZBLX~>`2$?()pL`Chr9Z>6{iTQ;9PR@p>EgcnY_eVur&7W`24^P`eQPK85RI~+j z^REw2+iRnuEfp1QXZ`v1{_wQDFDly3L`7S`#=Fmlr|r+9qD|?5Hn+}!c5TR+a;fak zzVC%6@$aG{ai#+jV=nz4Be4>|!%MCU-NFAlDgx6T5Gc12h~wi!1Ic~<4BQ@`zH5*) zk^zhwC4B*(4F<#0*B2Fiv(eCp!|3WcIpNR0Q{m}5zC8N!uf*9U^BlqzQIZ(&O)npw z#B78lZi|w{fNugX3Qyt-A|&zZC`kdB9z$mACN9a+`S|p8X zl+(!}6K@&=hB;3SPvZ>{(%8v)3vU_&#yJPV(|AjSG~(_fN{<};c2`xLK=lV z_^Q6aayG)8A#Tu$=|Vk2&KI-rQm0?(?(}2#3H(=EddZTacW212sNsT>-1pXJV*eM6 CLahb> literal 0 HcmV?d00001 diff --git a/en/doctrees/termini_acronimi.doctree b/en/doctrees/termini_acronimi.doctree new file mode 100644 index 0000000000000000000000000000000000000000..93d3646e2c7a6e9bd90eb0475fe46d6548f787be GIT binary patch literal 76322 zcmeHw3zQsJd8TE($FiP&f$g|#$<}B*)ia}+(Ma-hERE!`9wTc;_yML>(_J%FrJnAl zs#~Km=HUd`_MX}efd&qcz=4p*CLtk*unswd6SF`d?+rOP3rPr$S(YT6-E z{1c++=>c(bw-JE`jzS<%7 zTkDi7cSBi27AkdPi!-meeOjeroAcEQAW)Xqnt2D=b2sJ+n&aRmuGbf}CGToezFH1{ z%xk#|w!Xk|HeXsQ9CpeYLETigbw{@^>h-F-v7#+fin`HfTxYCxH)jKy@N0u$=QiAR zh6rq_=>N&)^#!wNR?Je-$=FV%?yf7CMZJDveRUq7uXn2RPQ|Q%!cs93H((#^-JHoN zPtDs;DJX}-hZUo;ROstd6y@%Dd+6RiLElqCx9w6)oYsU4U%6J9H zzY+g##=l$e?^aN?VWDI%X_Qy`Sl!rd?5P^J8^gw4qu(T3VL?Y z*7ahR6D(==g^Y7?k%&0FZ00M*VP*e#z{Yw`8|CBv%YC;;WlPT1Y6TG17ovg0alY#A zmHWr*?%Jwt*4+VlWb`tvm^bs9C)Mtnfx7Wphgdy@0+{xh?Mo^MwN z)nb_Qj^$wM`D{V2RCHUt)Upsx2gQ6(2kP6uPKx&}(flVezqbYRjUTTY**DY;&3Jvl zwBa*-bt2QtiA-NjYNCnhyNPM1Z06gEJ3Sw5WOYo4cF5{rBC9P@OOd!a$XbNKu|RgO zi!m5{ND%h!fUqC)3EQ4X*gFyl+nz|+y{sTiy**<&iXcOonn+ozXjarK*}0G$4ApfVK?^cCK2f zn95?oRM5sPl}!cex1tx(3@K(&d0ka^Dw-nNIPFO^PP*chiX|nlAp&CNb=#p-OS)1l z74eT64D+Jtk+#EqZ1uhnG-97jYQ)@~&B&A6r0WvNvy;fv(KdzTO%@7D#n2V~lD1SX z=nj*op;gZlc@@KSLh7hpS753rOS)F9D3y{j&y1;pF}=@kw05|s(|vJ0AnFTpM8Tv> zl(Oq1L~V9AR5W{05A8#=u_QeyW4g9Qd0x370y&bO&) zeIEAB%>pmgNEj@C8nk3u6zJ}=XR=FrMMDFvT^8uwvtWZ*7|V>rm5zIjAV9UtsLI~Q zB4h;5ciZJ4Ghrzj-*As#1|zYI33h&@B|D2Tc8&$5o1H4c#9c{?qXP{by)xh^B2efX z;FA%if>^u5SlJ+!FG%U}b)YWzx}_yw2Jvr*QnS3goY59hYZglvGbSpI3F~hN zod~U3s0=NbP&Y%+L?zrW*(+J^Mxn5{m<_r>S*=^J6(DbI337pJObBxKk%DF}IcGE*olTh6-GgStjjw4a{~IF=sOTZ%i|9>z zUyLx~M`K2IH%AL)WvW|-k~1mjx~(N$`9`{Cb=%Ym=9AorIK8qJe@g>duZ)s~@qozp zB3${gJg%Bzg;X8wjjDzm3Z{0qWa_nzOg;3-+*zINx}Ir@yrO}l>!Tc5%N5)IQiLEs zibqg9O32P+Z|p=fCaBpXPt7FMrO!>T5)^qwJ8DQV``ommCLZOosflJxP;+}rYL*(M z##2W=IjgLdZi@<$r*3?%l9ZDlJF1)#Vu$>ttfTH|$>I4%4!t69$`}Cbp%L>`W%L~l z0(L``HcxuIZ$%``kK>Wm5GSPQf!=CgEN?=__O|4wS%+8WE!e-)N9R_`de6#fHujbV zj^aApi-{pa`d);kxDIcO74p=p4v*(hFxB6ZsU{tM1Vi+osdPav_Nu5NuV~;Xro(gi z5(uI%MF@)N@OYGvogQ^~G-HCAeJ!aeH&(JE1rxSBi6WWwIkpFS<|yG^4P+_NN|)pK zRIS2qM_BXY3Qa}%Y>FGw_fT(@FbRLq0~u(^`)1-na>~Bn0cumV~@2LdaQt(R3=_0EN6P*^yMOhBbEiWJKdesPG?W z8Xkv4+#^dw^bKKV1Py~NX{fZI0UZmH-&0+WdL(9~;cX2PBkX}#Qm?Kh41@@KAQ~H; z7RqfTc1YpL%c8I`=YmnSC8IRSlAZB-dPhwsSGuU%U5tq2MUt=-dD=7>DckOgR1h&D zPyVw^^jXNnVOb`EF8#Tq>UIs&wMnZ%d663M{(1#dk^&ivd zHVxO}Z^OvQxGWizvRP<`Tf&YHv-+c>*^$hCc{Lmk@&z9bMl;e7FCcGK1$~ElOpWm0l`@VkF9r+lK*e9Sa_EdcJ;QO`9=kLDpzyBptHwqK;&Z zsv~X5qIaZD7QIxEwLeN$XLe|yJso!1jo1rO8f(uEkNT(14rNTRGukyfDOI#FiHbJX zzM_GhRj6q6Qo+tx*X)d^B|GCCYu1=L-mYeW9eSR!8lsm9cE-DA=RjKQG|uw`N;pu` zW9oqp?9lVn*$L-%4s^-Rcv^Y~FX|{e;~n%4y(4vY=%qq-CR(zivt8p)7zge0cqX-0 zi(l2i&~?E)q0r3ZYP{tNVu)s5_1+U@X77CsQ+{AT|^gwhw`3W`9;g*~v z8qw-RS{ev1YN%h$`gx**2BLRF>sBg8G`&>Rth-vWldOS|Hbs7#7z*l5P_w{LjH4h% zAU&L=7)z3h5Ai_9S-bdCE2rWlYG66}n1V27Tk&dylC&V4P}X{CWu>zhtw zntP{#eu-$Hc>gqr5vgDFo+wKxX`pBy_5PMTwbDQ-^};65*@+LO26ZUHQTtvPy(7v` zN*XBag-y0(=Si}BX3tC?Rn9%C9Is+9l(v^drcr7A7OmA53(A(uwEhw+cq>EIa-pQ< zouU21`$vX`Cx&RiDYD6lL8!D_-%wAjycTqX&Os1xS zRbn^7r}voI)QDF9@%M+&BP|KNjR>7wY-BLH!m*+Dt)piVpyGFk?1reQ#NH$d_-M=g z{5#4|p;TPNa_)HJDUfS(0uo>rFdk{eknWSjS1RX95RY6%7!M*fW&Qh4`mvUz^U8>+)1xDY)UlEMYGjz3G?!j+%uLB% z#De02i5bWtx`9>DLx?{%Je;LJhYs-f$+hW z2u~8iBa;oySj$f>RsnB#dQdz^Fp@P1s6#^@8 z>h#duqjN*|VgJlM_=m;I7jGY(oOvj7GMj;vW2$6)0xBRgJUlT=Vz3(75yYHmNz5|U0J7v%-llY9=4?Y^`vEwqp zPM;QFXIg^g%|`?_ZJg^UZ;=8NzgGd>nU?4tBbl7>)}o=U=!{V;5E?`89|H&2Sf|3R zM%C7^9)*_IsMALiOSR80e>4vf%>LbscQ-^XJ*w0>8={0CZppzsb3ikY)D{F|UE`Sv zc{;?hCb7}X+jccu(dNwpZ9a@EuWJLfAB-!Fs}m7k!U)mqAVNry^uSW5tO=BX(Pms-$9Y#S1q_HP?z<2RVysgCRk(1X^_aZ)^b!G`9DLDfgZa2 z4-2@jY6+K{Rcv4jwT|>xJzF8b>+RNv>l|RKL<-jb8A1&vqc88H0_GzvVfv*SF}kI{ z7%x>UfwWi3v|GNpRHGejK#gzXz1&ibd|1GJv?bgVo)Dktp;Y5=FX)ZU2!LIP7b*P= zi!|89)g!_5MFH@!mH=5dJ@iPVo7v;%921VUDpjm3Zj#(+j}oZqX9)8_p=U4qy8`Uv zEx~%LuxT5Kdh|@`Ob>eM%g;xK8<6&e4EX#t@`&hp(q^3$(9piS`ka z-5ExEw#)Lh;3mfL`!H~x#y;ahuNCnE-sI)Wj+S!tUI@9Xn%h1L0{v@RqBptGRgZE@ zqk1%8O*IBaVDvt4BvSa?1d3jqX2UDqMSUo#H;2_`Uh+z*Y~~zwKeNLS=mn0we+o@K(P9pS3V zhisK1_uTc2)ziH23F`d{5dA2kN+NnwfXI3yUG6)v5xZ_SyPL^X!=kN~jVQ(Ucoaiu z^UC~+a$a}}6AQm-Gu8Pl7eTZ0v+^-(UB^CSt&h+PzG3|}obHlTypMif$GLVlk(pGuD0X%2 zaBpZyLr_j0Ts`oTCKmriCGYL@jlH69Hsf=m$he%=V~i?R4LorHg&Qi1cBxv9@E2Ad zxb`iOBe$l9Ewch=!KH%d1@*)>!v36x{nPjZf&C2r#09qHo2=hM+!N=T-obTxzLZ~S z$`n=iwRS1$6gPyj9>bV+a~kU>A~|wz7#KJPCuZ<>hwi3A7BLMdtPH>ptLL(K1Ga}_ z;YQ@s);IA2e!9cGCMj_!wSR+{ovPcn=xx_o-@u=Cf<~;wOMDwry&#e5FTD@^IY+g= zjz978h!gUTNrmSQl_?$shO0xZq8Lz}`4R@};L}nm+a+v-M5od5 zv;&mG4`SAW8oP0Q=c106AKal@>yWBbsmIE%y-N71SJZ#%74@Gr6?K2d;@>_nFvkTv z31`72+ph=KUq@bL?L(%0`QH+a9LoKj5@h&tzgL2RIBz?_+a8HjK5w^j)Q-T*zPx*) z&W#vJWGKa z32zT&{elFEzN{}YbI@e#C~M&>=)N-_&lDd1xu4@mQ6GqP0fQttqwOrVeR9p zc53o5zs=&O)ZkDxgd0I_s!$>4bwevGD5V9itnkoZqGpGrr(auy5Bf!1=J$EoLF<-5 zE*(saHhgT5f5!muOpRkugV<6F_^JkTQx%=gQE(FS;S4HRn9aFDJ6qxp*;Q(U`LqGg z%qG~4ri)N4|3>dB(Hp4G_eoT_cs;rn_2@m_)}!_n_41qi8wUnX>e@n}_B^#ox02Q6 zwubmZO$!UoAxHx3_>Ja0{b3%2~azLgw)qSluhE>-;#vO%5~_xpAo$@`_e) z*cG{kj*U1wC1S<&^T_vpamRD8s=y5?77g>8&-%mr{=I!dv-~jRG^nKCmJoz^>B1Gd z_1E2&ZhP^${7Tw4FyM)YFYz&B!P>SVu*f%f(ZZUr1J5M;pjRVmr`|}Ms~f;opF}F( zFxbdZJJy7=B;8n!UH0ASbGI{QjI)$4X)EMuUsIx;kiob;0XvHnLm;}V@#;XaUW|n#B?{&6VF_~lhTxP0BXJ&I2_7GkNaf4n zagN$a4j;|IK#f?I!pWS1;r*&-fI+qTsI~c0wL&(ZURXd6&@)SEPaWBI8a5ym7F3!D zM>;G8Q4V7+?C^O^l8vADH8xyEnnkZK>8|kLpYI`Jn%!OT3{Vm3EzH_H&P*s z&1SIwRtyy7bX44h75;=r46=?BM6jBk77~&nOG7@iw4O$I*tNY^H)-_ukyRo)6v8DI zLgNZ|y@}&ZE=5N5{LxY2Y_D;^)!nFLG!YE)iD(-f6a@xX-K#MpdY6Jgp`yfLWc*qc z^Zy%8V^t3IiK_S{q?5iJ^;*^NJ?kxa9?XkIhIw&Xg-C3@KQapAZVJ9i^)J>QG&}>d zVdOwry_2bEZ@~EV@y9vu@u(PgU7#h}(KE$1nbZwOH>>`PyFnb+v0u!dwO`HP%?*!x z^Hao|KZNe{w&T$?sEq$sRf6L4B)NT45Z946LXfP4l8hE%q!aJy$o3z&e7okFpskq| z-L=Ga=8MR<-_C6JHExg~tlqyXFVnv*!9<+Do50^^B~tlq%yS&IV;gf1#5zC{RmF-^ z^%S^hVfv$H4t3I^;|}|1jNKbL??Y=78PC8q`QBFg&z>1nX3jJvOlqtW+o?es)1*cU zy04Gg5Wks1i$rZ4-SJAsYm1Uwm@t;#Rt7DS@b9UVOIYf<(&rtcq?OThpw0A0KzuN0 zR7CW!^?3geFpZ&zev?Jix`;pVX_%JNVzH*j`cWio)$G7qPh+z~pKI6b{3D*XY<9fF z={7rk8>PD=8xXazJ7Rr=GrZcZj!)YT_dP$TQXez~o-JEzXg&Y??{D^xK8Z=#n~D|}ic}u_MazZ*Te(^7dbTU9XMS%ivATT+ z`Sz>Zwm>|*-dkAf{$7F-zuo!Y50OA@L4TK8>^+OgLC64j1aXPd1Zp49iI z;As?2K&6xPoBbCrj>OUwE_-e=1#DGi7u`KCpmneFzRDz z8O9*Skx|tavHPSLyi4Kp(}Ftn!NafcTm7{j7FF!p=$6wo+ zjYAW{QxM@m5w{(lM}Y+s=ZTAvqWItzs?lJ)#+B^8XorG^lu%o|jsQ(pP%G!#|KYF? zRTH#Trmd8gi_t-_a1H4XMP7s2F)JYq@e;Ykw`IUu?liL5WqR z3JiW#xiK;;)R;D`H_H-K`Sr$;;3v*1&U~`U5~=)pv&2z5)|j1d)X{O0_J;Mx!m3Sd+7wp9rM%of6c?`NUaL*4w+~bG4-u>zX_Y zj~E!_PL#?|AkV&3UKNQOO5w8-RQOW(aS8l!)^LWD^)ZQ5qL0B*J4)fdyb8-AF*irc zl(C4&TXY|&X*%VXCT?Zq)6>z0c2Vz}*I}t(UkHgejousBaI$ESa*oVu3yBXj!C>FA z0sjs#t>DcP#t!B*92|*`u`dYy0+weMLhC0o-62{6teEs?xAjY9(_T@4O2-NjGz+@2 zY?wKN29K6#`vR7YRLk@@9~e;o>Ujw2^Oq!qI4+qu=F9q{ZY6WI>oZ1_!@iivK z*{{xhVbriT|GfkeqVFPsKF%4=B(h$TNafe&Z*$a+wfV%^$k~+f`m8BMeOc7G$T|-8 zEKM~B&M_mkGqjmfeP$~YD*b555(*fIDlwr{v+?cxa~?v z6UyC$1T~@$Ai+mm?r@%wH7t?JmphfCc9gr1Ocg!k;reup((@9f2vm5O98`FZC`OSM zFgbt`BnTeVJZ&8lvWd|pe_i~bg60Q`TvIUGRG~&lj8H{qxY=-`o;bZLXXv>L+|X2b zAZm%G7wC=EP@sP}G8@#CSqX87moZLdvd(l{#$D8u_EEo#WlG3^w*jF@t`vG8ORt3Y?_J<$5H+5QyOE37M&_AmT5<|Y z*>{b=z2W6wON1*~MDSM*Ea_QcfR8{q%X68Ph44ad+} zf(qdOb(D>$;NEgd>o=Qj^>@DmJ-Uniw~aupR`|o%@A#c5G(Z$vmGT9O>+HaDe z(8hJ_F{DVLP4O)Wwtbu88;m(V|Jyja8ZQ_e#$df5k;=CzzQ$2I+7!j<3c98k=sUyS z50%*!xIy9d)JM%lYzr(X)4r?HL3Hn^;}|hD!tqtq2|ArZ>7Rt2eA3hu%t$FG_j)f^ z{8#DW?v|JPvq6Pe-`A~0jDs1hE0L<@o6)gru3hSdO0p72Vx&-1l zPdMelnwLoB*T*bJ?N}eT#TPyVV|z{agA#tL1ju;KaWaGTquu6wwM!T)W2o@dV^hg? z!OtPXekpGf5yO)HPZA{fCH*rJ$m4wBzy|BX5~=)>{vb!~SkmX%;ZwB1$Jl~$x7cd} z6G#8GkCQaQEKJD*}&}prf{n-K9m# z3OlQURg*41#xRobGo(NS@K|`}5<8HruTU=0Cx71h8>}iku?EEY8Q0jmu(!RVSR=sdbS|gFl=jflA&W`o}+9Xpy(DyB#23miQ1mHLd9GYR>+AWHgp`_=MOZphH>g)R} z=OQKjpagJV(;t;U8|MgTZCH~Msr-_@m!ozp>6;r>WOSZ8DDe)lf|Acm5D-U&Gd3)( zTU4uE^04TrPn%fF--gTzi;g0N^}Hql-Y@;PNFa{$gmXBorzKMPrT<2b+OhQ2Xs5l< z*l8bBj!h2DP11NLjdldm&}FJXIzA#nP#iT5*RVd+E$Y>l4$OR_W5->@VkuEZK94N> zGD2NTKWZo`UyvZemz2*+ppSEgLp`kLBvSd3@@bCRQBv-Rc9BK*I3gf4y9tv}SYEQx z1KD^{f|58+9Q$E?y<42CEgP^7X3iwa#D*<_Ok6p0CX|IuxG!rRAZmBk0S*bV)<~oh z)`6TX{D|KV6i#uJ{>YN4a6F?^w4m(wNKgCYSv&WL4M;XCr0* zpagJXFG!$`bA+QrtVxMf!d~F09reIXaTiI+CEq?$Q0{pN_;E})FT~Qi#q=_i`)snE z_%>u!l>2PNPOM1)7nXtq+Bioza>ROCB9*WdIBLgof0A{6+y`XiW_RpF#MZ%PUyf?M@i2n*59`wt3gT6hV{250bJNG5@_Qb;XD%SX^B+Ae&MJcOL~W2(!qX@ zpp+Ay1SR|t383-Z=aBmkb({OuF5!&>1K2p0Sj3-4Ui~6oi#TB!e?bDeXzwNP##zdP zrROA4iT0kOb}Zw}xuVHF0Rz{nCrem)qmh8KeWwJQAg2!`4tb5GRz5O?V*Nf+K2oE%*XhS|gE4wBT~mu`;Xcp<~EH z=aq-(tUb6t$qXtF*cwjYSQ%6v%J6!P(-~z}yI?NifPq2fwufeCPAiW~GS`)95_?LTn& ztJW|sdN$d{cnVn+HpbbAjqyf#;doL4ZJZ+m94$+v@-<9_qjqe6uJhf11kKMZd;1n+ z;;kMBW&J)0$Z;GdaJ;8m9IIW{m_6ImszLb_GV7Q2I*Jr3!%s_q_m#nKNFa{$WPzt= zB~tn2{c9YxV|nkH!?Hv6E5Unb6yQPQ5Nj;L(QvuQfh>GQf{r-G3&8k%w-~#Sh4xYX zT`AsT?AB3}cBOnaVQI7V2HcFfza@?AZ$uG`)Wt@W@N@1au?9b~kR^IgW(xu>{_l7Y z;4SDf!e0pO>-Bafv+KXQyWAzJE=Zvk%UkJ9#v`3ZoyHIdy94 z^wBAPh;v|WV{_@YnKN_KGp8p{-bUMGXfdvTcvI+BN$d;e;bALKB zEqpS(p8X-EB2a)RgN~=ZK2Q`w7C1&NnI(HJm+(c z^6E?`^8{-^T)-zBCe(yWQr=Y-Za&OmuUTnffjwJ!hlj(bvkh+(@D0jGVg;jLtN4Y0 zllMsoK-`w8wBbY>plu%q#;SH<0PP3p!Hf;HIT*fD9c=+VDfl_IYw}T-ihN&~_M3w&g&O;pB~bqo z;sEN;v)H5d+<&=%!q3w?ajetjdBVOvb^t@jQJ{Zto_nKDY#&UpYPsN$?1hNuc zTkREgH(KXnn;Ldz(sxv;U((3`B_Fp*uIXX3v3-Z3RGg+=<(*H$u*2qPI=jU7?7Cv9 zs1}7q94MRgUmO(UKS>m0T*q9BF@U3vH!f>7dEbv#_G_NmceGRAH%RWCl}4R=NN z2U}aW2mRX9U9jgLUy6keq|LEEn4KNQ$n$G7`{kpL@NQ{u1Abf*8-+HG_Vqx!1?fAD z#P-oQ!Uicg0UP`ML-BHNL1~NLj|!7KENiuK_jfcZw_Sl)pw03&ipzA$(7}m(ePyr=xJ$kV2;;5hl%)^i*HAAX{--F7!PrK+9N>%38&Mn%`STXR+0MjtTiKRWGh z5qAoxEcMgwCit4HK%|_yyMt;>#Vj}(xEaG5nPR@~Zh&(r_@@j6jyI&Ab~j@uEgkM$ zvhj+|Pjh>o!4>~=&4iZ<3in?3pfpz+Q`V0 z6KmY7sktjwm$H{=!laHnTe1JqEN98#EFd{}-;LfK-E)BJWT_#|!Y!r)-wyOSKS6L~ z3(o8<*_CWTzo-}Bc*5<&A)vv}_3jS+k_oQZS%`?V-d&&9=c|i&-&Vh-A%?AMOSrSS zVrw~_5Y=n$R~<0gJa5Ou2Ofm!3aox z!_5s(8eU%xuB3arFA79w=osFhs3CUHm7ftvNW7*u6 z&6^G#Tm>M0E;owG!1cu40zBC6ilbjKP=fbf?Z?dW*;F{~$-R!Q@EthMpg1UCdSMP-xpy`1tHNvxn?vO>6rHbL+Ahu)S zwv#EZz#J@QO7`MV-MyA#at07Hi|y|yp$bZ56Yi_G508P;tvEWV;q`PUeEl8b_3c~s zI>cFy>W>#Ah>f~Z~m+xwXIRmXLUP(uE#nhgp_8x|8T@-{ z;28)|DQ6ZJAO=D&>?BPAe?SfK%q5cFLP;Z=nsP=O31YJ}ujf&NSC9om*DLtQwK>GP zkkywovyk=YUOC%4e3KjUT3GN@+B5E2y?C*X#>U;`X%n4v;C7t*g`Nv!56AH?!hJ8H z+d-~;c_%fA4SaDp^*7Y}jbp~3@whQh5f`6d<3* z=bCS$vKxO=C437a1MW3qE1t0VvLl)O0BQXsyjo}uANOVEDX;EEO5|Pl8!s4NGhQ;j zZG6x8uGNR#ch*J1DEKx7-=pBW6!byxtc?_0 zPr)@5?4jUR3Pvc%P;f5=cTsSHf(I#hl!9{<=oHLTFpM_TQYrW_M)s`_Qm_R!yS15u z7qKnT`Z@*u6yv?BEVMNi*cuCKjRm#FLRw=1t+8;{STJiWlrLU9jRmE~LQ-P^sj+a>STJfV6g3uz8Vf^>1);`5P-6iA!zeK@%pnyz z80L@)8w_(ug$#x{q{4lM3-%c<)MvOrYh0MmRE<}VUjCZ#-=L_zX?)lCJ5Ni|iG!Y& z+DccfrEa7v)>8d+#ae2du2@SwKv%4#=wu&HOTC7!SWB67#aikjU9pz>F}h+c^>(^q zE%j4$#aikY=!&(}vvkE;>a%pkTI#>j6>F)#pexo=e@j=arT&4gSW9i7YR_6~7hSQI zQs|1cluB2ur4G{-YpLUO#ae2Pu2@THbj4b#NLQ?-UQbu7rD}A=TIyYN#aimabj4cg zSLlkh)Tii*wbU2sinY|2>58?~U(pq7sh8-Awbb|MinUZ9ReRP_*V7eisXcVXT55!@ zSWDeYSFEK@&=qT`N9l^SlulQyrEI!lE%he4VlCy;6>F*Y(iLl|pQS6-QXi)))>6Mk zSFELepRQO-eTA-AOMR2BSWEpKU9py013~n()K zHA7ddrCviBN-GsowLT5rRtUKSncW_^zWI%LRlC}15%vyz?;`zk3iT1{ge zrhv2=kMLSFYhoRsfCk~M0tGZ2X8i$zs(W?R8sx_Q>Kx{?*er&%;N2m+U&Qn5py(a4 zRQWEf$EEpFAuurc<~0pBgV>v6Z`>@t%87Qy-jD8^U7`NswTC30rqz<*+hjl$P`%yIMpidkB-G7vRJKb{woZmCZ1iz)sRF zzONUDXzT(0g0eiefNn^}b}Hex>*rD0omR&2(9Ct#f1ze>zV#@MyWa0guW{E=I|ws- z`t-3G>eI%@BCO~5P1a}dM>vaU$4KTuyv-()UGWTRI_EN z{!$*?pLYw+`YKWc(2RcWQ|R>*H`Cx}mjDm92DsZULw>wto!f)`t~}VkPYdji^Z@q$ zHef^d9q37;v$WD4@-;i8g?9&{b|t*6%J-HYAm7;xxv;2eT6=UEd31NCg-+=K-AFS! z&%sUxBSd<8j1S6VoJtGhtvz6zY>RO>pT2{U5SzLHy4@c0ygcS?T9|L^0drDC^*kw2 zxuWZDo7ju?Bscg@d&p18LtaS>^6nlW-_yRBt!0e$!U?rg>45j$@_65w7GCl++-<|t z0WVA`3I(Qjvk=j+a9`C)J_?8 zZwHnAqCDWQrv-R#4}d$VFDzcc5G}^HX~?F%c>l9J z4Lhans%sH76}xI*4|tEYm+2f1i^rTq=-C{-y7s{L%L5-u3-~|}!0&1goFUV^VtceF z<m`u7U%wuBV0B?+GAai$C^tE>tGL9TenbAtS~r9wB&k?i8qnVNR()>T)jRRcTL9_(Rx zuoG#4y{`wba<#T&zhF)t?!#%py}t*za<#UDsa%u?dm$~blRbbJf*M2$9h1VunI*lj*c8s$42(69fsQau9Y^IHX>>&=F;&VFb+1CYJQ1U z0=6&0J@W8wO$*+GJ;2-73@@j3P_FmNW4kLYY|}kpOK3Cm1=XP~TyW={)1JiKq}je0 zAC-rCE-k1J^#C>C6GC-q+*xNq0!+EBa|2AK{{!HJl6xrgeK8i?x1kqE|2X$ zq=oHOX<@6hS1-RHkL~Bu!uCj7*gA9yKP!*zxwNo7nijST?aS>iHo@O`%YTe9`6BLk_|)aQq_F9RBm5J7r_Sd(6zVZ~%tz9~{6r6!)n;o34s<5QM-H|Z z+Vk@Go=6MdYtzKnVUfg>^7xk1!k0}4AFR>Qkpms@)#dU1L|XXH_kb^9@o+<(G#y9v z)R69UsFc4f5Be9=0<37dbChxiXELhNO4f6G$ru!QHj8>Ee( zU5I)aMo_F2d)X-55@LsL@vuBZHARSvX$oqG;f;snAs$Z=qMath4y#u3@({HjREQmH zgEz`Ue0_=#FNUS4yH^EnX4uEzRc0|)sOHJ1;Uc*gys53bm;TfEuTp=2UopL6f6TeqgVx_V|b zV;u3}Qcu-g&iT)|=Wgeo`+~NI_b)nU5&f^ewo=Mu3#SrxI$bEHoyt^wdAgXYjXQFR@9dqbxu*OO;SHFMO4+7mTZtv zoyx4LjM(*dyIL)0M`~5DKqN2DrYj(?zATluD;2!N@3w+HE`BXf*Gl@25j%CF?2K}n z6{p7Y{gskUtS&E=or+UF=}gt?%c}Mm<(SH}XEtOO*HatcQ?@FGvcx=D z7H6)_EC$z47kUNGZX?c887Fljo=p`C_gmRY&n&8l4E7Z zDI__=xLrPxsGJ-lAo?e=>1w9m>e=d|(Z+ebc>Km}%N9^J#B8yh2Vm`*8)zKUHB~>i zXX{jbajl%4s>h;pMupjhbT(}Zt*)OFo60=9LZ}{s00tzo?LmUb+#M(dR^Dk+7$hmw z3Yzk!awt3LWZtP(opStCLm?b?#e8EE=);SPg!?Kl{ej3|*8q8c_rl=b%B6A6bRV5K)`Nd1Ce#Y5lc~mD3HYiA#0R95@zk3o8=h@+C>Iv zx+;a*dtB7sC{a5<5Vdy&qIP~DYR@6mChT${TNsO@&#SHqF3stLHv_=@QxI)Znmz~!7`r)}Pc*+IpQ_+CJ zkSXA9J*F;Qq}mV11*Bq6bte0WLH9rHE1xXI@$X2Vm6(kbRbL)QjB-*fCU3M?q9E; zP2JSBehK57D;2-gA~9h3vfGo{UPd@e-z>xz-C! zy&Xd*2TN%w46+WKV~lpj{YoUPlf>!_8>x+6of6hZLKkGKWNNRi3P`QtoMV%9oflFA z!{dGog+wYPtOw4ZPZO5YTZT{HF80DElu6X(Q8<}KfaOc0A-Z{HjnSY@sa!`xe5RZ9 z+DHz=;ekCzPnVn-+p1xs6dy*WNf#-xf=KmwP%=%rKb6L5rY7B_P$9M1i&X9i*6DqX za++n|jfH!lRXpJoW@^4XMfjjHEPDzy0Vk@-gOg#|%_JJ68CrHPVG5yGGlWY1Cbv7E z#Xz4Flg9fg9xTils(`Y5m|5N?nBw%*$aLKv@MKzLw}{SZX*G)bXVxTx_;;r#Pj3e2 z-F`R;$i3xqamJ%lw*Vh-7kYtX7^oHxS~7t)T#ihjA$rElAkri$HQVCF#W3l2cmNr4 z#FSj32~Qe{uBMoS;(OEA1?Jy6Kc3EyW8#Ensb@Rp#7Q82{4Fa+77Y6CPd2O(`f z)bavJAU(d)e2SyS3Px7Z@&eXO)L6lr8uJ^X){|Nzd2m)p`YBhyCcMBJ`bGOO$s=M? zxF=gl6;C?l78Xy^DvK5-@36XyYU`wCxd}aLCBG%S-!u~aQIT-7YZ?^aoelZ+4mbBG zCN>?J$s*hI`Zo=hizl;KZ&V8DQ=!ZKpu~%T3vM!<253{U!NS{tnS(W*ScP6!L-Y=7 zt+95C1y=k!lXa7zMH6L>)Y7e7B~fd#@-r=j)5PQ_u1YeI$P(;?x3Kiy0f*3-Jvq(933iD>CTRZ=r}x( zk(1CXEXq(yUNf3{DvK0#XKwLR{44??EpnIkRI zcIT#+(dnI=G0^rzZ-h413++&o^dNNT`y7vfh%lu)&uAH)zPUoDF9JG!P0*q5bB<1* zi_UK}M5mDjnzOm-_QdqrscT<67Ra2Rx+y&Ei^}n$G)ET5J4fBs5T`~KXpUxK+cDWO z*G}Cw7Di=w@tGqFq-S9_H$>+?8u<(l4(zdRKW6Q#VfB-ao_O|D$+wIAxRtZn zM2UPe;oV#9td;UbJ6-AQ>FVk3?AqQ*K523G4~O#@c>tG3?NkbG#RWbqLLS1|cs5-^ zngEZp^EhYiRD8^(!qfElt5rK?8DDk78&SjRGf1zpSi2jdNnX{-g8|(E~7$qqI?`=rWONgF)u`mW#?~}!pJ(7pdJG|$i+NO-X2L?_tooJ-cz?^6V%$Z<7VSS4i>!8iU zmlEWXA;-$s3S+k71D>u6iTWjqsyI`n@CQ{M;N3*iNMCsD_j$25_7~YdV(;PJ?w#?z z?w+`3wVMo>Q>|nZ#qt<@j`LaUJa*CxI7)XSeP35slK$DblmF^Q=g`^Jlc4{1C%1KV z;&2{)ruQei@aXCe>I_yo1-EVwn7-Fqb(3DzJrm?9b-lGAWcx`^_Z*7v9@uLt<(Pfn zeK-hb*G5OPDY%9@5t)HQ8 z--py19xC%PqHmLZ`WKB|N?}JP{7ez5Fr?$he7JSm`6xO(r!mwDb|$GZhsNRzE5YY! zb;ipD0_|`^(4Ik{4elD!a8-*%1XRd6)lu$=(U+vl_GmRuZ{kJrjElnwI^NY6R28?1&-n^mBk&oN zzE+6jKFQL{gcP^tv8fkev#J%dgAJMG^GU?)T=ThvX!8hA{e1?wyR9L2cacsW5k6?> zE1L7D9E19>2!QnioV|-9@hiCaVA>L}vBQGvBCqqei zs38U;i~(&#QeWUMd2LN>j}C`&XHsX;#L2ATsy&j;)A>ZxcwOk4eRp|jYka#07oEUM z4iadHBCjtsBTWG`+z_B01km2@ZF0>PCw|G!BbZ473q+k|C)Ig0KD2jtd~X72;ut7& zb$7=HFiY^Uy~M$H50~n1%@piGwbVlSiuR)oY2Qh-4-6mKv8@aKTU}kAb!TRxQe@Lx zsUif2T~2rQb?w+5Xl_?!D@C^u4-@|PnwjgA0d7{2;^Ov(Tu=a&BnGla;(LmzoxNS2 zy#+2jWfxf%rP@edI=)vrk(49+R4`!g>P?n z>76M7it9TXay>*`@4wSymFNgIys%RzoU-mVL3JmcDff1sxnjkM=Mc#tKH-eS?fe*> zlg*4*d>XkpH{mr$@=wjAYlmiEv10emhU{{;iZgE7>O`(pj1^pd#nBDZ=76`VN3ilw z&8oX6J-bR3o5vcmDW&QebVshylq$}$l~0%GK>c*7dMDao)ja7tTd8^~R_xx@klh19 zi4V*`swTT99Dg?g#!i?br9ZVu-IHB21ej`64Bp+4LAFi%@AOPFXINb&i`ZM$8a#@p zX|8uh39ji+&E~Dj&d$1C#q2X1GAq2V=@dzP&tP$I20|50HC=++d3TqO({}yQBUkgS z=G$FEh|ISxp6XWIKC2ER0~#d-HCO@VN_AvpBnqzmLOCZ#K)lTnEF_=|-W z>vsr~6neeDJg-_MTKje#Z%8x+8KaSHZ}&DI(HNPG2$Ut`(}~)A$#$AA>Y* z8M07Hk9K)pY3eb~5+Q$BlOj~3u(uns!NE~{nw+gv;=K9+%TY45$XzT6Yi36NcvoP^ zq04=Z%*f-xfzo+fnLnKd=N1E;DCWQ@%cWCcHqsC?UfUH*MW<^ON39jX;#Qq>90R?m zm<8vKcWnz&lFP$t^dio?+*v^AP9PFOGwDMVLAcr#n1M`YBK z*g>&Z>>(K4PM=6FHjS7(r^P+?j$Ww(KSCL*AL6M$M8gyOmdGycb z1Is)*g#ZIDz*{$X+5Z8KQWRuADFDS5D?4gcYH;MKjMnn`Er1^bZJ=xytQh=;Sa7i| z{O2x8RgtgoCT$@KRV6!;KMjG$hMZ9pno*xSP%cT{r%p;QGIqs^;bd#cxv@ApO5Q9< z@+PWOVq9>nR4$H}syEWQ1e7tBu!iAvGc1(N>PN(q{^Lf4)(!H{BvX9T@x*4K6&;!N z^+aoYyJ7QkuVDCL5|(2>4cy0{>M*7{UHQMB3+lrG~>XF$@`Rs_A$ zRRoc_Az1AcwHE{_r7rPrW%U6>##v#7ob zEBp8UC=f?S^5t*meYY+93fYIp*s{8Vpcwb{P?Z4Vk07YoYK6N8;j6aAf|ICK9H|0bk)_~F zSf&NzR$^QHL7CB*G~&4;cy#-*m7WmFLgn0`$e9O?6$C$kbq>;FbSFpQQkK(%bh5kK|i zXeGrwMtUOZ*!ud_QMAwxirFcy^DC(Wz(0a_o1D$ih6_-3&qOtM&nrEuA5KrJePU$> z)O1kH;V8{5oYdCF6A#RQ(3PGR9!^WNk<}wJpy3>kwH2+Z6>E#2?y~Kgx#|~at1Eou z={5t*d_8w6kosQ@icy3z*lwS27;1(4FABw~x6iEKN8?uC02%>mGDUZ?h8dTfCYi?B zLIi3WeaA4Y$ezUg0ZA;`Co%tz#jK9wa$A2lB5lavG`oyR-|^&TZa2p4A@@NdUK*%f zv!+Zdz=v6k;D0IND8bX&YuU~ZU_dqLwLaE#iJyp|7#|a&pvt*TpKEpK0t899{rKp1 zI-4TErbx4zAuOvR!}}#7q^;gOO9T^~dz=b;BKJx}jq{jWVkh@3JUEiv`uaJW{j8em z>{nZJ$U$A-2T)iTJyiK06Du`JCl_)xFk&K7x*c8EN94S5Oyqx|FxO}GZDEUI@;gSfs&P5s|{V&$;++zIYHh&@~-(^%khlQOz#yhfrZO+=&Pe?)xJkXqso-)sVX-Laq?pn+7gx)r6S?i7cp_ zj=p*e^yjpGR|W-C8%+j8ibn<~BA{u?;9|&NEJ7|r295jR`ch&4aVrs#^(*RF-T5Th zwx37nj(_U!jt^%xW89g`d1ltKLosLD%Z9{SzUYkB*WJHeWFKvUED{{sc z-;Ssy>S58_nI&^_xmHdtRfP(W)dn59j6aM3i=0|gbvz7RKb;E~WjJZ#dMDZ5wwyV_w zHCCUFfR!Awf0D5ZpRt=TSOyH3X{;Q{7gHya_twk_*RdNP#Gu;ZB6YS*fwyYbnK4Z`*$Xg=)Uxw14uM*>QL@b*Wsgg^&Z)CVqzdWfiklr zn z?6K5ccMJ^NyYJ4sx+dX{S;bkR0?rZ9);<2=u z_ok*5_0@3R#??jnB&&&M(0%ORF^LJ(mFAk#vYtfL5}C}!arQbg_Zs4-agOwZq}D(? z=u<1Y5vm!oFE}gxnc0V5cj>!*^b<|`F}g{$-Ufq@3uYgzFVEYBu^JBj^F^!G5_Y9B z*|AI>|5cN?WR32!rC$A?sgHF>e7H?0_jrU(@N3g@dBy@i^Yr2MTjTDkOQWe)@EXd{ zpt*7=#s~lDDO(IF&AGJe4>cE+c|9C*%a)13h&i2BZ!tuftEydruR@K{W)(yQ2~+NY zte`(zno%Q;ZLTdsE;*|>w@K36%b_3jbKW$re8Xy`kZrpL|;E_`|SMM(Ekhgf|zU3AEhtCcMXEI$l zL&Jf_Vr?W;HLN=;#~Drgo;-4N`|HC^`T-iC<$j1Z{9x`!c-EJY@Ag#gC-@yS7DJ5Z z-2Mptg*g_ZT&mOLt=~4B2R2-e#juGsMXO`wVy)zvVd`C;m`(@SZo>i}V#a76Y!{Hl z<>JJ&_w2R}N73@>X`hU>=lY6RjPI}u9A*3tfgzT%+BlUSKD-H^A`Ty3kEE>)>=2YE z_h^J%uOa$2lP+Mn9Vlgns>USLIf? zDK+lr<8wrXTZ^QvwKIhN$*qczOX9wQlQw1fE^`Qf z#f!(o*6l+F#qLI}ki{xIeCS2k3@lU%*PWq3y@9cWs?Z>HGDyZ8x4t2m0y%)GpMOMz z^6=6p3nV9$?I;mWD1oWMFow?(ZVjHwJ%jQ;k^6lNcd18^Q(U6c>v!^u+2Y~$;sSy2 zCSkTYge=N!0X<>d5b3SS{$h_Os&zjO>fpEzxqjWxxOZgEv|nlt98L2}y_Pj8Jau0J2!HSV{_n=*_ zp1uz5-@^6Kg6kpO3#NR(Y3p{hn8yw+CFV^Zy6L>quWZ$sDcrRke;fgC6GX&-%Dq=0 zV=V3b9n4)UhO?TnSU=9F!RL~KY zBZJZ#UwN!?x~vV4PNX|LaLhWI9mg?Gd%UEN*H!UKo$Disq5K-fW7@)7oH)%_u?`~= zOgWp{10PZPGmFz7*qaoa?EP@J>pzZz*gKDNZ8-c8RvSKN%Q&=WRyxDFa@8!?#l537 zz#*k*6VIw4h;APrC#VwQv`ObVu2>dZ+FPtK2Ztz`5$PZ+1d*`zj`hP^+Df4(#vwv< z$uTZ5Mn#U>RoUs9>i+Z=q%17Iu}5BCCi5!|UkpKL1Mry$3Mmc1r&tTIj(u?>h111S z+RBLO!m!daI#a|14a2@3fh6g=;F9EZtrm5M+hMbfAqrRSj%A!O@vE^A^TM;nj3!!v`dB;Xi;A)KqDenAkf#wVo|J4 z1Ee{t%Od{LNOweFQ6haclCm4j)0)^mT{>l{jI;s(!b$}KkVhk(H*?wmMkc_85r1h$ z_e6*BHx!I_ow2S#(?ykGP`RkyhQ7l&HEsQ+@mka}TCl-%X9~ye;rx%$0G7aTI`Ed= z*IRg4)bZfR9~T=(M4Y9E5vPjA=y#w>2vM^6Wpj?|)|YdT%#9S{aSqOW$<1uep_aR~ z(x}Ze;pR6O1O37sSyUN{@Fftb=_Mrfk7;qtaFl|UdJc`$m-9^v1v`)3Vmi9WBxQNT&a3p698_ow%T*HPVGS6+p z`Ag1p$iBlOLqme|iLTApd!OOs9E&4DY z%Ub*VRME1QrYc+j=4=PC<#HQQoZpgp`+m=Aq*#^-uVD7eT9-^;)?zQrz_qOuNkeQM zUFcui;#|5(IV_(@*4>VPiHRfv&gGsRA(w0b&*Y>53tVOcIF5Du@mi&dWdsrMNH18O zwDUC>vinEM_hUT=4$S@JzT7XIm;2duxnBU{b6oCs-Iil2tO0D|RZVNsK)#TH%yheB zggz;Owi`yuoj2)(4|2lBh}V~j#g3`WuKJ2o=4xtlU9!zB1+rA5ZgcIr z20@BBMBX`LIFvEoIwLqWRc~m*H#I3a04D}`s_E^_1y|wi%v3*w4$M7|i)xIvry)mF zzlFBHe@!@&E_m(lpW>y~1<$queV7mX`?#MfvcHX#=gSii)xQO;wh%LN=+1uac zu)pw04>Y&GB=Ci~T|$Yp&i{(h57$1a^FNQkv8mpOG?@EIgj~|P{*aS4wXP@0Y1nth zNW>k}hr3L_VrxjoD@)+ly|ru^35x~VG#y2Z1MSy^@CH~Drj;yD1$=bFYjY3HY5iIh zm#n0QU>e0WCV9%zwQHJn{;N2DBvDdTY`&Hd!@7td5;g?mp-4GzI#{~A-WibOwWxxg z@Rnn$9D+6GHZXVLK(wZE3vE%;grnc09>vQ*i%K8n!=j$_Q$-e4Q`L&t(#Uxmii>Db zg{26uVD=Vuy|Ae6DW5>o`VdJ$nAX+CnIPQ?rdS@~`Y3JeDaUKSyjRQQ*2 z(xx^xbqAk%lTkd0FSQZKJf<=>B1#m-oH;S5{WGsjgZyp=dFIyh1DrpSkf^F4>lsAC zY^>*}XF!tIdJ1~NTZySmqfn-IF?ZoWw5Ci8Z9RWUIQp&Uzu{$|^`sB;VLex`@=-yn@+V&!C};(L8gTfq*offdiVS6GG8kTdqUWW_^dL>KR~mb%b0} z)vw~D0d~{p+LEJF+GHzJ7-W)X0iqObfiDXp5aZHoH!ShcponQmP96x|U&cojI5E*q zUVjLrNQ(!!?LZk`-x`8;c$v>C-4)7x5oBWmo(1501d3ian0h?kV8q={AB>|Fu~<6~ zJ9E>I2zHof1jEd(u~w6NHb^2RG*wf*#S%;C05=r@2HCYAXWql@s)<-0h&?MpE_q__ zE>3FVa9$$>jWc!_==g9JFnbsDbH9n=)j-Ect^42?BT2*t`+^93nP`jyjr$|yGSFyj zZou=Au3 z^U-;J-cJ>Eo|>v~0hoGKM9#-hT(j=O5LKo@E%{MJZIGzP!k)tU9vvTOUaW;JQ2Vd?8Z!xUKkzyZky z&L0U)sw!xX5JW-)VS@@^G-$W??U(@}-kE`*B3y}0S>Fp;uVkLW*>6qO3vJx)A{_n3 zZ2&I=jT?QK594;iPZb$AO;symDik4CtU(}Mi3y*3N=nz$C`A$ zGId}v^^RF_zG##>X5ZMqzE&MSti(A|m+9?9xzi%IIvuG(3h25i?mCC9@?0$Ac_rh# zGa(cgJs<$-0SYzfSskT<-7@M?xVI-_;Cxcor`Tuke9 z3W8D)`EWV50&eyMjlnJN&ccD4HZn0Qvr`D}N*5QX8)wwLt;(Yvp|L7zB6fV^0H$(f z+$o5+cHY7r&iHGbrf|E|mBl21(QMwqg%kL^nH|pgrZ=l6(PhQ0J#-(p)z!Oki@F2H zLNMAy_ZDj-dD`F1@u`H%er2O|gYwvG6!D~4Bug&)CY&f^ZKO+04$Ubfx{LiF%g*%g z`p~a2VygL;=3D3zQaWDuQEL2c_4y~kZ-Bl2CGzav0#KECV)g-6xj}H~8hO}|^cLea z*Qv37>s+-up+V}DTzyo!WxVQtYtJl5Y zyEl$_(sValTm-d?SNWbRPxn^ZXjEzGDsf~-Ua^i9DrK+mS=cLfMv?Z4s|~hSs2WFM zD4w3YVrwJn_THDmL74xZ@P$jjmvTp7j}M#!wU&_MkfA54zOWy!IO5ZaH87cCYK#e?FNf}} zRw7x%1*>I98fFitE9MJLMvTZl9cTn945)?ck%kQhJKZ6L7hNV}JLK zt}a<@HtkkB)1abMNjuI2vmlS1#Vkr7R*9M00IzJK;w?t3d6B8q4(3~~KOtX%nafRk z)zNxn7;jXUZf<$4m*I^rGt)8x=y=&Q{$_LvJT#Qd-C$XoFMlYRXEl*0*&(^2cZ`8+ zrSEtc(!D)GF1gAx#7Ud3=tT%6b012Q3gj}t$9VL{^ z>ongDLdm=#I^&N>uZ(O`BQXKc&a*tOXTjfmRiS z*EW`ZD0%|UzVq0C7d6`ht%}RO)x3CqD|LId ze~lm>6Z6*s^KZ{N<_o=my?!m!l;%}lSL<`|GH?N#KFr4g_9j17w1BOt3O698*j|U6 z|Jkb8!Yhy#>La36%_K|}_KftPIncm7gG3m=SB*M0EA0z;OE!y^4tVsI^haUVwXzb;`n$|ZwlQ$pl;xV1rIKq`i1#E2vUx|z@pi3JwrA^k4SXkzM&Rkp={2wS6 zdm8g|VK6b_jU>2K$YvUsk9sb%s<(Ri?)r6PX2R84_B=!n_dNYG*N1T8TffP8(+tSJ zFi;7@DQm4e-#P=Tf-ee|ifo8D+C{7clXy|(Ck!Yi14uZ_8iUZ4-0tGt~= zAm=JNscyyZU`d2)qU^8V7J++H)!zcl-Vz~~RP{G<(x&}&d@q6tR?T37zG(|BjX2ol zOUtzka*8-VAe+YF>CMTca62g&`T?AFeUBoJ0#8H&G3m}4+aOE+P{#_vb5iT{H zfYy*+XruBgg4AzRzK@rIMuk4ihf!I(-bWP~6-`wuVtXrc{%fmZ3$I}IMr9R(-O25} zK$G%x@Gniua+Odwq&T6|WTYew%4Q^OW=>5te;e?+HbO3`=9@TaQ-cz7od{qz^jfOb zfqTd?z}Bt-o86VsR{4R8}E)fp?W_=tl1DiE{n2%=tn|`XO zS!=4oTb(Jkw2vGdY6X^>-XB49B#_X>D<7?B4dI^~P2 z{4xW4ahEGs6py!(_gxfkT=Ii$>W#a~J1z&KK>p73vi9ITDu`=yrG& zBCH_YYkfWfFS6JATO@7PuuZlfGubwLg&u&f5V`YgwDV&d`>l;b!#!KKv4_sa6WKJq zN#DF}``E$lsS~|NZ^;hq8r^<)TXOsGttan2(RFCgU5EDGmMZSsmp^g)u3Zx%A8x{> ze0KHe@ZN)qO?!eJhBhL&FuZ)UxAC;=h&x4o#6qV0J1gn!J9pTXG(BqBp59EhmagpB zc^Ypkqo>D2VubTW;%5>Es$_K=u@qM#3nDD*9`YR8=!QI}8bUH~;z|lG(UeelMvDp& zX^^RN?7kj*v@5=KXJ0Db*SBL^eCM{Vp7;*Cdvr%S?ez7e;eSn4V%CEU-P^Wq+p%@$ z)~!4FCBo;rFSl>qzEe9QofSxDXMhA3Kp?K6`F4}WInB$7yyP0+%k>_!InIZd(=XU& z%+AYcre%1&oMajE;pMdHJl7uky_~MWr-)O8tB|xcWBXT-?v)X8$+6dEoV4i_A%d6F zZj>ZDpkObjy+{y|?OhQVF#DL#fbE+iZPgt-OxFo=>`X5JL>2tGvAu2)B3%mn$f0Qr>> za!HV1#z~tts*@B8j7UO9Q^A6pT^6;^#J-XAL{|% z^HW9Z0h+3C6Jm<(Z;|saQCzd0%xFI06-XQPQZ98yKFTmM`VJJ+$Sgl!8yVwfly-cG zXk?ZmX)}IJl>QDVEsl^&qO^#UHZ?N4yjSq;E|#55!k7GA;Ztz^?nOW#5g5bI7sw`IMR&jV7)H|{BkB!>{hT-4=E@NVRl_5W>u1BDYpw*< z;c970^vjTFCle7)Z)*}=XmfRfB;Yq!&&10>b44HK!(2VrPZgOfO;sym`v>GahT@tv zUqfu+70ljT;nXQ_nFM-myq3@xP0n}g}z+O&hP93s|(xV3g?*R~zUtzpao5e)({ zFnSWbdiLYDfzm^p0^w7{R~a;0#+edpNo3MC1QVn|em{e38nk7SUNw923+B%`Pq<*D zA*15ikX_P{`DwJw)tz#Lr+XP=&-6RxByDc^l?3%X8L;(aFq)G9mdrZ!Q9^|NAxB#)$zPHYK<$>TjoetUH+-$)-Fc< zN3`Pi1wi2q8swRqMQp_j-A!G4VL&&v0WSl)Df%!U-P8_0Rn$#ss=|8_)A)WBInPIN z5xXfNw(tsO-%Zi(23@AhR?ld>xub-==%f}KH{9OA*qhDJuY0n^4n^SCMCofl=}3fJ zvWq&%NtAz?GaZ3)qZH)pdYd>t*J z7{G3M~E>i|*LL$<2y&xHgV$>(m~*itX=;3P$Rks8CZsuICuHpOLCG`j>4W%|A1y zzHhpzr|QB?eJ8#*H1#6$+?x8EnEy!H*Uz+@N$1JbOV~_PFGLsKq|Mgw4YY=f1Gw-v zx7J$2LYw+iBtpNb&){XCsizO~Vd`J%r;1Fyrm7XOeG@qy6c^Fd3nLa@!JL?SeI2+t zqJKMKFHOC1N%%V$d$R@kbx)f5w?*LBRPKKUN^gmfODgvpIcZZ<{~EPyP5w&OFv2C_ z5I@$3c-x!R##}mf{P=LMr&e-lv0kX%pKxm2RMM!X@JA zNhEF73z!Q2FF@+r2)U$!Z{nm)t>U|psAt8A-`13krYt0IgiyshA| znRgHz*Xr$oZ7XH$f*2NCxQ4Q9rx1(3LR)iL<0W}%V10`+F#^#=JKSFLM2bG+fXt*xf-Sn6QgqDx{JzqB6rwy<06{9Zd?!P zjSTLjo(yoiCRqR+-txRnlYZeg!B4R=g^zFK`PWY% zDJi5r|N3wKGn;RwO;1&8#Ivu`sf^Y;M95OwgSAJBHS*kd#9>z+C1c5@CW*lEcJ60{rFZO0Cha>?ubUYsZU)!o zo=0tR^MM~A=eLm4*93C^LZxATOB*p=t%9w`eTyz8BX3Nd>zg9TLN)cLsX!bJq^4_H z#x;do06Fg_qPRQS7(wK&0t;3e+g&nrrUL)Fi>;ZfexaQnFBY=orV-cL1DkopJyYry z5-RR$sJy2UxEAZMPg?a44N$y2j3qh1pVw3fZRRl(hVB@-!st}8W8^nNN6_82U||gx zO+Z>PH9?Q1s;6UC$8OKP4VyiF7;-$i|H$xObsQZ9jAqAbxJQ`g|1m06#2XPVDzx&u z2_cM_^{t7X<1+LJsoB+0n9u^hHdwWq^608ola#uqM0C|6qFA-o`JvRsNy3dI2W^bB zB5g5X*Xe&FLiKW?!ma-LSqM$n984+6)TI=E==4J~pmeEF4_%0?baqZWmkiyq`+5rx z%dc^+L(kUfEB6wSr-ISKz7wMiH*~tT?Bu0?b7ojfG!Q+bCA^E zJw#pIzezpr zL&)8IZa<3Afw&OJvfVhS(qOq!ju36M>{xs)BMxgKz`R~`ygaM` zP4$}@eRJh8T7<@TM39?o)>H{wmG#r!&^=JrJ(n&K74jw|OQ)N%ol!=K65jI7p94=+k z2YcMK)g)#u8Kl2Adpgs1Y;ga+%8|Q!4(;7_`rwJtJMVRFQz<$ANH;q9uHK%V+c+i( z>MD$k;+7@N@{-}0QNp1M>DtCM z5wgkcft8%J>GnW`$SJ)jNp^q1kyExJK}5d0BQRieZihAy--!s>TH`xP=#*j2c!SU> zw@2svwg@bkoL@woAC8dC;5>ZfB-d$|M<}%}uJe{nYaU{!JOHAko|&;zUV;x1_3K3u z7&B46m{5K}glrP!=W^1f?P{T-mq-8?s(QC?dus%lnS!{41o7rM7sNvECViTK@Gf$$ z1DhYj%fQ_v`Y<26NniC-MN6-ms&FG>%I#8;+xt;ov;NFzK;bn=Gj$)AI@jS-euh$& zoiW0v{DMGhBbT}CkdFhVv7(+@alQ#*6hwC(-S_$fMW3dd2=>jb{d_6?U3 z6y_?>Tn10M66Mc9@RVz*m}$XNh0x-n=jd|L zgDT-gkEIfE*F=iy!yAIBLzj~dozDe^*WH>9EwqVD5t@DzIgFQqCXznPhl#BDsUj1p zscJ=TSCHHWQC>t7DcXK`4Rc~58--7J6@f3^LXGeVuV(PWl~1l?y&?j?rg~pVFx4Yu zlj{8-Cv9pX&vg6*0*W?%B7{wNjNvnvS)+zcct7V2hhEwos)lXO+=NXKREMjhDaogi zB>#Y^2q(BTNiMXZ`VNV}Z>YYEmw|?gKFo)q`h}k=GE|zXR^(=p+`fSFA{r{u0>f*V z8$*>U2Od@0aGA$YrOLW*zZf4Pj^!>u(q{ac>U|Z#v_3*MsorZiX;VY>{Jo>2w5NO$ z{_AEugFO7t^TsGf-0oQ{TVwDyC(jT#<%rAbiUkM$>FnN#-D~M}DZ{b+y zxosl3-HP&>wM3&yh1W29%d-*@ro^UEp!Io>1R#b<%Vaujfqt8X5Z?XCq0&nt@NL3% zHNo}b2-zfDFXW`nEYPusuv<87Lb)3!A`y*~{2_(ExbpReqYnA#jNmrTZGE+Jp4@PX zX>z*3t}1=WJEPV3coE*?89P6!-qIeN`dx$vIlSFu`d!1j2L@ogaNdSo#%&G&BflBf zPsBt7;Vsrg#=*`v)y1X40j^liRx{(|sF)^~$A+JTu|x*zR&kZZpzCBOYgBHE*HtWb z4HD^uV`E@+W7i2DM%ONt@~4&mQ3c+6)@ZFDBHF;Ah^X>0q^@$dCO|(YP{)cIPSSsm zHO!o(n;!9o=+u1H@N@U1kg7`_@sFWozel_`WmqFs9`Wy|GM>o2$n=OOn!R)L)6}ai zh(hU>DseQ{0b08%^J6TD@U||;=2RJv%|G@O(BZkn@C!4*@N)O|@StYn4kLts!#fMp zzFtH2^=&MwaH+OrU+W7!j97Ykz%b$`U^8$SK_BL07;&+mDjG&;s#=lTwIsJ6wko&q z8fHI?2nngv2j106ixE<18-WsSF}epy!z?n!jiyWQq3Z~y&IsA0dT-&R&4v&4r$|hl zA%_0U1X|cO-CdKaLyyqVU2_!Q8@g+X%;p$?L#mPcBKP>Fi>CPvt5*7jYc6Zdf4JR~ zBiDPGb~9;ISInN)T`|4xml8HJ(1H+MczZT2eFrs#BLQsq-7#8g3JY!NA0rw1CyZ~x z%Roy{ALhf-f5cA}S$a)XD{|XRa(e^HYi9WjxrNs-Czc*wf`OC8uMzliO&w|U(CKjo z-)uvE<&(|rA0zNd{;q7!G+bOrQ?GnOqB zJQG5=+0y|hZ)hEH%4|z$h#hhIL!2shr$-_NGOCpE>hv_p7xU)~5T}LrOBUXl=_|HR z?<=Ufu)bpL6(N0v$UL`w#g(Wq;xOe>B=tAedFm@9Z0qY!ON8svG{Jt{dtA>L$D!{u zgCOpV4uwmP_a+T`*;3fgLr3`>wn3GO+KW5A)G?-S4N0 z`YugXc+X-Qt>kqKez@|19e@A7pIdgTC|{hEb@`(uXx%=A7xruRNnU0Cn)X?$-uQxTcx zw)go5=0B49eSv8=lg?A`BVjXVDnfMOZQ5)O32F}S4Pc{z)ri;}7TVgMe`SERUyPT5 z)}B7hhqb@PPZe2vO;sy$>m<1?LU|Fby^vdY4Rd1c8wG{iMc_+oZv=(g&ET7D$gh0T z+CL)#zovS35llBk$R@4*PEOj?+P|hj)U{uqsBlR}-E_S`Rr#&seDzC-MK&wn2=EEv? z`>7(Utf^{6Zd*xit59A`atp7)u*%^{WoS5Y{{RiaVM*a*LOGqKVx&E0RSeFYp8f%h{yb=b}JS z=qzh=cN|B#sWk3C>r2bdD8&@x%E@rZdy-QTbk#IX{iNc_2-(gBv`G3aPHF;upc&9D z%hrJXH&Nwu*wtIWKBx7&LU;+P4O`0BLLgE+LU=Jl)L43y)D*(?B!m}4$Yuzku|>$e z9KysJ(SOofI!!~#DSp{}1&HXW-^83w&EUq3IAu#!X0DBKe>Nf9tcj3yd} z#%qJ#X46yk)%cfk$#9dPGV`U(=0k5G9JD3kXm+&`&1Zc%Lh@B*B+APWRSl8V=v_w)993|C0iD=rN&6Ux2~#u9B_uI3Q0l6sr(3%Qun9@a`QRLdkaM-(`^mq|OfBiJE@^pW4#^AkRn#gVFwy++$AI1_$nOD@YP*duvFTqI{q zL?uQRJ4G?u`Ni!Or#yfVnDA*$mx@`$FQ$!03WG_$^;wQBZx>Em>1-LDfQXBUR1U>N zMm#*d8M%ab(+lRGW8}=q{8}ID&Cvf!1oY+Po~q-?{o%RAGn}E;oF~6G19nnE9nP!> zU3C{i)6LQ!0du;6+d~aoslH#`?+8+N4%f*64rN?J+AH_OF?0iQle&%;^N8|A8|!Xp z&`LvrBbP-EGjQPwW{x2al6Vh9$R_8Qw{p^^%OVj1 z;*?O58B~G9MQ3snSF(-LMH1)^ zIa09j0%O-OIh0G;`8>vk$f?Fr3sJS(Z~apQS(ySDBmsPF&IPd0i)YKOg3{8&=TPRl zOb23iQy`q5g3Z9iGx{(ei)WYksiMU*O;xz@Fy(d|$?Zq2$}PMGX`bHCrOq@EPNOIf zTfw`sFGiGy?F34+vj@FM+HA4VglULi>WYv}+Lt&dZE9bhrRbdFNq~Q+*2cN z_PTxesMW-hPz-)~$ZueeYe~**C9cgFj)1=j>M(&iIOm`)w9UAWfbiRl99{<64Eiu1 zHlyyRifo3aD!fITayv?L8$)@`+K|y0!fTilo6+bB@OKdS(l^97uk`y2e)s@hj(Oi6 zfnO7*+X<$(M#v^%dNU_&YBQc9=aoLm(4QGEK%603dbm1e(-OxWD9_i+B1^BSYDI2$lHAszyoi=wn6U5~=ETxB^7+1v zz?YWZ@cABQ@Xa>lS3YU!k3`_tRPSR1)4>SYqxdxfikvZ`5XcxQp6DK7b8> zi)*btEVQ}*49UUY#2AX^NFdydr>wc=p+-s^@k=xxQw?9F75zW1@W8pQ-iMem& z^!*D0Uz&Tv>H9wze6tPtl~0=cpGDx;RPSdJOh1m0O{(|5bJC{f{;g^;fH&0iRp5M; zw*T^L-|nkkf}H7n;Qj)wZ0Nn9KcV zet*>CIODTpTd?Dz*H5#BRKAvmD~<@H7OSM-%NW!C2r3wWZN{3Ektw+-v3C$tq9zk*9Vq#?%jz6MO#9?D=5=@cbz_P8!=yMPp4EpWyn#jy(tfm(Gr5t2W9=Q`}61HlRAH*?gXY zc)=eFfjB4Z0@jRC$_d9Q;ofvyp+17kadD$7g}Xgo%{mBbtTFl=8AFxVQRl z0iIcqLA@sgf@q{3&ZXm)WZOdnT{Bz&W5Qiah2HZC7TOm~pb#=gI~^Ki928yb{RIU; z$(muR%#9-f?=jR1xs@IA6tjukxN|BC@q$ZS$y-74Ef!>Hc$fi48@KeP5Oy_N8K?ZR z%2B8+vp(I0tXP2X2^9_qSaGVPuYx$OE)rrW2k&uG3&Rzw&^;dmLP4mpkU~skvd|7H zo693Hi~9gEb-VFuB<(h%~QJpPQq!6Ku>2Yw9Q`kK2(F)A`l4>LCv;k zfK+q|d&5PTj!`QOr%SpT*272&Zra>pKtQQTh=4Fjd6h!wj-z3dI8aK33#SVr6V@Ik zQM6G_q%4>*VaF|D3q(5!LW;GAwwmKanAQOgV@JOnRoQ zCP_Nbq48wao?aa5D_IK4<1rK@1XoiiCpA*APVe+3lTJMCRZp7<$_6|(oa@`ke{iyXR|N2Hi4E{d*# z5RuI_r$I_WhTX+PwKvjNyggYI=1_4Ynt{^J4r(x96#lsI+gEAW#TJ%YxRr9#hPQ4l z&l*9nP=kdUdbNmNqkBp@FlOLz+(u`3qEMU=rbTvOs#-e*r_l=QExO1tM_^G#d<}nDC?akLafNK^YU)oiMSoj=)kpAv;d0brMd+EO133!z9Q8kW7p= z`>fK)7bFYV2y%pl^r*mcu{MTYssv<8Wo!`XxTokR(MXvttz^1|V#C$RkD>+K0tLX; z%IFx894!;A5y}REE3!nSRJ_U;VW8QL2ek=GP=Qac@c%VBj@T9$RqnWHFaLVqKbkWVKqwZwK_8e{b0QCa1T#)<=E+f3dkPDJj z9WO{;5xOv;*BXQ9TPD{nl&fePFC6GRpPKd2d6#)~p+Tgqh{+Lb zOwqDTzR>xWUrn0Xl2#qtea@mqV(5m!ub3yCT~`w8VXdqyX(34Ac>^jQ`yN0(yYhsY z!+(>NC)q@geFt(s3gc%?h|Uh_o{~d4Z2>NgV20&RG8qf%+>gB!nsRo%^2xGZsbv|| z6}Nhhc}oO+@DKL90doZnjknCmXVu)IwHvK2ELtoK(%Gd~tk|Aidi`&?^vazx&F?y> zYmU+qv^m(rP1$rtX)OxC!RW?-D&v{oGE3}xgwxTgS$cNslpK5Cx#*@S0L9tu7Hk<6 z+|9tV+bvJ-?G}H_X{9qwH|k8EjxpQWU7T@;oG&8p;=u0q&m1%@$CItVA+(JTlbl=2NV1DC9ER|n+P|q-6BdNIo}Nr z;_n+&=)8%EiG)3dQ`rcEn8+fwVivw~ohZnL+ePOnJWDE_xCyq1_r>z*qc!h3m1SwqOW_F6;si1n~RGV`nuy3 z>T9fQ-v==}$$UOBHkM2@p(w$=Ju!~2M$Q2oRSXx|QbY@KMk46hCxQGP3L8{Tx>}hGNu}6gm4rhS>?pYn z3hyKx<0@TD)yO@ImA=2d-Lm3O5;YT~c-1U!4R}<;I+KlI_BttMe7Pb_jIuZNmG^VG zWVP-Ww)wF7mU)m5h%^j#xY*8Dr!o)K+a|Kh8_BGmXxRw&H;3h;t3^G(u+olcR#=9?9f zd7_^34h7E8_{)1sE6E8nME7#r`sgf2ViAXcLI|p>s$ZVZ$H&I};kL7dIQ2#tovYZo zSMXRa0cUgy`c2DNG`OVkkxckB1mV33L3rJO)Rz*26wWty1j`-=r~{Hbudlc9Ff?3g zU-qOLr7GQB=^4{_GK4TICBvm?d%m0qPKIjgDbFwdfNE%pqMSgz(^x|kqhSH(P2G(}juey4L+WEl{Xm+ils{$JHC^O zdWw!6-vQp91Y^g=*>sQYd#SUnHytJ#L&OgeALbBIu-1xMDUext8zU0#$SSYQcnc>r z?=AV@uX~#}TG5xlVL&TVuhEKj%+$n5`%ew*t5i$dEQ*RUKAt(DPo}~2Kd{Pq=6X-E z!Sq(oVA@#0k4Kyx?hplt4TU&HY0x*frESc)lHOt?8ttALP~~5(39ge)>AH0qd)9Z%pw0^d#pP<5Ai-=l z;j@n#83d(qzFm;|Ukr%NL*Fi(IG!&x3@qVFBaUbyPKl>Q_yyh>9%TPEibx<<0kC1m zC!^JlqujbXGAPdPm?yTOqn1-HW9JadX;d7tmMDUY)lqRAs~?5+AK%LfQpGfOL~p=9 z2-J||OwLWmH_HRh=-J=!WadPxZGlxH_apDh%Eso5vVP@$;mMUdg_2}=wv`@?bXE5S zXkSOJt!>ew`r=9zSCB2kGY*WW9KQzrTr|&5ckLla-8~{M8HoJQw`hniImmx@e zkpQrYOks*x=h-uZqO;(@+(|?e;&1`V^Fka(ywN<=Cu}>l7hnI7uy#?H1v`a65F&&S zw_V{HA{_|0QB&_HDU+`SMU@%?D@tjf+4B+Dc(bR zC|CqAP+=@^4M(ab0wRE0B7Yo#Y{qNjgjP*=U-YE`l?*rcY<%B`pY|tB_=ERR)AMd% zQ}~0o;brR^*r!S7-^@C1E*bnT6-P@3Fn%w7GU%#qj2|ZUedm5R1go;@I4|I1wmwDI zC4P)c3?IXl zh%!2y7_Y;_gAftX5EBU=^_FwW9*36{`B;g7Mk5ZzWP|m_VBhQ*D(Err(nc_&anZlH zgKVtTLr1%<4%eRdc8!f~ zrh0m;8&R3{bgOS{te<-W)H!aSKwUbzl^i{q8%z|$3$BgSfl@bz^2Moaj4j=OQq;f5 zP-SW)3Y^?PY#eP(2I*l3HL5h=R!|D!!>@vmZdWgSX#b0j^F(?A> z_3RiMQ;AyUxl$V$&sHVRJ!gz(wwggq4;}4o%yTdC+^2Zn#zGZ56aSLu-r4coOFTo2 zGO!e%NGdxyY{!e?gp#xf0HvlDBTmYu;S`ZiI#8@Zs8B34fkKfTSJD1hjB5DcT~n;T z9NsWbqBhF?C3X3CoiVy}*U*05^nQGu*}g08)OU^1Mk>0L^SG2qeK%FeefKqy43@4# zP->cN|D?v;lzTo|`lVc7^Nk~CUd*DHrR z){c_eTtc{h$ms)B=9xZFM;J~?tJ8BK@&s~4`+X(t+j!Iul8uFP| zHKef)hV9<+$VrTV8yA2@%-kPi*#czgC5^*;D$%p8e`z9NC669Cu=j9s@8LazM+Ocb zP3|2UIx;jYjum8-+qH75Rt~DU_dg8_{}=MQZd@IKi}UtQg*E^(U&?Gg^j!i)*Usl6 zYa^QG`bO1K<6==eUL1|vw6j55Q3#ihAidgMN2gXR+gL`XB?qx_rBX`|TH-$|c0;C} z%sfQ9wwjEN+y{smI0toOM@9ONchpy#CA)toMNN)^!c)@;s?gXUzWJQ`C0NU+V~r?I z?DwXVBd3!EgrUZ{(A@HlMT>IpLj9HcMS%(7)Q)6Cp-6`1sHR)x#=eqlpT;{^)6YZo z&0Kxu=J#48HJN*mHou)^dTlJTlq$>RroBRB<7w|2>(*(cJ#YcxTEH*p&?Z!ks-8+^ zylfgCGrALcMJ%>EZ)eA2Vmfc!xS6}1BqpqL8>iBJ;GGfVE(3TCGx*{Co@oqULG6Ap zLNAU2+5`h7e?^hDvr3l$t z<9l^1cI(ljgE)Ylb^^J6SaZF?O{sZ)Bs$NpjzGN0^Q(yGS4POz8qe!uvEf>&R4h{% z_L0+pZ2ysFdzCk_=KTH9Ie%{i7EI0`BF^6(A)CRu?sim9{$Tj()X||@LX=7U#lX3Nv;_h^5U%clna^D7-vbC)-Q)>}?7ipR`I5~rV zA_CW@2&PB`-;9t=ir{fh+LZSxQ;lL<9W9J{9^#gNDy>*TiJyL(8{)ATW57A#?$V;qIOAdmzC*XZo)jne_1;E(Po z@cJe)p`n=U6}K~grud@X!+MiCc10KRRLgeigi}sro$6?!SRU(yKT>C=I-c)@+7sjn z`opXF-qU^(W(eNvOe6#!ZemRf@-SJDa|3wtZ$h+YLC%Zyb#+^}7pQ&HMK4Y|$bOEY zUfD|4`O|A{&PEW9w4hD|Moj)+L;R0K$krPF3w_h!!-N?bj6>33tOJ`5;H7IY&he}c z(}(%E>G1dbRFQX)rm7XaeT3xpnvImndRW3P z>t;I*PyKsqPNf>83%@|MQWw_xl4~XSj|ePDCHPqcHcakcPu%}FLbleFV4>|`M=Zb& zUW}K4c91^IhaK$qQ$==AQx$HdOu4;*VkPw9V zTdn3!oLDRTF&0N8t9LX40w!>8B;am~kWDK5VNTlA>K!nx-WJ5&NFy{IJ(Ds(Kp8G^ zDO^EV5euo>Fv1|h*^TbU^LX{Z7S3szu7#{dK-YxqO$6D!a}HS~3;8ls+tfn7A_7a& zLjHCHHcal{Ox#aK$kv*|EVPCE5MkyYDZUdg11%(dm=6p2*M6$VLTakQ?UyOHw~*Z4 zf$}0+NYT*4YnZ)-T<=;)>HHUDBfm>x5H@nHvXL^mwvzwGB8g-rza0Su6TG()c;AYU zO)C92IB8QWd6cZA@_K}CqigeUi!=`WiKvNr%#Ufk$Q>dUU^6M4B;WB`7KZ~%b{QK< z2n;HZ2EtsPnZjMWx$NoG1j6w)L3|s5xCGfEYG6bVBiT(0)hZQgII`RrfhB1-uZ+Nk z$^HKz?k|gwtu+-|XuElsF!S5ZoA5HwZqkSOu$#yIRFU1(RE1kLQ*Li3xm}O)TGHC^ z8fI@d*Tm=sXQwPqQU)2#`$-1EXs+_6)fV%4ER66LEYhF{y@Ozzh>%UHdzF(m zwV2nD#l%4YoR@|lIP4u3;(7XvpA*&LL*t#G3sUlmasS3A5rrh31a{DaGi)iaaqYbZN_O|YlSk)QF7BG%i zTT>WwXA<^gQ)=iHa}o zwG8+&jRXYn@j7W9X!92Bcgv|StrTlzcpwP(RqQFAQ(u#+VbcbiTk_N4`YQE?f*Ma9 zt}m}ReBu+(tfxy4s<=5Jfn%%~)fEuIW9c0fIiWK3>M7wbks}|=!}S$oh~QARaZLt_ zSb<$~?3duMF#cF6YD%K`6Zo@T{#h&M@z?5VF_j#_ashpXq)034=ZzMNRV*wxo-YT^ zsjntil0t1fd5YXDrtoG>r3#li+`chRH#1aF-euyAg8?+KobAE5qhtFL!XWq}p;{A(5cwk_?9)W%TW8j2-?6TwJPcIs(@OG@XRGB74GQ`M>Z+G4F5 zT*4K;FTNsj--J5W*KjKcs^9$J%UoYa^j82<2Jm1p2hmhk=k3B+4RU2xY7p}Z8^grix)XGJ!h#JTCw>?ydL)YrhLpqSLJ>gU2kxV}1F z8!shYr30w^Ld_zmz_t7a$QCLjdi|e=HH`Yj%HIU9 zD~Zx+_+k{;)nuxEA*EyjkTOZ5C<<@_&mO#wU(?kGNY}s*#aBGN(Zye@iVt^ZnSwgo zBWOf)lg5GN^(&y3<4L!5x^CgP^oEq=!TP$&X>1UmN@lWSnLPf33NN91dZy~DD&scV z*}XM1>k5E6pZ^wrCi6waXuxXi3 zsF=zYMxh4EE}Tb}0%zBK>GF*siKk#Q%H3p=^(IB zK53`ZaOx)mGFe|Q-Pxe8`B7og9;`2R3MZ!!Y@xnfSQ9j1Xk!*3d}w<-S+&b!4y+Tn zTMwe3T2&ZTs15EJs_+F%w`8_t?#>KkCNi1KLzx$4-j#V{<`bDe$$UQZsapL!BM&*> zbEf*aBju^gE%o+P#z~zJ7d&O|uCJ;Uye}r|D|Aph+=|lfxehAxuKIb>e#KE}1&uon z{mgt~`fD`y%;#&w->4>F1K+@;FJzK;F@evH+yR{5$ovoJP?E0nhD;ES%=oCIQ6HXe0ZAUI~KI**kQmXSJ zZ&IpFt-Vva+b%-7?_D`99T_&1$456%>0_6n(i+Fu&!!o2KFWYEbmjp!#-Mx0AJpX| z*)qaKrptUY^LXY5neS(QmH9=k9buhv%jj_tJuaZf)%3WE9^Ldv(Bme0Tu+Y!^thEC zchTbxdW_N|MUM(SO7wUEJ)TRCm(hbRsm{HQ9*@xD_vrC9dc2Pw@1e&>=<#Rt_$)pC ziXQ(+k1x}M?nBQ#L60BPE%=chKVl^!Ouse1aYy zrN`&!@i+8%oE~4L$M@**U3&bS9zUVS(#3czrpNj8SVs?w9#_yKPLCKp`suNq9{cFA zhaN}iaT`5sdOVvR1$vyI$8+d$iXM~ncz_-c)8ip}{4PD-M32Yl@dxzyFg^Z+9{-yj zpQOhZ>GAjU_-A_j6Fq)FkMGmtSM>M=J=!tY$}OYEMfA9U9#_-jDtdI&BSDXw=y5$g z4$$LPdK{z2?euWyF+z_&rBUk#>G3E=+PR16@rUd2cqcu+Mt^>V9v`JP^XK&VGdj-m zA$sunA3oi)3C(Bmic_#r+1i$=u%K@T1+^8opOQRR=}QLC?@ zHYD2fa}i_eo0FLzOlE#H$xUdIo6jUSok?ysliXw`xw%YoQ<>yuGRaM3lAFgQH;qYd z7L(j0Cb>CGa#NV(W-!T3V3O5;l2w0_)qavyev;LFl2v_@)qIjwe3I3Bl2v<>)q0Xu zdXm+7l2v(<)p(Lsc#_q3l2vz-)pn9qc9PX~l2vt*)pU|obduF`l2vn()pC+ma+1|? zl2vh%)o_wkaFW$;l2vb#)ozkiZj#k)l2vVz)ohYgY?9S$l2r=`Ll=NBKS`Z{Fh5C+ zfG|HveI{9TCRuGBWR-c4)#X7}l}T2U2U$fPWc8TLk!n21Y61G81Cy){ldK94vKmb0 zNCh6OWiBD1Kc4vq7|w5Jev$c+u$t$P@nNgEhJLZtyo`Ra)$E{OY&EyiFSeRD(=WD~ zgY=87<~{U_t!9pXvDKWQUu-pBOuyJ_zKVXa)qErUVypR1`o&iB1N4in<|pVETg}hW zFSeSG(=WD~-=kk_HGfXO*lI2%GsIT&eEP*!)1qH&HRJS)t!6*{Vyn52ezDa&O261@ z+VqR9W`TaO)qD>9Vyihxzu0O%OuyJ_{x1DutN9rHVypRK`o&iBf736vnqQ<}Y&HLx zezDd30sUgD`78RxR8ezDd3 z5&dGTc@C6VSj{!`i>>Bm^oy-#2mNBJxs`sg)x4R0vDG|6zu0O%i+-`yq!j^SH6LDz zU(O0V#^~_@dVG)`Y)N15TGG$cFSexbVH0}+{(PJszjYxVll17^fJZky*v@`}%x>vo zJj(PKy&R7WJ=R`<$9j5vnjW8_2is#hHY)5f|N6>R`17muc+o~Y9-s%?=*!3`vyHxq zetnc4AEpOe>+jPqw$^kImd86eT61A*Eq>9FfLsEPT79*5T0p}k#MaD;+Y)IiBHqvh zP^A+CV(%M~4#Q+jBgRLHd3UD4NiXodbW^V|N?f68N2_j`#YQL3(okGtAJV#{Z{YGlk?^QURKbu@WTGIq z1 zmp`7LKZt*QbBfnj_2MRS@IOv`ZKbyb10(F)(0gI}>SQAB6$h7z#XaRg ze!Sx7+XX!B&c)Hjn@iPUB>~u88`zYcfhv?YMFvEUeFBetlnc9xfbEiCp+rS?)=pMI z0%BfHegjW_m5b~lkXx$BlPS$q6zG?D-RE4oiwHWST33jMlZqGEj2>E z2u=uq?4q+&P;OqXqrX?@z@xJ7m7>Ev-YYc`%x(?Uy6Vx+kwI2D4fjPHu$pU5PWI!; z8W&k?XSKe||Km&3DKF-US(rbu_Sh)ATkzh^T;7Wb-d?%auGS72S-azSy2(XfO`xxr z(;*;-Y^;6fg1m0ufCnGs0yh)D>(pRtx=pUV7q30crCm$V)~?x=S$ikZj|;G##?znV zqU!{Dq-H_GlwvFcYg-jz)!TUJn_N&I0lHBQZOUN7=Wp=nuei{D0yOgzaO z@hLuZ1o97;)gV}9sY8UVI zfbDSk%!*7aWT+}m%u)8o@8Y@daB-t`6|HuOA00zAz@sc- z#X15N5kqOMs#d!akG+r!+d;r$S}kBz+%`Nn%*E{_aB*d;XtUe#*g-Dr`nq9*@^9@V z9-HREZm1hJB*z}YV{hidb`h|+R;wHiJc#E$z{Tw*aB;0x5g|X1$3Dk}-AKT?d}+l> zUr%AqlPbWSo?;GNkxYLdPkoPzdKrQ0l9>@YIHL@prVtCcyvhEExBkFo?IBp#R0mLI zN`*VsK!;3?@F+{jw26S*P>pjIjVC;lh3S+y5`RDJ1sH?v74qWr;>D}D#G46Xmnq!D zbkK-uAtRtEQcfLsW0cF-OE9jjF4g#yST7?l!eKmbh>O=p;9XkHivAf zt$jb%axV3}#fy063tY^80@Ej9%B$&zc;N?J!U2NNrMH3g0dm{Vc-v20wn2i;rS#IN z%zj-|Qn~Pq06M@q4IX6)aIPQ-U7|N3l;bYJc;0RM}vM;PVB-HJGqG4 z2}HN093nYwZ#lGAf@@*DRjwVyYj<#IhX`7i+L|yTirhyYkGqZwcNGB_sIIN)T&6AJ zH?)A?uRz|8N8ZMTyqXCaGc#h@dNk-)r0gEXBOl^I4ik_rpTvn-MThe;-u4ogZ3mYv zFYjJH!P`FKvhC!uDF%hV;cdTg*+#f*`{d;C87i}!2DAYN;xxi)KLojRA(F~mE(i%3}6l2h39Fj=F ze$H{tItoJ`1N@7Z{>3OgLXp<|LPq7r3&Q9)=RA0nDbDF1rWjpP1$HcFD1x~F9_eF5 zj!=*;b2=xUz^qxja}~*vZFq4Xqxd_DxOTBB0@x%T8Dm5qu0SS=OUp<6Sm&rNb#5Ss lb6Znz)K77RS?Ze&m{{U%7!?gea literal 0 HcmV?d00001 diff --git a/en/doctrees/trust_marks.doctree b/en/doctrees/trust_marks.doctree new file mode 100644 index 0000000000000000000000000000000000000000..9f496e61a8c07aeee5bb4bb1e990d6b39eb9a9ae GIT binary patch literal 98829 zcmeHw37i~Pd8c(tquYmMV;eUTwnt-i_l$1ILT0SPjCCT7v20^nJ>50a-RkL{baiVa z9|;gl+E64LXhT8>BqX~K2=HSUh+)YAi8&IE5XdH*5S);ZC4sOZyRZQ^$^O6Zy{cDL zUB~O58i{1%pY^7?>K)(rf8YDw_pa}~e92P_uUc>w{b#K;XG-PT#Z10ftksK#*|C-v z>xI^|QEPVI(An~e&f}dyYegeJYt~zhg3+4XUw!${;@?}o`tqOel$Jf*DXp*;j~f@M)R@>$bciZz z=}aCZG&`kL=0x5a$Typf@z z4P%nythhK`-Dl3^iPhyZ4Z}1V7mQBJTGq@@QHoA!ptPa1$XbzeV8XAZHaeT|*31&K z^_u*XD;ksKTDe)S*UU`AY<8^0)pE_~99`0y0Mi@I)`ZzCHvwV2=8Ef}5A<%%WKxe! zG#*Q#9`@}^m73Glfq_&iwSS_KJuqOyw+LU|sh03(@pZi=e+lrw!Zx5*+6bshHvs$_ z@$Y8*y9NKA2dI`#)*I7#qLm8kls1>1-zwc&8ZO;l8Z2!&x)d2~Z3SdtEu3g{@^&_q zWXP3dQR%kQB5-|&kSlQZV&be&G79I@CX>bg{L9Q9uICEnMxkot zrW%G(%W;C~eB*q^yf8&T?3*nYo27lJZ95$_mT+1(9xt40-U7-{%ogRV0Bk^U1Bqk0 zI@ZE%J3H2*R-@dphV(h3%<{EjxtJGHZ7mq;lwM{Ms>e|QV-necpo%Cx7+4D|yj`_$ zifW-%QCoh4g+x+MFpDqr{!QZ}+3R!xn9Y>efJ1LsDyjxWXaLh2RcH zb~ktsbPBQod!qx`k4wPT1p@Z^K)}`o0(O8EMA?W&tUwWTAWH{A7M5HKvjI-c^%)4- zMh|GJC>yo+JE*-?qIOLnYVQd|?V3Q;9wpRf^Nm`$HkC%7XF{o_%T073#!MA`8x-t# ztJy54rmE!>`nc(tati9VY1GgSrOLI`kF*T4nNQh$T>cSsPDaYC*XpTa9uW|;Xf#Yp zHEpD7^&0+Bhf%&z7ND)S9+M>fOw}+MygYjKB7xT|l}!a5_3J5^DyeBBUu&kC_0$9-mbMWy24ttT-a3(N#vKQ! zPw4>#lP*xoHoAaXVJ&Uu8&ig|57Cd00kho6u|o&bM-Cq%3#B<@?#pKDGe)gk%+!o# z)|@e58HpEZ$Xd-PG}Ds?qzF<|ucb$F!x>>~kTGa?vexo?xmcihAWRx5o_CJH0t1fw z*E{D@Hg&Ck1pDS@n_p^?)&TN0U~3jY#nA<@U;fzX*z#_^H=jP0n>Lzx^w;@0VX*lO zz#&j}WJbI?$hy|XBi)!m%NB*XuyMX`Zp=8us7ft;&AMj}0C@LNV3xzTUW$6ECXOsi~YZBFg1k z%~HLAA&6n3mCY0HaMwJaDkC!p3AkFd|oJ%liXqylba7#^W|ytRK9_+ zC#>z>nP!gt+4$=JMi&BU446?O2G^oQ7a}qmBeJe;U$nfr_`rIO8!Su@xXN>3C1VM!x?(A)4)q6>k3t)%&7nxW%#YN)_m7`8 z*v#u2CRY|dj5fM4s?0VUvLqKkGKv7m8%3cr+8;V@!fa@suMf>A)TP9xUkP$$5d{q? zW{FK0G~Ot4hQ>{p4b82g&`kTKMyMkR&OB?SO>Q9)>PBJ}q?}}Iw{i-It?)}&N8J{R z;W+{fN%h>Iq_;l;= z)sYa%JJe$fLsxCjNiKjqI@}vYq0^@hcN1nqvn3Ro8Gj=?SS`brCs8Dm zzQFcC-xvktGM=#nS-E#v;Ckl3e-gp*v+VDp^`<=bsi9?=-8N9nFnow&|;3HOc1`?965& zBcGr+)2L}vPQ{L-x4Bx7^L?}YPQ>85YDI}mvr?wEP>l45&i2emGUyTr?@%6zqeGe6va>rB9fJ)SxnS&c#5*&I^;(>j51|dt z!l130cc#5PmlMP8*V7^&H%eo=R!)@3A+oh`+S3P432A5|#BcpLC^+qmaB|x}P7DuD zUOk-{PD)en4aMoyIC#8Xq zk*|Gq>*w7u8i?|6x2;61X3ErVS$Bq_6Rd%dHbH#45OUg$)3Sh&2O}qjBRx!#2c<+> zmdMt|X@4kAVN#Tk{@LB7eS)OOt$UpBE`+?ACm|_Pdglc_qq9938)$cCyG9$^4(YH5 z=|Skw_k?XABFvVZ13ja&BPn!tXrQwr1|9mII66BVbnXg8Crkq+Ha6Xz=^mXr`o*Pz zyyH_RhO2#1K5mo}(m?Jp>I*}03e!Ldjly<>AIBAq}KPVWXkw zJVKVwnNwqjQum!r-P6MCCmkC7@(^ur9lP_@+jL3Ql_TlS=fpZgPR^9)%C#I-54D-iGuVs&f*rek zOm85P(hf;bJWP@c29D89G-4=V&W8ar9}L)79}dO(HH5X~#7I?JwW++#0QRk3Nw{yY zsY)|dHt?Xzg}4)`i}WiG`jJr3c`L->6Wd4jrgw~NOS`7INpl%Zvz)0nrm%y!TE>!N zmR?}na~AP;3=ik%&)&WKYXrSQc6eKc{vXNh8qVV69et+v7lsiGj|BAsD~*~{whK(( zYbCQex6IB5dA6M16AIbAB&Uatrw@)D_6p@x{*gy;$}QiToGcfx(bJ$E*Z?kDE~3vI z*_j>Lmfb#_9oacLym!y=-mE$0Yt~DP(`g*}ap9oeC z#zKplYJt7somu=pvMW0RF3oy&?{@H)?cP1UsE~K7Yxz@gcTkJFm?CW!$3j`;of?OZ zrOzBbe(KoRk+FlL500HYG1g0kZX3>`5=VA``Fn+x@ug^;BS2 z?+@8xFdyXDz#I()W|mq2S#oJUrgZS+X>T{u(*~=p6W?Q#ixhgZNq@qWfx=US?!`-8>4#@gP_u%4LzRifYigWE*rFb&z8h&vo1`~_{tw2&=;LLUH%m0T3%q#6o?{?v$BDl#x1O<`y#8Mn-HbAFC0op?V z9Uj>wCu?z>m-IY5m1Hn8lx-M=?0EY0;e+YJ8N^A$P#7K=NsnQa;A4BSf$uIZ?ca(i z=!51=5Bb})p9!UXFVQ}B=H#AT!`QerJnWiqW+u!!t6sAS{~Gy5F}q`U&+b5VyQ*x~ zolIOz_}?pLZnqV1TtPM$&aI&b*MXb6w1|CaQ9eyO~8) zcHd*dU?1L|o7qmY5GICr0W)^1kgA@>DSwLU;m-SBap$PsehIL-zAu#P)5P_?_q((b z9jL~>>%w`Xp}I{_ouvcg?#{DPH;r@!ZVJ+~#zZ<_ouX5(rD@YAk&7y`ZgnJoDkdF0 zH1~pSc3%?8E_bUqv8J?+cB#TvaQGF+GrT$nyfs}FD}O3hoyF+66>772e<+)>R$WH7 zc8T6v#X0=Or5QRN-(9Qjfi_t6p4**kt-1=f**zP|?olDcNBgK%FT3Xre>Vcg&U>qr zeyS>Uj&1b`FqLRC_&_Lwteft=-!;tavpBO1$6C!6wi0(qu6slYuIZ;@^F_9vopZT1 zvk!(cE4E$JxsmjtQ}t7QRH|sI#To239~t&>I-owf>ec&J@$JkZX!EVIr?PEs9}4C6 zev;jj%$d_oF{T{Dzhk~}9Ks$Zp;O?CxdsOS7f*X^Cv{5AI z6l`(fXBPh`p05=wvtO&d46av-t=sH&ACtRH^viUJc5M`k%+|jXOj79H{^ferE759G zS1y!j@*qZ*?e>vfKB8f%iunYyo~ExDbhm2F#wGlPW5*zgTZSYQ(EK1nW{W}0U|pgCr|QshjQL^U%{`t)$1KcSm^jm(qAg#*QNw=#b` z1%XOa873di0tWt$Y%61aK7!m~Bdq$Fwb zFX?oald2HwWVQsSXW2#zr=S|y*?QwVoLkWxSJ_DO2p=O8Gw2n+$5I>TpQHSRLr_c? zuCSItkF!y0dtEIpDJ`WAa}XbwV8#VYlj@VTlKDyzUvhM_-uupW{Z)B<@l{s^dH=Hc z29A|S5vR1Fa*_VPMQ7>uN{b%h=#yz%K@JzD8u^)$n}oj}hX=HwAr~R3!SUl;hKAVN z8JTr(hlYVoY9BQFzH?CdJI|#s-X=e4$p^_ypC~2K|vJ^U^;;YJYRXRSsLe`g9oiYgP%bvfHK?AfI!Fv=wAe#Jwb<0#EnUgc>-bNYFg zB*Oce!`ce?9kv~>xk$H`I|NYksJszbIsVwZ-++#K;WUU(BSBn)kRU&UsD5XR)*^^A z^q$*Y?sDEMRm)d9Pg+ZDPjuVtjv?Am7iP~+p?V3z-$tPdh4t2d`PbNJ9JGZD8lj>_ z9KV)0c682imnMRX3=1Ef`h6R|3Q+&@i z>0_ea0S@FktXu(SrXL{IFtk$T-$Rrq)`QuhA* z3kLgtg!5{lEFgA2^mID)^9{fo*BZR_10TXpPvNhhzlF~h%qdotXUuY~P;C_r2K+Fu z9NdoDV1FElW~*!Gg;-vowRNsOGF?-HlQ<`i$n;}tYV6dge0s^~c&gT#o-i6)wxUiP zFWMXxPBjYXQmDT%>nUtsY?ijB^6<+^-ngOYAr|Lshn44YnbeUMVi*m$H-+ER>HH<~ z(g~;NMsYw&3#_&lNf-QelY1J~FZ}AiCZ1L2@I9{h%I~bFnE{tg4>$}>52lj>5&@Br)tJ*>X?zAObH=R4c2QDbu29)C8X01fwY}V@XnIEabW9D7j#3L? zZFq^z0b9z^D$t_1c*h+iY&N!+gaw*oavJ8)(AE^MBbX&NgPe5ZqiC>_se|>}WO)k9 ze$+Ts3;6wiYY3@UaubBsobVbM8$$rJTg){9@Twf2&pB$@cvLvscq6^njnf_k2fefh zc;XIg57zm^`9cY0_q$M?Y_@JvHG>oc|Hz8?0 z?MmZ+Db`MBdRfbKaNDm@Pu`9ZzPLkiv&P64F;duKn9A~w@|0OHYWYUFj&2Di3>hhY zb%2(7yj){tP^)8HmBouuY>vhw)B&<9H~LW(s^RYJiz+3{_Xf0%HD03aMlql`QRz=> zU@T2>DvH~}BEX<>2%=!QjgnpVVggO2DfUt7fjJ`Xh?O9?m*#j~xLBQiJ-VlHh}HP0 zG;BLeRysZ#y|b=k1@u$m<>p(e(AS0>BwT#rTvhVY$B6fvss?nPz0qNN7!JAKUL-j`Z0 z6HfC5p|~Q}v}#|k`eCRWCHRj8G}pOxX0Ot3N>n&E;6q!fXPBc@%qLTC?1QPd{7}oI zqkV(~^rC&>`aiT&Ysv0ovRS_af9B4P`x@evu29#U(XqcUQ`Ym1w z&wCSZ5g*bQ9x9w$#BG|4JJl%2?xh-U^i(5eEmvcM8m36Axru7MaNae)cJ>YEQy!&T zl~S7m4B1Wl#5ewK&v40M(IwB`WU=)x2TSh~L?cI2t(UT5t5SB;zK6I3%7y;h)RhyT zmvV1)-n2D1g~*ZiK{-PvaoiC{H8wd(9#*Nl%W@YJOm(At0YkAw$rf2=>gX}BtI18h zmvCm`@c~>(L>FVM|M%*_eqz5+{V-II(>Q-WMg!1gYSt3WNa2pTC#~hxd~K?QGl95k zjdpT%tTmMjLt4OW3$Usn1k(K z#$ek$n+y+}p-4U1*YL+XzR@3)4TMkLD2s8fBeHKZK;HR^UPff!(*RhG$f&4*5m^ug zaU-&oOXDY@{iWU+Ga`$G+Yu;1Z7)43oO6Z=)Y+el8ICz4u4Kkz zO5~u4CL+aph`j<^7SlDFBeK{z#AquRqbAc3BQhFx61m<{84t=tEIBT-X&NVK3Vw{Q&88ctDN>XO%W|n_%tDW1x><;}FMTK)azBf7Xm`~PT z&=-w}pp~)Jt(trgJ1Iv1}%ipNS1-*lT95PdIZ zF!K}0p@6Al?9q^V$XT!z^HP}M!AuR7<;1je;0%>xk^Fzfvm-b6X*7!0Vzo_~knqhI zDmR}UQ|m_TTE;aKDAcw~rZCrLq*}EyE)(*qX3-Uui(AO##5@{_819IaS|(qt&ol?1 zm+@LoA3$mvtpe=@--j7Rdq|ktU#!!T{{fg<`$^WCmvW7I)!^SOptO}Lht)W`{EXf{ zgr#@`9AN!F`|uDh&E;)W>#bK_dA5{dEO3o^b^g($xyDum=fv0?aa5F_*N`=7tr3&0 ziC)wh9QK8ZWk%ZTj=*fi+P=7dw0p|Ql>7bGTfHW88r6?!FzRhoaE0cg9@8u$da{`Tw+a&Ye9UO9n0jb@GvIM*zb+S|B-zT_|&HSPLr9ZM1&Rsf!j zM3uLoYHhW!##@#W^tW>Tdz)xOqOlmh9u5zD`Vzdx=L zqgsbug?pl_Fgy!I+wU@M(fG;=BsO}hKsY(8{3fT0E+C=;M}cYrYQWR)IXJnZ>F@RHn8@#~j^TH$@>jjqad>xZEfw0j zV=YMYtm7Myw=x+?CH#~|X|L-_W$!Ha?-x8z0~Dt_PtoYZ@T_Ee4L)aR9=2l5#wxAs z(msoF(Y23TnFE)#OvjeEep&n!m)Dkni!ZM&v4r7q^^$T|HQmTP)u^{-x<1j_fo0gu zN|$eUeGJ`_Yb{5TSzPy4>Kwh6W>kkkJBUf+4=Qj3e{2=++t=;iM_#!TagXj#AdhZ3 zz}gaw9^iXQ9gA=PS=6Y{cD?756c|7>E_HqKYA8%s(%plyxAye^l^kKgD=|0_fJmyL z=kXj$i*ApVDXyn|uChEoRmNHlwM?|ks4aN%E z^+Q8J3#)Z9!HG@;&z(w5K=|6 zBJ@kn*kjMu5Y19z7VPvXwIFnTSONvZw;2Xh*>X6hE9K3y>C$i3k|E03Hf9##hf4Va zP8r=GzlS)0f(qeT;sFh*0g#RHQ_OW=&FC7Z8DX}IFS-kCK?gv$Y(Z;f3$o)YNM5J`iR`ZS zYvABT51x4{do@x?^mcL7WE#)O-WtzK8HURDQ7N`ki)=DQjvpJURqn_Nj9<|JLpGNGsDXeNH~0psyj>%etk<`3)Y!%{64r5We;}3kn0w!mGqBd^ zbDm*9^qb9RIexU<%4S1ZbF;ZNkVr>B1qspe;{_Vti7FrG+@lHU4d{huMx8zfj}Cp` z(qP$3AKVF5zR@dv(E!Z70bPwg$1}?t*o4-taGKB>Z*&F7)rg~MuB}1TxSrRG9Xu6P zR%)b@b-SFS#x|loI*q7%Uys}$MUzw-Z7IXJ=(nX^96wrwWm}@Gxh>r&+fpE{j>rm1 zq9w`;JA5Wp?%+bA>FEvjg`=uT;nAV*ehtpO^ufzfWxQAVq5<$UspzPmfK>qk#F#2P zsQrq)wrQ1)Gww&^y!GOiTM~nT)5}{Kqt^O`2Z6&ft05jQb>V_q19O zHT)5cR8oEY8b^)oH8iHxo<&ZQ<=|}pT_&8Gosaqc0oJ&gcP zDO^iMG}WB8>qDJI)ZUD+DL}ndBb9`D3rCG@PDi7SunB|i&cPABI!~vKHS^>^D0PaL z+*6~)>2eJ_4E$%-HSDsJ43)lJc0b3DRzK1%qpaC3%fQb>FXTJDnIJA&Oug-(gvvR_ ztTl-HNqhdnDw4?a+Nu10*lqWzgN~mF{R@qzQK$=h|-cCAFMp) zdS_u5obBqVUV|fb+JOoe4CBroSRvq^bz@kX7{CZ{kH~Dy{`XYICvI|&o05?7Hq(TQ>3zRttI+fUcO={IHV(#UBYKM@KbC^ z1YTHzpbfe>dQTDMFC=i!xFVW!xIbF0ek(~t8)L^ildo zyKa3ot#S>*B6yx2h=k0@KhOtdcl01!(bQsxh>$%Sy2bQUr8(aRbvm`S!Vz=3;3X{f zs^rJ}D0#WvW>hvoRfKbd?j~hZFrZ$l^gq=H8OIWBq>dI8tc3R}-LnD>bcVJ)-pacHCw2NXqrA#putNMjj5vs0g$>B0;c^#2l$+w?$y13<2TRK} zx~SGwP~~Y!Er`wbh>7CoqX7~$Xf0-@tVL!Mo_d!d#MPaX9m7A%^AVz8L*+yG6E%Wm zXPt1%+p$*ijHhsk)?vq^;?PN_@=4@jEkh|y+U*7JpD52-i4guKaqCLC*=h4dRwe<(TA<& zU7Eu=4WG3&>a(`g*4$|rS)`vX2_-GJ(~>^w#R^)piXigVnvNB;fzxSOK~zMb6%IF{-WXZ0)EWTvCri+2Lx$5Asg8mZ*O#WY8aoj1~0 z33&=RNrr=0Lf(W3ni~2I8Vq>ZeihjM4;raFY)4DHocE|`3+rVi8O zQVx!51BL99piN>vprR^C`!v35LjH^fn_kGD0OTLnNF^cvO^zBXX=yrOJPTh+!mk86 zG9JtpE~Ny6y#L`szFegvCeC5;9#c7*?`s+WdAWWyxc+LdTx$v1M+HFrY|BRX*Q}eN zVzO+tBPPpaJS8J5@KIAnmLO`B8Q$Gb`~=WisF6y_$iL{x$WWJzkgNDe0qG@)BOSMD zK;xB;Hu&AtE5GwC9WczqGi{!=#03BixWjh*;9!bN-bLbgG9Dex3>?0g$2BJK zV({2R@0!d2KS_ z451nr>G5-7?trZF`{sooRmBEZacRWa5VOO!TJ}#gvIkVeX^t3fidaj9TZm3+)LLG{wKrD3{Go9>}Ool}W4W@6)hfy)Q5Bn3y^q)$WFT!eKb8T9SRuDj=6 zl?s|y#y~@Q@#Vy|U_OlT_&Vss6qHmQR9=CCY>BWS_!`0rS-mMLnu6;cF zTIDqWc>)E*^-~_L5?z2a1n1B{-+&ocqj8~JFmjls;%j}`^?sm2{yeCcZScClR0_#2 zXdo%|^Jg_M@givf$=}sTC6W9jM~&6bp~PQW2rsXoi< z8dji00xp|zQ5V!Tov`XM1Lr4m#~%1Q4Y<7+z781vZLb*iAdS&c<#MbTmV`&Omtz-F z!;{-qPY0N|k;}36Y=FH}RTXF5z_V4D;Fb4?2F^!{NY3&7-X|kz;w^SE^15+nu{ZS+ z>@UJpm~#Q~dMo6sQ~$TFi8qzyI_xGy^-c`_w0~kSGtQ$N_KY`MPuUBYaG1wrVQCZh z2{_~`FE~9WbEx00LA_Uc-vH^g83FY_33mW?r*QUvVHJ5KgXP*Yxc9AGz{;$`Gm`?1 zF50QFO18*%eFYs)4sHo>(MbQ4s4#`Z#u zC142EOdXe^(M5AG`e;SkPD95fhwSBHGY|hl;){$X4{sjyTyB9i=h;#jH)FsRBZzkV zn+rGd-qNvdP{uSW7=yzshf=%+r2_-o2%AHfaAi&)IQA+MvJ~FXP#8A5!S@!jBrdS_ zGgHTsx?GatHp6rCe9>OZ+^^>OF@G=O9yo_vjb^Z#AzbN`n|^UCj3Unll6<@6Ve{sz z>1LUrDH(om| zq4D~zTvXY=6TtOgiO{^hR%0Q7Iok$t5@&pz}oeOi@%QhQO2gvo!3 zsVy4UdQ@Y00r0&7!&Yn&T8i7UC(77Vv=m;}C(9RcJu)tdZcWmowIIV4bQnd0f>8|$ zyx!DErMt#fp4)LB8^u-GGzj1^3f)u1rntOo&o!{ZJc#SkKF@ej4inTkg6qb1&`X&Q z4Hcc?i5#7IZi6%~3l*yFuUXq|20_a?L^@hdzELS}v6Nh(FF|mx-QZk$SG>vb}KLB zKM%OlYf8eg>2Ix9Zj^dlx{C+7l4ZqNs1gY1ma8r-t0memK zLv7;BJbwGG9K{%fFLWL_LLTtN${pWhTFB$J3e0QBw3u?i4@|a<%FVhc?TkokXX!F{ zM&(7OmylJHZYrFHi*x|TN*U8Mf*z44Y1M#C<;dpDXol`6Hw{ek)S6XfNbzwlf>pTS zn_s~lDk*E4z5!46xdnT#!@ncfJ93T;zgk0vy}IV@Pyn_#LzAtr7UK$f_bzGc%h=#) zix{eoDpE8oQNgYr%+=+j$nOK)g;1mI;&?_nvsHyteat_?cdF>1ar*+#tqv%CfO%14 z1}9x=lmkuJ<+1O<#7Q1k7OfhN=g5OExS5(_VS==AiM>OLdt01oK1|Eg4ZajdHXy!e zv{6UVMp5=r?jGj<1Ab}U{khS#s*H~}vq*X8qx8&{w`&NaG+U?;?nkpd%1|_&*coDr znB5C36)#k}5A;FhBUeyhowhD2rWaH0ooMTCWTc~exensE)PiFRVkds-kDbx(HJMB* zcaX2PEk6P)(-=Q47jZT|jsqY!pjVe&e@XW66%&@FwMJZrE7CNlsoyXCQEAKZwF|n- z^lbfiTNp|Ug;*G#2s#!9_297<#)ffc!3upH-RjF{3~k{G`|Q-&*ENJq+8AG>O7LvG zf1l6BusY-DV8xy$x%sDvQ#>a2%FBKh3K;tg32$;W;JSUwxdTV+8KPvIpR`t@&iKY~x1+e`0e;G$Kp*Est%)b3pxspJ-w{TwxRi;Bi(_abtV z3Wyuj+&zQU<9Y*j9|l5!dy`(J_+I6Xtdz{F^%;Mq z1`A%sKMclyOe2+t@o04+H+SvT$W`w0m+dO4UH+b#SdST5`4EVbQs!O%dm0}!rRxJ4 zjCn!+2ta+G7nWr2nx&dA#y`C4#Zf?u7?s1x8lG^$J&s|WbuD_8n+UgSt@LM#=J1qDdisTl=77y5DsKq9+#VQ z*MZG%;AP4;6xQO~?9iraj5cNJu)J6|c%(aKA)$4s!UE`rDx-omJ?W0Kf^pFbrI9Ynm;4N&@!td=}v-i+ePn_u}~* z!1GYzcwT8`Q6n7u%Hm~s8K^Ai!{tyGFZWYL%0f{U-Il%8_M1rg5VDJFJf3C{UBKLx z#Zv47DhBF`w-EHg;$B!TDpm1TMqW!*yjg==FGjxwjNYV?N@CREsIjWzn~tjR-#zMV zMsy|>GO01%n2FhY-bY?;mUvvQ#@O%>XkR@_hjuW-wVy7C7B`P(?Q5uLf%iamKQGC6 zZXL~H%P6O-)oa~%QSQT0h_3to*zZxTZl3`Py6VKfP|i?0KY2Z*{8Z_`?`ZY4|LAQsRZDT-`^Mv?2W;F$MJp z>GcC4VyQS36nYQvyf6`|MVGsOF2b*9{C*5LR15OFl&FPhJ?m9cAA^$mHLkmGfu;g_ zQ&LyD|GoX{fc|$QUaIEiI!Q+#E=T{n*H0Dozly3}s_l1>@>*o4+5d{ZCAxsQ_rEkY z&o=`*;QI)B(E%?)93|ZMGxpK4CsoWD4Sv1C{R~h#rIAVs_i>II+XFvz--)rasd1bG z!0h$(OlsEdR`0!koUQIW9j~Bs0$VXzUZmA|Gj)RY|CbAguuMol%kWi2%i_FpzppV_ z*mrLC&XK+9AnU253sI1p40+{Ut_^PT2EouV^D->KH?Xs+Lpx)-He37S)Kngh zm<#8PMy6~uCo}cNR2I7-v!&*AHH*3@1T*x5H?91(8@A{s>y`FT0I!(VQ664t4NiKUJg-6jjl!)mv@9ii@jrD*msuMD8N? zY}$Gt%K8GAbdq(B2HuHei%`n9hKz&XhE{8t z=ZdOcs_nB#`2}RBsn3O`iY_1#eU39afg|;+uT}aSag<)U79Zj)5UJ1CA!;1IUg7>6 zP+F~#N(%P?M|J7*VBvm|ZPYod=*ps#eiLSm2@J-unl_ES!}S_G7fjS!O_+J`XQ1pl zdnPrx3?0L6SOZosR-Xq}>BOhGYW zlK62AEW8MQ0SLZaBb7w(agG|RB!1LZ5@%+NLV1$T50-^%l*4@IiT~Q1$eXrOSeB;+ zd3mLTybCBb=yF<(7_Lhww#e-(>#gGDphMNvFL6zIYjH5)e#BH!82p{Q+d|7nqM|mV1-AE3It5ML7DE?N{(JP}$Ol%b{$q zy3R)xDO*KVFV*%%r2Nxft1Y^Kxhq@9c)6IPC4oQ{dlT4~Dt4KSr`pVO37eStAE{WM zgQ#(xj919N1hh74q>@5@Ek})0tY?1|XBJ&A@?n|9M{Nnq@P9HwR2Lh#m=kBaBoFZSZ zJ1I_{8Xr4(V)U5!(hB=Wj4N{5F0#fY1pz>Mlf#Q{w8B10Y*r?{laOyNA7%M~9J zKN)pnCfi%qFX9vTf<*_A8b4ZcZDmXr+)-G2FM@=C2QN z0j9e;sB%>yAp|O^a0s+tskGyL5V&R^E{arArZNj61S-N2LYt0d@{LM4Ip1W!m%2-^ zhHOf3PR(uyikORi5VO@^X;FIRqiUcX$`FL_i7O8hw$od2vwbkdX4UWy*<_+ zqQ}||GUEEVo_Z|nN}FZR60m-=?DKdTXqM53%VCy%+fNmlWs0g^s_jpa@-xV;r)rBX zVD4raE+%2;;(
    J5%jwuECTsa=atnkLywM2+LwE8t%SQp+_`NdaHNQR7T9YmYs~ z9IKhQ&$C5SUioUufS-+WmF%%ohY#A@NKd*98fRUz{|uZ7uRAng^J4L5z+y0QEUt88 zKTSCJ8~fdO8Q9qA!{un~ML$*4*cDaLZP8n8UqQ;dkX@YMdqg<8fVnqz|AZGj&IXUh zUQRU;G~q=lloEI)*Nc|P`lA|HcoBRS2tKNjN+NiXqsA(MeYO(d6V-H@+rXwYV#{v& z(tCKC-Q!-O(`8~R%uxe#$-+?tZ`FX#i^rb>kDp5%k1MSRo*^9kir|BI8K?;8!{tx} zf8?i%6oH~Dx}AEf?Jtn>KO;L$MIgjDx&V(Nh>j}Vx{GtD;Zbe3?u$?pwp;h>1CGN* zx^=hD&f5;H-~eYC-H?eUd1JG5N|Q$ngWNu`|D)-0lXjIN5;a?jU$0Hn;bDP(;`ZqRT-|I%zRg)W zBSzoVDi=(292tYBYj}>LFK!FKgvXtNA$;g?s^dZ#c-)Cr7H$+ulN>f|97h%bOe)>E z7_kF9`Kp~J$YqgdPsvJ7p`~ppbDki0$G;Xh9mObc2^Uq8(AUx~QOB#^*U-YQVuqu! z`DfB9%Eg0|0bH?EJg)fuEZ7wvdEy(P>68<}=Y537Qols;B|+n(w2v;II(;g&|FCIH z&y?%A!zV^EI}e=OD!sNxraLq0O}8s19pVR;w;SnrbQ|DGaM0@n_&F|DCGbyD;QQYN z1R@9bo}tP%;7m_;Fa5D$XY+;j+jx*-aHBZEo5gHsp1s5 z^d6e#s9sEe2f z0Q|oi2fxZr!T;Vl!~d@S;eUFr@b8X;f5BG8su2EO>IEoaSE)Mo4AzY34_Nwm2ZN(${&zdF>7OBM4U`VG$K+&bGxe>v{ovv z%ub~V`_ILS_{gl79czH2=J;;<0NP87Xk_Uae@B;A{wGL7(cdEq%gEWRd|SMsV#FIa zF*bxYEb#MPZ#8gzVWoxmG?ZNc3|qKvsMgHMPbaKZ_M2+CW^_(i%T1%%#IOVeuctfB zn&qmQnQYW+P2A7}H{vg$0g~yAn=0hV?u4~s%BayzI`sy!Sb?)u;uIc!tP~~Tf}PrV z{2Y)!Ta7Ayt!~x}xd|M?qOZV@rcA7>C+qblIVg2~Il91FZK4w4*F1NT_62tEW{rvC zZ!=gmp5}oT^1D&Iu|41A=n!BIqd3z9$tX@Ha9*s!nGyJk%2f?GXbqI$hsOT7 z#9D7$ECVZ?6lrF)$vS#+wy%q|6|WI&EuBxi-^k;$|akE}*fd zwWQUYOz-JfH+etgj7Fp0$YCg1tQrkqOk@_C9cwK%JqG7+v+s*9i%RNx0J%ow8&JOY zgD=>kk^bv0j`YQYB&uhDm`g+{GoU4y|VJp1N~#tdWw#n4&A6V_5} zCzvb~J}aX zsn*P2%$3Shr7HeGgcn!qB>AgMsJ&+HM_OpsCV;wze~X{FDtrw~Xm2i*aA83KQ!Apm z0cD1elxAxN2RYY3Ct-~Q_zN}gBm}5lpuNIMFI-KU0xo%c@z{qH3d@VexR^B(#AbQ| zJ%ZW11QJSy(L^EF6%gxuj#rj)`C<{r%1D8+YCxuFT5|bgd3muHrt>r?S zpb0}7=`1nYM>E&VH>Qjx3(k5F<*e{P%qC5AErX>arLCn0OJk+kQmOR%(vO$kQ+jLZ znbL<#Un+g7WnJw_L%kL!vKCG>I;A7l0AG5>KDRoh2d!1Dn)}79wZiewMc%arl!vZP z={?rfQh%k9sfos&hJ2Qu>3)sIUiwmt_?xr|u$I@$#X=f)e(>qz1@MwzA;0?-a(%UVX6%6O%(mYywryY#KnKbL+`S&6+$mE{y% zPr-E*+)BYF3bs*@rQj|K_ET_-f-wpnpx`AGOj1ywz@%V?f|pb9I0dhx;58JynSwV_ z@D2)onSu{c@O}zDM!|1T@Hq;8kAgp?;EyTzIt5>&;5!uj0|g5gBKQ}2T1!u>D7cA& z8z|U9!EF@mqF_4(2Pt?V1*a%DPQk+zJV-%>f+-4SDQHsgDhggf!B120lN7v_f}f+{ z-4wi&f~P6?AO+7*@No+MfP&9c@GJ#irr?_t{0#-)qu{#~EM0_P5e3&!u#SQh1vgWW zreKJIeH84b;2sJNQ7}%yiz&!c@G=T&6r88vQ3@_n(5B!C3ZA0i^%T6Fg11rdJ_>%7 zf{#-0VG2G?!6zvAZxnoyg1@BT&nftO3jU6Qf1=>~6bz8nw2Xp{6kJQe^C@^91tSz> zC^$gDofI6U;6)UirQkja3<@SFV7rV>v412B?K>2F6E|m6{)U2EaGOfyCJGwVBI*=; zm4as}V5^gD%5PAzuOnz#E2tgNUT>imzS=H*yIuO{HaCMdH-R>bf15?W&0^nXk#DoO zw^`KNEaq(%@ivQhn?<|LV%=tuZnHSIS(Mu>#%&hiHj8hYMYqjj+h&n%v$(cdRNE}3 zZ5Gisi)Wifv&~}JW|3^OIJQ|7+bo7{7Qr@)UziZ5EL>i$|M9qs?N` zW|3&KIJ8+5+AIcb7J)WbKd420wJTKZPjZz%$<_TNSM`%z&3MmosCu7lm2MzC|7_{M zL$Q6m^n=oOgjQQf%7L}oT6$uwb`w3ZR@*{PtkrhW6Kl1D^u${26g{z4dzhYBt5xWU zwc0E_u~vH(J+W5%X?kL<_Evggt@dtuVy*TxJ+W4MhMrif{Q*6(R(qD7SgU=Lo>;4W zkDgeoEhRO`!RZAt!B{^Yqg)H zC)R5JiJn-i{TF&-t@c~=#9HmM^u${2Pw0uY+W(*@)@uKoo>;3bAf?1wZ4EuKR=bg& zSgQ@v6Kl1d^u${2ZhB&^c9Nc0tG$$-SgT#6C)R5G^fdka2nDR)){v58{YJMY3;jkn z#|ZsKw@rvKGffGweq$Hb>{q1nBu@WV=m=`%7wHV1wc2e{lJc`w7s_;P1S~Ds9O4a) z9_)C+nsUDp@nD?82A!U$R~<8zqh9NK>BL^)$#I2UDkr+ylRpN5jV6scuk+_6zg%Sv z@c!@?M#>n(tt`~5Rbee+D81}pUA%t-xO<{=8bJ_)>|(d1!QM1>j0Z|^3uLkwuFmlvW->^L-j0OLC*eE)36ECY|O!s z7A{tOulT)D%c}VcGt)3#?tq%4p@CNa3(q8pP0vW@L^&m(c5x*%wAI>$#>6L!?X5EPqm; z<=;t)LZ|Cww$!Fau*m*WeHIdHlzuczj+T zJdQ^4xLMqR0j)_!veAg<`MMjlHPY3H+LJ~KYp9$0;5n$FVlu5<Boy%bWXP`32F{T$#mODsC4un=$;3>GOLeDSn@yJijn9FwM#gN7rvbpWkyy z@q23@{Jtox1GS)kr1;&^2fs(6Wx7x; zV>yu|8-K`oCdO>hjDJm^@vkPu_)s5=-xAB^4|&**V zQoIiL!E4lfj=f4dlGzrmoqtZB*`G;@*^zl-7JI;>nf;(Xv;R3MX1C1`v*{gi%zj>< z+0P`!?DlzMHb#v9MxWWgPKwzb^TzDXXfa-NqqdcC6{03$W$c_cW_Lw1d$T^X&q<2e zUGv23&bT(aTc6n-Nin;-4`%lV*cNg#3})^zOJ;`!;=M-;xxwclN=oPOAm8aqNCr zpWP27#qRz-*ww4sm^S-GeP(|@DP~_VZ_I9w*2jOR&+OkO#q5E3V|GV0v&(MMwxSjz zY9dzDU41aC*J@*j1JBcE_qj>2`@%lh)oZme7V@3?%&{28fg zt2ULl8OMp3XzBfReU3kp6vs#U;5cBXjZxb^vNyeBWLr9BhV75^dHhmRJl@j>k6XKI zwKz?i{-Ue!+xqN%D=GF~)CYT8y4fq_W0dR4o3-ts<%pVyJv7z_ZvlN~v6`ln_f>dF zFXSJA>M2K8XwZzuZTEui+wQ}qiO z64Gc6-=WXpFDJ#}$v!v?Fjk4fXy!hq&)jb$#oVbrm>ceHd~(+?^k_7Tf2z;oA1B4) zi~C?PXqOJn#ghhgO~&tz=Jq@K-2OvS+@9`(+W=`bMs~$a^{joawrR5pQ4=w3&h)|D zwr*)HoAo`rhDXxdhKFOA+@jCqZAmdXo)D9Td_9dbHhZ@Z$IMV3)MxUANilg}A4~>x ziIv$Hh4ZjJZx1HL+e?z-tr@LeX7zb%CdJ$RN%0mlDEw)C-hMJE-p(e)+xh5vd$&Gs z?@Wrf2a@6~W}NhlK5rjSinj;*;4R38p}n{1;!J%ey852gXYtEPvG`CQEM~epzB;qm zh^fQx=`;A?)^=nX&%7Dlu9K7AH{b#5#Q-)r*7`(z(n2IyP3;4&_zhof2iv_6ZU zNRY+leXtlXWh@GSygPxjfIMyTGm1rnyq-#DjO^@gWw}S8D5eojd(~DC6Xp7i;_%(JwVT(K@1v3 z0~}J3kF1jzN;-Z{0_VlMaT4cpVm~{(PIjHdFX!6(9LL^`^PIJFtesU3@5agIa5u2>bh0e(SP0zZlhw?ujI{g zx$cxLx9e>vJEiuLRd02FuzT-!bYI`yfH-?xRvs^ z?3$bR3s_%rmO}4W)_QmN_w2EY&*t;_3m1!HFTUv=`1d0(zUiIa%K8i4%0_R^IqM45 zIw1FVb*WX}x`v4+w7Qke?!4)ZnXOjSo^Q860yTNHU3SqtZ+)p|x-M?wdTrfY5?33_ z?S}d>Zb;nzBe z&YigH7Km7#eETb*p<~ZF?R>-{Q9C-Im<~gic+{8=w#L zcINZO^YhK;4fMmogGQybR2v&J4CDU!X5rA7gl{#T>Tj*($KvTW&;KRB0||S8TICi% zRk;=5-;RGf@$Y5$_i{kBZoz3TnbcOQtXmnc+|{n!U74)hQ`uFy_ry9Bu)7^ofOq|T zvuny?=#>fWmDQD3R91uPR|>uYWv?R2N)@YgDQB0Q`tydpWG-5uF`qBsfBxkbjylDX z-7M9t;$qXX>P3EG$!uQAyO$RUh=a>^xm7u6?3oSFSj+F~csz8iWeX@1FU!7jneBS3+fBRcO{Axc3N!0vyKD-s_Et@FE3b74)hEya$9-hS;yR-8Ol&VO z^Y-+@Y3hY`UA25*KQyg!v1YYeRx@`cu@g=P-Tc4+==&F!3ir)=`(u&6Cjt3r<=sm0 z_1%hD`St+mijVY`SfrO@k={aLq6g{w32C=sm;13hJ)e%EIwM(Ip}IR3)r7ZGfw(bf znug#^z`Hv_2nH2Nz*6sRY4s)Ihp_;Q>m_V#X z4Rad=?74QUWgCk%+rS*R)UXYR-eCb3_Ro5Z~By_Cn#NjqY}YsP_RVQy03&DCl~ zt6~|}6?3Ukvs?zx#H?N>@LCnyRnXDAZa`HrmMpX0GFpx?&xqwDV%C^HX>IdPW?OJK z0P3UZfPzXF%VoD{KyCEawan(CrSwD03M3QohS+vR-S zY8Bju1Ee>rGBH7$*F^OAS)f5E%;cxSLdW|y z2|%vdz)%*IXJay`< zL@)}=aFG)xL#j_hDJ;XIxfD*L%J6UtB~rT*k?N7*hhd@zOwJ{%KB}P7iiltolHn!P z1c0a}4WN(=4`)&6j3~qPhDm7dO@yWq9b|`VHgtJnMN;WYtPhNgQA}A8unc|Bl{h~Q zD^<6Knx9unDr#p>UIpJ{qYc71`hyk7L?VvQL~$epk2agm$eL$RKm@Uyb;Ou{szrmz z&!A+K_(rZf{YqJ`OotD zGlj&#v`7T6t2Riw^NDopD&-ML#Q3REEN8v-kDqQjmu(mkB|}D7=#D5TIVaYN=I2uY zjXMd}v=gI))!SH!ULg^^lZtDM!@_EczoQsK;w&Lj3`u*eZ~BmiR{t?sx5-?KzY)vG zY+5kr&0eONOe8yOX7#P3#i{(B^kP^U`GSfAYbFYcFiK!X&AGlQb}F|=8$rSIasN3r z2G7+f%EZh{g-WKF8WNr9{8TpRprC>1Oy{QhqC;h5jt&(n(b+Q`I%HYT2AzH;ddWL8 z{n24Ff9B{=!z4P>L!*)BX`~%1A;}L!#PGfI=|N2q#_t337yR3d`xta8i=`Kq5{TV)-c}Nfebs+k5y( zmqNkQ0GqH3N^N=W$3IE}9ZbX|R%_1f%Sr;Fpvd^@mCySINFXXhA6uDd%~YryS@$KP z6EA`AZie{uAQX(7U}OQI5Jo|cfP1(}A(S#1S)y2p)BTA!C2>(k@@HR<^oiplUG@ae zHH5;FCnGLWa_51e(V5Oh2iljPPBF%&!5wmu9)}J+&sYbdhDqKzG&DLhS)ntN0-c!w z=+N`b(U}R*c`y;3Bngz++H_yOcXb-b7fk|%*QY@aZG2HVI!YNyAbpMcP$EuA5-6ip z*ghhHa+NMV4gf92(j-s` zTqUqpuz6uFyovhJVld4dP$hIVJjG*1(Yu6V|NdWv-zm{;{DqEG~R!QK|Dh=@s_Mjh21f5+Wj-H&JI*^;0 z+LP1F+$6cImTTvo<{~_ZYc{qV3v>f+&jsY4nVc-rp92T@*A!-j!sMPj{XbRQJ6XU{ zJ9Ba@R; z(=i>oy#sxyUqnS6z$JSHdu+~NMKGR0<%mbfHb)rpG!J?>P%#;uh4uSL24`O z$ZS81?5_7dQP`Cvb|k`As-Y6Y#}hH6qi_mC#b7Jhs<2KhPNWii+NcZN{2GBqC$RZ^ zZ_g322MM&(b7vG>EyqE41lwvY@Jx)kq}((YS~88#%es$X!n0A zs`pA(8L}4H`zI3#Vc!$`5gbFJ5v0fwx^C~OJ{u>N;9o;W{(=*JbP8v3I*zW5B73A~ z>1N*VZbjojzrR6MOJYwY63eHJh}f*@TtjWsI#B*z0qRaCQuj3RBl5bmWgv#XItjHU8B>6Vc~UiAoc^h(rj*@hKtIeHwPIMM5zr+ zgPJA*I+F;{egf#|)L!3Mi}SlA=MkDD56e)YX_X4+a%YYn&K=DoPY#O0@s^Xrv3|-LqAq-2Q5T5bQ5ztseln5j zGeq@cPiaz#4phVMx^&5Es%aCgF3<^aee$e2u9d4IE*u2tv?0lngQMp)*6wwBhh{!c|}uo-=Al}a+7 zN+i?oRZZzmU1PXct$L|>wL!<@dwW%1XoJ-7x!r5+Rjp!4?)gM=PY5PHF+#6~$-QJn zrx6f#Dcq&>Q*~)@Y->b-sYXfQ(}@JKYzN_dCYzV38R>f1@ zlGu-5rJ12~Y5l*&UH^t;XwKH zQ5Maoz&REICyh7=l@+v8VrC{{#h)s8icwAITtERcFn0*Tu!rk~#_+SY1M%%8qK4{vg<8 z3e7goP&Et7PV*9CVUdN*wsLGAz`DkbyT$jhQP*m=-Bz(~Ejlfmk2P}?QADX)!vRD$ zQgDRDrrD_IG=B0N1tIfsL7Xy#eY5K>2Q6DRuZj!2h?CNG17XQr!&xv)Lph)t74x!1 z!OAEO92T2yh2Q127$%~dF4FI%-Ks=5jPQ@gExd^e9H3ir7VGwNh?8cPDu#m>nuw3) z!lJ}ET?CxbtHjdWKwL2`_dTv5`zkNH=$nwTfWzLDg2UcGtaVTI_4J1$u?EbB@B%jO z%2;Lo5UAF*d)}5aR_!XH0ve~$`TjyjHwzvFXSIm;z#GP?(=LV2d+h9~lZJ>tYs_DzP=rlxF=aW3FmDGhBKTm# zflbPwx9?X>3!8^{aOmRhG4rx%*Vx+wg{XJW(P%Q}5bV@x-hY%sA38mude z)ZmMuia>#OokJZf*;{=tv5AniTV!u>H>#HWJhvnqoOqYFhMVK9c3Wjcbw&yoj)ktJ zM=d7#`#vgvNA>6MCpLdP7gbIF9XX;Se^>RFaW`!j{2ubA>VoQjp;C3s z|AcO&#=QD*%Dzd2F?ApV*ipG3$akd~>I#cE)W^kO=qm|gfd3MjD%n5uuBz={kmcHt z|0k3%BJyk24v+j64S8`8qc8Sp5;UUKS>&iCJj`97FZj~-U@mm5rk zP`$Ayhya&DA(WOul{J1QY`Z+IV(t?=AqGsChBM#NLh#BtbnGm)5-j>20rb(DWx9yb z>njAh4y9J^?=-i5Z*G89&UAH}v7h4)LR1H*2-4L2sE2%;J7eH5{7I@q?Mltt4;?G%;%T zsngo(goT>JrITAFqLZ}gT^D3fhw=8292fZ^U zCUA3N;@-SL+MS+3sg=CIqGr^bWpLaWc(rZOu<>8st%k!w(^)b=G`AW5 zcO#IjSdC3gi1Bc^f>AUvkvC2w)TL9#hM|sEyTQYCjH(W3qqU=7K6LoqAir)c`@_a= z(zpY4WkV}pX|O-_jnE@%wm8Ea3A4gF1ct&YSXYqO``G*A+gpvUQ*XW|1us8?JYZm| zgtfuFqw#>MR5Z8xED8)1#{SK$kI>9L!*g5zCf*QXMv3SqjfGSRZyKS=#g*poK!%Af z7-ml0o-D(>pBGb;nCs-sgzw9kwfN!4E%5O~8v7s#sq75^!RI&lTY_IxPn> zz`&e1F##uOBe+A0TPYr~T5m~vjt!AQrd-Gt-!Z|Ua}R2qUs%zGD`xm%W`;1wgPlTj z1?;5VRVDm*dUm49c%ZH!s8kVgjo2DSQnq1C!K>c?zz9v4;yGxjz6p3#w09UD#TNmR z^gi#`XxeHtosw0?E-y_=$AU=kQlASVf%%FTS%q9-7IJOjZB5g!RWf1t-YvO|W*t?Q zn8d9sFalw#o+~;|N7$CI{lqLiZ?%^3y&!+O27`imQ3R$WAxDH2$bg}=?zCtM!(3XH z>e)9u8A0!UECn}(wWwP|y<1VAoOuYFQL&#;S@Ht{7K0dV@&h)($C;)kC-3&ZbRmP* zMb{U>2b0!NX8Fma@z57k;%oB1rc(WLqLp?E;GY{XXkcqO8CjxuFHR7zDwgVHPsPWq zM-d0Y!o9HDXgA2NN56Gu5;~in#8Cn;rluXg~K&-qULK`0Eto{R_y05%PKb;R$S2 zUcFB@-T7f=1AO5k7;J6rO>YZye=^>ae|zX-9P$CQ1o6N(%#wMuLPj!u4^7`u7`Vf6 zgK%>;q^=|Tzvq4+A8%aOYXOR`GW~tMEyx<)X968mMH! zTZHBy)|23;D85;MCmfXD5X&_BmQoJi9lUHiZMSw6Ms9x(t&9nBH!r&;CZK4+It@k3 z5b;e>h6+>*wN1$^rvyh7R|q9|W{Zsk*H|*K1?O8qPMwAv8!KPM*A2y5&o2!I5VRGW z74+>Q_!E@yc}1R*F-uCJvdz1=($p%pd?|NRShIWiKrm$Y@9Ybjs^t|an89DBQG2ka_v7-o1P-hWkcE*h++b2=p$JDmq$6$OVCbqsyYg zU1IC!%xP`U9PzsjUA#9xMtp+i3sqTcD8!cKYuf&(OxS^7hZv#QKY*divROCBGMp;&?ISdD_b}|L zs`8s3+PZ&95;t@E!&~-0ho<_QnAe{k_D0%S52t`J`w3O z`dm51+lqdMdo7AZXdHSx4X+nCtnfF;*<*rMO2310e6&1lZM#nGvQ_S$Sk<$n6D=M_ zXQW<`npI?pbN*IL7RQCp7NjUnn`ur;We1BKGN)nlgSM8;`c+?rQF0Up4Jk%-2Q8F^ zl?#2)(Aec79@AOj)fsYdp+fFwxm=`62!3G&3|3oDJbCsUN?(B4kc~6YDYYqww_%~$ z@ux-bMOOYYE;i<{z=07R%NzKgg{##hJAW3%c*3m1u+1CF_j56BaUn2o!i$Xin|!k_ zeH9^6to4`7T45KVokGs2=`4g`jIjA4@s;oo8dGnnO8zOrzr?u137x-32_p)f>(&o1 zbjDijM7so*iIF&n>0Bk;c-TC%avY@qjO(SnqL+qcxR~yH2@vwT@Af{$spi~<7p~0* zW(P_bu|Mw`p+C3vjJ!eJs;kZd{b8gbaY&Lhe3g=hffRDvh@$7Z3vKM3OY<)of8eqT z7ZmI@=rU2bp71(R%0I}|z?nt*OOJ&Gt*^%ViWhAK!azhjav@by+JS{FnVcJf1+R2A z@FisHYOw;JS{L>stX9W{T&?2Zi7h+~B3rix{0B;HH~^3btG@wbz#SZJ_dr+JsLAoqqa(4zo$xBq8+-n z4po)Mkuls>{WBvpf8VGq6j;neyN4O?h|iul-am`+egwz+Fyd(0s|#4+wH@qjMpP4j zsA6eZ$7-3r2v14x2z_?Xg<@cH5=+>S7uzBN7|7ab%%v= zTpo>L(ii)qY(1`%WYL|a0_Pw0nz|Y|1;l&TvHeTBM_~=^yGMz-$v`HH!|F=&k^;U< zzW2Q51||LT*oBGQkyz|4+qD`>hUXD?OSsGuJg1~9K6RR)k6oQWH{OB&1Z1z+u~x$8 z!ix5@8dyysA3hEpB(UeLAvTZ#Vbva$`MJm#qSb*GE?fF)R{t2K(X*Lu^|QE)E*hxL z>gVu4EEmqd9&G(BuJgy$*M#c=c_r9k7yk~>eE1V$@(lU7Lb>kYA~~1d5P70XdQS?8<15!xDJ$3WUj^n2M4}*dn272Szg=*x_d zzA1K+`Rq0ha9TCJrLdyLD;hvRLB!PR|>~RRF)s}hjaC}HH>ONBsmC71$%dG@r18Nj_m>UO)g?*ev5+z{HRq&bfPM$O9}| zhjjQlN}Q73;p-PCj#9*tC5u-eLITri6<@lBG!T}J{*!YY9D+6$eV<8$FSvwL2;vxl z$)4Xdnf2Jn(+;zMJv_@l7Zg%Ttj(eDC>CfFSAL>lzgY z_ESeXe2K;XlV={sCj3I_;Kk_!`}bZX&V@M@Q#~@4p|8+4r4ngn6N#}1x5_%y9`+Fn zmfK!o$W|zpT4pp5uVk%VFI!i%HG+tHlX!;RTW=vq8g|0E*t5nlP8eg$T zdW>uc8bHH7JjaHgVSS)(1U&L%j7tB}!mTMR=113bely!LVeclnvMvw3;|z z*nNScreNoz>+O*-&|rQylOy$_G(uBE86ybafl3t$+q{P};H7|g!4hhk96Y%q+G$me zmFNIrzf(jNhDr@>`r^g>vQ?|)F4e*B1z)f%1b!bEF(`yliM(*yO`Jx9QERzkV-|w^ z_ho>z;N!n2IA{iYx6H$RwufC(|pY-T`In=4UaZWpq^jAx+*73 z#bhWKe!c;tA!gR=+A!{d6)#?ta-rGC`^!`WkjLntnNV%}#qqj9JPclce!ltqn2}Ue zA;e$!ctlPggjj42-%k4cjs2X>pWCC)JyB4;LbSIy&8_A$i z{TRlkR2RHk6M(yTQ4a5$V@HuHb&N|5Pu=>QO*5@8JgEUJJYPA)5L7jZ_E)B4<0~`% za%AoO^UcB`mGO=NP4d>k%L!-Jx|KO^r)8 zn5rQT%Gm@c`}3fLc`6p>e($Q*6b8^6*9E!@nxJNw83GZ4tN+SVVgHW*GV&nnKXcaV zS9H$%r4+myLNr!{^@zrSf^l$}X~be!W_<7)l$H?%$*Y*(!h+k}!NCCcWn3v}?i+-CpHdW9Zy11q zCUSyq(M67+a2Sz;NXykHxQB-jIms1x>x5R*^;YHBUHAWzs0!j>l7RaMmRkL5`@5dE zl9q7ZaepTtI~Or(D-=%GsNpL!(wR;KJ~iB$iEzi{D{kCbxRd-1pq4IC*jQS5m1)@} zO@gG>lHMvDFtl}9u)>n-L1FWN0`c|Ls9^cr?@50;W6vbpAfUx%f z0Og4fpa_f z`-6W@3`9#w3i~7{r9idl3Hww`7xf4(g%EM`Z5z&w^2Cl1HzewW+dWI%$l;Z^t-Sw@ z7W!-F3+Eub)TAfHXK-vlc%qM5xf)epNI$AR&!eip-W6t>rUrCq*X>S|x4&{NCx;m? z2LVpsQ3@HmwT(DGH{ne4qsSfjo3UwJdFK%GCI$z>4wqtkZ@UZ=h6p0hAy3mGOu0!3|YKbaw$;No@G-ZoBAxp^GX!k$YV2Y=VSntWna#4i56$VqRbAGXnHcJYHFvbNw8gddwk zO)wnRFX88y|Fhk!;n$XyQ!36w;iadjaV?tGyxP@{F{_6sR(V_K^C9r!EnXpA0mq8H ztq6K*H}HMQB@QBsB5xOWWLViEt;!KI28TG%YSiez5Zu^|Y29hUu!-YeweE@Qy|Ic} z3x2NkwjrD!;KHQec4elu-rBM?-(Ey{TPe&w;6e^)JWIH;#E znEJyHA}@P4Qu}$?0eG+?q5a63Szm19q%qJgJgu*VAG0E#>x7qZsfVK;;{9n~w^-f$sp>x=UTJZZ%x1 zU3Q8v;33zI!m*;LzsVd@Y85ZrE`0)w%A$~fbj+JRONxWyxV2u62OcWkX3*ne5QxzZ zrtxzY=_ojD(|SAT3iZHnLFWk3!Bk)wJ-(@FE(brsq1$L&`Htfl1WWin!xJ~&<85tN z4RuDJ=)q?$8W;<%Riv@uy+kh2aof!|uHw*mojg)Y7~~(+w5Wi+Y);@E`Yj;fAiK329^VFd;#rF%-t03#cGP-29y~> zTK={h*z?^AvBaNH^2NXlU?8Vt*B8JBQZ8&KNr4r1Bp-*CLS?2HjB8jZfo)Buy}c z!Hw9k=d&6`@%;^EoNZ_nSgQrOiZXEC!0o;sUxhkW*DnDBJ zNadF+pQ?Pc?QIXeLjf1~CGYzAX18+88^a;F(xsdYZthl|@iw>N5T$M`d*b8t;_(k4 zw{78LPvYnMyzRdH!Y2|r^gs^$S@}rsZThD2r`kl{f@%O9RpArx3Gz@S|4CfaQ82U3 z+wyjqTIsE)?BaS?<;BY9Dt}w~>&jOu|57F2$m)7ZZlQ!?&sXoFD0v4ZKSasTQ1X+M`~oHao|507OCAU-Z5=wSaayKQjlQ}WN0Y($90>N-kxP;wI`g?J%2mm_<9xo*ib*4zp#4S+c|I*kM-eFdKH51v|`s9cH}_vt5T- zuEXrsVOHxfn{}AQI?P@jW~~mhRfk!s!|c>yR_ZVtb(n=Z%sw4voer~2hgqh>?9yRY z=`fpgm_<6w9vx)-JkY zsWnSiEVUk{E0$WP=!&J*Yv_ulmQ7bIwJy^YORYE46-%wR(G^RrchVJ0t@qFsORW#m z6-%uT(-ljtPtp}jEjk}Aq}CVcilx?<=!&J*S`q^+wYJk0ORbmD6-%w%bj4EZ09~=v zI!0G4wa(HNORbA^#ZqgDu2^b4M^`Mh-a=O_wYqf0QtMrG#Zv42bj4EZLv+Pb>!WnV zQtS8Wilx?zbj4EZZ|I7p)|csurPf9g11z<6&=pIqak^ruHAz=2wH}}=mRgU|6-%wB z=!&IQnXXuBy^gL}YQ2H3SZaMQU9r^qVY*_e_0x34QtJbB#Zv3n>58S+$LWft)*sLn zORc}4E0$XSKvyiat|OttQfmucvDCVau2^c_Lsu-dX6TBg)*M~2)H+F5EVZ7cE0$XH zy+Q(W>*8;YbY_gR?&wcWz)*`hV%&CzoGC)asnSgG(QY-vfhsRT2)(EYGdU4NK9 zZHxOq2qmZbAm~1^#{I7D8K~aaNq`dX>rx}TM32ia^ zex2LA@*H413riO?(S@rAjg|SJXJEqn8BiAu#uN4KU|YQ5qT->5rl{dM*#Z;kkV z-J0VkkDa0gZ`f8*eHWKh{R#XDd_DLRs_~HIAH{UrBz@ix+O}~gf6ElkSa*{7o=#4K z3x$I#Lh1*^{YHA?esx&lsvp7|0cjO{Gmus?-4i>>ZZsr;2a^dLZ#KX{Et8gV{fYg< z^u&HTD`H9j)O zw87Kq7KRtolYSv9(sLt_zBjR(gU`J6@8jpv6S|xgq4^OAeRwdT<4)RTe>XkR-=7uH zg%OBO9K_^*Q-|#he+R7=-=Ch=_hv=w?2tbyLW|%ogFl0%jtr zexN*lLwa(*Ju7neuOPVtgwzkGC-?1Hk$YeSa`&g`-2tQa1L;Zq`K(AiI0C6Dbg10E zL8JEL>52XAtcbmD1Y*;SS`a&k+`mXq?w@8w?)@W>o33vMjM?k9rdBMzk`=KJtQfJ= z{pZ@-(i3|NvSy-19a=GBXZjO6lb+bAtcZPZ1Y*;T+JVb~lj+GlkrlZQjX-X?Q9D3G zuB0c{%8J;z5r~bMY2AihHriK=#Wtc5k+a8uU4ws!j;v@sJOZr~y$Y1MIEc9al%BX>$cnflBM=uOkLY*?e4{So2nNou7&zuY zC*1q@dvpYHAMEW*pFYc|wd;#?s+$SNai0DZ|7CiLKc5xF$3~zy#?!{C zPfs1l%}njd4Y07SxgoW>v(I6fffyUjvy;@$%;b2SuE_`Wv@@~(HyhleM@7`YW zO6CCJx<5T_vsux0d<5EJ=FD;}=h7KAdjb2e&q4Iq{k!o@dQwkiMe1WCkQ(FBhplyU zfJRVDPo13=btgukZl;$>Nd?HU*X`hKn(t0e=9{x3^YIbLEc79>Kb!t|dJ5l}6@^cX zKw*rufm>65+I}THZ6C~vwv!{!7Snt7qH{SnlvSdzKXLyj zJ#k;iin!Aw5I5O7_hwgO&5Fo# z84+1Bog7Z!ADEsTV4-ZJCvqt(BA*U>4rJl-)$N{UvUrSHqhpv@KN!$6XXuH(E13#0Vw%^Z+wx_eAZNP%* z@6*%vH(Am4%m}o_DKq4Rn=3b*M*r^Hye+jdvk_S{QD&YUfyB5&m`q}GKp(y$J%Qs{ z5%`)B2#h)6W#`Iy+d@z$hbe{s1jnt+&6fsr>O<*iejqEFFN{EQu2-!=D4~6`Q~Ucf z?KA1=dnzmXUYjL-1DqsU>FIl2R`eCKp$}^5^wiz~^u0AbecziEeHTZdFUC_kGA0qS zHz&l9KbxNDpU#SC{*=>@r@>>0E;r4ER_;M1& literal 0 HcmV?d00001 diff --git a/en/doctrees/userinfo_endpoint.doctree b/en/doctrees/userinfo_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..d2b335c07afcd28ff2b0b5dcb4210e289974c71e GIT binary patch literal 76083 zcmeHw3zQsJd8S??X+{rAvMt-#jvEQvqp_;H=Pk)EG?o?OZ*Z1B3{`dXgr+VJLebwq!^q+B+UX_)~`K(wfRkV_%w~UP? zt=L$SD)rXeT6=!7^<=Bx=&gy%y4I)_rIxV@K8mtZF4d$;>rs5%O8)CgSVQC5UaORJWY5@8EQ`91mw4`}h)d?v#!{o|{+JhwXKT^| z^V55NseC}MiUf6IwI=CO?VQwV7#r&1B86zleezCutXu_}cHaolUR?iVwtz!Kt zl%xfvqSO_wqGxM*y=AN`D;24Atfw&#(AVjWdA+XGL7`Uh_;uI^dpBpZnJ4CJPh?OI z2M%Q9`ck>CFO$jKHDAl!(`VDS7GJ%gde~?4>vqHXWs(O7Ltst54phlEfczWr?`HhF z1^-?Qs@5-PwIz}AN{O}P-SSHs@~v`SzFqE@_Z(Y~2=+EYA~4p>*IJ?-4FwtS1X(NJ zCa(qRJ50F(vX>FEqAV593QAF{JdshB#6<}hv)LT}XTS8^q*f>@wPIN+EY>8cQeXj= z#M;@cer}P7IIygg>hgii(5S;k4-4z%(RNwg8_H@#Xf6_aove8n9C2iKr;kA=A)Byw zID|cI5wQL5RMXW80wTe<%6wv1BP^yAbM*|{N%V^u6U{5vbbtSV{Rx)Vg zma0ky>bEXc&nILB@rIrvn17Y3biCR&ym!;^=ohf=TV2XZ;BDpizHwj$MYdR0Qt$b2C{)+$o5 zE-XlpB1nx^5e5tStl8I~&Y<1M8XGmGR3v}MnAJ(~y>mJ&=)ke|_0CI4o0`_IqJML< zjhAX9IxK(Wv}B?e=@51&IqZ~fVX}fQ?uE2C8VhjrB8MZ7Kw)fvBt1+y zzIMC53XU&JkkaF8tY!0cOC(=1@pb%&aPXi@&GPbcR$N4_S=7#D6;vDry}uj=5n`iU z&n+lWH#uk`4ezzug@XB_TwYu(I76U<*r>}|4Py>TN42V!76OFzloth2^l;<6aA|nd z7MqpHkWEe|k{nZ~K!Z#j%1&rC$)zYstrX##6pAo39;Q<^Ia;VDc{s3MXDPI=0`0Sz z=r~;)6(*jida@2XN`#7EnEIr0%X0&OBUt>Jn4D3vV56b zwfS~NHJU7L{a1Sa>>+qGiFnBYa}&GL8&p-kwwl5 zYo%RYAu`pC#Z{PcvV41$Q;2Vuzm#>A*;sVcp31O)7QFKwpu zm}z+=%<^NB74YLybYFM1&zCn_#%_<~r(K6P=2i56rw*OEP?fq?PIJCk0v!2uxakv9 zhLoO%CBF_2`f_>dR)_m@XfxFx$yA#TpTHD7XwuF~m2MT4CyD?^J{?{}N+5_*@(|?H z;eIbJJ6-ByD;HAf+F1<1;HD_xQKr)uSeA zjls=~O~c+u8tM@=U|>P=d!pl6kI;++Vhc!&-5>A;HS1c)M2OuV@cPD}g>vih?NWIB zk|+%3+-6jWWRwF+*S)6OZFM6?AmAVN0))arcnG6Y=39;3XJs)dLeb^JN)@PdCrs-Pz4a|&; z@{&Oz+l3|{3EMx-YR!%o2D3x_YS^9Ra}suDGZ9fhP@HL0LAR!22ZbR|4RXHkw!Twl z@ZGINsZ6s{q_$8DcF4|fb}$`w5K$sK!@^)JI}}Ii>`Ua(9kY{C%^KmTStIc^3+${w&7w$cc1Aj8XEZI@8BMHNBf@B0%>q00 zJ!QQ^k=pExcFfLLTI>WDb{wtiXyp-MEP);Ro;o}3V$N8H?2M+RcMwsc?2IPp9f~7$ zb|_L?cE%&wkyuB@S|N5C;?Znstrm+az|c--VbIphqk_NXa(vkBx?slRWoe4HmlN0J zFr&43+Sdh7DQRfRNU-p|paeVlA^6Tl;cycxM{z#r44V9;qG*M6w?P!xD zuNHE?I^6hm5ckY;ocy>N=s+YVp}l5dJS`1`hywMiT|bW}XdsHiTeni_HB+Q^&AKy^ zop23=uqpD>#*kBQoSFrOd>lDG9O+?M^0Aak%`&64dAci-rzj~(N&k$uX`e7D^6DPv zyN4ma=1ED4T)lI5$LtKJ(+3*Q4s+D8VMvEPNDpI&zNg#=qKw(Hb5F$~^E;=12pxpLCwYvu;Wo zwrF#%s?*+#a5g>0M`7M)ypsvi5AX`IjazPc4}-tJbfV18|lbzdZ#v{kxr90W>? zOOZ$=a$SYBg4y#+;nh@*5+hR-z$&rp;nV!g*c6FY>+_W%bRv?_T}0@?#UO*;EscTN zw~oGffZD%ZWY>E|#TS!Zz=tC9^9IUKS*t8!|MoepD9)F$ksVv&A=>^j_QuP%>5_`8 zK+-K1%you>HB(+tDg`PYsx!N**nEHY$anzsPRf$tWC@CgWywPW^U<0eJb*9R431%MAjhuI2U*17EIv_xReP z=vCL&PZ!+;7rKNbZHQBm5ZO+RL&t@=$rC4!PaU3`IQYoa%=AisI zX6Jj`j)>h$q@6rC>(W)%G?+(Fr1}DDiP4snYT`m&pf`d>d*KA^a2E0-VS6;z;*$rv z_0vT?W{XOPso14I9SMZ(JyDL}7!uVW7mnH2Z9mng;KUO4*U*ta=Y$`f!pRSZ;p#QL z2TGP+X076OF(&T&OG?@XI}-_(oi-w{Y2#c+dGi#Y{d)z_os2~HFv;YMx%mujMKVTv zN6-jH|Cl(yNjd>`G#WLrg4qEo)Tu+ErP^neKbi**X6tR%eCs0To>fZDhF!uhi{xOQ zaX>4O)D}2%U8C7?emd-ZO!mn#^PJUOU7T0SblT9bysmZBzB8{hDvW!0aXomm0}n1m z+!ISlS+fb6jU;Fv5i~hCW=+=O{4VKvm?p_$W++#ain&w5?Bs+nnS~z#9fkbhpfH6| zLICzU3Ew>^?cXja=!1H-gZS;d&qd~aKjnRDZf4(D9vipvdC!D11EFh7_3CvP)DUZ> z+(>@kc&NJFtmv8(i3ddRy$j}cTLC8}WTQA0iGs|b6wr~K5e{j^{lj_Bq5_M&C~B-M zs*U-wwZ~o0!7H=Zqoc!~A1+jfX%<4q5HDoLZZkq@0*>{QS06h6dl#Lfdb`bljrxH| z)U$;8=xL8uq65{~cU?Ry)!b$ixz5oEac|?PYPuw-uuC8;OY?$QUZhj6@{%5q$hGRS zR~=bDU676*y7Yu?xDQ6cWz8y1thri;J5{r<;NUfnXZUpvu+=>UYyEVgI*ZYlmZ%N$ zbRJ{$><>87KnJ;Tf{lhYMg(yBMGmAFlEy(3DXrk^g% z`)xgY$?4i)ABhBOZo8&)Bf_DR+Q}{o)vT(eD)yTX<^xFk+>f4e^}ls-J97x!xZUU} zZ5!>&Bhj8F*_~l%XFDuk6?S2CYYYQxY0OBRYo@|qz#Gkc)x4$bedj{%sOH9J!AAdz zNc0M8bcI8#r4dXT=AM7abgW-@XkrOu+bcLo0-AuT2(3P!r=a} z5zvi_06S3b7|;ndU#xoMg1nh|Gx-a6b6ImL$R+2~ChgHk(uRq&*~1g#ql5e0+Cd4| z7K(yYBI6XS$AzCc{3CyXTCl->?e1mpymDdPX4m_K*zHWek|)!ijbgFU26uv4IrMJ- z^1SLa)9$9OLS&}NWEk~qhX=<3nMP05oKMg-fxcqU-Kf-S7w{LB9K$4T1A>rGk92un zxw%I_%QWD_B#9##oBK17Fqo;6fFvurF0k1TXpX91ik!)kxN7DLFXTfF2;CH@WWF#S z9>|}!mIeK}q!=ny-aXI<4ITIr}V{^OaRMCZoF4=QM(71J}B%q_m%UO76AwL!- zBsayS=w&RypUaqYUYdzhBx4D=wE3D3@YQQ^>heKwvf(9CcTT?S_5Bp-9&{DN^t5$_s(Xx9e$ey|cKk`mhr9UurDc^29 zkdt8{Emv#c1XV4!tkurK5*E#mDU!fu2QaG9!(OrXSf)d{*Jw8e#&c#~nGI3cs9ML& zhxU?bgvFXzmAwdm?-Y!awV}+wESZ?8*0eh4f~hjQy@tUuv5sHplT~#5kTO&$Y1RkF zsNs*Ya64?AF*`BY%v2?#)o|pFOqpr(b(lTtqcE271^72T?qxB}p2T8%r9=r^9w-?3 zZ_i#shq*fT?I8A`=z4}7bkEv_^ZyqpN3NdYkgHddK;5oBNq?C2RY$~NQb565+di2k z_G-oR&e$+(T4S+^bbdQ|cq_bf%J!Qn4@|c0?7;pgs#%{{g3ViI=GH5TpFb5^)F&R8 zJC)HYk^vLX zELs7Bto75F`XH>IB@{bZ%3kYzf%Mcb!<*CjvQvurAlPEyy^Paq#0>DxwsZswl`WvWb(!xAD(sDBrOj6XAwA=u%L1|I{ zHxf)$SSWkZ!m>IWEIKK&wv({=+qtcdj`D{xu5sHMbMq?M4)<3AitW7sizwP!tZ68{ z_j#HBVvM4TYoDklu*T}-44Sil*{#*)CtN$lPXwE*5Arlu&pOT3$1Gds38szJhe=vd z5>9&sYsKmmUYd5XUei}Ll)W}(W6^e{ zTc(tS#n&?7NKmk4N)nb2cO@*B&@w&8FD$=yS%f9DWpaeY+cKF&=Wk=Y9jf-0X@{eY z{Gp6%JuQ=~Z#!z5FqYbay#%m}T`tU*wc=TCk8+8IMRre4tD46=y!*rK>4HB0u;+k1 zsF5xlmFJHXl^Nye+yjqK4Nfal`qWar`pCr8*woVO#I#zfoH|reMclyQjJz*%s*VEs zR)S2?wIoIlPO6}5e$m)i7AuPlY_?~&mei{)W2>wz%4Phk7htiRE{36^{GW)`9ZX;A z=^;S-uA<2#Ni6G{mv%$&kRET++}?)4^we&9lA|v!aFl(Y9P_l8!+1 zA*HzPuQS|XsZ(KF!1W7&L7qW(pz{wC{OU_MLizajYh!N# z8|%&5(lS;HObh(8PYY0K{{tℜ>vh1;P0th4Kz5rsX{tPIxW|z!XlVU~Az5Eo?Be zuV#vf?&0Ozh_75(3w5f3_67G#ffRV zRpmphs-P>g5hrkDQCDNkNea*o0b>{oo(&@_5m4%+7{qWz)Z!aq9A(O+|rZp~wS7hZ#Ejdvcy>E$NQuoGT$ zd|)kH!{`*VJz{rPEt$9q61)rJyHjJoa&)HK5I^h-91_WprG1 zg(Gl9ETvzt7jmiY%QdaBD4QB%z+Cqo@Tv_BtHd5Zh}3Su2L@mQw<`I3Te^o9?5x#i zZ2HVttCy|@nMpb4F2mb4uo*w!w0z%y1I(_|>rJF?xa(QCcx_`z7$w29&8;476HSww zMp)i@9Tx4Z^)Oc5Py=1$Y>y{r2}R<_rkT4=WD~aCy|VcNde*iIeW-8Es#P?xo`Y?s z40iKpW{&k87xlVuLM!1Mrc^qRIW3j;W`>3`M;m4M7~Gc`+<#zj^uXv?=E#XteO7BF zP-}G{BUVXvnMwE@ZMN;}dlhaC-G%MqyAEV_&CVUfuD{8XyY|vcwB+>i;LzyU#C;RO z{d1#(L*|#WN{PPQKXpzU9u|%*jaTx+k34ql(9wm{4_3;D8zuep(7uP|mpyWRR1zPm zA3S!@42O1!!l515)%RpymZhE9g*`#^*6oyLF^_@ua~R4kSVwL|oV{RCAgc|Qw(YxC z_4r0bJ*U7@hwEDr>xg?0S|&d{w0~?r0n6;F%rAtzMZI?34iAo4esL)+Xhd z$KZHIZNTrbyHbdwJs*q^8u+vW>&1Qw&3lWs%SI1vM!C=y#5XHvph2FXZE^#+sX4g7 zufCJWz+3cKdzdd*gx`fvaT9CAgVllfS$GY0QG?S|{*fSz2dFKMP|r~QcB((aysB@* zAAe!_p4t|#qTj4yWl|1EOTzdd7+F~}_EVKAKFHJM|^&%$&l$XmI9~5{A4-&Yb=UzDLfSnt}Z@r#slpsXu)x zSpTNdC|_VE?31Iv{)+MBSK>ikZArtQGh}|RymO|`qFnNvDUkZ+Obg5&u{~pI(YxL7 zZtO7&JHE2{f9u5YRy@OV_8K;Wc4>8n`+eqQ_4NkqfjBYm8);g7*v zGER?Fouyd4UC<_i@^?YihbVk<-xF43RN}3@?`g6bFW!F1pt!UIfSyhar(|4dwfAWt zYU_JGioc+~H3gtFA$x0u&NwbyTtxu@#wyC-lku_2jDKF%gu z{s2xVthbLuGM*McR+!^a*CQ0CL~vrg(iJ&RJU|AVb0jo~%;05cMWzpzqaxoI%oSB+ zH&^lX%wKFUE2Q3x=sGI4_yl|vIo|6kG&snBIbRp;)mTUC0j*{BT6{q( zW2uFHIjb+av+#0>u{d>6Wm45iU4(TZ&nk>6woP`b3vI9ZJ6|L5u5Y}G$x!EUc-L9F zjUyx<7u)c4HJcH;sPaKTw%U~7qRNLjip*+N{tY9plhQqd(tR&SD63WZ1?DxeRdE(o zn7y;mM)b3Y$pUOGs+hLX97+8=JS4Rm7VO{R0N~eDFjk^|h9gvGu(vsjD%eysAKrQR zwu^hSwWh*6yMw3i@B@E=1A-qotd6M9bA<8%k5;CnLoF5kPL5cuB^9e~u7<+4$4S-# zWmgpoYbn_15h`UnH#t(a7Jgikug3>Y>AD79lUg)C$wiR7ogb?Gu~L1=?yAjU z4Vvz;Huu+H9}!GHz%+(fwr!HQA2MROh81Gk>{gaU9g=44gu=Burdg6cYMx-;gc+qM z%2M$xwz|QNN*%Aw{vS+9_+rO0>0Z0-3W?BMcG+(Hzmi=?;f!#Iguk3iDCfb{%lS%o zQ(sOz1iPun@G`WUN*^vqH+3nPE9$1Yxr$d&{$g7|$ommpQl<7)&-er^9k_|b+N~19 zez#C1b`i1K<4yQ+mDo=cCkX>9tBHIA2VOr*i(u(>9HA_hev)}jRAR*krl%gtoKlux z{7YP_W|oz@x$m})SN5h_>@h?yS#OY)Zc;TRs2NeuOv65KO(`BCQ#tqvdnuM>C+IZO zY60y?_AHv5UZKR?68I%n0++ZB<645D{5z{JW9_Rilw92E%ct-?a`nXw>|cFhwmDd; zBw+qE7ymb`w74%Eo%y>Ae|(42lEBZiy!*ZKuCMT0eR1}rx2S9K4fBkcMVo(B#Voq` zYVEHPGHS#JLr{3&`!z4srnMWN2+==aJs5qXZZd4JE-|ARj;wU z`@LQ!Rd3PeSM_Gm#aC&6Z8(eCa3Tan5O8O;;YzFeXQ>E-J^Od#WvHsB50^vLe%_gak_11lviTFny}t$pWzVW?U*o{* z7w#pn^xru`SuA~-c}-OHj|ZnGrr3=;G(BPW>uc5#d(1`@m8wDq;rnM#?#XsG2cgvU zjJ8~XeO8JAr;MDnsVkWUr%U{g97X3Zj|$4;hpCsxl~y*HEg{Ng8(xMg8~SiLl+92u zSEOv*T*d1Gf3Z~&atos4R5oTciccUFWrLA(sIr+R?k!~lKd!Pl$++iIHpe;e`dNAm zEKPBQvXsqX<~32-?6sB61G7`+d}X7eJl2qKtk;?RG;Ki7oOIMfXMvmwUFM+2kGTfS zO6r)ebcKE!@eu4iJdKy36`DR=jtc#Y!CX;=c5@Y9-~7d}e^Ws$C=Q*JJ@ic(vk5k8Ur7Q6ItsxcohkzMcf$78LsKD0;b43-{ z%~gE;@)z4Vg#5csi!D9@Uj>f$YVAKU7dNB5hV4H&AF_6;F5sol$T7_=a&0*oGPj(} zg_*@MTSa$=NydM`x0|3&MZ1@ZGGT(sUt;G`Vjk;0mt%9uNo4X;5Ak*zhj(*{702b+ zTyg=Bt>z)Px#U$GMP>~&ml<*KEr`E#UyahObA+;*g~yoJ#Ad z@hlBo;fU4RUSid(6t|Z|9o79VGGz~`d`ES^hYy_c^%oq#{3QP*Nd68-D2wE8F|Uc$ zDvbjWy;l+JE)PIljldR}!D9nX3v(??z^{WkI{>jAF~oK7V-7&vf}rUifOsuRlXz=C z0AaEjUpxGgL2<2507!MJGs(Ep{nk@J)Hd)ugqNZHR{C%``mGDWTv5N(%~dDGMmA9o zBDy%aY%8|-1T3xjO|$NIX`vwM@a=1fdut}iclh>ojC+6ejF`55iUY4-xL*gBp5zE+ z3HRg7Yoglg;_&VJ7|Kgr2~0eEi+d)6Yl4(;+?wDg@I7)(&G17uGoHAl;WG@G-z)EmVQPnOEqeWHhh|~NS2n+#z8-S=?hrh|iqM&yUTG!#BPvWN zA>ZMZ@8M;r5~dHALkVBCEs!fx!fviQDYl9j7>G@ndZQ>*3U~Ug?Tl zB_4tm`3zo$R%H5cIV$pNgSn!L?B*)Ip81RIB0@fj=#m86C!+BQ_$qR|S8Eo~9D_!C z4Vwi#5i+LhXco{-uHV>bFSfVTSK@q{WLu{5esS&eI~M+7%819t{%+$2?BK#71O&8h z6)Y9zP1BjUpG5r__*du1V6kyss7IJ=fj7#T=?yb-i5Gxwnyl4eVwPPCZJ#pmy>sgN zb4+Ue-HBlHYgz99b$BJocda2A$cxWf;#~*zObHhokVSr2H^p9KvNpwzPry3Ad7bTD zr)G{#P8TMp51pKunm$#SoSmJSox8`g8TqO}Ebh|Ge_^@xkDB*(k_aQiZ%yD!1k3EA zZ}sQYP4~+oEOj=R{vu+Ct7b8S=|4fx_`!73W6;X9CU9+CJ1bQj3t0t;T>@tf~&vWiVjYs4HbXyMUWRalHjBqpg3Cj*h!#?%6#V z(?;*2g!`jmaj@3H4;afaPXXY^CNm}60#rGRpMBQPMy-rrTk2Y|FfSI*(pSC3rZ0>g z3z}B1;1X!hmt(7qEo6%vc6bZtQB{|4>i}#}zy@8lP}G)|07*xDH=1v7B#ON$&>@5Z z)>m~MSw?bJ0O!T#nnaiT7Ru5&soXlY#^{s9vh%aY*e;z{z*SwWH+0)mkI_?-<{OKM zZz~yPBfE8oR}z=-rng=bixMG%t+uU7rP`=Ns-f86t7Y^w>I=fYmT{B+gDLI>85cE_ zr5ZSS+<0`FD50ByIz?VQ2>K)t3Mh6q*u=M>O0)dTflz$y0$)KkUJh;==zPk!+ zm+*THPE8wEW49M>+AfqNvfl@obQSKjvEICVf!I(=g(`HaavnooV=Hd$*08I~er2qo z8)deX8cWrJBXl5@y|Ax{r3kNLZ@_Ftr=oXXRduOR(hBF7NS3ytIfCu%f;S|S5VU3I z6rC(rQ(T3TqLZ;%0HG@)@M?oy8CX3rHUp228oKz zTiro0MOZ?KZ>ovQ&QD0_cB)hmoXR5Pu&gX8_11}Pw;NllQq^r=2@fnFRw3@lK2;3k zdfO^BUhCQF1zZqa$!fL5T+6tYe6kF{X90I-p@ixvk&SpS+?pQ&rCV`HZXkMk<3@j* z9euo2D;O$-U0zh8QeAEx+i2Vjv0N%RwbSV!6!az<_%qT?Yv#pld?Yk9#`X%`JxNIKWTB}>#ZBW;2z3~8i8OsF6Af@!Uh z3C?z83ZhkqQia%{=RsG#^~;Clz49aSl)Nm<@-y<&^0V@L|tt&dWE8HY#=Y@mwx#L`FZ(o)>$@$OZe43o!C+By``5)wbm7G5#=iB7`fSm7>vl=G<)gRN-R(je* z&W+?;PfkBMw~{kT&Ja2Gk#jFOGvpj6=N05UOpZd%0y*c%(aCw5oTtcn3psBh=iTJ| zJUJgG=a}pCjiF$@y>Oyg<(L?0kC5{&`tWn) z{Fr|JAL@)6y(IHwz}2kKFEr)9Y05upGLdgGac?qFZ!$4&G7)bw@oqBFZZffMGLddF zac(kEZZa`$G7)Yv@oh5EZ8EWKGLdaEacweDZ89-!G7)Vu@oX~DY%;NIGLdXDacnYC zY%(!yG7)St@oO^CYcjEGGLdUCaceSBYcerwG7)Ps@oF;BYBI5EGLdRBacVMAYBDiu zG7)Mr@o6&AX)>{CGLdOAacMG9X)-ZsG7)Jq@n|y9Xfm;AGLdL9acDA8XfiQqG7)I9 z;%~B|Z?a-5{Zn9#&$cp$PD_*3961>QYwaJR~Vne=xwDR-v*PyumO#UbN z2d36qO_iT%t*!LLwAPLE#I#mFJu$5{N>5B{-A7MMYt7IT(^{{fC#JO&dSY7Z96d3u z^)x*(t@RdqVp{9n^u)B*hv|uFtxwVu(^{XUC#JQ&L{Cg>eS@Bu*7`0zF|G9v^u)AQ z52*pBwRX@G(^|LC6VqCI>4|Br{q)4N)?s>LT5FD;nASQ&PfTkq(G$~JkJA&=T5q5y zrnOr1#I)A?>4|BrkJ1yudDHwAOd%iD|9BqbH`dR*}+ST5AhEF|G9? zdSY7Zc6wr3YlNPd);dT}OlwWk6VqBRrzfVh=(X*s+Lvps_8VPk9Idnm{ zdX5~reOdiwa+r3bjasI5V^2)GJwxy4x-9hta>)Fv`aC&w6j}W=IdoD@T_A_nr_^63 zhx8#ERyT|--ku^UMq>-^XJXxI>YbWzXiQ-HGy6#1H>N*yxzV#+n%Bxs=aYH8Ch*en z-Rq07*G`oM+Tn{IL%Uj?#*)_t6{J$9*73GyH`HptT^+vMQc02OKY+5c)!Pw_b=1JyQd4hhvQ}1G&DexjrBw80@iro z8?NT=a;<~cRJvRPT>!r`9yo(cYwYo8U(Ap8C(=TDM;B=KN20Asiwag#Sr;T8>z({q z_oan(Zx>jjTPQD9bU4X|2H(K&0e@~FY<%_skA`nx&R$niOD2w1#@orn>1Sd06*6ErG+)$1=hIv9D9j*Fgp~l zu|CZY_CKTrc5sEj4rd4B!G4t=>{rqPJG3%jg^?t%-{%MWztRFbykcMz#CX#+++C`T z@R~}OYGlR0j>e1et^8njr3H3$#lVimgT0p@>|JSr9a|x=qe*r4VSca=rUiDq3$S;E z^et$a2s7*U{glFJHc=nz{BWyj!QHola1)f&oA}|rF)g_JyMVioqjVE$?Jw~|{a{*9 z4|D;QqYovFC)L{D z^1(7c)OuP_@9P3;$P^8slNeBu5EJsqy34BUTlulRIW4RcU0@w(?@5V^N#H)h5ANTl z1@2H6;6n5fozuW3sdG4sfx|2roOjT%%O<`oKgSREx6*<;*#+Et+so3zCuPcw%A#lk z$GM((#Lx31{^PU|AMOHi$d((aGCa6n7#SQA5~kYzkssp^)53V93ygc)OSQBlVBceW z5njEMyQj1bUQ_8Q-QNYgJ?-#{VuErN_^}P7g>9+}Y$0uCsVwMpm`z#0LM#~oRN{;A z2tU+AX+b^O1=NtOeOO}`6M6(9Ke|_@h3;4v=tkOwlPXCrnjJ{2=Gk0{K7}AVZo&bvZ%dyoMj!6KP?4 zFfD8ed$`}pkL?|4VLP1`wuC|9ukvI2cv{#VN(=3tPfC>CgDF zeLF2|k92`8tPew*a0M8Gs>T=J>g%~%^&h7N@#S4W3_FC$Al4Gf@J4=s*TZWn-IiB$ z0WjoJ@ z<7wf0Wt#XBHc2S__!iQ_S4amRdZWXGV+r`4=EwI`TKLX%fiGmIbf8Y+LOj7#L%5?d zUTELV5BlfR0xhNkx>OSv>cRz_<+pVa79HzSNx+H3c+j8Z2mOh(K+kspIz$t}#Flhk z$j9UR54oCsTyj%}Llu-I}mP zXNe!8nj*w*W>_O3CUk_}zz^|tDMFOf6x4)iE2;HPqiseR$43aLAQQ4d0?J@OF_}^C+O+MT{l9Pl BCl3Gs literal 0 HcmV?d00001 diff --git a/en/entity_configuration.html b/en/entity_configuration.html new file mode 100644 index 00000000..2781869d --- /dev/null +++ b/en/entity_configuration.html @@ -0,0 +1,1498 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Entity Configuration + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Entity Configuration

    +

    An Entity Configuration (EC) is a Federation Metadata in Jose format, signed by an Entity +and regarding itself, published at the web endpoint .well-known/openid-federation.

    +
    +

    Entity Configuration Signature

    +

    All the signature-check operations regarding the ESs, ECs and TMs, +are carried out with the Federation public keys. For the supported algorithms refer to Section Cryptografic Algorithm

    +
    +

    Warning

    +

    The Federation keys SHOULD be different from the OIDC Core ones. The latter ones are contained in the OIDC Metadata. An EC contains both the Federation public keys and the OIDC Metadata.

    +
    +
    +
    +

    Entity Configuration - common claims

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    iss

    String. Identifier of the issuing Entity.

    spid-icon cieid-icon

    sub

    String. Identifier of the Entity to which it is referred.

    spid-icon cieid-icon

    iat

    UNIX Timestamp with the time of generation of the JWT, coded as NumericDate as indicated at RFC 7519

    spid-icon cieid-icon

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated at RFC 7519.

    spid-icon cieid-icon

    jwks

    A JSON Web Key Set (JWKS) RFC 7517 that represents the public part of the signing keys of the +Entity at issue. Each JWK in the JWK set MUST have a key ID (claim kid).

    spid-icon cieid-icon

    metadata

    JSON Object. Each key of the JSON Object represents an identifier of the type of +Metadata and each value MUST be a JSON Object that represents +the Metadata, according to the Metadata schema of that type.

    +

    An Entity Configuration MAY contain more Metadata statements, but only one for each type of +Metadata (<entity_type>).

    +

    The allowed types are the following:

    +
      +
    • openid_relying_party

    • +
    • openid_provider

    • +
    • federation_entity

    • +
    • oauth_authorization_server

    • +
    • oauth_resource

    • +
    +

    spid-icon cieid-icon

    +
    +

    Warning

    +

    Inside the EC the claims iss e sub contain the same value (URL).

    +
    +
    +
    +

    Entity Configuration Leaves and Intermediates

    +

    In addition to the previously defined claims, the EC of the Leaf and Intermediate Entities, contain also +the following claims:

    + +++++ + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    authority_hints

    Array if URLs. It contains a list of URLs of the superior Entities, such as TA or SA, +that MAY issue an ES related to this subject.

    spid-icon cieid-icon

    trust_marks

    A JSON Array containing the Trust Marks. See the Section Trust Mark. +Required for all the members except the Trust Anchor.

    spid-icon cieid-icon

    + +
    +
    +

    Entity Configuration Trust Anchor

    +

    The ECs of a TA, other than the common claims of all the other members, contains also the following ones:

    + +++++ + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    constraints

    JSON Object that describes the Trust Chain bounds and MUST contain the attribute max_path_length. +It represents the maximum number of SAs between a Leaf and the TA.

    +

    It MAY contain also allowed_leaf_entity_types, that restricts what types of Leaf Entities that MAY appear beneath the entity described in this Entity Statement

    +

    spid-icon cieid-icon

    trust_marks_issuers

    JSON Array that indicates which Federation authorities are considered trustworthy +for issuing specific TMs, assigned with their unique identifiers.

    spid-icon cieid-icon

    + +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/entity_statement.html b/en/entity_statement.html new file mode 100644 index 00000000..97f8a46f --- /dev/null +++ b/en/entity_statement.html @@ -0,0 +1,1723 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Entity Statements + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Entity Statements

    +

    The basic component for building a Trust Chain is the Entity Statement (ES), a signed JWT that +contains the Federation public keys of a subordinate Entity (subject) and further data used to control the +process of Trust Chain resolution.

    +

    An Entity publishes an ES related to a subordinate, at its Fetch Endpoint. +The superior Entity MAY define the Metadata policy for a subject and publishes the TMs that it has issued for it.

    +
    +

    Entity Statement Signature

    +

    The same considerations made for the ECs and reported in the section Firma della Entity Configuration, apply.

    +
    +
    +

    Entity Statement

    +

    The ES issued by the TA or by an Intermediate for its own direct subordinates, MUST contain the following attributes:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    iss

    See OIDC-FED Section 3.1 for further details.

    spid-icon cieid-icon

    sub

    See OIDC-FED Section 3.1 for further details.

    spid-icon cieid-icon

    iat

    See OIDC-FED Section 3.1 for further details.

    spid-icon cieid-icon

    exp

    See OIDC-FED Section 3.1 for further details.

    spid-icon cieid-icon

    jwks

    Federation JWKS of the sub entity. See OIDC-FED Section 3.1 for further details.

    spid-icon cieid-icon

    metadata_policy

    JSON Object that describes the Metadata policy. Each key of the JSON Object represents an +identifier of the type of Metadata and each value MUST be a JSON Object that represents the Metadata +policy according to that Metadata type. Please refer to the OIDC-FED specifications, Section-5.1, +for the implementation details.

    spid-icon cieid-icon

    trust_marks

    JSON Array containing the Trust Marks issued by itself for the subordinate subject.

    spid-icon cieid-icon

    constraints

    It MAY contain the allowed_leaf_entity_types, that restricts what types of metadata a subject is allowed to publish.

    spid-icon cieid-icon

    + +
    +
    +

    Metadata Policy

    +

    Trust Anchors and Intermediates (SAs) MUST publish a policy regarding their respective descendants in the Entity Statement referring to them. The Metadata Policy MUST cascade to all descendants.

    +
    +

    TA Metadata Policy for RP

    +

    The following claims MUST be considered in the metadata parameter of type openid_realying_party within the policy that the TA establishes for an RP.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Operations / Values

    Supported by

    jwks

    Operations: subset_of
    +Values: MUST contain the RP JWKS related to the OIDC Core operations.

    spid-icon cieid-icon

    grant_types

    Operations: subset_of
    +Values: MUST be authorization_code, refresh_token

    spid-icon cieid-icon

    id_token_signed_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    id_token_encrypted_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    cieid-icon

    id_token_encrypted_response_enc

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    cieid-icon

    userinfo_signed_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_encrypted_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_encrypted_response_enc

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    token_endpoint_auth_method

    Operations: one_of
    +Values: MUST be private_key_jwt

    spid-icon cieid-icon

    client_registration_types

    Operations: one_of
    +Values: MUST be automatic

    spid-icon cieid-icon

    +
    +
    +

    TA Metadata Policy for SA

    +

    The following claims MUST be considered in the metadata parameter of type openid_relying_party within the policy that the TA establishes for a SA. This policy MUST be cascaded to the metadata of the direct descendant (RP aggregate) of the SA.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Operations / Values

    Supported by

    grant_types

    Operations: subset_of
    +Values: MUST be authorization_code, refresh_token

    spid-icon cieid-icon

    id_token_signed_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    id_token_encrypted_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    cieid-icon

    id_token_encrypted_response_enc

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    cieid-icon

    userinfo_signed_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_encrypted_response_alg

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_encrypted_response_enc

    Operations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    token_endpoint_auth_method

    Operations: one_of
    +Values: MUST be private_key_jwt

    spid-icon cieid-icon

    client_registration_types

    Operations: one_of
    +Values: MUST be automatic

    spid-icon cieid-icon

    +
    +
    +

    SA Metadata Policy for RP

    +

    The following claims MUST be considered in the metadata parameter of type openid_relying_party within the policy that the SA establishes for an RP its direct descendant (Aggregate).

    + +++++ + + + + + + + + + + + + +

    Claim

    Operations / Values

    Supported by

    jwks

    Operations: subset_of
    +Values: MUST contain the RP JWKS related to the OIDC Core Operations

    spid-icon cieid-icon

    +
    +
    +

    TA Metadata Policy for OP

    +

    Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro metadata di tipo openid_provider all'interno della policy che il TA stabilisce per un RP suo discendente diretto.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Operarations / Values

    Supportato da

    jwks

    Operarations: subset_of
    +Values: DEVE contenere i JWKS del OP relativi alle Operarations di Core

    spid-icon cieid-icon

    revocation_endpoint_auth_methods_supported

    Operarations: one_of
    +Values: MUST be private_key_jwt

    spid-icon cieid-icon

    code_challenge_methods_supported

    Operarations: subset_of
    +Values: MUST be S256

    spid-icon cieid-icon

    scopes_supported

    Operarations: subset_of
    +Values: MUST contain openid, offline_access. CIE id MAY also contain profile, email.

    spid-icon cieid-icon

    response_types_supported

    Operarations: one_of
    +Values: MUST be code.

    spid-icon cieid-icon

    response_modes_supported

    Operarations: subset_of
    +Values: MUST be form_post, query.

    spid-icon cieid-icon

    grant_types_supported

    Operarations: subset_of
    +Values: MUST be refresh_token, authorization_code.

    spid-icon cieid-icon

    acr_values_supported

    Operarations: subset_of
    +Values: MUST be
    https://www.spid.gov.it/SpidL1,
    https://www.spid.gov.it/SpidL2,
    https://www.spid.gov.it/SpidL3.

    spid-icon cieid-icon

    subject_types_supported

    Operarations: one_of
    +Values: MUST be pairwise.

    spid-icon cieid-icon

    id_token_signing_alg_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    id_token_encryption_alg_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    id_token_encryption_enc_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_signing_alg_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_encryption_alg_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    userinfo_encryption_enc_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    token_endpoint_auth_methods_supported

    Operarations: one_of
    +Values: MUST be private_key_jwt

    spid-icon cieid-icon

    token_endpoint_auth_signing_alg_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    claims_parameter_supported

    Operarations: one_of
    +Values: MUST be true

    spid-icon cieid-icon

    request_parameter_supported

    Operarations: one_of
    +Values: MUST be true

    spid-icon cieid-icon

    authorization_response_iss_parameter_supported

    Operarations: one_of
    +Values: MUST be true

    spid-icon cieid-icon

    client_registration_types_supported

    Operarations: one_of
    +Values: MUST be automatic

    spid-icon cieid-icon

    request_authentication_methods_supported

    Operarations: one_of
    +Values: MUST be request_object

    spid-icon cieid-icon

    request_authentication_signing_alg_values_supported

    Operarations: subset_of
    +Values: MUST contain the algorithms defined in the Section Cryptographic Algorithms

    spid-icon cieid-icon

    + +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/errors_federation.html b/en/errors_federation.html new file mode 100644 index 00000000..2eebf173 --- /dev/null +++ b/en/errors_federation.html @@ -0,0 +1,1421 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Federation error management + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Federation error management

    +

    In case of errors during Federation operations, entities MUST give anomaly messages as following.

    + +++++ + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    error

    See Federation error codes

    spid-icon cieid-icon

    error_description

    Error description.

    spid-icon cieid-icon

    +
    +

    Federation error codes

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Erro

    Description

    HTTP Code

    Supported by

    temporarily_unavailable

    well-known or Federation endpoint is unreachable.

    302 Found/400 Bad Request

    spid-icon cieid-icon

    invalid_client

    The Trust Chain validation fails and the Client is not authorized.

    302 Found

    spid-icon cieid-icon

    unauthorized_client

    Applying the metadata policy results in a metadata not compliant or no valid Trust Mark for the requested profile is present within the configuration.

    302 Found

    spid-icon cieid-icon

    invalid_request

    The request is incomplete or does not comply with current specifications.

    400 Bad Request

    spid-icon cieid-icon

    not_found

    The required resource is not found.

    404 Not Found

    spid-icon cieid-icon

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/esempi.html b/en/esempi.html new file mode 100644 index 00000000..6d192a03 --- /dev/null +++ b/en/esempi.html @@ -0,0 +1,2250 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Examples + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Examples

    +

    This section gathers all the non-normative examples of the requests and responses to the Federation's endpoints, that are defined in this document.

    +

    All the responses of type jose have been decoded and represented with their headings, for the sake of reading.

    +
    +

    EN 1. Entity Configuration Request

    +
    GET /.well-known/openid-federation HTTP/1.1
    +Host: rp.example.it
    +
    +
    +
    +
    +

    EN 1.1. Entity Configuration Response Relying Party

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649590602,
    +    "iat": 1649417862,
    +    "iss": "https://rp.example.it/",
    +    "sub": "https://rp.example.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "n": "5s4qi …",
    +                "e": "AQAB",
    +                "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "openid_relying_party": {
    +            "application_type": "web",
    +            "client_id": "https://rp.example.it/",
    +            "client_registration_types": [
    +                "automatic"
    +            ],
    +            "jwks": {
    +                "keys": [
    +                    {
    +                        "kty": "RSA",
    +                        "use": "sig",
    +                        "n": "1Ta-sE …",
    +                        "e": "AQAB",
    +                        "kid": "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +                    }
    +                ]
    +            },
    +            "client_name": "Name of an example organization",
    +            "contacts": [
    +                "ops@rp.example.it"
    +            ],
    +            "grant_types": [
    +                "refresh_token",
    +                "authorization_code"
    +            ],
    +            "redirect_uris": [
    +                "https://rp.example.it/oidc/rp/callback/"
    +            ],
    +            "response_types": [
    +                "code"
    +            ],
    +            "subject_type": "pairwise"
    +        },
    +        "federation_entity": {
    +            "federation_resolve_endpoint": "https://rp.example.it/resolve/",
    +            "organization_name": "PA OIDC Service Provider",
    +            "homepage_uri": "https://rp.example.it",
    +            "policy_uri": "https://rp.example.it/policy",
    +            "logo_uri": "https://rp.example.it/static/logo.svg",
    +            "contacts": [
    +               "tech@example.it"
    +             ]
    +        }
    +    },
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.agid.gov.it/openid_relying_party/public/",
    +            "trust_mark": "eyJh …"
    +        }
    +    ],
    +    "authority_hints": [
    +        "https://registry.agid.gov.it/"
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 1.2. Entity Configuration Response Openid Provider

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649610249,
    +    "iat": 1649437449,
    +    "iss": "https://openid.provider.it/",
    +    "sub": "https://openid.provider.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "e": "AQAB",
    +                "n": "01_4a …",
    +                "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "openid_provider": {
    +            "authorization_endpoint": "https://openid.provider.it/authorization",
    +            "revocation_endpoint": "https://openid.provider.it/revocation/",
    +            "id_token_encryption_alg_values_supported": [
    +                "RSA-OAEP"
    +            ],
    +            "id_token_encryption_enc_values_supported": [
    +                "A128CBC-HS256"
    +            ],
    +            "token_endpoint": "https://openid.provider.it/token/",
    +            "userinfo_endpoint": "https://openid.provider.it/userinfo/",
    +            "introspection_endpoint": "https://openid.provider.it/introspection/",
    +            "claims_parameter_supported":true,
    +            "contacts": [
    +                "ops@https://idp.it"
    +            ],
    +            "client_registration_types_supported": [
    +                "automatic"
    +            ],
    +            "code_challenge_methods_supported": [
    +                "S256"
    +            ],
    +            "request_authentication_methods_supported": {
    +                "ar": [
    +                    "request_object"
    +                ]
    +            },
    +            "acr_values_supported": [
    +                "https://www.spid.gov.it/SpidL1",
    +                "https://www.spid.gov.it/SpidL2",
    +                "https://www.spid.gov.it/SpidL3"
    +            ],
    +            "claims_supported": [
    +                "https://attributes.spid.gov.it/spid_code",
    +                "given_name",
    +                "family_name",
    +                "place_of_birth",
    +                "birthdate",
    +                "gender",
    +                "https://attributes.spid.gov.it/company_name",
    +                "https://attributes.spid.gov.it/registered_office",
    +                "https://attributes.spid.gov.it/fiscal_number",
    +                "https://attributes.spid.gov.it/vat_number",
    +                "https://attributes.spid.gov.it/document_details",
    +                "phone_number",
    +                "email",
    +                "address",
    +                "https://attributes.spid.gov.it/eid_exp_date",
    +                "https://attributes.spid.gov.it/e_delivery_service"
    +            ],
    +            "grant_types_supported": [
    +                "authorization_code",
    +                "refresh_token"
    +            ],
    +            "id_token_signing_alg_values_supported": [
    +                "RS256",
    +                "ES256"
    +            ],
    +            "issuer": "https://openid.provider.it/",
    +            "jwks": {
    +                "keys": [
    +                    {
    +                        "kty": "RSA",
    +                        "use": "sig",
    +                        "n": "1Ta-sE …",
    +                        "e": "AQAB",
    +                        "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +                    }
    +                ]
    +            },
    +            "scopes_supported": [
    +                "openid",
    +                "offline_access"
    +            ],
    +            "logo_uri": "https://openid.provider.it/static/svg/spid-logo-c-lb.svg",
    +            "organization_name": "SPID OIDC identity provider",
    +            "op_policy_uri": "https://openid.provider.it/it/website/legal-information/",
    +            "request_parameter_supported":true,
    +            "request_uri_parameter_supported":true,
    +            "require_request_uri_registration":true,
    +            "response_types_supported": [
    +                "code"
    +            ],
    +            "subject_types_supported": [
    +                "pairwise",
    +                "public"
    +            ],
    +            "token_endpoint_auth_methods_supported": [
    +                "private_key_jwt"
    +            ],
    +            "token_endpoint_auth_signing_alg_values_supported": [
    +                "RS256",
    +                "RS384",
    +                "RS512",
    +                "ES256",
    +                "ES384",
    +                "ES512"
    +            ],
    +            "userinfo_encryption_alg_values_supported": [
    +                "RSA-OAEP",
    +                "RSA-OAEP-256"
    +            ],
    +            "userinfo_encryption_enc_values_supported": [
    +                "A128CBC-HS256",
    +                "A192CBC-HS384",
    +                "A256CBC-HS512",
    +                "A128GCM",
    +                "A192GCM",
    +                "A256GCM"
    +            ],
    +            "userinfo_signing_alg_values_supported": [
    +                "RS256",
    +                "RS384",
    +                "RS512",
    +                "ES256",
    +                "ES384",
    +                "ES512"
    +            ],
    +            "request_object_signing_alg_values_supported": [
    +                "RS256",
    +                "RS384",
    +                "RS512",
    +                "ES256",
    +                "ES384",
    +                "ES512"
    +            ]
    +        },
    +        "federation_entity": {
    +            "federation_resolve_endpoint": "https://openid.provider.it/resolve/",
    +            "organization_name": "SPID OIDC identity provider",
    +            "homepage_uri": "https://provider.it",
    +            "policy_uri": "https://provider.it/policy",
    +            "logo_uri": "https://provider.it/static/logo.svg",
    +            "contacts": [
    +               "tech@provider.it"
    +             ]
    +        }
    +    },
    +    "authority_hints": [
    +        "https://registry.agid.gov.it/"
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 1.3. Entity Configuration Response Intermediary

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "em3cmnZgHIYFsQ090N6B3Op7LAAqj8rghMhxGmJstqg",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649631824,
    +    "iat": 1649459024,
    +    "iss": "https://aggregatore.it/",
    +    "sub": "https://aggregatore.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "e": "AQAB",
    +                "n": "14aW …",
    +                "kid": "em3cmnZgHIYFsQ090N6B3Op7LAAqj8rghMhxGmJstqg"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "federation_entity": {
    +            "contacts": [
    +                "soggetto@aggregatore.it"
    +            ],
    +            "federation_fetch_endpoint": "https://aggregatore.it/fetch/",
    +            "federation_resolve_endpoint": "https://aggregatore.it/resolve/",
    +            "federation_list_endpoint": "https://aggregatore.it/list/",
    +            "homepage_uri": "https://soggetto.aggregatore.it",
    +            "name": "Soggetto Aggregatore di esempio"
    +        },
    +        "trust_mark_issuer": {
    +            "federation_status_endpoint": "https://aggregatore.it/trust_mark_status/",
    +
    +        }
    +    },
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.gov.it/intermediate/private/full/",
    +            "trust_mark": "eyJh …"
    +        }
    +    ],
    +    "authority_hints": [
    +        "https://registry.agid.gov.it/"
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 1.4. Entity Configuration Response Trust Anchor

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649375259,
    +    "iat": 1649373279,
    +    "iss": "https://registry.agid.gov.it/",
    +    "sub": "https://registry.agid.gov.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "n": "3i5vV-_ …",
    +                "e": "AQAB",
    +                "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "federation_entity": {
    +            "organization_name": "example TA"
    +            "contacts":[
    +                "spid.tech@agid.gov.it"
    +            ],
    +            "policy_uri": "https://registry.agid.gov.it/policy",
    +            "homepage_uri": "https://registry.agid.gov.it/",
    +            "logo_uri":"https://registry.agid.gov.it/static/svg/logo.svg",
    +            "federation_fetch_endpoint": "https://registry.agid.gov.it/fetch/",
    +            "federation_resolve_endpoint": "https://registry.agid.gov.it/resolve/",
    +            "federation_list_endpoint": "https://registry.agid.gov.it/list/",
    +            "federation_trust_mark_status_endpoint": "https://registry.agid.gov.it/trust_mark_status/"
    +        }
    +    },
    +    "trust_marks_issuers": {
    +        "https://registry.agid.gov.it/openid_relying_party/public/": [
    +            "https://registry.spid.agid.gov.it/",
    +            "https://public.intermediary.spid.it/"
    +        ],
    +        "https://registry.agid.gov.it/openid_relying_party/private/": [
    +            "https://registry.spid.agid.gov.it/",
    +            "https://private.other.intermediary.it/"
    +        ]
    +    },
    +    "constraints": {
    +        "max_path_length": 1
    +    }
    +}
    +
    +
    +
    +
    +

    EN 1.5. Trust Mark issued by TA to a RP

    +
    {
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +            "iss": "https://registry.interno.gov.it/",
    +            "trust_mark": "$JWT"
    +        }
    +    ]
    +}
    +
    +
    +

    Where the $JWT payload is:

    +
    {
    +    "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +    "iss": "https://sa.esempio.it/",
    +    "sub": "https://rp.esempio.it/",
    +    "iat": 1579621160,
    +    "organization_type": "public",
    +    "id_code": {
    +       "ipa_code": "123456",
    +       "aoo_code": "Uff_protocollo"
    +    }
    +    "email": "email_or_pec@rp.it",
    +    "organization_name#it": "Denominazione del RP",
    +    "ref": "https://documentazione_di_riferimento.it/"
    +}
    +
    +
    +
    +
    +

    EN 1.6. Trust Mark issued by TA to a SA

    +
    {
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.interno.gov.it/intermediate/private/full/",
    +            "iss": "https://registry.interno.gov.it/",
    +            "trust_mark": "$JWT"
    +        }
    +    ]
    +}
    +
    +
    +

    Where the $JWT payload is:

    +
    {
    +    "id": "https://registry.interno.gov.it/intermediate/private/full/",
    +    "iss": "https://registry.interno.gov.it/",
    +    "sub": "https://sa.esempio.it/",
    +    "iat": 1579621160,
    +    "organization_type": "private",
    +    "id_code": {
    +       "fiscal_number": "1234567890"
    +    }
    +    "email": "email_or_pec@intermediate.it",
    +    "organization_name#it": "Denominazione del SA",
    +    "sa_profile": "full",
    +    "ref": "https://documentazione_di_riferimento.it/"
    +}
    +
    +
    +
    +
    +

    EN 1.7. Trust Mark issued by SA to a RP

    +
    {
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +            "iss": "https://sa.esempio.it",
    +            "trust_mark": "$JWT"
    +        }
    +    ]
    +}
    +
    +
    +

    Where the $JWT payload is:

    +
    {
    +    "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +    "iss": "https://sa.esempio.it/",
    +    "sub": "https://rp.esempio.it/",
    +    "iat": 1579621160,
    +    "organization_type": "public",
    +    "id_code": {
    +       "ipa_code": "987654",
    +    }
    +    "email": "email_or_pec@rp.it",
    +    "organization_name#it": "Denominazione del RP",
    +    "ref": "https://documentazione_di_riferimento.it/"
    +}
    +
    +
    +
    +
    +

    EN 2. Entity Statement Request

    +
    GET /fetch?sub=https://rp.example.it/
    +HTTP/1.1
    +Host: registry.agid.gov.it
    +
    +
    +
    +
    +

    EN 2.1 Entity Statement Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649623546,
    +    "iat": 1649450746,
    +    "iss": "https://registry.agid.gov.it/",
    +    "sub": "https://rp.example.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "n": "5s4qi …",
    +                "e": "AQAB",
    +                "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }
    +        ]
    +    },
    +    "metadata_policy": {
    +        "openid_relying_party": {
    +            "scope": {
    +                "superset_of": [
    +                    "openid"
    +                ],
    +                "subset_of": [
    +                    "openid",
    +                    "offline_access"
    +                ]
    +            },
    +            "contacts": {
    +                "add": [
    +                    "tech@example.it"
    +                ]
    +            }
    +        }
    +    },
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.agid.gov.it/openid_relying_party/public/",
    +            "trust_mark": "eyJhb …"
    +        }
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 3. Entity List Request

    +
    GET /list?entity_type=openid_provider
    +HTTP/1.1
    +Host: registry.agid.gov.it
    +
    +
    +
    +
    +

    EN 3.1. Entity List Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/json
    +
    +["https://openid-provider.it/", "https://spid.provider.it", … ]
    +
    +
    +
    +
    +

    EN 4. Resolve Entity Statement Endpoint Request

    +
    GET /resolve/?sub=https://openid.provider.it/&anchor=https://registry.agid.gov.it/
    +HTTP/1.1
    +Host: registry.agid.gov.it
    +
    +
    +
    +
    +

    EN 4.1. Resolve Entity Statement Endpoint Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "iss": "https://registry.agid.gov.it/",
    +    "sub": "https://rp.example.it/",
    +    "iat": 1649355587,
    +    "exp": 1649410329,
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.agid.gov.it/openid_relying_party/public/",
    +            "trust_mark": "eyJh …"
    +        }
    +    ],
    +    "metadata": {
    +        "openid_relying_party": {
    +            "application_type": "web",
    +            "client_id": "https://rp.example.it/",
    +            "client_registration_types": [
    +                "automatic"
    +            ],
    +            "jwks": {
    +                "keys": [
    +                    {
    +                        "kty": "RSA",
    +                        "use": "sig",
    +                        "n": "…",
    +                        "e": "AQAB",
    +                        "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +                    }
    +                ]
    +            },
    +            "client_name": "Name of an example organization",
    +            "contacts": [
    +                "ops@rp.example.it"
    +            ],
    +            "grant_types": [
    +                "refresh_token",
    +                "authorization_code"
    +            ],
    +            "redirect_uris": [
    +                "https://rp.example.it/oidc/rp/callback/"
    +            ],
    +            "response_types": [
    +                "code"
    +            ],
    +            "subject_type": "pairwise"
    +        }
    +    },
    +    "trust_chain": [
    +        "eyJhbGciOiJSUzI1NiIsImtpZCI6Ims1NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
    +        "eyJhbGciOiJSUzI1NiIsImtpZCI6IkJYdmZybG5oQU11SFIwN2FqVW1BY0JS ...",
    +        "eyJhbGciOiJSUzI1NiIsImtpZCI6IkJYdmZybG5oQU11SFIwN2FqVW1BY0JS ..."
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 5. Trust Mark Status Request

    +
    POST /trust_mark_status HTTP/1.1
    +Host: registry.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +id=https%3A%2F%2registry.agid.gov.it%2Fopenid_relying_party%2Fpublic%2F
    +&sub=https%3A%2F%2rp.example.it%2F
    +
    +
    +
    +
    +

    EN 5.1. Trust Mark Status Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/json
    +
    +{"active": true}
    +
    +
    +
    +
    +

    EN 6. Authorization Request

    +

    Example (HTTP request):

    +
    GET /auth?client_id=https://rp.spid.agid.gov.it&
    +response_type=code&scope=openid& code_challenge=qWJlMe0xdbXrKxTm72EpH659bUxAxw80&
    +code_challenge_method=S256&
    +request=eyJhbGciOiJSUzI1NiIsImtpZCI6IjJIbm9GUzNZbkM5dGppQ2FpdmhXTFZVSj
    +NBeHdHR3pfOTh1UkZhcU1FRXMifQ.eyJpc3MiOiJodHRwczovL3RydXN0LWFuY2hvci5va
    +WRjLWZlZGVyYXRpb24ub25saW5lL29pZGMvcnAvIiwic2NvcGUiOiJvcGVuaWQiLCJyZWR
    +pcmVjdF91cmkiOiJodHRwczovL3RydXN0LWFuY2hvci5vaWRjLWZlZGVyYXRpb24ub25sa
    +W5lL29pZGMvcnAvY2FsbGJhY2siLCJyZXNwb25zZV90eXBlIjoiY29kZSIsIm5vbmNlIjo
    +iOXhnTWc4NHpsTG12OFJvRjg1RjJ5WExmdDQ1U3ZGUXciLCJzdGF0ZSI6InplaTJ6Mnh4e
    +jZYQUFZUHM0eUlxRzZ2aWpQNDJyTVpHIiwiY2xpZW50X2lkIjoiaHR0cHM6Ly90cnVzdC1
    +hbmNob3Iub2lkYy1mZWRlcmF0aW9uLm9ubGluZS9vaWRjL3JwLyIsImVuZHBvaW50Ijoia
    +HR0cHM6Ly90cnVzdC1hbmNob3Iub2lkYy1mZWRlcmF0aW9uLm9ubGluZS9vaWRjL29wL2F
    +1dGhvcml6YXRpb24iLCJhY3JfdmFsdWVzIjoiaHR0cHM6Ly93d3cuc3BpZC5nb3YuaXQvU
    +3BpZEwyIiwiaWF0IjoxNjg2NTc2OTI2LCJleHAiOjE2ODY1NzY5ODYsImp0aSI6IjAxMjZ
    +lZWRlLWUwZjMtNDE3My05NzE3LTQ0NzUyMmI2NmI2NyIsImF1ZCI6WyJodHRwczovL3Ryd
    +XN0LWFuY2hvci5vaWRjLWZlZGVyYXRpb24ub25saW5lL29pZGMvb3AvIiwiaHR0cHM6Ly9
    +0cnVzdC1hbmNob3Iub2lkYy1mZWRlcmF0aW9uLm9ubGluZS9vaWRjL29wL2F1dGhvcml6Y
    +XRpb24iXSwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImdpdmVuX25hbWUiOnsiZXNzZW50aWF
    +sIjp0cnVlfSwiZW1haWwiOnsiZXNzZW50aWFsIjp0cnVlfX0sInVzZXJpbmZvIjp7Imdpd
    +mVuX25hbWUiOm51bGwsImZhbWlseV9uYW1lIjpudWxsLCJlbWFpbCI6bnVsbCwiaHR0cHM
    +6Ly9hdHRyaWJ1dGVzLnNwaWQuZ292Lml0L2Zpc2NhbF9udW1iZXIiOm51bGx9fSwicHJvb
    +XB0IjoiY29uc2VudCBsb2dpbiIsImNvZGVfY2hhbGxlbmdlIjoidllobWRZcUNtMW1tZTJ
    +HcUZkRFdweHlvdEFPc3dlX0RFV0lNYUlUcHlOTSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZ
    +CI6IlMyNTYifQ.r1ei1Wep3p---8XFXEwptev-tlyzNBPnOiYk5Z11OY7cvHuRhExmMFmN
    +vyztwjQZRB92LsDMEaOs3bTfj_19S_L28o8MAMmjD5BO-obE8b_8rMNY4uVCAyNwzC6NVC
    +XnGQymH1UJWHvWGGUF_xO-8JVbWhV7cGJiwCrfaX3H-ZPyFQInHJh3NQ9uN2vk-FZvKl1I
    +urWVC4kUpe4FZKHX-2FjRe5kBKwPCw2eCMJgY-eSG0zEzukyHz5l3oUPQdk-olg3gowbNm
    +AB6nkURsiJqxu1clrEgnDIeM4yN0m-sEGXLehS40Iqds75e8IMfYBYqCQ2LgU9PwF5gr7e
    +iSQD8A
    +
    +Host: https://op.spid.agid.gov.it
    +HTTP/1.1
    +
    +
    +

    Example of JWT payload:

    +
    {
    +"alg": "RS256",
    +"kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +}
    +.
    +{
    +    "client_id": "https://rp.spid.agid.gov.it",
    +    "response_type": "code",
    +    "scope": "openid",
    +    "code_challenge": "qWJlMe0xdbXrKxTm72EpH659bUxAxw80",
    +    "code_challenge_method": "S256",
    +    "nonce": "MBzGqyf9QytD28eupyWhSqMj78WNqpc2",
    +    "prompt": "login",
    +    "redirect_uri": "https://rp.spid.agid.gov.it/callback1",
    +    "acr_values": {
    +      "https://www.spid.gov.it/SpidL1":null,
    +      "https://www.spid.gov.it/SpidL2":null
    +    },
    +    "claims": {
    +      "userinfo": {
    +          "given_name":null,
    +          "family_name":null
    +      }
    +    },
    +    "state": "fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd"
    +}
    +
    +
    +
    +
    +

    EN 7. Metadata Policy

    +

    The following example shows a Metadata policy in the Entity Statement provided by a TA and related to an RP

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "jwks": {
    +          "keys": [{
    +            "subset_of": [{
    +                "kty": "RSA",
    +                "use": "sig",
    +                "n": "…",
    +                "e": "AQAB",
    +                "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }]
    +          }]
    +        },
    +        "grant_types": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        },
    +        "id_token_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "id_token_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "id_token_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "userinfo_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "userinfo_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "userinfo_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "token_endpoint_auth_method": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "client_registration_types": {
    +            "one_of": ["automatic"]
    +        }
    +    }
    +}
    +
    +
    +

    The following example shows a Metadata policy in the Entity Statement provided by a TA and related to an SA

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "grant_types": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        }
    +        "id_token_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "id_token_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "id_token_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "userinfo_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "userinfo_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "userinfo_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "token_endpoint_auth_method": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "client_registration_types": {
    +            "one_of": ["automatic"]
    +        }
    +    }
    +}
    +
    +
    +

    The following example shows a Metadata policy in the Entity Statement provided by a SA and related to an RP

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "jwks": {
    +            "subset_of": [{
    +                "kty": "RSA",
    +                "use": "sig",
    +                "n": "…",
    +                "e": "AQAB",
    +                "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }]
    +        }
    +    }
    +}
    +
    +
    +

    The following example shows a Metadata policy in the Entity Statement provided by a TA and related to an OP.

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "jwks": {
    +            "subset_of": [{
    +                "kty": "RSA",
    +                "use": "sig",
    +                "n": "…",
    +                "e": "AQAB",
    +                "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }]
    +        },
    +        "revocation_endpoint_auth_methods_supported": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "code_challenge_methods_supported": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        },
    +        "scopes_supported": {
    +            "subset_of": ["openid", "offline_access", "profile", "email"]
    +        },
    +        "response_types_supported": {
    +            "one_of": ["code"]
    +        },
    +        "response_modes_supported": {
    +            "subset_of": ["form_post", "query"]
    +        },
    +        "grant_types_supported": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        },
    +        "acr_values_supported": {
    +            "subset_of": ["https://www.spid.gov.it/SpidL1", "https://www.spid.gov.it/SpidL2", "https://www.spid.gov.it/SpidL3"]
    +        },
    +        "subject_types_supported": {
    +            "one_of": ["pairwise"]
    +        },
    +        "id_token_signing_alg_values_supported": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "id_token_encryption_alg_values_supported": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "id_token_encryption_enc_values_supported": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "userinfo_signing_alg_values_supported": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "userinfo_encryption_alg_values_supported": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "userinfo_encryption_enc_values_supported": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "token_endpoint_auth_methods_supported": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "token_endpoint_auth_signing_alg_values_supported": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "claims_parameter_supported": {
    +            "one_of": ["true"]
    +        },
    +        "request_parameter_supported": {
    +            "one_of": ["true"]
    +        },
    +        "authorization_response_iss_parameter_supported": {
    +            "one_of": ["true"]
    +        },
    +        "client_registration_types_supported": {
    +            "one_of": ["automatic"]
    +        },
    +        "request_authentication_methods_supported": {
    +            "one_of": ["request_object"]
    +        },
    +        "request_authentication_signing_alg_values_supported": {
    +            "subset_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        }
    +    }
    +}
    +
    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/federation_endpoint.html b/en/federation_endpoint.html new file mode 100644 index 00000000..ea240048 --- /dev/null +++ b/en/federation_endpoint.html @@ -0,0 +1,1380 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Federation Endpoints + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Federation Endpoints

    +

    All the Entities MUST contain the following endpoints:

    +
    +
      +
    • /.well-known/openid-federation: gives the Entity Configuration (for +more details, see OIDC-FED Section 6)

    • +
    • resolve Entity statement endpoint: gives the final Metadata, the Trust Chain and the Trust Marks +regarding another subject. For more details, see OIDC-FED Section 7.2).

    • +
    +
    +
    +

    Warning

    +
      +
    • the resolve endpoint MUST NOT return TMs which are not valid at the time of the request;

    • +
    • the resolve endpoint MUST return the serialized Trust Chain for the subject.

    • +
    +
    +

    In addition to the Federation endpoints reported before, the Entities of type TA or SA MUST provide the following endpoints:

    +
    +
      +
    • fetch Entity statement endpoint: returns the ESs regarding a direct subordinate subject. +For obtaining the ES of an Entity, at least its Entity identifier is needed. (For more details, see OIDC-FED Section 7.1).

    • +
    • trust mark status endpoint: allows an Entity to test if a TM is still active or not. The request MUST +be sent to the subject that has released that TM. (For more details, see OIDC-FED Section 7.4).

    • +
    • Entity listing endpoint: returns the list of the subordinate Entities registered by the TA or an SA. +(For more details, see OIDC-FED Section 7.3).

    • +
    +
    +

    An Entity of type AA, in addition to the common Federation endpoints like all the Entities, MUST also include the trust mark status endpoint for allowing the dynamic validation of the TMs, released by the AA.

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/flusso_autenticazione.html b/en/flusso_autenticazione.html new file mode 100644 index 00000000..9ef9feb9 --- /dev/null +++ b/en/flusso_autenticazione.html @@ -0,0 +1,1375 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Authentication Flow + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Authentication Flow

    +

    The authentication schemas "Entra con SPID" and "Entra con CIE" implement the OpenID Connect Authorization Code Flow with the PKCE (Proof Key for Code Exchange, RFC 7636). +This flow returns an Authorization Code that can be used to get an ID Token, an Access Token +and possibly a Refresh Token too. +The Authorization Code Flow gets the Authorization Code from the Authorization Endpoint of the OpenID Provider and all the tokens are returned by the Token Endpoint.

    +_images/flusso.svg +

    In the following, the descriptions of the flow steps, with the numbers indicated in the picture.

    +
    +
      +
    1. The User, in the access page of the Relying Party (RP):

      +
        +
      • Clicks on the button "Enter with SPID" or "Enter with CIE";

      • +
      • In the SPID case, choses the authentication OP.

      • +
      +
    2. +
    3. The RP prepares an Authorization Request and sends it to the Authorization Endpoint of the OP.

    4. +
    5. The OP authenticates the user and received the user's consent to release his attributes to the RP.

    6. +
    7. The OP redirects the user to the URL contained in the parameter redirect_uri specified by the RP, passing an Authorization Code in the Authorization Response.

    8. +
    9. The RP sends the Authorization Code received at the OP Token Endpoint.

    10. +
    11. The OP Token Endpoint releases an ID Token, an Access Token and, if expected, a Refresh Token.

    12. +
    13. The RP receives and validates the Access Token and the ID Token. Then requests the user's attributes to the OP UserInfo Endpoint and uses, for the authentication, the Access Token contained in the HTTP Authorization header.

    14. +
    15. The OP UserInfo Endpoint checks the Access Token validity and releases the required attributes to the RP.

    16. +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/genindex.html b/en/genindex.html new file mode 100644 index 00000000..94ee1b1e --- /dev/null +++ b/en/genindex.html @@ -0,0 +1,1423 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Index + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + + + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/index.html b/en/index.html new file mode 100644 index 00000000..956f1bbc --- /dev/null +++ b/en/index.html @@ -0,0 +1,1525 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | SPID/CIE OpenID Connect + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + +
    +

    SPID/CIE OpenID Connect

    +

    SPID and CIE id are the Italian Systems of Public Digital Identity. They adopt the standards OpenID Connect Core, International Government Assurance Profile (iGov) for OpenID Connect 1.0 and OpenID Connect Federation 1.0.

    +

    Thanks to the digital identity the public and private services provides the keys to access the online services through unique access credentials.

    +

    This documentation contains the consolidated technical specifications, compliant to the national guidelines, to improve the experience of integration in the OIDC SPID and CIE id Federations, for the public and private Service Providers (RP), Identity Providers (OP) and Intermediate Entities (SA).

    +

    In this documentation you can find:

    +
    +
      +
    • Practical examples of Metadata, OpenID Connect requests and responses.

    • +
    • How to perform and automatic registration of the RPs to the OpenID Providers.

    • +
    • How an OpenID Provider recognizes and dynamically registers an RP.

    • +
    • How to use the endpoints of the Federation APIs.

    • +
    • How to authenticate a user to SPID and CIE id.

    • +
    +
    +
    +

    Index of content

    +
    + +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/introspection_endpoint.html b/en/introspection_endpoint.html new file mode 100644 index 00000000..fae57087 --- /dev/null +++ b/en/introspection_endpoint.html @@ -0,0 +1,1478 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Introspection Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Introspection Endpoint

    +

    The Introspection Endpoint exposed by the OP, allows the RPs to obtain information +about a token in their possession, as for example its validity.

    + +
    +

    Request

    +

    The request to the Introspection Endpoint contains the token, +together with a Client Assertion that allows authenticating the RP that makes the request.

    +

    Example:

    +
    POST /introspection HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88…
    +&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +client_id=https%3A%2F%2Frp.spid.agid.gov.it&
    +token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT
    +QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8
    +iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4
    +MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA
    +RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw
    +RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9
    +h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w…
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    client_assertion

    JWT signed with the Relying Party's private key, containing the same parameters as documented +for the requests to the Token Endpoint. The OP must test the validity of all the fields that +are present in the JWT, plus the validity of its signature, +with respect to the parameter client_id.

    spid-icon cieid-icon

    client_assertion_type

    String. Allowed values: urn:ietf:params:oauth:clientassertion-type:jwt-bearer

    spid-icon cieid-icon

    client_id

    URI that unquely identifies the RP. The OP must check that the client_id is known inside the +Federation.

    spid-icon cieid-icon

    token

    The token about which the RP wants to obtain information.

    spid-icon cieid-icon

    +
    +
    +

    Response

    +

    The Introspection Endpoint responds with a JSON Object defined as follows.

    +

    Example:

    +
    {
    +    "active":true
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    active

    Boolean value that indicates the token validity. If the token is expired, it has been revoked or it +has never been issued for the calling client_id, the Introspection Endpoint must return false.

    spid-icon cieid-icon

    scope

    List of scopes required in the Authorization Request.

    spid-icon

    exp

    Token expiration.

    spid-icon

    sub

    Subject identifier. The same released in the ID Token. The RP MUST verify that the value is the same contained in the ID Token.

    spid-icon

    client_id

    URI of the RP registered in the federation. The RP MUST verify that the value is the same of the own client_id.

    spid-icon

    iss

    OP identified registered in the federation in Uniform Resource Locator (URL) format. The RP MUST verify that the value is the same of the OP queried.

    spid-icon

    aud

    RP client ID. The RP MUST verify that the value is the same of the own client ID.

    spid-icon

    +
    +
    +

    Error Codes

    +

    As defined for Token endpoint.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/la_federazione_delle_identita.html b/en/la_federazione_delle_identita.html new file mode 100644 index 00000000..a87975d5 --- /dev/null +++ b/en/la_federazione_delle_identita.html @@ -0,0 +1,1410 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | The Italian eID Federations + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    The Italian eID Federations

    +

    A Digital Identity Federation is an infrastructure inside which many organizations, with different domains, +participate in the same regulatory framework for building a mechanism of trust, both administrative, by +stipulating conventions and getting accreditation by one or more authorities and technological by +adopting standards of interoperability.

    +

    This configuration establishes the levels of assurance and security that are appropriate for the +citizens in order to authenticate on a web service (Service Provider) using their own digital identity, released +by another web service (Identity Provider).

    +

    The participants (RP or OP) who are recognized inside the same Federation, obtain Metadata from each +other. The Metadata contains the public keys for the operations of digital signature and encryption, +and the information needed for the data interchange.

    +

    The Metadata are certified by a trusted party who is AgID in the SPID Federation and the Ministry of Interior in the CIE Federation. They both correspond to the Federation Authorities.

    +

    Both SPID and CIE id implement OpenID Connect Federation 1.0 and extend some functionalities, achieving +a solid implementation and producing the good practices for its adoption. For more details about the +standard please refer to the official specifications OIDC-FED and the section Differences with OIDC Federation 1.0.

    +
    +

    OpenID Connect Federation

    +

    The OIDC Federation produces an infrastructure of trust that is:

    +
    +
      +
    • Dynamic. The trust may be dynamically established during the first authentication request. +The Federation Authorities expose an endpoint that supplies signed statements about the subordinate +Entities. These statements contain the public keys of the subordinate Entities and the Metadata policy. +The Federation Authorities can disable an Entity in the Federation at every moment, simply by +stopping supplying statements about it.

    • +
    • Scalable. It reduces significantly the onboarding costs, according to the delegation principle, with +the institution of Intermediate Entities (SA).

    • +
    • Transparent. Any Entity involved in the Federation can always build the trust towards an Entity +securely. Furthermore, the federation composition, in all its parts, becomes navigable in real time +through the Federation API.

    • +
    +
    +_images/spid_cie_oidc_federation_model.svg +

    At the base of the trees there are the Federation Authorities of SPID and CIE id and, going up, the OPs that have no Intermediates, the RPs and the +Intermediates that, in turn, aggregate other RPs.

    +
    +
    +

    Configuration of the Federation

    +

    The configuration of the Federation is published by the Trust Anchor inside its Entity Configuration, available at a well known web path and corresponding to a +.well-known/openid-federation.

    +

    All the members MUST obtain the Federation configuration before the operational phase and they +MUST keep it up-to-date on a daily basis. The Federation configuration contains the Trust Anchor +public keys for the signature operations, the maximum number of Intermediates allowed between a Leaf and the Trust Anchor (max_path length) and the authorities who are enabled to issue the Trust Marks (trust_marks_issuers).

    +

    Here a non-normative example of Entity Configuration response Trust Anchor.

    +

    For further details, please read the section about the Entity Configuration.

    +
    +
    +

    How to participate

    +

    The participant MUST publish its configuration +(Entity Configuration) at the webpath .well-known/openid-federation.

    +

    The technical and administrative representatives complete the onboarding procedure, +defined by the Federation Authority or by an Intermediate (SA), +in order to register a new Entity or for updating a preexisting one.

    +

    The Federation Authority or an Intermediate, after doing all the required technical and administrative controls, registers the public keys of the onboarded Entity and releases a proof of Federation membership, +in the form of Trust Mark (TM).

    +

    The Leaf MUST include the TM inside its own Federation configuration (Entity Configuration) as proof of +success in the Onboarding process.

    +

    The Federation Authority or an Intermediate MUST publish the Leaf Entity Statement containing the Federation public keys of the onboarded Entity and the TMs released for it.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/log_management.html b/en/log_management.html new file mode 100644 index 00000000..a83dc7f4 --- /dev/null +++ b/en/log_management.html @@ -0,0 +1,1409 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Retention Policy + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Retention Policy

    +
    +

    Log management of a OP and an RP

    +

    OPs and RPs MUST retain the following.

    +
      +
    1. A transaction log containing the exchanged messages. The messages stored in the log MUST be at least the following:

      +
      +
        +
      • Trust Chain related to the Entity which messages are being exchanged with, composed as follows:

        +
        +
          +
        1. The Entity Configuration of the Entity which messages are being exchanged with.

        2. +
        3. [Only for OP] The Entity Statement of the SA referring to the RP, if any.

        4. +
        5. The Entity Statement of the TA referring to the descendant Entity.

        6. +
        7. The Entity Configuration of the TA.

        8. +
        +
        +
      • +
      • AuthenticationRequest

      • +
      • AuthenticationResponse related to the AuthenticationRequest*.

      • +
      • TokenRequest related to the AuthenticationRequest.

      • +
      • TokenResponse related to the TokenRequest.

      • +
      • The UserInfoRequest related to the TokenRequest, if any.

      • +
      • The UserInfoResponse related to the UserInfoRequest, if any.

      • +
      • RevocationRequest related to the TokenRequest, if any.

      • +
      • The RevocationResponse related to the RevocationRequest, if any.

      • +
      +
      +
    2. +
    +
    +

    spid-icon

    +

    For each message, where applicable, the following information could be indexed for research and consultation purposes:

    +
    +
      +
    • authorization code

    • +
    • client_id

    • +
    • jti

    • +
    • iss

    • +
    • sub

    • +
    • iat

    • +
    • exp

    • +
    +
    +
    +
    +

    Warning

    +

    The information stored in the logs MUST be retained and managed for not less than 24 months in full compliance with national and european privacy regulations. Access to the data MUST be restricted to designated personnel. In order to ensure confidentiality data encryption mechanisms or employed database systems (DBMS) that realize encrypted persistence of information MUST be adopted. Integrity e non-repudiation properties MUST be ensured.

    +
    +
    +
    +

    Federation Historical Key registry

    +

    In order to enable the verification of messages exchanged by Entities participating in the federation and their Trust Chains, the TA MUST publish its federation public key history (JWKS) within a registry made available to all participants via the /.well-known/openid-federation-historical-jwks endpoint. For further technical details, please refer to Section 7.5 of OIDC-FED.

    +
    +

    Warning

    +

    Keys that have not been active more than 24 months MAY be removed from the registry at the TA's convenience.

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/logout.html b/en/logout.html new file mode 100644 index 00000000..24e3f4bc --- /dev/null +++ b/en/logout.html @@ -0,0 +1,1361 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Logout + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Logout

    +
    +

    cieid-icon

    +

    RPs MAY establish individual sessions related to authenticated users. In cases where such individual sessions are instaurated by the RPs, the RPs MUST provide users with a logout functionality for the purpose of deleting the established individual session. +During the logout phase the RPs MUST revoke all the Access Tokens still active and related to user authentication, through the use of the revocation endpoint ( Revocation Endpoint ).

    +
    +

    Note

    +

    In case an offline_access mechanism via Refresh Token is supported by the OP, the latter MUST NOT be revoked following a logout.

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/metadata_aa.html b/en/metadata_aa.html new file mode 100644 index 00000000..e272b0dd --- /dev/null +++ b/en/metadata_aa.html @@ -0,0 +1,1497 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Attribute Authority Metadata + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Attribute Authority Metadata

    +

    An AA MUST publish in its EC a federation_entity Metadata and an oauth_resource Metadata, if the resources are protected it MUST also publish an oauth_authorization_server Metadata.

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     },
    +     "oauth_authorization_server":{
    +       ...
    +     },
    +     "oauth_resource":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    The AA Metadata of type "federation_entity" MUST contain at least the following mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    organization_name

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    homepage_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    policy_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    logo_uri

    URL of the entity's logo; it MUST be in SVG format. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    contacts

    Institutional certified email address (PEC) of the entity. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_trust_mark_status_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.8.

    spid-icon cieid-icon

    federation_resolve_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.8.

    spid-icon cieid-icon

    +

    The AA Metadata with "oauth_authorization_server" MUST contain at least the following mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    issuer

    See RFC 8414#page-4. It MUST contain an HTTPS URL that uniquely identifies the AA.

    spid-icon cieid-icon

    authorization_endpoint

    Only for Attribute Authority private flow. See LG-AA and RFC 8414#page-4.

    spid-icon cieid-icon

    token_endpoint

    See RFC 8414#page-4.

    spid-icon cieid-icon

    jwks

    See JWK.

    spid-icon cieid-icon

    scopes_supported

    See RFC 8414#page-4.

    spid-icon cieid-icon

    response_types_supported

    See RFC 8414#page-4,

    spid-icon cieid-icon

    grant_types_supported

    See RFC 8414#page-4 and RFC 8623.

    spid-icon cieid-icon

    token_endpoint_auth_methods_supported

    See RFC 8414#page-4. The supported value is private_key_jwt.

    spid-icon cieid-icon

    token_endpoint_auth_signing_alg_values_supported

    See RFC 8414#page-4. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    op_policy_uri

    See RFC 8414#page-4.

    spid-icon cieid-icon

    op_tos_uri

    See RFC 8414#page-6.

    spid-icon cieid-icon

    dpop_signing_alg_values_supported

    See OAuth-DPoP. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    +

    The AA Metadata of type "oauth_resource" MUST contain at least the following mandatory parameters:

    + +++++ + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    resource

    See OAuth-RS. One or more HTTPS URLs that identify the endpoints of the protected resources.

    spid-icon cieid-icon

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/metadata_oidc.html b/en/metadata_oidc.html new file mode 100644 index 00000000..b7955915 --- /dev/null +++ b/en/metadata_oidc.html @@ -0,0 +1,1363 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Metadata + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Metadata

    +

    OIDC-FED uses and extends the Metadata claims as defined in the specifications OpenID Connect Discovery 1.0 (OpenID.Discovery) and OpenID Connect Dynamic Client Registration 1.0 (OpenID.Registration), respectively for OP and RP.

    +

    In OIDC-FED the OIDC Metadata regarding an RP or OP is defined inside the claim metadata and its sub-claim +<entity-type>, inside the Entity Configuration, as a JSON Object.

    + +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/metadata_oidc_op.html b/en/metadata_oidc_op.html new file mode 100644 index 00000000..655546e2 --- /dev/null +++ b/en/metadata_oidc_op.html @@ -0,0 +1,1523 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | OpenID Connect Provider Metadata (OP) + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    OpenID Connect Provider Metadata (OP)

    +

    An OP MUST publish in its EC a Metadata of type federation_entity and a Metadata of type openid_provider, as +reported in the following example:

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     }
    +     "openid_provider":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    The EC of an OP MUST configure a Metadata of type "federation_entity" and contain at least the following +mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    organization_name

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    homepage_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    policy_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    logo_uri

    URL of the entity's logo; it MUST be in SVG format. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    contacts

    Institutional certified email address (PEC) of the entity. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_resolve_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.6.

    spid-icon cieid-icon

    +

    The EC of an OP MUST configure a metadata of type "openid_provider", that MUST contain at least the following mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    issuer

    See OpenID.Discovery#OP_Metadata. It MUST contain an HTTPS URL that uniquely identifies the OP.

    spid-icon cieid-icon

    authorization_endpoint

    See OpenID.Discovery#OP_Metadata.

    spid-icon cieid-icon

    token_endpoint

    See OpenID.Discovery#OP_Metadata.

    spid-icon cieid-icon

    userinfo_endpoint

    See OpenID.Discovery#OP_Metadata.

    spid-icon cieid-icon

    introspection_endpoint

    See RFC 8414#page-4.

    spid-icon cieid-icon

    revocation_endpoint

    See RFC 8414#page-4.

    spid-icon cieid-icon

    revocation_endpoint_auth_methods_supported

    See RFC 8414#page-4. The supported value is private_key_jwt

    cieid-icon

    code_challenge_methods_supported

    See RFC 8414#page-4. The OP MUST support S256 (see RFC 7636#section-4.3).

    spid-icon cieid-icon

    scopes_supported

    See OpenID.Discovery#OP_Metadata. The supported values are openid and offline_access. CIE id supports also profile, email. For more details, see the section User's Claims.

    spid-icon cieid-icon

    response_types_supported

    See OpenID.Discovery#OP_Metadata. The supported value is code.

    spid-icon cieid-icon

    response_modes_supported

    See OpenID.Discovery#OP_Metadata. The supported values are form_post and query.

    spid-icon cieid-icon

    grant_types_supported

    See OpenID.Discovery#OP_Metadata. The supported values are refresh_token and authorization_code.

    spid-icon cieid-icon

    acr_values_supported

    See OpenID.Discovery#OP_Metadata. The supported values are:

    +

    https://www.spid.gov.it/SpidL1 +https://www.spid.gov.it/SpidL2 +https://www.spid.gov.it/SpidL3

    +

    spid-icon cieid-icon

    subject_types_supported

    See OpenID.Discovery#OP_Metadata. The supported value is pairwise.

    spid-icon cieid-icon

    id_token_signing_alg_values_supported

    See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    id_token_encryption_alg_values_supported

    See OpenID.Discovery#OP_Metadata. See key encryption Cryptographic algorithms.

    cieid-icon

    id_token_encryption_enc_values_supported

    See OpenID.Discovery#OP_Metadata. See content encryption Cryptographic algorithms.

    cieid-icon

    userinfo_signing_alg_values_supported

    See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    userinfo_encryption_alg_values_supported

    See OpenID.Discovery#OP_Metadata. See key encryption Cryptographic algorithms.

    spid-icon cieid-icon

    userinfo_encryption_enc_values_supported

    See OpenID.Discovery#OP_Metadata. See content encryption Cryptographic algorithms.

    spid-icon cieid-icon

    request_object_signing_alg_values_supported

    See OpenID.Discovery#OP_Metadata. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    +
    +

    Warning

    +

    The OP Metadata of type "openid_provider" exposes the claim jwks as regulated by OID-FED instead of +the claim jwks_uri as required at OpenID.Discovery#OP_Metadata.

    +
    +
    +

    See also

    + +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/metadata_oidc_rp.html b/en/metadata_oidc_rp.html new file mode 100644 index 00000000..49f075d9 --- /dev/null +++ b/en/metadata_oidc_rp.html @@ -0,0 +1,1479 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | OpenID Connect Relying Party Metadata (RP) + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    OpenID Connect Relying Party Metadata (RP)

    +

    An RP MUST publish in its EC a Metadata of type federation_entity and a Metadata of type openid_relying_party, as reported in the following example:

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     }
    +     "openid_relying_party":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    The OP Metadata of type "federation_entity" MUST contain at least the following mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    organization_name

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    homepage_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    policy_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    logo_uri

    URL of the entity's logo; it MUST be in SVG format. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    contacts

    Institutional certified email address (PEC) of the entity. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_resolve_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.6.

    spid-icon cieid-icon

    +

    The RP Metadata of type "openid_relying_party" MUST contain at least the following mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by*

    redirect_uris

    See OpenID.Registration#ClientMetadata. It is mandatory using an HTTPS schema in case of a web-based client.

    spid-icon cieid-icon

    grant_types

    See OpenID.Registration#ClientMetadata. The supported values are authorization_code and refresh_token.

    spid-icon cieid-icon

    jwks

    See OpenID.Registration#ClientMetadata and JWK.

    spid-icon cieid-icon

    id_token_signed_response_alg

    See OpenID.Registration#ClientMetadata. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    id_token_encrypted_response_alg

    See OpenID.Registration#ClientMetadata. See key encryption Cryptographic algorithms.

    cieid-icon

    id_token_encrypted_response_enc

    See OpenID.Registration#ClientMetadata. This content encryption is required only if the id_token_encrypted_response_alg is given. See key encryption Cryptographic algorithms.

    cieid-icon

    userinfo_signed_response_alg

    See OpenID.Registration#ClientMetadata. See signature Cryptographic algorithms.

    spid-icon cieid-icon

    userinfo_encrypted_response_alg

    See OpenID.Registration#ClientMetadata. See key encryption Cryptographic algorithms.

    spid-icon cieid-icon

    userinfo_encrypted_response_enc

    See OpenID.Registration#ClientMetadata. See content encryption Cryptographic algorithms.

    spid-icon cieid-icon

    token_endpoint_auth_method

    See OpenID.Registration#ClientMetadata. The required value is private_key_jwt.

    spid-icon cieid-icon

    client_id

    See OpenID.Registration. It MUST contain an HTTPS URL that uniquely identifies the RP.

    spid-icon cieid-icon

    client_registration_types

    See OIDC-FED Section 4.1. The required value is automatic.

    spid-icon cieid-icon

    response_types

    JSON array containing a list of the OAuth 2.0 response_type values that the RP is declaring that it will restrict itself to using. It MUST contain the value code.

    spid-icon cieid-icon

    +
    +

    Note

    +

    The URIs contained in the claim redirect_uris MAY also use custom schemas (e.g. myapp://) +in order to support mobile applications.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/metadata_oidc_ta_sa.html b/en/metadata_oidc_ta_sa.html new file mode 100644 index 00000000..3694139c --- /dev/null +++ b/en/metadata_oidc_ta_sa.html @@ -0,0 +1,1422 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Trust Anchor (TA) and Intermediate (SA) Metadata + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Trust Anchor (TA) and Intermediate (SA) Metadata

    +

    A TA and a SA MUST publish in the EC a Metadata of type federation_entity, as reported in the following example:

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    The EC of a TA and a SA MUST configure a Metadata of type "federation_entity" and contain at least the following +mandatory parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    organization_name

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    homepage_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    policy_uri

    See OIDC-FED Section 4.8

    spid-icon cieid-icon

    logo_uri

    URL of the entity's logo; it MUST be in SVG format. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    contacts

    Institutional certified email address (PEC) of the entity. See OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_fetch_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.8.

    spid-icon cieid-icon

    federation_list_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.8.

    spid-icon cieid-icon

    federation_trust_mark_status_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.8.

    spid-icon cieid-icon

    federation_resolve_endpoint

    See Section Federation Endpoint and OIDC-FED Section 4.8.

    spid-icon cieid-icon

    +
    +

    See also

    +
      +
    • Example of an EC of a TA and a SA SA

    • +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/objects.inv b/en/objects.inv new file mode 100644 index 0000000000000000000000000000000000000000..f59fcebaf257f3586af5a615be06612236b2d5ad GIT binary patch literal 1751 zcmV;|1}OO>AX9K?X>NERX>N99Zgg*Qc_4OWa&u{KZXhxWBOp+6Z)#;@bUGkYP)S5D zLrFy-Pf0{WAT1zLWoK_}Wgt{#V{U0Md?av*PJAarPHb0B7EY-J#6b0A}HZE$jBb8}^6Aa!$TZf78R zY-wUH3V7P3Sxax*I1s+;R|s$q?SWY|=>ynXHqGt^Xtzd^JqwI9mWj%uO43f9U%$hL zL{g$`1$&Azk8g(a;=@!a!JhVt6?+A(f?TTV_llP}d7sk}?_#TVP5!S0F|a^pbg#Bt zuotQrZwqLvjB=fSrIPf%2dJ(=hYW z8QVco^45fzi6}2)o(;v{{5e-V@97FOM#m+4L2OXF*i9w&QWZNYen{)!oBUCe@^47O z1shH66{55ofuOwLtSXC=K>_xY)%+0qbxP8D`Gsxz4CT*EZS(JUUv6^t7e8o2lIdV* zhgnf!o>{pU@bW@q-zAhHAf#}5QF_iioF6Z9fGf)( zvF>6kg`)q*5JB~nEjLuI+Y$$EZ&)g-UthJ;AZ)Zdyp!`yjX@x9PT`_>~Jgtel$nc*7=$Wb&L#ME;Dp#4PBly^u2=?j~DBq zmjhE*%S>HaQ&;Cq-Qnp;?4V*)#7p|H%+3dE=fgQWakm9_J}$HK(c1ZV5grDZlzZGo zo{stBwLW3c{C*vQe_96q$%2161O9Lwfqz~G{@H?mo&kSIdA_KgOf~sh8b(H<6)u;x z!li8mEu8?hnG8@Dm7*y`Uxr_qOgVV9%)u+`;8oD84shb!qSTwjW7^}h{?xrisWyqm zG=Bp{D~j9Bnm4RGW`1TS?;r{GWQgB7hMWZ(e4B$?c?KCY(=EdBK0ttQA`%Rzp^l-;xA4aK#QlX9#Tz2?5S0HJL-fqAfa+o#LZQy2A zMFmX*1#TreK{UiZDQHbRZgH1Tv|$uCdUV{^jLaHd7k=B1fFq7Yx(5?$bkuc5LVbvD z0$_zS63D0U_5F0mr|R&f^=ltG(dV zkiUJrewWj>3eGH;oVO21okpiK6|v+9KE&CnjK_D+ccD(FtPl3;%`3w#PNIrA)Fr_l z-<#&5JUpOir?G+@<;t2LLGQHe+Edf z`;pl*{BWPc8l0O$TX}{*0;DWRprYK4pSCp3?PZp~#zCBgPhR1YCQo6r&s~z&H7Laj zTGs+<{ahMd9aH>a_wxm6P9F?T;Q6)8A+CB333X@8C@eH8s(95su}|Od=qvYK$AyAQ zzu1kce(ptYH7F6IH2c7(G!pLRzQwjmb%lVR%iGIg5Z`7RgJ=wr=>V`616B&&vR#y) zG0%-|q)O9^*P4FRUPet5K}_4pHjb~!Sj4_{%kxcXXhXFVr*<2>XZ!c&Gw;xbK#ZWj z$%Xn+C5+V*IxW;(vB{gxgc% + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Revocation Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Revocation Endpoint

    +

    An RP MAY request the revocation of an Access Token or a Refresh Token issued by an OP.

    +

    The OP MUST revoke the token specified in the request.

    +
    +

    spid-icon

    +

    When the user logs out or when his/her session with the RP expires (according to the policies decided by the RP) the RP MUST revoke the Access Token in its possession, if it is not expired yet.

    +
    +

    Note

    +

    The Access Token revocation implies revoking all the Refresh Tokens linked to it, if not expired yet.

    +
    +

    The OP MUST revoke the token specified in the request and MUST end the Single Sign-On session, if it is still active. Any other active tokens for the user must be kept valid.

    +
    +
    +

    cieid-icon

    +

    The Access Token revocation MUST NOT imply revoking all the Refresh Tokens linked to it.

    +

    If the token passed to the request is a Refresh Token, the OP MUST revoke the respective Access Token as well, if it is not expired yet.

    +
    +
    +

    Note

    +

    The authentication method MUST be private_key_jwt (see the revocation_endpoint_auth_methods_supported parameter in Section Metadata OP)

    +
    + +
    +

    Request

    +

    The request to the Revocation Endpoint consists of sending the token to be revoked, together with a Client Assertion that allows the identification of the RP that sends the request.

    +

    Example:

    +
    POST /revoke HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +client_id=https%3A%2F%2Frp.spid.agid.gov.it&
    +token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT
    +QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8
    +iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4
    +MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA
    +RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw
    +RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9
    +h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    client_assertion

    JWT signed with the Relying Party's private key, containing the same parameters included in the Token Endpoint request. The OP must check the validity of all the fields in the JWT, and the validity of its signature, according to the parameter client_id.

    spid-icon cieid-icon

    client_assertion_type

    String. urn:ietf:params:oauth:clientassertion-type:jwt-bearer

    spid-icon cieid-icon

    client_id

    URL HTTPS that uniquely identifies the RP.

    spid-icon cieid-icon

    token

    The token which the RP is asking to revoke.

    spid-icon cieid-icon

    +
    +
    +

    Response

    +

    The Revocation Endpoint answers with a code HTTP 200, also though the indicated token does not exist or has already been revoked (so that non information is going to be released).

    +
    +
    +

    Error codes

    +

    As defined for Token endpoint.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/search.html b/en/search.html new file mode 100644 index 00000000..dfe5d503 --- /dev/null +++ b/en/search.html @@ -0,0 +1,1359 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Search + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + + +
    + +
    + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/searchindex.js b/en/searchindex.js new file mode 100644 index 00000000..9882480b --- /dev/null +++ b/en/searchindex.js @@ -0,0 +1 @@ +Search.setIndex({"docnames": ["attributi_utente", "authorization_endpoint", "avvisi_spid", "come_contribuire", "confronto_oidc_cie_e_oidc_igov", "cryptographic_algos", "differenze_oidc_fed", "differenze_spid_cie", "diventa_fornitore", "entity_configuration", "entity_statement", "errors_federation", "esempi", "federation_endpoint", "flusso_autenticazione", "index", "introspection_endpoint", "la_federazione_delle_identita", "log_management", "logout", "metadata_aa", "metadata_oidc", "metadata_oidc_op", "metadata_oidc_rp", "metadata_oidc_ta_sa", "revocation_endpoint", "seccons_bcps", "soggetti_aggregatori", "standards", "termini_acronimi", "token_endpoint", "trust_marks", "trust_negotiation", "userinfo_endpoint"], "filenames": ["attributi_utente.rst", "authorization_endpoint.rst", "avvisi_spid.rst", "come_contribuire.rst", "confronto_oidc_cie_e_oidc_igov.rst", "cryptographic_algos.rst", "differenze_oidc_fed.rst", "differenze_spid_cie.rst", "diventa_fornitore.rst", "entity_configuration.rst", "entity_statement.rst", "errors_federation.rst", "esempi.rst", "federation_endpoint.rst", "flusso_autenticazione.rst", "index.rst", "introspection_endpoint.rst", "la_federazione_delle_identita.rst", "log_management.rst", "logout.rst", "metadata_aa.rst", "metadata_oidc.rst", "metadata_oidc_op.rst", "metadata_oidc_rp.rst", "metadata_oidc_ta_sa.rst", "revocation_endpoint.rst", "seccons_bcps.rst", "soggetti_aggregatori.rst", "standards.rst", "termini_acronimi.rst", "token_endpoint.rst", "trust_marks.rst", "trust_negotiation.rst", "userinfo_endpoint.rst"], "titles": ["User attributes", "Authorization endpoint", "SPID regulatory references", "How to contribute", "Differences with OIDC iGov", "Cryptographic algorithms", "Differences with OIDC Federation", "Differences between SPID e CIE id", "Become a service provider", "Entity Configuration", "Entity Statements", "Federation error management", "Examples", "Federation Endpoints", "Authentication Flow", "SPID/CIE OpenID Connect", "Introspection Endpoint", "The Italian eID Federations", "Retention Policy", "Logout", "Attribute Authority Metadata", "Metadata", "OpenID Connect Provider Metadata (OP)", "OpenID Connect Relying Party Metadata (RP)", "Trust Anchor (TA) and Intermediate (SA) Metadata", "Revocation Endpoint", "Security Considerations", "Intermediate Entities", "References", "Terms and Acronyms", "Token Endpoint", "Trust Marks", "Metadata retrieval", "UserInfo Endpoint"], "terms": {"tutti": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "gli": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "esempi": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "contenuti": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "questa": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "documentazion": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "sono": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "da": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "intendersi": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "come": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "non": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "normativi": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "all": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "contain": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "thi": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "document": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "ar": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "meant": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "norm": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 30, 31, 32, 33], "The": [0, 1, 2, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14, 15, 16, 18, 20, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "follow": [0, 1, 2, 4, 5, 9, 10, 11, 12, 13, 14, 16, 18, 19, 20, 22, 23, 24, 27, 28, 30, 31, 32, 33], "tabl": [0, 1, 27, 31], "show": [0, 4, 12], "list": [0, 1, 6, 9, 13, 15, 16, 23, 26, 29, 31, 32], "support": [0, 1, 2, 4, 5, 6, 7, 9, 10, 11, 16, 19, 20, 22, 23, 24, 25, 28, 30, 31, 33], "spid": [0, 4, 5, 6, 8, 10, 12, 14, 16, 17, 22, 29, 31, 32], "cie": [0, 4, 5, 6, 8, 10, 14, 17, 22, 29, 31, 32], "variabl": 0, "prefix": 0, "http": [0, 1, 7, 10, 11, 12, 14, 16, 20, 22, 23, 25, 27, 28, 30, 31, 32, 33], "eid": [0, 1, 15, 31], "gov": [0, 1, 7, 10, 12, 16, 22, 25, 30, 31, 33], "repres": [0, 1, 9, 10, 12, 17, 29, 31, 32], "namespac": 0, "claim": [0, 4, 10, 11, 12, 15, 16, 20, 21, 22, 23, 24, 25, 26, 29, 30, 31, 32, 33], "descript": [0, 1, 9, 10, 11, 14, 16, 20, 22, 23, 24, 25, 30, 31, 33], "spid_cod": [0, 12], "categori": 0, "registri": [0, 12, 15, 31], "identif": [0, 25, 27, 28, 31], "code": [0, 4, 9, 10, 12, 14, 15, 18, 22, 23, 27, 28, 29, 31], "string": [0, 1, 9, 16, 25, 30, 31, 33], "assign": [0, 9], "digit": [0, 15, 17, 29, 30], "ident": [0, 12, 15, 17, 29, 30], "provid": [0, 1, 2, 4, 7, 13, 14, 15, 17, 19, 21, 28, 29, 30], "must": [0, 1, 4, 5, 9, 10, 11, 13, 16, 17, 18, 19, 20, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33], "uniqu": [0, 1, 9, 15, 20, 22, 23, 25, 30, 31, 32, 33], "format": [0, 9, 16, 20, 22, 23, 24, 28, 30, 31, 32], "cod_idp": 0, "unique_numb": 0, "where": [0, 12, 18, 19, 30, 31], "made": [0, 10, 18, 30, 32], "4": [0, 1, 2, 4, 13, 15, 20, 22, 23, 24, 28, 33], "letter": [0, 29], "an": [0, 1, 7, 9, 10, 12, 13, 14, 15, 17, 19, 20, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32], "alphanumer": [0, 1, 30], "compos": [0, 18, 31, 32], "10": [0, 28, 29], "charact": [0, 1, 2, 28, 30], "gener": [0, 1, 9, 28, 30, 32], "its": [0, 1, 2, 10, 13, 16, 17, 18, 20, 21, 22, 23, 25, 26, 28, 29, 30, 31, 32, 33], "own": [0, 10, 16, 17, 26, 27, 29, 31, 32, 33], "domain": [0, 17, 27, 31], "abcd123456789a": 0, "given_nam": [0, 1, 12], "name": [0, 4, 12, 26, 28, 31, 33], "sequenc": [0, 29], "word": [0, 28], "separ": [0, 1], "singl": [0, 1, 7, 25], "space": [0, 1], "each": [0, 1, 9, 10, 17, 18, 26, 27, 31, 32], "start": [0, 2, 26, 28, 31, 32], "capit": [0, 29], "giovanni": 0, "mario": [0, 33], "family_nam": [0, 1, 12, 33], "last": [0, 12, 30, 33], "bianchi": 0, "verdi": 0, "place_of_birth": [0, 12], "place": 0, "birth": 0, "provinc": 0, "json": [0, 9, 10, 12, 16, 21, 23, 28, 29, 30, 31, 32], "object": [0, 1, 4, 9, 10, 16, 21, 26, 28, 31, 32], "local": 0, "correspond": [0, 1, 17, 31, 32], "real": [0, 17, 31], "estat": 0, "belfior": 0, "citi": 0, "foreign": 0, "countri": [0, 28], "e": [0, 9, 12, 15, 18, 23, 28, 30, 31], "g": [0, 23, 28, 30], "f205": 0, "milano": 0, "region": 0, "mi": 0, "birthdat": [0, 1, 12], "date": [0, 2, 17, 28, 29, 30, 32], "specif": [0, 1, 6, 9, 10, 11, 15, 17, 21, 26, 28, 29], "iso8601": [0, 28], "2004": [0, 28], "yyyi": 0, "indic": [0, 1, 9, 14, 16, 25, 28, 30, 31, 33], "year": 0, "us": [0, 1, 4, 5, 7, 10, 12, 14, 15, 17, 19, 21, 23, 26, 27, 28, 29, 30, 31, 32, 33], "four": 0, "mm": 0, "month": [0, 18], "2": [0, 1, 4, 13, 15, 16, 23, 28, 29, 30, 31, 32, 33], "two": [0, 1, 26, 31], "dd": 0, "dai": [0, 30], "2002": [0, 28], "09": [0, 2, 28], "24": [0, 2, 18, 28], "gender": [0, 12], "valu": [0, 1, 7, 9, 10, 16, 20, 22, 23, 26, 29, 30, 31, 32, 33], "accept": [0, 4, 33], "femal": 0, "male": 0, "company_nam": [0, 12], "compani": 0, "In": [0, 1, 2, 4, 5, 6, 7, 9, 11, 13, 14, 15, 18, 19, 21, 26, 27, 28, 29, 30, 31, 32, 33], "substr": 0, "agenzia": [0, 29], "per": [0, 2, 10, 28, 29], "l": [0, 28, 29], "italia": [0, 29], "digital": [0, 28, 29], "registered_offic": [0, 12], "extra": 0, "regist": [0, 13, 15, 16, 17, 27, 32], "offic": 0, "street_address": 0, "postal_cod": 0, "country_cod": 0, "type": [0, 9, 10, 12, 13, 16, 20, 21, 22, 23, 24, 25, 27, 30, 31, 33], "address": [0, 12, 20, 22, 23, 24, 29], "via": [0, 18, 19, 30], "vial": 0, "piazza": 0, "hius": 0, "number": [0, 9, 14, 15, 17, 28, 31, 32], "zip": 0, "includ": [0, 1, 4, 7, 13, 17, 25, 27, 29, 30, 31], "listz": 0, "21": 0, "00144": 0, "roma": 0, "fiscal_numb": [0, 1, 12, 31, 33], "fiscal": [0, 31], "natur": [0, 2, 28], "person": [0, 30], "For": [0, 1, 6, 7, 9, 13, 17, 18, 22, 26, 30, 31, 32], "pleas": [0, 1, 3, 6, 10, 17, 18, 30], "refer": [0, 1, 4, 5, 9, 10, 15, 17, 18, 27, 30], "cf": 0, "certif": [0, 28], "propos": [0, 3], "draft": [0, 28, 30], "etsi": 0, "en": [0, 15], "319": 0, "412": [0, 28], "1": [0, 1, 4, 10, 13, 15, 16, 17, 21, 23, 25, 26, 28, 29, 30, 31, 32, 33], "impli": [0, 7, 25], "case": [0, 1, 2, 4, 11, 14, 19, 23, 26, 27, 28, 30, 31, 32], "tinit": 0, "abcxyz00w00z000z": 0, "company_fiscal_numb": 0, "legal": [0, 12, 29], "vat_numb": [0, 12, 31], "vat": [0, 31], "vatit": 0, "partitaiva": 0, "12345678901": 0, "document_detail": [0, 12], "proprieti": 0, "cartaidentita": 0, "passaporto": 0, "patenteguida": 0, "patentenautica": 0, "librettopension": 0, "patentinoimptermici": 0, "portoarmi": 0, "tesserariconoscimento": 0, "document_numb": 0, "issuer": [0, 1, 4, 12, 20, 22, 28, 29, 31], "issu": [0, 2, 3, 9, 10, 15, 16, 17, 25, 28, 29, 30, 31, 32], "entiti": [0, 11, 13, 15, 17, 18, 20, 21, 22, 23, 24, 26, 29, 31], "obtain": [0, 1, 7, 13, 16, 17, 26, 27, 30, 32, 33], "from": [0, 1, 3, 7, 9, 14, 17, 18, 26, 29, 30, 32], "concaten": 0, "term": [0, 15], "build": [0, 10, 17, 27, 32], "unless": [0, 26, 31], "conjunct": 0, "articl": 0, "preposit": 0, "regionelazio": 0, "lazio": 0, "provinciacatania": 0, "catania": 0, "prefetturaroma": 0, "prefectur": 0, "ministeroeconomiafinanz": 0, "ministri": [0, 17, 29], "economi": 0, "financ": 0, "date_of_issu": 0, "issuanc": [0, 30, 31, 33], "date_of_expiri": 0, "expiri": [0, 1, 9, 29, 30, 31, 32, 33], "as09452389": 0, "comuneroma": 0, "2013": [0, 28], "01": 0, "02": 0, "31": 0, "phone_numb": [0, 12], "mobil": [0, 23, 30], "phone": 0, "numer": 0, "without": [0, 26, 29, 30], "intern": [0, 1, 6, 15, 28, 30, 31], "phone_number_verifi": 0, "boolean": [0, 16], "whether": 0, "s": [0, 1, 12, 14, 16, 18, 20, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "ha": [0, 1, 2, 4, 7, 10, 13, 16, 25, 26, 28, 29, 30, 31, 32], "been": [0, 2, 4, 12, 16, 18, 25, 28, 29, 30, 31], "verifi": [0, 1, 16, 30], "op": [0, 1, 4, 7, 9, 12, 14, 15, 16, 17, 19, 21, 23, 25, 26, 27, 29, 30, 31, 32, 33], "landline_numb": 0, "landlin": 0, "email": [0, 1, 4, 7, 10, 12, 20, 22, 23, 24, 30, 31], "mail": [0, 31], "standard": [0, 6, 15, 17, 27, 28, 30, 31], "email_verifi": [0, 1], "e_delivery_servic": [0, 12], "qualifi": [0, 29], "electron": [0, 28, 29], "deliveri": [0, 30], "pec": [0, 20, 22, 23, 24, 31], "pecdomain": 0, "eid_exp_d": [0, 12], "accord": [0, 4, 9, 10, 17, 25, 29, 30, 31, 32], "hous": 0, "three": 0, "inform": [0, 2, 12, 16, 17, 18, 25, 28, 30, 31], "prefer": [0, 1], "sort": 0, "liszt": 0, "rm": 0, "IT": 0, "conveni": [0, 18], "we": [0, 4, 26], "report": [0, 1, 10, 13, 22, 23, 24], "produc": [0, 17, 26], "composit": [0, 1, 15, 17, 27], "sever": [0, 26], "particular": 0, "As": [0, 1, 4, 16, 25, 26, 33], "italian": [0, 3, 15, 29, 31], "oidc": [0, 1, 5, 9, 10, 12, 13, 15, 17, 18, 20, 21, 22, 23, 24, 26, 27, 28, 29, 31, 32], "physic": 0, "domicil": 0, "salaria": 0, "km": 0, "23": [0, 28], "800": 0, "00015": 0, "monterotondo": 0, "There": [0, 31], "unit": 0, "state": [0, 1, 4, 12, 29], "america": 0, "both": [0, 1, 4, 7, 9, 17, 32], "field": [0, 16, 25, 28, 33], "503": [0, 30], "washington": 0, "avenu": 0, "12401": 0, "kingston": 0, "new": [0, 3, 7, 17, 26, 29, 30, 31], "york": 0, "exampl": [1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "initi": [1, 7, 30], "user": [1, 7, 14, 15, 19, 22, 25, 30, 31, 33], "select": 1, "authent": [1, 4, 7, 15, 16, 17, 19, 25, 26, 27, 28, 30, 32, 33], "rp": [1, 4, 7, 9, 14, 15, 16, 17, 19, 21, 25, 26, 27, 29, 30, 31, 32, 33], "redirect": [1, 14], "sign": [1, 4, 7, 9, 10, 16, 17, 25, 29, 30, 31, 33], "jwt": [1, 4, 9, 10, 12, 16, 25, 28, 29, 30, 31, 33], "convei": 1, "mai": [1, 4, 7, 9, 10, 17, 18, 19, 23, 25, 26, 27, 28, 29, 30, 31], "method": [1, 7, 25, 29, 30, 33], "post": [1, 7, 12, 16, 25, 30, 33], "get": [1, 7, 12, 14, 17, 30, 32, 33], "With": 1, "sent": [1, 13, 30, 32, 33], "form": [1, 12, 16, 17, 25, 29, 30], "serial": [1, 13], "queri": [1, 10, 12, 16, 22, 29, 31, 32], "more": [1, 6, 9, 13, 17, 18, 20, 22, 27, 29, 30, 31, 32], "detail": [1, 6, 7, 10, 13, 17, 18, 22, 30], "see": [1, 6, 7, 9, 10, 11, 13, 20, 22, 23, 24, 25, 29, 30, 31, 32, 33], "openid": [1, 2, 4, 5, 7, 9, 10, 13, 14, 16, 18, 21, 27, 28, 29, 30, 31, 33], "core": [1, 4, 5, 9, 10, 15, 28, 30, 31, 33], "insid": [1, 9, 16, 17, 21, 26, 27, 29, 31, 32], "same": [1, 7, 9, 10, 16, 17, 25, 26, 30, 31, 32], "client_id": [1, 7, 12, 16, 18, 23, 25, 26, 27, 30, 32, 33], "response_typ": [1, 7, 12, 23], "should": [1, 3, 4, 9, 29, 30], "mismatch": 1, "consid": [1, 4, 9, 10, 26, 29], "mandatori": [1, 4, 6, 7, 20, 22, 23, 24, 31], "It": [1, 9, 10, 17, 20, 22, 23, 26, 29, 30, 31, 33], "defin": [1, 4, 7, 9, 10, 12, 16, 17, 21, 25, 26, 27, 29, 30, 31, 32, 33], "scopes_support": [1, 10, 12, 20, 22], "metadata": [1, 4, 5, 9, 11, 13, 15, 17, 25, 28, 29, 30, 31], "At": [1, 17, 26, 30, 32], "least": [1, 13, 18, 20, 22, 23, 24, 27, 30, 32], "present": [1, 2, 4, 11, 16, 26, 28, 29, 30, 31], "code_challeng": [1, 12, 30], "rfc": [1, 4, 9, 14, 20, 22, 28, 29, 30, 31, 32, 33], "7636": [1, 14, 22, 28], "section": [1, 2, 4, 6, 7, 9, 10, 12, 13, 16, 17, 18, 20, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "code_challenge_method": [1, 12], "code_challenge_methods_support": [1, 10, 12, 22], "jwtrequest": 1, "header": [1, 14, 30, 33], "jose": [1, 9, 12, 30, 33], "alg": [1, 12, 30, 33], "7516": [1, 28], "cryptograph": [1, 10, 15, 20, 22, 23, 33], "algorithm": [1, 9, 10, 15, 20, 22, 23, 28, 30, 33], "kid": [1, 9, 12, 30, 33], "7638": [1, 28, 33], "section_3": [1, 10, 33], "typ": [1, 12, 30], "omit": 1, "assum": [1, 30], "implicit": 1, "payload": [1, 12, 30, 33], "registr": [1, 4, 15, 21, 23, 28, 29, 30, 31, 32], "url": [1, 9, 14, 16, 20, 22, 23, 24, 25, 26, 29, 30, 31, 32], "identifi": [1, 4, 9, 10, 13, 16, 20, 22, 23, 25, 27, 28, 29, 30, 31, 32, 33], "nonc": [1, 12, 30], "authrequest": [1, 30], "casual": 1, "32": [1, 30], "return": [1, 3, 13, 14, 16, 30, 33], "id": [1, 4, 5, 9, 10, 12, 14, 15, 16, 17, 22, 29, 31, 33], "token": [1, 4, 12, 14, 15, 16, 19, 25, 28, 29, 33], "so": [1, 25, 31], "client": [1, 4, 11, 15, 16, 21, 23, 25, 26, 28, 30, 32], "can": [1, 2, 7, 14, 15, 17, 26, 27, 28, 29, 30, 31, 32], "test": [1, 13, 16], "equal": [1, 5, 26, 30, 32, 33], "prompt": [1, 12, 30], "allow": [1, 7, 9, 10, 13, 16, 17, 25, 26, 29, 30, 31, 32], "consent": [1, 7, 14, 30], "If": [1, 3, 16, 25, 26, 27, 30, 32], "On": [1, 7, 25], "session": [1, 7, 19, 25, 30], "yet": [1, 25], "activ": [1, 7, 12, 13, 16, 18, 19, 25], "make": [1, 16, 30, 32], "Then": [1, 14, 32], "ask": [1, 25], "permiss": [1, 32], "transfer": [1, 28], "login": [1, 12], "forc": 1, "redirect_uri": [1, 12, 14, 23, 26, 27], "response_types_support": [1, 10, 12, 20, 22], "acr_valu": [1, 4, 12, 30], "acr_values_support": [1, 10, 12, 22], "contest": 1, "class": 1, "acr": [1, 4, 7, 30], "them": [1, 2, 6, 10, 27, 28, 31, 32], "appear": [1, 9, 29], "order": [1, 2, 17, 18, 23, 28, 30, 32, 33], "higher": 1, "level": [1, 17, 28, 30], "than": [1, 5, 9, 18, 27, 30, 31, 32], "Such": [1, 30], "choic": 1, "NOT": [1, 4, 5, 13, 19, 25, 26, 29, 30, 31], "caus": 1, "neg": [1, 31], "result": [1, 11, 29, 30, 31, 32], "claimsrequestparamet": 1, "side": 1, "end": [1, 7, 25, 30, 32], "exp": [1, 4, 9, 10, 12, 16, 18, 26, 30, 31, 32, 33], "unix": [1, 9, 30, 31, 33], "timestamp": [1, 9, 28, 30, 31, 33], "time": [1, 4, 9, 13, 17, 26, 28, 30, 31, 32, 33], "numericd": [1, 9, 30, 31, 33], "7519": [1, 9, 28, 29, 30, 31, 33], "iat": [1, 4, 9, 10, 12, 18, 30, 31, 33], "iss": [1, 4, 7, 9, 10, 12, 16, 18, 28, 30, 31, 33], "aud": [1, 4, 6, 16, 30, 33], "ui_local": 1, "option": [1, 4, 29, 30, 31], "languag": 1, "script": 1, "interfac": [1, 27], "bcp47": 1, "rfc5646": 1, "pkce": [1, 4, 14], "extens": [1, 31], "protocol": [1, 28, 31], "oauth": [1, 4, 7, 16, 20, 23, 25, 28, 30], "0": [1, 15, 17, 21, 23, 26, 28, 29, 30, 31], "also": [1, 9, 10, 13, 20, 22, 23, 25, 29, 30], "profil": [1, 4, 7, 10, 11, 12, 15, 22, 28, 29, 30, 31, 32], "igov": [1, 15, 16, 28, 30, 33], "govern": [1, 15, 30], "assur": [1, 15, 17, 30], "aim": [1, 2, 3, 26, 28, 31], "avoid": [1, 4, 26], "possibl": [1, 6, 14, 26, 30], "attack": [1, 4, 7, 26], "intercept": 1, "consist": [1, 25, 26], "hash": [1, 30], "challeng": 1, "when": [1, 25, 26, 29, 32], "contact": [1, 12, 20, 22, 23, 24, 31], "flow": [1, 4, 6, 15, 20, 30], "send": [1, 4, 14, 25, 30, 32, 33], "creat": [1, 2, 26, 28], "check": [1, 9, 14, 16, 25, 29, 31, 33], "python": 1, "shown": 1, "import": 1, "hashlib": 1, "base64": [1, 29], "re": 1, "os": 1, "random": [1, 30], "def": 1, "get_pkc": 1, "str": 1, "s256": [1, 10, 12, 22], "code_challenge_length": 1, "int": 1, "64": 1, "hasher": 1, "sha256": 1, "code_verifier_length": 1, "randint": 1, "43": 1, "128": 1, "code_verifi": [1, 30], "urlsafe_b64encod": 1, "urandom": 1, "decod": [1, 12], "utf": 1, "8": [1, 4, 20, 22, 23, 24], "sub": [1, 4, 9, 10, 12, 16, 18, 21, 26, 30, 31, 33], "za": 1, "z0": 1, "9": 1, "encod": [1, 30], "digest": 1, "replac": 1, "attribut": [1, 2, 7, 9, 10, 12, 14, 15, 21, 26, 28, 29, 30, 31, 33], "doesn": [1, 32], "t": [1, 6, 26, 28, 32], "thei": [1, 2, 4, 5, 6, 7, 15, 17, 28, 29, 31], "onli": [1, 4, 6, 7, 9, 18, 20, 23, 26, 29, 30, 31, 33], "avail": [1, 7, 17, 18, 26, 27, 30, 31, 32], "userinfo": [1, 4, 12, 14, 15, 30], "equival": 1, "eida": [1, 28], "minimum": [1, 30], "dataset": 1, "nation": [1, 15, 18, 31], "one": [1, 7, 9, 17, 26, 27, 29, 30, 31, 32, 33], "combin": 1, "wa": 1, "would": [1, 26], "have": [1, 4, 6, 9, 12, 17, 18, 26, 29, 30, 31, 32], "ani": [1, 6, 7, 17, 18, 25, 30, 31, 32], "definit": [1, 26], "usag": [1, 4], "mode": [1, 27], "claimsparamet": 1, "specifi": [1, 2, 4, 14, 25, 28, 29, 31], "ad": [1, 26, 31, 32], "tool": [1, 16, 25, 30], "ietf": [1, 4, 7, 16, 25, 28, 30], "org": [1, 16, 25, 30], "html": [1, 16, 25, 30, 33], "rfc6749": [1, 30], "net": [1, 16, 30, 33], "spec": [1, 4, 16, 30, 33], "connect": [1, 2, 4, 7, 14, 21, 26, 28, 29, 30, 31, 32, 33], "1_0": [1, 16, 30, 33], "authrequestvalid": 1, "success": [1, 17], "requir": [1, 2, 4, 5, 6, 7, 9, 11, 14, 16, 17, 22, 23, 28, 29, 30, 31], "authrespons": 1, "pass": [1, 14, 25], "access": [1, 3, 4, 7, 14, 15, 18, 19, 25, 28, 33], "advantag": 1, "expos": [1, 5, 6, 16, 17, 22, 27, 30, 31, 32], "agent": 1, "malwar": 1, "could": [1, 18, 26, 29], "control": [1, 10, 17, 32], "suppos": 1, "valid": [1, 11, 13, 14, 15, 16, 25, 26, 29, 32, 33], "callback": [1, 12, 27], "a032faf23d986353019ff8eda96cadce2ea1c368f04bf4c5e1759d559dda1c08056c7c4d4e8058cb002a0c8fa9a920272350aa102548523a8aff4ccdb44cb3fa": 1, "2ujz3tbbhwqel4xpfsj5ansjkhd7ilfc": 1, "3a": [1, 12, 16, 25], "2f": [1, 12, 16, 25], "2fop": 1, "2foidc": 1, "event": 1, "anomali": [1, 11], "messag": [1, 11, 18, 32], "describ": [1, 9, 10, 26, 29, 30, 31, 32], "relat": [1, 7, 9, 10, 12, 18, 19, 26, 30, 32], "line": [1, 2, 28], "guida": [1, 2, 28], "ux": 1, "error_descript": [1, 11], "statu": [1, 13, 15, 29, 31], "match": [1, 26, 30], "access_deni": 1, "deni": 1, "due": [1, 26, 30], "invalid": [1, 30], "unsuit": 1, "credenti": [1, 15, 30], "6749": [1, 30], "302": [1, 11, 28], "found": [1, 11, 30], "unauthorized_cli": [1, 11], "invalid_request": [1, 11, 30], "lack": [1, 30, 32], "incorrect": [1, 30], "invalid_scop": 1, "server_error": [1, 30], "encount": [1, 30], "problem": [1, 26, 30], "temporarily_unavail": [1, 11, 30], "temporari": [1, 30], "unsupported_response_typ": 1, "doe": [1, 6, 7, 11, 25, 30, 31, 32], "login_requir": 1, "autherror": 1, "consent_requir": 1, "request_uri_not_support": 1, "request_uri": [1, 4], "registration_not_support": 1, "invalid_request_object": 1, "miss": 1, "uri": [1, 16, 23, 28, 33], "400": [1, 11, 30], "bad": [1, 11, 26, 30], "system": [2, 8, 15, 18, 26, 28, 29], "up": [2, 4, 7, 17, 28, 29, 30, 32], "complex": [2, 28], "intervent": [2, 28], "differ": [2, 9, 15, 17, 26, 27, 28, 30], "aspect": [2, 28, 29], "clarif": [2, 28], "note": [2, 28], "studi": [2, 28], "better": [2, 28], "applic": [2, 5, 12, 16, 18, 23, 25, 28, 30, 33], "understand": [2, 28], "regul": [2, 6, 18, 22, 28, 29], "alreadi": [2, 25, 28, 30, 33], "agid": [2, 12, 16, 17, 25, 28, 29, 30, 31, 33], "complianc": [2, 4, 18, 28, 29, 31], "what": [2, 9, 10, 28, 29], "prescrib": [2, 28], "art": [2, 28], "dpcm": [2, 28], "octob": [2, 28], "2014": [2, 28], "organ": [2, 12, 17, 28, 31], "gather": [2, 12, 28], "involv": [2, 17, 28, 29, 31], "commit": [2, 28], "actor": [2, 28], "public": [2, 3, 4, 9, 10, 12, 15, 17, 18, 28, 29, 31, 32], "privat": [2, 4, 12, 15, 16, 20, 25, 28, 29, 30, 31], "announc": [2, 28], "ensur": [2, 18, 28], "uniform": [2, 16, 28, 29], "interpret": [2, 28, 29], "rule": [2, 28, 29], "technic": [2, 15, 17, 18, 29], "els": [2, 28], "might": [2, 28], "necessari": [2, 26, 28], "correct": [2, 3, 28], "oper": [2, 5, 9, 10, 11, 17, 26, 28, 29, 30, 31, 32], "whole": [2, 28], "implement": [2, 4, 6, 10, 14, 17, 26, 28, 29], "ll": [2, 7, 28, 30], "gg": [2, 7, 28, 30], "11": [2, 28], "2021": [2, 28], "avviso": [2, 7, 28, 30], "n": [2, 7, 12, 26, 28, 29, 30], "41": [2, 7, 28, 30], "v2": [2, 28], "integrazion": [2, 28, 30], "pdf": [2, 28], "06": [2, 28], "05": [2, 28], "2022": [2, 28], "tabella": [2, 28], "attributi": [2, 28], "utent": [2, 28], "v1": [2, 28], "3": [2, 4, 10, 13, 15, 16, 22, 28, 30, 31], "determina": [2, 28], "feder": [2, 4, 5, 9, 10, 12, 15, 16, 20, 22, 23, 24, 27, 28, 29, 31, 32], "regol": [2, 28], "tecnich": [2, 28], "il": [2, 10, 28], "funzionamento": [2, 28], "della": [2, 10, 28], "federazion": [2, 28], "14": [2, 28, 29], "author": [2, 4, 9, 11, 14, 15, 16, 17, 18, 21, 26, 27, 28, 29, 30, 31, 32, 33], "guidelin": [2, 15, 28], "18": [2, 28], "07": [2, 28], "you": [3, 15], "want": [3, 16, 30], "click": [3, 14], "github": 3, "icon": 3, "upper": 3, "right": 3, "corner": 3, "label": 3, "sourc": 3, "repositori": 3, "find": [3, 15, 26], "some": [3, 17, 26, 27, 31], "mistak": 3, "wish": 3, "clarifi": [3, 30], "someth": 3, "even": 3, "simpli": [3, 6, 17], "notifi": 3, "improv": [3, 15], "open": 3, "after": [3, 17, 26, 30, 32], "receiv": [3, 14, 30, 31, 32], "commun": [3, 6, 31], "develop": 3, "abl": 3, "pull": 3, "request": [3, 4, 7, 11, 13, 14, 15, 17, 26, 32], "modif": 3, "base": [4, 17, 23, 29], "vtr": 4, "adopt": [4, 6, 15, 17, 18, 26, 31], "instead": [4, 22], "respons": [4, 7, 14, 15, 17, 32], "auth": [4, 12, 27, 28, 30], "mandat": 4, "paramet": [4, 10, 14, 15, 16, 20, 22, 23, 24, 25, 26, 30, 33], "mix": [4, 7], "i": [4, 7, 10, 28], "d": [4, 7, 28], "secur": [4, 6, 7, 15, 17, 28, 30, 32], "bcp": [4, 7, 28, 29], "endpoint": [4, 9, 10, 11, 14, 15, 17, 18, 19, 20, 22, 23, 24, 27, 29, 31, 32], "vot": 4, "vtm": 4, "thu": [4, 7], "aforement": 4, "within": [4, 10, 11, 18, 30], "recommend": [4, 5, 7, 29], "do": [4, 17, 26], "while": [4, 7, 26, 31], "at_hash": [4, 30], "subject": [4, 9, 10, 13, 16, 29, 31, 32, 33], "pairwis": [4, 10, 12, 22, 30], "nest": [4, 28, 30], "kei": [4, 5, 9, 10, 12, 14, 15, 16, 17, 22, 23, 25, 28, 29, 30, 31, 32], "encrypt": [4, 5, 7, 17, 18, 22, 23, 28, 30, 31, 33], "interchang": [4, 17, 28], "dynam": [4, 13, 15, 17, 21, 28, 31, 32], "automat": [4, 10, 12, 15, 23, 32], "scope": [4, 6, 12, 15, 16, 26, 30, 33], "offline_access": [4, 10, 12, 19, 22, 30], "other": [4, 9, 12, 17, 25, 31, 32], "doc": 4, "polici": [4, 11, 15, 17, 25, 29, 30, 31, 32], "regard": [4, 9, 10, 13, 21, 29, 32], "7": [4, 13, 15, 18, 28], "5": [4, 10, 15, 18, 28, 30, 31, 33], "distribut": 4, "modal": 4, "9068": [4, 28, 30], "particip": [5, 15, 18, 29, 32], "signatur": [5, 15, 16, 17, 20, 22, 23, 25, 28, 32], "length": [5, 17], "rsa": [5, 12, 33], "greater": [5, 30, 31], "2048": 5, "bit": 5, "A": [5, 9, 17, 18, 24, 26, 28, 29, 31], "4096": 5, "rs256": [5, 12, 30], "rfc7518": 5, "rs512": [5, 12], "oaep": [5, 12, 33], "256": [5, 12], "rfc7516": 5, "a128cbc": [5, 12], "hs256": [5, 12], "content": [5, 12, 16, 22, 23, 25, 30, 33], "a256cbc": [5, 12, 33], "hs512": [5, 12, 33], "es256": [5, 12], "es512": [5, 12], "ps256": [5, 12], "ps512": [5, 12], "ecdh": [5, 12], "es": [5, 9, 10, 12, 13, 29], "a128kw": [5, 12], "a256kw": [5, 12], "none": 5, "rsa_1_5": 5, "hs384": [5, 12], "between": [6, 9, 15, 17, 26, 27, 30, 31, 32], "offici": [6, 8, 17], "automatic_client_registr": 6, "explicit": [6, 7, 30], "rather": 6, "about": [6, 16, 17, 29, 30, 31], "reason": [6, 26, 30], "why": 6, "consider": [6, 10, 15], "sinc": 6, "don": [6, 26], "need": [6, 13, 17, 30], "addit": [6, 7, 9, 13, 31], "crit": 6, "likewis": 6, "naming_constraint": 6, "policy_language_crit": 6, "trust_anchor_id": 6, "presenc": [6, 7], "implic": 6, "ignor": 6, "until": [6, 26, 32], "futur": 6, "main": [7, 31], "th": 7, "enabl": [7, 17, 18, 30, 31], "featur": 7, "moreov": 7, "revocation_endpoint_auth_methods_support": [7, 10, 12, 22, 25], "mitig": 7, "against": [7, 15], "further": [7, 10, 17, 18, 26, 31], "long": [7, 30], "nell": 7, "whith": 7, "which": [7, 9, 13, 16, 17, 18, 25, 26, 27, 29, 30, 31, 32], "www": [7, 10, 12, 16, 22, 25, 27, 30], "spidl1": [7, 10, 12, 22, 30], "renew": [7, 26, 30, 32], "pre": [7, 27, 30], "exist": [7, 25, 27, 30, 32], "set": [7, 9, 30, 31], "phase": [7, 17, 19, 30], "given": [7, 23, 29, 30, 32], "dure": [7, 11, 17, 19, 29, 30, 31, 32], "still": [7, 13, 19, 25, 30], "revok": [7, 16, 19, 25, 30, 31], "link": [8, 25, 32], "onboard": [8, 17, 29, 31], "how": [8, 15, 26, 30, 31, 32], "ec": [9, 10, 20, 22, 23, 24, 28, 29, 31, 32], "itself": [9, 10, 23, 29, 30], "publish": [9, 10, 17, 18, 20, 22, 23, 24, 26, 27, 29, 31, 32], "web": [9, 12, 17, 23, 27, 28, 29, 30, 31, 32], "well": [9, 11, 12, 13, 17, 18, 25, 27, 31, 32], "known": [9, 11, 12, 13, 16, 17, 18, 27, 30, 32], "ess": [9, 13, 27], "tm": [9, 10, 13, 17, 26, 29, 31], "carri": 9, "out": [9, 25, 26, 31], "cryptograf": 9, "ones": 9, "latter": [9, 19], "jwk": [9, 10, 12, 18, 20, 22, 23, 26, 28], "7517": [9, 28], "part": [9, 17, 26, 28, 32], "schema": [9, 14, 23], "statement": [9, 13, 15, 17, 18, 29, 31, 32], "entity_typ": [9, 12, 31], "openid_relying_parti": [9, 10, 12, 23, 31], "openid_provid": [9, 10, 12, 22, 31], "federation_ent": [9, 12, 15, 20, 22, 23, 24], "oauth_authorization_serv": [9, 20], "oauth_resourc": [9, 15, 20], "previous": [9, 26, 30, 32], "leaf": [9, 17, 26, 27, 29, 31, 32], "authority_hint": [9, 12, 15, 32], "arrai": [9, 10, 23, 26, 29], "superior": [9, 10, 26, 29, 32], "ta": [9, 13, 15, 18, 21, 26, 29, 31, 32], "sa": [9, 13, 15, 17, 18, 21, 26, 27, 29, 31, 32], "trust_mark": [9, 10, 12], "mark": [9, 10, 11, 13, 15, 17, 27, 29, 32], "member": [9, 17, 26, 31, 32], "except": 9, "constraint": [9, 10, 12, 26], "chain": [9, 10, 11, 13, 18, 26, 29, 32], "bound": 9, "max_path_length": [9, 12, 26, 32], "maximum": [9, 15, 17, 32], "allowed_leaf_entity_typ": [9, 10], "restrict": [9, 10, 18, 23], "beneath": 9, "trust_marks_issu": [9, 12, 17, 31, 32], "trustworthi": 9, "basic": 10, "compon": 10, "trust": [10, 11, 13, 15, 17, 18, 21, 27, 28, 29, 32], "subordin": [10, 13, 17, 26, 27, 29, 31, 32], "data": [10, 17, 18, 28, 30, 31], "process": [10, 17, 26, 29, 30, 31, 32], "resolut": [10, 31], "fetch": [10, 12, 13, 29], "firma": 10, "configur": [10, 11, 13, 15, 18, 21, 22, 24, 26, 27, 29, 30, 31, 33], "appli": [10, 11, 26, 29, 30, 32], "intermedi": [10, 12, 15, 17, 21, 26, 29, 31, 32], "direct": [10, 13, 28, 30], "fed": [10, 13, 17, 18, 20, 21, 22, 23, 24, 27, 28, 29, 31], "metadata_polici": [10, 12], "anchor": [10, 15, 17, 21, 26, 29, 32], "respect": [10, 16, 21, 25], "descend": [10, 18], "cascad": 10, "openid_realying_parti": 10, "establish": [10, 17, 19, 26, 29, 31, 32], "subset_of": [10, 12], "grant_typ": [10, 12, 23, 30], "authorization_cod": [10, 12, 22, 23, 30], "refresh_token": [10, 12, 22, 23, 30], "id_token_signed_response_alg": [10, 12, 23], "id_token_encrypted_response_alg": [10, 12, 23, 30], "id_token_encrypted_response_enc": [10, 12, 23], "userinfo_signed_response_alg": [10, 12, 23], "userinfo_encrypted_response_alg": [10, 12, 23], "userinfo_encrypted_response_enc": [10, 12, 23], "token_endpoint_auth_method": [10, 12, 23], "one_of": [10, 12], "private_key_jwt": [10, 12, 20, 22, 23, 25, 26, 30], "client_registration_typ": [10, 12, 23], "aggreg": [10, 17, 27, 29, 31], "di": [10, 12, 28], "seguito": 10, "vengono": 10, "riportati": 10, "che": 10, "devono": 10, "esser": 10, "considerati": 10, "nel": 10, "parametro": 10, "tipo": 10, "interno": [10, 12, 31], "stabilisc": 10, "un": 10, "suo": 10, "discendent": 10, "diretto": 10, "operar": 10, "supportato": [10, 33], "deve": 10, "contener": 10, "del": [10, 12], "relativi": 10, "response_modes_support": [10, 12, 22], "form_post": [10, 12, 22], "grant_types_support": [10, 12, 20, 22], "spidl2": [10, 12, 22, 30], "spidl3": [10, 12, 22], "subject_types_support": [10, 12, 22], "id_token_signing_alg_values_support": [10, 12, 22], "id_token_encryption_alg_values_support": [10, 12, 22], "id_token_encryption_enc_values_support": [10, 12, 22], "userinfo_signing_alg_values_support": [10, 12, 22], "userinfo_encryption_alg_values_support": [10, 12, 22], "userinfo_encryption_enc_values_support": [10, 12, 22], "token_endpoint_auth_methods_support": [10, 12, 20], "token_endpoint_auth_signing_alg_values_support": [10, 12, 20], "claims_parameter_support": [10, 12], "true": [10, 12, 16, 31], "request_parameter_support": [10, 12], "authorization_response_iss_parameter_support": [10, 12], "client_registration_types_support": [10, 12], "request_authentication_methods_support": [10, 12], "request_object": [10, 12], "request_authentication_signing_alg_values_support": [10, 12], "give": [11, 13, 31], "erro": 11, "unreach": 11, "invalid_cli": [11, 30], "fail": [11, 30], "compliant": [11, 15, 27, 31], "incomplet": 11, "compli": [11, 29], "current": [11, 28, 30], "not_found": 11, "resourc": [11, 16, 20, 26, 27, 28, 29, 32, 33], "404": 11, "Not": 11, "head": 12, "sake": 12, "read": [12, 17], "host": [12, 16, 25, 30], "200": [12, 25, 30, 33], "ok": [12, 30, 33], "modifi": [12, 30, 33], "wed": [12, 30, 33], "22": [12, 30, 33], "jul": [12, 30, 33], "2018": [12, 28, 30, 33], "19": [12, 28, 30, 33], "15": [12, 30, 33], "56": [12, 30, 33], "gmt": [12, 30, 33], "2hnofs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 12, "1649590602": 12, "1649417862": 12, "kty": 12, "5s4qi": 12, "aqab": 12, "application_typ": 12, "sig": 12, "1ta": 12, "se": 12, "yhnfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 12, "client_nam": 12, "subject_typ": 12, "federation_resolve_endpoint": [12, 20, 22, 23, 24], "organization_nam": [12, 20, 22, 23, 24, 31], "pa": 12, "servic": [12, 15, 17, 26, 28, 30, 31], "homepage_uri": [12, 20, 22, 23, 24], "policy_uri": [12, 20, 22, 23, 24, 31], "logo_uri": [12, 20, 22, 23, 24, 31], "static": [12, 26, 31], "logo": [12, 20, 22, 23, 24, 31], "svg": [12, 20, 22, 23, 24], "tech": 12, "eyjh": 12, "db67gl7ck3tfiiaf7n6_7shvqk0mdymeqcogglkuaaw": [12, 30], "1649610249": 12, "1649437449": 12, "01_4a": 12, "authorization_endpoint": [12, 20, 22], "revocation_endpoint": [12, 22], "revoc": [12, 15, 19, 28, 30], "token_endpoint": [12, 20, 22], "userinfo_endpoint": [12, 22], "introspection_endpoint": [12, 22], "introspect": [12, 15, 28], "idp": 12, "claims_support": 12, "fanfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 12, "c": [12, 28], "lb": 12, "op_policy_uri": [12, 20], "websit": 12, "request_uri_parameter_support": 12, "require_request_uri_registr": 12, "rs384": 12, "es384": 12, "a192cbc": 12, "a128gcm": 12, "a192gcm": 12, "a256gcm": 12, "request_object_signing_alg_values_support": [12, 22], "em3cmnzghiyfsq090n6b3op7laaqj8rghmhxgmjstqg": 12, "1649631824": 12, "1649459024": 12, "aggregator": 12, "14aw": 12, "soggetto": 12, "federation_fetch_endpoint": [12, 24], "federation_list_endpoint": [12, 24], "esempio": 12, "trust_mark_issu": 12, "federation_status_endpoint": 12, "trust_mark_statu": 12, "full": [12, 18, 27, 31], "fifyx03bnosd8m6gyqifnhnp9cm_sam9tc5nlloiirc": 12, "1649375259": 12, "1649373279": 12, "3i5vv": 12, "_": 12, "federation_trust_mark_status_endpoint": [12, 20, 24], "1579621160": 12, "organization_typ": [12, 31], "id_cod": [12, 27, 31], "ipa_cod": [12, 27, 31], "123456": 12, "aoo_cod": [12, 27, 31], "uff_protocollo": 12, "email_or_pec": 12, "denominazion": 12, "ref": [12, 31], "documentazione_di_riferimento": 12, "1234567890": [12, 33], "sa_profil": [12, 31], "987654": 12, "1649623546": 12, "1649450746": 12, "superset_of": 12, "add": [12, 27, 30, 31], "eyjhb": 12, "1649355587": 12, "1649410329": 12, "5nnnofs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 12, "trust_chain": 12, "eyjhbgcioijsuzi1niisimtpzci6ims1nehrderpynlhy3m5wldwtwz2auhm": 12, "eyjhbgcioijsuzi1niisimtpzci6ikjydmzybg5oqu11sfiwn2fqvw1by0j": 12, "x": [12, 16, 25, 30], "urlencod": [12, 16, 25, 30], "2registri": 12, "2fopenid_relying_parti": 12, "2fpublic": 12, "2rp": 12, "qwjlme0xdbxrkxtm72eph659buxaxw80": 12, "eyjhbgcioijsuzi1niisimtpzci6ijjibm9guznzbkm5dgppq2fpdmhxtfzvsj": 12, "nbehdhr3pfoth1ukzhcu1frxmifq": 12, "eyjpc3mioijodhrwczovl3rydxn0lwfuy2hvci5va": 12, "wrjlwzlzgvyyxrpb24ub25saw5ll29pzgmvcnaviiwic2nvcguioijvcgvuawqilcjyzwr": 12, "pcmvjdf91cmkioijodhrwczovl3rydxn0lwfuy2hvci5vawrjlwzlzgvyyxrpb24ub25sa": 12, "w5ll29pzgmvcnavy2fsbgjhy2silcjyzxnwb25zzv90exblijoiy29kzsisim5vbmnlijo": 12, "ioxhntwc4nhpstg12ofjvrjg1rjj5wexmddq1u3zguxcilcjzdgf0zsi6inplatj6mnh4": 12, "jzyqufzuhm0eulxrzz2awpqndjytvphiiwiy2xpzw50x2lkijoiahr0chm6ly90cnvzdc1": 12, "hbmnob3iub2lkyy1mzwrlcmf0aw9ulm9ubgluzs9vawrjl3jwlyisimvuzhbvaw50ijoia": 12, "hr0chm6ly90cnvzdc1hbmnob3iub2lkyy1mzwrlcmf0aw9ulm9ubgluzs9vawrjl29wl2f": 12, "1dghvcml6yxrpb24ilcjhy3jfdmfsdwvzijoiahr0chm6ly93d3cuc3bpzc5nb3yuaxqvu": 12, "3bpzewyiiwiawf0ijoxnjg2ntc2oti2lcjlehaioje2ody1nzy5odysimp0asi6ijaxmjz": 12, "lzwrllwuwzjmtnde3my05nze3ltq0nzuymmi2nmi2nyisimf1zci6wyjodhrwczovl3ryd": 12, "xn0lwfuy2hvci5vawrjlwzlzgvyyxrpb24ub25saw5ll29pzgmvb3aviiwiahr0chm6ly9": 12, "0cnvzdc1hbmnob3iub2lkyy1mzwrlcmf0aw9ulm9ubgluzs9vawrjl29wl2f1dghvcml6i": 12, "xrpb24ixswiy2xhaw1zijp7imlkx3rva2vuijp7imdpdmvux25hbwuionsizxnzzw50awf": 12, "sijp0cnvlfswizw1hawwionsizxnzzw50awfsijp0cnvlfx0sinvzzxjpbmzvijp7imdpd": 12, "mvux25hbwuiom51bgwsimzhbwlsev9uyw1lijpudwxslcjlbwfpbci6bnvsbcwiahr0chm": 12, "6ly9hdhryawj1dgvzlnnwawquz292lml0l2zpc2nhbf9udw1izxiiom51bgx9fswichjvb": 12, "xb0ijoiy29uc2vudcbsb2dpbiisimnvzgvfy2hhbgxlbmdlijoidllobwrzcuntmw1tztj": 12, "hcuzkrfdwehlvdefpc3dlx0rfv0lnyuluchlotsisimnvzgvfy2hhbgxlbmdlx21ldghvz": 12, "ci6ilmyntyifq": 12, "r1ei1wep3p": 12, "8xfxewptev": 12, "tlyznbpnoiyk5z11oy7cvhurhexmmfmn": 12, "vyztwjqzrb92lsdmeaos3btfj_19s_l28o8mammjd5bo": 12, "obe8b_8rmny4uvcaynwzc6nvc": 12, "xngqymh1ujwhvwgguf_xo": 12, "8jvbwhv7cgjiwcrfax3h": 12, "zpyfqinhjh3nq9un2vk": 12, "fzvkl1i": 12, "urwvc4kupe4fzkhx": 12, "2fjre5kbkwpcw2ecmjgi": 12, "esg0zezukyhz5l3oupqdk": 12, "olg3gowbnm": 12, "ab6nkursijqxu1clregndiem4yn0m": 12, "segxlehs40iqds75e8imfybyqcq2lgu9pwf5gr7": 12, "isqd8a": 12, "mbzgqyf9qytd28eupywhsqmj78wnqpc2": [12, 30], "callback1": 12, "null": 12, "fyziol9lf2cekunt2jzxilrdink0upcd": 12, "6": [13, 15, 20, 22, 23], "resolv": [13, 15, 29, 32], "final": [13, 29, 32], "anoth": [13, 17, 26], "befor": [13, 17, 26, 29], "releas": [13, 14, 16, 17, 25, 26, 30, 31, 32, 33], "aa": [13, 20, 29, 31], "common": [13, 15, 28, 29], "like": 13, "entra": 14, "con": 14, "proof": [14, 17, 28], "exchang": [14, 18, 28], "refresh": [14, 15, 19, 25], "too": 14, "step": [14, 32], "pictur": [14, 32], "page": [14, 20, 22, 30, 32], "reli": [14, 15, 16, 21, 25, 29, 30], "parti": [14, 15, 16, 17, 21, 25, 26, 29, 30, 31], "button": [14, 32], "enter": [14, 30], "chose": 14, "prepar": 14, "hi": [14, 25], "expect": [14, 30], "thank": 15, "onlin": 15, "through": [15, 17, 19, 26, 29, 30, 31, 32, 33], "consolid": 15, "experi": 15, "integr": [15, 18], "practic": [15, 17, 28], "perform": [15, 32], "recogn": [15, 17, 30, 31, 32], "api": [15, 17], "european": [15, 18], "legisl": 15, "regulatori": [15, 17], "acronym": 15, "convent": [15, 17], "leav": [15, 26, 32], "retriev": 15, "error": [15, 32], "manag": [15, 29, 32], "logout": 15, "retent": 15, "log": [15, 25], "histor": 15, "unsupport": [15, 30], "deterr": 15, "abus": 15, "best": [15, 28], "special": 15, "upgrad": 15, "strategi": 15, "intermediari": 15, "becom": [15, 17], "contribut": 15, "possess": [16, 25, 28, 30], "rfc7662": [16, 28], "oauth2": [16, 29, 30], "03": [16, 30, 33], "togeth": [16, 25], "assert": [16, 25, 30], "client_assert": [16, 25, 30], "eyjhbgcioijiuzi1niisinr5cci6ikpxvcj9": [16, 25, 30], "eyjzdwiioiixmjm0nty3odkwiiw": [16, 25, 30], "ibmftzsi6ilnqsuqilcjhzg1pbii6dhj1zx0": [16, 25, 30], "lvyrdpvjm0s9q7oixcyviiqgwy0wwqlqxvfgyswlf88": [16, 25], "client_assertion_typ": [16, 25, 30], "urn": [16, 25, 30], "3aietf": [16, 25, 30], "3aparam": [16, 25, 30], "3aoauth": [16, 25, 30], "3aclient": [16, 25, 30], "3ajwtbear": [16, 25, 30], "2frp": [16, 25], "eyjhbgcioijsuzi1nij9": [16, 25], "eyjlehaioje0mtg3mdi0mtqsimf1zci6wyjlnzfmyjcyys05nzrmlt": [16, 25], "qwmdetymniny1lnjdjmmjjmdazn2yixswiaxnzijoiahr0chm6xc9cl2fzlxzhlmv4yw1wbguuy29txc8": [16, 25], "ilcjqdgkioiiymwixntk2zc04nwqzltqzn2mtywq4my1im2yyy2uyndcyndqilcjpyxqioje0mtg2otg4": [16, 25], "mtr9": [16, 25], "fxdtezdlbthzfnrow7w27rlk5m0wprfffh7h4bdfw5fr3pwiqejkmdfabjvn3_yfaokbv06we5ra": [16, 25], "rjubdjmfffrrw23cmbpgqcik7nq4l012x_1j4iewoqxxmltywqq_bcbmjcw3mtpry1aoocfbojpx1k2jw": [16, 25], "rkytyvtlwlff6s5gkciyf3b0badjoqehd_ivssiph3xubjkmtkrtlfwr0q0pdpeyvepkmsi28xzvdagnxa4j7qi5lozyeyzgr9": [16, 25], "h70xqlvzqwwl1p0": [16, 25], "f_0jadfmjfo1yl4iexfpozzsb3hhf2vfdl6d_llehryh2g2ozf59emism_ccs4g47862w": [16, 25], "plu": 16, "param": [16, 25, 30], "clientassert": [16, 25], "bearer": [16, 25, 30, 33], "unqu": 16, "respond": 16, "expir": [16, 25, 30], "never": 16, "call": [16, 30], "fals": 16, "locat": [16, 29], "infrastructur": [17, 28], "mani": [17, 26], "framework": 17, "mechan": [17, 18, 19, 26, 30], "administr": [17, 26, 31], "stipul": 17, "accredit": 17, "technolog": 17, "interoper": [17, 26, 29, 31], "appropri": [17, 30], "citizen": 17, "who": [17, 30, 31], "certifi": [17, 20, 22, 23, 24, 29], "interior": [17, 29], "extend": [17, 21], "function": [17, 19, 29, 30], "achiev": [17, 32], "solid": 17, "good": 17, "first": [17, 27, 31, 32], "suppli": [17, 31], "These": [17, 30], "disabl": [17, 30], "everi": [17, 26, 30], "moment": [17, 31], "stop": [17, 26, 32], "scalabl": 17, "reduc": 17, "significantli": 17, "cost": 17, "deleg": 17, "principl": 17, "institut": [17, 20, 22, 23, 24, 29, 31], "transpar": [17, 27], "alwai": [17, 30], "toward": [17, 31, 32], "furthermor": 17, "navig": [17, 26], "tree": 17, "go": [17, 25], "turn": [17, 26, 27, 31], "path": [17, 26, 27, 32], "keep": [17, 30, 31], "daili": 17, "basi": 17, "max_path": 17, "here": 17, "webpath": 17, "complet": [17, 31], "procedur": [17, 26, 29, 30, 32], "updat": [17, 26, 29, 32], "preexist": 17, "membership": 17, "retain": 18, "transact": [18, 28], "store": 18, "being": 18, "authenticationrequest": 18, "authenticationrespons": 18, "tokenrequest": 18, "tokenrespons": 18, "userinforequest": 18, "userinforespons": 18, "revocationrequest": 18, "revocationrespons": 18, "index": 18, "research": 18, "consult": 18, "purpos": [18, 19], "jti": [18, 30], "less": 18, "privaci": [18, 31], "design": 18, "personnel": 18, "confidenti": 18, "emploi": 18, "databas": 18, "dbm": 18, "realiz": 18, "persist": 18, "repudi": 18, "properti": 18, "verif": [18, 30], "histori": 18, "remov": [18, 26], "individu": 19, "instaur": 19, "delet": 19, "protect": [20, 33], "8414": [20, 22, 28], "lg": 20, "8623": 20, "op_tos_uri": 20, "dpop_signing_alg_values_support": 20, "dpop": 20, "rs": [20, 29], "One": 20, "discoveri": [21, 22, 26, 28, 29, 32], "op_metadata": 22, "oid": 22, "jwks_uri": 22, "clientmetadata": 23, "declar": 23, "custom": 23, "myapp": 23, "her": 25, "decid": [25, 26], "kept": 25, "rfc7009": [25, 28], "answer": 25, "though": 25, "filter": [26, 31], "consumpt": 26, "suffer": 26, "high": 26, "fake": 26, "try": 26, "third": 26, "priori": 26, "exclud": 26, "whenev": [26, 30], "consequ": [26, 31], "kind": [26, 27], "relationship": 26, "vertic": [26, 32], "root": [26, 29], "mean": [26, 29], "belong": [26, 31], "analysi": 26, "introduc": 26, "horizont": 26, "model": 26, "tri": 26, "shortest": 26, "move": 26, "upward": 26, "threshold": [26, 32], "exceed": [26, 32], "limit": 26, "becaus": [26, 30, 32], "take": [26, 32], "element": [26, 28, 31, 32], "exagger": 26, "excess": 26, "trigger": 26, "arriv": 26, "among": [26, 29, 31, 32], "work": [26, 28, 31, 32], "calcul": [26, 30, 32], "preserv": 26, "chang": 26, "run": 26, "onc": [26, 32], "again": [26, 30], "previou": [26, 30], "Or": 26, "wai": [26, 31, 32], "durat": [26, 30, 31], "certain": 26, "old": 26, "top": [26, 31], "mask": 27, "behind": 27, "light": [27, 31], "second": [27, 30], "proxi": 27, "arrang": 27, "behalf": [27, 29], "usual": 27, "sa_domain": 27, "outlin": 27, "authz": 27, "varlei": 28, "m": [28, 29], "grassi": 28, "p": 28, "sakimura": [28, 29], "bradlei": [28, 29], "j": [28, 29], "jone": [28, 29], "de": 28, "medeiro": 28, "b": 28, "mortimor": 28, "august": 28, "2015": [28, 29], "novemb": 28, "jai": 28, "2119": [28, 29], "bradner": 28, "march": 28, "1997": 28, "2616": [28, 33], "r": 28, "getti": 28, "mogul": 28, "frystyk": 28, "h": 28, "masint": 28, "leach": 28, "berner": 28, "lee": 28, "hypertext": 28, "june": 28, "1999": 28, "3339": 28, "klyne": 28, "newman": 28, "internet": 28, "doi": [28, 29], "17487": [28, 29], "rfc3339": 28, "juli": 28, "3986": [28, 32], "syntax": 28, "7009": 28, "lodderstedt": 28, "dronia": 28, "scurtescu": 28, "7159": 28, "brai": 28, "javascript": 28, "notat": [28, 29], "7515": [28, 29, 31], "jw": [28, 33], "rfc7515": 28, "hildebrand": 28, "jwe": [28, 33], "rfc7517": 28, "7518": 28, "jwa": 28, "rfc7519": [28, 29], "7523": 28, "campbel": 28, "martimor": 28, "grant": 28, "agarw": 28, "rfc7636": 28, "septemb": 28, "thumbprint": 28, "rfc7638": 28, "7662": 28, "richer": 28, "7591": 28, "ed": 28, "machulak": 28, "hunt": 28, "rfc7591": 28, "7800": 28, "tschofenig": 28, "semant": 28, "rfc7800": 28, "april": 28, "2016": 28, "8174": [28, 29], "leiba": 28, "ambigu": 28, "uppercas": 28, "vs": 28, "lowercas": 28, "rfc8174": 28, "2017": 28, "server": [28, 29, 30], "rfc8414": 28, "8725": 28, "hardt": 28, "sheffer": 28, "y": 28, "februari": 28, "2020": 28, "bertocci": 28, "v": 28, "rfc9068": 28, "resp": 28, "selhausen": 28, "k": 28, "z": 28, "fett": 28, "progress": 28, "januari": 28, "labunet": 28, "decemb": 28, "yusef": 28, "shekh": 28, "marco": 28, "embed": 28, "en319": 28, "esi": 28, "e164": 28, "telecommun": 28, "union": 28, "164": 28, "plan": 28, "2010": 28, "iso": 28, "8601": 28, "represent": [28, 30], "icao": 28, "doc9303": 28, "civil": 28, "aviat": 28, "machin": 28, "readabl": 28, "travel": 28, "seventh": 28, "edit": 28, "mrtd": 28, "iso3166": 28, "3166": 28, "subdivis": 28, "cad": 28, "dl": 28, "2005": 28, "82": 28, "codic": 28, "dell": 28, "amministrazion": 28, "gu": 28, "seri": 28, "general": 28, "112": 28, "16": 28, "suppl": 28, "ordinario": 28, "93": 28, "semplificazioni": 28, "76": 28, "misur": 28, "urgenti": 28, "la": 28, "semplificazion": 28, "innovazion": 28, "20a04921": 28, "228": 28, "33": 28, "convers": 28, "law": 28, "amend": 28, "120": 28, "eu": 28, "No": 28, "910": 28, "parliament": 28, "council": 28, "market": 28, "repeal": 28, "dm": 28, "210": 28, "modalit\u00e0": 28, "emission": 28, "carta": 28, "identit\u00e0": 28, "elettronica": 28, "15a09809": 28, "30": [28, 30], "12": 28, "section_1": 29, "fedetarion": 29, "handl": 29, "funcion": 29, "facilit": 29, "self": 29, "recogniz": [29, 31, 32], "etc": 29, "aquir": 29, "share": 29, "subset": 29, "hint": 29, "collect": [29, 30], "whose": [29, 31, 33], "posit": [29, 31], "throughout": 29, "text": 29, "cieid": 29, "card": 29, "mint": 29, "polygraph": 29, "ipz": 29, "fa": 29, "mininterno": [29, 31], "handler": 29, "attribu": 29, "keyword": 29, "le": 29, "cut": 29, "off": 29, "editor": 29, "base64url": [29, 30], "denot": 29, "safe": 29, "pad": 29, "succesful": 30, "clientauthent": 30, "tokenendpoint": 30, "below": [30, 32, 33], "lvyrdpvjm0s9q7oixcyviiqgwy0wwqlqxvfgyswl": 30, "usdwmnezjppg5oav8x3j": 30, "9g8s40mozm3nsqjhnhi7onse38jklfv2": 30, "rpauthent": 30, "8xloxbtzp8": 30, "uuid4": 30, "eg": 30, "jwtbearer": 30, "next": 30, "access_token": 30, "dc34pf6kdg": 30, "token_typ": 30, "wj848bcylp": 30, "expires_in": 30, "1800": 30, "id_token": 30, "eyjzdwiioiixmjm0nti": 30, "expiti": 30, "9sd798asd98asui23hiuds89y798sfyg": 30, "9ea42af0": 30, "594c": 30, "4486": 30, "9602": 30, "8a1f8dde42d3": 30, "1656859559": 30, "1656857579": 30, "subjectidtyp": 30, "prevent": 30, "reus": 30, "reject": [30, 32], "execut": 30, "cty": [30, 33], "qiyh4xpjgsoz2meaylkfwqeq": 30, "1519032969": [30, 33], "nbf": [30, 33], "1519033149": [30, 33], "nw4j0zmwrk4krbq53g7z": 30, "effect": 30, "codeidtoken": 30, "Its": 30, "left": 30, "most": 30, "half": 30, "octet": 30, "ascii": 30, "begin": 30, "idtoken": 30, "interact": 30, "To": 30, "scenario": [30, 31], "notif": 30, "neither": 30, "nor": 30, "abil": 30, "condit": 30, "treatment": 30, "sm": 30, "app": 30, "legitim": 30, "therefor": 30, "acquisit": 30, "along": 30, "rotat": [30, 31], "origin": 30, "notwithstand": 30, "approach": 30, "consensu": 30, "t1": 30, "rt1": 30, "30gg": 30, "t2": 30, "4gg": 30, "rt2": 30, "t3": 30, "32gg": 30, "28gg": 30, "submit": [30, 31], "rt3": 30, "t4": 30, "64gg": 30, "longer": 30, "unknown": 30, "401": 30, "unauthor": 30, "unsupported_grant_typ": 30, "invalid_gr": 30, "500": 30, "unavail": 30, "agreement": 31, "context": 31, "typic": 31, "ipa": 31, "forth": 31, "done": 31, "essenti": 31, "absenc": 31, "structur": 31, "entity_rol": 31, "trustmark_profil": 31, "sector": 31, "tos_uri": 31, "info": 31, "service_document": 31, "oas3": 31, "exclus": 31, "point": 31, "ogran": 31, "uo_cod": 31, "explain": 32, "save": 32, "associ": 32, "lowest": 32, "period": 32, "simplifi": 32, "occur": 32, "perspect": 32, "extract": 32, "refus": 32, "successfulli": 32, "ore": 32, "reach": 32, "directli": 32, "besid": 32, "either": 32, "download": 32, "append": 32, "servizi": 32, "slash": 32, "6750": 33, "eyjhbgcioijsuzi1niisimtpzci6imrcnjdntddja": 33, "bodi": 33, "explicitli": 33, "enc": 33, "hivo33": 33, "km7n03zqkdjfwvnlfudsw28yhqzx5eaxtaka": 33, "fornitore_identita": 33, "fornitore_servizio": 33, "rossi": 33, "mroxxxxxxxxxxxxx": 33, "descrizion": 33, "recipi": 33}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"user": 0, "attribut": [0, 20], "exampl": [0, 12], "author": [1, 7, 12, 20], "endpoint": [1, 7, 12, 13, 16, 25, 26, 30, 33], "request": [1, 12, 16, 25, 30, 33], "paramet": [1, 7], "scope": [1, 7], "claim": [1, 6, 7, 9], "spid": [1, 2, 7, 15, 18, 25, 28, 30, 33], "icon": [1, 18, 19, 25, 30, 33], "cieid": [1, 19, 25, 30, 33], "respons": [1, 12, 16, 25, 30, 33], "error": [1, 11, 16, 25, 30, 33], "manag": [1, 11, 18], "code": [1, 11, 16, 25, 30, 33], "regulatori": [2, 28], "refer": [2, 28], "how": [3, 17], "contribut": 3, "differ": [4, 6, 7], "oidc": [4, 6], "igov": 4, "cryptograph": 5, "algorithm": 5, "feder": [6, 11, 13, 17, 18, 26], "client": 6, "registr": 6, "trust": [6, 9, 12, 24, 26, 31], "mark": [6, 12, 26, 31], "unsupport": 6, "entiti": [6, 9, 10, 12, 27, 32], "statement": [6, 10, 12], "between": 7, "e": 7, "cie": [7, 15, 28], "id": [7, 28, 30], "metadata": [7, 10, 12, 20, 21, 22, 23, 24, 26, 32], "token": [7, 30], "refresh": [7, 30], "userinfo": [7, 33], "introspect": [7, 16], "revoc": [7, 25, 31], "logout": [7, 19], "becom": 8, "servic": 8, "provid": [8, 12, 22, 32], "configur": [9, 12, 17, 32], "signatur": [9, 10], "common": 9, "leav": 9, "intermedi": [9, 24, 27], "anchor": [9, 12, 24], "polici": [10, 12, 18], "ta": [10, 12, 24], "rp": [10, 12, 18, 23], "sa": [10, 12, 24], "op": [10, 18, 22], "en": 12, "1": 12, "reli": [12, 23, 32], "parti": [12, 23, 32], "2": 12, "openid": [12, 15, 17, 22, 23, 26, 32], "3": 12, "intermediari": 12, "4": 12, "5": 12, "issu": 12, "6": 12, "7": 12, "list": 12, "resolv": [12, 26], "statu": 12, "authent": 14, "flow": 14, "connect": [15, 17, 22, 23], "index": 15, "content": 15, "The": 17, "italian": 17, "eid": 17, "particip": 17, "retent": 18, "log": 18, "an": 18, "histor": 18, "kei": [18, 26], "registri": 18, "secur": 26, "consider": 26, "deterr": 26, "against": 26, "abus": 26, "maximum": 26, "number": 26, "authority_hint": 26, "best": 26, "practic": 26, "special": 26, "core": 26, "public": 26, "upgrad": 26, "strategi": 26, "technic": 28, "nation": 28, "european": 28, "legisl": 28, "term": 29, "acronym": 29, "convent": 29, "norm": 29, "access": [30, 32], "valid": [30, 31], "period": 30, "federation_ent": 31, "oauth_resourc": 31, "composit": 31, "retriev": 32}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1, "sphinx.ext.todo": 2, "sphinx": 56}}) \ No newline at end of file diff --git a/en/seccons_bcps.html b/en/seccons_bcps.html new file mode 100644 index 00000000..a7866ac2 --- /dev/null +++ b/en/seccons_bcps.html @@ -0,0 +1,1387 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Security Considerations + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Security Considerations

    +

    In this section we describe some security considerations in the OIDC Federation scope.

    +
    +

    Trust Marks as deterrent against abuses

    +

    The TM implementation and the filter on the TMs in the process of Federation Entity Discovery, turn out to be necessary +against attacks aimed at the resource consumption. If an OP suffers an attack at the authorization endpoint and the attack consists of an high number of connections with fake client_id and authority_hints, then the OP, trying to find a path to the TA for establishing the trust with the requester, would produce several connections to third-party systems.

    +

    The OP MUST statically validate the TM or a-priori exclude the request whenever the TM is not present. +In case the TM is not present or not valid, the procedure of Federation Entity Discovery MUST NOT +be started and consequently MUST NOT create connections to third party systems.

    +
    +
    +

    Maximum Number of authority_hints

    +

    Inside a Federation, through the constraint named max_path_length, the Trust Anchor decides how many Intermediates are allowed between it and the Leaves. This kind of relationship is vertical, from the Leaf to the root. As an example, if this attribute has the value equal to 1, it means that only one SA is allowed between a Leaf and the TA.

    +

    Every Leaf MUST publish its superiors inside the list contained in the claim authority_hints. A Leaf in the Federation MAY have superiors belonging to different Federations. The analysis of the available superiors introduces an horizontal navigation model. As an example, an OP tries to find the shortest path to the Trust Anchor through all the URLs contained in the array authority_hints, before doing a further vertical move upwards, to one of the Intermediates that are present in this array.

    +

    The threshold max_path_length is applied to the vertical navigation and, after exceeding this threshold without finding a TA, the procedure of Federation Entity Discovery MUST be stopped. Consider the example of an RP that's a subordinate of an SA that's in turn a subordinate of another SA, while the max_path_length claim is equal to 1 and, after exceeding this threshold without finding the Trust Anchor, the procedure MUST be stopped.

    +

    At the same time, the specifications of OIDC Federation 1.0 don't define a limit of the number of authority_hints, and this is because no TA can limit the number of Federations in which a member can take part. For this reason, it is useful that implementers adopt a maximum limit to the number of elements allowed inside the array authority_hints. The reason is avoiding that an exaggerated number of URLs contained in the list authority_hints, due to a bad configuration of a Leaf, produce an excessive resource consumption.

    +
    +
    +

    Resolve endpoint

    +

    This endpoint MUST release the Metadata, the Trust Marks and the previously processed Trust Chain, and MUST +NOT trigger a procedure of Federation Entity Discovery for each request arrival, unless this endpoint is secured with a client authentication mechanism, such as private_key_jwt [OIDC-CORE]. When using private_key_jwt the value in the sub parameter of the private_key_jwt MUST match the value sub in the request to the Resolve endpoint.

    +
    +
    +
    +

    Best Practices

    +

    In this section we describe some best practices.

    +
    +

    Specializing the OpenID Core and Federation public keys

    +

    It is a best practice to use public keys that are specialized for the two kinds of operations, Core and Federation.

    +
    +
    +

    Upgrading strategy of the OpenID Metadata

    +

    The interoperability among members works through the Metadata obtained from the Trust Chain calculation and preservation. This means that if an OP at the time T calculates the Trust Chain for an RP and this, at the time T+n, changes its own Metadata, the OP could consequently run into problems of validating the RP authorization requests, until the OP will have once again updated the RP-related Trust Chain.

    +

    A best practice to avoid service stops on the OIDC Core operations, is adding the new public keys inside the objects jwks without removing the previous values. Or, for example, the new redirect_uri.

    +

    In this way, after exceeding the maximum duration limit of the Trust Chain, defined in the claim exp and published in the TA Entity Configuration, it is certain that all the members have renewed their Trust Chain and it is possible, for the Leaf administrators, to remove the old definitions from the top of the list.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/soggetti_aggregatori.html b/en/soggetti_aggregatori.html new file mode 100644 index 00000000..63a3e86e --- /dev/null +++ b/en/soggetti_aggregatori.html @@ -0,0 +1,1395 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Intermediate Entities + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Intermediate Entities

    +

    An Intermediate Entity (SA) can register pre-existing RPs that are compliant to the OIDC-FED standard or mask their subordinates behind it. In the first case, the SA is of type Transparent (Light Aggregator), and in the second case it is of type Proxy (Full Aggregator)

    +

    The Light SAs register pre-existing RPs that are compliant to OIDC-FED and publishes the ESs referred to them.

    +

    The Full SAs arrange building an authentication and federation interface, on behalf of their own subordinates, by using web resources that are usually exposed inside their own domain. This kind of SAs expose for each of their subordinates, the following resources:

    +
    +
      +
    • .well-known/openid-federation, containing the Leaf's Entity Configuration;

    • +
    • Authorization callback endpoint for obtaining the auth code by the OP (redirect_uri).

    • +
    +
    +

    The Full type SAs MUST add at least one of the available identification code in the id_code (as defined in the Section Trust Mark Composition) inside the web path, which in turn is inside the client_id that identifies the subordinate Entity <SA_domain>/<id_code>/. If more than one identification code is available, the SA MAY include them in the web path as in the following example: <SA_domain>/ipa_code/aoo_code/.

    +

    The following table contains some non-normative examples for outlining the differences between the SAs of +types Light and Full:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Mode Light

    Mode Full

    client_id

    https://www.rp.it/

    https://www.sa.it/<id_code>/

    redirect_uri

    https://www.rp.it/callback/

    https://www.sa.it/<id_code>/callback/

    authz endpoint

    https://www.rp.it/authorization/

    https://www.sa.it/<id_code>/authorization/

    Entity Configuration

    https://www.rp.it/.well-known/openid-federation

    https://www.sa.it/<id_code>/.well-known/openid-federation

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/standards.html b/en/standards.html new file mode 100644 index 00000000..f289e6ee --- /dev/null +++ b/en/standards.html @@ -0,0 +1,1546 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | References + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    References

    +
    +

    Technical references

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    OIDC-FED

    OpenID Connect Federation 1.0

    iGov.OIDC

    Varley, M., Grassi, P. "iGov Profile for OpenID Connect", October 2018.

    OpenID.Core

    Sakimura, N., Bradley, J., Jones, M., de Medeiros, B. and C. Mortimore, "OpenID Connect Core 1.0", August 2015.

    OpenID.Registration

    Sakimura, N., Bradley, J., and M. Jones, "OpenID Connect Dynamic Client Registration 1.0," November 2014.

    OpenID.Discovery

    Sakimura, N., Bradley, J., Jones, M., and E. Jay, "OpenID Connect Discovery 1.0," November 2014.

    RFC 2119

    Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels," BCP 14, RFC 2119, March 1997.

    RFC 2616

    Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, “Hypertext Transfer Protocol -- HTTP/1.1,” RFC 2616, June 1999.

    RFC 3339

    Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002.

    RFC 3986

    Uniform Resource Identifier (URI): Generic Syntax

    RFC 7009

    Lodderstedt, T., Dronia, S., Scurtescu, M., “OAuth 2.0 Token Revocation,” RFC7009, August 2013.

    RFC 7159

    Bray, T., “The JavaScript Object Notation (JSON) Data Interchange Format,” RFC 7159, March 2014.

    RFC 7515

    Jones, M., Bradley, J. and N. Sakimura, "JSON Web Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May 2015.

    RFC 7516

    Jones, M., Hildebrand, J., "JSON Web Encryption (JWE)", May 2015.

    RFC 7517

    Jones, M., "JSON Web Key (JWK)", RFC 7517, DOI 10.17487/RFC7517, May 2015.

    RFC 7518

    Jones, M., "JSON Web Algorithms (JWA)", May 2015.

    RFC 7519

    Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015.

    RFC 7523

    Jones, M., Campbell, B., Martimore, C., “JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants”, May 2015.

    RFC 7636

    Sakimura, N., Bradley, J. and N. Agarwal, "Proof Key for Code Exchange by OAuth Public Clients", RFC 7636, DOI 10.17487/RFC7636, September 2015.

    RFC 7638

    Jones, M., Sakimura, N., “JSON Web Key (JWK) Thumbprint,”RFC7638, September 2015.

    RFC 7662

    Richer, J., "OAuth 2.0 Token Introspection", RFC 7662, DOI 10.17487/RFC7662, October 2015.

    RFC 7591

    Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol", RFC 7591, DOI 10.17487/RFC7591, July 2015.

    RFC 7800

    Jones, M., Bradley, J. and H. Tschofenig, "Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)", RFC 7800, DOI 10.17487/RFC7800, April 2016.

    RFC 8174

    Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", RFC 8174, DOI 10.17487/RFC8174, May 2017.

    RFC 8414

    Jones, M., Sakimura, N., and J. Bradley, "OAuth 2.0 Authorization Server Metadata", RFC 8414, DOI 10.17487/RFC8414, June 2018.

    RFC 8725

    Jones, M., D. Hardt, Sheffer, Y., "JSON Web Token Best Current Practices", February 2020.

    RFC 9068

    Bertocci, V., “JSON Web Token (JWT) Profile for OAuth 2.0 Access Token,” RFC9068, October 2021.

    I-D.ietf-oauth-iss-auth-resp

    Selhausen, K. M. Z. and D. Fett, "OAuth 2.0 Authorization Server Issuer Identification", Work in Progress, Internet-Draft, Draft-5, January 2022.

    I-D.ietf-OAuth-Security-BCP

    Lodderstedt, T., Bradley, J., Labunets, A., Fett, D., “OAuth 2.0 Security Best Current Practice”, Draft-19, December 2021.

    draft-yusef-oauth-nested-jwt

    Shekh-Yusef, R., Hardt, D., De Marco, G., “JSON Web Token (JWT) Embedded Tokens”, Draft-06, December 2022.

    EN319-412-1

    Electronic Signatures and Infrastructures (ESI); Certificate Profiles;

    E164

    International Telecommunication Union, "E.164: The international public telecommunication numbering plan," 2010.

    ISO8601-2004

    International Organization for Standardization, "ISO 8601:2004. Data elements and interchange formats +- Information interchange - Representation of dates and times," 2004.

    ICAO-Doc9303

    INTERNATIONAL CIVIL AVIATION ORGANIZATION, "Machine Readable Travel Documents, Seventh Edition, 2015, +Part 3: Specifications Common to all MRTDs", 2015

    ISO3166

    ISO, "ISO 3166-1:1997. Codes for the representation of names of countries and their subdivisions

    +
    +
    +
    +

    National and European legislation

    + ++++ + + + + + + + + + + + +

    CAD

    DL 7 March 2005 n.82: "Codice dell'amministrazione digitale." (GU Serie Generale n.112 16-05-2005 - Suppl. Ordinario n. 93)

    DL-SEMPLIFICAZIONI

    DL 16 July 2020 n.76: "Misure urgenti per la semplificazione e l'innovazione digitale." (20A04921) (GU Serie Generale n.228 14-09-2020 - Suppl. Ordinario n. 33) and its conversion into Law, with amendments, Law 11 September 2020 n. 120.

    EIDAS

    Regulation (Eu) No 910/2014 of the European Parliament and of the Council 23 July 2014 "on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC."

    +
    +

    SPID regulatory references

    +

    The SPID System start-up, for its nature and complexity, can require interventions on different aspects +with specifyings, clarifications, information notes and case studies, in order to provide support for a better +application and understanding of the SPID Regulations, already issued by AgID in compliancy to what prescribed +by the art. 4 of the DPCM 24 October 2014.

    +

    In order to organically gather such interventions and attribute them a character that involve application commitment by the involved actors in the SPID System, be they public or private, the present section "SPID Announcements" has been created, aimed at ensuring a uniform interpretation of the rules, the technical +aspects and what else might be necessary for the correct System operation as a whole.

    +

    The present technical rules implement the following SPID announcements:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Announcement

    Reference

    Date

    LL.GG. OpenID Connect in SPID

    LL.GG. OpenID Connect in SPID

    24/11/2021

    Avviso n.41

    Avviso n.41 v2 - Integrazione LL.GG. OpenID Connect in SPID.pdf

    06/05/2022

    Tabella Attributi utente v1.3

    Tabella Attributi in SPID - Integrazione LL.GG. OpenID Connect in SPID.pdf

    24/06/2022

    Determina SPID OpenID Connect Federation

    Regole tecniche per il funzionamento della Federazione SPID OpenID Connect - Integrazione LL.GG. OpenID Connect in SPID.pdf -

    14/09/2022

    Linee Guida Attribute Authority SPID

    SPID Attribute Authority Guidelines

    18/07/2022

    +
    +
    +

    CIE id References

    + ++++ + + + + + +

    DM-CIE

    DM 23 December 2015 n.210: "Modalità tecniche di emissione della Carta d'identità elettronica." (15A09809) (GU Serie Generale n.302 30-12-2015)

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/termini_acronimi.html b/en/termini_acronimi.html new file mode 100644 index 00000000..aa5e39dd --- /dev/null +++ b/en/termini_acronimi.html @@ -0,0 +1,1502 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Terms and Acronyms + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Terms and Acronyms

    +
    +

    Terms

    +

    Terms used by OIDC-FED#Section_1.2 and this documentation.

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Fedetarion Authority

    A legal Entity that handles the trust among the parties involved in the Federation, regulates the +funcional aspects and the onboarding procedures.

    Trust Anchor

    Entity handled by the Federation Authority that represents the Federation, its configuration and the trust root.

    Intermediate Entity or Intermediate

    An Intermediate Entity (SA), facilitates the onboarding process in the Federation and MAY handle the functionalities on behalf of its subordinate (aggregated) Entities. Inside the Federation, the Intermediate publishes its configuration and the Entity statements of its subordinates, according to the rules defined by Fedetarion Authority.

    Leaf Entity or Leaf

    Entity defined by OpenID Connect as Relying Party and OpenID Provider. It could also be an Attribute Authority (OAuth2 Authorization Server and Resource Server).

    Entity

    Participant to the the Federation. It may be a Trust Anchor, Intermediate or Leaf.

    Entity Configuration

    Federation metadata issued by an Entity about itself, in the form of a self-signed JWT RFC 7515. It contains the public Federation's signing keys, the OIDC metadata, the URLs of its superiors authorities and the Trust Marks issued by authorities that are recognizable inside the Federation and that certify the Entity's compliance to specific profiles.

    Entity Statement

    Statement issued by a superior Entity (Trust Anchor or Intermediate) regarding +a subordinate subject (RP, OP or Intermediate), in the form of a signed JWT RFC 7515, containing +the public key of the Entity, the Trust Marks issued by the Entity itself and the Metadata policy +to be applied to the subject's Metadata.

    Trust Mark

    JWT RFC 7515 signed by a Trust Mark issuer about an Entity. It certifies that the +Entity complies with profiles that are recognizable inside the Federation (public of private RP, public or private Intermediate Entity, etc.). A Leaf that aquires a Trust Mark during an Onboarding process, MUST include it in its Entity Configuration.

    Metadata

    A Metadata document describes the implementation of an OpenID Connect or OAuth2 Entity. The implementations +of all the Entities share the Metadata to establish a common method of trust and interoperability.

    Metadata policy

    The Trust Anchor publishes rules and policies to be applied to the subordinates' Metadata, +specifying what values and values subsets are allowed for a given Metadata claim.

    Authority hint

    An array of URLs containing the identifiers of the superior Entities, Trust Anchor or +Intermediate, that MUST issue an Entity Statement for their own subordinates.

    Federation Entity Discovery

    Collection of Entity Configuration / Statements, from a Leaf Entity up to the Trust Anchor

    Trust Chain

    Validation Procedure of the sequence of Entity Configuration / Statements that have +been collected through the Federation Entity Discovery, +whose positive result is a final Metadata regarding +an Entity, and the expiry date before which it must be updated.

    Onboarding

    Registration Procedure of a new Entity inside the SPID and CIE Federations.

    Federation Endpoint

    Endpoints defined in OIDC Federation 1.0, used to fetch and resolve Entity statements, query a list of all the subordinate Entities and check the trust mark status.

    +
    +
    +

    Acronyms

    +

    In this section are defined all the acronyms that are used throughout the text.

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    SPID

    Italian Public System of Digital Identity, whose Federation Authority is AgID (Agenzia per L'Italia Digitale).

    CIEid

    Italian Digital Identity System based on the Electronic ID Card (CIE), whose Federation Authority is the +Ministry of the Interior. The technical and operative management is given to the State Mint and Polygraphic Institute (IPZS).

    OIDC

    OpenID Connect.

    OIDC-FED

    OIDC Federation 1.0.

    FA

    Federation Authority.

    TA

    OIDC Federation Trust Anchor.

    AgID

    Agenzia per l'Italia Digitale, FA/TA of SPID.

    MinInterno

    Ministry of Interior, FA/TA of CIE id.

    OP

    OpenID Provider (Leaf Entity).

    RP

    Relying Party (Leaf Entity).

    SA

    Intermediate Entity or Intermediate. An intermediate Entity that can handle all the Federation +aspects of one or more RPs.

    AA

    Attribute Authority, handler of the qualified attribues (Leaf Entity).

    TM

    Trust Mark.

    EC

    Entity Configuration.

    ES

    Entity Statement.

    URL

    Uniform Resource Locator, it is a web address.

    JWT

    See RFC 7519 Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015.

    RS

    OAuth2 Resource Server

    $JWT

    The value of a JWT (JSON Web Token).

    +
    +
    +

    Conventions and Normative Terms

    +

    The keywords "MUST", "MUST NOT", "REQUIRES", "REQUIRE", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY" and "OPTIONAL" in the present document must be interpreted as described at BCP 14 RFC 2119 RFC 8174 when and only when they appear in capital letters.

    +

    Le notations [...] and ... mean that the text has been cut off for editor's requirements.

    +

    base64url denotes the URL-safe base64 coding without padding, defined at RFC 7515#section-2.

    +

    All the examples contained in this document must be considered as non-normative.

    +
    +

    Warning

    +

    All the examples contained in this documentation are meant to be non-normative

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/token_endpoint.html b/en/token_endpoint.html new file mode 100644 index 00000000..4f006337 --- /dev/null +++ b/en/token_endpoint.html @@ -0,0 +1,1826 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Token Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Token Endpoint

    +

    At the end of the authentication flow described at the previous section, the RP sends a request to the Token Endpoint with the authorization code received by the OP. These tokens MUST be signed JWT.

    +

    The Token response, if succesfull, returns an ID Token, an Access Token and possibly a Refresh Token (if the authentication request has scope=offline_access and prompt=consent. See Section Refresh Token.).

    +
    +

    spid-icon

    +

    In a long revocable session, the RP MAY request a Token to the Token Endpoint sending a Refresh Token in its possession, for obtaining a new Access Token and a new ID Token.

    +
    +
    +

    Note

    +

    The authentication method of the RP by the Token Endpoint is the private_key_jwt (OpenID.Core#ClientAuthentication)

    +
    + +
    +

    Request

    +

    The claims that MUST be included in the Token Request are given below.

    +

    Request example with authorization code (case 1)

    +
    +
    POST /token HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_id=https://rp.spid.agid.gov.it&
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +code=usDwMnEzJPpG5oaV8x3j&
    +code_verifier=9g8S40MozM3NSqjHnhi7OnsE38jklFv2&
    +grant_type=authorization_code
    +
    +
    +
    + +

    Request example with Refresh Token (case 2):

    +
    +
    POST /token HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_id=https://rp.spid.agid.gov.it&
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +grant_type=refresh_token&
    +refresh_token=8xLOxBtZp8
    +
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    client_id

    See OpenID.Registration. It MUST contain an HTTPS URL that uniquely identifies the RP.

    spid-icon cieid-icon

    client_assertion

    JWT signed with the Relying Party's private key containing the following parameters:

    +
    +

    iss: This MUST contain the client_id.

    +

    sub: This MUST contain the iss.

    +

    aud: URL of the OP Token Endpoint.

    +

    iat: UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519.

    +

    exp: UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    +

    jti: Unique Identifier uuid4 for this authentication request, generated by the client. Eg: it can be in uuid4 format.

    +
    +

    spid-icon cieid-icon

    client_assertion_type

    It must get the following value:
    +urn:ietf:params:oauth:client-assertion-type:jwtbearer.

    spid-icon cieid-icon

    code

    Authorization code returned in the Authentication Response. Required only if grant_type is authorization_code.

    spid-icon cieid-icon

    code_verifier

    Verification code of the code_challenge. Required only if grant_type is authorization_code.

    spid-icon cieid-icon

    grant_type

    Type of credentials, presented by the RP, for the current request. +It MAY get one of the following values:

    +
    +
      +
    • authorization_code

    • +
    • refresh_token

    • +
    +
    +

    spid-icon cieid-icon

    refresh_token

    Required only if grant_type is refresh_token.

    spid-icon cieid-icon

    +
    +
    +

    Response

    +

    The OpenID Provider (OP) returns an ID Token, an Access Token and possibly a Refresh Token.

    +

    The Access Token must be formed according to the standard indications of the "International Government Assurance Profile (iGov) for OAuth 2.0 - Draft 03", section 3.2.1, "JWT Bearer Tokens".

    +

    The ID Token must be formed according to the indications contained in the next section.

    +

    The response MUST contain the following claims.

    +

    Response example:

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/json
    +
    +{
    +    "access_token":"dC34Pf6kdG...",
    +    "token_type":"Bearer",
    +    "refresh_token":"wJ848BcyLP...",
    +    "expires_in":1800,
    +    "id_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY..."
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    access_token

    The Access Token, in signed JWT format, allows accessing the UserInfo Endpoint for obtaining the attributes.

    spid-icon cieid-icon

    token_type

    Type of Access Token returned. It MUST always be equal to Bearer.

    spid-icon cieid-icon

    refresh_token

    Available only in case of long revocable session. The Refresh Token MUST be a signed JWT format. It allows calling again the Token Endpoint for obtaining a new Access Token and a new ID Token.

    spid-icon cieid-icon

    expires_in

    Expity time of the Access Token in seconds.

    spid-icon cieid-icon

    id_token

    ID Token in JWT format (see next section).

    spid-icon cieid-icon

    +
    +
    +

    Access Token

    +

    The Access Token is a signed JSON Web Token (JWT) that allows access to the +UserInfo endpoint to get user attributes.

    +

    Access Token header and payload example:

    +
    {
    +  "alg": "RS256",
    +  "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
    +  "typ": "at+jwt"
    +}
    +.
    +{
    +  "iss":"https://op.spid.agid.gov.it/",
    +  "sub": "9sd798asd98asui23hiuds89y798sfyg",
    +  "aud": [
    +  "https://rp.spid.example.it"
    +  ],
    +  "client_id": "https://rp.spid.example.it",
    +  "scope": "openid",
    +  "jti": "9ea42af0-594c-4486-9602-8a1f8dde42d3",
    +  "exp": 1656859559,
    +  "iat": 1656857579
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    iss

    It MUST be an HTTPS URL that uniquely identifies the OP. The client MUST verify that this value matches the called OP.

    spid-icon cieid-icon

    sub

    See OpenID.Core#SubjectIDTypes. It MUST be of type pairwise.

    spid-icon cieid-icon

    client_id

    It MUST contain a HTTPS URL that uniquely identifies the RP.

    spid-icon cieid-icon

    aud

    It MUST match the value client_id. The RP MUST verify that this value matches its client ID.

    spid-icon cieid-icon

    scope

    The OP SHOULD add the scope parameter as defined in RFC 9068 Section 2.2.3. It MUST match the value in the authentication request.

    spid-icon cieid-icon

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    jti

    It MUST be a String in uuid4 format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed.

    spid-icon cieid-icon

    nonce

    See OpenID.Core#AuthRequest. It MUST be a random string of at least 32 alphanumeric characters. This value MUST match the value sent by the RP in the authentication request.

    spid-icon cieid-icon

    +
    +
    +

    ID Token

    +

    The ID Token is a signed JSON Web Token (JWT) that contains information about the user that has executed the authentication. The RPs MUST validate the ID Token.

    +
    +

    cieid-icon

    +

    If the RP exposes in its metadata the parameter id_token_encrypted_response_alg the OP MUST encrypt the ID Token.

    +
    +

    In this case the ID Token MUST be a nested signed and encrypted JWT containing the cty (Content-Type) parameter in the JOSE header configured to JWT (see RFC 7519#section-5.2).

    +

    The claims available in the ID Token are given below.

    +

    Example of header and payload of an ID Token:

    +
    {
    +  "alg": "RS256",
    +  "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw"
    +}
    +.
    +{
    +    "iss":"https://op.spid.agid.gov.it/",
    +    "sub":"9sd798asd98asui23hiuds89y798sfyg",
    +    "aud":"https://rp.spid.agid.gov.it/auth",
    +    "acr":"https://www.spid.gov.it/SpidL2",
    +    "at_hash":"qiyh4XPJGsOZ2MEAyLkfWqeQ",
    +    "iat":1519032969,
    +    "nbf":1519032969,
    +    "exp":1519033149,
    +    "jti":"nw4J0zMwRk4kRbQ53G7z",
    +    "nonce":"MBzGqyf9QytD28eupyWhSqMj78WNqpc2"
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    iss

    It MUST be an HTTPS URL that uniquely identifies the OP. The client MUST verify that this value matches the called OP.

    spid-icon cieid-icon

    sub

    See OpenID.Core#SubjectIDTypes. It MUST be pairwise type.

    spid-icon cieid-icon

    aud

    It MUST match the value client_id. The RP MUST verify that this value matches its client ID.

    spid-icon cieid-icon

    acr

    Effective authentication level. It MUST be equal or greater than the one requested by the client in the Authentication Request.

    spid-icon cieid-icon

    at_hash

    See OpenID.Core#CodeIDToken. Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the Access Token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. The client MUST verify this value by applying the same function to the Access Token returned with the Token ID.

    spid-icon cieid-icon

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    nbf

    UNIX Timestamp. Time of the validity beginning of the JWT in NumericDate format, as indicated in RFC 7519. MUST match with the value of iat.

    spid-icon cieid-icon

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    jti

    It MUST be a String in uuid4 format. Unique Token ID identifier that the RP MAY use to prevent reuse by rejecting the Token ID if already processed.

    spid-icon cieid-icon

    nonce

    See OpenID.Core#AuthRequest. It MUST be a random string of at least 32 alphanumeric characters. This value MUST match the value sent by the RP in the authentication request.

    spid-icon cieid-icon

    + +
    +
    +

    Refresh Token

    +

    The Refresh Token is a signed JWT that MAY be issued by the OP and MAY be used to obtain a new Access Token that enables the RP to access the UserInfo endpoint without requiring any direct user interaction.

    +

    The Refresh Token MUST be a signed JWT containing at least the following parameters.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    iss

    It MUST be an HTTPS URL that uniquely identifies the OP. The RP MUST verify that this value matches the called OP.

    spid-icon cieid-icon

    aud

    It MUST match the value client_id. The RP MUST verify that this value matches its client ID.

    spid-icon cieid-icon

    iat

    UNIX Timestamp with the time of JWT issuance, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    jti

    It MUST be a String in uuid4 format. Unique Refresh Token identifier that the RP MAY use to prevent reuse by rejecting the Refresh Token if already processed.

    spid-icon cieid-icon

    +
    +

    cieid-icon

    +

    To obtain a Refresh Token, the RP MUST include in the scope parameter of the authentication request the value offline_access and in the prompt parameter, the value consent. The use of this scope can be useful in scenarios where an RP needs to verify that an end user's digital identity is still valid or wants to keep attributes it has previously collected during the authentication phase up-to-date, such as for sending notifications to the end user after the end user has been authenticated. +The Refresh Token MUST NOT allow the requesting RP to obtain an ID Token, neither the one previously issued during authentication nor a new ID Token. The use of the Refresh Token MUST NOT be used by RPs to obtain a new user authentication with the OP or to renew a pre-existing session, but MAY be used as a mechanism to obtain from the UserInfo endpoint only the same set of user attributes requested at the initial authentication phase and for which the user has given explicit consent. Such consent MUST be collected by the OP at the end-user authentication phase on the consent page (it requires the ability to enable or disable this option on the consent page) and MAY be conditional on a validity period if defined by the OP according to policies on the treatment of personal data. Disabling this option by the user MUST still allow user authentication but MUST NOT release a Refresh Token.

    +

    The OP who receives a request for a new Access Token via a Refresh Token MAY send a notification to the user via one of the available e-delivery services (email, sms, mobile app notification). The user who does not recognize this operation as legitimate or who wants to disable this option can request from the OP a revocation of the given consent (and therefore of the tokens issued as a result of the same) according to the procedures made known within the consent acquisition page. The notification MUST be informative only and not authorizing. Within the notification MUST be made known to the user how to revoke the consent given. The OP MUST allow the user to disable this option at any time through appropriate functionality made available by the OP itself.

    +

    For security reasons, an OP MUST return, along with a new Access Token, also a new Refresh Token, invalidating all previously issued tokens (refresh token rotation) to the RP and related to the end-user. The new Refresh Token MUST have the exp parameter according to the expected duration.

    +
    +
    +

    spid-icon

    +

    In a mobile application scenario, to prevent the user from entering credentials every time, an RP MAY use the Refresh Token to enable revocable long sessions as defined in LL.GG. OpenID Connect in SPID and Avviso n.41 . +The Token endpoint verifies the validity of the Refresh Token and, if the the original authentication request included https://www.spid.gov.it/SpidL1 in the acr_values, a new ID Token valid only for the SPID level 1 is issued. +For more details on the Refresh Token in SPID, please refer to the following documentation:

    +
    +
    +
    +
    +

    Validity Period of a Refresh Token

    +

    The Refresh Token MUST NOT be valid (difference between iat and exp) more than 30 days.

    +

    If the Refresh Token is not valid (expired or revoked) and the RP sends a Token refresh request to the OP, the OP MUST return an error in the response (see Error codes).

    +
    +

    cieid-icon

    +

    Notwithstanding the validity of the token, the OP MAY set a validity period related to the consent the user has provided to use the scope=offline_access and the Refresh Token. Approaching the expiration of the validity period of the consensus, whenever such a period is provided for in the OP's policies, the value of exp MUST be calculated as the minimum value between the validity period of the token and that of the consensus.

    +
    +
    +

    Note

    +

    In order to clarify the rotation mechanism, a non-normative example is given below where Refresh Tokens are assumed to be valid for 30 days.

    +
      +
    • t1: an RP authenticates with scope=offline_access, then obtains a Refresh Token RT1 (validity 30gg)

    • +
    • t2 = t1 + 4gg: the RP makes a request to the Token endpoint by presenting RT1. The OP recognizes that the request is from the same RP and issues a new Access Token and new Refresh Token RT2 with validity 30gg from t2

    • +
    • t3 = t1 + 32gg: after 28gg from t2 the RP makes a request to the Token endpoint by submitting RT2. The OP recognizes that the request is from the same RP and issues a new Access Token and new Refresh Token RT3 with validity 30gg from t3

    • +
    • t4 = t1 + 64gg: after 32gg from t3 the RP makes a request to the Token endpoint by submitting RT3. This time the OP rejects the request with an error because RT3 is found to be no longer valid.

    • +
    +
    +
    +
    +
    +

    Error codes

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    HTTP Code

    Supported by

    invalid_client

    Client authentication failed (e.g., unknown client_id, no client authentication included, or unsupported authentication method)
    (RFC 6749#section-5.2).

    401 Unauthorized

    spid-icon cieid-icon

    unsupported_grant_type

    The grant_type parameter contains an incorrect value.

    400 Bad Request

    spid-icon cieid-icon

    invalid_grant

    The grant_type, code, code_verifier, access_token parameters are not valid.

    400 Bad Request

    spid-icon cieid-icon

    invalid_request

    The request is not valid due to the lack or incorrectness of one or more parameters.

    400 Bad Request

    spid-icon cieid-icon

    server_error

    The OP encountered an internal problem.

    500 internal server error

    spid-icon cieid-icon

    temporarily_unavailable

    The OP encountered a temporary internal problem.

    503 Service Unavailable

    spid-icon cieid-icon

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/trust_marks.html b/en/trust_marks.html new file mode 100644 index 00000000..90dfa092 --- /dev/null +++ b/en/trust_marks.html @@ -0,0 +1,1602 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Trust Marks + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Trust Marks

    +

    The Trust Marks (TM) are signed JWT RFC 7515 and represent the statements of compliance with a well defined set of requirements of trust and/or interoperability, or an agreement among the parties involved in the Federation.

    +

    The main aim of the TMs is exposing information that is not required by the OpenID Connect Core protocol, +but turns out to be useful in the federative context.

    +

    Typical examples include the Entity's national or international identification code (fiscal code, IPA code, VAT number), institutional contacts and so forth, as defined at OIDC-FED. Further data may be added +by the issuing subject.

    +

    During the registration process of a new Leaf Entity (onboarding), the TMs are issued and signed by the TA +or its Intermediates (SA) or by Attribute Authorities (AA), if they are defined inside the attribute trust_marks_issuers, published inside the TA's Entity Configuration.

    +

    Each member Entity MUST expose, in its own configuration (EC), the TMs released by the issuing authorities.

    +

    In the CIE / SPID scenario, a TM is signed by the TA MinInterno / Agid or their Intermediates (SA) or by Attribute Authorities (AA).

    +

    The TA defines the subjects who are enabled to issue TMs that are recognizable inside the Federation, +and this is done by the claim trust_marks_issuers, contained in its own Entity Configuration. +The value of the claim trust_marks_issuers is composed by a JSON Object having as keys the TM identifiers, and as values the list of identifiers (URLs) or the Entities who are enabled to issue them.

    +

    In the following, a non-normative example of the object trust_marks_issuers inside the TA's Entity Configuration.

    +
    {
    +    "trust_marks_issuers":{
    +        "https://registry.agid.gov.it/openid_relying_party/public/":[
    +            "https://registry.spid.agid.gov.it/",
    +            "https://public.intermediate.spid.it/"
    +        ],
    +        "https://registry.agid.gov.it/openid_relying_party/private/":[
    +            "https://registry.spid.agid.gov.it/",
    +            "https://private.other.intermediate.it/"
    +        ]
    +    }
    +}
    +
    +
    +

    Each member Entity MUST expose in its configuration (EC), the TMs released by the issuing authority.

    +

    In the CIE / SPID scenario, a TM is signed by the TA MinInterno / Agid or their Intermediates (SA) or +Attribute Authorities (AA).

    +

    The TA defines the subjects that are enabled to issue TMs that are recognizable inside the Federation, +and it does it with the claim trust_marks_issuers, that is present in its Entity Configuration. +The value of the attribute trust_marks_issuers is composed by a JSON Object whose keys are the TM identifiers and whose values are the list of the identifiers (URLs) of the Entities enabled +to issue them.

    +

    The Trust Marks represent the first filter for establishing the trust among the parties. +They are essential elements for starting the Metadata resolution. +In their absence, an Entity is not recognized as a member inside the Federation.

    +

    Inside the SPID Federation, the Trust Marks have unique identifiers (claim id) in URL format, that adopt +the following structure: https:// <domain> / <entity_role> / <trustmark_profile> / [extension /]

    +

    In the following, some non-normative examples:

    +
    +
      +
    • TM RP public: https://registry.agid.gov.it/openid_relying_party/public/

    • +
    • TM SA private: https://registry.agid.gov.it/intermediate/private/full/

    • +
    • TM AA: https://registry.agid.gov.it/oauth_resource/public/

    • +
    +
    +

    The following table defines the <entity_role> that are recognizable inside the SPID and CIE id Federations:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Type

    Description

    Entity

    openid_relying_party

    the Entity in the claim sub is an RP.

    RP

    openid_provider

    the Entity in the claim sub is an OP.

    OP

    intermediate

    the Entity in the claim sub is an Intermediate.

    SA

    oauth_resource

    the Entity in the claim sub is an Attribute Authority.

    AA

    +

    The following table defines the <trustmark_profile> that are recognizable inside the SPID and CIE id Federations:

    + +++++ + + + + + + + + + + + + + + + + +

    Profile

    Description

    Entity

    public

    the Entity in the claim sub belongs to the Italian Public Administration.

    RP, OP, SA, AA

    private

    the Entity in the claim sub belongs to the private sector.

    RP, OP, SA, AA

    +
    +

    federation_entity Trust Mark

    +

    In addition to the claims of the public and private profiles, the profile intermediate identifies the SA and adds the extensions full and light in the sa_profile claim, according to the ways of operation towards the subordinate Entities.

    + +
    +
    +

    oauth_resource Trust Mark

    +

    In addition to the claims of the public and private profiles, the profile oauth_resource +identifies the AA and adds the following mandatory claims:

    + ++++ + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    policy_uri

    URL where the AA privacy policy is available.

    tos_uri

    URL where the AA info policy is available.

    claims

    List of JSON Objects that define the user's attributes, required by the AA. +Example:
    {"https://attributes.eid.gov.it/fiscal_number":{"essential":true},
    "email":{"essential":true},}

    service_documentation

    URL where the OAS3 document, that describes how the AA services works, is available.

    +
    +
    +

    Trust Mark Validation

    +

    There are two ways of validating a Trust Mark:

    +
    +
      +
    1. Static Validation. The Trust Mark is validated through its issuing authority's public key (claim iss), on top of the correspondence of the claim sub to the same claim of the Entity Configuration in which it is contained, and on top of the expiry value (claim exp)

    2. +
    3. Dynamic Validation. The Federation members can query the endpoint trust mark status supplied by its issuer (claim iss), for a real-time checking of the TMs that it has issued.

    4. +
    +
    +

    All the Entities that release Trust Marks, MUST expose a Trust Mark status endpoint for allowing the dynamic validation.

    +
    +

    See also

    + +
    +
    +
    +

    Trust Mark Revocation

    +

    A Trust Mark can be revoked at any moment only and exclusively by the issuing subject. +For example, in case of exclusion of an Aggregated Subject by the Federation Authority, it communicates the exclusion of the Aggregated Subject to the SA. Consequently, the SA MUST revoke the TM for its subordinate.

    +
    +

    Note

    +

    In case of TM revocation, the dynamic validation gives a negative result, while the static +validation keeps on giving a positive result, unless the signing encryption keys of the TM-releasing subject are rotated.

    +
    +
    +
    +

    Trust Mark Composition

    +

    The claims defined inside the TMs are compliant with the elements defined in the OIDC Federation 1.0 (OIDC-FED) standard. See the following list.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    iss

    String. URL that uniquely identifies its issuing Authority.

    spid-icon cieid-icon

    sub

    String. URL that uniquely identifies the subject for which the Trust Mark has been issued.

    spid-icon cieid-icon

    id

    String. Unique identifier of the Trust Mark. It is an URL with the following structure:
    +<TA domain>/<entity_type>/<trustmark_profile>/
    +non-normative example: https://registry.interno.gov.it/openid_relying_party/public/

    spid-icon cieid-icon

    iat

    UNIX Timestamp with the JWT issuance time, coded as NumericDate as indicated at RFC 7519

    spid-icon cieid-icon

    logo_uri

    String. An URL that points to the logo that represents the Trust Mark.

    spid-icon cieid-icon

    exp

    UNIX Timestamp with the JWT expiry time, coded as NumericDate as indicated at RFC 7519

    spid-icon cieid-icon

    ref

    String. URL that points to public web information, about this Trust Mark

    spid-icon cieid-icon

    organization_type

    String. Specifies if the Entity belongs to the Italian Public Administration or the private sector (public or private)

    spid-icon cieid-icon

    id_code

    JSON Object. It contains one or more ogranization identification codes. Available claims are: +- ipa_code: REQUIRED for public organization. +- aoo_code: OPTIONAL. +- uo_code: OPTIONAL. +- vat_number: REQUIRED for private organization only if fiscal_number is not available. +- fiscal_number: REQUIRED for private organization only if vat_number is not available.

    spid-icon cieid-icon

    email

    String. Institutional e-mail or PEC of the Organization.

    spid-icon cieid-icon

    organization_name

    String. The complete name of the service-supplying Entity.

    spid-icon cieid-icon

    +
    +

    Warning

    +

    The value in the claim exp MUST NOT be greater than the duration of the agreements submitted during the onboarding process, between the Trust Mark issuer and the Organizations receiving the TM.

    +
    + +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/trust_negotiation.html b/en/trust_negotiation.html new file mode 100644 index 00000000..0ba82389 --- /dev/null +++ b/en/trust_negotiation.html @@ -0,0 +1,1428 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | Metadata retrieval + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Metadata retrieval

    +

    This section explains the ways the participants of a federation have to establish the trust among them, the ways for the Leaves to recognize each other inside the same federation and get each other's Metadata.

    +
    +

    Relying Party

    +

    The RP gets the list of the OPs in JSON format by querying the endpoint list, +available by the Trust Anchor. For each subject contained in the JSON response and corresponding to an OP, the RP requests the Entity Configuration of the OP.

    +

    For each EC of the OPs, the RP validates the signature of the OP Entity Configuration using the public key obtained in the Entity +Statement released by the Trust Anchor for that OP. After validating the Entity Configuration signature, the RP establishes the trust with the OP.

    +

    Finally, the RP applies the policies published by the Trust Anchor on the OP's Metadata and saves the resulting +Metadata by associating it to an expiry date (claim exp). The expiry date corresponds to the lowest +value of exp, obtained from all the elements that compose the Trust Chain. Periodically, the RP updates +the Metadata of all the OPs, renewing their related Trust Chain.

    +

    After obtaining the final Metadata of all the OpenID Connect Providers, the RP generates the SPID button or CIE button and publishes it inside its authentication page.

    +

    The procedure of Federation Entity Discovery for the RPs gets simplified because, inside the Federation, the existence of Intermediates between the OPs and their Trust Anchor is not allowed.

    +_images/metadata_discovery.svg +

    The Federation Entity Discovery procedure from the Leaf, up to the Trust Anchor. The public key for validating the Entity Configuration of the subordinate Entity is obtained from the Entity Statement released by a superior.

    +
    +
    +

    OpenID Provider

    +

    When a Provider (OP) receives an authorization request from a non-previously-recognized RP, +the automatic client registration procedure occurs. The operations made by the OP to +dynamically register an RP are described below.

    +_images/automatic_client_registration.svg +

    The registration of an RP from the perspective of an OP that, for the first time, receives an authorization +request from the RP and starts the Federation Entity Discovery process and the Trust Chain saving.

    +

    The OP extracts the unique identifier (client_id) from the object request contained in the +Authorization Request and sends an Entity Configuration request (RP). +The OP obtains the Entity Configuration of the RP and validates the signatures of Trust Mark that are +recognized inside the Federation [1].

    +

    If the RP configuration does not expose any Trust Mark that is recognizable by the RP profile (see Section Trust Mark), the Provider MUST refuse the authorization with an error message as defined in Section Federation Error Management.

    +

    If the Provider successfully validates at least a Trust Mark for the RP profile contained inside the +configuration of the requesting RP, it extracts the superior Entities from the claim authority_hints and +starts the Federation Entity Discovery process until the Trust Chain calculation and the achievement of +the final Metadata.

    +

    During the Federation Entity Discovery, the Provider requests one ore more superior Entities [2] for the Entity +Statement regarding the RP, obtains the public key for validating the RP configuration and finally reaches +the Trust Anchor. Then it applies the Metadata policy published by the Trust Anchor and saves the +resulting final RP Metadata, associating them to an expiry date. After that date, it will +renew the RP Metadata, according to the Trust Chain renewal procedure.

    +

    After obtaining the final Metadata, the Provider validates the request sent by RP.

    +

    In case an RP has a SA as a superior Entity and not directly the TA, the procedure of achieving and validating the Entity Configuration of the RP occurs through the Entity Statement published +by the SA towards the RP and through validating the Entity Configuration of the SA with the Entity Statement issued by the TA towards the SA. If the threshold of the maximum number of vertical Intermediates, +defined by the value max_path_length, is exceeded, the OP stops the process of Federation Entity Discovery and rejects the RP request.

    + + +_images/trust_anchor.svg +

    Each member exposes its own configuration and its own Trust Marks. The link between a Leaf and +the Trust Anchor occurs directly or through an Intermediate (SA) as in the picture.

    +
    +
    +

    Access to the Entity Configuration

    +

    This section describes how to identify the URL RFC 3986 in order to download the Entity Configuration of a given subject.

    +

    The web path .well-known/openid-federation is the resource by which an Entity publishes its configuration (Entity Configuration). This web path MUST be appended to the URL which identifies the subject.

    +

    Examples:

    +
    +
      +
    • with a subject identifier equal to https://rp.example.it the resulting Entity Configuration URL is
      +https://rp.example.it/.well-known/oidc-federation.

    • +
    • with a subject identifier equal to https://rp.servizi-spid.it/oidc/ the resulting +Entity Configuration URL is
      +https://rp.servizi-spid.it/oidc/.well-known/oidc-federation.

    • +
    +
    +

    In case of subject identifier URLs lacking the ending slash mark "/", this must be added between the URL and the appended web path resource.

    +

    Once the RP is recognized as part in the Federation, it gets the permission to make an Authentication Request. +The OP that doesn't recognize the RP that sent the request, has to resolve the trust for that RP. The OP starts +requesting the Entity Configuration of the RP at the .well-known endpoint of the RP and, following the path +provided by the authority_hint, reaches the TA. At each chain step, the OP can perform all the security controls by requesting the Entity Statements to each Entity and validating the Trust Marks and the signatures. The following picture is a representative example of how the Trust Chain works.

    +_images/cie_esempio_trust_chain.svg +

    The Federation Entity Discovery process to build a Trust Chain and obtain the final Metadata.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/en/userinfo_endpoint.html b/en/userinfo_endpoint.html new file mode 100644 index 00000000..c6dfce66 --- /dev/null +++ b/en/userinfo_endpoint.html @@ -0,0 +1,1512 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentation | UserInfo Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Public documents, made digital.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    UserInfo Endpoint

    +

    The UserInfo Endpoint is a protected resource that returns the authenticated user's claims. In order to obtain +the requested claims, the RP sends a request to the UserInfo Endpoint using the Access Token.

    +
    +

    Request

    +
    +

    spid-icon

    +

    The UserInfo Endpoint MUST only support the method HTTP GET RFC 2616 and MUST accept and validate the Access Token sent in the Authorization field of the Header, whose type is Bearer RFC 6750.

    +
    +
    +

    cieid-icon

    +

    The UserInfo Endpoint MUST support the method HTTP GET and HTTP POST RFC 2616 and MUST accept and validate the Access Token sent in the Authorization field of the Header, whose type is Bearer RFC 6750.

    +
    +
    GET https://op.spid.agid.gov.it/userinfo
    + Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImRCNjdnTDdja ...
    +
    +
    + +
    +
    +

    Response

    +

    The content of the Response body MUST be a signed and encrypted JWT.

    +

    The JOSE header MUST contain the cty parameter (Content Type) configured to JWT (see RFC 7519#section-5.2).

    +

    The UserInfo Endpoint returns user attributes explicitly requested through the claims parameter or through the use of the scope parameter in the Authentication Request.

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/jose
    +
    +{
    +  "alg": "RSA-OAEP",
    +  "enc": "A256CBC-HS512",
    +  "kid": "HIvo33-Km7n03ZqKDJfWVnlFudsW28YhQZx5eaXtAKA",
    +  "cty": "JWT"
    +}
    +.
    +{
    +   "iss": "https://op.fornitore_identita.it",
    +   "aud": "https://rp.fornitore_servizio.it",
    +   "iat": 1519032969,
    +   "nbf": 1519032969,
    +   "exp": 1519033149,
    +   "sub": "OP-1234567890",
    +   "name": "Mario",
    +   "family_name": "Rossi",
    +   "https://attributes.spid.gov.it/fiscal_number": "MROXXXXXXXXXXXXX"
    +}
    +
    +
    +

    The JWE header MUST contain the parameter below:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    alg

    String. See Cryptographic algorithms..

    spid-icon cieid-icon

    kid

    See RFC 7638#section_3.

    spid-icon cieid-icon

    enc

    String. See Cryptographic algorithms..

    spid-icon cieid-icon

    cty

    String. It MUST contain the value "JWT".

    spid-icon cieid-icon

    +

    The JWE payload is a JWS containing the following parameters:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Description

    Supported by

    sub

    String. Subject identifier, equal to the identifier already released in the ID Token. +The RP MUST check that the value is equal to the one, contained in the ID Token.

    spid-icon cieid-icon

    iat

    UNIX Timestamp with the time of the JWT issuance, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    exp

    UNIX Timestamp with the expiry time of the JWT, coded as NumericDate as indicated in RFC 7519.

    spid-icon cieid-icon

    aud

    String. Subject Identifier of the response recipient (RP). +The RP MUST check that the value is equal to its own client_id.

    spid-icon cieid-icon

    iss

    String. URI that uniquely identifies the OP.

    spid-icon cieid-icon

    <user claims>

    The requested user claims.

    spid-icon cieid-icon

    +

    The JWS header MUST contains the parameters below:

    + +++++ + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    alg

    String. See Cryptographic algorithms..

    spid-icon cieid-icon

    kid

    See RFC 7638#section_3.

    spid-icon cieid-icon

    cty

    String. It MUST contain the value "JWT".

    spid-icon cieid-icon

    +
    +
    +

    Error codes

    +

    As defined for Token endpoint.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/index.html b/index.html new file mode 100644 index 00000000..4b8ac71a --- /dev/null +++ b/index.html @@ -0,0 +1,15 @@ + + + + SPID CIE OIDC Docs + + + +

    SPID CIE OIDC Docs

    + + + + diff --git a/it/.buildinfo b/it/.buildinfo new file mode 100644 index 00000000..8d041885 --- /dev/null +++ b/it/.buildinfo @@ -0,0 +1,4 @@ +# Sphinx build info version 1 +# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done. +config: d5ac755cef36458b7bb2292710f74a64 +tags: 645f666f9bcd5a90fca523b33c5a78b7 diff --git a/it/_images/Eo_circle_green_checkmark.svg b/it/_images/Eo_circle_green_checkmark.svg new file mode 100644 index 00000000..19e0bd7f --- /dev/null +++ b/it/_images/Eo_circle_green_checkmark.svg @@ -0,0 +1,2 @@ + diff --git a/it/_images/Eo_circle_red_letter-x.svg b/it/_images/Eo_circle_red_letter-x.svg new file mode 100644 index 00000000..4c3c8e78 --- /dev/null +++ b/it/_images/Eo_circle_red_letter-x.svg @@ -0,0 +1 @@ + diff --git a/it/_images/automatic_client_registration.svg b/it/_images/automatic_client_registration.svg new file mode 100644 index 00000000..3223e202 --- /dev/null +++ b/it/_images/automatic_client_registration.svg @@ -0,0 +1 @@ +User-AgentCIE (OP)RPCIE Fed AuthOIDC Authz Requestsigned by the RP https://rp.example.it/Entity Configuration Requesthttps://rp.example.it/.well-known/openid-federationEntity Configuration ResponseContent-Type: application/joseValidation of Trust MarksRoute to authority_hint https://registry.gov.it/Entity Configuration Requesthttps://registry.gov.it/.well-known/openid-federationEntity Configuration ResponseContent-Type: application/joseResponse ValidationEntity Statement request to Authority about its descendanthttps://registry.gov.it/oidc/fedapi?sub=https%3A%2F%2Frp.example.it%2FEntity Statement response about its descendanthttps://registry.gov.it/oidc/fedapi?sub=https%3A%2F%2Frp.example.it%2FValidates ResponseAcquires the policy and produces the final entity statementRP registration(Metadata and Trust Chain)The user submits the login form and give consentHTTP 200 - auth code responseUser-AgentCIE (OP)RPCIE Fed Auth \ No newline at end of file diff --git a/it/_images/cie_esempio_trust_chain.svg b/it/_images/cie_esempio_trust_chain.svg new file mode 100644 index 00000000..a6974252 --- /dev/null +++ b/it/_images/cie_esempio_trust_chain.svg @@ -0,0 +1,597 @@ + + + + + + + + + + + + + + + + + + + + + + + + cie_esempio_trust_chain + + + + + Foglio.194 + + Rettangolo.132 + + + + + + + Rettangolo.133 + OP + + + + + + + OP + + Rettangolo + + + + + + + Rettangolo.126 + TA + + + + + + + TA + + Rettangolo.121 + + + + + + + Rettangolo.126 + RP + + + + + + + RP + + Foglio.193 + + Cerchio + + + + + + + Rettangolo arrotondato + OIDC authentication request + + + + + + + + + + + + + + + + + + + + + + OIDCauthenticationrequest + + Rettangolo arrotondato.100 + send EC + + + + + + + + + + + + + + + + + + + + + + send EC + + Rettangolo arrotondato.102 + Validate EC and acquire the fed_api_endpoint + + + + + + + + + + + + + + + + + + Validate EC andacquire thefed_api_endpoint + + Rettangolo arrotondato.103 + ES request querying the fed_api_endpoint + + + + + + + + + + + + + + + + + + ES requestquerying thefed_api_endpoint + + Cerchio.104 + + + + + + + Rettangolo arrotondato.106 + RP EC request + + + + + + + + + + + + + + + + + + + + + + RP ECrequest + + Rettangolo arrotondato.107 + Validate EC, trust marks and acquire the authority_hint + + + + + + + + + + + + + + + + + + + + + + Validate EC, trustmarks and acquirethe authority_hint + + Rettangolo arrotondato.108 + TA EC request following authority_hint + + + + + + + + + + + + + + + + + + + + + + TA EC requestfollowingauthority_hint + + Connettore dinamico.111 + + + + Connettore dinamico.113 + + + + Connettore dinamico.115 + + + + Connettore dinamico.116 + + + + Connettore dinamico.118 + + + + Connettore dinamico.134 + + + + Connettore dinamico.136 + + + + Rettangolo arrotondato.137 + send EC + + + + + + + + + + + + + + + + + + + + + + send EC + + Foglio.161 + + Rettangolo + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + + Foglio.168 + + Rettangolo + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + + Connettore dinamico.175 + + + + Rettangolo arrotondato.176 + Validate ES of RP and apply metadata policy + + + + + + + + + + + + + + + + + + Validate ES of RPand apply metadata policy + + Rettangolo arrotondato.177 + send ES of RP + + + + + + + + + + + + + + + + + + + + + + send ES of RP + + Connettore dinamico.180 + + + + Foglio.181 + + Rettangolo + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + + Connettore dinamico.188 + + + + Rettangolo arrotondato.189 + Store the RP trust chain + + + + + + + + + + + + + + + + + + Store the RPtrust chain + + Connettore dinamico.190 + + + + Connettore dinamico.191 + + + + + + diff --git a/it/_images/cieid3.svg b/it/_images/cieid3.svg new file mode 100644 index 00000000..e0619876 --- /dev/null +++ b/it/_images/cieid3.svg @@ -0,0 +1,86 @@ + + + + + + + + + + Pagina 1 + + + Foglio.3617 + + Foglio.2903 + + + + Foglio.2954 + + + + Foglio.3603 + + Foglio.3601 + + + + Foglio.3602 + + + + + Foglio.3616 + + Foglio.3609 + + + + Foglio.3610 + + + + Foglio.3611 + + + + Foglio.3613 + + + + Rettangolo + + + + + + + + + diff --git a/it/_images/flusso.svg b/it/_images/flusso.svg new file mode 100644 index 00000000..d2ecc30a --- /dev/null +++ b/it/_images/flusso.svg @@ -0,0 +1,1816 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + flow + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.363 + + Foglio.364 + + + + Foglio.365 + + Foglio.366 + + + + Foglio.367 + + + + + Foglio.368 + + + + + + + + + + + Foglio.369 + + Foglio.370 + + + + Foglio.371 + + + + Foglio.372 + + + + + + + Foglio.373 + + + + + + + + + + + Foglio.374 + + Foglio.375 + + + + Foglio.376 + + + Foglio.377 + + + Foglio.378 + + Foglio.379 + + + + Foglio.380 + + + + Foglio.381 + + + Foglio.382 + + + Foglio.383 + + + Foglio.384 + + + Foglio.385 + + + + + + + + Rettangolo + + + + + + + Rettangolo.175 + + + + + + + Rettangolo.176 + + + + + + + Rettangolo.177 + + + + + + + Rettangolo.178 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività + Relying Party + + Foglio.2 + + + + Foglio.3 + + Foglio.4 + + + + Foglio.5 + + + + + Foglio.6 + + + + + + + + + + + Foglio.7 + + Foglio.8 + + + + Foglio.9 + + + + Foglio.10 + + + + + + + Foglio.11 + + + + + + + + + + + Foglio.12 + + Foglio.13 + + + + Foglio.14 + + + Foglio.15 + + + Foglio.16 + + Foglio.17 + + + + Foglio.18 + + + + Foglio.19 + + + Foglio.20 + + + Foglio.21 + + + Foglio.22 + + + Foglio.23 + + + + + + + + + Relying Party + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.24 + User + + Foglio.25 + + + + Foglio.26 + + Foglio.27 + + + + Foglio.28 + + + + + Foglio.29 + + + + + + + + + + + Foglio.30 + + Foglio.31 + + + + Foglio.32 + + + + Foglio.33 + + + + + + + Foglio.34 + + + + + + + + + + + Foglio.35 + + Foglio.36 + + + + Foglio.37 + + + Foglio.38 + + + Foglio.39 + + Foglio.40 + + + + Foglio.41 + + + + Foglio.42 + + + Foglio.43 + + + Foglio.44 + + + Foglio.45 + + + Foglio.46 + + + + + + + + + User + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.47 + Authorization Endpoint + + Foglio.48 + + + + Foglio.49 + + Foglio.50 + + + + Foglio.51 + + + + + Foglio.52 + + + + + + + + + + + Foglio.53 + + Foglio.54 + + + + Foglio.55 + + + + Foglio.56 + + + + + + + Foglio.57 + + + + + + + + + + + Foglio.58 + + Foglio.59 + + + + Foglio.60 + + + Foglio.61 + + + Foglio.62 + + Foglio.63 + + + + Foglio.64 + + + + Foglio.65 + + + Foglio.66 + + + Foglio.67 + + + Foglio.68 + + + Foglio.69 + + + + + + + + + AuthorizationEndpoint + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.70 + Token Endpoint + + Foglio.71 + + + + Foglio.72 + + Foglio.73 + + + + Foglio.74 + + + + + Foglio.75 + + + + + + + + + + + Foglio.76 + + Foglio.77 + + + + Foglio.78 + + + + Foglio.79 + + + + + + + Foglio.80 + + + + + + + + + + + Foglio.81 + + Foglio.82 + + + + Foglio.83 + + + Foglio.84 + + + Foglio.85 + + Foglio.86 + + + + Foglio.87 + + + + Foglio.88 + + + Foglio.89 + + + Foglio.90 + + + Foglio.91 + + + Foglio.92 + + + + + + + + + TokenEndpoint + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.93 + UserInfo Endpoint + + Foglio.94 + + + + Foglio.95 + + Foglio.96 + + + + Foglio.97 + + + + + Foglio.98 + + + + + + + + + + + Foglio.99 + + Foglio.100 + + + + Foglio.101 + + + + Foglio.102 + + + + + + + Foglio.103 + + + + + + + + + + + Foglio.104 + + Foglio.105 + + + + Foglio.106 + + + Foglio.107 + + + Foglio.108 + + Foglio.109 + + + + Foglio.110 + + + + Foglio.111 + + + Foglio.112 + + + Foglio.113 + + + Foglio.114 + + + Foglio.115 + + + + + + + + + UserInfoEndpoint + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attività.116 + OpenID Provider (OP) + + Foglio.117 + + + + Foglio.118 + + Foglio.119 + + + + Foglio.120 + + + + + Foglio.121 + + + + + + + + + + + Foglio.122 + + Foglio.123 + + + + Foglio.124 + + + + Foglio.125 + + + + + + + Foglio.126 + + + + + + + + + + + Foglio.127 + + Foglio.128 + + + + Foglio.129 + + + Foglio.130 + + + Foglio.131 + + Foglio.132 + + + + Foglio.133 + + + + Foglio.134 + + + Foglio.135 + + + Foglio.136 + + + Foglio.137 + + + Foglio.138 + + + + + + + + + OpenID Provider (OP) + + + Cerchio + 1 + + + + + + + 1 + + Cerchio.179 + + + + + + + Cerchio.180 + 2 + + + + + + + 2 + + Flusso di attività + Scelta OP + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Scelta OP + + Cerchio.183 + + + + + + + Flusso di attività.184 + Authorization Request + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Authorization Request + + Cerchio.185 + 3 + + + + + + + 3 + + Cerchio.187 + + + + + + + Flusso di attività.339 + + + + + + + + + + + + + + + + + + + + + + + + + + + Cerchio.340 + + + + + + + Flusso di attività.342 + + + + + + + + + + + + + + + + + + + + + + + + + + + Connettore dinamico + + + + Cerchio.341 + + + + + + + Connettore dinamico.345 + + + + Cerchio.346 + 4 + + + + + + + 4 + + Cerchio.347 + + + + + + + Flusso di attività.348 + + + + + + + + + + + + + + + + + + + + + + + + + + + Cerchio.349 + 5 + + + + + + + 5 + + Cerchio.350 + + + + + + + Flusso di attività.351 + Authorization Code + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Authorization Code + + Cerchio.352 + + + + + + + Cerchio.353 + 6 + + + + + + + 6 + + Flusso di attività.354 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cerchio.355 + 7 + + + + + + + 7 + + Cerchio.356 + + + + + + + Flusso di attività.357 + Access Token + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Access Token + + Cerchio.358 + + + + + + + Cerchio.359 + 8 + + + + + + + 8 + + Flusso di attività.360 + + + + + + + + + + + + + + + + + + + + + + + + + + + + Foglio.386 + User Authentication Autorizzazione Invio Attributi + + + + User Authentication Autorizzazione Invio Attributi + + Foglio.388 + Redirect Message + + + + Redirect Message + + Foglio.390 + Access Token e ID Token + + + + Access Token eID Token + + Foglio.392 + Claims + + + + Claims + + diff --git a/it/_images/metadata_discovery.svg b/it/_images/metadata_discovery.svg new file mode 100644 index 00000000..bfae860e --- /dev/null +++ b/it/_images/metadata_discovery.svg @@ -0,0 +1,848 @@ + + + + + + + + + + + + + + + + + + + + + + + + metadata_discovery + + + + + Foglio.266 + + + Foglio.321 + + Foglio.200 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.175 + { “kid” : bfxafKvtP } { “iss” : RP2 “sub” : RP2 “authority_hi... + + + + {kid” : bfxafKvtP}{iss” : RP2sub” : RP2authority_hints” : SAkid” : bfxafKvtP[...]} + + Foglio.193 + + Cerchio + + + + + + + + Foglio.194 + + Foglio.195 + + Foglio.196 + + + + Foglio.197 + + + + + + Foglio.199 + RP2 Entity Configuration + + + + RP2 EntityConfiguration + + + Foglio.315 + RP2 .well-known endpoint + + + + RP2 .well-known endpoint + + + Foglio.322 + + Foglio.232 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.224 + { “kid” : dcEE870s } { “iss” : SA “sub” : SA “authority_hints... + + + + {kid” : dcEE870s}{iss” : SAsub” : SAauthority_hints” : TAkid” : dcEE870s[...]} + + Foglio.231 + SA Entity Configuration + + + + SA EntityConfiguration + + Foglio.214 + + Cerchio + + + + + + + Foglio.213 + + Cerchio.203 + + + + + + + Rettangolo + + + + + + + Cerchio.205 + + + + + + + Cerchio.206 + + + + + + + Cerchio.207 + + + + + + + Rettangolo.208 + + + + + + + Rettangolo.209 + + + + + + + Rettangolo.210 + + + + + + + + + + Foglio.317 + SA .well-known endpoint + + + + SA .well-known endpoint + + + Foglio.323 + + Foglio.233 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.242 + { “kid” : dcEE870s } { “iss” : SA “sub” : RP2 “kid” : bfxafKv... + + + + {kid” : dcEE870s}{iss” : SAsub” : RP2kid” : bfxafKvtP[...]} + + Foglio.243 + SA Entity Statement of RP2 + + + + SA EntityStatement of RP2 + + Foglio.244 + + Cerchio + + + + + + + Foglio.246 + + Cerchio.203 + + + + + + + Rettangolo + + + + + + + Cerchio.205 + + + + + + + Cerchio.206 + + + + + + + Cerchio.207 + + + + + + + Rettangolo.208 + + + + + + + Rettangolo.209 + + + + + + + Rettangolo.210 + + + + + + + + + + Foglio.318 + SA FETCH endpoint + + + + SA FETCH endpoint + + + Foglio.324 + + Foglio.296 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.282 + { “kid” : pZQU9t0A } { “iss” : TA “sub” : TA “kid” : pZQU9t0A... + + + + {kid” : pZQU9t0A}{iss” : TAsub” : TAkid” : pZQU9t0A[...]} + + Foglio.283 + TA Entity Configuration + + + + TA EntityConfiguration + + Foglio.272 + + Cerchio + + + + + + + Foglio.268 + + Foglio.269 + + Foglio.270 + + + + Foglio.271 + + + + + + + + Foglio.319 + TA .well-known endpoint + + + + TA .well-known endpoint + + + Foglio.325 + + Foglio.297 + + Rettangolo.181 + + + + + + + Rettangolo + + + + + + + Rettangolo.169 + + + + + + + Triangolo rettangolo + + + + + + + Rettangolo.155 + + + + + + + Rettangolo.156 + + + + + + + Rettangolo.158 + + + + + + + Rettangolo.159 + + + + + + + Foglio.306 + { “kid” : pZQU9t0A } { “iss” : TA “sub” : SA “kid” : dcEE870s... + + + + {kid” : pZQU9t0A}{iss” : TAsub” : SAkid” : dcEE870s[...]} + + Foglio.307 + TA Entity Statement of SA + + + + TA EntityStatement ofSA + + Foglio.308 + + Cerchio + + + + + + + Foglio.310 + + Foglio.311 + + Foglio.312 + + + + Foglio.313 + + + + + + + + Foglio.320 + TA FETCH endpoint + + + + TA FETCH endpoint + + + Connettore dinamico + OP acquires the authority_hints to follow + + + + + OP acquires the authority_hints to follow + + Connettore dinamico.327 + OP acquires the authority_hints to follow + + + + + OP acquires the authority_hints to follow + + Connettore dinamico.328 + OP acquires the federation_fetch_endpoint to query + + + + + OP acquires the federation_fetch_endpoint to query + + Connettore dinamico.329 + OP acquires the federation_fetch_endpoint to query + + + + + OP acquires the federation_fetch_endpoint to query + + diff --git a/it/_images/spid3.svg b/it/_images/spid3.svg new file mode 100644 index 00000000..f2056e3a --- /dev/null +++ b/it/_images/spid3.svg @@ -0,0 +1,85 @@ + + + + + + + + + + Pagina 1 + + + Foglio.4311 + + Foglio.3619 + + + + Foglio.3621 + + + + Foglio.3625 + + + + Foglio.3631 + + + + Foglio.3808 + + + + Foglio.3830 + + + + Foglio.3845 + + + + + + + Semicerchio + + Foglio.4309 + + + + + Cerchio + + + + + + + + diff --git a/it/_images/spid_cie_oidc_federation_model.svg b/it/_images/spid_cie_oidc_federation_model.svg new file mode 100644 index 00000000..7529aeef --- /dev/null +++ b/it/_images/spid_cie_oidc_federation_model.svg @@ -0,0 +1 @@ +AgIDTrust AnchorSPID OPRPRPIntermediaryIntermediaryRPSPID OPRPMinInternoTrust AnchorCIE OPRPRPIntermediary \ No newline at end of file diff --git a/it/_images/trust_anchor.svg b/it/_images/trust_anchor.svg new file mode 100644 index 00000000..6581bf0e --- /dev/null +++ b/it/_images/trust_anchor.svg @@ -0,0 +1,202 @@ + + + + + + + + + + + + + + + + trust_anchor eng + + + Foglio.3 + Exposes its Entity Configuration + + + + Exposes its Entity Configuration + + Foglio.4 + Exposes the FETCH endpoint and releases Entity Statements + + + + Exposes the FETCH endpoint and releases Entity Statements + + Foglio.5 + about its subordinates + + + + about its subordinates + + Foglio.6 + + + + Foglio.7 + + + + Foglio.8 + OpenID Relying Party + + + + OpenID Relying Party + + Foglio.9 + + + + Foglio.10 + + + + Foglio.11 + Intermediary + + + + Intermediary + + Foglio.12 + (federation entity) + + + + (federation entity) + + Foglio.13 + Exposes its Entity Configuration containing the Trust Marks + + + + Exposes its Entity Configuration containing the Trust Marks + + Foglio.14 + Exposes the FETCH endpoint and releases Entity Statements + + + + Exposes the FETCH endpoint and releases Entity Statements + + Foglio.17 + + + + Foglio.18 + + + + Foglio.19 + + + + Foglio.20 + + + + Foglio.21 + authority + + + + authority + + Foglio.22 + hint + + + + hint + + Foglio.23 + + + + Foglio.24 + + + + Foglio.25 + authority + + + + authority + + Foglio.26 + hint + + + + hint + + Foglio.27 + + + + Foglio.28 + + + + Foglio.29 + Trust Anchor + + + + Trust Anchor + + Foglio.30 + (federation entity) + + + + (federation entity) + + Foglio.31 + about its subordinates + + + + about its subordinates + + Foglio.32 + Exposes its Entity Configuration containing the Trust Marks + + + + Exposes its Entity Configuration containing the Trust Marks + + diff --git a/it/_sources/attributi_utente.rst.txt b/it/_sources/attributi_utente.rst.txt new file mode 100644 index 00000000..aab0ebf6 --- /dev/null +++ b/it/_sources/attributi_utente.rst.txt @@ -0,0 +1,336 @@ +.. include:: ../common/common_definitions.rst + +.. _user_claims: + +Tabella attributi utente +------------------------ + +La seguente tabella riporta l'elenco degli attributi utente supportati da SPID e/o CIE. La variable ``$PREFIX=https://attributes.eid.gov.it`` rappresenta il namespace. + +.. list-table:: + :widths: 20 40 1 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato** |br| **da** + * - **$PREFIX/spid_code** |br| Categoria: anagrafica + - Codice identificativo. String. Il codice identificativo è assegnato dal gestore dell'identità digitale e deve essere univoco. + + Il formato è il seguente: + ``=`` + + Dove: + + ****: è un codice composto da 4 lettere univocamente assegnato al gestore delle identità; + + ****: è una stringa alfanumerica composta da 10 caratteri che il gestore delle identità genera in maniera univoca nell'ambito del proprio dominio. + + Esempio: + + ``"$PREFIX/spid_code":"ABCD123456789A"`` + + - |spid-icon| + * - **given_name** |br| Categoria: anagrafica + - Nome. String. Stringa composta da una sequenza di parole con carattere iniziale maiuscolo, + intervallate da spazi singoli. + + Esempio: + + ``"given_name":"Giovanni Mario"`` + + - |spid-icon| |cieid-icon| + * - **family_name** |br| Categoria: anagrafica + - Cognome. String. Stringa composta da una sequenza di parole con carattere iniziale maiuscolo, + intervallate da spazi singoli. + + Esempio: + + ``"family_name":"Bianchi Verdi"`` + + - |spid-icon| |cieid-icon| + * - **place_of_birth** |br| Categoria: anagrafica + - Luogo di nascita, Provincia di nascita. JSON Object: + + "**locality** : Stringa corrispondente al codice catastale (Codice Belfiore) del Comune + o della nazione estera di nascita (Es. "F205" per la città di Milano) + + "**region**" : Stringa corrispondente alla sigla della provincia di nascita + + Esempio: + + .. code-block:: json + + "place_of_birth":{ + "region":"MI", + "locality":"F205" + } + + - |spid-icon| |cieid-icon| + * - **birthdate** |br| Categoria: anagrafica + - Data di nascita. String. Secondo specifica ISO8601-2004 nel formato + YYYY indica l'anno utilizzando 4 cifre |br| + MM indica il mese in (due) cifre |br| + DD indica il giorno in (due) cifre |br| + Esempio: |br| + + ``"birthdate":"2002-09-24"`` + + - |spid-icon| |cieid-icon| + * - **gender** |br| Categoria: anagrafica + - Sesso. String. Valori ammessi: |br| + "female" per sesso femminile |br| + "male" per sesso maschile |br| + Esempio: |br| + + ``"gender":"female"`` + + - |spid-icon| |cieid-icon| + * - **$PREFIX/company_name** |br| Categoria: anagrafica + - Ragione o denominazione sociale. String. Stringa composta da una sequenza di parole intervallate + da spazi singoli. + In maiuscolo le sottostringhe corrispondenti a nomi (es. “Agenzia per l'Italia Digitale”) + + .. code-block:: json + + "$PREFIX/company_name": "Agenzia per l'Italia Digitale" + + - |spid-icon| + * - **$PREFIX/registered_office** |br| Categoria: extra anagrafica + - Sede legale. JSON Object: formatted, street_address, locality, region, postal_code, country, + country_code. + Json composto da una stringa composta da una sequenza di parole intervallate da spazi singoli rappresentanti: + + - Tipologia( via, viale, piazza …) + - Indirizzo + - Nr.civico + - CAP + - Luogo + - Provincia + + la stringa è inserita nel claim "formatted" del JSON Object "address" + + Esempio: + + .. code-block:: json + + "$PREFIX/registered_office":{ + "formatted":"via Listz 21 00144 Roma" + } + + - |spid-icon| + * - **$PREFIX/fiscal_number** |br| Categoria: anagrafica + - Codice fiscale della persona fisica. String. Per il formato si faccia riferimento alla codifica + dell'attributo CF per i certificati, proposta nell'ambito del Draft ETSI EN 319 412-1, + che nel caso specifico prevede la seguente composizione: + TINIT- + + Esempio: + + ``"$PREFIX/fiscal_number":“TINIT-ABCXYZ00W00Z000Z"`` + + - |spid-icon| |cieid-icon| + * - **$PREFIX/company_fiscal_number** |br| Categoria: anagrafica + - Codice fiscale Persona Giuridica. String. Per il formato si faccia riferimento alla codifica dell'attributo CF per i certificati, proposta + nell'ambito del Draft ETSI EN 319 412-1, che nel caso specifico prevede la seguente composizione: + + ``TINIT-segue il codice fiscale`` + + Esempio: + + ``"$PREFIX/company_fiscal_number":"TINIT-ABCXYZ00W00Z000Z"`` + + - |spid-icon| + * - **$PREFIX/vat_number** |br| Categoria: anagrafica + - Partita IVA. String. Per il formato si faccia riferimento alla codifica dell'attributo Partita IVA per i certificati, + proposta nell'ambito del Draft ETSI EN 319 412-1, che nel caso specifico prevede la seguente composizione: + + ``VATIT-`` + + Esempio: + + ``"$PREFIX/vat_number": "VATIT-12345678901"`` + + - |spid-icon| + * - **document_details** |br| Categoria: extra anagrafica + - Documento d'identità. JSON Object (document): + + Json contenente le proprietà che rappresentano: + + - "**type**" : valori ammessi: + + - *cartaIdentita, passaporto, patenteGuida,* + + - *patenteNautica, librettoPensione,* + + - *patentinoImpTermici, portoArmi,* + + - *tesseraRiconoscimento;* + + - "**document_number**" : Numero del documento; + - "**issuer**" : JSON Object: + + - "**name**" stringa ottenuta dalla + concatenazione dei termini costituenti la + denominazione dell'ente a meno di + congiunzioni, articoli e preposizioni. + + Es. regioneLazio ( Regione Lazio); + provinciaCatania ( Provincia di Catania); + prefetturaRoma (Prefettura di Roma); + MinisteroEconomiaFinanze ( Ministero + dell'Economia e delle Finanze); + + - "**date_of_issuance**" : data di rilascio del documento; + + - "**date_of_expiry**" : data di scadenza del documento; + + Esempio: + + .. code-block:: json + + "document_details":{ + "type":"cartaIdentita", + "document_number":"AS09452389", + "issuer":{ + "name":"ComuneRoma" + }, + "date_of_issuance":"2013-01-02", + "date_of_expiry":"2013-01-31" + } + + - |spid-icon| |cieid-icon| + * - **phone_number** |br| Categoria: extra anagrafica + - Numero di telefono mobile. String. Stringa numerica senza spazi intermedi |br| + Esempio: |br| + ``"phone_number":"VATIT-12345678901"`` + - |spid-icon| |cieid-icon| + * - **phone_number_verified** |br| Categoria: extra anagrafica + - Valore Booleano che indica se il numero di telefono mobile dell'utente è stato verificato dall'OP. + - |cieid-icon| + * - **$PREFIX/landline_number** |br| Categoria: extra anagrafica + - Numero di telefono fisso. String. Stringa numerica senza spazi intermedi |br| + Esempio: |br| + ``"$PREFIX/landline_number":"VATIT-12345678901"`` + - |cieid-icon| + * - **email** |br| Categoria: extra anagrafica + - Indirizzo di posta elettronica. String. Formato standard indirizzo di posta elettronica |br| + Esempio: |br| + ``"email":"name@domain.it"`` + - |spid-icon| |cieid-icon| + * - **email_verified** |br| Categoria: extra anagrafica + - Valore Booleano che indica se l'email dell'utente è stata verificata dall'OP. + - |cieid-icon| + * - **$PREFIX/e_delivery_service** |br| Categoria: extra anagrafica + - Domicilio digitale. Indirizzo casella PEC |br| + Esempio: |br| + ``"$PREFIX/e_delivery_service":"nome@pecdomain.it"`` + - |spid-icon| |cieid-icon| + * - **$PREFIX/eid_exp_date** |br| Categoria: extra anagrafica + - Data di scadenza identità. Secondo specifica ISO8601-2004 nel formato + "YYYY-MM-DD" dove |br| + YYYY indica l'anno utilizzando 4 cifre |br| + MM indica il mese in (due) cifre |br| + DD indica il giorno in (due) cifre |br| + Esempio: |br| + ``"$PREFIX/eid_exp_date":"2002-09-24"`` + - |spid-icon| + * - **address** |br| Categoria: extra anagrafica + - JSON Object (address): + + - "**street_address**": L'attributo contiene la tipologia (via, viale, piazza …), l'indirizzo e il numero civico. Le tre informazioni sono preferibilmente ordinate come d'uso per lo specifico Stato. + + - "**postal_code**": CAP + + - "**locality**": Comune + + - "**region**": Provincia + + - "**country_code**": Nazione + + Esempio: + + .. code-block:: json + + "address":{ + "street_address":"Via Liszt 21", + "postal_code":"00144", + "locality":"Roma", + "region":"RM", + "country_code":"IT" + } + + - |spid-icon| |cieid-icon| + +.. _user_claims_scopes: + + +Esempi +++++++ + +Si riportano per comodità gli esempi che danno luogo alla composizione di un unico JSON Object da parte di più attributi ed in particolare i claim ``"place_of_birth"``, ``"address"``, ``"document_details"``, ``$PREFIX/registered_office``. + +Si riportano a titolo di esempio due indirizzi italiani: + + +.. list-table:: + :widths: 20 80 + :header-rows: 1 + + * - **Attributo** + - **Esempio codifica OIDC** + * - Indirizzo domicilio fisico + CAP domicilio fisico + Comune domicilio fisico + Provincia domicilio fisico + Nazione domicilio fisico + - .. code-block:: json + + "address": { + "street_address":"Via Liszt 21", + "postal_code":"00144", + "locality":"Roma", + "region":"RM", + "country_code":"IT" + } + + * - Indirizzo domicilio fisico + CAP domicilio fisico + Comune domicilio fisico + Provincia domicilio fisico + Nazione domicilio fisico + - .. code-block:: json + + "address": { + "street_address":"S.S. Salaria Km 23,800", + "postal_code":"00015", + "locality":"Monterotondo", + "region":"RM", + "country_code":"IT" + } + +Vi sono casi, come per gli Stati Uniti d'America, dove oltre alla nazione (US) esiste uno Stato. +In tali casi lo Stato è indicato nel campo Provincia. +Si riporta il seguente esempio: + +.. list-table:: + :widths: 20 80 + :header-rows: 1 + + * - **Attributo** + - **Esempio codifica OIDC** + * - Indirizzo domicilio fisico + CAP domicilio fisico + Comune domicilio fisico + Provincia domicilio fisico + Nazione domicilio fisico + - .. code-block:: json + + "address":{ + "street_address":"503,Washington Avenue", + "postal_code":"12401", + "locality":"Kingston", + "region":"New york", + "country_code":"US" + } + diff --git a/it/_sources/authorization_endpoint.rst.txt b/it/_sources/authorization_endpoint.rst.txt new file mode 100644 index 00000000..4ec7145d --- /dev/null +++ b/it/_sources/authorization_endpoint.rst.txt @@ -0,0 +1,350 @@ +.. include:: ../common/common_definitions.rst + +Authorization endpoint (Authentication) +--------------------------------------- + +Request ++++++++ + +Per avviare il processo di autenticazione, il RP reindirizza l'utente all'*Authorization Endpoint* dell'OP selezionato, inviando una richiesta *HTTP* contenente il parametro **request** in formato **JWT** firmato e contenente l'*Authorization Request* firmata dal RP. + +Per veicolare la richiesta, il RP PUÒ utilizzare i metodi **POST** e **GET**. Mediante il metodo **POST** i parametri DEVONO essere trasmessi utilizzando la *Form Serialization*. +Mediante il metodo **GET** i parametri DEVONO essere trasmessi utilizzando la *Query String Serialization*. Per maggiori dettagli vedi `OpenID.Core#Serializations`_. + +.. warning:: + Il parametro **scope** DEVE essere trasmesso sia come parametro nella chiamata HTTP sia all'interno dell'oggetto request e i loro valori DEVONO corrispondere. + + |cieid-icon| + I parametri **client_id** e **response_type** DOVREBBERO essere trasmessi sia come parametri sulla chiamata HTTP sia all'interno dell'oggetto request. + + |spid-icon| + I parametri **client_id** e **response_type** DEVONO essere trasmessi sia come parametri sulla chiamata HTTP sia all'interno dell'oggetto request e i loro valori DEVONO corrispondere, in caso contrario solo i parametri all’interno dell’oggetto request DEVONO essere considerati. + +.. seealso:: + + - :ref:`Esempio di Authorization Request ` + +Di seguito i parametri obbligatori nella richiesta di autenticazione *HTTP*. + +.. _tabella_parametri_authz_req: Authorization request + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Parametro** + - **Descrizione** + - **Supportato da** + * - **scope** + - Riporta di valori di *scope* supportati dall'OP e definiti dal parametro **scopes_supported** nel :ref:`Metadata OP `. DEVE essere presente almeno il valore *openid*. + - |spid-icon| |cieid-icon| + * - **code_challenge** + - Vedi :rfc:`7636#section-4.2`. + - |spid-icon| |cieid-icon| + * - **code_challenge_method** + - Come definito dal parametro **code_challenge_methods_supported** nel :ref:`Metadata OP `. + - |spid-icon| |cieid-icon| + * - **request** + - Vedi `OpenID.Core#JWTRequests`_. DEVE essere un **JWT** firmato. + - |spid-icon| |cieid-icon| + +Di seguito una tabella che riporta la composizione dell'header del **JWT**. + +.. _tabella_jwt_header_authz_req: Authorization request JWT header + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Jose Header** + - **Descrizione** + - **Supportato da** + * - **alg** + - Vedi :rfc:`7516#section-4.1.1`. Vedi :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **kid** + - Vedi :rfc:`7638#section_3`. + - |spid-icon| |cieid-icon| + +.. note:: + Il parametro **typ** se omesso assume il valore implicito di **JWT**. + + +Il payload del **JWT** contiene i seguenti parametri obbligatori. + +.. _tabella_jwt_payload_authz_req: Authorization request + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **client_id** + - Vedi `OpenID.Registration`_. DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP. + - |spid-icon| |cieid-icon| + * - **code_challenge** + - Come definito nella :ref:`Tabella dei parametri HTTP `. + - |spid-icon| |cieid-icon| + * - **code_challenge_method** + - Come definito nella :ref:`Tabella dei parametri HTTP `. + - |spid-icon| |cieid-icon| + * - **nonce** + - Vedi `OpenID.Core#AuthRequest`_. DEVE essere una stringa casuale di almeno 32 caratteri alfanumerici. Questo valore sarà restituito nell'ID Token fornito dal Token Endpoint, in modo da consentire al client di verificare che sia uguale a quello inviato nella richiesta di autenticazione. + - |spid-icon| |cieid-icon| + * - **prompt** + - Vedi `OpenID.Core#AuthRequest`_. I valori consentiti sono: + + **consent**: Se non è già attiva una sessione di Single Sign-On, + l'OP fa una richiesta di autenticazione all'utente. + Quindi chiede il consenso al trasferimento degli attributi. + + **consent login**: l'OP forza una richiesta di autenticazione all'utente. + Quindi chiede il consenso al trasferimento degli attributi. + + - |spid-icon| |cieid-icon| + * - **redirect_uri** + - Vedi `OpenID.Core#AuthRequest`_. DEVE essere una URL indicata nel :ref:`Metadata RP `. + - |spid-icon| |cieid-icon| + * - **response_type** + - Vedi `OpenID.Core#AuthRequest`_. Come definito dal parametro **response_types_supported** nel :ref:`Metadata OP `. + - |spid-icon| |cieid-icon| + * - **scope** + - Come definito nella :ref:`Tabella dei parametri HTTP `. + - |spid-icon| |cieid-icon| + * - **acr_values** + - Vedi `OpenID.Core#AuthRequest`_. Come definito dal parametro **acr_values_supported** nel :ref:`Metadata OP `. + Valori di riferimento della classe di contesto dell'Authentication Request. + DEVE essere una stringa separata da uno spazio, che specifica i valori "acr" richiesti in ordine di preferenza. L'OP PUÒ utilizzare un'autenticazione ad un livello più alto di quanto richiesto. Tale scelta non DEVE comportare un esito negativo della richiesta. + - |spid-icon| |cieid-icon| + * - **claims** + - Vedi `OpenID.Core#ClaimsRequestParameter`_. Vedi Sezione "Parametri scope e claims". + - |spid-icon| |cieid-icon| + * - **state** + - Vedi `OpenID.Core#AuthRequest`_. DEVE essere una stringa casuale di almeno 32 caratteri alfanumerici. Identificativo univoco della sessione lato RP. Questo valore verrà restituito al client nella risposta al termine dell'autenticazione. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **iss** + - DEVE corrispondere al *client_id*. + - |spid-icon| |cieid-icon| + * - **aud** + - DEVE corrispondere all'identificativo del OP (parametro *issuer* presente nel :ref:`Metadata OP `.) + - |spid-icon| |cieid-icon| + * - **ui_locales** + - Lingue preferibili per visualizzare le pagine dell’OP. L’OP può ignorare questo parametro se non dispone di nessuna delle lingue indicate. Lista di codici RFC5646 separati da spazi. + - |spid-icon| |cieid-icon| + +.. note:: + **PKCE** è un'estensione del protocollo *OAuth 2.0* prevista anche nel profilo *iGov* (`International Government Assurance Profile for OAuth 2.0 `_) e finalizzata ad evitare un potenziale attacco attuato con l'intercettazione dell'*authorization code*. Consiste nella generazione di un codice (**code verifier**) e del suo hash (**code challenge**). Il **code challenge** viene inviato all'OP nella richiesta di autenticazione. + + Quando il RP contatta il *Token Endpoint* al termine del flusso di autenticazione, invia il **code verifier** originariamente creato, in modo che l'OP possa confrontare che il suo hash corrisponda con quello acquisito nella richiesta di autenticazione. + + Di seguito un script Python di esempio per generare i parametri richiesti. + + .. literalinclude :: ../../static/pkce.py + :language: python + + +.. _parametri_scope_claims: + +Parametri **scope** e **claims** +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. admonition:: |spid-icon| + + Gli attributi dell'utente POSSONO essere richiesti dal RP nell'Authorization Request usando il parametro **claims**. + + Non è possibile richiedere attributi SPID nell' ID Token. Gli attributi dell'utente sono disponibili all'interno della response dello UserInfo endpoint. + + + +.. admonition:: |cieid-icon| + + Gli attributi dell'utente POSSONO essere richiesti dal RP nell'Authorization Request usando i parametri **scope** o **claims**. + + + Nel caso di utilizzo del parametro **scope** i seguenti valori sono supportati: + + - **profile**: usando questo valore è possibile ottenere il profilo utente di default che corrisponde al Minimum Dataset eIDAS: + + - *family_name*, + - *given_name*, + - *birthdate*, + - *\https://attributes.eid.gov.it/fiscal_number* (National Unique Identifier). + + - **email**: questo valore permette di ottenere, se resi disponibili dall'utente, i seguenti attributi: + + - *email*, + - *email_verified*. + + Il parametro **scope** PUÒ contenere uno o più valori separati da uno spazio. Ad esempio l'utilizzo congiunto di *profile* e *email* permette di ottenere l'unione degli insiemi degli attributi (Minimum Dataset eIDAS e l'email). + Nel caso di richiesta di singoli attributi dell'utente o specifiche combinazioni di essi, Il RP DOVREBBE usare il parametro **claims**. + + Gli attributi richiesti tramite il parametro **scope** sono disponibili sia nell'ID Token e sia nella risposta allo *userinfo endpoint*. + + .. warning:: + + Quando il parametro **scope** contiene solo il valore **openid** e il parametro **claims** non è presente oppure non è valorizzato, la response dello userinfo endpoint NON DEVE contenere nessun attributo utente ma soltanto il claim *sub*. + +Per la definizione del parametro **claims** e la modalità di utilizzo per la richiesta degli attributi dell'utente si può fare riferimento a `OpenID.Core#ClaimsParameter`_. + + +Response +++++++++ + +Un'Authentication response è un messaggio di risposta di autorizzazione OAuth 2.0 +restituito dall'authorization endpoint dell'OpenID Provider (OP) al termine del flusso di +autenticazione. L'OP reindirizzerà l'utente all'url contenuto nel parametro redirect_uri specificato nella richiesta di autorizzazione, aggiungendo i parametri della risposta. + +.. seealso:: + + - https://tools.ietf.org/html/rfc6749#section-4.1.2 + - https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation + +Se l'autenticazione è avvenuta con successo, l'OpenID Provider (OP), +reindirizza l'utente aggiungendo i seguenti parametri obbligatori come query parameters al *redirect_uri* (come definito in `OpenID.Core#AuthResponse`_): + +.. _tabella_authz_res: Authorization response + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **code** + - Codice univoco di autorizzazione (*Authorization Code*) che il client può passare al Token Endpoint per ottenere un ID Token e un Access Token. Questo ha il vantaggio di non esporre alcun token allo User Agent o a malware che controllano questo. + - |spid-icon| |cieid-icon| + * - **state** + - Valore state incluso nell'*Authentication Request*. Il client è tenuto a verificarne la corrispondenza. Deve essere lo stesso valore indicato dal client nella Authorization Request. + - |spid-icon| |cieid-icon| + * - **iss** + - Identificatore univoco dell'OP che ha creato l'Authentication Response. Il RP DEVE validare + questo parametro e NON DEVE permettere a più OP di usare lo stesso identificatore. + - |cieid-icon| + + +Esempio di Authorization Response dell'OP: + + .. code-block:: http + + http://rp-test.it/oidc/rp/callback/?code=a032faf23d986353019ff8eda96cadce2ea1c368f04bf4c5e1759d559dda1c08056c7c4d4e8058cb002a0c8fa9a920272350aa102548523a8aff4ccdb44cb3fa&state=2Ujz3tbBHWQEL4XPFSJ5ANSjkhd7IlfC&iss=http%3A%2F%2Fop-test%2Foidc%2Fop%2F + + +Gestione degli errori ++++++++++++++++++++++ + +In caso di errore, l'OP o il RP rappresentano i messaggi di anomalia relativi agli scambi OpenID +Connect, come descritti nelle relative tabelle definite dalle `Linee Guida UX SPID`_. + +.. _tabella_authz_errs_res: Authorization response errors + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **Errore** + - Vedi :ref:`Codici di errori ` + - |spid-icon| |cieid-icon| + * - **Descrizione dell'errore** + - Descrizione più dettagliata dell'errore, finalizzata ad aiutare lo sviluppatore per eventuale debugging. Questo messaggio non è + destinato ad essere visualizzato all'utente (a tal fine si faccia riferimento alle `Linee Guida UX SPID`_) + - |spid-icon| |cieid-icon| + * - **state** + - Parametro obbligatorio solo nel caso di risposta di errore alla *Authentication Request* e DEVE essere uguale al valore *state* incluso nella *Authentication Request*. Il RP DEVE verificare che corrisponda a quello inviato nella *Authentication Request*. + - |spid-icon| |cieid-icon| + + +.. _codici_errore: + +Codici di errore +^^^^^^^^^^^^^^^^ + +.. _tabella_authz_errs: Authorization errors + + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Errore** + - **Descrizione** + - **Codice HTTP** + - **Supportato da** + + * - *access_denied* + - L’OP ha negato l’accesso a causa di credenziali non valide o non adeguate al livello SPID richiesto (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *unauthorized_client* + - Il client non è autorizzato a richiedere un authorization code (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *invalid_request* + - La richiesta non è valida a causa della mancanza o della non correttezza di uno o più parametri (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *invalid_scope* + - Sono stati richiesti degli scope non validi (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *server_error* + - L’OP ha riscontrato un problema interno (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *temporarily_unavailable* + - L’OP ha riscontrato un problema interno temporaneo (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *unsupported_response_type* + - Il response_type richiesto non è supportato (:rfc:`6749#section-4.1.2.1`). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *login_required* + - L'OP richiede l'autenticazione da parte dell'utente (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *consent_required* + - L'OP richiede il consenso esplicito da parte dell'utente (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *request_uri_not_supported* + - L'OP non supporta l'uso del parametro *request_uri* (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *registration_not_supported* + - L'OP non supporta l'uso del parametro *registration* (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + * - *invalid_request_object* + - Il parametro *request* contiene un *Request Object* non valido (`OpenID.Core#AuthError`_). + - *302 Found* + - |spid-icon| |cieid-icon| + + +.. warning:: + + In caso di URI di reindirizzamento non valido, non corrispondente o mancante, l'OP restituisce *400 Bad Request* come codice HTTP. + + diff --git a/it/_sources/avvisi_spid.rst.txt b/it/_sources/avvisi_spid.rst.txt new file mode 100644 index 00000000..0b34b811 --- /dev/null +++ b/it/_sources/avvisi_spid.rst.txt @@ -0,0 +1,37 @@ +Riferimenti normativi SPID ++++++++++++++++++++++++++++ + +L'avvio del **Sistema SPID**, per sua natura e complessità, può richiedere di intervenire su diversi aspetti con specificazioni, chiarimenti, note informative e casi esemplificativi, al fine di dare supporto ad una migliore applicazione e comprensione dei Regolamenti SPID già emanati dall'AgID in conformità con quanto prescritto dall'art.4 del DPCM 24 ottobre 2014. + +Al fine di raccogliere organicamente tali interventi e attribuirvi un carattere cogente che ne comporti l'obbligo di applicazione da parte degli attori convolti nel Sistema SPID, siano essi pubblici che privati, è stata creata la presente sezione **“Avvisi SPID”** con l'obiettivo di assicurare un'uniforme interpretazione delle regole, degli aspetti tecnici e di quant'altro necessario per il corretto funzionamento del Sistema nel suo complesso. + +Le presenti regole tecniche implementano i seguenti avvisi SPID: + + +.. list-table:: + :widths: 20 40 20 + :header-rows: 1 + + * - Avviso + - Riferimento + - Data + + * - LL.GG. OpenID Connect in SPID + - `LL.GG. OpenID Connect in SPID `_ + - 24/11/2021 + + * - Avviso n.41 + - `Avviso n.41 - Integrazione LL.GG. OpenID Connect in SPID.pdf `_ + - 06/05/2022 + + * - Tabella Attributi utente v1.3 + - `Tabella Attributi in SPID - Integrazione LL.GG. OpenID Connect in SPID.pdf `_ + - 24/06/2022 + + * - Determina SPID OpenID Connect Federation + - `Regole tecniche per il funzionamento della Federazione SPID OpenID Connect - Integrazione LL.GG. OpenID Connect in SPID.pdf - `_ + - 14/09/2022 + + * - Linee Guida Attribute Authority SPID + - `Linee guida recanti le regole tecniche dei gestori di attributi qualificati `_ + - 18/07/2022 diff --git a/it/_sources/come_contribuire.rst.txt b/it/_sources/come_contribuire.rst.txt new file mode 100644 index 00000000..e63176f7 --- /dev/null +++ b/it/_sources/come_contribuire.rst.txt @@ -0,0 +1,12 @@ +.. include:: ../common/common_definitions.rst + +Come contribuire +---------------- + +Per contribuire clicca in alto a destra sulla icona di GitHub, alla voce "Sorgente" e accedi al repository pubblico. + +Se trovi una inesattezza o desideri risolvere un dubbio o semplicemente notificare qualcosa per migliorare questa documentazione, apri una nuova Issue. + +A seguito dell'apertura della Issue e dei riscontri ottenuti dalla comunità di Developers italia potrai aprire una nuova Pull Request contenente la modifica o la correzione da te proposta. + + diff --git a/it/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt b/it/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt new file mode 100644 index 00000000..a5fd16cc --- /dev/null +++ b/it/_sources/confronto_oidc_cie_e_oidc_igov.rst.txt @@ -0,0 +1,41 @@ +.. include:: ../common/common_definitions.rst + +Differenze con OIDC iGov +------------------------ + +CIE OpenID Connect e SPID OpenID Connect sono basati su `iGov.OIDC`_ con le seguenti differenze: + + - La sezione 2.1 di iGov riporta **vtr**, **acr_values** e **PKCE** come OPZIONALI, sia in SPID che in CIE id **PKCE** e **acr_values** sono RICHIESTI. In entrambe le implementazioni di SPID e CIE, si è adottato **acr_values** al posto di **vtr**. + + - L'Authentication Response nel flusso di autenticazione di CIE impone l'uso del claim **iss** per evitare l'attacco mix-up `I-D.ietf-OAuth-Security-BCP`_. L'uso di questo claim è OPZIONALE in SPID. + + - La sezione 2.4 di iGov stabilisce "Gli RP POSSONO opzionalmente mandare richieste all'Authorization Endpoint usando il parametro request." Sia in SPID che in CIE id, l'uso del parametro request è RICHIESTO. + + - La sezione 3.1 di iGov stabilisce che "in caso di utilizzo di **vtr** nella richiesta di autenticazione, l'ID Token DEVE contenere i seguenti claim RICHIESTI, cioè: **vot** e **vtm** ". Considerando che **vtr** non è usato in SPID e CIE id, i claim appena citati non vengono inclusi all'interno dell'ID Token. + + - La sezione 3.1 di iGov stabilisce che "il claim **auth-time** nell'ID Token è RACCOMANDATO". SPID e CIE id non adottano questo claim nell'ID Token. + + - L'ID Token, sia in SPID che in CIE id, DEVE avere il claim **acr** RICHIESTO, mentre questo è opzionale nell'iGov draft iGov. + + - L'ID Token, sia in SPID che in CIE id, ha il requisito del claim **at_hash** RICHIESTO. Questo è OPZIONALE in OIDC-CORE è assente in iGOV. + + - Sia in SPID che in CIE id, l'identificatore del soggetto DEVE essere **pairwised**. + + - La UserInfo Response, sia in SPID che in CIE id, DEVE essere un Nested JWT, firmato con la chiave privata dell'emettitore e cifrato con la chiave pubblica del RP. + + - Il JWT firmato della UserInfo Response DEVE avere i claim **iss**, **sub**, **aud**, **iat** e **exp**. + + - La sezione 3.4 di iGov stabilisce "Gli OpenID Provider POSSONO accettare oggetti request by reference usando il parametro request_uri". Questo parametro è intercambiabile con il parametro request. SPID e CIE id adottano solamente il parametro request. + + - Sezione 3.8. La registrazione dinamica di iGOV specifica che la registrazione dinamica del client è obbligatoria. Sia in CIE id che in SPID, la registrazione automatica OIDC del client è OBBLIGATORIA, mentre la registrazione dinamica OIDC del client NON DOVREBBE essere supportata. + + - Nella sezione 4.2 di iGOV gli scope **openid**, **offline_access**, **profile** e **email** vengono usati in CIE id OpenID Connect proposal e non considerano gli altri scope raccomandati nel profilo iGov, cioè: **doc**. + + - Nella sezione 4.2 di iGOV gli scope **openid**, **offline_access** vengono usati in SPID OpenID Connect proposal e non considerano gli altri scope raccomandati nel profilo iGov, cioè: **doc**. + + - La sezione 4.3 di iGov definisce la politica relativa all'oggetto userinfo del claim request. In CIE id, definiamo la politica per entrambi gli oggetti userinfo e ID Token. + + - Nelle sezioni 3.7 e 2.5 di iGOV, i Metadata sia di SPID che di CIE id vengono distribuiti secondo le modalità definite nella sezione "3. Metadata". + + - L'Access Token è un JWT firmato in conformità a :rfc:`9068`. + diff --git a/it/_sources/cryptographic_algos.rst.txt b/it/_sources/cryptographic_algos.rst.txt new file mode 100644 index 00000000..81aaaa08 --- /dev/null +++ b/it/_sources/cryptographic_algos.rst.txt @@ -0,0 +1,120 @@ +.. include:: ../common/common_definitions.rst + +.. _supported_algs: + +Algoritmi crittografici ++++++++++++++++++++++++ + +Tutti i partecipanti devono pubblicare gli algoritmi supportati +di criptazione e firma all'interno dei propri metadata. Tali agoritmi sono utilizzati per tutte le operazioni di cifratura e firma previsti da OIDC core e di Federation. + +.. note:: + + La lunghezza delle chiavi RSA deve essere pari o superiore a 2048 bit. + Si raccomanda una lunghezza di 4096 bit. + +In SPID e CIE id i seguenti algoritmi DEVONO essere supportati: + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Algoritmi** + - **Operazioni** + - **Riferimento** + - **Supportato da** + * - **RS256** + - Signature + - `OpenID.Core`_ and `RFC7518 `_. + - |spid-icon| |cieid-icon| + * - **RS512** + - Signature + - `RFC7518 `_ + - |spid-icon| |cieid-icon| + * - **RSA-OAEP** + - Key Encryption + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **RSA-OAEP-256** + - Key Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + * - **A128CBC-HS256** + - Content Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + * - **A256CBC-HS512** + - Content Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + +In SPID e CIE id è RACCOMANDATO il supporto per i seguenti algoritmi: + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Algoritmi** + - **Operazioni** + - **Riferimento** + - **Applicabile a** + * - **ES256** + - Signature + - `OpenID.Core`_ and `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **ES512** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **PS256** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **PS512** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **ECDH-ES** + - Key Encryption + - `RFC7518`_. + - |cieid-icon| + * - **ECDH-ES+A128KW** + - Key Encryption + - `RFC7518`_. + - |cieid-icon| + * - **ECDH-ES+A256KW** + - Key Encryption + - `RFC7518`_. + - |cieid-icon| + + +In SPID e CIE id i seguenti algoritmi NON DEVONO essere supportati: + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Algoritmi** + - **Operazioni** + - **Riferimenti** + - **Applicabile a** + * - **none** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **RSA_1_5** + - Key Encryption + - `RFC7516`_. + - |spid-icon| |cieid-icon| + * - **HS256** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **HS384** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| + * - **HS512** + - Signature + - `RFC7518`_. + - |spid-icon| |cieid-icon| diff --git a/it/_sources/differenze_oidc_fed.rst.txt b/it/_sources/differenze_oidc_fed.rst.txt new file mode 100644 index 00000000..ad41294a --- /dev/null +++ b/it/_sources/differenze_oidc_fed.rst.txt @@ -0,0 +1,27 @@ +.. include:: ../common/common_definitions.rst + + +.. _differenze_con_oidc_federation: + +Differenze con OIDC Federation +------------------------------ + +In questa sezione sono elencate le differenze che intercorrono tra lo standard ufficiale e l'implementazione SPID e CIE. + + +Client Registration ++++++++++++++++++++ + +SPID e CIE supportano esclusivamente **automatic_client_registration**. La modalità **explicit client registration** non è supportata. + + +Trust Mark +++++++++++ + +L'esposizione dei Trust Mark in SPID e CIE è obbligatoria. Per approfondimenti sulla ragione dell'obbligo dei Trust Mark si rimanda alla sezione :ref:`Considerazioni di Sicurezza`. + + +Claim non supportati negli Entity Statement ++++++++++++++++++++++++++++++++++++++++++++ + +Poiché SPID e CIE non necessitano di alcun claim aggiuntivo in ambito federativo, non necessitano del claim **crit**. Inoltre non sono supportati i claim **aud**, **naming_constraints**, **policy_language_crit** e **trust_anchor_id**. L'eventuale presenza di questi claim non presenta alcuna implicazione, questi verranno semplicemente ignorati fino ad ulteriori avvisi che li normino. diff --git a/it/_sources/differenze_spid_cie.rst.txt b/it/_sources/differenze_spid_cie.rst.txt new file mode 100644 index 00000000..de6e7b8f --- /dev/null +++ b/it/_sources/differenze_spid_cie.rst.txt @@ -0,0 +1,68 @@ +.. include:: ../common/common_definitions.rst + +.. _DifferenzeSPID_CIE: + +Differenze tra SPID e CIE id +---------------------------- + +In questa sezione sono riportate le principali differenze tra i profili implementativi SPID e CIE id. + +Metadata +++++++++ + +Nei metadata OP e RP per CIE id sono presenti i parametri che abilitano la cifratura dell'ID Token (vedi le sezioni relative al `Metadata OP `_ e al `Metadata RP `_). SPID non consente la cifratura dell'ID Token, dunque tali parametri non sono richiesti. + +Inoltre, il metadata OP per CIE id richiede anche il parametro *revocation_endpoint_auth_methods_supported*, non richiesto da SPID. + +Authorization Endpoint +++++++++++++++++++++++ + +SPID, al contrario di CIE id, prevede l'inserimento obbligatorio dei parametri *client_id* e *response_type* nella richiesta HTTP. +Inoltre, CIE id prevede come obbligatorio il parametro *iss* nella response per mitigare gli attacchi di tipo mix-up `I-D.ietf-OAuth-Security-BCP`_. + + +Parametri Scope e Claims +++++++++++++++++++++++++ + +CIE id consente di richiedere gli attributi dell'utente sia tramite il parametro *claims* nella richiesta di autenticazione e sia tramite il parametro *scope*, abilitando in quest'ultimo i valori *profile* e *email*. + +SPID non consente l'utilizzo di *profile* e *email* nel parametro *scope*. + +Per ulteriori dettagli vedi la sezione :ref:`Parametri Scope e claims `. + + +ID Token +++++++++ + +SPID non consente di rilasciare gli attributi dell'utente all'interno dell'ID Token. +In CIE id gli attributi dell'utente sono disponibili sia nell'ID Token e sia nella UserInfo response. Inoltre, il CIE id supporta la criptazione dell'ID Token. + + +Refresh Token ++++++++++++++ + +SPID prevede l'utilizzo del Refresh Token per abilitare le sessioni lunghe rinnovabili così come definito nelle `LL.GG. OpenID Connect in SPID `_ e nell' `Avviso n.41 `_ . Consente, infatti, di ottenere, oltre all'Access Token, l'ID Token valido esclusivamente per SPID livello 1. + +In CIE id il Refresh Token non consente di ottenere l'ID Token e non è utilizzabile dagli RP per ottenere una nuova autenticazione dell'utente con l'OP o rinnovare una sessione preesistente. In CIE id il Refresh Token è usato per ottenere dallo UserInfo endpoint esclusivamente il medesimo set di attributi dell'utente richiesti in fase di autenticazione iniziale, per il quale l'utente ha espresso il consenso esplicito. +Per ulteriori dettagli si veda la sezione :ref:`Refresh Token `. + +UserInfo Endpoint ++++++++++++++++++ + +CIE id supporta entrambi i metodi HTTP GET e HTTP POST per le richieste allo UserInfo endpoint. +SPID consente solo l'utilizzo del metodo HTTP GET. + +Introspection Endpoint +++++++++++++++++++++++ + +CIE id prevede il solo parametro *active* nella risposta dell'Introspection endpoint. SPID aggiunge ulteriori parametri come specificato nella sezione :ref:`Introspection Endpoint `. + + +Revocation Endpoint e Logout +++++++++++++++++++++++++++++ + +Entrambi SPID e CIE id prevedono che il RP effettui una richiesta di revoca dell'Access Token in fase di logout dell'utente. +In SPID la revoca di un Access Token implica anche la revoca dell'eventuale Refresh Token ancora attivo ad esso collegato e la scadenza della sessione di Single Sign-On se ancora attiva. + +In CIE id, invece, la revoca di un Access Token non prevede la revoca del relativo Refresh Token, allo stesso tempo la richiesta di revoca di un Refresh Token determina anche la revoca di tutti i relativi token ancora attivi. + diff --git a/it/_sources/diventa_fornitore.rst.txt b/it/_sources/diventa_fornitore.rst.txt new file mode 100644 index 00000000..267f46b8 --- /dev/null +++ b/it/_sources/diventa_fornitore.rst.txt @@ -0,0 +1,11 @@ +.. include:: ../common/common_definitions.rst + + +Diventa fornitore di servizi +---------------------------- + +Qui di seguito riportiamo gli indirizzi di riferimento per le procedure di "onboarding" di SPID e CIE, cioè per diventare fornitori di servizi. + + - `Come diventare fornitori di servizi SPID `_ + + - `Come diventare fornitori di servizi CIE `_ diff --git a/it/_sources/entity_configuration.rst.txt b/it/_sources/entity_configuration.rst.txt new file mode 100644 index 00000000..5c3848f0 --- /dev/null +++ b/it/_sources/entity_configuration.rst.txt @@ -0,0 +1,121 @@ +.. include:: ../common/common_definitions.rst + + +.. _Entity_Configuration: + +Entity Configuration +-------------------- + +Un'**Entity Configuration (EC)** è un Metadata di Federazione in formato Jose e firmato da una Entità e riguardante se stessa, pubblicato presso il web endpoint **.well-known/openid-federation**. + +.. _firma_EC: + +Firma della Entity Configuration +++++++++++++++++++++++++++++++++ + +Tutte le operazioni di verifica della firma relative agli ES, EC e TM sono eseguite con le chiavi pubbliche di Federazione. Per quanto riguarda gli algoritmi di firma supportati si veda la Sezione :ref:`Algoritmi Crittografici `. + + +.. warning:: + Distinguiamo le chiavi di Federazione da quelle di OIDC Core. Queste ultime risiedono nei Metadata OIDC. Un EC contiene sia le chiavi pubbliche di Federazione che i Metadata OIDC. Le chiavi di Federazione DOVREBBERO essere diverse da quelle di OIDC Core. + + + +Entity Configuration - claim comuni ++++++++++++++++++++++++++++++++++++ + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **iss** + - String. Identificativo dell'entità che lo emette. + - |spid-icon| |cieid-icon| + * - **sub** + - String. Identificativo del soggetto a cui è riferito. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **jwks** + - Un JSON Web Key Set (JWKS) :rfc:`7517` che rappresenta la parte pubblica delle chiavi di firma dell'entità interessata. Ogni JWK nel set JWK DEVE avere un ID di chiave (claim kid). + - |spid-icon| |cieid-icon| + * - **metadata** + - JSON Object. Ogni chiave dell'oggetto JSON rappresenta un identificatore del tipo + di :ref:`Metadata` e ogni valore DEVE essere un oggetto JSON + che rappresenta i Metadata secondo lo schema di Metadata di quel tipo. + + Una configurazione di entità PUÒ contenere più dichiarazioni di Metadata, ma solo una per ogni tipo di Metadata (<**entity_type**>). + + I tipi consentiti sono i seguenti: + + - openid_relying_party + - openid_provider + - federation_entity + - oauth_authorization_server + - oauth_resource + - |spid-icon| |cieid-icon| + +.. warning:: + All'interno dell'EC i valori degli attributi **iss** e **sub** contengono il medesimo valore (URL). + + +Entity Configuration Foglia e intermediari +++++++++++++++++++++++++++++++++++++++++++ + +Gli EC delle entità Foglia e intermediari, in aggiunta ai claim precedentemente definiti, contengono anche i seguenti claim: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **authority_hints** + - Array di URL. Contiene una lista di URL delle entità superiori, quali TA o SA che POSSONO emettere un ES relativo a questo soggetto. + - |spid-icon| |cieid-icon| + * - **trust_marks** + - Un array JSON contenente i Trust Mark. Vedere la Sezione :ref:`Trust Mark `. + Obbligatorio per tutti i partecipanti fatta esclusione del Trust Anchor. + - |spid-icon| |cieid-icon| + +.. seealso:: + + - :ref:`Non-normative example of EC of an OP` + - :ref:`Non-normative example of EC of a RP` + - :ref:`Non-normative example of EC of a Federation Intermediary (SA)` + +.. _entity_configuration_ta: + +Entity Configuration Trust Anchor ++++++++++++++++++++++++++++++++++ + +Gli EC di un TA, in aggiunta ai claim comuni a tutti i partecipanti, contengono anche i seguenti: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **constraints** + - JSON Object che descrive un insieme di vincoli della Trust Chain e che DEVE contenere l'attributo **max_path_length**. Rappresenta il numero massimo di SA tra una Foglia e il TA. + PUÒ anche contenere il claim **allowed_leaf_entity_types**, che restringe i tipi di Entità riconoscobili come suoi discendenti. + - |spid-icon| |cieid-icon| + * - **trust_marks_issuers** + - JSON Array che indica quali autorità sono considerate attendibili nella Federazione per l'emissione di specifici TM, questi assegnati mediante il proprio identificativo univoco. + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - :ref:`Esempio di EC di un TA ` + diff --git a/it/_sources/entity_statement.rst.txt b/it/_sources/entity_statement.rst.txt new file mode 100644 index 00000000..c06fa145 --- /dev/null +++ b/it/_sources/entity_statement.rst.txt @@ -0,0 +1,303 @@ +.. include:: ../common/common_definitions.rst + +.. _Entity_Statement: + +Entity Statement +---------------- + +Il componente basilare per costruire una Catena di Fiducia (Trust Chain) è l'**Entity Statement (ES)**, un JWT firmato che contiene la chiavi pubbliche dell' Entità discendente (subject) e ulteriori dati usati per controllare il processo di risoluzione della Trust Chain. + +Una entità pubblica un **ES** relativo ad un suo discendente presso il proprio :ref:`Fetch Endpoint`. L'entità superiore PUÒ definire le policy sui metadata per un soggetto discendente e pubblicare i TM da lei emessi per questo. + + + +Firma di Entity Statement ++++++++++++++++++++++++++ + +Si applicano le medesime considerazioni fatte per gli **EC** e riportate nella sezione :ref:`Firma della Entity Configuration`. + + +Entity Statement +++++++++++++++++ + +Gli ES emessi dal TA o da un suo Intermediario per i propri diretti discendenti, DEVONO contenere i seguenti attributi: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **iss** + - Si rimanda alla specifica `OIDC-FED`_ Sezione 3.1 per i dettagli. + - |spid-icon| |cieid-icon| + * - **sub** + - Si rimanda alla specifica `OIDC-FED`_ Sezione 3.1 per i dettagli. + - |spid-icon| |cieid-icon| + * - **iat** + - Si rimanda alla specifica `OIDC-FED`_ Sezione 3.1 per i dettagli. + - |spid-icon| |cieid-icon| + * - **exp** + - Si rimanda alla specifica `OIDC-FED`_ Sezione 3.1 per i dettagli. + - |spid-icon| |cieid-icon| + * - **jwks** + - JWKS di Federazione dell'entità *sub*. Si rimanda alla specifica `OIDC-FED`_ Sezione 3.1 per i dettagli. + - |spid-icon| |cieid-icon| + * - **metadata_policy** + - JSON Object che descrive un criterio di Metadata. Ogni chiave dell'oggetto JSON rappresenta un identificatore del tipo di Metadata e ogni valore DEVE essere un oggetto JSON che rappresenta la politica dei Metadata in base allo schema di quel tipo di Metadata. Si rimanda alla specifica `OIDC-FED`_ Section 5.1 per i dettagli implementativi. + - |spid-icon| |cieid-icon| + * - **trust_marks** + - JSON Array contenente i Trust Mark emessi da se stesso per il soggetto discendente. + - |spid-icon| |cieid-icon| + * - **constraints** + - PUÒ contenere il claim **allowed_leaf_entity_types** per restringere i tipi di Entità riconoscobili per il suo discendente (esempio: solo RP). + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - `OIDC-FED#Section_3.1`_ + - :ref:`Esempio non normativo di Entity Statement` + +.. _Metadata_Policy: + +Metadata Policy ++++++++++++++++ + +Trust Anchors e Intermediari (SA) DEVONO pubblicare una policy relativa ai rispettivi discendenti nell'Entity Statement ad essi riferito. La Metadata Policy si DEVE applicare a cascata su tutti i discendenti. + +Metadata Policy di un TA per un RP +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro *metadata* di tipo *openid_realying_party* all'interno della policy che il TA stabilisce per un RP suo discendente diretto. + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operazioni** / **Valori** + - **Supportato da** + * - **jwks** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere i JWKS del RP relativi alle operazioni di Core + - |spid-icon| |cieid-icon| + * - **grant_types** + - Operazioni: *subset_of* |br| + Valori: DEVE essere *authorization_code* e *refresh_token* + - |spid-icon| |cieid-icon| + * - **id_token_signed_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **id_token_encrypted_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |cieid-icon| + * - **id_token_encrypted_response_enc** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |cieid-icon| + * - **userinfo_signed_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_enc** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_method** + - Operazioni: *one_of* |br| + Valori: DEVE essere *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **client_registration_types** + - Operazioni: *one_of* |br| + Valori: DEVE essere *automatic* + - |spid-icon| |cieid-icon| + + + + +Metadata Policy di un TA per un SA +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro *metadata* di tipo *openid_relying_party* all'interno della policy che il TA stabilisce per un SA. Questa policy DEVE essere applicata a cascata ai metadata dei RP discendenti diretti (aggregati) del SA. + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operazioni** / **Valori** + - **Supportato da** + * - **grant_types** + - Operazioni: *subset_of* |br| + Valori: DEVE essere *authorization_code* e *refresh_token* + - |spid-icon| |cieid-icon| + * - **id_token_signed_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **id_token_encrypted_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |cieid-icon| + * - **id_token_encrypted_response_enc** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |cieid-icon| + * - **userinfo_signed_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_alg** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_enc** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_method** + - Operazioni: *one_of* |br| + Valori: DEVE essere *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **client_registration_types** + - Operazioni: *one_of* |br| + Valori: DEVE essere *automatic* + - |spid-icon| |cieid-icon| + + +Metadata Policy di un SA per una RP +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro *metadata* di tipo *openid_relying_party* all'interno della policy che il SA stabilisce per un RP suo discendente diretto (Aggregato). + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operazioni** / **Valori** + - **Supportato da** + * - **jwks** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere i JWKS del RP relativi alle operazioni di Core + - |spid-icon| |cieid-icon| + + +Metadata Policy di un TA per un OP +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro *metadata* di tipo *openid_provider* all'interno della policy che il TA stabilisce per un RP suo discendente diretto. + +.. list-table:: + :widths: 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Operazioni** / **Valori** + - **Supportato da** + * - **jwks** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere i JWKS del OP relativi alle operazioni di Core + - |spid-icon| |cieid-icon| + * - **revocation_endpoint_auth_methods_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **code_challenge_methods_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE essere *S256* + - |spid-icon| |cieid-icon| + * - **scopes_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere *openid*, *offline_access*. Per CIE id PUÒ contenere anche *profile*, *email*. + - |spid-icon| |cieid-icon| + * - **response_types_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *code*. + - |spid-icon| |cieid-icon| + * - **response_modes_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE essere *form_post*, *query*. + - |spid-icon| |cieid-icon| + * - **grant_types_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE essere *refresh_token*, *authorization_code*. + - |spid-icon| |cieid-icon| + * - **acr_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE essere |br| *https://www.spid.gov.it/SpidL1*, |br| *https://www.spid.gov.it/SpidL2*, |br| *https://www.spid.gov.it/SpidL3*. + - |spid-icon| |cieid-icon| + * - **subject_types_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *pairwise*. + - |spid-icon| |cieid-icon| + * - **id_token_signing_alg_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **id_token_encryption_alg_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **id_token_encryption_enc_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_signing_alg_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_alg_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_enc_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_methods_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *private_key_jwt* + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_signing_alg_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + * - **claims_parameter_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *true* + - |spid-icon| |cieid-icon| + * - **request_parameter_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *true* + - |spid-icon| |cieid-icon| + * - **authorization_response_iss_parameter_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *true* + - |spid-icon| |cieid-icon| + * - **client_registration_types_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *automatic* + - |spid-icon| |cieid-icon| + * - **request_authentication_methods_supported** + - Operazioni: *one_of* |br| + Valori: DEVE essere *request_object* + - |spid-icon| |cieid-icon| + * - **request_authentication_signing_alg_values_supported** + - Operazioni: *subset_of* |br| + Valori: DEVE contenere gli algoritmi definiti nella Sezione :ref:`Algoritmi Crittografici ` + - |spid-icon| |cieid-icon| + +.. seealso:: + + - :ref:`Esempi non normativi di Metadata Policy` + + diff --git a/it/_sources/errors_federation.rst.txt b/it/_sources/errors_federation.rst.txt new file mode 100644 index 00000000..a87d2ef1 --- /dev/null +++ b/it/_sources/errors_federation.rst.txt @@ -0,0 +1,61 @@ +.. include:: ../common/common_definitions.rst + +.. _errors_federation: + +Gestione degli errori di federazione +++++++++++++++++++++++++++++++++++++ + +In caso di errore durante le operazioni di federazione, le entità DEVONO rappresentare i messaggi di anomalia come descritto di seguito. + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **Errore** + - Vedi :ref:`Codici di errori ` + - |spid-icon| |cieid-icon| + * - **Descrizione dell'errore** + - Descrizione più dettagliata dell'errore, finalizzata ad aiutare lo sviluppatore per eventuale debugging. + - |spid-icon| |cieid-icon| + + +.. _codici_errore_federation: + +Codici di errore di Federation +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Errore** + - **Descrizione** + - **Codice HTTP** + - **Supportato da** + * - *temporarily_unavailable* + - Uno degli endpoint di well-known o di Federation non è raggiungibile. + - *302 Found* or *400 Bad Request* + - |spid-icon| |cieid-icon| + * - *invalid_client* + - Il Client non è autorizzato perchè la validazione della Trust Chain fallisce. + - *302 Found* + - |spid-icon| |cieid-icon| + * - *unauthorized_client* + - L'applicazione del metadata policy produce un metadata non conforme o nessun Trust Mark valido per il profilo richiesto è presente all'interno della configurazione. + - *302 Found* + - |spid-icon| |cieid-icon| + * - *invalid_request* + - La richiesta non è completa o non è conforme a quanto definito dalle presenti specifiche tecniche. + - *400 Bad Request* + - |spid-icon| |cieid-icon| + * - *not_found* + - La risorsa richiesta non è stata trovata. + - *404 Not Found* + - |spid-icon| |cieid-icon| + + + diff --git a/it/_sources/esempi.rst.txt b/it/_sources/esempi.rst.txt new file mode 100644 index 00000000..676881a9 --- /dev/null +++ b/it/_sources/esempi.rst.txt @@ -0,0 +1,10 @@ +.. include:: ../common/common_definitions.rst + +Esempi +====== + +In questa sezione sono raccolti tutti gli esempi non normativi delle richieste e delle risposte agli endpoint di Federazione definiti all'interno di questo documento. + +Tutte le response di tipo jose sono state decodificate e rappresentate insieme alle loro intestazioni per migliorare la lettura. + +.. include:: ../common/common_examples.rst diff --git a/it/_sources/federation_endpoint.rst.txt b/it/_sources/federation_endpoint.rst.txt new file mode 100644 index 00000000..1012b5ac --- /dev/null +++ b/it/_sources/federation_endpoint.rst.txt @@ -0,0 +1,23 @@ +.. include:: ../common/common_definitions.rst + +.. _federation_endpoint: + +Endpoint di Federazione +----------------------- + +Tutte le entità DEVONO contenere i seguenti endpoint: + + - **/.well-known/openid-federation**: fornisce l'`Entity Configuration `__ (per maggiori dettagli vedi `OIDC-FED`_ Section 6) + - **resolve entity statement endpoint**: fornisce il metadata finale, la Trust Chain e i Trust Mark relativi ad un altro soggetto. Per maggiori dettagli vedi `OIDC-FED`_ Section 7.2. + +.. warning:: + Il **resolve entity statement endpoint** NON DEVE restituire alcuna informazione relativa ad un soggetto del quale non ha precedentemente raccolto gli statement e calcolato la Trust Chain. Nel caso in cui i TM non siano più validi al momento della richiesta, questi NON DEVONO essere inclusi nella risposta. + + +Le Entità di tipo **TA** o **SA** DEVONO offrire i seguenti endpoint, in aggiunta agli endpoint di federazione sopra riportati: + + - **fetch entity statement endpoint**: fornisce gli ES relativi ad un soggetto discendente diretto. Per ottenere un ES è necessario indicare almeno l'identificativo dell'entità di cui si vuole ottenere lo statement. (per maggiori dettagli vedi `OIDC-FED`_ Section 7.1) + - **trust mark status endpoint**: permette a un'entità di verificare se un TM è ancora attivo o no. La query DEVE essere inviata al soggetto che ha rilasciato quel TM. (per maggiori dettagli vedi `OIDC-FED`_ Section 7.4) + - **entity listing endpoint**: fornisce la lista delle entità discendenti registrate presso il TA o un SA (per maggiori dettagli vedi `OIDC-FED`_ Section 7.3) + +Un'entità di tipo **AA**, oltre agli endpoint di Federazione comuni a tutte le entità, DEVE riportare anche il **trust mark status endpoint** per consentire la validazione dinamica dei TM rilasciati dall'AA. diff --git a/it/_sources/flusso_autenticazione.rst.txt b/it/_sources/flusso_autenticazione.rst.txt new file mode 100644 index 00000000..e16faf66 --- /dev/null +++ b/it/_sources/flusso_autenticazione.rst.txt @@ -0,0 +1,41 @@ +.. include:: ../common/common_definitions.rst + +.. _flusso_autenticazione: + +Flusso di autenticazione +------------------------ + +Gli schemi di autenticazioni **"Entra con SPID"** e **"Entra con CIE"** implementano il flusso **OpenID Connect Authorization Code Flow** con l'estensione **PKCE** (Proof Key for Code Exchange, :rfc:`7636`). +Questo flusso restituisce un **Authorization Code** che può essere utilizzato per ottenere un **ID Token** +e un **Access Token** e se possibile anche un **Refresh Token**. +L'**Authorization Code Flow** ottiene l'**Authorization Code** dall'*Authorization Endpoint* dell'OpenID Provider e tutti i token sono restituiti dal **Token Endpoint**. + +.. image:: ../../images/flusso.svg + :width: 100% + + +Segue la descrizione dei passaggi, come da numerazione indicata in figura. + + #. L'Utente, nella pagina di accesso del Relying Party (RP): + + * Seleziona il pulsante "Entra con SPID" o "Entra con CIE"; + + * Nel caso SPID, seleziona l'OP con cui autenticarsi. + + #. Il RP prepara una Richiesta di Autorizzazione con i parametri necessari previsti da *PKCE* e la invia all'*Authorization Endpoint* dell'OP. + + #. L'OP autentica l'utente mediante l'inserimento delle credenziali e ottiene il consenso per l'accesso agli attributi dell'utente da parte del RP. + + #. L'OP reindirizza l'utente all'URL contenuto nel parametro *redirect_uri* specificato dal RP, passando un *Authorization Code* nell'Authorization Response. + + #. Il RP invia l'*Authorization Code* ricevuto al *Token Endpoint* dell'OP. + + #. Il *Token Endpoint* dell'OP rilascia un **ID Token**, un **Access Token** e se previsto un **Refresh Token**. + + #. Il RP riceve e valida l'**Access Token** e l'**ID Token**. Per chiedere gli attributi che erano stati autorizzati dall'utente al punto 3, invia una richiesta all'*UserInfo Endpoint* dell'OP utilizzando l'**Access Token** per l'autenticazione all'interno della intestazione HTTP Authorization. + + #. Lo *UserInfo Endpoint* dell'OP verifica la validità dell'**Access Token** e rilascia gli attributi richiesti al RP. + + + + diff --git a/it/_sources/index.rst.txt b/it/_sources/index.rst.txt new file mode 100644 index 00000000..122ed64c --- /dev/null +++ b/it/_sources/index.rst.txt @@ -0,0 +1,57 @@ +======================= +SPID/CIE OpenID Connect +======================= + +`SPID `_ e `CIE id `_ sono i Sistemi Pubblici di Identità Digitale Italiani e +adottano gli standard `OpenID Connect Core `_, `International Government Assurance Profile (iGov) for OpenID Connect 1.0 `_ e `OpenID Connect Federation 1.0 `_. + +Grazie all'`identità digitale `_, la Pubblica Amministrazione e i fornitori di servizi privati forniscono +la chiave per accedere ai servizi online attraverso una credenziale unica. + +Questa documentazione contiene le specifiche tecniche consolidate, conformi alle Linee Guida Nazionali, +per migliorare l'esperienza di integrazione alle Federazioni OIDC SPID e CIE id per i Fornitori di Servizio +pubblici e privati (RP), Identity Providers (OP) e Soggetti Aggregatori (SA). + +In questa documentazione trovi: + + - Gli esempi pratici dei Metadata, delle richieste e delle risposte OpenID Connect. + - Come effettuare la registrazione automatica dei RP presso gli OpenID Provider. + - Come un OpenID Provider riconosce e registra dinamicamente un RP. + - Come utilizzare gli endpoint della API della Federazione. + - Come autenticare un utente a SPID e CIE ed ottenere i suoi attributi. + + +Indice dei contenuti +-------------------- + +.. toctree:: + :maxdepth: 2 + + standards.rst + termini_acronimi.rst + la_federazione_delle_identita.rst + entity_configuration.rst + entity_statement.rst + trust_marks.rst + soggetti_aggregatori.rst + trust_negotiation.rst + federation_endpoint.rst + errors_federation.rst + metadata_oidc.rst + flusso_autenticazione.rst + authorization_endpoint.rst + token_endpoint.rst + userinfo_endpoint.rst + attributi_utente.rst + introspection_endpoint.rst + revocation_endpoint.rst + logout.rst + cryptographic_algos.rst + log_management.rst + differenze_spid_cie.rst + confronto_oidc_cie_e_oidc_igov.rst + differenze_oidc_fed.rst + seccons_bcps.rst + esempi.rst + diventa_fornitore.rst + come_contribuire.rst diff --git a/it/_sources/introspection_endpoint.rst.txt b/it/_sources/introspection_endpoint.rst.txt new file mode 100644 index 00000000..55541cf8 --- /dev/null +++ b/it/_sources/introspection_endpoint.rst.txt @@ -0,0 +1,109 @@ +.. include:: ../common/common_definitions.rst + +.. _introspection_endpoint: + +Introspection Endpoint (verifica validità token) +------------------------------------------------ + +L'Introspection Endpoint esposto dall'OP consente ai RP di ottenere informazioni su un token in loro possesso, come ad esempio la sua validità. + +.. seealso:: + + - https://tools.ietf.org/html/rfc7662 + - https://openid.net/specs/openid-igov-oauth2-1_0-03.html#Section-3.2.2 + +Request ++++++++ + +La richiesta all'Introspection Endpoint consiste nell'invio del token su cui si vogliono ottenere informazioni unitamente a una Client Assertion che consente di autenticare il RP che esegue la richiesta. + + +**Esempio:** + +.. code-block:: http + + POST /introspection HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88 … & + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + client_id=https%3A%2F%2Frp.spid.agid.gov.it& + token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT + QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8 + iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4 + MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA + RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw + RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9 + h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w… + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **client_assertion** + - JWT firmato con la chiave privata del Relying Party contenente gli stessi parametri documentati per le richieste al + Token Endpoint. L'OP deve verificare la validità di tutti i campi presenti nel JWT, nonché la validità della sua firma in relazione al parametro **client_id**. + - |spid-icon| |cieid-icon| + * - **client_assertion_type** + - String. Valori ammessi: **urn:ietf:params:oauth:clientassertion-type:jwt-bearer** + - |spid-icon| |cieid-icon| + * - **client_id** + - URI che identifica univocamente il RP. L'OP deve verificare che il client_id sia noto all'interno della Federazione. + - |spid-icon| |cieid-icon| + * - **token** + - Il token su cui il RP vuole ottenere informazioni. + - |spid-icon| |cieid-icon| + + +Response +++++++++ + +L'Introspection Endpoint risponde con un oggetto JSON definito come segue. + +**Esempio:** + +.. code-block:: json + + { + "active":true + } + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **active** + - Valore booleano che indica la validità del token. Se il token è scaduto, è revocato o non è mai stato emesso per il client_id chiamante, l'Introspection Endpoint deve restituire false. + - |spid-icon| |cieid-icon| + * - **scope** + - Lista degli scope richiesti al momento dell’Authorization Request. + - |spid-icon| + * - **exp** + - Scadenza del token. + - |spid-icon| + * - **sub** + - Identificatore del soggetto, coincidente con quello già rilasciato nell’ID Token. Il RP deve verificare che il valore coincida con quello contenuto nell’ID Token. + - |spid-icon| + * - **client_id** + - URI che identifica univocamente il RP come da Registro SPID. Il RP deve verificare che il valore coincida con il proprio client_id. + - |spid-icon| + * - **iss** + - Identificatore dell’OP che lo contraddistingue univocamente nella federazione nel formato Uniform Resource Locator (URL). Il client è tenuto a verificare che questo valore corrisponda all’OP chiamato. + - |spid-icon| + * - **aud** + - Contiene il client ID. Il client è tenuto a verificare che questo valore corrisponda al proprio client ID. + - |spid-icon| + +Codici di errore +++++++++++++++++ + +Come definiti per :ref:`Token endpoint`. diff --git a/it/_sources/la_federazione_delle_identita.rst.txt b/it/_sources/la_federazione_delle_identita.rst.txt new file mode 100644 index 00000000..fa6d3ecd --- /dev/null +++ b/it/_sources/la_federazione_delle_identita.rst.txt @@ -0,0 +1,57 @@ +.. include:: ../common/common_definitions.rst + +Le Federazioni eID Italiane +--------------------------- + +Una Federazione delle Identità Digitali è una infrastruttura all'interno della quale tante organizzazioni, afferenti a domini differenti, aderiscono ad un medesimo quadro regolatorio per costruire un meccanismo di fiducia sia amministrativo, mediante la stipula di convenzioni e accreditamento presso una o più autorità super partes, che tecnologico, mediante l'adozione di standard di interoperabilità sicuri che consentono l'interscambio dei dati. + +Questa configurazione stabilisce i livelli di garanzia e di sicurezza adeguati affinchè un individuo possa autenticarsi presso un servizio web (Service Provider) mediante la propria identità digitale, rilasciata da un altro servizio web (Identity Provider). + +I partecipanti (RP o OP), che si riconoscono all'interno della medesima Federazione, ottengono i Metadata gli uni degli altri. I Metadata contengono le chiavi pubbliche per le operazioni di firma digitale e criptazione e le definizioni necessarie all'interscambio delle informazioni. + +I Metadata sono certificati da un parte fidata che all'interno della Federazione SPID è AgID, mentre all'interno della Federazione CIE è il Ministero dell'Interno. Questi corrispondono alla Autorità di Federazione. + +SPID e CIE id implementano OpenID Connect Federation 1.0 e ne estendono alcune funzionalità, realizzano una implementazione concreta e producono le buone pratiche per la sua adozione. Per approfondimenti allo standard si rimanda alle specifiche ufficiali `OIDC-FED`_ e alla sezione :ref:`Differenze con OIDC Federation 1.0`. + + +OpenID Connect Federation ++++++++++++++++++++++++++ + +La Federazione OIDC produce una infrastruttura della fiducia che è: + + - **Dinamica**. La fiducia può essere stabilita dinamicamente durante la prima richiesta di autenticazione. + Le Autorità della Federazione espongono un endpoint che fornisce "dichiarazioni" firmate riguardanti le entità discendenti. Queste contengono le chiavi pubbliche dei discendenti e la politica dei Metadata. Le Autorità della Federazione possono disabilitare un'entità nella Federazione in qualsiasi momento, semplicemente smettendo di emettere le dichiarazioni inerenti a questa. + - **Scalabile**. Riduce significativamente i costi di onboarding, in accordo al principio di delega, con l'istituzione di entità intermediarie (SA). + - **Trasparente**. Qualsiasi Entità coinvolta nella Federazione può in ogni momento costruire la fiducia autonomamente e in modo sicuro. Inoltre, la composizione della Federazione, in tutte le sue parti, diventa navigabile mediante la sua API, in tempo reale. + +.. image:: ../../images/spid_cie_oidc_federation_model.svg + :width: 100% + +*Schema ad albero con le Autorità di Federazione SPID e CIE id e, salendo, gli OP che non hanno Intermediari, gli RP e gli Intermediari che a loro volta Aggregano altri RP.* + +Configurazione della Federazione +++++++++++++++++++++++++++++++++ + +La configurazione della Federazione è pubblicata dal Trust Anchor all'interno della sua :ref:`Entity Configuration`, disponibile presso un web path ben noto e corrispondente a **.well-known/openid-federation**. + +Tutti i partecipanti DEVONO ottenere, prima della fase di esercizio, la configurazione della Federazione e mantenerla aggiornata su base giornaliera. All'interno della configurazione della Federazione sono pubblicate le chiave pubbliche del Trust Anchor usate per le operazioni di firma, il numero massimo di Intermediari consentiti tra una Foglia e il Trust Anchor (**max_path length**) e le autorità abilitate all'emissione dei Trust Mark (**trust_marks_issuers**). + + +Si veda qui un esempio non normativo di :ref:`Entity Configuration response Trust Anchor` + + +Si veda la Sezione dedicata alle :ref:`Entity Configuration` per ulteriori dettagli. + + +Modalità di partecipazione +++++++++++++++++++++++++++ + +Per aderire alle Federazioni SPID e CIE id un partecipante deve pubblicare la propria configurazione (Entity Configuration) presso il proprio web endpoint :ref:`.well-known/openid-federation`. + +Gli incaricati tecnici ed amministrativi della Foglia completano la procedura amministrativa per la registrazione di una nuova Entità o l'aggiornamento di un'Entità preesistente definita dalla Autorità di Federazione o da un suo Intermediario (SA). + +L'Autorità di Federazione o il suo Intermediario, dopo aver effettuato tutti i controlli amministrativi e tecnici richiesti, registra le chiavi pubbliche della Foglia e rilascia una prova di adesione alla Federazione sotto forma di Trust Mark (TM). + +La Foglia DEVE includere il TM all'interno della propria configurazione di Federazione (Entity Configuration) come prova del buon esito del processo di onboarding. + +L'Autorità di Federazione o suo Intermediario DEVE pubblicare la dichiarazione di riconoscimento della Foglia (Entity Statement) contenente le chiavi pubbliche di Federazione della Foglia e i TM a questa rilasciati. diff --git a/it/_sources/log_management.rst.txt b/it/_sources/log_management.rst.txt new file mode 100644 index 00000000..e94d07cf --- /dev/null +++ b/it/_sources/log_management.rst.txt @@ -0,0 +1,56 @@ +.. include:: ../common/common_definitions.rst + +.. _Log_Management: + +Retention Policy +================ + +Gestione dei Log di un OP e di un RP +------------------------------------ + +Gli OP e gli RP DEVONO mantenere: + +1. Un registro delle transazioni contenente i log relativi ai messaggi scambiati. I messaggi memorizzati e mantenuti nel registro DEVONO essere almeno i seguenti: + + - **Trust Chain** relativa all'Entità con la quale è avvenuta la transazione, composta da: + + 1. L'**Entity Configuration** del Entità con la quale è avvenuta la transazione. + 2. [Solo per OP] L'**Entity Statement** del SA riferito al RP (se presente). + 3. L'**Entity Statement** del TA riferito al suo discendente. + 4. L'**Entity Configuration** del TA. + + - **AuthenticationRequest** + - **AuthenticationResponse** relativa all'*AuthenticationRequest* + - **TokenRequest** relativa all'*AuthenticationRequest* + - **TokenResponse** relativa alla *TokenRequest* + - L'eventuale **UserInfoRequest** relativa alla *TokenRequest* + - L'eventuale **UserInfoResponse** relativa alla *UserInfoRequest* + - L'eventuale **RevocationRequest** relativa alla *TokenRequest* + - L'eventuale **RevocationResponse** relativa alla *RevocationRequest* + +.. admonition:: |spid-icon| + + Per ogni messaggio POSSONO essere indicizzate, ai fini di ricerca e consultazione, le seguenti + informazioni: + + - authorization code + - client_id + - jti + - iss + - sub + - iat + - exp + +.. warning:: + Le informazioni contenute nei registri DEVONO essere mantenute e gestite per una durata non inferiore a 24 mesi nel pieno rispetto delle vigenti normative nazionali ed europee in materia di privacy. L’accesso ai dati DEVE essere riservato a personale incaricato. Al fine di garantire la confidenzialità DEVONO essere adottati meccanismi di cifratura dei dati o impiegati sistemi di basi di dati (DBMS) che realizzano la persistenza cifrata delle informazioni. Infine, nella memorizzazione dei dati DEVONO essere garantite le proprietà di integrità e non ripudio. + + +Registro storico delle chiavi pubbliche di Federazione +------------------------------------------------------ + +Al fine di consentire la verifica dei messaggi scambiati dalle Entità che partecipano alla federazione e delle relative Trust Chain, il TA DEVE pubblicare lo storico delle proprie chiavi pubbliche (JWKS) di federazione all'interno di un registro reso disponibile a tutti i partecipanti tramite l'endpoint */.well-known/openid-federation-historical-jwks*. Per ulteriori dettagli tecnici si rimanda alla Sezione 7.5 di `OIDC-FED`_. + +.. warning:: + Le chiavi che non sono sono più attive da più di 24 mesi POSSONO essere rimosse dal registro a discrezione del TA. + + diff --git a/it/_sources/logout.rst.txt b/it/_sources/logout.rst.txt new file mode 100644 index 00000000..47992ce1 --- /dev/null +++ b/it/_sources/logout.rst.txt @@ -0,0 +1,14 @@ +.. include:: ../common/common_definitions.rst + +Logout +------ + +.. admonition:: |cieid-icon| + + I RP POSSONO instaurare sessioni individuali relative agli utenti autenticati. Nei casi in cui tali sessioni individuali vengano instaurate dai RP, questi ultimi DEVONO fornire agli utenti una funzionalità di logout con lo scopo di eliminare la sessione individuale instaurata. + Durante la fase di logout i RP DEVONO revocare tutti gli Access Token ancora attivi e collegati all'autenticazione degli utenti, tramite l'utilizzo del revocation endpoint (:ref:`Revocation Endpoint `). + + .. note:: + Nel caso sia supportato dall'OP un meccanismo di *offline_access* tramite *Refresh Token*, quest'ultimo NON DEVE essere revocato a seguito di un logout. + + diff --git a/it/_sources/metadata_aa.rst.txt b/it/_sources/metadata_aa.rst.txt new file mode 100644 index 00000000..b0ea4c07 --- /dev/null +++ b/it/_sources/metadata_aa.rst.txt @@ -0,0 +1,116 @@ +.. include:: ../common/common_definitions.rst + + +Metadata Attribute Authority +++++++++++++++++++++++++++++ + +Una AA DEVE pubblicare, all'interno del suo EC, un Metadata *federation_entity* e un Metadata *oauth_resource* e, se le risorse sono protette, DEVE anche pubblicare un Metadata *oauth_authorization_server*. + + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + }, + "oauth_authorization_server":{ + ... + }, + "oauth_resource":{ + ... + } + } + } + +Il Metadata di tipo **"federation_entity"** DEVE contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **organization_name** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **policy_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **contacts** + - PEC istituzionale dell'ente. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **federation_trust_mark_status_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + + +Il Metadata di tipo **"oauth_authorization_server"** DEVE contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **issuer** + - Vedi :rfc:`8414#page-4`. DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'AA. + - |spid-icon| |cieid-icon| + * - **authorization_endpoint** + - Solo per Attribute Authority **private** flow. Vedi `LG-AA` and :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **token_endpoint** + - Vedi :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **jwks** + - Vedi `JWK`_. + - |spid-icon| |cieid-icon| + * - **scopes_supported** + - Vedi :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **response_types_supported** + - Vedi :rfc:`8414#page-4`, + - |spid-icon| |cieid-icon| + * - **grant_types_supported** + - Vedi :rfc:`8414#page-4` e :rfc:`8623`. + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_methods_supported** + - Vedi :rfc:`8414#page-4`. Il valore supportato è **private_key_jwt**. + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_signing_alg_values_supported** + - Vedi :rfc:`8414#page-4`. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **op_policy_uri** + - Vedi :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **op_tos_uri** + - Vedi :rfc:`8414#page-6`. + - |spid-icon| |cieid-icon| + * - **dpop_signing_alg_values_supported** + - Vedi `OAuth-DPoP`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + + +Il Metadata di tipo **"oauth_resource"** DEVE contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **resource** + - Vedi `OAuth-RS`_. Una o più HTTPS URL che identificano gli endpoint delle risorse protette. + - |spid-icon| |cieid-icon| diff --git a/it/_sources/metadata_oidc.rst.txt b/it/_sources/metadata_oidc.rst.txt new file mode 100644 index 00000000..1f33c07a --- /dev/null +++ b/it/_sources/metadata_oidc.rst.txt @@ -0,0 +1,21 @@ +.. include:: ../common/common_definitions.rst + +.. _metadata_oidc: + +Metadata +-------- + +OIDC-FED utilizza ed estende i claim dei Metadata così come definiti all'interno delle specifiche di OpenID Connect Discovery 1.0 (`OpenID.Discovery`_) e OpenID Connect Dynamic Client Registration 1.0 (`OpenID.Registration`_) rispettivamente per OP e RP. + +In OIDC-FED il Metadata OIDC relativo a RP e OP viene definito all'interno del claim **metadata** e del suo sotto claim ****, all'interno dell'Entity Configuration, come oggetto JSON. + + +.. toctree:: + :maxdepth: 1 + + metadata_oidc_op.rst + metadata_oidc_rp.rst + metadata_oidc_ta_sa.rst + metadata_aa.rst + + diff --git a/it/_sources/metadata_oidc_op.rst.txt b/it/_sources/metadata_oidc_op.rst.txt new file mode 100644 index 00000000..0698ab45 --- /dev/null +++ b/it/_sources/metadata_oidc_op.rst.txt @@ -0,0 +1,176 @@ +.. include:: ../common/common_definitions.rst + +.. _MetadataOP: + +OpenID Connect Provider Metadata (OP) ++++++++++++++++++++++++++++++++++++++ + +Un OP DEVE pubblicare all'interno del suo EC un Metadata da *federation_entity* e uno da *openid_provider* come riportato nel seguente esempio: + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + } + "openid_provider":{ + ... + } + } + } + +L'EC di un OP DEVE configurare un metadata di tipo **"federation_entity"** e contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **organization_name** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **policy_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **contacts** + - PEC istituzionale dell'ente. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.6 + - |spid-icon| |cieid-icon| + + +L'EC di un OP DEVE configurare un metadata di tipo **"openid_provider"** DEVE contenere almeno i seguenti parametri obbligatori: + + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **issuer** + - Vedi `OpenID.Discovery#OP_Metadata`_. DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. + - |spid-icon| |cieid-icon| + * - **authorization_endpoint** + - Vedi `OpenID.Discovery#OP_Metadata`_. + - |spid-icon| |cieid-icon| + * - **token_endpoint** + - Vedi `OpenID.Discovery#OP_Metadata`_. + - |spid-icon| |cieid-icon| + * - **userinfo_endpoint** + - Vedi `OpenID.Discovery#OP_Metadata`_. + - |spid-icon| |cieid-icon| + * - **introspection_endpoint** + - Vedi :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **revocation_endpoint** + - Vedi :rfc:`8414#page-4`. + - |spid-icon| |cieid-icon| + * - **revocation_endpoint_auth_methods_supported** + - Vedi :rfc:`8414#page-4`. Il valore supportato è **private_key_jwt** + - |cieid-icon| + * - **code_challenge_methods_supported** + - Vedi :rfc:`8414#page-4`. L'OP DEVE supportare S256 (vedi :rfc:`7636#section-4.3`). + - |spid-icon| |cieid-icon| + * - **scopes_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. I valori supportati sono *openid* e *offline_access*. CIE id supporta anche *profile*, *email*. Per maggiori dettagli vedi :ref:`Sezione User Claims `. + - |spid-icon| |cieid-icon| + * - **response_types_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Il valore supportato è **code**. + - |spid-icon| |cieid-icon| + * - **response_modes_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. I valori supportati sono *form_post* e *query*. + - |spid-icon| |cieid-icon| + * - **grant_types_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. I valori supportati sono *refresh_token* e *authorization_code*. + - |spid-icon| |cieid-icon| + * - **acr_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. I valori supportati sono: + + ``https://www.spid.gov.it/SpidL1`` + ``https://www.spid.gov.it/SpidL2`` + ``https://www.spid.gov.it/SpidL3`` + + - |spid-icon| |cieid-icon| + * - **subject_types_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Il valore supportato è **pairwise**. + - |spid-icon| |cieid-icon| + * - **id_token_signing_alg_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **id_token_encryption_alg_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. Vedi key encryption :ref:`supported_algs`. + - |cieid-icon| + * - **id_token_encryption_enc_values_supported** + - See `OpenID.Discovery#OP_Metadata`_. Vedi content encryption :ref:`supported_algs`. + - |cieid-icon| + * - **userinfo_signing_alg_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_alg_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi key encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encryption_enc_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi content encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **request_object_signing_alg_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| +.. * - **request_object_encryption_alg_values_supported** +.. - Fino a diversa indicazione di AgID, non deve essere incluso. +.. - |spid-icon| +.. * - **request_object_encryption_enc_values_supported** +.. - Fino a diversa indicazione di AgID, non deve essere incluso. +.. - |spid-icon| + * - **token_endpoint_auth_methods_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Il valore supportato è **private_key_jwt** + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_signing_alg_values_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **claims_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Vedi :ref:`Attributi Utente ` per maggiori dettagli. + - |spid-icon| |cieid-icon| + * - **claims_parameter_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Il valore supportato è *true*. + - |spid-icon| |cieid-icon| + * - **request_parameter_supported** + - Vedi `OpenID.Discovery#OP_Metadata`_. Il valore supportato è *true*. + - |spid-icon| |cieid-icon| + * - **authorization_response_iss_parameter_supported** + - Vedi :rfc:`9207#section-3`. Deve valere *true*. + - |cieid-icon| + * - **jwks** + - Vedi `OIDC-FED`_ Section 4.2 e `JWK`_. + - |spid-icon| |cieid-icon| + * - **client_registration_types_supported** + - Vedi `OIDC-FED`_ Section 4.2. Il valore supportato è **automatic**. + - |spid-icon| |cieid-icon| + * - **request_authentication_methods_supported** + - Vedi `OIDC-FED`_ Section 4.2. Il valore supportato è **request_object**. + - |spid-icon| |cieid-icon| + * - **request_authentication_signing_alg_values_supported** + - Vedi `OIDC-FED`_ Section 4.2. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + + +.. warning:: + Il Metadata **"openid_provider"** DEVE adottare il parametro **jwks** o **signed_jwks_uri** come normato da OID-FED invece del parametro **jwks_uri** come richiesto in `OpenID.Discovery#OP_Metadata`_. + +.. seealso:: + + - :ref:`Esempio di EC di un OP ` + + diff --git a/it/_sources/metadata_oidc_rp.rst.txt b/it/_sources/metadata_oidc_rp.rst.txt new file mode 100644 index 00000000..ca5f7b42 --- /dev/null +++ b/it/_sources/metadata_oidc_rp.rst.txt @@ -0,0 +1,105 @@ +.. include:: ../common/common_definitions.rst + +.. _MetadataRP: + +OpenID Connect Relying Party Metadata (RP) +++++++++++++++++++++++++++++++++++++++++++ + +Un RP DEVE pubblicare all'interno del suo EC un Metadata di tipo *federation_entity* e uno di tipo *openid_relying_party* come riportato nel seguente esempio: + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + } + "openid_relying_party":{ + ... + } + } + } + +Il Metadata di tipo **"federation_entity"** DEVE contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **organization_name** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **policy_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **logo_uri** + - (RACCOMANDATO) URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **contacts** + - PEC istituzionale dell'ente. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.6 + - |spid-icon| |cieid-icon| + + + + +Il Metadata di tipo **"openid_relying_party"** DEVE contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **redirect_uris** + - Vedi `OpenID.Registration#ClientMetadata`_. È obbligatorio l'uso dello schema HTTPS nel caso di client web-based. + - |spid-icon| |cieid-icon| + * - **grant_types** + - Vedi `OpenID.Registration#ClientMetadata`_. I valori ammissibili **authorization_code** e **refresh_token**. + - |spid-icon| |cieid-icon| + * - **jwks** + - Vedi `OpenID.Registration#ClientMetadata`_ e `JWK`_. + - |spid-icon| |cieid-icon| + * - **id_token_signed_response_alg** + - Vedi `OpenID.Registration#ClientMetadata`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **id_token_encrypted_response_alg** + - Vedi `OpenID.Registration#ClientMetadata`_. Vedi key encryption :ref:`supported_algs`. + - |cieid-icon| + * - **id_token_encrypted_response_enc** + - Vedi `OpenID.Registration#ClientMetadata`_. Obbligatorio solo nel caso sia presente anche il parametro *id_token_encrypted_response_alg*. Vedi content encryption :ref:`supported_algs`. + - |cieid-icon| + * - **userinfo_signed_response_alg** + - Vedi `OpenID.Registration#ClientMetadata`_. Vedi signature :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_alg** + - Vedi `OpenID.Registration#ClientMetadata`_. Vedi key encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **userinfo_encrypted_response_enc** + - Vedi `OpenID.Registration#ClientMetadata`_. Vedi content encryption :ref:`supported_algs`. + - |spid-icon| |cieid-icon| + * - **token_endpoint_auth_method** + - Vedi `OpenID.Registration#ClientMetadata`_. Il valore richiesto è **private_key_jwt**. + - |spid-icon| |cieid-icon| + * - **client_id** + - Vedi `OpenID.Registration`_. DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP. + - |spid-icon| |cieid-icon| + * - **client_registration_types** + - Vedi `OIDC-FED`_ Section 4.1. Il valore richiesto è **automatic**. + - |spid-icon| |cieid-icon| + * - **response_types** + - Array dei valori di response_type previsti da OAuth 2.0 che il RP userà nelle richieste di autenticazione. Deve contenere il valore **code**. + - |spid-icon| |cieid-icon| + +.. note:: + Gli URI presenti nel parametro **redirect_uris** POSSONO anche usare eventuali schemi custom (ad es. myapp://) al fine di supportare applicazioni mobili. + diff --git a/it/_sources/metadata_oidc_ta_sa.rst.txt b/it/_sources/metadata_oidc_ta_sa.rst.txt new file mode 100644 index 00000000..f2153bc3 --- /dev/null +++ b/it/_sources/metadata_oidc_ta_sa.rst.txt @@ -0,0 +1,62 @@ +.. include:: ../common/common_definitions.rst + +.. _MetadataTA: + +Metadata di Trust Anchor (TA) e Intermediari (SA) ++++++++++++++++++++++++++++++++++++++++++++++++++ + +Un TA e un SA DEVONO pubblicare all'interno del loro EC un Metadata da *federation_entity* come riportato nel seguente esempio: + +.. code-block:: json + + { + "metadata":{ + "federation_entity":{ + ... + } + } + } + +L'EC di un TA e di SA DEVE configurare un metadata di tipo **"federation_entity"** e contenere almeno i seguenti parametri obbligatori: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **organization_name** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **homepage_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **policy_uri** + - Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **logo_uri** + - URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **contacts** + - PEC istituzionale dell'ente. Vedi Sezione 4.8 di `OIDC-FED`_ + - |spid-icon| |cieid-icon| + * - **federation_fetch_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_list_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_trust_mark_status_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + * - **federation_resolve_endpoint** + - Vedi Sezione :ref:`Endpoint di Federazione ` e `OIDC-FED`_ Section 4.8 + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - Esempio di EC di un :ref:`OP ` e di un SA :ref:`SA ` + + diff --git a/it/_sources/revocation_endpoint.rst.txt b/it/_sources/revocation_endpoint.rst.txt new file mode 100644 index 00000000..c88eb72e --- /dev/null +++ b/it/_sources/revocation_endpoint.rst.txt @@ -0,0 +1,92 @@ +.. include:: ../common/common_definitions.rst + +.. _Revocation_Endpoint: + +Revocation Endpoint +------------------- + +Un RP PUÒ chiedere la revoca di un Access Token o di un Refresh Token emesso da un OP. + +L'OP DEVE revocare il token specificato nella richiesta. + +.. admonition:: |spid-icon| + + Quando l'utente esegue il logout o quando la sua sessione presso il RP scade (in base alle policy decise da quest'ultimo) il RP DEVE richiedere la revoca dell’Access Token e dell’eventuale Refresh Token in suo possesso, se questi non fossero già scaduti. + + .. note:: + La revoca di un Access Token comporta la revoca di tutti i Refresh Token non ancora scaduti a questo collegati. + + L'OP DEVE revocare il token specificato nella richiesta e DEVE terminare la sessione di Single Sign-On se ancora attiva. Eventuali altri token attivi per l’utente dovranno invece essere mantenuti validi. + +.. admonition:: |cieid-icon| + + La revoca di un Access Token NON DEVE comportare la revoca di tutti i Refresh Token a questo collegati. + + La revoca di un Refresh Token DEVE comportare la revoca di tutti gli Access Token a questo collegati. + +.. note:: + Il metodo di autenticazione del RP presso il *revocation endpoint* DEVE essere **private_key_jwt** (vedi il parametro *revocation_endpoint_auth_methods_supported* nella Sezione :ref:`Metadata OP `) + + +.. seealso:: + + - https://tools.ietf.org/html/rfc7009 + +Request ++++++++ + +La richiesta al Revocation Endpoint consiste nell'invio del token che si vuole revocare unitamente a una Client Assertion che consente di identificare il RP che esegue la richiesta. + + +**Esempio:** + +.. code-block:: http + + POST /revoke HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88& + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + client_id=https%3A%2F%2Frp.spid.agid.gov.it& + token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT + QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8 + iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4 + MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA + RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw + RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9 + h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **client_assertion** + - JWT firmato con la chiave privata OIDC del Relying Party contenente gli stessi parametri inseriti in fase di richiesta al Token Endpoint. L'OP deve verificare la validità di tutti i campi presenti nel JWT, nonché la validità della sua firma in relazione al parametro **client_id**. + - |spid-icon| |cieid-icon| + * - **client_assertion_type** + - String. **urn:ietf:params:oauth:clientassertion-type:jwt-bearer** + - |spid-icon| |cieid-icon| + * - **client_id** + - URL HTTPS che identifica univocamente il RP. + - |spid-icon| |cieid-icon| + * - **token** + - Il token che il RP chiede di revocare. + - |spid-icon| |cieid-icon| + + +Response +++++++++ + +Il Revocation Endpoint risponde con un codice HTTP 200, anche nel caso in cui il token indicato non esista o sia già stato revocato (in modo da non rilasciare informazioni). + + +Codici di errore +++++++++++++++++ + +Come definiti per :ref:`Token endpoint`. diff --git a/it/_sources/seccons_bcps.rst.txt b/it/_sources/seccons_bcps.rst.txt new file mode 100644 index 00000000..a5d40ca4 --- /dev/null +++ b/it/_sources/seccons_bcps.rst.txt @@ -0,0 +1,55 @@ +.. include:: ../common/common_definitions.rst + +.. _Considerazioni_di_Sicurezza: + +Considerazioni di Sicurezza +--------------------------- + +In questa sezione descriviamo alcune considerazioni di sicurezza in ambito OIDC Federation. + + +Trust Mark come deterrente contro gli abusi ++++++++++++++++++++++++++++++++++++++++++++ + +L'implementazione dei Trust Mark e il filtro su questi in fase di Federation Entity Discovery risulta necessario contro gli attacchi destinati al consumo delle risorse. Un OP attaccato con un numero ingente di connessioni presso il suo endpoint di *authorization*, contenenti **client_id** e **authority_hints** fasulli, produrrebbe svariate connessioni verso sistemi di terze parti nel tentativo di trovare un percorso verso la TA e instaurare la fiducia con il richiedente. + +L'OP DEVE validare staticamente il TM oppure DEVE escludere a priori la richiesta ove il TM non risultasse presente, in caso di assenza o non validità di un TM la procedura di Federation Entity Discovery NON DEVE essere avviata e NON DEVE creare di conseguenza connessioni verso sistemi di terze parti. + + +Numero Massimo di authority_hints ++++++++++++++++++++++++++++++++++ + +All'interno di una Federazione il Trust Anchor decide quante intermediazioni consentire tra di lui e le Foglie, mediante la constraint denominata **max_path_length**. Questo tipo di relazione è di tipo verticale, dalla Foglia alla radice. Questo attributo se valorizzato ad esempio con un valore numerico intero pari a 1 indica che soltanto un SA è consentito tra una Foglia e il TA. + +Ogni Foglia DEVE pubblicare i suoi superiori all'interno della lista contenuta nel claim **authority_hints**. Una Foglia all'interno della Federazione PUÒ avere superiori afferenti a diverse Federazioni. L'analisi dei superiori disponibili introduce un modello di navigazione orizzontale, ad esempio un OP tenta di trovare il percorso più breve verso il Trust Anchor attraverso tutti gli URL contenuti all'interno dell'array **authority_hints** prima di fare un ulteriore movimento verticale, a salire, verso uno degli Intermediari presenti in questo array. + +La soglia **max_path_length** si applica per la navigazione verticale e superata questa soglia senza aver trovato il TA, la procedura di Federation Entity Discovery DEVE essere interrotta. Si faccia l'esempio di un RP discendente di un SA che a sua volta è discendente di un altro SA, essendo il valore di **max_path_length** pari a 1 e, superata questa soglia senza aver trovato il Trust Anchor, la procedura DEVE essere interrotta. + +Allo stesso tempo la specifica OIDC Federation 1.0 non definisce un limite per il numero di **authority_hints**, questo perché nessun Trust Anchor può limitare il numero di Federazioni alle quali un partecipante può aderire. Per questa ragione è utile che gli implementatori adottino un limite massimo del numero di elementi consentiti all'interno dell'Array authority_hint. Questo per evitare che un numero esagerato di URL contenuti nella lista di **authority_hints**, dovuto ad una cattiva configurazione di una Foglia, produca un consumo di risorse eccessivo. + + +Resolve endpoint +++++++++++++++++ + +Questo endpoint DEVE rilasciare i Metadata, i Trust Mark e la Trust Chain già precedentemente elaborata e NON DEVE innescare una procedura di Federation Entity Discovery ad ogni richiesta pervenuta, a meno che questo endpoint non venga protetto con un meccanismo di autenticazione dei client, come ad esempio *private_key_jwt* [OIDC-CORE]. In caso di utilizzo di *private_key_jwt* il valore presente nel parametro *sub* del *private_key_jwt* DEVE coincidere con quello presente nella richiesta al Resolve endpoint. + + +Buone Pratiche +-------------- + +In questa sezione descriviamo alcune buone pratiche per ottenere la massima resa dalle entità di Federazione. + + +Specializzare le chiavi pubbliche OpenID Core e Federation +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +È buona pratica usare chiavi pubbliche specializzate per i due tipi di operazioni, Core e Federation. + +Modalità di aggiornamento dei Metadata OpenID Core +++++++++++++++++++++++++++++++++++++++++++++++++++ + +L'interoperabilità tra i partecipanti funziona mediante i Metadata ottenuti dal calcolo e dalla conservazione delle Trust Chain. Questo significa che se un OP al tempo T calcola la Trust Chain per un RP e questo al tempo T+n modifica i propri Metadata, l'OP di conseguenza potrebbe incorrere in problematiche di validazione delle richieste di autorizzazione del RP, fino a quando non avrà aggiornato la Trust Chain relativa a questo. + +La buona pratica per evitare le interruzioni di servizio relative alle operazioni di OIDC Core è quella di aggiungere le nuove chiavi pubbliche all'interno degli oggetti *jwks* senza rimuovere i valori preesistenti. Oppure, ad esempio, i nuovi *redirect_uri*. + +In questa maniera dopo il limite massimo di durata delle Trust Chain, definito con il claim **exp** e pubblicato nella Entity Configuration della TA, si ha la certezza che tutti i partecipanti abbiano rinnovato le loro Trust Chain, e sarà possibile agli amministratori della Foglia rimuovere le vecchie definizioni in cima alla lista. diff --git a/it/_sources/soggetti_aggregatori.rst.txt b/it/_sources/soggetti_aggregatori.rst.txt new file mode 100644 index 00000000..78c4da32 --- /dev/null +++ b/it/_sources/soggetti_aggregatori.rst.txt @@ -0,0 +1,40 @@ +.. include:: ../common/common_definitions.rst + +.. _Soggetti_aggregatori: + +Soggetti Aggregatori +^^^^^^^^^^^^^^^^^^^^ + +Un SA può registrare RP preesistenti e già conformi allo standard OIDC-FED, afferenti a domini esterni al proprio oppure mascherare dietro di sé i propri discendenti. Nel primo caso il SA è di tipo *Trasparente* (**Aggregatore Light**) mentre nel secondo caso è di tipo *Proxy* (**Aggregatore Full**). + +I SA **Light** registrano RP preesistenti e conformi a OIDC-FED e pubblicano gli ES a questi riferiti. + +I SA **Full** provvedono a costruire una interfaccia di autenticazione e federazione per conto dei propri aggregati, mediante risorse web solitamente esposte all'interno del proprio dominio. Questa tipologia di Aggregatore espone le seguenti risorse per ogni suo aggregato: + + - **.well-known/openid-federation**, contenente la Entity Configuration del proprio discendente (aggregato); + - Authorization callback endpoint per l'acquisizione dell'auth code da parte del OP (**redirect_uri**). + +Il SA di tipo **Full** DEVE aggiungere almeno uno dei codici identificativi presenti nell'**id_code** (così come definito nella Sezione :ref:`Composizione dei Trust Mark `), all'interno del web path che compone il client_id, questo identifica univocamente all'interno della federazione l'aggregato ``//``. Se sono disponibili più di un codice identificativo, il SA PUÒ riportarli nel web path come nel seguente esempio: ``/ipa_code/aoo_code/``. + +Nella seguente tabella sono presenti alcuni esempi non normativi per evidenziare le differenze tra gli aggregati Light e Full: + +.. list-table:: + :widths: 10 50 50 + :header-rows: 1 + + * - + - Modalità **Light** + - Modalità **Full** + * - **client_id** + - \https://www.rp.it/ + - \https://www.sa.it// + * - **redirect_uri** + - \https://www.rp.it/callback/ + - \https://www.sa.it//callback/ + * - **authorization endpoint** + - \https://www.rp.it/authorization/ + - \https://www.sa.it//authorization/ + * - **Entity Configuration** + - \https://www.rp.it/.well-known/openid-federation + - \https://www.sa.it//.well-known/openid-federation + diff --git a/it/_sources/standards.rst.txt b/it/_sources/standards.rst.txt new file mode 100644 index 00000000..42464024 --- /dev/null +++ b/it/_sources/standards.rst.txt @@ -0,0 +1,33 @@ +Riferimenti +----------- + +.. include:: ../common/standards.rst + + +Normativa Nazionale ed Europea +--------------------------------- + +.. list-table:: + :widths: 25 75 + :header-rows: 0 + + * - `CAD`_ + - DL 7 March 2005 n.82: "Codice dell'amministrazione digitale." (GU Serie Generale n.112 16-05-2005 - Suppl. Ordinario n. 93) + * - `DL-SEMPLIFICAZIONI`_ + - DL 16 July 2020 n.76: "Misure urgenti per la semplificazione e l'innovazione digitale." (20A04921) (GU Serie Generale n.228 14-09-2020 - Suppl. Ordinario n. 33) and its conversion into Law, with amendments, Law 11 September 2020 n. 120. + * - `EIDAS`_ + - Regulation (Eu) No 910/2014 of the European Parliament and of the Council 23 July 2014 "on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC." + + +.. include:: ../it/avvisi_spid.rst + + +Riferimenti normativi CIE id +++++++++++++++++++++++++++++ + +.. list-table:: + :widths: 25 75 + :header-rows: 0 + + * - `DM-CIE`_ + - DM 23 December 2015 n.210: "Modalità tecniche di emissione della Carta d'identità elettronica." (15A09809) (GU Serie Generale n.302 30-12-2015) diff --git a/it/_sources/termini_acronimi.rst.txt b/it/_sources/termini_acronimi.rst.txt new file mode 100644 index 00000000..f150ad14 --- /dev/null +++ b/it/_sources/termini_acronimi.rst.txt @@ -0,0 +1,113 @@ +.. include:: ../common/common_definitions.rst + +Termini e Acronimi +------------------ + +Termini ++++++++ + +Seguono i termini utilizzati da `OIDC-FED#Section_1.2`_ e in questo documento. + +.. list-table:: + :widths: 15 85 + :header-rows: 0 + + * - **Autorità di Federazione** + - Un'entità legale che gestisce la fiducia tra le parti coinvolte nella Federazione e norma il funzionamento e le modalità + di registrazione e riconoscimento dei partecipanti. + * - **Trust Anchor** + - Sistema gestito dalla Autorità di Federazione, che rappresenta la Federazione e la sua configurazione. + * - **Intermediario** + - Soggetto Aggregatore (SA), facilita l'ingresso nella Federazione e PUÒ gestire le funzionalità per conto di un + suo discendente (aggregato). Pubblica la propria configurazione all'interno della Federazione e le affermazioni di riconoscimento delle parti sue discendenti (aggregati) secondo le regole definite dall'Autorità di Federazione. + * - **Foglia** + - Entità definita dal protocollo OpenID Connect come Relying Party e Provider OpenID. Può anche essere una Attribute Authority (OAuth2 Authorization Server e Resource Server). + * - **Entità** + - Partecipante alla Federazione. Trust Anchor, Intermediario o Foglia. + * - **Entity Configuration** + - Dichiarazione di un'entità, emessa per proprio conto, nella forma di JWT auto firmato :rfc:`7515` e contenente la sua configurazione. Contiene le chiavi pubbliche di Federazione, i Metadata OIDC, gli URL delle autorità sue superiori e i Trust Mark emessi da autorità riconoscibili nella Federazione che attestano l'aderenza del soggetto a determinati profili. + * - **Entity Statement** + - Dichiarazione di riconoscimento emessa da un'entità superiore (Trust Anchor o Intermediario) riguardante un soggetto discendente (RP, OP, AA o Intermediario) in formato JWT firmato :rfc:`7515`, contenente le chiavi pubbliche del soggetto discendente, i Trust Mark emessi per i quali è emettitore e la politica dei Metadata da applicare ai Metadata del soggetto. + * - **Trust Mark** + - JWT firmato :rfc:`7515` dall'ente emettitore e relativo ad un partecipante. Attesta la conformità di questo ai profili riconoscibili all'interno Federazione (RP pubblico o privato, Soggetto Aggregatore Pubblico o Privato, etc.). La Foglia che acquisisce il marchio di fiducia durante il processo di onboarding DEVE includere questo nella sua Entity Configuration. + * - **Metadata** + - Documento che descrive l'implementazione di una entità OpenID Connect o OAuth2. Le implementazioni di ogni Entità condividono i Metadata per stabilire una base di fiducia e interoperabilità. + * - **Metadata policy** + - Il Trust Anchor pubblica le regole e le politiche da applicare sui Metadata dei discendenti, specificando quali valori o sottoinsiemi di valori sono consentiti per un dato parametro di Metadata. + * - **Authority hint** + - Array di valori URL contenente gli identificativi delle Entità superiori, Trust Anchor o Intermediario, che emettono un Entity Statement per i propri discendenti. + * - **Federation Entity Discovery** + - Raccolta di Entity Configuration e Statement. Inizia da un'Entità Foglia fino al raggiungimento del Trust Anchor. + * - **Trust Chain** + - Procedura di validazione della sequenza di Entity Configuration e Statement raccolta mediante Federation Entity Discovery, il cui esito positivo è un Metadata finale relativo ad una Entità e la data di scadenza entro la quale la Trust Chain deve essere aggiornata. + * - **Onboarding** + - Procedura di registrazione di una nuova entità all'interno della Federazione SPID e CIE + * - **Federation Endpoint** + - Endpoint definit in OIDC Federation 1.0, usati per prendere e risolvere gli statement delle entità, interrogare una lista di tutte le entità subordinate e verificare lo stato dei Trust Mark. +.. * - **Sessione individuale** +.. - Sessione che un fornitore di servizio (RP) può instaurare con un utente al fine di erogare un particolare servizio. + + +Acronimi +++++++++ + +In questa sezione sono definiti tutti gli acronimi utilizzati all'interno del testo. + +.. list-table:: + :widths: 15 85 + :header-rows: 0 + + * - **SPID** + - Sistema Pubblico di Identità Digitale italiano, la cui Authorità di Federazione è la AgID (Agenzia per l'Italia Digitale). + * - **CIE id** + - Sistema Pubblico di Identità Digitale italiano basato sulla Carta d'Identità Elettronica (CIE), di cui il Ministero dell'Interno è l'Autorità di Federazione. La gestione tecnica e operativa è affidata all'Istituto Poligrafico e Zecca dello Stato (IPZS). + * - **OIDC** + - OpenID Connect. + * - **OIDC-FED** + - `OIDC Federation 1.0 `_. + * - **FA** + - Autorità di Federazione (Federation Authority). + * - **TA** + - OIDC Federation Trust Anchor. + * - **AgID** + - Agenzia per l'Italia Digitale, FA/TA di SPID. + * - **MinInterno** + - Ministero dell'Interno, FA/TA di CIE id. + * - **OP** + - OpenID Provider (Entità Foglia). + * - **RP** + - Relying Party (Entità Foglia). + * - **SA** + - Soggetti Aggregatori. Entità Intermediarie che possono gestire tutti gli aspetti della Federazione di uno o più RP. + * - **AA** + - Attribute Authority, Gestore degli Attributi qualificati (Entità Foglia). + * - **TM** + - Trust Mark. + * - **EC** + - Entity Configuration. + * - **ES** + - Entity Statement. + * - **URL** + - Uniform Resource Locator, corrispondente ad un indirizzo web. + * - **JWT** + - Vedi :rfc:`7519` Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015. + * - **RS** + - OAuth2 Resource Server. + * - **$JWT** + - Il valore di un JWT (JSON Web Token). + + + +Convenzioni e Termini normativi ++++++++++++++++++++++++++++++++ + +Le parole chiave "DEVE" e "DEVONO", "NON DEVE" e "NON DEVONO", "RICHIEDE" e "RICHIESTO", "NON DEVE", "DOVREBBE", "NON DOVREBBE", "RACCOMANDATO", "PUÒ" e "OPZIONALE" nel presente documento devono essere interpretate come descritte nel BCP 14 :rfc:`2119` :rfc:`8174` quando e solo quando appaiono in maiuscolo. + +Le notazioni [...] e ... indicano che il testo è stato troncato per esigenze editoriali. + +*base64url* denota la codifica URL-safe base64 senza padding definita in :rfc:`7515#section-2`. + +Tutti gli esempi contenuti in questo documento sono da considerarsi come non normativi. + +.. warning:: + |warning-message-it| diff --git a/it/_sources/token_endpoint.rst.txt b/it/_sources/token_endpoint.rst.txt new file mode 100644 index 00000000..a2a9cbe7 --- /dev/null +++ b/it/_sources/token_endpoint.rst.txt @@ -0,0 +1,425 @@ +.. include:: ../common/common_definitions.rst + +Token Endpoint +-------------- + +Al termine del flusso di autenticazione descritto nel paragrafo precedente, il RP invia una richiesta al Token Endpoint inviando l'authorization code ricevuto dall'OP per ottenere un *ID Token* e un *Access Token* ed eventualmente un *Refresh Token* (se è stata effettuata una richiesta di autenticazione con *scope=offline_access* e *prompt=consent*. Vedi la Sezione :ref:`Refresh Token `). + +I token restituiti devono essere JWT firmati. + +.. admonition:: |spid-icon| + + In presenza di una `sessione lunga revocabile`_, il RP PUÒ chiamare il Token Endpoint inviando il *Refresh Token* in suo possesso per ottenere un nuovo *Access Token* e *ID Token*. + +.. note:: + Il metodo di autenticazione del RP presso il token endpoint è il **private_key_jwt** (`OpenID.Core#ClientAuthentication`_). + + +.. seealso:: + + * https://tools.ietf.org/html/rfc6749#section-3.2 + * https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint + * https://openid.net/specs/openid-igov-oauth2-1_0-03.html#Section-2.1.2 + * https://openid.net/specs/openid-igov-openid-connect-1_0-03.html#Section-2.2 + + +Request ++++++++ + +Di seguito i claim che DEVONO essere inseriti nella *Token Request*. + + +**Esempio di richiesta con authorization code (caso 1)** + + .. code-block:: json + + POST /token HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_id=https://rp.spid.agid.gov.it& + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…& + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + code=usDwMnEzJPpG5oaV8x3j& + code_verifier=9g8S40MozM3NSqjHnhi7OnsE38jklFv2& + grant_type=authorization_code + +.. seealso:: + + - https://openid.net/specs/openid-connect-core-1_0.html#RPAuthentication + + +**Esempio di richiesta con Refresh Token (caso 2):** + + .. code-block:: json + + POST /token HTTP/1.1 + Host: https://op.spid.agid.gov.it + Content-Type: application/x-www-form-urlencoded + + client_id=https://rp.spid.agid.gov.it& + client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw + ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…& + client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer& + grant_type=refresh_token& + refresh_token=8xLOxBtZp8 + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **client_id** + - Vedi `OpenID.Registration`_. DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP. + - |spid-icon| |cieid-icon| + * - **client_assertion** + - JWT firmato con la chiave privata del Relying Party contenente i seguenti parametri: + + **iss**: DEVE corrispondere al valore *client_id* + + **sub**: DEVE corrispondere al valore *iss* + + **aud**: URL del Token Endpoint dell'OP + + **iat**: UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519`. + + **exp**: UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519` + + **jti**: Identificatore univoco per questa richiesta di autenticazione, generato dal client. Ad esempio in formato *uuid4*. + - |spid-icon| |cieid-icon| + * - **client_assertion_type** + - Deve assumere il seguente valore: |br| + **urn:ietf:params:oauth:client-assertion-type:jwtbearer** + - |spid-icon| |cieid-icon| + * - **code** + - Codice di autorizzazione restituito nell'Authentication response. Obbligatorio solo se **grant_type** è **authorization_code** + - |spid-icon| |cieid-icon| + * - **code_verifier** + - Codice di verifica del code_challenge. Obbligatorio solo se **grant_type** è **authorization_code** + - |spid-icon| |cieid-icon| + * - **grant_type** + - Tipo di credenziale presentata dal RP per la richiesta corrente. + PUÒ assumere uno dei seguenti valori: + + - **authorization_code** + - **refresh_token** + + - |spid-icon| |cieid-icon| + * - **refresh_token** + - Obbligatorio solo se **grant_type** è **refresh_token** + - |spid-icon| |cieid-icon| + + +Response +++++++++ + +L'OpenID Provider (OP) restituisce un ID Token e Access Token e un eventuale Refresh Token, in formato JWT firmato. + +L'Access Token deve essere formato secondo le indicazioni dello standard `"International Government Assurance Profile (iGov) for OAuth 2.0 - Draft 03", section 3.2.1, "JWT Bearer Tokens" `_. + +L'ID Token deve essere formato secondo le indicazioni del paragrafo successivo. + +La risposta DEVE contenere i seguenti claim. + +**Esempio di risposta:** + +.. code-block:: http + + HTTP/1.1 200 OK + Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT + Content-Type: application/json + + { + "access_token":"dC34Pf6kdG...", + "token_type":"Bearer", + "refresh_token":"wJ848BcyLP...", + "expires_in":1800, + "id_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY..." + } + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **access_token** + - L'Access Token, in formato JWT firmato, consente l'accesso allo UserInfo endpoint per ottenere gli attributi. + - |spid-icon| |cieid-icon| + * - **token_type** + - Tipo di *Access Token* restituito. DEVE essere valorizzato sempre con **Bearer** + - |spid-icon| |cieid-icon| + * - **refresh_token** + - Disponibile sono nel caso di `sessione lunga revocabile`_. Il *Refresh Token*, in formato JWT firmato, consente di chiamare nuovamente il Token Endpoint per ottenere un nuovo *Access Token* e un nuovo *ID Token*. + - |spid-icon| |cieid-icon| + * - **expires_in** + - Scadenza dell'*Access Token* in secondi. + - |spid-icon| |cieid-icon| + * - **id_token** + - ID Token in formato JWT (vedi paragrafo successivo) + - |spid-icon| |cieid-icon| + +Access Token +++++++++++++ + +L'Access Token è un JSON Web Token (JWT) firmato che consente l'accesso allo +UserInfo endpoint per ottenere gli attributi dell'utente. +Di seguito i claim che compongono l'Access Token. + +**Esempio del contenuto di intestazione di payload di un Access Token:** + +.. code-block:: json + + { + "alg": "RS256", + "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw", + "typ": "at+jwt" + } + . + { + "iss":"https://op.spid.agid.gov.it/", + "sub": "9sd798asd98asui23hiuds89y798sfyg", + "aud": [ + "https://rp.spid.example.it" + ], + "client_id": "https://rp.spid.example.it", + "scope": "openid", + "jti": "9ea42af0-594c-4486-9602-8a1f8dde42d3", + "exp": 1656859559, + "iat": 1656857579 + } + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **iss** + - DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. Il client DEVE verificare che questo valore corrisponda all'OP chiamato. + - |spid-icon| |cieid-icon| + * - **sub** + - Vedi `OpenID.Core#SubjectIDTypes`_. DEVE essere di tipo *pairwise*. + - |spid-icon| |cieid-icon| + * - **client_id** + - DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP. + - |spid-icon| |cieid-icon| + * - **aud** + - DEVE coincidere con il valore *client_id*. Il RP DEVE verificare che questo valore corrisponda al proprio client ID. + - |spid-icon| |cieid-icon| + * - **scope** + - L'OP DOVREBBE inserire il parametro *scope* come previsto in :rfc:`9068` Sezione 2.2.3. DEVE coincidere con il valore presente in fase di richiesta di autenticazione. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **jti** + - DEVE essere una Stringa in formato *uuid4*. Identificatore unico dell'ID Token che il RP PUÒ utilizzare per prevenirne il riuso, rifiutando l'ID Token se già processato. + - |spid-icon| |cieid-icon| + + +ID Token +++++++++ + +L'ID Token è un JSON Web Token (JWT) firmato che contiene informazioni sull'utente che ha eseguito l'autenticazione. I RP DEVONO eseguire la validazione dell'ID Token. + +.. admonition:: |cieid-icon| + + Il RP PUÒ richiedere che L'ID Token sia cifrato (vedere il parametro *id_token_encrypted_response_alg* nel :ref:`Metadata RP ` ). + Se il RP inserisce nel suo metadata il parametro id_token_encrypted_response_alg, l'OP DEVE restituire l'ID Token **firmato e cifrato**. L'ID Token in formato JWT DEVE contenere il parametro *cty* (Content-Type) nell'intestazione JOSE con il valore *JWT* (vedere :rfc:`7519#section-5.2`). + +Di seguito i claim disponibili nell'ID Token. + + **Esempio del contenuto di intestazione e di payload di un ID Token:** + +.. code-block:: json + + { + "alg": "RS256", + "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw" + } + . + { + "iss":"https://op.spid.agid.gov.it/", + "sub":"9sd798asd98asui23hiuds89y798sfyg", + "aud":"https://rp.spid.example.it/auth", + "acr":"https://www.spid.gov.it/SpidL2", + "at_hash":"qiyh4XPJGsOZ2MEAyLkfWqeQ", + "iat":1519032969, + "nbf":1519032969, + "exp":1519033149, + "jti":"nw4J0zMwRk4kRbQ53G7z", + "nonce":"MBzGqyf9QytD28eupyWhSqMj78WNqpc2" + } + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **iss** + - DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. Il client DEVE verificare che questo valore corrisponda all'OP chiamato. + - |spid-icon| |cieid-icon| + * - **sub** + - Vedi `OpenID.Core#SubjectIDTypes`_. DEVE essere di tipo *pairwise*. + - |spid-icon| |cieid-icon| + * - **aud** + - DEVE coincidere con il valore *client_id*. Il RP DEVE verificare che questo valore corrisponda al proprio client ID. + - |spid-icon| |cieid-icon| + * - **acr** + - Livello di autenticazione effettivo. DEVE essere uguale o superiore a quello richiesto dal RP nella Authentication Request. + - |spid-icon| |cieid-icon| + * - **at_hash** + - Vedi `OpenID.Core#CodeIDToken`_. Il suo valore è la codifica base64url della prima metà dell'hash calcolato sulla rappresentazione ASCII dell'*Access Token*, usando l'algoritmo di hashing indicato in **alg** nell'header dell'ID Token. Il client DEVE verificare che questo valore corrisponda applicando la medesima funzione all'*Access Token* restituito insieme all'ID Token. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **nbf** + - UNIX Timestamp. Istante di inizio validità del JWT in formato NumericDate, come indicato in :rfc:`7519`. DEVE corrispondere con il valore di **iat**. + - |spid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **jti** + - DEVE essere una Stringa in formato *uuid4*. Identificatore unico dell'ID Token che il RP PUÒ utilizzare per prevenirne il riuso, rifiutando l'ID Token se già processato. + - |spid-icon| |cieid-icon| + * - **nonce** + - Vedi `OpenID.Core#AuthRequest`_. DEVE essere una stringa casuale di almeno 32 caratteri alfanumerici. Questo valore DEVE coincidere con quello inviato dal RP nella richiesta di autenticazione. + - |spid-icon| |cieid-icon| + + +.. seealso:: + + - https://openid.net/specs/openid-connect-core-1_0.html#IDToken + - https://openid.net/specs/openid-igov-openid-connect-1_0-03.html#Section-3.1 + +.. _Refresh_Token: + +Refresh Token ++++++++++++++ + +Il *Refresh Token* è un JWT che PUÒ essere rilasciato dall'OP e che PUÒ essere usato per ottenere un nuovo *Access Token* che abilita il RP ad accedere allo *UserInfo endpoint* senza interazione diretta dell'utente. + +Il *Refresh Token* DEVE essere rilasciato in formato JWT, firmato, e contenere almeno i seguenti parametri. + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **iss** + - DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. Il RP DEVE verificare che questo valore corrisponda all'OP chiamato. + - |spid-icon| |cieid-icon| + * - **aud** + - DEVE coincidere con il valore *client_id*. Il RP DEVE verificare che questo valore corrisponda al proprio client ID. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **jti** + - DEVE essere una Stringa in formato *uuid4*. Identificatore unico del *Refresh Token* che il RP PUÒ utilizzare per prevenirne il riuso, rifiutando il *Refresh Token* se già processato. + - |spid-icon| |cieid-icon| + +.. admonition:: |cieid-icon| + + Per ottenere un *Refresh Token*, il RP DEVE includere nel parametro *scope* della richiesta di autenticazione il valore *offline_access* e nel parametro *prompt* il valore *consent*. L'utilizzo di questo *scope* può essere utile in scenari nei quali un RP ha la necessità di verificare che l'identità digitale di un utente finale sia ancora valida o vuole mantenere aggiornati gli attributi che ha precedentemente raccolto durante la fase di autenticazione, ad esempio per l'invio di notifiche all'utente finale successive all'autenticazione dello stesso. + **Il Refresh Token NON DEVE consentire al RP richiedente di ottenere un ID Token, nè quello precedentemente rilasciato in fase di autenticazione nè un nuovo ID Token. L'utilizzo del Refresh Token NON DEVE essere utilizzato dagli RP per ottenere una nuova autenticazione dell'utente con l'OP o rinnovare una sessione preesistente, ma PUÒ essere utilizzato come meccanismo per ottenere dallo UserInfo endpoint esclusivamente il medesimo set di attributi dell'utente richiesti in fase di autenticazione iniziale e per il quale l'utente ha espresso il consenso esplicito.** Tale consenso DEVE essere raccolto dall'OP in fase autenticazione dell'utente finale nella pagina di consenso. L'utente finale DEVE avere la possibilità di abilitare o disabilitare questa opzione prima di inviare il consenso che PUÒ essere soggetto ad un periodo di validità se definito dall'OP in base alle policy sul trattamento dei dati personali. + + L'OP che riceve una richiesta di un nuovo *Access Token* tramite un *Refresh Token* PUÒ inviare una notifica all'utente tramite uno dei recapiti digitali disponibili (email, sms, notifica mobile app). L'utente che non riconosce legittima questa operazione o che vuole disabilitare questa opzione PUÒ richiedere all'OP una revoca del consenso dato (e quindi dei token emessi a seguito dello stesso) secondo le modalità rese note all'interno della pagina di raccolta del consenso. La notifica DEVE avere solo carattere informativo e non autorizzativo. All'interno della notifica DEVE essere reso noto all'utente le modalità di revoca del consenso dato. L'OP DEVE consentire all'utente di disabilitare in qualsiasi momento questa opzione tramite apposita funzionalità messa a disposizione dall'OP stesso. + + Per ragioni di sicurezza, un OP DEVE restituire, insieme ad un nuovo *Access Token*, anche un nuovo *Refresh Token*, invalidando tutti i token precedentemente rilasciati (*refresh token rotation*) al RP e in relazione al soggetto interessato (utente finale). Il nuovo *Refresh Token* DEVE avere il parametro *exp* non superiore alla durata prevista. + +.. admonition:: |spid-icon| + + Per applicazioni mobili in cui il RP intenda offrire un'esperienza utente che non richieda il reinserimento delle credenziali SPID ad ogni utilizzo dell'applicazione, si POSSONO utilizzare le sessioni lunghe revocabili utilizzando il Refresh Token come normato nelle `LL.GG. OpenID Connect in SPID `_ e nell' `Avviso n.41 `_ . + Il *Token endpoint* verifica la validità del Refresh Token e, se nella richiesta di autenticazione originaria era presente nell' *acr_values* il valore *https://www.spid.gov.it/SpidL1*, rilascia un nuovo *ID Token* valido esclusivamente per il livello 1 SPID. + Per maggiori dettagli sull'utilizzo del Refresh Token nel contesto SPID, si vedano i seguenti documenti normativi: + + - `LL.GG. OpenID Connect in SPID `_ + - `Avviso n.41 - Integrazione LL.GG. OpenID Connect in SPID `_ + + + + +Periodo di validità di un Refresh Token +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Il *Refresh Token* NON DEVE avere una validità (differenza tra *iat* e *exp*) superiore a 30 giorni. + +Se allo scadere del periodo di validità l'RP effettua una richiesta all'OP, quest'ultimo DEVE restituire un errore nella risposta (Vedi :ref:`Codici di Errore `). + +.. admonition:: |cieid-icon| + + Fermo restando la validità del token, l'OP PUÒ fissare un periodo di validità relativo al consenso che l'utente ha fornito all'utilizzo dello *scope* *offline_access* e del *Refresh Token*. In prossimità del termine di validità del consenso, qualora tale termine sia previsto nelle policy dell'OP, il valore di *exp* DEVE essere calcolato come il valore minimo tra la durata di validità del token e quella del consenso. + + .. note:: + Al fine di chiarire il meccanismo di rotazione si riporta di seguito un esempio non normativo dove si descrive l'emissione e il lifecyle del *Refresh Token* con validità di 30 giorni. + + - t1: un RP effettua un autenticazione con *scope=offline_access*, quindi ottiene *Refresh Token* RT1 (validità 30gg) + - t2 = t1 + 4gg: l'RP fa richiesta al *Token endpoint* presentando RT1. L'OP riconosce che la richiesta proviene dallo stesso RP e rilascia un nuovo *Access Token* e nuovo *Refresh Token* RT2 con validità 30gg a partire da t2 + - t3 = t1 + 32gg: dopo 28gg da t2 l'RP fa richiesta al *Token endpoint* presentando RT2. L'OP riconosce che la richiesta proviene dallo stesso RP e rilascia un nuovo *Access Token* e nuovo *Refresh Token* RT3 con validità 30gg da t3 + - t4 = t1 + 64gg: dopo 32gg da t3 l'RP fa richiesta al *Token endpoint* presentando RT3. Questa volta l'OP rifiuta la richiesta con un errore perchè RT3 risulta non più valido. + +.. _TOKEN_ENDPOINT_ERRORS: + +Codici di errore +++++++++++++++++ + +.. list-table:: + :widths: 20 20 20 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Codice HTTP** + - **Supportato da** + + * - *invalid_client* + - Problemi durante la client authentication (ad esempio, il client_id è conosciuto, non è fornita l'autenticazione del client o il metodo di autenticazione non è supportato) |br| (:rfc:`6749#section-5.2`). + - *401 Unauthorized* + - |spid-icon| |cieid-icon| + + * - *unsupported_grant_type* + - Il parametro grant_type contiene un valore non corretto (:rfc:`6749#section-5.2`). + - *400 Bad Request* + - |spid-icon| |cieid-icon| + + * - *invalid_grant* + - I parametri grant_type, code, code_verifier, access_token non sono validi (:rfc:`6749#section-5.2`). + - *400 Bad Request* + - |spid-icon| |cieid-icon| + + * - *invalid_request* + - La richiesta non è valida a causa della mancanza o della non correttezza di uno o più parametri (:rfc:`6749#section-5.2`). + - *400 Bad Request* + - |spid-icon| |cieid-icon| + + * - *server_error* + - L'OP ha riscontrato un problema interno (:rfc:`6749#section-5.2`). + - *500 Internal Server Error* + - |spid-icon| |cieid-icon| + + * - *temporarily_unavailable* + - L'OP ha riscontrato un problema interno temporaneo (:rfc:`6749#section-5.2`). + - *503 Service Unavailable* + - |spid-icon| |cieid-icon| diff --git a/it/_sources/trust_marks.rst.txt b/it/_sources/trust_marks.rst.txt new file mode 100644 index 00000000..84c4e6ae --- /dev/null +++ b/it/_sources/trust_marks.rst.txt @@ -0,0 +1,213 @@ +.. include:: ../common/common_definitions.rst + +.. _Trust_Mark: + +Trust Mark +========== + +I **Trust Mark (TM)**, letteralmente tradotti come *Marchi di Fiducia*, sono JWT firmati :rfc:`7515` e rappresentano la dichiarazione di conformità ad un insieme ben definito di requisiti di fiducia e/o di interoperabilità o un accordo tra le parti coinvolte all'interno della Federazione. + +Lo scopo principale dei TM è quello di esporre alcune informazioni non richieste dal protocollo OpenID Connect Core ma che risultano utili in contesto Federativo. + +Esempi tipici includono il codice di identificazione nazionale o internazionale dell'entità (Codice Fiscale, IPA Code, Partita IVA, VAT Number), i contatti istituzionali e altro, come definito in `OIDC-FED`_. Ulteriori dati possono essere aggiunti dal soggetto che li emette. + +I TM sono emessi e firmati, durante il processo di registrazione di una nuova entità di tipo Foglia (Onboarding), dal (TA) o suoi Intermediari (SA) o da Gestori Qualificati di Attributi (AA), se definiti all'interno dell'attributo **trust_marks_issuers**, pubblicato all'interno dell'Entity Configuration del TA. + +Di seguito un esempio non normativo dell'oggetto **trust_marks_issuers** all'interno della Entity Configuration del TA. + +.. code-block:: json + + { + "trust_marks_issuers":{ + "https://registry.agid.gov.it/openid_relying_party/public/":[ + "https://registry.spid.agid.gov.it/", + "https://public.intermediate.spid.it/" + ], + "https://registry.agid.gov.it/openid_relying_party/private/":[ + "https://registry.spid.agid.gov.it/", + "https://private.other.intermediate.it/" + ] + } + } + + +Ogni entità partecipante DEVE esporre nella propria configurazione (EC) i TM rilasciati dalle autorità che li emettono. + +Nello scenario CIE / SPID, un TM viene firmato dal TA **MinInterno** / **Agid** o loro Intermediari (SA) o Gestori Qualificati di Attributi (AA). + +Il TA definisce i soggetti abilitati all'emissione dei TM riconoscibili all'interno della Federazione, mediante il claim **trust_marks_issuers**, presente all'interno del proprio Entity Configuration. Il valore dell'attributo **trust_marks_issuers** è composto da un oggetto JSON avente come chiavi gli identificativi dei TM e come valori la lista degli identificativi (URL) delle entità abilitate ad emetterli. + +I Trust Mark rappresentano il primo filtro per l'instaurazione della fiducia tra le parti, sono elementi indispensabili per avviare la risoluzione dei metadati. In loro assenza una entità non è riconoscibile come partecipante all’interno della Federazione. + +All’interno della Federazione SPID i Trust Mark presentano degli identificativi univoci (claim id) in formato URL che adottano la seguente struttura: **https:// / / [ /] [estensione /]** + +Alcuni esempi non normativi sono di seguito riportati: + + + - TM RP public: **\https://registry.agid.gov.it/openid_relying_party/public/** + - TM SA private: **\https://registry.agid.gov.it/intermediate/private/** + - TM AA: **\https://registry.agid.gov.it/oauth_resource/public/** + + +La tabella seguente definisce i riconoscibili all'interno delle Federazioni SPID e CIE id: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - tipo + - descrizione + - entità + * - **openid_relying_party** + - l'entità nel claim *sub* è un RP. + - RP + * - **openid_provider** + - l'entità nel claim *sub* è un OP. + - OP + * - **intermediate** + - l'entità nel claim *sub* è un Soggetto Aggregatore. + - SA + * - **oauth_resource** + - l'entità nel claim *sub* è una Attribute Authority. + - AA + +La tabella seguente definisce i riconoscibili all'interno delle Federazioni SPID e CIE id: + + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **profilo** + - **descrizione** + - **Entità** + * - **public** + - l'entità nel claim *sub* appartiene alla pubblica amministrazione italiana. + - RP, OP, SA, AA + * - **private** + - l'entità nel claim *sub* appartiene al settore privato. + - RP, OP, SA, AA + + +federation_entity Trust Mark +-------------------------------- + +In aggiunta ai claim dei profili **public** e **private**, il profilo **intermediate** individua i SA e aggiunge le estensioni **full** e **light** all'interno del claim **sa_profile**, a seconda della modalità con cui operano rispetto ai Soggetti Aggregati + +.. seealso:: + + Si veda Sezione :ref:`Soggetti aggregatori nel contesto Federativo ` + +oauth_resource Trust Mark +------------------------------------------ + +In aggiunta ai claim dei profili **public** e **private**, il profilo **oauth_resource** individua le AA e aggiunge i seguenti claim obbligatori: + +.. list-table:: + :widths: 20 60 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + * - **policy_uri** + - URL dove è disponibile la privacy policy dell'AA. + * - **tos_uri** + - URL dove è disponibile la info policy dell'AA. + * - **claims** + - Lista di JSON Object che definiscono gli attributi dell’utente richiesti dall'AA. Esempio: |br| ``{"https://attributes.eid.gov.it/fiscal_number":{"essential":true},`` |br| ``"email":{"essential":true},}`` + * - **service_documentation** + - URL dove è disponibile il documento OAS3 che descrive il funzionamento dei servizi dell'AA. + +Validazione dei Trust Mark +-------------------------- + +Esistono due modi per validare un Trust Mark: + + 1. Validazione **statica**. Il Trust Mark viene validato mediante la chiave pubblica dell'autorità che lo ha emesso (attributo **iss**), sulla base della corrispondenza dell'attributo **sub** con il medesimo attributo della Entity Configuration in cui è contenuto e sulla base del valore di scadenza (attributo **exp**). + + 2. Validazione **dinamica**. I partecipanti della Federazione possono interrogare l'endpoint :ref:`trust mark status` erogato dal suo emettitore (attributo iss) per la verifica in tempo reale dei TM da lui emessi. + +Tutte le entità che rilasciano Trust Mark DEVONO esporre un endpoint di Trust Mark status per consentire la validazione **dinamica**. + +.. seealso:: + + - `OIDC-FED`_ Sezione .5.3.2. + + +Revoca dei Trust Mark +--------------------- + +Un Trust Mark può essere revocato in qualsiasi momento solo ed esclusivamente dal soggetto che lo ha emesso. Ad esempio, in caso di esclusione di un Soggetto Aggregato da parte della Autorità di Federazione, questa comunica al Soggetto Aggregatore l'esclusione dell'Aggregato. Di conseguenza il SA DEVE revocare il TM per il suo discendente. + +.. note:: + Nel caso di revoca di un TM, la validazione **dinamica** darà esito negativo, mentre la validazione **statica** continuerà a dare esito positivo, a meno di rotazioni delle chiavi crittografiche di firma del soggetto che ha rilasciato il TM. + +.. _ComposizioneTM: + +Composizione dei Trust Mark +--------------------------- + +Gli attributi definiti all'interno dei TM aderiscono a quanto definito all'interno dello standard OIDC Federation 1.0 (`OIDC-FED`_). Segue la lista. + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **iss** + - String. URL che identifica univocamente l'Autorità che lo ha emesso. + - |spid-icon| |cieid-icon| + * - **sub** + - String. URL che identifica univocamente il soggetto per il quale il Trust Mark è stato emesso. + - |spid-icon| |cieid-icon| + * - **id** + - String. Identificativo univoco del Trust Mark. È un URL con la seguente struttura: |br| + **///** |br| + es. non normativo: ``https://registry.interno.gov.it/openid_relying_party/public/`` + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **logo_uri** + - String. Un URL che punta al logo rappresentante il Trust Mark. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519` + - |spid-icon| |cieid-icon| + * - **ref** + - String. URL che punta a informazioni presenti sul web relative a questo Trust Mark. + - |spid-icon| |cieid-icon| + * - **organization_type** + - String. Specifica se l'ente appartiene alla pubblica amministrazione italiana o al settore privato (**public** o **private**) + - |spid-icon| |cieid-icon| + * - **id_code** + - Oggetto JSON. Contiene uno o più codici di identificazione dell'organizzazione. I claim disponibili sono: + - **ipa_code**: OBBLIGATORIO nel caso di organizzazione pubblica. + - **aoo_code**: OPZIONALE. + - **uo_code**: OPZIONALE. + - **vat_number**: OBBLIGATORIO per organizzazione privata se non presente *fiscal_number*. + - **fiscal_number**: OBBLIGATORIO per organizzazione privata se non presente *vat_number*. + - |spid-icon| |cieid-icon| + * - **email** + - String. Email istituzionale o PEC dell'organizzazione. + - |spid-icon| |cieid-icon| + * - **organization_name** + - String. Il nome completo dell'entità che fornisce i servizi + - |spid-icon| |cieid-icon| + * - **sa_profile** + - String. RICHIESTO per SA. Specifica il profilo dell’Aggregatore, **full** o **light**. + - |spid-icon| |cieid-icon| + +.. warning:: + + Il valore contenuto nel parametro **exp** NON DEVE essere superiore alla durata delle convenzioni stipulate in fase di onboarding tra l'Entità che rilascia i Trust Mark e le organizzazioni che lo ricevono. + +.. seealso:: + + - `OIDC-FED`_ Sezione 5.3.1. + - Esempi non normativi: :ref:`Trust Mark issued by TA to a RP `, :ref:`Trust Mark issued by TA to a SA `, :ref:`Trust Mark issued by SA to a RP `, + + diff --git a/it/_sources/trust_negotiation.rst.txt b/it/_sources/trust_negotiation.rst.txt new file mode 100644 index 00000000..88b5ead4 --- /dev/null +++ b/it/_sources/trust_negotiation.rst.txt @@ -0,0 +1,92 @@ +.. include:: ../common/common_definitions.rst + +Acquisire i Metadata +-------------------- + +In questa sezione sono illustrate le modalità di mutuo riconoscimento dei partecipanti all'interno della medesima federazione, le modalità con le quali i partecipanti ottengono i metadata gli uni degli altri in maniera sicura. + + +Relying Party ++++++++++++++ + +Il RP ottiene la lista degli OP in formato JSON interrogando l':ref:`endpoint list` disponibile presso il :ref:`Trust Anchor`. Per ogni soggetto contenuto nella :ref:`risposta` dell'endpoint list e corrispondente ad un OP, il RP :ref:`richiede` ed ottiene l'Entity Configuration presso l'OP. + +Per ogni EC degli OP, il RP verifica la firma del contenuto adoperando la chiave pubblica ottenuta dall'Entity Statement rilasciato dalla Trust Anchor per gli OP. Verifica la firma dell'Entity Configuration degli OP usando la chiave pubblica ottenuta dall'Entity Statement rilasciato dal TA. + +Il RP applica infine le politiche pubblicate dal Trust Anchor sui Metadata dell'OP e salva il Metadata finale associandolo ad una data di scadenza (claim **exp**). La data di scadenza corrisponde al valore di **exp** più basso ottenuto da tutti gli elementi che compongono la **Trust Chain**. Periodicamente il RP aggiorna i Metadata di tutti gli OP rinnovando la Trust Chain relativa a questi. + +Ottenuti i Metadata finali di tutti i OpenID Connect Provider, il RP genera lo **SPID Button** o il **CIE id Button** e lo pubblica all'interno della pagina di autenticazione destinata agli utenti. + +La procedura di Federation Entity Discovery risulta semplificata per i RP, perché all'interno della Federazione non è consentita l'esistenza di Intermediari tra gli OP ed il loro Trust Anchor. + + +.. image:: ../../images/metadata_discovery.svg + :width: 100% + +*La procedura di Federation Entity Discovery a partire dalla Foglia fino al Trust Anchor. Dall'Entity Statement rilasciato da un superiore si ottiene la chiave pubblica per la validazione dell'Entity Configuration dell'entità discendente.* + + +OpenID Provider ++++++++++++++++ + +Quando un Provider (OP) riceve una richiesta di autorizzazione da parte di un RP non precedentemente riconosciuto, avviene la procedura di **automatic client registration**. Sono di seguito descritte le operazioni compiute dal OP per registrare un RP dinamicamente. + +.. image:: ../../images/automatic_client_registration.svg + :width: 100% + + +*La registrazione di un RP dalla prospettiva di un OP che per la prima volta riceve una richiesta di autorizzazione dal RP e avvia il processo di Federation Entity Discovery e salvataggio della Trust Chain.* + + +L'OP estrae l'identificativo univoco (**client_id**) dall'oggetto *request* contenuto all'interno della *Authorization Request* ed effettua una richiesta di Entity Configuration presso il :ref:`RP`. Ottiene l'Entity Configuration del RP e convalida la firma dei Trust Mark riconoscibili all'interno della Federazione [1]_. + +Se il RP non espone all'interno della sua configurazione nessun Trust Mark riconoscibile per il profilo di RP (vedi Sezione :ref:`Trust Mark`) il Provider DEVE rifiutare l'autorizzazione con un messaggio di errore come definito nella Sezione :ref:`Gestione degli errori di Federazione `. + +Se il Provider convalida con successo almeno un Trust Mark per il profilo RP contenuto all'interno della configurazione del RP richiedente, estrae le entità superiori contenute nel claim **authority_hints** ed avvia la fase di Federation Entity Discovery. Ne consegue il calcolo della **Trust Chain** e l'ottenimento del Metadata finale. + +Durante il Federation Entity Discovery, il Provider richiede ad una o più entità superiori [2]_ l'Entity Statement relativo al RP e ottiene la chiave pubblica con la quale valida la configurazione del RP, fino a giungere al Trust Anchor. Infine applica la politica dei Metadata pubblicata dal Trust Anchor e salva il risultante Metadata finale del RP associandolo ad una data di scadenza, oltre la quale rinnoverà il Metadata secondo le modalità di rinnovo della Trust Chain. + +Ottenuto il Metadata finale, il Provider valida la richiesta del RP secondo le modalità definite in questo documento. + +Nei casi in cui un RP avesse come entità superiore un SA e non direttamente il TA, la procedura di acquisizione e validazione dell'Entity Configuration del RP avviene mediante l'Entity Statement pubblicato dal SA nei confronti del RP e mediante la convalida dell'Entity Configuration del SA con l'Entity Statement emesso dalla TA in relazione al SA. Se la soglia del massimo numero di Intermediari verticali, definita dal valore di **max_path_length**, viene superata, l'OP blocca il processo di Federation Entity Discovery e rigetta la richiesta del RP. + + +.. [1] I Trust Mark di Federazione sono configurati nel claim **trust_marks_issuers** e contenuti nell'Entity Configuration del Trust Anchor. + +.. [2] Un RP può esporre più di una entità superiore all'interno del proprio claim di **authority_hints**. Si pensi ad un RP che partecipa sia alla Federazione SPID che a quella CIE. Inoltre un RP può risultare come aggregato di molteplici Intermediari, sia questi SPID o CIE. + + +.. image:: ../../images/trust_anchor.svg + :width: 100% + +*Ogni partecipante espone la propria configurazione e i propri Trust Mark. Il collegamento tra una Foglia e il Trust Anchor avviene in maniera diretta oppure mediante un Intermediario (Soggetto Aggregatore) come in Figura.* + + +Accesso alla Entity Configuration ++++++++++++++++++++++++++++++++++ + +In questa sezione viene descritto come individuare per un determinato soggetto l'URL :rfc:`3986` per il download della Entity Configuration. + +La risorsa attraverso la quale un partecipante pubblica la sua configurazione (Entity Configuration) corrisponde al webpath ``.well-known/openid-federation`` e DEVE essere appesa all'URL che identifica il soggetto. + +Esempi: + + - con identificativo del soggetto pari a ``https://rp.example.it`` il risultante URL di Entity Configuration è |br| + ``https://rp.example.it/.well-known/oidc-federation``. + + - con identificativo del soggetto pari ``https://rp.servizi-spid.it/oidc/`` il risultante URL di Entity Configuration è |br| + ``https://rp.servizi-spid.it/oidc/.well-known/oidc-federation``. + +Se l'URL che identifica il soggetto non presenta il simbolo di slash finale ("/"), è necessario aggiungerlo prima di concatenare il web path della risorsa .well-known. + + +Una volta che un RP viene riconosciuto come parte della Federazione, ottiene il permesso di effettuare una Richiesta di Autenticazione. L'OP che non ha interagito prima d'ora con un RP che fa la richiesta, è in grado di risolvere la fiducia mediante l'API di federazione (Federation Entity Discovery e produzione della Trust Chain). L'OP inizia richiedendo la Entity Configuration del RP al .well-known endpoint del RP e, seguendo il percorso dato dall'*authority_hint*, raggiunge la radice del Trust, cioè il TA. In ogni passo della catena l'OP può eseguire tutti i controlli di sicurezza richiedendo le dichiarazioni di entità da ciascuna entità e convalidando i Trust Mark e le firme. La figura che segue dà un esempio rappresentativo di come funziona la catena del Trust. + + +.. image:: ../../images/cie_esempio_trust_chain.svg + :width: 100% + + +*The Federation Entity Discovery process to build a Trust Chain and obtain the final Metadata.* + + diff --git a/it/_sources/userinfo_endpoint.rst.txt b/it/_sources/userinfo_endpoint.rst.txt new file mode 100644 index 00000000..5f796d88 --- /dev/null +++ b/it/_sources/userinfo_endpoint.rst.txt @@ -0,0 +1,149 @@ +.. include:: ../common/common_definitions.rst + +UserInfo Endpoint +----------------- + +Lo UserInfo Endpoint è una risorsa protetta che restituisce gli attributi dell'utente autenticato. Per ottenere gli attributi richiesti, il RP inoltra una richiesta allo UserInfo Endpoint utilizzando l'Access Token. + +Request ++++++++ + +.. admonition:: |spid-icon| + + Lo UserInfo Endpoint DEVE supportare l'uso del solo metodo HTTP GET :rfc:`2616` e DEVE accettare e validare l'Access Token inviato all'interno del campo Authorization dell'Header, di tipo Bearer :rfc:`6750`. + +.. admonition:: |cieid-icon| + + Lo UserInfo Endpoint DEVE supportare l'uso dei metodi HTTP GET e POST :rfc:`2616` e DEVE accettare e validare l'Access Token inviato all'interno del campo Authorization dell'Header, di tipo Bearer :rfc:`6750`. + + +.. code-block:: http + + GET https://op.spid.agid.gov.it/userinfo + Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImRCNjdnTDdja ... + +.. seealso:: + + - https://openid.net/specs/openid-connect-core-1_0.html#UserInfo + - https://openid.net/specs/openid-igov-openid-connect-1_0-03.html#Section-4 + + +.. _userinfo_response: + +Response +++++++++ + +.. admonition:: |spid-icon| + + La response dello UserInfo Endpoint DEVE specificare nel "Content-Type" il valore "application/jwt". + +Il contenuto del corpo della Response DEVE essere un `JWT firmato e cifrato. `_. + +L'header JOSE DEVE contenere il parametro *cty* (Content Type) valorizzato con *JWT* (vedi :rfc:`7519#section-5.2`). + +Lo UserInfo Endpoint restituisce gli attributi utente esplicitamente richiesti tramite il parametro **claims** o tramite l'utilizzo del parametro **scope** nella Authentication Request. + +**Esempio:** + +.. code-block:: http + + HTTP/1.1 200 OK + Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT + Content-Type: application/jose + + { + "alg": "RSA-OAEP", + "enc": "A256CBC-HS512", + "kid": "HIvo33-Km7n03ZqKDJfWVnlFudsW28YhQZx5eaXtAKA", + "cty": "JWT" + } + . + { + "iss": "https://op.fornitore_identita.it", + "aud": "https://rp.fornitore_servizio.it", + "iat": 1519032969, + "nbf": 1519032969, + "exp": 1519033149, + "sub": "OP-1234567890", + "name": "Mario", + "family_name": "Rossi", + "https://attributes.spid.gov.it/fiscal_number": "MROXXXXXXXXXXXXX" + } + +L'intestazione del JWE DEVE contenere i seguenti parametri: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **alg** + - String. Vedi :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **kid** + - Vedi :rfc:`7638#section_3`. + - |spid-icon| |cieid-icon| + * - **enc** + - String. Vedi :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **cty** + - String. DEVE essere valorizzato con "JWT". + - |spid-icon| |cieid-icon| + + +Il payload del JWE è un JWS contenente all'interno del suo payload i seguenti parametri: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **sub** + - String. Identificatore del soggetto, coincidente con quello già rilasciato nell'ID Token. + Il RP DEVE verificare che il valore coincida con quello contenuto nell'ID Token. + - |spid-icon| |cieid-icon| + * - **iat** + - UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **exp** + - UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in :rfc:`7519`. + - |spid-icon| |cieid-icon| + * - **aud** + - String. Identificatore del soggetto destinatario della response (RP). + Il RP DEVE verificare che il valore coincida con il proprio client_id. + - |spid-icon| |cieid-icon| + * - **iss** + - String. URI che identifica univocamente l'OP. + - |spid-icon| |cieid-icon| + * - **** + - I claim richiesti al momento dell'autenticazione. + - |spid-icon| |cieid-icon| + +L'intestazione del JWS DEVE contenere i seguenti parametri: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Descrizione** + - **Supportato da** + * - **alg** + - String. Vedi :ref:`supported_algs`.. + - |spid-icon| |cieid-icon| + * - **kid** + - Vedi :rfc:`7638#section_3`. + - |spid-icon| |cieid-icon| + * - **cty** + - String. DEVE essere valorizzato con "JWT". + - |spid-icon| |cieid-icon| + +Codici di errore +++++++++++++++++ + +Come definiti per :ref:`Token endpoint`. + diff --git a/it/_static/_sphinx_javascript_frameworks_compat.js b/it/_static/_sphinx_javascript_frameworks_compat.js new file mode 100644 index 00000000..8549469d --- /dev/null +++ b/it/_static/_sphinx_javascript_frameworks_compat.js @@ -0,0 +1,134 @@ +/* + * _sphinx_javascript_frameworks_compat.js + * ~~~~~~~~~~ + * + * Compatability shim for jQuery and underscores.js. + * + * WILL BE REMOVED IN Sphinx 6.0 + * xref RemovedInSphinx60Warning + * + */ + +/** + * select a different prefix for underscore + */ +$u = _.noConflict(); + + +/** + * small helper function to urldecode strings + * + * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURIComponent#Decoding_query_parameters_from_a_URL + */ +jQuery.urldecode = function(x) { + if (!x) { + return x + } + return decodeURIComponent(x.replace(/\+/g, ' ')); +}; + +/** + * small helper function to urlencode strings + */ +jQuery.urlencode = encodeURIComponent; + +/** + * This function returns the parsed url parameters of the + * current request. Multiple values per key are supported, + * it will always return arrays of strings for the value parts. + */ +jQuery.getQueryParameters = function(s) { + if (typeof s === 'undefined') + s = document.location.search; + var parts = s.substr(s.indexOf('?') + 1).split('&'); + var result = {}; + for (var i = 0; i < parts.length; i++) { + var tmp = parts[i].split('=', 2); + var key = jQuery.urldecode(tmp[0]); + var value = jQuery.urldecode(tmp[1]); + if (key in result) + result[key].push(value); + else + result[key] = [value]; + } + return result; +}; + +/** + * highlight a given string on a jquery object by wrapping it in + * span elements with the given class name. + */ +jQuery.fn.highlightText = function(text, className) { + function highlight(node, addItems) { + if (node.nodeType === 3) { + var val = node.nodeValue; + var pos = val.toLowerCase().indexOf(text); + if (pos >= 0 && + !jQuery(node.parentNode).hasClass(className) && + !jQuery(node.parentNode).hasClass("nohighlight")) { + var span; + var isInSVG = jQuery(node).closest("body, svg, foreignObject").is("svg"); + if (isInSVG) { + span = document.createElementNS("http://www.w3.org/2000/svg", "tspan"); + } else { + span = document.createElement("span"); + span.className = className; + } + span.appendChild(document.createTextNode(val.substr(pos, text.length))); + node.parentNode.insertBefore(span, node.parentNode.insertBefore( + document.createTextNode(val.substr(pos + text.length)), + node.nextSibling)); + node.nodeValue = val.substr(0, pos); + if (isInSVG) { + var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect"); + var bbox = node.parentElement.getBBox(); + rect.x.baseVal.value = bbox.x; + rect.y.baseVal.value = bbox.y; + rect.width.baseVal.value = bbox.width; + rect.height.baseVal.value = bbox.height; + rect.setAttribute('class', className); + addItems.push({ + "parent": node.parentNode, + "target": rect}); + } + } + } + else if (!jQuery(node).is("button, select, textarea")) { + jQuery.each(node.childNodes, function() { + highlight(this, addItems); + }); + } + } + var addItems = []; + var result = this.each(function() { + highlight(this, addItems); + }); + for (var i = 0; i < addItems.length; ++i) { + jQuery(addItems[i].parent).before(addItems[i].target); + } + return result; +}; + +/* + * backward compatibility for jQuery.browser + * This will be supported until firefox bug is fixed. + */ +if (!jQuery.browser) { + jQuery.uaMatch = function(ua) { + ua = ua.toLowerCase(); + + var match = /(chrome)[ \/]([\w.]+)/.exec(ua) || + /(webkit)[ \/]([\w.]+)/.exec(ua) || + /(opera)(?:.*version|)[ \/]([\w.]+)/.exec(ua) || + /(msie) ([\w.]+)/.exec(ua) || + ua.indexOf("compatible") < 0 && /(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua) || + []; + + return { + browser: match[ 1 ] || "", + version: match[ 2 ] || "0" + }; + }; + jQuery.browser = {}; + jQuery.browser[jQuery.uaMatch(navigator.userAgent).browser] = true; +} diff --git a/it/_static/base-stemmer.js b/it/_static/base-stemmer.js new file mode 100644 index 00000000..ca6cca15 --- /dev/null +++ b/it/_static/base-stemmer.js @@ -0,0 +1,294 @@ +/**@constructor*/ +BaseStemmer = function() { + this.setCurrent = function(value) { + this.current = value; + this.cursor = 0; + this.limit = this.current.length; + this.limit_backward = 0; + this.bra = this.cursor; + this.ket = this.limit; + }; + + this.getCurrent = function() { + return this.current; + }; + + this.copy_from = function(other) { + this.current = other.current; + this.cursor = other.cursor; + this.limit = other.limit; + this.limit_backward = other.limit_backward; + this.bra = other.bra; + this.ket = other.ket; + }; + + this.in_grouping = function(s, min, max) { + if (this.cursor >= this.limit) return false; + var ch = this.current.charCodeAt(this.cursor); + if (ch > max || ch < min) return false; + ch -= min; + if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) return false; + this.cursor++; + return true; + }; + + this.in_grouping_b = function(s, min, max) { + if (this.cursor <= this.limit_backward) return false; + var ch = this.current.charCodeAt(this.cursor - 1); + if (ch > max || ch < min) return false; + ch -= min; + if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) return false; + this.cursor--; + return true; + }; + + this.out_grouping = function(s, min, max) { + if (this.cursor >= this.limit) return false; + var ch = this.current.charCodeAt(this.cursor); + if (ch > max || ch < min) { + this.cursor++; + return true; + } + ch -= min; + if ((s[ch >>> 3] & (0X1 << (ch & 0x7))) == 0) { + this.cursor++; + return true; + } + return false; + }; + + this.out_grouping_b = function(s, min, max) { + if (this.cursor <= this.limit_backward) return false; + var ch = this.current.charCodeAt(this.cursor - 1); + if (ch > max || ch < min) { + this.cursor--; + return true; + } + ch -= min; + if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) { + this.cursor--; + return true; + } + return false; + }; + + this.eq_s = function(s) + { + if (this.limit - this.cursor < s.length) return false; + if (this.current.slice(this.cursor, this.cursor + s.length) != s) + { + return false; + } + this.cursor += s.length; + return true; + }; + + this.eq_s_b = function(s) + { + if (this.cursor - this.limit_backward < s.length) return false; + if (this.current.slice(this.cursor - s.length, this.cursor) != s) + { + return false; + } + this.cursor -= s.length; + return true; + }; + + /** @return {number} */ this.find_among = function(v) + { + var i = 0; + var j = v.length; + + var c = this.cursor; + var l = this.limit; + + var common_i = 0; + var common_j = 0; + + var first_key_inspected = false; + + while (true) + { + var k = i + ((j - i) >>> 1); + var diff = 0; + var common = common_i < common_j ? common_i : common_j; // smaller + // w[0]: string, w[1]: substring_i, w[2]: result, w[3]: function (optional) + var w = v[k]; + var i2; + for (i2 = common; i2 < w[0].length; i2++) + { + if (c + common == l) + { + diff = -1; + break; + } + diff = this.current.charCodeAt(c + common) - w[0].charCodeAt(i2); + if (diff != 0) break; + common++; + } + if (diff < 0) + { + j = k; + common_j = common; + } + else + { + i = k; + common_i = common; + } + if (j - i <= 1) + { + if (i > 0) break; // v->s has been inspected + if (j == i) break; // only one item in v + + // - but now we need to go round once more to get + // v->s inspected. This looks messy, but is actually + // the optimal approach. + + if (first_key_inspected) break; + first_key_inspected = true; + } + } + do { + var w = v[i]; + if (common_i >= w[0].length) + { + this.cursor = c + w[0].length; + if (w.length < 4) return w[2]; + var res = w[3](this); + this.cursor = c + w[0].length; + if (res) return w[2]; + } + i = w[1]; + } while (i >= 0); + return 0; + }; + + // find_among_b is for backwards processing. Same comments apply + this.find_among_b = function(v) + { + var i = 0; + var j = v.length + + var c = this.cursor; + var lb = this.limit_backward; + + var common_i = 0; + var common_j = 0; + + var first_key_inspected = false; + + while (true) + { + var k = i + ((j - i) >> 1); + var diff = 0; + var common = common_i < common_j ? common_i : common_j; + var w = v[k]; + var i2; + for (i2 = w[0].length - 1 - common; i2 >= 0; i2--) + { + if (c - common == lb) + { + diff = -1; + break; + } + diff = this.current.charCodeAt(c - 1 - common) - w[0].charCodeAt(i2); + if (diff != 0) break; + common++; + } + if (diff < 0) + { + j = k; + common_j = common; + } + else + { + i = k; + common_i = common; + } + if (j - i <= 1) + { + if (i > 0) break; + if (j == i) break; + if (first_key_inspected) break; + first_key_inspected = true; + } + } + do { + var w = v[i]; + if (common_i >= w[0].length) + { + this.cursor = c - w[0].length; + if (w.length < 4) return w[2]; + var res = w[3](this); + this.cursor = c - w[0].length; + if (res) return w[2]; + } + i = w[1]; + } while (i >= 0); + return 0; + }; + + /* to replace chars between c_bra and c_ket in this.current by the + * chars in s. + */ + this.replace_s = function(c_bra, c_ket, s) + { + var adjustment = s.length - (c_ket - c_bra); + this.current = this.current.slice(0, c_bra) + s + this.current.slice(c_ket); + this.limit += adjustment; + if (this.cursor >= c_ket) this.cursor += adjustment; + else if (this.cursor > c_bra) this.cursor = c_bra; + return adjustment; + }; + + this.slice_check = function() + { + if (this.bra < 0 || + this.bra > this.ket || + this.ket > this.limit || + this.limit > this.current.length) + { + return false; + } + return true; + }; + + this.slice_from = function(s) + { + var result = false; + if (this.slice_check()) + { + this.replace_s(this.bra, this.ket, s); + result = true; + } + return result; + }; + + this.slice_del = function() + { + return this.slice_from(""); + }; + + this.insert = function(c_bra, c_ket, s) + { + var adjustment = this.replace_s(c_bra, c_ket, s); + if (c_bra <= this.bra) this.bra += adjustment; + if (c_bra <= this.ket) this.ket += adjustment; + }; + + this.slice_to = function() + { + var result = ''; + if (this.slice_check()) + { + result = this.current.slice(this.bra, this.ket); + } + return result; + }; + + this.assign_to = function() + { + return this.current.slice(0, this.limit); + }; +}; diff --git a/it/_static/basic.css b/it/_static/basic.css new file mode 100644 index 00000000..9039e027 --- /dev/null +++ b/it/_static/basic.css @@ -0,0 +1,932 @@ +/* + * basic.css + * ~~~~~~~~~ + * + * Sphinx stylesheet -- basic theme. + * + * :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS. + * :license: BSD, see LICENSE for details. + * + */ + +/* -- main layout ----------------------------------------------------------- */ + +div.clearer { + clear: both; +} + +div.section::after { + display: block; + content: ''; + clear: left; +} + +/* -- relbar ---------------------------------------------------------------- */ + +div.related { + width: 100%; + font-size: 90%; +} + +div.related h3 { + display: none; +} + +div.related ul { + margin: 0; + padding: 0 0 0 10px; + list-style: none; +} + +div.related li { + display: inline; +} + +div.related li.right { + float: right; + margin-right: 5px; +} + +/* -- sidebar --------------------------------------------------------------- */ + +div.sphinxsidebarwrapper { + padding: 10px 5px 0 10px; +} + +div.sphinxsidebar { + float: left; + width: 230px; + margin-left: -100%; + font-size: 90%; + word-wrap: break-word; + overflow-wrap : break-word; +} + +div.sphinxsidebar ul { + list-style: none; +} + +div.sphinxsidebar ul ul, +div.sphinxsidebar ul.want-points { + margin-left: 20px; + list-style: square; +} + +div.sphinxsidebar ul ul { + margin-top: 0; + margin-bottom: 0; +} + +div.sphinxsidebar form { + margin-top: 10px; +} + +div.sphinxsidebar input { + border: 1px solid #98dbcc; + font-family: sans-serif; + font-size: 1em; +} + +div.sphinxsidebar #searchbox form.search { + overflow: hidden; +} + +div.sphinxsidebar #searchbox input[type="text"] { + float: left; + width: 80%; + padding: 0.25em; + box-sizing: border-box; +} + +div.sphinxsidebar #searchbox input[type="submit"] { + float: left; + width: 20%; + border-left: none; + padding: 0.25em; + box-sizing: border-box; +} + + +img { + border: 0; + max-width: 100%; +} + +/* -- search page ----------------------------------------------------------- */ + +ul.search { + margin: 10px 0 0 20px; + padding: 0; +} + +ul.search li { + padding: 5px 0 5px 20px; + background-image: url(file.png); + background-repeat: no-repeat; + background-position: 0 7px; +} + +ul.search li a { + font-weight: bold; +} + +ul.search li p.context { + color: #888; + margin: 2px 0 0 30px; + text-align: left; +} + +ul.keywordmatches li.goodmatch a { + font-weight: bold; +} + +/* -- index page ------------------------------------------------------------ */ + +table.contentstable { + width: 90%; + margin-left: auto; + margin-right: auto; +} + +table.contentstable p.biglink { + line-height: 150%; +} + +a.biglink { + font-size: 1.3em; +} + +span.linkdescr { + font-style: italic; + padding-top: 5px; + font-size: 90%; +} + +/* -- general index --------------------------------------------------------- */ + +table.indextable { + width: 100%; +} + +table.indextable td { + text-align: left; + vertical-align: top; +} + +table.indextable ul { + margin-top: 0; + margin-bottom: 0; + list-style-type: none; +} + +table.indextable > tbody > tr > td > ul { + padding-left: 0em; +} + +table.indextable tr.pcap { + height: 10px; +} + +table.indextable tr.cap { + margin-top: 10px; + background-color: #f2f2f2; +} + +img.toggler { + margin-right: 3px; + margin-top: 3px; + cursor: pointer; +} + +div.modindex-jumpbox { + border-top: 1px solid #ddd; + border-bottom: 1px solid #ddd; + margin: 1em 0 1em 0; + padding: 0.4em; +} + +div.genindex-jumpbox { + border-top: 1px solid #ddd; + border-bottom: 1px solid #ddd; + margin: 1em 0 1em 0; + padding: 0.4em; +} + +/* -- domain module index --------------------------------------------------- */ + +table.modindextable td { + padding: 2px; + border-collapse: collapse; +} + +/* -- general body styles --------------------------------------------------- */ + +div.body { + min-width: 360px; + max-width: 800px; +} + +div.body p, div.body dd, div.body li, div.body blockquote { + -moz-hyphens: auto; + -ms-hyphens: auto; + -webkit-hyphens: auto; + hyphens: auto; +} + +a.headerlink { + visibility: hidden; +} + +a.brackets:before, +span.brackets > a:before{ + content: "["; +} + +a.brackets:after, +span.brackets > a:after { + content: "]"; +} + +h1:hover > a.headerlink, +h2:hover > a.headerlink, +h3:hover > a.headerlink, +h4:hover > a.headerlink, +h5:hover > a.headerlink, +h6:hover > a.headerlink, +dt:hover > a.headerlink, +caption:hover > a.headerlink, +p.caption:hover > a.headerlink, +div.code-block-caption:hover > a.headerlink { + visibility: visible; +} + +div.body p.caption { + text-align: inherit; +} + +div.body td { + text-align: left; +} + +.first { + margin-top: 0 !important; +} + +p.rubric { + margin-top: 30px; + font-weight: bold; +} + +img.align-left, figure.align-left, .figure.align-left, object.align-left { + clear: left; + float: left; + margin-right: 1em; +} + +img.align-right, figure.align-right, .figure.align-right, object.align-right { + clear: right; + float: right; + margin-left: 1em; +} + +img.align-center, figure.align-center, .figure.align-center, object.align-center { + display: block; + margin-left: auto; + margin-right: auto; +} + +img.align-default, figure.align-default, .figure.align-default { + display: block; + margin-left: auto; + margin-right: auto; +} + +.align-left { + text-align: left; +} + +.align-center { + text-align: center; +} + +.align-default { + text-align: center; +} + +.align-right { + text-align: right; +} + +/* -- sidebars -------------------------------------------------------------- */ + +div.sidebar, +aside.sidebar { + margin: 0 0 0.5em 1em; + border: 1px solid #ddb; + padding: 7px; + background-color: #ffe; + width: 40%; + float: right; + clear: right; + overflow-x: auto; +} + +p.sidebar-title { + font-weight: bold; +} + +div.admonition, div.topic, aside.topic, blockquote { + clear: left; +} + +/* -- topics ---------------------------------------------------------------- */ + +div.topic, aside.topic { + border: 1px solid #ccc; + padding: 7px; + margin: 10px 0 10px 0; +} + +p.topic-title { + font-size: 1.1em; + font-weight: bold; + margin-top: 10px; +} + +/* -- admonitions ----------------------------------------------------------- */ + +div.admonition { + margin-top: 10px; + margin-bottom: 10px; + padding: 7px; +} + +div.admonition dt { + font-weight: bold; +} + +p.admonition-title { + margin: 0px 10px 5px 0px; + font-weight: bold; +} + +div.body p.centered { + text-align: center; + margin-top: 25px; +} + +/* -- content of sidebars/topics/admonitions -------------------------------- */ + +div.sidebar > :last-child, +aside.sidebar > :last-child, +div.topic > :last-child, +aside.topic > :last-child, +div.admonition > :last-child { + margin-bottom: 0; +} + +div.sidebar::after, +aside.sidebar::after, +div.topic::after, +aside.topic::after, +div.admonition::after, +blockquote::after { + display: block; + content: ''; + clear: both; +} + +/* -- tables ---------------------------------------------------------------- */ + +table.docutils { + margin-top: 10px; + margin-bottom: 10px; + border: 0; + border-collapse: collapse; +} + +table.align-center { + margin-left: auto; + margin-right: auto; +} + +table.align-default { + margin-left: auto; + margin-right: auto; +} + +table caption span.caption-number { + font-style: italic; +} + +table caption span.caption-text { +} + +table.docutils td, table.docutils th { + padding: 1px 8px 1px 5px; + border-top: 0; + border-left: 0; + border-right: 0; + border-bottom: 1px solid #aaa; +} + +th { + text-align: left; + padding-right: 5px; +} + +table.citation { + border-left: solid 1px gray; + margin-left: 1px; +} + +table.citation td { + border-bottom: none; +} + +th > :first-child, +td > :first-child { + margin-top: 0px; +} + +th > :last-child, +td > :last-child { + margin-bottom: 0px; +} + +/* -- figures --------------------------------------------------------------- */ + +div.figure, figure { + margin: 0.5em; + padding: 0.5em; +} + +div.figure p.caption, figcaption { + padding: 0.3em; +} + +div.figure p.caption span.caption-number, +figcaption span.caption-number { + font-style: italic; +} + +div.figure p.caption span.caption-text, +figcaption span.caption-text { +} + +/* -- field list styles ----------------------------------------------------- */ + +table.field-list td, table.field-list th { + border: 0 !important; +} + +.field-list ul { + margin: 0; + padding-left: 1em; +} + +.field-list p { + margin: 0; +} + +.field-name { + -moz-hyphens: manual; + -ms-hyphens: manual; + -webkit-hyphens: manual; + hyphens: manual; +} + +/* -- hlist styles ---------------------------------------------------------- */ + +table.hlist { + margin: 1em 0; +} + +table.hlist td { + vertical-align: top; +} + +/* -- object description styles --------------------------------------------- */ + +.sig { + font-family: 'Consolas', 'Menlo', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace; +} + +.sig-name, code.descname { + background-color: transparent; + font-weight: bold; +} + +.sig-name { + font-size: 1.1em; +} + +code.descname { + font-size: 1.2em; +} + +.sig-prename, code.descclassname { + background-color: transparent; +} + +.optional { + font-size: 1.3em; +} + +.sig-paren { + font-size: larger; +} + +.sig-param.n { + font-style: italic; +} + +/* C++ specific styling */ + +.sig-inline.c-texpr, +.sig-inline.cpp-texpr { + font-family: unset; +} + +.sig.c .k, .sig.c .kt, +.sig.cpp .k, .sig.cpp .kt { + color: #0033B3; +} + +.sig.c .m, +.sig.cpp .m { + color: #1750EB; +} + +.sig.c .s, .sig.c .sc, +.sig.cpp .s, .sig.cpp .sc { + color: #067D17; +} + + +/* -- other body styles ----------------------------------------------------- */ + +ol.arabic { + list-style: decimal; +} + +ol.loweralpha { + list-style: lower-alpha; +} + +ol.upperalpha { + list-style: upper-alpha; +} + +ol.lowerroman { + list-style: lower-roman; +} + +ol.upperroman { + list-style: upper-roman; +} + +:not(li) > ol > li:first-child > :first-child, +:not(li) > ul > li:first-child > :first-child { + margin-top: 0px; +} + +:not(li) > ol > li:last-child > :last-child, +:not(li) > ul > li:last-child > :last-child { + margin-bottom: 0px; +} + +ol.simple ol p, +ol.simple ul p, +ul.simple ol p, +ul.simple ul p { + margin-top: 0; +} + +ol.simple > li:not(:first-child) > p, +ul.simple > li:not(:first-child) > p { + margin-top: 0; +} + +ol.simple p, +ul.simple p { + margin-bottom: 0; +} + +/* Docutils 0.17 and older (footnotes & citations) */ +dl.footnote > dt, +dl.citation > dt { + float: left; + margin-right: 0.5em; +} + +dl.footnote > dd, +dl.citation > dd { + margin-bottom: 0em; +} + +dl.footnote > dd:after, +dl.citation > dd:after { + content: ""; + clear: both; +} + +/* Docutils 0.18+ (footnotes & citations) */ +aside.footnote > span, +div.citation > span { + float: left; +} +aside.footnote > span:last-of-type, +div.citation > span:last-of-type { + padding-right: 0.5em; +} +aside.footnote > p { + margin-left: 2em; +} +div.citation > p { + margin-left: 4em; +} +aside.footnote > p:last-of-type, +div.citation > p:last-of-type { + margin-bottom: 0em; +} +aside.footnote > p:last-of-type:after, +div.citation > p:last-of-type:after { + content: ""; + clear: both; +} + +/* Footnotes & citations ends */ + +dl.field-list { + display: grid; + grid-template-columns: fit-content(30%) auto; +} + +dl.field-list > dt { + font-weight: bold; + word-break: break-word; + padding-left: 0.5em; + padding-right: 5px; +} + +dl.field-list > dt:after { + content: ":"; +} + +dl.field-list > dd { + padding-left: 0.5em; + margin-top: 0em; + margin-left: 0em; + margin-bottom: 0em; +} + +dl { + margin-bottom: 15px; +} + +dd > :first-child { + margin-top: 0px; +} + +dd ul, dd table { + margin-bottom: 10px; +} + +dd { + margin-top: 3px; + margin-bottom: 10px; + margin-left: 30px; +} + +dl > dd:last-child, +dl > dd:last-child > :last-child { + margin-bottom: 0; +} + +dt:target, span.highlighted { + background-color: #fbe54e; +} + +rect.highlighted { + fill: #fbe54e; +} + +dl.glossary dt { + font-weight: bold; + font-size: 1.1em; +} + +.versionmodified { + font-style: italic; +} + +.system-message { + background-color: #fda; + padding: 5px; + border: 3px solid red; +} + +.footnote:target { + background-color: #ffa; +} + +.line-block { + display: block; + margin-top: 1em; + margin-bottom: 1em; +} + +.line-block .line-block { + margin-top: 0; + margin-bottom: 0; + margin-left: 1.5em; +} + +.guilabel, .menuselection { + font-family: sans-serif; +} + +.accelerator { + text-decoration: underline; +} + +.classifier { + font-style: oblique; +} + +.classifier:before { + font-style: normal; + margin: 0 0.5em; + content: ":"; + display: inline-block; +} + +abbr, acronym { + border-bottom: dotted 1px; + cursor: help; +} + +/* -- code displays --------------------------------------------------------- */ + +pre { + overflow: auto; + overflow-y: hidden; /* fixes display issues on Chrome browsers */ +} + +pre, div[class*="highlight-"] { + clear: both; +} + +span.pre { + -moz-hyphens: none; + -ms-hyphens: none; + -webkit-hyphens: none; + hyphens: none; + white-space: nowrap; +} + +div[class*="highlight-"] { + margin: 1em 0; +} + +td.linenos pre { + border: 0; + background-color: transparent; + color: #aaa; +} + +table.highlighttable { + display: block; +} + +table.highlighttable tbody { + display: block; +} + +table.highlighttable tr { + display: flex; +} + +table.highlighttable td { + margin: 0; + padding: 0; +} + +table.highlighttable td.linenos { + padding-right: 0.5em; +} + +table.highlighttable td.code { + flex: 1; + overflow: hidden; +} + +.highlight .hll { + display: block; +} + +div.highlight pre, +table.highlighttable pre { + margin: 0; +} + +div.code-block-caption + div { + margin-top: 0; +} + +div.code-block-caption { + margin-top: 1em; + padding: 2px 5px; + font-size: small; +} + +div.code-block-caption code { + background-color: transparent; +} + +table.highlighttable td.linenos, +span.linenos, +div.highlight span.gp { /* gp: Generic.Prompt */ + user-select: none; + -webkit-user-select: text; /* Safari fallback only */ + -webkit-user-select: none; /* Chrome/Safari */ + -moz-user-select: none; /* Firefox */ + -ms-user-select: none; /* IE10+ */ +} + +div.code-block-caption span.caption-number { + padding: 0.1em 0.3em; + font-style: italic; +} + +div.code-block-caption span.caption-text { +} + +div.literal-block-wrapper { + margin: 1em 0; +} + +code.xref, a code { + background-color: transparent; + font-weight: bold; +} + +h1 code, h2 code, h3 code, h4 code, h5 code, h6 code { + background-color: transparent; +} + +.viewcode-link { + float: right; +} + +.viewcode-back { + float: right; + font-family: sans-serif; +} + +div.viewcode-block:target { + margin: -1px -10px; + padding: 0 10px; +} + +/* -- math display ---------------------------------------------------------- */ + +img.math { + vertical-align: middle; +} + +div.body div.math p { + text-align: center; +} + +span.eqno { + float: right; +} + +span.eqno a.headerlink { + position: absolute; + z-index: 1; +} + +div.math:hover a.headerlink { + visibility: visible; +} + +/* -- printout stylesheet --------------------------------------------------- */ + +@media print { + div.document, + div.documentwrapper, + div.bodywrapper { + margin: 0 !important; + width: 100%; + } + + div.sphinxsidebar, + div.related, + div.footer, + #top-link { + display: none; + } +} \ No newline at end of file diff --git a/it/_static/css/theme.css b/it/_static/css/theme.css new file mode 100644 index 00000000..6c29bebe --- /dev/null +++ b/it/_static/css/theme.css @@ -0,0 +1 @@ +@charset "UTF-8";@import url("https://fonts.googleapis.com/css?family=Lora:400,700");@import url("https://fonts.googleapis.com/css?family=Roboto+Mono:400,700");@import url("https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600,700");.primary-bg{background-color:#06c}.primary-color{color:#06c}.primary-border-color,.primary-border-color.border{border-color:#06c!important}.white-bg{background-color:#fff}.white-color{color:#fff}.white-border-color-,.white-border-color-.border{border-color:#fff!important}.primary-bg-a1{background-color:#bfdfff}.primary-color-a1{color:#bfdfff}.primary-border-color-a1,.primary-border-color-a1.border{border-color:#bfdfff!important}.primary-bg-a2{background-color:#93c4f5}.primary-color-a2{color:#93c4f5}.primary-border-color-a2,.primary-border-color-a2.border{border-color:#93c4f5!important}.primary-bg-a3{background-color:#6aaaeb}.primary-color-a3{color:#6aaaeb}.primary-border-color-a3,.primary-border-color-a3.border{border-color:#6aaaeb!important}.primary-bg-a4{background-color:#4392e0}.primary-color-a4{color:#4392e0}.primary-border-color-a4,.primary-border-color-a4.border{border-color:#4392e0!important}.primary-bg-a5{background-color:#207bd6}.primary-color-a5{color:#207bd6}.primary-border-color-a5,.primary-border-color-a5.border{border-color:#207bd6!important}.primary-bg-a6{background-color:#06c}.primary-color-a6{color:#06c}.primary-border-color-a6,.primary-border-color-a6.border{border-color:#06c!important}.primary-bg-a7{background-color:#0059b3}.primary-color-a7{color:#0059b3}.primary-border-color-a7,.primary-border-color-a7.border{border-color:#0059b3!important}.primary-bg-a8{background-color:#004d99}.primary-color-a8{color:#004d99}.primary-border-color-a8,.primary-border-color-a8.border{border-color:#004d99!important}.primary-bg-a9{background-color:#004080}.primary-color-a9{color:#004080}.primary-border-color-a9,.primary-border-color-a9.border{border-color:#004080!important}.primary-bg-a10{background-color:#036}.primary-color-a10{color:#036}.primary-border-color-a10,.primary-border-color-a10.border{border-color:#036!important}.primary-bg-a11{background-color:#00264d}.primary-color-a11{color:#00264d}.primary-border-color-a11,.primary-border-color-a11.border{border-color:#00264d!important}.primary-bg-a12{background-color:#001a33}.primary-color-a12{color:#001a33}.primary-border-color-a12,.primary-border-color-a12.border{border-color:#001a33!important}.primary-bg-b1{background-color:#06c}.primary-color-b1{color:#06c}.primary-border-color-b1,.primary-border-color-b1.border{border-color:#06c!important}.primary-bg-b2{background-color:#1262b3}.primary-color-b2{color:#1262b3}.primary-border-color-b2,.primary-border-color-b2.border{border-color:#1262b3!important}.primary-bg-b3{background-color:#1f5c99}.primary-color-b3{color:#1f5c99}.primary-border-color-b3,.primary-border-color-b3.border{border-color:#1f5c99!important}.primary-bg-b4{background-color:#265380}.primary-color-b4{color:#265380}.primary-border-color-b4,.primary-border-color-b4.border{border-color:#265380!important}.primary-bg-b5{background-color:#294766}.primary-color-b5{color:#294766}.primary-border-color-b5,.primary-border-color-b5.border{border-color:#294766!important}.primary-bg-b6{background-color:#26394d}.primary-color-b6{color:#26394d}.primary-border-color-b6,.primary-border-color-b6.border{border-color:#26394d!important}.primary-bg-b7{background-color:#1f2933}.primary-color-b7{color:#1f2933}.primary-border-color-b7,.primary-border-color-b7.border{border-color:#1f2933!important}.primary-bg-b8{background-color:#12161a}.primary-color-b8{color:#12161a}.primary-border-color-b8,.primary-border-color-b8.border{border-color:#12161a!important}.primary-bg-c1{background-color:#dce9f5}.primary-color-c1{color:#dce9f5}.primary-border-color-c1,.primary-border-color-c1.border{border-color:#dce9f5!important}.primary-bg-c2{background-color:#c4dcf5}.primary-color-c2{color:#c4dcf5}.primary-border-color-c2,.primary-border-color-c2.border{border-color:#c4dcf5!important}.primary-bg-c3{background-color:#abd0f5}.primary-color-c3{color:#abd0f5}.primary-border-color-c3,.primary-border-color-c3.border{border-color:#abd0f5!important}.primary-bg-c4{background-color:#93c4f5}.primary-color-c4{color:#93c4f5}.primary-border-color-c4,.primary-border-color-c4.border{border-color:#93c4f5!important}.primary-bg-c5{background-color:#7ab8f5}.primary-color-c5{color:#7ab8f5}.primary-border-color-c5,.primary-border-color-c5.border{border-color:#7ab8f5!important}.primary-bg-c6{background-color:#62abf5}.primary-color-c6{color:#62abf5}.primary-border-color-c6,.primary-border-color-c6.border{border-color:#62abf5!important}.primary-bg-c7{background-color:#499ff5}.primary-color-c7{color:#499ff5}.primary-border-color-c7,.primary-border-color-c7.border{border-color:#499ff5!important}.primary-bg-c8{background-color:#3193f5}.primary-color-c8{color:#3193f5}.primary-border-color-c8,.primary-border-color-c8.border{border-color:#3193f5!important}.primary-bg-c9{background-color:#1887f5}.primary-color-c9{color:#1887f5}.primary-border-color-c9,.primary-border-color-c9.border{border-color:#1887f5!important}.primary-bg-c10{background-color:#007af5}.primary-color-c10{color:#007af5}.primary-border-color-c10,.primary-border-color-c10.border{border-color:#007af5!important}.primary-bg-c11{background-color:#0070e0}.primary-color-c11{color:#0070e0}.primary-border-color-c11,.primary-border-color-c11.border{border-color:#0070e0!important}.primary-bg-c12{background-color:#06c}.primary-color-c12{color:#06c}.primary-border-color-c12,.primary-border-color-c12.border{border-color:#06c!important}.analogue-1-bg-a1{background-color:#e7e6ff}.analogue-1-color-a1{color:#e7e6ff}.analogue-1-border-color-a1,.analogue-1-border-color-a1.border{border-color:#e7e6ff!important}.analogue-1-bg-a2{background-color:#bbb8f5}.analogue-1-color-a2{color:#bbb8f5}.analogue-1-border-color-a2,.analogue-1-border-color-a2.border{border-color:#bbb8f5!important}.analogue-1-bg-a3{background-color:#918deb}.analogue-1-color-a3{color:#918deb}.analogue-1-border-color-a3,.analogue-1-border-color-a3.border{border-color:#918deb!important}.analogue-1-bg-a4{background-color:#6b65e0}.analogue-1-color-a4{color:#6b65e0}.analogue-1-border-color-a4,.analogue-1-border-color-a4.border{border-color:#6b65e0!important}.analogue-1-bg-a5{background-color:#4840d6}.analogue-1-color-a5{color:#4840d6}.analogue-1-border-color-a5,.analogue-1-border-color-a5.border{border-color:#4840d6!important}.analogue-1-bg-a6{background-color:#271fcc}.analogue-1-color-a6{color:#271fcc}.analogue-1-border-color-a6,.analogue-1-border-color-a6.border{border-color:#271fcc!important}.analogue-1-bg-a7{background-color:#221bb3}.analogue-1-color-a7{color:#221bb3}.analogue-1-border-color-a7,.analogue-1-border-color-a7.border{border-color:#221bb3!important}.analogue-1-bg-a8{background-color:#1d1799}.analogue-1-color-a8{color:#1d1799}.analogue-1-border-color-a8,.analogue-1-border-color-a8.border{border-color:#1d1799!important}.analogue-1-bg-a9{background-color:#191380}.analogue-1-color-a9{color:#191380}.analogue-1-border-color-a9,.analogue-1-border-color-a9.border{border-color:#191380!important}.analogue-1-bg-a10{background-color:#140f66}.analogue-1-color-a10{color:#140f66}.analogue-1-border-color-a10,.analogue-1-border-color-a10.border{border-color:#140f66!important}.analogue-1-bg-a11{background-color:#0f0b4d}.analogue-1-color-a11{color:#0f0b4d}.analogue-1-border-color-a11,.analogue-1-border-color-a11.border{border-color:#0f0b4d!important}.analogue-1-bg-a12{background-color:#0a0833}.analogue-1-color-a12{color:#0a0833}.analogue-1-border-color-a12,.analogue-1-border-color-a12.border{border-color:#0a0833!important}.analogue-2-bg-a1{background-color:#ccfffd}.analogue-2-color-a1{color:#ccfffd}.analogue-2-border-color-a1,.analogue-2-border-color-a1.border{border-color:#ccfffd!important}.analogue-2-bg-a2{background-color:#9ff5f2}.analogue-2-color-a2{color:#9ff5f2}.analogue-2-border-color-a2,.analogue-2-border-color-a2.border{border-color:#9ff5f2!important}.analogue-2-bg-a3{background-color:#75ebe7}.analogue-2-color-a3{color:#75ebe7}.analogue-2-border-color-a3,.analogue-2-border-color-a3.border{border-color:#75ebe7!important}.analogue-2-bg-a4{background-color:#4fe0dc}.analogue-2-color-a4{color:#4fe0dc}.analogue-2-border-color-a4,.analogue-2-border-color-a4.border{border-color:#4fe0dc!important}.analogue-2-bg-a5{background-color:#2bd6d0}.analogue-2-color-a5{color:#2bd6d0}.analogue-2-border-color-a5,.analogue-2-border-color-a5.border{border-color:#2bd6d0!important}.analogue-2-bg-a6{background-color:#0accc6}.analogue-2-color-a6{color:#0accc6}.analogue-2-border-color-a6,.analogue-2-border-color-a6.border{border-color:#0accc6!important}.analogue-2-bg-a7{background-color:#09b3ad}.analogue-2-color-a7{color:#09b3ad}.analogue-2-border-color-a7,.analogue-2-border-color-a7.border{border-color:#09b3ad!important}.analogue-2-bg-a8{background-color:#089994}.analogue-2-color-a8{color:#089994}.analogue-2-border-color-a8,.analogue-2-border-color-a8.border{border-color:#089994!important}.analogue-2-bg-a9{background-color:#06807b}.analogue-2-color-a9{color:#06807b}.analogue-2-border-color-a9,.analogue-2-border-color-a9.border{border-color:#06807b!important}.analogue-2-bg-a10{background-color:#056663}.analogue-2-color-a10{color:#056663}.analogue-2-border-color-a10,.analogue-2-border-color-a10.border{border-color:#056663!important}.analogue-2-bg-a11{background-color:#044d4a}.analogue-2-color-a11{color:#044d4a}.analogue-2-border-color-a11,.analogue-2-border-color-a11.border{border-color:#044d4a!important}.analogue-2-bg-a12{background-color:#033331}.analogue-2-color-a12{color:#033331}.analogue-2-border-color-a12,.analogue-2-border-color-a12.border{border-color:#033331!important}.complementary-1-bg{background-color:#f73e5a}.complementary-1-color{color:#f90}.complementary-1-border-color-,.complementary-1-border-color-.border{border-color:#f73e5a!important}.complementary-1-bg-a1{background-color:#fffcfd}.complementary-1-color-a1{color:#fffcfd}.complementary-1-border-color-a1,.complementary-1-border-color-a1.border{border-color:#fffcfd!important}.complementary-1-bg-a2{background-color:#f5d0d6}.complementary-1-color-a2{color:#f5d0d6}.complementary-1-border-color-a2,.complementary-1-border-color-a2.border{border-color:#f5d0d6!important}.complementary-1-bg-a3{background-color:#eba4af}.complementary-1-color-a3{color:#eba4af}.complementary-1-border-color-a3,.complementary-1-border-color-a3.border{border-color:#eba4af!important}.complementary-1-bg-a4{background-color:#e07b8b}.complementary-1-color-a4{color:#e07b8b}.complementary-1-border-color-a4,.complementary-1-border-color-a4.border{border-color:#e07b8b!important}.complementary-1-bg-a5{background-color:#d65669}.complementary-1-color-a5{color:#d65669}.complementary-1-border-color-a5,.complementary-1-border-color-a5.border{border-color:#d65669!important}.complementary-1-bg-a6{background-color:#cc334a}.complementary-1-color-a6{color:#cc334a}.complementary-1-border-color-a6,.complementary-1-border-color-a6.border{border-color:#cc334a!important}.complementary-1-bg-a7{background-color:#b32d41}.complementary-1-color-a7{color:#b32d41}.complementary-1-border-color-a7,.complementary-1-border-color-a7.border{border-color:#b32d41!important}.complementary-1-bg-a8{background-color:#992637}.complementary-1-color-a8{color:#992637}.complementary-1-border-color-a8,.complementary-1-border-color-a8.border{border-color:#992637!important}.complementary-1-bg-a9{background-color:#80202e}.complementary-1-color-a9{color:#80202e}.complementary-1-border-color-a9,.complementary-1-border-color-a9.border{border-color:#80202e!important}.complementary-1-bg-a10{background-color:#661a25}.complementary-1-color-a10{color:#661a25}.complementary-1-border-color-a10,.complementary-1-border-color-a10.border{border-color:#661a25!important}.complementary-1-bg-a11{background-color:#4d131c}.complementary-1-color-a11{color:#4d131c}.complementary-1-border-color-a11,.complementary-1-border-color-a11.border{border-color:#4d131c!important}.complementary-1-bg-a12{background-color:#330d12}.complementary-1-color-a12{color:#330d12}.complementary-1-border-color-a12,.complementary-1-border-color-a12.border{border-color:#330d12!important}.complementary-2-bg{background-color:#f90}.complementary-2-color{color:#f90}.complementary-2-border-color-,.complementary-2-border-color-.border{border-color:#f90!important}.complementary-2-bg-a1{background-color:#ffe6bf}.complementary-2-color-a1{color:#ffe6bf}.complementary-2-border-color-a1,.complementary-2-border-color-a1.border{border-color:#ffe6bf!important}.complementary-2-bg-a2{background-color:#f5ce93}.complementary-2-color-a2{color:#f5ce93}.complementary-2-border-color-a2,.complementary-2-border-color-a2.border{border-color:#f5ce93!important}.complementary-2-bg-a3{background-color:#ebb76a}.complementary-2-color-a3{color:#ebb76a}.complementary-2-border-color-a3,.complementary-2-border-color-a3.border{border-color:#ebb76a!important}.complementary-2-bg-a4{background-color:#e0a243}.complementary-2-color-a4{color:#e0a243}.complementary-2-border-color-a4,.complementary-2-border-color-a4.border{border-color:#e0a243!important}.complementary-2-bg-a5{background-color:#d68d20}.complementary-2-color-a5{color:#d68d20}.complementary-2-border-color-a5,.complementary-2-border-color-a5.border{border-color:#d68d20!important}.complementary-2-bg-a6{background-color:#cc7a00}.complementary-2-color-a6{color:#cc7a00}.complementary-2-border-color-a6,.complementary-2-border-color-a6.border{border-color:#cc7a00!important}.complementary-2-bg-a7{background-color:#b36b00}.complementary-2-color-a7{color:#b36b00}.complementary-2-border-color-a7,.complementary-2-border-color-a7.border{border-color:#b36b00!important}.complementary-2-bg-a8{background-color:#995c00}.complementary-2-color-a8{color:#995c00}.complementary-2-border-color-a8,.complementary-2-border-color-a8.border{border-color:#995c00!important}.complementary-2-bg-a9{background-color:#804d00}.complementary-2-color-a9{color:#804d00}.complementary-2-border-color-a9,.complementary-2-border-color-a9.border{border-color:#804d00!important}.complementary-2-bg-a10{background-color:#663d00}.complementary-2-color-a10{color:#663d00}.complementary-2-border-color-a10,.complementary-2-border-color-a10.border{border-color:#663d00!important}.complementary-2-bg-a11{background-color:#4d2e00}.complementary-2-color-a11{color:#4d2e00}.complementary-2-border-color-a11,.complementary-2-border-color-a11.border{border-color:#4d2e00!important}.complementary-2-bg-a12{background-color:#331f00}.complementary-2-color-a12{color:#331f00}.complementary-2-border-color-a12,.complementary-2-border-color-a12.border{border-color:#331f00!important}.complementary-3-bg{background-color:#00cf86}.complementary-3-color{color:#00cf86}.complementary-3-border-color-,.complementary-3-border-color-.border{border-color:#00cf86!important}.complementary-3-bg-a1{background-color:#bfffe9}.complementary-3-color-a1{color:#bfffe9}.complementary-3-border-color-a1,.complementary-3-border-color-a1.border{border-color:#bfffe9!important}.complementary-3-bg-a2{background-color:#93f5d3}.complementary-3-color-a2{color:#93f5d3}.complementary-3-border-color-a2,.complementary-3-border-color-a2.border{border-color:#93f5d3!important}.complementary-3-bg-a3{background-color:#6aebbd}.complementary-3-color-a3{color:#6aebbd}.complementary-3-border-color-a3,.complementary-3-border-color-a3.border{border-color:#6aebbd!important}.complementary-3-bg-a4{background-color:#43e0a9}.complementary-3-color-a4{color:#43e0a9}.complementary-3-border-color-a4,.complementary-3-border-color-a4.border{border-color:#43e0a9!important}.complementary-3-bg-a5{background-color:#20d696}.complementary-3-color-a5{color:#20d696}.complementary-3-border-color-a5,.complementary-3-border-color-a5.border{border-color:#20d696!important}.complementary-3-bg-a6{background-color:#00cc85}.complementary-3-color-a6{color:#00cc85}.complementary-3-border-color-a6,.complementary-3-border-color-a6.border{border-color:#00cc85!important}.complementary-3-bg-a7{background-color:#00b374}.complementary-3-color-a7{color:#00b374}.complementary-3-border-color-a7,.complementary-3-border-color-a7.border{border-color:#00b374!important}.complementary-3-bg-a8{background-color:#009963}.complementary-3-color-a8{color:#009963}.complementary-3-border-color-a8,.complementary-3-border-color-a8.border{border-color:#009963!important}.complementary-3-bg-a9{background-color:#008053}.complementary-3-color-a9{color:#008053}.complementary-3-border-color-a9,.complementary-3-border-color-a9.border{border-color:#008053!important}.complementary-3-bg-a10{background-color:#006642}.complementary-3-color-a10{color:#006642}.complementary-3-border-color-a10,.complementary-3-border-color-a10.border{border-color:#006642!important}.complementary-3-bg-a11{background-color:#004d32}.complementary-3-color-a11{color:#004d32}.complementary-3-border-color-a11,.complementary-3-border-color-a11.border{border-color:#004d32!important}.complementary-3-bg-a12{background-color:#003321}.complementary-3-color-a12{color:#003321}.complementary-3-border-color-a12,.complementary-3-border-color-a12.border{border-color:#003321!important}.analogue-1-bg{background-color:#3126ff}.analogue-1-color{color:#3126ff}.analogue-1-border-color-,.analogue-1-border-color-.border{border-color:#3126ff!important}.analogue-1-bg-b1{background-color:#3126ff}.analogue-1-color-b1{color:#3126ff}.analogue-1-border-color-b1,.analogue-1-border-color-b1.border{border-color:#3126ff!important}.analogue-1-bg-b2{background-color:#4239e6}.analogue-1-color-b2{color:#4239e6}.analogue-1-border-color-b2,.analogue-1-border-color-b2.border{border-color:#4239e6!important}.analogue-1-bg-b3{background-color:#4e47cc}.analogue-1-color-b3{color:#4e47cc}.analogue-1-border-color-b3,.analogue-1-border-color-b3.border{border-color:#4e47cc!important}.analogue-1-bg-b4{background-color:#5550b3}.analogue-1-color-b4{color:#5550b3}.analogue-1-border-color-b4,.analogue-1-border-color-b4.border{border-color:#5550b3!important}.analogue-1-bg-b5{background-color:#585499}.analogue-1-color-b5{color:#585499}.analogue-1-border-color-b5,.analogue-1-border-color-b5.border{border-color:#585499!important}.analogue-1-bg-b6{background-color:#555380}.analogue-1-color-b6{color:#555380}.analogue-1-border-color-b6,.analogue-1-border-color-b6.border{border-color:#555380!important}.analogue-1-bg-b7{background-color:#4e4d66}.analogue-1-color-b7{color:#4e4d66}.analogue-1-border-color-b7,.analogue-1-border-color-b7.border{border-color:#4e4d66!important}.analogue-1-bg-b8{background-color:#42414d}.analogue-1-color-b8{color:#42414d}.analogue-1-border-color-b8,.analogue-1-border-color-b8.border{border-color:#42414d!important}.analogue-2-bg{background-color:#0bd9d2}.analogue-2-color{color:#0bd9d2}.analogue-2-border-color-,.analogue-2-border-color-.border{border-color:#0bd9d2!important}.analogue-2-bg-b1{background-color:#0bd9d2}.analogue-2-color-b1{color:#0bd9d2}.analogue-2-border-color-b1,.analogue-2-border-color-b1.border{border-color:#0bd9d2!important}.analogue-2-bg-b2{background-color:#1dbfba}.analogue-2-color-b2{color:#1dbfba}.analogue-2-border-color-b2,.analogue-2-border-color-b2.border{border-color:#1dbfba!important}.analogue-2-bg-b3{background-color:#29a6a2}.analogue-2-color-b3{color:#29a6a2}.analogue-2-border-color-b3,.analogue-2-border-color-b3.border{border-color:#29a6a2!important}.analogue-2-bg-b4{background-color:#318c89}.analogue-2-color-b4{color:#318c89}.analogue-2-border-color-b4,.analogue-2-border-color-b4.border{border-color:#318c89!important}.analogue-2-bg-b5{background-color:#347371}.analogue-2-color-b5{color:#347371}.analogue-2-border-color-b5,.analogue-2-border-color-b5.border{border-color:#347371!important}.analogue-2-bg-b6{background-color:#315958}.analogue-2-color-b6{color:#315958}.analogue-2-border-color-b6,.analogue-2-border-color-b6.border{border-color:#315958!important}.analogue-2-bg-b7{background-color:#29403f}.analogue-2-color-b7{color:#29403f}.analogue-2-border-color-b7,.analogue-2-border-color-b7.border{border-color:#29403f!important}.analogue-2-bg-b8{background-color:#1d2626}.analogue-2-color-b8{color:#1d2626}.analogue-2-border-color-b8,.analogue-2-border-color-b8.border{border-color:#1d2626!important}.complementary-1-bg-b1{background-color:#f73e5a}.complementary-1-color-b1{color:#f73e5a}.complementary-1-border-color-b1,.complementary-1-border-color-b1.border{border-color:#f73e5a!important}.complementary-1-bg-b2{background-color:#de4e63}.complementary-1-color-b2{color:#de4e63}.complementary-1-border-color-b2,.complementary-1-border-color-b2.border{border-color:#de4e63!important}.complementary-1-bg-b3{background-color:#c45869}.complementary-1-color-b3{color:#c45869}.complementary-1-border-color-b3,.complementary-1-border-color-b3.border{border-color:#c45869!important}.complementary-1-bg-b4{background-color:#ab5e69}.complementary-1-color-b4{color:#ab5e69}.complementary-1-border-color-b4,.complementary-1-border-color-b4.border{border-color:#ab5e69!important}.complementary-1-bg-b5{background-color:#915e66}.complementary-1-color-b5{color:#915e66}.complementary-1-border-color-b5,.complementary-1-border-color-b5.border{border-color:#915e66!important}.complementary-1-bg-b6{background-color:#785a5e}.complementary-1-color-b6{color:#785a5e}.complementary-1-border-color-b6,.complementary-1-border-color-b6.border{border-color:#785a5e!important}.complementary-1-bg-b7{background-color:#5e5052}.complementary-1-color-b7{color:#5e5052}.complementary-1-border-color-b7,.complementary-1-border-color-b7.border{border-color:#5e5052!important}.complementary-1-bg-b8{background-color:#454142}.complementary-1-color-b8{color:#454142}.complementary-1-border-color-b8,.complementary-1-border-color-b8.border{border-color:#454142!important}.complementary-2-bg-b1{background-color:#f90}.complementary-2-color-b1{color:#f90}.complementary-2-border-color-b1,.complementary-2-border-color-b1.border{border-color:#f90!important}.complementary-2-bg-b2{background-color:#e69317}.complementary-2-color-b2{color:#e69317}.complementary-2-border-color-b2,.complementary-2-border-color-b2.border{border-color:#e69317!important}.complementary-2-bg-b3{background-color:#cc8b29}.complementary-2-color-b3{color:#cc8b29}.complementary-2-border-color-b3,.complementary-2-border-color-b3.border{border-color:#cc8b29!important}.complementary-2-bg-b4{background-color:#b38136}.complementary-2-color-b4{color:#b38136}.complementary-2-border-color-b4,.complementary-2-border-color-b4.border{border-color:#b38136!important}.complementary-2-bg-b5{background-color:#99743d}.complementary-2-color-b5{color:#99743d}.complementary-2-border-color-b5,.complementary-2-border-color-b5.border{border-color:#99743d!important}.complementary-2-bg-b6{background-color:#806640}.complementary-2-color-b6{color:#806640}.complementary-2-border-color-b6,.complementary-2-border-color-b6.border{border-color:#806640!important}.complementary-2-bg-b7{background-color:#66563d}.complementary-2-color-b7{color:#66563d}.complementary-2-border-color-b7,.complementary-2-border-color-b7.border{border-color:#66563d!important}.complementary-2-bg-b8{background-color:#4d4336}.complementary-2-color-b8{color:#4d4336}.complementary-2-border-color-b8,.complementary-2-border-color-b8.border{border-color:#4d4336!important}.complementary-3-bg-b1{background-color:#00cf86}.complementary-3-color-b1{color:#00cf86}.complementary-3-border-color-b1,.complementary-3-border-color-b1.border{border-color:#00cf86!important}.complementary-3-bg-b2{background-color:#12b57c}.complementary-3-color-b2{color:#12b57c}.complementary-3-border-color-b2,.complementary-3-border-color-b2.border{border-color:#12b57c!important}.complementary-3-bg-b3{background-color:#1f9c70}.complementary-3-color-b3{color:#1f9c70}.complementary-3-border-color-b3,.complementary-3-border-color-b3.border{border-color:#1f9c70!important}.complementary-3-bg-b4{background-color:#278262}.complementary-3-color-b4{color:#278262}.complementary-3-border-color-b4,.complementary-3-border-color-b4.border{border-color:#278262!important}.complementary-3-bg-b5{background-color:#2a6953}.complementary-3-color-b5{color:#2a6953}.complementary-3-border-color-b5,.complementary-3-border-color-b5.border{border-color:#2a6953!important}.complementary-3-bg-b6{background-color:#284f41}.complementary-3-color-b6{color:#284f41}.complementary-3-border-color-b6,.complementary-3-border-color-b6.border{border-color:#284f41!important}.complementary-3-bg-b7{background-color:#20362e}.complementary-3-color-b7{color:#20362e}.complementary-3-border-color-b7,.complementary-3-border-color-b7.border{border-color:#20362e!important}.complementary-3-bg-b8{background-color:#141c19}.complementary-3-color-b8{color:#141c19}.complementary-3-border-color-b8,.complementary-3-border-color-b8.border{border-color:#141c19!important}.neutral-1-bg{background-color:#17324d}.neutral-1-color{color:#17324d}.neutral-1-border-color-,.neutral-1-border-color-.border{border-color:#17324d!important}.neutral-1-bg-a1{background-color:#ebeced}.neutral-1-color-a1{color:#ebeced}.neutral-1-border-color-a1,.neutral-1-border-color-a1.border{border-color:#ebeced!important}.neutral-1-bg-a2{background-color:#d9dadb}.neutral-1-color-a2{color:#d9dadb}.neutral-1-border-color-a2,.neutral-1-border-color-a2.border{border-color:#d9dadb!important}.neutral-1-bg-a3{background-color:#c5c7c9}.neutral-1-color-a3{color:#c5c7c9}.neutral-1-border-color-a3,.neutral-1-border-color-a3.border{border-color:#c5c7c9!important}.neutral-1-bg-a4{background-color:#adb2b8}.neutral-1-color-a4{color:#adb2b8}.neutral-1-border-color-a4,.neutral-1-border-color-a4.border{border-color:#adb2b8!important}.neutral-1-bg-a5{background-color:#959da6}.neutral-1-color-a5{color:#959da6}.neutral-1-border-color-a5,.neutral-1-border-color-a5.border{border-color:#959da6!important}.neutral-1-bg-a6{background-color:#768594}.neutral-1-color-a6{color:#768594}.neutral-1-border-color-a6,.neutral-1-border-color-a6.border{border-color:#768594!important}.neutral-1-bg-a7{background-color:#5b6f82}.neutral-1-color-a7{color:#5b6f82}.neutral-1-border-color-a7,.neutral-1-border-color-a7.border{border-color:#5b6f82!important}.neutral-1-bg-a8{background-color:#435a70}.neutral-1-color-a8{color:#435a70}.neutral-1-border-color-a8,.neutral-1-border-color-a8.border{border-color:#435a70!important}.neutral-1-bg-a9{background-color:#2f475e}.neutral-1-color-a9{color:#2f475e}.neutral-1-border-color-a9,.neutral-1-border-color-a9.border{border-color:#2f475e!important}.neutral-1-bg-a10{background-color:#17324d}.neutral-1-color-a10{color:#17324d}.neutral-1-border-color-a10,.neutral-1-border-color-a10.border{border-color:#17324d!important}.neutral-2-bg{background-color:#e6ecf2}.neutral-2-color{color:#e6ecf2}.neutral-2-border-color-{border-color:#e6ecf2}.neutral-2-bg-b1{background-color:#e6ecf2}.neutral-2-color-b1{color:#e6ecf2}.neutral-2-border-color-b1,.neutral-2-border-color-b1.border{border-color:#e6ecf2!important}.neutral-2-bg-b2{background-color:#c2c7cc}.neutral-2-color-b2{color:#c2c7cc}.neutral-2-border-color-b2,.neutral-2-border-color-b2.border{border-color:#c2c7cc!important}.neutral-2-bg-b3{background-color:#9da2a6}.neutral-2-color-b3{color:#9da2a6}.neutral-2-border-color-b3,.neutral-2-border-color-b3.border{border-color:#9da2a6!important}.neutral-2-bg-b4{background-color:#797c80}.neutral-2-color-b4{color:#797c80}.neutral-2-border-color-b4,.neutral-2-border-color-b4.border{border-color:#797c80!important}.neutral-2-bg-b5{background-color:#565759}.neutral-2-color-b5{color:#565759}.neutral-2-border-color-b5,.neutral-2-border-color-b5.border{border-color:#565759!important}.neutral-2-bg-b6{background-color:#2f3133}.neutral-2-color-b6{color:#2f3133}.neutral-2-border-color-b6,.neutral-2-border-color-b6.border{border-color:#2f3133!important}.neutral-2-bg-b7{background-color:#0c0c0d}.neutral-2-color-b7{color:#0c0c0d}.neutral-2-border-color-b7,.neutral-2-border-color-b7.border{border-color:#0c0c0d!important}.neutral-2-bg-a1{background-color:#e6ecf2}.neutral-2-color-a1{color:#e6ecf2}.neutral-2-border-color-a1,.neutral-2-border-color-a1.border{border-color:#e6ecf2!important}.neutral-2-bg-a2{background-color:#bcc4cc}.neutral-2-color-a2{color:#bcc4cc}.neutral-2-border-color-a2,.neutral-2-border-color-a2.border{border-color:#bcc4cc!important}.neutral-2-bg-a3{background-color:#9aa0a6}.neutral-2-color-a3{color:#9aa0a6}.neutral-2-border-color-a3,.neutral-2-border-color-a3.border{border-color:#9aa0a6!important}.neutral-2-bg-a4{background-color:#777b80}.neutral-2-color-a4{color:#777b80}.neutral-2-border-color-a4,.neutral-2-border-color-a4.border{border-color:#777b80!important}.neutral-2-bg-a5{background-color:#535659}.neutral-2-color-a5{color:#535659}.neutral-2-border-color-a5,.neutral-2-border-color-a5.border{border-color:#535659!important}.neutral-2-bg-a6{background-color:#2f3133}.neutral-2-color-a6{color:#2f3133}.neutral-2-border-color-a6,.neutral-2-border-color-a6.border{border-color:#2f3133!important}.neutral-2-bg-a7{background-color:#17181a}.neutral-2-color-a7{color:#17181a}.neutral-2-border-color-a7,.neutral-2-border-color-a7.border{border-color:#17181a!important}.lightgrey-bg-a1{background-color:#e8f2fc}.lightgrey-color-a1{color:#e8f2fc}.lightgrey-border-color-a1,.lightgrey-border-color-a1.border{border-color:#e8f2fc!important}.lightgrey-bg-a2{background-color:#edf5fc}.lightgrey-color-a2{color:#edf5fc}.lightgrey-border-color-a2,.lightgrey-border-color-a2.border{border-color:#edf5fc!important}.lightgrey-bg-a3{background-color:#f2f7fc}.lightgrey-color-a3{color:#f2f7fc}.lightgrey-border-color-a3,.lightgrey-border-color-a3.border{border-color:#f2f7fc!important}.lightgrey-bg-a4{background-color:#f5f9fc}.lightgrey-color-a4{color:#f5f9fc}.lightgrey-border-color-a4,.lightgrey-border-color-a4.border{border-color:#f5f9fc!important}.lightgrey-bg-b1{background-color:#e6f0fa}.lightgrey-color-b1{color:#e6f0fa}.lightgrey-border-color-b1,.lightgrey-border-color-b1.border{border-color:#e6f0fa!important}.lightgrey-bg-b2{background-color:#ebf2fa}.lightgrey-color-b2{color:#ebf2fa}.lightgrey-border-color-b2,.lightgrey-border-color-b2.border{border-color:#ebf2fa!important}.lightgrey-bg-b3{background-color:#edf4fa}.lightgrey-color-b3{color:#edf4fa}.lightgrey-border-color-b3,.lightgrey-border-color-b3.border{border-color:#edf4fa!important}.lightgrey-bg-b4{background-color:#f2f6fa}.lightgrey-color-b4{color:#f2f6fa}.lightgrey-border-color-b4,.lightgrey-border-color-b4.border{border-color:#f2f6fa!important}.lightgrey-bg-c1{background-color:#f7f9fa}.lightgrey-color-c1{color:#f7f9fa}.lightgrey-border-color-c1,.lightgrey-border-color-c1.border{border-color:#f7f9fa!important}.lightgrey-bg-c2{background-color:#f5f6f7}.lightgrey-color-c2{color:#f5f6f7}.lightgrey-border-color-c2,.lightgrey-border-color-c2.border{border-color:#f5f6f7!important}:root{--blue:#0073e6;--indigo:#554dff;--purple:#9e99ff;--pink:#ffb3bf;--red:#f73e5a;--orange:#f90;--yellow:#ffda73;--green:#00cc85;--teal:#0bd9d2;--cyan:#00fff7;--white:#fff;--gray:#656566;--gray-dark:#323333;--italia:#06c;--gray-secondary:#5c6f82;--gray-tertiary:#5a768a;--gray-quaternary:#fcfdff;--primary:#0073e6;--secondary:#5c6f82;--success:#00cc85;--info:#979899;--warning:#f90;--danger:#f73e5a;--light:#e9e6f2;--dark:#17324d;--100:#e3e4e6;--200:#cacacc;--300:#b1b1b3;--400:#979899;--500:#7e7f80;--600:#656566;--700:#4c4c4d;--800:#323333;--900:#19191a;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:"Titillium Web",Geneva,Tahoma,sans-serif;--font-family-monospace:"Roboto Mono",monospace}@media print{*,:after,:before{text-shadow:none!important;-webkit-box-shadow:none!important;box-shadow:none!important}a:not(.btn){text-decoration:underline}abbr[title]:after{content:" (" attr(title) ")"}pre{white-space:pre-wrap!important}blockquote,pre{border:1px solid #7e7f80;page-break-inside:avoid}thead{display:table-header-group}img,tr{page-break-inside:avoid}h2,h3,p{orphans:3;widows:3}h2,h3{page-break-after:avoid}@page{size:a3}.container,body{min-width:992px!important}.navbar{display:none}.badge{border:1px solid #000}.table{border-collapse:collapse!important}.table td,.table th{background-color:#fff!important}.table-bordered td,.table-bordered th{border:1px solid #b1b1b3!important}.table-dark{color:inherit}.table-dark tbody+tbody,.table-dark td,.table-dark th,.table-dark thead th{border-color:#d6dce3}.table .thead-dark th{color:inherit;border-color:#d6dce3}}*,:after,:before{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:rgba(0,0,0,0)}article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;font-family:Titillium Web,Geneva,Tahoma,sans-serif;font-size:16px;font-size:1rem;font-weight:300;line-height:1.5;color:#19191a;text-align:left;background-color:#fff}[tabindex="-1"]:focus{outline:0!important}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:8px}p{margin-top:0;margin-bottom:1rem}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0;text-decoration-skip-ink:none}address{font-style:normal;line-height:inherit}address,dl,ol,ul{margin-bottom:1rem}dl,ol,ul{margin-top:0}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}a{color:#0073e6;text-decoration:none;background-color:transparent}a:hover{color:#004d99;text-decoration:underline}a:not([href]):not([tabindex]),a:not([href]):not([tabindex]):focus,a:not([href]):not([tabindex]):hover{color:inherit;text-decoration:none}a:not([href]):not([tabindex]):focus{outline:0}code,kbd,pre,samp{font-family:Roboto Mono,monospace;font-size:1em}pre{margin-top:0;margin-bottom:1rem;overflow:auto}figure{margin:0 0 1rem}img{border-style:none}img,svg{vertical-align:middle}svg{overflow:hidden}table{border-collapse:collapse}caption{padding-top:1em;padding-bottom:1em;color:#5a768a;text-align:left;caption-side:bottom}th{text-align:inherit}label{display:inline-block;margin-bottom:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,input{overflow:visible}button,select{text-transform:none}select{word-wrap:normal}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]:not(:disabled),[type=reset]:not(:disabled),[type=submit]:not(:disabled),button:not(:disabled){cursor:pointer}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{padding:0;border-style:none}input[type=checkbox],input[type=radio]{-webkit-box-sizing:border-box;box-sizing:border-box;padding:0}input[type=date],input[type=datetime-local],input[type=month],input[type=time]{-webkit-appearance:listbox}textarea{overflow:auto;resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{display:block;width:100%;max-width:100%;padding:0;margin-bottom:.5rem;font-size:24px;font-size:1.5rem;line-height:inherit;color:inherit;white-space:normal}progress{vertical-align:baseline}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{outline-offset:-2px;-webkit-appearance:none}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}output{display:inline-block}summary{display:list-item;cursor:pointer}template{display:none}[hidden]{display:none!important}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{margin-bottom:8px;font-weight:700;line-height:1.2}.h1,h1{font-size:40px;font-size:2.5rem}.h2,h2{font-size:32px;font-size:2rem}.h3,h3{font-size:28px;font-size:1.75rem}.h4,h4{font-size:24px;font-size:1.5rem}.h5,h5{font-size:20px;font-size:1.25rem}.h6,h6{font-size:16px;font-size:1rem}.lead{font-size:20px;font-size:1.25rem;font-weight:300}.display-1{font-size:56px;font-size:3.5rem}.display-1,.display-2{font-weight:700;line-height:1.2}.display-2{font-size:40px;font-size:2.5rem}.display-3{font-size:24px;font-size:1.5rem}.display-3,.display-4{font-weight:700;line-height:1.2}.display-4{font-size:20px;font-size:1.25rem}hr{margin-top:16px;margin-bottom:16px;border:0;border-top:1px solid rgba(0,0,0,.1)}.small,small{font-size:12.432px;font-size:.777rem}.mark,mark{padding:.2em;background-color:#fcf8e3}.list-inline,.list-unstyled{padding-left:0;list-style:none}.list-inline-item{display:inline-block}.list-inline-item:not(:last-child){margin-right:.5rem}.initialism{font-size:90%;text-transform:uppercase}.blockquote{margin-bottom:16px;font-size:20px;font-size:1.25rem}.blockquote-footer{display:block;font-size:12.432px;font-size:.777rem}.blockquote-footer:before{content:"\2014\00A0"}.img-fluid,.img-thumbnail{max-width:100%;height:auto}.img-thumbnail{padding:.25rem;background-color:#fff;border:1px solid #b1b1b3;border-radius:4px;-webkit-box-shadow:0 1px 2px rgba(0,0,0,.075);box-shadow:0 1px 2px rgba(0,0,0,.075)}.figure{display:inline-block}.figure-img{margin-bottom:8px;line-height:1}.figure-caption{font-size:90%;color:#656566}code{font-size:87.5%;color:#17324d;word-break:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:87.5%;color:#fff;background-color:#19191a;border-radius:2px;-webkit-box-shadow:inset 0 -.1rem 0 rgba(0,0,0,.25);box-shadow:inset 0 -.1rem 0 rgba(0,0,0,.25)}kbd kbd{padding:0;font-size:100%;font-weight:700;-webkit-box-shadow:none;box-shadow:none}pre{display:block;font-size:87.5%;color:#19191a}pre code{font-size:inherit;color:inherit;word-break:normal}.pre-scrollable{max-height:340px;overflow-y:scroll}.container{width:100%;padding-right:6px;padding-left:6px;margin-right:auto;margin-left:auto}@media (min-width:576px){.container{max-width:540px}}@media (min-width:768px){.container{max-width:720px}}@media (min-width:992px){.container{max-width:960px}}@media (min-width:1200px){.container{max-width:1140px}}.container-fluid{width:100%;padding-right:6px;padding-left:6px;margin-right:auto;margin-left:auto}.row{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;margin-right:-6px;margin-left:-6px}.no-gutters{margin-right:0;margin-left:0}.no-gutters>.col,.no-gutters>[class*=col-]{padding-right:0;padding-left:0}.col,.col-1,.col-2,.col-3,.col-4,.col-5,.col-6,.col-7,.col-8,.col-9,.col-10,.col-11,.col-12,.col-auto,.col-lg,.col-lg-1,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg-auto,.col-md,.col-md-1,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-md-10,.col-md-11,.col-md-12,.col-md-auto,.col-sm,.col-sm-1,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-auto,.col-xl,.col-xl-1,.col-xl-2,.col-xl-3,.col-xl-4,.col-xl-5,.col-xl-6,.col-xl-7,.col-xl-8,.col-xl-9,.col-xl-10,.col-xl-11,.col-xl-12,.col-xl-auto{position:relative;width:100%;padding-right:6px;padding-left:6px}.col{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-auto{-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-1,.col-auto{-webkit-box-flex:0}.col-1{-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-2{-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-2,.col-3{-webkit-box-flex:0}.col-3{-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-4{-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-4,.col-5{-webkit-box-flex:0}.col-5{-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-6{-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-6,.col-7{-webkit-box-flex:0}.col-7{-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-8{-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-8,.col-9{-webkit-box-flex:0}.col-9{-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-10{-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-10,.col-11{-webkit-box-flex:0}.col-11{-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-1{margin-left:8.3333333333%}.offset-2{margin-left:16.6666666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.3333333333%}.offset-5{margin-left:41.6666666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.3333333333%}.offset-8{margin-left:66.6666666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.3333333333%}.offset-11{margin-left:91.6666666667%}@media (min-width:576px){.col-sm{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-sm-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-sm-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-sm-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-sm-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-sm-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-sm-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-sm-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-sm-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-sm-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-sm-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-sm-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-sm-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-sm-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-sm-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-sm-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-sm-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-sm-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-sm-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-sm-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-sm-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-sm-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-sm-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-sm-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-sm-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-sm-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-sm-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-sm-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-sm-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-sm-0{margin-left:0}.offset-sm-1{margin-left:8.3333333333%}.offset-sm-2{margin-left:16.6666666667%}.offset-sm-3{margin-left:25%}.offset-sm-4{margin-left:33.3333333333%}.offset-sm-5{margin-left:41.6666666667%}.offset-sm-6{margin-left:50%}.offset-sm-7{margin-left:58.3333333333%}.offset-sm-8{margin-left:66.6666666667%}.offset-sm-9{margin-left:75%}.offset-sm-10{margin-left:83.3333333333%}.offset-sm-11{margin-left:91.6666666667%}}@media (min-width:768px){.col-md{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-md-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-md-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-md-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-md-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-md-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-md-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-md-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-md-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-md-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-md-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-md-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-md-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-md-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-md-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-md-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-md-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-md-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-md-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-md-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-md-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-md-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-md-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-md-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-md-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-md-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-md-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-md-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-md-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-md-0{margin-left:0}.offset-md-1{margin-left:8.3333333333%}.offset-md-2{margin-left:16.6666666667%}.offset-md-3{margin-left:25%}.offset-md-4{margin-left:33.3333333333%}.offset-md-5{margin-left:41.6666666667%}.offset-md-6{margin-left:50%}.offset-md-7{margin-left:58.3333333333%}.offset-md-8{margin-left:66.6666666667%}.offset-md-9{margin-left:75%}.offset-md-10{margin-left:83.3333333333%}.offset-md-11{margin-left:91.6666666667%}}@media (min-width:992px){.col-lg{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-lg-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-lg-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-lg-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-lg-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-lg-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-lg-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-lg-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-lg-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-lg-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-lg-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-lg-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-lg-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-lg-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-lg-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-lg-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-lg-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-lg-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-lg-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-lg-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-lg-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-lg-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-lg-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-lg-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-lg-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-lg-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-lg-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-lg-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-lg-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-lg-0{margin-left:0}.offset-lg-1{margin-left:8.3333333333%}.offset-lg-2{margin-left:16.6666666667%}.offset-lg-3{margin-left:25%}.offset-lg-4{margin-left:33.3333333333%}.offset-lg-5{margin-left:41.6666666667%}.offset-lg-6{margin-left:50%}.offset-lg-7{margin-left:58.3333333333%}.offset-lg-8{margin-left:66.6666666667%}.offset-lg-9{margin-left:75%}.offset-lg-10{margin-left:83.3333333333%}.offset-lg-11{margin-left:91.6666666667%}}@media (min-width:1200px){.col-xl{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.col-xl-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-xl-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-xl-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-xl-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-xl-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-xl-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-xl-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-xl-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-xl-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-xl-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-xl-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-xl-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-xl-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-xl-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-xl-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-xl-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-xl-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-xl-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-xl-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-xl-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-xl-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-xl-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-xl-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-xl-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-xl-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-xl-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-xl-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-xl-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-xl-0{margin-left:0}.offset-xl-1{margin-left:8.3333333333%}.offset-xl-2{margin-left:16.6666666667%}.offset-xl-3{margin-left:25%}.offset-xl-4{margin-left:33.3333333333%}.offset-xl-5{margin-left:41.6666666667%}.offset-xl-6{margin-left:50%}.offset-xl-7{margin-left:58.3333333333%}.offset-xl-8{margin-left:66.6666666667%}.offset-xl-9{margin-left:75%}.offset-xl-10{margin-left:83.3333333333%}.offset-xl-11{margin-left:91.6666666667%}}.table{width:100%;margin-bottom:16px;color:#19191a}.table td,.table th{padding:1em;vertical-align:top;border-top:1px solid #d6dce3}.table thead th{vertical-align:bottom;border-bottom:2px solid #d6dce3}.table tbody+tbody{border-top:2px solid #d6dce3}.table-sm td,.table-sm th{padding:.3rem}.table-bordered,.table-bordered td,.table-bordered th{border:1px solid #d6dce3}.table-bordered thead td,.table-bordered thead th{border-bottom-width:2px}.table-borderless tbody+tbody,.table-borderless td,.table-borderless th,.table-borderless thead th{border:0}.table-striped tbody tr:nth-of-type(odd){background-color:#f6f7f9}.table-hover tbody tr:hover{color:#19191a;background-color:#e5f1fa}.table-primary,.table-primary>td,.table-primary>th{background-color:#b8d8f8}.table-primary tbody+tbody,.table-primary td,.table-primary th,.table-primary thead th{border-color:#7ab6f2}.table-hover .table-primary:hover,.table-hover .table-primary:hover>td,.table-hover .table-primary:hover>th{background-color:#a1cbf6}.table-secondary,.table-secondary>td,.table-secondary>th{background-color:#d1d7dc}.table-secondary tbody+tbody,.table-secondary td,.table-secondary th,.table-secondary thead th{border-color:#aab4be}.table-hover .table-secondary:hover,.table-hover .table-secondary:hover>td,.table-hover .table-secondary:hover>th{background-color:#c3cad1}.table-success,.table-success>td,.table-success>th{background-color:#b8f1dd}.table-success tbody+tbody,.table-success td,.table-success th,.table-success thead th{border-color:#7ae4c0}.table-hover .table-success:hover,.table-hover .table-success:hover>td,.table-hover .table-success:hover>th{background-color:#a3edd3}.table-info,.table-info>td,.table-info>th{background-color:#e2e2e2}.table-info tbody+tbody,.table-info td,.table-info th,.table-info thead th{border-color:#c9c9ca}.table-hover .table-info:hover,.table-hover .table-info:hover>td,.table-hover .table-info:hover>th{background-color:#d5d5d5}.table-warning,.table-warning>td,.table-warning>th{background-color:#ffe2b8}.table-warning tbody+tbody,.table-warning td,.table-warning th,.table-warning thead th{border-color:#ffca7a}.table-hover .table-warning:hover,.table-hover .table-warning:hover>td,.table-hover .table-warning:hover>th{background-color:#ffd89f}.table-danger,.table-danger>td,.table-danger>th{background-color:#fdc9d1}.table-danger tbody+tbody,.table-danger td,.table-danger th,.table-danger thead th{border-color:#fb9ba9}.table-hover .table-danger:hover,.table-hover .table-danger:hover>td,.table-hover .table-danger:hover>th{background-color:#fcb0bc}.table-light,.table-light>td,.table-light>th{background-color:#f9f8fb}.table-light tbody+tbody,.table-light td,.table-light th,.table-light thead th{border-color:#f4f2f8}.table-hover .table-light:hover,.table-hover .table-light:hover>td,.table-hover .table-light:hover>th{background-color:#ebe8f2}.table-dark,.table-dark>td,.table-dark>th{background-color:#bec6cd}.table-dark tbody+tbody,.table-dark td,.table-dark th,.table-dark thead th{border-color:#8694a2}.table-hover .table-dark:hover,.table-hover .table-dark:hover>td,.table-hover .table-dark:hover>th{background-color:#b0b9c2}.table-100,.table-100>td,.table-100>th{background-color:#f7f7f8}.table-100 tbody+tbody,.table-100 td,.table-100 th,.table-100 thead th{border-color:#f0f1f2}.table-hover .table-100:hover,.table-hover .table-100:hover>td,.table-hover .table-100:hover>th{background-color:#e9e9ec}.table-200,.table-200>td,.table-200>th{background-color:#f0f0f1}.table-200 tbody+tbody,.table-200 td,.table-200 th,.table-200 thead th{border-color:#e3e3e4}.table-hover .table-200:hover,.table-hover .table-200:hover>td,.table-hover .table-200:hover>th{background-color:#e3e3e5}.table-300,.table-300>td,.table-300>th{background-color:#e9e9ea}.table-300 tbody+tbody,.table-300 td,.table-300 th,.table-300 thead th{border-color:#d6d6d7}.table-hover .table-300:hover,.table-hover .table-300:hover>td,.table-hover .table-300:hover>th{background-color:#dcdcde}.table-400,.table-400>td,.table-400>th{background-color:#e2e2e2}.table-400 tbody+tbody,.table-400 td,.table-400 th,.table-400 thead th{border-color:#c9c9ca}.table-hover .table-400:hover,.table-hover .table-400:hover>td,.table-hover .table-400:hover>th{background-color:#d5d5d5}.table-500,.table-500>td,.table-500>th{background-color:#dbdbdb}.table-500 tbody+tbody,.table-500 td,.table-500 th,.table-500 thead th{border-color:#bcbcbd}.table-hover .table-500:hover,.table-hover .table-500:hover>td,.table-hover .table-500:hover>th{background-color:#cecece}.table-600,.table-600>td,.table-600>th{background-color:#d4d4d4}.table-600 tbody+tbody,.table-600 td,.table-600 th,.table-600 thead th{border-color:#afafaf}.table-hover .table-600:hover,.table-hover .table-600:hover>td,.table-hover .table-600:hover>th{background-color:#c7c7c7}.table-700,.table-700>td,.table-700>th{background-color:#cdcdcd}.table-700 tbody+tbody,.table-700 td,.table-700 th,.table-700 thead th{border-color:#a2a2a2}.table-hover .table-700:hover,.table-hover .table-700:hover>td,.table-hover .table-700:hover>th{background-color:silver}.table-800,.table-800>td,.table-800>th{background-color:#c6c6c6}.table-800 tbody+tbody,.table-800 td,.table-800 th,.table-800 thead th{border-color:#949595}.table-hover .table-800:hover,.table-hover .table-800:hover>td,.table-hover .table-800:hover>th{background-color:#b9b9b9}.table-900,.table-900>td,.table-900>th{background-color:#bfbfbf}.table-900 tbody+tbody,.table-900 td,.table-900 th,.table-900 thead th{border-color:#878788}.table-hover .table-900:hover,.table-hover .table-900:hover>td,.table-hover .table-900:hover>th{background-color:#b2b2b2}.table-active,.table-active>td,.table-active>th{background-color:#e5f1fa}.table-hover .table-active:hover,.table-hover .table-active:hover>td,.table-hover .table-active:hover>th{background-color:#d0e5f6}.table .thead-dark th{color:#fff;background-color:#323333;border-color:#464646}.table .thead-light th{color:#4c4c4d;background-color:#cacacc;border-color:#d6dce3}.table-dark{color:#fff;background-color:#323333}.table-dark td,.table-dark th,.table-dark thead th{border-color:#464646}.table-dark.table-bordered{border:0}.table-dark.table-striped tbody tr:nth-of-type(odd){background-color:hsla(0,0%,100%,.05)}.table-dark.table-hover tbody tr:hover{color:#fff;background-color:hsla(0,0%,100%,.075)}@media (max-width:575.98px){.table-responsive-sm{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-sm>.table-bordered{border:0}}@media (max-width:767.98px){.table-responsive-md{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-md>.table-bordered{border:0}}@media (max-width:991.98px){.table-responsive-lg{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-lg>.table-bordered{border:0}}@media (max-width:1199.98px){.table-responsive-xl{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-xl>.table-bordered{border:0}}.table-responsive{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive>.table-bordered{border:0}.form-control{display:block;width:100%;height:calc(1.5em + .75rem + 2px);padding:.375rem .75rem;font-size:16px;font-size:1rem;font-weight:300;line-height:1.5;color:#4c4c4d;background-color:#fff;background-clip:padding-box;border:1px solid #979899;border-radius:4px;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075);-webkit-transition:border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-control{-webkit-transition:none;transition:none}}.form-control::-ms-expand{background-color:transparent;border:0}.form-control:focus{color:#4c4c4d;background-color:#fff;border-color:#5c6f82;outline:0;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.25);box-shadow:inset 0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.25)}.form-control::-webkit-input-placeholder{color:#656566;opacity:1}.form-control::-moz-placeholder{color:#656566;opacity:1}.form-control::-ms-input-placeholder{color:#656566;opacity:1}.form-control::placeholder{color:#656566;opacity:1}.form-control:disabled,.form-control[readonly]{background-color:#cacacc;opacity:1}select.form-control:focus::-ms-value{color:#4c4c4d;background-color:#fff}.form-control-file,.form-control-range{display:block;width:100%}.col-form-label{padding-top:calc(.375rem + 1px);padding-bottom:calc(.375rem + 1px);margin-bottom:0;font-size:inherit;line-height:1.5}.col-form-label-lg{padding-top:calc(.5rem + 1px);padding-bottom:calc(.5rem + 1px);font-size:20px;font-size:1.25rem;line-height:1.556}.col-form-label-sm{padding-top:calc(.25rem + 1px);padding-bottom:calc(.25rem + 1px);font-size:14px;font-size:.875rem;line-height:1.428}.form-control-plaintext{display:block;width:100%;padding-top:.375rem;padding-bottom:.375rem;margin-bottom:0;line-height:1.5;color:#19191a;background-color:transparent;border:solid transparent;border-width:1px 0}.form-control-plaintext.form-control-lg,.form-control-plaintext.form-control-sm{padding-right:0;padding-left:0}.form-control-sm{height:calc(1.428em + .5rem + 2px);padding:.25rem .5rem;font-size:14px;font-size:.875rem;line-height:1.428;border-radius:2px}.form-control-lg{height:calc(1.556em + 1rem + 2px);padding:.5rem 1rem;font-size:20px;font-size:1.25rem;line-height:1.556;border-radius:8px}select.form-control[multiple],select.form-control[size],textarea.form-control{height:auto}.form-group{margin-bottom:1rem}.form-text{display:block;margin-top:.25rem}.form-row{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;margin-right:-5px;margin-left:-5px}.form-row>.col,.form-row>[class*=col-]{padding-right:5px;padding-left:5px}.form-check{position:relative;display:block;padding-left:1.25rem}.form-check-input{position:absolute;margin-top:.3rem;margin-left:-1.25rem}.form-check-input:disabled~.form-check-label{color:#5a768a}.form-check-label{margin-bottom:0}.form-check-inline{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding-left:0;margin-right:.75rem}.form-check-inline .form-check-input{position:static;margin-top:0;margin-right:.3125rem;margin-left:0}.valid-feedback{display:none;width:100%;margin-top:.25rem;font-size:12.432px;font-size:.777rem;color:#00cc85}.valid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:1rem;margin-top:.1rem;font-size:14px;font-size:.875rem;line-height:1.5;color:#19191a;background-color:#00cc85;border-radius:4px}.form-control.is-valid,.was-validated .form-control:valid{border-color:#00cc85;padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%2300cc85' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3E%3C/svg%3E");background-repeat:no-repeat;background-position:100% calc(.375em + .1875rem);background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-valid:focus,.was-validated .form-control:valid:focus{border-color:#00cc85;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.form-control.is-valid~.valid-feedback,.form-control.is-valid~.valid-tooltip,.was-validated .form-control:valid~.valid-feedback,.was-validated .form-control:valid~.valid-tooltip{display:block}.was-validated textarea.form-control:valid,textarea.form-control.is-valid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.custom-select.is-valid,.was-validated .custom-select:valid{border-color:#00cc85;padding-right:calc((3em + 2.25rem)/4 + 1.75rem);background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23323333' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px,url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%2300cc85' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3E%3C/svg%3E") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)}.custom-select.is-valid:focus,.was-validated .custom-select:valid:focus{border-color:#00cc85;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.custom-select.is-valid~.valid-feedback,.custom-select.is-valid~.valid-tooltip,.form-control-file.is-valid~.valid-feedback,.form-control-file.is-valid~.valid-tooltip,.was-validated .custom-select:valid~.valid-feedback,.was-validated .custom-select:valid~.valid-tooltip,.was-validated .form-control-file:valid~.valid-feedback,.was-validated .form-control-file:valid~.valid-tooltip{display:block}.form-check-input.is-valid~.form-check-label,.was-validated .form-check-input:valid~.form-check-label{color:#00cc85}.form-check-input.is-valid~.valid-feedback,.form-check-input.is-valid~.valid-tooltip,.was-validated .form-check-input:valid~.valid-feedback,.was-validated .form-check-input:valid~.valid-tooltip{display:block}.custom-control-input.is-valid~.custom-control-label,.was-validated .custom-control-input:valid~.custom-control-label{color:#00cc85}.custom-control-input.is-valid~.custom-control-label:before,.was-validated .custom-control-input:valid~.custom-control-label:before{border-color:#00cc85}.custom-control-input.is-valid~.valid-feedback,.custom-control-input.is-valid~.valid-tooltip,.was-validated .custom-control-input:valid~.valid-feedback,.was-validated .custom-control-input:valid~.valid-tooltip{display:block}.custom-control-input.is-valid:checked~.custom-control-label:before,.was-validated .custom-control-input:valid:checked~.custom-control-label:before{border-color:#00ffa6;background-color:#00ffa6}.custom-control-input.is-valid:focus~.custom-control-label:before,.was-validated .custom-control-input:valid:focus~.custom-control-label:before{-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.custom-control-input.is-valid:focus:not(:checked)~.custom-control-label:before,.custom-file-input.is-valid~.custom-file-label,.was-validated .custom-control-input:valid:focus:not(:checked)~.custom-control-label:before,.was-validated .custom-file-input:valid~.custom-file-label{border-color:#00cc85}.custom-file-input.is-valid~.valid-feedback,.custom-file-input.is-valid~.valid-tooltip,.was-validated .custom-file-input:valid~.valid-feedback,.was-validated .custom-file-input:valid~.valid-tooltip{display:block}.custom-file-input.is-valid:focus~.custom-file-label,.was-validated .custom-file-input:valid:focus~.custom-file-label{border-color:#00cc85;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.25);box-shadow:0 0 0 .2rem rgba(0,204,133,.25)}.invalid-feedback{display:none;width:100%;margin-top:.25rem;font-size:12.432px;font-size:.777rem;color:#f73e5a}.invalid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:1rem;margin-top:.1rem;font-size:14px;font-size:.875rem;line-height:1.5;color:#19191a;background-color:#f73e5a;border-radius:4px}.form-control.is-invalid,.was-validated .form-control:invalid{border-color:#f73e5a;padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f73e5a' viewBox='-2 -2 7 7'%3E%3Cpath stroke='%23f73e5a' d='M0 0l3 3m0-3L0 3'/%3E%3Ccircle r='.5'/%3E%3Ccircle cx='3' r='.5'/%3E%3Ccircle cy='3' r='.5'/%3E%3Ccircle cx='3' cy='3' r='.5'/%3E%3C/svg%3E");background-repeat:no-repeat;background-position:100% calc(.375em + .1875rem);background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-invalid:focus,.was-validated .form-control:invalid:focus{border-color:#f73e5a;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.form-control.is-invalid~.invalid-feedback,.form-control.is-invalid~.invalid-tooltip,.was-validated .form-control:invalid~.invalid-feedback,.was-validated .form-control:invalid~.invalid-tooltip{display:block}.was-validated textarea.form-control:invalid,textarea.form-control.is-invalid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.custom-select.is-invalid,.was-validated .custom-select:invalid{border-color:#f73e5a;padding-right:calc((3em + 2.25rem)/4 + 1.75rem);background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23323333' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px,url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f73e5a' viewBox='-2 -2 7 7'%3E%3Cpath stroke='%23f73e5a' d='M0 0l3 3m0-3L0 3'/%3E%3Ccircle r='.5'/%3E%3Ccircle cx='3' r='.5'/%3E%3Ccircle cy='3' r='.5'/%3E%3Ccircle cx='3' cy='3' r='.5'/%3E%3C/svg%3E") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)}.custom-select.is-invalid:focus,.was-validated .custom-select:invalid:focus{border-color:#f73e5a;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.custom-select.is-invalid~.invalid-feedback,.custom-select.is-invalid~.invalid-tooltip,.form-control-file.is-invalid~.invalid-feedback,.form-control-file.is-invalid~.invalid-tooltip,.was-validated .custom-select:invalid~.invalid-feedback,.was-validated .custom-select:invalid~.invalid-tooltip,.was-validated .form-control-file:invalid~.invalid-feedback,.was-validated .form-control-file:invalid~.invalid-tooltip{display:block}.form-check-input.is-invalid~.form-check-label,.was-validated .form-check-input:invalid~.form-check-label{color:#f73e5a}.form-check-input.is-invalid~.invalid-feedback,.form-check-input.is-invalid~.invalid-tooltip,.was-validated .form-check-input:invalid~.invalid-feedback,.was-validated .form-check-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid~.custom-control-label,.was-validated .custom-control-input:invalid~.custom-control-label{color:#f73e5a}.custom-control-input.is-invalid~.custom-control-label:before,.was-validated .custom-control-input:invalid~.custom-control-label:before{border-color:#f73e5a}.custom-control-input.is-invalid~.invalid-feedback,.custom-control-input.is-invalid~.invalid-tooltip,.was-validated .custom-control-input:invalid~.invalid-feedback,.was-validated .custom-control-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid:checked~.custom-control-label:before,.was-validated .custom-control-input:invalid:checked~.custom-control-label:before{border-color:#f96f84;background-color:#f96f84}.custom-control-input.is-invalid:focus~.custom-control-label:before,.was-validated .custom-control-input:invalid:focus~.custom-control-label:before{-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.custom-control-input.is-invalid:focus:not(:checked)~.custom-control-label:before,.custom-file-input.is-invalid~.custom-file-label,.was-validated .custom-control-input:invalid:focus:not(:checked)~.custom-control-label:before,.was-validated .custom-file-input:invalid~.custom-file-label{border-color:#f73e5a}.custom-file-input.is-invalid~.invalid-feedback,.custom-file-input.is-invalid~.invalid-tooltip,.was-validated .custom-file-input:invalid~.invalid-feedback,.was-validated .custom-file-input:invalid~.invalid-tooltip{display:block}.custom-file-input.is-invalid:focus~.custom-file-label,.was-validated .custom-file-input:invalid:focus~.custom-file-label{border-color:#f73e5a;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.25);box-shadow:0 0 0 .2rem rgba(247,62,90,.25)}.form-inline{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.form-inline .form-check{width:100%}@media (min-width:576px){.form-inline label{-ms-flex-align:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.form-inline .form-group,.form-inline label{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;align-items:center;margin-bottom:0}.form-inline .form-group{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;-ms-flex-align:center}.form-inline .form-control{display:inline-block;width:auto;vertical-align:middle}.form-inline .form-control-plaintext{display:inline-block}.form-inline .custom-select,.form-inline .input-group{width:auto}.form-inline .form-check{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:auto;padding-left:0}.form-inline .form-check-input{position:relative;-ms-flex-negative:0;flex-shrink:0;margin-top:0;margin-right:.25rem;margin-left:0}.form-inline .custom-control{-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.form-inline .custom-control-label{margin-bottom:0}}.btn{display:inline-block;font-weight:600;color:#19191a;text-align:center;vertical-align:middle;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;background-color:transparent;border:0 solid transparent;padding:.375rem .75rem;font-size:1rem;line-height:1.5;border-radius:4px;-webkit-transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.btn{-webkit-transition:none;transition:none}}.btn:hover{color:#19191a;text-decoration:none}.btn.focus,.btn:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.25);box-shadow:0 0 0 .2rem rgba(0,115,230,.25)}.btn.disabled,.btn:disabled{opacity:.65;-webkit-box-shadow:none;box-shadow:none}.btn:not(:disabled):not(.disabled).active,.btn:not(:disabled):not(.disabled):active{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125);box-shadow:inset 0 3px 5px rgba(0,0,0,.125)}.btn:not(:disabled):not(.disabled).active:focus,.btn:not(:disabled):not(.disabled):active:focus{-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.25),inset 0 3px 5px rgba(0,0,0,.125);box-shadow:0 0 0 .2rem rgba(0,115,230,.25),inset 0 3px 5px rgba(0,0,0,.125)}a.btn.disabled,fieldset:disabled a.btn{pointer-events:none}.btn-primary{color:#fff;background-color:#0073e6;border-color:#0073e6;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-primary:hover{color:#fff;background-color:#0060bf;border-color:#0059b3}.btn-primary.focus,.btn-primary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5)}.btn-primary.disabled,.btn-primary:disabled{color:#fff;background-color:#0073e6;border-color:#0073e6}.btn-primary:not(:disabled):not(.disabled).active,.btn-primary:not(:disabled):not(.disabled):active,.show>.btn-primary.dropdown-toggle{color:#fff;background-color:#0059b3;border-color:#0053a6}.btn-primary:not(:disabled):not(.disabled).active:focus,.btn-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5)}.btn-secondary{color:#fff;background-color:#5c6f82;border-color:#5c6f82;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-secondary:hover{color:#fff;background-color:#4c5c6c;border-color:#475664}.btn-secondary.focus,.btn-secondary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(92,111,130,.5)}.btn-secondary.disabled,.btn-secondary:disabled{color:#fff;background-color:#5c6f82;border-color:#5c6f82}.btn-secondary:not(:disabled):not(.disabled).active,.btn-secondary:not(:disabled):not(.disabled):active,.show>.btn-secondary.dropdown-toggle{color:#fff;background-color:#475664;border-color:#424f5d}.btn-secondary:not(:disabled):not(.disabled).active:focus,.btn-secondary:not(:disabled):not(.disabled):active:focus,.show>.btn-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5)}.btn-success{color:#19191a;background-color:#00cc85;border-color:#00cc85;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-success:hover{color:#fff;background-color:#00a66c;border-color:#009963}.btn-success.focus,.btn-success:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,204,133,.5)}.btn-success.disabled,.btn-success:disabled{color:#19191a;background-color:#00cc85;border-color:#00cc85}.btn-success:not(:disabled):not(.disabled).active,.btn-success:not(:disabled):not(.disabled):active,.show>.btn-success.dropdown-toggle{color:#fff;background-color:#009963;border-color:#008c5b}.btn-success:not(:disabled):not(.disabled).active:focus,.btn-success:not(:disabled):not(.disabled):active:focus,.show>.btn-success.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5)}.btn-info{color:#19191a;background-color:#979899;border-color:#979899;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-info:hover{color:#19191a;background-color:#848586;border-color:#7e7e80}.btn-info.focus,.btn-info:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5)}.btn-info.disabled,.btn-info:disabled{color:#19191a;background-color:#979899;border-color:#979899}.btn-info:not(:disabled):not(.disabled).active,.btn-info:not(:disabled):not(.disabled):active,.show>.btn-info.dropdown-toggle{color:#19191a;background-color:#7e7e80;border-color:#777879}.btn-info:not(:disabled):not(.disabled).active:focus,.btn-info:not(:disabled):not(.disabled):active:focus,.show>.btn-info.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-warning{color:#19191a;background-color:#f90;border-color:#f90;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-warning:hover{color:#19191a;background-color:#d98200;border-color:#cc7a00}.btn-warning.focus,.btn-warning:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(255,153,0,.5)}.btn-warning.disabled,.btn-warning:disabled{color:#19191a;background-color:#f90;border-color:#f90}.btn-warning:not(:disabled):not(.disabled).active,.btn-warning:not(:disabled):not(.disabled):active,.show>.btn-warning.dropdown-toggle{color:#19191a;background-color:#cc7a00;border-color:#bf7300}.btn-warning:not(:disabled):not(.disabled).active:focus,.btn-warning:not(:disabled):not(.disabled):active:focus,.show>.btn-warning.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5)}.btn-danger{color:#19191a;background-color:#f73e5a;border-color:#f73e5a;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-danger:hover{color:#fff;background-color:#f6193a;border-color:#f50d30}.btn-danger.focus,.btn-danger:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(247,62,90,.5)}.btn-danger.disabled,.btn-danger:disabled{color:#19191a;background-color:#f73e5a;border-color:#f73e5a}.btn-danger:not(:disabled):not(.disabled).active,.btn-danger:not(:disabled):not(.disabled):active,.show>.btn-danger.dropdown-toggle{color:#fff;background-color:#f50d30;border-color:#ec092b}.btn-danger:not(:disabled):not(.disabled).active:focus,.btn-danger:not(:disabled):not(.disabled):active:focus,.show>.btn-danger.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5)}.btn-light{color:#19191a;background-color:#e9e6f2;border-color:#e9e6f2;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-light:hover{color:#19191a;background-color:#d3cde5;border-color:#ccc4e1}.btn-light.focus,.btn-light:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(233,230,242,.5)}.btn-light.disabled,.btn-light:disabled{color:#19191a;background-color:#e9e6f2;border-color:#e9e6f2}.btn-light:not(:disabled):not(.disabled).active,.btn-light:not(:disabled):not(.disabled):active,.show>.btn-light.dropdown-toggle{color:#19191a;background-color:#ccc4e1;border-color:#c4bcdd}.btn-light:not(:disabled):not(.disabled).active:focus,.btn-light:not(:disabled):not(.disabled):active:focus,.show>.btn-light.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5)}.btn-dark{color:#fff;background-color:#17324d;border-color:#17324d;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-dark:hover{color:#fff;background-color:#0e1f2f;border-color:#0b1825}.btn-dark.focus,.btn-dark:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(23,50,77,.5)}.btn-dark.disabled,.btn-dark:disabled{color:#fff;background-color:#17324d;border-color:#17324d}.btn-dark:not(:disabled):not(.disabled).active,.btn-dark:not(:disabled):not(.disabled):active,.show>.btn-dark.dropdown-toggle{color:#fff;background-color:#0b1825;border-color:#08121b}.btn-dark:not(:disabled):not(.disabled).active:focus,.btn-dark:not(:disabled):not(.disabled):active:focus,.show>.btn-dark.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5)}.btn-100{color:#19191a;background-color:#e3e4e6;border-color:#e3e4e6;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-100:hover{color:#19191a;background-color:#cfd0d3;border-color:#c9cacd}.btn-100.focus,.btn-100:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(227,228,230,.5)}.btn-100.disabled,.btn-100:disabled{color:#19191a;background-color:#e3e4e6;border-color:#e3e4e6}.btn-100:not(:disabled):not(.disabled).active,.btn-100:not(:disabled):not(.disabled):active,.show>.btn-100.dropdown-toggle{color:#19191a;background-color:#c9cacd;border-color:#c2c3c7}.btn-100:not(:disabled):not(.disabled).active:focus,.btn-100:not(:disabled):not(.disabled):active:focus,.show>.btn-100.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5)}.btn-200{color:#19191a;background-color:#cacacc;border-color:#cacacc;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-200:hover{color:#19191a;background-color:#b6b7b9;border-color:#b0b1b3}.btn-200.focus,.btn-200:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(202,202,204,.5)}.btn-200.disabled,.btn-200:disabled{color:#19191a;background-color:#cacacc;border-color:#cacacc}.btn-200:not(:disabled):not(.disabled).active,.btn-200:not(:disabled):not(.disabled):active,.show>.btn-200.dropdown-toggle{color:#19191a;background-color:#b0b1b3;border-color:#a9aaad}.btn-200:not(:disabled):not(.disabled).active:focus,.btn-200:not(:disabled):not(.disabled):active:focus,.show>.btn-200.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5)}.btn-300{color:#19191a;background-color:#b1b1b3;border-color:#b1b1b3;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-300:hover{color:#19191a;background-color:#9d9ea0;border-color:#979899}.btn-300.focus,.btn-300:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(177,177,179,.5)}.btn-300.disabled,.btn-300:disabled{color:#19191a;background-color:#b1b1b3;border-color:#b1b1b3}.btn-300:not(:disabled):not(.disabled).active,.btn-300:not(:disabled):not(.disabled):active,.show>.btn-300.dropdown-toggle{color:#19191a;background-color:#979899;border-color:#909193}.btn-300:not(:disabled):not(.disabled).active:focus,.btn-300:not(:disabled):not(.disabled):active:focus,.show>.btn-300.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5)}.btn-400{color:#19191a;background-color:#979899;border-color:#979899;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-400:hover{color:#19191a;background-color:#848586;border-color:#7e7e80}.btn-400.focus,.btn-400:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(151,152,153,.5)}.btn-400.disabled,.btn-400:disabled{color:#19191a;background-color:#979899;border-color:#979899}.btn-400:not(:disabled):not(.disabled).active,.btn-400:not(:disabled):not(.disabled):active,.show>.btn-400.dropdown-toggle{color:#19191a;background-color:#7e7e80;border-color:#777879}.btn-400:not(:disabled):not(.disabled).active:focus,.btn-400:not(:disabled):not(.disabled):active:focus,.show>.btn-400.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-500{color:#19191a;background-color:#7e7f80;border-color:#7e7f80;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-500:hover{color:#fff;background-color:#6b6b6c;border-color:#656566}.btn-500.focus,.btn-500:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(126,127,128,.5)}.btn-500.disabled,.btn-500:disabled{color:#19191a;background-color:#7e7f80;border-color:#7e7f80}.btn-500:not(:disabled):not(.disabled).active,.btn-500:not(:disabled):not(.disabled):active,.show>.btn-500.dropdown-toggle{color:#fff;background-color:#656566;border-color:#5f5f5f}.btn-500:not(:disabled):not(.disabled).active:focus,.btn-500:not(:disabled):not(.disabled):active:focus,.show>.btn-500.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5)}.btn-600{color:#fff;background-color:#656566;border-color:#656566;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-600:hover{color:#fff;background-color:#525253;border-color:#4c4c4c}.btn-600.focus,.btn-600:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(101,101,102,.5)}.btn-600.disabled,.btn-600:disabled{color:#fff;background-color:#656566;border-color:#656566}.btn-600:not(:disabled):not(.disabled).active,.btn-600:not(:disabled):not(.disabled):active,.show>.btn-600.dropdown-toggle{color:#fff;background-color:#4c4c4c;border-color:#454546}.btn-600:not(:disabled):not(.disabled).active:focus,.btn-600:not(:disabled):not(.disabled):active:focus,.show>.btn-600.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5)}.btn-700{color:#fff;background-color:#4c4c4d;border-color:#4c4c4d;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-700:hover{color:#fff;background-color:#393939;border-color:#323233}.btn-700.focus,.btn-700:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(76,76,77,.5)}.btn-700.disabled,.btn-700:disabled{color:#fff;background-color:#4c4c4d;border-color:#4c4c4d}.btn-700:not(:disabled):not(.disabled).active,.btn-700:not(:disabled):not(.disabled):active,.show>.btn-700.dropdown-toggle{color:#fff;background-color:#323233;border-color:#2c2c2c}.btn-700:not(:disabled):not(.disabled).active:focus,.btn-700:not(:disabled):not(.disabled):active:focus,.show>.btn-700.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5)}.btn-800{color:#fff;background-color:#323333;border-color:#323333;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-800:hover{color:#fff;background-color:#1f2020;border-color:#191919}.btn-800.focus,.btn-800:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(50,51,51,.5)}.btn-800.disabled,.btn-800:disabled{color:#fff;background-color:#323333;border-color:#323333}.btn-800:not(:disabled):not(.disabled).active,.btn-800:not(:disabled):not(.disabled):active,.show>.btn-800.dropdown-toggle{color:#fff;background-color:#191919;border-color:#131313}.btn-800:not(:disabled):not(.disabled).active:focus,.btn-800:not(:disabled):not(.disabled):active:focus,.show>.btn-800.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5)}.btn-900{color:#fff;background-color:#19191a;border-color:#19191a;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075)}.btn-900:hover{color:#fff;background-color:#060606;border-color:#000}.btn-900.focus,.btn-900:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(25,25,26,.5)}.btn-900.disabled,.btn-900:disabled{color:#fff;background-color:#19191a;border-color:#19191a}.btn-900:not(:disabled):not(.disabled).active,.btn-900:not(:disabled):not(.disabled):active,.show>.btn-900.dropdown-toggle{color:#fff;background-color:#000;border-color:#000}.btn-900:not(:disabled):not(.disabled).active:focus,.btn-900:not(:disabled):not(.disabled):active:focus,.show>.btn-900.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5)}.btn-outline-primary{color:#0073e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #0073e6;box-shadow:inset 0 0 0 1px #0073e6}.btn-outline-primary:hover{color:#0959aa;-webkit-box-shadow:inset 0 0 0 1px #0959aa;box-shadow:inset 0 0 0 1px #0959aa}.btn-outline-primary.focus,.btn-outline-primary:focus{-webkit-box-shadow:inset 0 0 0 1px #0073e6,0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 0 0 1px #0073e6,0 0 0 .2rem rgba(0,115,230,.5)}.btn-outline-primary.disabled,.btn-outline-primary:disabled{color:#0073e6;background-color:transparent}.btn-outline-primary:not(:disabled):not(.disabled).active,.btn-outline-primary:not(:disabled):not(.disabled):active,.show>.btn-outline-primary.dropdown-toggle{color:#0073e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #0073e6;box-shadow:inset 0 0 0 1px #0073e6}.btn-outline-primary:not(:disabled):not(.disabled).active:focus,.btn-outline-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5)}.btn-outline-secondary{color:#5c6f82;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #5c6f82;box-shadow:inset 0 0 0 1px #5c6f82}.btn-outline-secondary:hover{color:#50565c;-webkit-box-shadow:inset 0 0 0 1px #50565c;box-shadow:inset 0 0 0 1px #50565c}.btn-outline-secondary.focus,.btn-outline-secondary:focus{-webkit-box-shadow:inset 0 0 0 1px #5c6f82,0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 0 0 1px #5c6f82,0 0 0 .2rem rgba(92,111,130,.5)}.btn-outline-secondary.disabled,.btn-outline-secondary:disabled{color:#5c6f82;background-color:transparent}.btn-outline-secondary:not(:disabled):not(.disabled).active,.btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.btn-outline-secondary.dropdown-toggle{color:#5c6f82;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #5c6f82;box-shadow:inset 0 0 0 1px #5c6f82}.btn-outline-secondary:not(:disabled):not(.disabled).active:focus,.btn-outline-secondary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(92,111,130,.5)}.btn-outline-success{color:#00cc85;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #00cc85;box-shadow:inset 0 0 0 1px #00cc85}.btn-outline-success:hover{color:#089161;-webkit-box-shadow:inset 0 0 0 1px #089161;box-shadow:inset 0 0 0 1px #089161}.btn-outline-success.focus,.btn-outline-success:focus{-webkit-box-shadow:inset 0 0 0 1px #00cc85,0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 0 0 1px #00cc85,0 0 0 .2rem rgba(0,204,133,.5)}.btn-outline-success.disabled,.btn-outline-success:disabled{color:#00cc85;background-color:transparent}.btn-outline-success:not(:disabled):not(.disabled).active,.btn-outline-success:not(:disabled):not(.disabled):active,.show>.btn-outline-success.dropdown-toggle{color:#00cc85;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #00cc85;box-shadow:inset 0 0 0 1px #00cc85}.btn-outline-success:not(:disabled):not(.disabled).active:focus,.btn-outline-success:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-success.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,204,133,.5)}.btn-outline-info{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-info:hover{color:#7f7f7f;-webkit-box-shadow:inset 0 0 0 1px #7f7f7f;box-shadow:inset 0 0 0 1px #7f7f7f}.btn-outline-info.focus,.btn-outline-info:focus{-webkit-box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-info.disabled,.btn-outline-info:disabled{color:#979899;background-color:transparent}.btn-outline-info:not(:disabled):not(.disabled).active,.btn-outline-info:not(:disabled):not(.disabled):active,.show>.btn-outline-info.dropdown-toggle{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-info:not(:disabled):not(.disabled).active:focus,.btn-outline-info:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-info.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-warning{color:#f90;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f90;box-shadow:inset 0 0 0 1px #f90}.btn-outline-warning:hover{color:#c2780a;-webkit-box-shadow:inset 0 0 0 1px #c2780a;box-shadow:inset 0 0 0 1px #c2780a}.btn-outline-warning.focus,.btn-outline-warning:focus{-webkit-box-shadow:inset 0 0 0 1px #f90,0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 0 0 1px #f90,0 0 0 .2rem rgba(255,153,0,.5)}.btn-outline-warning.disabled,.btn-outline-warning:disabled{color:#f90;background-color:transparent}.btn-outline-warning:not(:disabled):not(.disabled).active,.btn-outline-warning:not(:disabled):not(.disabled):active,.show>.btn-outline-warning.dropdown-toggle{color:#f90;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f90;box-shadow:inset 0 0 0 1px #f90}.btn-outline-warning:not(:disabled):not(.disabled).active:focus,.btn-outline-warning:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-warning.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(255,153,0,.5)}.btn-outline-danger{color:#f73e5a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f73e5a;box-shadow:inset 0 0 0 1px #f73e5a}.btn-outline-danger:hover{color:#e91938;-webkit-box-shadow:inset 0 0 0 1px #e91938;box-shadow:inset 0 0 0 1px #e91938}.btn-outline-danger.focus,.btn-outline-danger:focus{-webkit-box-shadow:inset 0 0 0 1px #f73e5a,0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 0 0 1px #f73e5a,0 0 0 .2rem rgba(247,62,90,.5)}.btn-outline-danger.disabled,.btn-outline-danger:disabled{color:#f73e5a;background-color:transparent}.btn-outline-danger:not(:disabled):not(.disabled).active,.btn-outline-danger:not(:disabled):not(.disabled):active,.show>.btn-outline-danger.dropdown-toggle{color:#f73e5a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #f73e5a;box-shadow:inset 0 0 0 1px #f73e5a}.btn-outline-danger:not(:disabled):not(.disabled).active:focus,.btn-outline-danger:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-danger.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(247,62,90,.5)}.btn-outline-light{color:#e9e6f2;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e9e6f2;box-shadow:inset 0 0 0 1px #e9e6f2}.btn-outline-light:hover{color:#cec9dd;-webkit-box-shadow:inset 0 0 0 1px #cec9dd;box-shadow:inset 0 0 0 1px #cec9dd}.btn-outline-light.focus,.btn-outline-light:focus{-webkit-box-shadow:inset 0 0 0 1px #e9e6f2,0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 0 0 1px #e9e6f2,0 0 0 .2rem rgba(233,230,242,.5)}.btn-outline-light.disabled,.btn-outline-light:disabled{color:#e9e6f2;background-color:transparent}.btn-outline-light:not(:disabled):not(.disabled).active,.btn-outline-light:not(:disabled):not(.disabled):active,.show>.btn-outline-light.dropdown-toggle{color:#e9e6f2;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e9e6f2;box-shadow:inset 0 0 0 1px #e9e6f2}.btn-outline-light:not(:disabled):not(.disabled).active:focus,.btn-outline-light:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-light.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(233,230,242,.5)}.btn-outline-dark{color:#17324d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #17324d;box-shadow:inset 0 0 0 1px #17324d}.btn-outline-dark:hover{color:#0e1823;-webkit-box-shadow:inset 0 0 0 1px #0e1823;box-shadow:inset 0 0 0 1px #0e1823}.btn-outline-dark.focus,.btn-outline-dark:focus{-webkit-box-shadow:inset 0 0 0 1px #17324d,0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 0 0 1px #17324d,0 0 0 .2rem rgba(23,50,77,.5)}.btn-outline-dark.disabled,.btn-outline-dark:disabled{color:#17324d;background-color:transparent}.btn-outline-dark:not(:disabled):not(.disabled).active,.btn-outline-dark:not(:disabled):not(.disabled):active,.show>.btn-outline-dark.dropdown-toggle{color:#17324d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #17324d;box-shadow:inset 0 0 0 1px #17324d}.btn-outline-dark:not(:disabled):not(.disabled).active:focus,.btn-outline-dark:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-dark.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(23,50,77,.5)}.btn-outline-100{color:#e3e4e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e3e4e6;box-shadow:inset 0 0 0 1px #e3e4e6}.btn-outline-100:hover{color:#cbcbcb;-webkit-box-shadow:inset 0 0 0 1px #cbcbcb;box-shadow:inset 0 0 0 1px #cbcbcb}.btn-outline-100.focus,.btn-outline-100:focus{-webkit-box-shadow:inset 0 0 0 1px #e3e4e6,0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 0 0 1px #e3e4e6,0 0 0 .2rem rgba(227,228,230,.5)}.btn-outline-100.disabled,.btn-outline-100:disabled{color:#e3e4e6;background-color:transparent}.btn-outline-100:not(:disabled):not(.disabled).active,.btn-outline-100:not(:disabled):not(.disabled):active,.show>.btn-outline-100.dropdown-toggle{color:#e3e4e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e3e4e6;box-shadow:inset 0 0 0 1px #e3e4e6}.btn-outline-100:not(:disabled):not(.disabled).active:focus,.btn-outline-100:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-100.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(227,228,230,.5)}.btn-outline-200{color:#cacacc;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #cacacc;box-shadow:inset 0 0 0 1px #cacacc}.btn-outline-200:hover{color:#b1b1b1;-webkit-box-shadow:inset 0 0 0 1px #b1b1b1;box-shadow:inset 0 0 0 1px #b1b1b1}.btn-outline-200.focus,.btn-outline-200:focus{-webkit-box-shadow:inset 0 0 0 1px #cacacc,0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 0 0 1px #cacacc,0 0 0 .2rem rgba(202,202,204,.5)}.btn-outline-200.disabled,.btn-outline-200:disabled{color:#cacacc;background-color:transparent}.btn-outline-200:not(:disabled):not(.disabled).active,.btn-outline-200:not(:disabled):not(.disabled):active,.show>.btn-outline-200.dropdown-toggle{color:#cacacc;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #cacacc;box-shadow:inset 0 0 0 1px #cacacc}.btn-outline-200:not(:disabled):not(.disabled).active:focus,.btn-outline-200:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-200.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(202,202,204,.5)}.btn-outline-300{color:#b1b1b3;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #b1b1b3;box-shadow:inset 0 0 0 1px #b1b1b3}.btn-outline-300:hover{color:#989898;-webkit-box-shadow:inset 0 0 0 1px #989898;box-shadow:inset 0 0 0 1px #989898}.btn-outline-300.focus,.btn-outline-300:focus{-webkit-box-shadow:inset 0 0 0 1px #b1b1b3,0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 0 0 1px #b1b1b3,0 0 0 .2rem rgba(177,177,179,.5)}.btn-outline-300.disabled,.btn-outline-300:disabled{color:#b1b1b3;background-color:transparent}.btn-outline-300:not(:disabled):not(.disabled).active,.btn-outline-300:not(:disabled):not(.disabled):active,.show>.btn-outline-300.dropdown-toggle{color:#b1b1b3;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #b1b1b3;box-shadow:inset 0 0 0 1px #b1b1b3}.btn-outline-300:not(:disabled):not(.disabled).active:focus,.btn-outline-300:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-300.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(177,177,179,.5)}.btn-outline-400{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-400:hover{color:#7f7f7f;-webkit-box-shadow:inset 0 0 0 1px #7f7f7f;box-shadow:inset 0 0 0 1px #7f7f7f}.btn-outline-400.focus,.btn-outline-400:focus{-webkit-box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 0 0 1px #979899,0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-400.disabled,.btn-outline-400:disabled{color:#979899;background-color:transparent}.btn-outline-400:not(:disabled):not(.disabled).active,.btn-outline-400:not(:disabled):not(.disabled):active,.show>.btn-outline-400.dropdown-toggle{color:#979899;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #979899;box-shadow:inset 0 0 0 1px #979899}.btn-outline-400:not(:disabled):not(.disabled).active:focus,.btn-outline-400:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-400.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(151,152,153,.5)}.btn-outline-500{color:#7e7f80;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #7e7f80;box-shadow:inset 0 0 0 1px #7e7f80}.btn-outline-500:hover{color:#656565;-webkit-box-shadow:inset 0 0 0 1px #656565;box-shadow:inset 0 0 0 1px #656565}.btn-outline-500.focus,.btn-outline-500:focus{-webkit-box-shadow:inset 0 0 0 1px #7e7f80,0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 0 0 1px #7e7f80,0 0 0 .2rem rgba(126,127,128,.5)}.btn-outline-500.disabled,.btn-outline-500:disabled{color:#7e7f80;background-color:transparent}.btn-outline-500:not(:disabled):not(.disabled).active,.btn-outline-500:not(:disabled):not(.disabled):active,.show>.btn-outline-500.dropdown-toggle{color:#7e7f80;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #7e7f80;box-shadow:inset 0 0 0 1px #7e7f80}.btn-outline-500:not(:disabled):not(.disabled).active:focus,.btn-outline-500:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-500.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(126,127,128,.5)}.btn-outline-600{color:#656566;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #656566;box-shadow:inset 0 0 0 1px #656566}.btn-outline-600:hover{color:#4c4c4c;-webkit-box-shadow:inset 0 0 0 1px #4c4c4c;box-shadow:inset 0 0 0 1px #4c4c4c}.btn-outline-600.focus,.btn-outline-600:focus{-webkit-box-shadow:inset 0 0 0 1px #656566,0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 0 0 1px #656566,0 0 0 .2rem rgba(101,101,102,.5)}.btn-outline-600.disabled,.btn-outline-600:disabled{color:#656566;background-color:transparent}.btn-outline-600:not(:disabled):not(.disabled).active,.btn-outline-600:not(:disabled):not(.disabled):active,.show>.btn-outline-600.dropdown-toggle{color:#656566;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #656566;box-shadow:inset 0 0 0 1px #656566}.btn-outline-600:not(:disabled):not(.disabled).active:focus,.btn-outline-600:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-600.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(101,101,102,.5)}.btn-outline-700{color:#4c4c4d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #4c4c4d;box-shadow:inset 0 0 0 1px #4c4c4d}.btn-outline-700:hover{color:#333;-webkit-box-shadow:inset 0 0 0 1px #333;box-shadow:inset 0 0 0 1px #333}.btn-outline-700.focus,.btn-outline-700:focus{-webkit-box-shadow:inset 0 0 0 1px #4c4c4d,0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 0 0 1px #4c4c4d,0 0 0 .2rem rgba(76,76,77,.5)}.btn-outline-700.disabled,.btn-outline-700:disabled{color:#4c4c4d;background-color:transparent}.btn-outline-700:not(:disabled):not(.disabled).active,.btn-outline-700:not(:disabled):not(.disabled):active,.show>.btn-outline-700.dropdown-toggle{color:#4c4c4d;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #4c4c4d;box-shadow:inset 0 0 0 1px #4c4c4d}.btn-outline-700:not(:disabled):not(.disabled).active:focus,.btn-outline-700:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-700.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(76,76,77,.5)}.btn-outline-800{color:#323333;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #323333;box-shadow:inset 0 0 0 1px #323333}.btn-outline-800:hover{color:#191919;-webkit-box-shadow:inset 0 0 0 1px #191919;box-shadow:inset 0 0 0 1px #191919}.btn-outline-800.focus,.btn-outline-800:focus{-webkit-box-shadow:inset 0 0 0 1px #323333,0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 0 0 1px #323333,0 0 0 .2rem rgba(50,51,51,.5)}.btn-outline-800.disabled,.btn-outline-800:disabled{color:#323333;background-color:transparent}.btn-outline-800:not(:disabled):not(.disabled).active,.btn-outline-800:not(:disabled):not(.disabled):active,.show>.btn-outline-800.dropdown-toggle{color:#323333;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #323333;box-shadow:inset 0 0 0 1px #323333}.btn-outline-800:not(:disabled):not(.disabled).active:focus,.btn-outline-800:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-800.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(50,51,51,.5)}.btn-outline-900{color:#19191a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #19191a;box-shadow:inset 0 0 0 1px #19191a}.btn-outline-900:hover{color:#000;-webkit-box-shadow:inset 0 0 0 1px #000;box-shadow:inset 0 0 0 1px #000}.btn-outline-900.focus,.btn-outline-900:focus{-webkit-box-shadow:inset 0 0 0 1px #19191a,0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 0 0 1px #19191a,0 0 0 .2rem rgba(25,25,26,.5)}.btn-outline-900.disabled,.btn-outline-900:disabled{color:#19191a;background-color:transparent}.btn-outline-900:not(:disabled):not(.disabled).active,.btn-outline-900:not(:disabled):not(.disabled):active,.show>.btn-outline-900.dropdown-toggle{color:#19191a;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #19191a;box-shadow:inset 0 0 0 1px #19191a}.btn-outline-900:not(:disabled):not(.disabled).active:focus,.btn-outline-900:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-900.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(25,25,26,.5)}.btn-link{font-weight:400;color:#0073e6;text-decoration:none}.btn-link:hover{color:#004d99;text-decoration:underline}.btn-link.focus,.btn-link:focus{text-decoration:underline;-webkit-box-shadow:none;box-shadow:none}.btn-link.disabled,.btn-link:disabled{color:#656566;pointer-events:none}.btn-group-lg>.btn,.btn-lg{padding:.5rem 1rem;font-size:1.125rem;border-radius:8px}.btn-group-sm>.btn,.btn-sm{padding:.25rem .5rem;font-size:.875rem;border-radius:2px}.btn-block{display:block;width:100%}.btn-block+.btn-block{margin-top:.5rem}input[type=button].btn-block,input[type=reset].btn-block,input[type=submit].btn-block{width:100%}.fade{-webkit-transition:opacity .15s linear;transition:opacity .15s linear}@media (prefers-reduced-motion:reduce){.fade{-webkit-transition:none;transition:none}}.fade:not(.show){opacity:0}.collapse:not(.show){display:none}.collapsing{position:relative;height:0;overflow:hidden;-webkit-transition:height .35s ease;transition:height .35s ease}@media (prefers-reduced-motion:reduce){.collapsing{-webkit-transition:none;transition:none}}.dropdown,.dropleft,.dropright,.dropup{position:relative}.dropdown-toggle{white-space:nowrap}.dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid;border-right:.3em solid transparent;border-bottom:0;border-left:.3em solid transparent}.dropdown-toggle:empty:after{margin-left:0}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;display:none;float:left;min-width:160px;min-width:10rem;padding:.5rem 0;margin:.125rem 0 0;font-size:16px;font-size:1rem;color:#19191a;text-align:left;list-style:none;background-clip:padding-box;border:0 solid transparent;border-radius:4px;-webkit-box-shadow:0 0 30px 5px rgba(0,0,0,.05);box-shadow:0 0 30px 5px rgba(0,0,0,.05)}.dropdown-menu-left{right:auto;left:0}.dropdown-menu-right{right:0;left:auto}@media (min-width:576px){.dropdown-menu-sm-left{right:auto;left:0}.dropdown-menu-sm-right{right:0;left:auto}}@media (min-width:768px){.dropdown-menu-md-left{right:auto;left:0}.dropdown-menu-md-right{right:0;left:auto}}@media (min-width:992px){.dropdown-menu-lg-left{right:auto;left:0}.dropdown-menu-lg-right{right:0;left:auto}}@media (min-width:1200px){.dropdown-menu-xl-left{right:auto;left:0}.dropdown-menu-xl-right{right:0;left:auto}}.dropup .dropdown-menu{top:auto;bottom:100%;margin-top:0;margin-bottom:.125rem}.dropup .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:0;border-right:.3em solid transparent;border-bottom:.3em solid;border-left:.3em solid transparent}.dropup .dropdown-toggle:empty:after{margin-left:0}.dropright .dropdown-menu{top:0;right:auto;left:100%;margin-top:0;margin-left:.125rem}.dropright .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:0;border-bottom:.3em solid transparent;border-left:.3em solid}.dropright .dropdown-toggle:empty:after{margin-left:0}.dropright .dropdown-toggle:after{vertical-align:0}.dropleft .dropdown-menu{top:0;right:100%;left:auto;margin-top:0;margin-right:.125rem}.dropleft .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";display:none}.dropleft .dropdown-toggle:before{display:inline-block;margin-right:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:.3em solid;border-bottom:.3em solid transparent}.dropleft .dropdown-toggle:empty:after{margin-left:0}.dropleft .dropdown-toggle:before{vertical-align:0}.dropdown-divider{height:0;margin:8px 0;overflow:hidden;border-top:1px solid #cacacc}.dropdown-item{display:block;width:100%;padding:12px 24px;clear:both;font-weight:400;color:#17324d;text-align:inherit;white-space:nowrap;background-color:transparent;border:0}.dropdown-item:focus,.dropdown-item:hover{color:#17324d;text-decoration:none;background-color:#e6ecf2}.dropdown-item.active,.dropdown-item:active{color:#fff;text-decoration:none;background-color:#0073e6}.dropdown-item.disabled,.dropdown-item:disabled{color:#656566;pointer-events:none;background-color:transparent}.dropdown-menu.show{display:block}.dropdown-header{display:block;padding:.5rem 24px;margin-bottom:0;font-size:14px;font-size:.875rem;color:#17324d;white-space:nowrap}.dropdown-item-text{display:block;padding:12px 24px;color:#17324d}.btn-group,.btn-group-vertical{position:relative;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;vertical-align:middle}.btn-group-vertical>.btn,.btn-group>.btn{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto}.btn-group-vertical>.btn.active,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:hover,.btn-group>.btn.active,.btn-group>.btn:active,.btn-group>.btn:focus,.btn-group>.btn:hover{z-index:1}.btn-toolbar{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.btn-toolbar .input-group{width:auto}.btn-group>.btn-group:not(:first-child),.btn-group>.btn:not(:first-child){margin-left:0}.btn-group>.btn-group:not(:last-child)>.btn,.btn-group>.btn:not(:last-child):not(.dropdown-toggle){border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn-group:not(:first-child)>.btn,.btn-group>.btn:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.dropdown-toggle-split{padding-right:.5625rem;padding-left:.5625rem}.dropdown-toggle-split:after,.dropright .dropdown-toggle-split:after,.dropup .dropdown-toggle-split:after{margin-left:0}.dropleft .dropdown-toggle-split:before{margin-right:0}.btn-group-sm>.btn+.dropdown-toggle-split,.btn-sm+.dropdown-toggle-split{padding-right:.375rem;padding-left:.375rem}.btn-group-lg>.btn+.dropdown-toggle-split,.btn-lg+.dropdown-toggle-split{padding-right:.75rem;padding-left:.75rem}.btn-group.show .dropdown-toggle{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125);box-shadow:inset 0 3px 5px rgba(0,0,0,.125)}.btn-group.show .dropdown-toggle.btn-link{-webkit-box-shadow:none;box-shadow:none}.btn-group-vertical{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group{width:100%}.btn-group-vertical>.btn-group:not(:first-child),.btn-group-vertical>.btn:not(:first-child){margin-top:0}.btn-group-vertical>.btn-group:not(:last-child)>.btn,.btn-group-vertical>.btn:not(:last-child):not(.dropdown-toggle){border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn-group:not(:first-child)>.btn,.btn-group-vertical>.btn:not(:first-child){border-top-left-radius:0;border-top-right-radius:0}.btn-group-toggle>.btn,.btn-group-toggle>.btn-group>.btn{margin-bottom:0}.btn-group-toggle>.btn-group>.btn input[type=checkbox],.btn-group-toggle>.btn-group>.btn input[type=radio],.btn-group-toggle>.btn input[type=checkbox],.btn-group-toggle>.btn input[type=radio]{position:absolute;clip:rect(0,0,0,0);pointer-events:none}.input-group{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:stretch;-ms-flex-align:stretch;align-items:stretch;width:100%}.input-group>.custom-file,.input-group>.custom-select,.input-group>.form-control,.input-group>.form-control-plaintext{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;width:1%;margin-bottom:0}.input-group>.custom-file+.custom-file,.input-group>.custom-file+.custom-select,.input-group>.custom-file+.form-control,.input-group>.custom-select+.custom-file,.input-group>.custom-select+.custom-select,.input-group>.custom-select+.form-control,.input-group>.form-control+.custom-file,.input-group>.form-control+.custom-select,.input-group>.form-control+.form-control,.input-group>.form-control-plaintext+.custom-file,.input-group>.form-control-plaintext+.custom-select,.input-group>.form-control-plaintext+.form-control{margin-left:-1px}.input-group>.custom-file .custom-file-input:focus~.custom-file-label,.input-group>.custom-select:focus,.input-group>.form-control:focus{z-index:3}.input-group>.custom-file .custom-file-input:focus{z-index:4}.input-group>.custom-select:not(:last-child),.input-group>.form-control:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-select:not(:first-child),.input-group>.form-control:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.input-group>.custom-file{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.input-group>.custom-file:not(:last-child) .custom-file-label,.input-group>.custom-file:not(:last-child) .custom-file-label:after{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-file:not(:first-child) .custom-file-label{border-top-left-radius:0;border-bottom-left-radius:0}.input-group-append,.input-group-prepend{display:-webkit-box;display:-ms-flexbox;display:flex}.input-group-append .btn,.input-group-prepend .btn{position:relative;z-index:2}.input-group-append .btn:focus,.input-group-prepend .btn:focus{z-index:3}.input-group-append .btn+.btn,.input-group-append .btn+.input-group-text,.input-group-append .input-group-text+.btn,.input-group-append .input-group-text+.input-group-text,.input-group-prepend .btn+.btn,.input-group-prepend .btn+.input-group-text,.input-group-prepend .input-group-text+.btn,.input-group-prepend .input-group-text+.input-group-text{margin-left:-1px}.input-group-prepend{margin-right:-1px}.input-group-append{margin-left:-1px}.input-group-text{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding:.375rem .75rem;margin-bottom:0;font-size:16px;font-size:1rem;font-weight:400;line-height:1.5;color:#4c4c4d;text-align:center;white-space:nowrap;background-color:#cacacc;border:1px solid #979899;border-radius:4px}.input-group-text input[type=checkbox],.input-group-text input[type=radio]{margin-top:0}.input-group-lg>.custom-select,.input-group-lg>.form-control:not(textarea){height:calc(1.556em + 1rem + 2px)}.input-group-lg>.custom-select,.input-group-lg>.form-control,.input-group-lg>.input-group-append>.btn,.input-group-lg>.input-group-append>.input-group-text,.input-group-lg>.input-group-prepend>.btn,.input-group-lg>.input-group-prepend>.input-group-text{padding:.5rem 1rem;font-size:20px;font-size:1.25rem;line-height:1.556;border-radius:8px}.input-group-sm>.custom-select,.input-group-sm>.form-control:not(textarea){height:calc(1.428em + .5rem + 2px)}.input-group-sm>.custom-select,.input-group-sm>.form-control,.input-group-sm>.input-group-append>.btn,.input-group-sm>.input-group-append>.input-group-text,.input-group-sm>.input-group-prepend>.btn,.input-group-sm>.input-group-prepend>.input-group-text{padding:.25rem .5rem;font-size:14px;font-size:.875rem;line-height:1.428;border-radius:2px}.input-group-lg>.custom-select,.input-group-sm>.custom-select{padding-right:1.75rem}.input-group>.input-group-append:last-child>.btn:not(:last-child):not(.dropdown-toggle),.input-group>.input-group-append:last-child>.input-group-text:not(:last-child),.input-group>.input-group-append:not(:last-child)>.btn,.input-group>.input-group-append:not(:last-child)>.input-group-text,.input-group>.input-group-prepend>.btn,.input-group>.input-group-prepend>.input-group-text{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.input-group-append>.btn,.input-group>.input-group-append>.input-group-text,.input-group>.input-group-prepend:first-child>.btn:not(:first-child),.input-group>.input-group-prepend:first-child>.input-group-text:not(:first-child),.input-group>.input-group-prepend:not(:first-child)>.btn,.input-group>.input-group-prepend:not(:first-child)>.input-group-text{border-top-left-radius:0;border-bottom-left-radius:0}.nav{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.nav-link{display:block;padding:.5rem 1rem}.nav-link:focus,.nav-link:hover{text-decoration:none}.nav-link.disabled{color:#656566;pointer-events:none;cursor:default}.nav-tabs{border-bottom:1px solid #b1b1b3}.nav-tabs .nav-item{margin-bottom:-1px}.nav-tabs .nav-link{border:1px solid transparent;border-top-left-radius:4px;border-top-right-radius:4px}.nav-tabs .nav-link:focus,.nav-tabs .nav-link:hover{border-color:#cacacc #cacacc #b1b1b3}.nav-tabs .nav-link.disabled{color:#656566;background-color:transparent;border-color:transparent}.nav-tabs .nav-item.show .nav-link,.nav-tabs .nav-link.active{color:#4c4c4d;background-color:#fff;border-color:#b1b1b3 #b1b1b3 #fff}.nav-tabs .dropdown-menu{margin-top:-1px;border-top-left-radius:0;border-top-right-radius:0}.nav-pills .nav-link{border-radius:4px}.nav-pills .nav-link.active,.nav-pills .show>.nav-link{color:#fff;background-color:#0073e6}.nav-fill .nav-item{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;text-align:center}.nav-justified .nav-item{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;text-align:center}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.navbar{position:relative;padding:8px 16px}.navbar,.navbar>.container,.navbar>.container-fluid{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.navbar-brand{display:inline-block;padding-top:.5rem;padding-bottom:.5rem;margin-right:16px;font-size:16px;font-size:1rem;line-height:inherit;white-space:nowrap}.navbar-brand:focus,.navbar-brand:hover{text-decoration:none}.navbar-nav{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;padding-left:0;margin-bottom:0;list-style:none}.navbar-nav .nav-link{padding-right:0;padding-left:0}.navbar-nav .dropdown-menu{position:static;float:none}.navbar-text{display:inline-block;padding-top:.5rem;padding-bottom:.5rem}.navbar-collapse{-ms-flex-preferred-size:100%;flex-basis:100%;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.navbar-toggler{padding:.25rem .75rem;font-size:20px;font-size:1.25rem;line-height:1;background-color:transparent;border:1px solid transparent;border-radius:0}.navbar-toggler:focus,.navbar-toggler:hover{text-decoration:none}.navbar-toggler-icon{display:inline-block;width:1.5em;height:1.5em;vertical-align:middle;content:"";background:no-repeat 50%;background-size:100% 100%}@media (max-width:575.98px){.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:576px){.navbar-expand-sm{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-sm,.navbar-expand-sm .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-sm .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-sm .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-sm .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-sm .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-sm .navbar-toggler{display:none}}@media (max-width:767.98px){.navbar-expand-md>.container,.navbar-expand-md>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:768px){.navbar-expand-md{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-md,.navbar-expand-md .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-md .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-md .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-md .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-md>.container,.navbar-expand-md>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-md .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-md .navbar-toggler{display:none}}@media (max-width:991.98px){.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:992px){.navbar-expand-lg{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-lg,.navbar-expand-lg .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-lg .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-lg .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-lg .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-lg .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-lg .navbar-toggler{display:none}}@media (max-width:1199.98px){.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:1200px){.navbar-expand-xl{-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-xl,.navbar-expand-xl .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal}.navbar-expand-xl .navbar-nav{-ms-flex-direction:row;flex-direction:row}.navbar-expand-xl .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-xl .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-xl .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-xl .navbar-toggler{display:none}}.navbar-expand{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand>.container,.navbar-expand>.container-fluid{padding-right:0;padding-left:0}.navbar-expand .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand .navbar-nav .dropdown-menu{position:absolute}.navbar-expand .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand>.container,.navbar-expand>.container-fluid{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand .navbar-collapse{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand .navbar-toggler{display:none}.navbar-light .navbar-brand,.navbar-light .navbar-brand:focus,.navbar-light .navbar-brand:hover{color:rgba(0,0,0,.9)}.navbar-light .navbar-nav .nav-link{color:rgba(0,0,0,.5)}.navbar-light .navbar-nav .nav-link:focus,.navbar-light .navbar-nav .nav-link:hover{color:rgba(0,0,0,.7)}.navbar-light .navbar-nav .nav-link.disabled{color:rgba(0,0,0,.3)}.navbar-light .navbar-nav .active>.nav-link,.navbar-light .navbar-nav .nav-link.active,.navbar-light .navbar-nav .nav-link.show,.navbar-light .navbar-nav .show>.nav-link{color:rgba(0,0,0,.9)}.navbar-light .navbar-toggler{color:rgba(0,0,0,.5);border-color:rgba(0,0,0,.1)}.navbar-light .navbar-toggler-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E")}.navbar-light .navbar-text{color:rgba(0,0,0,.5)}.navbar-light .navbar-text a,.navbar-light .navbar-text a:focus,.navbar-light .navbar-text a:hover{color:rgba(0,0,0,.9)}.navbar-dark .navbar-brand,.navbar-dark .navbar-brand:focus,.navbar-dark .navbar-brand:hover{color:#fff}.navbar-dark .navbar-nav .nav-link{color:hsla(0,0%,100%,.5)}.navbar-dark .navbar-nav .nav-link:focus,.navbar-dark .navbar-nav .nav-link:hover{color:hsla(0,0%,100%,.75)}.navbar-dark .navbar-nav .nav-link.disabled{color:hsla(0,0%,100%,.25)}.navbar-dark .navbar-nav .active>.nav-link,.navbar-dark .navbar-nav .nav-link.active,.navbar-dark .navbar-nav .nav-link.show,.navbar-dark .navbar-nav .show>.nav-link{color:#fff}.navbar-dark .navbar-toggler{color:hsla(0,0%,100%,.5);border-color:transparent}.navbar-dark .navbar-toggler-icon{background-image:url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkuMiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDEyIDEwIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxwYXRoIGQ9Ik0wIDRoMTJ2MkgwVjR6bTAtNGg4djJIMFYwem0wIDhoOHYySDBWOHoiIGZpbGw9IiNGRkYiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvc3ZnPg==)}.navbar-dark .navbar-text{color:hsla(0,0%,100%,.5)}.navbar-dark .navbar-text a,.navbar-dark .navbar-text a:focus,.navbar-dark .navbar-text a:hover{color:#fff}.card{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;min-width:0;word-wrap:break-word;background-color:#fff;background-clip:border-box;border:1px solid rgba(0,0,0,.125);border-radius:0}.card>hr{margin-right:0;margin-left:0}.card>.list-group:first-child .list-group-item:first-child{border-top-left-radius:0;border-top-right-radius:0}.card>.list-group:last-child .list-group-item:last-child{border-bottom-right-radius:0;border-bottom-left-radius:0}.card-body{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;padding:2rem}.card-title{margin-bottom:1rem}.card-subtitle{margin-top:-.5rem}.card-subtitle,.card-text:last-child{margin-bottom:0}.card-link:hover{text-decoration:none}.card-link+.card-link{margin-left:2rem}.card-header{padding:1rem 2rem;margin-bottom:0;background-color:transparent;border-bottom:1px solid rgba(0,0,0,.125)}.card-header:first-child{border-radius:-1px -1px 0 0}.card-header+.list-group .list-group-item:first-child{border-top:0}.card-footer{padding:1rem 2rem;background-color:transparent;border-top:1px solid rgba(0,0,0,.125)}.card-footer:last-child{border-radius:0 0 -1px -1px}.card-header-tabs{margin-bottom:-1rem;border-bottom:0}.card-header-pills,.card-header-tabs{margin-right:-1rem;margin-left:-1rem}.card-img-overlay{position:absolute;top:0;right:0;bottom:0;left:0;padding:1.25rem}.card-img{width:100%;border-radius:-1px}.card-img-top{width:100%;border-top-left-radius:-1px;border-top-right-radius:-1px}.card-img-bottom{width:100%;border-bottom-right-radius:-1px;border-bottom-left-radius:-1px}.card-deck{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.card-deck .card{margin-bottom:6px}@media (min-width:576px){.card-deck{-webkit-box-orient:horizontal;-ms-flex-flow:row wrap;flex-flow:row wrap;margin-right:-6px;margin-left:-6px}.card-deck,.card-deck .card{-webkit-box-direction:normal}.card-deck .card{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-flex:1;-ms-flex:1 0 0%;flex:1 0 0%;-webkit-box-orient:vertical;-ms-flex-direction:column;flex-direction:column;margin-right:6px;margin-bottom:0;margin-left:6px}}.card-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.card-group>.card{margin-bottom:6px}@media (min-width:576px){.card-group{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap}.card-group>.card{-webkit-box-flex:1;-ms-flex:1 0 0%;flex:1 0 0%;margin-bottom:0}.card-group>.card+.card{margin-left:0;border-left:0}.card-group>.card:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.card-group>.card:not(:last-child) .card-header,.card-group>.card:not(:last-child) .card-img-top{border-top-right-radius:0}.card-group>.card:not(:last-child) .card-footer,.card-group>.card:not(:last-child) .card-img-bottom{border-bottom-right-radius:0}.card-group>.card:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.card-group>.card:not(:first-child) .card-header,.card-group>.card:not(:first-child) .card-img-top{border-top-left-radius:0}.card-group>.card:not(:first-child) .card-footer,.card-group>.card:not(:first-child) .card-img-bottom{border-bottom-left-radius:0}}.card-columns .card{margin-bottom:1rem}@media (min-width:576px){.card-columns{-webkit-column-count:3;-moz-column-count:3;column-count:3;-webkit-column-gap:1.25rem;-moz-column-gap:1.25rem;column-gap:1.25rem;orphans:1;widows:1}.card-columns .card{display:inline-block;width:100%}}.accordion>.card{overflow:hidden}.accordion>.card:not(:first-of-type) .card-header:first-child{border-radius:0}.accordion>.card:not(:first-of-type):not(:last-of-type){border-bottom:0;border-radius:0}.accordion>.card:first-of-type{border-bottom:0;border-bottom-right-radius:0;border-bottom-left-radius:0}.accordion>.card:last-of-type{border-top-left-radius:0;border-top-right-radius:0}.accordion>.card .card-header{margin-bottom:-1px}.breadcrumb{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;padding:.75rem 1rem;margin-bottom:1rem;list-style:none;background-color:transparent;border-radius:0}.breadcrumb-item+.breadcrumb-item{padding-left:.5rem}.breadcrumb-item+.breadcrumb-item:before{display:inline-block;padding-right:.5rem;color:#656566;content:"/"}.breadcrumb-item+.breadcrumb-item:hover:before{text-decoration:underline;text-decoration:none}.breadcrumb-item.active{color:#656566}.pagination{display:-webkit-box;display:-ms-flexbox;display:flex;padding-left:0;list-style:none;border-radius:4px}.page-link{position:relative;display:block;padding:.5rem .75rem;margin-left:-1px;line-height:1.25;color:#0073e6;background-color:#fff;border:1px solid #b1b1b3}.page-link:hover{z-index:2;color:#004d99;text-decoration:none;background-color:#cacacc;border-color:#b1b1b3}.page-link:focus{z-index:2;outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.25);box-shadow:0 0 0 .2rem rgba(0,115,230,.25)}.page-item:first-child .page-link{margin-left:0;border-top-left-radius:4px;border-bottom-left-radius:4px}.page-item:last-child .page-link{border-top-right-radius:4px;border-bottom-right-radius:4px}.page-item.active .page-link{z-index:1;color:#fff;background-color:#0073e6;border-color:#0073e6}.page-item.disabled .page-link{color:#656566;pointer-events:none;cursor:auto;background-color:#fff;border-color:#b1b1b3}.pagination-lg .page-link{padding:.75rem 1.5rem;font-size:20px;font-size:1.25rem;line-height:1.5}.pagination-lg .page-item:first-child .page-link{border-top-left-radius:8px;border-bottom-left-radius:8px}.pagination-lg .page-item:last-child .page-link{border-top-right-radius:8px;border-bottom-right-radius:8px}.pagination-sm .page-link{padding:.25rem .5rem;font-size:14px;font-size:.875rem;line-height:1.5}.pagination-sm .page-item:first-child .page-link{border-top-left-radius:2px;border-bottom-left-radius:2px}.pagination-sm .page-item:last-child .page-link{border-top-right-radius:2px;border-bottom-right-radius:2px}.badge{display:inline-block;padding:.25em .4em;font-size:75%;font-weight:700;line-height:1;text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:4px;-webkit-transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,-webkit-box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.badge{-webkit-transition:none;transition:none}}a.badge:focus,a.badge:hover{text-decoration:none}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.badge-pill{padding-right:.6em;padding-left:.6em;border-radius:10rem}.badge-primary{color:#fff;background-color:#0073e6}a.badge-primary:focus,a.badge-primary:hover{color:#fff;background-color:#0059b3}a.badge-primary.focus,a.badge-primary:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,115,230,.5);box-shadow:0 0 0 .2rem rgba(0,115,230,.5)}.badge-secondary{color:#fff;background-color:#5c6f82}a.badge-secondary:focus,a.badge-secondary:hover{color:#fff;background-color:#475664}a.badge-secondary.focus,a.badge-secondary:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(92,111,130,.5);box-shadow:0 0 0 .2rem rgba(92,111,130,.5)}.badge-success{color:#19191a;background-color:#00cc85}a.badge-success:focus,a.badge-success:hover{color:#19191a;background-color:#009963}a.badge-success.focus,a.badge-success:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(0,204,133,.5);box-shadow:0 0 0 .2rem rgba(0,204,133,.5)}.badge-info{color:#19191a;background-color:#979899}a.badge-info:focus,a.badge-info:hover{color:#19191a;background-color:#7e7e80}a.badge-info.focus,a.badge-info:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(151,152,153,.5);box-shadow:0 0 0 .2rem rgba(151,152,153,.5)}.badge-warning{color:#19191a;background-color:#f90}a.badge-warning:focus,a.badge-warning:hover{color:#19191a;background-color:#cc7a00}a.badge-warning.focus,a.badge-warning:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(255,153,0,.5);box-shadow:0 0 0 .2rem rgba(255,153,0,.5)}.badge-danger{color:#19191a;background-color:#f73e5a}a.badge-danger:focus,a.badge-danger:hover{color:#19191a;background-color:#f50d30}a.badge-danger.focus,a.badge-danger:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(247,62,90,.5);box-shadow:0 0 0 .2rem rgba(247,62,90,.5)}.badge-light{color:#19191a;background-color:#e9e6f2}a.badge-light:focus,a.badge-light:hover{color:#19191a;background-color:#ccc4e1}a.badge-light.focus,a.badge-light:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(233,230,242,.5);box-shadow:0 0 0 .2rem rgba(233,230,242,.5)}.badge-dark{color:#fff;background-color:#17324d}a.badge-dark:focus,a.badge-dark:hover{color:#fff;background-color:#0b1825}a.badge-dark.focus,a.badge-dark:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(23,50,77,.5);box-shadow:0 0 0 .2rem rgba(23,50,77,.5)}.badge-100{color:#19191a;background-color:#e3e4e6}a.badge-100:focus,a.badge-100:hover{color:#19191a;background-color:#c9cacd}a.badge-100.focus,a.badge-100:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(227,228,230,.5);box-shadow:0 0 0 .2rem rgba(227,228,230,.5)}.badge-200{color:#19191a;background-color:#cacacc}a.badge-200:focus,a.badge-200:hover{color:#19191a;background-color:#b0b1b3}a.badge-200.focus,a.badge-200:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(202,202,204,.5);box-shadow:0 0 0 .2rem rgba(202,202,204,.5)}.badge-300{color:#19191a;background-color:#b1b1b3}a.badge-300:focus,a.badge-300:hover{color:#19191a;background-color:#979899}a.badge-300.focus,a.badge-300:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(177,177,179,.5);box-shadow:0 0 0 .2rem rgba(177,177,179,.5)}.badge-400{color:#19191a;background-color:#979899}a.badge-400:focus,a.badge-400:hover{color:#19191a;background-color:#7e7e80}a.badge-400.focus,a.badge-400:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(151,152,153,.5);box-shadow:0 0 0 .2rem rgba(151,152,153,.5)}.badge-500{color:#19191a;background-color:#7e7f80}a.badge-500:focus,a.badge-500:hover{color:#19191a;background-color:#656566}a.badge-500.focus,a.badge-500:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(126,127,128,.5);box-shadow:0 0 0 .2rem rgba(126,127,128,.5)}.badge-600{color:#fff;background-color:#656566}a.badge-600:focus,a.badge-600:hover{color:#fff;background-color:#4c4c4c}a.badge-600.focus,a.badge-600:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(101,101,102,.5);box-shadow:0 0 0 .2rem rgba(101,101,102,.5)}.badge-700{color:#fff;background-color:#4c4c4d}a.badge-700:focus,a.badge-700:hover{color:#fff;background-color:#323233}a.badge-700.focus,a.badge-700:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(76,76,77,.5);box-shadow:0 0 0 .2rem rgba(76,76,77,.5)}.badge-800{color:#fff;background-color:#323333}a.badge-800:focus,a.badge-800:hover{color:#fff;background-color:#191919}a.badge-800.focus,a.badge-800:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(50,51,51,.5);box-shadow:0 0 0 .2rem rgba(50,51,51,.5)}.badge-900{color:#fff;background-color:#19191a}a.badge-900:focus,a.badge-900:hover{color:#fff;background-color:#000}a.badge-900.focus,a.badge-900:focus{outline:0;-webkit-box-shadow:0 0 0 .2rem rgba(25,25,26,.5);box-shadow:0 0 0 .2rem rgba(25,25,26,.5)}@-webkit-keyframes progress-bar-stripes{0%{background-position:16px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{0%{background-position:16px 0}to{background-position:0 0}}.progress{height:16px;overflow:hidden;font-size:12px;font-size:.75rem;background-color:#cacacc;border-radius:0;-webkit-box-shadow:inset 0 .1rem .1rem rgba(0,0,0,.1);box-shadow:inset 0 .1rem .1rem rgba(0,0,0,.1)}.progress,.progress-bar{display:-webkit-box;display:-ms-flexbox;display:flex}.progress-bar{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;color:#fff;text-align:center;white-space:nowrap;background-color:#0073e6;-webkit-transition:width .6s ease;transition:width .6s ease}@media (prefers-reduced-motion:reduce){.progress-bar{-webkit-transition:none;transition:none}}.progress-bar-striped{background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent);background-size:16px 16px}.progress-bar-animated{-webkit-animation:progress-bar-stripes 1s linear infinite;animation:progress-bar-stripes 1s linear infinite}@media (prefers-reduced-motion:reduce){.progress-bar-animated{-webkit-animation:none;animation:none}}.media{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start}.media-body{-webkit-box-flex:1;-ms-flex:1;flex:1}.list-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;padding-left:0;margin-bottom:0}.list-group-item-action{width:100%;color:#0073e6;text-align:inherit}.list-group-item-action:focus,.list-group-item-action:hover{z-index:1;color:#00264d;text-decoration:none}.list-group-item-action:active{color:#19191a;background-color:#cacacc}.list-group-item{position:relative;display:block;padding:1rem 1.25rem;margin-bottom:-1px;background-color:#fff;border:1px solid rgba(0,0,0,.125)}.list-group-item:first-child{border-top-left-radius:4px;border-top-right-radius:4px}.list-group-item:last-child{margin-bottom:0;border-bottom-right-radius:4px;border-bottom-left-radius:4px}.list-group-item.disabled,.list-group-item:disabled{color:#656566;pointer-events:none;background-color:#fff}.list-group-item.active{z-index:2;color:#fff;background-color:#0073e6;border-color:#0073e6}.list-group-horizontal{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}@media (min-width:576px){.list-group-horizontal-sm{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-sm .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-sm .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-sm .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}@media (min-width:768px){.list-group-horizontal-md{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-md .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-md .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-md .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}@media (min-width:992px){.list-group-horizontal-lg{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-lg .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-lg .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-lg .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}@media (min-width:1200px){.list-group-horizontal-xl{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-xl .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-xl .list-group-item:first-child{border-top-left-radius:4px;border-bottom-left-radius:4px;border-top-right-radius:0}.list-group-horizontal-xl .list-group-item:last-child{margin-right:0;border-top-right-radius:4px;border-bottom-right-radius:4px;border-bottom-left-radius:0}}.list-group-flush .list-group-item{border-right:0;border-left:0;border-radius:0}.list-group-flush .list-group-item:last-child{margin-bottom:-1px}.list-group-flush:first-child .list-group-item:first-child{border-top:0}.list-group-flush:last-child .list-group-item:last-child{margin-bottom:0;border-bottom:0}.list-group-item-primary{color:#003c78;background-color:#b8d8f8}.list-group-item-primary.list-group-item-action:focus,.list-group-item-primary.list-group-item-action:hover{color:#003c78;background-color:#a1cbf6}.list-group-item-primary.list-group-item-action.active{color:#fff;background-color:#003c78;border-color:#003c78}.list-group-item-secondary{color:#303a44;background-color:#d1d7dc}.list-group-item-secondary.list-group-item-action:focus,.list-group-item-secondary.list-group-item-action:hover{color:#303a44;background-color:#c3cad1}.list-group-item-secondary.list-group-item-action.active{color:#fff;background-color:#303a44;border-color:#303a44}.list-group-item-success{color:#006a45;background-color:#b8f1dd}.list-group-item-success.list-group-item-action:focus,.list-group-item-success.list-group-item-action:hover{color:#006a45;background-color:#a3edd3}.list-group-item-success.list-group-item-action.active{color:#fff;background-color:#006a45;border-color:#006a45}.list-group-item-info{color:#4f4f50;background-color:#e2e2e2}.list-group-item-info.list-group-item-action:focus,.list-group-item-info.list-group-item-action:hover{color:#4f4f50;background-color:#d5d5d5}.list-group-item-info.list-group-item-action.active{color:#fff;background-color:#4f4f50;border-color:#4f4f50}.list-group-item-warning{color:#855000;background-color:#ffe2b8}.list-group-item-warning.list-group-item-action:focus,.list-group-item-warning.list-group-item-action:hover{color:#855000;background-color:#ffd89f}.list-group-item-warning.list-group-item-action.active{color:#fff;background-color:#855000;border-color:#855000}.list-group-item-danger{color:#80202f;background-color:#fdc9d1}.list-group-item-danger.list-group-item-action:focus,.list-group-item-danger.list-group-item-action:hover{color:#80202f;background-color:#fcb0bc}.list-group-item-danger.list-group-item-action.active{color:#fff;background-color:#80202f;border-color:#80202f}.list-group-item-light{color:#79787e;background-color:#f9f8fb}.list-group-item-light.list-group-item-action:focus,.list-group-item-light.list-group-item-action:hover{color:#79787e;background-color:#ebe8f2}.list-group-item-light.list-group-item-action.active{color:#fff;background-color:#79787e;border-color:#79787e}.list-group-item-dark{color:#0c1a28;background-color:#bec6cd}.list-group-item-dark.list-group-item-action:focus,.list-group-item-dark.list-group-item-action:hover{color:#0c1a28;background-color:#b0b9c2}.list-group-item-dark.list-group-item-action.active{color:#fff;background-color:#0c1a28;border-color:#0c1a28}.list-group-item-100{color:#767778;background-color:#f7f7f8}.list-group-item-100.list-group-item-action:focus,.list-group-item-100.list-group-item-action:hover{color:#767778;background-color:#e9e9ec}.list-group-item-100.list-group-item-action.active{color:#fff;background-color:#767778;border-color:#767778}.list-group-item-200{color:#69696a;background-color:#f0f0f1}.list-group-item-200.list-group-item-action:focus,.list-group-item-200.list-group-item-action:hover{color:#69696a;background-color:#e3e3e5}.list-group-item-200.list-group-item-action.active{color:#fff;background-color:#69696a;border-color:#69696a}.list-group-item-300{color:#5c5c5d;background-color:#e9e9ea}.list-group-item-300.list-group-item-action:focus,.list-group-item-300.list-group-item-action:hover{color:#5c5c5d;background-color:#dcdcde}.list-group-item-300.list-group-item-action.active{color:#fff;background-color:#5c5c5d;border-color:#5c5c5d}.list-group-item-400{color:#4f4f50;background-color:#e2e2e2}.list-group-item-400.list-group-item-action:focus,.list-group-item-400.list-group-item-action:hover{color:#4f4f50;background-color:#d5d5d5}.list-group-item-400.list-group-item-action.active{color:#fff;background-color:#4f4f50;border-color:#4f4f50}.list-group-item-500{color:#424243;background-color:#dbdbdb}.list-group-item-500.list-group-item-action:focus,.list-group-item-500.list-group-item-action:hover{color:#424243;background-color:#cecece}.list-group-item-500.list-group-item-action.active{color:#fff;background-color:#424243;border-color:#424243}.list-group-item-600{color:#353535;background-color:#d4d4d4}.list-group-item-600.list-group-item-action:focus,.list-group-item-600.list-group-item-action:hover{color:#353535;background-color:#c7c7c7}.list-group-item-600.list-group-item-action.active{color:#fff;background-color:#353535;border-color:#353535}.list-group-item-700{color:#282828;background-color:#cdcdcd}.list-group-item-700.list-group-item-action:focus,.list-group-item-700.list-group-item-action:hover{color:#282828;background-color:silver}.list-group-item-700.list-group-item-action.active{color:#fff;background-color:#282828;border-color:#282828}.list-group-item-800{color:#1a1b1b;background-color:#c6c6c6}.list-group-item-800.list-group-item-action:focus,.list-group-item-800.list-group-item-action:hover{color:#1a1b1b;background-color:#b9b9b9}.list-group-item-800.list-group-item-action.active{color:#fff;background-color:#1a1b1b;border-color:#1a1b1b}.list-group-item-900{color:#0d0d0e;background-color:#bfbfbf}.list-group-item-900.list-group-item-action:focus,.list-group-item-900.list-group-item-action:hover{color:#0d0d0e;background-color:#b2b2b2}.list-group-item-900.list-group-item-action.active{color:#fff;background-color:#0d0d0e;border-color:#0d0d0e}.close{float:right;font-size:24px;font-size:1.5rem;font-weight:700;line-height:1;color:#000;text-shadow:0 1px 0 #fff;opacity:.5}.close:hover{color:#000;text-decoration:none}.close:not(:disabled):not(.disabled):focus,.close:not(:disabled):not(.disabled):hover{opacity:.75}button.close{padding:0;background-color:transparent;border:0;-webkit-appearance:none;-moz-appearance:none;appearance:none}a.close.disabled{pointer-events:none}.modal-open{overflow:hidden}.modal-open .modal{overflow-x:hidden;overflow-y:auto}.modal{position:fixed;top:0;left:0;z-index:1050;display:none;width:100%;height:100%;overflow:hidden;outline:0}.modal-dialog{position:relative;width:auto;margin:.5rem;pointer-events:none}.modal.fade .modal-dialog{-webkit-transition:-webkit-transform .3s ease-out;transition:-webkit-transform .3s ease-out;transition:transform .3s ease-out;transition:transform .3s ease-out,-webkit-transform .3s ease-out;-webkit-transform:translateY(-50px);transform:translateY(-50px)}@media (prefers-reduced-motion:reduce){.modal.fade .modal-dialog{-webkit-transition:none;transition:none}}.modal.show .modal-dialog{-webkit-transform:none;transform:none}.modal-dialog-scrollable{display:-webkit-box;display:-ms-flexbox;display:flex;max-height:calc(100% - 1rem)}.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 1rem);overflow:hidden}.modal-dialog-scrollable .modal-footer,.modal-dialog-scrollable .modal-header{-ms-flex-negative:0;flex-shrink:0}.modal-dialog-scrollable .modal-body{overflow-y:auto}.modal-dialog-centered{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;min-height:calc(100% - 1rem)}.modal-dialog-centered:before{display:block;height:calc(100vh - 1rem);content:""}.modal-dialog-centered.modal-dialog-scrollable{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;height:100%}.modal-dialog-centered.modal-dialog-scrollable .modal-content{max-height:none}.modal-dialog-centered.modal-dialog-scrollable:before{content:none}.modal-content{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;width:100%;pointer-events:auto;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.2);border-radius:8px;-webkit-box-shadow:0 .25rem .5rem rgba(0,0,0,.5);box-shadow:0 .25rem .5rem rgba(0,0,0,.5);outline:0}.modal-backdrop{position:fixed;top:0;left:0;z-index:1040;width:100vw;height:100vh;background-color:#000}.modal-backdrop.fade{opacity:0}.modal-backdrop.show{opacity:.8}.modal-header{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;padding:1.5rem;border-bottom:0 solid #b1b1b3;border-top-left-radius:8px;border-top-right-radius:8px}.modal-header .close{padding:1.5rem;margin:-1rem -1rem -1rem auto}.modal-title{margin-bottom:0;line-height:1.5}.modal-body{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;padding:1.5rem}.modal-footer{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:end;-ms-flex-pack:end;justify-content:flex-end;padding:1.5rem;border-top:0 solid #b1b1b3;border-bottom-right-radius:8px;border-bottom-left-radius:8px}.modal-footer>:not(:first-child){margin-left:.25rem}.modal-footer>:not(:last-child){margin-right:.25rem}.modal-scrollbar-measure{position:absolute;top:-9999px;width:50px;height:50px;overflow:scroll}@media (min-width:576px){.modal-dialog{max-width:500px;margin:1.5rem auto}.modal-dialog-scrollable{max-height:calc(100% - 3rem)}.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 3rem)}.modal-dialog-centered{min-height:calc(100% - 3rem)}.modal-dialog-centered:before{height:calc(100vh - 3rem)}.modal-content{-webkit-box-shadow:0 .5rem 1rem rgba(0,0,0,.5);box-shadow:0 .5rem 1rem rgba(0,0,0,.5)}.modal-sm{max-width:300px}}@media (min-width:992px){.modal-lg,.modal-xl{max-width:800px}}@media (min-width:1200px){.modal-xl{max-width:1140px}}.tooltip{position:absolute;z-index:1070;display:block;margin:0;font-family:Titillium Web,Geneva,Tahoma,sans-serif;font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:14px;font-size:.875rem;word-wrap:break-word;opacity:0}.tooltip.show{opacity:1}.tooltip .arrow{position:absolute;display:block;width:12.8px;width:.8rem;height:6.4px;height:.4rem}.tooltip .arrow:before{position:absolute;content:"";border-color:transparent;border-style:solid}.bs-tooltip-auto[x-placement^=top],.bs-tooltip-top{padding:.4rem 0}.bs-tooltip-auto[x-placement^=top] .arrow,.bs-tooltip-top .arrow{bottom:0}.bs-tooltip-auto[x-placement^=top] .arrow:before,.bs-tooltip-top .arrow:before{top:0;border-width:.4rem .4rem 0;border-top-color:#004a4d}.bs-tooltip-auto[x-placement^=right],.bs-tooltip-right{padding:0 .4rem}.bs-tooltip-auto[x-placement^=right] .arrow,.bs-tooltip-right .arrow{left:0;width:6.4px;width:.4rem;height:12.8px;height:.8rem}.bs-tooltip-auto[x-placement^=right] .arrow:before,.bs-tooltip-right .arrow:before{right:0;border-width:.4rem .4rem .4rem 0;border-right-color:#004a4d}.bs-tooltip-auto[x-placement^=bottom],.bs-tooltip-bottom{padding:.4rem 0}.bs-tooltip-auto[x-placement^=bottom] .arrow,.bs-tooltip-bottom .arrow{top:0}.bs-tooltip-auto[x-placement^=bottom] .arrow:before,.bs-tooltip-bottom .arrow:before{bottom:0;border-width:0 .4rem .4rem;border-bottom-color:#004a4d}.bs-tooltip-auto[x-placement^=left],.bs-tooltip-left{padding:0 .4rem}.bs-tooltip-auto[x-placement^=left] .arrow,.bs-tooltip-left .arrow{right:0;width:6.4px;width:.4rem;height:12.8px;height:.8rem}.bs-tooltip-auto[x-placement^=left] .arrow:before,.bs-tooltip-left .arrow:before{left:0;border-width:.4rem 0 .4rem .4rem;border-left-color:#004a4d}.tooltip-inner{max-width:32em;padding:1rem;color:#fff;text-align:center;background-color:#004a4d;border-radius:4px}.popover{top:0;left:0;z-index:1060;max-width:276px;font-family:Titillium Web,Geneva,Tahoma,sans-serif;font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:14px;font-size:.875rem;word-wrap:break-word;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.2);border-radius:8px;-webkit-box-shadow:0 .25rem .5rem rgba(0,0,0,.2);box-shadow:0 .25rem .5rem rgba(0,0,0,.2)}.popover,.popover .arrow{position:absolute;display:block}.popover .arrow{width:16px;width:1rem;height:8px;height:.5rem;margin:0 8px}.popover .arrow:after,.popover .arrow:before{position:absolute;display:block;content:"";border-color:transparent;border-style:solid}.bs-popover-auto[x-placement^=top],.bs-popover-top{margin-bottom:.5rem}.bs-popover-auto[x-placement^=top]>.arrow,.bs-popover-top>.arrow{bottom:calc(-.5rem + -1px)}.bs-popover-auto[x-placement^=top]>.arrow:before,.bs-popover-top>.arrow:before{bottom:0;border-width:.5rem .5rem 0;border-top-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=top]>.arrow:after,.bs-popover-top>.arrow:after{bottom:1px;border-width:.5rem .5rem 0;border-top-color:#fff}.bs-popover-auto[x-placement^=right],.bs-popover-right{margin-left:.5rem}.bs-popover-auto[x-placement^=right]>.arrow,.bs-popover-right>.arrow{left:calc(-.5rem + -1px);width:8px;width:.5rem;height:16px;height:1rem;margin:8px 0}.bs-popover-auto[x-placement^=right]>.arrow:before,.bs-popover-right>.arrow:before{left:0;border-width:.5rem .5rem .5rem 0;border-right-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=right]>.arrow:after,.bs-popover-right>.arrow:after{left:1px;border-width:.5rem .5rem .5rem 0;border-right-color:#fff}.bs-popover-auto[x-placement^=bottom],.bs-popover-bottom{margin-top:.5rem}.bs-popover-auto[x-placement^=bottom]>.arrow,.bs-popover-bottom>.arrow{top:calc(-.5rem + -1px)}.bs-popover-auto[x-placement^=bottom]>.arrow:before,.bs-popover-bottom>.arrow:before{top:0;border-width:0 .5rem .5rem;border-bottom-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=bottom]>.arrow:after,.bs-popover-bottom>.arrow:after{top:1px;border-width:0 .5rem .5rem;border-bottom-color:#fff}.bs-popover-auto[x-placement^=bottom] .popover-header:before,.bs-popover-bottom .popover-header:before{position:absolute;top:0;left:50%;display:block;width:16px;width:1rem;margin-left:-.5rem;content:"";border-bottom:1px solid #f7f7f7}.bs-popover-auto[x-placement^=left],.bs-popover-left{margin-right:.5rem}.bs-popover-auto[x-placement^=left]>.arrow,.bs-popover-left>.arrow{right:calc(-.5rem + -1px);width:8px;width:.5rem;height:16px;height:1rem;margin:8px 0}.bs-popover-auto[x-placement^=left]>.arrow:before,.bs-popover-left>.arrow:before{right:0;border-width:.5rem 0 .5rem .5rem;border-left-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=left]>.arrow:after,.bs-popover-left>.arrow:after{right:1px;border-width:.5rem 0 .5rem .5rem;border-left-color:#fff}.popover-header{padding:.5rem .75rem;margin-bottom:0;font-size:16px;font-size:1rem;background-color:#f7f7f7;border-bottom:1px solid #ebebeb;border-top-left-radius:7px;border-top-right-radius:7px}.popover-header:empty{display:none}.popover-body{padding:.5rem .75rem;color:#19191a}.carousel{position:relative}.carousel.pointer-event{-ms-touch-action:pan-y;touch-action:pan-y}.carousel-inner{position:relative;width:100%;overflow:hidden}.carousel-inner:after{display:block;clear:both;content:""}.carousel-item{position:relative;display:none;float:left;width:100%;margin-right:-100%;-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-transition:-webkit-transform .6s ease-in-out;transition:-webkit-transform .6s ease-in-out;transition:transform .6s ease-in-out;transition:transform .6s ease-in-out,-webkit-transform .6s ease-in-out}@media (prefers-reduced-motion:reduce){.carousel-item{-webkit-transition:none;transition:none}}.carousel-item-next,.carousel-item-prev,.carousel-item.active{display:block}.active.carousel-item-right,.carousel-item-next:not(.carousel-item-left){-webkit-transform:translateX(100%);transform:translateX(100%)}.active.carousel-item-left,.carousel-item-prev:not(.carousel-item-right){-webkit-transform:translateX(-100%);transform:translateX(-100%)}.carousel-fade .carousel-item{opacity:0;-webkit-transition-property:opacity;transition-property:opacity;-webkit-transform:none;transform:none}.carousel-fade .carousel-item-next.carousel-item-left,.carousel-fade .carousel-item-prev.carousel-item-right,.carousel-fade .carousel-item.active{z-index:1;opacity:1}.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{z-index:0;opacity:0;-webkit-transition:opacity 0s .6s;transition:opacity 0s .6s}@media (prefers-reduced-motion:reduce){.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{-webkit-transition:none;transition:none}}.carousel-control-next,.carousel-control-prev{position:absolute;top:0;bottom:0;z-index:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:auto;color:#5c6f82;text-align:center;opacity:1;-webkit-transition:opacity .15s ease;transition:opacity .15s ease}@media (prefers-reduced-motion:reduce){.carousel-control-next,.carousel-control-prev{-webkit-transition:none;transition:none}}.carousel-control-next:focus,.carousel-control-next:hover,.carousel-control-prev:focus,.carousel-control-prev:hover{color:#5c6f82;text-decoration:none;outline:0;opacity:.9}.carousel-control-prev{left:0}.carousel-control-next{right:0}.carousel-control-next-icon,.carousel-control-prev-icon{display:inline-block;width:32px;height:32px;background:no-repeat 50%/100% 100%}.carousel-control-prev-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 8 8'%3E%3Cpath d='M5.25 0l-4 4 4 4 1.5-1.5L4.25 4l2.5-2.5L5.25 0z'/%3E%3C/svg%3E")}.carousel-control-next-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 8 8'%3E%3Cpath d='M2.75 0l-1.5 1.5L3.75 4l-2.5 2.5L2.75 8l4-4-4-4z'/%3E%3C/svg%3E")}.carousel-indicators{position:absolute;right:0;bottom:0;left:0;z-index:15;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;padding-left:0;margin-right:auto;margin-left:auto;list-style:none}.carousel-indicators li{-webkit-box-sizing:content-box;box-sizing:content-box;-webkit-box-flex:0;-ms-flex:0 1 auto;flex:0 1 auto;width:30px;height:3px;margin-right:3px;margin-left:3px;text-indent:-999px;cursor:pointer;background-color:#fff;background-clip:padding-box;border-top:10px solid transparent;border-bottom:10px solid transparent;opacity:.5;-webkit-transition:opacity .6s ease;transition:opacity .6s ease}@media (prefers-reduced-motion:reduce){.carousel-indicators li{-webkit-transition:none;transition:none}}.carousel-indicators .active{opacity:1}.carousel-caption{position:absolute;right:15%;bottom:20px;left:15%;z-index:10;padding-top:20px;padding-bottom:20px;color:#fff;text-align:center}.align-baseline{vertical-align:baseline!important}.align-top{vertical-align:top!important}.align-middle{vertical-align:middle!important}.align-bottom{vertical-align:bottom!important}.align-text-bottom{vertical-align:text-bottom!important}.align-text-top{vertical-align:text-top!important}.bg-primary{background-color:#0073e6!important}a.bg-primary:focus,a.bg-primary:hover,button.bg-primary:focus,button.bg-primary:hover{background-color:#0059b3!important}.bg-secondary{background-color:#5c6f82!important}a.bg-secondary:focus,a.bg-secondary:hover,button.bg-secondary:focus,button.bg-secondary:hover{background-color:#475664!important}.bg-success{background-color:#00cc85!important}a.bg-success:focus,a.bg-success:hover,button.bg-success:focus,button.bg-success:hover{background-color:#009963!important}.bg-info{background-color:#979899!important}a.bg-info:focus,a.bg-info:hover,button.bg-info:focus,button.bg-info:hover{background-color:#7e7e80!important}.bg-warning{background-color:#f90!important}a.bg-warning:focus,a.bg-warning:hover,button.bg-warning:focus,button.bg-warning:hover{background-color:#cc7a00!important}.bg-danger{background-color:#f73e5a!important}a.bg-danger:focus,a.bg-danger:hover,button.bg-danger:focus,button.bg-danger:hover{background-color:#f50d30!important}.bg-light{background-color:#e9e6f2!important}a.bg-light:focus,a.bg-light:hover,button.bg-light:focus,button.bg-light:hover{background-color:#ccc4e1!important}.bg-dark{background-color:#17324d!important}a.bg-dark:focus,a.bg-dark:hover,button.bg-dark:focus,button.bg-dark:hover{background-color:#0b1825!important}.bg-100{background-color:#e3e4e6!important}a.bg-100:focus,a.bg-100:hover,button.bg-100:focus,button.bg-100:hover{background-color:#c9cacd!important}.bg-200{background-color:#cacacc!important}a.bg-200:focus,a.bg-200:hover,button.bg-200:focus,button.bg-200:hover{background-color:#b0b1b3!important}.bg-300{background-color:#b1b1b3!important}.bg-400,a.bg-300:focus,a.bg-300:hover,button.bg-300:focus,button.bg-300:hover{background-color:#979899!important}a.bg-400:focus,a.bg-400:hover,button.bg-400:focus,button.bg-400:hover{background-color:#7e7e80!important}.bg-500{background-color:#7e7f80!important}.bg-600,a.bg-500:focus,a.bg-500:hover,button.bg-500:focus,button.bg-500:hover{background-color:#656566!important}a.bg-600:focus,a.bg-600:hover,button.bg-600:focus,button.bg-600:hover{background-color:#4c4c4c!important}.bg-700{background-color:#4c4c4d!important}a.bg-700:focus,a.bg-700:hover,button.bg-700:focus,button.bg-700:hover{background-color:#323233!important}.bg-800{background-color:#323333!important}a.bg-800:focus,a.bg-800:hover,button.bg-800:focus,button.bg-800:hover{background-color:#191919!important}.bg-900{background-color:#19191a!important}a.bg-900:focus,a.bg-900:hover,button.bg-900:focus,button.bg-900:hover{background-color:#000!important}.bg-white{background-color:#fff!important}.bg-transparent{background-color:transparent!important}.border{border:1px solid #b1b1b3!important}.border-top{border-top:1px solid #b1b1b3!important}.border-right{border-right:1px solid #b1b1b3!important}.border-bottom{border-bottom:1px solid #b1b1b3!important}.border-left{border-left:1px solid #b1b1b3!important}.border-0{border:0!important}.border-top-0{border-top:0!important}.border-right-0{border-right:0!important}.border-bottom-0{border-bottom:0!important}.border-left-0{border-left:0!important}.border-primary{border-color:#0073e6!important}.border-secondary{border-color:#5c6f82!important}.border-success{border-color:#00cc85!important}.border-info{border-color:#979899!important}.border-warning{border-color:#f90!important}.border-danger{border-color:#f73e5a!important}.border-light{border-color:#e9e6f2!important}.border-dark{border-color:#17324d!important}.border-100{border-color:#e3e4e6!important}.border-200{border-color:#cacacc!important}.border-300{border-color:#b1b1b3!important}.border-400{border-color:#979899!important}.border-500{border-color:#7e7f80!important}.border-600{border-color:#656566!important}.border-700{border-color:#4c4c4d!important}.border-800{border-color:#323333!important}.border-900{border-color:#19191a!important}.border-white{border-color:#fff!important}.rounded-sm{border-radius:2px!important}.rounded{border-radius:4px!important}.rounded-top{border-top-left-radius:4px!important}.rounded-right,.rounded-top{border-top-right-radius:4px!important}.rounded-bottom,.rounded-right{border-bottom-right-radius:4px!important}.rounded-bottom,.rounded-left{border-bottom-left-radius:4px!important}.rounded-left{border-top-left-radius:4px!important}.rounded-lg{border-radius:8px!important}.rounded-circle{border-radius:50%!important}.rounded-pill{border-radius:50rem!important}.rounded-0{border-radius:0!important}.clearfix:after{display:block;clear:both;content:""}.d-none{display:none!important}.d-inline{display:inline!important}.d-inline-block{display:inline-block!important}.d-block{display:block!important}.d-table{display:table!important}.d-table-row{display:table-row!important}.d-table-cell{display:table-cell!important}.d-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}@media (min-width:576px){.d-sm-none{display:none!important}.d-sm-inline{display:inline!important}.d-sm-inline-block{display:inline-block!important}.d-sm-block{display:block!important}.d-sm-table{display:table!important}.d-sm-table-row{display:table-row!important}.d-sm-table-cell{display:table-cell!important}.d-sm-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-sm-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media (min-width:768px){.d-md-none{display:none!important}.d-md-inline{display:inline!important}.d-md-inline-block{display:inline-block!important}.d-md-block{display:block!important}.d-md-table{display:table!important}.d-md-table-row{display:table-row!important}.d-md-table-cell{display:table-cell!important}.d-md-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-md-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media (min-width:992px){.d-lg-none{display:none!important}.d-lg-inline{display:inline!important}.d-lg-inline-block{display:inline-block!important}.d-lg-block{display:block!important}.d-lg-table{display:table!important}.d-lg-table-row{display:table-row!important}.d-lg-table-cell{display:table-cell!important}.d-lg-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-lg-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media (min-width:1200px){.d-xl-none{display:none!important}.d-xl-inline{display:inline!important}.d-xl-inline-block{display:inline-block!important}.d-xl-block{display:block!important}.d-xl-table{display:table!important}.d-xl-table-row{display:table-row!important}.d-xl-table-cell{display:table-cell!important}.d-xl-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-xl-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}@media print{.d-print-none{display:none!important}.d-print-inline{display:inline!important}.d-print-inline-block{display:inline-block!important}.d-print-block{display:block!important}.d-print-table{display:table!important}.d-print-table-row{display:table-row!important}.d-print-table-cell{display:table-cell!important}.d-print-flex{display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important}.d-print-inline-flex{display:-webkit-inline-box!important;display:-ms-inline-flexbox!important;display:inline-flex!important}}.embed-responsive{position:relative;display:block;width:100%;padding:0;overflow:hidden}.embed-responsive:before{display:block;content:""}.embed-responsive .embed-responsive-item,.embed-responsive embed,.embed-responsive iframe,.embed-responsive object,.embed-responsive video{position:absolute;top:0;bottom:0;left:0;width:100%;height:100%;border:0}.embed-responsive-21by9:before{padding-top:42.8571428571%}.embed-responsive-16by9:before{padding-top:56.25%}.embed-responsive-4by3:before{padding-top:75%}.embed-responsive-1by1:before{padding-top:100%}.flex-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-column,.flex-row{-webkit-box-direction:normal!important}.flex-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-row-reverse{-webkit-box-orient:horizontal!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-column-reverse,.flex-row-reverse{-webkit-box-direction:reverse!important}.flex-column-reverse{-webkit-box-orient:vertical!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}@media (min-width:576px){.flex-sm-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-sm-column,.flex-sm-row{-webkit-box-direction:normal!important}.flex-sm-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-sm-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-sm-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-sm-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-sm-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-sm-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-sm-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-sm-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-sm-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-sm-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-sm-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-sm-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-sm-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-sm-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-sm-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-sm-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-sm-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-sm-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-sm-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-sm-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-sm-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-sm-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-sm-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-sm-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-sm-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-sm-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-sm-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-sm-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-sm-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-sm-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-sm-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-sm-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-sm-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}@media (min-width:768px){.flex-md-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-md-column,.flex-md-row{-webkit-box-direction:normal!important}.flex-md-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-md-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-md-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-md-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-md-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-md-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-md-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-md-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-md-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-md-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-md-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-md-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-md-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-md-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-md-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-md-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-md-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-md-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-md-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-md-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-md-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-md-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-md-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-md-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-md-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-md-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-md-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-md-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-md-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-md-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-md-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-md-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-md-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}@media (min-width:992px){.flex-lg-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-lg-column,.flex-lg-row{-webkit-box-direction:normal!important}.flex-lg-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-lg-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-lg-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-lg-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-lg-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-lg-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-lg-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-lg-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-lg-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-lg-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-lg-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-lg-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-lg-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-lg-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-lg-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-lg-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-lg-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-lg-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-lg-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-lg-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-lg-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-lg-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-lg-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-lg-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-lg-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-lg-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-lg-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-lg-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-lg-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-lg-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-lg-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-lg-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-lg-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}@media (min-width:1200px){.flex-xl-row{-webkit-box-orient:horizontal!important;-ms-flex-direction:row!important;flex-direction:row!important}.flex-xl-column,.flex-xl-row{-webkit-box-direction:normal!important}.flex-xl-column{-webkit-box-orient:vertical!important;-ms-flex-direction:column!important;flex-direction:column!important}.flex-xl-row-reverse{-webkit-box-orient:horizontal!important;-webkit-box-direction:reverse!important;-ms-flex-direction:row-reverse!important;flex-direction:row-reverse!important}.flex-xl-column-reverse{-webkit-box-orient:vertical!important;-webkit-box-direction:reverse!important;-ms-flex-direction:column-reverse!important;flex-direction:column-reverse!important}.flex-xl-wrap{-ms-flex-wrap:wrap!important;flex-wrap:wrap!important}.flex-xl-nowrap{-ms-flex-wrap:nowrap!important;flex-wrap:nowrap!important}.flex-xl-wrap-reverse{-ms-flex-wrap:wrap-reverse!important;flex-wrap:wrap-reverse!important}.flex-xl-fill{-webkit-box-flex:1!important;-ms-flex:1 1 auto!important;flex:1 1 auto!important}.flex-xl-grow-0{-webkit-box-flex:0!important;-ms-flex-positive:0!important;flex-grow:0!important}.flex-xl-grow-1{-webkit-box-flex:1!important;-ms-flex-positive:1!important;flex-grow:1!important}.flex-xl-shrink-0{-ms-flex-negative:0!important;flex-shrink:0!important}.flex-xl-shrink-1{-ms-flex-negative:1!important;flex-shrink:1!important}.justify-content-xl-start{-webkit-box-pack:start!important;-ms-flex-pack:start!important;justify-content:flex-start!important}.justify-content-xl-end{-webkit-box-pack:end!important;-ms-flex-pack:end!important;justify-content:flex-end!important}.justify-content-xl-center{-webkit-box-pack:center!important;-ms-flex-pack:center!important;justify-content:center!important}.justify-content-xl-between{-webkit-box-pack:justify!important;-ms-flex-pack:justify!important;justify-content:space-between!important}.justify-content-xl-around{-ms-flex-pack:distribute!important;justify-content:space-around!important}.align-items-xl-start{-webkit-box-align:start!important;-ms-flex-align:start!important;align-items:flex-start!important}.align-items-xl-end{-webkit-box-align:end!important;-ms-flex-align:end!important;align-items:flex-end!important}.align-items-xl-center{-webkit-box-align:center!important;-ms-flex-align:center!important;align-items:center!important}.align-items-xl-baseline{-webkit-box-align:baseline!important;-ms-flex-align:baseline!important;align-items:baseline!important}.align-items-xl-stretch{-webkit-box-align:stretch!important;-ms-flex-align:stretch!important;align-items:stretch!important}.align-content-xl-start{-ms-flex-line-pack:start!important;align-content:flex-start!important}.align-content-xl-end{-ms-flex-line-pack:end!important;align-content:flex-end!important}.align-content-xl-center{-ms-flex-line-pack:center!important;align-content:center!important}.align-content-xl-between{-ms-flex-line-pack:justify!important;align-content:space-between!important}.align-content-xl-around{-ms-flex-line-pack:distribute!important;align-content:space-around!important}.align-content-xl-stretch{-ms-flex-line-pack:stretch!important;align-content:stretch!important}.align-self-xl-auto{-ms-flex-item-align:auto!important;align-self:auto!important}.align-self-xl-start{-ms-flex-item-align:start!important;align-self:flex-start!important}.align-self-xl-end{-ms-flex-item-align:end!important;align-self:flex-end!important}.align-self-xl-center{-ms-flex-item-align:center!important;align-self:center!important}.align-self-xl-baseline{-ms-flex-item-align:baseline!important;align-self:baseline!important}.align-self-xl-stretch{-ms-flex-item-align:stretch!important;align-self:stretch!important}}.float-left{float:left!important}.float-right{float:right!important}.float-none{float:none!important}@media (min-width:576px){.float-sm-left{float:left!important}.float-sm-right{float:right!important}.float-sm-none{float:none!important}}@media (min-width:768px){.float-md-left{float:left!important}.float-md-right{float:right!important}.float-md-none{float:none!important}}@media (min-width:992px){.float-lg-left{float:left!important}.float-lg-right{float:right!important}.float-lg-none{float:none!important}}@media (min-width:1200px){.float-xl-left{float:left!important}.float-xl-right{float:right!important}.float-xl-none{float:none!important}}.overflow-auto{overflow:auto!important}.overflow-hidden{overflow:hidden!important}.position-static{position:static!important}.position-relative{position:relative!important}.position-absolute{position:absolute!important}.position-fixed{position:fixed!important}.position-sticky{position:-webkit-sticky!important;position:sticky!important}.fixed-top{top:0}.fixed-bottom,.fixed-top{position:fixed;right:0;left:0;z-index:1030}.fixed-bottom{bottom:0}@supports ((position:-webkit-sticky) or (position:sticky)){.sticky-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}}.sr-only{position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;overflow:visible;clip:auto;white-space:normal}.shadow-sm{-webkit-box-shadow:0 .125rem .25rem rgba(0,0,0,.075)!important;box-shadow:0 .125rem .25rem rgba(0,0,0,.075)!important}.shadow{-webkit-box-shadow:0 .5rem 1rem rgba(0,0,0,.15)!important;box-shadow:0 .5rem 1rem rgba(0,0,0,.15)!important}.shadow-lg{-webkit-box-shadow:0 1rem 3rem rgba(0,0,0,.175)!important;box-shadow:0 1rem 3rem rgba(0,0,0,.175)!important}.shadow-none{-webkit-box-shadow:none!important;box-shadow:none!important}.w-25{width:25%!important}.w-50{width:50%!important}.w-75{width:75%!important}.w-100{width:100%!important}.w-auto{width:auto!important}.h-25{height:25%!important}.h-50{height:50%!important}.h-75{height:75%!important}.h-100{height:100%!important}.h-auto{height:auto!important}.mw-100{max-width:100%!important}.mh-100{max-height:100%!important}.min-vw-100{min-width:100vw!important}.min-vh-100{min-height:100vh!important}.vw-100{width:100vw!important}.vh-100{height:100vh!important}.stretched-link:after{position:absolute;top:0;right:0;bottom:0;left:0;z-index:1;pointer-events:auto;content:"";background-color:transparent}.m-0{margin:0!important}.mt-0,.my-0{margin-top:0!important}.mr-0,.mx-0{margin-right:0!important}.mb-0,.my-0{margin-bottom:0!important}.ml-0,.mx-0{margin-left:0!important}.m-1{margin:4px!important}.mt-1,.my-1{margin-top:4px!important}.mr-1,.mx-1{margin-right:4px!important}.mb-1,.my-1{margin-bottom:4px!important}.ml-1,.mx-1{margin-left:4px!important}.m-2{margin:8px!important}.mt-2,.my-2{margin-top:8px!important}.mr-2,.mx-2{margin-right:8px!important}.mb-2,.my-2{margin-bottom:8px!important}.ml-2,.mx-2{margin-left:8px!important}.m-3{margin:16px!important}.mt-3,.my-3{margin-top:16px!important}.mr-3,.mx-3{margin-right:16px!important}.mb-3,.my-3{margin-bottom:16px!important}.ml-3,.mx-3{margin-left:16px!important}.m-4{margin:24px!important}.mt-4,.my-4{margin-top:24px!important}.mr-4,.mx-4{margin-right:24px!important}.mb-4,.my-4{margin-bottom:24px!important}.ml-4,.mx-4{margin-left:24px!important}.m-5{margin:48px!important}.mt-5,.my-5{margin-top:48px!important}.mr-5,.mx-5{margin-right:48px!important}.mb-5,.my-5{margin-bottom:48px!important}.ml-5,.mx-5{margin-left:48px!important}.p-0{padding:0!important}.pt-0,.py-0{padding-top:0!important}.pr-0,.px-0{padding-right:0!important}.pb-0,.py-0{padding-bottom:0!important}.pl-0,.px-0{padding-left:0!important}.p-1{padding:4px!important}.pt-1,.py-1{padding-top:4px!important}.pr-1,.px-1{padding-right:4px!important}.pb-1,.py-1{padding-bottom:4px!important}.pl-1,.px-1{padding-left:4px!important}.p-2{padding:8px!important}.pt-2,.py-2{padding-top:8px!important}.pr-2,.px-2{padding-right:8px!important}.pb-2,.py-2{padding-bottom:8px!important}.pl-2,.px-2{padding-left:8px!important}.p-3{padding:16px!important}.pt-3,.py-3{padding-top:16px!important}.pr-3,.px-3{padding-right:16px!important}.pb-3,.py-3{padding-bottom:16px!important}.pl-3,.px-3{padding-left:16px!important}.p-4{padding:24px!important}.pt-4,.py-4{padding-top:24px!important}.pr-4,.px-4{padding-right:24px!important}.pb-4,.py-4{padding-bottom:24px!important}.pl-4,.px-4{padding-left:24px!important}.p-5{padding:48px!important}.pt-5,.py-5{padding-top:48px!important}.pr-5,.px-5{padding-right:48px!important}.pb-5,.py-5{padding-bottom:48px!important}.pl-5,.px-5{padding-left:48px!important}.m-n1{margin:-4px!important}.mt-n1,.my-n1{margin-top:-4px!important}.mr-n1,.mx-n1{margin-right:-4px!important}.mb-n1,.my-n1{margin-bottom:-4px!important}.ml-n1,.mx-n1{margin-left:-4px!important}.m-n2{margin:-8px!important}.mt-n2,.my-n2{margin-top:-8px!important}.mr-n2,.mx-n2{margin-right:-8px!important}.mb-n2,.my-n2{margin-bottom:-8px!important}.ml-n2,.mx-n2{margin-left:-8px!important}.m-n3{margin:-16px!important}.mt-n3,.my-n3{margin-top:-16px!important}.mr-n3,.mx-n3{margin-right:-16px!important}.mb-n3,.my-n3{margin-bottom:-16px!important}.ml-n3,.mx-n3{margin-left:-16px!important}.m-n4{margin:-24px!important}.mt-n4,.my-n4{margin-top:-24px!important}.mr-n4,.mx-n4{margin-right:-24px!important}.mb-n4,.my-n4{margin-bottom:-24px!important}.ml-n4,.mx-n4{margin-left:-24px!important}.m-n5{margin:-48px!important}.mt-n5,.my-n5{margin-top:-48px!important}.mr-n5,.mx-n5{margin-right:-48px!important}.mb-n5,.my-n5{margin-bottom:-48px!important}.ml-n5,.mx-n5{margin-left:-48px!important}.m-auto{margin:auto!important}.mt-auto,.my-auto{margin-top:auto!important}.mr-auto,.mx-auto{margin-right:auto!important}.mb-auto,.my-auto{margin-bottom:auto!important}.ml-auto,.mx-auto{margin-left:auto!important}@media (min-width:576px){.m-sm-0{margin:0!important}.mt-sm-0,.my-sm-0{margin-top:0!important}.mr-sm-0,.mx-sm-0{margin-right:0!important}.mb-sm-0,.my-sm-0{margin-bottom:0!important}.ml-sm-0,.mx-sm-0{margin-left:0!important}.m-sm-1{margin:4px!important}.mt-sm-1,.my-sm-1{margin-top:4px!important}.mr-sm-1,.mx-sm-1{margin-right:4px!important}.mb-sm-1,.my-sm-1{margin-bottom:4px!important}.ml-sm-1,.mx-sm-1{margin-left:4px!important}.m-sm-2{margin:8px!important}.mt-sm-2,.my-sm-2{margin-top:8px!important}.mr-sm-2,.mx-sm-2{margin-right:8px!important}.mb-sm-2,.my-sm-2{margin-bottom:8px!important}.ml-sm-2,.mx-sm-2{margin-left:8px!important}.m-sm-3{margin:16px!important}.mt-sm-3,.my-sm-3{margin-top:16px!important}.mr-sm-3,.mx-sm-3{margin-right:16px!important}.mb-sm-3,.my-sm-3{margin-bottom:16px!important}.ml-sm-3,.mx-sm-3{margin-left:16px!important}.m-sm-4{margin:24px!important}.mt-sm-4,.my-sm-4{margin-top:24px!important}.mr-sm-4,.mx-sm-4{margin-right:24px!important}.mb-sm-4,.my-sm-4{margin-bottom:24px!important}.ml-sm-4,.mx-sm-4{margin-left:24px!important}.m-sm-5{margin:48px!important}.mt-sm-5,.my-sm-5{margin-top:48px!important}.mr-sm-5,.mx-sm-5{margin-right:48px!important}.mb-sm-5,.my-sm-5{margin-bottom:48px!important}.ml-sm-5,.mx-sm-5{margin-left:48px!important}.p-sm-0{padding:0!important}.pt-sm-0,.py-sm-0{padding-top:0!important}.pr-sm-0,.px-sm-0{padding-right:0!important}.pb-sm-0,.py-sm-0{padding-bottom:0!important}.pl-sm-0,.px-sm-0{padding-left:0!important}.p-sm-1{padding:4px!important}.pt-sm-1,.py-sm-1{padding-top:4px!important}.pr-sm-1,.px-sm-1{padding-right:4px!important}.pb-sm-1,.py-sm-1{padding-bottom:4px!important}.pl-sm-1,.px-sm-1{padding-left:4px!important}.p-sm-2{padding:8px!important}.pt-sm-2,.py-sm-2{padding-top:8px!important}.pr-sm-2,.px-sm-2{padding-right:8px!important}.pb-sm-2,.py-sm-2{padding-bottom:8px!important}.pl-sm-2,.px-sm-2{padding-left:8px!important}.p-sm-3{padding:16px!important}.pt-sm-3,.py-sm-3{padding-top:16px!important}.pr-sm-3,.px-sm-3{padding-right:16px!important}.pb-sm-3,.py-sm-3{padding-bottom:16px!important}.pl-sm-3,.px-sm-3{padding-left:16px!important}.p-sm-4{padding:24px!important}.pt-sm-4,.py-sm-4{padding-top:24px!important}.pr-sm-4,.px-sm-4{padding-right:24px!important}.pb-sm-4,.py-sm-4{padding-bottom:24px!important}.pl-sm-4,.px-sm-4{padding-left:24px!important}.p-sm-5{padding:48px!important}.pt-sm-5,.py-sm-5{padding-top:48px!important}.pr-sm-5,.px-sm-5{padding-right:48px!important}.pb-sm-5,.py-sm-5{padding-bottom:48px!important}.pl-sm-5,.px-sm-5{padding-left:48px!important}.m-sm-n1{margin:-4px!important}.mt-sm-n1,.my-sm-n1{margin-top:-4px!important}.mr-sm-n1,.mx-sm-n1{margin-right:-4px!important}.mb-sm-n1,.my-sm-n1{margin-bottom:-4px!important}.ml-sm-n1,.mx-sm-n1{margin-left:-4px!important}.m-sm-n2{margin:-8px!important}.mt-sm-n2,.my-sm-n2{margin-top:-8px!important}.mr-sm-n2,.mx-sm-n2{margin-right:-8px!important}.mb-sm-n2,.my-sm-n2{margin-bottom:-8px!important}.ml-sm-n2,.mx-sm-n2{margin-left:-8px!important}.m-sm-n3{margin:-16px!important}.mt-sm-n3,.my-sm-n3{margin-top:-16px!important}.mr-sm-n3,.mx-sm-n3{margin-right:-16px!important}.mb-sm-n3,.my-sm-n3{margin-bottom:-16px!important}.ml-sm-n3,.mx-sm-n3{margin-left:-16px!important}.m-sm-n4{margin:-24px!important}.mt-sm-n4,.my-sm-n4{margin-top:-24px!important}.mr-sm-n4,.mx-sm-n4{margin-right:-24px!important}.mb-sm-n4,.my-sm-n4{margin-bottom:-24px!important}.ml-sm-n4,.mx-sm-n4{margin-left:-24px!important}.m-sm-n5{margin:-48px!important}.mt-sm-n5,.my-sm-n5{margin-top:-48px!important}.mr-sm-n5,.mx-sm-n5{margin-right:-48px!important}.mb-sm-n5,.my-sm-n5{margin-bottom:-48px!important}.ml-sm-n5,.mx-sm-n5{margin-left:-48px!important}.m-sm-auto{margin:auto!important}.mt-sm-auto,.my-sm-auto{margin-top:auto!important}.mr-sm-auto,.mx-sm-auto{margin-right:auto!important}.mb-sm-auto,.my-sm-auto{margin-bottom:auto!important}.ml-sm-auto,.mx-sm-auto{margin-left:auto!important}}@media (min-width:768px){.m-md-0{margin:0!important}.mt-md-0,.my-md-0{margin-top:0!important}.mr-md-0,.mx-md-0{margin-right:0!important}.mb-md-0,.my-md-0{margin-bottom:0!important}.ml-md-0,.mx-md-0{margin-left:0!important}.m-md-1{margin:4px!important}.mt-md-1,.my-md-1{margin-top:4px!important}.mr-md-1,.mx-md-1{margin-right:4px!important}.mb-md-1,.my-md-1{margin-bottom:4px!important}.ml-md-1,.mx-md-1{margin-left:4px!important}.m-md-2{margin:8px!important}.mt-md-2,.my-md-2{margin-top:8px!important}.mr-md-2,.mx-md-2{margin-right:8px!important}.mb-md-2,.my-md-2{margin-bottom:8px!important}.ml-md-2,.mx-md-2{margin-left:8px!important}.m-md-3{margin:16px!important}.mt-md-3,.my-md-3{margin-top:16px!important}.mr-md-3,.mx-md-3{margin-right:16px!important}.mb-md-3,.my-md-3{margin-bottom:16px!important}.ml-md-3,.mx-md-3{margin-left:16px!important}.m-md-4{margin:24px!important}.mt-md-4,.my-md-4{margin-top:24px!important}.mr-md-4,.mx-md-4{margin-right:24px!important}.mb-md-4,.my-md-4{margin-bottom:24px!important}.ml-md-4,.mx-md-4{margin-left:24px!important}.m-md-5{margin:48px!important}.mt-md-5,.my-md-5{margin-top:48px!important}.mr-md-5,.mx-md-5{margin-right:48px!important}.mb-md-5,.my-md-5{margin-bottom:48px!important}.ml-md-5,.mx-md-5{margin-left:48px!important}.p-md-0{padding:0!important}.pt-md-0,.py-md-0{padding-top:0!important}.pr-md-0,.px-md-0{padding-right:0!important}.pb-md-0,.py-md-0{padding-bottom:0!important}.pl-md-0,.px-md-0{padding-left:0!important}.p-md-1{padding:4px!important}.pt-md-1,.py-md-1{padding-top:4px!important}.pr-md-1,.px-md-1{padding-right:4px!important}.pb-md-1,.py-md-1{padding-bottom:4px!important}.pl-md-1,.px-md-1{padding-left:4px!important}.p-md-2{padding:8px!important}.pt-md-2,.py-md-2{padding-top:8px!important}.pr-md-2,.px-md-2{padding-right:8px!important}.pb-md-2,.py-md-2{padding-bottom:8px!important}.pl-md-2,.px-md-2{padding-left:8px!important}.p-md-3{padding:16px!important}.pt-md-3,.py-md-3{padding-top:16px!important}.pr-md-3,.px-md-3{padding-right:16px!important}.pb-md-3,.py-md-3{padding-bottom:16px!important}.pl-md-3,.px-md-3{padding-left:16px!important}.p-md-4{padding:24px!important}.pt-md-4,.py-md-4{padding-top:24px!important}.pr-md-4,.px-md-4{padding-right:24px!important}.pb-md-4,.py-md-4{padding-bottom:24px!important}.pl-md-4,.px-md-4{padding-left:24px!important}.p-md-5{padding:48px!important}.pt-md-5,.py-md-5{padding-top:48px!important}.pr-md-5,.px-md-5{padding-right:48px!important}.pb-md-5,.py-md-5{padding-bottom:48px!important}.pl-md-5,.px-md-5{padding-left:48px!important}.m-md-n1{margin:-4px!important}.mt-md-n1,.my-md-n1{margin-top:-4px!important}.mr-md-n1,.mx-md-n1{margin-right:-4px!important}.mb-md-n1,.my-md-n1{margin-bottom:-4px!important}.ml-md-n1,.mx-md-n1{margin-left:-4px!important}.m-md-n2{margin:-8px!important}.mt-md-n2,.my-md-n2{margin-top:-8px!important}.mr-md-n2,.mx-md-n2{margin-right:-8px!important}.mb-md-n2,.my-md-n2{margin-bottom:-8px!important}.ml-md-n2,.mx-md-n2{margin-left:-8px!important}.m-md-n3{margin:-16px!important}.mt-md-n3,.my-md-n3{margin-top:-16px!important}.mr-md-n3,.mx-md-n3{margin-right:-16px!important}.mb-md-n3,.my-md-n3{margin-bottom:-16px!important}.ml-md-n3,.mx-md-n3{margin-left:-16px!important}.m-md-n4{margin:-24px!important}.mt-md-n4,.my-md-n4{margin-top:-24px!important}.mr-md-n4,.mx-md-n4{margin-right:-24px!important}.mb-md-n4,.my-md-n4{margin-bottom:-24px!important}.ml-md-n4,.mx-md-n4{margin-left:-24px!important}.m-md-n5{margin:-48px!important}.mt-md-n5,.my-md-n5{margin-top:-48px!important}.mr-md-n5,.mx-md-n5{margin-right:-48px!important}.mb-md-n5,.my-md-n5{margin-bottom:-48px!important}.ml-md-n5,.mx-md-n5{margin-left:-48px!important}.m-md-auto{margin:auto!important}.mt-md-auto,.my-md-auto{margin-top:auto!important}.mr-md-auto,.mx-md-auto{margin-right:auto!important}.mb-md-auto,.my-md-auto{margin-bottom:auto!important}.ml-md-auto,.mx-md-auto{margin-left:auto!important}}@media (min-width:992px){.m-lg-0{margin:0!important}.mt-lg-0,.my-lg-0{margin-top:0!important}.mr-lg-0,.mx-lg-0{margin-right:0!important}.mb-lg-0,.my-lg-0{margin-bottom:0!important}.ml-lg-0,.mx-lg-0{margin-left:0!important}.m-lg-1{margin:4px!important}.mt-lg-1,.my-lg-1{margin-top:4px!important}.mr-lg-1,.mx-lg-1{margin-right:4px!important}.mb-lg-1,.my-lg-1{margin-bottom:4px!important}.ml-lg-1,.mx-lg-1{margin-left:4px!important}.m-lg-2{margin:8px!important}.mt-lg-2,.my-lg-2{margin-top:8px!important}.mr-lg-2,.mx-lg-2{margin-right:8px!important}.mb-lg-2,.my-lg-2{margin-bottom:8px!important}.ml-lg-2,.mx-lg-2{margin-left:8px!important}.m-lg-3{margin:16px!important}.mt-lg-3,.my-lg-3{margin-top:16px!important}.mr-lg-3,.mx-lg-3{margin-right:16px!important}.mb-lg-3,.my-lg-3{margin-bottom:16px!important}.ml-lg-3,.mx-lg-3{margin-left:16px!important}.m-lg-4{margin:24px!important}.mt-lg-4,.my-lg-4{margin-top:24px!important}.mr-lg-4,.mx-lg-4{margin-right:24px!important}.mb-lg-4,.my-lg-4{margin-bottom:24px!important}.ml-lg-4,.mx-lg-4{margin-left:24px!important}.m-lg-5{margin:48px!important}.mt-lg-5,.my-lg-5{margin-top:48px!important}.mr-lg-5,.mx-lg-5{margin-right:48px!important}.mb-lg-5,.my-lg-5{margin-bottom:48px!important}.ml-lg-5,.mx-lg-5{margin-left:48px!important}.p-lg-0{padding:0!important}.pt-lg-0,.py-lg-0{padding-top:0!important}.pr-lg-0,.px-lg-0{padding-right:0!important}.pb-lg-0,.py-lg-0{padding-bottom:0!important}.pl-lg-0,.px-lg-0{padding-left:0!important}.p-lg-1{padding:4px!important}.pt-lg-1,.py-lg-1{padding-top:4px!important}.pr-lg-1,.px-lg-1{padding-right:4px!important}.pb-lg-1,.py-lg-1{padding-bottom:4px!important}.pl-lg-1,.px-lg-1{padding-left:4px!important}.p-lg-2{padding:8px!important}.pt-lg-2,.py-lg-2{padding-top:8px!important}.pr-lg-2,.px-lg-2{padding-right:8px!important}.pb-lg-2,.py-lg-2{padding-bottom:8px!important}.pl-lg-2,.px-lg-2{padding-left:8px!important}.p-lg-3{padding:16px!important}.pt-lg-3,.py-lg-3{padding-top:16px!important}.pr-lg-3,.px-lg-3{padding-right:16px!important}.pb-lg-3,.py-lg-3{padding-bottom:16px!important}.pl-lg-3,.px-lg-3{padding-left:16px!important}.p-lg-4{padding:24px!important}.pt-lg-4,.py-lg-4{padding-top:24px!important}.pr-lg-4,.px-lg-4{padding-right:24px!important}.pb-lg-4,.py-lg-4{padding-bottom:24px!important}.pl-lg-4,.px-lg-4{padding-left:24px!important}.p-lg-5{padding:48px!important}.pt-lg-5,.py-lg-5{padding-top:48px!important}.pr-lg-5,.px-lg-5{padding-right:48px!important}.pb-lg-5,.py-lg-5{padding-bottom:48px!important}.pl-lg-5,.px-lg-5{padding-left:48px!important}.m-lg-n1{margin:-4px!important}.mt-lg-n1,.my-lg-n1{margin-top:-4px!important}.mr-lg-n1,.mx-lg-n1{margin-right:-4px!important}.mb-lg-n1,.my-lg-n1{margin-bottom:-4px!important}.ml-lg-n1,.mx-lg-n1{margin-left:-4px!important}.m-lg-n2{margin:-8px!important}.mt-lg-n2,.my-lg-n2{margin-top:-8px!important}.mr-lg-n2,.mx-lg-n2{margin-right:-8px!important}.mb-lg-n2,.my-lg-n2{margin-bottom:-8px!important}.ml-lg-n2,.mx-lg-n2{margin-left:-8px!important}.m-lg-n3{margin:-16px!important}.mt-lg-n3,.my-lg-n3{margin-top:-16px!important}.mr-lg-n3,.mx-lg-n3{margin-right:-16px!important}.mb-lg-n3,.my-lg-n3{margin-bottom:-16px!important}.ml-lg-n3,.mx-lg-n3{margin-left:-16px!important}.m-lg-n4{margin:-24px!important}.mt-lg-n4,.my-lg-n4{margin-top:-24px!important}.mr-lg-n4,.mx-lg-n4{margin-right:-24px!important}.mb-lg-n4,.my-lg-n4{margin-bottom:-24px!important}.ml-lg-n4,.mx-lg-n4{margin-left:-24px!important}.m-lg-n5{margin:-48px!important}.mt-lg-n5,.my-lg-n5{margin-top:-48px!important}.mr-lg-n5,.mx-lg-n5{margin-right:-48px!important}.mb-lg-n5,.my-lg-n5{margin-bottom:-48px!important}.ml-lg-n5,.mx-lg-n5{margin-left:-48px!important}.m-lg-auto{margin:auto!important}.mt-lg-auto,.my-lg-auto{margin-top:auto!important}.mr-lg-auto,.mx-lg-auto{margin-right:auto!important}.mb-lg-auto,.my-lg-auto{margin-bottom:auto!important}.ml-lg-auto,.mx-lg-auto{margin-left:auto!important}}@media (min-width:1200px){.m-xl-0{margin:0!important}.mt-xl-0,.my-xl-0{margin-top:0!important}.mr-xl-0,.mx-xl-0{margin-right:0!important}.mb-xl-0,.my-xl-0{margin-bottom:0!important}.ml-xl-0,.mx-xl-0{margin-left:0!important}.m-xl-1{margin:4px!important}.mt-xl-1,.my-xl-1{margin-top:4px!important}.mr-xl-1,.mx-xl-1{margin-right:4px!important}.mb-xl-1,.my-xl-1{margin-bottom:4px!important}.ml-xl-1,.mx-xl-1{margin-left:4px!important}.m-xl-2{margin:8px!important}.mt-xl-2,.my-xl-2{margin-top:8px!important}.mr-xl-2,.mx-xl-2{margin-right:8px!important}.mb-xl-2,.my-xl-2{margin-bottom:8px!important}.ml-xl-2,.mx-xl-2{margin-left:8px!important}.m-xl-3{margin:16px!important}.mt-xl-3,.my-xl-3{margin-top:16px!important}.mr-xl-3,.mx-xl-3{margin-right:16px!important}.mb-xl-3,.my-xl-3{margin-bottom:16px!important}.ml-xl-3,.mx-xl-3{margin-left:16px!important}.m-xl-4{margin:24px!important}.mt-xl-4,.my-xl-4{margin-top:24px!important}.mr-xl-4,.mx-xl-4{margin-right:24px!important}.mb-xl-4,.my-xl-4{margin-bottom:24px!important}.ml-xl-4,.mx-xl-4{margin-left:24px!important}.m-xl-5{margin:48px!important}.mt-xl-5,.my-xl-5{margin-top:48px!important}.mr-xl-5,.mx-xl-5{margin-right:48px!important}.mb-xl-5,.my-xl-5{margin-bottom:48px!important}.ml-xl-5,.mx-xl-5{margin-left:48px!important}.p-xl-0{padding:0!important}.pt-xl-0,.py-xl-0{padding-top:0!important}.pr-xl-0,.px-xl-0{padding-right:0!important}.pb-xl-0,.py-xl-0{padding-bottom:0!important}.pl-xl-0,.px-xl-0{padding-left:0!important}.p-xl-1{padding:4px!important}.pt-xl-1,.py-xl-1{padding-top:4px!important}.pr-xl-1,.px-xl-1{padding-right:4px!important}.pb-xl-1,.py-xl-1{padding-bottom:4px!important}.pl-xl-1,.px-xl-1{padding-left:4px!important}.p-xl-2{padding:8px!important}.pt-xl-2,.py-xl-2{padding-top:8px!important}.pr-xl-2,.px-xl-2{padding-right:8px!important}.pb-xl-2,.py-xl-2{padding-bottom:8px!important}.pl-xl-2,.px-xl-2{padding-left:8px!important}.p-xl-3{padding:16px!important}.pt-xl-3,.py-xl-3{padding-top:16px!important}.pr-xl-3,.px-xl-3{padding-right:16px!important}.pb-xl-3,.py-xl-3{padding-bottom:16px!important}.pl-xl-3,.px-xl-3{padding-left:16px!important}.p-xl-4{padding:24px!important}.pt-xl-4,.py-xl-4{padding-top:24px!important}.pr-xl-4,.px-xl-4{padding-right:24px!important}.pb-xl-4,.py-xl-4{padding-bottom:24px!important}.pl-xl-4,.px-xl-4{padding-left:24px!important}.p-xl-5{padding:48px!important}.pt-xl-5,.py-xl-5{padding-top:48px!important}.pr-xl-5,.px-xl-5{padding-right:48px!important}.pb-xl-5,.py-xl-5{padding-bottom:48px!important}.pl-xl-5,.px-xl-5{padding-left:48px!important}.m-xl-n1{margin:-4px!important}.mt-xl-n1,.my-xl-n1{margin-top:-4px!important}.mr-xl-n1,.mx-xl-n1{margin-right:-4px!important}.mb-xl-n1,.my-xl-n1{margin-bottom:-4px!important}.ml-xl-n1,.mx-xl-n1{margin-left:-4px!important}.m-xl-n2{margin:-8px!important}.mt-xl-n2,.my-xl-n2{margin-top:-8px!important}.mr-xl-n2,.mx-xl-n2{margin-right:-8px!important}.mb-xl-n2,.my-xl-n2{margin-bottom:-8px!important}.ml-xl-n2,.mx-xl-n2{margin-left:-8px!important}.m-xl-n3{margin:-16px!important}.mt-xl-n3,.my-xl-n3{margin-top:-16px!important}.mr-xl-n3,.mx-xl-n3{margin-right:-16px!important}.mb-xl-n3,.my-xl-n3{margin-bottom:-16px!important}.ml-xl-n3,.mx-xl-n3{margin-left:-16px!important}.m-xl-n4{margin:-24px!important}.mt-xl-n4,.my-xl-n4{margin-top:-24px!important}.mr-xl-n4,.mx-xl-n4{margin-right:-24px!important}.mb-xl-n4,.my-xl-n4{margin-bottom:-24px!important}.ml-xl-n4,.mx-xl-n4{margin-left:-24px!important}.m-xl-n5{margin:-48px!important}.mt-xl-n5,.my-xl-n5{margin-top:-48px!important}.mr-xl-n5,.mx-xl-n5{margin-right:-48px!important}.mb-xl-n5,.my-xl-n5{margin-bottom:-48px!important}.ml-xl-n5,.mx-xl-n5{margin-left:-48px!important}.m-xl-auto{margin:auto!important}.mt-xl-auto,.my-xl-auto{margin-top:auto!important}.mr-xl-auto,.mx-xl-auto{margin-right:auto!important}.mb-xl-auto,.my-xl-auto{margin-bottom:auto!important}.ml-xl-auto,.mx-xl-auto{margin-left:auto!important}}.text-monospace{font-family:Roboto Mono,monospace!important}.text-justify{text-align:justify!important}.text-wrap{white-space:normal!important}.text-nowrap{white-space:nowrap!important}.text-truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.text-left{text-align:left!important}.text-right{text-align:right!important}.text-center{text-align:center!important}@media (min-width:576px){.text-sm-left{text-align:left!important}.text-sm-right{text-align:right!important}.text-sm-center{text-align:center!important}}@media (min-width:768px){.text-md-left{text-align:left!important}.text-md-right{text-align:right!important}.text-md-center{text-align:center!important}}@media (min-width:992px){.text-lg-left{text-align:left!important}.text-lg-right{text-align:right!important}.text-lg-center{text-align:center!important}}@media (min-width:1200px){.text-xl-left{text-align:left!important}.text-xl-right{text-align:right!important}.text-xl-center{text-align:center!important}}.text-lowercase{text-transform:lowercase!important}.text-uppercase{text-transform:uppercase!important}.text-capitalize{text-transform:capitalize!important}.font-weight-light{font-weight:300!important}.font-weight-lighter{font-weight:lighter!important}.font-weight-normal{font-weight:400!important}.font-weight-bold{font-weight:700!important}.font-weight-bolder{font-weight:bolder!important}.font-italic{font-style:italic!important}.text-white{color:#fff!important}.text-primary{color:#004d99!important}a.text-primary:focus,a.text-primary:hover{color:#004080!important}.text-secondary{color:#3d4955!important}a.text-secondary:focus,a.text-secondary:hover{color:#323c46!important}.text-success{color:#008053!important}a.text-success:focus,a.text-success:hover{color:#006642!important}.text-info{color:#717273!important}a.text-info:focus,a.text-info:hover{color:#646566!important}.text-warning{color:#a36200!important}a.text-warning:focus,a.text-warning:hover{color:#995c00!important}.text-danger{color:#e00929!important}a.text-danger:focus,a.text-danger:hover{color:#c70825!important}.text-light{color:#bdb4d8!important}a.text-light:focus,a.text-light:hover{color:#aea3d0!important}.text-dark{color:#050b12!important}a.text-dark:focus,a.text-dark:hover{color:#000!important}.text-100{color:#bbbdc1!important}a.text-100:focus,a.text-100:hover{color:#aeb0b5!important}.text-200{color:#a3a4a7!important}a.text-200:focus,a.text-200:hover{color:#96979a!important}.text-300{color:#8a8b8d!important}a.text-300:focus,a.text-300:hover{color:#7d7e80!important}.text-400{color:#717273!important}a.text-400:focus,a.text-400:hover{color:#646566!important}.text-500{color:#585859!important}a.text-500:focus,a.text-500:hover{color:#4b4c4c!important}.text-600{color:#3f3f40!important}a.text-600:focus,a.text-600:hover{color:#323233!important}.text-700{color:#262626!important}a.text-700:focus,a.text-700:hover{color:#191919!important}.text-800{color:#0c0c0d!important}.text-900,a.text-800:focus,a.text-800:hover,a.text-900:focus,a.text-900:hover{color:#000!important}.text-body{color:#19191a!important}.text-muted{color:#5a768a!important}.text-black-50{color:rgba(0,0,0,.5)!important}.text-white-50{color:hsla(0,0%,100%,.5)!important}.text-hide{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.text-decoration-none{text-decoration:none!important}.text-break{word-break:break-word!important;overflow-wrap:break-word!important}.text-reset{color:inherit!important}.visible{visibility:visible!important}.invisible{visibility:hidden!important}body,html{font-size:16px;line-height:1.5}@media (min-width:576px){body,html{font-size:18px;line-height:1.555}}.h1,h1{letter-spacing:-1px}@media (min-width:576px){.h1,h1{font-size:2.666rem;letter-spacing:-1.3px;line-height:1.25}}.h2,h2{line-height:1.25}@media (min-width:576px){.h2,h2{font-size:2.222rem;line-height:1.2;letter-spacing:-2px}}.h3,h3{line-height:1.1428}@media (min-width:576px){.h3,h3{font-size:1.777rem;line-height:1.25}}.h4,h4{line-height:1.1666}@media (min-width:576px){.h4,h4{font-size:1.555rem;line-height:1.428;font-weight:600}}.h5,h5{font-weight:400}@media (min-width:576px){.h5,h5{font-size:1.333rem}}.h6,h6{font-weight:600;line-height:1.5}.display-1{font-size:49.776px;font-size:3.111rem}@media (min-width:576px){.display-1{font-size:3.111rem;line-height:1.428}}.blockquote,blockquote{font-family:Lora,Georgia,serif;margin:1.5rem 0}caption{font-size:12.432px;font-size:.777rem;line-height:1.4285}b,strong{font-weight:600}.small,small{font-size:15px;font-size:.9375rem;font-weight:400}@media (min-width:576px){.small,small{font-size:.8888rem}}.x-small{font-size:14px;font-size:.875rem;font-weight:400}@media (min-width:576px){.x-small{font-size:.7777rem}}.blockquote-footer{color:#656566}.bg-dark .blockquote-footer{color:#979899}.row.variable-gutters{margin-right:-6px;margin-left:-6px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:6px;padding-left:6px}@media (min-width:576px){.row.variable-gutters{margin-right:-6px;margin-left:-6px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:6px;padding-left:6px}}@media (min-width:768px){.row.variable-gutters{margin-right:-10px;margin-left:-10px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:10px;padding-left:10px}}@media (min-width:992px){.row.variable-gutters{margin-right:-10px;margin-left:-10px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:10px;padding-left:10px}}@media (min-width:1200px){.row.variable-gutters{margin-right:-14px;margin-left:-14px}.row.variable-gutters>.col,.row.variable-gutters>[class*=col-]{padding-right:14px;padding-left:14px}}.table td,.table th{text-align:left;border-bottom:1px solid #d6dce3;border-top:none}.breadcrumb-container .breadcrumb{padding:24px;border-radius:0}.breadcrumb-container .breadcrumb .breadcrumb-item{padding-left:0}.breadcrumb-container .breadcrumb .breadcrumb-item+.breadcrumb-item:before{display:none}.breadcrumb-container .breadcrumb .breadcrumb-item i{padding-right:.5em}.breadcrumb-container .breadcrumb .breadcrumb-item a{color:#5b6f82;font-weight:600}.breadcrumb-container .breadcrumb .breadcrumb-item.active a{font-weight:400;pointer-events:none}.breadcrumb-container .breadcrumb .breadcrumb-item span.separator{display:inline-block;font-weight:600;padding:0 .5em}.breadcrumb-container .breadcrumb.dark{background:#435a70}.breadcrumb-container .breadcrumb.dark .breadcrumb-item a,.breadcrumb-container .breadcrumb.dark .breadcrumb-item span.separator{color:#fff}.breadcrumb-container .breadcrumb.dark .breadcrumb-item i{color:#0bd9d2}.modal-content,.modal-header{border-radius:0}[data-toggle=collapse] .collapse-icon:before{content:"";display:inline-block;width:0;height:0;border-top:.5rem solid;border-right:.5rem solid transparent;border-bottom:0;border-left:.5rem solid transparent;vertical-align:3px;vertical-align:.1875rem}[data-toggle=collapse].collapsed .collapse-icon:before{-webkit-transform:rotate(180deg);transform:rotate(180deg)}.collapse-div{border-bottom:1px solid #e3e4e6}.collapse-div .collapse-div{border:1px solid #e3e4e6;border-top:0}.collapse-header{position:relative}.collapse-header [data-toggle=collapse]{width:100%;text-align:left;border:0;background-color:transparent;border-top:1px solid #e3e4e6;padding:14px 24px;cursor:pointer;color:#5c6f82;font-weight:600}.collapse-header [data-toggle=collapse][aria-expanded=false]{color:#0073e6}.collapse-header [data-toggle=collapse][aria-expanded=false]:after{content:"\e818"}.collapse-header [data-toggle=collapse][aria-expanded=true]:before{height:2px;width:56px;border-radius:2px;background-color:#0073e6;position:absolute;top:0;display:block;content:"";left:20px}.collapse-header [data-toggle=collapse][aria-expanded=false]:hover:after,.collapse-header [data-toggle=collapse][aria-expanded=true]:hover:after{text-decoration:none}.collapse-header [data-toggle=collapse]:after{content:"\e810";font-family:italia-icon-font;font-style:normal;font-weight:400;float:right;text-decoration:inherit;width:1em;margin-right:.2em;margin-top:5px;text-align:center;font-variant:normal;text-transform:none;line-height:1em}.collapse-header [data-toggle=collapse]:hover{background-color:#e6ecf2;text-decoration:underline}.collapse-header [data-toggle=collapse]:active{background-color:#0073e6;color:#fff;border-color:#0073e6}.collapse-body{padding:12px 24px 42px}.collapse-body .collapse-header button[aria-expanded=true]:before{height:0;width:0}.carousel{background-color:#444e57;padding:3.5em 3em 3em}.carousel-control-next,.carousel-control-prev{top:1em;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start}.carousel-control-prev{left:auto;right:6em}.carousel-control-next{right:3em}.carousel-caption{position:static;padding-bottom:0}.carousel-indicators li{background-color:rgba(101,220,223,.5)}.carousel-indicators .active{background-color:#5c6f82}.list-group-item{padding:1rem}.list-group-item.disabled,.list-group-item:disabled{cursor:default}.list-group-item-action:focus,.list-group-item-action:hover{text-decoration:underline;background-color:#d9e6f2}.list-group-item-action.disabled:focus,.list-group-item-action.disabled:hover,.list-group-item-action:disabled:focus,.list-group-item-action:disabled:hover{text-decoration:none;background-color:transparent;border-top-color:transparent}.list-group-item.active:focus,.list-group-item.active:hover{background-color:#0073e6}.alert{position:relative;margin-bottom:1rem;border:1px solid #b1b1b3;padding:1rem 1rem 1rem 4em}.alert-heading{color:inherit}.alert-link{font-weight:700}.alert-dismissible{padding-right:3.5rem}.alert-dismissible .close{position:absolute;top:0;right:0;padding:.8rem 1rem;color:inherit}.alert-success{border-left:8px solid #00cc85}.alert-info,.alert-success{background-position:1em .8em;background-repeat:no-repeat}.alert-info{border-left:8px solid #979899}.alert-warning{border-left:8px solid #f90}.alert-danger,.alert-warning{background-position:1em .8em;background-repeat:no-repeat}.alert-danger{border-left:8px solid #f73e5a;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M16 1.6C24 1.6 30.4 8 30.4 16S24 30.4 16 30.4 1.6 24 1.6 16 8 1.6 16 1.6zM16 0C7.2 0 0 7.2 0 16s7.2 16 16 16 16-7.2 16-16S24.8 0 16 0z'/%3E%3Cpath d='M14.4 24c0-.96.64-1.6 1.6-1.6s1.6.64 1.6 1.6c0 .96-.64 1.6-1.6 1.6s-1.6-.64-1.6-1.6zm.64-3.2l-.32-14.4h2.56l-.32 14.4z'/%3E%3C/svg%3E")}.alert-warning{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M14.333 26c0-1 .667-1.667 1.667-1.667S17.667 25 17.667 26 17 27.667 16 27.667 14.333 27 14.333 26zM15 22.667l-.333-15h2.667l-.333 15z'/%3E%3Cpath d='M16 2.667c1 0 2 .5 2.5 1.333l10.333 20.833c.5.833.5 2 0 2.833s-1.5 1.5-2.5 1.5H5.666c-1 0-2-.5-2.5-1.5-.5-.833-.5-2 0-2.833L13.499 4c.5-.833 1.5-1.333 2.5-1.333zM16 1c-1.5 0-3 .833-4 2.333L1.667 24.166c-1.667 3 .5 6.833 4 6.833h20.667c3.5 0 5.667-3.833 4-6.833L20.001 3.333c-1-1.667-2.5-2.333-4-2.333z'/%3E%3C/svg%3E")}.alert-success{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M32 6.682l-2.824-2.635-18.447 18.635-8.094-8.094L0 17.412l8.094 7.906h-.188l2.824 2.635 2.635-2.635z'/%3E%3C/svg%3E")}.alert-info{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32'%3E%3Cpath d='M16 1.6C24 1.6 30.4 8 30.4 16S24 30.4 16 30.4 1.6 24 1.6 16 8.16 1.6 16 1.6zM16 0C7.2 0 0 7.2 0 16s7.2 16 16 16 16-7.2 16-16S24.8 0 16 0z'/%3E%3Cpath d='M14.72 9.76V6.72h2.88v3.04h-2.88zm0 15.84V12h2.88v13.6h-2.88z'/%3E%3C/svg%3E")}.btn{padding:12px 24px;font-size:16px;white-space:normal}.btn-group-lg>.btn,.btn-group-sm>.btn,.btn-lg,.btn-sm,.btn-xs{border-radius:4px;line-height:1.5}.btn-xs{padding:8px;font-size:14px;line-height:1.428}.btn-group-sm>.btn,.btn-sm{padding:10px 20px;font-size:14px;line-height:1.428}.btn-group-lg>.btn,.btn-lg{padding:14px 28px;font-size:18px;line-height:1.556}.btn-block{border-radius:0}.btn-primary.disabled,.btn-primary:disabled{color:#bfc2c9;background-color:#e6e9f2;border-color:#dfe4f2}.btn-outline-secondary{background:#fcfdff;-webkit-box-shadow:inset 0 0 0 1px #e6e9f2;box-shadow:inset 0 0 0 1px #e6e9f2}.btn-outline-secondary:hover{-webkit-box-shadow:inset 0 0 0 1px #c9cedc;box-shadow:inset 0 0 0 1px #c9cedc}.bg-dark .btn-link{color:#fff}.bg-dark .btn-primary{color:#19191a;background-color:#fff;border-color:#0073e6;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);color:#0073e6}.bg-dark .btn-primary:hover{color:#19191a;background-color:#fff;border-color:#0059b3}.bg-dark .btn-primary.focus,.bg-dark .btn-primary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem rgba(0,115,230,.5)}.bg-dark .btn-primary.disabled,.bg-dark .btn-primary:disabled{color:#19191a;background-color:#fff;border-color:#0073e6}.bg-dark .btn-primary:not(:disabled):not(.disabled).active,.bg-dark .btn-primary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-primary.dropdown-toggle{color:#19191a;background-color:#fff;border-color:#0053a6}.bg-dark .btn-primary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-primary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem rgba(0,115,230,.5)}.bg-dark .btn-primary.disabled,.bg-dark .btn-primary:disabled,.bg-dark .btn-primary:hover{color:#0059b3}.bg-dark .btn-outline-primary{color:#fff;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #fff;box-shadow:inset 0 0 0 1px #fff;-webkit-box-shadow:inset 0 0 0 2px #fff;box-shadow:inset 0 0 0 2px #fff}.bg-dark .btn-outline-primary:hover{color:#e6e6e6;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-primary.focus,.bg-dark .btn-outline-primary:focus{-webkit-box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-primary.disabled,.bg-dark .btn-outline-primary:disabled{color:#fff;background-color:transparent}.bg-dark .btn-outline-primary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-primary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-primary.dropdown-toggle{color:#e6e6e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-primary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-outline-primary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-outline-primary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-primary:hover{-webkit-box-shadow:inset 0 0 0 2px #e6e6e6;box-shadow:inset 0 0 0 2px #e6e6e6}.bg-dark .btn-outline-primary.focus,.bg-dark .btn-outline-primary:focus{-webkit-box-shadow:inset 0 0 0 2px #fff,0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 0 0 2px #fff,0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-primary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-primary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-primary.dropdown-toggle{-webkit-box-shadow:inset 0 0 0 2px #fff;box-shadow:inset 0 0 0 2px #fff}.bg-dark .btn-secondary{background-color:#0073e6;border-color:#fff;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075);color:#fff}.bg-dark .btn-secondary:hover{color:#fff;background-color:#0d86ff;border-color:#e6e6e6}.bg-dark .btn-secondary.focus,.bg-dark .btn-secondary:focus{-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.15),0 1px 1px rgba(0,0,0,.075),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-secondary.disabled,.bg-dark .btn-secondary:disabled{color:#fff;background-color:#0073e6;border-color:#fff}.bg-dark .btn-secondary:not(:disabled):not(.disabled).active,.bg-dark .btn-secondary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-secondary.dropdown-toggle{color:#fff;background-color:#1a8cff;border-color:#dfdfdf}.bg-dark .btn-secondary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-secondary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary{color:#fff;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #fff;box-shadow:inset 0 0 0 1px #fff;-webkit-box-shadow:none;box-shadow:none}.bg-dark .btn-outline-secondary:hover{color:#e6e6e6;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-secondary.focus,.bg-dark .btn-outline-secondary:focus{-webkit-box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 0 0 1px #e6e6e6,0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary.disabled,.bg-dark .btn-outline-secondary:disabled{color:#fff;background-color:transparent}.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-secondary.dropdown-toggle{color:#e6e6e6;background-color:transparent;background-image:none;-webkit-box-shadow:inset 0 0 0 1px #e6e6e6;box-shadow:inset 0 0 0 1px #e6e6e6}.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled).active:focus,.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled):active:focus,.show>.bg-dark .btn-outline-secondary.dropdown-toggle:focus{-webkit-box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:inset 0 3px 5px rgba(0,0,0,.125),0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary:hover{-webkit-box-shadow:none;box-shadow:none}.bg-dark .btn-outline-secondary.focus,.bg-dark .btn-outline-secondary:focus{-webkit-box-shadow:0 0 0 .2rem hsla(0,0%,100%,.5);box-shadow:0 0 0 .2rem hsla(0,0%,100%,.5)}.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled).active,.bg-dark .btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.bg-dark .btn-outline-secondary.dropdown-toggle{-webkit-box-shadow:none;box-shadow:none}.form-group{position:relative;margin-bottom:4px;padding:1.5rem 0 1rem}.form-group button,.form-group input,.form-group optgroup,.form-group select,.form-group textarea{color:#17324d}.form-group label{position:absolute;color:#5c6f82;font-weight:600;line-height:40px;line-height:2.5rem;-webkit-transition:.2s ease-out;transition:.2s ease-out;top:24px;top:1.5rem;font-size:16px;font-size:1rem;cursor:text;display:block;width:100%;padding:0 .75rem;z-index:6}.form-group small.form-text{position:absolute;margin:0;padding:0 .75rem;font-size:12.432px;font-size:.777rem}.form-group.active label{-webkit-transform:translateY(-75%);transform:translateY(-75%);font-size:12.432px;font-size:.777rem}.form-group.active .ico-prefix,.form-group.active label{color:#5c6f82}.form-row .form-group{padding-bottom:0}input[type=date],input[type=datetime-local],input[type=email],input[type=number],input[type=password],input[type=search],input[type=tel],input[type=text],input[type=time],input[type=url],select,textarea{border:none;border-bottom:1px solid #5c6f82;border-radius:0;outline:0;height:40px;height:2.5rem;width:100%;-webkit-box-shadow:none;box-shadow:none;-webkit-transition:all .3s;transition:all .3s;font-weight:700}select,textarea{border:1px solid #5c6f82}input[type=file]+label{background-color:transparent}.form-control-plaintext+label,.form-group input.form-control-file+label,.form-group label.active,.form-group select.form-control+label,.input-group+label,.input-group~label,:disabled .form-group label{-webkit-transform:translateY(-75%);transform:translateY(-75%);font-size:12.432px;font-size:.777rem;background:transparent}:disabled .form-group label{top:0}.form-group.active .form-file-name{padding-bottom:1.95rem}.form-control-plaintext{padding:.375rem .75rem;background-color:#fff}.form-control:active,.form-control:focus{-webkit-box-shadow:none!important;box-shadow:none!important}.custom-select.is-valid,.form-control.is-valid,.was-validated .custom-select:valid,.was-validated .form-control:valid{background-position:100%!important;background-repeat:no-repeat!important;background-size:45px 45%!important;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%2300cc85' viewBox='0 0 192 512'%3E%3Cpath d='M435.848 83.466L172.804 346.51l-96.652-96.652c-4.686-4.686-12.284-4.686-16.971 0l-28.284 28.284c-4.686 4.686-4.686 12.284 0 16.971l133.421 133.421c4.686 4.686 12.284 4.686 16.971 0l299.813-299.813c4.686-4.686 4.686-12.284 0-16.971l-28.284-28.284c-4.686-4.686-12.284-4.686-16.97 0z'/%3E%3C/svg%3E")}.custom-select.is-invalid,.form-control.is-invalid,.was-validated .custom-select:invalid,.was-validated .form-control:invalid{background-position:100%!important;background-repeat:no-repeat!important;background-size:45px 45%!important;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f73e5a' viewBox='0 0 384 512'%3E%3Cpath d='M231.6 256l130.1-130.1c4.7-4.7 4.7-12.3 0-17l-22.6-22.6c-4.7-4.7-12.3-4.7-17 0L192 216.4 61.9 86.3c-4.7-4.7-12.3-4.7-17 0l-22.6 22.6c-4.7 4.7-4.7 12.3 0 17L152.4 256 22.3 386.1c-4.7 4.7-4.7 12.3 0 17l22.6 22.6c4.7 4.7 12.3 4.7 17 0L192 295.6l130.1 130.1c4.7 4.7 12.3 4.7 17 0l22.6-22.6c4.7-4.7 4.7-12.3 0-17L231.6 256z'/%3E%3C/svg%3E")}.custom-select.warning,.form-control.warning{background-position:100%!important;background-repeat:no-repeat!important;background-size:25px 45%!important;border-color:#f90;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23f90' viewBox='0 0 192 512'%3E%3Cpath d='M176 432c0 44.112-35.888 80-80 80s-80-35.888-80-80 35.888-80 80-80 80 35.888 80 80zM25.26 25.199l13.6 272C39.499 309.972 50.041 320 62.83 320h66.34c12.789 0 23.331-10.028 23.97-22.801l13.6-272C167.425 11.49 156.496 0 142.77 0H49.23C35.504 0 24.575 11.49 25.26 25.199z'/%3E%3C/svg%3E")}.custom-select.is-valid~.warning-feedback,.form-control.is-valid~.warning-feedback{display:block}.warning-feedback{display:none;width:100%;margin-top:.25rem;font-size:12.432px;font-size:.777rem;color:#f90}.invalid-feedback,.valid-feedback,.warning-feedback{margin-left:.75rem}.form-file input[type=file]{filter:alpha(opacity=0);margin:0;max-width:100%;opacity:0}.form-file .form-file-name{border-bottom:1px solid rgba(0,0,0,.15);border-radius:0;color:#464a4c;left:0;overflow:hidden;padding:.5rem .6rem 2rem;max-height:32px;max-height:2rem;pointer-events:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;z-index:5}.form-file .form-file-name,.form-file .form-file-name:before{background-color:#fff;line-height:1.7;position:absolute;right:0;top:0}.form-file .form-file-name:before{bottom:-1px;color:#0073e6;content:"Sfoglia";display:block;height:40px;height:2.5rem;padding:.4rem 1rem 1.5rem;border:1px solid #0073e6;z-index:6;border-top-right-radius:4px}.input-group-text{background-color:#f8f8f8;border:0;border-radius:0!important;border-bottom:1px solid #555}.input-group-prepend{margin-right:0}.input-group-append{margin-left:0}.input-group-lg>.form-control,.input-group-lg>.input-group-append>.btn,.input-group-lg>.input-group-append>.input-group-text,.input-group-lg>.input-group-prepend>.btn,.input-group-lg>.input-group-prepend>.input-group-text{padding:0 1rem;border-radius:0}.ico-prefix{position:absolute;width:48px;width:3rem;font-size:28.8px;font-size:1.8rem;z-index:10;text-align:center}.ico-prefix~.form-file-name{padding-left:3.5rem}.ico-prefix~.select-wrapper .select-dropdown,.ico-prefix~input,.ico-prefix~label,.ico-prefix~textarea{padding-left:3rem}.form-group.active .ico-prefix~label,.ico-prefix~.custom-select~label,.ico-prefix~label.active{padding-left:.75rem}.form-group .form-check,.form-row .form-check,.row .form-check{padding-left:0;margin-top:1rem}.form-check [type=checkbox],.form-check [type=radio]{position:absolute;left:-9999px}.form-check [type=checkbox]+label,.form-check [type=radio]+label{position:relative;padding-left:36px;cursor:pointer;display:inline-block;height:32px;line-height:32px;font-size:16px;font-size:1rem;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.form-check [type=checkbox]+label:after,.form-check [type=checkbox]+label:before{content:"";left:0;position:absolute;-webkit-transition:.2s;transition:.2s;z-index:1;border-style:solid;border-width:2px}.form-check [type=checkbox]+label:before{top:0;width:17px;height:17px;border:1px solid #e6e9f2;border-radius:1px;margin:2px 5px;-webkit-transform:rotate(37deg);transform:rotate(37deg);-webkit-transform-origin:100% 100%;transform-origin:100% 100%}.form-check [type=checkbox]+label:after{border-radius:4px;height:20px;width:20px;margin:6px 5px;top:0}.form-check [type=checkbox]:checked+label:before{top:6px;left:1px;width:8px;height:13px;border-color:transparent #fff #fff transparent;border-style:solid;border-width:2px;-webkit-transform:rotate(40deg);transform:rotate(40deg);-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-transform-origin:100% 100%;transform-origin:100% 100%;opacity:.8}.form-check [type=checkbox]:checked+label:after{border-color:#0073e6;background-color:#0073e6;z-index:0}.form-check [type=checkbox]:not(:checked)+label:after{background-color:transparent;border-color:#5c6f82;z-index:0}.form-check [type=checkbox]:not(:checked)+label:before{width:0;height:0;border-color:transparent;left:6px;top:10px}.form-check [type=checkbox]:disabled+label{cursor:not-allowed}.form-check [type=checkbox]:disabled:not(:checked)+label:after{border-color:#e6e9f2;background-color:#fff}.form-check [type=checkbox]:disabled:checked+label:after{background-color:#e6e9f2;border-color:#e6e9f2}.form-check [type=radio]+label{-webkit-transition:.2s ease;transition:.2s ease}.form-check [type=radio]+label:after,.form-check [type=radio]+label:before{content:"";position:absolute;left:0;top:0;margin:5px;width:22px;height:22px;z-index:0;border-radius:50%;border-style:solid;border-width:2px;-webkit-transition:.2s ease;transition:.2s ease}.form-check [type=radio]:not(:checked)+label:after,.form-check [type=radio]:not(:checked)+label:before{border-color:#5c6f82}.form-check [type=radio]:not(:checked)+label:after{z-index:-1;-webkit-transform:scale(0);transform:scale(0)}.form-check [type=radio]:checked+label:after{border-color:#0073e6;background-color:#0073e6;z-index:0;-webkit-transform:scale(.64);transform:scale(.64)}.form-check [type=radio]:checked+label:before{border-color:#0073e6}.form-check [type=radio]:disabled+label{cursor:not-allowed}.form-check [type=radio]:disabled:not(:checked)+label:after,.form-check [type=radio]:disabled:not(:checked)+label:before{border-color:#e6e9f2}.form-check [type=radio]:disabled:checked+label:after{border-color:#e6e9f2;background-color:#e6e9f2}.form-check [type=radio]:disabled:checked+label:before{border-color:#e6e9f2}.form-check.form-check-group{padding:0 0 8px;margin-bottom:16px;-webkit-box-shadow:inset 0 -1px 0 0 rgba(1,1,1,.1);box-shadow:inset 0 -1px 0 0 rgba(1,1,1,.1)}.form-check.form-check-group [type=checkbox]+label,.form-check.form-check-group [type=radio]+label{position:static;padding-left:8px;padding-right:52px}.form-check.form-check-group [type=checkbox]+label:after,.form-check.form-check-group [type=checkbox]+label:before,.form-check.form-check-group [type=radio]+label:after,.form-check.form-check-group [type=radio]+label:before{right:15px;left:auto}.form-check.form-check-group [type=checkbox]:checked+label:before{right:26px}.form-check.form-check-group [type=radio]:checked+label:before{right:15px}.form-check.form-check-group .form-text{opacity:.6;margin:0;padding-left:8px;padding-right:52px}.toggles,.toggles *{-webkit-appearance:none;-moz-appearance:none;appearance:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.toggles label{cursor:pointer;width:100%;margin:0 8px 8px;height:32px;line-height:32px;font-weight:700}.toggles label input[type=checkbox]{opacity:0;width:0;height:0}.toggles label input[type=checkbox]+.lever{content:"";position:relative;width:46px;height:16px;background-color:#e6e9f2;border-radius:10px;-webkit-transition:background .3s ease;transition:background .3s ease;vertical-align:middle;float:right;margin:8px 16px 0}.toggles label input[type=checkbox]+.lever:after,.toggles label input[type=checkbox]+.lever:before{content:"";position:absolute;display:inline-block;width:26px;height:26px;border-radius:50%;left:0;top:-5px;left:-3px;-webkit-transition:left .3s ease,background .1s ease,-webkit-transform .1s ease;transition:left .3s ease,background .1s ease,-webkit-transform .1s ease;transition:left .3s ease,background .1s ease,transform .1s ease;transition:left .3s ease,background .1s ease,transform .1s ease,-webkit-transform .1s ease}.toggles label input[type=checkbox]+.lever:before{background-color:rgba(0,115,230,.15)}.toggles label input[type=checkbox]+.lever:after{background-color:#5c6f82;background-size:10px 10px;background-repeat:no-repeat;background-position:50%;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg width='10' height='10' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M6.364 4.95l3.535 3.535L8.485 9.9 4.95 6.364 1.414 9.899 0 8.485 3.536 4.95 0 1.414 1.414 0 4.95 3.536 8.485 0 9.9 1.414 6.364 4.95z' fill='%23FFF' fill-rule='evenodd' opacity='.8'/%3E%3C/svg%3E");border:2px solid #fff}.toggles label input[type=checkbox]:checked+.lever{background-color:#e6e9f2}.toggles label input[type=checkbox]:checked+.lever:after,.toggles label input[type=checkbox]:checked+.lever:before{left:23px}.toggles label input[type=checkbox]:checked+.lever:after{background-color:#0073e6;background-size:14px 14px;background-repeat:no-repeat;background-position:50%;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg width='14' height='11' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M4.879 7.536l7.07-7.072 1.415 1.415-7.071 7.07-1.414 1.415L.636 6.121 2.05 4.707 4.88 7.536z' fill='%23FFF' fill-rule='evenodd' opacity='.5'/%3E%3C/svg%3E")}.toggles label input[type=checkbox][disabled]+.lever{cursor:default;background-color:#e6e9f2}.toggles label input[type=checkbox][disabled]+.lever:after,.toggles label input[type=checkbox][disabled]:checked+.lever:after{background-color:#e6e9f2}.select-wrapper{position:relative}.select-wrapper .search-wrap input{width:100%;border:none;border-bottom:1px solid #0073e6;font-size:14.4px;font-size:.9rem;padding:0 .5em}.select-wrapper .dropdown-menu{background-color:#fff;border-radius:0;-webkit-box-shadow:0 2px 4px 3px rgba(0,0,0,.1);box-shadow:0 2px 4px 3px rgba(0,0,0,.1);margin:0;display:none;min-width:100px;max-height:240px;overflow-y:auto;position:absolute;padding:.3rem;z-index:999;will-change:width,height;list-style-type:none;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;width:100%}.select-wrapper .dropdown-menu.show{display:block}.select-wrapper .dropdown-menu li{clear:both;color:#000;cursor:pointer;line-height:32px;width:100%;text-align:left;text-transform:none}.select-wrapper .dropdown-menu li.optgroup>span{color:#ccc;padding:0}.select-wrapper .dropdown-menu li:not(.disabled):focus,.select-wrapper .dropdown-menu li:not(.disabled):hover{background-color:#eee}.select-wrapper .dropdown-menu li.active>span:after{content:"";background-image:url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1MTIiIGhlaWdodD0iNTEyIiB2aWV3Qm94PSIwIDAgNDQ4LjggNDQ4LjgiPjxwYXRoIGZpbGw9IiMwMDZERjAiIGQ9Ik0xNDIuOCAzMjMuODVMMzUuNyAyMTYuNzUgMCAyNTIuNDVsMTQyLjggMTQyLjggMzA2LTMwNi0zNS43LTM1Ljd6Ii8+PC9zdmc+");background-size:16px 16px;background-repeat:no-repeat;background-position:50%;float:right;display:block;height:32px;width:16px;opacity:.5}.select-wrapper .dropdown-menu li>a,.select-wrapper .dropdown-menu li>span{font-size:14px;color:#5c6f82;font-weight:600;display:block;padding:0 .5rem}.select-wrapper .dropdown-menu li>a.filtrable label,.select-wrapper .dropdown-menu li>a [type=checkbox],.select-wrapper .dropdown-menu li>span.filtrable label,.select-wrapper .dropdown-menu li>span [type=checkbox]{display:none}.select-wrapper .dropdown-menu li.disabled>span{cursor:unset;color:#ccc}.select-wrapper .dropdown-menu li>a>i{height:inherit;line-height:inherit}.select-wrapper .select-dropdown{color:#17324d;border-bottom:1px solid #5c6f82;position:relative;cursor:pointer;background-color:transparent;outline:0;width:100%;font-size:16px;font-size:1rem;margin:0 0 15px;display:block;line-height:24px;padding:12px 38px 12px 16px}.select-wrapper .select-dropdown:disabled{color:rgba(0,0,0,.3);border-bottom-color:rgba(0,0,0,.3);cursor:default}.select-wrapper .select-dropdown ul{list-style-type:none;padding:0}.select-wrapper .select-dropdown ul li.disabled,.select-wrapper .select-dropdown ul li.disabled>span,.select-wrapper .select-dropdown ul li.optgroup{color:rgba(0,0,0,.3);background-color:transparent!important;cursor:context-menu}.select-wrapper .select-dropdown ul li.optgroup{border-top:1px solid #eee}.select-wrapper .select-dropdown ul li.optgroup.selected>span{color:rgba(0,0,0,.7)}.select-wrapper .select-dropdown ul li.optgroup>span{color:rgba(0,0,0,.4)}.select-wrapper .caret{color:#757575;position:absolute;right:12px;line-height:16px;top:calc(50% - 8px)}.select-wrapper .caret .disabled{color:rgba(0,0,0,.46)}.select-wrapper.show .select-dropdown{color:#0073e6;border-bottom:1px solid #0073e6}.select-wrapper.show .caret{color:#0073e6}.select-wrapper+label{padding:0 .75rem!important;position:absolute;top:-18px;font-size:12.8px;font-size:.8rem}.select-wrapper select.custom-select{display:none!important}.select-wrapper select:disabled{color:rgba(0,0,0,.3)}.btn-eye{background-position:50%!important;background-repeat:no-repeat!important;width:28px;height:22px;position:absolute;right:8px;right:.5rem;top:36px;top:2.25rem;z-index:10;color:#5c6f82;cursor:pointer}.eye-on{background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 576 512'%3E%3Cpath d='M272.702 359.139c-80.483-9.011-136.212-86.886-116.93-167.042l116.93 167.042zM288 392c-102.556 0-192.092-54.701-240-136 21.755-36.917 52.1-68.342 88.344-91.658l-27.541-39.343C67.001 152.234 31.921 188.741 6.646 231.631a47.999 47.999 0 0 0 0 48.739C63.004 376.006 168.14 440 288 440a332.89 332.89 0 0 0 39.648-2.367l-32.021-45.744A284.16 284.16 0 0 1 288 392zm281.354-111.631c-33.232 56.394-83.421 101.742-143.554 129.492l48.116 68.74c3.801 5.429 2.48 12.912-2.949 16.712L450.23 509.83c-5.429 3.801-12.912 2.48-16.712-2.949L102.084 33.399c-3.801-5.429-2.48-12.912 2.949-16.712L125.77 2.17c5.429-3.801 12.912-2.48 16.712 2.949l55.526 79.325C226.612 76.343 256.808 72 288 72c119.86 0 224.996 63.994 281.354 159.631a48.002 48.002 0 0 1 0 48.738zM528 256c-44.157-74.933-123.677-127.27-216.162-135.007C302.042 131.078 296 144.83 296 160c0 30.928 25.072 56 56 56s56-25.072 56-56l-.001-.042c30.632 57.277 16.739 130.26-36.928 171.719l26.695 38.135C452.626 346.551 498.308 306.386 528 256z'/%3E%3C/svg%3E")}.eye-off{background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%235c6f82' viewBox='0 0 576 512'%3E%3Cpath d='M569.354 231.631C512.97 135.949 407.81 72 288 72 168.14 72 63.004 135.994 6.646 231.631a47.999 47.999 0 0 0 0 48.739C63.031 376.051 168.19 440 288 440c119.86 0 224.996-63.994 281.354-159.631a47.997 47.997 0 0 0 0-48.738zM288 392c-102.556 0-192.091-54.701-240-136 44.157-74.933 123.677-127.27 216.162-135.007C273.958 131.078 280 144.83 280 160c0 30.928-25.072 56-56 56s-56-25.072-56-56l.001-.042C157.794 179.043 152 200.844 152 224c0 75.111 60.889 136 136 136s136-60.889 136-136c0-31.031-10.4-59.629-27.895-82.515C451.704 164.638 498.009 205.106 528 256c-47.908 81.299-137.444 136-240 136z'/%3E%3C/svg%3E")}.psw-wrapper{padding:0 .75rem}.psw-meter{height:3px;max-width:180px}.psw-meter .col-3{height:3px}.psw-percent,.psw-text{font-size:12px;font-size:.75rem;display:block;padding:.25rem 0;font-weight:500}.psw-percent{margin-right:5px}@-webkit-keyframes dropdownFadeIn{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:16px}}@keyframes dropdownFadeIn{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:16px}}@-webkit-keyframes dropdownFadeInTop{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:-16px}}@keyframes dropdownFadeInTop{0%{opacity:0;margin-top:0}to{opacity:1;margin-top:-16px}}.btn-dropdown{color:#06c;padding:0 4px;background-color:transparent;font-size:16px;font-size:1rem;border-radius:0}.btn-dropdown:not(:disabled):not(.disabled):active{-webkit-box-shadow:none;box-shadow:none}.btn-dropdown:after{content:"";font-size:12.8px;font-size:.8rem;font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;border:none;display:inline-block;vertical-align:0;width:auto;height:auto;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.btn-dropdown[aria-expanded=true]:after{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.dropdown-menu{border-radius:0 0 4px 4px}.dropdown-menu.full-width{width:100%}.dropdown-menu.full-width .link-list li{display:inline-block;width:auto}.dropdown-menu.full-width .link-list li:focus,.dropdown-menu.full-width .link-list li:hover{background:none;text-decoration:underline}.dropdown-menu .link-list{margin-bottom:0}.dropdown-menu .link-list h3{line-height:2.3em;margin-bottom:0}.dropdown-menu:before{content:"";position:absolute;top:-6px;left:24px;width:18px;height:18px;border-radius:4px;background-color:#fff;-webkit-transform:rotate(45deg);transform:rotate(45deg)}.dropdown-menu[x-placement=top-start]{border-radius:4px 4px 0 0}.dropdown-menu[x-placement=top-start]:before{bottom:-6px;top:auto}.dropdown-menu.dark{background-color:#435a70}.dropdown-menu.dark .link-list-wrapper ul span.divider{background:#2e465e}.dropdown-menu.dark .link-list-wrapper ul li a:hover span,.dropdown-menu.dark .link-list-wrapper ul li a span,.dropdown-menu.dark .link-list-wrapper ul li h3,.dropdown-menu.dark .link-list-wrapper ul li i{color:#fff}.dropdown-menu.dark .link-list-wrapper ul li a:not(.active):not(.disabled):hover i{color:#4fe0dc}.dropdown-menu.dark .link-list-wrapper ul li a.disabled span{color:#adb2b8}.dropdown-menu.dark:before{background-color:#435a70}nav.pagination-wrapper{display:-webkit-box;display:-ms-flexbox;display:flex}nav.pagination-wrapper,nav.pagination-wrapper.pagination-total{-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}nav.pagination-wrapper.pagination-total{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}nav.pagination-wrapper.pagination-total ul{margin-bottom:.5rem}nav.pagination-wrapper.pagination-total p{font-size:14.222px;font-size:.8888888889rem;color:#5b6f82;margin-bottom:1rem;font-weight:600;text-align:center}nav.pagination-wrapper .form-group{margin-left:2.5rem;width:72px;width:4.5rem;margin-top:0}nav.pagination-wrapper .form-group label{font-size:14.222px;font-size:.8888888889rem;color:#9da2a6}nav.pagination-wrapper .form-group.active label{font-size:12.8px;font-size:.8rem}nav.pagination-wrapper .btn.dropdown-toggle{font-size:14.222px;font-size:.8888888889rem;color:#5b6f82;font-weight:600;padding:12px;height:40px;height:2.5rem;border:none;width:100%}nav.pagination-wrapper .btn.dropdown-toggle:after{color:#0073e6;margin-left:.5rem}.pagination{-ms-flex-wrap:wrap;flex-wrap:wrap}.pagination .page-item{margin-right:5px}.pagination .page-item.disabled a.page-link,.pagination .page-item.disabled a.page-link i[class^=it-]{color:#c2c7cc}.pagination .page-item span.page-link{pointer-events:none}.pagination .page-item .page-link{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;height:40px;height:2.5rem;min-width:40px;min-width:2.5rem;border-radius:4px;border:none;font-size:14.222px;font-size:.8888888889rem;font-weight:600;color:#5b6f82;background-color:transparent}.pagination .page-item .page-link[aria-current]{border:1px solid #06c;color:#06c;pointer-events:none}.pagination .page-item .page-link.text,.pagination .page-item .page-link i[class^=it-]{color:#0073e6}.pagination .page-item .page-link i[class^=it-]{font-size:11.2px;font-size:.7rem}.pagination .page-item .page-link span.d-inline-block{margin-right:.5rem}.pagination .page-item .page-link:hover{color:#06c;background-color:transparent}.pagination .page-item .page-link:hover i[class^=it-]{color:#06c}@media (min-width:576px){.pagination .page-item .page-link{height:2.6666666667rem;min-width:2.6666666667rem}nav.pagination-wrapper .btn.dropdown-toggle{height:2.6666666667rem}}@media (min-width:768px){nav.pagination-wrapper{-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}nav.pagination-wrapper .dropdown{margin-left:2.6666666667rem}}@media (max-width:767.98px){.offcanvas-collapse{position:fixed;top:56px;bottom:0;left:1em;width:100%;overflow-y:auto;background-color:#323333;-webkit-transition:-webkit-transform .3s ease-in-out;transition:-webkit-transform .3s ease-in-out;transition:transform .3s ease-in-out;transition:transform .3s ease-in-out,-webkit-transform .3s ease-in-out;-webkit-transform:translateX(100%);transform:translateX(100%)}.offcanvas-collapse.open{-webkit-transform:translateX(-1rem);transform:translateX(-1rem)}}.nav-tabs{position:relative;background-color:#fff;border-bottom:0}.nav-tabs:after{content:"";position:absolute;z-index:-1;-webkit-box-shadow:0 0 2rem rgba(0,0,0,.15);box-shadow:0 0 2rem rgba(0,0,0,.15);bottom:0;left:10%;right:10%;width:80%;height:50%;border-radius:100%}.nav-tabs .nav-link{border-radius:0;font-weight:600;color:#5c6f82;border:none;border-bottom:2px solid transparent}.nav-tabs .nav-link.disabled{color:#b1b1b3;font-weight:400}.nav-tabs .nav-item.show .nav-link,.nav-tabs .nav-link.active{border-bottom:2px solid #06c;color:#06c;cursor:inherit}.nav-tabs .nav-item{margin-bottom:0}.nav-tabs.nav-dark{background-color:#455b71}.nav-tabs.nav-dark .nav-link{color:#c7d1d0}.nav-tabs.nav-dark .nav-item.show .nav-link,.nav-tabs.nav-dark .nav-link.active{background-color:#455b71;color:#00fff7;border-bottom:2px solid #00fff7}.it-ico-sm{font-size:28px;font-size:1.75rem}.it-ico{font-size:20px;font-size:1.25rem}.it-ico-lg{font-size:24px;font-size:1.5rem}.cookiebar{bottom:0;left:0;right:0;display:none;position:fixed;width:100%;z-index:1100}.cookiebar.cookiebar-top{bottom:auto;top:0}.cookiebar.show{display:block}.hero{padding:1rem;margin-bottom:1rem;background-color:#cacacc;border-radius:0}@media (min-width:576px){.hero{padding:1rem}}.hero .hero-heading{font-size:32px;font-size:2rem;font-weight:700;color:#00264d;margin-bottom:.8rem}.hero-fluid{padding-right:0;padding-left:0;border-radius:0}.forward{display:block;text-align:center;font-size:48px;font-size:3rem;-webkit-transition:all .2s ease-in-out;transition:all .2s ease-in-out}.forward:hover{text-decoration:none}.return-to-top{position:fixed;bottom:16px;right:16px;background:#0073e6;background:rgba(0,115,230,.7);width:48px;height:48px;display:block;text-decoration:none;border-radius:50%;display:none;text-align:center;z-index:1}.return-to-top,.return-to-top i{-webkit-transition:all .2s ease-in-out;transition:all .2s ease-in-out}.return-to-top i{color:#fff;margin:0;position:relative;top:8px;font-size:20px}.return-to-top i:before{margin:0}.return-to-top:hover{background:rgba(0,115,230,.9);text-decoration:none}.return-to-top:hover i{color:#fff;top:4px}.autocomplete-clear{visibility:hidden;position:absolute;z-index:2;right:4px;right:.25rem;top:8px;top:.5rem;background:transparent;border:none;cursor:pointer}.autocomplete-clear svg{fill:#a6a6a6}.autocomplete-wrap{position:absolute;left:0;right:0;background:#fff;-webkit-box-shadow:0 2px 5px rgba(0,0,0,.25);box-shadow:0 2px 5px rgba(0,0,0,.25);z-index:100;max-height:240px;overflow-y:auto;padding-left:0;list-style-type:none}.autocomplete-wrap li{cursor:pointer;padding:12px 16px;font-size:14px;font-size:.875rem}.autocomplete-wrap li:hover{background:#eee}.link-list-wrapper ul{padding:0;list-style-type:none}.link-list-wrapper ul.link-sublist{padding-left:24px}.link-list-wrapper ul li a{font-size:.889em;line-height:2.3em;display:block;padding:0 24px;position:relative}.link-list-wrapper ul li a:hover:not(.disabled){text-decoration:none}.link-list-wrapper ul li a:hover:not(.disabled) span{color:#06c;text-decoration:underline}.link-list-wrapper ul li a:hover:not(.disabled) p{color:#06c;text-decoration:none}.link-list-wrapper ul li a.disabled:hover{text-decoration:none}.link-list-wrapper ul li a.medium{font-weight:600}.link-list-wrapper ul li a span{color:#06c;display:block;margin-right:24px}.link-list-wrapper ul li a.right-icon i.right{position:absolute;top:0;right:24px;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.link-list-wrapper ul li a.right-icon i.right.secondary{color:#9da2a6}.link-list-wrapper ul li a.right-icon[aria-expanded=true] i.right{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.link-list-wrapper ul li a.active span{color:#17324d;text-decoration:underline}.link-list-wrapper ul li a.disabled{cursor:not-allowed}.link-list-wrapper ul li a.disabled.left-icon i,.link-list-wrapper ul li a.disabled.left-icon i.secondary,.link-list-wrapper ul li a.disabled.right-icon i,.link-list-wrapper ul li a.disabled.right-icon i.secondary,.link-list-wrapper ul li a.disabled span{color:#adb2b8}.link-list-wrapper ul li a.left-icon{display:-webkit-box;display:-ms-flexbox;display:flex}.link-list-wrapper ul li a.left-icon i.left{margin-right:8px}.link-list-wrapper ul li a.large{font-size:1em}.link-list-wrapper ul li a p{font-size:.778em;line-height:normal;color:#5b6f82}.link-list-wrapper ul li a.avatar{display:-webkit-box;display:-ms-flexbox;display:flex;margin-bottom:8px}.link-list-wrapper ul li a.avatar .avatar{display:block;border-radius:50px;margin-right:8px}.link-list-wrapper ul li h3{font-size:1em;color:#17324d;padding:0 24px}.link-list-wrapper ul li h3 a{line-height:inherit;font-size:1em;padding:0}.link-list-wrapper ul .divider{display:block;height:1px;background:#ebeced;margin:8px 0}.link-list-wrapper ul .toggles label{padding:0 24px;font-size:.889em;line-height:2.3em;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;height:auto;font-weight:inherit;margin:0}.link-list-wrapper ul .toggles input[type=checkbox]+.lever{margin:8px 0 0}.link-list-wrapper ul .form-check.form-check-group{padding:0 24px;-webkit-box-shadow:none;box-shadow:none}.link-list-wrapper ul .form-check.form-check-group [type=checkbox]+label{padding-left:0;font-size:.889em;line-height:2.3em;height:inherit;margin-bottom:0}.link-list-wrapper ul .form-check.form-check-group [type=checkbox]+label:after{right:24px}.link-list-wrapper ul .form-check.form-check-group [type=checkbox]+label:before{right:35px}.link-list-wrapper ul .form-check.form-check-group [type=checkbox][disabled]+label{color:#adb2b8}@media (min-width:576px){.link-list-wrapper ul li a.large{font-size:1em;line-height:2.7em}}@media (min-width:768px){.link-list-wrapper ul li a.large{line-height:2.7em}}@-webkit-keyframes megamenuFadeIn{0%{opacity:0;margin-top:16px}to{opacity:1;margin-top:16px}}@keyframes megamenuFadeIn{0%{opacity:0;margin-top:16px}to{opacity:1;margin-top:16px}}.navbar{background:#06c}.navbar .navbar-collapsable{position:fixed;top:0;right:0;left:0;bottom:0;z-index:10;background:rgba(0,0,0,.6);display:none}.navbar .navbar-collapsable .menu-wrapper{background:#06c;position:absolute;top:0;bottom:0;right:0;left:48px;pointer-events:all;overflow-y:auto;-webkit-transform:translateX(100%);transform:translateX(100%);-webkit-transition:all .3s;transition:all .3s}.navbar .navbar-collapsable .navbar-nav{margin-top:102px;padding:24px 0}.navbar .navbar-collapsable .navbar-nav li a.nav-link{color:#fff;font-weight:400;padding:12px 24px;position:relative}.navbar .navbar-collapsable .navbar-nav li a.nav-link.active{border-left:2px solid #fff}.navbar .navbar-collapsable.expanded .close-div,.navbar .navbar-collapsable.expanded .menu-wrapper{-webkit-transform:translateX(0);transform:translateX(0)}.navbar .close-div{-webkit-transform:translateX(100%);transform:translateX(100%);padding:24px;position:fixed;left:48px;right:0;top:0;background:#06c;z-index:10;-webkit-transition:all .3s;transition:all .3s}.navbar .close-div .close-menu{background:transparent;color:#fff;text-align:center;font-size:.75em;text-transform:uppercase;padding:0}.navbar .close-div .close-menu span{display:block;text-align:center;font-size:2em}.navbar .close-div .close-menu span:before{margin-right:0}.navbar .dropdown-menu{background:transparent;-webkit-box-shadow:none;box-shadow:none}.navbar .dropdown-menu:before{display:none}.navbar .dropdown-menu .link-list-wrapper{padding-left:24px;padding-right:24px}.navbar .dropdown-menu .link-list-wrapper ul li a h3,.navbar .dropdown-menu .link-list-wrapper ul li a span,.navbar .dropdown-menu .link-list-wrapper ul li h3{color:#fff}.navbar .dropdown-toggle{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.navbar .dropdown-toggle:after{font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;display:inline-block;text-decoration:inherit;width:auto;height:auto;margin-right:.2em;text-align:center;font-variant:normal;text-transform:none;line-height:1em;content:"\e818";vertical-align:auto;border:none;border-bottom:0;font-size:.8em;line-height:2em;-webkit-transform-origin:center;transform-origin:center;-webkit-transition:all .3s;transition:all .3s}.navbar .dropdown-toggle[aria-expanded=true]:after{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.custom-navbar-toggler{background:none;border:none}.custom-navbar-toggler span{color:#fff;font-size:1.625em}.inline-menu .link-list-wrapper .link-list,.inline-menu .link-list-wrapper .link-list li a{position:relative}.inline-menu .link-list-wrapper .link-list li a i{color:#6aaaeb}.inline-menu .link-list-wrapper .link-list li a:after{content:"";display:block;width:2px;background:#06c;position:absolute;right:0;top:0;height:100%;-webkit-transform-origin:center;transform-origin:center;-webkit-transform:scaleY(0);transform:scaleY(0);-webkit-transition:all .3s;transition:all .3s;z-index:1}.inline-menu .link-list-wrapper .link-list li a.active span{color:#06c;text-decoration:none}.inline-menu .link-list-wrapper .link-list li a[aria-expanded=true]:after{-webkit-transform:scaleY(1);transform:scaleY(1)}.inline-menu .link-list-wrapper .link-list:after{content:"";display:block;width:2px;background:-webkit-gradient(linear,left top,left bottom,from(#e6ecf2),to(rgba(230,236,242,.3)));background:linear-gradient(180deg,#e6ecf2 0,rgba(230,236,242,.3));position:absolute;right:0;top:0;height:100%}@media (min-width:992px){.navbar{background:#06c;padding:0}.navbar .navbar-collapsable{position:relative;z-index:auto;background:none;display:block!important}.navbar .navbar-collapsable,.navbar .navbar-collapsable .menu-wrapper{top:auto;right:auto;left:auto;bottom:auto;-webkit-transition:none;transition:none}.navbar .navbar-collapsable .menu-wrapper{position:inherit;overflow-y:visible;-webkit-transform:none;transform:none}.navbar .navbar-collapsable .navbar-nav{margin-top:0;padding:0 24px}.navbar .navbar-collapsable .navbar-nav li a.nav-link{font-weight:400;padding:12px 24px}.navbar .navbar-collapsable .navbar-nav li a.nav-link.active{border-left:0;border-bottom:2px solid #fff}.navbar .navbar-collapsable .navbar-nav li a.nav-link.disabled{opacity:.5;cursor:not-allowed}.navbar .close-div{display:none}.navbar .dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;float:left;min-width:10rem;padding:.5rem 0;margin:.125rem 0 0;font-size:1rem;color:#19191a;text-align:left;list-style:none;background-color:#fff;background-clip:padding-box;border:0 solid transparent;border-radius:4px;-webkit-box-shadow:0 0 30px 5px rgba(0,0,0,.05);box-shadow:0 0 30px 5px rgba(0,0,0,.05)}.navbar .dropdown-menu.show{-webkit-animation:dropdownFadeIn .3s forwards;animation:dropdownFadeIn .3s forwards;top:calc(100% - 16px)}.navbar .dropdown-menu:before{display:block}.navbar .dropdown-menu .link-list-wrapper{padding-left:0;padding-right:0}.navbar .dropdown-menu .link-list-wrapper ul li a h3,.navbar .dropdown-menu .link-list-wrapper ul li a span{color:#06c}.navbar .dropdown-menu .link-list-wrapper ul li h3{color:#19191a}.navbar .dropdown-toggle{display:block;-webkit-box-pack:inherit;-ms-flex-pack:inherit;justify-content:inherit}.navbar .dropdown-toggle:after{content:"";font-size:.8rem;font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;border:none;display:inline-block;vertical-align:0;width:auto;height:auto;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.navbar.megamenu .navbar-collapsable{width:100%}.navbar.megamenu .navbar-collapsable .nav-item{position:static}.navbar.megamenu .navbar-collapsable .nav-item a{position:relative}.navbar.megamenu .navbar-collapsable .nav-item a:before{content:"";position:absolute;top:auto;bottom:-12px;left:24px;width:18px;height:18px;border-radius:4px;background-color:#fff;-webkit-transform:rotate(45deg);transform:rotate(45deg);opacity:0;-webkit-transition:opacity .3s;transition:opacity .3s}.navbar.megamenu .navbar-collapsable .nav-item.show a:before{opacity:1}.navbar.megamenu .navbar-collapsable .dropdown-menu{min-width:auto;left:24px;right:24px}.navbar.megamenu .navbar-collapsable .dropdown-menu:before{display:none}.navbar.megamenu .navbar-collapsable .dropdown-menu.show{-webkit-animation:megamenuFadeIn .3s forwards;animation:megamenuFadeIn .3s forwards}.custom-navbar-toggler{display:none}}.skiplinks{background-color:#0bd9d2;text-align:center}.skiplinks a{display:inline-block;padding:.5rem;display:block;font-weight:600;color:#5b6f82;text-decoration:underline}.componente-base{background-color:#0073e6;color:#fff;cursor:pointer;padding:8px}.focus--keyboard,.form-check [type=checkbox]:focus+label,.toggles label input[type=checkbox]:focus+.lever{border-color:#f90;-webkit-box-shadow:0 0 6px 2px #f90;box-shadow:0 0 6px 2px #f90;outline:none}.focus--mouse,.form-check [type=checkbox]:focus.focus--mouse+label,.toggles label input[type=checkbox]:focus.focus--mouse+.lever{border-color:inherit;-webkit-box-shadow:none;box-shadow:none;outline:none}.bg-primary--dark{background-color:#06c}.bg-primary--mid-dark{background-color:#004e95}.bg-primary--darken{background-color:#002b4d}.text-grey{color:#ccc}.text-sans-serif{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}.text-serif{font-family:Lora,serif}.text-light-blue{color:#e6f3fe}.text-blue{color:#0073e6}.border-dark-blue{border-color:#193e5e!important}.border-medium-blue{border-color:#06c!important}.border-grey-light{border-color:#eaebed!important}.border-width-2{border-width:2px!important}.stopScrolling--vertical{overflow-y:hidden}.deactive{display:none!important}@font-face{font-family:docs-icons;src:url(../font/docs.eot);src:url(../font/docs-italia.eot#iefix) format("embedded-opentype"),url(../font/docs-italia.ttf) format("truetype"),url(../font/docs-italia.woff) format("woff"),url(../font/docs-italia.svg#docs) format("svg");font-weight:400;font-style:normal}[class*=" docs-icon-"],[class^=docs-icon-]{font-family:docs-icons!important;speak:none;font-style:normal;font-weight:400;font-variant:normal;text-transform:none;line-height:1;vertical-align:middle;color:inherit;font-size:20.8px;font-size:1.3rem;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.docs-icon-more:before{content:""}.docs-icon-expand:before{content:""}.docs-icon-collapse:before{content:""}.docs-icon-plus:before{content:""}.docs-icon-minus:before{content:""}.docs-icon-document:before{content:""}.docs-icon-edit:before{content:""}.docs-icon-download:before{content:""}.docs-icon-info:before{content:""}.docs-icon-compare:before{content:""}.docs-icon-github:before{content:""}.docs-icon-share:before{content:""}.docs-icon-search:before{content:""}.docs-icon-link:before{content:""}.docs-icon-external-link:before{content:""}.docs-icon-comment:before{content:""}.docs-icon-attention:before,.docs-icon-warning:before{content:""}.docs-icon-example:before{content:""}.docs-icon-procedure:before{content:""}.docs-icon-hint:before{content:""}.docs-icon-note:before{content:""}.docs-icon-step:before{content:""}.docs-icon-pdf:before{content:""}.docs-icon-html:before{content:""}.docs-icon-project:before{content:""}.docs-icon-publisher:before{content:""}.docs-icon-docs:before{content:""}.docs-icon-user:before{content:""}.small{font-size:14px}.navbar-dark--text-white{color:#fff}.navbar-dark .lang-selector .nav-link,.navbar-dark .navbar-nav .nav-link{color:#fff!important}.navbar.bg-white{background-color:#fff}.navbar.primary-bg-a7{background-color:#0059b3}@media (min-width:992px){.dropdown-menu.dropdown-menu-right:before{right:24px;left:auto}}@media (min-width:992px){.navbar .dropdown-menu.dropdown-menu-right{left:auto;right:0}}@media (max-width:991.98px){.dropdown-menu-right{right:auto;left:auto}}.btn-group.show .dropdown-menu[x-placement=bottom-start],.dropdown.show .dropdown-menu[x-placement=bottom-start]{-webkit-animation:dropdownFadeIn .3s forwards;animation:dropdownFadeIn .3s forwards}.btn-group.show .dropdown-menu[x-placement=top-start],.dropdown.show .dropdown-menu[x-placement=top-start]{-webkit-animation:dropdownFadeInTop .3s forwards;animation:dropdownFadeInTop .3s forwards}.dropdown-menu[x-placement^=bottom],.dropdown-menu[x-placement^=left],.dropdown-menu[x-placement^=right],.dropdown-menu[x-placement^=top]{right:auto;bottom:auto}.dropdown-menu:before{z-index:-1}.injected{display:none}body{color:#596771;background-color:#002b4d}body.no-scroll{overflow-y:hidden}p{font-family:Lora,serif}h1,h2,h3,h4,h5{color:#000;margin-bottom:2rem}img{max-width:100%;height:auto}.container-fluid--desktop{max-width:1450px}@-webkit-keyframes pulsate{0%{-webkit-transform:scale(.1);transform:scale(.1);opacity:0}50%{opacity:1}to{-webkit-transform:scale(1.2);transform:scale(1.2);opacity:0}}@keyframes pulsate{0%{-webkit-transform:scale(.1);transform:scale(.1);opacity:0}50%{opacity:1}to{-webkit-transform:scale(1.2);transform:scale(1.2);opacity:0}}.loading{overflow:hidden}.loading:after{position:absolute;background:#0073e6;height:100%;width:100%;z-index:10;content:"";left:0;top:0}.loading:before{border:5px solid #fff;margin:-15px 0 0 -15px;border-radius:30px;position:absolute;content:"";z-index:11;height:30px;left:50%;top:50%;opacity:0;width:30px;-webkit-animation:pulsate 1s ease-out;animation:pulsate 1s ease-out;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.loading.no-bg:after{background:none;position:relative}.dropdown-menu{background-color:#fff;padding:.5rem;margin:0;border-radius:.2rem;-webkit-box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);z-index:100}.dropdown-menu .dropdown-item{color:#0073e6}.dropdown-menu .dropdown-item.active,.dropdown-menu .dropdown-item:active{font-weight:600;text-decoration:inherit;background-color:inherit}#version-list .dropdown-toggle .current-version{max-width:8em;text-overflow:ellipsis;overflow:hidden;display:inline-block;font-size:inherit;font-weight:400}#version-list .version-list-wrapper{max-height:10.2em;max-width:18em;overflow-y:scroll}#version-list .dropdown-item{text-overflow:ellipsis;max-width:16em;overflow-x:hidden}.document-actions .dropdown-toggle:after{vertical-align:middle;line-height:1.5}@media (max-width:767.98px){.document-actions .dropdown-toggle:after{font-family:italia-icon-font!important;border:none;margin:0 2em 0 0;width:auto;height:auto;float:right;content:"\e818";vertical-align:middle;font-size:.8em;line-height:2em;-webkit-transform-origin:center;transform-origin:center;-webkit-transition:all .3s;transition:all .3s}.document-actions .dropdown-toggle[aria-expanded=true]:after{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.document-actions .dropdown-toggle:hover{text-decoration:none}.document-actions .dropdown-menu.show{position:static!important;-webkit-transform:none!important;transform:none!important;-webkit-box-shadow:none;box-shadow:none;padding:0;margin-top:16px;-webkit-animation:none;animation:none}.document-actions .dropdown-menu.show:before{display:none}}.header{font-size:16px;font-size:1rem}.header .navbar-brand{font-size:14.224px;font-size:.889rem;font-weight:600}.header .navbar-brand a{text-decoration:none}.header .navbar .dropdown-toggle:after{margin:0 .2rem;font-size:11.2px;font-size:.7rem}.header .nav-item{margin-left:.2rem}@media (min-width:992px){.header .nav-item{border-left:0;margin-left:0}}.header .nav-item.active{font-weight:600}.header .nav-item:not(.nav-text):not(.nav-item--no-underline).active,.header .nav-item:not(.nav-text):not(.nav-item--no-underline):hover{border-left:.2rem solid #fff;margin-left:0}@media (min-width:992px){.header .nav-item:not(.nav-text):not(.nav-item--no-underline).active,.header .nav-item:not(.nav-text):not(.nav-item--no-underline):hover{border-left:0;margin-left:0;border-bottom:2px solid #fff;margin-bottom:0}}.slim-header{font-size:14.224px;font-size:.889rem}.slim-header .navbar-toggler .navbar__icon{font-size:11.2px;font-size:.7rem;line-height:3em;display:inline-block;-webkit-transform:scaleY(-1);transform:scaleY(-1);-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s}.slim-header .navbar-toggler.collapsed .navbar__icon{-webkit-transform:scaleY(1);transform:scaleY(1)}.slim-header .navbar-toggler .dropdown-toggle:after{content:""}.slim-header.navbar .divider{border-top:.05rem solid #799ebc;padding-right:1px;width:10%;margin-top:.75rem;margin-bottom:1rem;margin-left:.2rem;padding-bottom:1px}.slim-header.navbar .divider:first-child{margin-top:1px}.slim-header.navbar .divider.divider--w-100{width:100%}@media (min-width:992px){.slim-header.navbar .divider.divider--w-100{width:inherit}}@media (min-width:992px){.slim-header.navbar .divider{border-top:0;width:inherit;margin-top:inherit;margin-bottom:inherit;border-right:.05rem solid #06c;padding-right:1px;margin-left:0}}.secondary-nav{font-weight:600}@media (max-width:991.98px){.secondary-nav.secondary-nav--offcanvas{-webkit-transform:translateX(-100%);transform:translateX(-100%);z-index:10;background-color:#fff;color:#06c;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s;-webkit-transition-timing-function:ease-in-out;transition-timing-function:ease-in-out;position:fixed;top:0;left:0;bottom:0;right:25%;overflow-y:auto}.secondary-nav.secondary-nav--offcanvas.active{-webkit-transform:translateX(0);transform:translateX(0)}}.secondary-nav .navbar-nav li{padding:.5rem;border-bottom:.2rem solid transparent}.secondary-nav .nav-item:not(.nav-text):not(.nav-item--no-underline).active,.secondary-nav .nav-item:not(.nav-text):not(.nav-item--no-underline):hover{border-bottom:.2rem solid #fff}@media (max-width:991.98px){.article-intro-more .dropdown.show:before{content:"";width:100vw;height:100%;position:fixed;top:0;left:0;background-color:rgba(0,0,0,.5);z-index:999}}.article-intro-more .dropdown .dropdown-toggle:after{display:none}.article-intro-more .dropdown .dropdown-menu{background-color:#fff;padding:.5rem;margin:0;border-radius:.2rem;-webkit-box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);z-index:100}@media (max-width:991.98px){.article-intro-more .dropdown .dropdown-menu{position:fixed!important;z-index:1001!important;top:calc(50% - 140px)!important;left:calc(50% - 140px)!important;-webkit-transform:none!important;transform:none!important}.article-intro-more .dropdown .dropdown-menu:before{display:none}}.article-intro-more .dropdown .dropdown-menu .dropdown-item{color:#0073e6}@media (max-width:991.98px){.lang-selector .dropdown.show:before{content:"";width:100vw;height:100%;position:fixed;top:0;left:0;background-color:rgba(0,0,0,.5);z-index:999}}.lang-selector .dropdown .dropdown-menu{background-color:#fff;padding:.5rem;margin:0;border-radius:.2rem;-webkit-box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);box-shadow:2px 2px 8px 0 rgba(0,0,0,.35);z-index:100}@media (max-width:991.98px){.lang-selector .dropdown .dropdown-menu{position:fixed!important;z-index:1001!important;top:calc(50% - 80px)!important;left:calc(50% - 80px)!important;-webkit-transform:none!important;transform:none!important}.lang-selector .dropdown .dropdown-menu:before{display:none}}.lang-selector .dropdown .dropdown-menu .dropdown-item{color:#0073e6}.lang-selector .dropdown .dropdown-menu .dropdown-item.active,.lang-selector .dropdown .dropdown-menu .dropdown-item:active{font-weight:600;text-decoration:inherit;background-color:inherit}.h1--header{font-size:21.328px;font-size:1.333rem;font-weight:600;line-height:1.2;letter-spacing:unset}@media (min-width:576px){.h1--header{font-size:1.8rem}}.h1--header span{font-size:11.2px;font-size:.7rem;font-weight:400}.svg--header{width:39px;height:36px}@media (min-width:576px){.svg--header{width:65px;height:60px}}.h2--header{font-size:14px;font-weight:300;letter-spacing:unset}.docs__document-info{color:#fff;font-size:14.4px;font-size:.9rem;vertical-align:bottom}.docs__document-info .docs__document-info__icon{font-size:19.2px;font-size:1.2rem;vertical-align:bottom}.docs__document-info .docs__document-info__ownership .docs__document-info__label{font-size:12.8px;font-size:.8rem}.docs__document-info .docs__document-info__ownership .docs__document-info__icon{font-size:16px;font-size:1rem}.doc-header{-webkit-box-shadow:0 0 120px 0 rgba(0,0,0,.1);box-shadow:0 0 120px 0 rgba(0,0,0,.1);position:relative;z-index:10;color:#0073e6;font-size:16px;font-weight:600}.doc-header .progress-container{width:100%;height:4px;height:.25rem;background:#e6f3fe}.doc-header .progress-bar{height:4px;height:.25rem;background:#06c;width:0}.docs-italia #cerca{border:1px solid #ccc;font-size:12.8px;font-size:.8rem;font-weight:100}.docs-italia #cerca::-webkit-input-placeholder{color:#ccc}.docs-italia #cerca::-moz-placeholder{color:#ccc}.docs-italia #cerca::-ms-input-placeholder{color:#ccc}.docs-italia #cerca::placeholder{color:#ccc}.social{color:#fff}.social .social__label{font-size:15.2px;font-size:.95rem}.social .social__link{color:#fff;font-size:16px;font-size:1rem}.social .social__link:active,.social .social__link:hover{text-decoration:none}#rtd-search-form{border:1px solid #ccc}#rtd-search-form input[type=text]{border:none;height:100%}#rtd-search-form .input-group-append button{background-color:#fff}#rtd-search-form .input-group-append button .docs-icon-search{font-size:19.2px;font-size:1.2rem}#documentInfo .tag{font-family:Titillium Web,Geneva,Tahoma,sans-serif}.offcanvas-menu{position:fixed;z-index:1000;width:100vw;height:100vh;top:0;left:0;right:0;bottom:0}.offcanvas-menu.animate--left{-webkit-transform:translate3d(-100%,0,0);transform:translate3d(-100%,0,0);-webkit-transition:-webkit-transform .4s;transition:-webkit-transform .4s;transition:transform .4s;transition:transform .4s,-webkit-transform .4s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1)}.offcanvas-menu.js-active{-webkit-transform:translateZ(0);transform:translateZ(0);-webkit-transition:-webkit-transform .8s;transition:-webkit-transform .8s;transition:transform .8s;transition:transform .8s,-webkit-transform .8s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1)}.offcanvas-menu .offcanvas-menu__inner{width:80%;background-color:#fff;height:100vh;-webkit-transform:translateX(0);transform:translateX(0);-webkit-transition:all .5s ease-out;transition:all .5s ease-out}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__header{padding:1.5rem 1.8rem 1rem}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__header .offcanvas-menu__title{font-weight:600;font-size:19.2px;font-size:1.2rem}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav{padding:.5rem 0 0;margin:0}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item{list-style:none;margin:0;padding:.5rem 1rem}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:first-child,.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:nth-child(4){position:relative}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:first-child:before,.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item:nth-child(4):before{content:"";width:64px;height:1px;left:32px;left:2rem;border-top:1px solid rgba(0,102,204,.2);position:absolute;top:0}.offcanvas-menu .offcanvas-menu__inner .offcanvas-menu__nav .offcanvas-menu__nav__item .offcanvas-menu__nav__link{padding:.5rem 1rem;font-size:16px;font-size:1rem;display:block}.offcanvas-menu.deactive .offcanvas-menu__inner{margin-left:-80%;overflow:hidden}.offcanvas-menu .offcanvas-menu__extra{width:20%;height:100vh;position:fixed;right:0;top:0}body:before{position:fixed;top:0;left:0;z-index:999;bottom:0;right:0;background:rgba(0,0,0,.5);content:"";opacity:0;-webkit-transform:translate3d(100%,0,0);transform:translate3d(100%,0,0);-webkit-transition:opacity .4s,-webkit-transform 0s .4s;transition:opacity .4s,-webkit-transform 0s .4s;transition:opacity .4s,transform 0s .4s;transition:opacity .4s,transform 0s .4s,-webkit-transform 0s .4s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1)}body.show-menu:before{opacity:1;-webkit-transition:opacity .8s;transition:opacity .8s;-webkit-transition-timing-function:cubic-bezier(.7,0,.3,1);transition-timing-function:cubic-bezier(.7,0,.3,1);-webkit-transform:translateZ(0);transform:translateZ(0)}#desktop-menu{-webkit-transform:translate(0);transform:translate(0);-webkit-transform:translateZ(0);transform:translateZ(0);will-change:position,transform;padding-bottom:5rem}#desktop-menu>button:first-of-type{margin-top:1.5rem}.col--nav{width:100%}@media (min-width:768px){.col--nav{width:420px;float:left;border-right:1px solid #eeeff0;padding-left:4.5rem}}.docs-menu{will-change:min-height;display:none}@media (min-width:768px){.docs-menu{display:block}}@media (max-width:767.98px){.docs-offcanvas-menu{-webkit-transform:translateX(100%);transform:translateX(100%);z-index:10;background-color:#fff;-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s;-webkit-transition-timing-function:ease-in-out;transition-timing-function:ease-in-out;position:fixed;top:0;left:0;bottom:0;right:0;overflow-y:auto}.docs-offcanvas-menu.active{-webkit-transform:translateX(0);transform:translateX(0)}}@media (min-width:768px){.docs-offcanvas-menu{display:none}}.navbar-toggler--wrap{position:fixed;bottom:0;left:0;right:0;z-index:9;background-color:#fff;-webkit-box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25);box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25)}@media (min-width:768px){.navbar-toggler--wrap{display:none}}.navbar-toggler{color:#06c;padding:1rem 1rem 1rem 2rem}.navbar-toggler__chapter{color:#000;font-size:12.8px;font-size:.8rem}.sidebar-tabs{position:fixed;top:0;left:0;right:0;background-color:#fff;-webkit-transform:translateX(100%);transform:translateX(100%);-webkit-transition:-webkit-transform .3s;transition:-webkit-transform .3s;transition:transform .3s;transition:transform .3s,-webkit-transform .3s;-webkit-transition-timing-function:ease-in-out;transition-timing-function:ease-in-out;z-index:11;-webkit-box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25);box-shadow:-1px -2px 62px -13px rgba(0,0,0,.25)}.sidebar-tabs.active{-webkit-transform:translateX(0);transform:translateX(0)}@media (min-width:768px){.sidebar-tabs{display:none}}.sidebar-btn{text-transform:uppercase;color:#06c;font-weight:700;cursor:pointer;border:0;border-bottom:3px solid #0073e6;background:none}@media (min-width:768px){.sidebar-btn{border-bottom:2px solid #bbd8f1}}.sidebar-btn.sidebar-btn--mobile{display:inline-block;font-size:11.2px;font-size:.7rem;text-align:center;border:0}.sidebar-btn.sidebar-btn--mobile.active.show{border-bottom:3px solid #0073e6;text-decoration:none}@media (min-width:768px){.sidebar-btn.sidebar-btn--mobile.active.show{border-bottom:2px solid #bbd8f1}}.form-check [type=checkbox]:focus.focus--mouse+label.sidebar-btn,.sidebar-btn.focus--mouse,.toggles label input[type=checkbox]:focus.focus--mouse+.sidebar-btn.lever{border-color:#0073e6!important}@media (min-width:768px){.form-check [type=checkbox]:focus.focus--mouse+label.sidebar-btn,.sidebar-btn.focus--mouse,.toggles label input[type=checkbox]:focus.focus--mouse+.sidebar-btn.lever{border-color:#bbd8f1!important}}.sidebar-btn .it-collapse,.sidebar-btn .it-expand{font-size:9.6px;font-size:.6rem;line-height:2.5}.sidebar-btn .it-expand{display:inline-block}.sidebar-btn.collapsed .it-expand,.sidebar-btn .it-collapse{display:none}.sidebar-btn.collapsed .it-collapse{display:inline-block}@media (min-width:768px){.sidebar-btn{display:block;width:100%;text-align:left}}@media (max-width:767.98px){.sidebar-btn.collapsed .it-collapse,.sidebar-btn.collapsed .it-expand,.sidebar-btn .it-collapse,.sidebar-btn .it-expand{display:none}}.main-container{overflow:hidden;position:relative;background-color:#fff}.doc-content__consultation{position:absolute;right:0;left:0;top:0;background-color:#4bd4d6;text-align:left;text-transform:uppercase;font-weight:700;color:#000;padding:.5rem 0 .5rem 2rem}@media (min-width:992px){.doc-content__consultation{padding-left:4rem}}@media (min-width:1200px){.doc-content__consultation{-webkit-transform:rotate(45deg) translate(45px,-125px);transform:rotate(45deg) translate(45px,-125px);width:320px;-webkit-transform-origin:left;transform-origin:left;z-index:1;left:auto;text-align:center;padding-left:0}}.col-content{padding:4rem 2rem}@media (min-width:992px){.col-content{padding:4rem 4rem 5rem}}.caption-wrap{clear:both}.caption-wrap .caption--table{margin-top:1rem;margin-bottom:1rem;display:block;font-family:Lora,serif;font-style:italic;font-size:12px;font-size:.75rem;padding:0}@media (min-width:992px){.caption-wrap .caption--table{width:calc(100% - 200px);float:left}}.caption-wrap .reference--wrap{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;margin-top:1rem;margin-bottom:2rem;font-size:.9em}@media (min-width:768px){.caption-wrap .reference--wrap{width:200px;float:right;padding-left:2rem}}.caption-number{font-weight:700;color:#000}.chapter-header{margin-bottom:1rem;margin-left:.5rem}.chapter-nav{position:relative}@media (min-width:992px){.chapter-nav{width:200px;float:left}}.figure-fixed-wrap{display:block;width:100%;overflow-x:auto}.figure-fixed{max-width:none}.title__background{width:100%;background-color:#e6f3fe;position:absolute;top:-1px;height:auto;left:-8px;left:-.5rem;display:none;right:0;z-index:0}.title__background:after{content:"";position:absolute;left:100%;-webkit-transform:translateX(-50%);transform:translateX(-50%);top:0;bottom:0;width:0;height:0;border-left:20px solid transparent;border-right:20px solid transparent;border-top:20px solid #e6f3fe}.std-term{background-color:#bffffd;color:#000;padding:.2rem}.footer-buttons--next{clear:both;margin-top:4rem}.footer-buttons--next a{background-color:#0073e6;color:#fff;padding:.5rem 1rem;border-radius:.2rem;font-weight:700;display:inline-block}.footer-buttons--prev{margin-bottom:2.5rem}.reference-icon{vertical-align:middle;display:inline-block}#doc-content{width:100%;position:relative}@media (min-width:768px){#doc-content{width:calc(100% - 420px);float:left}}#doc-content a.reference[href]{text-decoration:underline}#doc-content .useful-docs .mimetype{display:none}#doc-content .useful-docs ul{list-style-type:none;padding-left:0}#doc-content .useful-docs li{border-top:1px solid #ccc;padding-top:1rem;padding-bottom:1rem;vertical-align:middle}#doc-content .useful-docs li:after{display:none}#doc-content .useful-docs [class*=" docs-icon-"],#doc-content .useful-docs [class^=docs-icon-]{font-size:30.4px;font-size:1.9rem;color:#0073e6}#doc-content ul.simple,#doc-content ul.simple ul{list-style-type:disc}#doc-content ul.simple li,#doc-content ul.simple ul li{position:relative;margin-bottom:.5rem;font-size:14.4px;font-size:.9rem}#doc-content ul.simple li ul li,#doc-content ul.simple ul li ul li{margin-top:.5rem}#doc-content .section{clear:both}#doc-content .section:after{content:"";display:table;clear:both}@media (min-width:992px){#doc-content .section>*{width:calc(100% - 200px);float:left;clear:left}}@media (min-width:992px){#doc-content .section .caption-wrap,#doc-content .section .chapter-header,#doc-content .section .figure,#doc-content .section .full-width,#doc-content .section .section,#doc-content .section .table-responsive,#doc-content .section>.toctree-wrapper.compound{width:100%}}#doc-content .section .figure{width:100%}#doc-content .section .figure[id],#doc-content .section .rubric.ref[id],#doc-content .section .section[id],#doc-content .section .table[id]{border-top:4.2rem solid transparent}#doc-content .section .glossary dt:not([id=""]){margin-top:-4em;padding-top:4em}#doc-content .section ol.loweralpha,#doc-content .section ol.loweralpha li{list-style:lower-alpha}#doc-content .section ol.upperalpha,#doc-content .section ol.upperalpha li{list-style:upper-alpha}#doc-content .section ol.upperroman,#doc-content .section ol.upperroman li{list-style:upper-roman}#doc-content .section ol,#doc-content .section ol.arabic{list-style:decimal}#doc-content .topic-title{color:#000;font-weight:700;font-size:22.4px;font-size:1.4rem;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .topic.procedure{margin-bottom:3rem}#doc-content .topic.procedure em{font-weight:700}#doc-content .topic.procedure ol{padding-left:1rem}#doc-content .topic.procedure ol li{position:relative;margin-bottom:1rem;padding-left:1rem;counter-increment:list;list-style-type:none;font-family:Lora,serif}#doc-content .topic.procedure ol li:after{position:absolute;left:-16px;left:-1rem;top:0;width:16px;width:1rem;height:24px;height:1.5rem;z-index:1;content:counter(list);color:#fff;text-align:center;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;font-weight:600}#doc-content .topic.procedure .topic-title{text-transform:uppercase;font-size:17.6px;font-size:1.1rem;font-weight:700;color:#002b4d;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;padding-bottom:.2rem;background:-webkit-gradient(linear,left top,left bottom,from(#004e95),to(#004e95)) no-repeat 100% 100%/calc(100% - 2rem) 2px;background:linear-gradient(#004e95,#004e95) no-repeat 100% 100%/calc(100% - 2rem) 2px;margin-bottom:1rem}#doc-content .topic.procedure .topic-title [class*=" docs-icon-"],#doc-content .topic.procedure .topic-title [class^=docs-icon-]{margin-right:.5rem}#doc-content .topic.procedure .procedure__img{padding-left:1.5rem;margin-bottom:2rem;margin-left:.5rem;margin-top:2rem;border-left:1px solid #799ebc}#doc-content .topic.procedure .procedure__img img{-webkit-box-shadow:0 0 61px 0 rgba(0,0,0,.15);box-shadow:0 0 61px 0 rgba(0,0,0,.15)}#doc-content .topic.procedure .procedure-internal-title{text-transform:uppercase;color:#000;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:12.8px;font-size:.8rem;font-weight:700}#doc-content .topic.procedure .docs-icon-step{color:#004e95;position:absolute;left:-24px;left:-1.5rem;font-size:32px;font-size:2rem}@media (min-width:992px){#doc-content .title-wrap{width:calc(100% - 200px);float:left;clear:left;position:relative}#doc-content .title-wrap h2{line-height:60px}#doc-content .title-wrap h3{line-height:46px}#doc-content .title-wrap h1,#doc-content .title-wrap h2,#doc-content .title-wrap h3{display:inline;cursor:pointer;position:relative;color:#000;box-shadow:.5rem 0 0 #fff,-.5rem 0 0 #fff;-webkit-box-shadow:.5rem 0 0 #fff,-.5rem 0 0 #fff;-webkit-box-decoration-break:clone;-ms-box-decoration-break:clone;-o-box-decoration-break:clone;box-decoration-break:clone;left:-.5rem;z-index:1}#doc-content .title-wrap h1 .title__chapter,#doc-content .title-wrap h2 .title__chapter,#doc-content .title-wrap h3 .title__chapter{position:relative;color:#0073e6}#doc-content .title-wrap h1{line-height:71px}#doc-content .title-wrap h1 .title__chapter{position:relative;background-color:#0073e6;color:#fff;margin-right:.5rem;padding-left:.5rem;padding-right:.5rem;display:inline-block;z-index:1}#doc-content .title-wrap h1 .title__chapter:after,#doc-content .title-wrap h1 .title__chapter:before{content:"";top:0;bottom:0;width:.5rem;background-color:#0073e6;position:absolute}#doc-content .title-wrap h1 .title__chapter:after{right:100%}#doc-content .title-wrap h1 .title__chapter:before{left:100%}}#doc-content .title-wrap.active h1,#doc-content .title-wrap.active h2,#doc-content .title-wrap.active h3{-webkit-box-shadow:.5rem 0 0 #e6f3fe,-.5rem 0 0 #e6f3fe;box-shadow:.5rem 0 0 #e6f3fe,-.5rem 0 0 #e6f3fe;background-color:#e6f3fe}#doc-content .title-wrap.active .title__background{display:block}#doc-content .headerlink{display:none}#doc-content .document-info{padding:0}#doc-content .document-info .docutils.field-list{width:100%;margin-bottom:2rem;border-bottom:1px solid #ccc;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;display:grid}#doc-content .document-info .docutils.field-list tr{display:block;margin-bottom:2rem}@media (min-width:576px){#doc-content .document-info .docutils.field-list tr{width:50%;float:left}}#doc-content .document-info .docutils.field-list .field-body,#doc-content .document-info .docutils.field-list .field-name{display:block;font-weight:400}#doc-content .document-info .docutils.field-list .field-body{color:#06c;text-decoration:underline}#doc-content dd>p{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .highlights{font-size:24px;font-size:1.5rem;font-family:Lora,serif}#doc-content blockquote.epigraph{margin-top:2rem;padding-left:2rem;border-left:4px solid #00c4c8;color:#596771;font-size:19.2px;font-size:1.2rem;margin-bottom:2rem}#doc-content blockquote.epigraph .attribution{margin-bottom:0;font-size:16px;font-size:1rem}#doc-content .question-and-answers blockquote{margin-top:.5rem;margin-bottom:0}#doc-content .question-and-answers blockquote>div{font-weight:700;font-family:Lora,serif}#doc-content .question-and-answers .pull-quote{max-width:490px;margin-bottom:2rem}#doc-content .question-and-answers .pull-quote ul{list-style-type:none;padding-left:1.5rem}#doc-content .question-and-answers .pull-quote ul li{display:inline-block;margin-top:1rem}#doc-content .question-and-answers .pull-quote ul li:after{display:none}#doc-content .question-and-answers .pull-quote ul li a{padding:.2rem .5rem;margin-right:.2rem;background-color:#bffffd;color:#000;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;border-bottom:2px dotted #ccc}#doc-content .question-and-answers .pull-quote>div>p{text-transform:uppercase;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;color:#0b0b0b;margin-bottom:0;font-weight:100}#doc-content .question-and-answers .pull-quote:nth-of-type(odd){float:left;clear:right}#doc-content .question-and-answers .pull-quote:nth-of-type(odd) blockquote>div,#doc-content .question-and-answers .pull-quote:nth-of-type(odd) ul{padding-left:1.5rem;border-left:5px solid #00c4c8}#doc-content .question-and-answers .pull-quote:nth-of-type(2n){float:right;text-align:right;clear:left}#doc-content .question-and-answers .pull-quote:nth-of-type(2n) blockquote>div,#doc-content .question-and-answers .pull-quote:nth-of-type(2n) ul{padding-right:1.5rem;border-right:5px solid #00c4c8}#doc-content .question-and-answers .glossary.docutils{display:none}#doc-content .highlighted{background:#bffffd;display:inline-block;font-weight:700}.highlight{padding:1rem;margin-bottom:1em}.highlight pre{margin:0;padding-bottom:1em}.highlighttable .highlight{padding:0}.code .highlight{background:none}code:not(.download) .pre{background-color:#efc;padding:.2rem}code.download{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:100%}#doc-content .admonition{margin-bottom:2rem;margin-top:2rem;padding-left:2rem;border-left:4px solid;color:#596771}#doc-content .admonition .more{padding:0}#doc-content .admonition .admonition-title{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;text-transform:uppercase;font-weight:700}#doc-content .admonition .admonition-title [class*=" docs-icon-"],#doc-content .admonition .admonition-title [class^=docs-icon-]{font-size:24px;font-size:1.5rem;margin-right:.5rem}#doc-content .admonition .admonition__hidden-paragraph{display:none}#doc-content .admonition .admonition__toggle-wrap{border-top:1px solid #ccc;padding-top:1rem;margin-top:1.5rem}#doc-content .admonition .admonition__toggle-btn{cursor:pointer;background:none;border:none;color:#0073e6;padding-left:0}#doc-content .admonition .admonition__toggle-btn [class*=" docs-icon-"],#doc-content .admonition .admonition__toggle-btn [class^=docs-icon-]{font-size:9.6px;font-size:.6rem;margin-left:.5rem;position:relative}#doc-content .admonition .admonition__toggle-btn [class*=" docs-icon-"]:after,#doc-content .admonition .admonition__toggle-btn [class^=docs-icon-]:after{content:"";width:16px;width:1rem;height:16px;height:1rem;border:2px solid #0073e6;left:50%;top:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);position:absolute;border-radius:50%}#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-less:first-letter,#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-more:first-letter{text-transform:uppercase}#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-less{display:none}#doc-content .admonition .admonition__toggle-btn .admonition__toggle-show-more{display:inline-block}#doc-content .admonition .admonition__toggle-btn.active .admonition__toggle-show-more{display:none}#doc-content .admonition .admonition__toggle-btn.active .admonition__toggle-show-less{display:inline-block}#doc-content .admonition.display-page{background-color:#f9fafb;padding:2rem;position:relative;border:none}#doc-content .admonition.display-page:after,#doc-content .admonition.display-page:before{content:"";width:0;height:0;right:0;top:0;position:absolute;z-index:1}#doc-content .admonition.display-page:before{border-bottom:50px solid transparent;border-right:50px solid #fff}#doc-content .admonition.display-page:after{border-top:50px solid transparent;border-bottom:50px solid #ccc;border-right:50px solid transparent;-webkit-transform:translateY(-50%);transform:translateY(-50%)}#doc-content .admonition.display-page .admonition__hidden-paragraph p,#doc-content .admonition.display-page>p,#doc-content .admonition.display-page li{font-size:12.8px;font-size:.8rem;color:#002b4d}#doc-content .admonition.display-page ol{counter-reset:list}#doc-content .admonition.display-page ol li{margin-bottom:1rem;position:relative;list-style-type:none;counter-increment:list;color:#002b4d;font-family:Lora,serif;text-indent:16px;text-indent:1rem}#doc-content .admonition.display-page ol li:after{position:absolute;left:-16px;left:-1rem;top:0;width:17.6px;width:1.1rem;height:24px;height:1.5rem;z-index:1;content:counter(list) ".";text-align:center;font-weight:700}#doc-content .admonition.display-page ol li:before{position:absolute;left:-32px;left:-2rem;top:.65em;height:1px;z-index:1;content:"";font-weight:700;background-color:#002b4d;width:16px;width:1rem}#doc-content .admonition.display-page .admonition-title,#doc-content .admonition.display-page .code-block__header{color:#004e95;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .admonition.display-page .admonition-title{padding-bottom:.2rem;display:inline-block;background:-webkit-gradient(linear,left top,left bottom,from(#004e95),to(#004e95)) no-repeat 100% 100%/calc(100% - 2.2rem) 2px;background:linear-gradient(#004e95,#004e95) no-repeat 100% 100%/calc(100% - 2.2rem) 2px;margin-bottom:1rem;overflow:hidden}#doc-content .admonition.display-page .admonition-internal-title{text-transform:uppercase;font-size:12.8px;font-size:.8rem;font-weight:700;color:#002b4d;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .admonition.display-page .linenodiv pre{color:#8998a5;font-weight:400}#doc-content .admonition.display-page .highlighttable pre{font-size:12.8px;font-size:.8rem}#doc-content .admonition.admonition-consultation{padding-bottom:1rem;border-bottom:1px solid #ccc;position:relative}#doc-content .admonition.admonition-consultation a{text-decoration:underline}#doc-content .admonition.admonition-consultation .last{font-family:Lora,serif}#doc-content .admonition.admonition-consultation .admonition-title{color:#000;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#doc-content .admonition.admonition-consultation .admonition-title [class*=" docs-icon-"],#doc-content .admonition.admonition-consultation .admonition-title [class^=docs-icon-]{font-size:19.2px;font-size:1.2rem}#doc-content .admonition.error{border-color:#d83750}#doc-content .admonition.error .admonition-title{color:#d83750}#doc-content .admonition.note{border-color:#004e95}#doc-content .admonition.note .admonition-title{color:#004e95}#doc-content .admonition.attention,#doc-content .admonition.warning{border-color:#df7d26}#doc-content .admonition.attention .admonition-title,#doc-content .admonition.warning .admonition-title{color:#df7d26}#doc-content .admonition.important{border-color:#008255}#doc-content .admonition.important .admonition-title{color:#008255}#doc-content .admonition.important .last{font-weight:700;font-size:19.2px;font-size:1.2rem}#doc-content .admonition.hint{border-color:#008255}#doc-content .admonition.hint .admonition-title{color:#008255}#doc-content .admonition.hint .reference.internal{font-size:12.8px;font-size:.8rem;position:relative}#doc-content .admonition.hint .reference.internal:after{content:"";width:6.4px;width:.4rem;height:6.4px;height:.4rem;border-top:1px solid #0073e6;border-right:1px solid #0073e6;left:100%;-webkit-transform:rotate(45deg) translateY(-50%);transform:rotate(45deg) translateY(-50%);position:absolute;top:50%}#doc-content .admonition.admonition-may,#doc-content .admonition.admonition-must,#doc-content .admonition.admonition-must-not,#doc-content .admonition.admonition-should,#doc-content .admonition.admonition-should-not,#doc-content .admonition.admonition-use,#doc-content .admonition.admonition-use-not{margin-top:2rem;border:2px solid;border-radius:1em;padding:2em;position:relative}#doc-content .admonition.admonition-may .admonition__header,#doc-content .admonition.admonition-must-not .admonition__header,#doc-content .admonition.admonition-must .admonition__header,#doc-content .admonition.admonition-should-not .admonition__header,#doc-content .admonition.admonition-should .admonition__header,#doc-content .admonition.admonition-use-not .admonition__header,#doc-content .admonition.admonition-use .admonition__header{display:inline-block;position:relative;padding:0 1em;background:#fff}#doc-content .admonition.admonition-may .admonition__header .admonition-title,#doc-content .admonition.admonition-must-not .admonition__header .admonition-title,#doc-content .admonition.admonition-must .admonition__header .admonition-title,#doc-content .admonition.admonition-should-not .admonition__header .admonition-title,#doc-content .admonition.admonition-should .admonition__header .admonition-title,#doc-content .admonition.admonition-use-not .admonition__header .admonition-title,#doc-content .admonition.admonition-use .admonition__header .admonition-title{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif;margin:0}#doc-content .admonition.admonition-may:before,#doc-content .admonition.admonition-must-not:before,#doc-content .admonition.admonition-must:before,#doc-content .admonition.admonition-should-not:before,#doc-content .admonition.admonition-should:before,#doc-content .admonition.admonition-use-not:before,#doc-content .admonition.admonition-use:before{position:absolute;right:4em;top:-.65em;width:6em;padding:0 1em;display:inline-block;background-color:#fff}#doc-content .admonition.admonition-may,#doc-content .admonition.admonition-must,#doc-content .admonition.admonition-must-not,#doc-content .admonition.admonition-should,#doc-content .admonition.admonition-should-not{border-color:#004080}#doc-content .admonition.admonition-may .admonition__header,#doc-content .admonition.admonition-must-not .admonition__header,#doc-content .admonition.admonition-must .admonition__header,#doc-content .admonition.admonition-should-not .admonition__header,#doc-content .admonition.admonition-should .admonition__header{top:-2.8em}#doc-content .admonition.admonition-may .admonition__header .admonition-title,#doc-content .admonition.admonition-must-not .admonition__header .admonition-title,#doc-content .admonition.admonition-must .admonition__header .admonition-title,#doc-content .admonition.admonition-should-not .admonition__header .admonition-title,#doc-content .admonition.admonition-should .admonition__header .admonition-title{color:#004080}#doc-content .admonition.admonition-use{border-color:#00cf86}#doc-content .admonition.admonition-use .admonition__header .admonition-title{color:#00cf86}#doc-content .admonition.admonition-use .admonition__header .admonition-title:before{content:""}#doc-content .admonition.admonition-use-not{border-color:#d1344c}#doc-content .admonition.admonition-use-not .admonition__header .admonition-title{color:#d1344c}#doc-content .admonition.admonition-use-not .admonition__header .admonition-title:before{content:""}#doc-content .admonition.admonition-use-not .admonition__header,#doc-content .admonition.admonition-use .admonition__header{top:-3.2em}#doc-content .admonition.admonition-use-not .admonition__header .admonition-title:before,#doc-content .admonition.admonition-use .admonition__header .admonition-title:before{font-family:docs-icons;margin-right:.5rem;font-size:1.6em;vertical-align:middle}#doc-content .admonition.admonition-must:before{content:url(../images/must.svg)}#doc-content .admonition.admonition-should:before{content:url(../images/should.svg)}#doc-content .admonition.admonition-must-not:before{content:url(../images/must_not.svg)}#doc-content .admonition.admonition-should-not:before{content:url(../images/should_not.svg)}#doc-content .admonition.admonition-may:before{content:url(../images/may.svg)}.footer *{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}.footer a:hover{text-decoration:none}.footer .in-collaboration{font-size:.8em}.footer .team-logo--icon{width:54px}.footer .team-logo--text{font-size:16px;font-size:1rem;line-height:18px;max-width:160px;text-transform:uppercase}.footer .agid-logo--icon{width:8em}@media (min-width:768px){.footer .agid-logo--icon{width:10em}}.footer .agid-logo--separator{border-left-width:2px!important;height:30px}@media (min-width:768px){.footer .agid-logo--separator{height:40px}}.footer .agid-logo--text{width:112px;width:7rem;line-height:1.2;font-size:1em;display:inline-block;vertical-align:middle}@media (min-width:768px){.footer .agid-logo--text{font-size:1.1em;width:8rem}}.footer .small-prints{color:#00fff8;font-weight:600}.footer .social{font-size:1em;color:#fff}.footer .social .icon{color:#00264d;background-color:#fff;padding:.3em;border-radius:100%;font-size:22px}.footer .colophon{border-top:1px solid hsla(0,0%,100%,.1);margin-top:1.5em}@media (min-width:992px){.footer .colophon{margin-top:2em}}.footer-menu__link:hover{color:#fff}.t_translate-wrap{display:none}.doc-tooltip{background-color:#fff;font-family:Lora,serif;-webkit-box-shadow:0 0 100px 0 rgba(0,0,0,.15);box-shadow:0 0 100px 0 rgba(0,0,0,.15)}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:before,.doc-tooltip.bs-popover-auto[x-placement^=top]:before,.doc-tooltip.bs-popover-bottom:before,.doc-tooltip.bs-popover-top:before{content:"";width:0;height:0;border-top:40px solid transparent;border-bottom:40px solid transparent;border-left:40px solid #fff;position:absolute;left:0;z-index:-1}.doc-tooltip.bs-popover-auto[x-placement^=top]:before,.doc-tooltip.bs-popover-top:before{bottom:-40px}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:before,.doc-tooltip.bs-popover-bottom:before{top:-40px}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:after,.doc-tooltip.bs-popover-auto[x-placement^=top]:after,.doc-tooltip.bs-popover-bottom:after,.doc-tooltip.bs-popover-top:after{content:"";width:15px;height:15px;-webkit-transform:rotate(45deg);transform:rotate(45deg);position:absolute;left:5px;z-index:-2}.doc-tooltip.bs-popover-auto[x-placement^=top]:after,.doc-tooltip.bs-popover-top:after{-webkit-box-shadow:5px 5px 70px 8px rgba(0,0,0,.15);box-shadow:5px 5px 70px 8px rgba(0,0,0,.15);bottom:-20px}.doc-tooltip.bs-popover-auto[x-placement^=bottom]:after,.doc-tooltip.bs-popover-bottom:after{-webkit-box-shadow:-5px -5px 70px 8px rgba(0,0,0,.15);box-shadow:-5px -5px 70px 8px rgba(0,0,0,.15);top:-20px}.doc-tooltip.doc-tooltip--note:after,.doc-tooltip.doc-tooltip--note:before{content:none}.tooltip__wrap{overflow:hidden;width:330px;padding:2rem;font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}.tooltip__title{overflow:hidden;font-style:italic;margin-bottom:.5rem;font-size:1em;letter-spacing:0}.tooltip__content{font-size:14.4px;font-size:.9rem;font-style:italic;margin-bottom:0}.tooltip__close-btn{position:absolute;top:16px;top:1rem;right:16px;right:1rem;width:20px;height:20px;padding:0;background:none;border:0;cursor:pointer}.tooltip__close-btn:after,.tooltip__close-btn:before{content:"";position:absolute;height:20px;width:1px;background-color:#0073e6;top:0;left:50%}.tooltip__close-btn:after{-webkit-transform:rotate(45deg) translateX(-50%);transform:rotate(45deg) translateX(-50%)}.tooltip__close-btn:before{-webkit-transform:rotate(-45deg) translateX(-50%);transform:rotate(-45deg) translateX(-50%)}.tooltip__link{color:#0073e6;font-size:12.8px;font-size:.8rem;font-weight:100;text-transform:uppercase;letter-spacing:0;position:relative;display:inline-block;margin-top:1rem}.tooltip__link:after{content:"";position:absolute;left:100%;top:0;width:30px;background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAsAAAAGCAYAAAAVMmT4AAAABmJLR0QAAAAAAAD5Q7t/AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH4gUPDDQNy1r5IQAAAH5JREFUGNNj+I8HTD704v+ZR1/gfCYGPODNlz8MLv3XGc4+/srAwMDAwHjx6df//jNuYVX84esfhg9f/jAI8LAw3G4yYGD8+vPv/ztvfmBVPP3wK4YZ+14wdIfJM5Q4SzIw/v///z8uZzRsf8rAw8bEUOIsCRHA58EXn36h8AF2435mx6vmAAAAAABJRU5ErkJggg==");background-repeat:no-repeat;bottom:0;background-position:50%}@media (max-width:991.98px){.chapter-nav__list--hidden:not(.show){display:none}}@media (min-width:992px){.chapter-nav__list--hidden{visibility:hidden;opacity:0;-webkit-transition:visibility .35s,opacity .35s;transition:visibility .35s,opacity .35s}.chapter-nav__list--hidden.active{visibility:visible;opacity:1}}@media (max-width:991.98px){.chapter-nav__list-wrap{max-width:300px;margin-left:auto;margin-right:auto;border-radius:4px}}@media (min-width:992px){.chapter-nav__wrap{position:absolute;left:2rem;top:1rem}}.chapter-link{background:none;border:none;color:#0073e6;padding:0;display:inline-block;font-size:.9em;font-weight:400;cursor:pointer;vertical-align:middle}.chapter-link:hover{text-decoration:underline}.chapter-link__title{float:left}.chapter-link__counter{margin-right:.3rem;display:inline-block;float:left}.chapter-nav__list{list-style-type:none;margin-bottom:0;padding:1rem}@media (min-width:992px){.chapter-nav__list{padding:0}}.chapter-nav__title{padding:1rem;color:#000;font-size:12.8px;font-size:.8rem;font-weight:700;border-bottom:1px solid #ccc}.chapter-nav__title .title__chapter{color:#8998a5}@media (min-width:992px){.chapter-nav__title{display:none}}.chapter-nav__item:not(:last-child){margin-bottom:1rem}@media (min-width:992px){.chapter-nav__item:not(:last-child){margin-bottom:0}}.chapter-nav__list--visible{margin-top:1rem}@media (min-width:992px){.chapter-nav__list--visible{margin-top:-.5rem}}.chapter-nav__list--visible .chapter-nav__item{display:inline-block}@media (min-width:992px){.chapter-nav__list--visible .chapter-nav__item{display:block}}#doc-content ::-webkit-scrollbar{width:1em;height:14px}#doc-content ::-webkit-scrollbar-track{background-color:#e6f3fe;border-radius:7px;border:2px solid #fff}#doc-content ::-webkit-scrollbar-thumb{background-color:#0073e6;border-radius:7px;background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAHCAYAAAABIM1CAAAALUlEQVQoU2N88+m/hggf4w0GLODJp//CLEwMUhI8jJexyT/7/l+OcdSAQRAGABbrTN6F2sNMAAAAAElFTkSuQmCC");background-repeat:no-repeat;background-position:50%}#doc-content table:not(.footnote){border:0}#doc-content table:not(.footnote) td{border-right:0;border-left:0}#doc-content table:not(.footnote):not(.highlighttable) td{min-width:220px}#doc-content table:not(.footnote) thead .head{border-right:0;border-left:0;text-transform:uppercase;color:#000;font-size:12px;font-size:.75rem;vertical-align:top}#doc-content table:not(.footnote) tr{font-size:12px;font-size:.75rem}#doc-content .footnote-reference{color:#193e5e;border:1px solid #193e5e;border-radius:3px;padding:0 .4rem;line-height:1.4}#doc-content .note-action{margin-top:.5rem}#doc-content .note-back-btn,#doc-content .note-close-btn{background:none;border:0;display:inline-block;color:#0073e6;font-size:1.2em;cursor:pointer}#doc-content .note-back-btn{position:relative}#doc-content .note-back-btn:before{content:"";top:0;bottom:0;width:1px;position:absolute;background-color:#0073e6;left:0}#doc-content .note-back-btn:hover{text-decoration:underline}#doc-content .docutils.footnote{color:#000;font-size:12.8px;font-size:.8rem;display:none;margin-bottom:2rem}#doc-content .docutils.footnote td{width:100%;float:left}#doc-content .docutils.footnote .fn-backref{color:#193e5e;border:1px solid #193e5e;border-radius:3px;padding:.2rem;line-height:1;display:inline-block;margin-bottom:.5rem}.block-comments{margin-top:4.4rem;padding-bottom:2rem}.block-comments__body p{font-family:Titillium Web,Geneva,Tahoma,sans-serif}.block-comments__header{border-bottom-color:#ccc!important;border-top-color:#eeeff0!important}.block-comments__header h6{color:#06c}.block-comments__img{width:56px}.block-comments__reply-anchor{margin-top:-5em;padding-top:5em}.block-comments__logout-link{display:none;padding-top:.25em}.block-comments__logout-link--icon{position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);color:#d83750;text-shadow:0 0 20px #000}.block-comments__logout-link--icon:hover{color:#fff}.block-comments__logout-link:hover{text-decoration:none}.block-comments__logout-link--visible{display:block;position:relative}.block-comments__input{margin-bottom:1em!important}.block-comments__toggle-btn{background:none;width:32px;width:2rem;height:32px;height:2rem}.block-comments__toggle-btn .docs-icon-minus,.block-comments__toggle-btn .docs-icon-plus{color:#06c;position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%)}.block-comments__toggle-btn .docs-icon-plus{display:none}.block-comments__toggle-btn.collapsed .docs-icon-plus{display:block}.block-comments__toggle-btn.collapsed .docs-icon-minus{display:none}.block-comments__item-btn{background:none;width:32px;width:2rem;height:24px;height:1.5rem;border:0}.block-comments__item-btn .it-collapse,.block-comments__item-btn .it-expand{color:#06c}.block-comments__item-btn.collapsed .it-collapse,.block-comments__item-btn .it-expand{display:none}.block-comments__item-btn.collapsed .it-expand{display:inline-block}.block-comments__item{padding-top:1em}.block-comments__item.hidden{opacity:.5}.block-comments__item.is-new{background-color:#e6f3fe;-webkit-animation:background-fade-highlight 2s ease-out 1 forwards;animation:background-fade-highlight 2s ease-out 1 forwards}.block-comments__content{word-wrap:break-word}.block-comments__name{color:#06c;font-weight:400;font-size:16px;font-size:1rem;letter-spacing:0}.block-comments__date,.block-comments__role{font-size:14px;line-height:21px}.block-comments__role{letter-spacing:.88px}.block-comments__paragraph{font-size:14px;line-height:21px}.block-comments__paragraph a{text-decoration:underline}.box-comment{position:relative;width:100%}.box-comment:not(.sending) .loading{display:none}.box-comment.sending .loading{margin-left:1em;display:inline-block!important;position:relative;overflow:visible;width:40px;z-index:1}.box-comment.sending .loading:before{border:5px solid #0073e6!important;top:60%}.box-comment textarea{min-height:5em;font-weight:400;border:1px solid #eeeff0;border-radius:5px}.box-comment textarea:focus{border:1px solid #596771}.box-comment textarea::-webkit-input-placeholder{color:#ccc}.box-comment textarea::-moz-placeholder{color:#ccc}.box-comment textarea::-ms-input-placeholder{color:#ccc}.box-comment textarea::placeholder{color:#ccc}.box-comment__login{display:-webkit-box;display:-ms-flexbox;display:flex;border:1px solid #edf5fc;border-radius:5px;padding:1em}.box-comment__legend{font-size:12px}.box-comment__user-image{border-radius:50%;position:relative;height:56px;width:56px;float:left}.box-comment__user-image--anon{margin:.25em .75em .25em .25em;background-color:#e8f2fc}.box-comment__user-image i{position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%)}.box-comment__buttons{float:left}.box-comment__required{float:right}.box-comment__required>span{font-size:.8em}.box-comment__submit{position:relative;overflow:hidden}.box-comment__submit .loading.no-bg{display:none;width:30px;height:0;content:" ";overflow:visible;margin-bottom:5px;margin-left:-15px;margin-right:5px}.box-comment__submit .loading.no-bg:before{left:auto}.box-comment__submit>div:not(.loading){display:inline}.box-comment__suggestions__tooltip .tooltip__content{font-style:normal;padding-left:1.75em;font-size:.95em}.missing_permission{width:100%}.missing_permission__text{border:1px solid #edf5fc;border-radius:5px;padding:1em}@-webkit-keyframes background-fade-highlight{to{background-color:transparent}}@keyframes background-fade-highlight{to{background-color:transparent}}@media (max-width:767.98px){.sidebar-nav{padding-top:5.5rem}}.sidebar-nav a{text-decoration:none;color:#596771;font-size:14.4px;font-size:.9rem;display:block;line-height:1.6;margin-bottom:1rem;margin-top:1rem}.sidebar-nav a.current_item{position:relative;z-index:1;margin-bottom:1rem;margin-top:1rem;-webkit-transition:margin-bottom .3s,margin-top .3s;transition:margin-bottom .3s,margin-top .3s}.sidebar-nav a.current_item:before{content:"";position:absolute;top:-8px;top:-.5rem;bottom:-8px;bottom:-.5rem;left:-8px;left:-.5rem;right:-8px;right:-.5rem;background-color:#bffffd;z-index:-1}.sidebar-nav a:focus,.sidebar-nav a:hover{text-decoration:underline}.sidebar-nav>.sidebar-list--wrapper{padding:1rem}@media (min-width:768px){.sidebar-nav>.sidebar-list--wrapper{padding:0}}.sidebar-nav>.sidebar-list--wrapper>ul>li{padding:.1rem 3rem .1rem 1rem}.sidebar-nav>.sidebar-list--wrapper>ul>li>a{font-weight:700}.sidebar-nav>.sidebar-list--wrapper ul{list-style-type:none;padding-left:0;margin-bottom:0}.sidebar-nav>.sidebar-list--wrapper ul.current>li.current{background-color:#f6fbff}.sidebar-nav>.sidebar-list--wrapper ul.current>li.current a{color:#004e95}.sidebar-nav>.sidebar-list--wrapper ul ul{padding-left:1rem}.sidebar-nav>.sidebar-list--wrapper.figures-index--menu,.sidebar-nav>.sidebar-list--wrapper.glossary-mobile--menu,.sidebar-nav>.sidebar-list--wrapper.table-index--menu{padding-top:1rem}.sidebar-nav>.sidebar-list--wrapper.figures-index--menu>ul>li,.sidebar-nav>.sidebar-list--wrapper.glossary-mobile--menu>ul>li,.sidebar-nav>.sidebar-list--wrapper.table-index--menu>ul>li{padding-bottom:0;padding-top:.5rem}#glossary-page>.chapter-header{display:none}#glossary-page .chapter-header{padding-top:2rem;padding-bottom:2rem;padding-left:.5rem;overflow:hidden}#glossary-page .chapter-header h2{font-size:128px;font-size:8rem;font-family:Lora,serif;line-height:1}#glossary-page .glossary-page__btn{border:0;background:none;cursor:pointer;color:#0073e6;display:block;width:100%;text-align:left;text-transform:uppercase;-webkit-transition:color .3s;transition:color .3s}#glossary-page .glossary-page__btn .docs-icon-minus,#glossary-page .glossary-page__btn .docs-icon-plus{color:#0073e6}#glossary-page .glossary-page__btn .docs-icon-minus{display:inline-block}#glossary-page .glossary-page__btn .docs-icon-plus{display:none}#glossary-page .glossary-page__btn.collapsed{color:#596771}#glossary-page .glossary-page__btn.collapsed .docs-icon-minus{display:none}#glossary-page .glossary-page__btn.collapsed .docs-icon-plus{display:inline-block}#glossary-page .term-content{padding-left:2.3rem}#glossary-page .term-content,#glossary-page .term-content p{font-family:Titillium Web,Helvetica Neue,Helvetica,Arial,sans-serif}#glossary-page .term-content:last-of-type.show,#glossary-page dt:last-of-type .glossary-page__btn.collapsed{border-bottom:2px solid #eaebed}.glossary-page__copy-link-wrap{color:#0073e6}.glossary-page__copy-link{background:none;border:none;color:#0073e6;cursor:pointer}@media (max-width:767.98px){.return-to-top{bottom:4rem}}.return-to-top i:before{margin:0}@media (max-width:767.98px){.modal.modal-sm-full .modal-dialog{margin:0;max-width:none}.modal.modal-sm-full .modal-dialog .modal-content{margin:0;width:100vw;height:100vh;border-radius:0!important;border:none}}@font-face{font-family:italia-icon-font;src:url(../font/italia-icon-font.eot?94539880);src:url(../font/italia-icon-font.eot?94539880#iefix) format("embedded-opentype"),url(../font/italia-icon-font.woff2?94539880) format("woff2"),url(../font/italia-icon-font.woff?94539880) format("woff"),url(../font/italia-icon-font.ttf?94539880) format("truetype"),url(../font/italia-icon-font.svg?94539880#italia-icon-font) format("svg");font-weight:400;font-style:normal}[class*=" it-"]:before,[class^=it-]:before{font-family:italia-icon-font;font-style:normal;font-weight:400;speak:none;display:inline-block;text-decoration:inherit;width:1em;margin-right:.2em;text-align:center;font-variant:normal;text-transform:none;line-height:1em;font-smoothing:antialiased}.it-app:before{content:"\e800"}.it-app-1:before{content:"\e801"}.it-arrow-down:before{content:"\e802"}.it-arrow-left:before{content:"\e803"}.it-arrow-right:before{content:"\e804"}.it-arrow-up:before{content:"\e805"}.it-behance:before{content:"\e806"}.it-calendar:before{content:"\e807"}.it-camera:before{content:"\e808"}.it-cancel:before{content:"\e809"}.it-check:before{content:"\e80a"}.it-chevron-left:before{content:"\e80d"}.it-chevron-right:before{content:"\e80e"}.it-close:before{content:"\e80f"}.it-collapse:before{content:"\e810"}.it-comment:before{content:"\e811"}.it-copy:before{content:"\e812"}.it-download:before{content:"\e813"}.it-drop-down:before{content:"\e814"}.it-drop-up:before{content:"\e815"}.it-help:before{content:"\e816"}.it-expand-media:before{content:"\e817"}.it-expand:before{content:"\e818"}.it-external-link:before{content:"\e819"}.it-facebook:before{content:"\e81a"}.it-favorite:before{content:"\e81b"}.it-file:before{content:"\e81c"}.it-flickr:before{content:"\e81d"}.it-github:before{content:"\e81e"}.it-googleplus:before{content:"\e81f"}.it-no:before{content:"\e820"}.it-instagram:before{content:"\e821"}.it-link:before{content:"\e822"}.it-linkedin:before{content:"\e823"}.it-list:before{content:"\e824"}.it-lock:before{content:"\e825"}.it-mail:before{content:"\e826"}.it-medium:before{content:"\e827"}.it-more-actions:before{content:"\e828"}.it-more-items:before{content:"\e829"}.it-pdf:before{content:"\e82a"}.it-pin:before{content:"\e82b"}.it-print:before{content:"\e82c"}.it-refresh:before{content:"\e82f"}.it-rss:before{content:"\e830"}.it-search:before{content:"\e831"}.it-settings:before{content:"\e832"}.it-share:before{content:"\e833"}.it-slideshare:before{content:"\e834"}.it-twitter:before{content:"\e835"}.it-unlock:before{content:"\e836"}.it-upload:before{content:"\e837"}.it-video:before{content:"\e838"}.it-warning:before{content:"\e839"}.it-whatsapp:before{content:"\e83a"}.it-youtube-text:before{content:"\e83b"}.it-youtube:before{content:"\e83c"}.it-zoom-in:before{content:"\e83d"}.it-zoom-out:before{content:"\e83e"}.it-error:before{content:"\e83f"}.it-info:before{content:"\e840"}.it-paper-plane:before{content:"\e841"} \ No newline at end of file diff --git a/it/_static/data/glossary.json b/it/_static/data/glossary.json new file mode 100644 index 00000000..9e26dfee --- /dev/null +++ b/it/_static/data/glossary.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/it/_static/doctools.js b/it/_static/doctools.js new file mode 100644 index 00000000..c3db08d1 --- /dev/null +++ b/it/_static/doctools.js @@ -0,0 +1,264 @@ +/* + * doctools.js + * ~~~~~~~~~~~ + * + * Base JavaScript utilities for all Sphinx HTML documentation. + * + * :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS. + * :license: BSD, see LICENSE for details. + * + */ +"use strict"; + +const _ready = (callback) => { + if (document.readyState !== "loading") { + callback(); + } else { + document.addEventListener("DOMContentLoaded", callback); + } +}; + +/** + * highlight a given string on a node by wrapping it in + * span elements with the given class name. + */ +const _highlight = (node, addItems, text, className) => { + if (node.nodeType === Node.TEXT_NODE) { + const val = node.nodeValue; + const parent = node.parentNode; + const pos = val.toLowerCase().indexOf(text); + if ( + pos >= 0 && + !parent.classList.contains(className) && + !parent.classList.contains("nohighlight") + ) { + let span; + + const closestNode = parent.closest("body, svg, foreignObject"); + const isInSVG = closestNode && closestNode.matches("svg"); + if (isInSVG) { + span = document.createElementNS("http://www.w3.org/2000/svg", "tspan"); + } else { + span = document.createElement("span"); + span.classList.add(className); + } + + span.appendChild(document.createTextNode(val.substr(pos, text.length))); + parent.insertBefore( + span, + parent.insertBefore( + document.createTextNode(val.substr(pos + text.length)), + node.nextSibling + ) + ); + node.nodeValue = val.substr(0, pos); + + if (isInSVG) { + const rect = document.createElementNS( + "http://www.w3.org/2000/svg", + "rect" + ); + const bbox = parent.getBBox(); + rect.x.baseVal.value = bbox.x; + rect.y.baseVal.value = bbox.y; + rect.width.baseVal.value = bbox.width; + rect.height.baseVal.value = bbox.height; + rect.setAttribute("class", className); + addItems.push({ parent: parent, target: rect }); + } + } + } else if (node.matches && !node.matches("button, select, textarea")) { + node.childNodes.forEach((el) => _highlight(el, addItems, text, className)); + } +}; +const _highlightText = (thisNode, text, className) => { + let addItems = []; + _highlight(thisNode, addItems, text, className); + addItems.forEach((obj) => + obj.parent.insertAdjacentElement("beforebegin", obj.target) + ); +}; + +/** + * Small JavaScript module for the documentation. + */ +const Documentation = { + init: () => { + Documentation.highlightSearchWords(); + Documentation.initDomainIndexTable(); + Documentation.initOnKeyListeners(); + }, + + /** + * i18n support + */ + TRANSLATIONS: {}, + PLURAL_EXPR: (n) => (n === 1 ? 0 : 1), + LOCALE: "unknown", + + // gettext and ngettext don't access this so that the functions + // can safely bound to a different name (_ = Documentation.gettext) + gettext: (string) => { + const translated = Documentation.TRANSLATIONS[string]; + switch (typeof translated) { + case "undefined": + return string; // no translation + case "string": + return translated; // translation exists + default: + return translated[0]; // (singular, plural) translation tuple exists + } + }, + + ngettext: (singular, plural, n) => { + const translated = Documentation.TRANSLATIONS[singular]; + if (typeof translated !== "undefined") + return translated[Documentation.PLURAL_EXPR(n)]; + return n === 1 ? singular : plural; + }, + + addTranslations: (catalog) => { + Object.assign(Documentation.TRANSLATIONS, catalog.messages); + Documentation.PLURAL_EXPR = new Function( + "n", + `return (${catalog.plural_expr})` + ); + Documentation.LOCALE = catalog.locale; + }, + + /** + * highlight the search words provided in the url in the text + */ + highlightSearchWords: () => { + const highlight = + new URLSearchParams(window.location.search).get("highlight") || ""; + const terms = highlight.toLowerCase().split(/\s+/).filter(x => x); + if (terms.length === 0) return; // nothing to do + + // There should never be more than one element matching "div.body" + const divBody = document.querySelectorAll("div.body"); + const body = divBody.length ? divBody[0] : document.querySelector("body"); + window.setTimeout(() => { + terms.forEach((term) => _highlightText(body, term, "highlighted")); + }, 10); + + const searchBox = document.getElementById("searchbox"); + if (searchBox === null) return; + searchBox.appendChild( + document + .createRange() + .createContextualFragment( + '" + ) + ); + }, + + /** + * helper function to hide the search marks again + */ + hideSearchWords: () => { + document + .querySelectorAll("#searchbox .highlight-link") + .forEach((el) => el.remove()); + document + .querySelectorAll("span.highlighted") + .forEach((el) => el.classList.remove("highlighted")); + const url = new URL(window.location); + url.searchParams.delete("highlight"); + window.history.replaceState({}, "", url); + }, + + /** + * helper function to focus on search bar + */ + focusSearchBar: () => { + document.querySelectorAll("input[name=q]")[0]?.focus(); + }, + + /** + * Initialise the domain index toggle buttons + */ + initDomainIndexTable: () => { + const toggler = (el) => { + const idNumber = el.id.substr(7); + const toggledRows = document.querySelectorAll(`tr.cg-${idNumber}`); + if (el.src.substr(-9) === "minus.png") { + el.src = `${el.src.substr(0, el.src.length - 9)}plus.png`; + toggledRows.forEach((el) => (el.style.display = "none")); + } else { + el.src = `${el.src.substr(0, el.src.length - 8)}minus.png`; + toggledRows.forEach((el) => (el.style.display = "")); + } + }; + + const togglerElements = document.querySelectorAll("img.toggler"); + togglerElements.forEach((el) => + el.addEventListener("click", (event) => toggler(event.currentTarget)) + ); + togglerElements.forEach((el) => (el.style.display = "")); + if (DOCUMENTATION_OPTIONS.COLLAPSE_INDEX) togglerElements.forEach(toggler); + }, + + initOnKeyListeners: () => { + // only install a listener if it is really needed + if ( + !DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS && + !DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS + ) + return; + + const blacklistedElements = new Set([ + "TEXTAREA", + "INPUT", + "SELECT", + "BUTTON", + ]); + document.addEventListener("keydown", (event) => { + if (blacklistedElements.has(document.activeElement.tagName)) return; // bail for input elements + if (event.altKey || event.ctrlKey || event.metaKey) return; // bail with special keys + + if (!event.shiftKey) { + switch (event.key) { + case "ArrowLeft": + if (!DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) break; + + const prevLink = document.querySelector('link[rel="prev"]'); + if (prevLink && prevLink.href) { + window.location.href = prevLink.href; + event.preventDefault(); + } + break; + case "ArrowRight": + if (!DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) break; + + const nextLink = document.querySelector('link[rel="next"]'); + if (nextLink && nextLink.href) { + window.location.href = nextLink.href; + event.preventDefault(); + } + break; + case "Escape": + if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) break; + Documentation.hideSearchWords(); + event.preventDefault(); + } + } + + // some keyboard layouts may need Shift to get / + switch (event.key) { + case "/": + if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) break; + Documentation.focusSearchBar(); + event.preventDefault(); + } + }); + }, +}; + +// quick alias for translations +const _ = Documentation.gettext; + +_ready(Documentation.init); diff --git a/it/_static/documentation_options.js b/it/_static/documentation_options.js new file mode 100644 index 00000000..93e68497 --- /dev/null +++ b/it/_static/documentation_options.js @@ -0,0 +1,14 @@ +var DOCUMENTATION_OPTIONS = { + URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), + VERSION: 'version: latest', + LANGUAGE: 'it', + COLLAPSE_INDEX: false, + BUILDER: 'html', + FILE_SUFFIX: '.html', + LINK_SUFFIX: '.html', + HAS_SOURCE: true, + SOURCELINK_SUFFIX: '.txt', + NAVIGATION_WITH_KEYS: false, + SHOW_SEARCH_SUMMARY: true, + ENABLE_SEARCH_SHORTCUTS: false, +}; \ No newline at end of file diff --git a/it/_static/file.png b/it/_static/file.png new file mode 100644 index 0000000000000000000000000000000000000000..a858a410e4faa62ce324d814e4b816fff83a6fb3 GIT binary patch literal 286 zcmV+(0pb3MP)s`hMrGg#P~ix$^RISR_I47Y|r1 z_CyJOe}D1){SET-^Amu_i71Lt6eYfZjRyw@I6OQAIXXHDfiX^GbOlHe=Ae4>0m)d(f|Me07*qoM6N<$f}vM^LjV8( literal 0 HcmV?d00001 diff --git a/it/_static/font/docs-italia.eot b/it/_static/font/docs-italia.eot new file mode 100644 index 0000000000000000000000000000000000000000..169c6163b35c962c959ee57b2c2257fd4ae9f981 GIT binary patch literal 11192 zcmeHNdypK(dGDUy*_oZ)*?H{D&hFgq&h6v&w7S>s?d?5~ba2S%^a9C;AO>S}7roF$ z4<1T@U<9!fY+_L;aZ0gCpxy%e1vE^OIkJx&Ais)|1#&w|(&T!S+>W*f(dP*1B@Hr6 z>Z0cTu%MDpAVKaYj9f8$?R8iFWc{ndDEWIrq@6pi9T_$3=old^hqC!ShZk(|` zc;A)}J^d2$gP8c&Z#{a)G0Yp++8^DC^`< z$7?Ck#Iu*^WEvzqNuH+;tH?H%B7(PC{UZ*^Md(JlpyCh9rHnCR(a9VJnd1uhdU zWaN59i2}Uc-eVX&1&nE=8mW>o(5!|T_+mCL`pW1X!L0)}NRC8N$LC@L*C2ZOfcfl9 zj9f%Z6)ionsy?*ka025+A=Xi}8AS^Z?M;YRMBohDmXWhDgOupGrc-Bhdi5Zm5~~j| z8lOo9Gv<^V5jC80GREnJ$bNuaL&lNkWAa(2Q659z7Ut>#OA8GWNS~FU5#-@8 zrLU4EjUm7KqELfNuPX?7CC{E)evVwhaHEn-VfX440GD2V=TH}>Oti{j4qRtA-x(-K zL6;$NE7bk2SMtkC%gdrSFXPI8=PN{%(dBDB)#Hf{cu+#o+gMcx zV>K})ny$3}|1vQB{{&qaeRTOvX`VdwSPp(-r`Cd00 z>YtqKM_v0@It@YqrCj#r$RD$(q;HZeAu(DlDKzSM1=<`PpNP>g9UtpwPqiNj<^ntd zqvARhg9a3k<5r9ypx4sHLZN*M4Gdf~X#bF>!F6y^9RC*t{xmW`FUG(S9o$qP59SK( zAGUv3m9nYf~9aV>4o%_1?=$kJI} z9gk~TWN*faV4{=H?U}N(Oc6z!|*f(t_*XfA7w8}6jmK`y<~Ei&gR1T72M1P z%<<`IjJh%oN-kn1u!N5+FR}gX0m#V+Sx2^zU&0um1t&)_Nd-MRgy>K}EWN)UvNOPU&&PcfCT zGiR1g(BpDcPO2|H+xq*wCaMnycxSaxx-C z<Ie;`g9?h|X-JU?>S6Wo&yfe8kQG^qF?vRhMb#%{Q^N$>6HJyEmF1`%Uqe5CxIKSF zdVa}{8zDiAxb$xq;lHI4lVti`*@$CtUy#+P(jJjw5{t=S(9l78mOg&CebeFgcf_(U z_JgPaKlcw3*7YXV^$@)8orI*iLf&0MD9#(`D)~nhSA#NG2O-!%$E*FF)pOlgQ4=Q} z(DZ1to^CXqbn`Ny@*q}yyu}rzi_oAJgy~T*ND$w&?IB;$s1_nAF zPl!TZDv(E248%*Ndw4}OskW1gvK;Ho;Dn*H9)!B`6fA1_G$jsH&QptVwc|L2;;A>AQE=uH859+I4SVMZh=D1FlrqTu@k? zo!$At+1Z0Is=>k8*$?iVon0&h?KfVXo_=b>4k6l{4>Xj$gsOr;7%wJ8qeAu~WP%(3 zyMQ&4Bl2JsI^>2#b5Ra;v0#)4qn^<3BMLM*d2o;QqqTuUYr7a_XW zv?ExqX&OVh{On+DetdksR-4V`hD^hRs4^r&x!i26Q?oh94H-{(>w@CuYISolSm${) z+sMdr#xQFByUUfdVb`R!-I+{yUOMf0tzs~K;*yDkQ_A@Ti5tQwlL~%zst`uM9 zTR~wei#o6iwvqY1KN%ESzMsybt`JP+KIB!QE~ahNJa5SH%5kj>!1ek>som#!!;V)> z=ta*N0s~21=)gndI5MHUdt7F@*mJ2>c%)GuYpoY1K+u`94@QK0*O2|gbO6-$U`~V` z1%QqrpU{XS3(MhsVT6Hq0CEEkcGPS_=*xIhA|peCbA8ovF`F%_v7y0%+pf~|xMdA* z4|0X97pJ=BtuJDY`Kdx>DihVI=4A`H{Pu=sNV;!kYo=cIT;`Zr4K_KI(95pjs&QSp z>e#^GkgAq|xKiz(8yp&855;0-zo%5LR(A~#HMW0h!}RrDT+ebQ25U{Z;Ct6kmuLK7 zx|sD;O;i1JaXRp4%4p^VO1$LAF+b~Nle${=Wle@N&=kt%;<|VJhUri3XbcVSs#eRT z9={yJMkGQ`kTQFWeT2-C8_9kg0g%3E+DngO@gOHx7^OS{Y3736nh*>apFl7)%xTH9 zZdu`V)u~OtfvPPq_XP7sRoL9ENWJe9nU++Nl zwjolIGe~?tyUowG|3H9+a=9Ln|EzM2-)Ib9w(i5OTTtx8CnJfPA;(qrTTF9Q$1OH~ zd$>s({`P98FeSU`BIZ^}xr(JR_8_xm5Ef3*P+g8bYu7#L&Tyz~ZcF?2Y!>4M5qYGH zpqTr{3HZimV9%@Eh#CCwE| zXt5GixE+j&THc}i?+O@t3N7ak^x&Ewsv{(Etg1*~3$E_BgM^-SOvBZ4oBAh5M&>Gg zl}svSMVOlodbh1zJFsELpkeEF%^cpnwH5?9Rqbm(UYVO5>aW&i+0%-KU9q*aS^jX% z@oclE8aL#wJ~frQJlAX6(RiY#I5M(-baag!7>EGZ*!1`OxGr0UUXYn**gd*ml2y}O zSFKjE#nR@!N^hkQ)YO=&ZL1o6o^P4MTkUvn@6K8+kAZi{lAGSNb^!QHXN`?$-Nmn@ z=?S|!qgQHEh0B8Sn%Z@12dcx_tZG^PM#;qVvX0%Aqqo`fkfRTf2SNK#R3J>2FoNZV zh=uwa^(tIC!YWR?Znz9;clguoH6aT6I?XzpkIt^+(rwD>Fs)^Uj`Py($#HIFc$`Hg z*te)0K{UzQudT$1PqnY%vV|%MCMgV7zbwn`x%O+h5!X(oY#^e>`{>L&CO-zzw43_H*h8CBJpWV?3FgNE7;kYcB; z0O@Ogfy7NnCq>bP7gSIWL%f*HUR5rqY>5`)y1t>&*r4n2_BmQ}Tu7Eb>iL2E4ttUud*YY96%1gTng3LXKBO;W)Q|EGozg zB@dgfr;Yk}Q#9pvHe`;Ic3HEz*xdYy?WGMly{6*SBr4B9!Xo?x}lbdt1JU(ZG zuCo2JTPxf9%bP1#>5Xd!2d--j?x-<#y{DVrSj>=3U9afdwrx9wyEa#=R5VMg?Wn;( zC77J+^?c7(`$|{*=9T?Bt1hgmWwuE!T{P24w)J?8T+rNti>f2^Z!nTPi8Hd;_FA#qGty*v#! zl{iMR%8Ia9>!{MIml{0G2Pr#>n5VSp7F+y&aYkH^oI59NGxF|I#?2dg+|U!fjdK>Ua42;~4udBbt+zG?rnPLHBSRAXcFVck#Y*w^`vThC-2)B&*z5Z)~#dKBv}xw#P77d46(g)^ykUgLK-J zT**wBfnB+|c`{M-JP$FJneg@BZC+_AOjYuRzrOgEZh*`N4&G`X8K2zZs2M7hZsjzyW?whC_ zW`*!e=LKN}b@Ysi15PFG>QV+4UQ-aDr4#qvce*e?-#)N=rFy1Nm{v6~31>x`yn9~H zC^%?UHCLYxrjpW%1W080UL>=ZWJBe701n3m2`FmzU{X5 z>$lw|ojqN;r`;FKoZfIx5bVaEZm;8jr+|B~L%?%FwgoLYs2e35B)j_e1l54r)z1lX zy?CEEp4T253&+QifM`vapJqNpo^VHPxbL>y>mh4LGT~CB^9@;=WyQhzx(Bx9n z9|~l*N^Dew$t(AZvT#eX`benbs^1k1HLcaBX{(Qyq%XDi`;AOyO)BMUF)gYnsYC*y zmz;6alL39CIPRuBUK&ea*CxlbSkAK6W~@>F1%C|POe=?O_~$HhZ93D)=Q*->l#cnO zR@%)7l)+>OwMz6x^aHk9Iy0I(kVq+9l`;GQF(yt?CWF~3r>hSHpYElci%nqHaPxneiY4l6}h#F_AN6F+An-=H~F7pgAnYWqhk zFzs#M-!qs>Ijq+oOj+2rq(*w^5B!molgf+dzqB`jdQO5)IlS%$kkd)DD+vcShrX3? zz~Pg-mVUy!-3=IZWz+#ulyof5ob>yT{f!91O+`r}k>v=7kVsJ{of^pCG3YNnkQq*; zoo>N!hAvU^aXzMYFQ0X)y-8#s7fwR@^R((tjyO z#E3{%Afa>kY$8I~R=nq~lFPwW_z?tL;^hT@jm4SPvKZa~qO@hz$C}0ZsB2kHX+o}7 zH_-YRb_<~=g6GInymr@?exR7rkd{fdzhY|a?=|x>%ee5>gu~baIEKG)Cu9F?^(a+L zNJ=Lh={bJNyhYP5{48dgG3nl==M#>dq*pW6{tA5v+bAl%&8);GC2A)RW6p4h%iqDA zzk;t1T)gYU+o$j?qBz77QZ`=gi_s!2bFavK<$nt(MY)aP{ka!Xcr3}@Y?osxt(}LX zkn99|PP1f5y>NowOYdAtu=;ieM8etcB$D`+YQ$>*daVeE}UgGX`Wt- zE%KLO9W-6nVs4yj*b7zY6wkK*_7|nDaevZvllL3${p;6@m~nY|`9-$Oo`l!_9JtnX z%;KO$Shez0xK-nUA3p}=Iv4(%Q{Wg653x7lI}vey6`D)*S;27ekb&zi`mA8+dg;!q zAwEDy)5D+yn6W$L$ir7*>`yg2f*mXJl`{5nYg;8HFqGDTANaA z$S)6ybR|>IWXAmF{LtX`QfUl&2!$Ohm98Ehm~V~F4-Z{aDz;D*RWviUMKQFPskA2! zga9{^pNJ?j{!&bi;Fa1dD3a2M@{QQqa032-Wf_>(ntaa;rd3;2D%3LUt@kb+n5*`0%;yF}IuGXZ8~dws1MgY- zF-{mmIlRdEXTXQb%Hkq_%1VUA)ChDiChu9~Eae9!{Ml`Tts8p|)^f5~*;%hIteQ(& zlwO?S@LZ+Rf@Qt%5pezI&Sqtfh9&Lfj68gJg`M3=MzG-qQx_LI07MH*z_bl5VJcuL z_>BAL{mshoPvEZOKGA{KcT!$n!~G!cZeQN+9PU%N zC$Rby(#vr3wc=i0M#{t*G<>U7!1r^bIIrG>sQE^+7aum>MLvcY@f3NKJW0MvzD53y z`~&$u`B(Bfd7DP)Wpt6AqOVE5^f{)nKaXsdN9BKwekR(+7U;P8lh_|>Rqe0iH^tA! zFC@OMZ%Wz*F>W-zZ+^@Ab3y4T@+abpKz`Em?kh>2>hOc&dzmh8BJH4mO?$ip%YX+va1`*7 z4y@rDz_WXg?zv;=;IV~62NyuL_xOtR`hB^a;*2jz9ai?UpTgJZ|^VP-MeMa(W{RhJu(a_;Gec0Bfa?absr%9 k!RrF@`>@1b^2_9IJhy + + +Generated by IcoMoon + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/_static/font/docs-italia.ttf b/it/_static/font/docs-italia.ttf new file mode 100644 index 0000000000000000000000000000000000000000..96a7767f4dd660a0d79cc2678274189f10fb7ad4 GIT binary patch literal 11012 zcmeHNd5|2{d4I3p^mI?p^!72`(=)v@(>uq`YP8qP&dwf4T3BSXxQ5*r`*0-na9n>yetszk*cVxBu3?n>X%Sf&A|XDa~EGXXkGF zch~-mkiPe!e(YKlDBojmB7Y3|^0fyJ-*Wr+V$;Zf1NmR>KeTJ-M>ih5laLjkMgH)C zowr<1-a{TCq?$m!=itr*dp5l9iRY0YAcTJF`a?Gz#=LQ@{3Wj^d@UNulL12a?>u~v zs3gK`aq$|u|GIrUQP$3(j@MH3;LjeSlPR*D93#(AhgRrC^fG!iy@lRIe=4b{*NIFN z^p24@=%r)T7O{y#QY4Mq2OJH1CSdJ-5@NHtO+qo7$8Gw{W1T=bREJAzvW zY>+I8qK?nS2Cf10^a1nPnHaf%mMU6$VpY9p%i#pZixLU9Nk-7ZLwl190pd8rwk70j z%pfUxu4va8?Oxr;C&lUmjK+JVF=I}-VNt^=Cu5u*Qp5Z&BV)+(G5M@hD376U6LWQe zr3*O)qYjEvzV;aAoEF&gz-9{EbwNcZ5q|Zsv2y$PT(w9hs#*klrQK-TB*F}W9m}5^bK20uSxKYWauygeYfJ-mG zv#1MGCR$}N2d*=m?+g^=@;OMZCm$lWyqH^DSX>mndD%{KBf0rSBFgCEFBYF)d}#5( z#lP{o(Qo;9q5~e3Q1mvI)k%bmPl~2X?f<_FO#eSY7e*ggd`+5T_rk7uqyzzRqNQS` zIXc!DNm=g#OLG$|R!qFp%?A4>Ci+m<`r~$k5I`xHy;<@__PF#Nk|88UD@BDy9WPHC zBV*$+8m42TeeChp{lRR2M_`m)r)D*((B$ zx3TyNI|Ul?MHH;jO5YGI6{AWQb*(~}Iw`)8f)%D%&=hT2g)j}FsdIm}B z2|XQGG%c>B47y$i+Q&G2-I(oIXP&^xZAm-Pk~EiQU%nr9fErofe9uJps~ zIf=rmW3J~-?)=%DJ+p+Hxqvx7J%v%1#zDzB%mkM3{>25hm)!+9878a92J%N31GM1e zD0ERlk2WFN6c9`A>jP~9Fd?9&X0l)vT+wJ1Wra}E3L`1ki7Myi*!sVe?YQPBtt-?n zSzKMJ^pQ3!>GJcM8kdhVm9dj27mm^+a#Ze8pS!R1sF6$>bUS}8gQf3(0nKHZMP)QQ zdr~nKISSa&q%E4O>6UUVB1PpdNL{LS>g;J&c|kQ)SzaVbgJUw1_asdYm`QH2uU`C5 z_5eEuI#kJ8*a7$il8cGKh6v@$$BIDG<>ffCs_dF~svJ_+Vq#TQ?56h;8 z3ADzUEHNs}Q9HhZe&IlC?x6I{f*m(Pf*5h>-_OB6pc0d0`a{`>V{wnjYE)?rOEHPX z~sAfYQWF^gM@XxhIQQw?|U;L$&QeBmJo{b8oEsWQN`7u z1lBcgAxHPhh9dgO@?(<37)S?_GJp~Gm>?Lh zm-j*hC|HZjP>=W=dD6f@N8$-l$V&zCsEUDjsdO8!h<2&1u6bFGwP*4ei$Foa9Y&?c z#L%MqJbhK|io$<$oAE5W2flp*GIA}{r^rW~n(oDg4mmewj_Lh%azHP^H z_`Ngh<^veG`E@hzT?YTtL$j}6am8hnNl^(31*(AnYBZ{;t`Ac%fmkpF9A|(viQ=T!cE-9INo<3UPyz0-4T{LFSS) z777!mTWFVr1?05F--)_e$_d>0xAhkM2wQ}B+npz&&YTV6ACA)QI2o$8H1CZD!ICYv2J4HKfukPK$CGu3v@ z`XD=KJnXFs3hOJC^@U)S=T&VZEz4=csQPa&S5k&ul~#6UGVXb)l;<@I!PwFBCK665 z>*pnI2%}8O`lLMTujdUpULm0uJZBILBsHM}_mU&Xg!1ljndM^7rB>mQMs2jYT9^Pq zXU;wt5$;_>_7Bm1P}_q!5q1;+I);2gBaSRAhxdgM2Ht+i4LI0VvvHv>V-1N64-U-s zR!W6Trl7_K2l{WgMAPGzHMBX%<}+TL>YBH@fHmeO^X18ORHvGk$!Bw$>zX0yzL}|- zddYK{V`eni))7{R4xlS_I;9rEhj%aG2d2iJz zl+DI0E9eTc4ZHm3|whY3;2^y-)(P!+M zC*2$lmC0^s-I&Q>ydWYEmk<iFI-*g0!T#LJ2Kaq6)WzQBlh~bp9OyLr6^i& zeRh!0GmdGvdUjpk#PINJxwo87Canl_Q$f$Bl`H$#Y#A_Y-L9HLJ2qB>Agijqt%u69 z6N7z~nk;)-!LZA=mNHB4uR5M>R#oH5?4`#ivlnK2Y&#lHbQgw)_l}ILumb}T;0l}m zg&)^t%h2;O^9;LN_lvS>nyV_6a;8vR-&^h}=Yy&mQ?*SMqu28-b7-R-@9EiEt>!TB z7Flvr>sIyypXscy5v{xU6*WC!SEluHbuxcJP+C#FVr742D3ehwtIsH!m|n)QJ96|U zdj@j!9&!(8ABqZu$r47eR2Q*OU%gg=OGjA6Y1avtLG3nwI=#k4L2tWRd-KuWb)3IV zSstb}tG@PF2uXIWn7EU9OMI>~PsU^NgiHWdM zW{-yJ`k`1O;~0X4BF+@UxU4k>3`!Io==FzTp>~i%T851MuUbwPtwRP1Bc(1t7k2#VP1Lh$-&JHoGxa3a-sPsgoAm1O9P!&qz; zwHhU>QFG2AcI7^6oSkUB-uko5kn5FAJEN-Ll49w4w{4c(m?}GoD|J^;2 z4+`rC3prL1g=5?TvZx?0lss&@n$~M$4bha_*^oI-%4Lnld}IA5HW$}q^{R?flc+om z35)16pSt*xyVqxDczn(VTxIj;HkLQ{mDZOp(d(BD^j}dQ*ivO|yQiDpXv~mJT`%jK zHf=hNyEZxS=O{9BDnY@r*>f^lv&ny56;LM%J(oWZg%*VRaPs@KLsKA530ck$xp= z7JfpzTfd@Dw%$XJO;4Ygo^JgR$fbYK4d4sxg>ENjm(ttYNVgb}3=AEm$AD^QAx`PMVjFHBE|zM!$leZgHg9o_*tg$@>q8R}~2YA=LY z3L$KL`o=q%&|`-Vmg}+tiuS^b1H^xb4pR=Gls6p1?wj^K<#a1*L^akn?$iB*j(wf) zxF!9*i7U$nT%|5K&g)*?b9>ALV&Bb;$!iAevSk}GGxRrt371N88Ga42 z_AF#AM;c@u*#aGWcVWWX<+lh+tyJtO72C&m%VkXIm@xLZUUC+Cor0lvfukiyx&+qw z41!ieKl?0X1P<^gG8|ImmRno@dh0EW-OXucEW9BK89O2T=U#S$kd>0VP;q-gS?PkY zmb%?i;=vt!^99=mZ@Qy(#NfM$$3;%6wNC!zHqB+jUghWPi4)>Zb|y=8yleuO7aD$%I&q?$3Ly*_^vb)38chjDNF zTw*({*q@NQAbp`*d+UKtsA+CnBSTLay2j2qkirip+y;O4HqULwA;SGo^yawR-nWOI z1Se(O5Vl9@r%kV2-@*2}lwKnI!WltWK^;A<;($|$ySkKyh1V1WXsN^s2!q@ei} zxdfK+8k}(a&nX^?ung+rV5m1Fy;~cpgA*t#iSpV=p^tOLYk&jIl5$)+wY1WO0l-G0 zOE(IR?uz4PtV%ky1mAE&>y;aBkWQT_-qz|3rcbQ7EeLktPdC?az>~*4&?ew%A=`qM z9Mp{>4w7B{CxU7~?dqomx!%m5e(Jn>O$3JU2Xkx38p=*JG%#xNr(0L14#?pmgI0Z{h2?Ubdovo{6%XWsOKc; zq{Hj31Ua2VtDJCPbLi^{2OK`OZQ(b(+pU06S3(^iMM=eS%t^ib*x!yI+*Fh}w=fC3O|B?OT4_`udz7Onij(w zK$JGE+GwLt8*wemDUQpv${Jc5#cm<=MDQFrir4Pi!p{^_8r0HVt*@IJ`;lf|U>Rq> zk#HEh3&-$hZ)WV@tZt=(2}!AhBR$PenKx+q**9XQ8Ix{bcqZZ4UG!4MT3@I4VjD%J zH<^`Kr$p_p1DG=$;^Ox)=da`I0~hc5@b)Quizp7Ugp`d{dSkReOWZ4RU-{nxicxN3 zcz^DN6dp^m*IK1mQfuYlC?q?V&t06u>Thqg!1emcqYrH zU&dSbg#p9S8XdM>$Ttn=a^NFI9p?Pxdk={;cMsNPi-if8O8h4Z#o5~6?&dp}_Rm)O z*5DtVrm3B7?XF+bC&Xh68`M8 z!PbpE4Qn}3C~vLRb}pMsN|c_P;m~Zk+=OL4`vGwM_s(W%j)o;|<%~RVV2PcbNk*{Y z220(4EiRvBOyXA0#fKdGh>k?HX5OoxW}>jB+?6T^R?n$Ttv#m8Z>;XmB;sUBRH>Khp71~vYQ+v zw~&t@Mm$a)Adix7knfUzCjUZyN`6gVA#c(My@1Zsf8KVtw;kjYSf89=y?GOgM37?ByM-JnYvHeJQ zZr^j`P1hYd*i#>>;k(B@_>Sx*6dwYX9#Y4*eYHP`;SV;L-LvmQ`*+?5SG|Yq!^dm; z`R8hXu-Cdn2M_n`+jDTwjXMwT+1>NOTYEO_I&|rwLkEW-1$=&oF~fa8c~H!HC-Qr+ e#2)fNax0!2u+&4K*CElCf6W?7)7!b(F8MDQ8O)Xd literal 0 HcmV?d00001 diff --git a/it/_static/font/docs-italia.woff b/it/_static/font/docs-italia.woff new file mode 100644 index 0000000000000000000000000000000000000000..cda2cacb9b6c8afb3c845bff87d03a2b034e3dea GIT binary patch literal 11092 zcmeHNdypK(dGDUy*_oZ)xq0l&&hFgq&h6v&w7S>s?d?5~bZ`iCdV$0t6oWB3Sub?a z!+;#X7(x8NU_?ReloFH3g#$JOmx(#FeZMkxIgb;QBE$4VL?C9vOgF8QfvL7OUgs1dZeza}h&YMscxd?f+oy>g)ZrzKr z^@Nn>c-p*i*NW@+?A%RA-(zSq#*_V@*Z=f-6r${B$d`FizRTXa{@{^Y2w4$9{+B%6 z{@vL0fy2AdZp9ho#ke2cciU^G$BF~&qsAL}TJnhbE6XdxrlBT5wD?ereS=t*Eq z;i-`d86}sHDrVq|*|_K{qjv;J2W*fmiK33r#Rjec^z;Gq*_jx*fR-v+dSX?*Xv^UQ z#)}dO$s{9a;i0`rh5&J#VcQaNHfE3%Jy*2rjCQYXA!(wH%)+_0$Ol#?+| z52<1PmqVIjVoW~k6v|`h+r(U5VCh0m!Kj0xl&?L8Ij05oJg}JpcU@3X6L%X@Q9}(M z#Q}}@NFgu!uqHmT3oHpSp9b1-9=L?D-_Qq8N2Je4Ts!U$pY#>dpfTi^U({Tl9YHII}aAWpPYtTac*8Y3y|cfiuz#EKOY@0QqL-^4^8>RNx?ZV&<} z<+3+RKF^+zzD+WO#Av0c(5U0(X=7w;JVwLk*k~VnqV-@f8{ifgW!EViG@yVSw`>Ff zy^_x7^R44(VBn%b>*xF#Tm?7B@joW;r;q`9F$RWc8Eu-rhJX%lc>A0e4aV=%g_2OZskfk%cIv&>yPnRg&wA2c{ z<4Ss2Z(z~lqPM1bhT&-nTp8v{Kg^z&D6Bf>dfw#DpUv4bOSqW}nB&t^7zg7Zvnq6QWH4vGl$^&?W#A0$OS&3s%7ujaE@s z2qmpBl5(A>a$b(D{|niUYmU;oO6`)x)ul=wX~U8(zo4mc`8ZP97(FUSMzgag6;qL;fDKLBqPd!GDGx-XsQfvpOVv)DJmUSc=vbw%y?U-2OKRez0-73W)Kc|^lWJTb zR35~tjWxNVbPyWUf-pS<1_|Puwms-eTQY;TZDPSF?E;gdik#FIzM`3`9Al9vy)CSe zqkCmT5&dNOi;~0`NC%QKfD!gZK`>q~?}Z3Zuojo09`!l$q=A8s#uK8DmkQ)j6$9~7 z={8;w?NVD^^RgUk&*Y0N0tE$k7?r*#h8ErD>Fa7&6#kprjOW-r@a+?jk?Wy8MXo9^ ztz1-KUZE5oR<gc#*=&%XpPAWu#mvlp7}a3^ z%*+*AXJ+Q}LF@Hbrly`)vqgwD=K~F8FQKYn5XOs1(WsEU2pK2)Kra_wXqX%z55cl@ z;id!s=x=6bH{bs(1B7|$6-F0OSY66YYg+q5HCu4x*B+1$)P zb#82Iu3DYRW(Q5fgs3t+2D90jYP)8AkR3E0^;QLi^_9x{La@s7sXCI6R_pTxPhiE^j?ZKP~I|=|DLq4GqM;4aD z`@#qVZ$IP)9BixExX_oehD3%32WERKr9viCP-BAw{Wn~y>2b>%+8ku_881$C&0Af- z8grBR@?<)yQ_aidv$@T6&5(58%v4RiAG?m?~sERnt^IRhSC= z=@OcGff6q|a?HNn(|U3SUkwd6-FryLz=l@H^&77#>Np04RKoXtXooeT_viBfD9sk zA)NJS)P1~#Kj1!p4A_(03`%FH2>Wy+=F1Kgx+D)4;Ub`!o4dIJ!>VI8Ls!CEd zjD=Um>-7yO*G+Ax*T(^GbW$J#TO!kp{-;o!E~WJeGnkAPA)}|mK0Ygp~Xs6;dU@8YI%pw zzawDiDYTs5(1UA!sE&}t(TXB{Be<;34ib9CF%4JGuIrl^9-b}tmea|k6=7~F=-IS# zW&fHj1BR{JRdZ;^#%d5`RkgSENO^W*u&+{+Wlt*@cG=caX6e0E$Ft3wm?5_-EGOA_u8ATJ*%Q$vNj^1L=LXIvW_ki}Hs6d!3VFXKc5exOzYZbV3gjJk& zop2e{Zu6(pYg`ocwwtv#AMIVo`P-D`VOrA)9q0MmlcU_q@HmS~uy0X0f@qSpUR{b4 zpJ-jqWeZgjOi~!EenpmBv#nRN!>*l7+U{_cp3RQfj)fpC#HNZMqNT)b1f)?_G2_$` zqhKIYlU9nD$%s>rhiegra7_k;&@2o~Tbos#2f{osp>Uu~rr&r%vy>lMjy;lXDcKRr z1?XU4m&dUPoe|QvUctUW3}@-|xA7!m8IDpDYYBDvEp`&}-;X^E84m;WNzRK-WO^Yz zpNa(`$*z^0!X___yRbP1Z`v$E1QFK4X#}!}gbp#a#P=vM5mw6V@o-%~5Nl){L$FZ9nPM21wZ?!!iGn6FJ18B= z;h0LsZX^P|{xB@m4sw{>K|TrzlSApiT+fLTS5W*xv(CRRXt0Wkeasr#kOcri5nEjd zUO#O|__YyEq#Ez(xV5N~41IAJi>;zoqhvK|&N;-c+-Hrm6RkH}f0`L`y|QU%R25uO zEM4!m&5|2aWhZg9?kZ~RRjTO@YGbPE=nE$$Qx0To{UpamC(0gt)f+7qN*{)snprN({q}XXIK>F%e@o*E;1ET2c zb1JBZA)e1ol!8E+oqz@%%vk%BShBPjT6~hh*3h?2*=x zJssN_o&_jTgf$^uoGACc&}gC5JZOgph4q7l9IJ@JF>V1_RFD@+9yVP~>$S0lXv*zu z$Q&o-vPNURvHlaAi)*raRmG`ERGx-}Mf90_FTV8d_1PI7pR)m1+5DM}<;{Ji_2o83XtGh|cO%lf8Gn~oz@XRGD1W@*(eRT!uQle0aZ@7Zc^@uH7i z+_$yj!kSuUi)2#;Gu6d5{@Es{>ZrXAvkkLXW)>Se&@9gs)Bz1=z76=s=RuPQ&P}^; zYFUE>ZY6VMH`$MUB;UL=`OV_DRn#r<(Ego93(6%VjtQ%mqv56!$0$}w5f*C|RhqS8 zorn1#Wm^$*los4Vlc(pW#r5Fn)6ym*=Psn(oT0}JJ<;Px>!FQjB-*8a!|BoWu7xwQ zhJ7IGKGqGZqo_xYv4#6#^5Tm0lBikuG3{=>M4xJ1LLZo(J~2Jr`T>wj|DYSd7uXBk zPR=kB*wI)pTvA{cw1rb$y58eFiE{)+m8M%yUW*7LN*_H&U)n2Bii-Kxv(qn5Plvvs zvB-VFT{s=y0Xl^a7K$0_YUpY&gjot9Y<>F1JDJd9hYptOvI2_s!ixjMe~1oK4xp4b z9K-IL_C4)%D{4eF);8|f{e+Hvo$t6M{r-uo%LZJfE;-JdUfpwh%miZJ&5gR9jDX8wM-QO-#<1?n-}vPPvjRnF%wn%hxp?NEAHJ zLyTo6eEn06i%o^8O3v_C7v9tjklDb&TlIZo6B}Gr*0gTd8}Z-t>{lJ^B-Yhy+sjfs z?zEmB@COWIN)^=O80+fIpVukRrF-+WOa9Z(;0iPBUZS zx1x}-6T*M)Wj6>}DY*+3w7rM2#ALxXd=C(C5^pv4%?3@EB z{9wXu@Oy9b+-4ji+z&->j=SxBd+14UQpOEodz60K^xE|uY;Q{GCBiS95rh@g(bFmp zIF-1oOKDhmO+kQ`O5AbBiTvDLYu}Eg>gjxbO4Yz5oE2&EjyXN8;Gk92TzxK>QsN*w zE^OiMgC3XM7neqR5nR%ZK;V6G3Ezuiv=dYL7w3ZF8q~VFsN8WPm;$D_%yCBZqGC?R zc1}5+|13t=Y$UpLqu}VSIBv$Oq*F`q4L7u2yWs}u)QRG4t=?ez z#G2cJUPKP|}hR{r$UC!T&f2-fU4 zy+iyTnx1~>H0&PEQw1K#HP9NK$$@!)~6v$4M*r*7TSLzdG z;g)3ikx<)JzatoGSj$h-mLD%kUuy03>*@50WYX7ST2xVzi3CC~Iqjw<0{UQK%uRW` zG?u`wO^#`?tYxiCTOlnG^S4wAO)oPJ&K4yzXj{(@C_-2?sWZzL{{q;Rm)Y{F-;W6)@^b zr~{-ZsaTFVsoy>Jw;~8P6{QOgS&ncB4=L)TlKpAi2K)`<+{!bwOU`jBB+xx|%UT6j2_(rg5|?Q+p(;iNy9`g=JdM#N(Y5;{l7$_QZ_ z@t(UvE(BNMM-Xs{mlyms7H3-1Vt50H(xz1#Z4_!Fu4OsJak*AmLu;ehErgy3o+C%` z+Fe`tsbWflTDq(CHB)0h)XWPk*<GKh9l(9~>?u~2=IE8!B7X_iLDO|D=EkXp zy-=A>@@(t-f9UBNcXqjM*PVuY=jzoWW?Woce4Z_`$Kka<3$Aq>vp8rGR;@G{Zq<0; z$B#j|&V~QRBsj*yL+nlXPDGqvh2|1{mN1+uFT}ju{=~2Hi zH#o4lSR92OLSaXX#mk2J=b9sPLxYzW3r!S770rxoPz)_*Dy{K-A;68~CnAcBzZ8=r zc%}9-ilh{xd?U6poPghNSq7%HBG)~QX;qh%3N;avP;D(1m%w>h#tfQ;;^l)wb0e74 z&}HwKR0Ykn7`=uM-WuB{47C~44CNF2GzFoaM1P~8AR%;*!LBaAuGU~xKi}bE=<&`Y z{xZ^^=fo^wA>W0=A%Ddtpnb$HWFq93@iu;8z;Luihiw<~O~bhy_=r)5IY0T{Ln6)H zgSFXWVFIQS|A|6zwl=uC`R=9tvz5NJx$Hnl=Yec)ZC_=!|6NNz!UVM$v#BM%;2VrOTP5p1}@)cN@~0MWt{Fl|FimhuUigh&<7&*G(Bx-e&7MJ4#koRwp^x}x2*!?o<%3=v)ADOF#1s~Fx-D<;zX{{x z!iO;4Y&$jZYb&)69{Gj+=ro$TvyQ+`1%NfcqZo?74pJ~G~;6fXY0^Zez zHN;lm;@@gTVkk+WCWIxNqukqu8Okqf!~EN{N7}Fqc%ThO0Uv6^8omKMwfpd{n+EqE z*?D09PLS;|2D}NMi|xm!mOHWe*iUwD-*e+l`wt)LsSnlg-Qym7M|Km64+BdNspH$e z+8@O52OG@p+4sQ%J8y)m-b41`S569uxL93E``$cPHwhK{tGp| B(DMKQ literal 0 HcmV?d00001 diff --git a/it/_static/font/italia-icon-font.eot b/it/_static/font/italia-icon-font.eot new file mode 100644 index 0000000000000000000000000000000000000000..5242e53839d7d1643699f0b6fc9a012d4f4d5f56 GIT binary patch literal 23672 zcmd_S33yxAeJ6U(-2q(eJ4k{T00C|wNP+}Fi4+NulqiXmM3GuZ$)-qgktnXBDBDTA zB(@XVl3(MbQ;%ai9mkW!P22{uV`r(`dNPyN$)uSX$F-BDahs*{(DXI+%S)4fstC{T z+zV=PKiZt`)^5ni3XWnGhAds84}|05{W=2lNGo&V57EDr73RJm@C%AXrXLxSM z49OQsaXUZq=4o=2A0-b1fVE_NP$yQ2kR%e?rLULoeG8=wDv7gMFBizuxK{8*i$!xW zS=|2So5+!(wb;yZ`iJ$qk{m^z;>+P_0sWSUjB*odvJjP6fpT`Npp&?Wn|O#92?HS&}0iWDD6! zI!PDVhQ`^<{r~-=vI*e+wLA^oY^{vMR<>A9dY-K)lD@LQh9biVb_PbU#4w`>Oks&( zVG*;-62s4;Y$U8ODFTaG!djD}$w*jrV2hC$CKatl0w$26%}BrrQnVWh*g=Y*ZkB*2 zr06sfFoqOeMq<=obQ=j+M2a3G0iQ_GYb0P6Df)~A93w@)k$`Qa2u{Ef@QxINMgj(s zV#r9qMN+IV60njKD~$yFB*iKt0aHmaY$V_;DOMW^*h`9tsniQi(0&bIH z%t*j;Qmio&@SPOnMgr!OV!}wE0aC0r5~zU`>x=}tAjNtkfkH^J!APJLQfxF5sD>0l z-7JBANU_;Spd?akF%qNxVylrrU8I;c66lN++l&N?BgJ+jF;P&=7ztEJir}^^fgVXQ zXCzQ2DRvkMG)jtFj09>WMR04DK)0mWX(UiEDRvnNv`mViVwOPFq{wg=3G_{hJw^hh zlVaXTpm}gOBQfe{IQQmhzQ~UNi)CP%9oXQ3s>+H`FyQff{64SSBoQf7 zK2vX7hF!CAcK^~Pdh4Z2r3WtI!*WO)A2hO;E^%X*E(dVqj`Gb*>>hp?2fZ>5g;eE3 zvLp&TM`hAaaYrS)0Ro21iJnI4q_TLiB61_RQltI(v#e! zYw9zRx_n$fHFSXIII=^QINFZ}DU<;=9{{C${0>g^HPQ&`_0t@U@Wpa{WAx!8r9a>< z(T~!JBPI1nY5E8~{+9mg^`pW8N#y7b)<{2VpN_Cb4zscC@#*zDBh+uAGL3NmR(kRX z{b|W{Go9EFsaEg)QBxlm-un2Q~3F0A@on23qZh3G_QWpvrewQcrqj7~gU zuK!4BUT*+(G9E_wBKIL+h!5DVxBvplNR8mH%C<_A>g9Y;q zZrRwa8$K{TZdA61NQz03OiNIVD76qei9TBdt7Vc14$AQYH;Dx`E2?=CIIBp!GU=oy zSu`CavM9bS! zpixm=6NKvK#vX<4Fk3eEzx0xp;#2?lR3H)wJVmo%F||Kcl5JLnMl(kJw{n+N^-niqAJ1V2mO8xMqd!ilD(u1*%=bvi$ibks{W6`R6*j(y-;WHSA zheROzI>=`R3x3c@Coxfpnr4Y2h=L+6Stw_w)P$+CQc0zPA_cWNBG=5ijp4sD;*3YGoz(V3OiYKV z$3~+m+TKlb1|0ySf#EUHBSjPK*|d)@T)v;b?ehJ>>gphW8#|W%F*TG-4&AgDhvu%6 zU0o+{o9pVD>ni;ylF}kg5pI3s6)u?z2RB{`hQmQF84Q0ixtD>nL#}I12gf1jkFY10 zj;YJ$QOvAHVtMU~c=h|h7wG^JFi+>{L9Z@=JhCK9T5X~>;mCn*HNVgAYo>Co?3evH zf3B7_-lx^+n1pRSkQ$9?x)NiC`8=v_C4ucl1)y|@m!r>@hxBIlUMJ6C$&HS*4KwLgG0 zF=>ewil<8JrE~N2!P5FXy+9v4RXWH02nTwB-B>@xZs5S`(Q*01dLKE0KE`vXgz{%M zd)BboIs*lbmvtu@GBE@lc3*zbDsg;25vWK7af!$hkz}&ODwIV@=NW{*NuiW-V89{T5^Ew%NM!fo$|MbSN)noY}zi|2YDr1+p z0wdCmVKzT3@t%zjn#>RJ9uW5B!3a}*c!KQ8?=WHfib#|R zGlVDQpo~D833SZBGD%{j$y@o|p%5jBcofJOstQ5f^Ehp)ERY}#T9|spI99AoQJvJQ zO9Q>%jMV(#R%{e)eBqPf(8e62n@?5;xkrQ5;mgb1qpxqw(HBDDPjWxVg~H*`<(~(u zI~cL>=1_Pe#hWhwd?m-g%l&^<=iz4TYQO(m%F&LUn)IUdhT;{ zrZidlzv=hs_e=kHw2ObbbX(~!=oWf^7c$%Ef7bC^$DJ`ytvAm^gsyGPp;@%fbghhu zGK8IBOLHT5T~oaV-o)`mMh_g*N`I=a*_)T&e29OPPlE1z(7?v>hdQzxFG42q+yIfl zW+mX9$O|IBKzI&X--3)q6(k}|DwG4#9mI)aOUlt9GZwry5!I?HoHmos>=Ol|P{qX7 zFpK@6fR4MdR*?J<>$1n^cW2qsM!{mBw72K7X{h*MICjc@S4yEP&_DlE>X1r5E8ScA zu|(Au!U--B<|=Wld@6K$BwyDrEISsc?#sPNgdGH#~heyXxA0_eVesemQbBwu`i%L!LBa+W)+U- z+xGA4?y9e&WPI$<=)U9oCw2|=_jT><9?E4}Q+1v7TWb@Ma4>-FmcuMVYqoosZXbyz zz%H^-#(Yp2B!<>Bn%G96#AOm$s2DzId=f|%W$pU4m#K1I8-?0o6fzK|=y_rhlrW$S zlYLdxC&l=eFZU}ptBHT!YPVe;??}RLgz0iHk8_2RzRfpYrd5>aC^Y@niJ-Y?eaGUV36$iINMa@=w=|gsF z`AH>e)MZmH2rz_T?%&G0-TF4~+@_e|KD=HQGz@f8wvLbp_V>g2y_j7oK{>gW@*F=v zWPuZ8Zi%q{28annB!h^EB#DQC5KQ4KFFyE5EZR^XuZcFs8iQVM5bPufieZ8ndtkpW z%>;2Krc351lgywTC?#>maIo=e!#?!3x#_K)om;2p-k3YFwX?e|eQ4}!V~5gh$Q+pi zzt}_XEyWw@_q(~j0@UmqbJJV882D{-M-DTn!$-b;1mJ(%U5Y2^_e!f^7nqMXPjlY| zf2<<4`5J)|$XtlD2{wc=qK`n|w@2b^i|&xcibmQd$DH_LZ{D8kreNMWv9qDrsLb^~ z=D6^U`T2C!q0aN8cG)b;5-;&0&zYZQ6Z`b(#jRBpPg4rEBZ)Q$7&gaG!nRNWtIRIa zo$st?Js8+(<+y&v6;}nwO03#JcIL?#6`2)uC=usKQ!>6QF%YQ=1xO87BQu`V3U*^K z9P|g%Sesxxh^codZfj{xqsuwgSKPTe`+i?FWl-$f&K`IFLu6%oYzUyFqIN4qw&u`no{lMpM zOl>=I>(tVbzFmixCvQ2JPc`_wndZt!LnarAZO_+4s>0dM$Bz#m+dY&^*VUzSL%WX+ zAAhVX8-~&ADvvT`Zv(7HX|kR_LrjWUF`1W$%_>@L;*uS!sF)y;nK@WBTfl+{wkFmI z$EJjydRqydZf$8!H6g#H6EUlevR(~~Vy{U09z2hAu_vN3{7fSt`>7C^GXva!! z1vac}^btF-WeeGo&kDd69t5~VcoDw^B2xSoBuom(PnYDBWZIJrk!ru!B!TbQbVM=O z9ph^{`(tW5mK`VoUBqAB(8k*nwb14v*Yr|@NcpDSYb!$=AKbIHvX`o!Ccih@8B2Qo z?zTW>OQ4aS@%mkDfvOfi%93j_pUKLPY{GMAcCVGxs+J~`oJ@8A#^&_+8{3d^c>v8y zlF5h%=1-khK}LN7w0V^D=eG~$yIKV*xF}B#M>&Xc2qs}*Aj1hephpTT1UFV7&iNHa zG)$3!lMw?DA)fChLI3!Yg*vlhSugjc($CY$nsCr^C^f?WdT`EuU08^$Wuqp@pRu-fd_8`Z4BEJiE`iIvrF{Z;G#f3x$j zJLSIp?Zt&}|M1&C{K5CX_jiB$`gi~4JAeJPm;U@KU-Com;nbWHZ=01Ownf@%CDLfw>tSeWS?5K%ThJ#Shag**9wAyt+WuQM#=xSPjme z;dS1wV}A_$bw<^U^RpjAa%RMWMT(EeF~$OPt(8NihTaO`O;8;k2L=&?v~K2fs$ry6 zrW}w;8%rt5v?eIKjI_X9m}%@9s5a3XgF%PMQW#{ck_79KsHo5=Es9BS@QNf>`z;Qu z>PQ#uIY6WCJmCMb+&JD%K>`=w#y^*NH)g9Ji_3=UO%;STPKR%drOR6klB(h+F zt<5YePyn#&pj1T5u(?Z$yRynv8+NH?vy8EF7TmJfTtSSk7trJ#hNV9umS)zq#* zHW8vpRLq*o>2>((>SGmNKPOqxAAicNio7TY*b2eQSXtE+Z%7XBjCuVgNgvANkL&)q zH}B+MD3KXP{2!hpBerSE5*C1|t*&V1c z+~jpP^A*>YQ_3IQyv@@gP>b8+rouZg-bY?JO}R&29oZ2 zJKlZvo^yAvtgWn_Sv_@fYWc*{v7-kk4^8ghH?Xs(yJK|gXnVS@*6<;DV!oJaB5uxI z!Dc1`s>Ut`;#;>ZJ0aA?2+VY_j6&Okb+nu6COe%3b#Vr<7N+h9jCe3NfY!Zun3<&+ zr)YD+yhq>O$_LH&7j3b;dE*tB^YG)6`g!9KE(w!g>8tye_m#ey9O9aKVBD_Oy0g^* zE!^9d+t#%43IHzE`uuzDdi1V6eqZgSGL`D z13!W`u4}L(Ih6WPH2NXbxbas#3q9M~bK83stL%z75`{Gjcj-!PI=f}>U3>Q2wRcN4 zU0Y(X^vjVgtgS8EJEE{mP7F2bHcFaUUvKg`-^&`rf$1gC*UL7HFnoi@Ac`dHBP6;+ zumz@2z(6LPVwxnd;}VG@lNOZA0yEzVJTDxCF3M~~0zafxQufW&scgaY)dr(wz6CEdeSODD{~=hj4Rcre zkUo)-fBBbSO-+!#-zcRk*OmT5b#Q$>+!n^~b)=5!!0W;4(vPk$&1tMuA3kX0PV8B_ zu`g_aZ{VBHc_>vjc|kiY0X)2EP)V8N2{QtJ7hNC_I88(_J}f=)h44z z{|e9IF=ob*n8S%Z2^;z^YY@%By2#ok%Xkz!yMwG@2@5AmjLX0$+uoLLZLEv7#9Hdy zz8a?)o6|Tpd7uJAx_X^4x2v|z+p>jYVog^XnHvZ4vkiMHX7b_NoH4%mTCj3ULpW#^ zU*jnMTDT@Nv@6?DtzCYoyOYKN{`SaZI2&K`D?1R zo<90dy{*mRNF>~x-hMgHy`SxabbMQfnt#>z+?C&ArUFAPL7afH5BoCPx597*ck>9d zU-5@cY?BUh@_MduF{`?Z8Dh813sqJ`7KdPOwZ+Z@xPe=EzRk01oRc}svA`UKQ@HC2EbECQ89DYAO+5`Vq z&x|h=@^O#ixbcJbBd3nEmG0r>jXCbo&)0Tz?CQNX+OU4dmO?5^nI2-=bwQG&;?IF?53DSr!Maxu|&)=;V|v67VslD>EaF|%k6eJ zU=Q@W{SKGI#jH%6UEgiJ#diXm3-2^hCv%TnagDT>j+c&C&==?n+-I(Jf8UnK2et;!f&SnXf=pHsgJR8_y$;m^g^3C<$is-&>WuSlAi4=s(zxVapvlsU zFaIU&+;|Ulm;R~rDKiSbHuy02p4UoGmo9Qj>38mu^V8dbfX!Nl@pI~+!Y=gmqxlP=I7j+Dr*DCCOo31ihXSlM^)$1;< z?dsLeUCmwFO?v2RmoL9@HII&7)hi5pMhmR2qu7C+BcIQI?g;f*hp5TR4Y=%_MS&h? zT_Rr9qJXW>M%rS_lq?ei+IdALnZDEd+bB6X@DJ!D>1rOHaT2lh06 z;^F!6gXwoN!<7DZ*S{Q0HZ=w6tsMX5e}-bsn@tgOR6<)$nA zwjB89rd`Q{3?HFWhG5GG5Ley~cSAog0s%MBZ<(Oi2XBV~=IZ817cqP&70;(~Dg5&B zR9$Uf{}cUvwRK#w<2@%Hm|7ScTbO#_#Ctl1cl6fQ)z$XyVDwq4 zuW`z=PzZV>r@Xu=KWn{_46~l|Iux85x|GNDM=n3l@45VZpsFgs?_tMGI9Xkt49{=; zgzMY5pSvxync4UW{Y2>)OWeEJIa3uV9rIUJ`ROMDRlo1UL)Fzko1f3TT#A%Rlxr{j z9_2Fah{r4Adl5Xjk!;U*`yeL$Zn)IA0r(yvJ;fynnhSnV3h5?`hH6n}(Ws%3GzR1D zdaumf1Uh+K;}w7{TaGwoP>Z3RIhgfAV@8e)|E^5i*wI&yjFw|DJ+n?-EJr66HlcLz*3?}zx3WDJVIZX+ZvsDn&Xn!0e-E1SkY4Nsd-FZb zloxtq5PldFMKA_aegvEZp7}rIG3ci1E+#6iy9}LYe)i^LL%a7>Hq^xx3`*1o#kibd zGGW}%s~6f>gb*{lW^{JI_+>3~KC$t2!cr5ax<%6GzY2X7Sbv1oT7ICdRX6SEPf(Y| z>`HWWYsrMq8>r~1PSPdH%e>b#q1Z)5ajtLe?>*=?S$NKYP!x-_dNO;sArTE#)p_Yj z2I(}rU%)owj-pJ>2YV6XVtorBqJEwlN!+vjjN zXAH=}L^`wM)@KW!*L@~NJZ2DHfmFURz!Y9O5Tvx98N}hZy@|!jjA89mes@JEUK2`H zr0RnrR7@|$)atXT^VlovfIth~3#A*$uKGskmgbgB+xW3pkBu{&8b7wMyT2z>`U|f8 z*uJ5rRH|uc-}C#1lE@71TcKOh_Y5s;Lh6rH1d{NAtL!%5u6Y1`V|v_a{(Hcy9x_Cp zBF~c#W|l2zLM=|9-FcY7Z1gnaf7p8xc7|KXz_c>kTZ zudnTWYTu^@cIJn+51|)5TD6@?q-qXU!5-?jQ@=;I^Vw-Nl@TN(+4&gkea#f&s)yD> zR%0rAXfw?*7g7)JHbQ`~U&Y209#YB6?2=5jHDkjBQzGicl!dj#sgZ*r z2YBv>qQIi*ni!i*rx^S~_1&&!-JW0lQ! zI0Lq@$7W%WwW&Lp0dGd&dmXP@-ZtFCrgi^!3jxvKB>cDnyt?zQ^O~QQ(ph`Dtr9EO$S<%&lxX18T9r)L2o&dC;P}v zWGR0-zct%JMTKv)a#X4W>tLgkq0T8wR+GxhW~xZC!i;zb_n`>J6NSSTgS6lqX7mM5 z)A0V@?SvdTwEw2zn|2Ru-`BfuTi2EjG?QyjCu%A}K93D#<#sY&E=$b1?(<6qA8!NK z*+$dVFu0=t)*SHpT(*`Sax9WWlAU72iO4A6eVo}Gn0HQ(vuiV`tbEleTAAS)I^EbU zl_uF2h(Ud?s#g8L5W&_~HQ3x>F;%Lg^#iJ6fiisgKk=H|z0m>FH&|J_*?c*t&WR6 zRF{4_yZ8Aq^Wat8EL6kK=2nukd@*Bf>d=F1+*?+58%=!l=V-g+XLv8gtUC!)Bi9Vv=D zZrHobCg!n@N2@CQKDP_TlLm9c+Zj*1ZC8vX*Ben-NbFloC(XLOWaEu178Ku&>?UPP z$+gxK!)juT@7wymgTF8v zP2h%{fp{hp(fJlg&<=&+O1K`Zt)N#O$6zQ&s3Gg2yEc>Kzb-nho(t7MBVvz*>s|0! zoTAn4C|zQ6`NOB5=I#X$DWYzF0;q0(VswF^5U0~>b$Xnz_gNiQhufQ0M1P}* zFr*0RB1aL6=FY^tIaoINKQVhem+y6%trq&HN>T|eFE0li@MSr8o6EIPGc)r?unoO( z1#g+|n+Ko2Kt7%iWZ_Uf1)2E1)APJQ@1n9G47``h{YFG{3sXvHnZQ7GC0RG%Hofg5fP?W|z6o5n{HVBlJYT)E*t?yQJ8xgSuyo<@!R-sZ z3*BAunB7Y9v`3GxWNrCN>=tYn@eWMGVFq@lE2o(s zw2fy0{p`!M58Y$Bx!EXtLpN2JoX@SRk$#`fgcu`Y0?fUsW9G8l?Q*uF%ESo)rxtaG zW3^(9E8G-thCOCe8WCSU31L(mn7q@k*aD4_K2GJ8Hu=5v`x^JRY(tcDyj@IqBHG~L zcw<%bNRy!112%*rx!m>X$7bJk>d@Z(Jq@+Bm3#9ywb!MaZ#z?ZV>A*;RPF7W+)I;{ z78hdc!lD{f9451e_o|-8h%Z$g4OfVr^$Nl*1_wnz#J;Xkt$k2ytWE242mAgu}z?hcw7^Zt8h3?TOZRqHezqF%XGeR>}`oF!WY4r3zzD-ZP zu#RHw|G&}I{3m}4y(B?v$QleS{nl~yDw@IuHJ(5A)vsz=!2i|Pzxw*${Pki(K(*VQa5q9li^KK{i$(_Q6n0=g%)u-^)*Hv0jNUfH zcDms@^MY-HF~>HQ;B?Ll-zc~>3qX_g*B;@SHkdLVLr5+Ihj&zuV+5-Q?`8okjAet} zGl5-xSu3423`k(ix|Wz=7L|IVbY169&~W`FT{5#5RIK}IywHl~rw5`cAE3X>?1 zoEg@zAw=3(*nT>f;btv%n}9$L+5KXx&1cQrUE6>^fdJG6=-GJ@A$ z?Qd;$1gg9OxW|iWRkm5C?fyMpyUF5Bcr;nY_Jh*Wr%;X6f)L=3*cG4CY~<7+HonohCu1&+Ohke!JZ_Zmq1gJ6Kz3 z1hYCHyT$2~gik>h#e`tc<@LJW)7o14GrAqg^G#SszWZILY?3WXGU&FLNY{4xVF)k*Nv){_V@aRWkvW4M@_+SRptWswbvhcq;+RyYv|wAPN$ezF*VKVm16^?VpY^+mQ~sP z`VVA2_{}Rm_ZMKvZXuz(Kb35N#Z6b|@Q)Id&Q*sFam*&FFO3n}$|Qd|y4cugG3ySZ zU$Nvs8rq)m`E8W{wp?A+IC`q*Quq95Vw(kiOAdy6RyN;#spr&{vW*YEyxjg8x4W() zs2D&(u0Gvc`$TPT`UYjCr$6zDjtBAk%mPdbuqQCp z7U8Qm7(6qMZw^}i^#{!?;BPzF8yNGbsZ^lDzkIB3G3n7W9njr35F7CT&+H2$*xdYK z-qH-+9qWtzY&lvgzWM4CHbSuB@q`)k45c2(tlR9^I}%3hRLw5{L#tZ8?g7ME(%o(L+4Ex_P7*`f>{=Z2>YCFlFI^=+3H}w3$uGZ!^9VceGrlTB3QM)-8kn_0{a3Q zwpN<&urF;+sZmEdntiv=qhysp;B>(3IqboYK}9(!>>CcG)s$MJ;^@2I=TN%LfzVn= z@f>!!O0Uk$%>2j^m3&e%G!pQbld8iv=Hop3S}J$i9D$Dq>Nr)XbPPGtNM*2)$DA-b ze8WBt?b~bz0rzQNf>SvI?x|C!o}fbMGTVDyeSgReesdxZ-xtpzq}C4(5Bmg*;FB4q zviDsUu(`ojokg|*!zG!QCJ~nbrTQRFy4O{pLtbe5cpI!n3s(d^_1=1i&Ez(_jfggV zx3c*rksq6MiHWgHJKKQNLe^kPnF+`b$%z?#%R56qX-IKVEs^?Mc(L8p60n&YLM`E2 zIvnjjRjmoV^);b~TSApuQro)mNA2x_n#2>6TT`KE^pR6A-hoH`kbfNSDhBX=p7LBc zga{J6dzeM6Gyd9u*2ZDT$|hvkVA+cqgl7C;t^A!f{I9`-0vAwAKl0IgCA=!O@z<+= zs;UZqV<C+^xE}|1Q{6Y2yjJ6eK+yq9115KP% z=YJfxcl`^o@I{o6S09akZS#yBG2^1_ElK?!V^}$RM*klgymOEH|AwbnP1k<9Sxvvy z^vIi+f2I0f{4KY8?Kr;t=A|3<;r(xJ@T`9yDNn%+d62w7endUoyLpZOh7c0kg(2aD z@B!iXh0Eei;>X1o#8;(L@{D}D{C_DaYeJ(Y?AGMd$;`q_J4Kka@_9t zhBNBYT!-C{c!=jEZ_;<0?}z?R2BLuv2VMp*t+AdI`ZMYV+TL;QK_Gv33*|k4!nw5t-~L=XsP5mGc7fHG#!0htu+SK~&3~T-DEhp3K>vP)N+RBo)v)rz>y0&t9c6vQ^YJGimYjg9p z{ULqOtyamquw9=gC&?-N^OuIdg6RWO)JPhNSS#s3?gSt-KpIf<2$p6452oRG4o{rY z@0`VT9%=Jm!e#-nh&w65{y%I9_5bpJ6}$c)#oh_}o$lZG-^kwSsR8_l*)q}^Mz)Ug z48~)O{Vcf!^MjX@@SW2~xu%awBRg?k)}f8@YM4)U?=+sDMtMq~)pe9^#h(H+zwP|! z6l9Q%**N{ev731=AbLbd2^qndCTgY@yj)?0IJZ*={>jA!bA^X`5hm@Y0UAVvbOo)1 z)hi5fuh9sN(ip9wahkw;>UFf9Hoy^`q)l*_Hq#c`O4GEBw$lvWT+PuAx`l3q39SnO z{@t{P@KdX+=Bc%{m0O!;R&HG`XBTJZ)-6V#K5YtZeHjWiPMWKXYusP;^Nfm*;yIXvoyQBE=+^& z6xM;om8lui%-YJT-W^%bom&-7%`UF0v$w5IEzdM9&CbkENydeB_O|ueHIQc0;{5W0 zGB-6ndtzmUWo`k{uFnc{^NX|6+~WN7!kTn)e*M(B6XugED<>CcR~OHn<(5}W^UG(~ zr%tX-EeU!J?11{0admcGz@Ne`2uoA*ixO+}+>*MqvNqc^HN6hHJ!{r4(8$tResyM! zU!7kTSJ&p3*X6a@xwYA|r}(wAXQi{VQ)|+{Pe&x&VHO|8wE&o0i-00LQg z{nq()j6phwu}?2Z=T_Mih_~SWihS$T+A^L}Zap=%eikdGzH8;&`neOcP3su9T)vRs zy|S{@G{3CqX8?$^SkE9 zl7uKYG`3@0(+0mlYzGDl(&*8#LVHD_ZhUf1JAY`bz{RJ&$o>RwdOCKZA`&T(@dD|K z^*@6)`X+mu3N%^JCg++8TvD6S3NH>9gv8Nj>ZrMI$MlYoV`Gt6q~iRTRu~>0ixl$X z6hAj4y`j&0G{u z^lI#m(KtKe{*LJa-w;80pLSk5kGe0mh;a<-z}Vz)#nj07SZo}3^P^+9Rlx>TZn>!- zCJS<3<1-MZ`qW6cjP=Ga#j)P00(WArK&MfEL2PI$$VrWL($Y8m1%aFZ2)db{9A_Yt z{dy;rW-kkT zJT}#DG+}w0#|t%h3J+fy+O-d<3}<4!&tNOQV=Ph;i;Oo!nhMtBMULB1n3?KtD%g@3 zfTk7HzCCPQ$i#Zb3s!bDf-5VonhJJQ!wgKL+XY+Sq;`H%E7&k;O$A4C@Zi`* zVWxk)reK|o-PTlaCI=6U4UQUx6%mxX^>SD8BC+=!8oOw>WBsOj3-(5aq(I%?iz+)< zaVSt9R)UWYk6mP#i^=LekL6{}Hbi20Y%^bB+-Hvf_u1WXjAQ`)ADF}*N7@NDXso+gsr0nd&JhQVud68%5K=Pu%&cWnGk)1=yixN9mBrnSBT$#M6 zuya-NqKTcuNm8&j{stYXMn}S^Kto5^If9O`a}*t6=NLM|&Nb)=JIB!xc21xp>|BeE zuyY+c!p`+ctxL!Ah9t)CnAG~%T(Cu(!nsh-kg73RXlN`nfLxNm)B&K>4e2E|)e&R7 z>X$+QUz!R{SJr^~3dx27^|t7auD{is)G~TMTL43M{35x63*4|hNFri}(C=lUjRVgzk@TesUay`POHq&?Ru)*v_eriWpkhiE-hiw}Sd^&}-?0xGHHvHc8#YlB2W{A*L9^Bt9i9}+m&J+dh^liV7ilqOylOA>niO@7P5`!fkO;g z&Vw9(p^l>|w1sL=dOx+ysJEP*jjS%BE!9F%` zjIVUXIw~U9taoI*+{a!v8Jm;Z$HpIFGtatM9>Cp%t{a<88`! zg4a@yyO0LVK(f$|(=Ik^J20=>PROjydD@+1=vdf=Y2A~2hLG*Z3?f5WW+?d#)l2pw zqnGSsFul07pTV%qFoR*40}O^`Mi@*tGNTNJWezeJmN~>=SmrQ;$s==w!LZC2gJGF* z2E#H(8B8BC#~2LD+{9p5=4J-NG7}7@2btpxhGixh49iS07?wGaEaa|C^EA6CbfS1h z&vhX;tK$=jx8Y(gS?IU|eUe@1(5LhqgPzxO4D@ueu;mKq0=v*b7xf$iUD9(5bU9hr zdIfZaUFe{zdX9mf(Q^!RE%~eo|Fu%qjCvaj%4~tJ8NQ8)nkE7z`=t>mAoO>@lnu3d z^&$~_F?!O#GS8Yhsu(#N(Q{Jom$(;k+k{fN_e&&i + + +Copyright (C) 2018 by original authors @ fontello.com + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/_static/font/italia-icon-font.ttf b/it/_static/font/italia-icon-font.ttf new file mode 100644 index 0000000000000000000000000000000000000000..f290bd6e060305044fed76427a695f7cf364aa71 GIT binary patch literal 23472 zcmd_S33yxAc_w_$-2q(eJ4k{T00C|wNP+}Fi4+NulqiXmM3GuZ$)-qgktnXBDBDTA zB(@XVlK*DuUyoxu9mkW!P22{uV<%1B){~jEPX07AzvJ3T)40vj88n@yo=lqbQAK#( zb1$eZa<(V)%skJKJolb^&UerHZRh*GOF{`DcJgk*lhuLIL%rIC_&ZT@8R_8u(dKlw zw)LxPoY50@edQSD}d*k zQ%mc2y!qR2{S%(M@cb`}E7Mbd__?Rg6SBJ<&v!3P-LcAzseg>;&*E8Io?4py(Z7BX zeeHgg5WZ=3-uNOR$Law8KEmd1CM~3!aQ!=n4iekq z)cP_B5kTudtp3_OU7SBTMHG~>8j3nrOHo3Jv{}l3hkk&F=GA|#1~e(4+Kx^JMAK_ziF>*WG@ z2G0t9(PPnEOcuAl^%ioZXe~Cgoc_bcT}h52Pw~s)Z2{w!h>UU*TCxz8ScwhT;UG@p zB5vX#Ug9Hu5+FgWQU%_wB4JWZG!h|E5+gMvP7axV}vnU%0J4}keVwSMiq-Zh{b{*JaB!)>vtC4^Sq-Zk|aDo)= zMgn$_BB+}s;0Y-@jRcG#MVFBn^%vbn0v3^?$4I~@QuG=Lm_>>{BLT-q(QhPR8!3Vl zumrp##h{UZfutBR5^#|eD~trJB*jW20Y6Ex%1FReQVbgjI7^DvMgsPdqGlxEF)2oj z1dJxdsF8r%q!=?2u$&ZYj0Aiq#ki4x`J|XI5@>)FYmEeIAjLW(fi6g~-bkPjQfx31 zXoVCTjRdM8MNl_OpdV6fHWDa_6kCkMsK3~1Bv2PAri}zTBgHl&f#OK9-AJH4Qp^|$ zR7i^8wk&}jNik<6P$nsM7zs2=id&2XY9&Q*YnDK_q}XXBP%tTW840vZilAbaK-Hwk za2E;mO^Q860;Q8;-bkQ%a5y6|>Ss9j)@i=Tj{u8hV45A+;Kzl6Qf8XQl@;T-nI;TX63B@(j|KPrAwuUF5!pekT%|LWG`Lf#x7kBpyIA_8Ges$!>svA#N{+RywNa-nlWJ978 zVO8593oak$$5wz>4IU3=M z<@UztBS%WV$6cZyp%X_+>XFj)5qkWF@#^iP!2wC+=nmFNKkJ{4uucxMx$W`k?K>mX zZ=y1daQ|9*>InUD$#pB8*bu2!`Y4|CiJ4;D6() zMyV(Z0~Lb>^G&L3tm>vOjE@_Q?IDt4QY6z76eCJ4gid127Qt$nB!Yu-yueLjL(Ph6 zo&?S+60b};sYw=12Z=0-GOn^XX2Tf7q4F38fAtoLY(rCMm)Jy;ZBlQOl$*3*TDz|_ zX(iNp5bBnlqXHZ2uRO;5Z*aonBBDC5-!o(NYmMEv^~*Cqf!<1_}ctwpFh@3#r719+NdW?+tS%wwufdDjhrmS zqKVo_I-3zeziFS>C-Jy>q(&-cYw-qa#p^^Xk#slBq$oeBn9a(6VwV-I&H1vUohsc6 zcQ15zFZ6WIX(DJ;6xRfyy1B7Op*zf$jr}jbtflzWKRg|XL;_FKY*|;^BrxXs)#0D>qx4mm5(-S(H44lq$Q%YCR2lr zR%PR5#nwKSNsltQ44(I2b)M$|$L#<~yeEHmn%b;%z=5l3wW&*rx7r8 z#KNhT2{+|jAR~@WFnTZ(ep05QsO}ahos~)|6%`8?SQ7TsXM#YA_rQa>-!$6Un^{oLzEV zb2>OKIe&z`!E{VrHjiRuH4@8fSH!E|2fj!LkbrqQPY-%^0pyV-S<-3~wFyTKbgTJ& zeqS?{Yh}Oe&-rt;d~rwbnRBHdojcRJgXO4=aVTt!_yx(O00Pg`|Up{;(R>_^IjDD;8E~tf==9RGrp@%2P zuKW%Y=C6oEnJ`0mQVz-pq?tg+3@no*Mw+~p-yI53l88rvjG?L!)IE>Wrpf{d(x8Q@ zSBzuD$`sW}y}C5e$IVF14{pU~(Z&}(5e{w4F}nFgb&z{3SRKB+%suwT#vFYy6#fMF zy<8|94qg6fu)2d03vUjEH&VRm@=sTC47@!4*K{6k#>u89-({CM@Z|v_3gU`F1xZ+u zsl-VuJP!Wc3g*moHEN~11;Ob6leY+F!R&H59VRi*=*NmuXPb$(VYQtR6OFj||9H8J zJNt#w^QGrMOJ_=xrTZCL(lg zYYyF_ccyD)Oq3z)4BMKU!RwmpHSi{mFEV=Im{$5@eb3&y{MHBf$M_`Z&Ib)_EPtpY z%kd&)63-0~32asZ&WXGr@(YCLp!F@t*i=Cx!lXhuAl*USIJTu69WrCXYZFnes={eA z`OH31APQAXY!9?C(k`bOrin ze?lEn=_jT8OFxvT`eHc2CBj@Ku9Z)RPLJg4`h{hOW1s49D5}qF_F5#Huqa5r$`s$g zmHx$e%}np4u8nY_GMuPE;^?kua^Fy>;gleRDgz!*z~xgFyR0}(if5}Ls1A?A6=iyA znI_purWR+Pz2rFgA9;TpHHjTm5)N9u3nq>*i2^RYT z+7s;R!mrohc)o4_zV5F2I!eaJ4vp?RzJFrZK!0D?-tM7XrZrX9S--V55eWwaIBq%2 zGPGv9hw1i_Xaeja3uVj)l|f=?O{0lz6iQqsk%fxkgT^O;R8iKhKYN)f=e1F&9Y!Go zVTzt77C{LE$}rhiMSW6?f8}z&VzZj~7p!*MmxRWe?fKFt(W&Gwlsf#>EEy_poZIom#w(C z9V%M3+Djj_Tgz`MQKK!JazTJ01Z#gI?{@3QymOmkg8R^VSm5RnWbB9bH?20}1}ue|x-C$VTleY_^x7;6lAy+N>( zASi|jVw{2fzBCiWnV2q_qf9b`a-fvN8N0;n_%pEz*pbj7T>JfndQFkexq~9s6 zf?Z%e-a5^F8~m|~)aGjhN+5F~(k9px#)v)x{oEdjvm?4g7AqQQn;diE7iaVKTsH;t z)`^`>#YSbW_i@LCug%Y=s}6OZAGOP7S(bQ-7kSS73|rV|PA_h)s(6M{upLRXLBOyz zehRjQ3Rq=!k?wqFJsZKmRx8K#Gp@KQKvrVc4zfE>#;C}wphJl`N1BrHU5SB6RVYAe zxEh)9q*kySgW+I2SjO4}<3UWlLvdS6YZ^n&v9Y4&>gxM_)s#W8-*)y=jQhrxmbR+u zk-js>j@>%G);pqAwWTuKPJ~^W=JHHz-P75l)%0$=(A6EUZBGv84|e6-+w)xq^TWyZ z`gnfZ4(@wCe`9Lfk=v)1j`Zz1ygYf^!F;O0=gl-%MjA4?NNjt)CQ=p7c0O@@_}K2D zT)M6|2*hR$ziOkHw zs@Vb-L~t~*PB=Ct^wir*=yYpKbE+xX*ic_rdvj^+WUKniN$X9GgXtZ=KyqLHDSffj zznOlK93Smi$*sVKb&Wn^2exb>Tk=@}*usMVmk2N7Z-Iyue+v>81>~noa!NAo$%aU^ z-)oY<_iQ?%80?PmHJ$x2wH@0Ilz=YcFCS>*?TK1w^N?$LsX?TC)9$sEp^f+NSzFml zRZo-O8|{oGy?%FFpt2>Kn`oxS1*FlY(@Ql4bpZL>vpF5W zpc$6WF>=B$2*|IKM-TOZdh|k_S+T5_`$Flb>10hf=(d?MEgS;VlG?b^S$wV}f4_e3*WIbOE71JPJ48gN@= zp4*ymhL(?XWh2#!xkmF{qmTEK)8rfE`}AXmcz2CahkJlJ9WPQ9b{dZ8<|$^! zxu(XtS#xdSCO9)rF>}^Y;&ez3Cr+hy8&m`p0$wGmg)I5KoZCemPPYRbme}l)ZPH3r zsDYeHpnJhEHRkbgvJA}SIMbM!!c?$JpgdpBn|8xk#YQxCO%GO^-FmZ@RhY$yb@gM=V@MSCpLP*oR~ zB|N$%Kj#Tp?Pgb1quK8{K;@AGDW_HCd6AP9L6QEH+mVbMkQ3pw;8_ zB~4Y4prk2OT@%$tG%tI7=KI2!~&kbV#>8G`}^sUw15b(J4l zALuoRYA>sS8pBOqSDCN4wwzM_;AS;Xhd?cEkDC&A$P;qdjB}U7q;VSlIt@vr9zUoc zD!E0Rz}jo6kN)k;G*Bv*)=K|{hUm*19~$Afnfo7o^)%%keQji;bb{}`Qu|vp@Ykiw z_n+Xnk=IIdr(b*I-noquoE0!Ml+Q+Pcz1GSluVLkvPSMBPv$=oqOKq~q{}&h{@sGZ zjl(~|9?EQ97HYEbrilQx`6)AwPC^9PC953@F)Zu7truGa7& zd1AhpY9emVUBOl+0;Lxp#1a)x+u@KA?leO%XJM{+3j!D#e@XmR5&dlq`Owdc0?ELPbSb0i9D7Ha8AZ92PU z?>&3=+_QH}HeFj{u=INZN6SYL1QIp57X#D(c4(AUd0j4*tI z#~_L%oFgQE zYGT#fw5|YrfvO3Jjtx_FL}v%f3^S;*jm0@MjN?Y8eClj7j;U)1Z0L4uvtNH=U zWSkLYFsn^Qk^Uv##cRxrBQb{)dlNSFpVuL}gLRShOP28}PId=b#}YP9lo*$RPqw`+ z-P%|eZHcwixqUTGGY+S59P&T~hII8hV{TV%o3~{P$HbbhG%`01e{c z@%3QkmWFW9D!$H9{`GK8W@uNoqguQCf%bkalFLQ3?N7e``kSTSqT~HF^+9jc9xFXc zle9g4H07_U)_VHrKlZjZha-`2b9(#bJojF94$|>$9cunn-*Z=fiK4aE@p_`HZNSs-WW6Kv0o?BivIHkZ@&DK%|str zU0LChD=WqgLow{RXAt?LkSIL;Eo3l{g9d!16ee8#B(@+6W}ZU9sIwj=GwH-3jh7=V7x(%1ac@Bq5t>4)7EtLW6_9VC{BRVEyk9o7PV z1UFsWL1ekz4hQUkez)J@a=4h4iL>jcts8tNu(|L~6Lm88$Q9Q}d+B)Tcm;itzQ}$0 zTK7k;^eRnmyh<;X{)G0HbaY^Q@I2@bULnY26)`B*yxHqeEl`-K0E0Y?c&*Mj?*^iq zASI1Q?nRm`z4Xdo(9Vr_QFrMdOP@5O;46cVaPNA(^i1g@r<8u{0s62*tDsPU>x2zw-6@ekejz@3S1>E9C7 zFQtdB=D8nU&C`i!8A87sz}IEVdj%T~!$)I`_4x#|>);p+7R+tp9=xby;Jj90_uCAW z$vVT8g`r;eaP3g94(@91+F{Z|SBHH0&8v9~^r~KA*fUySbsfbC>>T-A{&X zMQU5>T5fI@(bbJ#&MZQiirT0qAg^TOFfHZUnWH_!_$~v3 zG-HQ{tRLqCon?7rzreDxVXaM$k2a0gI(-&SG+S!_Y2QAt0-J~1MP``N-|YJ5gUP0*K)sdYzxYp3ta-C3Vvb7a%V|?&o=!NO z5#GsIF#ouPH_Mg-|J1ZAd63~FbjlEH83E$T+u?5L2Sy;^2Kp@%^!nuOFu+_r9O)v4 z52fPyR4#?Td^}ZG+t>eOe_w4Km+W}giHD{Z#>N(=9y;-^j^Q1>wRLs1y*n5^7_mxU zLto6-Tm=aoN6c0e;;J(AtAhm}wDDUY5IIhog#*R}{xAz?kV%{dXEzCCf!KIEZ=1yd z+iZ5u!fT@Q@#88bUJJ+D2tNs?=y2K{6CNtd%3-i|@OHD=dW2Zr+BPIk{!1xm;KRaJia@j%t@`tVY9^-t#K zGq02)r4r@ZOTR<8OgrN7%J^OcPi`dJ^W8p(NxvH|HEsaDM@Ua`NrL8rKPZKClSM;mDXK`&NDxI>#?ETdnz01 z;tD1u>XTwz&M=uUZs^quZ7f2F8D29wJ7D~>mN}o;{5oN&2~*u7>GNNOz6z|r!dflA z(AKJ(cJw!>%VKsVI=Z!F!siWC^i(J566IyyYno8(qM|t0xAylQbek+Z=RhcmMOrU@Gh0p0e6C)lo2(LgY-xy#DFC7R{+RqH)aNOR)Vr9m# zcPhWTA{4I)r7BYOK@lpZmttx4)zo?Hm3=^!9eM3oP2KTMdE$RD)7B(UES1JNYc)?Xx4Y+Gwz}T1` zcbfkW@T!Llk*CQEwO-J$z(F$f37YO^ds5;UN;4Lr@}8G zqzaa95qO7?dJ}J+v{91^+A?uCazZ$bS*aj^HN%yHqmE>ic7N*k_U+xCC#3M1-+SRx z&;Q$xyzjkt-?_fF_vw9~9N3v3+CGF)^k~&~CXuQ+SOt5i-%kA=-OgvH)l^21jAZ9y zu=h1nh^ro23t5e&?4ivx$6QD~yxRx?!g&=3Q+P-vFSAQB+188$6HJL{7fY@iDd8}~ zgRhh3fTTtah8*CzABqBtrfX(cuiGMEn8X7#0!H=CsEYAdv^8jMF|OAx27~FKXMXso zM-;(TM9zHin6b*{yPN@A*kiLW$lBCh%z!r|aPrx!K&ny(LNw+~^KeVc@C3Uw^V)LQY!2JS zrU!P~!*Uo(iP;vm?|h)iY!BPb;pJ|yUMZ`@iQC5FoVrBw#K$aXc2 z!71`*1eY=_+guj6Vl^Ma!)F934Ue+@UU-h>d#&-btb9gs2{(m#K(K7wS{@~a3WPEA z6~@0)WFX()7>0wl$_bAE5#f2j>1O~23>KHjVs-?^#^H=1+yb~eVq78Q8Q$r>r?@|! z@YWay1Fwja^JdK0HX4^=#uhT)WSrTij7o4X5q75uI@7VGbvV^BJUN^yJ<+j6U&`ia zho7Eq8NT&EOUr>&f3oyAI-HQC7m_+0mf8AzGBtc+IOX-fpt9Ew+;X5L`MmK#i$QPy z1@x99d9sh(LYDHU^INkmR8;szD@UbDunsmm8S0#}WHqV0Y^I7NE6j+8a36|bJW)7o zF-Qx(VMbr@G!5_X-A>4nL;G(TzGe5o_Ips6^@bNZqoozH-4TC!hV9f!a&t+@bCC4I3B-trOoQRA9-p85EfqCcjIJ-83%F0ij zqLmq*q0^1sR%w!bff&^Hs%q5_3=wQ?RfEk97E`4^2K`pLls22-nw7uP*M=4&x$c}+oz0hXI&S?L;^KaS^G{zszqO-1 z!66taQt8L}T7WcVkx4L>!KG(-^C-M|Ku8KT8V62>oI~jrxNDt}fP|PN1l2G<1PkcH zN-|*ywvL=GL3Qb;vwNQ(D-T}P%|bQ&Y;7eu%NLW~+qOUa?$U2RkbZc*C)?rRB%7ty zxvw?=n{&XIYN+_V5)9?r!n+%qcSe%lnoy{xmitg=s`9-T?mIR#Zk}8HZ}a zcp{3M+L5BjFW;ZEYO0Kn@7*-Qwe&5v39W2(YGv5KnEMo|W4`DhVqO3$7e+asQ$wXR!Oj>4J zir9UE2tTJ2-$5WYM-eL<-B4CV8iVQ@LyQ@25j+2t%USw&bno+}Z-0^QEma^Y&!?UFazEN=k z2*(K{U|bwx(*$nF8Hi^x5uI;=1np25u7vBs+6sEraSVoXgc`CDx@$8z{;Q(X>bX!I zG$Qs`xZVYy#VK0tj?yKzmfwHo8SWm@vT~XQ>lyK_$5&KI2_P`URh_x{ZX zF#NYJz4ZeB=e&Y5q60c7tbK$E@Na|ZB3@5~D@D}pPXN{JPmC@Q6ykJRtxk^<_CBk_ z>TrA0is)|?5rz~2UF0ZY(cGDsHwVim|Ho#J=kon7v(-ZXL`f>4<>lpo1HLQ=Z*#de zYG!8s0Jfo5ui!1yee>Y+7s$u*fh-)VryvvGb9$Z^=si>xgn@Tcx!;IrZedCZR1>C` zuz;E+g;B2__Rp-YW-3YQE)y82t|aRQ+@`mE1#mE)%eR2*mR}WjkLRnG7JIi-a`&B! z7nUv@KDd3MccHs09B?#52W{h7KtKCs+K28j-8^iRy`h^bOwQ-l)kwcjXF`k-F#+b@)G>2e?oK&d zQDx$UfK!XQ!?9Yi#uaV~IKv*ZDUFCPpM)?f4ou$ZS8RdCNFS&2N}K%d`hAW2Tecy} zIo>WNJP~d1aJ;dqd8A3u>;W4>kzDTj^y9PdICW_6{+@=~+RDB8TiWZ=&3BwBy*V0* zB&zmyP41=1N{b7zbzxBrDh`v`!+TXvW5k!Lj)p75&UyvmmI7y!>gPFk;EEfEjv24WgbcQ@^_=-?ukSH`Ov<-`39UF zw&BB;%zOGz9^SjZyRjDd11CKA-oJq^VMRP(|J{7cx4-eZ z!taX-|JT3DRR^{sTzjjG!{V8hks5)xc4j!m^4m0Ml?R@t_9dX+&cT9;!~c^pS{s&qOK%kx6`kXBR8&6JQP%;z$*(AYNOA7Y0QS<=7$6MLezv$W^!} zEig1{G#rM;6AVHfuv$aoBowlSm?gxDaenld7^hc-*7Uz~pf(Kjsh>MguNk44D*fL+ z(lkc;@7`vlURX!5_y1=MHUEjOi&Iop3ioMT^7s3yVeu>=brjKg_`_ zKGqw@myF&v#CE#jI`e{Uf-%Q7mEd&F3*RWXH48wK_0JyRnKqa*UPDMO1BZ81k7ER@ z2k&M9ER1D?-7|q*{#YxWH4I2#%(|ACU>22(@#zNx*8^43erA91c@f=-;Xy_;(>A7& z%MyTfTMCmXkenITu^~j-SlE6#m*HkDcAJ1e4%z)utIcQKc%$?8yE;G8+Uitgz7=wk zw>z|oA~J&4UhQvfbp)!s0=UOZX;rpartSVcUc1TSO?Wg}#_@yF(kIc3)q)V<58D-= z(`sxK*us;Yj;?{`5{1c{aY*xhHE5SR6`c-B0Y^J$}30H{_9( zKWeS4wmVo~X#}%6AHU7%lY~z~7R7{M(B<{I-qqS#`ct|c$@6tsN51`Sr)-ifN;G(I z&2O^HHha~(N)Lq{HoIN6n!@I&qI%q|T@AjfDqq92KWssjj2IV_$k}ga?cw4now=_! z;OjQgO#CPD)qv1;j$w9g`=imxGHmj`^p=SKH9povNiPo)=sCGSur)u+LdDi zrD9doWR_Lg{l@oXKKS)3KKB=4$!;N`yg!v}fW=K$=Lk**bgnvdh+{TUeQS)+Rwnt& z(Z$9=i&=LN{faFI($Myd&u^prH|6T8#?ezfm%8Ui6Wc8CTXHbmv$FZ_OFgHqlx@8K zmF4!=x!rXYLB#+Pa`oxn+9zv!(>EzAJ@fI8FXt+jnOer=ANzKg*{ZgZgZTr@S_N-8 zvsSV15Dc|JnW5nz`uQg$sD=hIL3YyD(b^=;Zo3 zU=?6efIWe!wg_Ln$>f=Fd~?$BuRdvJ0e{=c-o%(kO{D@I{`qsg!K6pebU=6CKy1WA zJhLy1;BfQ%c}p{NckD0Dv*l>1_~xfiI0(Up#}j7EGn9HDvu?9v-$)p-Q#C&W46SPU zx)%^>oKWyrskCRA8Zq z`(UGEW;ve(tyj`ye9wMX+l9 zxN**-1oj0q9IZ6pVPD#uQlpM^H2Y4UN69LI!0CY5bJ&AF1{LL`ux~h!R#R$?imUHI zpF`;~2SRHh#dFx@D!n!{GxGySRPss5&`7{zPO1*yn2+=9YpL96a|AvXsN+0VcX4tb&J<7==QEnE@w)O+h4 zHj~@zHX_>e)5_+TM1CC7B__r)?d$+j3t59DWhNj$Bqvt%hHr*`)R5w$S|at?@M62G zC15i*gj&M4bvW96s#+7e@iU=ET0)gtQro)m2kq^Fn#7ZnTT`KE^wCo=-hoGbpML`1 zDhBX zm+-0B#$T=eiK;66iH$Eld9Ui?{>7QToQ^4eqZuWa6NB4%8aeI=>?#~4=5-qHUL4ZgWY{lDTZ z*3z{<-K?eGXnORm%fD26Fa3u5y>=d7eCyIp$MD{_Hh4C^50{ryTWDh7V%@^i{fk2DS1Y|Q~qyCO8J7R-}D9ZoO-wV6Psjv(B5r- zpZ#APyBv2qzUGX&G}mGGqaNaU*_-s;;rqV-6M<;pLxI}k4!nw5t-~L=XsP5 zmGc7fx0LfDdRQ#yC6wP@&YR&we4w1S;48OhnK?p$cN{SnUn=J*(P(oy&k-BlU(WL= zzqOnfkiV;(7m1I4q@0&f{#-e4CWqt>LNE(V*E9pS)1Ryj(8c_2HmYu?e zXtjS|vv|%U&EaVorL%xoL_S5Paa}_D>-t;sxHjR5l`bQ<2|t22PNKa<)U$qm zKJ+iDKaAGafQ<8cFB;~N!fbxgTLXA&S$}g%pTP{~W6b?5xecSk$4U5|(`UJ+&q^aZ z^&YOySHpU;y3=T98qg_yRo79v75@~V`O186Tpyi+46-pBx1YIoGtUJ?j|eFtBN)>} z&D4UAE36RbcIv=?a&f_2;h|oHN&9Jl1`#1$K`UYP3Pap$G(w{^Mr&xCCh(nl9j&Jg za6~6*6WpcEw1u|PG;O2pG=nc!bF_nQp<7`>>q3BkH|-(()at5vYHe-h_NJMY+n3AP z#o4)ai&3gmgJR^*t;#26PfaaP&nnYXi?ho!Q)|*R{x90v6mBS86sJ$kPA{mq-nIr} zV9i)JAM}RA>BW_^czb1WaccGKtPJW|nq6KOra^ZK8^Geq)Qo9nZDmy-j;!a-tqP}R z7gyEUJ65NbXPTB~XXd9Q#aU@? zaejJXO*%Qhe(Kx_^U0N!lZ&&fi|5XA%PXe&<+JNkC)cKy1ib}zLHo;iI=e35pTaE& zOH=cU66^HblDf3AHrq5cy$-rPYt|po$vx4&T{M8EW(svEDnDt3 z7FOTFAYU3D(=dqhQyTkfX%ZzGt247)mgTaO6_YTIR1|3A_;{>9hR0^d$D0a#Qrn>w zg!mK&B=!xD6~tI?L5lTa_~QjS*;EjcF^o%_xhS6K)mV+uIlH2M$8>>jh@iYrJFlHb z+ZS8JIHq-AY;w3_YGiyYHjdi-=oqRh*rdumHxWW`fc z!H#Ae`jTi^foTl8VC$RI&QEFu8y2mp;7AT09J?sY^pDpRth2E@nhMV3;DNEhQKPUT zf^xTB?n+)H_P#@77wvZJ-&AkG-pG&?sM~u{WfvK2IZ}K8#cOTZ7 z-TldnJi7;y7X@|?CNGNY9!g%6*u5foQD*nb>f^%g0=D27)Uh+5=H|W z2Ey(U420dI7zn$^Fc5aH!9dtOj)Aay0s~?9S`38U>o5>@uTN@SI-WNqF@MLT*2mU@ zZQ2y>g?ffmjmbhoW1#`$k_4s>0Htn9FR`hP7~@qx7XtXwRA{=g2h>+cHWaA0MPKFA zwX1S{RdZ6y=;Lew4BhdwR zq?0LsS5u+w7l8u9rUBlLtsuU*meK|oWnu|;pFckk8vrL51J4G}1G%1|r1p#dWN-InQT@!H33s8G}>6 zD$yT$jO_$zVHdBb6A(3RG&nieH#rk4@O@J=;4xg^R0Z;r;~>l%-UA*P$wH=av*x-+dy<80<9Xl^LzeR($DipK+mb3YqW`?UTnqs>SC=7I z3{;TP9zJtE6Y619txc(p3!q%$j$2bgyL;@m`fHqu0Wq;4?6TI zJ;$Ku^&A5|oh)p*0=mE+bkIdT$3U0#90OfW7PejiU11M8=&GJ$pl9?P16@l#XTtwl zDQiZ(jRj@4z}F1l!9-0Hfs+052ow%p6sWoQ>!?srL)q zOQ<%XRPOx($s2i|^k1x@4<3Nl_~6(@ey0Cof<1jfc{hwG`3I+=Ist^a4xdvwsy2L{ QzV+UM@c%$i^b_(w0enpTDF6Tf literal 0 HcmV?d00001 diff --git a/it/_static/font/italia-icon-font.woff b/it/_static/font/italia-icon-font.woff new file mode 100644 index 0000000000000000000000000000000000000000..101f487bc8f60c2e787058058785bbec8f2a43cf GIT binary patch literal 13888 zcmY*=V~{3I6YVp$xntY5ZQHiZ9ox2T@7O!mj&0kXx$}Pa{<#%#qB~FJsm_i@Ra9iU z%ZrHtfB-*@O#p!K-%-2%|JwhZ|Nl)~Syc!C0MhtjxqqNS5Jl=GuT0PM!zKUN!aq>s zBamz~wl#G4;Z}a&3jlyFv0V-VjNM!a005Bxv?xCy0AKzFHFGex{o!l?0I+xf0LCFQ zAzstm(D_FT`SIfe`Tu}uZsTbN06>8P02DuZK?9N$ATA42LlXdiQRl~p`3G!>tZ{4> zKjaVhGZp~<2P6>eAkh}KE*?Kz{f|xYgO{76?`s=-x*wllOf{o#J}|J@%5?cMu8yo0^73jn|Z`@^*W0Km~18Hq3sPNqLv)}bGr z*AGGu1*y9{vW*Q)3=DRR7!2x-4V)bBp$vB>Bx%NsmV^ zH~hAQCol^N2L_OFgGm7Xr}Z1<2na|C2&jm(L;wL1MhG_Z=`$D|1w}PAFg5Fg2L7j` zjESSi(B)tP|CTq5IE*vN07o$inFs=a1BX@k8RK$ZU2Q-CHDs5c1xZxVW~Dx$oC3WX z)fFpt4(RpZ9yie5!>x6Yp*k-317}pL9cWyD@j)1>(VnTdf^r{ zzkgn7hk7Y@*4M!Z*u=HXTr-u@STmE-YO|5j@T}kTY>$-%zrBS%b4{^In+8-d>3mA5 zsc^Spc^&3iRjAjzfu|MyS`e0zT&1a%ma=rUs90v3AsPw2QfgorT5K z*6c=5LA$uHvwY}LF5FZ%W+wKpOl<7TEX>R-tW0lKmS;1ItIhNe;4t&to}ZWCzh@`_ zf{Zwd^T7`j420|kvi-x=s9Czti=pCrN@fSskiyVf84e9u){BwZ^#6tuY&0g&&8|tw zk3!`>?YWKE-qF7|S#v&N_tUz@rYDJSK6c1VDsn%bTAW-rMb=7OfjLh|&Y~Y)SR#wL z;DI^~m7P%Zq2Tr=G>shF22(_=NnLBh4HFR|QfR5I7eRc-)66vSIZ+gwXf0Nk9jE0z zrPJOQ>{i|O!{Qom;4UaOV|KCNZ6sC2R4tS!+h_@7PfiwxCLwLK1HNW;|7HiN#?E~s%P>d^6^0=6zn*}RQ%m|8Peh4M|ky0QMOvW zbnE;_54~rZJ12jGzP)1WfdKw!?8VN73#opvwzlC$bJ8V+3XC++C&^ zNE$Z*rn}mv|7buAdeeG&ksjxf7<7j*We$T#QfFDjJQ@{ z=1(mT=x;684v9oh-%fw|$?OR(0W&4gvJEB&LD+x7|C?A&#R*vkU%9%xr!Mzh61gb` zddHr{lV7BSk_kyy4ObH|s4|py)MsW+O-Jt8 zj+k#ErsH+Kl!lzg@yT-K&0MY+b^>xV^OP&oOuas58My<=InvBsK82LlE-RwpU$6`~ z6z9S<_7sH4blL8Yk776ghL2|mE&&nN&XZ#vE|^6fI#cOyny<%m7s^?WE|E5x zsn0l_5+`=}vV=x!kHxLt*KlT!AN$04tF#mq!VmVnxTHebZ8SBQRCR+LnrlN|$yVXv zBAYg&%G>d!ucD#>^MEZ8qCqj{)2?%R!1@VT8U4MtT^!@b zJGI7`#BD*8+ptoUmotU;Rm0AX6d$|yFHktGGwnLa@x1isE7$vnb!h6JY~lYYkzp)6 z8iv3XP7IeQoSCvnUjKo>M8}-HR)~!Gu6kSX$)#2enR6uBmRo3>J2rs*Kv?k?e*~F* zHa>BJqnmloM9H&z*tN;1EyOr4J7H(Au4&io0NOQdw2(BvnBdS8Bp{Z&B@nyJZU&<0v|+s#IRyEjnxP5jCsKn){p0m>C>O> z`kOvukl?2`oD(*efgIp5jsvdG7}mc$X?O$Yd;c9 zDyW(dqAahmF}SCoY&!ZCixK+SEjanrPf+?*e)<&uhC&bfXdaaQ79}Y2sXCuS_{gq@ zd3FuX_=xaB%JgDRn1c64`=mibBXy*00^uZApQ^3ZwSal4o{Rq3T0HvNFvI}WShuVccYS? z4Y2*dSc3|M`A`H%2@)JdAmTSDy63 z(%Lw1n)qGn`4C-1H<5E-6nCth8=|H|&L%^GNw_ew;d9XPC%7nC-rB;`@XMF|XZa3U z00=kDMn|f5Ks$&iDRYom;>)}ISw2#kn$>TpsRHB;1Mr4=*@M}AvFx&Zr1~WiMWX7y z29_0St9V0EiKEiiknN0agk8YCZVi>zU=4UOn5or$f#Zclb%2>j9^%>)4P*{WJSZG; z0V;$i>ZgHJXW;{p)rtj2NNlGkaT6-;eF&Nr!qYHbdChQp7Zv1usX0kAkK%d zJc8D@=L*t1{L#{!lhxskG+$`4Y(`+8n(|0dgH>&H@CbFWu-V~`1VuRRp{7N;xWq(T zq@Ar#yze$NBL`on5du7T9>8hDI(GWg=q##35&sI1#}b-pjx0msyXgNdptjqNc(ru+ zEqk@J^-&U$Gd65h6WRKdQ>UK%Z5!#_Z^*T=YZOLn%SCJ1Gos`V;}GZj>MXj4RT1eX zKz3KNpD~sl-p7+bQ&nCP*)q`BlvRmQP5aakq$~WB>YMH%7!9dcdPhKPCfbKnb|KbC zLrWy7R1)#UH$T$^d5O2p%GP0Q;^B~QU+7=hrbOpz%3LABgA5P$DcV%tt`YPsh>y7$ zoFeg>R3g>b3JdaRD*2XJVw8C_e7=0}1e+%9#W^+f=s~GRg-P}i%Wc^&uh)6mx}J#= zVMhL1)QQp!_5NjIzo+(=#5tF}gDjhcz(~%9-vJkSqe;<)6M3=YN{iKdDP~S{TmWl&9UCj7iBA9`F~pM|Nf>pi z9<6C-NMKAgI8&LVPDk@}1Ixt_s8!2{|2tPUNtA;aAKAY)|FK4Y|Dwd2BeS4ZphS1D zu7#pIrsJH%Z}*oz%Qfb%7jIelc7hzuEN4QzzF=1b9wW@Lgbbo@u5VXzdI#myh|``) z-nJ*K-SnQf--2ayLrD2O&q;apVxh&G@D!`d(c$K=wj3;cE@rbo;>_?~j-!*?Iap$i zNT4=7C~*S87&tNh)K$p=O9gDM!zf{ehT|J3kt;7B1T(hqn3c_XmsV-i8jQ##gOiKb z>@_BV@D3PXs-*e9TCpW#szHnOIO|QD^nO*Coy%8%?+jG)(dHv(F&f^ZbZkx#+IKKTPzjQu;h~K$y z-no#}0zlP_>>eU;*&>5J7E>uenQg6|XnGg9N{!pKQU8{OEr86dm8;}2{EHaHIq76A zv4cdP&#G0>cN;q`Fxf)%H=RZ*9T7}^lt?JX^wFY_^1XnIkZw7hxxdpfN055`;@30x z_au3%nabcJpPB1@TV@i*n6ipQo0$c|X&Phe7WvqW_W zLR{jts!)Q2#eG@71w9(N7`$k!Q*`s|d<-;c-SfAoc-Vx5IPs!jn}7g)9C7R+o5nEM37!1Gz}F!!!2z&zTVA@|KWVS`Q-XI( z{Ed07d0()6W_2syDE=7!%U@-}L6b>Ov`=Xc_pa?b%Uiob@nD92p z!hewvyb>XD_c2qA)sTey&b86FH#vqoDcJK)(25sSvSD8;vv~}T@juE?`mR9;6sSZIpT`ii8|wpBE!g~hI6J1 z#_Ebil2JEF+*jy{k!AYuh6@XG^_lBGEOechp1BmUEn}&SbZk^9;Ge6h`L{!-RfhP^ z4+h!RVA9g!rDyRq+Iv2~tW5WJ4=Sf9$=AB(*YGFBiU$Hgw(&FqYC|1I4j zlO)eHV;>ulNyUhv($?BOy3yoG?J2gvCc<7NacpQC;BM)qr^M22ut%0eat&K&$p99UW-pqlW^FNh%k z5sE-0AFLg$;pk>@8TvtzX>KdkO45adJJ8P`aX}K1BoxaiD07>Kb*QA+I0I#Y3Byv1 zP!tUwR1Yj%*q+m|+20`l`y^snZey08L1z?S!^iGcpa;MXA^*E)CFr_A8TX}g@Zem) z^`iwv{2iR~m6jZyPN6a+NS_n(z@Nvatnr2WNn1ddgDs&8b|0olrUh(Iy1syccESY` zaohnuPH+QHp7XZ7kJWW2Fn(dTSLDzGGw9AOILD8bCVnoA_xSs6p~B~-uh08T|c0oDsZb&>2fPYk$NrHcJ6!Ehe-I#I_k?|C5T)SY@I+1WX&M zicP)_R%-|c$d)ff4rw7n_EIixWUv5WMMw+0D9P)|mE~uS7s8S=s$@$>Xv7G!$@>cZ zxM*dXX12{#l&&=QP2@`<*)zAS3n^~yp3CR+(ow=()YRZWsE*Y^xEC|r_1Eb;Hy}Y{ z;$-%q>{IK~HMjx$jd7YLSqbbBdHDPGb4AmZk zkD4d+$wjRso>+-dD=%Kl2Qq?}yfbD==~W`!qxj}iv~jC}iyCjfEZTeq4qT~KJ1e0n z7x}b}jBU65Oh!z%1|t`(zY#&kqjrx_emnPUfc!hHJt5*%D*?SXnWYpJ^Ljpc8Ts^z z)Spge6S3by3G% zncJ6(1B7)WhbbOJL7EB&*}I0}|9B4eh#Ky8db)WpWjjnsq&|a@bb17cGGst~=mH2o zOM(r(ver8BacM@13OA6M>F-BIW@S&XPu^b!S?{lOhw!#JmUw3jhGl=(;CPI?nntWq zv}19Cm08G!#b536a*34K!Rdg4!FC0rVrVse3>^>SZ5{)`MX|8g)s$-#NCX6`l@BAL z!zDom7P*y({*q4Y$Qp)K?oA^*)lkQ1PbjexFk(&GrSPmB@JDb>f zPHG{)VWJ#5oBvdvi^IKNUM1HZDFg-00iatr;P~ zwo#cp)$YD zdgsG68WjwQQ^ri-)!*C~6r=h?&yTF)b5^{E#>!b5Y{GaVEB>bY#n!w1Z$J;7TEu`<^uRN8#XKmmp@6;6lFDiJ2PoNRXKMX!Hw79M^>{p(4=R*}YXeD7@MJ%TsfBj+pbhdm@JoX; zZ-5bJqLIZkb10**qvX}IBS^>`!l#^rUa`HICFuaT;oUj{la9b-S5J7+iQ>W&Eu;zjwZ*W2W`16kIy$a>oA0=IvkBvc3!`!QHN`t zZym<%%!&XVv41jD$ahHkC^;D%60GU24BPOn)j^8Kd#{l2`y3wLw@Qwf-0?ZYfvixI zLB;QT5jYAMIE3y3UC4{5V7L~y*hM}sRvI+K_T3C81YRWPI&F9)s~ajyUw030&7X%C zsHZrZ-M*|?*mU9`4WkwXObhLgz=%4N=}WoXcpb)Zre<_zWf$gq-M1ds6ta8mTpwwh zS%bIE*MEfBWj7_$H7)id!M&T5+Yv~R@qc5r_3$-vF{xBvV77B!pdWhd75l-Tv8u1vy}|%hd@f||_NX>|)Eg)(W zo{0(8(U6_0u#VT(fQHRQ5DC~l)VxAk>e(p{5(m5XYC4x1_~@ymv&N0hn;UsHI&+3y)m3$-x0fo<$}xCPkV9Z!RsA&9N)B zyw$=9#OzXnQR*cfBSaY9(|a@MuPZ(!6fB0{F4zzk=0HYN(60<&yklK&O7-n^yvQo; zX^>`mkZzxyAp9Ir;MrR7sRuO;2 z-1fd1*XGe8Mu>G^akEtKt}c0po769O5!BvICY6?q+D#pvLbNuhj5;=Xq;ILs1PcY< z@UY{nL^R%2q;OtEKprzU}l$Q96+ z{2QSILW4=7m#h+2D*MJ^17L}0*@5Xa%oPt(2};%4p)@N)bTeEy4xZatDGAAa^f1ib zim|vMT;xYqb-g$3+2e>xz zR=2Py*TgS~WnX@Mz`hP98CtRYsB$_ z$U-kA$0Mlr%>HHnu2zq>y({abujGAdx%Q;|g^Q;M8}7HgBMMg-pZ4dZpiQ~5#$A$Q zUDh9woBajW19g&N`Wmo?V(P>mtbt6r^UN+YqYMzV7AwV_LD2vNVZ|8D;ulrZt>XX< z@nscX(wlpBicoNEW>jEK_otd23!Cb?O`newIO@gS{`P|QfF2=vb8&C&($1FmvwDg7 ztT0gq*IO9R-hOj}0SYq$gOfh=DJxKXgSucXhAH*Pg(wQeZt1bU%(CM$w zu2iJJ76bzOMOuUK?i>*Io$Y@SF5uUH)4~*DBMgPwRan)>`pYuMTg=>IdD&W-=cO9E zue)}8&ebt6)a!b$L*1XIFR-SXTg}AW36E!?ZO`e?-=7TYXDJs#xfBtocI#yLOal|T z(P4=QKOE`*BA$% z#1$sbpGpMV4WyN0D2))$+n%;A$yAbNgbxwlYBaY~8gyS#45_johJ=1jzU-4m<}$;l zz_&KS%Y02Aftk%5g$Quq7(C53qmGFct&UdI;3wp0UlX<^W3g-V58yW-%+q^9bf*pg zz1O3`YrhZ&++1hgD6qUGDVIsjtUIp%Ew=bZCo3^JZER9?E(f_RhtDz~qs1pok0uW6 z_j0oC+NT*r6;jj{4brTtviNf;fZLy3H$^{d8@PN8eIP3xelFCpo8wttJ!FMAQkMc9 z6{g42tU)oCwRqb}bv+P-&7BHQv+e%$aI&&;a@w>aeSLFh6*NwGJ+>J@jm@3tC}s3r zFX*#f;=9uek-;=eF%(#|m_RpKU-Yw|#6SisEtG?gPDdmB%pWW&50)pVaAwNfRJOhN`1nPKp6 zbq&A531iJ){-+KT`wn-GRN1UAfq4m*sAUFX20u$p7w5wAyi0uSoM%b8P!Ej+=Ue;s zhOXIMx!{2sKOf=}mV=_mG3Y%B>B<_9kDiR(3SGXjeZ=qEkyNr$w~w`d$$jh)wD#tu z+1L?Yr0QH*`c8_7BFG$SNqjD?{8&i5fs^g2t_bBa4b&VfxfCXE&)XA=Cpy(}@3WUl zhXq&ri^($&9uLN><6|y8&F7bSerHW-m(pO0@Q0PSKxa35w*-HUQ4vQ#^`#LyX_ROu zWLQF!XbW_dYiUOVqE1H`w9{NJp14d%vbVPY?al0g?;Rb|Ati(KczT5!jV>OpMmEJJ z{t>7M^75`nPC3f+7^P*64$Pe00q=M2@-=J}IpUeXn(xvY1;ZG%9tP`aU+~e!pt1$z zvtSSBi=Ft~E9yx7a#7;r!?A4h4w8u^+s?JDxXpd(%=?I&eI^Xnz?)D+I5)UKCJ_nh zEHsn^+QCDFh=|2Y|%_^U5xZW~}rR zQ4P+5@&=G|K$>ypn6%=uI4mWaEKGp~z2-Yw9mV%M=Bsk-&rVk4CrCkXJ`dWxR))M1 zpiaZiD@(NfJGeC$-MsP8Eqz9ZoE1&s{R=%nDYW^a3~U%z5$KbJH%kxN$bCY?3<arm|{KkV(=S)sGp&rX$q|%m{5_Val({3BK zdU7*#o+rm;ru~ZBW-`WWMe0KA&vM)C{N10wHZ+#}FtK!wUSTxD;2{^vn%Xn4&7Azs z1BLLn{V%_+F6MEZPig+~|L#&%K$9)9p3{0PweoMrb|#uHK%Qg|I?FFY>B~V`R*^IW z{T0FDJgvjc*kkPF;$=}^hml!jw+r0DmoQqPKrnC%d#0KPMs*iiABrI?2=+oIb6rU)vdz(&OqLqZN&ymtM_U^ zU%^weF>|HoV=E}hr=x;57CnaFgy!pGg3tY!p+2jir#Yo`wX zBq*cUi|2Z>!dMXZ{J7kEzOsFZ)vd^R0><=c@#1DS_I=y*`>6Z%eI_>9n>Tn_=a(-R z3WHGY?+k1Ew?9)xJg6BK*BxZJk8Qz1#J}$P19a{?XSRJkEG_A>sEt$aQVyB z3bHSK<&aer`Bh>?vi9i&9p#JLZSf03vu3+5R?qklaWT0xy>Yz;CW?V_9X3dBL^LXQ zbsI%^hg66*OfvZDw3F5jpV)!rKSFHl52VBsUYBPj(}L1$x?5xN)71xM&m_hUPbA@3 zD`Kv**3GBDE4v|W7)$qw7ml^Tf`$!_XVKz*`JvhT^ZLBtQ@RPR^*$XTcACQFb5P;T z23=;QRE!so>&!T2n|Qgt-733G>;3(_Cc82aXPlFP`a&E{{=U#QV(!f8Y`5r>;vrTpKdVeywDDaEe33+lehdswg z!v_Lg!|g*?1G6f};;K{*>JQlheF22kk_c7zbc26n$9Vd2$|f>}!ic0BU}Kuy2lOPq z4|-Y8D>+M}Qf%1{Z!=)-vTe)9@A6~dBX)7_XJM)GucnX+&v9D)pKS~S+eW&bGnaRA zI#qC{zl^W3mlK4GaBc_gbil7j7A4z+viE#2vh5WX+9h`x?0zv{_U7FI6&d}ljtdTf zsf+_3IQ%9hvNq_$(t44V-+0n5L}ReadoeEH58;H;o=e1;U44O(i=3OtEdt^`oZ)nM@t9OvaH>LfX%Z0tTNaM`PGc|28IVf!2x%V-p~c< zJ{lejSdfMiBhAkB6Z`?G#L^Nfh{q}<2!a0mn9VvV(+8?M{Wce8JvrIuZ!7ZC)cky& zo#%OYc;3!0^OMzkcb{K86ZZ$}77=7E1{b#Oz1z||J3$63fcJl$Xwc|;yQ9|kJGB2k zD#7?ZtNOldr~i7*<8j_SmH*sL%KI1%^Z$PKd!BpVe$Mr_?|rJ#HC+tfe;fm@H4gpnxhrtS=gdX}Lo#_tx=8 z8O_i5Q=6IexXed!qU8N({GKnhRrvC=Dgy)RI37w5DR%}f4Jc8F0#0pO;1~psQ6A#f zr%c$VYx^rjL;k|IU6gUQL=EE4z;RPe)yuX3ve8sE#Y6 zX_))_L2Z<&^~=dXUK9Qg&z``!{Kgk=>bkAmufUfP-YLblu-24g4pILX+m5j&d=Twq zlOVym?Q36i`MA$A4+x)_IxxvVtMTdk0N0Ksx6#+E)5}ph zJbSMevbI{qKGgPxaG6!?uz1i@R%XpU?|psUjnBuAf3)_T;hQ$7^D^{$f3t9YL@4iQ z$c3Qei)Vn2`9_B*uDh=KWfj!xGdn;JbTHR+&}ms8cM+ z>~gGUz^=N9%nZcz;P9%e>230MzCBWjwoyW9{@juMy+xw@)1q8+JDq>hXdq-#8G4mU zF^~lK%CFL7A%O<~)8xtd)~`23?^qI}(+zVXc8u;#AXz&ESMjZ-bIQ!ff5={+)Wmk}C71 zIB6C100F{(OafFG+pO_YH)axl8-4c;J>OJM+I>!G^OaE$IS(#j;B`vhCia@KhHQJu z%$a-zAbv5BHY_(OS3{7I_bz^=tTsi4e$gLaOdlLK=vAd*2R ztHcXh?ECwXKk60CnIV3nzYi1{3=nz@|6ktz|LO*Qa{9qY^gq5IzuE6$!1E!Y>p=jm zND!m{_51br^~uQc?0@4IF5u=jc8|Wye(P%tYkz-(b=s4GfB*<;`PqI_&;bAwKs2BW za0Y}5>;*yqG7X9a$^t3_Y6KbznhW{?rUO5Q^}ED1qpMIE_SvOn|J0l8y>M9Yv!-_dq|uD8(egOvGIJ#qrAzD;Kv9 z4-c;pA07XRz=7buYK#ABO85YW0GR&*0RRKk0A>K^A6gXVr&i*>{P>WBDXBpL)DZc# z%9X(I!1K;Tbjvr8z(2^59Z11+9sfkJ=1rtBDU&Mxg;?heq|KV&KyAF!C zZSy{FWVE9I#9so!7M-UXj1a=2)pYvtYH`&owmEAP@Nus50~T)S9x+B-vv;Q)K}KG7 zp!IC?=1}!xdBc|-b@~I`um4DW&N;?>oOwWyZ*}hLp5?`!V|s4KVsq3qgM0O`P{~!Z zK+vALdt)%^MV1yf5~LUyqS!jMCq_)$B$uusJj$#Rs0wO_a9Lx#F+^fm8n7Ksd7x(K zoXU9lxihbBhVAin9~=a+<_TSDb)bI%eu2aL2L}hG<&)2!C<~mVXT@5=9pS#q3>~VDZrb4?ZnpS!t z<BT>GF$w=JX` zKg=lVATi!Eu^g62Z{H764+D=5NRUYkno9a!M`S z?Zfo!VfXAq`0ZiD-f(9?TOSW_ZmF|gPf;!`1P=powO9&!_I1-PEkF}jBnu@~giMs2 zj7DG@shKyDw(E-ZI@^e4Eb=o!n<_QMEmpVG=R%L^ijx&5UP^Mp=4&oAtu^3|P>LPt3s8m zNiIWy!wTos?W}8t7m9rSpEBgQjn9$xuEkYLrDd?_N)@8}s5i6Agg3X3U~AO1&P51w zL*+&r(ThjLA=Gn$zB1b0)-WaI7lV5W(;=oYU6BWE8rA&G0JL;%qZX!AVlVSxr|AE_ zCF7f|eg`57BVuA>{R8m7IXJL5uw!7@zcg~#7#Wx>0x+}M(=j;-X!yVxqNXe{=7I8A z$m6H3nxp!G2F%PHR?7!gkT4ti3y6(~og*j2SP|_p#6duaqlCqsBtRu3Nf2$042=%v Y*7{$1T|uO;#mK-h0I+Vv4*(^b literal 0 HcmV?d00001 diff --git a/it/_static/font/italia-icon-font.woff2 b/it/_static/font/italia-icon-font.woff2 new file mode 100644 index 0000000000000000000000000000000000000000..4598d5a9919533a1c6aba2b07bddaec3786da1df GIT binary patch literal 11952 zcmV;hE>F>SPew8T0RR9104}fq4*&oF09&vC04`Sm0RR9100000000000000000000 z0000SR0dW6iBa%zykd<= zBrm<)dH?3dn(f=mkiseyGTGrysUDoE=Tim#<%KqHokKql1e z0>-}od@f(l#Rt+8446NmQ)d5;=hr3IamIy-0;noZ8CKnPv%%G(Kk3%@CPdMQqfrvV zLNFiJjQ!@EduLvBruEnEtmv=4@&@>A_Ky%Af;zAOK@e*aA~8WhN>~sjScPIz;x-q$ zC}ZWKQqSQ+SM9AD*Y18S)r&F!rgCb#3GcQnFtluQ2|!Q+kb6Jr=3W9ra%gj)9I^vN z6dXMPSS?$69}wd4Jy=B@QlJIy4hg=t-|hV$gNP0mgV{zlnF`&3(xngT(e_G3nea8M zJOk-MWYnjGZI*(Psi;%b*Hxnn@2C50h?E>q>AtWCh|x~=%gwmh`>tR*Sp177XN?rq;DYw=19hz?`39`mkO&Uu@s zD5%uLLeRxU{WTGw=fmcR)wT6~!Pf_Ow}?pjLj$(c$Mwb80dO3mo%JE+y|HZhix*9( z?yG)0te*I_5Ky0)75P$apN@~o61jw#>)QO1W!-fy45w1S^m9hyyE*;^rHbiQ=9ahN zf9RA!7&4jDDIXh4$V|?~>|3UyBiB_4lj%9eh5s{Nl2vL&qty|JBr=6cqcfQD3W`d~ zDl9gK%j2sGglZyn8ycEoEo~iLJ$(a1BV!X&GY~ELv;&~}H$4Ig%L@dgz9|Bg$^?~4 zl1e2-rIMyn$xx|esZ?@QDw9+yGcTtPnSD6}$Q0C>f#@h*BX+gD4%M z42UuzDi2Wwh$=!<38KmnRe>lAqHKtAAj*X(52AdCszOu%Q6WUtAS!~WIz%-gDu$?* zmoo#h{c>hOcF-Bsg{U4x^&x5iQA3CtLDU$cCJ;4+s2N1fA!-3p7^0R0t;&k2a>=S| z!wrbh00ex;QIg*NL+|}9{`o2L@ioDJzEpQ9!dCuA@es<+?6h$X_y@FMk08v!gFq#| z^bpXw_-7Z5KJ|}7i=(sA{^#h-HQiNlwi_KdHDXw&hyO|S5Wy|yJbs;xIU;s!Vl48H z5C^_56Onw2Ie`^8CL^s+`o)~4p9bV98SoY_Qt~7q5`B>*(y z)$6=k8U)QyhJfdJMrX*?!N#ag-n+qTT(x5g+lzU(Df=l}%5m^Pyus#(vP{p*Lji`X zJ(T1k=)fwY48&m|#j}4ZsY;jma!%Ppd1zf2i=Jrcs`^Jt#hmlr;MpPQe3W|d=l>F`n)6$d2&<%A~b6#I$bdUhy@s~6n| zRa)=JoU5NTq}HDlqy~(VSSxZf-itr^FnehB64C4`gv~fl`My9hsZp1?f z=5r&#a-QWfOS8wUU0UM%i%F1?jk`@4ad!;cR%h@Yvm9l5%psXW7s|@IB?2b~wUNdF z57e&y+J#Lyc?R`2HJhO#&|vG&Ji{~>Rs-A|1C*enI8%{2+*7A1xu zZ_6z<@Ab5rX{9*_ZMIXmc$+AnVx&Ykkq;^ucqu)`J0%@2Ey2qLq+@(DCR{-=_-A z00E5vngBGT5-kg$1wbo+*{Dp*0hkM59)S61rd9y35Wpe;i&3do0yl2^M<5*lajr^7SJFv$1kwYX zu7TNufo ziaA=YcUXbrjP(iuAS6eUCpeM zxTF1TGj5vFq-CAlYmcq!fhG+>BsEVuacs=Vp#ezf)rlmg!}Y-zMp=cJ^tjDF0?n2TGI#ZLJoDU}GrO0a^)jm9C_-$U1x% z1tDo?-WA)pBP}3Kw8=jdiFYGboN5qQMJO@=f`U_h=tr@~n?t54x?UOvsWnogX)W7_ zgVIP|_34ZrvJru_0IKtAwq7BRu=QylpjSalu4Jf|1y{_203k=o10WPIX&VG?MfDg! zGS?}DOj<(whx=z+PjxHp4!c2I7UD7tLddvEztXe)#55AkklgZ|MJ;L=rLK!u`bji70wEbuJmEfOdsT}^byubXIw&3lDnD9cJ2u}F6(FznKll$c)+E@ z6Q(oY`CKKEIKh;2FqsEsc`PPBlA(>^dt76IL!2y%xT9qjnT?1AB)tQt%Hv*X1fjTb zDeVusxgzT5BHJE#L1z&_(dq6X?#5zR3f)nba!JPDpH6y9+%IeMN@WYpY`>8jH=h1kbp&_z^aFZf_gG+UwK+TIvOE9uxX(;ZCk=^(2u@ z$^)U+pLmG1CD^t#R2RrTLel7i+^Gd=YP~bIzY}~i=4K!nP#sj%5v8asWExBE1gVf@ z?f4sG8@!=ww7KBX!dt)t-wDQo(LV2w%m_{RGlSc(4z3U8yoxm7m3~#Wj6Ku4TA0?p z^g*KZj(~$qEnP~5CpK#+(Lt<6l9E|fcEyQ!7%HaIVIcS;q~azSM&rRZBs%47@aBRk zT7yl@lR4yVO=%X|%G=O5W$*CFU^3%Yo+GrynW~3%VS?`tj=VRBo^2zDFkw$hljoL0 zD*hFdn2cJolhs}0L7|cqx89~wSx2MVMV%++7HZxGeABDpJ9Wc`YX?CGoX?Ag#GKID zrw%e-A8Z-hfHxU5XrOKqGEP6g^x2zVyz%AcLnV8%8%1BeSuM!iv8wALx^7h4U~D!n zp3kPav8x(}L8oq!=>%+9yT-XS;_5zRVal7ry7+0ewgYFGVCkJUrAKW6m5MPB}OD{F0u7@`pAj7vJKJh@vvYO`8?uz`_EMDSe z+qxQTXW?yW==IoZbgGY3WPj| zH5Z~pN=2By2Gt2mkb@Nf1e@TK4VzEqLl8I$vvm~Lkb3*qW{ri?8aAlaHz!PHIKUjB zYKRF})UQ|;$s%E&;w5ET%!YDOh6537iA-GMMfTj{#oG-+OFiaQV=)ujBrZ|sX$KNV zB3esZ*q28#__4 zVmcl*>bT~@TgwA`u~}CGc?(q8<%fXcqx$Kb22i+1%eU=NADQc2baSL*hr1K=-Cmwe zCfS7uU=+jVW|?e?t8tXe#-MD3C%NF($Z+{oM=1JObb6SbP7XfydY%0GF_IZCo@OL* zz_iJ-E*Ga#lqeI793feOFf9%vhYw~bnDXmx#U1t36wF^vWwB~BuSF?tg0djX!Qr)- zecmd<h zew(j8!U}Jf9Wi?Cq_gcy!FfXfD=#j2HbK6Dbyp!=Cll^g6Y@xd?Oc6&bJdvK zV1_@EzNkTU^OdSD&_#uDo#OJ*-m7&xdV$5FBlJQWIxa_Dj7k}(;gDX(N^3D_Il8ON zRcy>4-*>zQ^%JQmeKsc9*F!Y9MQ?}BPh>_?cS26P;z&FE-+QTc{3C}W9}TDW6l->S$G=g#%Rrnd}Z)U{yr%y`7_`OI6;X)xWYvTI53;a zu9Ox74YimvC;63Xz6jyo$cE90bf)}gNe#lY7XsNaCU;L}>B;pMz20T2gx*H~YJX<5 z!QR!mR^ITs?+5%lp+4rJ5UjEfz8%F_H)$%GK+n!%qR?tr(p|4|G4UEZ8%cY(ak&ha!4N9Jbmlb#7hJ)A~IBZ_?jqub=Ee5~@y+tip50 zt2lg3JyQQ|Lk67hhcAT6|8kXo1Ft+BcTVNk`94yMJQb0O>FeAVVb{$^`wd19{uzU2 zAZN=n9JSIGv*7&bfg}}G3VtXxg1E^64RG#PHsjMQRp4P%m-EKX8`ME+%0~L0=$A2b8Kzhd8lk5`vf@U&`OKv35g5L8N%o9NynN3W=TtO4z zGl6LtVN=-NWDSF%Ei}t$p*E@=65BBVuZ5(ENaZ3y0JoTVfGXK9-RUPeRRu=~h+D@zL5P}qXqZfz4L7(Zn!#rIPRu9Lx23;)i~61rH;QCk&HBtNJsP{==*&FqMx{l@R^7rd?D-;N`W6-aY7)` zpGJFt+Jy2uHwpTQgM>}{CS&uih_58_j-s@I*o(P~>J9o5)C>C4=W-X0)mIH^ z=W>CcL6HyDf%$QGP=BXK(tq2+`eo6@`;>tsaNG#5C0+`{!o-qX`*h{J|(H08q!J z74g@pcf6y>r1IDc9sPb)?G|1!!(hmlPR`Qwejh9N-g~m^*P9`qVc->S?ojQPw_al9<|f6VV|_lGo^nWdblVZsGdj@G5UmLgPldilZK}q za&!F#Y%HEUVo&>@yRU&^TyQ(>^jg#sqK|)nS=?Z!IZ@OhNh&b>toG zVK+cDB<%||{OH&C0)uX4Ti_1+Wsaq0=YwC>-1R2f{3Q=e>$&P*AMC8La4s+ECbk{l zDhj{1O^tlMdwYZu!w9uvvI7ob`;eJUeM|TO2d6E8!$xhdC6f}lUI|y7spUVI^C)HR%>fP6EOlCSU*V(pD)u zT!+Bn`vGii6oxcHU>Y-24@MGNRT}qZ&6X{z@Uc`hOp^BjO}|Ck-?IO^Y3Tc(Y$`sq zd^14%szc$|#<~bxcgiqMTw1;zpf#;&nw_%S%oOV_Qyl$q_gJY)z|?uQn&eJ_F2?DK zpfj1F;aV~2Qb}#Cq@`B;{#Us)qptAF^gp5%)G~1uvmLpu>rcC>GEFz7rDe*dVrkT+ zRhsO7x{5YuUW{>r3Zz@HJ#wT6ovcMRi(S&v3nQ*oS;CX4@r_d(XE5hrt=PG1BOGMM zFTW5ZgvN}7o19?KU;WF zA6xwt!T@-2Prq)}C*V)b)J`s*^M#@iKtA&`oUG((fI+xqE z5X`m5?+kPYx-7v2uOT+~CRQ1%3~fHg=aQv4?rZ!B7mZl{ehcQgvG|dj8Luu2`l>v zLE20TO@~g2pcfgxu4C0q&SP3E+>@MLOd)G#T$!|$RhnAM$`KFD(l7SYo;6cwOjIVw z6$zP%JIoR*L7u3@rLCH|SG||NV}cq#fZrQ=@X(6fyZ7+7Mhr5)EU(O9^=M6Sje_6w zpou>S4TdUsO?6E{ki8T3^6hS8&&PHa*YWeXIXT=s{u8ro=jQP9o+JjVn=~)QF{ec= za5`nOT$+Vi+~&=k!pAbbxQ0o6i#HQzKOEcS*Z|Ujb=X3ooScOWU9m4I3|)*JOKp&$5iX=XIoB%MXu_?#nP?1K zY=;-R#=<}wCZAUxfZQQzj#aCcN-HW_rG~f%ns8OcC(Gilvj>Du%_?%r%{_lB&H>`nUHY|nN(G9or(G3uT3|&0p*jF4iokL5Z zg4a`R$9QE`)dnOv1|5pTBvo5%Si$d7@T?pO*9N#{X-Hr01QAp)W-Zw7wPSW`6 zm@7+r1K#iz3La(1NTZY@Bts>?QHld(h|*}9aVW-h&|lD2o$-?viQ8rKJM!n`Iu_@0 zmwL_8g62`E@gX`9uESL}N)mugznwHcO0uRh_aC_V515KUV)L*1Cr8uSswm*h9MLwy zAr=r?U%G|AFf5V?`p@2#FyqMu|etW z&RVmQV}@qQ^GR8N#;UG=!i;49q_~@yo8E^UUikX(3aRKGemf^@Hg5aH<5BN}JxmYb zWrefCag^y~if1v91&1!e(ILyiL`}#sTIjPRn}Q$p@RmEkFX>zs6(GV3eg`9rr93Fs zfk5g5k=RPFAC7502vJa>J{V|MF0kT_z&z| z#;Pe*|Glx_jH-gZ{que`)QrlycAyg~kJu3bm3R7YL^bsOpKq&vExEJy?!E7Dq^3V{ z5Y5<2rJ?inEOk+Tq8W8+rk>@~C3XWrZROGqVaHP8QhTqm7|FW|bQ^_6xxn~esb{J# zeCl5Wm??5N&&nvEtYzi+u)`c3rC^4tNIHGO?&;G#HE8cre|D_H#LTv@pxdnX`Z)_3_@Qt+~}Lt2P{s4eFg0d$>G&wwd-J6 zuQeWK*7Fjp3Qyt-=>#Bx zSc}pn2=siHCu|32HE7Zs(=$YdAfLf)26u;_?|>6cHaI2iS)y!6NFhgex$kVSlvc)# zqE){@9=}H|=<4w33%0G(wQX+X;j3#E-PwoWF-1=k&=OUk0R@$oYJhgcqCB8Rj&&X& zh%RyHQ3{qW5X?gGV!<{I%bl@*J0B5q5SnT@$p$o*nt@yn4o$5(=vYAI0;pOhC3^OX z_p~`$^J?xiTptbu9$@q0>SS+c6Hi8i#cVhX>U7C7|eIeSnTpBIgC8|+zU2W%xXGCDy0+0+D0<-!QIj0R$Drx=Mk*d%NoUV4Z zH^9}EZmUb9~HY^zi>4W+Agvz0D&R#0PF{jRxRZIgMJ$ZRI? zob4TB(bkQEc+=a!U_Iq1Pws?E!#*K4Cl+48)zoc*iJFWMR^c%K)S*MfM0~MznKn2W z_$&wEk#ARuc_Ev2@{TDY#YFN_YaNvA)8u;j6=H3FNJ~=)Y%A4|B{1w-slS1$t*h72 z)=j(Jq?Slu7lXR#7Il;Bb2RfZlgv$i1tLWaSxDdw2+gr-<&Y-#~9A#RaT)wyDa8l|brw(HZ!?3G`NkGA4wW1}9`!l2r} zwLaY^$tPf$AhtSWgi&>L06AS6OH%qow_dZ#n!-6+YB-ItJi^l!Njf8;%ew>%FF)&Q z)g$y7VAeI<^fhGU8j7-b!TL)x-?J*J%u~jVCYKhkqJ6%H9^D`6mWeSvE|7w*EOVm5 z%|azYXwUOa zn=GYrszml9X)VmTuM#KaEf%6pwF;;%0QZiQ^0eig&wI562%bN$uY3MMH`@DmZ{NHg z^uK!f;?|98S5KYn^_}S1x@Gf5r=#v!{nJXD$skHk6Q)iWBsKxx#il$io=mO6q%o*2 zH3g;mN%g52F}!i8feQ3XS-`{XyWsr8$wYGTXbDZs=ZPg*LYSMf$!B$!=2zi6(`+C0 zohaOf4kWUhuR#%#1_B)`N{yuL9%^=Jb{=FvLF=U*;K^(0sWx^0&$oV-%S2e7pVFUOcD3~EeV~Lyn6%*qj-h5@B;vF+dCS$Oh|#WK zR&1Ta@I_VqqNzx^Cf&_<=VI!NT}-P+;eOGTf)NXN>%;K`=iW4zc%Hyq(`sIXxuwKy zutJirE?q@8(kUibri2Ngi!hY1(aa#6E!E{^kZ3zN#y%jx2m_dT{3*?J1J$Byq#NMj z6?l|0iY2dRIj&-fRhh6%r+S&DeU$pz-9{5NeeRn)?VxP^s*Jk`fbmCTi$%ID&Y@nG z`eM!#1%0;kgMR8${=zh<&J)fre*Q+!@8^}5UwZMWCmvtp`SilMKum$ zUpw^V2H^zu6xIs~UGz}(mc0ocnEj0zqGXBQfN8SVph$`ljkMCdfu2w1{tXGW;?;Y( zhGmMSfedKT3At`7qY&aHVmz64%S$K==+~eUZ}ArSzY!f>nm@L;KS1r|zJKtY%0JIt zpPXE{>hbk`zf__Xb9kY1PT=^Vf9v&J$1Yi=Yih>3)3wWwu6V8@lHEDM#49i{!8W;> zvoPKpy?I}tBYr@OVr=zyxJ5SxZ zaeQ!Cs0AKdIwH~$v(RcE(TS>LVEQ3MumMoZ`q1=TvypFv2Bp|>KKhX#KVaP@zWm8< z6smG6O^^Kd>hleaHkK9Q{mm9-3XH*q34)v?4~7^!q1GlxgK!K&ldz5~2{%N=CGABt&oY1QgZ@6Vad&|?!)7f-1{CqChZToKCROPI=%j5B| z>l3DS=SUMsQNH34crni4D1{I}7a+oB=i=<6@tI{=uyp!b=X+a$8k_Q@skivT&I!zh z!_{2F0MF;y#k{6UA~@h_ep(&^NsZ%7V9R4;V6t*X$o*-2g!_B%$kd~zbuWmP%d>W* zt3&CHG6ObNa-4CmwQtN7Mmeb z06`c8XT6Xq{X&?kikVK=e6F-v+dam5AA#Q{@|UOGiAsN>p}P7r3MZHIjWG}g<9;`r zAT&k5`y()eE|R&|r-|yw&?n=!ZUdd;d=Y|%9~Qg%w!XsUmtNdlqV&h#zxdTl(q(4( z!sZL}spsShzD)ni+B+rw?^y%2r4M)i9VjaAEs^@Ofth}CecmN8+wBpt`sek239Emh zcA~^z|Hj?4*muZ}j$3=KUUpxizpS=2T~5#}bKAUuT(|i()YR6mp+ZCzrza=|_$f5* z2t22ulG+AT~E?feEhgpxg6u7MZC=U9LU zvUodz=7fqc+(tKVrcbeNWKL1a!4({snFF0oGjHopBL4j@YZ_geJ?1}~%l@k$?`iv( z{PK@s+2qOnK;z#9{HKNe%t6^dcv(lUGcw3@1t;{3d9i^(`;vPzk$kV&o^O7w*Icf*U+ z)XF>uBPn=FXlOzx!w@${CNt?U2w?a+02hEjJB4V4&gf{GPFLs}{}f@OVmcuP4v{CP zi9*z{%@ZxZF68f7X3ijtNmonZoLthlHzsO~8H?ZJ=#}hNSYxWGlax5v4B<X4-j||A2KDx#a2H7zvN11 zOF5Yc58X;BZ^)q%^4T=c^UGc^&1ZV_d9%bz@AOTy>Z_9z@3 z`*WAfpCo0l^}k(mfRZ`n-;IyPLX47okM+m?TK|W$H@&mm4ZPux`teEqzi7G0FFxx= z{)fKBGL=hqUOYX0w}BlKaW>cXCZz&uNNNYeq#ah}rx_bHshDOFFre@|Asn`v2UW2MUkJFLkm*+>EZKJD!8t&WH z+@CN2dmKEW$P;MiA)&&SLwvFI0sVO!Ok7mBiu~?Cf2_7XN-5b}VuW0<_mUE_HD2Lx zpguDSOsh#H^CJ7`lGWS&@-coNy&4Hr=|Y-Wns z&5`_ByM-*&(|QqEBIa1j4a*?CdGeNOQB|}do@J9EqmDTO z;}8G;vlW2Kd7j*=61s>URpxU8E`H@B~Qy{@ohkP{ubSXfkH6!Q;@MmUGQbyP(TTC CrWaHI literal 0 HcmV?d00001 diff --git a/it/_static/images/agid-logo.svg b/it/_static/images/agid-logo.svg new file mode 100644 index 00000000..a81f5eb8 --- /dev/null +++ b/it/_static/images/agid-logo.svg @@ -0,0 +1,25 @@ + + + +Logo dell&Agenzia per l&Italia Digitale +Emblema della Repubblica Italiana con accanto l&acronimo AGID + + + + + + + + + + + + + + + + + diff --git a/it/_static/images/may.svg b/it/_static/images/may.svg new file mode 100644 index 00000000..53670ba9 --- /dev/null +++ b/it/_static/images/may.svg @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + + + diff --git a/it/_static/images/must.svg b/it/_static/images/must.svg new file mode 100644 index 00000000..177c3c51 --- /dev/null +++ b/it/_static/images/must.svg @@ -0,0 +1,71 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/it/_static/images/must_not.svg b/it/_static/images/must_not.svg new file mode 100644 index 00000000..8c0c0d85 --- /dev/null +++ b/it/_static/images/must_not.svg @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/it/_static/images/should.svg b/it/_static/images/should.svg new file mode 100644 index 00000000..c1f35d65 --- /dev/null +++ b/it/_static/images/should.svg @@ -0,0 +1,52 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/it/_static/images/should_not.svg b/it/_static/images/should_not.svg new file mode 100644 index 00000000..88e64a64 --- /dev/null +++ b/it/_static/images/should_not.svg @@ -0,0 +1,52 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/it/_static/images/team-digitale-logo.svg b/it/_static/images/team-digitale-logo.svg new file mode 100644 index 00000000..fa557011 --- /dev/null +++ b/it/_static/images/team-digitale-logo.svg @@ -0,0 +1,15 @@ + + + + + + + + + diff --git a/it/_static/italian-stemmer.js b/it/_static/italian-stemmer.js new file mode 100644 index 00000000..df6ddfd3 --- /dev/null +++ b/it/_static/italian-stemmer.js @@ -0,0 +1,996 @@ +// Generated by Snowball 2.1.0 - https://snowballstem.org/ + +/**@constructor*/ +ItalianStemmer = function() { + var base = new BaseStemmer(); + /** @const */ var a_0 = [ + ["", -1, 7], + ["qu", 0, 6], + ["\u00E1", 0, 1], + ["\u00E9", 0, 2], + ["\u00ED", 0, 3], + ["\u00F3", 0, 4], + ["\u00FA", 0, 5] + ]; + + /** @const */ var a_1 = [ + ["", -1, 3], + ["I", 0, 1], + ["U", 0, 2] + ]; + + /** @const */ var a_2 = [ + ["la", -1, -1], + ["cela", 0, -1], + ["gliela", 0, -1], + ["mela", 0, -1], + ["tela", 0, -1], + ["vela", 0, -1], + ["le", -1, -1], + ["cele", 6, -1], + ["gliele", 6, -1], + ["mele", 6, -1], + ["tele", 6, -1], + ["vele", 6, -1], + ["ne", -1, -1], + ["cene", 12, -1], + ["gliene", 12, -1], + ["mene", 12, -1], + ["sene", 12, -1], + ["tene", 12, -1], + ["vene", 12, -1], + ["ci", -1, -1], + ["li", -1, -1], + ["celi", 20, -1], + ["glieli", 20, -1], + ["meli", 20, -1], + ["teli", 20, -1], + ["veli", 20, -1], + ["gli", 20, -1], + ["mi", -1, -1], + ["si", -1, -1], + ["ti", -1, -1], + ["vi", -1, -1], + ["lo", -1, -1], + ["celo", 31, -1], + ["glielo", 31, -1], + ["melo", 31, -1], + ["telo", 31, -1], + ["velo", 31, -1] + ]; + + /** @const */ var a_3 = [ + ["ando", -1, 1], + ["endo", -1, 1], + ["ar", -1, 2], + ["er", -1, 2], + ["ir", -1, 2] + ]; + + /** @const */ var a_4 = [ + ["ic", -1, -1], + ["abil", -1, -1], + ["os", -1, -1], + ["iv", -1, 1] + ]; + + /** @const */ var a_5 = [ + ["ic", -1, 1], + ["abil", -1, 1], + ["iv", -1, 1] + ]; + + /** @const */ var a_6 = [ + ["ica", -1, 1], + ["logia", -1, 3], + ["osa", -1, 1], + ["ista", -1, 1], + ["iva", -1, 9], + ["anza", -1, 1], + ["enza", -1, 5], + ["ice", -1, 1], + ["atrice", 7, 1], + ["iche", -1, 1], + ["logie", -1, 3], + ["abile", -1, 1], + ["ibile", -1, 1], + ["usione", -1, 4], + ["azione", -1, 2], + ["uzione", -1, 4], + ["atore", -1, 2], + ["ose", -1, 1], + ["ante", -1, 1], + ["mente", -1, 1], + ["amente", 19, 7], + ["iste", -1, 1], + ["ive", -1, 9], + ["anze", -1, 1], + ["enze", -1, 5], + ["ici", -1, 1], + ["atrici", 25, 1], + ["ichi", -1, 1], + ["abili", -1, 1], + ["ibili", -1, 1], + ["ismi", -1, 1], + ["usioni", -1, 4], + ["azioni", -1, 2], + ["uzioni", -1, 4], + ["atori", -1, 2], + ["osi", -1, 1], + ["anti", -1, 1], + ["amenti", -1, 6], + ["imenti", -1, 6], + ["isti", -1, 1], + ["ivi", -1, 9], + ["ico", -1, 1], + ["ismo", -1, 1], + ["oso", -1, 1], + ["amento", -1, 6], + ["imento", -1, 6], + ["ivo", -1, 9], + ["it\u00E0", -1, 8], + ["ist\u00E0", -1, 1], + ["ist\u00E8", -1, 1], + ["ist\u00EC", -1, 1] + ]; + + /** @const */ var a_7 = [ + ["isca", -1, 1], + ["enda", -1, 1], + ["ata", -1, 1], + ["ita", -1, 1], + ["uta", -1, 1], + ["ava", -1, 1], + ["eva", -1, 1], + ["iva", -1, 1], + ["erebbe", -1, 1], + ["irebbe", -1, 1], + ["isce", -1, 1], + ["ende", -1, 1], + ["are", -1, 1], + ["ere", -1, 1], + ["ire", -1, 1], + ["asse", -1, 1], + ["ate", -1, 1], + ["avate", 16, 1], + ["evate", 16, 1], + ["ivate", 16, 1], + ["ete", -1, 1], + ["erete", 20, 1], + ["irete", 20, 1], + ["ite", -1, 1], + ["ereste", -1, 1], + ["ireste", -1, 1], + ["ute", -1, 1], + ["erai", -1, 1], + ["irai", -1, 1], + ["isci", -1, 1], + ["endi", -1, 1], + ["erei", -1, 1], + ["irei", -1, 1], + ["assi", -1, 1], + ["ati", -1, 1], + ["iti", -1, 1], + ["eresti", -1, 1], + ["iresti", -1, 1], + ["uti", -1, 1], + ["avi", -1, 1], + ["evi", -1, 1], + ["ivi", -1, 1], + ["isco", -1, 1], + ["ando", -1, 1], + ["endo", -1, 1], + ["Yamo", -1, 1], + ["iamo", -1, 1], + ["avamo", -1, 1], + ["evamo", -1, 1], + ["ivamo", -1, 1], + ["eremo", -1, 1], + ["iremo", -1, 1], + ["assimo", -1, 1], + ["ammo", -1, 1], + ["emmo", -1, 1], + ["eremmo", 54, 1], + ["iremmo", 54, 1], + ["immo", -1, 1], + ["ano", -1, 1], + ["iscano", 58, 1], + ["avano", 58, 1], + ["evano", 58, 1], + ["ivano", 58, 1], + ["eranno", -1, 1], + ["iranno", -1, 1], + ["ono", -1, 1], + ["iscono", 65, 1], + ["arono", 65, 1], + ["erono", 65, 1], + ["irono", 65, 1], + ["erebbero", -1, 1], + ["irebbero", -1, 1], + ["assero", -1, 1], + ["essero", -1, 1], + ["issero", -1, 1], + ["ato", -1, 1], + ["ito", -1, 1], + ["uto", -1, 1], + ["avo", -1, 1], + ["evo", -1, 1], + ["ivo", -1, 1], + ["ar", -1, 1], + ["ir", -1, 1], + ["er\u00E0", -1, 1], + ["ir\u00E0", -1, 1], + ["er\u00F2", -1, 1], + ["ir\u00F2", -1, 1] + ]; + + /** @const */ var /** Array */ g_v = [17, 65, 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128, 128, 8, 2, 1]; + + /** @const */ var /** Array */ g_AEIO = [17, 65, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128, 128, 8, 2]; + + /** @const */ var /** Array */ g_CG = [17]; + + var /** number */ I_p2 = 0; + var /** number */ I_p1 = 0; + var /** number */ I_pV = 0; + + + /** @return {boolean} */ + function r_prelude() { + var /** number */ among_var; + var /** number */ v_1 = base.cursor; + while(true) + { + var /** number */ v_2 = base.cursor; + lab0: { + base.bra = base.cursor; + among_var = base.find_among(a_0); + if (among_var == 0) + { + break lab0; + } + base.ket = base.cursor; + switch (among_var) { + case 1: + if (!base.slice_from("\u00E0")) + { + return false; + } + break; + case 2: + if (!base.slice_from("\u00E8")) + { + return false; + } + break; + case 3: + if (!base.slice_from("\u00EC")) + { + return false; + } + break; + case 4: + if (!base.slice_from("\u00F2")) + { + return false; + } + break; + case 5: + if (!base.slice_from("\u00F9")) + { + return false; + } + break; + case 6: + if (!base.slice_from("qU")) + { + return false; + } + break; + case 7: + if (base.cursor >= base.limit) + { + break lab0; + } + base.cursor++; + break; + } + continue; + } + base.cursor = v_2; + break; + } + base.cursor = v_1; + while(true) + { + var /** number */ v_3 = base.cursor; + lab1: { + golab2: while(true) + { + var /** number */ v_4 = base.cursor; + lab3: { + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab3; + } + base.bra = base.cursor; + lab4: { + var /** number */ v_5 = base.cursor; + lab5: { + if (!(base.eq_s("u"))) + { + break lab5; + } + base.ket = base.cursor; + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab5; + } + if (!base.slice_from("U")) + { + return false; + } + break lab4; + } + base.cursor = v_5; + if (!(base.eq_s("i"))) + { + break lab3; + } + base.ket = base.cursor; + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab3; + } + if (!base.slice_from("I")) + { + return false; + } + } + base.cursor = v_4; + break golab2; + } + base.cursor = v_4; + if (base.cursor >= base.limit) + { + break lab1; + } + base.cursor++; + } + continue; + } + base.cursor = v_3; + break; + } + return true; + }; + + /** @return {boolean} */ + function r_mark_regions() { + I_pV = base.limit; + I_p1 = base.limit; + I_p2 = base.limit; + var /** number */ v_1 = base.cursor; + lab0: { + lab1: { + var /** number */ v_2 = base.cursor; + lab2: { + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab2; + } + lab3: { + var /** number */ v_3 = base.cursor; + lab4: { + if (!(base.out_grouping(g_v, 97, 249))) + { + break lab4; + } + golab5: while(true) + { + lab6: { + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab6; + } + break golab5; + } + if (base.cursor >= base.limit) + { + break lab4; + } + base.cursor++; + } + break lab3; + } + base.cursor = v_3; + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab2; + } + golab7: while(true) + { + lab8: { + if (!(base.out_grouping(g_v, 97, 249))) + { + break lab8; + } + break golab7; + } + if (base.cursor >= base.limit) + { + break lab2; + } + base.cursor++; + } + } + break lab1; + } + base.cursor = v_2; + if (!(base.out_grouping(g_v, 97, 249))) + { + break lab0; + } + lab9: { + var /** number */ v_6 = base.cursor; + lab10: { + if (!(base.out_grouping(g_v, 97, 249))) + { + break lab10; + } + golab11: while(true) + { + lab12: { + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab12; + } + break golab11; + } + if (base.cursor >= base.limit) + { + break lab10; + } + base.cursor++; + } + break lab9; + } + base.cursor = v_6; + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab0; + } + if (base.cursor >= base.limit) + { + break lab0; + } + base.cursor++; + } + } + I_pV = base.cursor; + } + base.cursor = v_1; + var /** number */ v_8 = base.cursor; + lab13: { + golab14: while(true) + { + lab15: { + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab15; + } + break golab14; + } + if (base.cursor >= base.limit) + { + break lab13; + } + base.cursor++; + } + golab16: while(true) + { + lab17: { + if (!(base.out_grouping(g_v, 97, 249))) + { + break lab17; + } + break golab16; + } + if (base.cursor >= base.limit) + { + break lab13; + } + base.cursor++; + } + I_p1 = base.cursor; + golab18: while(true) + { + lab19: { + if (!(base.in_grouping(g_v, 97, 249))) + { + break lab19; + } + break golab18; + } + if (base.cursor >= base.limit) + { + break lab13; + } + base.cursor++; + } + golab20: while(true) + { + lab21: { + if (!(base.out_grouping(g_v, 97, 249))) + { + break lab21; + } + break golab20; + } + if (base.cursor >= base.limit) + { + break lab13; + } + base.cursor++; + } + I_p2 = base.cursor; + } + base.cursor = v_8; + return true; + }; + + /** @return {boolean} */ + function r_postlude() { + var /** number */ among_var; + while(true) + { + var /** number */ v_1 = base.cursor; + lab0: { + base.bra = base.cursor; + among_var = base.find_among(a_1); + if (among_var == 0) + { + break lab0; + } + base.ket = base.cursor; + switch (among_var) { + case 1: + if (!base.slice_from("i")) + { + return false; + } + break; + case 2: + if (!base.slice_from("u")) + { + return false; + } + break; + case 3: + if (base.cursor >= base.limit) + { + break lab0; + } + base.cursor++; + break; + } + continue; + } + base.cursor = v_1; + break; + } + return true; + }; + + /** @return {boolean} */ + function r_RV() { + if (!(I_pV <= base.cursor)) + { + return false; + } + return true; + }; + + /** @return {boolean} */ + function r_R1() { + if (!(I_p1 <= base.cursor)) + { + return false; + } + return true; + }; + + /** @return {boolean} */ + function r_R2() { + if (!(I_p2 <= base.cursor)) + { + return false; + } + return true; + }; + + /** @return {boolean} */ + function r_attached_pronoun() { + var /** number */ among_var; + base.ket = base.cursor; + if (base.find_among_b(a_2) == 0) + { + return false; + } + base.bra = base.cursor; + among_var = base.find_among_b(a_3); + if (among_var == 0) + { + return false; + } + if (!r_RV()) + { + return false; + } + switch (among_var) { + case 1: + if (!base.slice_del()) + { + return false; + } + break; + case 2: + if (!base.slice_from("e")) + { + return false; + } + break; + } + return true; + }; + + /** @return {boolean} */ + function r_standard_suffix() { + var /** number */ among_var; + base.ket = base.cursor; + among_var = base.find_among_b(a_6); + if (among_var == 0) + { + return false; + } + base.bra = base.cursor; + switch (among_var) { + case 1: + if (!r_R2()) + { + return false; + } + if (!base.slice_del()) + { + return false; + } + break; + case 2: + if (!r_R2()) + { + return false; + } + if (!base.slice_del()) + { + return false; + } + var /** number */ v_1 = base.limit - base.cursor; + lab0: { + base.ket = base.cursor; + if (!(base.eq_s_b("ic"))) + { + base.cursor = base.limit - v_1; + break lab0; + } + base.bra = base.cursor; + if (!r_R2()) + { + base.cursor = base.limit - v_1; + break lab0; + } + if (!base.slice_del()) + { + return false; + } + } + break; + case 3: + if (!r_R2()) + { + return false; + } + if (!base.slice_from("log")) + { + return false; + } + break; + case 4: + if (!r_R2()) + { + return false; + } + if (!base.slice_from("u")) + { + return false; + } + break; + case 5: + if (!r_R2()) + { + return false; + } + if (!base.slice_from("ente")) + { + return false; + } + break; + case 6: + if (!r_RV()) + { + return false; + } + if (!base.slice_del()) + { + return false; + } + break; + case 7: + if (!r_R1()) + { + return false; + } + if (!base.slice_del()) + { + return false; + } + var /** number */ v_2 = base.limit - base.cursor; + lab1: { + base.ket = base.cursor; + among_var = base.find_among_b(a_4); + if (among_var == 0) + { + base.cursor = base.limit - v_2; + break lab1; + } + base.bra = base.cursor; + if (!r_R2()) + { + base.cursor = base.limit - v_2; + break lab1; + } + if (!base.slice_del()) + { + return false; + } + switch (among_var) { + case 1: + base.ket = base.cursor; + if (!(base.eq_s_b("at"))) + { + base.cursor = base.limit - v_2; + break lab1; + } + base.bra = base.cursor; + if (!r_R2()) + { + base.cursor = base.limit - v_2; + break lab1; + } + if (!base.slice_del()) + { + return false; + } + break; + } + } + break; + case 8: + if (!r_R2()) + { + return false; + } + if (!base.slice_del()) + { + return false; + } + var /** number */ v_3 = base.limit - base.cursor; + lab2: { + base.ket = base.cursor; + if (base.find_among_b(a_5) == 0) + { + base.cursor = base.limit - v_3; + break lab2; + } + base.bra = base.cursor; + if (!r_R2()) + { + base.cursor = base.limit - v_3; + break lab2; + } + if (!base.slice_del()) + { + return false; + } + } + break; + case 9: + if (!r_R2()) + { + return false; + } + if (!base.slice_del()) + { + return false; + } + var /** number */ v_4 = base.limit - base.cursor; + lab3: { + base.ket = base.cursor; + if (!(base.eq_s_b("at"))) + { + base.cursor = base.limit - v_4; + break lab3; + } + base.bra = base.cursor; + if (!r_R2()) + { + base.cursor = base.limit - v_4; + break lab3; + } + if (!base.slice_del()) + { + return false; + } + base.ket = base.cursor; + if (!(base.eq_s_b("ic"))) + { + base.cursor = base.limit - v_4; + break lab3; + } + base.bra = base.cursor; + if (!r_R2()) + { + base.cursor = base.limit - v_4; + break lab3; + } + if (!base.slice_del()) + { + return false; + } + } + break; + } + return true; + }; + + /** @return {boolean} */ + function r_verb_suffix() { + if (base.cursor < I_pV) + { + return false; + } + var /** number */ v_2 = base.limit_backward; + base.limit_backward = I_pV; + base.ket = base.cursor; + if (base.find_among_b(a_7) == 0) + { + base.limit_backward = v_2; + return false; + } + base.bra = base.cursor; + if (!base.slice_del()) + { + return false; + } + base.limit_backward = v_2; + return true; + }; + + /** @return {boolean} */ + function r_vowel_suffix() { + var /** number */ v_1 = base.limit - base.cursor; + lab0: { + base.ket = base.cursor; + if (!(base.in_grouping_b(g_AEIO, 97, 242))) + { + base.cursor = base.limit - v_1; + break lab0; + } + base.bra = base.cursor; + if (!r_RV()) + { + base.cursor = base.limit - v_1; + break lab0; + } + if (!base.slice_del()) + { + return false; + } + base.ket = base.cursor; + if (!(base.eq_s_b("i"))) + { + base.cursor = base.limit - v_1; + break lab0; + } + base.bra = base.cursor; + if (!r_RV()) + { + base.cursor = base.limit - v_1; + break lab0; + } + if (!base.slice_del()) + { + return false; + } + } + var /** number */ v_2 = base.limit - base.cursor; + lab1: { + base.ket = base.cursor; + if (!(base.eq_s_b("h"))) + { + base.cursor = base.limit - v_2; + break lab1; + } + base.bra = base.cursor; + if (!(base.in_grouping_b(g_CG, 99, 103))) + { + base.cursor = base.limit - v_2; + break lab1; + } + if (!r_RV()) + { + base.cursor = base.limit - v_2; + break lab1; + } + if (!base.slice_del()) + { + return false; + } + } + return true; + }; + + this.stem = /** @return {boolean} */ function() { + var /** number */ v_1 = base.cursor; + r_prelude(); + base.cursor = v_1; + r_mark_regions(); + base.limit_backward = base.cursor; base.cursor = base.limit; + var /** number */ v_3 = base.limit - base.cursor; + r_attached_pronoun(); + base.cursor = base.limit - v_3; + var /** number */ v_4 = base.limit - base.cursor; + lab0: { + lab1: { + var /** number */ v_5 = base.limit - base.cursor; + lab2: { + if (!r_standard_suffix()) + { + break lab2; + } + break lab1; + } + base.cursor = base.limit - v_5; + if (!r_verb_suffix()) + { + break lab0; + } + } + } + base.cursor = base.limit - v_4; + var /** number */ v_6 = base.limit - base.cursor; + r_vowel_suffix(); + base.cursor = base.limit - v_6; + base.cursor = base.limit_backward; + var /** number */ v_7 = base.cursor; + r_postlude(); + base.cursor = v_7; + return true; + }; + + /**@return{string}*/ + this['stemWord'] = function(/**string*/word) { + base.setCurrent(word); + this.stem(); + return base.getCurrent(); + }; +}; diff --git a/it/_static/jquery-3.6.0.js b/it/_static/jquery-3.6.0.js new file mode 100644 index 00000000..fc6c299b --- /dev/null +++ b/it/_static/jquery-3.6.0.js @@ -0,0 +1,10881 @@ +/*! + * jQuery JavaScript Library v3.6.0 + * https://jquery.com/ + * + * Includes Sizzle.js + * https://sizzlejs.com/ + * + * Copyright OpenJS Foundation and other contributors + * Released under the MIT license + * https://jquery.org/license + * + * Date: 2021-03-02T17:08Z + */ +( function( global, factory ) { + + "use strict"; + + if ( typeof module === "object" && typeof module.exports === "object" ) { + + // For CommonJS and CommonJS-like environments where a proper `window` + // is present, execute the factory and get jQuery. + // For environments that do not have a `window` with a `document` + // (such as Node.js), expose a factory as module.exports. + // This accentuates the need for the creation of a real `window`. + // e.g. var jQuery = require("jquery")(window); + // See ticket #14549 for more info. + module.exports = global.document ? + factory( global, true ) : + function( w ) { + if ( !w.document ) { + throw new Error( "jQuery requires a window with a document" ); + } + return factory( w ); + }; + } else { + factory( global ); + } + +// Pass this if window is not defined yet +} )( typeof window !== "undefined" ? window : this, function( window, noGlobal ) { + +// Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1 +// throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode +// arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common +// enough that all such attempts are guarded in a try block. +"use strict"; + +var arr = []; + +var getProto = Object.getPrototypeOf; + +var slice = arr.slice; + +var flat = arr.flat ? function( array ) { + return arr.flat.call( array ); +} : function( array ) { + return arr.concat.apply( [], array ); +}; + + +var push = arr.push; + +var indexOf = arr.indexOf; + +var class2type = {}; + +var toString = class2type.toString; + +var hasOwn = class2type.hasOwnProperty; + +var fnToString = hasOwn.toString; + +var ObjectFunctionString = fnToString.call( Object ); + +var support = {}; + +var isFunction = function isFunction( obj ) { + + // Support: Chrome <=57, Firefox <=52 + // In some browsers, typeof returns "function" for HTML elements + // (i.e., `typeof document.createElement( "object" ) === "function"`). + // We don't want to classify *any* DOM node as a function. + // Support: QtWeb <=3.8.5, WebKit <=534.34, wkhtmltopdf tool <=0.12.5 + // Plus for old WebKit, typeof returns "function" for HTML collections + // (e.g., `typeof document.getElementsByTagName("div") === "function"`). (gh-4756) + return typeof obj === "function" && typeof obj.nodeType !== "number" && + typeof obj.item !== "function"; + }; + + +var isWindow = function isWindow( obj ) { + return obj != null && obj === obj.window; + }; + + +var document = window.document; + + + + var preservedScriptAttributes = { + type: true, + src: true, + nonce: true, + noModule: true + }; + + function DOMEval( code, node, doc ) { + doc = doc || document; + + var i, val, + script = doc.createElement( "script" ); + + script.text = code; + if ( node ) { + for ( i in preservedScriptAttributes ) { + + // Support: Firefox 64+, Edge 18+ + // Some browsers don't support the "nonce" property on scripts. + // On the other hand, just using `getAttribute` is not enough as + // the `nonce` attribute is reset to an empty string whenever it + // becomes browsing-context connected. + // See https://github.com/whatwg/html/issues/2369 + // See https://html.spec.whatwg.org/#nonce-attributes + // The `node.getAttribute` check was added for the sake of + // `jQuery.globalEval` so that it can fake a nonce-containing node + // via an object. + val = node[ i ] || node.getAttribute && node.getAttribute( i ); + if ( val ) { + script.setAttribute( i, val ); + } + } + } + doc.head.appendChild( script ).parentNode.removeChild( script ); + } + + +function toType( obj ) { + if ( obj == null ) { + return obj + ""; + } + + // Support: Android <=2.3 only (functionish RegExp) + return typeof obj === "object" || typeof obj === "function" ? + class2type[ toString.call( obj ) ] || "object" : + typeof obj; +} +/* global Symbol */ +// Defining this global in .eslintrc.json would create a danger of using the global +// unguarded in another place, it seems safer to define global only for this module + + + +var + version = "3.6.0", + + // Define a local copy of jQuery + jQuery = function( selector, context ) { + + // The jQuery object is actually just the init constructor 'enhanced' + // Need init if jQuery is called (just allow error to be thrown if not included) + return new jQuery.fn.init( selector, context ); + }; + +jQuery.fn = jQuery.prototype = { + + // The current version of jQuery being used + jquery: version, + + constructor: jQuery, + + // The default length of a jQuery object is 0 + length: 0, + + toArray: function() { + return slice.call( this ); + }, + + // Get the Nth element in the matched element set OR + // Get the whole matched element set as a clean array + get: function( num ) { + + // Return all the elements in a clean array + if ( num == null ) { + return slice.call( this ); + } + + // Return just the one element from the set + return num < 0 ? this[ num + this.length ] : this[ num ]; + }, + + // Take an array of elements and push it onto the stack + // (returning the new matched element set) + pushStack: function( elems ) { + + // Build a new jQuery matched element set + var ret = jQuery.merge( this.constructor(), elems ); + + // Add the old object onto the stack (as a reference) + ret.prevObject = this; + + // Return the newly-formed element set + return ret; + }, + + // Execute a callback for every element in the matched set. + each: function( callback ) { + return jQuery.each( this, callback ); + }, + + map: function( callback ) { + return this.pushStack( jQuery.map( this, function( elem, i ) { + return callback.call( elem, i, elem ); + } ) ); + }, + + slice: function() { + return this.pushStack( slice.apply( this, arguments ) ); + }, + + first: function() { + return this.eq( 0 ); + }, + + last: function() { + return this.eq( -1 ); + }, + + even: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return ( i + 1 ) % 2; + } ) ); + }, + + odd: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return i % 2; + } ) ); + }, + + eq: function( i ) { + var len = this.length, + j = +i + ( i < 0 ? len : 0 ); + return this.pushStack( j >= 0 && j < len ? [ this[ j ] ] : [] ); + }, + + end: function() { + return this.prevObject || this.constructor(); + }, + + // For internal use only. + // Behaves like an Array's method, not like a jQuery method. + push: push, + sort: arr.sort, + splice: arr.splice +}; + +jQuery.extend = jQuery.fn.extend = function() { + var options, name, src, copy, copyIsArray, clone, + target = arguments[ 0 ] || {}, + i = 1, + length = arguments.length, + deep = false; + + // Handle a deep copy situation + if ( typeof target === "boolean" ) { + deep = target; + + // Skip the boolean and the target + target = arguments[ i ] || {}; + i++; + } + + // Handle case when target is a string or something (possible in deep copy) + if ( typeof target !== "object" && !isFunction( target ) ) { + target = {}; + } + + // Extend jQuery itself if only one argument is passed + if ( i === length ) { + target = this; + i--; + } + + for ( ; i < length; i++ ) { + + // Only deal with non-null/undefined values + if ( ( options = arguments[ i ] ) != null ) { + + // Extend the base object + for ( name in options ) { + copy = options[ name ]; + + // Prevent Object.prototype pollution + // Prevent never-ending loop + if ( name === "__proto__" || target === copy ) { + continue; + } + + // Recurse if we're merging plain objects or arrays + if ( deep && copy && ( jQuery.isPlainObject( copy ) || + ( copyIsArray = Array.isArray( copy ) ) ) ) { + src = target[ name ]; + + // Ensure proper type for the source value + if ( copyIsArray && !Array.isArray( src ) ) { + clone = []; + } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) { + clone = {}; + } else { + clone = src; + } + copyIsArray = false; + + // Never move original objects, clone them + target[ name ] = jQuery.extend( deep, clone, copy ); + + // Don't bring in undefined values + } else if ( copy !== undefined ) { + target[ name ] = copy; + } + } + } + } + + // Return the modified object + return target; +}; + +jQuery.extend( { + + // Unique for each copy of jQuery on the page + expando: "jQuery" + ( version + Math.random() ).replace( /\D/g, "" ), + + // Assume jQuery is ready without the ready module + isReady: true, + + error: function( msg ) { + throw new Error( msg ); + }, + + noop: function() {}, + + isPlainObject: function( obj ) { + var proto, Ctor; + + // Detect obvious negatives + // Use toString instead of jQuery.type to catch host objects + if ( !obj || toString.call( obj ) !== "[object Object]" ) { + return false; + } + + proto = getProto( obj ); + + // Objects with no prototype (e.g., `Object.create( null )`) are plain + if ( !proto ) { + return true; + } + + // Objects with prototype are plain iff they were constructed by a global Object function + Ctor = hasOwn.call( proto, "constructor" ) && proto.constructor; + return typeof Ctor === "function" && fnToString.call( Ctor ) === ObjectFunctionString; + }, + + isEmptyObject: function( obj ) { + var name; + + for ( name in obj ) { + return false; + } + return true; + }, + + // Evaluates a script in a provided context; falls back to the global one + // if not specified. + globalEval: function( code, options, doc ) { + DOMEval( code, { nonce: options && options.nonce }, doc ); + }, + + each: function( obj, callback ) { + var length, i = 0; + + if ( isArrayLike( obj ) ) { + length = obj.length; + for ( ; i < length; i++ ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } else { + for ( i in obj ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } + + return obj; + }, + + // results is for internal usage only + makeArray: function( arr, results ) { + var ret = results || []; + + if ( arr != null ) { + if ( isArrayLike( Object( arr ) ) ) { + jQuery.merge( ret, + typeof arr === "string" ? + [ arr ] : arr + ); + } else { + push.call( ret, arr ); + } + } + + return ret; + }, + + inArray: function( elem, arr, i ) { + return arr == null ? -1 : indexOf.call( arr, elem, i ); + }, + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + merge: function( first, second ) { + var len = +second.length, + j = 0, + i = first.length; + + for ( ; j < len; j++ ) { + first[ i++ ] = second[ j ]; + } + + first.length = i; + + return first; + }, + + grep: function( elems, callback, invert ) { + var callbackInverse, + matches = [], + i = 0, + length = elems.length, + callbackExpect = !invert; + + // Go through the array, only saving the items + // that pass the validator function + for ( ; i < length; i++ ) { + callbackInverse = !callback( elems[ i ], i ); + if ( callbackInverse !== callbackExpect ) { + matches.push( elems[ i ] ); + } + } + + return matches; + }, + + // arg is for internal usage only + map: function( elems, callback, arg ) { + var length, value, + i = 0, + ret = []; + + // Go through the array, translating each of the items to their new values + if ( isArrayLike( elems ) ) { + length = elems.length; + for ( ; i < length; i++ ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + + // Go through every key on the object, + } else { + for ( i in elems ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + } + + // Flatten any nested arrays + return flat( ret ); + }, + + // A global GUID counter for objects + guid: 1, + + // jQuery.support is not used in Core but other projects attach their + // properties to it so it needs to exist. + support: support +} ); + +if ( typeof Symbol === "function" ) { + jQuery.fn[ Symbol.iterator ] = arr[ Symbol.iterator ]; +} + +// Populate the class2type map +jQuery.each( "Boolean Number String Function Array Date RegExp Object Error Symbol".split( " " ), + function( _i, name ) { + class2type[ "[object " + name + "]" ] = name.toLowerCase(); + } ); + +function isArrayLike( obj ) { + + // Support: real iOS 8.2 only (not reproducible in simulator) + // `in` check used to prevent JIT error (gh-2145) + // hasOwn isn't used here due to false negatives + // regarding Nodelist length in IE + var length = !!obj && "length" in obj && obj.length, + type = toType( obj ); + + if ( isFunction( obj ) || isWindow( obj ) ) { + return false; + } + + return type === "array" || length === 0 || + typeof length === "number" && length > 0 && ( length - 1 ) in obj; +} +var Sizzle = +/*! + * Sizzle CSS Selector Engine v2.3.6 + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://js.foundation/ + * + * Date: 2021-02-16 + */ +( function( window ) { +var i, + support, + Expr, + getText, + isXML, + tokenize, + compile, + select, + outermostContext, + sortInput, + hasDuplicate, + + // Local document vars + setDocument, + document, + docElem, + documentIsHTML, + rbuggyQSA, + rbuggyMatches, + matches, + contains, + + // Instance-specific data + expando = "sizzle" + 1 * new Date(), + preferredDoc = window.document, + dirruns = 0, + done = 0, + classCache = createCache(), + tokenCache = createCache(), + compilerCache = createCache(), + nonnativeSelectorCache = createCache(), + sortOrder = function( a, b ) { + if ( a === b ) { + hasDuplicate = true; + } + return 0; + }, + + // Instance methods + hasOwn = ( {} ).hasOwnProperty, + arr = [], + pop = arr.pop, + pushNative = arr.push, + push = arr.push, + slice = arr.slice, + + // Use a stripped-down indexOf as it's faster than native + // https://jsperf.com/thor-indexof-vs-for/5 + indexOf = function( list, elem ) { + var i = 0, + len = list.length; + for ( ; i < len; i++ ) { + if ( list[ i ] === elem ) { + return i; + } + } + return -1; + }, + + booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|" + + "ismap|loop|multiple|open|readonly|required|scoped", + + // Regular expressions + + // http://www.w3.org/TR/css3-selectors/#whitespace + whitespace = "[\\x20\\t\\r\\n\\f]", + + // https://www.w3.org/TR/css-syntax-3/#ident-token-diagram + identifier = "(?:\\\\[\\da-fA-F]{1,6}" + whitespace + + "?|\\\\[^\\r\\n\\f]|[\\w-]|[^\0-\\x7f])+", + + // Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors + attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace + + + // Operator (capture 2) + "*([*^$|!~]?=)" + whitespace + + + // "Attribute values must be CSS identifiers [capture 5] + // or strings [capture 3 or capture 4]" + "*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" + + whitespace + "*\\]", + + pseudos = ":(" + identifier + ")(?:\\((" + + + // To reduce the number of selectors needing tokenize in the preFilter, prefer arguments: + // 1. quoted (capture 3; capture 4 or capture 5) + "('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" + + + // 2. simple (capture 6) + "((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" + + + // 3. anything else (capture 2) + ".*" + + ")\\)|)", + + // Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latter + rwhitespace = new RegExp( whitespace + "+", "g" ), + rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + + whitespace + "+$", "g" ), + + rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ), + rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" + whitespace + + "*" ), + rdescend = new RegExp( whitespace + "|>" ), + + rpseudo = new RegExp( pseudos ), + ridentifier = new RegExp( "^" + identifier + "$" ), + + matchExpr = { + "ID": new RegExp( "^#(" + identifier + ")" ), + "CLASS": new RegExp( "^\\.(" + identifier + ")" ), + "TAG": new RegExp( "^(" + identifier + "|[*])" ), + "ATTR": new RegExp( "^" + attributes ), + "PSEUDO": new RegExp( "^" + pseudos ), + "CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" + + whitespace + "*(even|odd|(([+-]|)(\\d*)n|)" + whitespace + "*(?:([+-]|)" + + whitespace + "*(\\d+)|))" + whitespace + "*\\)|)", "i" ), + "bool": new RegExp( "^(?:" + booleans + ")$", "i" ), + + // For use in libraries implementing .is() + // We use this for POS matching in `select` + "needsContext": new RegExp( "^" + whitespace + + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" + whitespace + + "*((?:-\\d)?\\d*)" + whitespace + "*\\)|)(?=[^-]|$)", "i" ) + }, + + rhtml = /HTML$/i, + rinputs = /^(?:input|select|textarea|button)$/i, + rheader = /^h\d$/i, + + rnative = /^[^{]+\{\s*\[native \w/, + + // Easily-parseable/retrievable ID or TAG or CLASS selectors + rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/, + + rsibling = /[+~]/, + + // CSS escapes + // http://www.w3.org/TR/CSS21/syndata.html#escaped-characters + runescape = new RegExp( "\\\\[\\da-fA-F]{1,6}" + whitespace + "?|\\\\([^\\r\\n\\f])", "g" ), + funescape = function( escape, nonHex ) { + var high = "0x" + escape.slice( 1 ) - 0x10000; + + return nonHex ? + + // Strip the backslash prefix from a non-hex escape sequence + nonHex : + + // Replace a hexadecimal escape sequence with the encoded Unicode code point + // Support: IE <=11+ + // For values outside the Basic Multilingual Plane (BMP), manually construct a + // surrogate pair + high < 0 ? + String.fromCharCode( high + 0x10000 ) : + String.fromCharCode( high >> 10 | 0xD800, high & 0x3FF | 0xDC00 ); + }, + + // CSS string/identifier serialization + // https://drafts.csswg.org/cssom/#common-serializing-idioms + rcssescape = /([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g, + fcssescape = function( ch, asCodePoint ) { + if ( asCodePoint ) { + + // U+0000 NULL becomes U+FFFD REPLACEMENT CHARACTER + if ( ch === "\0" ) { + return "\uFFFD"; + } + + // Control characters and (dependent upon position) numbers get escaped as code points + return ch.slice( 0, -1 ) + "\\" + + ch.charCodeAt( ch.length - 1 ).toString( 16 ) + " "; + } + + // Other potentially-special ASCII characters get backslash-escaped + return "\\" + ch; + }, + + // Used for iframes + // See setDocument() + // Removing the function wrapper causes a "Permission Denied" + // error in IE + unloadHandler = function() { + setDocument(); + }, + + inDisabledFieldset = addCombinator( + function( elem ) { + return elem.disabled === true && elem.nodeName.toLowerCase() === "fieldset"; + }, + { dir: "parentNode", next: "legend" } + ); + +// Optimize for push.apply( _, NodeList ) +try { + push.apply( + ( arr = slice.call( preferredDoc.childNodes ) ), + preferredDoc.childNodes + ); + + // Support: Android<4.0 + // Detect silently failing push.apply + // eslint-disable-next-line no-unused-expressions + arr[ preferredDoc.childNodes.length ].nodeType; +} catch ( e ) { + push = { apply: arr.length ? + + // Leverage slice if possible + function( target, els ) { + pushNative.apply( target, slice.call( els ) ); + } : + + // Support: IE<9 + // Otherwise append directly + function( target, els ) { + var j = target.length, + i = 0; + + // Can't trust NodeList.length + while ( ( target[ j++ ] = els[ i++ ] ) ) {} + target.length = j - 1; + } + }; +} + +function Sizzle( selector, context, results, seed ) { + var m, i, elem, nid, match, groups, newSelector, + newContext = context && context.ownerDocument, + + // nodeType defaults to 9, since context defaults to document + nodeType = context ? context.nodeType : 9; + + results = results || []; + + // Return early from calls with invalid selector or context + if ( typeof selector !== "string" || !selector || + nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) { + + return results; + } + + // Try to shortcut find operations (as opposed to filters) in HTML documents + if ( !seed ) { + setDocument( context ); + context = context || document; + + if ( documentIsHTML ) { + + // If the selector is sufficiently simple, try using a "get*By*" DOM method + // (excepting DocumentFragment context, where the methods don't exist) + if ( nodeType !== 11 && ( match = rquickExpr.exec( selector ) ) ) { + + // ID selector + if ( ( m = match[ 1 ] ) ) { + + // Document context + if ( nodeType === 9 ) { + if ( ( elem = context.getElementById( m ) ) ) { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( elem.id === m ) { + results.push( elem ); + return results; + } + } else { + return results; + } + + // Element context + } else { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( newContext && ( elem = newContext.getElementById( m ) ) && + contains( context, elem ) && + elem.id === m ) { + + results.push( elem ); + return results; + } + } + + // Type selector + } else if ( match[ 2 ] ) { + push.apply( results, context.getElementsByTagName( selector ) ); + return results; + + // Class selector + } else if ( ( m = match[ 3 ] ) && support.getElementsByClassName && + context.getElementsByClassName ) { + + push.apply( results, context.getElementsByClassName( m ) ); + return results; + } + } + + // Take advantage of querySelectorAll + if ( support.qsa && + !nonnativeSelectorCache[ selector + " " ] && + ( !rbuggyQSA || !rbuggyQSA.test( selector ) ) && + + // Support: IE 8 only + // Exclude object elements + ( nodeType !== 1 || context.nodeName.toLowerCase() !== "object" ) ) { + + newSelector = selector; + newContext = context; + + // qSA considers elements outside a scoping root when evaluating child or + // descendant combinators, which is not what we want. + // In such cases, we work around the behavior by prefixing every selector in the + // list with an ID selector referencing the scope context. + // The technique has to be used as well when a leading combinator is used + // as such selectors are not recognized by querySelectorAll. + // Thanks to Andrew Dupont for this technique. + if ( nodeType === 1 && + ( rdescend.test( selector ) || rcombinators.test( selector ) ) ) { + + // Expand context for sibling selectors + newContext = rsibling.test( selector ) && testContext( context.parentNode ) || + context; + + // We can use :scope instead of the ID hack if the browser + // supports it & if we're not changing the context. + if ( newContext !== context || !support.scope ) { + + // Capture the context ID, setting it first if necessary + if ( ( nid = context.getAttribute( "id" ) ) ) { + nid = nid.replace( rcssescape, fcssescape ); + } else { + context.setAttribute( "id", ( nid = expando ) ); + } + } + + // Prefix every selector in the list + groups = tokenize( selector ); + i = groups.length; + while ( i-- ) { + groups[ i ] = ( nid ? "#" + nid : ":scope" ) + " " + + toSelector( groups[ i ] ); + } + newSelector = groups.join( "," ); + } + + try { + push.apply( results, + newContext.querySelectorAll( newSelector ) + ); + return results; + } catch ( qsaError ) { + nonnativeSelectorCache( selector, true ); + } finally { + if ( nid === expando ) { + context.removeAttribute( "id" ); + } + } + } + } + } + + // All others + return select( selector.replace( rtrim, "$1" ), context, results, seed ); +} + +/** + * Create key-value caches of limited size + * @returns {function(string, object)} Returns the Object data after storing it on itself with + * property name the (space-suffixed) string and (if the cache is larger than Expr.cacheLength) + * deleting the oldest entry + */ +function createCache() { + var keys = []; + + function cache( key, value ) { + + // Use (key + " ") to avoid collision with native prototype properties (see Issue #157) + if ( keys.push( key + " " ) > Expr.cacheLength ) { + + // Only keep the most recent entries + delete cache[ keys.shift() ]; + } + return ( cache[ key + " " ] = value ); + } + return cache; +} + +/** + * Mark a function for special use by Sizzle + * @param {Function} fn The function to mark + */ +function markFunction( fn ) { + fn[ expando ] = true; + return fn; +} + +/** + * Support testing using an element + * @param {Function} fn Passed the created element and returns a boolean result + */ +function assert( fn ) { + var el = document.createElement( "fieldset" ); + + try { + return !!fn( el ); + } catch ( e ) { + return false; + } finally { + + // Remove from its parent by default + if ( el.parentNode ) { + el.parentNode.removeChild( el ); + } + + // release memory in IE + el = null; + } +} + +/** + * Adds the same handler for all of the specified attrs + * @param {String} attrs Pipe-separated list of attributes + * @param {Function} handler The method that will be applied + */ +function addHandle( attrs, handler ) { + var arr = attrs.split( "|" ), + i = arr.length; + + while ( i-- ) { + Expr.attrHandle[ arr[ i ] ] = handler; + } +} + +/** + * Checks document order of two siblings + * @param {Element} a + * @param {Element} b + * @returns {Number} Returns less than 0 if a precedes b, greater than 0 if a follows b + */ +function siblingCheck( a, b ) { + var cur = b && a, + diff = cur && a.nodeType === 1 && b.nodeType === 1 && + a.sourceIndex - b.sourceIndex; + + // Use IE sourceIndex if available on both nodes + if ( diff ) { + return diff; + } + + // Check if b follows a + if ( cur ) { + while ( ( cur = cur.nextSibling ) ) { + if ( cur === b ) { + return -1; + } + } + } + + return a ? 1 : -1; +} + +/** + * Returns a function to use in pseudos for input types + * @param {String} type + */ +function createInputPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for buttons + * @param {String} type + */ +function createButtonPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return ( name === "input" || name === "button" ) && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for :enabled/:disabled + * @param {Boolean} disabled true for :disabled; false for :enabled + */ +function createDisabledPseudo( disabled ) { + + // Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable + return function( elem ) { + + // Only certain elements can match :enabled or :disabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled + if ( "form" in elem ) { + + // Check for inherited disabledness on relevant non-disabled elements: + // * listed form-associated elements in a disabled fieldset + // https://html.spec.whatwg.org/multipage/forms.html#category-listed + // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled + // * option elements in a disabled optgroup + // https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled + // All such elements have a "form" property. + if ( elem.parentNode && elem.disabled === false ) { + + // Option elements defer to a parent optgroup if present + if ( "label" in elem ) { + if ( "label" in elem.parentNode ) { + return elem.parentNode.disabled === disabled; + } else { + return elem.disabled === disabled; + } + } + + // Support: IE 6 - 11 + // Use the isDisabled shortcut property to check for disabled fieldset ancestors + return elem.isDisabled === disabled || + + // Where there is no isDisabled, check manually + /* jshint -W018 */ + elem.isDisabled !== !disabled && + inDisabledFieldset( elem ) === disabled; + } + + return elem.disabled === disabled; + + // Try to winnow out elements that can't be disabled before trusting the disabled property. + // Some victims get caught in our net (label, legend, menu, track), but it shouldn't + // even exist on them, let alone have a boolean value. + } else if ( "label" in elem ) { + return elem.disabled === disabled; + } + + // Remaining elements are neither :enabled nor :disabled + return false; + }; +} + +/** + * Returns a function to use in pseudos for positionals + * @param {Function} fn + */ +function createPositionalPseudo( fn ) { + return markFunction( function( argument ) { + argument = +argument; + return markFunction( function( seed, matches ) { + var j, + matchIndexes = fn( [], seed.length, argument ), + i = matchIndexes.length; + + // Match elements found at the specified indexes + while ( i-- ) { + if ( seed[ ( j = matchIndexes[ i ] ) ] ) { + seed[ j ] = !( matches[ j ] = seed[ j ] ); + } + } + } ); + } ); +} + +/** + * Checks a node for validity as a Sizzle context + * @param {Element|Object=} context + * @returns {Element|Object|Boolean} The input node if acceptable, otherwise a falsy value + */ +function testContext( context ) { + return context && typeof context.getElementsByTagName !== "undefined" && context; +} + +// Expose support vars for convenience +support = Sizzle.support = {}; + +/** + * Detects XML nodes + * @param {Element|Object} elem An element or a document + * @returns {Boolean} True iff elem is a non-HTML XML node + */ +isXML = Sizzle.isXML = function( elem ) { + var namespace = elem && elem.namespaceURI, + docElem = elem && ( elem.ownerDocument || elem ).documentElement; + + // Support: IE <=8 + // Assume HTML when documentElement doesn't yet exist, such as inside loading iframes + // https://bugs.jquery.com/ticket/4833 + return !rhtml.test( namespace || docElem && docElem.nodeName || "HTML" ); +}; + +/** + * Sets document-related variables once based on the current document + * @param {Element|Object} [doc] An element or document object to use to set the document + * @returns {Object} Returns the current document + */ +setDocument = Sizzle.setDocument = function( node ) { + var hasCompare, subWindow, + doc = node ? node.ownerDocument || node : preferredDoc; + + // Return early if doc is invalid or already selected + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( doc == document || doc.nodeType !== 9 || !doc.documentElement ) { + return document; + } + + // Update global variables + document = doc; + docElem = document.documentElement; + documentIsHTML = !isXML( document ); + + // Support: IE 9 - 11+, Edge 12 - 18+ + // Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936) + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( preferredDoc != document && + ( subWindow = document.defaultView ) && subWindow.top !== subWindow ) { + + // Support: IE 11, Edge + if ( subWindow.addEventListener ) { + subWindow.addEventListener( "unload", unloadHandler, false ); + + // Support: IE 9 - 10 only + } else if ( subWindow.attachEvent ) { + subWindow.attachEvent( "onunload", unloadHandler ); + } + } + + // Support: IE 8 - 11+, Edge 12 - 18+, Chrome <=16 - 25 only, Firefox <=3.6 - 31 only, + // Safari 4 - 5 only, Opera <=11.6 - 12.x only + // IE/Edge & older browsers don't support the :scope pseudo-class. + // Support: Safari 6.0 only + // Safari 6.0 supports :scope but it's an alias of :root there. + support.scope = assert( function( el ) { + docElem.appendChild( el ).appendChild( document.createElement( "div" ) ); + return typeof el.querySelectorAll !== "undefined" && + !el.querySelectorAll( ":scope fieldset div" ).length; + } ); + + /* Attributes + ---------------------------------------------------------------------- */ + + // Support: IE<8 + // Verify that getAttribute really returns attributes and not properties + // (excepting IE8 booleans) + support.attributes = assert( function( el ) { + el.className = "i"; + return !el.getAttribute( "className" ); + } ); + + /* getElement(s)By* + ---------------------------------------------------------------------- */ + + // Check if getElementsByTagName("*") returns only elements + support.getElementsByTagName = assert( function( el ) { + el.appendChild( document.createComment( "" ) ); + return !el.getElementsByTagName( "*" ).length; + } ); + + // Support: IE<9 + support.getElementsByClassName = rnative.test( document.getElementsByClassName ); + + // Support: IE<10 + // Check if getElementById returns elements by name + // The broken getElementById methods don't pick up programmatically-set names, + // so use a roundabout getElementsByName test + support.getById = assert( function( el ) { + docElem.appendChild( el ).id = expando; + return !document.getElementsByName || !document.getElementsByName( expando ).length; + } ); + + // ID filter and find + if ( support.getById ) { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + return elem.getAttribute( "id" ) === attrId; + }; + }; + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var elem = context.getElementById( id ); + return elem ? [ elem ] : []; + } + }; + } else { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + var node = typeof elem.getAttributeNode !== "undefined" && + elem.getAttributeNode( "id" ); + return node && node.value === attrId; + }; + }; + + // Support: IE 6 - 7 only + // getElementById is not reliable as a find shortcut + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var node, i, elems, + elem = context.getElementById( id ); + + if ( elem ) { + + // Verify the id attribute + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + + // Fall back on getElementsByName + elems = context.getElementsByName( id ); + i = 0; + while ( ( elem = elems[ i++ ] ) ) { + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + } + } + + return []; + } + }; + } + + // Tag + Expr.find[ "TAG" ] = support.getElementsByTagName ? + function( tag, context ) { + if ( typeof context.getElementsByTagName !== "undefined" ) { + return context.getElementsByTagName( tag ); + + // DocumentFragment nodes don't have gEBTN + } else if ( support.qsa ) { + return context.querySelectorAll( tag ); + } + } : + + function( tag, context ) { + var elem, + tmp = [], + i = 0, + + // By happy coincidence, a (broken) gEBTN appears on DocumentFragment nodes too + results = context.getElementsByTagName( tag ); + + // Filter out possible comments + if ( tag === "*" ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem.nodeType === 1 ) { + tmp.push( elem ); + } + } + + return tmp; + } + return results; + }; + + // Class + Expr.find[ "CLASS" ] = support.getElementsByClassName && function( className, context ) { + if ( typeof context.getElementsByClassName !== "undefined" && documentIsHTML ) { + return context.getElementsByClassName( className ); + } + }; + + /* QSA/matchesSelector + ---------------------------------------------------------------------- */ + + // QSA and matchesSelector support + + // matchesSelector(:active) reports false when true (IE9/Opera 11.5) + rbuggyMatches = []; + + // qSa(:focus) reports false when true (Chrome 21) + // We allow this because of a bug in IE8/9 that throws an error + // whenever `document.activeElement` is accessed on an iframe + // So, we allow :focus to pass through QSA all the time to avoid the IE error + // See https://bugs.jquery.com/ticket/13378 + rbuggyQSA = []; + + if ( ( support.qsa = rnative.test( document.querySelectorAll ) ) ) { + + // Build QSA regex + // Regex strategy adopted from Diego Perini + assert( function( el ) { + + var input; + + // Select is set to empty string on purpose + // This is to test IE's treatment of not explicitly + // setting a boolean content attribute, + // since its presence should be enough + // https://bugs.jquery.com/ticket/12359 + docElem.appendChild( el ).innerHTML = "" + + ""; + + // Support: IE8, Opera 11-12.16 + // Nothing should be selected when empty strings follow ^= or $= or *= + // The test attribute must be unknown in Opera but "safe" for WinRT + // https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section + if ( el.querySelectorAll( "[msallowcapture^='']" ).length ) { + rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" ); + } + + // Support: IE8 + // Boolean attributes and "value" are not treated correctly + if ( !el.querySelectorAll( "[selected]" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" ); + } + + // Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+ + if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) { + rbuggyQSA.push( "~=" ); + } + + // Support: IE 11+, Edge 15 - 18+ + // IE 11/Edge don't find elements on a `[name='']` query in some cases. + // Adding a temporary attribute to the document before the selection works + // around the issue. + // Interestingly, IE 10 & older don't seem to have the issue. + input = document.createElement( "input" ); + input.setAttribute( "name", "" ); + el.appendChild( input ); + if ( !el.querySelectorAll( "[name='']" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*name" + whitespace + "*=" + + whitespace + "*(?:''|\"\")" ); + } + + // Webkit/Opera - :checked should return selected option elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + // IE8 throws error here and will not see later tests + if ( !el.querySelectorAll( ":checked" ).length ) { + rbuggyQSA.push( ":checked" ); + } + + // Support: Safari 8+, iOS 8+ + // https://bugs.webkit.org/show_bug.cgi?id=136851 + // In-page `selector#id sibling-combinator selector` fails + if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) { + rbuggyQSA.push( ".#.+[+~]" ); + } + + // Support: Firefox <=3.6 - 5 only + // Old Firefox doesn't throw on a badly-escaped identifier. + el.querySelectorAll( "\\\f" ); + rbuggyQSA.push( "[\\r\\n\\f]" ); + } ); + + assert( function( el ) { + el.innerHTML = "" + + ""; + + // Support: Windows 8 Native Apps + // The type and name attributes are restricted during .innerHTML assignment + var input = document.createElement( "input" ); + input.setAttribute( "type", "hidden" ); + el.appendChild( input ).setAttribute( "name", "D" ); + + // Support: IE8 + // Enforce case-sensitivity of name attribute + if ( el.querySelectorAll( "[name=d]" ).length ) { + rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" ); + } + + // FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled) + // IE8 throws error here and will not see later tests + if ( el.querySelectorAll( ":enabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: IE9-11+ + // IE's :disabled selector does not pick up the children of disabled fieldsets + docElem.appendChild( el ).disabled = true; + if ( el.querySelectorAll( ":disabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: Opera 10 - 11 only + // Opera 10-11 does not throw on post-comma invalid pseudos + el.querySelectorAll( "*,:x" ); + rbuggyQSA.push( ",.*:" ); + } ); + } + + if ( ( support.matchesSelector = rnative.test( ( matches = docElem.matches || + docElem.webkitMatchesSelector || + docElem.mozMatchesSelector || + docElem.oMatchesSelector || + docElem.msMatchesSelector ) ) ) ) { + + assert( function( el ) { + + // Check to see if it's possible to do matchesSelector + // on a disconnected node (IE 9) + support.disconnectedMatch = matches.call( el, "*" ); + + // This should fail with an exception + // Gecko does not error, returns false instead + matches.call( el, "[s!='']:x" ); + rbuggyMatches.push( "!=", pseudos ); + } ); + } + + rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join( "|" ) ); + rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join( "|" ) ); + + /* Contains + ---------------------------------------------------------------------- */ + hasCompare = rnative.test( docElem.compareDocumentPosition ); + + // Element contains another + // Purposefully self-exclusive + // As in, an element does not contain itself + contains = hasCompare || rnative.test( docElem.contains ) ? + function( a, b ) { + var adown = a.nodeType === 9 ? a.documentElement : a, + bup = b && b.parentNode; + return a === bup || !!( bup && bup.nodeType === 1 && ( + adown.contains ? + adown.contains( bup ) : + a.compareDocumentPosition && a.compareDocumentPosition( bup ) & 16 + ) ); + } : + function( a, b ) { + if ( b ) { + while ( ( b = b.parentNode ) ) { + if ( b === a ) { + return true; + } + } + } + return false; + }; + + /* Sorting + ---------------------------------------------------------------------- */ + + // Document order sorting + sortOrder = hasCompare ? + function( a, b ) { + + // Flag for duplicate removal + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + // Sort on method existence if only one input has compareDocumentPosition + var compare = !a.compareDocumentPosition - !b.compareDocumentPosition; + if ( compare ) { + return compare; + } + + // Calculate position if both inputs belong to the same document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + compare = ( a.ownerDocument || a ) == ( b.ownerDocument || b ) ? + a.compareDocumentPosition( b ) : + + // Otherwise we know they are disconnected + 1; + + // Disconnected nodes + if ( compare & 1 || + ( !support.sortDetached && b.compareDocumentPosition( a ) === compare ) ) { + + // Choose the first element that is related to our preferred document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( a == document || a.ownerDocument == preferredDoc && + contains( preferredDoc, a ) ) { + return -1; + } + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( b == document || b.ownerDocument == preferredDoc && + contains( preferredDoc, b ) ) { + return 1; + } + + // Maintain original order + return sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + } + + return compare & 4 ? -1 : 1; + } : + function( a, b ) { + + // Exit early if the nodes are identical + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + var cur, + i = 0, + aup = a.parentNode, + bup = b.parentNode, + ap = [ a ], + bp = [ b ]; + + // Parentless nodes are either documents or disconnected + if ( !aup || !bup ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + return a == document ? -1 : + b == document ? 1 : + /* eslint-enable eqeqeq */ + aup ? -1 : + bup ? 1 : + sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + + // If the nodes are siblings, we can do a quick check + } else if ( aup === bup ) { + return siblingCheck( a, b ); + } + + // Otherwise we need full lists of their ancestors for comparison + cur = a; + while ( ( cur = cur.parentNode ) ) { + ap.unshift( cur ); + } + cur = b; + while ( ( cur = cur.parentNode ) ) { + bp.unshift( cur ); + } + + // Walk down the tree looking for a discrepancy + while ( ap[ i ] === bp[ i ] ) { + i++; + } + + return i ? + + // Do a sibling check if the nodes have a common ancestor + siblingCheck( ap[ i ], bp[ i ] ) : + + // Otherwise nodes in our document sort first + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + ap[ i ] == preferredDoc ? -1 : + bp[ i ] == preferredDoc ? 1 : + /* eslint-enable eqeqeq */ + 0; + }; + + return document; +}; + +Sizzle.matches = function( expr, elements ) { + return Sizzle( expr, null, null, elements ); +}; + +Sizzle.matchesSelector = function( elem, expr ) { + setDocument( elem ); + + if ( support.matchesSelector && documentIsHTML && + !nonnativeSelectorCache[ expr + " " ] && + ( !rbuggyMatches || !rbuggyMatches.test( expr ) ) && + ( !rbuggyQSA || !rbuggyQSA.test( expr ) ) ) { + + try { + var ret = matches.call( elem, expr ); + + // IE 9's matchesSelector returns false on disconnected nodes + if ( ret || support.disconnectedMatch || + + // As well, disconnected nodes are said to be in a document + // fragment in IE 9 + elem.document && elem.document.nodeType !== 11 ) { + return ret; + } + } catch ( e ) { + nonnativeSelectorCache( expr, true ); + } + } + + return Sizzle( expr, document, null, [ elem ] ).length > 0; +}; + +Sizzle.contains = function( context, elem ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( context.ownerDocument || context ) != document ) { + setDocument( context ); + } + return contains( context, elem ); +}; + +Sizzle.attr = function( elem, name ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( elem.ownerDocument || elem ) != document ) { + setDocument( elem ); + } + + var fn = Expr.attrHandle[ name.toLowerCase() ], + + // Don't get fooled by Object.prototype properties (jQuery #13807) + val = fn && hasOwn.call( Expr.attrHandle, name.toLowerCase() ) ? + fn( elem, name, !documentIsHTML ) : + undefined; + + return val !== undefined ? + val : + support.attributes || !documentIsHTML ? + elem.getAttribute( name ) : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; +}; + +Sizzle.escape = function( sel ) { + return ( sel + "" ).replace( rcssescape, fcssescape ); +}; + +Sizzle.error = function( msg ) { + throw new Error( "Syntax error, unrecognized expression: " + msg ); +}; + +/** + * Document sorting and removing duplicates + * @param {ArrayLike} results + */ +Sizzle.uniqueSort = function( results ) { + var elem, + duplicates = [], + j = 0, + i = 0; + + // Unless we *know* we can detect duplicates, assume their presence + hasDuplicate = !support.detectDuplicates; + sortInput = !support.sortStable && results.slice( 0 ); + results.sort( sortOrder ); + + if ( hasDuplicate ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem === results[ i ] ) { + j = duplicates.push( i ); + } + } + while ( j-- ) { + results.splice( duplicates[ j ], 1 ); + } + } + + // Clear input after sorting to release objects + // See https://github.com/jquery/sizzle/pull/225 + sortInput = null; + + return results; +}; + +/** + * Utility function for retrieving the text value of an array of DOM nodes + * @param {Array|Element} elem + */ +getText = Sizzle.getText = function( elem ) { + var node, + ret = "", + i = 0, + nodeType = elem.nodeType; + + if ( !nodeType ) { + + // If no nodeType, this is expected to be an array + while ( ( node = elem[ i++ ] ) ) { + + // Do not traverse comment nodes + ret += getText( node ); + } + } else if ( nodeType === 1 || nodeType === 9 || nodeType === 11 ) { + + // Use textContent for elements + // innerText usage removed for consistency of new lines (jQuery #11153) + if ( typeof elem.textContent === "string" ) { + return elem.textContent; + } else { + + // Traverse its children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + ret += getText( elem ); + } + } + } else if ( nodeType === 3 || nodeType === 4 ) { + return elem.nodeValue; + } + + // Do not include comment or processing instruction nodes + + return ret; +}; + +Expr = Sizzle.selectors = { + + // Can be adjusted by the user + cacheLength: 50, + + createPseudo: markFunction, + + match: matchExpr, + + attrHandle: {}, + + find: {}, + + relative: { + ">": { dir: "parentNode", first: true }, + " ": { dir: "parentNode" }, + "+": { dir: "previousSibling", first: true }, + "~": { dir: "previousSibling" } + }, + + preFilter: { + "ATTR": function( match ) { + match[ 1 ] = match[ 1 ].replace( runescape, funescape ); + + // Move the given value to match[3] whether quoted or unquoted + match[ 3 ] = ( match[ 3 ] || match[ 4 ] || + match[ 5 ] || "" ).replace( runescape, funescape ); + + if ( match[ 2 ] === "~=" ) { + match[ 3 ] = " " + match[ 3 ] + " "; + } + + return match.slice( 0, 4 ); + }, + + "CHILD": function( match ) { + + /* matches from matchExpr["CHILD"] + 1 type (only|nth|...) + 2 what (child|of-type) + 3 argument (even|odd|\d*|\d*n([+-]\d+)?|...) + 4 xn-component of xn+y argument ([+-]?\d*n|) + 5 sign of xn-component + 6 x of xn-component + 7 sign of y-component + 8 y of y-component + */ + match[ 1 ] = match[ 1 ].toLowerCase(); + + if ( match[ 1 ].slice( 0, 3 ) === "nth" ) { + + // nth-* requires argument + if ( !match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + // numeric x and y parameters for Expr.filter.CHILD + // remember that false/true cast respectively to 0/1 + match[ 4 ] = +( match[ 4 ] ? + match[ 5 ] + ( match[ 6 ] || 1 ) : + 2 * ( match[ 3 ] === "even" || match[ 3 ] === "odd" ) ); + match[ 5 ] = +( ( match[ 7 ] + match[ 8 ] ) || match[ 3 ] === "odd" ); + + // other types prohibit arguments + } else if ( match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + return match; + }, + + "PSEUDO": function( match ) { + var excess, + unquoted = !match[ 6 ] && match[ 2 ]; + + if ( matchExpr[ "CHILD" ].test( match[ 0 ] ) ) { + return null; + } + + // Accept quoted arguments as-is + if ( match[ 3 ] ) { + match[ 2 ] = match[ 4 ] || match[ 5 ] || ""; + + // Strip excess characters from unquoted arguments + } else if ( unquoted && rpseudo.test( unquoted ) && + + // Get excess from tokenize (recursively) + ( excess = tokenize( unquoted, true ) ) && + + // advance to the next closing parenthesis + ( excess = unquoted.indexOf( ")", unquoted.length - excess ) - unquoted.length ) ) { + + // excess is a negative index + match[ 0 ] = match[ 0 ].slice( 0, excess ); + match[ 2 ] = unquoted.slice( 0, excess ); + } + + // Return only captures needed by the pseudo filter method (type and argument) + return match.slice( 0, 3 ); + } + }, + + filter: { + + "TAG": function( nodeNameSelector ) { + var nodeName = nodeNameSelector.replace( runescape, funescape ).toLowerCase(); + return nodeNameSelector === "*" ? + function() { + return true; + } : + function( elem ) { + return elem.nodeName && elem.nodeName.toLowerCase() === nodeName; + }; + }, + + "CLASS": function( className ) { + var pattern = classCache[ className + " " ]; + + return pattern || + ( pattern = new RegExp( "(^|" + whitespace + + ")" + className + "(" + whitespace + "|$)" ) ) && classCache( + className, function( elem ) { + return pattern.test( + typeof elem.className === "string" && elem.className || + typeof elem.getAttribute !== "undefined" && + elem.getAttribute( "class" ) || + "" + ); + } ); + }, + + "ATTR": function( name, operator, check ) { + return function( elem ) { + var result = Sizzle.attr( elem, name ); + + if ( result == null ) { + return operator === "!="; + } + if ( !operator ) { + return true; + } + + result += ""; + + /* eslint-disable max-len */ + + return operator === "=" ? result === check : + operator === "!=" ? result !== check : + operator === "^=" ? check && result.indexOf( check ) === 0 : + operator === "*=" ? check && result.indexOf( check ) > -1 : + operator === "$=" ? check && result.slice( -check.length ) === check : + operator === "~=" ? ( " " + result.replace( rwhitespace, " " ) + " " ).indexOf( check ) > -1 : + operator === "|=" ? result === check || result.slice( 0, check.length + 1 ) === check + "-" : + false; + /* eslint-enable max-len */ + + }; + }, + + "CHILD": function( type, what, _argument, first, last ) { + var simple = type.slice( 0, 3 ) !== "nth", + forward = type.slice( -4 ) !== "last", + ofType = what === "of-type"; + + return first === 1 && last === 0 ? + + // Shortcut for :nth-*(n) + function( elem ) { + return !!elem.parentNode; + } : + + function( elem, _context, xml ) { + var cache, uniqueCache, outerCache, node, nodeIndex, start, + dir = simple !== forward ? "nextSibling" : "previousSibling", + parent = elem.parentNode, + name = ofType && elem.nodeName.toLowerCase(), + useCache = !xml && !ofType, + diff = false; + + if ( parent ) { + + // :(first|last|only)-(child|of-type) + if ( simple ) { + while ( dir ) { + node = elem; + while ( ( node = node[ dir ] ) ) { + if ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) { + + return false; + } + } + + // Reverse direction for :only-* (if we haven't yet done so) + start = dir = type === "only" && !start && "nextSibling"; + } + return true; + } + + start = [ forward ? parent.firstChild : parent.lastChild ]; + + // non-xml :nth-child(...) stores cache data on `parent` + if ( forward && useCache ) { + + // Seek `elem` from a previously-cached index + + // ...in a gzip-friendly way + node = parent; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex && cache[ 2 ]; + node = nodeIndex && parent.childNodes[ nodeIndex ]; + + while ( ( node = ++nodeIndex && node && node[ dir ] || + + // Fallback to seeking `elem` from the start + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + // When found, cache indexes on `parent` and break + if ( node.nodeType === 1 && ++diff && node === elem ) { + uniqueCache[ type ] = [ dirruns, nodeIndex, diff ]; + break; + } + } + + } else { + + // Use previously-cached element index if available + if ( useCache ) { + + // ...in a gzip-friendly way + node = elem; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex; + } + + // xml :nth-child(...) + // or :nth-last-child(...) or :nth(-last)?-of-type(...) + if ( diff === false ) { + + // Use the same loop as above to seek `elem` from the start + while ( ( node = ++nodeIndex && node && node[ dir ] || + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + if ( ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) && + ++diff ) { + + // Cache the index of each encountered element + if ( useCache ) { + outerCache = node[ expando ] || + ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + uniqueCache[ type ] = [ dirruns, diff ]; + } + + if ( node === elem ) { + break; + } + } + } + } + } + + // Incorporate the offset, then check against cycle size + diff -= last; + return diff === first || ( diff % first === 0 && diff / first >= 0 ); + } + }; + }, + + "PSEUDO": function( pseudo, argument ) { + + // pseudo-class names are case-insensitive + // http://www.w3.org/TR/selectors/#pseudo-classes + // Prioritize by case sensitivity in case custom pseudos are added with uppercase letters + // Remember that setFilters inherits from pseudos + var args, + fn = Expr.pseudos[ pseudo ] || Expr.setFilters[ pseudo.toLowerCase() ] || + Sizzle.error( "unsupported pseudo: " + pseudo ); + + // The user may use createPseudo to indicate that + // arguments are needed to create the filter function + // just as Sizzle does + if ( fn[ expando ] ) { + return fn( argument ); + } + + // But maintain support for old signatures + if ( fn.length > 1 ) { + args = [ pseudo, pseudo, "", argument ]; + return Expr.setFilters.hasOwnProperty( pseudo.toLowerCase() ) ? + markFunction( function( seed, matches ) { + var idx, + matched = fn( seed, argument ), + i = matched.length; + while ( i-- ) { + idx = indexOf( seed, matched[ i ] ); + seed[ idx ] = !( matches[ idx ] = matched[ i ] ); + } + } ) : + function( elem ) { + return fn( elem, 0, args ); + }; + } + + return fn; + } + }, + + pseudos: { + + // Potentially complex pseudos + "not": markFunction( function( selector ) { + + // Trim the selector passed to compile + // to avoid treating leading and trailing + // spaces as combinators + var input = [], + results = [], + matcher = compile( selector.replace( rtrim, "$1" ) ); + + return matcher[ expando ] ? + markFunction( function( seed, matches, _context, xml ) { + var elem, + unmatched = matcher( seed, null, xml, [] ), + i = seed.length; + + // Match elements unmatched by `matcher` + while ( i-- ) { + if ( ( elem = unmatched[ i ] ) ) { + seed[ i ] = !( matches[ i ] = elem ); + } + } + } ) : + function( elem, _context, xml ) { + input[ 0 ] = elem; + matcher( input, null, xml, results ); + + // Don't keep the element (issue #299) + input[ 0 ] = null; + return !results.pop(); + }; + } ), + + "has": markFunction( function( selector ) { + return function( elem ) { + return Sizzle( selector, elem ).length > 0; + }; + } ), + + "contains": markFunction( function( text ) { + text = text.replace( runescape, funescape ); + return function( elem ) { + return ( elem.textContent || getText( elem ) ).indexOf( text ) > -1; + }; + } ), + + // "Whether an element is represented by a :lang() selector + // is based solely on the element's language value + // being equal to the identifier C, + // or beginning with the identifier C immediately followed by "-". + // The matching of C against the element's language value is performed case-insensitively. + // The identifier C does not have to be a valid language name." + // http://www.w3.org/TR/selectors/#lang-pseudo + "lang": markFunction( function( lang ) { + + // lang value must be a valid identifier + if ( !ridentifier.test( lang || "" ) ) { + Sizzle.error( "unsupported lang: " + lang ); + } + lang = lang.replace( runescape, funescape ).toLowerCase(); + return function( elem ) { + var elemLang; + do { + if ( ( elemLang = documentIsHTML ? + elem.lang : + elem.getAttribute( "xml:lang" ) || elem.getAttribute( "lang" ) ) ) { + + elemLang = elemLang.toLowerCase(); + return elemLang === lang || elemLang.indexOf( lang + "-" ) === 0; + } + } while ( ( elem = elem.parentNode ) && elem.nodeType === 1 ); + return false; + }; + } ), + + // Miscellaneous + "target": function( elem ) { + var hash = window.location && window.location.hash; + return hash && hash.slice( 1 ) === elem.id; + }, + + "root": function( elem ) { + return elem === docElem; + }, + + "focus": function( elem ) { + return elem === document.activeElement && + ( !document.hasFocus || document.hasFocus() ) && + !!( elem.type || elem.href || ~elem.tabIndex ); + }, + + // Boolean properties + "enabled": createDisabledPseudo( false ), + "disabled": createDisabledPseudo( true ), + + "checked": function( elem ) { + + // In CSS3, :checked should return both checked and selected elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + var nodeName = elem.nodeName.toLowerCase(); + return ( nodeName === "input" && !!elem.checked ) || + ( nodeName === "option" && !!elem.selected ); + }, + + "selected": function( elem ) { + + // Accessing this property makes selected-by-default + // options in Safari work properly + if ( elem.parentNode ) { + // eslint-disable-next-line no-unused-expressions + elem.parentNode.selectedIndex; + } + + return elem.selected === true; + }, + + // Contents + "empty": function( elem ) { + + // http://www.w3.org/TR/selectors/#empty-pseudo + // :empty is negated by element (1) or content nodes (text: 3; cdata: 4; entity ref: 5), + // but not by others (comment: 8; processing instruction: 7; etc.) + // nodeType < 6 works because attributes (2) do not appear as children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + if ( elem.nodeType < 6 ) { + return false; + } + } + return true; + }, + + "parent": function( elem ) { + return !Expr.pseudos[ "empty" ]( elem ); + }, + + // Element/input types + "header": function( elem ) { + return rheader.test( elem.nodeName ); + }, + + "input": function( elem ) { + return rinputs.test( elem.nodeName ); + }, + + "button": function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === "button" || name === "button"; + }, + + "text": function( elem ) { + var attr; + return elem.nodeName.toLowerCase() === "input" && + elem.type === "text" && + + // Support: IE<8 + // New HTML5 attribute values (e.g., "search") appear with elem.type === "text" + ( ( attr = elem.getAttribute( "type" ) ) == null || + attr.toLowerCase() === "text" ); + }, + + // Position-in-collection + "first": createPositionalPseudo( function() { + return [ 0 ]; + } ), + + "last": createPositionalPseudo( function( _matchIndexes, length ) { + return [ length - 1 ]; + } ), + + "eq": createPositionalPseudo( function( _matchIndexes, length, argument ) { + return [ argument < 0 ? argument + length : argument ]; + } ), + + "even": createPositionalPseudo( function( matchIndexes, length ) { + var i = 0; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "odd": createPositionalPseudo( function( matchIndexes, length ) { + var i = 1; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "lt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? + argument + length : + argument > length ? + length : + argument; + for ( ; --i >= 0; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "gt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? argument + length : argument; + for ( ; ++i < length; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ) + } +}; + +Expr.pseudos[ "nth" ] = Expr.pseudos[ "eq" ]; + +// Add button/input type pseudos +for ( i in { radio: true, checkbox: true, file: true, password: true, image: true } ) { + Expr.pseudos[ i ] = createInputPseudo( i ); +} +for ( i in { submit: true, reset: true } ) { + Expr.pseudos[ i ] = createButtonPseudo( i ); +} + +// Easy API for creating new setFilters +function setFilters() {} +setFilters.prototype = Expr.filters = Expr.pseudos; +Expr.setFilters = new setFilters(); + +tokenize = Sizzle.tokenize = function( selector, parseOnly ) { + var matched, match, tokens, type, + soFar, groups, preFilters, + cached = tokenCache[ selector + " " ]; + + if ( cached ) { + return parseOnly ? 0 : cached.slice( 0 ); + } + + soFar = selector; + groups = []; + preFilters = Expr.preFilter; + + while ( soFar ) { + + // Comma and first run + if ( !matched || ( match = rcomma.exec( soFar ) ) ) { + if ( match ) { + + // Don't consume trailing commas as valid + soFar = soFar.slice( match[ 0 ].length ) || soFar; + } + groups.push( ( tokens = [] ) ); + } + + matched = false; + + // Combinators + if ( ( match = rcombinators.exec( soFar ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + + // Cast descendant combinators to space + type: match[ 0 ].replace( rtrim, " " ) + } ); + soFar = soFar.slice( matched.length ); + } + + // Filters + for ( type in Expr.filter ) { + if ( ( match = matchExpr[ type ].exec( soFar ) ) && ( !preFilters[ type ] || + ( match = preFilters[ type ]( match ) ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + type: type, + matches: match + } ); + soFar = soFar.slice( matched.length ); + } + } + + if ( !matched ) { + break; + } + } + + // Return the length of the invalid excess + // if we're just parsing + // Otherwise, throw an error or return tokens + return parseOnly ? + soFar.length : + soFar ? + Sizzle.error( selector ) : + + // Cache the tokens + tokenCache( selector, groups ).slice( 0 ); +}; + +function toSelector( tokens ) { + var i = 0, + len = tokens.length, + selector = ""; + for ( ; i < len; i++ ) { + selector += tokens[ i ].value; + } + return selector; +} + +function addCombinator( matcher, combinator, base ) { + var dir = combinator.dir, + skip = combinator.next, + key = skip || dir, + checkNonElements = base && key === "parentNode", + doneName = done++; + + return combinator.first ? + + // Check against closest ancestor/preceding element + function( elem, context, xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + return matcher( elem, context, xml ); + } + } + return false; + } : + + // Check against all ancestor/preceding elements + function( elem, context, xml ) { + var oldCache, uniqueCache, outerCache, + newCache = [ dirruns, doneName ]; + + // We can't set arbitrary data on XML nodes, so they don't benefit from combinator caching + if ( xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + if ( matcher( elem, context, xml ) ) { + return true; + } + } + } + } else { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + outerCache = elem[ expando ] || ( elem[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ elem.uniqueID ] || + ( outerCache[ elem.uniqueID ] = {} ); + + if ( skip && skip === elem.nodeName.toLowerCase() ) { + elem = elem[ dir ] || elem; + } else if ( ( oldCache = uniqueCache[ key ] ) && + oldCache[ 0 ] === dirruns && oldCache[ 1 ] === doneName ) { + + // Assign to newCache so results back-propagate to previous elements + return ( newCache[ 2 ] = oldCache[ 2 ] ); + } else { + + // Reuse newcache so results back-propagate to previous elements + uniqueCache[ key ] = newCache; + + // A match means we're done; a fail means we have to keep checking + if ( ( newCache[ 2 ] = matcher( elem, context, xml ) ) ) { + return true; + } + } + } + } + } + return false; + }; +} + +function elementMatcher( matchers ) { + return matchers.length > 1 ? + function( elem, context, xml ) { + var i = matchers.length; + while ( i-- ) { + if ( !matchers[ i ]( elem, context, xml ) ) { + return false; + } + } + return true; + } : + matchers[ 0 ]; +} + +function multipleContexts( selector, contexts, results ) { + var i = 0, + len = contexts.length; + for ( ; i < len; i++ ) { + Sizzle( selector, contexts[ i ], results ); + } + return results; +} + +function condense( unmatched, map, filter, context, xml ) { + var elem, + newUnmatched = [], + i = 0, + len = unmatched.length, + mapped = map != null; + + for ( ; i < len; i++ ) { + if ( ( elem = unmatched[ i ] ) ) { + if ( !filter || filter( elem, context, xml ) ) { + newUnmatched.push( elem ); + if ( mapped ) { + map.push( i ); + } + } + } + } + + return newUnmatched; +} + +function setMatcher( preFilter, selector, matcher, postFilter, postFinder, postSelector ) { + if ( postFilter && !postFilter[ expando ] ) { + postFilter = setMatcher( postFilter ); + } + if ( postFinder && !postFinder[ expando ] ) { + postFinder = setMatcher( postFinder, postSelector ); + } + return markFunction( function( seed, results, context, xml ) { + var temp, i, elem, + preMap = [], + postMap = [], + preexisting = results.length, + + // Get initial elements from seed or context + elems = seed || multipleContexts( + selector || "*", + context.nodeType ? [ context ] : context, + [] + ), + + // Prefilter to get matcher input, preserving a map for seed-results synchronization + matcherIn = preFilter && ( seed || !selector ) ? + condense( elems, preMap, preFilter, context, xml ) : + elems, + + matcherOut = matcher ? + + // If we have a postFinder, or filtered seed, or non-seed postFilter or preexisting results, + postFinder || ( seed ? preFilter : preexisting || postFilter ) ? + + // ...intermediate processing is necessary + [] : + + // ...otherwise use results directly + results : + matcherIn; + + // Find primary matches + if ( matcher ) { + matcher( matcherIn, matcherOut, context, xml ); + } + + // Apply postFilter + if ( postFilter ) { + temp = condense( matcherOut, postMap ); + postFilter( temp, [], context, xml ); + + // Un-match failing elements by moving them back to matcherIn + i = temp.length; + while ( i-- ) { + if ( ( elem = temp[ i ] ) ) { + matcherOut[ postMap[ i ] ] = !( matcherIn[ postMap[ i ] ] = elem ); + } + } + } + + if ( seed ) { + if ( postFinder || preFilter ) { + if ( postFinder ) { + + // Get the final matcherOut by condensing this intermediate into postFinder contexts + temp = []; + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) ) { + + // Restore matcherIn since elem is not yet a final match + temp.push( ( matcherIn[ i ] = elem ) ); + } + } + postFinder( null, ( matcherOut = [] ), temp, xml ); + } + + // Move matched elements from seed to results to keep them synchronized + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) && + ( temp = postFinder ? indexOf( seed, elem ) : preMap[ i ] ) > -1 ) { + + seed[ temp ] = !( results[ temp ] = elem ); + } + } + } + + // Add elements to results, through postFinder if defined + } else { + matcherOut = condense( + matcherOut === results ? + matcherOut.splice( preexisting, matcherOut.length ) : + matcherOut + ); + if ( postFinder ) { + postFinder( null, results, matcherOut, xml ); + } else { + push.apply( results, matcherOut ); + } + } + } ); +} + +function matcherFromTokens( tokens ) { + var checkContext, matcher, j, + len = tokens.length, + leadingRelative = Expr.relative[ tokens[ 0 ].type ], + implicitRelative = leadingRelative || Expr.relative[ " " ], + i = leadingRelative ? 1 : 0, + + // The foundational matcher ensures that elements are reachable from top-level context(s) + matchContext = addCombinator( function( elem ) { + return elem === checkContext; + }, implicitRelative, true ), + matchAnyContext = addCombinator( function( elem ) { + return indexOf( checkContext, elem ) > -1; + }, implicitRelative, true ), + matchers = [ function( elem, context, xml ) { + var ret = ( !leadingRelative && ( xml || context !== outermostContext ) ) || ( + ( checkContext = context ).nodeType ? + matchContext( elem, context, xml ) : + matchAnyContext( elem, context, xml ) ); + + // Avoid hanging onto element (issue #299) + checkContext = null; + return ret; + } ]; + + for ( ; i < len; i++ ) { + if ( ( matcher = Expr.relative[ tokens[ i ].type ] ) ) { + matchers = [ addCombinator( elementMatcher( matchers ), matcher ) ]; + } else { + matcher = Expr.filter[ tokens[ i ].type ].apply( null, tokens[ i ].matches ); + + // Return special upon seeing a positional matcher + if ( matcher[ expando ] ) { + + // Find the next relative operator (if any) for proper handling + j = ++i; + for ( ; j < len; j++ ) { + if ( Expr.relative[ tokens[ j ].type ] ) { + break; + } + } + return setMatcher( + i > 1 && elementMatcher( matchers ), + i > 1 && toSelector( + + // If the preceding token was a descendant combinator, insert an implicit any-element `*` + tokens + .slice( 0, i - 1 ) + .concat( { value: tokens[ i - 2 ].type === " " ? "*" : "" } ) + ).replace( rtrim, "$1" ), + matcher, + i < j && matcherFromTokens( tokens.slice( i, j ) ), + j < len && matcherFromTokens( ( tokens = tokens.slice( j ) ) ), + j < len && toSelector( tokens ) + ); + } + matchers.push( matcher ); + } + } + + return elementMatcher( matchers ); +} + +function matcherFromGroupMatchers( elementMatchers, setMatchers ) { + var bySet = setMatchers.length > 0, + byElement = elementMatchers.length > 0, + superMatcher = function( seed, context, xml, results, outermost ) { + var elem, j, matcher, + matchedCount = 0, + i = "0", + unmatched = seed && [], + setMatched = [], + contextBackup = outermostContext, + + // We must always have either seed elements or outermost context + elems = seed || byElement && Expr.find[ "TAG" ]( "*", outermost ), + + // Use integer dirruns iff this is the outermost matcher + dirrunsUnique = ( dirruns += contextBackup == null ? 1 : Math.random() || 0.1 ), + len = elems.length; + + if ( outermost ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + outermostContext = context == document || context || outermost; + } + + // Add elements passing elementMatchers directly to results + // Support: IE<9, Safari + // Tolerate NodeList properties (IE: "length"; Safari: ) matching elements by id + for ( ; i !== len && ( elem = elems[ i ] ) != null; i++ ) { + if ( byElement && elem ) { + j = 0; + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( !context && elem.ownerDocument != document ) { + setDocument( elem ); + xml = !documentIsHTML; + } + while ( ( matcher = elementMatchers[ j++ ] ) ) { + if ( matcher( elem, context || document, xml ) ) { + results.push( elem ); + break; + } + } + if ( outermost ) { + dirruns = dirrunsUnique; + } + } + + // Track unmatched elements for set filters + if ( bySet ) { + + // They will have gone through all possible matchers + if ( ( elem = !matcher && elem ) ) { + matchedCount--; + } + + // Lengthen the array for every element, matched or not + if ( seed ) { + unmatched.push( elem ); + } + } + } + + // `i` is now the count of elements visited above, and adding it to `matchedCount` + // makes the latter nonnegative. + matchedCount += i; + + // Apply set filters to unmatched elements + // NOTE: This can be skipped if there are no unmatched elements (i.e., `matchedCount` + // equals `i`), unless we didn't visit _any_ elements in the above loop because we have + // no element matchers and no seed. + // Incrementing an initially-string "0" `i` allows `i` to remain a string only in that + // case, which will result in a "00" `matchedCount` that differs from `i` but is also + // numerically zero. + if ( bySet && i !== matchedCount ) { + j = 0; + while ( ( matcher = setMatchers[ j++ ] ) ) { + matcher( unmatched, setMatched, context, xml ); + } + + if ( seed ) { + + // Reintegrate element matches to eliminate the need for sorting + if ( matchedCount > 0 ) { + while ( i-- ) { + if ( !( unmatched[ i ] || setMatched[ i ] ) ) { + setMatched[ i ] = pop.call( results ); + } + } + } + + // Discard index placeholder values to get only actual matches + setMatched = condense( setMatched ); + } + + // Add matches to results + push.apply( results, setMatched ); + + // Seedless set matches succeeding multiple successful matchers stipulate sorting + if ( outermost && !seed && setMatched.length > 0 && + ( matchedCount + setMatchers.length ) > 1 ) { + + Sizzle.uniqueSort( results ); + } + } + + // Override manipulation of globals by nested matchers + if ( outermost ) { + dirruns = dirrunsUnique; + outermostContext = contextBackup; + } + + return unmatched; + }; + + return bySet ? + markFunction( superMatcher ) : + superMatcher; +} + +compile = Sizzle.compile = function( selector, match /* Internal Use Only */ ) { + var i, + setMatchers = [], + elementMatchers = [], + cached = compilerCache[ selector + " " ]; + + if ( !cached ) { + + // Generate a function of recursive functions that can be used to check each element + if ( !match ) { + match = tokenize( selector ); + } + i = match.length; + while ( i-- ) { + cached = matcherFromTokens( match[ i ] ); + if ( cached[ expando ] ) { + setMatchers.push( cached ); + } else { + elementMatchers.push( cached ); + } + } + + // Cache the compiled function + cached = compilerCache( + selector, + matcherFromGroupMatchers( elementMatchers, setMatchers ) + ); + + // Save selector and tokenization + cached.selector = selector; + } + return cached; +}; + +/** + * A low-level selection function that works with Sizzle's compiled + * selector functions + * @param {String|Function} selector A selector or a pre-compiled + * selector function built with Sizzle.compile + * @param {Element} context + * @param {Array} [results] + * @param {Array} [seed] A set of elements to match against + */ +select = Sizzle.select = function( selector, context, results, seed ) { + var i, tokens, token, type, find, + compiled = typeof selector === "function" && selector, + match = !seed && tokenize( ( selector = compiled.selector || selector ) ); + + results = results || []; + + // Try to minimize operations if there is only one selector in the list and no seed + // (the latter of which guarantees us context) + if ( match.length === 1 ) { + + // Reduce context if the leading compound selector is an ID + tokens = match[ 0 ] = match[ 0 ].slice( 0 ); + if ( tokens.length > 2 && ( token = tokens[ 0 ] ).type === "ID" && + context.nodeType === 9 && documentIsHTML && Expr.relative[ tokens[ 1 ].type ] ) { + + context = ( Expr.find[ "ID" ]( token.matches[ 0 ] + .replace( runescape, funescape ), context ) || [] )[ 0 ]; + if ( !context ) { + return results; + + // Precompiled matchers will still verify ancestry, so step up a level + } else if ( compiled ) { + context = context.parentNode; + } + + selector = selector.slice( tokens.shift().value.length ); + } + + // Fetch a seed set for right-to-left matching + i = matchExpr[ "needsContext" ].test( selector ) ? 0 : tokens.length; + while ( i-- ) { + token = tokens[ i ]; + + // Abort if we hit a combinator + if ( Expr.relative[ ( type = token.type ) ] ) { + break; + } + if ( ( find = Expr.find[ type ] ) ) { + + // Search, expanding context for leading sibling combinators + if ( ( seed = find( + token.matches[ 0 ].replace( runescape, funescape ), + rsibling.test( tokens[ 0 ].type ) && testContext( context.parentNode ) || + context + ) ) ) { + + // If seed is empty or no tokens remain, we can return early + tokens.splice( i, 1 ); + selector = seed.length && toSelector( tokens ); + if ( !selector ) { + push.apply( results, seed ); + return results; + } + + break; + } + } + } + } + + // Compile and execute a filtering function if one is not provided + // Provide `match` to avoid retokenization if we modified the selector above + ( compiled || compile( selector, match ) )( + seed, + context, + !documentIsHTML, + results, + !context || rsibling.test( selector ) && testContext( context.parentNode ) || context + ); + return results; +}; + +// One-time assignments + +// Sort stability +support.sortStable = expando.split( "" ).sort( sortOrder ).join( "" ) === expando; + +// Support: Chrome 14-35+ +// Always assume duplicates if they aren't passed to the comparison function +support.detectDuplicates = !!hasDuplicate; + +// Initialize against the default document +setDocument(); + +// Support: Webkit<537.32 - Safari 6.0.3/Chrome 25 (fixed in Chrome 27) +// Detached nodes confoundingly follow *each other* +support.sortDetached = assert( function( el ) { + + // Should return 1, but returns 4 (following) + return el.compareDocumentPosition( document.createElement( "fieldset" ) ) & 1; +} ); + +// Support: IE<8 +// Prevent attribute/property "interpolation" +// https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx +if ( !assert( function( el ) { + el.innerHTML = ""; + return el.firstChild.getAttribute( "href" ) === "#"; +} ) ) { + addHandle( "type|href|height|width", function( elem, name, isXML ) { + if ( !isXML ) { + return elem.getAttribute( name, name.toLowerCase() === "type" ? 1 : 2 ); + } + } ); +} + +// Support: IE<9 +// Use defaultValue in place of getAttribute("value") +if ( !support.attributes || !assert( function( el ) { + el.innerHTML = ""; + el.firstChild.setAttribute( "value", "" ); + return el.firstChild.getAttribute( "value" ) === ""; +} ) ) { + addHandle( "value", function( elem, _name, isXML ) { + if ( !isXML && elem.nodeName.toLowerCase() === "input" ) { + return elem.defaultValue; + } + } ); +} + +// Support: IE<9 +// Use getAttributeNode to fetch booleans when getAttribute lies +if ( !assert( function( el ) { + return el.getAttribute( "disabled" ) == null; +} ) ) { + addHandle( booleans, function( elem, name, isXML ) { + var val; + if ( !isXML ) { + return elem[ name ] === true ? name.toLowerCase() : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; + } + } ); +} + +return Sizzle; + +} )( window ); + + + +jQuery.find = Sizzle; +jQuery.expr = Sizzle.selectors; + +// Deprecated +jQuery.expr[ ":" ] = jQuery.expr.pseudos; +jQuery.uniqueSort = jQuery.unique = Sizzle.uniqueSort; +jQuery.text = Sizzle.getText; +jQuery.isXMLDoc = Sizzle.isXML; +jQuery.contains = Sizzle.contains; +jQuery.escapeSelector = Sizzle.escape; + + + + +var dir = function( elem, dir, until ) { + var matched = [], + truncate = until !== undefined; + + while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { + if ( elem.nodeType === 1 ) { + if ( truncate && jQuery( elem ).is( until ) ) { + break; + } + matched.push( elem ); + } + } + return matched; +}; + + +var siblings = function( n, elem ) { + var matched = []; + + for ( ; n; n = n.nextSibling ) { + if ( n.nodeType === 1 && n !== elem ) { + matched.push( n ); + } + } + + return matched; +}; + + +var rneedsContext = jQuery.expr.match.needsContext; + + + +function nodeName( elem, name ) { + + return elem.nodeName && elem.nodeName.toLowerCase() === name.toLowerCase(); + +} +var rsingleTag = ( /^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i ); + + + +// Implement the identical functionality for filter and not +function winnow( elements, qualifier, not ) { + if ( isFunction( qualifier ) ) { + return jQuery.grep( elements, function( elem, i ) { + return !!qualifier.call( elem, i, elem ) !== not; + } ); + } + + // Single element + if ( qualifier.nodeType ) { + return jQuery.grep( elements, function( elem ) { + return ( elem === qualifier ) !== not; + } ); + } + + // Arraylike of elements (jQuery, arguments, Array) + if ( typeof qualifier !== "string" ) { + return jQuery.grep( elements, function( elem ) { + return ( indexOf.call( qualifier, elem ) > -1 ) !== not; + } ); + } + + // Filtered directly for both simple and complex selectors + return jQuery.filter( qualifier, elements, not ); +} + +jQuery.filter = function( expr, elems, not ) { + var elem = elems[ 0 ]; + + if ( not ) { + expr = ":not(" + expr + ")"; + } + + if ( elems.length === 1 && elem.nodeType === 1 ) { + return jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : []; + } + + return jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { + return elem.nodeType === 1; + } ) ); +}; + +jQuery.fn.extend( { + find: function( selector ) { + var i, ret, + len = this.length, + self = this; + + if ( typeof selector !== "string" ) { + return this.pushStack( jQuery( selector ).filter( function() { + for ( i = 0; i < len; i++ ) { + if ( jQuery.contains( self[ i ], this ) ) { + return true; + } + } + } ) ); + } + + ret = this.pushStack( [] ); + + for ( i = 0; i < len; i++ ) { + jQuery.find( selector, self[ i ], ret ); + } + + return len > 1 ? jQuery.uniqueSort( ret ) : ret; + }, + filter: function( selector ) { + return this.pushStack( winnow( this, selector || [], false ) ); + }, + not: function( selector ) { + return this.pushStack( winnow( this, selector || [], true ) ); + }, + is: function( selector ) { + return !!winnow( + this, + + // If this is a positional/relative selector, check membership in the returned set + // so $("p:first").is("p:last") won't return true for a doc with two "p". + typeof selector === "string" && rneedsContext.test( selector ) ? + jQuery( selector ) : + selector || [], + false + ).length; + } +} ); + + +// Initialize a jQuery object + + +// A central reference to the root jQuery(document) +var rootjQuery, + + // A simple way to check for HTML strings + // Prioritize #id over to avoid XSS via location.hash (#9521) + // Strict HTML recognition (#11290: must start with <) + // Shortcut simple #id case for speed + rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/, + + init = jQuery.fn.init = function( selector, context, root ) { + var match, elem; + + // HANDLE: $(""), $(null), $(undefined), $(false) + if ( !selector ) { + return this; + } + + // Method init() accepts an alternate rootjQuery + // so migrate can support jQuery.sub (gh-2101) + root = root || rootjQuery; + + // Handle HTML strings + if ( typeof selector === "string" ) { + if ( selector[ 0 ] === "<" && + selector[ selector.length - 1 ] === ">" && + selector.length >= 3 ) { + + // Assume that strings that start and end with <> are HTML and skip the regex check + match = [ null, selector, null ]; + + } else { + match = rquickExpr.exec( selector ); + } + + // Match html or make sure no context is specified for #id + if ( match && ( match[ 1 ] || !context ) ) { + + // HANDLE: $(html) -> $(array) + if ( match[ 1 ] ) { + context = context instanceof jQuery ? context[ 0 ] : context; + + // Option to run scripts is true for back-compat + // Intentionally let the error be thrown if parseHTML is not present + jQuery.merge( this, jQuery.parseHTML( + match[ 1 ], + context && context.nodeType ? context.ownerDocument || context : document, + true + ) ); + + // HANDLE: $(html, props) + if ( rsingleTag.test( match[ 1 ] ) && jQuery.isPlainObject( context ) ) { + for ( match in context ) { + + // Properties of context are called as methods if possible + if ( isFunction( this[ match ] ) ) { + this[ match ]( context[ match ] ); + + // ...and otherwise set as attributes + } else { + this.attr( match, context[ match ] ); + } + } + } + + return this; + + // HANDLE: $(#id) + } else { + elem = document.getElementById( match[ 2 ] ); + + if ( elem ) { + + // Inject the element directly into the jQuery object + this[ 0 ] = elem; + this.length = 1; + } + return this; + } + + // HANDLE: $(expr, $(...)) + } else if ( !context || context.jquery ) { + return ( context || root ).find( selector ); + + // HANDLE: $(expr, context) + // (which is just equivalent to: $(context).find(expr) + } else { + return this.constructor( context ).find( selector ); + } + + // HANDLE: $(DOMElement) + } else if ( selector.nodeType ) { + this[ 0 ] = selector; + this.length = 1; + return this; + + // HANDLE: $(function) + // Shortcut for document ready + } else if ( isFunction( selector ) ) { + return root.ready !== undefined ? + root.ready( selector ) : + + // Execute immediately if ready is not present + selector( jQuery ); + } + + return jQuery.makeArray( selector, this ); + }; + +// Give the init function the jQuery prototype for later instantiation +init.prototype = jQuery.fn; + +// Initialize central reference +rootjQuery = jQuery( document ); + + +var rparentsprev = /^(?:parents|prev(?:Until|All))/, + + // Methods guaranteed to produce a unique set when starting from a unique set + guaranteedUnique = { + children: true, + contents: true, + next: true, + prev: true + }; + +jQuery.fn.extend( { + has: function( target ) { + var targets = jQuery( target, this ), + l = targets.length; + + return this.filter( function() { + var i = 0; + for ( ; i < l; i++ ) { + if ( jQuery.contains( this, targets[ i ] ) ) { + return true; + } + } + } ); + }, + + closest: function( selectors, context ) { + var cur, + i = 0, + l = this.length, + matched = [], + targets = typeof selectors !== "string" && jQuery( selectors ); + + // Positional selectors never match, since there's no _selection_ context + if ( !rneedsContext.test( selectors ) ) { + for ( ; i < l; i++ ) { + for ( cur = this[ i ]; cur && cur !== context; cur = cur.parentNode ) { + + // Always skip document fragments + if ( cur.nodeType < 11 && ( targets ? + targets.index( cur ) > -1 : + + // Don't pass non-elements to Sizzle + cur.nodeType === 1 && + jQuery.find.matchesSelector( cur, selectors ) ) ) { + + matched.push( cur ); + break; + } + } + } + } + + return this.pushStack( matched.length > 1 ? jQuery.uniqueSort( matched ) : matched ); + }, + + // Determine the position of an element within the set + index: function( elem ) { + + // No argument, return index in parent + if ( !elem ) { + return ( this[ 0 ] && this[ 0 ].parentNode ) ? this.first().prevAll().length : -1; + } + + // Index in selector + if ( typeof elem === "string" ) { + return indexOf.call( jQuery( elem ), this[ 0 ] ); + } + + // Locate the position of the desired element + return indexOf.call( this, + + // If it receives a jQuery object, the first element is used + elem.jquery ? elem[ 0 ] : elem + ); + }, + + add: function( selector, context ) { + return this.pushStack( + jQuery.uniqueSort( + jQuery.merge( this.get(), jQuery( selector, context ) ) + ) + ); + }, + + addBack: function( selector ) { + return this.add( selector == null ? + this.prevObject : this.prevObject.filter( selector ) + ); + } +} ); + +function sibling( cur, dir ) { + while ( ( cur = cur[ dir ] ) && cur.nodeType !== 1 ) {} + return cur; +} + +jQuery.each( { + parent: function( elem ) { + var parent = elem.parentNode; + return parent && parent.nodeType !== 11 ? parent : null; + }, + parents: function( elem ) { + return dir( elem, "parentNode" ); + }, + parentsUntil: function( elem, _i, until ) { + return dir( elem, "parentNode", until ); + }, + next: function( elem ) { + return sibling( elem, "nextSibling" ); + }, + prev: function( elem ) { + return sibling( elem, "previousSibling" ); + }, + nextAll: function( elem ) { + return dir( elem, "nextSibling" ); + }, + prevAll: function( elem ) { + return dir( elem, "previousSibling" ); + }, + nextUntil: function( elem, _i, until ) { + return dir( elem, "nextSibling", until ); + }, + prevUntil: function( elem, _i, until ) { + return dir( elem, "previousSibling", until ); + }, + siblings: function( elem ) { + return siblings( ( elem.parentNode || {} ).firstChild, elem ); + }, + children: function( elem ) { + return siblings( elem.firstChild ); + }, + contents: function( elem ) { + if ( elem.contentDocument != null && + + // Support: IE 11+ + // elements with no `data` attribute has an object + // `contentDocument` with a `null` prototype. + getProto( elem.contentDocument ) ) { + + return elem.contentDocument; + } + + // Support: IE 9 - 11 only, iOS 7 only, Android Browser <=4.3 only + // Treat the template element as a regular one in browsers that + // don't support it. + if ( nodeName( elem, "template" ) ) { + elem = elem.content || elem; + } + + return jQuery.merge( [], elem.childNodes ); + } +}, function( name, fn ) { + jQuery.fn[ name ] = function( until, selector ) { + var matched = jQuery.map( this, fn, until ); + + if ( name.slice( -5 ) !== "Until" ) { + selector = until; + } + + if ( selector && typeof selector === "string" ) { + matched = jQuery.filter( selector, matched ); + } + + if ( this.length > 1 ) { + + // Remove duplicates + if ( !guaranteedUnique[ name ] ) { + jQuery.uniqueSort( matched ); + } + + // Reverse order for parents* and prev-derivatives + if ( rparentsprev.test( name ) ) { + matched.reverse(); + } + } + + return this.pushStack( matched ); + }; +} ); +var rnothtmlwhite = ( /[^\x20\t\r\n\f]+/g ); + + + +// Convert String-formatted options into Object-formatted ones +function createOptions( options ) { + var object = {}; + jQuery.each( options.match( rnothtmlwhite ) || [], function( _, flag ) { + object[ flag ] = true; + } ); + return object; +} + +/* + * Create a callback list using the following parameters: + * + * options: an optional list of space-separated options that will change how + * the callback list behaves or a more traditional option object + * + * By default a callback list will act like an event callback list and can be + * "fired" multiple times. + * + * Possible options: + * + * once: will ensure the callback list can only be fired once (like a Deferred) + * + * memory: will keep track of previous values and will call any callback added + * after the list has been fired right away with the latest "memorized" + * values (like a Deferred) + * + * unique: will ensure a callback can only be added once (no duplicate in the list) + * + * stopOnFalse: interrupt callings when a callback returns false + * + */ +jQuery.Callbacks = function( options ) { + + // Convert options from String-formatted to Object-formatted if needed + // (we check in cache first) + options = typeof options === "string" ? + createOptions( options ) : + jQuery.extend( {}, options ); + + var // Flag to know if list is currently firing + firing, + + // Last fire value for non-forgettable lists + memory, + + // Flag to know if list was already fired + fired, + + // Flag to prevent firing + locked, + + // Actual callback list + list = [], + + // Queue of execution data for repeatable lists + queue = [], + + // Index of currently firing callback (modified by add/remove as needed) + firingIndex = -1, + + // Fire callbacks + fire = function() { + + // Enforce single-firing + locked = locked || options.once; + + // Execute callbacks for all pending executions, + // respecting firingIndex overrides and runtime changes + fired = firing = true; + for ( ; queue.length; firingIndex = -1 ) { + memory = queue.shift(); + while ( ++firingIndex < list.length ) { + + // Run callback and check for early termination + if ( list[ firingIndex ].apply( memory[ 0 ], memory[ 1 ] ) === false && + options.stopOnFalse ) { + + // Jump to end and forget the data so .add doesn't re-fire + firingIndex = list.length; + memory = false; + } + } + } + + // Forget the data if we're done with it + if ( !options.memory ) { + memory = false; + } + + firing = false; + + // Clean up if we're done firing for good + if ( locked ) { + + // Keep an empty list if we have data for future add calls + if ( memory ) { + list = []; + + // Otherwise, this object is spent + } else { + list = ""; + } + } + }, + + // Actual Callbacks object + self = { + + // Add a callback or a collection of callbacks to the list + add: function() { + if ( list ) { + + // If we have memory from a past run, we should fire after adding + if ( memory && !firing ) { + firingIndex = list.length - 1; + queue.push( memory ); + } + + ( function add( args ) { + jQuery.each( args, function( _, arg ) { + if ( isFunction( arg ) ) { + if ( !options.unique || !self.has( arg ) ) { + list.push( arg ); + } + } else if ( arg && arg.length && toType( arg ) !== "string" ) { + + // Inspect recursively + add( arg ); + } + } ); + } )( arguments ); + + if ( memory && !firing ) { + fire(); + } + } + return this; + }, + + // Remove a callback from the list + remove: function() { + jQuery.each( arguments, function( _, arg ) { + var index; + while ( ( index = jQuery.inArray( arg, list, index ) ) > -1 ) { + list.splice( index, 1 ); + + // Handle firing indexes + if ( index <= firingIndex ) { + firingIndex--; + } + } + } ); + return this; + }, + + // Check if a given callback is in the list. + // If no argument is given, return whether or not list has callbacks attached. + has: function( fn ) { + return fn ? + jQuery.inArray( fn, list ) > -1 : + list.length > 0; + }, + + // Remove all callbacks from the list + empty: function() { + if ( list ) { + list = []; + } + return this; + }, + + // Disable .fire and .add + // Abort any current/pending executions + // Clear all callbacks and values + disable: function() { + locked = queue = []; + list = memory = ""; + return this; + }, + disabled: function() { + return !list; + }, + + // Disable .fire + // Also disable .add unless we have memory (since it would have no effect) + // Abort any pending executions + lock: function() { + locked = queue = []; + if ( !memory && !firing ) { + list = memory = ""; + } + return this; + }, + locked: function() { + return !!locked; + }, + + // Call all callbacks with the given context and arguments + fireWith: function( context, args ) { + if ( !locked ) { + args = args || []; + args = [ context, args.slice ? args.slice() : args ]; + queue.push( args ); + if ( !firing ) { + fire(); + } + } + return this; + }, + + // Call all the callbacks with the given arguments + fire: function() { + self.fireWith( this, arguments ); + return this; + }, + + // To know if the callbacks have already been called at least once + fired: function() { + return !!fired; + } + }; + + return self; +}; + + +function Identity( v ) { + return v; +} +function Thrower( ex ) { + throw ex; +} + +function adoptValue( value, resolve, reject, noValue ) { + var method; + + try { + + // Check for promise aspect first to privilege synchronous behavior + if ( value && isFunction( ( method = value.promise ) ) ) { + method.call( value ).done( resolve ).fail( reject ); + + // Other thenables + } else if ( value && isFunction( ( method = value.then ) ) ) { + method.call( value, resolve, reject ); + + // Other non-thenables + } else { + + // Control `resolve` arguments by letting Array#slice cast boolean `noValue` to integer: + // * false: [ value ].slice( 0 ) => resolve( value ) + // * true: [ value ].slice( 1 ) => resolve() + resolve.apply( undefined, [ value ].slice( noValue ) ); + } + + // For Promises/A+, convert exceptions into rejections + // Since jQuery.when doesn't unwrap thenables, we can skip the extra checks appearing in + // Deferred#then to conditionally suppress rejection. + } catch ( value ) { + + // Support: Android 4.0 only + // Strict mode functions invoked without .call/.apply get global-object context + reject.apply( undefined, [ value ] ); + } +} + +jQuery.extend( { + + Deferred: function( func ) { + var tuples = [ + + // action, add listener, callbacks, + // ... .then handlers, argument index, [final state] + [ "notify", "progress", jQuery.Callbacks( "memory" ), + jQuery.Callbacks( "memory" ), 2 ], + [ "resolve", "done", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 0, "resolved" ], + [ "reject", "fail", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 1, "rejected" ] + ], + state = "pending", + promise = { + state: function() { + return state; + }, + always: function() { + deferred.done( arguments ).fail( arguments ); + return this; + }, + "catch": function( fn ) { + return promise.then( null, fn ); + }, + + // Keep pipe for back-compat + pipe: function( /* fnDone, fnFail, fnProgress */ ) { + var fns = arguments; + + return jQuery.Deferred( function( newDefer ) { + jQuery.each( tuples, function( _i, tuple ) { + + // Map tuples (progress, done, fail) to arguments (done, fail, progress) + var fn = isFunction( fns[ tuple[ 4 ] ] ) && fns[ tuple[ 4 ] ]; + + // deferred.progress(function() { bind to newDefer or newDefer.notify }) + // deferred.done(function() { bind to newDefer or newDefer.resolve }) + // deferred.fail(function() { bind to newDefer or newDefer.reject }) + deferred[ tuple[ 1 ] ]( function() { + var returned = fn && fn.apply( this, arguments ); + if ( returned && isFunction( returned.promise ) ) { + returned.promise() + .progress( newDefer.notify ) + .done( newDefer.resolve ) + .fail( newDefer.reject ); + } else { + newDefer[ tuple[ 0 ] + "With" ]( + this, + fn ? [ returned ] : arguments + ); + } + } ); + } ); + fns = null; + } ).promise(); + }, + then: function( onFulfilled, onRejected, onProgress ) { + var maxDepth = 0; + function resolve( depth, deferred, handler, special ) { + return function() { + var that = this, + args = arguments, + mightThrow = function() { + var returned, then; + + // Support: Promises/A+ section 2.3.3.3.3 + // https://promisesaplus.com/#point-59 + // Ignore double-resolution attempts + if ( depth < maxDepth ) { + return; + } + + returned = handler.apply( that, args ); + + // Support: Promises/A+ section 2.3.1 + // https://promisesaplus.com/#point-48 + if ( returned === deferred.promise() ) { + throw new TypeError( "Thenable self-resolution" ); + } + + // Support: Promises/A+ sections 2.3.3.1, 3.5 + // https://promisesaplus.com/#point-54 + // https://promisesaplus.com/#point-75 + // Retrieve `then` only once + then = returned && + + // Support: Promises/A+ section 2.3.4 + // https://promisesaplus.com/#point-64 + // Only check objects and functions for thenability + ( typeof returned === "object" || + typeof returned === "function" ) && + returned.then; + + // Handle a returned thenable + if ( isFunction( then ) ) { + + // Special processors (notify) just wait for resolution + if ( special ) { + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ) + ); + + // Normal processors (resolve) also hook into progress + } else { + + // ...and disregard older resolution values + maxDepth++; + + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ), + resolve( maxDepth, deferred, Identity, + deferred.notifyWith ) + ); + } + + // Handle all other returned values + } else { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Identity ) { + that = undefined; + args = [ returned ]; + } + + // Process the value(s) + // Default process is resolve + ( special || deferred.resolveWith )( that, args ); + } + }, + + // Only normal processors (resolve) catch and reject exceptions + process = special ? + mightThrow : + function() { + try { + mightThrow(); + } catch ( e ) { + + if ( jQuery.Deferred.exceptionHook ) { + jQuery.Deferred.exceptionHook( e, + process.stackTrace ); + } + + // Support: Promises/A+ section 2.3.3.3.4.1 + // https://promisesaplus.com/#point-61 + // Ignore post-resolution exceptions + if ( depth + 1 >= maxDepth ) { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Thrower ) { + that = undefined; + args = [ e ]; + } + + deferred.rejectWith( that, args ); + } + } + }; + + // Support: Promises/A+ section 2.3.3.3.1 + // https://promisesaplus.com/#point-57 + // Re-resolve promises immediately to dodge false rejection from + // subsequent errors + if ( depth ) { + process(); + } else { + + // Call an optional hook to record the stack, in case of exception + // since it's otherwise lost when execution goes async + if ( jQuery.Deferred.getStackHook ) { + process.stackTrace = jQuery.Deferred.getStackHook(); + } + window.setTimeout( process ); + } + }; + } + + return jQuery.Deferred( function( newDefer ) { + + // progress_handlers.add( ... ) + tuples[ 0 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onProgress ) ? + onProgress : + Identity, + newDefer.notifyWith + ) + ); + + // fulfilled_handlers.add( ... ) + tuples[ 1 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onFulfilled ) ? + onFulfilled : + Identity + ) + ); + + // rejected_handlers.add( ... ) + tuples[ 2 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onRejected ) ? + onRejected : + Thrower + ) + ); + } ).promise(); + }, + + // Get a promise for this deferred + // If obj is provided, the promise aspect is added to the object + promise: function( obj ) { + return obj != null ? jQuery.extend( obj, promise ) : promise; + } + }, + deferred = {}; + + // Add list-specific methods + jQuery.each( tuples, function( i, tuple ) { + var list = tuple[ 2 ], + stateString = tuple[ 5 ]; + + // promise.progress = list.add + // promise.done = list.add + // promise.fail = list.add + promise[ tuple[ 1 ] ] = list.add; + + // Handle state + if ( stateString ) { + list.add( + function() { + + // state = "resolved" (i.e., fulfilled) + // state = "rejected" + state = stateString; + }, + + // rejected_callbacks.disable + // fulfilled_callbacks.disable + tuples[ 3 - i ][ 2 ].disable, + + // rejected_handlers.disable + // fulfilled_handlers.disable + tuples[ 3 - i ][ 3 ].disable, + + // progress_callbacks.lock + tuples[ 0 ][ 2 ].lock, + + // progress_handlers.lock + tuples[ 0 ][ 3 ].lock + ); + } + + // progress_handlers.fire + // fulfilled_handlers.fire + // rejected_handlers.fire + list.add( tuple[ 3 ].fire ); + + // deferred.notify = function() { deferred.notifyWith(...) } + // deferred.resolve = function() { deferred.resolveWith(...) } + // deferred.reject = function() { deferred.rejectWith(...) } + deferred[ tuple[ 0 ] ] = function() { + deferred[ tuple[ 0 ] + "With" ]( this === deferred ? undefined : this, arguments ); + return this; + }; + + // deferred.notifyWith = list.fireWith + // deferred.resolveWith = list.fireWith + // deferred.rejectWith = list.fireWith + deferred[ tuple[ 0 ] + "With" ] = list.fireWith; + } ); + + // Make the deferred a promise + promise.promise( deferred ); + + // Call given func if any + if ( func ) { + func.call( deferred, deferred ); + } + + // All done! + return deferred; + }, + + // Deferred helper + when: function( singleValue ) { + var + + // count of uncompleted subordinates + remaining = arguments.length, + + // count of unprocessed arguments + i = remaining, + + // subordinate fulfillment data + resolveContexts = Array( i ), + resolveValues = slice.call( arguments ), + + // the primary Deferred + primary = jQuery.Deferred(), + + // subordinate callback factory + updateFunc = function( i ) { + return function( value ) { + resolveContexts[ i ] = this; + resolveValues[ i ] = arguments.length > 1 ? slice.call( arguments ) : value; + if ( !( --remaining ) ) { + primary.resolveWith( resolveContexts, resolveValues ); + } + }; + }; + + // Single- and empty arguments are adopted like Promise.resolve + if ( remaining <= 1 ) { + adoptValue( singleValue, primary.done( updateFunc( i ) ).resolve, primary.reject, + !remaining ); + + // Use .then() to unwrap secondary thenables (cf. gh-3000) + if ( primary.state() === "pending" || + isFunction( resolveValues[ i ] && resolveValues[ i ].then ) ) { + + return primary.then(); + } + } + + // Multiple arguments are aggregated like Promise.all array elements + while ( i-- ) { + adoptValue( resolveValues[ i ], updateFunc( i ), primary.reject ); + } + + return primary.promise(); + } +} ); + + +// These usually indicate a programmer mistake during development, +// warn about them ASAP rather than swallowing them by default. +var rerrorNames = /^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/; + +jQuery.Deferred.exceptionHook = function( error, stack ) { + + // Support: IE 8 - 9 only + // Console exists when dev tools are open, which can happen at any time + if ( window.console && window.console.warn && error && rerrorNames.test( error.name ) ) { + window.console.warn( "jQuery.Deferred exception: " + error.message, error.stack, stack ); + } +}; + + + + +jQuery.readyException = function( error ) { + window.setTimeout( function() { + throw error; + } ); +}; + + + + +// The deferred used on DOM ready +var readyList = jQuery.Deferred(); + +jQuery.fn.ready = function( fn ) { + + readyList + .then( fn ) + + // Wrap jQuery.readyException in a function so that the lookup + // happens at the time of error handling instead of callback + // registration. + .catch( function( error ) { + jQuery.readyException( error ); + } ); + + return this; +}; + +jQuery.extend( { + + // Is the DOM ready to be used? Set to true once it occurs. + isReady: false, + + // A counter to track how many items to wait for before + // the ready event fires. See #6781 + readyWait: 1, + + // Handle when the DOM is ready + ready: function( wait ) { + + // Abort if there are pending holds or we're already ready + if ( wait === true ? --jQuery.readyWait : jQuery.isReady ) { + return; + } + + // Remember that the DOM is ready + jQuery.isReady = true; + + // If a normal DOM Ready event fired, decrement, and wait if need be + if ( wait !== true && --jQuery.readyWait > 0 ) { + return; + } + + // If there are functions bound, to execute + readyList.resolveWith( document, [ jQuery ] ); + } +} ); + +jQuery.ready.then = readyList.then; + +// The ready event handler and self cleanup method +function completed() { + document.removeEventListener( "DOMContentLoaded", completed ); + window.removeEventListener( "load", completed ); + jQuery.ready(); +} + +// Catch cases where $(document).ready() is called +// after the browser event has already occurred. +// Support: IE <=9 - 10 only +// Older IE sometimes signals "interactive" too soon +if ( document.readyState === "complete" || + ( document.readyState !== "loading" && !document.documentElement.doScroll ) ) { + + // Handle it asynchronously to allow scripts the opportunity to delay ready + window.setTimeout( jQuery.ready ); + +} else { + + // Use the handy event callback + document.addEventListener( "DOMContentLoaded", completed ); + + // A fallback to window.onload, that will always work + window.addEventListener( "load", completed ); +} + + + + +// Multifunctional method to get and set values of a collection +// The value/s can optionally be executed if it's a function +var access = function( elems, fn, key, value, chainable, emptyGet, raw ) { + var i = 0, + len = elems.length, + bulk = key == null; + + // Sets many values + if ( toType( key ) === "object" ) { + chainable = true; + for ( i in key ) { + access( elems, fn, i, key[ i ], true, emptyGet, raw ); + } + + // Sets one value + } else if ( value !== undefined ) { + chainable = true; + + if ( !isFunction( value ) ) { + raw = true; + } + + if ( bulk ) { + + // Bulk operations run against the entire set + if ( raw ) { + fn.call( elems, value ); + fn = null; + + // ...except when executing function values + } else { + bulk = fn; + fn = function( elem, _key, value ) { + return bulk.call( jQuery( elem ), value ); + }; + } + } + + if ( fn ) { + for ( ; i < len; i++ ) { + fn( + elems[ i ], key, raw ? + value : + value.call( elems[ i ], i, fn( elems[ i ], key ) ) + ); + } + } + } + + if ( chainable ) { + return elems; + } + + // Gets + if ( bulk ) { + return fn.call( elems ); + } + + return len ? fn( elems[ 0 ], key ) : emptyGet; +}; + + +// Matches dashed string for camelizing +var rmsPrefix = /^-ms-/, + rdashAlpha = /-([a-z])/g; + +// Used by camelCase as callback to replace() +function fcamelCase( _all, letter ) { + return letter.toUpperCase(); +} + +// Convert dashed to camelCase; used by the css and data modules +// Support: IE <=9 - 11, Edge 12 - 15 +// Microsoft forgot to hump their vendor prefix (#9572) +function camelCase( string ) { + return string.replace( rmsPrefix, "ms-" ).replace( rdashAlpha, fcamelCase ); +} +var acceptData = function( owner ) { + + // Accepts only: + // - Node + // - Node.ELEMENT_NODE + // - Node.DOCUMENT_NODE + // - Object + // - Any + return owner.nodeType === 1 || owner.nodeType === 9 || !( +owner.nodeType ); +}; + + + + +function Data() { + this.expando = jQuery.expando + Data.uid++; +} + +Data.uid = 1; + +Data.prototype = { + + cache: function( owner ) { + + // Check if the owner object already has a cache + var value = owner[ this.expando ]; + + // If not, create one + if ( !value ) { + value = {}; + + // We can accept data for non-element nodes in modern browsers, + // but we should not, see #8335. + // Always return an empty object. + if ( acceptData( owner ) ) { + + // If it is a node unlikely to be stringify-ed or looped over + // use plain assignment + if ( owner.nodeType ) { + owner[ this.expando ] = value; + + // Otherwise secure it in a non-enumerable property + // configurable must be true to allow the property to be + // deleted when data is removed + } else { + Object.defineProperty( owner, this.expando, { + value: value, + configurable: true + } ); + } + } + } + + return value; + }, + set: function( owner, data, value ) { + var prop, + cache = this.cache( owner ); + + // Handle: [ owner, key, value ] args + // Always use camelCase key (gh-2257) + if ( typeof data === "string" ) { + cache[ camelCase( data ) ] = value; + + // Handle: [ owner, { properties } ] args + } else { + + // Copy the properties one-by-one to the cache object + for ( prop in data ) { + cache[ camelCase( prop ) ] = data[ prop ]; + } + } + return cache; + }, + get: function( owner, key ) { + return key === undefined ? + this.cache( owner ) : + + // Always use camelCase key (gh-2257) + owner[ this.expando ] && owner[ this.expando ][ camelCase( key ) ]; + }, + access: function( owner, key, value ) { + + // In cases where either: + // + // 1. No key was specified + // 2. A string key was specified, but no value provided + // + // Take the "read" path and allow the get method to determine + // which value to return, respectively either: + // + // 1. The entire cache object + // 2. The data stored at the key + // + if ( key === undefined || + ( ( key && typeof key === "string" ) && value === undefined ) ) { + + return this.get( owner, key ); + } + + // When the key is not a string, or both a key and value + // are specified, set or extend (existing objects) with either: + // + // 1. An object of properties + // 2. A key and value + // + this.set( owner, key, value ); + + // Since the "set" path can have two possible entry points + // return the expected data based on which path was taken[*] + return value !== undefined ? value : key; + }, + remove: function( owner, key ) { + var i, + cache = owner[ this.expando ]; + + if ( cache === undefined ) { + return; + } + + if ( key !== undefined ) { + + // Support array or space separated string of keys + if ( Array.isArray( key ) ) { + + // If key is an array of keys... + // We always set camelCase keys, so remove that. + key = key.map( camelCase ); + } else { + key = camelCase( key ); + + // If a key with the spaces exists, use it. + // Otherwise, create an array by matching non-whitespace + key = key in cache ? + [ key ] : + ( key.match( rnothtmlwhite ) || [] ); + } + + i = key.length; + + while ( i-- ) { + delete cache[ key[ i ] ]; + } + } + + // Remove the expando if there's no more data + if ( key === undefined || jQuery.isEmptyObject( cache ) ) { + + // Support: Chrome <=35 - 45 + // Webkit & Blink performance suffers when deleting properties + // from DOM nodes, so set to undefined instead + // https://bugs.chromium.org/p/chromium/issues/detail?id=378607 (bug restricted) + if ( owner.nodeType ) { + owner[ this.expando ] = undefined; + } else { + delete owner[ this.expando ]; + } + } + }, + hasData: function( owner ) { + var cache = owner[ this.expando ]; + return cache !== undefined && !jQuery.isEmptyObject( cache ); + } +}; +var dataPriv = new Data(); + +var dataUser = new Data(); + + + +// Implementation Summary +// +// 1. Enforce API surface and semantic compatibility with 1.9.x branch +// 2. Improve the module's maintainability by reducing the storage +// paths to a single mechanism. +// 3. Use the same single mechanism to support "private" and "user" data. +// 4. _Never_ expose "private" data to user code (TODO: Drop _data, _removeData) +// 5. Avoid exposing implementation details on user objects (eg. expando properties) +// 6. Provide a clear path for implementation upgrade to WeakMap in 2014 + +var rbrace = /^(?:\{[\w\W]*\}|\[[\w\W]*\])$/, + rmultiDash = /[A-Z]/g; + +function getData( data ) { + if ( data === "true" ) { + return true; + } + + if ( data === "false" ) { + return false; + } + + if ( data === "null" ) { + return null; + } + + // Only convert to a number if it doesn't change the string + if ( data === +data + "" ) { + return +data; + } + + if ( rbrace.test( data ) ) { + return JSON.parse( data ); + } + + return data; +} + +function dataAttr( elem, key, data ) { + var name; + + // If nothing was found internally, try to fetch any + // data from the HTML5 data-* attribute + if ( data === undefined && elem.nodeType === 1 ) { + name = "data-" + key.replace( rmultiDash, "-$&" ).toLowerCase(); + data = elem.getAttribute( name ); + + if ( typeof data === "string" ) { + try { + data = getData( data ); + } catch ( e ) {} + + // Make sure we set the data so it isn't changed later + dataUser.set( elem, key, data ); + } else { + data = undefined; + } + } + return data; +} + +jQuery.extend( { + hasData: function( elem ) { + return dataUser.hasData( elem ) || dataPriv.hasData( elem ); + }, + + data: function( elem, name, data ) { + return dataUser.access( elem, name, data ); + }, + + removeData: function( elem, name ) { + dataUser.remove( elem, name ); + }, + + // TODO: Now that all calls to _data and _removeData have been replaced + // with direct calls to dataPriv methods, these can be deprecated. + _data: function( elem, name, data ) { + return dataPriv.access( elem, name, data ); + }, + + _removeData: function( elem, name ) { + dataPriv.remove( elem, name ); + } +} ); + +jQuery.fn.extend( { + data: function( key, value ) { + var i, name, data, + elem = this[ 0 ], + attrs = elem && elem.attributes; + + // Gets all values + if ( key === undefined ) { + if ( this.length ) { + data = dataUser.get( elem ); + + if ( elem.nodeType === 1 && !dataPriv.get( elem, "hasDataAttrs" ) ) { + i = attrs.length; + while ( i-- ) { + + // Support: IE 11 only + // The attrs elements can be null (#14894) + if ( attrs[ i ] ) { + name = attrs[ i ].name; + if ( name.indexOf( "data-" ) === 0 ) { + name = camelCase( name.slice( 5 ) ); + dataAttr( elem, name, data[ name ] ); + } + } + } + dataPriv.set( elem, "hasDataAttrs", true ); + } + } + + return data; + } + + // Sets multiple values + if ( typeof key === "object" ) { + return this.each( function() { + dataUser.set( this, key ); + } ); + } + + return access( this, function( value ) { + var data; + + // The calling jQuery object (element matches) is not empty + // (and therefore has an element appears at this[ 0 ]) and the + // `value` parameter was not undefined. An empty jQuery object + // will result in `undefined` for elem = this[ 0 ] which will + // throw an exception if an attempt to read a data cache is made. + if ( elem && value === undefined ) { + + // Attempt to get data from the cache + // The key will always be camelCased in Data + data = dataUser.get( elem, key ); + if ( data !== undefined ) { + return data; + } + + // Attempt to "discover" the data in + // HTML5 custom data-* attrs + data = dataAttr( elem, key ); + if ( data !== undefined ) { + return data; + } + + // We tried really hard, but the data doesn't exist. + return; + } + + // Set the data... + this.each( function() { + + // We always store the camelCased key + dataUser.set( this, key, value ); + } ); + }, null, value, arguments.length > 1, null, true ); + }, + + removeData: function( key ) { + return this.each( function() { + dataUser.remove( this, key ); + } ); + } +} ); + + +jQuery.extend( { + queue: function( elem, type, data ) { + var queue; + + if ( elem ) { + type = ( type || "fx" ) + "queue"; + queue = dataPriv.get( elem, type ); + + // Speed up dequeue by getting out quickly if this is just a lookup + if ( data ) { + if ( !queue || Array.isArray( data ) ) { + queue = dataPriv.access( elem, type, jQuery.makeArray( data ) ); + } else { + queue.push( data ); + } + } + return queue || []; + } + }, + + dequeue: function( elem, type ) { + type = type || "fx"; + + var queue = jQuery.queue( elem, type ), + startLength = queue.length, + fn = queue.shift(), + hooks = jQuery._queueHooks( elem, type ), + next = function() { + jQuery.dequeue( elem, type ); + }; + + // If the fx queue is dequeued, always remove the progress sentinel + if ( fn === "inprogress" ) { + fn = queue.shift(); + startLength--; + } + + if ( fn ) { + + // Add a progress sentinel to prevent the fx queue from being + // automatically dequeued + if ( type === "fx" ) { + queue.unshift( "inprogress" ); + } + + // Clear up the last queue stop function + delete hooks.stop; + fn.call( elem, next, hooks ); + } + + if ( !startLength && hooks ) { + hooks.empty.fire(); + } + }, + + // Not public - generate a queueHooks object, or return the current one + _queueHooks: function( elem, type ) { + var key = type + "queueHooks"; + return dataPriv.get( elem, key ) || dataPriv.access( elem, key, { + empty: jQuery.Callbacks( "once memory" ).add( function() { + dataPriv.remove( elem, [ type + "queue", key ] ); + } ) + } ); + } +} ); + +jQuery.fn.extend( { + queue: function( type, data ) { + var setter = 2; + + if ( typeof type !== "string" ) { + data = type; + type = "fx"; + setter--; + } + + if ( arguments.length < setter ) { + return jQuery.queue( this[ 0 ], type ); + } + + return data === undefined ? + this : + this.each( function() { + var queue = jQuery.queue( this, type, data ); + + // Ensure a hooks for this queue + jQuery._queueHooks( this, type ); + + if ( type === "fx" && queue[ 0 ] !== "inprogress" ) { + jQuery.dequeue( this, type ); + } + } ); + }, + dequeue: function( type ) { + return this.each( function() { + jQuery.dequeue( this, type ); + } ); + }, + clearQueue: function( type ) { + return this.queue( type || "fx", [] ); + }, + + // Get a promise resolved when queues of a certain type + // are emptied (fx is the type by default) + promise: function( type, obj ) { + var tmp, + count = 1, + defer = jQuery.Deferred(), + elements = this, + i = this.length, + resolve = function() { + if ( !( --count ) ) { + defer.resolveWith( elements, [ elements ] ); + } + }; + + if ( typeof type !== "string" ) { + obj = type; + type = undefined; + } + type = type || "fx"; + + while ( i-- ) { + tmp = dataPriv.get( elements[ i ], type + "queueHooks" ); + if ( tmp && tmp.empty ) { + count++; + tmp.empty.add( resolve ); + } + } + resolve(); + return defer.promise( obj ); + } +} ); +var pnum = ( /[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/ ).source; + +var rcssNum = new RegExp( "^(?:([+-])=|)(" + pnum + ")([a-z%]*)$", "i" ); + + +var cssExpand = [ "Top", "Right", "Bottom", "Left" ]; + +var documentElement = document.documentElement; + + + + var isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ); + }, + composed = { composed: true }; + + // Support: IE 9 - 11+, Edge 12 - 18+, iOS 10.0 - 10.2 only + // Check attachment across shadow DOM boundaries when possible (gh-3504) + // Support: iOS 10.0-10.2 only + // Early iOS 10 versions support `attachShadow` but not `getRootNode`, + // leading to errors. We need to check for `getRootNode`. + if ( documentElement.getRootNode ) { + isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ) || + elem.getRootNode( composed ) === elem.ownerDocument; + }; + } +var isHiddenWithinTree = function( elem, el ) { + + // isHiddenWithinTree might be called from jQuery#filter function; + // in that case, element will be second argument + elem = el || elem; + + // Inline style trumps all + return elem.style.display === "none" || + elem.style.display === "" && + + // Otherwise, check computed style + // Support: Firefox <=43 - 45 + // Disconnected elements can have computed display: none, so first confirm that elem is + // in the document. + isAttached( elem ) && + + jQuery.css( elem, "display" ) === "none"; + }; + + + +function adjustCSS( elem, prop, valueParts, tween ) { + var adjusted, scale, + maxIterations = 20, + currentValue = tween ? + function() { + return tween.cur(); + } : + function() { + return jQuery.css( elem, prop, "" ); + }, + initial = currentValue(), + unit = valueParts && valueParts[ 3 ] || ( jQuery.cssNumber[ prop ] ? "" : "px" ), + + // Starting value computation is required for potential unit mismatches + initialInUnit = elem.nodeType && + ( jQuery.cssNumber[ prop ] || unit !== "px" && +initial ) && + rcssNum.exec( jQuery.css( elem, prop ) ); + + if ( initialInUnit && initialInUnit[ 3 ] !== unit ) { + + // Support: Firefox <=54 + // Halve the iteration target value to prevent interference from CSS upper bounds (gh-2144) + initial = initial / 2; + + // Trust units reported by jQuery.css + unit = unit || initialInUnit[ 3 ]; + + // Iteratively approximate from a nonzero starting point + initialInUnit = +initial || 1; + + while ( maxIterations-- ) { + + // Evaluate and update our best guess (doubling guesses that zero out). + // Finish if the scale equals or crosses 1 (making the old*new product non-positive). + jQuery.style( elem, prop, initialInUnit + unit ); + if ( ( 1 - scale ) * ( 1 - ( scale = currentValue() / initial || 0.5 ) ) <= 0 ) { + maxIterations = 0; + } + initialInUnit = initialInUnit / scale; + + } + + initialInUnit = initialInUnit * 2; + jQuery.style( elem, prop, initialInUnit + unit ); + + // Make sure we update the tween properties later on + valueParts = valueParts || []; + } + + if ( valueParts ) { + initialInUnit = +initialInUnit || +initial || 0; + + // Apply relative offset (+=/-=) if specified + adjusted = valueParts[ 1 ] ? + initialInUnit + ( valueParts[ 1 ] + 1 ) * valueParts[ 2 ] : + +valueParts[ 2 ]; + if ( tween ) { + tween.unit = unit; + tween.start = initialInUnit; + tween.end = adjusted; + } + } + return adjusted; +} + + +var defaultDisplayMap = {}; + +function getDefaultDisplay( elem ) { + var temp, + doc = elem.ownerDocument, + nodeName = elem.nodeName, + display = defaultDisplayMap[ nodeName ]; + + if ( display ) { + return display; + } + + temp = doc.body.appendChild( doc.createElement( nodeName ) ); + display = jQuery.css( temp, "display" ); + + temp.parentNode.removeChild( temp ); + + if ( display === "none" ) { + display = "block"; + } + defaultDisplayMap[ nodeName ] = display; + + return display; +} + +function showHide( elements, show ) { + var display, elem, + values = [], + index = 0, + length = elements.length; + + // Determine new display value for elements that need to change + for ( ; index < length; index++ ) { + elem = elements[ index ]; + if ( !elem.style ) { + continue; + } + + display = elem.style.display; + if ( show ) { + + // Since we force visibility upon cascade-hidden elements, an immediate (and slow) + // check is required in this first loop unless we have a nonempty display value (either + // inline or about-to-be-restored) + if ( display === "none" ) { + values[ index ] = dataPriv.get( elem, "display" ) || null; + if ( !values[ index ] ) { + elem.style.display = ""; + } + } + if ( elem.style.display === "" && isHiddenWithinTree( elem ) ) { + values[ index ] = getDefaultDisplay( elem ); + } + } else { + if ( display !== "none" ) { + values[ index ] = "none"; + + // Remember what we're overwriting + dataPriv.set( elem, "display", display ); + } + } + } + + // Set the display of the elements in a second loop to avoid constant reflow + for ( index = 0; index < length; index++ ) { + if ( values[ index ] != null ) { + elements[ index ].style.display = values[ index ]; + } + } + + return elements; +} + +jQuery.fn.extend( { + show: function() { + return showHide( this, true ); + }, + hide: function() { + return showHide( this ); + }, + toggle: function( state ) { + if ( typeof state === "boolean" ) { + return state ? this.show() : this.hide(); + } + + return this.each( function() { + if ( isHiddenWithinTree( this ) ) { + jQuery( this ).show(); + } else { + jQuery( this ).hide(); + } + } ); + } +} ); +var rcheckableType = ( /^(?:checkbox|radio)$/i ); + +var rtagName = ( /<([a-z][^\/\0>\x20\t\r\n\f]*)/i ); + +var rscriptType = ( /^$|^module$|\/(?:java|ecma)script/i ); + + + +( function() { + var fragment = document.createDocumentFragment(), + div = fragment.appendChild( document.createElement( "div" ) ), + input = document.createElement( "input" ); + + // Support: Android 4.0 - 4.3 only + // Check state lost if the name is set (#11217) + // Support: Windows Web Apps (WWA) + // `name` and `type` must use .setAttribute for WWA (#14901) + input.setAttribute( "type", "radio" ); + input.setAttribute( "checked", "checked" ); + input.setAttribute( "name", "t" ); + + div.appendChild( input ); + + // Support: Android <=4.1 only + // Older WebKit doesn't clone checked state correctly in fragments + support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked; + + // Support: IE <=11 only + // Make sure textarea (and checkbox) defaultValue is properly cloned + div.innerHTML = ""; + support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue; + + // Support: IE <=9 only + // IE <=9 replaces "; + support.option = !!div.lastChild; +} )(); + + +// We have to close these tags to support XHTML (#13200) +var wrapMap = { + + // XHTML parsers do not magically insert elements in the + // same way that tag soup parsers do. So we cannot shorten + // this by omitting or other required elements. + thead: [ 1, "", "
    " ], + col: [ 2, "", "
    " ], + tr: [ 2, "", "
    " ], + td: [ 3, "", "
    " ], + + _default: [ 0, "", "" ] +}; + +wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead; +wrapMap.th = wrapMap.td; + +// Support: IE <=9 only +if ( !support.option ) { + wrapMap.optgroup = wrapMap.option = [ 1, "" ]; +} + + +function getAll( context, tag ) { + + // Support: IE <=9 - 11 only + // Use typeof to avoid zero-argument method invocation on host objects (#15151) + var ret; + + if ( typeof context.getElementsByTagName !== "undefined" ) { + ret = context.getElementsByTagName( tag || "*" ); + + } else if ( typeof context.querySelectorAll !== "undefined" ) { + ret = context.querySelectorAll( tag || "*" ); + + } else { + ret = []; + } + + if ( tag === undefined || tag && nodeName( context, tag ) ) { + return jQuery.merge( [ context ], ret ); + } + + return ret; +} + + +// Mark scripts as having already been evaluated +function setGlobalEval( elems, refElements ) { + var i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + dataPriv.set( + elems[ i ], + "globalEval", + !refElements || dataPriv.get( refElements[ i ], "globalEval" ) + ); + } +} + + +var rhtml = /<|&#?\w+;/; + +function buildFragment( elems, context, scripts, selection, ignored ) { + var elem, tmp, tag, wrap, attached, j, + fragment = context.createDocumentFragment(), + nodes = [], + i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + elem = elems[ i ]; + + if ( elem || elem === 0 ) { + + // Add nodes directly + if ( toType( elem ) === "object" ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, elem.nodeType ? [ elem ] : elem ); + + // Convert non-html into a text node + } else if ( !rhtml.test( elem ) ) { + nodes.push( context.createTextNode( elem ) ); + + // Convert html into DOM nodes + } else { + tmp = tmp || fragment.appendChild( context.createElement( "div" ) ); + + // Deserialize a standard representation + tag = ( rtagName.exec( elem ) || [ "", "" ] )[ 1 ].toLowerCase(); + wrap = wrapMap[ tag ] || wrapMap._default; + tmp.innerHTML = wrap[ 1 ] + jQuery.htmlPrefilter( elem ) + wrap[ 2 ]; + + // Descend through wrappers to the right content + j = wrap[ 0 ]; + while ( j-- ) { + tmp = tmp.lastChild; + } + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, tmp.childNodes ); + + // Remember the top-level container + tmp = fragment.firstChild; + + // Ensure the created nodes are orphaned (#12392) + tmp.textContent = ""; + } + } + } + + // Remove wrapper from fragment + fragment.textContent = ""; + + i = 0; + while ( ( elem = nodes[ i++ ] ) ) { + + // Skip elements already in the context collection (trac-4087) + if ( selection && jQuery.inArray( elem, selection ) > -1 ) { + if ( ignored ) { + ignored.push( elem ); + } + continue; + } + + attached = isAttached( elem ); + + // Append to fragment + tmp = getAll( fragment.appendChild( elem ), "script" ); + + // Preserve script evaluation history + if ( attached ) { + setGlobalEval( tmp ); + } + + // Capture executables + if ( scripts ) { + j = 0; + while ( ( elem = tmp[ j++ ] ) ) { + if ( rscriptType.test( elem.type || "" ) ) { + scripts.push( elem ); + } + } + } + } + + return fragment; +} + + +var rtypenamespace = /^([^.]*)(?:\.(.+)|)/; + +function returnTrue() { + return true; +} + +function returnFalse() { + return false; +} + +// Support: IE <=9 - 11+ +// focus() and blur() are asynchronous, except when they are no-op. +// So expect focus to be synchronous when the element is already active, +// and blur to be synchronous when the element is not already active. +// (focus and blur are always synchronous in other supported browsers, +// this just defines when we can count on it). +function expectSync( elem, type ) { + return ( elem === safeActiveElement() ) === ( type === "focus" ); +} + +// Support: IE <=9 only +// Accessing document.activeElement can throw unexpectedly +// https://bugs.jquery.com/ticket/13393 +function safeActiveElement() { + try { + return document.activeElement; + } catch ( err ) { } +} + +function on( elem, types, selector, data, fn, one ) { + var origFn, type; + + // Types can be a map of types/handlers + if ( typeof types === "object" ) { + + // ( types-Object, selector, data ) + if ( typeof selector !== "string" ) { + + // ( types-Object, data ) + data = data || selector; + selector = undefined; + } + for ( type in types ) { + on( elem, type, selector, data, types[ type ], one ); + } + return elem; + } + + if ( data == null && fn == null ) { + + // ( types, fn ) + fn = selector; + data = selector = undefined; + } else if ( fn == null ) { + if ( typeof selector === "string" ) { + + // ( types, selector, fn ) + fn = data; + data = undefined; + } else { + + // ( types, data, fn ) + fn = data; + data = selector; + selector = undefined; + } + } + if ( fn === false ) { + fn = returnFalse; + } else if ( !fn ) { + return elem; + } + + if ( one === 1 ) { + origFn = fn; + fn = function( event ) { + + // Can use an empty set, since event contains the info + jQuery().off( event ); + return origFn.apply( this, arguments ); + }; + + // Use same guid so caller can remove using origFn + fn.guid = origFn.guid || ( origFn.guid = jQuery.guid++ ); + } + return elem.each( function() { + jQuery.event.add( this, types, fn, data, selector ); + } ); +} + +/* + * Helper functions for managing events -- not part of the public interface. + * Props to Dean Edwards' addEvent library for many of the ideas. + */ +jQuery.event = { + + global: {}, + + add: function( elem, types, handler, data, selector ) { + + var handleObjIn, eventHandle, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.get( elem ); + + // Only attach events to objects that accept data + if ( !acceptData( elem ) ) { + return; + } + + // Caller can pass in an object of custom data in lieu of the handler + if ( handler.handler ) { + handleObjIn = handler; + handler = handleObjIn.handler; + selector = handleObjIn.selector; + } + + // Ensure that invalid selectors throw exceptions at attach time + // Evaluate against documentElement in case elem is a non-element node (e.g., document) + if ( selector ) { + jQuery.find.matchesSelector( documentElement, selector ); + } + + // Make sure that the handler has a unique ID, used to find/remove it later + if ( !handler.guid ) { + handler.guid = jQuery.guid++; + } + + // Init the element's event structure and main handler, if this is the first + if ( !( events = elemData.events ) ) { + events = elemData.events = Object.create( null ); + } + if ( !( eventHandle = elemData.handle ) ) { + eventHandle = elemData.handle = function( e ) { + + // Discard the second event of a jQuery.event.trigger() and + // when an event is called after a page has unloaded + return typeof jQuery !== "undefined" && jQuery.event.triggered !== e.type ? + jQuery.event.dispatch.apply( elem, arguments ) : undefined; + }; + } + + // Handle multiple events separated by a space + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // There *must* be a type, no attaching namespace-only handlers + if ( !type ) { + continue; + } + + // If event changes its type, use the special event handlers for the changed type + special = jQuery.event.special[ type ] || {}; + + // If selector defined, determine special event api type, otherwise given type + type = ( selector ? special.delegateType : special.bindType ) || type; + + // Update special based on newly reset type + special = jQuery.event.special[ type ] || {}; + + // handleObj is passed to all event handlers + handleObj = jQuery.extend( { + type: type, + origType: origType, + data: data, + handler: handler, + guid: handler.guid, + selector: selector, + needsContext: selector && jQuery.expr.match.needsContext.test( selector ), + namespace: namespaces.join( "." ) + }, handleObjIn ); + + // Init the event handler queue if we're the first + if ( !( handlers = events[ type ] ) ) { + handlers = events[ type ] = []; + handlers.delegateCount = 0; + + // Only use addEventListener if the special events handler returns false + if ( !special.setup || + special.setup.call( elem, data, namespaces, eventHandle ) === false ) { + + if ( elem.addEventListener ) { + elem.addEventListener( type, eventHandle ); + } + } + } + + if ( special.add ) { + special.add.call( elem, handleObj ); + + if ( !handleObj.handler.guid ) { + handleObj.handler.guid = handler.guid; + } + } + + // Add to the element's handler list, delegates in front + if ( selector ) { + handlers.splice( handlers.delegateCount++, 0, handleObj ); + } else { + handlers.push( handleObj ); + } + + // Keep track of which events have ever been used, for event optimization + jQuery.event.global[ type ] = true; + } + + }, + + // Detach an event or set of events from an element + remove: function( elem, types, handler, selector, mappedTypes ) { + + var j, origCount, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.hasData( elem ) && dataPriv.get( elem ); + + if ( !elemData || !( events = elemData.events ) ) { + return; + } + + // Once for each type.namespace in types; type may be omitted + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // Unbind all events (on this namespace, if provided) for the element + if ( !type ) { + for ( type in events ) { + jQuery.event.remove( elem, type + types[ t ], handler, selector, true ); + } + continue; + } + + special = jQuery.event.special[ type ] || {}; + type = ( selector ? special.delegateType : special.bindType ) || type; + handlers = events[ type ] || []; + tmp = tmp[ 2 ] && + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ); + + // Remove matching events + origCount = j = handlers.length; + while ( j-- ) { + handleObj = handlers[ j ]; + + if ( ( mappedTypes || origType === handleObj.origType ) && + ( !handler || handler.guid === handleObj.guid ) && + ( !tmp || tmp.test( handleObj.namespace ) ) && + ( !selector || selector === handleObj.selector || + selector === "**" && handleObj.selector ) ) { + handlers.splice( j, 1 ); + + if ( handleObj.selector ) { + handlers.delegateCount--; + } + if ( special.remove ) { + special.remove.call( elem, handleObj ); + } + } + } + + // Remove generic event handler if we removed something and no more handlers exist + // (avoids potential for endless recursion during removal of special event handlers) + if ( origCount && !handlers.length ) { + if ( !special.teardown || + special.teardown.call( elem, namespaces, elemData.handle ) === false ) { + + jQuery.removeEvent( elem, type, elemData.handle ); + } + + delete events[ type ]; + } + } + + // Remove data and the expando if it's no longer used + if ( jQuery.isEmptyObject( events ) ) { + dataPriv.remove( elem, "handle events" ); + } + }, + + dispatch: function( nativeEvent ) { + + var i, j, ret, matched, handleObj, handlerQueue, + args = new Array( arguments.length ), + + // Make a writable jQuery.Event from the native event object + event = jQuery.event.fix( nativeEvent ), + + handlers = ( + dataPriv.get( this, "events" ) || Object.create( null ) + )[ event.type ] || [], + special = jQuery.event.special[ event.type ] || {}; + + // Use the fix-ed jQuery.Event rather than the (read-only) native event + args[ 0 ] = event; + + for ( i = 1; i < arguments.length; i++ ) { + args[ i ] = arguments[ i ]; + } + + event.delegateTarget = this; + + // Call the preDispatch hook for the mapped type, and let it bail if desired + if ( special.preDispatch && special.preDispatch.call( this, event ) === false ) { + return; + } + + // Determine handlers + handlerQueue = jQuery.event.handlers.call( this, event, handlers ); + + // Run delegates first; they may want to stop propagation beneath us + i = 0; + while ( ( matched = handlerQueue[ i++ ] ) && !event.isPropagationStopped() ) { + event.currentTarget = matched.elem; + + j = 0; + while ( ( handleObj = matched.handlers[ j++ ] ) && + !event.isImmediatePropagationStopped() ) { + + // If the event is namespaced, then each handler is only invoked if it is + // specially universal or its namespaces are a superset of the event's. + if ( !event.rnamespace || handleObj.namespace === false || + event.rnamespace.test( handleObj.namespace ) ) { + + event.handleObj = handleObj; + event.data = handleObj.data; + + ret = ( ( jQuery.event.special[ handleObj.origType ] || {} ).handle || + handleObj.handler ).apply( matched.elem, args ); + + if ( ret !== undefined ) { + if ( ( event.result = ret ) === false ) { + event.preventDefault(); + event.stopPropagation(); + } + } + } + } + } + + // Call the postDispatch hook for the mapped type + if ( special.postDispatch ) { + special.postDispatch.call( this, event ); + } + + return event.result; + }, + + handlers: function( event, handlers ) { + var i, handleObj, sel, matchedHandlers, matchedSelectors, + handlerQueue = [], + delegateCount = handlers.delegateCount, + cur = event.target; + + // Find delegate handlers + if ( delegateCount && + + // Support: IE <=9 + // Black-hole SVG instance trees (trac-13180) + cur.nodeType && + + // Support: Firefox <=42 + // Suppress spec-violating clicks indicating a non-primary pointer button (trac-3861) + // https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click + // Support: IE 11 only + // ...but not arrow key "clicks" of radio inputs, which can have `button` -1 (gh-2343) + !( event.type === "click" && event.button >= 1 ) ) { + + for ( ; cur !== this; cur = cur.parentNode || this ) { + + // Don't check non-elements (#13208) + // Don't process clicks on disabled elements (#6911, #8165, #11382, #11764) + if ( cur.nodeType === 1 && !( event.type === "click" && cur.disabled === true ) ) { + matchedHandlers = []; + matchedSelectors = {}; + for ( i = 0; i < delegateCount; i++ ) { + handleObj = handlers[ i ]; + + // Don't conflict with Object.prototype properties (#13203) + sel = handleObj.selector + " "; + + if ( matchedSelectors[ sel ] === undefined ) { + matchedSelectors[ sel ] = handleObj.needsContext ? + jQuery( sel, this ).index( cur ) > -1 : + jQuery.find( sel, this, null, [ cur ] ).length; + } + if ( matchedSelectors[ sel ] ) { + matchedHandlers.push( handleObj ); + } + } + if ( matchedHandlers.length ) { + handlerQueue.push( { elem: cur, handlers: matchedHandlers } ); + } + } + } + } + + // Add the remaining (directly-bound) handlers + cur = this; + if ( delegateCount < handlers.length ) { + handlerQueue.push( { elem: cur, handlers: handlers.slice( delegateCount ) } ); + } + + return handlerQueue; + }, + + addProp: function( name, hook ) { + Object.defineProperty( jQuery.Event.prototype, name, { + enumerable: true, + configurable: true, + + get: isFunction( hook ) ? + function() { + if ( this.originalEvent ) { + return hook( this.originalEvent ); + } + } : + function() { + if ( this.originalEvent ) { + return this.originalEvent[ name ]; + } + }, + + set: function( value ) { + Object.defineProperty( this, name, { + enumerable: true, + configurable: true, + writable: true, + value: value + } ); + } + } ); + }, + + fix: function( originalEvent ) { + return originalEvent[ jQuery.expando ] ? + originalEvent : + new jQuery.Event( originalEvent ); + }, + + special: { + load: { + + // Prevent triggered image.load events from bubbling to window.load + noBubble: true + }, + click: { + + // Utilize native event to ensure correct state for checkable inputs + setup: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Claim the first handler + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + // dataPriv.set( el, "click", ... ) + leverageNative( el, "click", returnTrue ); + } + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Force setup before triggering a click + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + leverageNative( el, "click" ); + } + + // Return non-false to allow normal event-path propagation + return true; + }, + + // For cross-browser consistency, suppress native .click() on links + // Also prevent it if we're currently inside a leveraged native-event stack + _default: function( event ) { + var target = event.target; + return rcheckableType.test( target.type ) && + target.click && nodeName( target, "input" ) && + dataPriv.get( target, "click" ) || + nodeName( target, "a" ); + } + }, + + beforeunload: { + postDispatch: function( event ) { + + // Support: Firefox 20+ + // Firefox doesn't alert if the returnValue field is not set. + if ( event.result !== undefined && event.originalEvent ) { + event.originalEvent.returnValue = event.result; + } + } + } + } +}; + +// Ensure the presence of an event listener that handles manually-triggered +// synthetic events by interrupting progress until reinvoked in response to +// *native* events that it fires directly, ensuring that state changes have +// already occurred before other listeners are invoked. +function leverageNative( el, type, expectSync ) { + + // Missing expectSync indicates a trigger call, which must force setup through jQuery.event.add + if ( !expectSync ) { + if ( dataPriv.get( el, type ) === undefined ) { + jQuery.event.add( el, type, returnTrue ); + } + return; + } + + // Register the controller as a special universal handler for all event namespaces + dataPriv.set( el, type, false ); + jQuery.event.add( el, type, { + namespace: false, + handler: function( event ) { + var notAsync, result, + saved = dataPriv.get( this, type ); + + if ( ( event.isTrigger & 1 ) && this[ type ] ) { + + // Interrupt processing of the outer synthetic .trigger()ed event + // Saved data should be false in such cases, but might be a leftover capture object + // from an async native handler (gh-4350) + if ( !saved.length ) { + + // Store arguments for use when handling the inner native event + // There will always be at least one argument (an event object), so this array + // will not be confused with a leftover capture object. + saved = slice.call( arguments ); + dataPriv.set( this, type, saved ); + + // Trigger the native event and capture its result + // Support: IE <=9 - 11+ + // focus() and blur() are asynchronous + notAsync = expectSync( this, type ); + this[ type ](); + result = dataPriv.get( this, type ); + if ( saved !== result || notAsync ) { + dataPriv.set( this, type, false ); + } else { + result = {}; + } + if ( saved !== result ) { + + // Cancel the outer synthetic event + event.stopImmediatePropagation(); + event.preventDefault(); + + // Support: Chrome 86+ + // In Chrome, if an element having a focusout handler is blurred by + // clicking outside of it, it invokes the handler synchronously. If + // that handler calls `.remove()` on the element, the data is cleared, + // leaving `result` undefined. We need to guard against this. + return result && result.value; + } + + // If this is an inner synthetic event for an event with a bubbling surrogate + // (focus or blur), assume that the surrogate already propagated from triggering the + // native event and prevent that from happening again here. + // This technically gets the ordering wrong w.r.t. to `.trigger()` (in which the + // bubbling surrogate propagates *after* the non-bubbling base), but that seems + // less bad than duplication. + } else if ( ( jQuery.event.special[ type ] || {} ).delegateType ) { + event.stopPropagation(); + } + + // If this is a native event triggered above, everything is now in order + // Fire an inner synthetic event with the original arguments + } else if ( saved.length ) { + + // ...and capture the result + dataPriv.set( this, type, { + value: jQuery.event.trigger( + + // Support: IE <=9 - 11+ + // Extend with the prototype to reset the above stopImmediatePropagation() + jQuery.extend( saved[ 0 ], jQuery.Event.prototype ), + saved.slice( 1 ), + this + ) + } ); + + // Abort handling of the native event + event.stopImmediatePropagation(); + } + } + } ); +} + +jQuery.removeEvent = function( elem, type, handle ) { + + // This "if" is needed for plain objects + if ( elem.removeEventListener ) { + elem.removeEventListener( type, handle ); + } +}; + +jQuery.Event = function( src, props ) { + + // Allow instantiation without the 'new' keyword + if ( !( this instanceof jQuery.Event ) ) { + return new jQuery.Event( src, props ); + } + + // Event object + if ( src && src.type ) { + this.originalEvent = src; + this.type = src.type; + + // Events bubbling up the document may have been marked as prevented + // by a handler lower down the tree; reflect the correct value. + this.isDefaultPrevented = src.defaultPrevented || + src.defaultPrevented === undefined && + + // Support: Android <=2.3 only + src.returnValue === false ? + returnTrue : + returnFalse; + + // Create target properties + // Support: Safari <=6 - 7 only + // Target should not be a text node (#504, #13143) + this.target = ( src.target && src.target.nodeType === 3 ) ? + src.target.parentNode : + src.target; + + this.currentTarget = src.currentTarget; + this.relatedTarget = src.relatedTarget; + + // Event type + } else { + this.type = src; + } + + // Put explicitly provided properties onto the event object + if ( props ) { + jQuery.extend( this, props ); + } + + // Create a timestamp if incoming event doesn't have one + this.timeStamp = src && src.timeStamp || Date.now(); + + // Mark it as fixed + this[ jQuery.expando ] = true; +}; + +// jQuery.Event is based on DOM3 Events as specified by the ECMAScript Language Binding +// https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html +jQuery.Event.prototype = { + constructor: jQuery.Event, + isDefaultPrevented: returnFalse, + isPropagationStopped: returnFalse, + isImmediatePropagationStopped: returnFalse, + isSimulated: false, + + preventDefault: function() { + var e = this.originalEvent; + + this.isDefaultPrevented = returnTrue; + + if ( e && !this.isSimulated ) { + e.preventDefault(); + } + }, + stopPropagation: function() { + var e = this.originalEvent; + + this.isPropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopPropagation(); + } + }, + stopImmediatePropagation: function() { + var e = this.originalEvent; + + this.isImmediatePropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopImmediatePropagation(); + } + + this.stopPropagation(); + } +}; + +// Includes all common event props including KeyEvent and MouseEvent specific props +jQuery.each( { + altKey: true, + bubbles: true, + cancelable: true, + changedTouches: true, + ctrlKey: true, + detail: true, + eventPhase: true, + metaKey: true, + pageX: true, + pageY: true, + shiftKey: true, + view: true, + "char": true, + code: true, + charCode: true, + key: true, + keyCode: true, + button: true, + buttons: true, + clientX: true, + clientY: true, + offsetX: true, + offsetY: true, + pointerId: true, + pointerType: true, + screenX: true, + screenY: true, + targetTouches: true, + toElement: true, + touches: true, + which: true +}, jQuery.event.addProp ); + +jQuery.each( { focus: "focusin", blur: "focusout" }, function( type, delegateType ) { + jQuery.event.special[ type ] = { + + // Utilize native event if possible so blur/focus sequence is correct + setup: function() { + + // Claim the first handler + // dataPriv.set( this, "focus", ... ) + // dataPriv.set( this, "blur", ... ) + leverageNative( this, type, expectSync ); + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function() { + + // Force setup before trigger + leverageNative( this, type ); + + // Return non-false to allow normal event-path propagation + return true; + }, + + // Suppress native focus or blur as it's already being fired + // in leverageNative. + _default: function() { + return true; + }, + + delegateType: delegateType + }; +} ); + +// Create mouseenter/leave events using mouseover/out and event-time checks +// so that event delegation works in jQuery. +// Do the same for pointerenter/pointerleave and pointerover/pointerout +// +// Support: Safari 7 only +// Safari sends mouseenter too often; see: +// https://bugs.chromium.org/p/chromium/issues/detail?id=470258 +// for the description of the bug (it existed in older Chrome versions as well). +jQuery.each( { + mouseenter: "mouseover", + mouseleave: "mouseout", + pointerenter: "pointerover", + pointerleave: "pointerout" +}, function( orig, fix ) { + jQuery.event.special[ orig ] = { + delegateType: fix, + bindType: fix, + + handle: function( event ) { + var ret, + target = this, + related = event.relatedTarget, + handleObj = event.handleObj; + + // For mouseenter/leave call the handler if related is outside the target. + // NB: No relatedTarget if the mouse left/entered the browser window + if ( !related || ( related !== target && !jQuery.contains( target, related ) ) ) { + event.type = handleObj.origType; + ret = handleObj.handler.apply( this, arguments ); + event.type = fix; + } + return ret; + } + }; +} ); + +jQuery.fn.extend( { + + on: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn ); + }, + one: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn, 1 ); + }, + off: function( types, selector, fn ) { + var handleObj, type; + if ( types && types.preventDefault && types.handleObj ) { + + // ( event ) dispatched jQuery.Event + handleObj = types.handleObj; + jQuery( types.delegateTarget ).off( + handleObj.namespace ? + handleObj.origType + "." + handleObj.namespace : + handleObj.origType, + handleObj.selector, + handleObj.handler + ); + return this; + } + if ( typeof types === "object" ) { + + // ( types-object [, selector] ) + for ( type in types ) { + this.off( type, selector, types[ type ] ); + } + return this; + } + if ( selector === false || typeof selector === "function" ) { + + // ( types [, fn] ) + fn = selector; + selector = undefined; + } + if ( fn === false ) { + fn = returnFalse; + } + return this.each( function() { + jQuery.event.remove( this, types, fn, selector ); + } ); + } +} ); + + +var + + // Support: IE <=10 - 11, Edge 12 - 13 only + // In IE/Edge using regex groups here causes severe slowdowns. + // See https://connect.microsoft.com/IE/feedback/details/1736512/ + rnoInnerhtml = /\s*$/g; + +// Prefer a tbody over its parent table for containing new rows +function manipulationTarget( elem, content ) { + if ( nodeName( elem, "table" ) && + nodeName( content.nodeType !== 11 ? content : content.firstChild, "tr" ) ) { + + return jQuery( elem ).children( "tbody" )[ 0 ] || elem; + } + + return elem; +} + +// Replace/restore the type attribute of script elements for safe DOM manipulation +function disableScript( elem ) { + elem.type = ( elem.getAttribute( "type" ) !== null ) + "/" + elem.type; + return elem; +} +function restoreScript( elem ) { + if ( ( elem.type || "" ).slice( 0, 5 ) === "true/" ) { + elem.type = elem.type.slice( 5 ); + } else { + elem.removeAttribute( "type" ); + } + + return elem; +} + +function cloneCopyEvent( src, dest ) { + var i, l, type, pdataOld, udataOld, udataCur, events; + + if ( dest.nodeType !== 1 ) { + return; + } + + // 1. Copy private data: events, handlers, etc. + if ( dataPriv.hasData( src ) ) { + pdataOld = dataPriv.get( src ); + events = pdataOld.events; + + if ( events ) { + dataPriv.remove( dest, "handle events" ); + + for ( type in events ) { + for ( i = 0, l = events[ type ].length; i < l; i++ ) { + jQuery.event.add( dest, type, events[ type ][ i ] ); + } + } + } + } + + // 2. Copy user data + if ( dataUser.hasData( src ) ) { + udataOld = dataUser.access( src ); + udataCur = jQuery.extend( {}, udataOld ); + + dataUser.set( dest, udataCur ); + } +} + +// Fix IE bugs, see support tests +function fixInput( src, dest ) { + var nodeName = dest.nodeName.toLowerCase(); + + // Fails to persist the checked state of a cloned checkbox or radio button. + if ( nodeName === "input" && rcheckableType.test( src.type ) ) { + dest.checked = src.checked; + + // Fails to return the selected option to the default selected state when cloning options + } else if ( nodeName === "input" || nodeName === "textarea" ) { + dest.defaultValue = src.defaultValue; + } +} + +function domManip( collection, args, callback, ignored ) { + + // Flatten any nested arrays + args = flat( args ); + + var fragment, first, scripts, hasScripts, node, doc, + i = 0, + l = collection.length, + iNoClone = l - 1, + value = args[ 0 ], + valueIsFunction = isFunction( value ); + + // We can't cloneNode fragments that contain checked, in WebKit + if ( valueIsFunction || + ( l > 1 && typeof value === "string" && + !support.checkClone && rchecked.test( value ) ) ) { + return collection.each( function( index ) { + var self = collection.eq( index ); + if ( valueIsFunction ) { + args[ 0 ] = value.call( this, index, self.html() ); + } + domManip( self, args, callback, ignored ); + } ); + } + + if ( l ) { + fragment = buildFragment( args, collection[ 0 ].ownerDocument, false, collection, ignored ); + first = fragment.firstChild; + + if ( fragment.childNodes.length === 1 ) { + fragment = first; + } + + // Require either new content or an interest in ignored elements to invoke the callback + if ( first || ignored ) { + scripts = jQuery.map( getAll( fragment, "script" ), disableScript ); + hasScripts = scripts.length; + + // Use the original fragment for the last item + // instead of the first because it can end up + // being emptied incorrectly in certain situations (#8070). + for ( ; i < l; i++ ) { + node = fragment; + + if ( i !== iNoClone ) { + node = jQuery.clone( node, true, true ); + + // Keep references to cloned scripts for later restoration + if ( hasScripts ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( scripts, getAll( node, "script" ) ); + } + } + + callback.call( collection[ i ], node, i ); + } + + if ( hasScripts ) { + doc = scripts[ scripts.length - 1 ].ownerDocument; + + // Reenable scripts + jQuery.map( scripts, restoreScript ); + + // Evaluate executable scripts on first document insertion + for ( i = 0; i < hasScripts; i++ ) { + node = scripts[ i ]; + if ( rscriptType.test( node.type || "" ) && + !dataPriv.access( node, "globalEval" ) && + jQuery.contains( doc, node ) ) { + + if ( node.src && ( node.type || "" ).toLowerCase() !== "module" ) { + + // Optional AJAX dependency, but won't run scripts if not present + if ( jQuery._evalUrl && !node.noModule ) { + jQuery._evalUrl( node.src, { + nonce: node.nonce || node.getAttribute( "nonce" ) + }, doc ); + } + } else { + DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc ); + } + } + } + } + } + } + + return collection; +} + +function remove( elem, selector, keepData ) { + var node, + nodes = selector ? jQuery.filter( selector, elem ) : elem, + i = 0; + + for ( ; ( node = nodes[ i ] ) != null; i++ ) { + if ( !keepData && node.nodeType === 1 ) { + jQuery.cleanData( getAll( node ) ); + } + + if ( node.parentNode ) { + if ( keepData && isAttached( node ) ) { + setGlobalEval( getAll( node, "script" ) ); + } + node.parentNode.removeChild( node ); + } + } + + return elem; +} + +jQuery.extend( { + htmlPrefilter: function( html ) { + return html; + }, + + clone: function( elem, dataAndEvents, deepDataAndEvents ) { + var i, l, srcElements, destElements, + clone = elem.cloneNode( true ), + inPage = isAttached( elem ); + + // Fix IE cloning issues + if ( !support.noCloneChecked && ( elem.nodeType === 1 || elem.nodeType === 11 ) && + !jQuery.isXMLDoc( elem ) ) { + + // We eschew Sizzle here for performance reasons: https://jsperf.com/getall-vs-sizzle/2 + destElements = getAll( clone ); + srcElements = getAll( elem ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + fixInput( srcElements[ i ], destElements[ i ] ); + } + } + + // Copy the events from the original to the clone + if ( dataAndEvents ) { + if ( deepDataAndEvents ) { + srcElements = srcElements || getAll( elem ); + destElements = destElements || getAll( clone ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + cloneCopyEvent( srcElements[ i ], destElements[ i ] ); + } + } else { + cloneCopyEvent( elem, clone ); + } + } + + // Preserve script evaluation history + destElements = getAll( clone, "script" ); + if ( destElements.length > 0 ) { + setGlobalEval( destElements, !inPage && getAll( elem, "script" ) ); + } + + // Return the cloned set + return clone; + }, + + cleanData: function( elems ) { + var data, elem, type, + special = jQuery.event.special, + i = 0; + + for ( ; ( elem = elems[ i ] ) !== undefined; i++ ) { + if ( acceptData( elem ) ) { + if ( ( data = elem[ dataPriv.expando ] ) ) { + if ( data.events ) { + for ( type in data.events ) { + if ( special[ type ] ) { + jQuery.event.remove( elem, type ); + + // This is a shortcut to avoid jQuery.event.remove's overhead + } else { + jQuery.removeEvent( elem, type, data.handle ); + } + } + } + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataPriv.expando ] = undefined; + } + if ( elem[ dataUser.expando ] ) { + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataUser.expando ] = undefined; + } + } + } + } +} ); + +jQuery.fn.extend( { + detach: function( selector ) { + return remove( this, selector, true ); + }, + + remove: function( selector ) { + return remove( this, selector ); + }, + + text: function( value ) { + return access( this, function( value ) { + return value === undefined ? + jQuery.text( this ) : + this.empty().each( function() { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + this.textContent = value; + } + } ); + }, null, value, arguments.length ); + }, + + append: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.appendChild( elem ); + } + } ); + }, + + prepend: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.insertBefore( elem, target.firstChild ); + } + } ); + }, + + before: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this ); + } + } ); + }, + + after: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this.nextSibling ); + } + } ); + }, + + empty: function() { + var elem, + i = 0; + + for ( ; ( elem = this[ i ] ) != null; i++ ) { + if ( elem.nodeType === 1 ) { + + // Prevent memory leaks + jQuery.cleanData( getAll( elem, false ) ); + + // Remove any remaining nodes + elem.textContent = ""; + } + } + + return this; + }, + + clone: function( dataAndEvents, deepDataAndEvents ) { + dataAndEvents = dataAndEvents == null ? false : dataAndEvents; + deepDataAndEvents = deepDataAndEvents == null ? dataAndEvents : deepDataAndEvents; + + return this.map( function() { + return jQuery.clone( this, dataAndEvents, deepDataAndEvents ); + } ); + }, + + html: function( value ) { + return access( this, function( value ) { + var elem = this[ 0 ] || {}, + i = 0, + l = this.length; + + if ( value === undefined && elem.nodeType === 1 ) { + return elem.innerHTML; + } + + // See if we can take a shortcut and just use innerHTML + if ( typeof value === "string" && !rnoInnerhtml.test( value ) && + !wrapMap[ ( rtagName.exec( value ) || [ "", "" ] )[ 1 ].toLowerCase() ] ) { + + value = jQuery.htmlPrefilter( value ); + + try { + for ( ; i < l; i++ ) { + elem = this[ i ] || {}; + + // Remove element nodes and prevent memory leaks + if ( elem.nodeType === 1 ) { + jQuery.cleanData( getAll( elem, false ) ); + elem.innerHTML = value; + } + } + + elem = 0; + + // If using innerHTML throws an exception, use the fallback method + } catch ( e ) {} + } + + if ( elem ) { + this.empty().append( value ); + } + }, null, value, arguments.length ); + }, + + replaceWith: function() { + var ignored = []; + + // Make the changes, replacing each non-ignored context element with the new content + return domManip( this, arguments, function( elem ) { + var parent = this.parentNode; + + if ( jQuery.inArray( this, ignored ) < 0 ) { + jQuery.cleanData( getAll( this ) ); + if ( parent ) { + parent.replaceChild( elem, this ); + } + } + + // Force callback invocation + }, ignored ); + } +} ); + +jQuery.each( { + appendTo: "append", + prependTo: "prepend", + insertBefore: "before", + insertAfter: "after", + replaceAll: "replaceWith" +}, function( name, original ) { + jQuery.fn[ name ] = function( selector ) { + var elems, + ret = [], + insert = jQuery( selector ), + last = insert.length - 1, + i = 0; + + for ( ; i <= last; i++ ) { + elems = i === last ? this : this.clone( true ); + jQuery( insert[ i ] )[ original ]( elems ); + + // Support: Android <=4.0 only, PhantomJS 1 only + // .get() because push.apply(_, arraylike) throws on ancient WebKit + push.apply( ret, elems.get() ); + } + + return this.pushStack( ret ); + }; +} ); +var rnumnonpx = new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" ); + +var getStyles = function( elem ) { + + // Support: IE <=11 only, Firefox <=30 (#15098, #14150) + // IE throws on elements created in popups + // FF meanwhile throws on frame elements through "defaultView.getComputedStyle" + var view = elem.ownerDocument.defaultView; + + if ( !view || !view.opener ) { + view = window; + } + + return view.getComputedStyle( elem ); + }; + +var swap = function( elem, options, callback ) { + var ret, name, + old = {}; + + // Remember the old values, and insert the new ones + for ( name in options ) { + old[ name ] = elem.style[ name ]; + elem.style[ name ] = options[ name ]; + } + + ret = callback.call( elem ); + + // Revert the old values + for ( name in options ) { + elem.style[ name ] = old[ name ]; + } + + return ret; +}; + + +var rboxStyle = new RegExp( cssExpand.join( "|" ), "i" ); + + + +( function() { + + // Executing both pixelPosition & boxSizingReliable tests require only one layout + // so they're executed at the same time to save the second computation. + function computeStyleTests() { + + // This is a singleton, we need to execute it only once + if ( !div ) { + return; + } + + container.style.cssText = "position:absolute;left:-11111px;width:60px;" + + "margin-top:1px;padding:0;border:0"; + div.style.cssText = + "position:relative;display:block;box-sizing:border-box;overflow:scroll;" + + "margin:auto;border:1px;padding:1px;" + + "width:60%;top:1%"; + documentElement.appendChild( container ).appendChild( div ); + + var divStyle = window.getComputedStyle( div ); + pixelPositionVal = divStyle.top !== "1%"; + + // Support: Android 4.0 - 4.3 only, Firefox <=3 - 44 + reliableMarginLeftVal = roundPixelMeasures( divStyle.marginLeft ) === 12; + + // Support: Android 4.0 - 4.3 only, Safari <=9.1 - 10.1, iOS <=7.0 - 9.3 + // Some styles come back with percentage values, even though they shouldn't + div.style.right = "60%"; + pixelBoxStylesVal = roundPixelMeasures( divStyle.right ) === 36; + + // Support: IE 9 - 11 only + // Detect misreporting of content dimensions for box-sizing:border-box elements + boxSizingReliableVal = roundPixelMeasures( divStyle.width ) === 36; + + // Support: IE 9 only + // Detect overflow:scroll screwiness (gh-3699) + // Support: Chrome <=64 + // Don't get tricked when zoom affects offsetWidth (gh-4029) + div.style.position = "absolute"; + scrollboxSizeVal = roundPixelMeasures( div.offsetWidth / 3 ) === 12; + + documentElement.removeChild( container ); + + // Nullify the div so it wouldn't be stored in the memory and + // it will also be a sign that checks already performed + div = null; + } + + function roundPixelMeasures( measure ) { + return Math.round( parseFloat( measure ) ); + } + + var pixelPositionVal, boxSizingReliableVal, scrollboxSizeVal, pixelBoxStylesVal, + reliableTrDimensionsVal, reliableMarginLeftVal, + container = document.createElement( "div" ), + div = document.createElement( "div" ); + + // Finish early in limited (non-browser) environments + if ( !div.style ) { + return; + } + + // Support: IE <=9 - 11 only + // Style of cloned element affects source element cloned (#8908) + div.style.backgroundClip = "content-box"; + div.cloneNode( true ).style.backgroundClip = ""; + support.clearCloneStyle = div.style.backgroundClip === "content-box"; + + jQuery.extend( support, { + boxSizingReliable: function() { + computeStyleTests(); + return boxSizingReliableVal; + }, + pixelBoxStyles: function() { + computeStyleTests(); + return pixelBoxStylesVal; + }, + pixelPosition: function() { + computeStyleTests(); + return pixelPositionVal; + }, + reliableMarginLeft: function() { + computeStyleTests(); + return reliableMarginLeftVal; + }, + scrollboxSize: function() { + computeStyleTests(); + return scrollboxSizeVal; + }, + + // Support: IE 9 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Behavior in IE 9 is more subtle than in newer versions & it passes + // some versions of this test; make sure not to make it pass there! + // + // Support: Firefox 70+ + // Only Firefox includes border widths + // in computed dimensions. (gh-4529) + reliableTrDimensions: function() { + var table, tr, trChild, trStyle; + if ( reliableTrDimensionsVal == null ) { + table = document.createElement( "table" ); + tr = document.createElement( "tr" ); + trChild = document.createElement( "div" ); + + table.style.cssText = "position:absolute;left:-11111px;border-collapse:separate"; + tr.style.cssText = "border:1px solid"; + + // Support: Chrome 86+ + // Height set through cssText does not get applied. + // Computed height then comes back as 0. + tr.style.height = "1px"; + trChild.style.height = "9px"; + + // Support: Android 8 Chrome 86+ + // In our bodyBackground.html iframe, + // display for all div elements is set to "inline", + // which causes a problem only in Android 8 Chrome 86. + // Ensuring the div is display: block + // gets around this issue. + trChild.style.display = "block"; + + documentElement + .appendChild( table ) + .appendChild( tr ) + .appendChild( trChild ); + + trStyle = window.getComputedStyle( tr ); + reliableTrDimensionsVal = ( parseInt( trStyle.height, 10 ) + + parseInt( trStyle.borderTopWidth, 10 ) + + parseInt( trStyle.borderBottomWidth, 10 ) ) === tr.offsetHeight; + + documentElement.removeChild( table ); + } + return reliableTrDimensionsVal; + } + } ); +} )(); + + +function curCSS( elem, name, computed ) { + var width, minWidth, maxWidth, ret, + + // Support: Firefox 51+ + // Retrieving style before computed somehow + // fixes an issue with getting wrong values + // on detached elements + style = elem.style; + + computed = computed || getStyles( elem ); + + // getPropertyValue is needed for: + // .css('filter') (IE 9 only, #12537) + // .css('--customProperty) (#3144) + if ( computed ) { + ret = computed.getPropertyValue( name ) || computed[ name ]; + + if ( ret === "" && !isAttached( elem ) ) { + ret = jQuery.style( elem, name ); + } + + // A tribute to the "awesome hack by Dean Edwards" + // Android Browser returns percentage for some values, + // but width seems to be reliably pixels. + // This is against the CSSOM draft spec: + // https://drafts.csswg.org/cssom/#resolved-values + if ( !support.pixelBoxStyles() && rnumnonpx.test( ret ) && rboxStyle.test( name ) ) { + + // Remember the original values + width = style.width; + minWidth = style.minWidth; + maxWidth = style.maxWidth; + + // Put in the new values to get a computed value out + style.minWidth = style.maxWidth = style.width = ret; + ret = computed.width; + + // Revert the changed values + style.width = width; + style.minWidth = minWidth; + style.maxWidth = maxWidth; + } + } + + return ret !== undefined ? + + // Support: IE <=9 - 11 only + // IE returns zIndex value as an integer. + ret + "" : + ret; +} + + +function addGetHookIf( conditionFn, hookFn ) { + + // Define the hook, we'll check on the first run if it's really needed. + return { + get: function() { + if ( conditionFn() ) { + + // Hook not needed (or it's not possible to use it due + // to missing dependency), remove it. + delete this.get; + return; + } + + // Hook needed; redefine it so that the support test is not executed again. + return ( this.get = hookFn ).apply( this, arguments ); + } + }; +} + + +var cssPrefixes = [ "Webkit", "Moz", "ms" ], + emptyStyle = document.createElement( "div" ).style, + vendorProps = {}; + +// Return a vendor-prefixed property or undefined +function vendorPropName( name ) { + + // Check for vendor prefixed names + var capName = name[ 0 ].toUpperCase() + name.slice( 1 ), + i = cssPrefixes.length; + + while ( i-- ) { + name = cssPrefixes[ i ] + capName; + if ( name in emptyStyle ) { + return name; + } + } +} + +// Return a potentially-mapped jQuery.cssProps or vendor prefixed property +function finalPropName( name ) { + var final = jQuery.cssProps[ name ] || vendorProps[ name ]; + + if ( final ) { + return final; + } + if ( name in emptyStyle ) { + return name; + } + return vendorProps[ name ] = vendorPropName( name ) || name; +} + + +var + + // Swappable if display is none or starts with table + // except "table", "table-cell", or "table-caption" + // See here for display values: https://developer.mozilla.org/en-US/docs/CSS/display + rdisplayswap = /^(none|table(?!-c[ea]).+)/, + rcustomProp = /^--/, + cssShow = { position: "absolute", visibility: "hidden", display: "block" }, + cssNormalTransform = { + letterSpacing: "0", + fontWeight: "400" + }; + +function setPositiveNumber( _elem, value, subtract ) { + + // Any relative (+/-) values have already been + // normalized at this point + var matches = rcssNum.exec( value ); + return matches ? + + // Guard against undefined "subtract", e.g., when used as in cssHooks + Math.max( 0, matches[ 2 ] - ( subtract || 0 ) ) + ( matches[ 3 ] || "px" ) : + value; +} + +function boxModelAdjustment( elem, dimension, box, isBorderBox, styles, computedVal ) { + var i = dimension === "width" ? 1 : 0, + extra = 0, + delta = 0; + + // Adjustment may not be necessary + if ( box === ( isBorderBox ? "border" : "content" ) ) { + return 0; + } + + for ( ; i < 4; i += 2 ) { + + // Both box models exclude margin + if ( box === "margin" ) { + delta += jQuery.css( elem, box + cssExpand[ i ], true, styles ); + } + + // If we get here with a content-box, we're seeking "padding" or "border" or "margin" + if ( !isBorderBox ) { + + // Add padding + delta += jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + + // For "border" or "margin", add border + if ( box !== "padding" ) { + delta += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + + // But still keep track of it otherwise + } else { + extra += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + + // If we get here with a border-box (content + padding + border), we're seeking "content" or + // "padding" or "margin" + } else { + + // For "content", subtract padding + if ( box === "content" ) { + delta -= jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + } + + // For "content" or "padding", subtract border + if ( box !== "margin" ) { + delta -= jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + } + } + + // Account for positive content-box scroll gutter when requested by providing computedVal + if ( !isBorderBox && computedVal >= 0 ) { + + // offsetWidth/offsetHeight is a rounded sum of content, padding, scroll gutter, and border + // Assuming integer scroll gutter, subtract the rest and round down + delta += Math.max( 0, Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + computedVal - + delta - + extra - + 0.5 + + // If offsetWidth/offsetHeight is unknown, then we can't determine content-box scroll gutter + // Use an explicit zero to avoid NaN (gh-3964) + ) ) || 0; + } + + return delta; +} + +function getWidthOrHeight( elem, dimension, extra ) { + + // Start with computed style + var styles = getStyles( elem ), + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-4322). + // Fake content-box until we know it's needed to know the true value. + boxSizingNeeded = !support.boxSizingReliable() || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + valueIsBorderBox = isBorderBox, + + val = curCSS( elem, dimension, styles ), + offsetProp = "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ); + + // Support: Firefox <=54 + // Return a confounding non-pixel value or feign ignorance, as appropriate. + if ( rnumnonpx.test( val ) ) { + if ( !extra ) { + return val; + } + val = "auto"; + } + + + // Support: IE 9 - 11 only + // Use offsetWidth/offsetHeight for when box sizing is unreliable. + // In those cases, the computed value can be trusted to be border-box. + if ( ( !support.boxSizingReliable() && isBorderBox || + + // Support: IE 10 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Interestingly, in some cases IE 9 doesn't suffer from this issue. + !support.reliableTrDimensions() && nodeName( elem, "tr" ) || + + // Fall back to offsetWidth/offsetHeight when value is "auto" + // This happens for inline elements with no explicit setting (gh-3571) + val === "auto" || + + // Support: Android <=4.1 - 4.3 only + // Also use offsetWidth/offsetHeight for misreported inline dimensions (gh-3602) + !parseFloat( val ) && jQuery.css( elem, "display", false, styles ) === "inline" ) && + + // Make sure the element is visible & connected + elem.getClientRects().length ) { + + isBorderBox = jQuery.css( elem, "boxSizing", false, styles ) === "border-box"; + + // Where available, offsetWidth/offsetHeight approximate border box dimensions. + // Where not available (e.g., SVG), assume unreliable box-sizing and interpret the + // retrieved value as a content box dimension. + valueIsBorderBox = offsetProp in elem; + if ( valueIsBorderBox ) { + val = elem[ offsetProp ]; + } + } + + // Normalize "" and auto + val = parseFloat( val ) || 0; + + // Adjust for the element's box model + return ( val + + boxModelAdjustment( + elem, + dimension, + extra || ( isBorderBox ? "border" : "content" ), + valueIsBorderBox, + styles, + + // Provide the current computed size to request scroll gutter calculation (gh-3589) + val + ) + ) + "px"; +} + +jQuery.extend( { + + // Add in style property hooks for overriding the default + // behavior of getting and setting a style property + cssHooks: { + opacity: { + get: function( elem, computed ) { + if ( computed ) { + + // We should always get a number back from opacity + var ret = curCSS( elem, "opacity" ); + return ret === "" ? "1" : ret; + } + } + } + }, + + // Don't automatically add "px" to these possibly-unitless properties + cssNumber: { + "animationIterationCount": true, + "columnCount": true, + "fillOpacity": true, + "flexGrow": true, + "flexShrink": true, + "fontWeight": true, + "gridArea": true, + "gridColumn": true, + "gridColumnEnd": true, + "gridColumnStart": true, + "gridRow": true, + "gridRowEnd": true, + "gridRowStart": true, + "lineHeight": true, + "opacity": true, + "order": true, + "orphans": true, + "widows": true, + "zIndex": true, + "zoom": true + }, + + // Add in properties whose names you wish to fix before + // setting or getting the value + cssProps: {}, + + // Get and set the style property on a DOM Node + style: function( elem, name, value, extra ) { + + // Don't set styles on text and comment nodes + if ( !elem || elem.nodeType === 3 || elem.nodeType === 8 || !elem.style ) { + return; + } + + // Make sure that we're working with the right name + var ret, type, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ), + style = elem.style; + + // Make sure that we're working with the right name. We don't + // want to query the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Gets hook for the prefixed version, then unprefixed version + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // Check if we're setting a value + if ( value !== undefined ) { + type = typeof value; + + // Convert "+=" or "-=" to relative numbers (#7345) + if ( type === "string" && ( ret = rcssNum.exec( value ) ) && ret[ 1 ] ) { + value = adjustCSS( elem, name, ret ); + + // Fixes bug #9237 + type = "number"; + } + + // Make sure that null and NaN values aren't set (#7116) + if ( value == null || value !== value ) { + return; + } + + // If a number was passed in, add the unit (except for certain CSS properties) + // The isCustomProp check can be removed in jQuery 4.0 when we only auto-append + // "px" to a few hardcoded values. + if ( type === "number" && !isCustomProp ) { + value += ret && ret[ 3 ] || ( jQuery.cssNumber[ origName ] ? "" : "px" ); + } + + // background-* props affect original clone's values + if ( !support.clearCloneStyle && value === "" && name.indexOf( "background" ) === 0 ) { + style[ name ] = "inherit"; + } + + // If a hook was provided, use that value, otherwise just set the specified value + if ( !hooks || !( "set" in hooks ) || + ( value = hooks.set( elem, value, extra ) ) !== undefined ) { + + if ( isCustomProp ) { + style.setProperty( name, value ); + } else { + style[ name ] = value; + } + } + + } else { + + // If a hook was provided get the non-computed value from there + if ( hooks && "get" in hooks && + ( ret = hooks.get( elem, false, extra ) ) !== undefined ) { + + return ret; + } + + // Otherwise just get the value from the style object + return style[ name ]; + } + }, + + css: function( elem, name, extra, styles ) { + var val, num, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ); + + // Make sure that we're working with the right name. We don't + // want to modify the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Try prefixed name followed by the unprefixed name + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // If a hook was provided get the computed value from there + if ( hooks && "get" in hooks ) { + val = hooks.get( elem, true, extra ); + } + + // Otherwise, if a way to get the computed value exists, use that + if ( val === undefined ) { + val = curCSS( elem, name, styles ); + } + + // Convert "normal" to computed value + if ( val === "normal" && name in cssNormalTransform ) { + val = cssNormalTransform[ name ]; + } + + // Make numeric if forced or a qualifier was provided and val looks numeric + if ( extra === "" || extra ) { + num = parseFloat( val ); + return extra === true || isFinite( num ) ? num || 0 : val; + } + + return val; + } +} ); + +jQuery.each( [ "height", "width" ], function( _i, dimension ) { + jQuery.cssHooks[ dimension ] = { + get: function( elem, computed, extra ) { + if ( computed ) { + + // Certain elements can have dimension info if we invisibly show them + // but it must have a current display style that would benefit + return rdisplayswap.test( jQuery.css( elem, "display" ) ) && + + // Support: Safari 8+ + // Table columns in Safari have non-zero offsetWidth & zero + // getBoundingClientRect().width unless display is changed. + // Support: IE <=11 only + // Running getBoundingClientRect on a disconnected node + // in IE throws an error. + ( !elem.getClientRects().length || !elem.getBoundingClientRect().width ) ? + swap( elem, cssShow, function() { + return getWidthOrHeight( elem, dimension, extra ); + } ) : + getWidthOrHeight( elem, dimension, extra ); + } + }, + + set: function( elem, value, extra ) { + var matches, + styles = getStyles( elem ), + + // Only read styles.position if the test has a chance to fail + // to avoid forcing a reflow. + scrollboxSizeBuggy = !support.scrollboxSize() && + styles.position === "absolute", + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-3991) + boxSizingNeeded = scrollboxSizeBuggy || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + subtract = extra ? + boxModelAdjustment( + elem, + dimension, + extra, + isBorderBox, + styles + ) : + 0; + + // Account for unreliable border-box dimensions by comparing offset* to computed and + // faking a content-box to get border and padding (gh-3699) + if ( isBorderBox && scrollboxSizeBuggy ) { + subtract -= Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + parseFloat( styles[ dimension ] ) - + boxModelAdjustment( elem, dimension, "border", false, styles ) - + 0.5 + ); + } + + // Convert to pixels if value adjustment is needed + if ( subtract && ( matches = rcssNum.exec( value ) ) && + ( matches[ 3 ] || "px" ) !== "px" ) { + + elem.style[ dimension ] = value; + value = jQuery.css( elem, dimension ); + } + + return setPositiveNumber( elem, value, subtract ); + } + }; +} ); + +jQuery.cssHooks.marginLeft = addGetHookIf( support.reliableMarginLeft, + function( elem, computed ) { + if ( computed ) { + return ( parseFloat( curCSS( elem, "marginLeft" ) ) || + elem.getBoundingClientRect().left - + swap( elem, { marginLeft: 0 }, function() { + return elem.getBoundingClientRect().left; + } ) + ) + "px"; + } + } +); + +// These hooks are used by animate to expand properties +jQuery.each( { + margin: "", + padding: "", + border: "Width" +}, function( prefix, suffix ) { + jQuery.cssHooks[ prefix + suffix ] = { + expand: function( value ) { + var i = 0, + expanded = {}, + + // Assumes a single number if not a string + parts = typeof value === "string" ? value.split( " " ) : [ value ]; + + for ( ; i < 4; i++ ) { + expanded[ prefix + cssExpand[ i ] + suffix ] = + parts[ i ] || parts[ i - 2 ] || parts[ 0 ]; + } + + return expanded; + } + }; + + if ( prefix !== "margin" ) { + jQuery.cssHooks[ prefix + suffix ].set = setPositiveNumber; + } +} ); + +jQuery.fn.extend( { + css: function( name, value ) { + return access( this, function( elem, name, value ) { + var styles, len, + map = {}, + i = 0; + + if ( Array.isArray( name ) ) { + styles = getStyles( elem ); + len = name.length; + + for ( ; i < len; i++ ) { + map[ name[ i ] ] = jQuery.css( elem, name[ i ], false, styles ); + } + + return map; + } + + return value !== undefined ? + jQuery.style( elem, name, value ) : + jQuery.css( elem, name ); + }, name, value, arguments.length > 1 ); + } +} ); + + +function Tween( elem, options, prop, end, easing ) { + return new Tween.prototype.init( elem, options, prop, end, easing ); +} +jQuery.Tween = Tween; + +Tween.prototype = { + constructor: Tween, + init: function( elem, options, prop, end, easing, unit ) { + this.elem = elem; + this.prop = prop; + this.easing = easing || jQuery.easing._default; + this.options = options; + this.start = this.now = this.cur(); + this.end = end; + this.unit = unit || ( jQuery.cssNumber[ prop ] ? "" : "px" ); + }, + cur: function() { + var hooks = Tween.propHooks[ this.prop ]; + + return hooks && hooks.get ? + hooks.get( this ) : + Tween.propHooks._default.get( this ); + }, + run: function( percent ) { + var eased, + hooks = Tween.propHooks[ this.prop ]; + + if ( this.options.duration ) { + this.pos = eased = jQuery.easing[ this.easing ]( + percent, this.options.duration * percent, 0, 1, this.options.duration + ); + } else { + this.pos = eased = percent; + } + this.now = ( this.end - this.start ) * eased + this.start; + + if ( this.options.step ) { + this.options.step.call( this.elem, this.now, this ); + } + + if ( hooks && hooks.set ) { + hooks.set( this ); + } else { + Tween.propHooks._default.set( this ); + } + return this; + } +}; + +Tween.prototype.init.prototype = Tween.prototype; + +Tween.propHooks = { + _default: { + get: function( tween ) { + var result; + + // Use a property on the element directly when it is not a DOM element, + // or when there is no matching style property that exists. + if ( tween.elem.nodeType !== 1 || + tween.elem[ tween.prop ] != null && tween.elem.style[ tween.prop ] == null ) { + return tween.elem[ tween.prop ]; + } + + // Passing an empty string as a 3rd parameter to .css will automatically + // attempt a parseFloat and fallback to a string if the parse fails. + // Simple values such as "10px" are parsed to Float; + // complex values such as "rotate(1rad)" are returned as-is. + result = jQuery.css( tween.elem, tween.prop, "" ); + + // Empty strings, null, undefined and "auto" are converted to 0. + return !result || result === "auto" ? 0 : result; + }, + set: function( tween ) { + + // Use step hook for back compat. + // Use cssHook if its there. + // Use .style if available and use plain properties where available. + if ( jQuery.fx.step[ tween.prop ] ) { + jQuery.fx.step[ tween.prop ]( tween ); + } else if ( tween.elem.nodeType === 1 && ( + jQuery.cssHooks[ tween.prop ] || + tween.elem.style[ finalPropName( tween.prop ) ] != null ) ) { + jQuery.style( tween.elem, tween.prop, tween.now + tween.unit ); + } else { + tween.elem[ tween.prop ] = tween.now; + } + } + } +}; + +// Support: IE <=9 only +// Panic based approach to setting things on disconnected nodes +Tween.propHooks.scrollTop = Tween.propHooks.scrollLeft = { + set: function( tween ) { + if ( tween.elem.nodeType && tween.elem.parentNode ) { + tween.elem[ tween.prop ] = tween.now; + } + } +}; + +jQuery.easing = { + linear: function( p ) { + return p; + }, + swing: function( p ) { + return 0.5 - Math.cos( p * Math.PI ) / 2; + }, + _default: "swing" +}; + +jQuery.fx = Tween.prototype.init; + +// Back compat <1.8 extension point +jQuery.fx.step = {}; + + + + +var + fxNow, inProgress, + rfxtypes = /^(?:toggle|show|hide)$/, + rrun = /queueHooks$/; + +function schedule() { + if ( inProgress ) { + if ( document.hidden === false && window.requestAnimationFrame ) { + window.requestAnimationFrame( schedule ); + } else { + window.setTimeout( schedule, jQuery.fx.interval ); + } + + jQuery.fx.tick(); + } +} + +// Animations created synchronously will run synchronously +function createFxNow() { + window.setTimeout( function() { + fxNow = undefined; + } ); + return ( fxNow = Date.now() ); +} + +// Generate parameters to create a standard animation +function genFx( type, includeWidth ) { + var which, + i = 0, + attrs = { height: type }; + + // If we include width, step value is 1 to do all cssExpand values, + // otherwise step value is 2 to skip over Left and Right + includeWidth = includeWidth ? 1 : 0; + for ( ; i < 4; i += 2 - includeWidth ) { + which = cssExpand[ i ]; + attrs[ "margin" + which ] = attrs[ "padding" + which ] = type; + } + + if ( includeWidth ) { + attrs.opacity = attrs.width = type; + } + + return attrs; +} + +function createTween( value, prop, animation ) { + var tween, + collection = ( Animation.tweeners[ prop ] || [] ).concat( Animation.tweeners[ "*" ] ), + index = 0, + length = collection.length; + for ( ; index < length; index++ ) { + if ( ( tween = collection[ index ].call( animation, prop, value ) ) ) { + + // We're done with this property + return tween; + } + } +} + +function defaultPrefilter( elem, props, opts ) { + var prop, value, toggle, hooks, oldfire, propTween, restoreDisplay, display, + isBox = "width" in props || "height" in props, + anim = this, + orig = {}, + style = elem.style, + hidden = elem.nodeType && isHiddenWithinTree( elem ), + dataShow = dataPriv.get( elem, "fxshow" ); + + // Queue-skipping animations hijack the fx hooks + if ( !opts.queue ) { + hooks = jQuery._queueHooks( elem, "fx" ); + if ( hooks.unqueued == null ) { + hooks.unqueued = 0; + oldfire = hooks.empty.fire; + hooks.empty.fire = function() { + if ( !hooks.unqueued ) { + oldfire(); + } + }; + } + hooks.unqueued++; + + anim.always( function() { + + // Ensure the complete handler is called before this completes + anim.always( function() { + hooks.unqueued--; + if ( !jQuery.queue( elem, "fx" ).length ) { + hooks.empty.fire(); + } + } ); + } ); + } + + // Detect show/hide animations + for ( prop in props ) { + value = props[ prop ]; + if ( rfxtypes.test( value ) ) { + delete props[ prop ]; + toggle = toggle || value === "toggle"; + if ( value === ( hidden ? "hide" : "show" ) ) { + + // Pretend to be hidden if this is a "show" and + // there is still data from a stopped show/hide + if ( value === "show" && dataShow && dataShow[ prop ] !== undefined ) { + hidden = true; + + // Ignore all other no-op show/hide data + } else { + continue; + } + } + orig[ prop ] = dataShow && dataShow[ prop ] || jQuery.style( elem, prop ); + } + } + + // Bail out if this is a no-op like .hide().hide() + propTween = !jQuery.isEmptyObject( props ); + if ( !propTween && jQuery.isEmptyObject( orig ) ) { + return; + } + + // Restrict "overflow" and "display" styles during box animations + if ( isBox && elem.nodeType === 1 ) { + + // Support: IE <=9 - 11, Edge 12 - 15 + // Record all 3 overflow attributes because IE does not infer the shorthand + // from identically-valued overflowX and overflowY and Edge just mirrors + // the overflowX value there. + opts.overflow = [ style.overflow, style.overflowX, style.overflowY ]; + + // Identify a display type, preferring old show/hide data over the CSS cascade + restoreDisplay = dataShow && dataShow.display; + if ( restoreDisplay == null ) { + restoreDisplay = dataPriv.get( elem, "display" ); + } + display = jQuery.css( elem, "display" ); + if ( display === "none" ) { + if ( restoreDisplay ) { + display = restoreDisplay; + } else { + + // Get nonempty value(s) by temporarily forcing visibility + showHide( [ elem ], true ); + restoreDisplay = elem.style.display || restoreDisplay; + display = jQuery.css( elem, "display" ); + showHide( [ elem ] ); + } + } + + // Animate inline elements as inline-block + if ( display === "inline" || display === "inline-block" && restoreDisplay != null ) { + if ( jQuery.css( elem, "float" ) === "none" ) { + + // Restore the original display value at the end of pure show/hide animations + if ( !propTween ) { + anim.done( function() { + style.display = restoreDisplay; + } ); + if ( restoreDisplay == null ) { + display = style.display; + restoreDisplay = display === "none" ? "" : display; + } + } + style.display = "inline-block"; + } + } + } + + if ( opts.overflow ) { + style.overflow = "hidden"; + anim.always( function() { + style.overflow = opts.overflow[ 0 ]; + style.overflowX = opts.overflow[ 1 ]; + style.overflowY = opts.overflow[ 2 ]; + } ); + } + + // Implement show/hide animations + propTween = false; + for ( prop in orig ) { + + // General show/hide setup for this element animation + if ( !propTween ) { + if ( dataShow ) { + if ( "hidden" in dataShow ) { + hidden = dataShow.hidden; + } + } else { + dataShow = dataPriv.access( elem, "fxshow", { display: restoreDisplay } ); + } + + // Store hidden/visible for toggle so `.stop().toggle()` "reverses" + if ( toggle ) { + dataShow.hidden = !hidden; + } + + // Show elements before animating them + if ( hidden ) { + showHide( [ elem ], true ); + } + + /* eslint-disable no-loop-func */ + + anim.done( function() { + + /* eslint-enable no-loop-func */ + + // The final step of a "hide" animation is actually hiding the element + if ( !hidden ) { + showHide( [ elem ] ); + } + dataPriv.remove( elem, "fxshow" ); + for ( prop in orig ) { + jQuery.style( elem, prop, orig[ prop ] ); + } + } ); + } + + // Per-property setup + propTween = createTween( hidden ? dataShow[ prop ] : 0, prop, anim ); + if ( !( prop in dataShow ) ) { + dataShow[ prop ] = propTween.start; + if ( hidden ) { + propTween.end = propTween.start; + propTween.start = 0; + } + } + } +} + +function propFilter( props, specialEasing ) { + var index, name, easing, value, hooks; + + // camelCase, specialEasing and expand cssHook pass + for ( index in props ) { + name = camelCase( index ); + easing = specialEasing[ name ]; + value = props[ index ]; + if ( Array.isArray( value ) ) { + easing = value[ 1 ]; + value = props[ index ] = value[ 0 ]; + } + + if ( index !== name ) { + props[ name ] = value; + delete props[ index ]; + } + + hooks = jQuery.cssHooks[ name ]; + if ( hooks && "expand" in hooks ) { + value = hooks.expand( value ); + delete props[ name ]; + + // Not quite $.extend, this won't overwrite existing keys. + // Reusing 'index' because we have the correct "name" + for ( index in value ) { + if ( !( index in props ) ) { + props[ index ] = value[ index ]; + specialEasing[ index ] = easing; + } + } + } else { + specialEasing[ name ] = easing; + } + } +} + +function Animation( elem, properties, options ) { + var result, + stopped, + index = 0, + length = Animation.prefilters.length, + deferred = jQuery.Deferred().always( function() { + + // Don't match elem in the :animated selector + delete tick.elem; + } ), + tick = function() { + if ( stopped ) { + return false; + } + var currentTime = fxNow || createFxNow(), + remaining = Math.max( 0, animation.startTime + animation.duration - currentTime ), + + // Support: Android 2.3 only + // Archaic crash bug won't allow us to use `1 - ( 0.5 || 0 )` (#12497) + temp = remaining / animation.duration || 0, + percent = 1 - temp, + index = 0, + length = animation.tweens.length; + + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( percent ); + } + + deferred.notifyWith( elem, [ animation, percent, remaining ] ); + + // If there's more to do, yield + if ( percent < 1 && length ) { + return remaining; + } + + // If this was an empty animation, synthesize a final progress notification + if ( !length ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + } + + // Resolve the animation and report its conclusion + deferred.resolveWith( elem, [ animation ] ); + return false; + }, + animation = deferred.promise( { + elem: elem, + props: jQuery.extend( {}, properties ), + opts: jQuery.extend( true, { + specialEasing: {}, + easing: jQuery.easing._default + }, options ), + originalProperties: properties, + originalOptions: options, + startTime: fxNow || createFxNow(), + duration: options.duration, + tweens: [], + createTween: function( prop, end ) { + var tween = jQuery.Tween( elem, animation.opts, prop, end, + animation.opts.specialEasing[ prop ] || animation.opts.easing ); + animation.tweens.push( tween ); + return tween; + }, + stop: function( gotoEnd ) { + var index = 0, + + // If we are going to the end, we want to run all the tweens + // otherwise we skip this part + length = gotoEnd ? animation.tweens.length : 0; + if ( stopped ) { + return this; + } + stopped = true; + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( 1 ); + } + + // Resolve when we played the last frame; otherwise, reject + if ( gotoEnd ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + deferred.resolveWith( elem, [ animation, gotoEnd ] ); + } else { + deferred.rejectWith( elem, [ animation, gotoEnd ] ); + } + return this; + } + } ), + props = animation.props; + + propFilter( props, animation.opts.specialEasing ); + + for ( ; index < length; index++ ) { + result = Animation.prefilters[ index ].call( animation, elem, props, animation.opts ); + if ( result ) { + if ( isFunction( result.stop ) ) { + jQuery._queueHooks( animation.elem, animation.opts.queue ).stop = + result.stop.bind( result ); + } + return result; + } + } + + jQuery.map( props, createTween, animation ); + + if ( isFunction( animation.opts.start ) ) { + animation.opts.start.call( elem, animation ); + } + + // Attach callbacks from options + animation + .progress( animation.opts.progress ) + .done( animation.opts.done, animation.opts.complete ) + .fail( animation.opts.fail ) + .always( animation.opts.always ); + + jQuery.fx.timer( + jQuery.extend( tick, { + elem: elem, + anim: animation, + queue: animation.opts.queue + } ) + ); + + return animation; +} + +jQuery.Animation = jQuery.extend( Animation, { + + tweeners: { + "*": [ function( prop, value ) { + var tween = this.createTween( prop, value ); + adjustCSS( tween.elem, prop, rcssNum.exec( value ), tween ); + return tween; + } ] + }, + + tweener: function( props, callback ) { + if ( isFunction( props ) ) { + callback = props; + props = [ "*" ]; + } else { + props = props.match( rnothtmlwhite ); + } + + var prop, + index = 0, + length = props.length; + + for ( ; index < length; index++ ) { + prop = props[ index ]; + Animation.tweeners[ prop ] = Animation.tweeners[ prop ] || []; + Animation.tweeners[ prop ].unshift( callback ); + } + }, + + prefilters: [ defaultPrefilter ], + + prefilter: function( callback, prepend ) { + if ( prepend ) { + Animation.prefilters.unshift( callback ); + } else { + Animation.prefilters.push( callback ); + } + } +} ); + +jQuery.speed = function( speed, easing, fn ) { + var opt = speed && typeof speed === "object" ? jQuery.extend( {}, speed ) : { + complete: fn || !fn && easing || + isFunction( speed ) && speed, + duration: speed, + easing: fn && easing || easing && !isFunction( easing ) && easing + }; + + // Go to the end state if fx are off + if ( jQuery.fx.off ) { + opt.duration = 0; + + } else { + if ( typeof opt.duration !== "number" ) { + if ( opt.duration in jQuery.fx.speeds ) { + opt.duration = jQuery.fx.speeds[ opt.duration ]; + + } else { + opt.duration = jQuery.fx.speeds._default; + } + } + } + + // Normalize opt.queue - true/undefined/null -> "fx" + if ( opt.queue == null || opt.queue === true ) { + opt.queue = "fx"; + } + + // Queueing + opt.old = opt.complete; + + opt.complete = function() { + if ( isFunction( opt.old ) ) { + opt.old.call( this ); + } + + if ( opt.queue ) { + jQuery.dequeue( this, opt.queue ); + } + }; + + return opt; +}; + +jQuery.fn.extend( { + fadeTo: function( speed, to, easing, callback ) { + + // Show any hidden elements after setting opacity to 0 + return this.filter( isHiddenWithinTree ).css( "opacity", 0 ).show() + + // Animate to the value specified + .end().animate( { opacity: to }, speed, easing, callback ); + }, + animate: function( prop, speed, easing, callback ) { + var empty = jQuery.isEmptyObject( prop ), + optall = jQuery.speed( speed, easing, callback ), + doAnimation = function() { + + // Operate on a copy of prop so per-property easing won't be lost + var anim = Animation( this, jQuery.extend( {}, prop ), optall ); + + // Empty animations, or finishing resolves immediately + if ( empty || dataPriv.get( this, "finish" ) ) { + anim.stop( true ); + } + }; + + doAnimation.finish = doAnimation; + + return empty || optall.queue === false ? + this.each( doAnimation ) : + this.queue( optall.queue, doAnimation ); + }, + stop: function( type, clearQueue, gotoEnd ) { + var stopQueue = function( hooks ) { + var stop = hooks.stop; + delete hooks.stop; + stop( gotoEnd ); + }; + + if ( typeof type !== "string" ) { + gotoEnd = clearQueue; + clearQueue = type; + type = undefined; + } + if ( clearQueue ) { + this.queue( type || "fx", [] ); + } + + return this.each( function() { + var dequeue = true, + index = type != null && type + "queueHooks", + timers = jQuery.timers, + data = dataPriv.get( this ); + + if ( index ) { + if ( data[ index ] && data[ index ].stop ) { + stopQueue( data[ index ] ); + } + } else { + for ( index in data ) { + if ( data[ index ] && data[ index ].stop && rrun.test( index ) ) { + stopQueue( data[ index ] ); + } + } + } + + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && + ( type == null || timers[ index ].queue === type ) ) { + + timers[ index ].anim.stop( gotoEnd ); + dequeue = false; + timers.splice( index, 1 ); + } + } + + // Start the next in the queue if the last step wasn't forced. + // Timers currently will call their complete callbacks, which + // will dequeue but only if they were gotoEnd. + if ( dequeue || !gotoEnd ) { + jQuery.dequeue( this, type ); + } + } ); + }, + finish: function( type ) { + if ( type !== false ) { + type = type || "fx"; + } + return this.each( function() { + var index, + data = dataPriv.get( this ), + queue = data[ type + "queue" ], + hooks = data[ type + "queueHooks" ], + timers = jQuery.timers, + length = queue ? queue.length : 0; + + // Enable finishing flag on private data + data.finish = true; + + // Empty the queue first + jQuery.queue( this, type, [] ); + + if ( hooks && hooks.stop ) { + hooks.stop.call( this, true ); + } + + // Look for any active animations, and finish them + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && timers[ index ].queue === type ) { + timers[ index ].anim.stop( true ); + timers.splice( index, 1 ); + } + } + + // Look for any animations in the old queue and finish them + for ( index = 0; index < length; index++ ) { + if ( queue[ index ] && queue[ index ].finish ) { + queue[ index ].finish.call( this ); + } + } + + // Turn off finishing flag + delete data.finish; + } ); + } +} ); + +jQuery.each( [ "toggle", "show", "hide" ], function( _i, name ) { + var cssFn = jQuery.fn[ name ]; + jQuery.fn[ name ] = function( speed, easing, callback ) { + return speed == null || typeof speed === "boolean" ? + cssFn.apply( this, arguments ) : + this.animate( genFx( name, true ), speed, easing, callback ); + }; +} ); + +// Generate shortcuts for custom animations +jQuery.each( { + slideDown: genFx( "show" ), + slideUp: genFx( "hide" ), + slideToggle: genFx( "toggle" ), + fadeIn: { opacity: "show" }, + fadeOut: { opacity: "hide" }, + fadeToggle: { opacity: "toggle" } +}, function( name, props ) { + jQuery.fn[ name ] = function( speed, easing, callback ) { + return this.animate( props, speed, easing, callback ); + }; +} ); + +jQuery.timers = []; +jQuery.fx.tick = function() { + var timer, + i = 0, + timers = jQuery.timers; + + fxNow = Date.now(); + + for ( ; i < timers.length; i++ ) { + timer = timers[ i ]; + + // Run the timer and safely remove it when done (allowing for external removal) + if ( !timer() && timers[ i ] === timer ) { + timers.splice( i--, 1 ); + } + } + + if ( !timers.length ) { + jQuery.fx.stop(); + } + fxNow = undefined; +}; + +jQuery.fx.timer = function( timer ) { + jQuery.timers.push( timer ); + jQuery.fx.start(); +}; + +jQuery.fx.interval = 13; +jQuery.fx.start = function() { + if ( inProgress ) { + return; + } + + inProgress = true; + schedule(); +}; + +jQuery.fx.stop = function() { + inProgress = null; +}; + +jQuery.fx.speeds = { + slow: 600, + fast: 200, + + // Default speed + _default: 400 +}; + + +// Based off of the plugin by Clint Helfers, with permission. +// https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/ +jQuery.fn.delay = function( time, type ) { + time = jQuery.fx ? jQuery.fx.speeds[ time ] || time : time; + type = type || "fx"; + + return this.queue( type, function( next, hooks ) { + var timeout = window.setTimeout( next, time ); + hooks.stop = function() { + window.clearTimeout( timeout ); + }; + } ); +}; + + +( function() { + var input = document.createElement( "input" ), + select = document.createElement( "select" ), + opt = select.appendChild( document.createElement( "option" ) ); + + input.type = "checkbox"; + + // Support: Android <=4.3 only + // Default value for a checkbox should be "on" + support.checkOn = input.value !== ""; + + // Support: IE <=11 only + // Must access selectedIndex to make default options select + support.optSelected = opt.selected; + + // Support: IE <=11 only + // An input loses its value after becoming a radio + input = document.createElement( "input" ); + input.value = "t"; + input.type = "radio"; + support.radioValue = input.value === "t"; +} )(); + + +var boolHook, + attrHandle = jQuery.expr.attrHandle; + +jQuery.fn.extend( { + attr: function( name, value ) { + return access( this, jQuery.attr, name, value, arguments.length > 1 ); + }, + + removeAttr: function( name ) { + return this.each( function() { + jQuery.removeAttr( this, name ); + } ); + } +} ); + +jQuery.extend( { + attr: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set attributes on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + // Fallback to prop when attributes are not supported + if ( typeof elem.getAttribute === "undefined" ) { + return jQuery.prop( elem, name, value ); + } + + // Attribute hooks are determined by the lowercase version + // Grab necessary hook if one is defined + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + hooks = jQuery.attrHooks[ name.toLowerCase() ] || + ( jQuery.expr.match.bool.test( name ) ? boolHook : undefined ); + } + + if ( value !== undefined ) { + if ( value === null ) { + jQuery.removeAttr( elem, name ); + return; + } + + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + elem.setAttribute( name, value + "" ); + return value; + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + ret = jQuery.find.attr( elem, name ); + + // Non-existent attributes return null, we normalize to undefined + return ret == null ? undefined : ret; + }, + + attrHooks: { + type: { + set: function( elem, value ) { + if ( !support.radioValue && value === "radio" && + nodeName( elem, "input" ) ) { + var val = elem.value; + elem.setAttribute( "type", value ); + if ( val ) { + elem.value = val; + } + return value; + } + } + } + }, + + removeAttr: function( elem, value ) { + var name, + i = 0, + + // Attribute names can contain non-HTML whitespace characters + // https://html.spec.whatwg.org/multipage/syntax.html#attributes-2 + attrNames = value && value.match( rnothtmlwhite ); + + if ( attrNames && elem.nodeType === 1 ) { + while ( ( name = attrNames[ i++ ] ) ) { + elem.removeAttribute( name ); + } + } + } +} ); + +// Hooks for boolean attributes +boolHook = { + set: function( elem, value, name ) { + if ( value === false ) { + + // Remove boolean attributes when set to false + jQuery.removeAttr( elem, name ); + } else { + elem.setAttribute( name, name ); + } + return name; + } +}; + +jQuery.each( jQuery.expr.match.bool.source.match( /\w+/g ), function( _i, name ) { + var getter = attrHandle[ name ] || jQuery.find.attr; + + attrHandle[ name ] = function( elem, name, isXML ) { + var ret, handle, + lowercaseName = name.toLowerCase(); + + if ( !isXML ) { + + // Avoid an infinite loop by temporarily removing this function from the getter + handle = attrHandle[ lowercaseName ]; + attrHandle[ lowercaseName ] = ret; + ret = getter( elem, name, isXML ) != null ? + lowercaseName : + null; + attrHandle[ lowercaseName ] = handle; + } + return ret; + }; +} ); + + + + +var rfocusable = /^(?:input|select|textarea|button)$/i, + rclickable = /^(?:a|area)$/i; + +jQuery.fn.extend( { + prop: function( name, value ) { + return access( this, jQuery.prop, name, value, arguments.length > 1 ); + }, + + removeProp: function( name ) { + return this.each( function() { + delete this[ jQuery.propFix[ name ] || name ]; + } ); + } +} ); + +jQuery.extend( { + prop: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set properties on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + + // Fix name and attach hooks + name = jQuery.propFix[ name ] || name; + hooks = jQuery.propHooks[ name ]; + } + + if ( value !== undefined ) { + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + return ( elem[ name ] = value ); + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + return elem[ name ]; + }, + + propHooks: { + tabIndex: { + get: function( elem ) { + + // Support: IE <=9 - 11 only + // elem.tabIndex doesn't always return the + // correct value when it hasn't been explicitly set + // https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/ + // Use proper attribute retrieval(#12072) + var tabindex = jQuery.find.attr( elem, "tabindex" ); + + if ( tabindex ) { + return parseInt( tabindex, 10 ); + } + + if ( + rfocusable.test( elem.nodeName ) || + rclickable.test( elem.nodeName ) && + elem.href + ) { + return 0; + } + + return -1; + } + } + }, + + propFix: { + "for": "htmlFor", + "class": "className" + } +} ); + +// Support: IE <=11 only +// Accessing the selectedIndex property +// forces the browser to respect setting selected +// on the option +// The getter ensures a default option is selected +// when in an optgroup +// eslint rule "no-unused-expressions" is disabled for this code +// since it considers such accessions noop +if ( !support.optSelected ) { + jQuery.propHooks.selected = { + get: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent && parent.parentNode ) { + parent.parentNode.selectedIndex; + } + return null; + }, + set: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent ) { + parent.selectedIndex; + + if ( parent.parentNode ) { + parent.parentNode.selectedIndex; + } + } + } + }; +} + +jQuery.each( [ + "tabIndex", + "readOnly", + "maxLength", + "cellSpacing", + "cellPadding", + "rowSpan", + "colSpan", + "useMap", + "frameBorder", + "contentEditable" +], function() { + jQuery.propFix[ this.toLowerCase() ] = this; +} ); + + + + + // Strip and collapse whitespace according to HTML spec + // https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace + function stripAndCollapse( value ) { + var tokens = value.match( rnothtmlwhite ) || []; + return tokens.join( " " ); + } + + +function getClass( elem ) { + return elem.getAttribute && elem.getAttribute( "class" ) || ""; +} + +function classesToArray( value ) { + if ( Array.isArray( value ) ) { + return value; + } + if ( typeof value === "string" ) { + return value.match( rnothtmlwhite ) || []; + } + return []; +} + +jQuery.fn.extend( { + addClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).addClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + if ( cur.indexOf( " " + clazz + " " ) < 0 ) { + cur += clazz + " "; + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + removeClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).removeClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + if ( !arguments.length ) { + return this.attr( "class", "" ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + + // This expression is here for better compressibility (see addClass) + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + + // Remove *all* instances + while ( cur.indexOf( " " + clazz + " " ) > -1 ) { + cur = cur.replace( " " + clazz + " ", " " ); + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + toggleClass: function( value, stateVal ) { + var type = typeof value, + isValidValue = type === "string" || Array.isArray( value ); + + if ( typeof stateVal === "boolean" && isValidValue ) { + return stateVal ? this.addClass( value ) : this.removeClass( value ); + } + + if ( isFunction( value ) ) { + return this.each( function( i ) { + jQuery( this ).toggleClass( + value.call( this, i, getClass( this ), stateVal ), + stateVal + ); + } ); + } + + return this.each( function() { + var className, i, self, classNames; + + if ( isValidValue ) { + + // Toggle individual class names + i = 0; + self = jQuery( this ); + classNames = classesToArray( value ); + + while ( ( className = classNames[ i++ ] ) ) { + + // Check each className given, space separated list + if ( self.hasClass( className ) ) { + self.removeClass( className ); + } else { + self.addClass( className ); + } + } + + // Toggle whole class name + } else if ( value === undefined || type === "boolean" ) { + className = getClass( this ); + if ( className ) { + + // Store className if set + dataPriv.set( this, "__className__", className ); + } + + // If the element has a class name or if we're passed `false`, + // then remove the whole classname (if there was one, the above saved it). + // Otherwise bring back whatever was previously saved (if anything), + // falling back to the empty string if nothing was stored. + if ( this.setAttribute ) { + this.setAttribute( "class", + className || value === false ? + "" : + dataPriv.get( this, "__className__" ) || "" + ); + } + } + } ); + }, + + hasClass: function( selector ) { + var className, elem, + i = 0; + + className = " " + selector + " "; + while ( ( elem = this[ i++ ] ) ) { + if ( elem.nodeType === 1 && + ( " " + stripAndCollapse( getClass( elem ) ) + " " ).indexOf( className ) > -1 ) { + return true; + } + } + + return false; + } +} ); + + + + +var rreturn = /\r/g; + +jQuery.fn.extend( { + val: function( value ) { + var hooks, ret, valueIsFunction, + elem = this[ 0 ]; + + if ( !arguments.length ) { + if ( elem ) { + hooks = jQuery.valHooks[ elem.type ] || + jQuery.valHooks[ elem.nodeName.toLowerCase() ]; + + if ( hooks && + "get" in hooks && + ( ret = hooks.get( elem, "value" ) ) !== undefined + ) { + return ret; + } + + ret = elem.value; + + // Handle most common string cases + if ( typeof ret === "string" ) { + return ret.replace( rreturn, "" ); + } + + // Handle cases where value is null/undef or number + return ret == null ? "" : ret; + } + + return; + } + + valueIsFunction = isFunction( value ); + + return this.each( function( i ) { + var val; + + if ( this.nodeType !== 1 ) { + return; + } + + if ( valueIsFunction ) { + val = value.call( this, i, jQuery( this ).val() ); + } else { + val = value; + } + + // Treat null/undefined as ""; convert numbers to string + if ( val == null ) { + val = ""; + + } else if ( typeof val === "number" ) { + val += ""; + + } else if ( Array.isArray( val ) ) { + val = jQuery.map( val, function( value ) { + return value == null ? "" : value + ""; + } ); + } + + hooks = jQuery.valHooks[ this.type ] || jQuery.valHooks[ this.nodeName.toLowerCase() ]; + + // If set returns undefined, fall back to normal setting + if ( !hooks || !( "set" in hooks ) || hooks.set( this, val, "value" ) === undefined ) { + this.value = val; + } + } ); + } +} ); + +jQuery.extend( { + valHooks: { + option: { + get: function( elem ) { + + var val = jQuery.find.attr( elem, "value" ); + return val != null ? + val : + + // Support: IE <=10 - 11 only + // option.text throws exceptions (#14686, #14858) + // Strip and collapse whitespace + // https://html.spec.whatwg.org/#strip-and-collapse-whitespace + stripAndCollapse( jQuery.text( elem ) ); + } + }, + select: { + get: function( elem ) { + var value, option, i, + options = elem.options, + index = elem.selectedIndex, + one = elem.type === "select-one", + values = one ? null : [], + max = one ? index + 1 : options.length; + + if ( index < 0 ) { + i = max; + + } else { + i = one ? index : 0; + } + + // Loop through all the selected options + for ( ; i < max; i++ ) { + option = options[ i ]; + + // Support: IE <=9 only + // IE8-9 doesn't update selected after form reset (#2551) + if ( ( option.selected || i === index ) && + + // Don't return options that are disabled or in a disabled optgroup + !option.disabled && + ( !option.parentNode.disabled || + !nodeName( option.parentNode, "optgroup" ) ) ) { + + // Get the specific value for the option + value = jQuery( option ).val(); + + // We don't need an array for one selects + if ( one ) { + return value; + } + + // Multi-Selects return an array + values.push( value ); + } + } + + return values; + }, + + set: function( elem, value ) { + var optionSet, option, + options = elem.options, + values = jQuery.makeArray( value ), + i = options.length; + + while ( i-- ) { + option = options[ i ]; + + /* eslint-disable no-cond-assign */ + + if ( option.selected = + jQuery.inArray( jQuery.valHooks.option.get( option ), values ) > -1 + ) { + optionSet = true; + } + + /* eslint-enable no-cond-assign */ + } + + // Force browsers to behave consistently when non-matching value is set + if ( !optionSet ) { + elem.selectedIndex = -1; + } + return values; + } + } + } +} ); + +// Radios and checkboxes getter/setter +jQuery.each( [ "radio", "checkbox" ], function() { + jQuery.valHooks[ this ] = { + set: function( elem, value ) { + if ( Array.isArray( value ) ) { + return ( elem.checked = jQuery.inArray( jQuery( elem ).val(), value ) > -1 ); + } + } + }; + if ( !support.checkOn ) { + jQuery.valHooks[ this ].get = function( elem ) { + return elem.getAttribute( "value" ) === null ? "on" : elem.value; + }; + } +} ); + + + + +// Return jQuery for attributes-only inclusion + + +support.focusin = "onfocusin" in window; + + +var rfocusMorph = /^(?:focusinfocus|focusoutblur)$/, + stopPropagationCallback = function( e ) { + e.stopPropagation(); + }; + +jQuery.extend( jQuery.event, { + + trigger: function( event, data, elem, onlyHandlers ) { + + var i, cur, tmp, bubbleType, ontype, handle, special, lastElement, + eventPath = [ elem || document ], + type = hasOwn.call( event, "type" ) ? event.type : event, + namespaces = hasOwn.call( event, "namespace" ) ? event.namespace.split( "." ) : []; + + cur = lastElement = tmp = elem = elem || document; + + // Don't do events on text and comment nodes + if ( elem.nodeType === 3 || elem.nodeType === 8 ) { + return; + } + + // focus/blur morphs to focusin/out; ensure we're not firing them right now + if ( rfocusMorph.test( type + jQuery.event.triggered ) ) { + return; + } + + if ( type.indexOf( "." ) > -1 ) { + + // Namespaced trigger; create a regexp to match event type in handle() + namespaces = type.split( "." ); + type = namespaces.shift(); + namespaces.sort(); + } + ontype = type.indexOf( ":" ) < 0 && "on" + type; + + // Caller can pass in a jQuery.Event object, Object, or just an event type string + event = event[ jQuery.expando ] ? + event : + new jQuery.Event( type, typeof event === "object" && event ); + + // Trigger bitmask: & 1 for native handlers; & 2 for jQuery (always true) + event.isTrigger = onlyHandlers ? 2 : 3; + event.namespace = namespaces.join( "." ); + event.rnamespace = event.namespace ? + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) : + null; + + // Clean up the event in case it is being reused + event.result = undefined; + if ( !event.target ) { + event.target = elem; + } + + // Clone any incoming data and prepend the event, creating the handler arg list + data = data == null ? + [ event ] : + jQuery.makeArray( data, [ event ] ); + + // Allow special events to draw outside the lines + special = jQuery.event.special[ type ] || {}; + if ( !onlyHandlers && special.trigger && special.trigger.apply( elem, data ) === false ) { + return; + } + + // Determine event propagation path in advance, per W3C events spec (#9951) + // Bubble up to document, then to window; watch for a global ownerDocument var (#9724) + if ( !onlyHandlers && !special.noBubble && !isWindow( elem ) ) { + + bubbleType = special.delegateType || type; + if ( !rfocusMorph.test( bubbleType + type ) ) { + cur = cur.parentNode; + } + for ( ; cur; cur = cur.parentNode ) { + eventPath.push( cur ); + tmp = cur; + } + + // Only add window if we got to document (e.g., not plain obj or detached DOM) + if ( tmp === ( elem.ownerDocument || document ) ) { + eventPath.push( tmp.defaultView || tmp.parentWindow || window ); + } + } + + // Fire handlers on the event path + i = 0; + while ( ( cur = eventPath[ i++ ] ) && !event.isPropagationStopped() ) { + lastElement = cur; + event.type = i > 1 ? + bubbleType : + special.bindType || type; + + // jQuery handler + handle = ( dataPriv.get( cur, "events" ) || Object.create( null ) )[ event.type ] && + dataPriv.get( cur, "handle" ); + if ( handle ) { + handle.apply( cur, data ); + } + + // Native handler + handle = ontype && cur[ ontype ]; + if ( handle && handle.apply && acceptData( cur ) ) { + event.result = handle.apply( cur, data ); + if ( event.result === false ) { + event.preventDefault(); + } + } + } + event.type = type; + + // If nobody prevented the default action, do it now + if ( !onlyHandlers && !event.isDefaultPrevented() ) { + + if ( ( !special._default || + special._default.apply( eventPath.pop(), data ) === false ) && + acceptData( elem ) ) { + + // Call a native DOM method on the target with the same name as the event. + // Don't do default actions on window, that's where global variables be (#6170) + if ( ontype && isFunction( elem[ type ] ) && !isWindow( elem ) ) { + + // Don't re-trigger an onFOO event when we call its FOO() method + tmp = elem[ ontype ]; + + if ( tmp ) { + elem[ ontype ] = null; + } + + // Prevent re-triggering of the same event, since we already bubbled it above + jQuery.event.triggered = type; + + if ( event.isPropagationStopped() ) { + lastElement.addEventListener( type, stopPropagationCallback ); + } + + elem[ type ](); + + if ( event.isPropagationStopped() ) { + lastElement.removeEventListener( type, stopPropagationCallback ); + } + + jQuery.event.triggered = undefined; + + if ( tmp ) { + elem[ ontype ] = tmp; + } + } + } + } + + return event.result; + }, + + // Piggyback on a donor event to simulate a different one + // Used only for `focus(in | out)` events + simulate: function( type, elem, event ) { + var e = jQuery.extend( + new jQuery.Event(), + event, + { + type: type, + isSimulated: true + } + ); + + jQuery.event.trigger( e, null, elem ); + } + +} ); + +jQuery.fn.extend( { + + trigger: function( type, data ) { + return this.each( function() { + jQuery.event.trigger( type, data, this ); + } ); + }, + triggerHandler: function( type, data ) { + var elem = this[ 0 ]; + if ( elem ) { + return jQuery.event.trigger( type, data, elem, true ); + } + } +} ); + + +// Support: Firefox <=44 +// Firefox doesn't have focus(in | out) events +// Related ticket - https://bugzilla.mozilla.org/show_bug.cgi?id=687787 +// +// Support: Chrome <=48 - 49, Safari <=9.0 - 9.1 +// focus(in | out) events fire after focus & blur events, +// which is spec violation - http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order +// Related ticket - https://bugs.chromium.org/p/chromium/issues/detail?id=449857 +if ( !support.focusin ) { + jQuery.each( { focus: "focusin", blur: "focusout" }, function( orig, fix ) { + + // Attach a single capturing handler on the document while someone wants focusin/focusout + var handler = function( event ) { + jQuery.event.simulate( fix, event.target, jQuery.event.fix( event ) ); + }; + + jQuery.event.special[ fix ] = { + setup: function() { + + // Handle: regular nodes (via `this.ownerDocument`), window + // (via `this.document`) & document (via `this`). + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ); + + if ( !attaches ) { + doc.addEventListener( orig, handler, true ); + } + dataPriv.access( doc, fix, ( attaches || 0 ) + 1 ); + }, + teardown: function() { + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ) - 1; + + if ( !attaches ) { + doc.removeEventListener( orig, handler, true ); + dataPriv.remove( doc, fix ); + + } else { + dataPriv.access( doc, fix, attaches ); + } + } + }; + } ); +} +var location = window.location; + +var nonce = { guid: Date.now() }; + +var rquery = ( /\?/ ); + + + +// Cross-browser xml parsing +jQuery.parseXML = function( data ) { + var xml, parserErrorElem; + if ( !data || typeof data !== "string" ) { + return null; + } + + // Support: IE 9 - 11 only + // IE throws on parseFromString with invalid input. + try { + xml = ( new window.DOMParser() ).parseFromString( data, "text/xml" ); + } catch ( e ) {} + + parserErrorElem = xml && xml.getElementsByTagName( "parsererror" )[ 0 ]; + if ( !xml || parserErrorElem ) { + jQuery.error( "Invalid XML: " + ( + parserErrorElem ? + jQuery.map( parserErrorElem.childNodes, function( el ) { + return el.textContent; + } ).join( "\n" ) : + data + ) ); + } + return xml; +}; + + +var + rbracket = /\[\]$/, + rCRLF = /\r?\n/g, + rsubmitterTypes = /^(?:submit|button|image|reset|file)$/i, + rsubmittable = /^(?:input|select|textarea|keygen)/i; + +function buildParams( prefix, obj, traditional, add ) { + var name; + + if ( Array.isArray( obj ) ) { + + // Serialize array item. + jQuery.each( obj, function( i, v ) { + if ( traditional || rbracket.test( prefix ) ) { + + // Treat each array item as a scalar. + add( prefix, v ); + + } else { + + // Item is non-scalar (array or object), encode its numeric index. + buildParams( + prefix + "[" + ( typeof v === "object" && v != null ? i : "" ) + "]", + v, + traditional, + add + ); + } + } ); + + } else if ( !traditional && toType( obj ) === "object" ) { + + // Serialize object item. + for ( name in obj ) { + buildParams( prefix + "[" + name + "]", obj[ name ], traditional, add ); + } + + } else { + + // Serialize scalar item. + add( prefix, obj ); + } +} + +// Serialize an array of form elements or a set of +// key/values into a query string +jQuery.param = function( a, traditional ) { + var prefix, + s = [], + add = function( key, valueOrFunction ) { + + // If value is a function, invoke it and use its return value + var value = isFunction( valueOrFunction ) ? + valueOrFunction() : + valueOrFunction; + + s[ s.length ] = encodeURIComponent( key ) + "=" + + encodeURIComponent( value == null ? "" : value ); + }; + + if ( a == null ) { + return ""; + } + + // If an array was passed in, assume that it is an array of form elements. + if ( Array.isArray( a ) || ( a.jquery && !jQuery.isPlainObject( a ) ) ) { + + // Serialize the form elements + jQuery.each( a, function() { + add( this.name, this.value ); + } ); + + } else { + + // If traditional, encode the "old" way (the way 1.3.2 or older + // did it), otherwise encode params recursively. + for ( prefix in a ) { + buildParams( prefix, a[ prefix ], traditional, add ); + } + } + + // Return the resulting serialization + return s.join( "&" ); +}; + +jQuery.fn.extend( { + serialize: function() { + return jQuery.param( this.serializeArray() ); + }, + serializeArray: function() { + return this.map( function() { + + // Can add propHook for "elements" to filter or add form elements + var elements = jQuery.prop( this, "elements" ); + return elements ? jQuery.makeArray( elements ) : this; + } ).filter( function() { + var type = this.type; + + // Use .is( ":disabled" ) so that fieldset[disabled] works + return this.name && !jQuery( this ).is( ":disabled" ) && + rsubmittable.test( this.nodeName ) && !rsubmitterTypes.test( type ) && + ( this.checked || !rcheckableType.test( type ) ); + } ).map( function( _i, elem ) { + var val = jQuery( this ).val(); + + if ( val == null ) { + return null; + } + + if ( Array.isArray( val ) ) { + return jQuery.map( val, function( val ) { + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ); + } + + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ).get(); + } +} ); + + +var + r20 = /%20/g, + rhash = /#.*$/, + rantiCache = /([?&])_=[^&]*/, + rheaders = /^(.*?):[ \t]*([^\r\n]*)$/mg, + + // #7653, #8125, #8152: local protocol detection + rlocalProtocol = /^(?:about|app|app-storage|.+-extension|file|res|widget):$/, + rnoContent = /^(?:GET|HEAD)$/, + rprotocol = /^\/\//, + + /* Prefilters + * 1) They are useful to introduce custom dataTypes (see ajax/jsonp.js for an example) + * 2) These are called: + * - BEFORE asking for a transport + * - AFTER param serialization (s.data is a string if s.processData is true) + * 3) key is the dataType + * 4) the catchall symbol "*" can be used + * 5) execution will start with transport dataType and THEN continue down to "*" if needed + */ + prefilters = {}, + + /* Transports bindings + * 1) key is the dataType + * 2) the catchall symbol "*" can be used + * 3) selection will start with transport dataType and THEN go to "*" if needed + */ + transports = {}, + + // Avoid comment-prolog char sequence (#10098); must appease lint and evade compression + allTypes = "*/".concat( "*" ), + + // Anchor tag for parsing the document origin + originAnchor = document.createElement( "a" ); + +originAnchor.href = location.href; + +// Base "constructor" for jQuery.ajaxPrefilter and jQuery.ajaxTransport +function addToPrefiltersOrTransports( structure ) { + + // dataTypeExpression is optional and defaults to "*" + return function( dataTypeExpression, func ) { + + if ( typeof dataTypeExpression !== "string" ) { + func = dataTypeExpression; + dataTypeExpression = "*"; + } + + var dataType, + i = 0, + dataTypes = dataTypeExpression.toLowerCase().match( rnothtmlwhite ) || []; + + if ( isFunction( func ) ) { + + // For each dataType in the dataTypeExpression + while ( ( dataType = dataTypes[ i++ ] ) ) { + + // Prepend if requested + if ( dataType[ 0 ] === "+" ) { + dataType = dataType.slice( 1 ) || "*"; + ( structure[ dataType ] = structure[ dataType ] || [] ).unshift( func ); + + // Otherwise append + } else { + ( structure[ dataType ] = structure[ dataType ] || [] ).push( func ); + } + } + } + }; +} + +// Base inspection function for prefilters and transports +function inspectPrefiltersOrTransports( structure, options, originalOptions, jqXHR ) { + + var inspected = {}, + seekingTransport = ( structure === transports ); + + function inspect( dataType ) { + var selected; + inspected[ dataType ] = true; + jQuery.each( structure[ dataType ] || [], function( _, prefilterOrFactory ) { + var dataTypeOrTransport = prefilterOrFactory( options, originalOptions, jqXHR ); + if ( typeof dataTypeOrTransport === "string" && + !seekingTransport && !inspected[ dataTypeOrTransport ] ) { + + options.dataTypes.unshift( dataTypeOrTransport ); + inspect( dataTypeOrTransport ); + return false; + } else if ( seekingTransport ) { + return !( selected = dataTypeOrTransport ); + } + } ); + return selected; + } + + return inspect( options.dataTypes[ 0 ] ) || !inspected[ "*" ] && inspect( "*" ); +} + +// A special extend for ajax options +// that takes "flat" options (not to be deep extended) +// Fixes #9887 +function ajaxExtend( target, src ) { + var key, deep, + flatOptions = jQuery.ajaxSettings.flatOptions || {}; + + for ( key in src ) { + if ( src[ key ] !== undefined ) { + ( flatOptions[ key ] ? target : ( deep || ( deep = {} ) ) )[ key ] = src[ key ]; + } + } + if ( deep ) { + jQuery.extend( true, target, deep ); + } + + return target; +} + +/* Handles responses to an ajax request: + * - finds the right dataType (mediates between content-type and expected dataType) + * - returns the corresponding response + */ +function ajaxHandleResponses( s, jqXHR, responses ) { + + var ct, type, finalDataType, firstDataType, + contents = s.contents, + dataTypes = s.dataTypes; + + // Remove auto dataType and get content-type in the process + while ( dataTypes[ 0 ] === "*" ) { + dataTypes.shift(); + if ( ct === undefined ) { + ct = s.mimeType || jqXHR.getResponseHeader( "Content-Type" ); + } + } + + // Check if we're dealing with a known content-type + if ( ct ) { + for ( type in contents ) { + if ( contents[ type ] && contents[ type ].test( ct ) ) { + dataTypes.unshift( type ); + break; + } + } + } + + // Check to see if we have a response for the expected dataType + if ( dataTypes[ 0 ] in responses ) { + finalDataType = dataTypes[ 0 ]; + } else { + + // Try convertible dataTypes + for ( type in responses ) { + if ( !dataTypes[ 0 ] || s.converters[ type + " " + dataTypes[ 0 ] ] ) { + finalDataType = type; + break; + } + if ( !firstDataType ) { + firstDataType = type; + } + } + + // Or just use first one + finalDataType = finalDataType || firstDataType; + } + + // If we found a dataType + // We add the dataType to the list if needed + // and return the corresponding response + if ( finalDataType ) { + if ( finalDataType !== dataTypes[ 0 ] ) { + dataTypes.unshift( finalDataType ); + } + return responses[ finalDataType ]; + } +} + +/* Chain conversions given the request and the original response + * Also sets the responseXXX fields on the jqXHR instance + */ +function ajaxConvert( s, response, jqXHR, isSuccess ) { + var conv2, current, conv, tmp, prev, + converters = {}, + + // Work with a copy of dataTypes in case we need to modify it for conversion + dataTypes = s.dataTypes.slice(); + + // Create converters map with lowercased keys + if ( dataTypes[ 1 ] ) { + for ( conv in s.converters ) { + converters[ conv.toLowerCase() ] = s.converters[ conv ]; + } + } + + current = dataTypes.shift(); + + // Convert to each sequential dataType + while ( current ) { + + if ( s.responseFields[ current ] ) { + jqXHR[ s.responseFields[ current ] ] = response; + } + + // Apply the dataFilter if provided + if ( !prev && isSuccess && s.dataFilter ) { + response = s.dataFilter( response, s.dataType ); + } + + prev = current; + current = dataTypes.shift(); + + if ( current ) { + + // There's only work to do if current dataType is non-auto + if ( current === "*" ) { + + current = prev; + + // Convert response if prev dataType is non-auto and differs from current + } else if ( prev !== "*" && prev !== current ) { + + // Seek a direct converter + conv = converters[ prev + " " + current ] || converters[ "* " + current ]; + + // If none found, seek a pair + if ( !conv ) { + for ( conv2 in converters ) { + + // If conv2 outputs current + tmp = conv2.split( " " ); + if ( tmp[ 1 ] === current ) { + + // If prev can be converted to accepted input + conv = converters[ prev + " " + tmp[ 0 ] ] || + converters[ "* " + tmp[ 0 ] ]; + if ( conv ) { + + // Condense equivalence converters + if ( conv === true ) { + conv = converters[ conv2 ]; + + // Otherwise, insert the intermediate dataType + } else if ( converters[ conv2 ] !== true ) { + current = tmp[ 0 ]; + dataTypes.unshift( tmp[ 1 ] ); + } + break; + } + } + } + } + + // Apply converter (if not an equivalence) + if ( conv !== true ) { + + // Unless errors are allowed to bubble, catch and return them + if ( conv && s.throws ) { + response = conv( response ); + } else { + try { + response = conv( response ); + } catch ( e ) { + return { + state: "parsererror", + error: conv ? e : "No conversion from " + prev + " to " + current + }; + } + } + } + } + } + } + + return { state: "success", data: response }; +} + +jQuery.extend( { + + // Counter for holding the number of active queries + active: 0, + + // Last-Modified header cache for next request + lastModified: {}, + etag: {}, + + ajaxSettings: { + url: location.href, + type: "GET", + isLocal: rlocalProtocol.test( location.protocol ), + global: true, + processData: true, + async: true, + contentType: "application/x-www-form-urlencoded; charset=UTF-8", + + /* + timeout: 0, + data: null, + dataType: null, + username: null, + password: null, + cache: null, + throws: false, + traditional: false, + headers: {}, + */ + + accepts: { + "*": allTypes, + text: "text/plain", + html: "text/html", + xml: "application/xml, text/xml", + json: "application/json, text/javascript" + }, + + contents: { + xml: /\bxml\b/, + html: /\bhtml/, + json: /\bjson\b/ + }, + + responseFields: { + xml: "responseXML", + text: "responseText", + json: "responseJSON" + }, + + // Data converters + // Keys separate source (or catchall "*") and destination types with a single space + converters: { + + // Convert anything to text + "* text": String, + + // Text to html (true = no transformation) + "text html": true, + + // Evaluate text as a json expression + "text json": JSON.parse, + + // Parse text as xml + "text xml": jQuery.parseXML + }, + + // For options that shouldn't be deep extended: + // you can add your own custom options here if + // and when you create one that shouldn't be + // deep extended (see ajaxExtend) + flatOptions: { + url: true, + context: true + } + }, + + // Creates a full fledged settings object into target + // with both ajaxSettings and settings fields. + // If target is omitted, writes into ajaxSettings. + ajaxSetup: function( target, settings ) { + return settings ? + + // Building a settings object + ajaxExtend( ajaxExtend( target, jQuery.ajaxSettings ), settings ) : + + // Extending ajaxSettings + ajaxExtend( jQuery.ajaxSettings, target ); + }, + + ajaxPrefilter: addToPrefiltersOrTransports( prefilters ), + ajaxTransport: addToPrefiltersOrTransports( transports ), + + // Main method + ajax: function( url, options ) { + + // If url is an object, simulate pre-1.5 signature + if ( typeof url === "object" ) { + options = url; + url = undefined; + } + + // Force options to be an object + options = options || {}; + + var transport, + + // URL without anti-cache param + cacheURL, + + // Response headers + responseHeadersString, + responseHeaders, + + // timeout handle + timeoutTimer, + + // Url cleanup var + urlAnchor, + + // Request state (becomes false upon send and true upon completion) + completed, + + // To know if global events are to be dispatched + fireGlobals, + + // Loop variable + i, + + // uncached part of the url + uncached, + + // Create the final options object + s = jQuery.ajaxSetup( {}, options ), + + // Callbacks context + callbackContext = s.context || s, + + // Context for global events is callbackContext if it is a DOM node or jQuery collection + globalEventContext = s.context && + ( callbackContext.nodeType || callbackContext.jquery ) ? + jQuery( callbackContext ) : + jQuery.event, + + // Deferreds + deferred = jQuery.Deferred(), + completeDeferred = jQuery.Callbacks( "once memory" ), + + // Status-dependent callbacks + statusCode = s.statusCode || {}, + + // Headers (they are sent all at once) + requestHeaders = {}, + requestHeadersNames = {}, + + // Default abort message + strAbort = "canceled", + + // Fake xhr + jqXHR = { + readyState: 0, + + // Builds headers hashtable if needed + getResponseHeader: function( key ) { + var match; + if ( completed ) { + if ( !responseHeaders ) { + responseHeaders = {}; + while ( ( match = rheaders.exec( responseHeadersString ) ) ) { + responseHeaders[ match[ 1 ].toLowerCase() + " " ] = + ( responseHeaders[ match[ 1 ].toLowerCase() + " " ] || [] ) + .concat( match[ 2 ] ); + } + } + match = responseHeaders[ key.toLowerCase() + " " ]; + } + return match == null ? null : match.join( ", " ); + }, + + // Raw string + getAllResponseHeaders: function() { + return completed ? responseHeadersString : null; + }, + + // Caches the header + setRequestHeader: function( name, value ) { + if ( completed == null ) { + name = requestHeadersNames[ name.toLowerCase() ] = + requestHeadersNames[ name.toLowerCase() ] || name; + requestHeaders[ name ] = value; + } + return this; + }, + + // Overrides response content-type header + overrideMimeType: function( type ) { + if ( completed == null ) { + s.mimeType = type; + } + return this; + }, + + // Status-dependent callbacks + statusCode: function( map ) { + var code; + if ( map ) { + if ( completed ) { + + // Execute the appropriate callbacks + jqXHR.always( map[ jqXHR.status ] ); + } else { + + // Lazy-add the new callbacks in a way that preserves old ones + for ( code in map ) { + statusCode[ code ] = [ statusCode[ code ], map[ code ] ]; + } + } + } + return this; + }, + + // Cancel the request + abort: function( statusText ) { + var finalText = statusText || strAbort; + if ( transport ) { + transport.abort( finalText ); + } + done( 0, finalText ); + return this; + } + }; + + // Attach deferreds + deferred.promise( jqXHR ); + + // Add protocol if not provided (prefilters might expect it) + // Handle falsy url in the settings object (#10093: consistency with old signature) + // We also use the url parameter if available + s.url = ( ( url || s.url || location.href ) + "" ) + .replace( rprotocol, location.protocol + "//" ); + + // Alias method option to type as per ticket #12004 + s.type = options.method || options.type || s.method || s.type; + + // Extract dataTypes list + s.dataTypes = ( s.dataType || "*" ).toLowerCase().match( rnothtmlwhite ) || [ "" ]; + + // A cross-domain request is in order when the origin doesn't match the current origin. + if ( s.crossDomain == null ) { + urlAnchor = document.createElement( "a" ); + + // Support: IE <=8 - 11, Edge 12 - 15 + // IE throws exception on accessing the href property if url is malformed, + // e.g. http://example.com:80x/ + try { + urlAnchor.href = s.url; + + // Support: IE <=8 - 11 only + // Anchor's host property isn't correctly set when s.url is relative + urlAnchor.href = urlAnchor.href; + s.crossDomain = originAnchor.protocol + "//" + originAnchor.host !== + urlAnchor.protocol + "//" + urlAnchor.host; + } catch ( e ) { + + // If there is an error parsing the URL, assume it is crossDomain, + // it can be rejected by the transport if it is invalid + s.crossDomain = true; + } + } + + // Convert data if not already a string + if ( s.data && s.processData && typeof s.data !== "string" ) { + s.data = jQuery.param( s.data, s.traditional ); + } + + // Apply prefilters + inspectPrefiltersOrTransports( prefilters, s, options, jqXHR ); + + // If request was aborted inside a prefilter, stop there + if ( completed ) { + return jqXHR; + } + + // We can fire global events as of now if asked to + // Don't fire events if jQuery.event is undefined in an AMD-usage scenario (#15118) + fireGlobals = jQuery.event && s.global; + + // Watch for a new set of requests + if ( fireGlobals && jQuery.active++ === 0 ) { + jQuery.event.trigger( "ajaxStart" ); + } + + // Uppercase the type + s.type = s.type.toUpperCase(); + + // Determine if request has content + s.hasContent = !rnoContent.test( s.type ); + + // Save the URL in case we're toying with the If-Modified-Since + // and/or If-None-Match header later on + // Remove hash to simplify url manipulation + cacheURL = s.url.replace( rhash, "" ); + + // More options handling for requests with no content + if ( !s.hasContent ) { + + // Remember the hash so we can put it back + uncached = s.url.slice( cacheURL.length ); + + // If data is available and should be processed, append data to url + if ( s.data && ( s.processData || typeof s.data === "string" ) ) { + cacheURL += ( rquery.test( cacheURL ) ? "&" : "?" ) + s.data; + + // #9682: remove data so that it's not used in an eventual retry + delete s.data; + } + + // Add or update anti-cache param if needed + if ( s.cache === false ) { + cacheURL = cacheURL.replace( rantiCache, "$1" ); + uncached = ( rquery.test( cacheURL ) ? "&" : "?" ) + "_=" + ( nonce.guid++ ) + + uncached; + } + + // Put hash and anti-cache on the URL that will be requested (gh-1732) + s.url = cacheURL + uncached; + + // Change '%20' to '+' if this is encoded form body content (gh-2658) + } else if ( s.data && s.processData && + ( s.contentType || "" ).indexOf( "application/x-www-form-urlencoded" ) === 0 ) { + s.data = s.data.replace( r20, "+" ); + } + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + if ( jQuery.lastModified[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-Modified-Since", jQuery.lastModified[ cacheURL ] ); + } + if ( jQuery.etag[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-None-Match", jQuery.etag[ cacheURL ] ); + } + } + + // Set the correct header, if data is being sent + if ( s.data && s.hasContent && s.contentType !== false || options.contentType ) { + jqXHR.setRequestHeader( "Content-Type", s.contentType ); + } + + // Set the Accepts header for the server, depending on the dataType + jqXHR.setRequestHeader( + "Accept", + s.dataTypes[ 0 ] && s.accepts[ s.dataTypes[ 0 ] ] ? + s.accepts[ s.dataTypes[ 0 ] ] + + ( s.dataTypes[ 0 ] !== "*" ? ", " + allTypes + "; q=0.01" : "" ) : + s.accepts[ "*" ] + ); + + // Check for headers option + for ( i in s.headers ) { + jqXHR.setRequestHeader( i, s.headers[ i ] ); + } + + // Allow custom headers/mimetypes and early abort + if ( s.beforeSend && + ( s.beforeSend.call( callbackContext, jqXHR, s ) === false || completed ) ) { + + // Abort if not done already and return + return jqXHR.abort(); + } + + // Aborting is no longer a cancellation + strAbort = "abort"; + + // Install callbacks on deferreds + completeDeferred.add( s.complete ); + jqXHR.done( s.success ); + jqXHR.fail( s.error ); + + // Get transport + transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR ); + + // If no transport, we auto-abort + if ( !transport ) { + done( -1, "No Transport" ); + } else { + jqXHR.readyState = 1; + + // Send global event + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxSend", [ jqXHR, s ] ); + } + + // If request was aborted inside ajaxSend, stop there + if ( completed ) { + return jqXHR; + } + + // Timeout + if ( s.async && s.timeout > 0 ) { + timeoutTimer = window.setTimeout( function() { + jqXHR.abort( "timeout" ); + }, s.timeout ); + } + + try { + completed = false; + transport.send( requestHeaders, done ); + } catch ( e ) { + + // Rethrow post-completion exceptions + if ( completed ) { + throw e; + } + + // Propagate others as results + done( -1, e ); + } + } + + // Callback for when everything is done + function done( status, nativeStatusText, responses, headers ) { + var isSuccess, success, error, response, modified, + statusText = nativeStatusText; + + // Ignore repeat invocations + if ( completed ) { + return; + } + + completed = true; + + // Clear timeout if it exists + if ( timeoutTimer ) { + window.clearTimeout( timeoutTimer ); + } + + // Dereference transport for early garbage collection + // (no matter how long the jqXHR object will be used) + transport = undefined; + + // Cache response headers + responseHeadersString = headers || ""; + + // Set readyState + jqXHR.readyState = status > 0 ? 4 : 0; + + // Determine if successful + isSuccess = status >= 200 && status < 300 || status === 304; + + // Get response data + if ( responses ) { + response = ajaxHandleResponses( s, jqXHR, responses ); + } + + // Use a noop converter for missing script but not if jsonp + if ( !isSuccess && + jQuery.inArray( "script", s.dataTypes ) > -1 && + jQuery.inArray( "json", s.dataTypes ) < 0 ) { + s.converters[ "text script" ] = function() {}; + } + + // Convert no matter what (that way responseXXX fields are always set) + response = ajaxConvert( s, response, jqXHR, isSuccess ); + + // If successful, handle type chaining + if ( isSuccess ) { + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + modified = jqXHR.getResponseHeader( "Last-Modified" ); + if ( modified ) { + jQuery.lastModified[ cacheURL ] = modified; + } + modified = jqXHR.getResponseHeader( "etag" ); + if ( modified ) { + jQuery.etag[ cacheURL ] = modified; + } + } + + // if no content + if ( status === 204 || s.type === "HEAD" ) { + statusText = "nocontent"; + + // if not modified + } else if ( status === 304 ) { + statusText = "notmodified"; + + // If we have data, let's convert it + } else { + statusText = response.state; + success = response.data; + error = response.error; + isSuccess = !error; + } + } else { + + // Extract error from statusText and normalize for non-aborts + error = statusText; + if ( status || !statusText ) { + statusText = "error"; + if ( status < 0 ) { + status = 0; + } + } + } + + // Set data for the fake xhr object + jqXHR.status = status; + jqXHR.statusText = ( nativeStatusText || statusText ) + ""; + + // Success/Error + if ( isSuccess ) { + deferred.resolveWith( callbackContext, [ success, statusText, jqXHR ] ); + } else { + deferred.rejectWith( callbackContext, [ jqXHR, statusText, error ] ); + } + + // Status-dependent callbacks + jqXHR.statusCode( statusCode ); + statusCode = undefined; + + if ( fireGlobals ) { + globalEventContext.trigger( isSuccess ? "ajaxSuccess" : "ajaxError", + [ jqXHR, s, isSuccess ? success : error ] ); + } + + // Complete + completeDeferred.fireWith( callbackContext, [ jqXHR, statusText ] ); + + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxComplete", [ jqXHR, s ] ); + + // Handle the global AJAX counter + if ( !( --jQuery.active ) ) { + jQuery.event.trigger( "ajaxStop" ); + } + } + } + + return jqXHR; + }, + + getJSON: function( url, data, callback ) { + return jQuery.get( url, data, callback, "json" ); + }, + + getScript: function( url, callback ) { + return jQuery.get( url, undefined, callback, "script" ); + } +} ); + +jQuery.each( [ "get", "post" ], function( _i, method ) { + jQuery[ method ] = function( url, data, callback, type ) { + + // Shift arguments if data argument was omitted + if ( isFunction( data ) ) { + type = type || callback; + callback = data; + data = undefined; + } + + // The url can be an options object (which then must have .url) + return jQuery.ajax( jQuery.extend( { + url: url, + type: method, + dataType: type, + data: data, + success: callback + }, jQuery.isPlainObject( url ) && url ) ); + }; +} ); + +jQuery.ajaxPrefilter( function( s ) { + var i; + for ( i in s.headers ) { + if ( i.toLowerCase() === "content-type" ) { + s.contentType = s.headers[ i ] || ""; + } + } +} ); + + +jQuery._evalUrl = function( url, options, doc ) { + return jQuery.ajax( { + url: url, + + // Make this explicit, since user can override this through ajaxSetup (#11264) + type: "GET", + dataType: "script", + cache: true, + async: false, + global: false, + + // Only evaluate the response if it is successful (gh-4126) + // dataFilter is not invoked for failure responses, so using it instead + // of the default converter is kludgy but it works. + converters: { + "text script": function() {} + }, + dataFilter: function( response ) { + jQuery.globalEval( response, options, doc ); + } + } ); +}; + + +jQuery.fn.extend( { + wrapAll: function( html ) { + var wrap; + + if ( this[ 0 ] ) { + if ( isFunction( html ) ) { + html = html.call( this[ 0 ] ); + } + + // The elements to wrap the target around + wrap = jQuery( html, this[ 0 ].ownerDocument ).eq( 0 ).clone( true ); + + if ( this[ 0 ].parentNode ) { + wrap.insertBefore( this[ 0 ] ); + } + + wrap.map( function() { + var elem = this; + + while ( elem.firstElementChild ) { + elem = elem.firstElementChild; + } + + return elem; + } ).append( this ); + } + + return this; + }, + + wrapInner: function( html ) { + if ( isFunction( html ) ) { + return this.each( function( i ) { + jQuery( this ).wrapInner( html.call( this, i ) ); + } ); + } + + return this.each( function() { + var self = jQuery( this ), + contents = self.contents(); + + if ( contents.length ) { + contents.wrapAll( html ); + + } else { + self.append( html ); + } + } ); + }, + + wrap: function( html ) { + var htmlIsFunction = isFunction( html ); + + return this.each( function( i ) { + jQuery( this ).wrapAll( htmlIsFunction ? html.call( this, i ) : html ); + } ); + }, + + unwrap: function( selector ) { + this.parent( selector ).not( "body" ).each( function() { + jQuery( this ).replaceWith( this.childNodes ); + } ); + return this; + } +} ); + + +jQuery.expr.pseudos.hidden = function( elem ) { + return !jQuery.expr.pseudos.visible( elem ); +}; +jQuery.expr.pseudos.visible = function( elem ) { + return !!( elem.offsetWidth || elem.offsetHeight || elem.getClientRects().length ); +}; + + + + +jQuery.ajaxSettings.xhr = function() { + try { + return new window.XMLHttpRequest(); + } catch ( e ) {} +}; + +var xhrSuccessStatus = { + + // File protocol always yields status code 0, assume 200 + 0: 200, + + // Support: IE <=9 only + // #1450: sometimes IE returns 1223 when it should be 204 + 1223: 204 + }, + xhrSupported = jQuery.ajaxSettings.xhr(); + +support.cors = !!xhrSupported && ( "withCredentials" in xhrSupported ); +support.ajax = xhrSupported = !!xhrSupported; + +jQuery.ajaxTransport( function( options ) { + var callback, errorCallback; + + // Cross domain only allowed if supported through XMLHttpRequest + if ( support.cors || xhrSupported && !options.crossDomain ) { + return { + send: function( headers, complete ) { + var i, + xhr = options.xhr(); + + xhr.open( + options.type, + options.url, + options.async, + options.username, + options.password + ); + + // Apply custom fields if provided + if ( options.xhrFields ) { + for ( i in options.xhrFields ) { + xhr[ i ] = options.xhrFields[ i ]; + } + } + + // Override mime type if needed + if ( options.mimeType && xhr.overrideMimeType ) { + xhr.overrideMimeType( options.mimeType ); + } + + // X-Requested-With header + // For cross-domain requests, seeing as conditions for a preflight are + // akin to a jigsaw puzzle, we simply never set it to be sure. + // (it can always be set on a per-request basis or even using ajaxSetup) + // For same-domain requests, won't change header if already provided. + if ( !options.crossDomain && !headers[ "X-Requested-With" ] ) { + headers[ "X-Requested-With" ] = "XMLHttpRequest"; + } + + // Set headers + for ( i in headers ) { + xhr.setRequestHeader( i, headers[ i ] ); + } + + // Callback + callback = function( type ) { + return function() { + if ( callback ) { + callback = errorCallback = xhr.onload = + xhr.onerror = xhr.onabort = xhr.ontimeout = + xhr.onreadystatechange = null; + + if ( type === "abort" ) { + xhr.abort(); + } else if ( type === "error" ) { + + // Support: IE <=9 only + // On a manual native abort, IE9 throws + // errors on any property access that is not readyState + if ( typeof xhr.status !== "number" ) { + complete( 0, "error" ); + } else { + complete( + + // File: protocol always yields status 0; see #8605, #14207 + xhr.status, + xhr.statusText + ); + } + } else { + complete( + xhrSuccessStatus[ xhr.status ] || xhr.status, + xhr.statusText, + + // Support: IE <=9 only + // IE9 has no XHR2 but throws on binary (trac-11426) + // For XHR2 non-text, let the caller handle it (gh-2498) + ( xhr.responseType || "text" ) !== "text" || + typeof xhr.responseText !== "string" ? + { binary: xhr.response } : + { text: xhr.responseText }, + xhr.getAllResponseHeaders() + ); + } + } + }; + }; + + // Listen to events + xhr.onload = callback(); + errorCallback = xhr.onerror = xhr.ontimeout = callback( "error" ); + + // Support: IE 9 only + // Use onreadystatechange to replace onabort + // to handle uncaught aborts + if ( xhr.onabort !== undefined ) { + xhr.onabort = errorCallback; + } else { + xhr.onreadystatechange = function() { + + // Check readyState before timeout as it changes + if ( xhr.readyState === 4 ) { + + // Allow onerror to be called first, + // but that will not handle a native abort + // Also, save errorCallback to a variable + // as xhr.onerror cannot be accessed + window.setTimeout( function() { + if ( callback ) { + errorCallback(); + } + } ); + } + }; + } + + // Create the abort callback + callback = callback( "abort" ); + + try { + + // Do send the request (this may raise an exception) + xhr.send( options.hasContent && options.data || null ); + } catch ( e ) { + + // #14683: Only rethrow if this hasn't been notified as an error yet + if ( callback ) { + throw e; + } + } + }, + + abort: function() { + if ( callback ) { + callback(); + } + } + }; + } +} ); + + + + +// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) +jQuery.ajaxPrefilter( function( s ) { + if ( s.crossDomain ) { + s.contents.script = false; + } +} ); + +// Install script dataType +jQuery.ajaxSetup( { + accepts: { + script: "text/javascript, application/javascript, " + + "application/ecmascript, application/x-ecmascript" + }, + contents: { + script: /\b(?:java|ecma)script\b/ + }, + converters: { + "text script": function( text ) { + jQuery.globalEval( text ); + return text; + } + } +} ); + +// Handle cache's special case and crossDomain +jQuery.ajaxPrefilter( "script", function( s ) { + if ( s.cache === undefined ) { + s.cache = false; + } + if ( s.crossDomain ) { + s.type = "GET"; + } +} ); + +// Bind script tag hack transport +jQuery.ajaxTransport( "script", function( s ) { + + // This transport only deals with cross domain or forced-by-attrs requests + if ( s.crossDomain || s.scriptAttrs ) { + var script, callback; + return { + send: function( _, complete ) { + script = jQuery( " +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Tabella attributi utente

    +

    La seguente tabella riporta l'elenco degli attributi utente supportati da SPID e/o CIE. La variable $PREFIX=https://attributes.eid.gov.it rappresenta il namespace.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato
    da

    $PREFIX/spid_code
    Categoria: anagrafica

    Codice identificativo. String. Il codice identificativo è assegnato dal gestore dell'identità digitale e deve essere univoco.

    +

    Il formato è il seguente: +<codice_Identificativo>=<cod_IdP><nr.univoco>

    +

    Dove:

    +
    +

    <cod_IdP>: è un codice composto da 4 lettere univocamente assegnato al gestore delle identità;

    +

    <nr.univoco>: è una stringa alfanumerica composta da 10 caratteri che il gestore delle identità genera in maniera univoca nell'ambito del proprio dominio.

    +
    +

    Esempio:

    +

    "$PREFIX/spid_code":"ABCD123456789A"

    +

    spid-icon

    given_name
    Categoria: anagrafica

    Nome. String. Stringa composta da una sequenza di parole con carattere iniziale maiuscolo, +intervallate da spazi singoli.

    +

    Esempio:

    +

    "given_name":"Giovanni Mario"

    +

    spid-icon cieid-icon

    family_name
    Categoria: anagrafica

    Cognome. String. Stringa composta da una sequenza di parole con carattere iniziale maiuscolo, +intervallate da spazi singoli.

    +

    Esempio:

    +

    "family_name":"Bianchi Verdi"

    +

    spid-icon cieid-icon

    place_of_birth
    Categoria: anagrafica

    Luogo di nascita, Provincia di nascita. JSON Object:

    +

    "locality : Stringa corrispondente al codice catastale (Codice Belfiore) del Comune +o della nazione estera di nascita (Es. "F205" per la città di Milano)

    +

    "region" : Stringa corrispondente alla sigla della provincia di nascita

    +

    Esempio:

    +
    "place_of_birth":{
    +    "region":"MI",
    +    "locality":"F205"
    +}
    +
    +
    +

    spid-icon cieid-icon

    birthdate
    Categoria: anagrafica

    Data di nascita. String. Secondo specifica ISO8601-2004 nel formato +YYYY indica l'anno utilizzando 4 cifre
    +MM indica il mese in (due) cifre
    +DD indica il giorno in (due) cifre
    +Esempio:

    +

    "birthdate":"2002-09-24"

    +

    spid-icon cieid-icon

    gender
    Categoria: anagrafica

    Sesso. String. Valori ammessi:
    +"female" per sesso femminile
    +"male" per sesso maschile
    +Esempio:

    +

    "gender":"female"

    +

    spid-icon cieid-icon

    $PREFIX/company_name
    Categoria: anagrafica

    Ragione o denominazione sociale. String. Stringa composta da una sequenza di parole intervallate +da spazi singoli. +In maiuscolo le sottostringhe corrispondenti a nomi (es. “Agenzia per l'Italia Digitale”)

    +
    "$PREFIX/company_name": "Agenzia per l'Italia Digitale"
    +
    +
    +

    spid-icon

    $PREFIX/registered_office
    Categoria: extra anagrafica

    Sede legale. JSON Object: formatted, street_address, locality, region, postal_code, country, +country_code. +Json composto da una stringa composta da una sequenza di parole intervallate da spazi singoli rappresentanti:

    +
      +
    • Tipologia( via, viale, piazza …)

    • +
    • Indirizzo

    • +
    • Nr.civico

    • +
    • CAP

    • +
    • Luogo

    • +
    • Provincia

    • +
    +

    la stringa è inserita nel claim "formatted" del JSON Object "address"

    +

    Esempio:

    +
    "$PREFIX/registered_office":{
    +    "formatted":"via Listz 21 00144 Roma"
    +}
    +
    +
    +

    spid-icon

    $PREFIX/fiscal_number
    Categoria: anagrafica

    Codice fiscale della persona fisica. String. Per il formato si faccia riferimento alla codifica +dell'attributo CF per i certificati, proposta nell'ambito del Draft ETSI EN 319 412-1, +che nel caso specifico prevede la seguente composizione: +TINIT-<CodiceFiscale>

    +

    Esempio:

    +

    "$PREFIX/fiscal_number":“TINIT-ABCXYZ00W00Z000Z"

    +

    spid-icon cieid-icon

    $PREFIX/company_fiscal_number
    Categoria: anagrafica

    Codice fiscale Persona Giuridica. String. Per il formato si faccia riferimento alla codifica dell'attributo CF per i certificati, proposta +nell'ambito del Draft ETSI EN 319 412-1, che nel caso specifico prevede la seguente composizione:

    +

    TINIT-segue il codice fiscale

    +

    Esempio:

    +

    "$PREFIX/company_fiscal_number":"TINIT-ABCXYZ00W00Z000Z"

    +

    spid-icon

    $PREFIX/vat_number
    Categoria: anagrafica

    Partita IVA. String. Per il formato si faccia riferimento alla codifica dell'attributo Partita IVA per i certificati, +proposta nell'ambito del Draft ETSI EN 319 412-1, che nel caso specifico prevede la seguente composizione:

    +

    VATIT-<PartitaIVA>

    +

    Esempio:

    +

    "$PREFIX/vat_number": "VATIT-12345678901"

    +

    spid-icon

    document_details
    Categoria: extra anagrafica

    Documento d'identità. JSON Object (document):

    +

    Json contenente le proprietà che rappresentano:

    +
    +
      +
    • "type" : valori ammessi:

      +
        +
      • cartaIdentita, passaporto, patenteGuida,

      • +
      • patenteNautica, librettoPensione,

      • +
      • patentinoImpTermici, portoArmi,

      • +
      • tesseraRiconoscimento;

      • +
      +
    • +
    • "document_number" : Numero del documento;

    • +
    • "issuer" : <ente emettitore> JSON Object:

      +
        +
      • "name" stringa ottenuta dalla +concatenazione dei termini costituenti la +denominazione dell'ente a meno di +congiunzioni, articoli e preposizioni.

        +
        +

        Es. regioneLazio ( Regione Lazio); +provinciaCatania ( Provincia di Catania); +prefetturaRoma (Prefettura di Roma); +MinisteroEconomiaFinanze ( Ministero +dell'Economia e delle Finanze);

        +
        +
      • +
      +
    • +
    • "date_of_issuance" : data di rilascio del documento;

    • +
    • "date_of_expiry" : data di scadenza del documento;

    • +
    +
    +

    Esempio:

    +
    "document_details":{
    +    "type":"cartaIdentita",
    +    "document_number":"AS09452389",
    +    "issuer":{
    +        "name":"ComuneRoma"
    +    },
    +    "date_of_issuance":"2013-01-02",
    +    "date_of_expiry":"2013-01-31"
    +}
    +
    +
    +

    spid-icon cieid-icon

    phone_number
    Categoria: extra anagrafica

    Numero di telefono mobile. String. Stringa numerica senza spazi intermedi
    +Esempio:
    +"phone_number":"VATIT-12345678901"

    spid-icon cieid-icon

    phone_number_verified
    Categoria: extra anagrafica

    Valore Booleano che indica se il numero di telefono mobile dell'utente è stato verificato dall'OP.

    cieid-icon

    $PREFIX/landline_number
    Categoria: extra anagrafica

    Numero di telefono fisso. String. Stringa numerica senza spazi intermedi
    +Esempio:
    +"$PREFIX/landline_number":"VATIT-12345678901"

    cieid-icon

    email
    Categoria: extra anagrafica

    Indirizzo di posta elettronica. String. Formato standard indirizzo di posta elettronica
    +Esempio:
    +"email":"name@domain.it"

    spid-icon cieid-icon

    email_verified
    Categoria: extra anagrafica

    Valore Booleano che indica se l'email dell'utente è stata verificata dall'OP.

    cieid-icon

    $PREFIX/e_delivery_service
    Categoria: extra anagrafica

    Domicilio digitale. Indirizzo casella PEC
    +Esempio:
    +"$PREFIX/e_delivery_service":"nome@pecdomain.it"

    spid-icon cieid-icon

    $PREFIX/eid_exp_date
    Categoria: extra anagrafica

    Data di scadenza identità. Secondo specifica ISO8601-2004 nel formato +"YYYY-MM-DD" dove
    +YYYY indica l'anno utilizzando 4 cifre
    +MM indica il mese in (due) cifre
    +DD indica il giorno in (due) cifre
    +Esempio:
    +"$PREFIX/eid_exp_date":"2002-09-24"

    spid-icon

    address
    Categoria: extra anagrafica

    JSON Object (address):

    +
    +
      +
    • "street_address": L'attributo contiene la tipologia (via, viale, piazza …), l'indirizzo e il numero civico. Le tre informazioni sono preferibilmente ordinate come d'uso per lo specifico Stato.

    • +
    • "postal_code": CAP

    • +
    • "locality": Comune

    • +
    • "region": Provincia

    • +
    • "country_code": Nazione

    • +
    +
    +

    Esempio:

    +
    "address":{
    +    "street_address":"Via Liszt 21",
    +    "postal_code":"00144",
    +    "locality":"Roma",
    +    "region":"RM",
    +    "country_code":"IT"
    +}
    +
    +
    +

    spid-icon cieid-icon

    +
    +

    Esempi

    +

    Si riportano per comodità gli esempi che danno luogo alla composizione di un unico JSON Object da parte di più attributi ed in particolare i claim "place_of_birth", "address", "document_details", $PREFIX/registered_office.

    +

    Si riportano a titolo di esempio due indirizzi italiani:

    + ++++ + + + + + + + + + + + + + +

    Attributo

    Esempio codifica OIDC

    Indirizzo domicilio fisico +CAP domicilio fisico +Comune domicilio fisico +Provincia domicilio fisico +Nazione domicilio fisico

    "address": {
    +    "street_address":"Via Liszt 21",
    +    "postal_code":"00144",
    +    "locality":"Roma",
    +    "region":"RM",
    +    "country_code":"IT"
    +}
    +
    +
    +

    Indirizzo domicilio fisico +CAP domicilio fisico +Comune domicilio fisico +Provincia domicilio fisico +Nazione domicilio fisico

    "address": {
    +    "street_address":"S.S. Salaria Km 23,800",
    +    "postal_code":"00015",
    +    "locality":"Monterotondo",
    +    "region":"RM",
    +    "country_code":"IT"
    +}
    +
    +
    +
    +

    Vi sono casi, come per gli Stati Uniti d'America, dove oltre alla nazione (US) esiste uno Stato. +In tali casi lo Stato è indicato nel campo Provincia. +Si riporta il seguente esempio:

    + ++++ + + + + + + + + + + +

    Attributo

    Esempio codifica OIDC

    Indirizzo domicilio fisico +CAP domicilio fisico +Comune domicilio fisico +Provincia domicilio fisico +Nazione domicilio fisico

    "address":{
    +    "street_address":"503,Washington Avenue",
    +    "postal_code":"12401",
    +    "locality":"Kingston",
    +    "region":"New york",
    +    "country_code":"US"
    +}
    +
    +
    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/authorization_endpoint.html b/it/authorization_endpoint.html new file mode 100644 index 00000000..0633063b --- /dev/null +++ b/it/authorization_endpoint.html @@ -0,0 +1,1759 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Authorization endpoint (Authentication) + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Authorization endpoint (Authentication)

    +
    +

    Request

    +

    Per avviare il processo di autenticazione, il RP reindirizza l'utente all'Authorization Endpoint dell'OP selezionato, inviando una richiesta HTTP contenente il parametro request in formato JWT firmato e contenente l'Authorization Request firmata dal RP.

    +

    Per veicolare la richiesta, il RP PUÒ utilizzare i metodi POST e GET. Mediante il metodo POST i parametri DEVONO essere trasmessi utilizzando la Form Serialization. +Mediante il metodo GET i parametri DEVONO essere trasmessi utilizzando la Query String Serialization. Per maggiori dettagli vedi OpenID.Core#Serializations.

    +
    +

    Avvertimento

    +

    Il parametro scope DEVE essere trasmesso sia come parametro nella chiamata HTTP sia all'interno dell'oggetto request e i loro valori DEVONO corrispondere.

    +

    cieid-icon +I parametri client_id e response_type DOVREBBERO essere trasmessi sia come parametri sulla chiamata HTTP sia all'interno dell'oggetto request.

    +

    spid-icon +I parametri client_id e response_type DEVONO essere trasmessi sia come parametri sulla chiamata HTTP sia all'interno dell'oggetto request e i loro valori DEVONO corrispondere, in caso contrario solo i parametri all’interno dell’oggetto request DEVONO essere considerati.

    +
    + +

    Di seguito i parametri obbligatori nella richiesta di autenticazione HTTP.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Parametro

    Descrizione

    Supportato da

    scope

    Riporta di valori di scope supportati dall'OP e definiti dal parametro scopes_supported nel Metadata OP. DEVE essere presente almeno il valore openid.

    spid-icon cieid-icon

    code_challenge

    Vedi RFC 7636#section-4.2.

    spid-icon cieid-icon

    code_challenge_method

    Come definito dal parametro code_challenge_methods_supported nel Metadata OP.

    spid-icon cieid-icon

    request

    Vedi OpenID.Core#JWTRequests. DEVE essere un JWT firmato.

    spid-icon cieid-icon

    +

    Di seguito una tabella che riporta la composizione dell'header del JWT.

    + +++++ + + + + + + + + + + + + + + + + +

    Jose Header

    Descrizione

    Supportato da

    alg

    Vedi RFC 7516#section-4.1.1. Vedi Algoritmi crittografici..

    spid-icon cieid-icon

    kid

    Vedi RFC 7638#section_3.

    spid-icon cieid-icon

    +
    +

    Nota

    +

    Il parametro typ se omesso assume il valore implicito di JWT.

    +
    +

    Il payload del JWT contiene i seguenti parametri obbligatori.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    client_id

    Vedi OpenID.Registration. DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP.

    spid-icon cieid-icon

    code_challenge

    Come definito nella Tabella dei parametri HTTP.

    spid-icon cieid-icon

    code_challenge_method

    Come definito nella Tabella dei parametri HTTP.

    spid-icon cieid-icon

    nonce

    Vedi OpenID.Core#AuthRequest. DEVE essere una stringa casuale di almeno 32 caratteri alfanumerici. Questo valore sarà restituito nell'ID Token fornito dal Token Endpoint, in modo da consentire al client di verificare che sia uguale a quello inviato nella richiesta di autenticazione.

    spid-icon cieid-icon

    prompt

    Vedi OpenID.Core#AuthRequest. I valori consentiti sono:

    +

    consent: Se non è già attiva una sessione di Single Sign-On, +l'OP fa una richiesta di autenticazione all'utente. +Quindi chiede il consenso al trasferimento degli attributi.

    +

    consent login: l'OP forza una richiesta di autenticazione all'utente. +Quindi chiede il consenso al trasferimento degli attributi.

    +

    spid-icon cieid-icon

    redirect_uri

    Vedi OpenID.Core#AuthRequest. DEVE essere una URL indicata nel Metadata RP.

    spid-icon cieid-icon

    response_type

    Vedi OpenID.Core#AuthRequest. Come definito dal parametro response_types_supported nel Metadata OP.

    spid-icon cieid-icon

    scope

    Come definito nella Tabella dei parametri HTTP.

    spid-icon cieid-icon

    acr_values

    Vedi OpenID.Core#AuthRequest. Come definito dal parametro acr_values_supported nel Metadata OP. +Valori di riferimento della classe di contesto dell'Authentication Request. +DEVE essere una stringa separata da uno spazio, che specifica i valori "acr" richiesti in ordine di preferenza. L'OP PUÒ utilizzare un'autenticazione ad un livello più alto di quanto richiesto. Tale scelta non DEVE comportare un esito negativo della richiesta.

    spid-icon cieid-icon

    claims

    Vedi OpenID.Core#ClaimsRequestParameter. Vedi Sezione "Parametri scope e claims".

    spid-icon cieid-icon

    state

    Vedi OpenID.Core#AuthRequest. DEVE essere una stringa casuale di almeno 32 caratteri alfanumerici. Identificativo univoco della sessione lato RP. Questo valore verrà restituito al client nella risposta al termine dell'autenticazione.

    spid-icon cieid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    iss

    DEVE corrispondere al client_id.

    spid-icon cieid-icon

    aud

    DEVE corrispondere all'identificativo del OP (parametro issuer presente nel Metadata OP.)

    spid-icon cieid-icon

    ui_locales

    Lingue preferibili per visualizzare le pagine dell’OP. L’OP può ignorare questo parametro se non dispone di nessuna delle lingue indicate. Lista di codici RFC5646 separati da spazi.

    spid-icon cieid-icon

    +
    +

    Nota

    +

    PKCE è un'estensione del protocollo OAuth 2.0 prevista anche nel profilo iGov (International Government Assurance Profile for OAuth 2.0) e finalizzata ad evitare un potenziale attacco attuato con l'intercettazione dell'authorization code. Consiste nella generazione di un codice (code verifier) e del suo hash (code challenge). Il code challenge viene inviato all'OP nella richiesta di autenticazione.

    +

    Quando il RP contatta il Token Endpoint al termine del flusso di autenticazione, invia il code verifier originariamente creato, in modo che l'OP possa confrontare che il suo hash corrisponda con quello acquisito nella richiesta di autenticazione.

    +

    Di seguito un script Python di esempio per generare i parametri richiesti.

    +
    import hashlib
    +import base64
    +import re
    +import os
    +import random
    +def get_pkce(code_challenge_method: str = "S256", code_challenge_length: int = 64):
    +    hashers = {"S256": hashlib.sha256}
    +    code_verifier_length = random.randint(43, 128)
    +    code_verifier = base64.urlsafe_b64encode(os.urandom(code_verifier_length)).decode("utf-8")
    +    code_verifier = re.sub("[^a-zA-Z0-9]+", "", code_verifier)
    +
    +    code_challenge = hashers.get(code_challenge_method)(
    +        code_verifier.encode("utf-8")
    +    ).digest()
    +    code_challenge = base64.urlsafe_b64encode(code_challenge).decode("utf-8")
    +    code_challenge = code_challenge.replace("=", "")
    +
    +    return {
    +        "code_verifier": code_verifier,
    +        "code_challenge": code_challenge,
    +        "code_challenge_method": code_challenge_method,
    +    }
    +
    +
    +
    +
    +

    Parametri scope e claims

    +
    +

    spid-icon

    +

    Gli attributi dell'utente POSSONO essere richiesti dal RP nell'Authorization Request usando il parametro claims.

    +

    Non è possibile richiedere attributi SPID nell' ID Token. Gli attributi dell'utente sono disponibili all'interno della response dello UserInfo endpoint.

    +
    +
    +

    cieid-icon

    +

    Gli attributi dell'utente POSSONO essere richiesti dal RP nell'Authorization Request usando i parametri scope o claims.

    +

    Nel caso di utilizzo del parametro scope i seguenti valori sono supportati:

    +
      +
    • profile: usando questo valore è possibile ottenere il profilo utente di default che corrisponde al Minimum Dataset eIDAS:

      +
      +
        +
      • family_name,

      • +
      • given_name,

      • +
      • birthdate,

      • +
      • https://attributes.eid.gov.it/fiscal_number (National Unique Identifier).

      • +
      +
      +
    • +
    • email: questo valore permette di ottenere, se resi disponibili dall'utente, i seguenti attributi:

      +
      +
        +
      • email,

      • +
      • email_verified.

      • +
      +
      +
    • +
    +

    Il parametro scope PUÒ contenere uno o più valori separati da uno spazio. Ad esempio l'utilizzo congiunto di profile e email permette di ottenere l'unione degli insiemi degli attributi (Minimum Dataset eIDAS e l'email). +Nel caso di richiesta di singoli attributi dell'utente o specifiche combinazioni di essi, Il RP DOVREBBE usare il parametro claims.

    +

    Gli attributi richiesti tramite il parametro scope sono disponibili sia nell'ID Token e sia nella risposta allo userinfo endpoint.

    +
    +

    Avvertimento

    +

    Quando il parametro scope contiene solo il valore openid e il parametro claims non è presente oppure non è valorizzato, la response dello userinfo endpoint NON DEVE contenere nessun attributo utente ma soltanto il claim sub.

    +
    +
    +

    Per la definizione del parametro claims e la modalità di utilizzo per la richiesta degli attributi dell'utente si può fare riferimento a OpenID.Core#ClaimsParameter.

    +
    +
    +
    +

    Response

    +

    Un'Authentication response è un messaggio di risposta di autorizzazione OAuth 2.0 +restituito dall'authorization endpoint dell'OpenID Provider (OP) al termine del flusso di +autenticazione. L'OP reindirizzerà l'utente all'url contenuto nel parametro redirect_uri specificato nella richiesta di autorizzazione, aggiungendo i parametri della risposta.

    + +

    Se l'autenticazione è avvenuta con successo, l'OpenID Provider (OP), +reindirizza l'utente aggiungendo i seguenti parametri obbligatori come query parameters al redirect_uri (come definito in OpenID.Core#AuthResponse):

    + +++++ + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    code

    Codice univoco di autorizzazione (Authorization Code) che il client può passare al Token Endpoint per ottenere un ID Token e un Access Token. Questo ha il vantaggio di non esporre alcun token allo User Agent o a malware che controllano questo.

    spid-icon cieid-icon

    state

    Valore state incluso nell'Authentication Request. Il client è tenuto a verificarne la corrispondenza. Deve essere lo stesso valore indicato dal client nella Authorization Request.

    spid-icon cieid-icon

    iss

    Identificatore univoco dell'OP che ha creato l'Authentication Response. Il RP DEVE validare +questo parametro e NON DEVE permettere a più OP di usare lo stesso identificatore.

    cieid-icon

    +

    Esempio di Authorization Response dell'OP:

    +
    +
    http://rp-test.it/oidc/rp/callback/?code=a032faf23d986353019ff8eda96cadce2ea1c368f04bf4c5e1759d559dda1c08056c7c4d4e8058cb002a0c8fa9a920272350aa102548523a8aff4ccdb44cb3fa&state=2Ujz3tbBHWQEL4XPFSJ5ANSjkhd7IlfC&iss=http%3A%2F%2Fop-test%2Foidc%2Fop%2F
    +
    +
    +
    +
    +
    +

    Gestione degli errori

    +

    In caso di errore, l'OP o il RP rappresentano i messaggi di anomalia relativi agli scambi OpenID +Connect, come descritti nelle relative tabelle definite dalle Linee Guida UX SPID.

    + +++++ + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    Errore

    Vedi Codici di errori

    spid-icon cieid-icon

    Descrizione dell'errore

    Descrizione più dettagliata dell'errore, finalizzata ad aiutare lo sviluppatore per eventuale debugging. Questo messaggio non è +destinato ad essere visualizzato all'utente (a tal fine si faccia riferimento alle Linee Guida UX SPID)

    spid-icon cieid-icon

    state

    Parametro obbligatorio solo nel caso di risposta di errore alla Authentication Request e DEVE essere uguale al valore state incluso nella Authentication Request. Il RP DEVE verificare che corrisponda a quello inviato nella Authentication Request.

    spid-icon cieid-icon

    +
    +

    Codici di errore

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Errore

    Descrizione

    Codice HTTP

    Supportato da

    access_denied

    L’OP ha negato l’accesso a causa di credenziali non valide o non adeguate al livello SPID richiesto (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    unauthorized_client

    Il client non è autorizzato a richiedere un authorization code (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    invalid_request

    La richiesta non è valida a causa della mancanza o della non correttezza di uno o più parametri (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    invalid_scope

    Sono stati richiesti degli scope non validi (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    server_error

    L’OP ha riscontrato un problema interno (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    temporarily_unavailable

    L’OP ha riscontrato un problema interno temporaneo (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    unsupported_response_type

    Il response_type richiesto non è supportato (RFC 6749#section-4.1.2.1).

    302 Found

    spid-icon cieid-icon

    login_required

    L'OP richiede l'autenticazione da parte dell'utente (OpenID.Core#AuthError).

    302 Found

    spid-icon cieid-icon

    consent_required

    L'OP richiede il consenso esplicito da parte dell'utente (OpenID.Core#AuthError).

    302 Found

    spid-icon cieid-icon

    request_uri_not_supported

    L'OP non supporta l'uso del parametro request_uri (OpenID.Core#AuthError).

    302 Found

    spid-icon cieid-icon

    registration_not_supported

    L'OP non supporta l'uso del parametro registration (OpenID.Core#AuthError).

    302 Found

    spid-icon cieid-icon

    invalid_request_object

    Il parametro request contiene un Request Object non valido (OpenID.Core#AuthError).

    302 Found

    spid-icon cieid-icon

    +
    +

    Avvertimento

    +

    In caso di URI di reindirizzamento non valido, non corrispondente o mancante, l'OP restituisce 400 Bad Request come codice HTTP.

    +
    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/avvisi_spid.html b/it/avvisi_spid.html new file mode 100644 index 00000000..42a95249 --- /dev/null +++ b/it/avvisi_spid.html @@ -0,0 +1,1382 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Riferimenti normativi SPID + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + +
    +

    Riferimenti normativi SPID

    +

    L'avvio del Sistema SPID, per sua natura e complessità, può richiedere di intervenire su diversi aspetti con specificazioni, chiarimenti, note informative e casi esemplificativi, al fine di dare supporto ad una migliore applicazione e comprensione dei Regolamenti SPID già emanati dall'AgID in conformità con quanto prescritto dall'art.4 del DPCM 24 ottobre 2014.

    +

    Al fine di raccogliere organicamente tali interventi e attribuirvi un carattere cogente che ne comporti l'obbligo di applicazione da parte degli attori convolti nel Sistema SPID, siano essi pubblici che privati, è stata creata la presente sezione “Avvisi SPID” con l'obiettivo di assicurare un'uniforme interpretazione delle regole, degli aspetti tecnici e di quant'altro necessario per il corretto funzionamento del Sistema nel suo complesso.

    +

    Le presenti regole tecniche implementano i seguenti avvisi SPID:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Avviso

    Riferimento

    Data

    LL.GG. OpenID Connect in SPID

    LL.GG. OpenID Connect in SPID

    24/11/2021

    Avviso n.41

    Avviso n.41 - Integrazione LL.GG. OpenID Connect in SPID.pdf

    06/05/2022

    Tabella Attributi utente v1.3

    Tabella Attributi in SPID - Integrazione LL.GG. OpenID Connect in SPID.pdf

    24/06/2022

    Determina SPID OpenID Connect Federation

    Regole tecniche per il funzionamento della Federazione SPID OpenID Connect - Integrazione LL.GG. OpenID Connect in SPID.pdf -

    14/09/2022

    Linee Guida Attribute Authority SPID

    Linee guida recanti le regole tecniche dei gestori di attributi qualificati

    18/07/2022

    +
    + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/come_contribuire.html b/it/come_contribuire.html new file mode 100644 index 00000000..e4eacdb3 --- /dev/null +++ b/it/come_contribuire.html @@ -0,0 +1,1352 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Come contribuire + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Come contribuire

    +

    Per contribuire clicca in alto a destra sulla icona di GitHub, alla voce "Sorgente" e accedi al repository pubblico.

    +

    Se trovi una inesattezza o desideri risolvere un dubbio o semplicemente notificare qualcosa per migliorare questa documentazione, apri una nuova Issue.

    +

    A seguito dell'apertura della Issue e dei riscontri ottenuti dalla comunità di Developers italia potrai aprire una nuova Pull Request contenente la modifica o la correzione da te proposta.

    +
    + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/confronto_oidc_cie_e_oidc_igov.html b/it/confronto_oidc_cie_e_oidc_igov.html new file mode 100644 index 00000000..edd64205 --- /dev/null +++ b/it/confronto_oidc_cie_e_oidc_igov.html @@ -0,0 +1,1376 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Differenze con OIDC iGov + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Differenze con OIDC iGov

    +

    CIE OpenID Connect e SPID OpenID Connect sono basati su iGov.OIDC con le seguenti differenze:

    +
    +
      +
    • La sezione 2.1 di iGov riporta vtr, acr_values e PKCE come OPZIONALI, sia in SPID che in CIE id PKCE e acr_values sono RICHIESTI. In entrambe le implementazioni di SPID e CIE, si è adottato acr_values al posto di vtr.

    • +
    • L'Authentication Response nel flusso di autenticazione di CIE impone l'uso del claim iss per evitare l'attacco mix-up I-D.ietf-OAuth-Security-BCP. L'uso di questo claim è OPZIONALE in SPID.

    • +
    • La sezione 2.4 di iGov stabilisce "Gli RP POSSONO opzionalmente mandare richieste all'Authorization Endpoint usando il parametro request." Sia in SPID che in CIE id, l'uso del parametro request è RICHIESTO.

    • +
    • La sezione 3.1 di iGov stabilisce che "in caso di utilizzo di vtr nella richiesta di autenticazione, l'ID Token DEVE contenere i seguenti claim RICHIESTI, cioè: vot e vtm ". Considerando che vtr non è usato in SPID e CIE id, i claim appena citati non vengono inclusi all'interno dell'ID Token.

    • +
    • La sezione 3.1 di iGov stabilisce che "il claim auth-time nell'ID Token è RACCOMANDATO". SPID e CIE id non adottano questo claim nell'ID Token.

    • +
    • L'ID Token, sia in SPID che in CIE id, DEVE avere il claim acr RICHIESTO, mentre questo è opzionale nell'iGov draft iGov.

    • +
    • L'ID Token, sia in SPID che in CIE id, ha il requisito del claim at_hash RICHIESTO. Questo è OPZIONALE in OIDC-CORE è assente in iGOV.

    • +
    • Sia in SPID che in CIE id, l'identificatore del soggetto DEVE essere pairwised.

    • +
    • La UserInfo Response, sia in SPID che in CIE id, DEVE essere un Nested JWT, firmato con la chiave privata dell'emettitore e cifrato con la chiave pubblica del RP.

    • +
    • Il JWT firmato della UserInfo Response DEVE avere i claim iss, sub, aud, iat e exp.

    • +
    • La sezione 3.4 di iGov stabilisce "Gli OpenID Provider POSSONO accettare oggetti request by reference usando il parametro request_uri". Questo parametro è intercambiabile con il parametro request. SPID e CIE id adottano solamente il parametro request.

    • +
    • Sezione 3.8. La registrazione dinamica di iGOV specifica che la registrazione dinamica del client è obbligatoria. Sia in CIE id che in SPID, la registrazione automatica OIDC del client è OBBLIGATORIA, mentre la registrazione dinamica OIDC del client NON DOVREBBE essere supportata.

    • +
    • Nella sezione 4.2 di iGOV gli scope openid, offline_access, profile e email vengono usati in CIE id OpenID Connect proposal e non considerano gli altri scope raccomandati nel profilo iGov, cioè: doc.

    • +
    • Nella sezione 4.2 di iGOV gli scope openid, offline_access vengono usati in SPID OpenID Connect proposal e non considerano gli altri scope raccomandati nel profilo iGov, cioè: doc.

    • +
    • La sezione 4.3 di iGov definisce la politica relativa all'oggetto userinfo del claim request. In CIE id, definiamo la politica per entrambi gli oggetti userinfo e ID Token.

    • +
    • Nelle sezioni 3.7 e 2.5 di iGOV, i Metadata sia di SPID che di CIE id vengono distribuiti secondo le modalità definite nella sezione "3. Metadata".

    • +
    • L'Access Token è un JWT firmato in conformità a RFC 9068.

    • +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/cryptographic_algos.html b/it/cryptographic_algos.html new file mode 100644 index 00000000..b4116674 --- /dev/null +++ b/it/cryptographic_algos.html @@ -0,0 +1,1505 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Algoritmi crittografici + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Algoritmi crittografici

    +

    Tutti i partecipanti devono pubblicare gli algoritmi supportati +di criptazione e firma all'interno dei propri metadata. Tali agoritmi sono utilizzati per tutte le operazioni di cifratura e firma previsti da OIDC core e di Federation.

    +
    +

    Nota

    +

    La lunghezza delle chiavi RSA deve essere pari o superiore a 2048 bit. +Si raccomanda una lunghezza di 4096 bit.

    +
    +

    In SPID e CIE id i seguenti algoritmi DEVONO essere supportati:

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Algoritmi

    Operazioni

    Riferimento

    Supportato da

    RS256

    Signature

    OpenID.Core and RFC7518.

    spid-icon cieid-icon

    RS512

    Signature

    RFC7518

    spid-icon cieid-icon

    RSA-OAEP

    Key Encryption

    RFC7518.

    spid-icon cieid-icon

    RSA-OAEP-256

    Key Encryption

    RFC7516.

    spid-icon cieid-icon

    A128CBC-HS256

    Content Encryption

    RFC7516.

    spid-icon cieid-icon

    A256CBC-HS512

    Content Encryption

    RFC7516.

    spid-icon cieid-icon

    +

    In SPID e CIE id è RACCOMANDATO il supporto per i seguenti algoritmi:

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Algoritmi

    Operazioni

    Riferimento

    Applicabile a

    ES256

    Signature

    OpenID.Core and RFC7518.

    spid-icon cieid-icon

    ES512

    Signature

    RFC7518.

    spid-icon cieid-icon

    PS256

    Signature

    RFC7518.

    spid-icon cieid-icon

    PS512

    Signature

    RFC7518.

    spid-icon cieid-icon

    ECDH-ES

    Key Encryption

    RFC7518.

    cieid-icon

    ECDH-ES+A128KW

    Key Encryption

    RFC7518.

    cieid-icon

    ECDH-ES+A256KW

    Key Encryption

    RFC7518.

    cieid-icon

    +

    In SPID e CIE id i seguenti algoritmi NON DEVONO essere supportati:

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Algoritmi

    Operazioni

    Riferimenti

    Applicabile a

    none

    Signature

    RFC7518.

    spid-icon cieid-icon

    RSA_1_5

    Key Encryption

    RFC7516.

    spid-icon cieid-icon

    HS256

    Signature

    RFC7518.

    spid-icon cieid-icon

    HS384

    Signature

    RFC7518.

    spid-icon cieid-icon

    HS512

    Signature

    RFC7518.

    spid-icon cieid-icon

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/differenze_oidc_fed.html b/it/differenze_oidc_fed.html new file mode 100644 index 00000000..b2756dec --- /dev/null +++ b/it/differenze_oidc_fed.html @@ -0,0 +1,1367 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Differenze con OIDC Federation + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Differenze con OIDC Federation

    +

    In questa sezione sono elencate le differenze che intercorrono tra lo standard ufficiale e l'implementazione SPID e CIE.

    +
    +

    Client Registration

    +

    SPID e CIE supportano esclusivamente automatic_client_registration. La modalità explicit client registration non è supportata.

    +
    +
    +

    Trust Mark

    +

    L'esposizione dei Trust Mark in SPID e CIE è obbligatoria. Per approfondimenti sulla ragione dell'obbligo dei Trust Mark si rimanda alla sezione Considerazioni di Sicurezza.

    +
    +
    +

    Claim non supportati negli Entity Statement

    +

    Poiché SPID e CIE non necessitano di alcun claim aggiuntivo in ambito federativo, non necessitano del claim crit. Inoltre non sono supportati i claim aud, naming_constraints, policy_language_crit e trust_anchor_id. L'eventuale presenza di questi claim non presenta alcuna implicazione, questi verranno semplicemente ignorati fino ad ulteriori avvisi che li normino.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/differenze_spid_cie.html b/it/differenze_spid_cie.html new file mode 100644 index 00000000..bbba3768 --- /dev/null +++ b/it/differenze_spid_cie.html @@ -0,0 +1,1397 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Differenze tra SPID e CIE id + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Differenze tra SPID e CIE id

    +

    In questa sezione sono riportate le principali differenze tra i profili implementativi SPID e CIE id.

    +
    +

    Metadata

    +

    Nei metadata OP e RP per CIE id sono presenti i parametri che abilitano la cifratura dell'ID Token (vedi le sezioni relative al Metadata OP e al Metadata RP). SPID non consente la cifratura dell'ID Token, dunque tali parametri non sono richiesti.

    +

    Inoltre, il metadata OP per CIE id richiede anche il parametro revocation_endpoint_auth_methods_supported, non richiesto da SPID.

    +
    +
    +

    Authorization Endpoint

    +

    SPID, al contrario di CIE id, prevede l'inserimento obbligatorio dei parametri client_id e response_type nella richiesta HTTP. +Inoltre, CIE id prevede come obbligatorio il parametro iss nella response per mitigare gli attacchi di tipo mix-up I-D.ietf-OAuth-Security-BCP.

    +
    +
    +

    Parametri Scope e Claims

    +

    CIE id consente di richiedere gli attributi dell'utente sia tramite il parametro claims nella richiesta di autenticazione e sia tramite il parametro scope, abilitando in quest'ultimo i valori profile e email.

    +

    SPID non consente l'utilizzo di profile e email nel parametro scope.

    +

    Per ulteriori dettagli vedi la sezione Parametri Scope e claims.

    +
    +
    +

    ID Token

    +

    SPID non consente di rilasciare gli attributi dell'utente all'interno dell'ID Token. +In CIE id gli attributi dell'utente sono disponibili sia nell'ID Token e sia nella UserInfo response. Inoltre, il CIE id supporta la criptazione dell'ID Token.

    +
    +
    +

    Refresh Token

    +

    SPID prevede l'utilizzo del Refresh Token per abilitare le sessioni lunghe rinnovabili così come definito nelle LL.GG. OpenID Connect in SPID e nell' Avviso n.41 . Consente, infatti, di ottenere, oltre all'Access Token, l'ID Token valido esclusivamente per SPID livello 1.

    +

    In CIE id il Refresh Token non consente di ottenere l'ID Token e non è utilizzabile dagli RP per ottenere una nuova autenticazione dell'utente con l'OP o rinnovare una sessione preesistente. In CIE id il Refresh Token è usato per ottenere dallo UserInfo endpoint esclusivamente il medesimo set di attributi dell'utente richiesti in fase di autenticazione iniziale, per il quale l'utente ha espresso il consenso esplicito. +Per ulteriori dettagli si veda la sezione Refresh Token.

    +
    +
    +

    UserInfo Endpoint

    +

    CIE id supporta entrambi i metodi HTTP GET e HTTP POST per le richieste allo UserInfo endpoint. +SPID consente solo l'utilizzo del metodo HTTP GET.

    +
    +
    +

    Introspection Endpoint

    +

    CIE id prevede il solo parametro active nella risposta dell'Introspection endpoint. SPID aggiunge ulteriori parametri come specificato nella sezione Introspection Endpoint.

    +
    +
    +

    Revocation Endpoint e Logout

    +

    Entrambi SPID e CIE id prevedono che il RP effettui una richiesta di revoca dell'Access Token in fase di logout dell'utente. +In SPID la revoca di un Access Token implica anche la revoca dell'eventuale Refresh Token ancora attivo ad esso collegato e la scadenza della sessione di Single Sign-On se ancora attiva.

    +

    In CIE id, invece, la revoca di un Access Token non prevede la revoca del relativo Refresh Token, allo stesso tempo la richiesta di revoca di un Refresh Token determina anche la revoca di tutti i relativi token ancora attivi.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/diventa_fornitore.html b/it/diventa_fornitore.html new file mode 100644 index 00000000..bc12e3e7 --- /dev/null +++ b/it/diventa_fornitore.html @@ -0,0 +1,1361 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Diventa fornitore di servizi + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Diventa fornitore di servizi

    +

    Qui di seguito riportiamo gli indirizzi di riferimento per le procedure di "onboarding" di SPID e CIE, cioè per diventare fornitori di servizi.

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/doctrees/attributi_utente.doctree b/it/doctrees/attributi_utente.doctree new file mode 100644 index 0000000000000000000000000000000000000000..1e42ff1af1c038b324e8eee742a423d89eb8facf GIT binary patch literal 103768 zcmeHw3z!^Nb*5!mj~P8I$+l$K7A}u$G#aaWW;8Q;*_M&@Vk~JSB-xg2oK{VD&2+VT zy2ky`%LYsgp&goCOxi3YgpfcWfdC1F0K1z95GRn3kSCBpAUGi;fovcNyO6-{{^#7f z_3C=u?&*;XyZ)@2>Z)7!p7Wn`&pr2b?h}ii$zHMG3i_{cb!9ehmd>a3T&`s0j7qby zG-qXNGe)V}{E6n~S2kbP>~Hjx^>Y=gR?ZsD#uZ4B&6~ws*(fz1!ONADzG@aLX*+`@ zS!>4keST5nCi|J$d-~yYI{nD$Oz(3~ycz%A^4t?Y-OMj}q?zw&Ty@eoPo*ZLesztWK;hoh=&`qkPtA)*4Hy`ZRsf%=hNk<`*`4G7e1mwOFFlho_Z6 zV%93ze=<2^$}E{x(<)Wc`^6LTq zjrg|#|8B;=TL9JKDXToA6RlKOGruu^Yb}3Ueki{w-=E)nXfZO_QVYqTaph#WsmpBW zlL5~s3-d3`F9g@O3%vqoFCosdc_Vu!WoE6? zrpty=%J2s>dihMca(0@4*mcg#Rr9;Ftz!-vi}+hF9xs|}-U7-<%ogfJ0M_er1C3+4 znvE;Bjx`$#Yh|<97*OYoGSf>rGp7r!ZY&sR=6|F@s2+g;#%*MK!vv9kC{zlpye(2V zMpCGiT*?#WP&RUzqEW3H<<$8|Axt=8zAFLx`0SK$U+$$p6!}dN$Oj8=<})vA=Jotz z4$^rW=@p?!p9@8L1(}H!r0*o8E3;-UPTlGKND$RgsoE~8TS8Hd_*x0X9)~m!f}@V^ zuJs}46eIzAqXXEJHejnl0eeFzV5>p_+sy{TG~yAY$ZiQ2C?sJ+!j?V3>3-W!VAHKC|IMyQ?B%O$fkokE*efl*DFRWu;RY!Pi64D88T zwQ6e9MN>l?H#2K$Fuzr!gl0%HOWLC~qf*s1*~aM?(Ks1e#VT1^PDcWy%o*hheKlif zC98yg)L@urO##~K#)I=$g42k7G^`P8tZC&uyiHmg3SK!3JOgc$3*Me$QLE++%{Z^m z%odFbgQufa&k=alyjgLfqjp_`tD?;qda0^aEp3t!OG(6xUc1p+-I(ZZ#!UyPPpSb0 zmo8Mx)_H*HX)Lbl$mo6FA!OE-w z&qzE-LDxz~wwjtUpheIctCSkf45fvyLC&CTWE)E@Gnb`wAk21Be9s(*1r8jyuXoI) zY-(CR2mfY+iO%MBxPUBh$K&m{8 zsw@igfZ@E~Se|u=aiy65YUAJ>5b+Tv(Ro26I@3OM4mi@y>@UH^z0fU;wgoV{!NJI* zQ0N<=NDop@s*P@{jFZY%r0(Ihtts)kITEit;dS_6YR?`QnsevQrS)mlnrZ87+C;@M z;r$Jw6QS3N)xjwf=4KF<$ij20d?6zq6pPc-8K(=B(QDPbRYsq~sGwTS=B5IGEhE9BGAmi6CWDgNx;@OMEOV?-+3;Xs zKTgxvz6!KMBGGoalF3^lnVjMp<1)E%Z&5dAD#!FPI-78>+h>|N4rUXO|BW65Qs^P0 zMD(Ubi5^7kWQ@qh)?}`(>~9yLa3UpKeUWhGf^eNM%BEg4FLEPN=@c!0E&;G^@PdW$ z08e=ytn5?*tCmzQRQo!EDnOw`YGWi)KN3Xh-Um(|H`uT17$#2^0gTppF)Ey^mhF-} z0NF_dK>j2yI(s@p$4i)m=2mrR_P|`)*mSBvo-E>^A;WBA69tVw$(*6_5+x$R;kacM8e$IScMrUJGIw1g`{@z>#~h{VI+p9gBS`CRAw;%*g+#EOr)GqyofRXREh^C zJArGX3_F2~&E1`0-I=M?)Lz4+?X~iRWU%Ju1jUlS5d0Ikg$#s9f54j>ofe|j zliG#w@SGqFQZ5lqMIuU*ESaOCr?=0nWUaGCxs4H#oczRm2wh#^vQmg z_P%qG*rkeu^SMid(JvGRA zztMhA#NfSKi@Gw*N|{Qf7;Y1tk@RqP&_PCt=!~R>W6_~Jx{eNID$&{69y&C#-W_z} zhUlg4jK-tG!~9)GhX|ACjI@nTmul9iLd_bDuUSB69%>e4D$yBj8=bLk>CRYU%^FRO z#nmjJL+`t6cPLYd&RE;%Z0i;}!HFHm>N-|=G_@@O9eUq&bll0DZEd16)-Ah(j1qNc zEWz$j9$iO=GL^csJrW&*9T|Iu*lCEz(p_t{II93cYn_QfX_?1T{+7#0A=~wo$j6J) zxT=>E=W>W_B~Cj!z^O|Xng|JcKMo2`JtLgF{*RNwhm+q5))<>XIc2 z+MzWqdgQf2&RYi?zYS6zd5+T`*8=T|#3a;fPHpd&1wuxF`qgTmwPpQL*-D)5jKnEQi@IcgwzpWH zFfH=h9_PIWA;0D6k`}pk=dQNV8R?D>v^_ndP{&4~9kP=ih7P^&vJXUrN!{7qHaer- zLT6L~ozVnz=zZ7G8FkRPI})8J3)Ho~>GpJM@6@p`9t-5}pE@Z#^^5ZHqSPe|vGIM{eW$d8HH?1J zeiF~TDJ|Hd#o2NN*|}L-aET?m)xp|q(b993!L37EhX;qY57I)j6fgS5iZEK%Tb|Oh zS*#T<@dglD_G_lh+$_?BEF)XPU)Ij2rX4CgRgd3lwey=$(gA`P=2}datVZa*_hx7fH`+h@PTVn#TI=vsPB0EMg%$mc&D~{WA9E ztG4Kp#FZiK)-z(BA!Cn}XUtND#6xvv<17~6-!-~D!1P)oDdms^!^0$bVBi$3L?eX@ z%$X=)=7Rx=_5Mh#f1I$kIWe?itu(Dm2C#1Ra>Bh{Qk7z=B=DfhgSeBZh4jl0`hiH$ zc`3yHiIL%*snOxBDbFxBSuUemG1FFg8Y_s4CZ-$*=>e8K4FK^B zslDU-{Yp8lU%ZHIZF+5L%FJS+r$H;Q0oaAat3cx=zm&K*NL2P@No zYP~o&lfoV!4-W1V7lPeh2s$WJa`@s%4i6KDd-nvIvB;vPYhZ6^Y!LqsZyOv2mlbPp z=Lq;4Y+XIRFspmbwf)oOZm$w|2}Md4$0J$fl^XjFr%voYa_sQHUu3?i$vkxNECPh`Tp^J zdrr8F8?|z(Xq->uuQjXV&tTD*){Bl8xPM~sm*X^x;ez zT8^obvF$Jc>7k+RBlLIw#KC}?FT&z5-Me(odEoN?uvCNjAV&goC=!@+R0GJ9OYy#> zy+@A+>iRsj_W`6H_xHAJ5xbi}JGSSz3s=>$5FWuas#Dw&qb*cy$6c;(^U{^@ePO{z+prAX;dL^8r_Pt1eZhD0^UWk>kBt-Jb6>{!D38rt&b z?C_&qI71_0eD#Rr0m;(Cv@LFz$HaAiNkvO$k47@fyN!t1Zu5B+(dH4L{5=oc9gF1d zLDI>iV(}T;iew(;il9;S{xNWXopdS0(WsU65=I9|sN?%WrP^!DAI*b@XZvYdJasu& z9#u*vLrVB1kr+%e1~danZGkh^HJ0A44u@RFBzKmHeO4!``lMN;-G+YSb)94OopGhH z)OHUpZUQekNZ>-GJg}5Rngr;0BtSa|p#8(!?7>>>-z7Vb&?IS$3=Niz?BL1N@%?*K z`_o91f}=1rJe(RwFCoD8RR-RBxRk$LreF`Mvu)%rX+IH3`%a>L{KU~6+lH`kYiP(b z;LJ=^EH=HBDgtWg<=o)t(2nh)=61PRv7AgiOa!01%xsbdIH@4X#mPu6C>%-#j_lFY zJ}bL(WXLnAz?o-ti)Aren=IOE+$)1f%JF(CaM*`NGP5Hz3Q<89FJ#1SIli(|*w#-; zecbtUuqsBXfVc#y zbH-#!FHY00*ZfQ+ppgp;=e*{~{^>I5*rB->EZMz3l3i|Av184(I?AOAU%}y5Y|rr9 z9Pn242-g1Tvg%Am&#h3&<^z#z+EVp6-O45UrD~M2Sy8C4FXWLeX08@#Q!3QH5WZQJ_1D&1x!sjMX_Tuz1!r+}X z2E%%DSZyXguUfNawvrm&8P)^3(M%x@l-mb%zM9O=dh~*l3EBjHfn+XfP6e4Wof5Q1 zB0(D=(2gJ2yM1hUhg&H`W$j9zl2G1jxtryCApOCvG z`bSiV_AC^O%{I6a%%;%0{LAyGU83DZU71LtDP$OVwj;ya0z|`872^pND@AY7>8_Qk z1`xU_P|1AXcyOR}-dYw+=Yn&<2abw4@a5&uDKXO{G2^jaF;sM+Rx#vQ z5iD-i$fe-usbUuXb!uo^n3CKSSE3iOgmf-q&VFfDr%1#SsFZk3M&h-KstSNAXGHXX zU4DxrmrO~YqOk};qcHQ_SVrI2aZsG*a>^~HadI$^IA??98umez2hUmMGl*wJqgQGPMCoBaq5x(EX=n4xrE zHLgFYPa4Idt~ohsB1ggM>X-yF7+B%)tFE{rEFPG|1wa=rB29j6;T-)z(9Zm(LX~b2 z`je^dp@PiQRjm6Yn9q8 zCqw``gqY*?EykdwVTvxTA>Xq)03Ad0J5-bdE@-LXe>g#D_>~&r0`k~Q;nX10gmZ1 zfLO93?DAr4amQK|&v%8d;R}9?xWSy-RidxsRg&@e2l{+%;j8!)8p_gc8Cun1CBAx2 z;j6zE1^g8!Eqn!k{6h1yeD%PdAMlYu8zhg<_nf& zf#!Zs4=a=TVMl7CQrkq#YR9tNl~9lqs5-x=;R)T{60N#GCEC$=!$|Q%vDkwWD8CYO z84g9q5-1|2w)J1I-i}#B4BW!4C?H9Fe2NfXz!yYS`8-#Zc-#M3kyMyMHbIkCuGOCO z7ryAJI=1;qtb{`Y19o%8eiFv0bB0vPy$EnkBew{msh7yDprsb9fB_x7E;JLVs;gTH zaK-j&b+NsY1rX3!dZ?ta|0SUyWsRj09gSV9g=6HXrJyff75q)`YUtX_nbml$uyyS* zP8uTSe!sDO1>*RaSwj=kh9pP?1-8=K354e_O{cZ-BEkrSq|iR`3mQf0r?Ei_GF;TA z(ak~F0Qif=;wF0*@)K{t5v|SO z8i?lC1m3>3`!K*0f%z?h3qGy%ws-ZOK7FUaH8ai=wi5Z>chPe^JhuDJQaNqIwEOgF zQNMuHjWM~p73g=Fi^4OWs^1vytWcDhYKvHxiq9xuX}hpQaBZ@k8gXp|?2GmxR*T)2 zghM2LIpX~r1(N(V57Cru@xsV1n=D${Gnq$gR@K|lJGBG{bPNnQvKtuKMIx`2WbHxV zZNz}(s-lf*A{M`_1qkFxJutUA1!|M5oz+jg?T+4Fl;TkgryyN}Ux+G;u4ZvcFJX$Y zjLMASxm?5s*R|mxEsK629Rq+!;E0C}jr7)9PdRvwt}}%W*JkvRNw-23b*)78Tc4T4 zkRjD|Z5E5x$|mlu8JwG8rA2h?fSJi%3T(ofpcTG?Wz*B+2+Gyf|4>j2+f(>otgEOO z56qL4U8<<4N?X-pJ=FDInLxj#f7|n2al*v6DoC`H;Bs#zaN%0FnBaZA*&!O+lm3m4^y5wGx1b?z|DJRvtOZ-TpAQ?b9Bb-6a18300_1*!ig4|r zrS+da-Pht1_U-E1bI;y=!&^s2$F^;={Cu|s ztCzq61>1rJc<2}juf3uduvaco?@(!=-s?0_@3#+POE{OQurWv#j#?_XRK*LxFE)hV zE&Oi3F#ny@KoHV(SdVH@nUAo-u)a50@ zX*_BPy3pEGAs%v}ERb%ysd}>Q(h&7Ev@~j}JhcdI)jcNmUF1#eexsZ-!<(v~K=Dpf z75BAUDW6fG*lwzxW>Dfa)vw=(UTQNJUn`RI`}x&WeT*OrHdVhu(2J8z{jN2=xD-v* zp9ZO-rpl!%UI2cvA#iBneaJ4USLzd6d;xQBs!{_3d~9LHn#xR?IfYOJG z?L>&!FpVS2ltNo99=IZVSY2dP1dHrNbLPN7SdiTg!U%O4im*FU5IuBIQDD|@-VhSe zE)DZ?E9@nD8J?f>ERJg2)#q<9`gT1=XOL@s0&ci#N5=cMh)1&8;2~GfUYsmVtFBhh zH5UieCllDDquU#cFl&qx?VoBag)Nw_As`V>cBgG*&Bn^SIh`-!Up0eMT`SF((E`}Q zE0L=^nvZyYHZbwROS1cZgL%1!9o|pK1%0`nA;!aeIeKv^e7TPWsUly_r7B(ketkxq zrovm0ouV%%n(O!i=I+b&4-Bvihs{jwkBejS)$_5eNA$?JpOz^gf9HFfNW|L9|XBqp}uOwPQ#9#f#XkZDD-_GQb+2 z$0y5=_Z~SSQ)0CN&Nin3b*(>FgVW?mwQrv%6`JBQvJ6Wn=Oa09r?EYA37K+r_L?3= zox70}MvGBd=cq(S=lYVN?SR(wywG}UuY!O(pmxu^P}|$wJ*0lCWRiG{8D-{i^T)C8hnbS6tCO18}lq96L4ebp^_W(g@l5X zn-nV1QMg1mM$i{8Bfk71a@r+U0!z|=(oLr)h%DRGI}6^O^+LJ0!fov2EQpmh#s4Xc-E6l z$@9w%c#V8q>- zL@VU=Qisbbu8+z`x(L_G1+Cs<+zRtSmS?o#rwU^`4DV+Q0}cZ{RB{-eO(;mYg`pB1 z)l7641by++^s5UZ8WnztS&c`KFqu-6P?%ZFC6s#WX(p5kHCn zF}Yv0vE5k`?yZJ>yR^Poocm-g?)ZC$mv1NVLgW60r$O^mg*V`85BC?ExDOlRN6;Lb z(fGQRR7?DA;iX?!{(@x?aj^AUiHE|(#G3%W>=9?Aunb=+wll(T#G^O&c4oKRKG1X% zO$8e{tc$>Qzp&wS<2=GBCTyzR5Syjc*!8mAX(`rieC{OhV|pE)#%Biu8)$s!p;F^B zkx-Cw<3lAnjn7TqO|~t_IWXW6W^8{@ImlD<@5EfE6W=_P{!#1Z|;Re1?I^y<84amMU8`IVHITCv#8>wnd|TgnE&8WN$$$!ZD<_^x8N4 zINf_MCJXV--E+uG-R%v6_H#@F=-Ab#hb@8kwrnj6+`TbI5Np_3+wsH8prcH)37Xv6 zB;}w?Gpr%Jd$d->-p@=CmcTPd?ZyP@p*I;so0;*vZuFf*P@bYSZR-8nSrhARa48zl z1QX|9=x`U_Dck{{H7~pdrP_Tql?)snpK6=OJa~LH^B7-Yo+OIa7M|dwg;(K^(?a)* zV>$^TKQ3Bq!Tg-OmA(`6@Sb!I!EeLsBs=D>;U=hf3sccK!4u_l);w!w!wCM6hhR6I zL-2>&Cb$5CKR7pn7w+A2ECkz6yQFdohsZx{o5(XD^7rOOqw|t3)AK2?f@->vfC1hYfwT&2P^~RDPoS~ruB)i2WZgxcxjxcvD5nOrp-EdqwFg!Nrz#7VUf6bNkGiG#dMV>hFQvt4a~3VR!0zfpE1(@ldvQ_QI;`P5 zoY7J3xHY5qxvQ4Cn4^R4Xac`&_GBs!7}0u4t!k392#RxJVMR6C4+?%m zF>iV~T#yV2iTIHRc*qO!NsMxpQ&dejx`;7Cy`GlfBm3xJ9&P{06XV+c2@U7kX?&(0 zxV64B;%^`0D`7(bc1Q?Px2HQm^4Yv%t4 z!~w)<4&I+oM_PMCk3m^~Nob&NGD@Yf{q?p>dm^H=ZJ7EBwKILYF#IaC0D&h?J^0Yj z&;vt5xDGuOzEb87K$G1&+1h@Vu37tx0&n&jn%`&m;_JHKLj0%$L%dx{vJn1e_HwTY z{ttpI*yw(p!ERl;okXBEw7CgMTQ)G$LnRmCu7rY=T?8u8(b_~8LC_a3 zXul@C8k%$~vl?$UY)!g_lP0@to{Mw98*MhJItRVM$YfE@ z0mnY;#5s^!`2QBuPE(&r(Dl}){>PwnFBO{PYwEFOTC}k2gptcg{$SQ1hZ0>2BXkXl zg^cWWc0=sft{He#fnvK!onbQL>xREZJr%*6iXZbT1;YHLy*8q>J3W3(s8Phqo_4&M zri=0p$D3(0V^;ugRN&JVz#G~Y!0Q}H;tgSvN%Q+OmwxEr;{;OBi}?V_fxVb^bn-s~ zlJ_eB>4PL5y}A1f!*26_Ry90v0cscsb$?Ksgf5EKAtCy`PpXH>6{iJ=ung z5A?P@J}_q&;D?`4r`f-DWpd^5E7#LduGRP|xCdqJ>C^Y`IZ4ASwmhLFGPJQjoa3$d z+HULDw0`1N>=!D~X16bWOi;YG``Ktlu%Xhx?^GbnU)mcZN=tbfc-OYk+9d&u6B%=8 zIDC9!+{JRU)1oKk~m`~IisqZ#Y)HqnwCX4RD}a)0$dxGlWfFS1q*T2@EJl_tqFgc z(F-);^iZh@e^)|5%1t))s+>odD+2Y1} zSvQ)$Z`l%d@!DxNJ4=At{mf}(K9zuaYv1xMVElIkH@?2*kiGT^!COik!38UC$v-IL zj5>r^p@{*{NmC^^wsHF(I@EuzZR+3ZQvWXqTPxSWoLaT;iYrnYB9c@u%wmNgMe{(M zQSaWSUWBShX#u&&IU zEE`yle9S0SXkm09p;@xVXJ$_t@C)fc%B2sUk zvl0P|tBq2PHn-CR6UXxaX$ab5$fe#n!_=?F6^PlR=!?zb>5TrI->O z+t#riJ!i^1r_CDHW?LoTLf$Sy!kReU0#i$vqvB~KGfh;|e-!CQtlKjVQ#>H8Upvmr z_zWD9hTog-uoFT29?UV*hKvYN_W5wUne;+H&O{}3+wPFX#t4e6ZkoNb&bMT_A1O(oYcPx z^Hvq54?%aM!gu1cn^3B(#f3ZZ!|vtXl33eZ6nEn@MHF{2lkuLBAH{b7#cc{-#h}<{ zqY+~hLNL4~@v9I7A8`@9Ss)l$sEc1l9lwVaknrR8PT==|!dEf)t&caC{=VMzQHev) zdbx|%+Hi~Pg7kzsNRKP9>j&u<0MdDduY4dyTh_u_Oc58>(L6C$%J~;@l2s5kHu`(| z$}Z|3ggN##tSK}|vN=w6=vq~~@Gcv7I>Xi5Zv7%->~FWO2`P)S#J5)msBoqA%bZhu zJ-1skDwJEZ^^rcQo3EfS9yz~g-wnKfo{Na5CK~TkZ^E)GK;Di|%uaWrN8FA-tl|wL zKV@H7(GzaZ4~EaJ<^?;Bu5@mreBdMxm{l?0uu=U`7naB&P!s+nq$VKXh|E=1fW_j0 ztDk?VuJ=>~>wRBxC(A8B5Y|owcn>PTA97hCPMy!)IQ4)~^aQ}Gxo?X)=N(OId{{w?)pb}&gO&7GNqhZ%-mm>&vLcoB2bFwhh;xHN_40c{ zAAnM>$5%xJam5OECy3sqd7cnU4mLRB&mxEuuJ_70O zRZy>JM;l=wTs+zzko1i&ZR;$nP{}d7z%J-~P~7Vbe+~lm2g40Nk&{|J^Okw-xX+ zeNI=`o^Ew^0Maln*7W%XA7%V<=OeK<3(5AJ7}_~HwsmC3PMJn@A!K$mNzq4+6w>bH z0}R9#LVEr(J1V-=FZzrRc0#_3GMVG85#C$Nc^GW%V{5fB|-LW zZj1a4M=_$6pOiOgTG!vgT<-lEe@P&LY~L}WzlVp;Jh}H2F?w++_G^42NEPkZaH)zH zfWJQf9=`ltWS8Xg_{0`pz}y#aVEyH69#g!|*c}JIjE$ZWvTy@OG5d3o?ay-WW4CSS zU9H?7Ta2XK`go;J50w^d+>}s|@`4R2(NRRj1sj6OcnSJd3z^~gX318OD>!M$ zf(?Joeo{`Z(-e2nn8Hl2He*d9l&QN6Q${vJ;~)-)ukdWEIJ}f2zRVbyz~#uOzR;(= zSc2viGOT;#+A|vCy|;VBxcao4#jFra^#CV~23J`hs6crK=Tg;k2K@h z_QM)4rqdAU1_1~VzCh>?)|KHCtTfwn^q6zt_a!OI>2Z8NLA+!j{Rsat5dQbBBfPxj z4C?tm?fKR<0aHpw>smY%Y8tOVeo+1dU#`ZNibhMQUA$h;-Dr8XSmOw=T+y7X_kN?h zd#WWvX}H$OEmVONuIaglU{_m&y_+Eom@ay#WV%i!6r^mrsKj5mB}ubWS8)5q|z{kG|I`0_W}1ts2a&An|J7#P60DrT`m2fD}k zT(&!lI6GI*{+R$&Yh}L9-~?J3dZ^UOEVw4VAZ24hB|64L(Loke#tX~e%6uN$@b}EH zQWg0sCrxZ+UgJbwB^OwP*}@1?wOYmw2XFk216Fy4yk5A$rJP>Q@rivLvNiO>h;byA zH4GHZIlL%`eF|nNZC2&ZMH)RiHD3g|8n%%Iuh87w-YpHG5*-Z*ZElol+C48cd7B$S ziody`^W)-W2hm+0mBfYqB?;7f8WAF+y+-6OP(w8Ss+%?Ba*rFmoFMZyD67C`2@f5G z@(vHsi%T(X^!gxG)Xce5wPV=6h%e6|JH;-TFl_M!%)Obz5izXqo)Mmo=1nkjAIwKK zd@KDg+)DC3mSMaO+e1X}X50cTAU#xS0e>r@AmtX2N_5mwu>}-V#>>&)0{#^gm8glu?3unA0jGlVljn{2I=l-kl1(V9S!Psw$8xMa|uEt6Y9t9OTg{RUB~Tm zIM+Sb25cc&o$rD*p?vXb;Rof*`0{_Y3rf7U&fV(V?T*tJ*lAxhG2D0|gPpdBG~elo zAuou}Q(B`NF$@ zXwhMZ!%&`+8x3D>vN?24ZuGu(tIglBRO7YUcF~_>Bm*uwJyf!g-$^J)*+No@j)E$> z=z_|4$@&|@uR?Xc%nZk4W7qgEa?+%R@YD+I6x(M9m~d7lo7nG#AReE18Yd zh?G*qi9{Ifvb0exYfhEzv`3D}l$buoiPM-yE+HCD&DiWswQrv%6^`yIBg?RKElaJO zM%$y8u>as>Yiej`YU`+XwCurogT>YL8?IB-)jm!bEqG;Jr4k)o?eA3-P6rf^%?rhS zy@@K)0j)2d7g}%aRZ!FpsC{@|s15b(l=ZVTFEn{QJ3)%yv)knL?2_syJ3J5>e{s6N zS2@81#dj+i_VIv;(aU}p8wh_Gz-8m%-<$9|KOC$vXTcCQ>$!^gciCdbCn!m2Qdjz4 zxR&)6g{o?IC#gstSN-4*VC8c;7Ra?@WxoaEbR9DvZ)NQrziT+DFXBjJ9aJ%_;)iJM z+VG^ITCkU;=huR(10_inSmr6;MdJ|X5YLw_e=3aSzZmkTLtPzvFUV*I(tib{cXNL6 zMJGTSW-%im4M`db=}ZWu%LfMB&n2Eq>-I{UWr-x!lV6xff20E^v{{xT)J%e{|XWIm-1G8M-l_X1?w%WyLi#IytP zcLDLQw+nG}0dZUM$%3y`D9XPjpT4r4QlFqyw&ee-0&saocC(G}gUhcW10RkyFGI0YQI=xo!ToS#w6mv;; z2C1UCB$ujq0r=|EktGZ8={n@6IGH5m7GHvIz$8BDSwvR{0Ux@G2#8MFxC&vsE6qa- zNrOI!#Q5fy`5V7u)VLby&Y8JtzLJ{8;*3&L&u@67nZFtTZh3?cQGcKK`W*ei=@0o$ z6Zy>(Fxa1$ac>*z(rGPI!=jE1AD3RqRI=8rQL&@wuX|auKffON-H3mlybERI*jPi~ zrNnnB@g0?#|6G3aks?9umRqPY1BJ8rBg>YNvmf(3Yb+L15VDDqKb?wPX07uB;iZf) zyNC=?x`m{IYc3r`tymB|2IiY5C`veml&Af8)JsRF9p}GMc>ZaMrCvegWrS$Yqa)7~ zF~yoS?VKAt1B)sS>!oGKwG#eE2zGCbczlHz_+<hvMPv~n^#>yY3vQ+R4jWmS8nm_a}6VAg-;%m ziXKNsZt*`kAI0MUqt?JY_F;t(@0!+^E-eq z_*@Geg)g=|>JJ&W_PbOo1_t(E`-nMNt6BpCtc1Ryk;0PeK{<{FLY3)pQo5?tgV&0) z42zI7$*=H>=z0>-l?tEPWA*<>!26XJ9Q-^ZEPy?a&qtZk(e~QW@qK$k`QPO7e_iNT zE*6{BvA9ivDL)qL35!03&wN-_=PY5OW|8>d#a(kHOwPDl3%173$_w5=msb_@;4!K&bh z*U<2oeB~MOI)a&EoJm!sWqa~;P z=%jK~FNIx0>piJ5w>|GpEO(Y>JVI|db;DgY*)Z4!Q9*W)fzpOMk z=Ia3k)$!}YJ){pO)%D>eoHVhQKOD|xdt4aZ5_gZYP=A-yNR-!;5- z6bFLaQ;HtH>kz)J;A8p9@wq09bJ_)~d`7+q%sJk7!ZYXigFvby;8KEs+w{B+lJw8C zD}5zvFrkpE^t{*_MCTgnd4(98wmdJlxcB8-U+Hf z)h`qAd6ZKr{DOEwg^DL$IwhnMvc}?yRV!zWrkK{ll;48J%51F+c&Zuu)kI^td_o}u zn-h(t6*@*4RleC+O*2>6(o{)LA+!&oTIQOK#Rz>+Gu#tSc^Yq`(KC%Tyk#twEhCE_ z+GU5JKQpuVu}qYdLH1|xv)BGvD;M!=Mb*k?CiUzYdRuAouFl4qDa)#sEF2l^zB#m@ zv7!R`BJ^hFJT2{Q;t8#dG-osL;Au&31^L}5o*)_#Kgpakt9jBWoIFjhSJ)po50=vr z%;jpPXq+{Q%|lleG`MIdE+Bk0lEA$F#6`5#JV^PkStW6`omFM(w30NUT+0bY3 zq^DZOj3Ck7tT$GgrP*3F18u}yWof$ESX8S{rFJwMH~C*=jB?p3XYv%c(I^9BA~RcU zHm=| z%q-#+*h&Xb`2j~4FX@deT@9esI(`)`nv>Hu7Czr_4+tHhQJ`NVBn)?obZq z)hP`GOc~}N@nvQGobwYJx|-u~77et%dDMUzpmt={rpC%yW7f4)#LseiGKt;!8LAkK z>+{v>Y-QKrARbrJvlps}#-Fyz(}T^%b(E3`K*~%N6W>MDwq|1~o~Ldb8U>^)%Tw7v z_VmQf{)IAoR8*Zb_KZqxnC}f3ntCQ&HO`+<+YOc!MR3H zW!B8uuit>wCN?MAKi}I}W81G3GOYld6!bIyZ0lnzTFL)ejrg0A1T?VfbIQyyE!+q` z(&QFN=SCDisI}E=jV1Jfoi6`e{>%Aq=Km@G{rtZdda*&Iu!Jt_=yEMxZl%jDbQz{g znl8KPatB=w(dET-IYpQI=wi@ik}hSsSaf*>T^^@PgDy|e<;`??BVFD}m$%d9gLL_2 zy8IShew{9VK$qX6%U{yvb9DI{UH+CX|3;T@(PhDvxcqOrTS<4z=yD@nuBS^sU2dbx z7+to~GC?d{4`yDk}mJ2%e(0E zVY>V(U4EM`AEV13)8!B8@+G=_fi7RC%iq)GJ9POrT^23G4P7?UMWf3Q zT~c(pi!Qt9axYyD(&YiVoTN*RE;?P<=VCYO{p5Z95?$DdWEb)0=;zPiQfu^(e$xp{ zqAEXE&wsO?|9+j-yUwazXSJ@gO4nJP>#WLkR^vLWaGlk+&Z=8ywXL(t)>&Qatg3ZZ z(>kkYoz=6>s##~Xtg}kiSsm-Figi}QI;&uv)vwN~S7)`Wv&z+3-Ri7rbyl-Ft5}`Y ztIn!bXSJ%cO4V7N>a0q2R--zrP@UDM&Z<*qwW+hp)LC8XtSWU@lRB$Noz9WY`f0jjtMqQVW2^LGx?`*K+jPfP z>5u7-t5i?^cj%6-(juznY?ao~9b2WF>5i?^7P@1rw3F`GDjlFZwn``H zj;+#Zx?`&}Lw9VIF47%arPt6MTcsx5u~qt6x?`*KKDuM8^xx=?tKZM>8qA{b!O%fnve&B7q+s(W zz}>5x$Km>787G`*+n=EV`|~~MC|uTs(mM>`N zcW8ZZ?)zvlD3+eqiiXB(_qcn^g_bMna;2J<9i<8dsZICZS3%ED+h4-$QYEiVVfu(V zSDc?)2InjmePV^vWh>tq06TC)@KMiy5L4NtQax5g@pWl3FDJFdG!Q(iYJr*T1cKYW@Y9en(ZkLq?M|P9y zvdgq9yTVKHg_PWqM9HB~lqk4YLYy{Oo)M$v)RMYOT0f)?;s-hdF*s7r%}}!Sa_~sM7)@K529&V!gNA#wKIVJM$U*rl z8b-4Yh)VW)aq;2_$ z!q<=$)74(B1MY@fxx@Ckl9@|m{(_pPm>RlGoyU=G@pwxIJno6*aiiG(hmHyjR~hAa zo{y>Xe56}E_jSN?SVeW^x)Jj;Cf4CyaJ+oqs?P6Eb&KEII^g%k@$wbb*ydQVHh)B&^$&H6 z^%r))`tEqvg{UjD7Uo^!W&J1W41cCu3~%ay;Ux0~|BMEqay-2d&+<3aS^kG^vFwc3 zwBbi4m@isf0Di4AMk$`(#WyMYRSS`{E1t*Z4n%w)UZ=A~#J;PNX5$Yn4ToPD&$y<} z_=avVKF|TQ!EYqr&cy4#8bGyA;+}_>+w>u-b6}$UIk0GAdlj^*_q+7gh>44Yh z7Rt*j98OYgwT@v)o%J)_Vm;LX>)Rs5j73FRY!WFabO-C|jJ~>CjHWwa^qyo!H(ILQ z{-0B4`e(Yu^k4@}M^<9&5yHS$wu-+=y~Y2o&g)0J#p_T9yvB{^$Td#G>8$B?2 z{%Nqf+0dfBPEoQgP6SHGUb+)X|tko@Mw|Btooguyj z%@JW_9V2$Uyf!tKPPE4jb#|ZX7P~v+ z#pc0y2a`}9k3cQ zGDF-M%&1Nr6X)?&_TB2dzN=fj?(KlrfmR1fpH5=#x7C^ZShtwl*8y`O_K5ZeVr|q} zD@#iS5%#81Nt^`vk~+Iz=oY*CJ7D+jR$1Eo;k=_-XTEvUEjAB#z~*2KoAGM;K6MV?(=85< zbiiSVwZXEcc-}s#&fBxy;%%Y>-a@2jPFrWwq@?j2KBvy%m%GK`(GEBaaaM`Lc;>#R z&fIsq#T>^jr@duutW_Fnt$g;XVc5}l7T0RZuFN$^+7(ykB^}5wY?Tg;#ghf~490Jd z=XOY)+f=u>J>CJgA=+vTZ%Y{JxmTUJgWY28LL_C2?pm)>byPEE#B_$7H`#f<@|s;Z}0CG zZx3{fw}ejNr`37;RJV9L)h*u6#LMmP)Oq`xZt?bDw|GnFCtY!ias&VUZt?a|2fT&( zFtqkIm7BF@hVkaP|XgO}SQ#RV?AMq`;1*@DAxE;CEn qVl78uKc^`I=S{H@C;BJwU$yyTO}){Zqu92*A*(q-fthQQ>HiC23;?qL literal 0 HcmV?d00001 diff --git a/it/doctrees/authorization_endpoint.doctree b/it/doctrees/authorization_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..327e633f1ae9523037ff1f814e13e4270cca839a GIT binary patch literal 154010 zcmeEv37i~9b+={RtHY9PNw#IfSi;t7(ai2@SEmmwOR_ENv?SZIu^G+I^zL+Pc4nDF zhYxHHhc$Epn1y^mAP~-kGY}FWgb(AGBZM3T0{OTPhX5gg1VRYGeE;{Vs;jG~r>AFj zcGn5;!>!rwI^KKr>b+O5UcGu??kmnYXVy9NKli-KSl%w4No8`mVku`;Cfo(NQnof~ z6{{03pV;u+iTftH-G$}M=}M_q&RP@hIVh3M+l5@&Do)&mk4ve1)h<+0vVr;8(x_2C zKi9oPzO%bdJTsL_-E|_}_00!fh5vr%n-9EpB0vAGiTpx$&N1r@_1dKLgA)XmJ8vul z5ULaT#g(Cq+m)$S%l1&M3KR(B*>el2*05c)t9GeaNtG+r33pDxE?N`&=GKOQ^y*4&s8Y47AYrNKE9+4o)Vnm5O58hC zzBhq!*s&v#uZ|YFx)O=RRYT?8Yq}KqX5*{B)?EH9zAks=UxIi*VH2p9Uky^_F9Pw` z;J-`p-&675WgykO;Zk`tL$Fe36Zv)dr`7V8=lk;O^WFIk`{tp6jkS;l+;fM@6B*SE zRq63nnVr8PKO0y-UGNn!yO}V{=B@0>q@67l?@idFnGp*(rc%B5KmS$f-BU_u?Q*tY zrANw^RZMe*(M`Y)G@&nF0vbrLh6W zF1+j6Z!Og z6ZuU39*@#_N$Dk_ls+9w=_Mp4>L`5`QMxi_=c3r1z7GVcI;dD%Q*~n~RU6cfMZ|?3 zXg&%Kdc3>JprF^0BG@ZEf<0dnY*{G59u6hgvQUCu!vey#qA8Z80&z%|3?*5k>al3n z#kF}nLy5N9Ae!zss=ZE9?fg)xy)%?*=Z8}59-`XmOu1+mN0QKa6$sU&U4;U% z#tP7F5U|H;)vBEsDcA|6uu z77B@K-bz?!GNWS!tHQ*~K&$77c-6dJ(WE22o`9*67_~CRYNA?73^B!$iegrmR9eg3 zgPm=7!Xwlt;}HrbT_~5W_7Q5KJFl84k67A1gdX1unxzlz-MuS${hr-qp;X5zJ9>Ld zV^-15rHWRyw=!nIG7>M6;I*QattN*pa1pqsR801#`%=QzAY)J|S$9Fn&Sj|_0Fy?F z@y;_?V8F3{y>c>rlWP3}?3+s!zBD6Yuzby8{wk6P6X6m(`%NUu8zY7i9$ zQ~jpUaW7B=NS4Pil|^ShVtC)zmB&0_^eE;ZcW;;kMGU|cb)M3YIwJ;kuJ=Yay{8Bh z_iU$Vv?V~Ji#;0o7z%3xbm^m%S8AOumG(+WM(P~BwoE8`J+&dd@|?CI+e09aco$By;wwKYK3a=unlq33rSSM`%?LATD&L}Mn=-!5-6RiRr94X z)*My^(`qa?93a@-!bmcc@zKV6p~-NUVw}i!k;Xo>Kt@V@3?Sg2xu++~& z3GAC?NaI|PdPl9YohjINvrehBOFXlc0PQaJ(+=(dUw=N*$x?!Jb)_`rcDF~l0ECKg z>->asy5Zvq5bRk&g57l6u_G2+du>z8*F=C+tNo;MPFKsaCm)?;5kV)jh$hm`_K4&M zOi}1*EmLSGWT_-kyZq#9B8oyJwIzufQOGPZX$tuPQxv+q8HGlJJS0Sxq|p>huC;!a z5+X^GEKGpO(tZIJQd*O-!*cA3W~4k3B&8UT${2iwZRk58RsC%Q*zH0;^#m`8zI^;9 z%LtkU%4kYm*WQ#gU{f5oz8RV7#e8kZfyKOc_p!5MR@;K>sL@J*RHm30CE;YG{(QtT z#eA@oCRe*+-h@yQtlLj8Lm}45_g!%6gG{B9RSNXI*ZbR-JyDVIxa+p1mz0gA2kQ;hMaUVLPd1+=KLWC2Z^ zXS7Ef4U%H4r~3&KW?J3qqstL%#I96@XCppKm3_4u`9sc^H1U`9QAB=D1wLzfTpgDl z{uVSaiW(c6QKQ;`8d#VRHy>!(YZ3}iptS)1C|kj(DrR1YBSqN?{?b_V5VXG1nv(k` zMadxKim*vPVGYqvn>6V|Vx_p-u4GH6ta1w;m7J=g2a~s5Jx|**$yr`OA6v<9DgQT3 zi5+n%;Z@f#D7;e*@%EdWyA=}a4z=TXtM7l^;d1Ge4JV{x$N&pn5+q8p6zYYOzwJ0v!aONT8YzFSbe$+it^7>hadP+K-+*Uj zb6jFj&3dNkYlyb#rj_2+bbo47d}*wmgkHyOf6 z2BWFN+XNk_4gsd9Gte@1IyAEeW6Z3<=$QrTOu@{eMiq4iTc*zDPVvs>rZa0WxjAZP zfjacP!*YijRn*zsGIh3eiaNoKAy4XhQh6}Br3rQDd&jAxH-omcNS)1{k~?UqDer7< zB6p~bj#GykRlKvcA$2S^WaJLBr-(PFI;OR_sQ`smc^ivLGH*_rn#(Jp^mV-$sw9mblTPiojN3;36P-m<59tzXGABz{o|D|=w!<2j?qa=>g^5bbXO=pbx0Bg z<cKJrT;@2f`}QwGKMN=NaJmOwii(j?SsPHyd#1VTfB`Bg8Uw>FVL)P{d zM%B!^vLSWCB@pU%kUn)3^5%^a_8!nsWZ?S8)$24AjTXU0C%WGdKh)+dxvcx0!;DFH7!$T zuv63-j6t2jCe)$t9jDHqN1bOhq)sCV)Umbc)>QrK)RQkh31qHMy%N6pMeX>h)FBDv zU!z{zkWP&xP={7wTd~+NeW%_W^3f=I6-I6N>C+(zq*q}(8&c)vfxLZY_ogSlrO@#bbduwBbQYKgF-PE_KzqfB|F9oV4IcOXaWfT@% z9?oR5h&3+q0TK!uwv%>l3}r&X&{lBG+L`2t2Ze9y@z+G{Ov3o8C*F`UtEUiNC9$q+ zNKFd0PVWZ+Ev99Lh)TrO0&5DvGr9158b^zXnMs1GL|q>}#b>5whR7;E&kR9#`3V}f zowk-w7l@wjMft(L zzBK)_eLMfv59QF?w<$&c?@w>(>&1yZ`b_Un_2JRiAEpczSw*jJA29>3HP5E~JUbQO zDL%cSA<1qcKHYsFxohtplPO0sci)ZEahcliu$@JKs6~O?AY8AVgX-+x+}ppYcc8Dg zfAh}1?c4gc_f|#%(|TTRG>M}^K04?(ngrMQNzg{03d0*4Vz{3$+_f{H%^G$!QUiK@ zn|ty9{w=-zz_L>6-97;Pdh3JGXJ<2haV`JU*zJmiU6U>qihCQP$Z;FH_a~3;IdFLY z-s|`7+Ih#`LkIV^GN7CKdNGLogFyaD%{kN3LJ;NXYcNvM>XPBt(+`aXHxjLG?u|Xy#;F|Q}B$zJqLS_9Y5Cl44k{U z8vh~6`PAhDI}hEI+MiB=%dum!c`HOfs;_VB0R6k?;0*ybpNojGj6a^vd!ccErecGs z07nsKUqiy2rWrs6U6PMC?K*TMFxRI@-v=nQluc!JBL+6v>%VB)Wfkp6gijTqiiZ0e z(vVKnX&PzNTNJCb*ozwdgAEbk5ET0coMxgK zq|p(!ZvEjv8wZ~dW`LxQp-d8nLSKJ>axYd10kr2>`0m3}{jHILJgAPf(7uBG zXhYby6YP7B9@@605Aj=leLlZ4BT*@_=&e+dmm^co^$zxJ+Zrlv7u%JR*N6{^;CqeC zdL@9Hb)>L3)({KIs*;8wdnmcPl-)ki=i6K0#`AMv z)h3|srGw^v<>{0vR? zF*;>mKdSzPHc&N>|4w#PeH|-wk2gejpJ3vBZH%gk?nx`CMu6B!b4ck=J*3`|t~Low zJt_omZ-^kvrkif_Ei>Efu3{r0SG9(S;yTXtuPA{v{i)HsQOVg!_p6Y-qam^)`kD@t zBzGS!9d2V##Z=9WA?&=rFMw&6{^%Q5^R33)^C85>TQ^UAD{P>p+SJB@NnGdCIph5elkvA0?2CU>)@NeVI?wX$%G z!05ehmv8V{1*%nCri^TQr>x$v)f|G(MD=QE%+6Ml{oBJD8~g`T==sW|53TX zESRre>yQTDD~;9_YTh?#T><^9I6(X2#Uh&x282ln{ZU}PSFHlAW4qD~fu_u3WZ4e% zZwUYmOI7$2Dy1ZS#iF}btd`H>UnGPK@cmbgn#kot78*2{Eq&w(MrNojX za!S5;?tGaILgDWH?cw%36pxA9{T^=4bLi)WeeGP4p*j=`fXcJ?3cP3F-&qb_6rchYl zV-E5jNsOKZ_CX8l4;@AfK*6G>GSw0qE27V0u9T=1v14sRvvV4~o*R!HJKV!b;;bTi z7eI-GJLOWMr$;8G=;@*KaU%69y~gSeuZC^PtXE1{{s!tGlLS}Ak-INLn5B3Gy7SB3 zn>t4nFRz^QFpna}VgdHH@|lWV@ePH0VI%4(wpbNTUETig#Nd)w6HlySP{0<;-DFE+ zqx%xLIIlr-inrZ)V(1jSb7&xSjd!&H-9`RUB;NGcK)35rbsi3pBfi5=(?vdRQDDuN z{G(g=SPaNM8lc-^KlACPBv~HulV!f-O$ESgaH_8Hxi&h#uo0W0 zG#N~O)@}Y{3{ZpowM>GlrF z7D^UCT#UqwEM|MWXeV~>x%JS&Lr4vZO5K(~Xp-r+{YSgxsjug|ovr zFyv3vbt0|h;+51ynR zH<{L|)7kh-*SN5aK39hFjczjxie|X?v;oIpJM2>jrXk-i2;*QyxfS)?ty{Y)1_DxY zc!RexbZ+Q2!w4BYoCjk-5oDn$Amb%H5tCGr^Ww&3Gzm_`KqyGoOH)x|K({T(ONOJD zQP8hhFO3u!9u|$IitGv5nVc%nKw8|3BMOHmd6tVEcMjh*;M_~iJnn3UA|PA8Ona(7lLh-oW&Xpy0ZK%@CGiL#GE$4{Pn&N+MiCQDBb@{o*K&@oUL zdxGksl&IJlm^;W2t)zY_QH0%$mw7t_qc)QugNlohvCRSGlwz7}>(U5v48!b|whiQ- zohX!GE}zQaA5VQ?zY?KGNSKBs9#*QW>t3CX``)g-UdN;kMKYJPos&9|+y#_qElpXy z2!}(r9@%r_ny39wr1NFUa`DgH~Z|pqM)dUo1+~S|^dsU`<6w1In4Q zjnOU@N`{EWnBtZX|ES{6;JBKm2JJagJ{Dx-k}BG;iQLycx%rQ!1g*A~7;x&D`3jbA zrk$|Rn?_2=%;jmNYrU3hHNLNdgo70G)B#%x<4=}3snHO~w<4C#gIIbQV`Q?y8~+DP zbIA+deGU0H8T%N)wSmj`hveU>E)B`QTizJbL_FihV|e26uh(zIDXL3$?(6@mhpTKsFZvLy}LD;*nzdsjuU(M4j6WjhkDEsSIH9TJqNd3 zb3%yZh3=vu*uYjbT|l-=U%O&UfEHTxA&mNaBqoSR9hnJtRVH*lW`dWoxzZ@^otbblXwHQnc$n5QkXqEWy9iI~ z49=Wn?drrhf2LI(e$on9-s0je5*GlKu+zgE$<85y(DP7U1Yq|!0haJG{hCzk#u&A( zr@mG>yP6br=Lt@maAzec62;j`^$ZxVZqfwRx>EF}9IpBG2lE>+I}EOJ_wUBq&cb<2 zEI$4I%F+;`B}cFmgT<#<#p)fNx{alT*f`K`#yuTrRrBCWfC?0c;mwNPt@v%O5pAzY z*9tYx%EIqd5IshVAd?B!U}P1o(VV_TXA1=*AljLH0cqtMu=(1OyVF?k??{+ZNcsST z*zq!!u8}R!sRz2dqHJ>*z}=X4&-QIFt72gtp_txZzQE{I^$EV=JAoeXAtN~tIMK#1 zodx!Z98dbqtB#aQwXwQSw4IDgG7EGiQr*Xfdk467vs4iG3GTaqnEB&^nIGk`az257 z)V7s`KoKgq(s2G3W%pgxfi~*lV1nc=ob1z5)+5O5a>;)~rFhSq>(~@6pRKE6&P%LJ z4y(GkJiSG@s3 z9RJA75iO{{EsBcC&y#Mbl&haX-Ol&wSggA#+XWm_<}9-{-Ggqblkw?25`%Iky>Xd_ zlZ#PH(mTUNo1*&OBR2CHg@#DSGJZ+7He9@t3$eFI4r;`ESny7Z`+PaVLa83wM`fp7 zB`qsi3;qs1lDfn z1lowZcz7R^zVRrzYVqKVQmbU`tA)ZNs2YEv;8du7*QiX_Um9cM`w(7g;~UqvI37*A zbGV^uhH_@6hMUM3z`s~41?AL(1kun z9oTb?&9NQh3e|#O?1mv31M97Vpq1GDe)x>TNC;)0iG(OyS9z zi&#zTOx$y?_LlJLEY*mq8!#c;f;7c$Ge$y zjr9fLC$-}##?LGYchWE=PPi0nD;1%zKy2$~3KI{pw!uM_2{+~$BRa8xap$OU|KPK7 zkwFfU&SqSLV1ek#X$o!JW8~Z%f|4H>!oD>Qo@t@|ei~0=Dz)WDLi^2l87j2t!*mGk zPXwVNp{=26W!P}rlJk3Lu9>(phAp~-$qVg^f_j+C#c?rS0U6>HE4EM6!D7aS7a z$u2l9Mf;Hpj;Dse+S-C+4WrN)+lU3n22}0rf&+JCIUY^@Hoc%{v=}gF2Q~FX$7jb( ztA}UNcn8(PLA(rA5A?5< z!a-)7XKHNd{{a)jw307w+>sLAtNp>YK2W60rgh+Z(K5nv8OiAf zH1rb-1T5HS(XgFsL{Cn+c%a5vH27^M(PQI5BI=qVVF1IV2<`WTxYzl2^>M5`E$G&C zTR#C|oe*V(ELR)X?j>r6AFU-tiO?;6RW2RYtFgy_Y1ke=`j_34O!xv082=w1j^1X! z^Jm~P<+l-jALnCruew{`iuZ4$XLyiWZ^OTx-)gkNHO;B{{Ss1v_tpr-+=-# z9lURgfq;oNZt-#69HUliXvf;W{|k+Hqy788jF0*!V<2Iojw^bc$70knP>+_AQbpb$ zqgAa2msshRDLZ{b%11QO7IA}1Ur_~eq5RW~MYejo@o8XPIg!$uJGj4a@gml}cflQCjzzqU z1;<83ca7dur~}N~R=_oA!EFWV+^Dw_+YRlKcG4+HUlu`qR`N@8oF z(PwXS;cBK^w6K*H$acokEb6=%bTbS(H*{~|T9q#+I)9nS235DW0KV|=E=Y1OcjrrH z(epvFf#H-}DWU)Zyu`+eW9OWal@z@?TvfL z7bh&X|AUy2Noa-u;L0k;Bk8%AV;*w|YDSAqQ)EzEtD7K55VR&TW_rc>8X9!6F8w<; zFUHHz6(@a|juq!SgHX|mQ$y9tuw9Fq<7h6pc=PjR-LOS>Al2!Qgi>fHkPZ6qBpvq^ zGu7{KaXv+~7w)*(D5E*{(@c9)Mg@_O;_MSK@HLqmw{kgu9;23I?nk(2Q+>F`uMf8j zY*Txx>4Avt^zSg9&g9hHYOU^!emzyUsb1Al$5E>8=lI@G)rrccs#_s<(0zE<54hW? z6jWT;Cr^TPEskv;%|p>3|HoBtSH)LvptP}dp5~hsRdxVLUUTDI40iN%GdUGEo;ly< zk&2!Qt#Rs1i{afgm_ac-h?k*am_AI07``j=*vHmEwl>|+lckeCh)|Ln7GlL<1m-)>C6%U%1}|{M4>tCg{9UV>)Oe@aF*_`^m}qSe}#>-d^qbxr@kmTpf78P@6eZC zIi442O4I2>OsBdrkD%ID2V>MS zP>&Xc((G9fqgCn5l{2eT&fJhpEQVrn9t3ET+rsj*ybzyb^4jxbAZZdDm(Ms4#Hb|+ zejgWYI>quvOvw>z1nC1P6;!Dhj3*IiwUF@=rW$faA>l5k5<8l><;Z^C&=vPh(PfMH zX48$mI8P-KU;4A+2A#lfWTKht%T+4&!~{rLO6SYC6aQB!=qTpo?Pw7(C!wXH#F~mX zc^}n(-1!4D-h|-v$D155<4q<@9?xhH^oX7*CTHM+9_RIdE($lFBPb?k%=E(XtH7vk z;rLfHG%z~ZDDxkap%2rsaQtBqDq1*ds9G5|Tr}i-8qKvdY|$M^33@lT+Saylykjzp zmwIxr;W3$|C=*i{cA;o9Dwr&f+l!p}F=|O+IERZi6^6&mpl6YCLY^i)CUPfWA>&`H za5BZKlwGclrrLZ{GNo0(VN(`bv}#=$+PXH-dYE92u?=#K*am60bMD*RFBwEHQiWaI zxLFO=7KX}P5w^B>vWbarw%~V;MC_ehi>lFkC;l8OV(;YQ#-qXeQRY4h?uBxQ@Is*Y zwo$}rL{B%9C#k9RO>p&z;g~!*(_**=jOxU&g_ogXm_AI07=B?8DiXsQs#b;#7iT#` zXs($6GDJyq2a^}WEggJ$BaMdGSZQ|f<;^@kjpriqr}THdAqGv%34mLCzD_8M(TJXW zCQnjRA8CTCPbkOa$(a_)i_Z%Y%Kr^CLxnPZm=2-*lps_jlr>bX3>z+ebAHz9utj$; zd7%u?Td{;|ltVplJAk~L!gINlHleN}y2Lv$z70j2DI$}>anqZ#IYuohbT@I)WnoCM_-Qw9k7}QJxSQRLl zHr*!#c$%i0({_E(p>dpt+jMA{hiMEtDyN2VM8;Rb=h!%bmV<|B{3W9}M>#k0)W+k^ zA=9}*F#DVv$IroM)4%a6IKZAuMvQ2*crj-st}=9P0ZpSu#HV)R%}RHs)y~U-QQcbL z`NU9RE*bhT9ct&zL8wUWXsB8lHeBZDJb>m}8n);TCa-q7dU|l3+UQs{RPQ`OXrfO%eN*kucJhqQ< zk$7o`=V=K_2*d+8KEtI?jG9k>K40i!1I=-Uz_HWV~8xqS-ClaxN)QiW8Bq+gG6o)`QxQcNBy zZtUXpZNs8mROVJn^d@cqOm*E{qk94Ax)LkLaUuc=3LPo%wOGSY;fc7Q-Gyx z58*m4sgaEx8y81}Jv5Z2MJ7;2Oiz@#%ScqknkchSl-DJ1{hvY=k2whR%1|rJk!`>n z4|-I^1u-Lbkyu0wcBzc}9EmSxXuPp^Do0mArbc~<@m`PpW%0-UQZ@FtzjX%C^#+pQ zXl)=zyn&1!{$|43l+`nBj~pR7K#3V4-q+z}s69d-ro$e|1)(B)L_-xl0H$zuQ1cmR zE~Y&qbZm47leb5f(S0Gfx)oRVrjdgx)GB#^20>UQi~WW5w0j2?xy zyC+61$?j*kXoziMvind|)5L!#7YRYy8YgvzdxX z{Rj#Kb$@HV)DNMBs2Liu!SzX0ZPl0Rpxq zVq?ytnN}LV07i96;|F*dsx;`sbSRDUmIt6BrJocpH=t*DOOvyk5N&sss20?AhkV-Zo)B1D({`sBg~r%M zXuAhdwQX$|nhCpv8SBy1fBZqvGg_*dlb@Qpz6owVZ5MO$&$PDt5RG?miS!3}8LI8* z!*po7zYIb}+D=2&%CL>0=3CKRGf8jA?C1_Auk9kQbNDBszL=xIy8yn&^lv=3i2r1G z#y`fu*<|o%gHqp$QA<+l>s+*{cAMFlxp^yyVW&DgV;OppBNi)WZUsYS4r6OVb}3qj z;^+t=dkLzxDr8%WnJa^li12kw3^5wflgs2uYHD^9Tzx_}CQr_^(7hQL)d}65co`~m z>BDpg-E0sl61p0yR)(#Dn%AJYC>E_7w&)HfFLak86;HODMkE133PRTx_tOvv$=jui zYD4b1JQC)-^#?`y#P5AEus2z~3Yy&=qm~rEr@3e|@q7F;aRN1>Ok_XNTE0l9>sE0y zJT`0)S>fB5;d|N(IPA;&Lh!s-Im&~tnWu;aiq3#j3>!xY8Bmhy3OdhJI7!8#xN11i z5ZO_~1wECq3@+!|C_*@Jp&N&E;4G;)fst5?kzMO;KiG6@dZ~A5LKNs9@t{3*tg*#q}B9iUN3i1y}-yS8>#(fGmg@w{$M6IZ0+Fysj+L{INX-1(jwh7KG=N3|*$xAo~>9E5RL8!MVr}Q?y-93E}y%vNV7)XifWZ9V3x}swS--^5J z^f3Sx*k3`$c`VW>sL(2p^74?58kmc}#*+9OJaVQa?o5#XchT}>S7Se-HtJSm1hZez z{#AWEhFWvCbcEx{GFF~45Q7sv>CL%vALhzeL7tdWCFWe2X=QN91tH2{F z${-blij;wds+D1T4r(q$b1e;9bO)1H2FN&Pok7++u|4Z|VK_Gt?S(3sjWSvh>}T4? zQUo`~z}IB%`$45WF=|Oga2*$IstBB04(>gkIEGkk$kEX;&IwakkMuF{iLtM(lEob! z@U(I6H{@f3$F7tUBAqhGAPe9@aSCiVbfS16W98@=mb$HUbN}`eOi4Ag zKqi^1b&1Z^3N*Y7tpoKLTB$oYoW9r~4Z3qLzBkO!Dk_`0Xn{;dzP+9cUGp2rs$X~_ z^u>&SEQWj`!)_Lhn}c;z{2Z*HAm?E9Clwc%M^9*TEqP-OK zD5K@dkC^u6WC`+~+~NO0417)Iejcdwy%@D5bAN}6HWl=v&4lg7lJIh zgU*QiO1M*df@rVAeWjx1$}5@n{>k!+S#-7@|HIAhfh+Z-+vGwKv!sao_&A*cocl=LTutMa2kjnN6<$^o;=N1==QT(gt!!MJ&D2dP z|8!Vd%@1*1KN0I`_iD;Ujq64kHJG&iSWwY-G<%o?{S7qrZf+{N*VYI+(_-WMM8}}m z_!3@*iVgZO9b)4bL8wS32wR-M&vy_U{y18`4m<04$2*(gK`@@pTM?uJJ#gh%H%eM(*gyTl1%dioVwOC zxK^})kYb5C;CPayCYHJ}3BqIpOOB!=sfhGxH-G&9Eg?X+7FcpKWc3$=W`7o=mZaH-xM))q@S*+4|539@#8E8h5P~WbW4Oinluh}-WPl~& zBgZmG837kD_S?Ssz^e{n`))t~n;5G-`rZVRhm^_`E6I7r5OIm%&rz#dM&PGNLXu;1 zlwHh4Bp;!3*3^`R7)|b8I*~0jOWtS-)Fj7q)=t1Dx_Qgs7BobSB5e#JN;#TT7_u-M z|0kp1iN3GLU>%bmT=2tJI?fL>E&ArK4iSAn1)8Cvk3LL?=({Kg6^T9#RkUO>hwV2} z^T(|YTXYA8=!-5YubvWjFf=Y2cJ$rbr0^$?!zUVVjEC zH1YJg-0G3CcY)N@lxSYy9naMu8X3O&d#<75UNK;*1 zyT$!kbesS~Q^}U?v1;P*S&VCu%40P(I%Y$GLIsPF1R(z8_3GS$jkZ!Ls88?-n5>vB z)G)R?b|g}%Ui=@#$6<}$v6ERVHFmZuv7?ZIp3RI{I}&5unOKS$xl)e*JDgm*0V9gU+$0HQ!AYG%-1~BI)x^)Ax%gS7>JKg6$2^5^d zcU!xp%R^Ar_Ug@6j24qFOk*FIC14~{;1nbGO zAr)MF?U4SU+j*=Fz~%|dR5#KoV7|}>Fx%QShlAiZUXqdT$XrRj6cguK02|B#``^FH z7B=%5g&khhkP4dS|H?ycS{ciN%Mg!y&E<)1<)<+iM%o+HA=^R&Z7gndj}q=lii3q0 z#aVh;ew8Zf7i@uCX|yY64P*UUP16Fj zo77R-(+6odhV!M|4!U|Gadl$t(M_ATtmQake<5-|RP#Hqw6CJjmcb1>x)S&wxhbr2 z1+VTA6?Z5QQZ_ovKs8k>7b=-y zD?PMj&?-{1-K7d%GL{0dKsOsUq;eJ)TwALSC%3H)Z@z4$Dz%~Rwa2u=QlN4;fj4w>MWUKPj+Dg101rUhBXHSt`=Isr){q+9 zv{y0$cdra!H!G#e)>t6}K3RJ;6F_2IwyL#qF>#NF#aaW6wL46-HU`Rh{i%Z9i-sj7 zXVz7a??t`)y5yuj{_AP->uKT_Y*ExOIsR8;ns|z;zlox9=T%BIc)KUu>wEJ!W71o$ z6%n1>d%9FU3Gcg|OJ;2=S+aB4WUd5PeAp|)-#L+Amw%c&7pqw``jERoIX@@ddD8po zF3sB``2zl{rZeS{%EWyW?jpERtsrx&2-*E`RlNVN_7Ug_!2XglLR zY;>UL{ZtD_c=PKI<~JPl#}4CWh*To2c1i6tA0|(WqvYaBjJ#UEt2KE3saT6&cGrYE z7dy3fZo*yVRZnvDq^M3lhWr-*>@N%m7zL~p9A7YBejaURcRMBDJ2!Dy?%mq(`g6nB zpRs5Mz@Hz0EbJ~_Qk!9S@>rYqIRrB6p=vOPUakp;&``*gDRsam^lU&C-ET0d0XnWr zUvR3`o})*;NJGBLxgD*FkyotqTEM)}?aJgvOSlaS+c$oL>pb{DZt!1=!JFgqdX2>4 zLr0GuI(P_s0~HGA^mYKS6V7`mwCS>br?E986B#6G6}8u*m<5|;-bi8#;UKmhu=z%t zAGG(cS{HGn>XMGc(ZjgSi@QmvYrRs5#sJgBF4)YV08|lBK)XZ23#Cp2s|2l#Xen_E zFxy)kE+wpDZmfi&GD_8C%|-X}%(t;=bgxjt2bIm5e~9BU8cv$oNdGjEf7qRS+Rjz; z6Zr{uHu<95Rbsou9>vy(5G(_!%BhiweEPnLe8zb_aR*JP1Nrs&ZcM6W7~Gf2!Hse{ z62metc(UVnQPV}u;A*|vn2u97@Jv0L!}hfGuBYnTh^RxRh=?;)-^2CH4d@2p*wh6J z34chj=r?-)n(L)EG#Im2J-Me1#`Q@Ip=TC+GRAnCB$KAo&&-9 zFG7!KqE0$PH#;xJHziGum$2J1r8C2ekn(HUfNbtMh`o6n>gO$QneL9|r&pOOC>1UC zl_>#(N~*_VxKbPAJa$!kM^{%8<)xdRZvTIYK1CqlnjG{4cX;t9?`_UVt1;o7$G-DTt9ws5M1rJY!z*Ny;BgL~pcOeSRr{184)m>N!EI<(i z)X_L70EzSxanYBDGXI&DOMRTp=;}hSgI59*LdoCH#O@U>xliI^^kskv-R4w})6&XkM5e+RRRc3+19K&-$4IF%Aw1e9|2_VkDiO19Ypz$*h@ z-3sT$?w7{KYM_$5EKV>KMJ*vrhSFSGWXOTb(PaV)-fdKTZirNy_}u=u!r!{qxB zX(hkON1=Y-AjQGSn4--O)8un}fDfN10I zXGGqB@z;EPIO`&+6-|4&KBNxh`mp3%ABOcC$LKu2jh_8Rr|8!-SAu4VY2^HV1Fkvb z7n+_Vr}(`v0pU|aN<+}9%x4aGT(B-i!+HRp&IB>7_vQmQ5TA_H0T19hzbhfG4zDi?M963Sg-te-*%^Ey-tAqE0enNf}g zUXrZHz!S+*x<0*ZjbtAH$sBGfx>ti_jfGj12&K`vCPr7L2&Gzr?;H18Cqf$+jRKIC z2O(anmfs>RN9!_Swh@_>_b2HKYxi)(J^8e%tg_NZH^a;%6yAzE)W3&ooQD z)PGF#hrg10c%~J-38TSQH1yg9Vf4@gH^>9mD&JliW4NURp$?dDFT&<=`2J}$G>~X& zdsT7bJn=%;JJ1F^%dlH)Y}V@L!iW+_u%_DpJ-7v5TzB zKRX8cQV4il;THme?5zlaM<4|Hn8Bh=t(QPTc=E#Rz+LGJW70d{G2)m+e6ca}+;<&D z4hihvBT5IsI9?hNW4F)?2|#d0CNWwuDm)df-?A`El=%T))a0%%&+8OHbq99+3~s<>>-5)b-_XdfizQ3 zq&n1$bN^3?rlFb&YYriK&EDN9-{oQ+rDX?n>i#{z45#iROGm}HsvE*SK~=3yyWh49gSS*5ymK5CEEPZRFB!PJ z%^yo|gyK(FD(apPvqfyTj_UVfyWNX$F$fX>rR7bvSu2+w65(w)Sm68(k>UUaKDetx z3nH8!#RyzctTv=Eq}+=fnC3ftG4#YOssx5xfX zAkxgWC?nv%MoeKq@rghf%<;RxFt-#ra-G8E<(}kmTh7=|TflyIP|RI~-B&Ng`&~q9kS_gBhJ5k>^Hkg&BaLTRNpewtI6wdcW#2HkhJezkAu4e+fheb?4W4 z-dn66+UUg_n8j#3N_6S;Bm{;}k1eD>n{20;Bl_1E(YY~dN$2vpT-5Z(?^E>b*bo|& z?namOlvZy+>5lgAjX@IK#v20y#Ww~$OrmJJ+8l$w!5CZ-qn0rSTInjIL8<>J|2Yl! z6PWhRnB+>@S=Do09SSs!_OBhKFlkfK&;hN?Da6Ltsv_}RrIyV?EmC-Hs0P~z9jKI2 z#;1`Ct>Hzfd-hYJG&F=0k$#viOsD+au+0&;M;Pl2n#$G`#8HO_-Q}`k zk}D=r%4d74kGfTSlvX$rg{?Gt@HznKbSU@0Hp+IT)V++DfY$#rpVk-gr_RUfUUfU4 zsC(D&n6UG=D7)_hBH73B3%&j}Ggj+uT-AX#Lg0A34j1Qpb+5Xc=C4LP#4b9R9D1YI zM~MeTzV5kPO7q&s@F_|c5z^8F@DV0l^yD?!@=GB1pT?*qQ+0oUi#A2|yq=!j7G(_O zY ztx-Q0MPj1UdXU z=Q*kIDIAybTp)BviySp&?jwtu)zV3;NbUx4j6Sgwet{~26X4Iy6mXalX zGuW>a=N#n`d)Q)Yo8zy?_b`vIX$)NuMjmBxtf(iQZtXa?7A;$)VMHCXVf4}e@r3s* z9zo1#IbhC!uVDrpU`j+2t+g32(^>x?A~wKuH}Wi;#Y=JM4m>)`cb1DjOh?xL*94)W zqktN!R)+2CsCf#_H4}Hnutj$u^}~8@wO!kZ@`Q&=_&-6r%68&XdeVN7=+eX`B5kMl z$H3WS@Na-p?~PGQQtI7Yw5f>yW4N^7?Ly8uy0@CsrQ=*ZpV(#D<#Rww9~d(0BMeK5 zcC5hR`XwiBM&{4Y;;b(32l)=Z3OhMc^Vx<$4v z{Jo}-lrU%!eQ{&>^|*YV$Hf%Q7dApqiRV?+b3OXH)vs`?(b7hWXaaym^b4L8#Ph_g zAWZahGP&@Z;KI)`HqnT;#)UI2W|uxCM9e+`G(*KKeV7h0n+QThVpc=d%CLP4HGkgf zutj$;c`-Y`hpwdyHKVTr>QczgMj1Wnt|6Ml6R|r`w3%8lnfu$I($*NYBy$gP(WWBy z-72#N2{?#a&zgo0hVBNT>oj1{iVHa4m8_FH!b`}KgHkx`xpfbTO>9IU&!|kzp?sA{ z6s6M+s9Y6f5hup%M?Xk64^jjJ8{%39`))M^d}?>h{T~OnC)VzW!6fF$KaP>Vt>Ys< z6KNWrOStr6ot#(R;qYx`!*W7CbG>Oq3>aY6zuSp`cDEKUjYX* zoW10PNb=cc+<`;8XOwb>{@u~rTOLco3ae6fAW9;Mzk87)s4$etp6q=FRlGXWH?V0q zGrVaaw|(1|fz1Pb{o99!w^_N&_AS{=E^BSFGX2?sE!&3s28V_Rvzx8{t(&*!Hsik> zKJ;zt+q@;aH9MFawD5CVcBrp!Q>HJwZ8)<%vwc(FrmdR>Huq&R{e7D@4{qDMX&|#L zGmK`kxuLZ!`Hne^sfWEZtvS0(evJLrtb0 zVf@>afuEW!vLp(F#?8fi=`0^4nAL>72UjA_m$!VT#qFQ=3Ymw(J@U~0z%_IJI zable)%BX3M)0H<+jF8S`WtGeD_9;GT@YN&Ymzoff+?Fy5>We69MnU}>;Cq?>DCr;X z#SLvT$s5CA@wV<^c<>Ms3`3}#8I$q28F-E)P zO>RH6-8TIDsj`jf*iYR9l$B2~u%CJZJ~cDyq)%`c6Rs5tol;p}8>5z7uwKnYn=V*m z?5A32DRMt`1O;NEosEHjIa8ki+9zVvY7OmJ`>79V#2f9WzA!%O&yRtGiTW>r`U5d) z8K_4~LFvfZ5u;VPpDJfor}k5EFkufF8V&sIfJ?I4JW)(*t`Fi{OfGwW4D<|AA2^3Z z=zC*SleB&}7i~JbHr|Q==fn;~#P2x4`->t;CtF&HtFY?A<=$zQ=GHYQSbX6j0sH2{h!+u2hkFe?FejXu~)k z5XdlmOzgyeg=u8A;4jM2rnt*s!WpGj7osiPnv=1M6VCThm16#ft7pe>Bf@Oz#$ALb zP7V}6v+Be+f2L%i6XQ;W>eGd9nw)H?A0j|h9+v~NXpD)L{*whwO$AZyvrTXz3!^pG zm}xioB?(L?vLO6f-529!s2iL5cwJ(;*Ur$fj{X9sGCmbOw&5s*n(8VO@Y$E5L z7}ex7xQ>f9m5~4J$BO;dIlAy03plzkoKMvW@@x#=B%ZMm3JiBQ`L<8l1w=;)mpdKR z!}enlH;H5Ama~Rx2>C6Jc=06qFpbFdi)*^D4#w4>*w>^y(R{xIZox%$zP22%z0B5$ z?hKZQ1ps^d*GxM;(x(Ko2rFh%Covr{2p106{8d4|<64#kTqlgdenewKpl=HO_ z))EluGB`z&*ocm4+*&H3a_#d*EtJ48LR+AeXrEUH#bmH2i_Ke#PPB`spxM*`$3{?U z&*HU{C4`n=KV&}WbY#qba;wqYB_m@90FI1FG#iCzpy$g$QVzdC?8&TBQ{yT8qEMv=MWB8U!@SGZB8{B1CQNPRLJEo?-`gT~1-Ieo=-4)q^ zB4?Gz82}zz9n*12?az5)w7#q2-w}C|wb7xSnP~U%e-Nt)Be>3e{GTy6R$9S7X7Wcf zx2c9MBwqPZjA~L1{R`Kgg4u?9%w)pV&mDLu`w)l7t#z4Tt`(nboKSs6I@Q$@Bb*sj_(XQ0-__!a7 zfrN?s8p8eN7}X5i8!K7JTSuzy@5h)ya$8D@w@z(Ko!0|T9@d2EoK>`~To0>2W2xkf z`{-^I);#y37<89wq2Gu>K$Gs565XF4qnf1q16;JJjQNfI-+bUzh!xJ$-EEZjAW^^z zfgqjq$Yu~iOkp;NSq5?Lw&51#6nPw$ObLL=jheyzcQrayf|YauR~XV#moLm!8PiIM z?j1%e>@C|k6i;_Y+oA7gbXoZF8W-@a!A~*$q7|mpF^@5>W>M$Gpo4Kwsk=bjl$(+&=y3fbU&{a2mn2uHV<{(tG>ef)T!l?-ww`FLrnU!aZ zTXYXnb>GL_(AJjd%AQ&=BU6$fXP`I{7^Z=5rlAn#{rMqPH1i+jp)rL_a575fKNN!+ zCiAZ)BJPh-O%ic07j3GCpQR64$~#Cw6LI{Wb`@pnQNEKN=iL>(I6oQ3{m0d>J15`syOs1cyNP`MT>fGBHSF`90>0C+nfX)@X z5G`lS$=FSkadQY>K@zk!8JpLXA(7(e!5E;M7;hkqpBJNAYZ%Y8&V4`8 zEU0tejF+K0mp)8~&izCXD$=slL7GDBW^Ikv5cq zUR;Ag$=1bDOVC0)g=1^ZWJ_&o`pvqW*m-(%;I?`lNZm*2z?JykPzQ?2Gphri#`KHk zKdA!~jH_96hIF7Ldq4*YUWlIe<^)O71bL$46Qqd_JPblc=)fZ}hD3^lgCRo_lpZF= zDZ+SPjB2fkgqhZX&mo!xbzl)MLvPw-9FaI>mBqoeFctU?8UvvM7yHX<3H~k~3{$KGd04XhAH=}lWcPj|+goE)lkEN` zF4|NB-l%sb5p~SDL}|Me-q^8nX{dmUeGx-iwaQSFG50#3-a?C-c7MUNn;z}Ay3~{|qRqsiiSYnod_jzAtzkUV+V2LUSy20J#mi9bM<1p` z``sRdinO1GsufNhq;VTWd(DR17`NyiCa?W2>Zw|zNIjh?+l8}fY(t*P*o6$lf0!by z(QpVwxVk|#E!R);5ShXzI4Px0ti+&-ISIB9F~?$5lf)e5qD^(;(fArn;$O64tH&+v zHLfZ8a;E4MYf6NwP+U)cU%jfN{-adoTk*Z2suY!HR#pBn6EK=3rK)@{<7yV2Ayp~K z9#EBn8KT95IcK)goOx*oUcp(}+MH>kD!+*iBNmF^jxi)sN_;&A=qAQ|Gs{)0`;(Ao_ zsx;;F2ve5V(0~YKc~QfPTDV`!!(J8(nnhUN1CX|x1+-d_4v*hLn5WZ z@5cb$#Q18$_$@K2wTAIbtH*yJngv&qpTf&f^++G4Lp^>!2ocubj3L-E~(x?x9R-xKdLeAKBbi z!>H6rRJ$<5Tlj>im zF{-tO@k~qf2Z&}ti9Uvxp%R@wOov2&I0zLP0_xi{nj;E|B}htY5D#+v^qKY{$*;RPQDYg4duH)C7P$r zVZWY+{ZnW&=B$Z1>`mnR&j_`~^8M%d98o!;l|a3pKd*|?D#8K*f(uhQ?J6*Gmh-LON@S%wT?W(-XQAw_i+7K)TgfCw}JyD z(XAVh02r6iUpVQN!*8Om$!V5XPz!aMg`jPySp+K4v&m$yeZ*d4OqXa9w#HsfG|PJl zwZ@v|kMKFBW_eEx&`pf@6UOh1QLQzMXIis-ooE(ZIs6S?hH4i2FddrZ--1w)X3`YBqXn7 zWX@)t_E+8!{nEKQHK6-E-)*0_9NA0xBgz({fbB9}7$dHM(UNW>D-V4c0JeuHYof?X zQB@b6A}XwES8F&|WF>kA`}z{s;W8R2d`UNr(tQHB-%6xJ75m-B9jean602cK(+y(j zDTYwX?l&+Wn;LC-9Rf<7oEN}MxAQh`Ct3nZOM<#&4YwkME?yo#0a#-`A@(rk(w)TL zujR(0;dlv{0Yx>FaH{S6hJ*f##kyT=?$L#0$(*e+bvwTYMzqwGV_pejAWlAwtIh(q zm|4DbkB&Wu`wgV{#s#3~&2s*34c$)c{3XD5{ttSoIG-19s7vw251qSmMBe_J&X$|dPFW&>`_Ag70~@AXE7gsOns zmy8-4!l22|CVA`K`nGS59~4D;g@ik=QmU1+)`Uowjub|-+@;wXQo~>mSAII^E>>>} zxb|t{pu3=g%rUr9sxsj&N7l(&)h<+0!)4fyfONv0cWb6lLuSyIPl#*B`5xqh?!plm zm+;QuayZ7y>M3ymr7Oa zKUlsm`)0XIDBESRHkv*&Tq=)F;LTFFl(svR6%=d#2X9e73od-v|Y_3=UxW) zUeV_zvV!*l{tTRUsiq6KQ>!qs?_9SlpDB2M&UKetXKc_4c>!t_RcNj|m+##|drRqx zKF|s!%2s9+Zx&MKPKz+YC4Nio;#jSkwu&@YiX#*5+*)-wxoyI|#QY%6nx^xaVy2O%RCbpU{1p%>5Aqa%4`yy5Q$!Bj z5sNbVtXv0;$z*VVDM5} zzd|Ems3p1D=vdlgIuMm#s1&Kx;CcK8lr2_h==H0yidD;%(q~4AmzLrB#8Smd`)e|X zWUFc1cxDUUJTINID|Dg>h)5{stI5Fg#9a)0#GPq0Z^1OOWO~>x0KdB?+*R}o{owR3 zJ2b5#HJHPQFDhqFgWlp#aOiTHRA8Lq2>7sIkAi9kmaTV}j#*=fqQJdsAR5zbF})ee z0DPJl?u9BDEM8YqV`r=RQZZF3kMvHsE2$&{fRbrCcZA!$F(M1_K6!cHAV|6txrhVJ z(;MCV6{`8@T(c8k=gbf$QLdVw*tfvF6l^(~_GYJtK)NzUO!APsta7$k&74W+?U8%| z|A9y56iUSTiz}mucuPOKhG|^^q0Z;O#h>XyDT~|en6#H>^VnC*;-ImZZlE%g5VcR% z#?Zx5$RyYjpuZ3U4}pP7S-Ut4Hc)b51xboZZ75LA9wq)Qlrmy6&S8lJwiz8l0Dq-= z79iv;tBOumW>M;78i$_kLOPSn!G0kDGVU&y8F#_2g<&Dm9&%?}#Zwbdk94~|NfS(A za3h;cfFq52{6;KDCos-(0L7LNvkk6cuT0zrlji#T#{3=mz4_DmeE#A5^Yib_zb^k+ z{)73?o654clO<^>uJ#vlPD4!c;-5>rcOjKHUzRXD%c%eMC3W>lK`QS7Wu`uH9<={==<$|ic-*`k zk2kNt5^>l1`-T#*M=P?n^pIen(9sYIXWTXQg^g10fx(e+FZ7oZ;8eya3WypS zy@c^0ezg)KH5;)&wKEB#KfZSJRr1alZu7C+mBD6M9&;%QrgSLc#-Ytohg{eWE%vP% zr;4_7Jo?UYT$O?@58$5+8(#Q>ETc@#olip~%jLhB|62Zs`5)wek^e8JYZls?Pmk5~ zxPTr{qsL|R*hG(BdOU+3SJ7iXJ@(S$c6!`Ok70Ub=~1D_7(E`K$9?qpO?teD9dOS{#pU~sq=yC43c>I!nokzbG z)8i6)Tttrz^tgf^Tj()Bk6rY*mL7-caey9o(c=z!IP@5y$7y<0>G1+QUUBd3=kWiW z=hCZ}(c`!1@j80Eh8}OH$J^-f0eZZj9*@!EWAykeJ^q>=U!%vD>G99>_%1zuMvwoX z$Gq8i%%;cr^jJoZ1U)XLN0J^r^w>dq&*U;lidhDaejr2H9k6Y+r(PM}nUnML5OZ50M z=A82n^!Naly3YIQaYq*(x6$KUi}Cn6JzljMk5|&;Z>TWM4d<`v*I&}(^H0I!v-Ef= zCaCk9^!R&f{_p6q5;q<>E9k+i3tmusnm&Az9)ETj9v{M^<}RdZMW?%j%>L$h{)glF zUySpt8s`}`&a-KpXVN&&qH&%<<2-xDdFJ3cXRz=%&zNzZE#o{>#(9>E^9&j1*)h&D zW1MHjIM0Z2o(69XQm!!h8|~T z9%n`#XC@wJ1|DbT9cRWJXQmxzh8<^S9cM-zXC@tI1|4VS9B0NHXQmuyh8$;R9A`!x zXC@qH1{`PR8)wEFXQmrxh8t&Q8)rrvXC?!M!4;q|KZ&u%nW@H^p~jh+#+i}EnTf`k zfgWP!d59TjoS6nKgIC6xS;m=B#+gYTVg`ALnFBCj)E{D|7-xnUcZeAtVn!IR+MZZ{_9;RO`PVb^$ zEKVKz#p3id{bF(Y0{X?`^kwvm#p&zl7mL%k(=QgMAD~|>P9LLREKWa5zgV1pjefB> z{b%~c;`C?qi^b_Y5=$&j&!=B3P80Nt#c7g$u{hm9zgV2!K)+a=9;06@PBZk2#c7d# zu@t?Bez6oCr(Y~ZUqQcEivAw`Vk!D=`o&W8!}N=#=%?rxOVPilUo1txMZZ{z{*ZpL z6#WJLVkz21Vu_{bYWl@e^l9{qrD#9>VkvqJ{bDJ)kAATfJx;$^idyuGrD&Ocu@t?Z zez6pF=@(1USJ5w)qHm#JEJfc(zgUWXlzy=k{S5tLDf<8D7faFa&@YyvKc-(SMQ4!^ zWGT9oez6o?L% GEAGqMPX#OVR7-7faDY^oynFo%D;P=t=s;QuKcM#ZvU$BuY;% zz+;piEKhGHp_*ERM;|?YPLE&EgJtahBSCxb1$aD%9+$1eV;wzM?!J_SFU#HAN%*qd z9TqWnm%3xda%QcTu)fC}5cZ9N@8;ze~PQlml&j%N^0l7Nh&wJbj)@cSvGS5$P2xdE7HzD3Hg2+tmGdtqXrJ9KSOThv$EN!N%rWNbG-I z zz(?Vi3m?g|jYg8(ZBsOi+_X1_GYEkSo~-4ry%QSgXti8}_#HmGBhj13epzq1R)oX7_jIXzvX@;v@a!Z@b}pNQ0Ir0+ z;`es77wRTYSFZ@Yr?wwROzRD+FUF_l=i8%ZaBqT%*nAdvR7u?kSy?6*UP3t75^EXz zVJnAOP{Foj75kRb!d{q@-Se4f!Gczb*tZ|xM0m$iXo7}NS);+X7YGUwQ76peBv zKFVXALfNw>TM$ZDM-J;c+8YGErIQw!A`wFPH{;{`qE6wvp^YKFz6rhs#8g&Ep^{`0 zJN?m!zcoJMZ|W4{J#8R zRf|!yBUV*k8@NW9kZL2lKeZ_u*$wfLy`odd_D>PA1F8OKWOv0!_S#M%yJ>2WO%66g z_OAHI-q9&!2c`_!CTx5vPkL<@gh3w8YkPXqawA)94 z#S~#|QH($(nvK5|AJwmS3f1e{K((jdsK|`iO?LBs5g)n#>J)Oj+dwX4j?%#hY*C)V z;Rl=^N#KA%MQq_mc%D}G#kQI*K+%p^O?%ov_ZjtLDe*%(X`&_H7azO#bPBtDZD2Q8&!imw!@)1jw=O;tAI-n$6q@_nK(jXj&1g3L zPJ9f%-6;$Yw1HuWv_ZsdG;Xu{W2^rsI)&T8HgF3WJ$s~dDn(2hjp3U37+#2?9WihY zwSi%Xu}T<5Beyv|a+^AZ+~GEm>#Lu9GI$4aG#bT2@lo90DHLyR1H~&tP$d7fJj|*b z)LWymwc}$u+$n62w1I61w_5#Mnz%onA0N2~I)&WPHjvv?Ka_T*v~5dYe{xe_UlSx> z8z0G6cM8d49YQjjDN(TR_JO`8Ub{bukK`Y93dvjAKr%!nI;WcmoWG5a+h27Gw_7`f zTQyp|d_O*J|MdS`yPwx4f+!B)C@7dx!MmuCLVKBN8k?kI3&pdgpwQZ?aob%r{%F(e z1{zO7OItADB?nJ}f`S*%LJJE12ZDlv|AC;O;7Rc9Zc+l7%zM0kbKc8`nVo$znfVUN zHixn?lfolo;!@@?Jqr2I&!cSj-R*W-ZaayxT|?QJdD4X3RzTSn6gFE86K~Ws6wg$3 zH{TUGaTY~fR1j@PAQEDYX~Tzd;5`)Zx&kzbJJqoFOmK12q=u2r}bYrDgZYLwrH9_$x{D_XZuer@xx%te&%xQ*O`|R{%1=}(J zQre*%0Tay!4fJDt+ zkiNZ_*~RokPTT`{U6ga@f!s*L?ORPSyDRH*V-09L1vN4g_NQ`V6KKprjm-a>Z{)_;K;sD1 z$Sj)9Ibwb@&%i51Ymg9oisHvL%*oC)$*DdKfXmE3HWKv Jq}K_J{s&Qt_!s~H literal 0 HcmV?d00001 diff --git a/it/doctrees/avvisi_spid.doctree b/it/doctrees/avvisi_spid.doctree new file mode 100644 index 0000000000000000000000000000000000000000..4d61ce6747781f2ce8180de382e2bd9b6d8b63fb GIT binary patch literal 13614 zcmeHO+ix6K8Bgk4>^OFuHfd=R80aOgw*UZ7LN14wc0k zNLlZkJ?DJ)-*+zGyg2mw9rtdN|HNe2bhx)tGHu)QZ5AeChwWQ&gLzT%T5``z$%SNE zj0Wa%=*NM@60r?EEQh;xz`W#aA||MN#NDuzjvon`6>;CohdV>gurqQtnRZ6SP{bpb z6@C)?pXOB-a3aVx&kq`A#Fx0HJ@e#=V+jqzsKIC13bE6@^D7B)D~6jUSc?*8Dy*1d z%#5OdSKYGlpVjp%0cXTEGRGg!TEC7i2-+CTxb`%w`7SI(jzr$0)%cY+ zG-v@r)7-9m=x7bi+#~LZF%n)%@?30sposZGE8r2n%I;#5MPjU#Ymf29HMY79+?uHGm1I*bKyJWfx|GA*FcXS10oDMm%i zf-XsIkX?rOA=5=LLN*Ix0ILx407mYDfdF$N?yIp!j7kG2FwK-e3JGIhs+N$`Z^i%L z{#UKpf~co}b@yi;F7~c#<_zVg*0?}xp3n6Ibx#r0i68#Ax=oHFP+EUDGQ1v+h(}IR z@W}w`bUd#HZ7zq63HSKcs3=0OUYkq2_7BMWL)z1u@J?7^5LBHmqMeg_F z9?On*(dlg{?{bIo@>C~wwpRB!Q*CWIXTRx}v)v&2tIcyZcnm2j)02A0dHG|%yi9?Y z_xj|ed!&B{GriSorf;JYIV(9&#kbdb!nE_^(!oTXHvR@Z5UOm@U4(%Z)ikjhr=Y=TUGOyO4w;(@592f&8lYXM&&9;QZEOr>7(5bRt?oan=fY6Vs4v;4@Gg?z~+Gz zWpGdJ(wcVl;d6#`B?{6}Y#Fg4^RQXYHqg#ceHvoO-E5y4ordVMG-jxm1-dCw49YEQ zuPMYZc#Z>}23S?%Tq?;%Ds0LV13^d}Qv(d#W9bMmEvL^7*M);$1@(+7F_7b4{V*iWQcwNscu2wSq0PvbZVLzt zzd=(DiOo&d4^(cBLj57|DPGtVif-O4MTAYjP+X~h3V$;Dh?j4?<8+|z1DPA@3-bWm z+zFZ94UToVU;&aJQj^GdM=TYm(Ym5FxiaQigV=A9?o!0ApTdJgYNgTcfR!QjZE)SM zN(=Nx>YiXRHus70+`WXu))64l0ishGcP8ENhLE4cpN-I3N-q)<%HqFYCF>)h4bqFbj+ zMN?O?BBNWz(%LhjYulz=P(1X7Fa;h|rtCOw+UPDv)7RVQtdOnN>~oX_yJwIrb!xz1 zQ(CKG2>z3r%^FcpU`$O`RVFgJ0VagWUzcw$yp&Njgr}j?-~+zSm*e z(KvE&`5vvdoxJzgIoHPbH=vC>ppDCYYU3T*uS?2&`<#+W9+Kl8(n2i_3J3Z!s#j%hiU9~F@ZuYs<}1ND%jIvJZquoNluF$AysyHHPjbR<_ks5r|Whr|?H;m{I_~wn5vl_jiIZFu6WnXYk%6ma-$pMKF2_+-zdsQN+J7)u5cq-N zn4ayj0NN!sEtC>Z`f;@W36oJa=>c48OsIL+q2K;P$6&FW_z$5Z2kLPlPa<}? zrdNy28iTfNJm18@-pznlKd=p(;iBCJ8KiCKU>J9+RZjXD#qB!^o~nE$afZbNvb%4z znlK4mX_p;0nnvz!P^xU8%YeW$5tFCIq-=p^y^u`bYHEfowtZuzL5{SWt)Lcw$t$sJ zr1TJ6{Zomya?DA?<{{NCQCWcEawH1_=dc)uFd-aYorl0<(r&7{fQrxeQJn#Zgbd}H zz6a~lY&Oij6IJ*5BiwU}VhLX3)!>9KNA+@YYWE>A(PT{{zfC4##;K)Zf_DlDaa)$J z(HxeVt5|D#B@~*L6S0?iN(Ru=K*c!B6Tuui(5~M#w*Y-k1XZhJdTMD+e|I)LLewO8 zJ37vvrA%tc}oePUhGg%g7}3ia?eH`J{(U~ zNl59Yz!Y37!pj$M82(y2=cm4A19FF z>W|UKW%_uBK5j>*m)E>#Hy+z+7wW*xiYDTU8o+P=e=si-LT^5HAl0G1!Y9Wxw`YF8? zTU0;z3cRgR@!i}ZW!GCe8uQ+xZ8MH$ROO&OZSw=`gNTyL-p;wwUr-7nYl>n5s6_0< zs=$S%Ap>&d$fLe$e+^1~C3za*h?;E#Hr`hW;ed)@j%3AVR3c4;tMnE~*4oOh=?gin zy1}&Qai93&QK;*gD2Ty9b@f4QtKVkH7kWQ|)q5}W_Sb)meqGlhLuszvE(Xc_@V?B6 u(~mttNl(47B-beQAE{}?&RkbAuy%6Ka$}nUxkiXFW>W@A!CKYrm;M8B+Cg^! literal 0 HcmV?d00001 diff --git a/it/doctrees/come_contribuire.doctree b/it/doctrees/come_contribuire.doctree new file mode 100644 index 0000000000000000000000000000000000000000..dacafab6a68e1083dcaf3849aaf972c7af229a53 GIT binary patch literal 43794 zcmdU250Kned3R!;?K}U8?Icb@VzTiiv6EQ4d;e`GwsXEa+h;px$LGZP=d5+Rx|7bk zt3}e@*(QN7fugjcrC|$&LR!icra&mPbbz5uVSqM6TRKoE1*XtupwIyZn8K7&p#8p2 zdeW0t(&}X0r1ki|dwP0$@BM!7d*Az`r|+KX`kgiJTS5P zM5uz%lGp1qqSYfBhNjFk4S;}EUa3@csGhZ^TorX4A|c#W7i)HCZKc`pE@s5?c}<$7 zG~E|!)xCN{M5t>UnxsqGg4AkSYYcG?pJ>TF@>Y4J)m?IFf~(bxo$U~-7Z9vkcYc*B z(yUTf3`MQ$c}+K3)~c#fms-cVnlk|UI=wlg8;SuGs&y`{%RaETEuYUlF{3?^gLc@v zHzymlYEMrtm%C?1E9~!K^sR)u{8L?Y+rGQma;|Lh075^oCSM0s$u|J`H^R?0__-N= zZUL%R&#GEY#JXZ(ExA{|wJF~w7v&xDPWg^wt09A3&5#VND`&Kp$g;sl?&Ka>Dc>%y z1k`ugdIiYtM`UGLDxVjWvRZ#4r_{tb2{7jK1^7=_dSOB>l@+aAl}dA(B-KmwKuy%n z=kf^IZ#QS=_{-Mn8h+sZgcuOul*^)*1l`hk=!}NwwrWZq* z-hgJJjp=)kX}zIT;?y1Q4+L2qWUB44x+|2`h^G^g*zH!0V{p*b-K{E8p6e*suGA2kunGi}@)Z>Xb>!GKqJwr*m&PSS86l3i}E^E&@ ztX&<-+Vi2TT^-8WE0MKDQL8KUIRVBz9gM1=7%+fHjVg?7U|>%-4MWMzRh1l!akYk$ z1M_Q0br^Z z1X`okg}zcTZ_hPwGROv5YptqO%9su+=1fw2aqff#CU7*q-hDY`M+HOYVtPP+@jwv@)ua~Oi zrg9W1JHCcnjIWy``I3>ZGbC zlZzzBwkcpiCdcz*swR09buueuNR0+X=pPBQDeGJ-q)8kHPIMlh_I04$jENHcr#NTml^VZMdBhwhXa6jwQbh52o^X zN^8UYHDpZfjAW|KhL6D(JqW2EwfZu&$hH4eMi%E z!Z7^q3gpg69v=zvhzw3>nwom%>1GgM>{^~N!jGkJG&u=88zngjJZ=u8?op z33-qs!e` z!d~f(D|%U7khCT2h*a1kUMtdTQ+KCqlcQ2@LQbEYdwKqz$Hd;GOt_DGbzr#jk+}IO z$dA?q)(p0Y!1QQ3c)EitQ8nxgO-+?{)5DW#GQoi!#|}#Y~w}^evH{ zfqY*!>_A2x*%=V}V%fnwGG_-fW$g4XjUC)s&xW12EqbOqgYoRpHh<>qV8s|a150Kn zqnCRBco;4^8#q}&;2k&QWcQ8}N&d`$C8P1BG z;ENsC>bh2WP#EsO4&Kk49q(n%@DkY>%F6CQMjdr$sDs_XJThkoGiACn63LE46B*|X zu{#hC0vOpAEi`yaw8*nN`XzM6wfQ zfihd0j^x`{r>=eBERcVF>ZaiO7v{sWl#vDE*QobK@)Tu(GFpX=z+%V0ck1>bj-&Wh z80NwAlaU4TR$-%&>|DZ`&-BU3@!SIs(yq(av9DF*XaWgJoc*yN~Hm5LXMGbp(mRc zggLhsT-T$!x#oqO@2=PJX4tfP8SBd|*1G&$bNi(sbS#q4?MUe8T#!NjNMoS)t-^a8P@XN*oQ8qP^0P!XxH<6fw&IfN?z$$@Q-z*A5aXS8dkk zL!i9{Hb-V4+SAz*ud~ZhJ*KCJBPlzIdOCieFg7{iSIRl@(k1w;O>EB2DrGq6Dd7oh zAg-WPV9e|rD)jXi28xBgq0!==-NiixeJ;?gS66BReB;CM;Kg_p?B^*+Q6@upBog6q zL^w7Y7{(%tnri~Q;!pwp_YD{N0Hv-L_6z{NLi_3Qm1U7P*UqJfZY&YH4n;DElaUbV zq{jGhVS3`elgB3yO^%H|GI?TZaw!ekUo1c)_6-8~!^L9XKuCjbsZ_x>!&g2EXas!+ zrErZKe%GU72@M@u7skTTNEYY-`NZV-=(Go1YHC7Nx{!z8YD0uyg{m|sR^3_P#8lz* zL#GP|;Decc@B^on7j7FEJ#jRDyp#tmhgT&-BVYpZ#p1{S{+^gR98mKvI2(lj$0sxW z*q3GYcUIGeIHOeYYeT>By4E%O?!MBHFv9WTCE%+A2|S7tZ!C4H8YAdbBtg58pozX= zXR{W*-$gqQu1WH+GgQ!|a^bXaYGO>7$U_)0->v9dUXRFYKU5;Fj(9@5^8SOE4u1t!hs0J zdti1j1Kg<~hT?Q23Ur53f{E-2VO%Zm87Oiu6)5wvs8U-rnln}BjJsZdq~xzhhY5Re zpwt+^T?iePcp*D>>)|O?fY16dsSlk$-b3e_-n129s2_+#eF{+@J;PZg{Gb}nU6;>G znm24htqb^tI6rvKtGXo2gI@w+QJN9N>KuOcD%bRYMy{M+49|Z(B&7*;64}$ zmxfjNV$HKUiA%NT3NBvz^9;Yu0c-}>u+F6i)qNR#d4)2VXCh%bt;$Wh6PM_3RjFRq zE;jJ<`1V%i7uo>T|K0B8wklUJgZoe<++(&9A4}1yez@nQ;4lKf&ik7bFTEypKif)4 zFqX&wJ{$>JYw2USkC2rGPenknW@zR5NgxT54E|-CQBoeHB>>9rt z5ynrdCsQ=4-Bl|MIB(up3?S|CZgTDFkM(f7dkBefd)Z^z4DF+lXwRVTo*=ZRme{`Y z;1@=B)-d2Ljhw`JZYul@yw4QtwbI_9u2N*B(PbFUYzO*= z1C@rEs=c3}s{-DIMR&7qXcyr(cybKWxHa$yrsTAXi}Gp@^DNte4{1_@Vi@=5B4LoL zlYk~Gx-QV}2Uw1VUyIz$lDKZ>dtNApIuN=k(8+wya6Di-zLy2ldE^}Ok(0z6`0{e= z$v6`uIitN@d#mVTQP*g!{!uL~JVNuo2gC8v19aAKM z_6A^0qlZONJiK~B_iDJDV>KlQqTrxv75NVBM!yJin%Izec*aRdCz=J2X62r9ltwNa`65{t-^~{2@>Thz=xv3ZTpo`Swcs+=ILRgZ|7`u-_V~>u zx5rwp2L;>X6QjT@oVNfahPT<(9U^cD3kg(c)L9}2G!;A-V5`{OCZ|G^kz2zGDK_+| zCV1oh^dF$gk4p@n9}Go{910ei(ZwNnI)DpU z!J%KxS_3ZD*(H@A`}1(w<6JhiDqL+a)N%>^QsZ4Hu?woEU2IufW>wVyYa($sk6mGH zzyYw{td%a{vAq_=Yy=ChG+^i;SKK;ed7~X8RmmplrA5V%OWQd*XZb3%X@uvnEpR80 z#r&5+W2}vKz9HrNZv-B;HevmBAPL+!kt@}fwV^83=bCWH3)rrJ+wdzDsNU7EU9M^s zaOe#$UEmE0jQH3HtHCJED#%Z_QYnFd@mb|UOI~elglVu^@}eLU(5VfTW~~9|sT{on zQYnJYY1YLmW_T6F0JC)+o8F6R=u)$ymcX4kq}n8102?I1u{1d0={!jqQZ`Bp3V9O5 zyh`waJ)V!l8HZiVHLO2SSFzRu9&lC;+c&ry2TJ3lw7n3bkM*tSj}Xd%GXl*pM0}-~|R$c-4e>)?>_!2-U~FVYz1k zAzIHjE`q1SIxT}**0q?DDgY@<2AQ>j{vr;^*XpR zH%hN)Lbuj|sH^GPzJ!B|WjKXIuIaaxWti@jp#|;k1}qbW=m@>pfFjTnKTUQWGw=*3 zkXpv0yq;ayf|deY&Ii(wTVyCqv^yhus6XEVwW-a3qi@}~2vv|J$$&zxEkmmFC8;JV z)e`*G09d-g(K@L1W@i!(`dXc}t=cozN~ylknrhBiYi(-+T^O`c0jK8BKa7&?NS4rT z4*J0-KmPI|d6)bMxH?~yW%*h8Y595iIr+2l$K)@`FEp(!zGrNQ{^epWjI_f$ z}L2(_5Yf#*Z;uaKrDDo)wqqrNzF%(BoJcQx_6cUOV z6dDQ@#j8;~fx<%Z42rj+cr%K3qj(pJKSS|B6rV)#2^4>a;&UjzhT(dK5cR+=gNZML&vzC=Q@Ff#Nud$51?sLP0T$VgZGY;%O95 zp?D*TH=uY2inpP7FN*h|_y~#*qxcMpPoek%iqE6?28yqv_#TSyqWBq#pQ7km3F1l= zTTonu;${>#q1c7u4itM(45K)NVhqJJijyeLp*V}8hGHJYB@~M&UXS9nC|W3f8^t?O zJcr@~DBg$S<0w9g;sq3+Me$`6UqtaDif^L$A&T##_yvmpLeULl+Wcx1TTxt%q8CLD zMG=L7VjqgVD2}2yjN%N6(GNeX9@ zvYDi4CMlUo3TBdWnWR`IDV0eIWs)+Pq(~+ykx2?#dWxj_YvNAuz5LuZn?6zcOwqS^?%*_}gE3*qj zWM%eXh^)*Z43U+Y#t>PVa~L8kQ^OEhnM)WVEAx5`k(Fs-h^)*zF+^780~jJJ^KlH3 zm3aX}WM#gLA+j3em<`)43U+26^6*l{04@|%KR>d$jbZ?hRDkNDTc_({3V9S%KR;c$jW>b zLu6(C4MSvQ{sTi~WmcelAS<&0Lu6%Mh9R;tJ1|66W)MSUWkxYXR%QxAWMv-35Ly{p z6*jF6{QQZA&kbc*m(xTNhEzKSXUZ&{J#*k=aBfGjFyE@ps8x4LMv>P9BHh&8z8t$* zsr1kmU;eP*(F|N+T^r2HxwFFRfq6V_#p8lyU0JPGVXgy{VOYnl8N)4lh<_7I4qn$f z1rt)(!-J`<^G6!&0^R96AB}sN8}*B@^;=`n?qZYeclx%k>@84vvsE4i%BBsi3ALC7 zmt)JaDd}ztjCXb3DWxsAt@ERhH1uy>IO}_>%UOJ0VXeXu2&T-FQ-@CAD$xFGRBQo1 ze}HnDzZZV7-8&n8I3xKZkeh~++?+iH&26XcSoi>cdk+411FW!Nm(y8;RPyfMQJ8-` zIk-oc3U2;kc*2Dy?__@`Y8!5IED_+|Xn_3R35W-KAvxG)R$yPA0_?ppU_F-#u=d1b zjPa14O%D0DvVweb3dnc0LnfF0@#x;49Niyhg)Wx@U0*vo`&cRY293w~SIIGcIxCE~ zq`){Di!tbJKOXbHB**;ESz+Fu0&`eLrQ_nZ&sV?K{CLPePY(G%vx3~40`k82X6F3h z$K$dNVGbCNos2Vl!;Gg_k>cG=SpnXW0&pku<#QMx5BZ7YkS}Hhd1ng99lA5V z@Nm4u$K!o-a=dTK3hx~$@E(fSY1^GNYBo+LZ71{bz(1HA`14r-zcU5!yW@cqWOTNZdi|Qjv#x6)X(qF-d7^&gpa0jx2 zyC((Q-3eN^L$5uV9O`{pLEW1IYJxcw`pS;)we!ir&SeGm?i65?^jdNV9S`@l$>F{x zE4cThfSassJM`J-l7s!dtibMDHn0QnE&I{rVE;TTu=|${>|i|DFD3{3_gR5GkOFM7 zUfXdw@cra)|2-?X_ojfGtk-s!A+PREJdaulNi&&PjHUn^GScF=fPM$b@oJn)4s}~r zP!Fbn8nQEkC)Fjt@8Wo@dy``w$qMUO3aodwPoU6WUp%J3DPR_2V8$cd zpB&-cSs}bH1;P+(0|(gSu|1R=+XGo)n@WK#r1e~PwDAbF^%)wli5_16NmZ-+w)p9NWWL zVS6YmZ0F;#EhNXLXNB$Itgz|v*xr~N+Z(dN_DBkBVRINfdn=$L*?5TWO%CxrSwVa> z1;ns#FA1X7p$$Ki9N?$20{B=8fFWOY1$;}wi9OprEI4|NZ`5xj$NcrIFrQ6ZdE0$<1h z=|G?K`Dl#?eJDBTv8+Ig*?^97*%}Y}TyoH7vjRQiftIXwu2%$dBDGGbm#fVRco0+P i(DB$!u`W}0PQgE;^=mEB>Zzb-Hphb*`e|*>xY1MSsOx38T ztEuXqkqpFUeMs6+?8!pIIb=g#B!pyf9!qvvb~hUcfkSc**>E5Wc`Rfh9CDV!F6@$o z<%FF5{=eScRn^rsHMTMMSa)t$-MaUF-~I1@@BQoEzn<%R@AtpEf&VkFHfoAmy_}QE z<*HVejh4Bstd$zea<$%iPwVctwcgq~X!h&Us-ZRXlH4*kAVo=0D`j1-ww}h#U6j7A zR*amT!Pb(t9C%*oGjF!9sRI{ZpUdT*zE~Xi+H>#6zn}lwb026aTc2(z{pRNL@?|Qu zOX|0`s8;5dnuIFUTgnb&UNQ%ydR5?ulaGL(h%a!9sO(Lkj@P^G*E zrsOBK1e zsLOJ-$PX+_`lXz)vPeW6UscO><+w03>ax+t&-(dzXsvl$R7P^PNveRb0S^r%j_cJj zuNoR{nVTBA+AFwl(E!snvjbrbp*$7Z3M{-Gt#FoF zp;7f}-nAWcxm>Ks^}4K!mm?ct#%<>NyHFpWT_WCh`0F3a{DBDO+Y4_g#kaN;NqMu& zv|=;8GnDDoP^Nd1n&@EqK4RLaspU9vr~AY0td2OM?Xh||l+}o*6Oq{OR?WxYh%38$ z0}Q$aIfT8>CG2^duxmmIdv_>d*Mt)G04oSpj%Tby36fAIhEf*wcp}aQ_-Ss>P||J) zkmeQTu=cwyYrkN#c5NtYFNU&qZ76GRCe~IZy{c9hMT~g{l&YxKF@VUm3dS}l*z=8g zT@@B9s(>+WxuyzGzje8aVMtJ`!kZehQI`Z~jFXEgak-gmUV-kT9$>X zR>eOWFw_;*B5k+%0#u_7@Iuu#w!(}uE>IXSz4}D zWP{0*Fshe{yt<+q9(6RX3z(`1%d%9h3w2GHXU0T_F?qlqw04^_*=F2wiTZ3ZqA;Zk zm9iUrMD?3n>XN=Fd-Fq#K{AZu>Z)N+Z^pH(ospvQ=W`B7s zBBVy8o?lR*Zt~DX8m?>lm7;Z_QdwLqx=Wy<)Tk?(jx~pDpj*|-3vGn;RTf1_@^Rx{ z@Mw725u5d?kVB3TNsgscph2c5a}$~_dlYq3DtEW@`KubEvs9lA7gqsj<|N zP0l)NrG0)Oveb>uRhV+JQ~Q-uNNSJ2jCIsqksMxZ=g?{bqXq+Dib2d$mHs^11nfpX zZI<*{W%(q`PGgbPmd2y#M7rJ=sGB2W2O|0D)ZvZ!CCq=PC(mE0$*GmoTp*V=j)FSe zN(qx8mFHtAsKeV+c|4`n;lUa@OdX75szZlQz(fz4v`ca|t)lW}(Z*3ghnG+i2%?gF z1O;?>Fp0-bN*(U6m_yCok<`@MJK01<#ay05k*4$|o)4tvC?u~ovIKvpD{*@2R$kdY z*6g&7rlNXwr1j`~BwZ&A!|$#@4n^|#R6CEv;FPXwsb`*U25pR8?`MqhQz<^0>;#^U zlI;W@HxH)c#;cMeSocH{^0<$XbMm5U)GY%=a#_-SPeqwEuC>YVr}a@`-_Et&_K3JY zDG~l0yvjH<9FC-+9zg>Z79_uq_H6YCtw>vLZ4%?m2Lg{;eJ#Wg;>-v9sj+CG+WJy^ z6rNcVh3z$W7!@NKrI#$lS!<;?sTw71Mb>+;h?Jd2yjJAbrmm&z8e62?gg$w)@8$gW zJSL7OWx{>jtAm3(7m3?HrJQs??4M0zIqNKc|5;sIQDH=M1hP$pZf++<)IzOjb~=xs z{aS=I?R0vwIxFk2mycv`#*-Rh!m^s;ZyIArm?gwfLykSxHhnmTR{J(tx5-?KzipP0 z(WGS1lbu3Sh=d(9v)b0t;$Utlxf=G2d~U(6H4_=N35sh*6%E@IJ17qMdXRg6zkQ!7 zgZo}D%EZh{nL0u-*dsf`xxsAMK}KEK85Rd)*`Yi#XNNL%*cs}L9kQ%v!%m!u-jSV= zcy`##pE)~JF^8Sup4rK$XN@H2StId13+${z&!S8nc1C(;XEZC>8SUD$M#Ry$o&|R3 ze#Ux-GIiJ)?U|h;S+UdpV#n3Gu2voqk91*&?q|-9_cG^5kL-+QrFW1~SJ@fuqIW2d z%-Nw#9oZR+WJl(SjQxh#9f(JBnT=YURU1Ql-4}z7W*!xTBbS@P8P`QCA3saeNoP56 zQw}Rzho_?{c*;maQ$^ZmKQ0SyKO>&}^B*@wfTy6I&WtBdQy+`u>FH2;%19Hn>!Cdz za^%-S?p>FgpbkoGd5)7GPXir~BvJnar9gQ>SO$ z8_7<%2Ewx$^3%bP+i%>S1%?6~xhY)f;VK1K%A{vm**ZMk7s*qU6lJ7;#yYf5m=yVS zk9*(8P*C$^Bt@RyxxZ(2hO?Oijpc?D^s!+`hqFizV~6f%JO`qRIkNLW&+Lq3#m-0q zc1F6eL-#XhXT)Xa!AN$ZG*D)1)3IFV>eSUQJ`EIHpSmf0{fqMPvy_nr@~=@JisUIu z17)-d8^dBJXghWLkdLGIRT$;r=O-f#TxJo`6I7Mfrk-{V9QWP=k z0l?vUDw6AW5Z5*mS*SFsi;@EX`&M60x?kheO5|EO#G_U|#@$36Re$+OKN(3nZ-tne z86G?)jtmZoJ~KCIF1c=~IZa>04&sW6SB`nQfNjrtq#r31iuC8$G5$4(Q6XO#%F+LW z#Uq70j@r>}y1r6CP#6pw1-8pow`?DoZI?ZnE&644J*wx(>8VJ{9w9lMd{ms6o(c-( zqV&u&IMyaL78cYJHhRjm0~^HU)iTD+!O{HSP=2_O9~>Po96MS#mNypLy7iXwvWPQ2 zJ|4U)9t98hDM(SKgYe-{-Q$}| zl3!ihKRt94iO_W^(t$V~36XbdOr8(7HG*JQB$QZy=wVo*bX^fXfYCtjL#h z_^Z_<{K;43MXBP>0;gv3=P#VkKZpY}_v0USE3e!+JU;tK?o2TUDaWgl(J`oiT%j;F zOn;|lPPK`7A2x?c{;hNF1rPh{9Whvs>Nv!ljwEK4dH~JjL_U`^F?+79udma1-^SD~ zo+GpUushPdoY*>%O7!`9UEt!&L>isI z=JUNBN5mc^($0>b^XRH;8r&nOa(#hEVvHqaU0SG%bVbx?FPw-S&SGICY>&n!-11?! ze|o5oIHJ;HDNgIpL;~TxC+aC2L!ut!!LjDLou~R#oLIvC8andlp75hnIECRbT>Vz^ zww9%fIlH+%j9vHrbt~EdJL?B)4&czB3?~vLx!gLvF>ub04<8ZstYL4as`}c~`MnNc z&-%dz&^<{aI&1Ak!_d(kqq9M11jYc^5pb|hgjQ*&}pmUJ~9VLRM29MabTO8*lwGU4vIT(uax?IYi z7tc*ih*LSF5ixHl3=WFZSTwZ3-Ynz352f?l0|oU^ul10>Q}?;Zx*wyuPtVOBJyO6v zu0p|Qe`XMd#+ulu!@q{4m-8cqqhq1kcZX_dZYDku?bkgp2ONFetsn=*`A8Jx9i@nQ z?W{Pdm5vP;eD4@I^OB@-Thto!6?@COkw;Q?-(z6@UKlRchRG;lV8s_=z}tbRG!du# zDQN&*@VbZ2)x>El;Glji67@Mk{m2tOtwiUmu?@R)N!Gnl6t&LNfpPy>x}+JhxCA!^ z;;K9^N|i-A1gk6?Z4$X@Y1OZe?4KS;R}ZbdUm)AKnmV|6t9rN=zR)#QYVa8ET3gju zumkr(B;3=M5T8!bszJDyYn0CNidb@0DLkMAnT?_p753!3rc3y&El^una7&jLDpPPhqR~t zq%FN^(}oRgtEOS%?%c_VvC+Y!UMHdQ^@Wlsm&s)XPrUFmkAIY|tut(OE_*v1e3v|Q zcRAg^OYTnH-{`M%#(-pcseyi;*zc0ZN-d ztA-)6O#}+07L+2_gc8@=0?&(uP`5%ixAnEaGd>T`r55?{8zT(}5>}Y+eFcfGh>I zJ0^kSW^1XodBcV8aW+>Q>)F;di`cU`BGTarJCXg ze-UrO1j``g9y619A4L0A_5n9988~1q7!Bc~YahH=WZL-c`eK8OL_*nR^f;4vP}yxB zOd5C;-YEq|{_xkXKar!=p6tzlF_Hny{>178^C;;&k*R@?tTEnsKJ8 zhUS+lxS_3{sky8+16H8(>gVTh?i9DQy)G~(xlbx&ahHnMr>b>l%zrDj+rK^ zr7d&p3ll&=AY{>QKlCH3ZyZK>Rxwfy)^`a-K$ca0Xhp6rl7CILT7pml16qf7sR*RagcbVGZPC zcQ=RW7!`5YY6S_~QP2XuDwd#xJQ+C*mzhuxvQs8#bwrwbFZjXmEbxSb^;s`9P@ujl zEYm7^(hGEMsa{khL-E%oC%leaqH07|pntkAmsvT%)j0Jvw7Yt0_HnLHY-h3FrqIp; ztc+x?grP0Mxh6_tNyV-(BI(efnxyKhcvW9MbjT5a$8c*J8#P^()}3-YyGB)*;pw6P z!{cFLK_%aIw|6mheF@!(S{{64N7f0ZuVG(l_SW49zIco#k3i zSEvNH0Fqc8b=TuVG*8DP5x3={>x7T4- z0q=Y)T45@g2D&+Wd>_so#n?jo?kwje&Ul8&3&hM)va^q4_o$3!q${MoNP$MA=RuFW zXpn$w)WnM+H;thoe?HyA3ryB;=~mE8FQC08a1BW)Fqb085TW9La@cfWrBPl!yQMB zdYSdQ(h@RlVSzT}7D+N_v?sx<=^8oQgl3@B^0K5>5O-8JDSdXIY%|g}p~l0QqF|z8 zc}zxcvxg9k{V>CQyzbNlFFP>dq7j=$2Q-0IFh&PxJm1KK6@V@NYsc3KgNK2a5(LE7 zYoTFxLSTJCfu=YRiJFF2t0YFcTmd^P5|5OQ(!_#Tr_Jj=eeTR#Xu9bP!&Z*cvKGjZ zr*qbX)N+mOr~)@vS#X9oSEy(=G4(N37|xBMX@_#7j%d+v?>Hvm39~b!rLN-4Fv~9Q zaBsrjumC*d3Gu)T49a3zE5pNO{ZqdLO#CGYYw+`^+BckYi`i!l4hP0rXa#G|gN_T0 z?^nb$rNW{SKD#+%NjMI(+wqIX3P+A!%(>rC*goH=z{`IT(@Vd%XKxkVPj`xNP`m73 zfc>Md8GoEs8@$$BdJYRT*Io2K{CHB~uJ&*1g5O)ze+;x4WT4oBPJpfPeu3I*Pp+NC z{3fhcy(d4(Pey;tgcj+4K&$4xOH>F}%e&314hvoeR?$nJz)iQ|b_JKNPRRq_de(dX z3n?nF37W#oA*=@5oTax@_GVg%d(V6$MXC4nu#ERgN>jUkOi{b;ob=Kv{e2`*y@|z) z^@#&_4Y)=VMLdPQfVn9Jn4K6HJ)1~;UE+I~n4h@{XZ7{rY#2 z21$R5lP>*R{Be8mXI>qaAMX9ZLFLo03SK*dV7Cc9{Zo)6` zi6@fFJ7vxz%B}InKreHaFp%LZ_BD#aI;W0?4ebqE0Yt$EJ?!SdO9lO_a|! zmJU$o@(kTn|D}J8Yy9qaw<-2y$!zDL7o~uYS1p}pzT>rej8gcsz9K3}%yN0uQWB9=);U*SJG<4Eg+$(@`hEMdXVKx}d#?q|AB9m)8B&Q+Gu4X39gP z)x9VFAO)h}3M`UEyaV&ftS@_Iem+H+*N47N^YVP0;YT+{od_6@ithZcbC|k!D zckQ5hnf&a6#{XrOywsDQ_a^OLzBh8T<#l~u8gd&37dWj~Vnw;0q@@bI*3N78zAZG+ z2ldiUSeiVR9f|IDuX#`Jx0aXv zUeQ)%dlA7s5W#!aCW7xu$n#6H(I7-1%~w(dUGW@WbFI8~e=31m2Ee7X@b_#11JLFJ{|7#1Q(i!V{xTr@2h zj;AlsQ#GIFW(qDH;@@I?EPI zEAqSRR3vXPbc@68`fZE7#q3qKCzBg8XxR9tA7?@w!T#|k!5w$U67=ZcxO+2tct`n~zz*SfnC8HUPa!v9u_ejA@eImuHcNki%SNXt-gLM;rc~5*S1ycVK$11UxC5`~aT0*JmCsgJiCh37* z7b7Ja6z;I&Loe;Q8*Yu@I^~l;@~9Y83KjVmEQGzQ$p4XCc&Ug^6&Y4=8Ws6}Q&eQN zQ(wF!BIxz~F!b@-qHkMbBaBP9Ut3ru_M$EJL0kMew_R$3$cw)9|48nYe!wk6F?{4l z34k-q{Ag9$H4q#~AmKp+!5xs${dj5(y=nhN8(oPTu2@=dNrhvNYIPAFsmz`5pLef-K%mpOEpsbpE5d2ymKnHmB?Dg(MWR8dWK1N! z>>PP&D{rZa`>q!~pDQ8dOYXx}3$9$fm8pmy9qo1E6|Q?Q zsksSU_Ae(kJl zrQ$q%PSahK*hii9O3U1{plS6goNW1Sp5AEgBxiHg#&Yp89jeFI1k7D@n7;<++sov* z!$6idSyyDs$(2!Dg>UL2+yTK~1>N3hKj2>2q08jKqF9kvcCAW!6?7qmE=$X}(oasbWdhY|n!D6$tx<uwBOQt5j6)T6n0}^m4H*!_yKzS^%$j#PSyMd!Q0O z{c5>bgGx~^L$#W_$U#ZbyM#<2Q#;Fz zYsJgUBu>}hZ7!UX4NMu9(c;^6Y1RD+3Ej=^O)Bs^1v#v! za0StN^qK?au9{pcx*l(+qC4mceE!LBaZ_oT?$`Km*~rzd)D^ADE=ODD^^}q;fRsh} zg+L3zADy`k*Tp*vBcOB_)N)()bj8cw_3Rq2-CGc6X&#-ZTvuABx0$yqlO}OK`pUkNm~uP00GiUKwEZ0%U^(CabRAf70Q7V_=bC48B)7))4yo9_~7A&pyg1Jeq zuC!(v^W>Y5v#gvWc~Uv7Jf%!4 ztBRt$TX|l2QTYYs)5^z{FDjpHn0o@xkbgve$h>M^Zz(6u0XRA-T@qDDb4z*3+|j7| zFRYr@hkUHt??!4BpOvyxzi95U^%wj{8wSV`A)m^pJ1^4*C%)Jqd<$L$`0Fy(hh#95 zc_)S_$&B@!j8t@PR%-AxLoE{yb1P+N#Sbc9Q@*NvNBOq$L*)lc19&O8w3UJzD7cP- zJ1DrFfp4HP^{fl9#w1uGO76g*GCa}@k61@EHZ0~Gum1;0tbuT$_b z3Vx4*Kce816nvh7Kc(O+6#Nwh-=g5}DEK}Fe@{UlTyQR3MZq2luBPBN3T~$0Fa>v0 zaEyW@6r7}Bf`T~;&QfrZf~P51reKMJH&bw#f+huTr{KL5yqkhwq2L!O_-zV4LcxEg z;NukhF$JHY;J;Du1q!}S!QW8u9SXip!4E0;0R;mP&!w#t+(5x~6x>00d2ByHd!#6ER;x#64K=uK|$CO3AI8@kDj+~fvs za^p6+VZkt30t|CVjR}T1q(%h898%+fVGgO$UT7$OUZ-{1_3e4tcQ%*r zI4GN|>kZUm;mUF0C2$+=ns#2--~Dw98>9Cw%^+! zL8HLZ8O~|xQTz$oxWf6#J&fFRnm7yAv{u;1?$a0K@;*T|;K#P^dGaj#{1aVD4o>M6 z+|mM`aG@y&vF0Fa#_3zgbkZZh3>orJIU7|HpJlMA<2m3Fw0()x;un)z6MT?S2 z$6DTE$#Nwg@-HTb{PS5szAXjhdpaRk7DcH`gMK_Yx__S)Iw1wR!A^A6Mxz{kt1!L= zzmOc`pJj#d_7oV$V=?Y$-`}uDz~#M+(IX!7x07T3pIKqvmjZKGN9B*ea=YS7mhcq} zr|sNbjd;jg2NI7mn~}7qQ6@?e?@s~w{`h9bH&|?^vt97so*eJ3S>e4Sd%T!f!5GV) z;p5x)-sE_XW`+086nGzwZ(pk$+lUkP=EsslKbIBsyHY@ZARfBa)Yca?;@etF4!DvP z-~%ZDcT-=D`6Zh6m)VFC5BY`UkbgQW$OltE?xMcvB?|Crm*i?Z-VY|n`%78jy*mZo zlkqZLs*oFcl5G5eXK|WW#smNTzUY?dT zd{m~(a`4XNK=)+@G?xPCiS9u6Ye|>=4<-kFUsj;=DL_YdV%maI#Yl|5-BycFCdc}C zR#*!uu*TVQoOii{xuJONY$OL;%L?q^I)Q}~(s;1%N)GlNS%Do|AF$#`H?Y5+9PF=V z1$KDdz;+SiPbLTZU$O!_vTk5UJKC+! zUX9OfCUWJxcWDQbW-^HyO9A%2khul6cZ#sA!(zv;xx~?2SABeUa=3S81^4JW!tJ7@ zCX&N_C@Z+fQouc$pmn?S+NYC4eJU%c$5TK}FozPyy7k)CvG`#C5QVDS;2iM1>9u4w#y9p+MS8#QP&`8CiAHA6ktO}TBC+chk7V0s3%fD4YAA+I+=k=gqV=WciB_Pu})@%bs`1UL!A>SX|WqP zDLJ?|W(96C1-KA>MCTx|H);iE9dK9#UmrD$t}j8}oE+}utl&WJ=sQe zk-j9$z;SLSUV7h~9PzueLVPj>;*gy-a&>s{m^d;xBzCc|{dRJUAIS>isT3FwceZMI zS;PsF_$K`0UP3?*5u)FgeUz zRxr<`fSHeh884=%lOudMD};}xKp3KJu&pT`o17fmd{)?IQeX?2%F!A2cyP}q2ltk& zz@1G2uFxr(_MTd3nRtlrPY&^YSwVbV3W#BQSjbXM`o(9e9*al&(d1}h$%R=X&io04O@5lJ(d)jXaRwtBpJ8BLCDC@XAFWQDEE zl4&+Mwli5_yO0&OOY!ZdCdamr6}Bg{!q#OK@qBV@&t-+}sTA14<}kD~RV>%ET72_; zAUVXJ%L?M_Q$P$mnaB|JE^YX+Y;^Ewd;@+yIle#53f~*E z#Mk95`nQtf`@5|06|=#Inc48*kuLc9u1P#!xe7@$8PhMOz!$QWRu#)RRffwejeDYM z7^2lBWuuGMxh*;9o3jGVe*bzrE*t{7tV;`Z@k+yx9o%?5RhP>mj;zJ^)MLp(AIS>z ze2SJ1(L}Zb#dv&k$?=_C8$QdCmwgP}cYH@Sx4RAl*h|xP{t|teyh1IKXD@P|ZsgT^ xo}7c}S{44v=zMz-M(?6*Mai;}(~WxT;0*q&w|=@MnFD2Vgl0Povm62D{y+YnKL-E+ literal 0 HcmV?d00001 diff --git a/it/doctrees/cryptographic_algos.doctree b/it/doctrees/cryptographic_algos.doctree new file mode 100644 index 0000000000000000000000000000000000000000..6c1e61e289414a971dd2f9c66c1e0314d45ed10d GIT binary patch literal 72311 zcmd^o36va1nWk;2C3WktB;VME!tx=>&Z@q3*p}VyZb@yONb(7$oL!Y&nW^fka%PoU z^6`M>DnkN;UBCm@3XQR=ti3@tYrInzp!h_bc=H{9Sh!2Y&F{_u}7w{K0D<>B!6P>d5`Z(j(Gwx@$u0H+IM>V_8Fl z3C)hYN}m;t0kPTCl-X7j5Xj^uN?C__#`02C)ODQ1abHcGH;-17TMhTetXMj#Npmbt z|MB_icD*4I)D;a)(k1Pf)M**Zn_`7hbmRf~e0hn{Uvy}~uVpqnm*K2lAh7kC^`}^t z=9HS!RO&T7uj$Q>v9zkxq|Tnc)+|6@ptolArqTq3^_nNH!#>!%G@sAiKdarJLpf~U zo|BvN)q#OrE_dCmR@gCM)3*dyy{Y=xW%KGf!}?{C2MEJpO}+qB$rpkAi}CML{CgSx zy&P06o2zT{BH2ne>&P4A%Ukjl@}PW`yiwk?XBjfMrWKNban`KX5$$X!$!1TICGwT> z5}>}?^eZ5H1tBZRQt7Cml*eFdlg-)zSklsz zjD43?T})p`OzRD$9Ov$IeI&^0sO{P=tJj3G8j+fd#D2##4}+tQ@1E~t(7BOK*t;FV zUT+b$Hk7c3LJ3^qJ49z zjhAX98Z1vcPcqR9bi<*8#d)bI;sGt56zC0y!3MD~nji9uj&ZI{fS@%{mCc)Z$Z)Q2 z&>D_0ZYj#o7`sk_5uaf;J1>o7r{ZI0r&GGc=^C22C$i#bJiyUQ9F9B=g}wo9>0!!= zwZV;5bYfYKlpSB=9hQIf2b5Ss)=7~T@5DJvZn(j*TD*6BQ@_En&*HWR7u zYlD2b7o;%&t&-4pEkV`xoavL7IaYyO%o`@FqB5@^6gBic(b`VW0V5!oO~4&4_7EbV z!;Cwkb8X(yLy#4X5wxK@n(I2#X$cEA(q`{6FMB?^%0apgOPV59m3!GUMemg@e=Y&C zUg9MS!vmiCdAPD-nOt?na;ci?jjDi!Hd7lSnR<1Qshe**a!6v$yq;rr52YIrHqlR?a;wFk3f0UD^#%q{O z%@vW<%m=;3lp~9rMOLNDyiR1wjm1@%I9aj1;uI3wMW8n@9@xV( z&6G-S9svit&`X=?J?6bU9%jWc$qK}ADY~h*+UK*)_OYuX`RUg1)~t%=@XXYa6Ah_n zaXReFCBTti!_Al&L8SY6Sn_LlFqX?xuNv;R&}M35BvV})K8X=~&{RJv)p`{wPZj}= zd>UTDoj?%X$wQD&!~IcQc6!usuVFSdn0}UK>^v`H z3_sn)Lz5N3)hNk|;Bs?AZ``;h*^YH}Bq6tY2stEG6uoJVSMd9i=1CPb%5jcGhBvN< z3hQz{aM>l|dR`*DIk?8yG+Yx&Lo7Evhqcw$^ef zC!)untZRAiHJ6F)yi7RBT^nrN`AFQ}Cgqe3V#9%62GY9kzu}-(Kc-+z(RRpy3tbW< zMW}}ks#)<|f;QA62G{oVPFAGU1)?jIIC_l_E!|s@$b7N<46Bz{@#TiupB^O>uxQ|WYm>1wVh%pB|9Vep={VeMv3f<2t%>#P#&4HLz&v_45wp< z2HLY>CvL>v_MOpqcG#$Y=IoGRHajD!*~zG8jdIki(fFDLb{3&#QKmLKqp8^$%gT4g z5^L6|Fcw#{zz$u{Sa&E>o1L-L?2Ko{PVhaCqq>eNj|$@n?9lbh*>T_PjHhI0EGykX zMv1;NmY_S7N9OEMrnc{FiDXA&4H@f&vGX7v%V+k~Vp#Wx#gz>tq4Cx+ua%p@O6nba&ZTbrlrB6*7PqKx!s zOPBhDd68Fpoa-Kj{K}J&7rDA~eQI__vS|Zt$&YZO^3BL(vI zQE!aoDN2Dd>V<7VXU9Kw>eL|*NAbNd%EQY~MhfKi!X_fwxtCf#hY!w7x2uKG zPx`#X^WK!^Z_!+BdqUYlgXUji25+;_YE!wIH zY36isF9?(vmm-l$Gsyb@}uVIvGjmWkl#i zCCH$6hGU@iEv0K7p!RPU*@a$L@#SO}@KmHdZzg-H^;!kfxsTOL;%pW3+A%{OuI(>l zZ@zqUFsZnT zB4wG(6Hbc<|gHmn!1v&YZXi=t}1xtSfCS_1zkY=(ZRtY{n@sS{Tjkk zp)fd{r~ikFS8if!ZcZs-qNhX?vO!!yDdU+rG*%cIE{qHohQ=law{0EVR?sVf zYQ3yHFW{3O4-f7cmx3K$3VOJwjc|7)!o7rWaw6~;i@a5(1$cvF1^hoWUKj#Oyd8)qF1i1pDwydE_4aEv?0z!LS!>FruGVlr}rJ)JF|0Ua^lXJ1N&#v6zK3^ z0fjg;3h=uI2Zu&N3UqzB3T?(mKMFj8eHNv73OD?!OGS!;4z4x zE^w)(303KM9)If%5q}C*sUlXLR^ash!japL6mG!xGuPuEW-A}NVr1gL&H25>JiHvQ zO2)Q80`h}{TSn;b^!{A|H}AvbFwr}8&N<;?f2HjPi(!sU%$`VM7N`bLOHN>)DNP%HJk7KTsw5 zJhjeu@-&e~A7r!7eY?IGyMahMIC03Ot68sOwFE_K&ao#ko+V{XoNEenMyS(VH~}-9 zg~8FVIT}lF$%Ebc>7pLDT_xpR?9$&K353l(QFh_0B&tC!9J8(4{gI!75125&hQ0uF zKKP@Lat24jaP^zf10_o*^Hy=Y7!&9HCEeNvdms`l`}l~!W{q3;LwmTgI+=a_EHJgJt*zpE-2_hvymcy+xEkewr?ZbXAU3OIzEVrTZ4n1 z0cQq6uQTb@n^<2%)XIg?!L3_D<#v^#*PTo}AcE&zFjv_EoOB}_#gRx9v^q)=4cP<2 zRK2uqWYF_cfn{D2>#Qsqt=XzI$6YTVDqFrsM}vKEq}UjtQ3xGfypR#QRY+AA@RdJB z^`Y~hchNc0+p7UK>RTdFA0pH@-{w&z`o0?Tu1iNH&3$ab>H>W*?tOTwbzKrvEK?vX zNV9@it2zvd1dESaVf}`>tkN!NF^Op5fOV zU~75`*81r}bzVlF+)Ztmw?)FVO4ZZo=Dwr9RPo)ccA`OF%XgQmx1$ZH{?B+%wp2Yg zw&C6$33rd_#Cv)uRX^OLQt&YXU`PE$N0YPo^==0k%4 zqyz3nPr3Tfy11P&1a91J_H=I>?JFbE-bTKAfT2BmCNyT=3ZLnJ*TbdvHRSWvF)+nCDbl+ugZc#U$HlJuzzMjtq?lY)8A* z99_`s0$oKHyj5#zC-4``Jcjw-awMUc9$)jEazUWgWv=eS{EFi?c1hgrMdMq?fvtlQ z@M}fa1vVA}9clP|${9L|t8~8f!eHp?LYD-poG*=s2a4ydbHR8nIXivi@Q8yiFUL-s zGcl4gHqvVj9Gz(Cl09++{cTER0nI*M&cag*gX3XNa!K4By^JNqa~X5Ko@VY8$ykDw zHea)me4Rs8MQ=44bqxd+(K*n!`z6SpLuEHIj6N*Xf>+VT8Yda`DRk!%I_KWZxUC># zDYSyt!naXcVWF-a#gbPv@})=u>-VF-qKBPg=kZ#JwQB1XO~it%B{HvWE*FZ5(r+w> z%Cjb~y(X*NCoiMN=|)`a!*~o{T)LNx3nt92&pZ}r!*i=i+0q*<6Ysj{>-K_S>H|y9 zI3sM$Fq<3jt=@+?^7-m<`h$f%<*U>d9b$PnNuJcqc|tJsVcTB1%u z_ITH!DOhyPTrn%3JA!p#a-x$V-Hw*6Rqmz5VsZ^h%V7=HCSFrZ^ntc!zT3&s-IO_e z^NX>roP95>3wsP-0>f-EM`NMvOE_Fb8Q*wt6Pml{?K|ZYY3+I7vDY-g%4c6zuw}v?} zH#|7HH8-m?^8<$!tfO1P!i6;UlWWy{xhlEQ!ENI#A}c@DfR)bbZ>Plsd7W{}@9Pxg zpQJ8GEPSdyf>fc4SX#1A>hXRm{t)%pk7Y4@q~9=8V^gqD!SI4Ur(lgm%-E^4XdK!j z5mVE*9@u}t_5fEfERkPloOC`8DW6GA3KlnYbdq^@AI6A%nr+HC)O=a9qSadsk7l|` zkEOM%w2)%gMQ6dpu4mW^Br#VZ-g7R|{wK5 zr|IfCqu)v4tiq}G<8snNbvb2mzPbc|l4_7&K(UyqdIm?T-Qa)utc9i z%h=aLQSWk5uk^%qVbAcxp5_4HhkYSn-^7tB9qe_RHy<|J$0Am#EsLSRD=zTWzSu5w zg&(@a0m2XcB0!(zNacerMd~9-;_u8F@mp3Sq8G)dsLz>EP4#4oGg~ir%g09b`L24k zQBA6A{cyX(!(-#2yuaV&y^qCm`F@0-@Aq;r=jZz+;QQSisVu%9W>J%&9`=v=LNDDj z&U5zj9Kih6UJPqLo4K{S?uM}0%aGn(%%S0!yW1M=%3bH}@kft#?YO&W_6VrQ*6*wU z>Unw?Yy7vd`wuHUH@6BMYlNv!0VY;n_Fav8Vi-%={uS!~pmfiuFTp?SugbNSa83)-2MHGf{n7XBZ2%NYY5n!c*$V9 zim)9rxi&@_O=3mc?nKh+be*zoXZ+r&}ThHeT2uTPdY|D zYHie!ux`J)BWM+t;`dmUrr5CDxOx$?OI2*~H?W>*f5e=j_ova=&~WI}=uTqaZ1mx2 zgjg>BuVVbiKSr%a?(H0y{SJ<$$JJXnQdtguh(*olX>^oHB; zaoCksVs}uQXVg*ZtGccCVVqTegl9c_we4?3(lvcH-gW()VX1VrfK=IXcDf}^As&LQ z$UAT{RMP0esgSh$f>x2FxmKkqHZ0?=-iqu}65;%Q3rj5^_$w!g*MC~2c>>7UA=}QmF4i8Sky#uTR&+o zAQIAc3%lgB-wtp<_1lk?+10(7+n#sggV; zU74S5k$Z%A2)5tehLfQpM;A_o$UPdgibT$}Dqe&9u8y_h)wdwKRK*s5gKR_&O)*pC zqDBM1Nu^*m;8ss~W4j{vEmj^}Ex509aNuVStIexl;YejU{9`QYqKVv3IiULO$9nJT zk21GE81+NeT%QJY*7G}T+S+G1ir?y>{5dOx zG@gPboz+Je(Ere9)txQ1oE3o_inXAk><+W=Z5b@D%i`anJMBrXvSF zcDjW3u~;tAyZMQp;-Jh=G?r>sCpc1BMDJix6ZOP1JIxl#kojt54q$$3v2?O3W^V0E z{S(Q2^VK4Tb<@o~dksv+$VckAXK$u-U31Uw!&z^~AUNxct_NqG@x5Vt*tFA`-Vj%3 z?P2Kmn>GgCumx@O&eJmOi?6KyV#k`$>T%pB&K|1b>74X*cV50i%7o~ zQ_*>OI%pMjURy=rrgweHh<1bk8S-ldevgPb_OW57SLr}sF z;$*0V(S=hXVOr2Ck}%h*c!lx1Iu^!O_aVDf#TI{qOeE}JWJB`p#J)Avl*Muzl7Gbb zkMC_-5@v8<_A`ZLtwzd=S47S#&d2=K0i`C4I{i5I?B*p-Ny zH``&$t$1!r>~B~ZaJ9s~$bs9>7S`5Q|B@q><>ddBMNO2k;3RVkTky2=672gN5dC&z zDQ)#%GPgS$L3;sqr4_U#tHT8C-;h(3pwYE-f`%2j)#ozjY*p7+i;Mq#U>ec4U4ZUen-MW-s;6j$tf3R1z2pkSntTi)ikkj&uyWqaWernRb!2%8dh{yJoXY( zd~KlJ94z>`!vf&yG)F2+JZ@r9GZzn;1ESwc)T8Vr4^62Qkt&T&}(ou zN<8RVI`KFR&hAGl&U(UG)~7=}K1W9;kaw^3G69yy1;|T&B z6b}~N6^|#0DL(P|4hIYVN{B_u)o*d6vc%&XENbTB@hk^Kzuj1ET>VAnc4s3VE7znK zk8>zZmv}74*(mX#Yw5%TOP8xlk&071ILrEUh{q1X9u$u}PNo+REO4$~otBgo;t?O! znyzO~TZoPtHeK&EA+sXXd7SKRhTde?485=!c)9%t_U97Uq01yMr&}UXVJGOHUmURT z_o<$ncZ|8v$<59Ccb3Pgnw$4As<-AdFl=t#f95ED>lMgHSs|q9cVO{h^}`>jFI6 zS=8jmU*eK-UqeO~=Fqu$-@x@GpSM7Ng~NP*^}q_k>SG+K(t-BP%~L|VNf)df0XRG;ie~%ullfn#VX& zSu_u`sEKOAH#6^c4q$$3v9`B*OXk*Q(}dPxSK9vfeUzrF30=q8s3tUBOV@<1fU_!6 zB~`z4C49QyMtqcb@HVGuG2eINWa!%nx^ODqMtm-46^#(MR>jMc-_>QLd>GlKDz^9= zSZ^Z=EZ3f`CNoH4&Cu@mv{uinvK=6I<tFZf*ncHm(+Q}^!v3jjn(D;^%IFHhFePq~= zvr&RZ*U|~vQE;{lsW@u}XIYtnH8F>5gXtQwm2aOU&k2)I>4k zYm*rq!2H(MVC{pMTWd?$$<5RKQ`nWZP4+0I>1vaG7-yp-jIO1VusS&VAX0JG1ENVs)b|nWezqJ~y-H^Gp*+|#~>`E(P zGnA%F!mh{JC<&u$=_E`CXWNk~$uH8C@adMYCh-uIurf}DN*G-@6%zKQpj9Mcu2u00 z<9GEYQi{kfRk6k2AR`Hjny33AV&7?n`R3_u>jV8;uK`eHaD*Zjx#f3zSIqHV@v2fo&%}J7}_vH#?Gdjhti1#obBM*+kN~ zNIH(a&YDGMvy^gi_C%5GV)8&o-G^dU6(rS-3qm7e=T1Z;6U}I?m_?9{W#(Sh9d>tm zDxYbr!KTd`Hh?Nxm-ZX0>@!sbZ%y_aD|D&ZRBG4})L4gYJZU>gJwJy{!J1MH+lDT? zRjjro-Pz)WZJ4>==&wlFA{1LJX~?1{2Z`;wzMjKt!~y! z#aXd*l&_HDSaey(0`(ng7%D|^l~R?~K&wbp#`_*`9^@8HZDY*wZ;irDp#_O#NG z-^Jz`sVcEE#Ra7)7fV$UJ1ElS)m8%M#41gqty7Ct?6X+y>^aLAkj1L=v(H#39aq3r z6I*5KcBDR|uPn{BD#&lmf~eKN6=G^O>Dy`5u#4pSfkV$t!7cGVS8f4>KJ{k z=A5v#V_f3DP?R*St`%i$!Bdqqa7<>FnjPcpdaD_p!=-^Mfh^Qxa3o`mnQzGb{TBj> zjkRRI4w7WhQw5%mvAQbODlM@hf$cJWpQXUOb2O<`*UH7Rgq?)SxQ)VCURJ8t<`m+m zUnv){ujrg|ydy6&)?nx3deJ?FOyE$f%dPoF(Q!JE%1)Tuo{CtpYQJ$dI|F8GIu*Tp zs-a7*a=mzbo_uL7DokCMir$pWLr~kWvnlP?O?ef|icZ@U0*Gbha=S9HdSa{s9_)i! z!w#zT8d9vbVixDH5{ur!-V5i`5$=O+IVlbbm@+J*#8+zKg7Xs|x{fLp9H&-+A6Aul zu(ogQRmPfz)NmDm@T{UUvm(r=ieX%6@4tl8dcJX@Dc5Uk=j)Df9>rt^AZD>C&7*{{ zr>L<4=Y=Z$c?AR2@p3b=0JDUojqKf3PM8PN+HI#;R7$dt$-pXB#$~mmflGMZ*5g=Fd+W>n;5fkf{!G1o)@? zy>gI5+DKGMz(pEN~@?y?(QUXp0)%~Y1I;yzWZ0{%UPAa zJyYp>4VC6yt2BR7r8mGT4LPdRX;-P)>*O@f?m#PWtF%I`N-H?3^oB)h8Oumv%EStL zFy7T+k48~9mXopOm5uTbuy@HPtGLc#kecn<}CO2J1c_%sEdqTs(%@K+Rk zn}Tmr@J|#xO~Fqnc!q-CQ1B}X&N>UhAL!_8I$A}+B@|pl!6pi>q+pza5egnM091#hR|0~EZUfCQt%53UZmi83I?b(ww!_sC^(mb%PDv{1w$0%DcC{5wG`~3U^fM~Q*a9f5(Tpq zutp$j;_ap8;0%J6(NDhIJkc;~zx;!?{A^o(vCUk$&D^-nT)55Lx6NF)&D^%lT(-^J zwar|$&D^xjT(r&Hv&~$y&D^rhT(ZsFvCUku&D^lfT(HgDugzSq&D^fdT&~UBt<7Am z&D^ZbT&&I9tIb@i&D^TZT&m67sm)xe&D^NXT&T_5r_Efa&D^HVT&B(3rOjNW&D^BT zT%^t1qs?5S&D^5RT%yg~q0L;O&D@~PT%gU0zs-ui&5FIvioDH=yUmKa&5F6riWm%| zOu#S;saV^rNZYJ9+pH+ttQgy@2-~dqz&uLr!Ipdx>HGKOe}M4(Sbko9&QzTKvgXraB@WG1aNj5mTM}=!mIKn~s?3yo-*Q>U@ZfnCd)A zM@)6TKu1hb)KRlraC{QBc?jf(h*ag7wL$p&Hz4>S$5FIhq z*+EB4b@tE^Q=QxCh^dZ5M@)4zI%2Bx8aiUCW6%*(o%hlaQ=N~}5mTMNpd+R_U!)_Z zI^UurraJ#fM@)5oOh-(0o}(kCI%kq-Fx6Q@M@)4trX!|08|jFt&KMmr)wzj|nCcv$ zBc?j9q9dj{w8kk@9X6v{Jqz0&ss9Jd>!}~7qYu+ANXBY!E07+&#_E!Swj{M{@HjTl zPL;ET%*(oR zhB1KNNU7dJ-xl4jm00+;iWVC%p!2(Y(mMYzH7wqM>b&PH{f(VNXkIr&4Gndx%|th* z?N8U}Cv>#N?bA*NS?;qIhxP6MzIm#}R(EVlIdogF&ZE-InGMAp3H|omWoWT)85`Pq znYqC#cF|0e#F7%ngr%1ge8{0BzZ)K^Q9sYFT$eHEb5i-ToTBG2$dq$>v1QLLwb$`O+jer$ z;P@r$&NB8Ee(B*nSH_?sGGp4WswAE(*xG%CzKZ} z8l2?Xe4VB*@k9UXte^`$Kp&4RX1oV4)sIP9LRaaZ`GNjJRzUMT0KF+0=!QCPm-x5* zpnshe=t2*mBP($Z?}KZ2663Fy(DYb)9(P-7HKJzH)*9>qYus3e{aSt~KOC>loB6?B zl@-{bMFKmLABqP%#SeBOE3m_h16CMK0{d!yu&>Mt?8u^lO>pDm{9s#IfgN2muw(IV z{189bcVq>2Y|+4u$AkR@KiH3F1$KOqz>X!=*{|?}eJm@mTY3O{T}a!4UZG&r86$S= zjiE4>Pt@b@^TYj@tl(~4M7Rke^*le^f6EH)wjSVaE3A_}VBOr^fD$W7;4Zv?yUBDOqNZvxy-R$_8SFp*G$Qw1-&7AMLxhRGZNUVh zWB7gr9{}a>jfkH3He{F|cOfnAD7e!-z`dcnP%V5?uG*?qL>oB1g^G9Mz5Ix0vO>JG z2gF0&h^5-d&^BRoXjn)XYMbN7Sjr0Ht{yO6(~Yq_FJMk!d=b8uAKn95!Q0&fyiMKk zN@9Y_zK*+)aZ&WQA~F z4+ull2J@TZv0cKC?IJ`?)$ECS{O|7pTS)0CmHM$fIcYq?aejm&Ss^^o1HzD2D;c?hcjdFD)) z5A}dH#9O7I@q{s-5AcI~e^%fQ_W*9V+glaAzIA+XNEjX*OaS>gevqHZ3gnTDK$gTh zeTTDcWH4c<@(F&Bk7ot)mL5QcJQCG~1i|?^KenG{h3(d?ur=f5W!XjCO_?Q#n#tq- zwydxvbP99)*e=Zq+wEClI~reZ+xf9=$qL&YSz$})CmrF(_KK{q-Pr@Sur>@$!WGJm zdLzF0YWxt7W(Dz;JwOcmK#@Vz63Vd65Acmy0en>t07E|UQiL*FYe=Xwq?kX^((u8a zFk4C})DQ7v{^P7L-_-+VA+$9!GBlnriQo(T_&%Q%zPo$C7c$c}P^OBm3#J=OdP1Q- z#Si-LvH~q;1G=nU&h<3rc@U2MO(Z)JRx?E!SyNL8!B*0?GQ z_#!+(qz3R7hI8?O<%oI`jUV5l19L7?$yn)pRgWbeuo|IKD^*)%S_Z5_D{{Ro>1+3m b`|)41^QMky43ufPJN8*bXTP}`X#W2KRcx<3 literal 0 HcmV?d00001 diff --git a/it/doctrees/differenze_oidc_fed.doctree b/it/doctrees/differenze_oidc_fed.doctree new file mode 100644 index 0000000000000000000000000000000000000000..f7cd986d8deca54aa0ec12594535c8bf36d480d3 GIT binary patch literal 47439 zcmd5_3zXbedA4J(*Smfswi7482~n~nb~e_`?Avx?o6YXpS=+IV?ZkOGW9^J~r1k7* zkTkot32i8)$RJu8rnF59eH|!|!l5lalmi@Sfx@A$Q~IFvMVmuQpQrScwv;~q|Cg?G zrI9pRS=%%x{`Zb_b#=e*{`bHCy}FO*dwyv8<7??ES zwJ0~t_B-15zoGs5_8z-WmzE8!rB~#(y#``b6t!N}%mN}s*{oO~JI+9mdz+L$YQLsNn* zm~CaVF(=vml4Bm32m&ln*NVDsd7n|=P6F# z<;D5|qbVWOjZIxPWPM3)x9nb1s^JrDrC-^pth4*d9!>CT17qhNxM~y;tk!V3SUl4?c=JevBen#IqxXVA)L${r~+idrjLmogF2G*2Yfhy&8Ab%J9yA%H11^?~_ zsy57P`l5t+#h0~}0p(RK{j+D_aEN?3G8h}Bw*h#r?(}R3_dc*J+e-@Pgw`3 zA8_;vki7Xo`&uIaMeDANOrl76XR zEY*;R1IudFR1OHkV;&nl^eoTEtFJe0hss#a)=70Btlvii8b|qR+cyl4we58+U2WTg z>5*Y#QlqL?B}c36wS#TtSp!*p6bfM0Wwt-6Ae5&fOM#TPqZCeKDYP1X&byX_E?3KS z*)(Ncyc}ByC%s}m*oFG!fHRXm{Ei`1aXf$Q;jGPN1=vqUrnBu$)S_E37 zHN>HEso?k;=nS$(*50V8)e6RgjJZxq;F{;KfCESE>x0+xZfsh=0{+b_8D6ZB;IRCm z*OEy*(1A0j%ZsupK?5ya7wCbrzy`7~S{Mo%9s6cRfT%a2DmyRZ$nfqD=uIy(ekm${ zX&=1~MgkdQ?A#U0PA$OB5wCR1GYxQYujIwic!;A{cpPyG1$_f}CC8K(Yrv0H_F}n; zlpkN?ZN`@n%a?+Doj58^PWsd=FE1CQ8q}Jawp37|;;7*L6`>O$wd!VZUIlYg1WTmB zbxprgb}rQGwOZNh0+pqfsc1U%Ib;K>RkJ!DBCMxg6D5h`#=GFtaDl1K>STzKb9XE` zj!gjzGCN(E(sbFUsGC`-Kx{N9;_yV2P1)pGAzkJ;a4#3|=|BbA$Cz00dl|@kVnNPR zjqyPaOw}cI(Ks#X(Afm{dgY)AaX6V!`S0Qw5TS<*Z-m~o^G1#lHySZA&>79wm6??? z6rD*%*FY>?)i7OWWnGo(>Q!n)jI3-0Qwfpv3Z5(&58&R%aplHxxax@IQ#GB9s!$FY zQ?H6;>e(<;$IhQSBa>g3nI3`X?oCh4 zB$!K=o2(kdC6Po88fKT9IBJ4XuA3S@V~m>nVyRgSYmH-$Tyj>~D&4~?kz;OLuA+>S z8=E&y5wU&#a<);sV>!GS=FlkuqX`3m85%LiRPt$r6zn#hHb;A$cX1l##&O6B#qlY6 zI9u%t+c5ZFp;L0sP2p__a%SUnHjqk)qo56UV#1IizK>%mXv4#?e4et} z@L&!ZQ}@R*)nUV@V2B=Q(k{u3tcHq9BE(U^hF9QCKoGu(BPd|QgHe2TGTLxHV~m=? zSZbQ#N;Xwj!Iwu>M3=ro{y=7qBGL+xCGeH5Lh-R$`S0dfbK^2gh577=>(h5ETP2Lb z@AW_)h~@FAFptRKjIL{$Jx?!z5M#ISj1hi(3rCY1!M9Pe8^P!1a5irIEHTB}8%xOJ z93f}qnrfKN07ZIT(z&PNhBbD$Wbko0D%{(J&~2ZHgK3H2Q}8pxXb@v*Fk@(djs@!P zqbnZuh|EYRwUEXze<1LvQ`aH}LYP0m$A(S|=9Y`?Q+VRKC=BPEF|n+iJEJRRC#RY< znxbZnCf6)rXBBD|Cd$|uTQNIhdFjqr*P1mdjwRJBUxjwJ50&Lp!|>gUm9IiNTi3i^1A;(MgAAX*R8wljL$Z$ugeyXW%I(3ym2Gdp{lv zUOhvec>l+X5#T9kr*q@Ux6}t>dAbm(PdQnlupQdop+~$G^6q-v1Z`02k>@1+@h#AU zv7AJD&EiB}76=jw)vr$bJkiAhVH$kh%EfEOL|M&xD3+aQ3k1*R$WI4DUcK>Z7BCdx z$cy1=4`nI9QZ6;iNtW?+FqWq{Ey~IMOmtYEC@tb`k9VJAC}??d(jwpP99l6uBl-A1 z6NQl!b!-H*gLTrQ*uncb`#_j6raOmM%+6?D?2M*hXS54Dct3Y`Mm=_39m`If1W;4i^n>gVTrtF%8?*ofr~Rs;T5Up{h-qZo>B-h*vF7E1 zt9o=-Xk8Wpcm0Yt$K2{w%rCQ8Q?YE~RO#{wAW$YQB_tKe^$pf4W-q9PJFpyOB2yB9 zRb-dr)45G-N=U1F`{f~YI+oCTkkH9mm_dF@W2pA6$9o)5_S;8x8?P#Xlvn}J#OCMC zn4h}VsKNa0C9NXO)nOt#Oo<284wf;WZn{aASX^b)ZmH~iXDGWP$f1+E)rR&w;DBx0f2d{ zFDKo%vs{UkD@Huzieuc1)RFaCUoOC3ttr8uVqLCDbO zSTJ)C{=sbJrF%yvPaP|qC>KD>;Zw=j1ekzAsWdTye`ih}4XJq#Ob(OysdL^1AN$ix z4OSyNjF=O##4KYCKu=DjbxBjF&V=gvDz*0^rnZugOyh^4uj`$6eC{fYJ2c^|l~Kka zE+(d>svWDHa4DS6p|4=8nX8~r?5s#d`nXybxcD-Wb~2WT#wjD|`zp{Zp|(Xzq!66qX@j z4f5eQzHaBLJ{49h!TcIr^5?Da!&Nw?ktke!PV`X8;>Chn+&;#x^ZvTMnt?qX3zk+J zA=tceuE)G_1;~D{0=n14qI(i`@{}|A4BCqB7}<=VQRw}{zyYkJ6JZ~XmM%45bN~x= zb~>_D``z+~=7GcPUM)CRedMV}mAYqxmGGHZ4(5mh`~rz>fj8DQR+van2b;&lR+c&I ztj?O!oLa}#hC${_!OlcSn8HFM$p+xX++-@YG_^}9Ek9BAIxrM zfV;hjp?EA71#X8@21oXkIIUIokCeEN3Y2(7(x@z&t+~28$K5DGRNAk{0EfLaQf`jm zD1-rByoeFI&G3{a!m@sh8bBAk?xXWeZ`KSj)Q`uaK7*)_o#(6)E~tii*Og1M?l+r| z>msfY=Nr!j&5*?f*q1oWrDhdY ztoc?a^;;cZ!Ncn;&j{Kaz-Dp<>;CkidLN^&@1+dp6R|MeQstcP)Nc%ys@$mPSDLsy zzOz*Mjy6CIuG_udQsrLE;651(_qe0P$1{{_5bh;8+>8LQOTi+=pMH^g%eFESjBjKB zpNa)Yw&~b;uA7DH-?ZJx1T(|o1uLs7VUY|-BX12%nHkQ0rrJ4 z+&&EKmPVVz`P)~*SoA72y5cmoG@?VpS-AoOBjEHt zJjE40HG!-bC+V;a-jZC5>dnDyGv{$rYpNAP9NHh%1KOpEun&~q2lSqrt28;iz-Uh1 z9R5PleAc`Qa^3l4q&*u;+6a<%=E&5<*w8+|cHoQk`HCo4adQgtxZr0I{$adOE$C&J z{kaU>B_Gy(tloD?on^Y5Cez$RvBYGpg z22a%)PcSqQ??R`$)iCud@E3M+jMBJXcm!i|+QnV+a}R!&vw;t3Qi|6w?xk25wAD#S zlU2hIY4iguM>D8J-e5^mH48j1mLfM0x+7G{0?%+fU_8E-h2#0;90`z<#vBCF^76?z zn~UX)#&(^dqAM*!W@ANQaZR}@f}@v~v*@SA(s-1T+>!J~p0O_Re8#->(xgtYjCIK+ zaMtY#XSl`5jDW~{ zUf$l7B5!WNzld236g=#hx$ss#AC_MLg3)R=H62D|G}wc%Qg0dR5^O;PlaPeLL1-2< z+)uDlc9!s#`DML>g9YJ)BrIxG*!su(>`y{``7(T=tEjL>kyiY|tOI}P_TV7xQ25#R zd2ci&r}XzI+w6N&<;dGgZ{dT)2h_O@urwUzaPYc(ch`(F&hJbF=)dikQn3GvNc&F8 z7}T?E_KhKS{M4MhFMO0Qk*?&iEZ>pDvHy-QWXSQ3r~>jd(8;yzZ3-AR+Gu)$wc|#h zgDGQc&VSP0;iv~p|M1m=Ytr1?0qud?ZcB#mX*pbXnmE+-uC=iLoZd1_;ZfMSn6b)V z@(}-R3J%>m_YKTYpw7Yep}{)$O5 zN(JGxtP4`JscZ8ZY(VwLzPT`wqau`W{dW+)Hzty(>s&fM`Fr8{vU) z3%|!+Pg%Ct876o|y&$3P%(rEJw{WZ%8}MyA7jA$*k-OKrRmk1|PlLPDws-h#y65b) zVW)Y#y$D;Wwik9lT6Qm7z-@Y9`)qu#y$K|jMbCJa>LDO9tTbWWa4pq-f)i(D7B5G&E+? z;v5V<2+UVs()JP$uz`X9yj*u59UQE{Fc10@vkk2d+txXppsI_3;XW2;}T+zWnQh+jiK!vS2%POP;&Gc@0 z2`p+0CYlL!*g)edY`UyE+b^@XB6{a0?8r>GVFzZMkmO89lJ~OcFuM=F&tleTzEXvX z7rfJ%%$XF5=sHT6JXQ7k(iOY^lBkUJx>~{VwGMQ|f1;WpTQ}?#`~;$2 zxieb-SPr&#DyN^`(rRSrw!y(@#b;T%IqJ5bDJw&!);9kELl0p#kv`?O8CO4abvThQL2@m&fhlM{;N&1V?hb)&agL@)4p&j3BL! ztgz{F-uQ-nJ2)jUJ_FrU8hon2`51Fo%5-AP>)Q*T0i9Y<&>OUGjf@CGP7n?A??mHq zF(@n>-f1)RcJOADwf0tUoAET9vU?ECNqaN9LVn>%d!qsKnxV;p6MnXV1LmCAGY=hD z+{zyge0f}|!=C@1Z%Si1C+)tP3}ac?7ihx|_yC2+0xUM+$0p}ZWk~)K{Oossw)8su z+G1*zG9Iggcj1jakTv~E+ulB}X=Xz+W$xzjwe}Vq+G?~G%a?K0Q5&vog;rHVEM5&@msQf)0ZVL6DacR(s#pk-zasg4QWNLPT_hJi)zUuqh1 ztE!dZG$x336Vw@)=mD#0z;SV(Bn^QIhYpORo;QMjJaE<$ ze0|2r1fVo-OlK2yJR)i*Zl@0Kfho}#2MQPytU`%zg430}pP-@JuwH@UG-{xSb#)O~ zd-SH=_SUA{^o;=Gfxcf8)E%;qb;I_SGQnk|(7Xa0wKwQ1PTRf(V^RhnW*H12l#og1 zP{~d4-qI*gx)r{eg_6fBe)8VOvgD7&(9?oBYfy>c*rfLHjrN_OmWyStc6wF}Rx#mG zSl8^Ej4LpPdbzBqH3dco6g(OVS1`5h%?9*d%<^knP^}FhY6tyxe!{w|3i!5kveumy z1%`hsP=Zc%1D1(G?EAEu@CrOgjE1pYGjI(QNUPvVMBgrKM@wO}=0fr4R2O)e~(TuseQ6FXK!?@2~=UwMiu(O=+aObcW4!1XGUbS}S9uCfYFbtlJ9E1y?BuKb?z#g@H2@C>#U&e>&nhL&<9aFUerlpQ?aNLjYI!+Mk#Ahvf%PFwj< zM|ny4n(|HMAC&)6zO&E| z{kDZ(6t|+d8O5tm+>K%gMFGVj6c3^}j^Ys%PoQ`Vg^Xejg^of)@!cq%Lt&%1hT=z2 zyc5NHQTz;wUqtZ{6rVxyDHOkn;!7z02*p=Wd;`VTQG5%La__Q zZ7BAjxEIA3ieVHFqd1J>6p9llo>3KhjXiX{{ViZ`No9>v>HybZ;>P`rrZ11NqL z#m7*56vgLI{0fTSLGfEC{tU$*qxd@%e~seXDE&Z0Pt;v$L*C>BvHpty=+8O57Xd@qVNiXTMrQz+hz;=?FDh~g6{ei_9V zQG6c7@1yuKikDD)4aGmA_}IQ|?#@i7!11<|tmP}805q49{kmn`L*mhxW~ zDY`{UZjpjpq}&!Mwna*9kwROf%oZuKMM`Xu0$ZfK7AdYpN^6nATBNKNDXK+EYLS9k zq?{HhrbS9=kwRLej20=PMM`Lq0$QYe7Ac-ZN@tP6S)^GPZ zMM_|i0$5b|78Sfjg>F%STU6K<6|_Z#Y*7INdr)510v7BwD%5LKpx3A{ueFrhvG~5G zd=(7UHd!DlR_gCCL{{qC z7$PgxgVmm_)OHM!mAVTLP~7N-biDtkhKuk(GKg zhR8~_F+^7Cr!YiT>cbc!EATh^*9)V2G^L zdoV;+>K8CXR_fCjA}jS97$Ph6RSc1p`YQ~PmHKB4k(FA5W`wNN77USPZc)QfnHtQ3wela->*dCT6ydu`Zg+gso} zD7m=kDLPlsKWFhAe}%u|!~^#iyu8IZt?oI36!qrNMK5+=AjLlRR(fcAAbsd&=_dB; zZV9L5-dSV!L+^p+FJU)nQ$?%S!NUR<9D0wvQ#h{)uD=6al5ay*Kfcy@Q~M0K!!V-& z9BcQ4JLkn-XM(?sb0oGJS76@EBD?H$b=f?Mz(+IZBRYILnV$se&cbLB*8Sp-mT)y&&&0dP0-1+ziW=XZ|fN{0MGddNSJ7v%dhK<;9`xFfWZ@%~(T zyzkEo?_dVJN0N2gnSF_xjURlSL%NcI|5|$BpUn&S0~vrnm<*gC<8fBWX#YGt+CR+; z?cNM%_s62;C)Oro{Z4wU|CSe4F$3247K+CjI%z5y`pp|tJ73!%YA()KAp`XB*kblh zVoC;DNDuUZynq%n0DZVSQ2s!uWYCYK2R)M)=u!sIv6VP*-cvHxx%61ed0`#OfHi46 zhkf{kvzL;=K9?TsmAt?XuM$`|b|V?=JJW-GM_yn@RtGE|x0DR_Bk93@C@-+1s|L1< z8hA}_V0ymQZT!cM}K8Yq7?)RpL`-Z&W z9?1araA#SvV^=y(R7pns?(~R%EHA`IGa!zbX~Ug{l8o_}(_{Rlyf8kJ0ps4zQgseF zNrw03^zeQ=FL<*V;N9N|56(A9#`gE=vHeY6*p6ku7SU#Q9%qsab;G9AzR)^|nu~jI zJOk8-8GUp{NisSiJ-R#dLU$qqy3tN04W28K4D&#Gm=k%yd^7{hVgk%$gy+&Dd`(^m zPi8rch)c*+mQ_Mlj$LTJTHi6GC+))rGsPfcy9J{fVS6$!Y?qR; z+3B%e%M066d0{h>vAs7vwx7uh+tV4aMfor|_g2J%IFccLCOyPYfHYeoi}xMI>VNF**05NS?f3}5TmRcwTh+HJI~mCj=kxhzE|x}Kdj385_b*?1{(T*N?K2&H*jar} zyF$74iT#TmDwVUQp`r-Qj=sU3Rh<#F*|dz=Rud4Y$g7Nsjp8|L%Qe-uaTC`=b#=kL zT32Z`f*-SL`I4p0ah%~R3$+7wLnWx|8kS~j)}q#FIcuBhJiXD;NA#`wDrdOl(}Z7Z z1Uq-*u3aFoX5IT!s%UdY-DnzS-OgKfv*WC;8Fj65VyHC>(6`yGS-WX8L7`cf;`;1^ zy*u;y+;g+mb2-$*fde_cxlkJ!$>nkn&RT_oBZ9tFcq+d&#E;#ln;q|$OCBKX0c-kg zph|xQ$iD;s?!>>l@bA^2YR#N!EvQsh%B-Vr*Y9cR_v)ki4t=M7|A{q7V0SAf0q3S! ztD}l!=#^d4E35ST^i@Fp8dt7>?6riftZU^IZUrCVV!A_+6QgM{YE2m&!!WR;e`*HWHwL z#BsSg&P{tJI?k$=Wptcf>5)-lYQ17qR9C8dSlJ~6#ORJP>TC=HH%9X@QIOSLKLw%_4om?v3H^}9WWqwBj^U=&Zdg)Ca zUDe;{Gp&0}Z;WO7axBvuNlkPy{U9-IH;hUzai`~FQC7!=Xa}tBj%79B?NlTV`$dx& z9QS2+YluNVBSF}^eZpSw2)iYguy@81c1tW_2U$TFT5rb66d?^|N-SkbuczW{gx}`+ zj3w>15NSbHg09&2FkW(Z{LR&^c*2+pL?pii!w`S7gtlc_S$?PpGx7PO{{4qCk-(A&>~4Ps$DUkoc9=VgKb z#cH4_yO~L3_|Lan4Zko!E$ZKNj@KNi)&5EPR2uH8< zIg$hla|2{4G3CeF9>gm7u{=S_j<3m%;OnkLzI5X2Sfl6wtshbw&9GZ=0)u_xx2pg)+ zE2=7SZex9h)oJb*|RrJr>yt2kfli+ zc(?QPcBldE6HF{QUjg#fi6G~=#RMR?AFip!f_+-GFxkZLdg-7UaWt7o{of%mpkRiK z95I`AbCekIqA?@eyQ2lNGPP8O;tMJ0x;v4sN|dg%nq{ap;~IA&_MmKqQ;CrEN|`L! z1El;UuDn<-S6#6Js*VgsRiuQ1sqKkOy&=lf@$=`-XgsbPm?kNS2uHWc991tjEiWgD zATNqbP&i7!&Y{8BkqaiMxhFj}hoCM!ZU&VgDT!XxkYe_@Nunkk<%X$|3nr+!H<6l! zsMNUX$RlT&wbI?P5V`8c<0?)$d9h{X6can(FJm2bUm}MWqa3+B=%}bInFOExABu+rlql2}+P}zix?MUROTZgx1s~G=IA31lmp$)8@&W2Kn za1_?zZcLaADL;v&unv#L3V0e+hlfijnA(}hRF@7v3==(QGB0WMK^2vhM1-S|4lg4o z5JWji1ch{XI7-0IfI3_*n4sqVL~0t*Ms~PnU@T9fNJIKEj|T?kC?>54Svk4Ul{r2& zs~~TQH7~BvR8-EcxB-2~2Wy0J`288ku0$T6itY@W|6oAi~(oWyTmkJt4D?$SE9muoR2&X zhr3=Wph!pmS7R7h*yGIP7Jnm_ zk%_cq(3{;tGnxoHY-aVWqorbgPkJ>R82S8+eQPEXiU^8tMpbOj6kAmGNG-^JzTJCH zg~9Wn6=h;(r9_2L6qm@(SiYDIJ4mQ6J7Y?*Cp(lz=Il_Sf}K4}V}~s3*|5{gL@#7# zyf-^+=FglRDwtqrY{~3o)Uw7?w5;*oEeq@{L(8H>1v}$QW@jQR*_r6uvc{E(UM&mk z(DRJ-4kaqsnOHJAlUcD7UD)xpuCJBHmB~Kr(DTgM2^MoEm&ndUR(b~s^_888K6;1J z$ebNYRLIWWM0PYD$apKnen&i!&#c$tq#_J$^%n+(W}Z;OJ(nLt^y`Y7j?B_@+EGrg zA%~l+;A!6gJY}SzsUXqOkI#bN&WI;@{Nu+6@f6n6neh~8>ivm4JrgTW8EK-Z9@^3+ zN3s_3pZeT{bx>-{b1(S`G|+)WPGU#R%HFIr5E6>CuWtRkw~q#*G~~9G$*7qU6)o$5 zM0Vme5Z=v@pDu>{cH_4!Fcjj*kKs!X7b(P2CN0ZNR`B#-B2P(Dl#%|~+ogTtq)661 z{&R_;u;$4~iUPg!(3061%VrF;H$Rr5jg3J%#3VhA9eSSe7>EicWar?L*%{A@o$(ax zjQ3%Oo@dU^xX;eRiR>h4pv>l`d-L71Q(wPG8YnzJ^VzLvqo%(G^;;8p5jM9+#$w&hQv#>*n>|CRf&)L({M{-YG$Q^6J`bp~>jHLMe#~K9X3Tw^Dg(W_=#}w-?Q_I$Og=c5I1Z*BMHlrMzU+OH@77X0|u5`Tn8ty%Eq`sYr@nBq$y(l0*Z?=q@y31jJlQB4#-N z2(G6Rx&CG1+C!q{YOVUbDga>L>d%tySBO$6Tq;34N+mJwN9rp2&z|(7iKO#Zh^bR! z#r?{7agQRIxk+9~&Jl zj>S~ymP!q}8K-;A_=nxfi}#KlnmL|7S;|Aou~ag#7b+k>I=Xj^ z{!X1b77_CyYz|Z9t#kg30Q>8O7%WF|1TiNPiMdQIfJSl(pG!JCb0*T(m#M#xFtv%t z$ZS81tgd%I3Aif@?ns3%S3w1bClfiOqi_L-fq*S%slsDo_e3huC$+lJ&7TozbOM{t z_jVl-dzeT&edtU;SJO1%9>LI>bKDc7FR57STvMStib;Fn6zp(TM#tm!Xsp5`3A^_* zKs_l$Wr?|n+CP;Dg!i5p$8ZdZT2KJT9qV?V>N9X+3Hxj4$e(}0k51u?j>X{`cB4mX zmTu;~>JBjW-S^ioYXNp95iFlJBCuKGTuo(@Dp34h26U$r(LG5rIpc0VLtoJ!qu3EN zj@ds92RKQmz>h}DQtPk|P^C^EiLKQUul~_JNSM95dG~IBJhfG+e=$T2zc!JBS>}LN zAgM3#ZCw-jz3J%?`rG$a(jB>;*?;jhL78N-0vTAZ&G+MJY zZ;!iOKveeEV`IQRI#z0okrl$m6feeNw*haN3Xb(t)DXJx{Q#Y>dIv3lK>b7_>NAA; z_<2by(Sd60yDneStf1ROsS9*MT<$!prmZPe_$5#-YqN@4o2OH+`hp#i$W_(LvO4m9 z1|WSsbmJKdxUWlu%iStYtOZ&pb*}DM!N=-`L%`is#wmZ^YwJ`tu@ ztJ0u5b&la$)#_#IYJ-l)ch{;s(FWA;x!oJBRViZu_d+7v6Rr@S7@$_ea4%`mZUn$C zg{zc)236`G+ZvEy%25D(G7%u_rsL1M6m9*YdSZg964>C9-va)rdnxWzj<*qf^;N!DAjBDZh+gjA*99~Bu{w@w69M@ zd!A%>hS8o`V*OU(7smGHFz}YfPT~SL72yhA=a$QoYgxV*KweVI?Og;Y26wv3 z5$|Et=V!zk_(FFmd)ia5-niOZy+~ZPC?o;GHK2Te5`2jxmVUIof9iVZc)aF!!t(@ z@0}>_3mOZR! z^-MOpG0ZEWycyCnVc?0r4)S4Ch`T(Ygpwm=2&T6)5sQFq7|R8 z;t?CE#7M&#f||p6w6mq+zsfdTTGkPn&IOq|=L(aF#2|bGT*gD;aLlXg>T}XPXI=QT<7VlG zUy2t~l)|gL_fla(mA4+HaHJeBY+box#VO5z4?EWZS#IVur0UG+Ttl-w;c~qLvddi9 z3v;L>*Q1aHCxLL4=UT{AI1sF03~U~# zQPtx0TJEAiO_@I^e$1Rcc(H`Cgd(6|euOg=;r_fU9OS8xtRoN^2w7r5cIPUsI(+5i znk0S!5PF@RAX)|nf6%*zD`h+N&Cc^bYkquhf7K6j-9tYN`y)2F`Q6cjNzrK53w}Yi zmoWTPRR2AR%8(O!8tbjn)Ar74cA6Z10Y277MDj?T)X2vv-K|{k&=757P>-nSu;O;s zFL=_3MF*)P@^8cM0&a_vtnoYqR{scju^zAPz}1PBLB5-vHLfH@sjU7x#1u`^k@)Kp zv~K>+$ozecaLWAQ>C*Va3o?K7emefp4ifpZ;`!s-UHtv89{fGEj1A3KZLWB0zLUsk z4^D)H6)c?bR)v;}s5a+?>AG2i!>ZjmqZZO{l4^6Cdj(pCoFr33p%cv9E_V+X_0h1o zV!{t&IXmDZZ;ZNGu}gNVLH(Lm*|nQpr3&T2zEo*c5-5>}Z?G_d;NCPuoi}vAI&5Ch zRok#-6|j3Lr4};1gm;2+Y~XSvyBep;8bKV?5EU7%f3tIYB2T^yxbT)D12>0cAb8VR zC)9|fL*#p21E7K~QuB=)?NEo=x7*%I78V$&U1xQpH zZ;8nLh1<}jlkn}Pt`mJCMvImKku<#id^bi}8v0}OlRFIbn3h2UEi-4%V(npG#e|+> zV@x2Lf|1+hy4xrjm0i%I5Es`ERf+s8?aI~B)nhxL*K?}5$IhKQogeW9-W{U)nX+Ty zP+s9yhe?#5q?Zp5Mi$`pa-Q7nl51ml#Kd-HokozkCI*+e1>=g+YUD0XC!2dNmV)Lu zlQBU-vv`Q>vbr9B{C;J<#Gep~VV~0A-Ki9E;58}AhMUwXR7j9QT<$kV>PwVhW2hQ~ zG|mrDic{GNK~R`DKtsDoMg)vi_z}c61}OY~QTQc`Tad3;&d_k;RlTKA0Jx)v%z7En z2pq!Rlo?b}cL)0nemY;Hh1a(yC-dP$DpEAIEF zkTy?ozeu!)6!$A4ire{9PgDBy7$`R}Kne67e+&hRkLFkSDhkbaY(u5_Gc;s$2;(|i z^!2H)qLDJ{055x69|?VOD)4CpJ&*o`H$z~d-Sl0_?||=OV*$T&i)sy3n%m`0;n6Li zqtF&qqqZwhyRXe0VIZHs&28cLvB+)@*K`fqv?*+3tX56Ae1rijULKf~Nz1JEn#TtJbw^JPPx93|a^Ylt0|U z%)=FdpxwmTI6`R#WDKpL=|Q*|q^Y`%{9dZzJY^9x_K3^5U)9|;K(04O*y@eFUwbMJ zPy$(aT+~Yu9(;o!QFtz%hS?1&6@zk8rWHD}K;vE4e5QKlGc9)jHje`ryL&KKz2zSC zhwdd7rILI9;Ke|scBITHV0W6C(pNYeu-&kN50I3upcL}tbKjuFa$7b&Kw;GR6Iy}Y zyZQuj^{m@59dcBiKN(Y-JDt^BP-m6hg!O+dLYxws>uBGi75Wdl6*>>h z@clWQB*?_vW*4<2wEDEd^$~tN1wwBM^E+K_ zWmlxFT=>Bx<{RK-m*ck$5TBKBY8>iO|v z?#43bu7g9TcjT=5_`qeVSdawQOS%-xHx}C)v@NVLE?WtC_iC zFuZt{9|VTRU;w;aQVyF~QOHz=YvShlF_t{0sHJOoH1aql*FL2-illOBR;{?@1#f+>cc+ zNbgm1NXs)cCC!!Y=Ip{Y(w)^ZQb}uDdKFUW*&zzsQnf*;l08V6l6K?O^rochBE63# zUY-h;+({-`U&5v%eBGf+BzBpOTxOS|iz%r<7YA?ph3K07iqb7<3QSYZzEj}Mz6P9% z?8S(A;`cviW2!f5BlM=irx7)5Hrf;Ef1Gzl?JbxyVU2E3iT;8FKvK~Q|b8;o?*G#6q7M5++qi&v?zdi7H4Dn*|@VaY{U6^ESg^n zYKmG2n_S@ay(%gsWOCVz&GhJJ=ghbzX8)nDA%l@pPctRebYBVFI*r;k>D$P(f2?~; zP{L!Mg=;BT@MQ6Fmn`m!%HkJ1Srqeebi*t!!l;WSClv)ia4>rPIfR_aV?eM-aMX*+=H;31{C^R@TC6Td39f0L0{2k zM#BqZ>jZ2uuUX^L5WMw{6!qY(4^sxLNAb;cm_uks)K7)Pps*gqPYh`8ZB=?jb!>dc}DYwQ8Tg++;ymVLns+Lz< zT=s*GumALgk`k>qq`1PRiPK);7)w=Qq#*jLux)49tzt-jp{F`&&YP{KXfVAa`SS49 z78%VPt$NvsM%~8Jkt{W zDpVVtLLkSHu9B0DpR~P2%yw#w*Nx-OXn66)HGB#$h?H2Xo(rczzQvHbyS13~fs`9I zVAh*FPYTav5ZT1(2{O|znmM(CQ9GteWwS<(zMwz(aDxp$ZCd@BTX1Reh(esjx-3Qy zXK@r;nSo`BcQ*Ses$vN6PZZt&g}zjOGlf)#hboVt#R~zCNVW6d{nKC;#X4I0@ zbPE`nFhq|oMa00*J6&UjZ635C7=uI@7f7a>*gno@c4Auu=N1-CY(~(m1q0TKE{Vn_ z+!iDjBU>+L+@NJGis=iVcccd0$3Ft3zKnc-$ua^DypoIr{fV>9RUo90{VoCP@UDWA ztbbBGzhfZ9;VSNQYw^&zLC!m!ZNW|l1+y5}voy8<;3OnW-_<5IlWL;B3&rMhePr}R z0T7$cDn`#=(y>Tv#^_rA6kgc;gNM#5uxkPX>JnzP-f{KP?9~z*= zn$W;@$JvY>B4jqS^K%ya=mzjLuTyI+EjX{iUEV2Yc%D|`pxvzwe!v+7&Y!6Z4g6T| z=2SxRm+*7M``NN;__eWVmP@nnr9)4V;}A_SuY%q=(`?qwrY1c+vC`Q{=S}Oah0+!B z0FE8L&L(^U)o8$}&;qUJ*+}vZ_m1YCy|hc0jiyd}hiup0!w(`aJGW5zZIFa7!Z&Kb({VP|)cSl2{-VKl1;1~?&L8Jic-}ItN~xmJ zhAL!(gNNW?4d(Q72Jtg&R7z0rbH|7SlXHrL3Z?`rsPXld zdfER83EfQX3W8IghaA=nY;f*8e#;JLQ$uS6N`UZSOIicsj^b0>aD2DoxNYYfSFzi? z&Mp)>&dVt#7XUF!)CuAsDr#gM?ko3>j)T%oa99yZp6&$6`<^O#J8r>NF!+x{BdRp@ z&WUx-oe;}~lHWRgErz{gBqZ0JTkNYi@qDGE8}mAj;^>f()#OdQ<7}`ORJ5~aTWHoc zh`N=3yFcLry$pjpQ+sDw$FBA=YS3+NV3{ez+m~7mWU&cqiO-gMYT!Bq$SjkMB+v_6 zNK@FY*+@KNf#jDyGr)~;H7g~E&BCl!K?}Z$BIugdL?$mUBi5x7Z__QQl?vJZx!9Y% zGw+bs+MKJ^t~;x=`eNr)YnF~5@Nqhlvs(;oF+}@lmfZbtjBYau1<}G-gTw~AKx`=V zo%&IIxBiqqtzXu4{hj&?`bYE^_0Q_RuYXzpT+7)KdWZT7e#yCM*6Qd-oe@kE%9j)a z(%jLXayGQ+9H4*Wvg3LrbsxVIu?_gg^^Ot8jeB48|d6sKbsL0%L;Q{qbc#Z;xg6kB#hk|!g z@Bs?`6$QUb!N(~06b1j0fCjl_U~8kqu`4ath z+L`O>k(b)~_uBf8+uVfO+Z5G`&i*1`lw$0+&W>Iakn6_C&+bo`K7R@$`Wt&B^&EnW*QEamqwpj$* zEPibky*7(on?1cp)9V3iU!W`2n(v@1)|&65E7qDHq$}2%pP(z&nxCO7)|y|WE7qESL07CbzfD)HHUFNj zSZfZE8e*-vg|1j@-bGieHFwh$Yt8+1#ai}w*t$B^ESZltO zu2^e!=!&)G`{|0c=11v@wdN=3inZqF=!&)GSLlkh=1X+NTJyVf#ai=6bj4b8nA8w! z&8>9BT5~&HvDO@=E7qD1(G_dW<8;MZ^E_R#)~wJKYt3irinZoHqbt^$Z=);Ln!id{ ztTlgwu2^gSTe@Pc`3H2xTJyiq6>H6}(G_dW|4CP@HNQ_+tTk6aKwYi5k*-*4zLKt3 zYwn~g)|wM^#ai=Gx?-(4LszUdpQbC;n&gki)tY?8TJybhkG1CK=!&)Gx9N(tCY``^ zwI*%sceN&MPO(nR;= z(X_lLE1VHbr`Ves%^TOVnUxppFr8j|n7pjv{=0zg7dvM#FTlDMW*FXJ&&|-ERmr!> zgVQGaDhzE4;L`^f@N&(5GXs_v|1>|+|>iQ-THOSqFN;A#gV84+b?4M@^_EiIbeWVB2;5)gn0$`$dwKwE{NDuk{WCi)I z0U*Do8#2Dir}nAPTZdCO&07$4Nli0JdUFGyD|Vy9adCVrB2S*{d)J_n9^X^nBjfy&h-etN`yA0B}F`h2?jcmtmVH`%iDk z|06x*zsw5q&H*6zQD3z51iZ8`-y83b)8qYNR(S6p0PoS>GVOZUBFUz~WSJ+Yy@B60 zl6uJXGDOW}$hB(#;1Bc$&X6t3>@yH4rbnC43hiqKK)XK?t)2KY z`dC(2cMpIyxrdUmV!&xYrqfLfwe-+uvx2S+0DUsCnz7_uHt~tuKGVTBrw966RzULu z0DZJS(Cud0Y5#lDgMN2bpbGfLE8Sa#otYj^ldQmwEgRTAVthw>u(u;> zCPS+6Wdl3WTZ|{tgWZ!A*okEWJJ}oTOnR^>7jl+E2sws zfSO_qrR?q3YQLBs>=&{E`@jHT)3jQE?FaYU>EZr$R&XC20B*Xv?bBw5Hl!X!-Gr!_ z3@jd6Hn3y8``WwGgWZ-D*n`UkcDy&({prC@W(D@)0l=nfwSA`pXVb$yofX_i27sHc z)%F=7FQf-s%?j+H0l>!ew0w%GbtO07GT_q(n?3rh8oV_<)VE{>_0a*K##m+u9X_-H zplS|?33=}(`~LJ;U(5>Y;Q_Gj>K;ImN66mbKA9fe?_~w<$N=DC^bwsN@y;FNh>dVF z)f?_t(!>2yR&b{VfctQFUHWdc$bYCfa7|9TdL#aBdc=Q|72=})1#|rh3>=v z=*GK+l>JunuG{|0G;d1}vz-;plLNpk^nlr0On)Oi!e7q{;o}1!jL|mO*3=u@AEd|j zAF{%BY5;68wP(zmi+K{#-Uz>z9^rq@3gOHE2xA7Tgs?Zb@23a%y{y2U9st~EcjNPR z4MUIihPZK4>Y>aCqGmFbdF=oY<96wgEuJ)}WQ^b28|{wtXz$4i?U@14#z?DHoa|%j zIg}pU!K}cY9RS>(ZfS*!|9z9AMP<+EXdjTTPY?1!Rv^!11hTA}3LFIN9~ybcxl=eH6|=Pmj&X3ft?l!q)7qUj9vbY#+!9+xe`p^_diYIz6^eWrgiR zR@g4}uDAb|9^0Q~h3(0#u=SZI{at!&KgbH(Qv+a&8^h4vTLm8rZ}hId%{QkW!)!v- zOvW&;9{^(9*-M6K^{K zeOG$W@5lAyO*{z8Sy4uu=Qp;QhIf}AUDQQxzbsA1?!2AuRqG#;_Ru|Q( z=X$xzyw*OZ^qjdro6Vj+Q|Ni_kvGG?w>|gB+gtML(=EB%TzNt|hqZRd{fZX0%3M_! zp$UzayiT7H%^tDQ(3F{G10Z0NS12VNnrE&qRzzKggOKj3iB&7LrqryvKW4<@SxuUy zJl*H2mEC$>M5t@(nxsqGywqx%s~h4RUeS_!cDBG#J%?b`n*FCx zl4g~f(ooczp4Ie5%UoGeYEtWPS91nHU!^x^^oG&^3e_5y*I^&nyDpo}JT#*{l!1QO zy*nc}s+FFeOeS;NjF#Km!{}Q9XZfqT=(KfqqiO%L$O8!dz?ys&P$gdt(tyqx?bDAX83UonL z)Xrx0`8gzF_kvPt$h$NBLk=5VbS=-v?H60NMP(>wE5r&A*5jf9jiYw8%uD)*TIPzT zrnJnP<0Heu#9B!yiI!HI%WrPU59-M3ozMZ3HnTlJ9U-3z>;+QZwq7`jz0j<=E$`S5 znp7%Oq((#1gma;tFy(afo(|MU7Z;27b$t5+nco`1yub36TzI%8i}LR{Ov^UY>jRly z2xNLanu#{1Z$qZ_x>AZ#cRWAfXLXRNw#({{KvqMpjzwa((=?93K}UBtdl+;oVuZcX zA?#6`u*(7odwn2bmjx2Gmkfj=MKe~!3~?wE0x1i-JQim?bT##7AZb^5NOP-VtbN2` z?Hx92mj|-;WFTvo2eS4%$l8La)s)(t0QWo{jH;kC;07YqD{yZE1AC&`XegPvijskQ zT(z!b!2C9(8r+65N-gt}rldE-478ZuOTbCOC8?VGvKOZs*+f1WEyH_h8PnVV^WWO)7ofGrCV^zA?oRPM1e~esAX4i zM0K018lpBQx&9&C$0vca!t~_$m~dcX96gjqUEiI{sdcHQl(IFck<;rEct+L%0d%b< z6&u2=1X=`Iqt=AJLOyHx8t4qNo2A?&KIl$mCD>)!FdEKh|PwqYVgb<=`gJ7rCA?gU6naO6gh6311=4x znc6H(gBUqCgpy;~6tEzZ0iB#s07a2Buj44|Ei ziAC4TKyC>IIZGqP1=%}R5tXWbRMg;M6Wr^?gC@lOVtoC74aa~0PsmUsJWX3Qa*Wv7 zh>_m*Y_6_MES90*Ml!m3L+L8{={hcHida!D&`m^7%9ghjA6YNt$%6R+u0D<{JD0^( zTP~NX@nlr_TF97saVS#{`k6X(^29NT{JO+6aYgtzx{BwhywK3>nmB^&EEYlDEG|2v z$=Kl=#;Cb5J~g9YE^Tg-Y7kdM6g6m=ZEnJ-@n*SbYWRjRYHkXprs~%k%N*I{EU{JE z!Yh$wZfvfCjFX+4H%H@tE6MzYBVwS1o%kU}K3wYWr?Xl|O zG|bLpk>$(dQnWwW=<~FV>DabVe%ft#bEXXb@8tN2^K~h)aXRiP#mAA?hFdvd$`I@0 zSn}F%e=e7&q&D2!LdMkgP^Q{!_!vyl15N5#sg~4GaYgtz^4Rbq)C2@!O&mcU8}7~G zvXjt;^9^Iv+#E_x-9O02Dhl}WsEX*)7s($;%uzsDKC&|Wpes^-99C}K9BX!7W~s29 zZFyb#4ka6eLHL~~kXu4|Jmu#R8Jy5GHL>UE6yRg*N}e&okF{_#*%@3LCD|EVZuTYP z#%&T)tR10*+`|!aOqx^lhBZMEUzarQs<3H|%WX3Fyc`ww>8$UxOT?bIMDQiJjbSth zp)@o?Xn+R`)ZaT7J?jzJ5MOCNjbZ+P=Td8|1x$o6e}K;o4=vbQF1JhJk&B|x-*U!i zHk46($x@iMp7h2Qy{OJh+9GB|O6(H17wNUBGgEe%tx`@#PM_>^S^k{M#O}CEIG4L^ zV7POkxOtayoPp?_PBL@WUVraVO`TU@5|JsSPlc}alOm{rvuJicm!MuXWH#+^awO=irRHHE)PCPRW|LYNt1^Rf2S2b*ZMPvh)1PS?U;-^|ERTr%*=cBSbH zh3%bYwP!~QecAr_X4swNb1HUbGoc`#qBzs2f^JX6_6hym2y)K%+UKz`aNZq7sZ6tC zp-d_I7s<{*wl5uaprDTI3|hzGvx9{)b_N#54$iEn!%ox`J=2}RXm)6tKXrDn zVT_%@MYEIA$Qq0>vIe6^7O=AfBMS><> zc+u<(r^Sx{#g1cj9jiPj40m7$&!^6g`!Z)_k?ahmWp|*Uj=D3{!R}xgsk4KHGTqr3 z%8o>ijQxh#xe*U#Q@d+XQ9gz?J1+*AWgZf|cP=LfyRQpYIXp{~alM=40caaeH18S=#YKTZx0PhLBn8c(jJ-W|%*=|Fu-$rAbP(55y$;;oQ#*5Sr$ zgJRD-N9m7ifo=`uB+zRXM$)oCP>^qYwcF>B4i*T@;Kx=fUNaWTM%Hbi>;zjNxHd(8 z+8A=ijWe=aNgkF`8Ch1bjHf-JJcVgdO7>@@&H4ms5pR2(^BhB7%af88 zxprsoqS+Zp#|Ik84#XH^1E3x3Aw7s4JfE@;gbic5vv1Mt45r1-U<`H!JFtW2Q)g$; zVdwTxcET)BYR{%4+4iSX$G&hD$oqWiDb*oQ zz%sH;bY=6LFz2*_8+vp$(>#~)oOK7@40EfOu)WM;jfJv_OQj1(fIx}36p>UU*ELv6 z*gUTmUXJ}J5t*U@tRlM{pVnz&Q$$+r)6Wl~eu^59ad){IhEp{py3eLN4E*#sB*X!}%P1YKN!s z_n#c6?j!?=Dp`MQ4DU3}{c$IQayl??NYZIHZ zvq}*bdP=wg8;Hv(CAeqy4dwd!a|8KY-_U4&*UtQ|oId9p)~iZY0lx9!cyN!n6zt_G zNKhw3I2nrY2qGLC_1(rotD0*9y!=oO{_h*k^#Mv<&FvZhe7W}3<130HZ?5g1F1oQ; z=sHx%ARY>ZNGmnQj|j&n?mT*A^1$TS=&8x+smaB3Xn#Hjo!B=B;1A~WeFFg_TxaZQ42^&Z$ma7S1Ne7h>Yz`} zyI^sc$S<994!GFwXKJt%&0)kG2_Hhs)D)|cph?_+8M`N%YX=zF`~ ze#Ygl$hbojzEllm9OB2s^r>pw*G~8;oXerBU`yF5uTN}!k&5(jqt0{ic_M8pl(cx@JpIGO z0end(Kpc&xCe~nf06TSZJg`@L?EZ(_1Bcl@nzfF)$Yakcb#4ah;bWm3%n%3o1`_WD z&Ro|}b|gL>Y#kH(vdsF<>Ucw(Q7ZVgq1Sj_>6m?IUTH`e;dpT~@Xdh?E=92?mO3?! z5p+D1pq)t2MBlJISqtCqqMe7(Bw3gl%4t$DcS1NeF(yo8A&&r#LcXt0n1rVUAMBM9 zoaa!o-!3Sy2aWn7%4cmq5!&`$*!Ice(>sUruy8A%=O&y9gszh5)f*5{L)1#S!TipV zKy$lJ(N(7q4ut=>3uY@bz?~{$DDDnLf#FaJ;K)u3<7#o&K%RT4K!q1YmHMLIoT=Dr z-1Qt}rFcC$IPCd>LVW;dA#`}e3z)H62Un>AeAbUyJ?Om0U38A=P1*p4`kqkK#}M_Q zlblt;52|6^b@8mExwlPdbq>D}=Wm{6RhNV^#3c|Gq!~f1%;8tBa#i>9njD%FbG`8s|c-`=bIgEm0*ez$wEy~w&~DG?lCiAb-DtPv>HuVO5CQo{1YXh#-A?CJD8ol z=z1C0`$NH6%dYXe5n=qOdNe_&T0^x|hxO)tc^}dq_axV^-lHyVXAU7YZnt=>o1uLm z6zxgW-DyI5Y?1w2hPW`g{R{)q(kMur8>YhB!E3B`X?!p9$6UyZ8oAL;VCYYWqF3mq zD~!{fMzCl&E)`*71f1UeV_fIcEs#CMi5i5#o0oDyPjj%^%(}dx)|H|z^z90I0=h;K zAP$uK4Cq`nQ>=4(f!VCKS^W93xvV(@}|*ZKyT=NgU&%*T&1 ze?FI-10HhXm;+B)PCFTAGohT(+^#iMbiS!eY_13_ZbK>w;ONEWEcj|6KOCea*GARI zGu9!W%b4@MG^tZ4V;x$__$vDN>NZz{NhJS}MJ$!OdF0LIGX8-8 znDSQh?wky9({fr9zN^x53#xV&;$z{gnIZ`^X8_MSde9*{4zHw27J`CzZ1WO5nF)8C%raj0z9Z5MXW#{-*UPQU+eA?Z^}r^$YK(tL$dNC9I)#1BmLZ zbwk)_{{L&3)4z|z=--!O$8Ie@jDNNtUd?qiMR;91Q&Ed&3omJ^4UZcBRLGne!|-|0 zELqgv#v2`4T7VO!pb14)7bIFL!jwW_TuVYpfr%&LI=2@>?)Jp25qdG>sjw(&4bh$m z6mbSZ(rPMOUW74ni#SJ!0dFM%qEIRG5bsWaLz;*a!Kl_)zt!E{=GvKN1%ihbD)4bN zr=RYS?Zz_&hY>5Zz9KXvYwh*tKKjccH>z zw7iYxwz!I9hXjP^9Od`mqB@!6*Q1mf6Sekc6# zgz6jf>Tse#W2vn3jrBItaA&+aBMp29XQcU;ZP7KI#yB<(Zmo>WRdzJP^2ZPq1|>9m z92F?F4lj4`N=~Rmwjh`lg4B2|Q#V}oR$?hU@-trbW{c1_Qr7ZY;Eyu^9*Q*pmePKB z24wlG*i^jHm*34b(>V+yV{4p|0S)E`#F*IM5SrMz3zBa=Wp>X=;7E($%D3PL%#&gC;%Xg!thH(aU!!&w ze)iZun_2~at#7Es0!IJGvruCfx-92g=B8OyZPdVB<4zu4Zm!42j9Rl=I0qh96|Ati z0iwewb$H)G8y@IT+mIJ zj|^et+0QO>qjXLIy5Mz4Q+JPcm86;G98|Z#4s{GUG)b(&k#2l%A|a@jVQx@r^=1QJ z1;LB}kO~N!u;O4R?6BZHQJ_#e1sPtBRU{2)#%2~Fn*F6}vk_dvb-pvcBFekFmMt?k zSmg%P?>*tW*t`teuLDUCEROGB?0vgIaJ8K_Q@1>r2gQ9agQ{dIzM^0n5u3 zD_G#AbOe~K>Dcw|p}HGx3iArZYsIn(5XJ;o zA>(U0tCg$Sc%Y$Tt^+)lJsh*o;wMp&szOF%NVw7FdEFUkjT+ zI6px{H{!Sg#i`AK9#)hpuy*HVTg?r1sa|kA3dFMxkIabBd>k95v*H>K>)HBwh$ma4 z$)=WhCFZ0CK+Xa<>Ci*)WCPn}NOj@H{2)-e0jBnR#p4mTcxO&8dQQ6q>MYK{AcEZ; zT8Gz|*MVAA;i1hj1JZ4^|pN9wga|KzMlPmBKcd)>P)-7|L4jV=^tfw#? zh`OA9(?b~yELax~adnZ}>xwcwI~Sn`t>FeN6NR|lM6(W6;C?4GrC^(Z$3TJ9B7QL8 z+J#MMDPUs{Up@*x50#15V8neu&bB~psxz>ig5Ed}O^_uBto@jIWf5|nEl5>SsT5#u z7MLJ|1pu^+`g6w@e;`%Te^A$e_rh5K!zv zu^Yu96bDh9L~#N|35AH_3b;p>H=_6~{`?CRKSS|j5KXfiwc3hNiTm_CXUIP_5 zA{wNG1}UIH%4d+`8KiUuDV#ydW{{#8q+|vum_f>AkYX96R0b)OLCR#1A{nGa1}Tt1 z%43k?7^E}?DU3nNVvwR3q$CC@h(XF>kYX656b31TLCRo|A{e9u1}T6+oo`Ub8`S9r zb+|#DZBR!W)X4^QutA+`P{$h7sRnhZL7iz(M?OZKXix_lP5El>07LYB`B(DK zEi1Gf2Qyir4VWS;bPcA+3T?v_S)n0JkrmpHDY8P-m?A6m0H(+aDVQQFG><8=LXTpK ztkC0_A}jQEOpz7(0H(+aeF9Ttg}#U>vO-_M6j`BfV~VWM4>3hn=$DuxE7XOo(MONqxrpO9aF-2DB0;b3cy$Vxgg<6;*EA%c* zkrnz7rpO9?3R7f-p2ieep|4?ztk83qA}jP0Opz7(HKxc4b>pxmE3_F?WQBS$MOG+} zDY8O)Fhy4A5T?iqox~Jbp%SLZ3cUnVWQAUeDY8Ppk14W3Z^9H=q4!{ltk6d>MONsu zm?A6mB}|bO`Ua-R3Vjb#WQG0%Q)Gpfp{*b*v>sDrg@a# zDojJuiz9gUTRny^PvQ6*z@d0W>liq(@Dc^wVSD==t3u}yfIo~gv>WvE@KUbI4m%I1 z>`jzs+RB>ghRLbYC{T91p*5iuvk(k&X~Z15Mt>w(xrq&W$V*;O=mM{1z_JVE-{b z*l(r<_WA^1Z;t@$M!SIrR$O5o4f#LgL;iVMkTVG&-_j15c3X)?w{cbMp}7IFE^26o zY3~gQ(Dk*WvsV05*yd=Ax5US|EiH^&5?~yS#OU7$B^vWYe9ZgP!rYqxbI?GgFL|tR z+%VC^ZF>?8xey=n18G6V-ANZ~i1$QyGq*)aG~V;^@y@4(_r~<`f-l9kCW*%ThWL0N zPYdr&3Gm(#-M_&bj6_3!GCuSVqy>Fz0_c0Ap<7*TZ4wd<_^;vv{$g5yw=hz9#N@xeZw7TEqJ0t*qnqrrYR zKG^5d0z0rYU~wmhXt4hqAMCHw0z0^5U^}Ss)oWtARGT4dDlXN~l7StH?%9F(VDo8# z9bPi9!_i>xj1TruT3|<(2rO(^5Dj)NKG;%PV0R_}ds~2SVZSTk;)!&$$1jf$_oZpU z-L-^pI~b|A#)tc+wBYVe0C#7M-t91IKNcVAN7I6OYXYb-d??(;AbQmPeSENAN(=05 z3Bbk~wG^vA8t%Wuhx@&>;O=ehAZsd)#oi?YI}qKo*To0>!nDBd zTQabN(O^g7gB?r@?ClA_#v8RA9|!J=4|ggpxT6W+#v8RAJmj-mvn~Sl<~R>)X=8I-UUQ&Fu~phEk0N_sRI+ zKAsl1i3H#R>``!#`)IiT5FhTB(}H^-0o;A7^+Bc(?}y*obCV`)J>oB(RTiarW|9*s_okFJsyx+4kD4Yn&OIzLt%8Vo8M z4fC=1FkhJ#%sUgn%tgSAM)*X0gnyJ4!l?uZ1FQ|KV2{T3>G;_GJS}X~39tq9o)alN z8sW3?5k8X^!lMZg1~{vTFdE#?;)DBfTHx+V050D?`0Q1~5D`2Y;@Y*bU70nIH5FIp zSOSPat8{QK9xW(089x$@_Qv>Vx1@#kcmlKm+KNHHqrvTq5AL?Kz@10{uD@Md`Jmv@ zAn%J0@}9In-klOiE(UlsNIgEtdRidwNdPk7mI#r+qp`gvKDJkkL zaP6&tF}|ZAUb-%}53>%krsBgqkN{%Px0eJ_>(GbW;{&`YEr6#J01WuD%NO<+R_s}k zyCDX5bf=ER$9#KQm>*1lS!nlW?7-X6_)f>icPcG>g*5SXSR1hrA73Lad}q?ZXGigl z?!VW?$M@Q_@QDfV1uT&EjY&`V>}b#*j1T(#X@QCjmwseMq^d?jAlk7$+nC<8rh@AjI5C#7@Jm2cTIPd zdb*mfZjEH@gv0?_P+4A`Y+kUid2z^rT}ar3ump(X6Aomvn_aRH2>8S&B-xOJBn#o4 z?DzlmuC7fWmRefPiref{^pZy5NgomX9b75!&itJf<^?R-uum1ddq_msgiugT?dPn{_YzVwEl#lK&8=?(AhRMtM#sjN3vpO(+lR}*5t zu|v5s*3>0rq1mZy)E6XUP--?C%0jCN2$bbjN=ZldjJ3t8r0cke>w%iIWL~W+wd(GV z1*v$pAun>A_2-wW2lTo`P}kKPvMx8y$(@$5wkeek;;ny0QojY(> z&l6a!X8kFYT4g(^s@w$f zZ^pk{@$WYLyB$=mS=1U!66KXX)~W2M+}Wz!RT-)5tPE9l9b1DJ>~4j;z_@0i(UI)e zP?BL!l2w&gR#pM^-KJat*~5gaSdoioMWv|Ko)MHKsVoCyE|vg3RC+_roEXeA(E!r-tyF*!xNS%tr^-k72430ap zyUoX-^C6qCpLPg)&LZr(P{Q6BO4xOwgdJoBp~&%!6)8d*%EVC0qLQcLY>-oPd4`g< z-A9`HDVwzqJFLCOV(t1+);<`@+V!EVy`ETGmKrssRu<9b=}@Yo(nJFy*Q;pTpkPn8 znoUJ0R}}$m+)`Z;pnjWj4b70C)P&cyWW6Z~b{i)>jmAk9bgiZdB?%D_vm`fkO0^^l zHLZq!)L+-g7D6 zrl$1^=-<4;#!EF49hNUTEt%v6y5rQz!jjyS&_GL<1bW9j*dP|hbEAHxW87d9AU5i# z%I3#BWH`@vH0n-f+)}K3&3Nz<81ZGyX6Lp@cFI0>jyR=Tn69CVdm$^1_69h5xxwyKJaovVW_fuzCzVla%G$Y{f{LS{ z_m{^YLTXi;`9%flCJ#-d;l9?mP%v*)tL1XR83GlgR%C1b5mMFb}33yD@DX6g(B{m4AUta94*w4JseoK zbClXwf%e%<^!!~L|sE}2pM0* zXxjXuhY>3pGqR&Qnky^Qy)qP@Nt>=6k#v=Ubj`~RMXD-Kb0ebn%a;Ew0kU51B@6Qb zp6_|MvSOKBb;WY2I@}*sfgIXQ-5JT$YlBQ3eeCopnfrBp)8u(YfTQhRj@0F5!}^kk zAS;SVkUxsc&Y}L;@n+1X=C1VA9D=&Exan7dJgQ{&Rb7(WQE0U=$9X^FAdeEeum23SfD$gqd9Qky3 z5nlp9^d%2LJ{|6l;v+nQjIN8w7DVRjG1u`H)w**NM zwa{5KE1pZx4lQCf?O6Y0b!XOQZzPhvSyyU=DRb5ofBTsX37ZMA)sQ_OYfXLF6Rp-` zn%$=9TKo;nj7+2@gHm=2&1fWS|1_&LJ6agc?MbhO-AO*@!_I6bUK9`%XBt)1t*O{i zagV14InQ@k&nYu_?$)AArdjEwwovTpk)5&JXg2KNMTzW;iKDUX&^t0`hhA#4Gu9hB zG_#%!J8@I=w(N|@v%}N;nX^L~v)LK%nVpPk)_97VH6CBHz|IQPEPAQU&P31bOk^cH z6NxozT%3rjSzw2rXRLSVr8YZzduC^ER_p{9b{wtiXytKnZvs2?Jacy3#hl3=*_p^n z@8Cs=vNMsOcjz6NvqLYnWoKU`J2H1ZF zu8Zb-ye!S6?d8OEIn3AEJnip;r;Ic-WhB`9aaeHb8S&)p|2Q#xJo)u>W<0r?`amR4 zPld`;Mw%$7hqiXfkyi^jPaSUjIwKQP96Q?(Lnz3sT0Ffzvw+) zmNL>n-ZAQ-NS>lJP)4J$Nep)UbEi%n@^BPC3Zr*;`N>EFxudWLBH4MGdOq_fXATRG zJT5%g!t5vQC-JPClED@kXWJHJ%XKoigvo9*->O$Nsif!kjO-cBk4)yt&`e~bZ&-wp zS#M)eDi&cYT;mNOWcI6wN~w-GA!cM-Ic4j-Sax#Zse1fWXq^{)Pu+^QV0WumFu%6O znu=tTOr;CQL7>cBN<=D=>nf}j%${Egucva9nM_FptHiE{PxCReDG{yK<10hx;YdR7 zAVLq7gA9628UwX&H9hkHwST+FUgi}Q-<#|Lo{r4Vn<+n4tyYHp_BpL6EmUF14wHC@ zw!e(M?@ecPNySwl>6QxSIzz#lDK99s0u>L{nH_Z)-`_Vr834VFvLrfLg5u#Ud1&Am z-I+!Vmzc9r#H<7Wo9iQyT)&05wvfm|wN)!iHUQYIUP-!dvU4SJu599wD-YvNq^_)A zdD0(@B%Mtmrf0`S_lx7BdqmGPH)$@psVh0HQHBL^Rl$;Do^HVGIgj|`BO?X+vwuJT z8bzy+AK8Z+e2pHwkxv*ugtDQ_G~$QD3Y?H zB&UZ@h*LAuexWQ&Pd|-qZBlD-Q7OXEQzi>+5SLd*YYTUQ=2UvB$^5gL}uN;Gma+KE7!qoQXtuoDfbO3N&MppDMQiZ)75m|3~-cM}bn; z^83etFW+rFzN#pB)wT80MK_fSUBV}Ah({wKvZco1~$BlG-WV0FFwiOXHl=8jbON@djMkTw(ZR@JWEPP7%y<_XvvIT;!G*ZAqyiEjC5EBWh#|C&I#6 z92pO@(O88?9_-dn7xi9SRC@f1UHWs8K-l&~c@W!>s0O)k%)V~-u091jmSA5)TmGCK zezXf`WGoEVdNX>UWa(zkDsC5JqTOH8r){t&Bf;`+BLbT>&efDRPXXG$R{-6^k?3Ac zGC5}&pP{Wt#%NmvjbrqWi39AU6X8dr)sSkK9iT#;IUHK5gI4*YdGKJi?&i$9F7ni~ zO3B%EXqV;LQ#qxD=(HSW3#8P0)NKLHmfH>CwH`WG(jZlAecak{o7+@(sC|KP{e`o)V{X zh$Et-FfuwS&R~=ffW2DAa}P@Uw+jmTpjq$X{dV3@N9KJ$<$Y#;Zr|P!7;cS>cqW_~ zgs!pb)thjrAvH?*@sWL#q3U*{qHE4eJRpMiT`)Us1)TID8^t4$D99a30Ug;n@vv6h zKQ`i7RN$8vC5_9X-ddJQQ2RQjt=|CSfM^fvk*Flcp)=(8<9#Av8|t?`q26B zyXYL%+iwPJ)Q?7@K1HaHKIYL%w4oYy*Tu7P!)-Q^>pblc_corYrpuxVzXam4ydX-| zGVOY;Ea?G>T%|61)sgkn1?lLaOaHJ9_pwO0+^k~9nyYnEf7R?OIC#zN8GfAuY)wzW zT0dQ=&SLbXebk2ecqB}#R6U*U)L-x4foZN zaF3Zne5{XB^}{_Y2b&Q9JL@k}`so&_vu&$Sg6WGkz$YRBvTi#1m}i*T=jU_W=l+|C?AYTWMY>DxBiCnM25MzTA{XixQ6zAF5}=++np-qP4foa?5-U%>0kd^NnK z?7ing?y2U+XTe7QR3v(Z8(r}*w=|+j!@OL?#0WaQ4@`LqpPN8?6el&{2Jf7l4;#(F z+RRMe)apu67f1Jpjeu@eMEHSn$AC_%g<{dQdHfRZE<WWF>W9w?r-mIdRvI7GoITur;0ALblILOg2rvi zB@rFHw48;f7Dx7m3CS&SU-UAT5YJ`I*)PrF6v z!h$-E2mGqXww@=Wd_ru2H`3gLrU^ zxT1M4MHYF~kI{-Ac8l-RqLP_S-B63nkAzUfTz2WuUT#TGJu83?0C94Aw2( zN5%~%Xxbs>$v3yYTOuCXuEEr2R$p~hn0GLn9MG;ljX0HU>N5R-3(v|4G#;?zh7w81bgeAP*Q{=>@v#qHV02?rWaC8 zIErDOAPb8M`IuuDbgh~s@T;GHFCH{d(iqjlzZ$LW3#cA&dAD1@Fxea@YXZ4))ipt> z3K%E~@LpHfFsUI759gNUYE?X2)0S(tcQV%u7mrzThALZ(Re<9-R8tLR4TZ4=8-%fv z?*)EqENW8}w-`4?GUI;br}-<I3TSl^m^`UJg-kj=)NW5? z-R9`l*wS&o^8P+}x;p2kH*+aFZs&puf_Q!l@$3lxdQWxmIf&atI*0|eFg=x^chm;n zX{_VeqFi(oP0jOi>yvODan8e`r3}>9d+r&+5vm^o7W%7J<+u>85t1W1+TjoJft1?e zbBOBK4x5qdw|aBpYw@`qfEJI4L*a*AhBHbMyuKzqDqJmJ~{1 zep+wU>skYIP>KK_m*-^oyac85vZZJhd7Bwpkj za*MG&f_pb-f5SQRE6yQfHD}LQr8m*muSEzmpv8{t^?Xe={jcdu+tk0npHNS%R>#Iz zgVbowoo)loyLy^mxJ{?$OYjTYQNN9s8EbKae9piZG=13EfKWaU(}JSX?6mnYxh};e zCAGY48k_wBMOs4rbIPKljNm#~rLtiC@6~H&0rjHS=v8(_=C*yUh zOOci|Pu=s^IPw$=e`8hDO+26_MBcfc6CNh#va$eoh6pk2Joo6S=?5N|J~andxUhww>_Q=-9}xk7 zh193m)SCtz;r#!d9H;5H8Jr|F9sWl31_8I`B>guM+pe5C6=Alu;L7@tVJdTx z+e1+{7cu=+RQ)V!jcm8}b_%N%GE~){X6<5iu@7G|H$MElp2gM`+(t6xgX65G}Q8j-TdK zah*avn4(av(ZW4cO1{y;O{`G{uv+RHzL=dE>Pt7v4Xsu8s2X?BgHt7{D~V4j8S96K*?r$IjtxM=>Fb26ZzM9z=5&B#xsB(W@hGX{ zTBDBV5H+c``s+BH2di&Lk?Kb%f7{g8b5!+5@yB0SeyGtX=I4;-U$Agq&_H9J%t#-lDu=>pusVuJlfuknE+%u1}b!z3D zFvGS$WC)9a83YcUyPe!jVitxvT~$qx;cTlZn`0hy)%!{6G&bAUBva*=HFyqIZ$PRf z)_TMLGVhTc&$#D3Ji~f*sNx*SQMt%P9@UN*d_+v;o%Xpf75h+__=7dngTw>m9>>0z z=kHK2J%^jt`6644s|8oU=z+fA$ywA#wvzbCGca^xeDmUV|+}D`<_=dr1I@J_-{Vc(wv06@% z$`bApM@_8Ud!s8iCR)lk=m8TZl2B|ZG_if*%NrBhT68t8sUrLe6s^nkbsEL()>5B=7cP!J>;qY`?TGNRpMz`C;&d^XBKvb4W)P(=aHE=6wLae zFMxHGns5Ni`3KHmoqzust6AJ)EUf%z-D3G67Yk-12aqlKeAnP8dZ4(LMpHN|gU>Tu zqob>X@u{&1<_-4<2m}I!2}6FZ2xFc#voNuve(1njh{!gTzU*BD2n;9H8xYMgaI_~N6g01dkzDxnTl@zyX$3I%7TOBD zg}Ap`0mO0DjltZfY6aRU@cM-t4!hMirbuP6^y3^gu@yL*q>gp$?38Oy^BUr%H39CT zS7C)e>Xyj+xkS`8_~ReQr_=oERwRtl`tW=e)cW+fIIaJm@jO!Nn~7DylUI-S?oZW! z4lhfo>VKc}?iXHlFK2kAHN8a}6q#oM-YmNKYVNNg@ZhfgatMkDJ(9A9Txs<`ur5UX ze+w`})jvJB9O{32Fju7h-CXrjZ16a*{$sDj7XN`uSO4pVhhbtLK94sB?3VstO_5x6 zGeN9`oPq4=;MvAGqllW+;Q7THe&p3$id0qua5qOyYydur_0*&DbF;!@FoHTJUw}zN zQy4n>*s=LtZvTDq4A14koQu!D#$gp?`~VX#^!ja!DxUiDE~uJz6TS&S?j@2TR#VCe zbLE8L-ab^K|$v+O`;P``0FI&d|veq+FcG68I{Yg1=@5rO;9WUrK@8FXlM6LH$CCR2E;K=cpl#(~y4=_s_X$n&ZR3 ztQNy+4Y*yg=b|~5w{=3>VQy0Ag(;jg!82G*rLGO4K`|}RY$M})ZK?`nrG4-W3<@=B zn$Ag8O2{peWd(%SdOtZx3tZmMdMu1!t*zBcFon_t9nr`L)AJP9WCtZsj@-uVkrhGf zO2GG60@Sa;aKs)B8Lx;Z!!#54x+jIYdc7-UHizyv*5GNd3pAwu6JC(k$nF}vA+Fjv zMt15dtmGJ8le+7WG`&fkx}MT+@)duGDIE^oP>DIT=v$1}U4H3s8XvRx;+2fQR#Mi# zZC16ndWz6^^CPg8cdVF96IO_%y>5H*k>}q@kKrGZI%0L@`Hw+*sp5GIbnT+wEkL$) z4RTHf_^{zMYY$1bPvnR09UkTnTquyiZ+6^jg>`E1vOX+1qDz<_(n^BBjS zv;PB^5wn8l;cUJ2cp2Wc+_lyHh=T(V|Ex!FMP#(6aPjXcC4E{KZ z_F4-@-8!Di)U4iWsXk4q&Gx%1wv+j15Gkl&gM#KS1bBy6&vTCY&iod41B`t>I%U*f z0Pk?K9}?dI@UET#z=6B^wo3!>a^5IwpMq|l4Gp)H4U9BH3gZ1PlDLEpq!08A3BK0V zU%50$n@vde7V8igpLAgaBRg6DbkA9bBXso>y=FaHtr=@fwa_uH7P<9(f^zK`vQy17 zo3Q9tcoqjDJC;6CHLmpd>088laQyT&0v@)eLk}*;_-XB6AXhYga&r}50DheVfAH!{ z$aY*uuB+JMKj0fb#Yg=cbnK7;)50%0sQma!3l z&cF4{iBsz1W@^{KdA70(w&&_L+;^IQ;vpEvnJcB1r5tuLSOX1gHIivllhnkz^Fj+v zwq;0&4(ISNTOC-$C-3I^x}aqs9ZABEH43hMV+qvqJ>1iQjZBu;`mUTdU)JeDkh!v^omYWFlIq zNE-Zg0e;)nJVT6U!`j2(%8<3C*0+bjxZUi2k~=+j6N1QdqqxUr{Lb8>vBQi^5Z%Z^ z!0O-es6ttf+_eBp{p9_I;d^_JXpn3PWy`V;xy3+2vAff~BykF%m7<`nJqHa$C9Uc< zDMx_B+wU@-eUNq&PFXY9Oc|_KLvy{G>{_I9S%F&xNs!RTu1d-h?Ip%04y1&wEA2Qg zVe@zm{cbXtp$Ff!JpZ^G=YqoA$}0l{|e&(1iIz zyg+wyZXOHA*dmJ=R2&n-E4I_~_9lI@5XT(14pUIuX56t5|5uV5r^!2!qCown1fR0% z(acNfN)Jn$!~=SPzFj3H+zcI-(u2z}EPYcjS2Qeja}}?6{KYnploDQ-R3&|tEB*tP zX1kN$+E=TOrm)#)Vdis5YDAcv{Cm9JZVEkdU6u4p#8EoSllP{;?`I7@cGY*MNM*71 za~w5MCA|-(8xm_JUiLCO%G`T~njt=f6W}8!JW39Lu#qh2ZNrTt+{@PmiVx=+gLCBL zrwk)>s4iZSXu`*cf}S^9tQ3_xOx)qu14C^LO7vp2MJNB5ON8c2522?HXLUS8p;7bx zzO(9<(5JYBLKoknkeE|?U-zussGr4KEI}A_leu5{1OAG?d)M3Y+h@4+{BQ8KSTW0Q z{}V}jU49#EI-(!4_6EPmDiO!C14lC~Sx5Do#S&k|{k4Je^oazLXe8ZRZMf2^f5XNQ z)&G6K3|0N~;Bu(`TZ6eG)$iu2mtuqWW%WC~7F+xWe5yY_sx>2Nc50)ehRsO6Bc#u) z-i@14laTgMyt31rgv9K7HLWZ zp;Qy*PTo6BC*CMpVS08nx98xQ!L*5mQ~tE0y`(jLzmeBFVFuGE4Rh+~f-p3HXqPWX zV+YM0M(S%Y=WNfnS__N*Ww-;Ty+c2kLsnSkAfKd;eQI5G?)p@>eHZP?ooPPrD)q;x z76cmi-jw=jydkd76Qk56B<)qHZ-OT-mKM1NX$jHmaI>sFoRFvPiBw8;B1I}|74|4c z^%wvCbj2ScwIQYdWB5RK={t9QrElLw>F-D?eSF<5{EPU=r4|005-5u){C6SgB^5rO z!X5BU1+UZUa|wCsE__P$qbX9w6#jh5!tY(}yw%%B`*q~9TP&QrKC!UxLM-k}6pOfg zxdQWXeE!k|=C=}PjuDs_ko1xShL4mE2n-x`s~=6sQ@6lSst>0~Ie zA(?A;m^2F;tj4Y*IV(t);Y$uj*QemfKW-{P@NBv+(<;%O$mFH267~BI?<$e?j?1x1 zbb~=(N(~NK;g}W6N9U9pjG@R{iCjvXQ;<^? z(1li>%o}*Sgf*8-v$i{JgC-4TOiR*vnC~_#g(^%UniV+x7EXEg6v7pIjr@sdFe%5; z=P+%;2eH_M;$Y))*CL~eb~HE0cIu{8h5JRk#I(u4f?u_&EyK5FRhAa*P8HdnW9bhK zDl!Y(Np@pKRvBzDjqh=f0_Gp^Y63$my{OSSe(2W#zTVQvBeY(GYh&tWxf8?-E6<)Q zU|(SY^V?!!d9#aLyX$jp;EDUDukoAW)x4z|>7zUg`{YWNnVYpRkno}(Q=~TBnj1kGfo%Egcz?8{k5OGz<-GgBEHOes{L2o7N&-CDO zOg$e6=8C4C-CXrjY;~l(5wDAzfurWnS8VYguv*IBU}5NM)p5IT)v*AFlr4C;4&7Jy zD3yiTr@Y=>uF>r@Znb)x%O+knEq!u21s{Ile;rtSI7KRp#aWJ;)btr2Va;t?N3eMw z`>(RB9bf@M1|w(fGF_t;j517vUl0Zbkcl^X|aU`JbM&d!*dsc0J%{9rDDRdZ<( zR)6qROs=!AxOsxCDbV!5+85r%>F7I!ta%moyoL4)TSV%#bm`f`NWL}Uq4}Ivbp7o8 z-f4gdu{A3s_|~(=qt~lvasrQOpzeUsH+AyMmE!E)~UCadkcm`>Xk{zbPb_!>*9 zzbWW#&FZBDp^2G={sxj>(k%3N$ePu82=a>wd7@U_FaDJ3%PCS>v(R5mh#EHwO`rOF zLVC)eH47aSSGRTyMQk$QwqK+Hm)7X0--UF04oa~0B?M-GISH1KISGz4;OW|~neCJZ zCoHIwum*j$quzEcrsBVW@9XM*^A2UkyyKnB9#VDQc&?O2@rj#pQVh234B2P8`Lh~z zW=qJK4%kfK+fcC9&et&ItAbBD`J(Tecf9$svts)N!jWNoOlrrRjz?GcYGX6b3&q(G z&4Tr4*4Sv@;d5|ijdgIELuan&9b*d)oxz@=s-9cK(PPvz=@@Gsm8$4vI7|LKWj$-G zH~o5|W7EM8xMno{f8xgm^Gn#DTRV%NgVxVhql#afnp&~2fb+NMsovqfs>6XRB2}HA1I8BlyaKLpKvPS%BMle>C3&G$#``u~XVxG_ zLzb3sXFZ)JE)yaguCrOG)mu%>5s-gV9NlINw3>_JzK(H=|3N`+G_*#cf+ORr*g48a zy(z_J$GBE&HN)RLZRp5b-(yD}Gc%-rn zwoCYZje_i5kNqiHqf{u#bSx7-L#|C{jWy`eVqXxkp_B^P#ImTIhdU!8ytR-|Hm2dEh5L|!K3$NunV78`H(Yv?my4)&hh4V`!OV`0`B98AXcvG^3 z;7F8nIQz$x&1(yoYN2yMEOmi|YwgOw^~Bf+Jap<1`p-BC971Eo#9?by;CrfLY@;iD z2RnT!4hooFSVDPe|w%s#Mmz6l%Z{SUYjuPGfUjuDi#y5FQ+CRfo7E`&2QE zm)TBEaa+&TFTljS#z(Mrj2kH?X8I%A!wO;Cj)jpVWz^`nU; z)&_i=v*2t&rXX5aizBhYb}k)9?hI9qRCZUMsLWKBE0xMSE6-IvSb0z7h04b&pRatT zWo-4Oq0@Xgk#Wre_Lv_r$XiVDtVq*}oyrr&#ujY{b8ajf>-n@$^YJ?oTaj^isQL4Q z##T#z;UI0ePb*^`w%Mt?(0vR(@Fdo;rxBVs$MA+bOt#f;%a=oq|ycaugh-;2sK& zQScB2k5ljn1u_K-6f`K%DELtdo}s{?;35S-OTkZ5@GBJjA_c!r!GEOSQxtrHg8xFn zXDRp+1z(`xFDdwQ3cg9fKTvS>H3Q82Iy!8H_YrQli$ZlmB93U*Vli-P?W?4{rc1ydBvQ*e@k zGZZ{U!4d^31y573Ou?He_z4O+6ug6i_fha33O+=^uTk)E3Vw@%&rt9J1%FJzf2ZIj z3SOk(8x;Hv1wWwRyA-Ua?$H_wwo!0B1v@AZC>WtYq~JaZ4p4BEf(I#hjDph?lqirW z;0_q~xpq-k?3EOZqlai7mNiCKBNS*bpH!<9{0ns)e?S3uD!Cu|3QBe}f|jwK>H)7A zaQ%O&UHSWV<%eyq25qhaZ5IDFi+-EMzRe=vW^r$`sJB_n+brU37VkETcALez%_7}q zac;9Hw^@waEW<-!_YGo5i-xBHLzhZL_GhSxnn3qHPw>Hj8GP#j?#J*=BKUvnaM% z4BIS%Z5F>ai(Z?>uFWFXW^rq?sI^(l+ALyi7OysoR-47D%_7xiacZ+DwONeXEJAG- zpEiq5o5iNhBGYDZX|t%bSxnk2B5f9rHj74^#iGq3(PnXIvnaG#4B9LLZ7%*c7kyi$ zV!y~m-d3r&FLF^|GIW zpexpDe?nKR)&7F6SgZYSx?-(%6)7dwYMbbawc5++inZEKx?-(1PFJke4$&2BwOP7i zt@awaVy(7JSFF|e>a+Coa}=;v<15x` z>BL^|d*gchtDI=7@BJ9&aEdAO{uAZ4a zGDpK<|1^gBJNzc~llWs#gjyZ}ypxa)E4hcTI^Uq)zF_vng*(V6qqr!S?hq7Rz*Ga) z?Cmo%J-*Yvk{;ZbdIhI`5h)yK6`UDNcZ&djTeL%ju8*;TQN(lvecY1U~ zS)seV4|Jp5=uD?}IZQ6e@g+E&9^(U9VZ5UcjE7<|?qJg*OrkVsSRgmzF&ENfeljb} zJNm#JR#DmKBA4q9Or9y&`)@kU)8ipuNDuj3R*>)P1M+?G#jGx4nwZz<6Y#z(J>Iux zh4-%P@uFLW8Ds_=U%nqqkM{#v;eBNvcpr){U$Yuph*Q?)-%k(y_p*Y%vk&M81G>1Nc4hz!@?v zNyZoROnS6OvO>GN548Iu(Kh5VycC%uhIp*S^jObig;neWYjg|c#flCmiFUey;j`(X zKb;lyTp!T)Miw&}*K6>}oG={xx9Nd)vI3g#1Lyxb+iwxaq~I$0yI1z#A~dtr3d>`R$%w65ZJNYXgt_|Ne}i1 zS%Do}8L;Ab64;xzrtV&CL)1*VSK})NHbIQX(t{nz3hcy+ft`pK;}hw@9?c5u-W3D8 zHy&&`J=juKU?*1y>_k$X{jv05eV7GRU$uDU*T$KonP&7@;-UmtMOm2ES8Ef818392tz-rFP#7o8YR#2zcCm!+I8&db1RwHUA{iX-|KpbLeBiF`8_lx7Bd&Gnpw%gNVd_`6m zAL;|+?(R}8Es5Cn5?_S(q=&aJD|j<~z}wXguP7xb*GJN0JCzl-qkUitX){Yzk$nDE z$;E|4PB4`CV${+@t!4%FSRYVBEc&ptE+zB`E~ZEKrmWB%?*rX?v`(j)xstPsxjfiOhvz`iLS+ZWPf`+Qc| z=K8=EQhG{RJC`GAjYs$o=@I^2RtQh_fiR@kN(ke@ZMZRYr)C|ZX40v7xDRk6-IdQW zABIAWhj>?dh<9WK@l+oW!_0MPQl3<)XI6eP9_{_<(cYUC+W9`vhDfVCx;J6Y=hf-K zJ(?A`(|v&3(=DxvuI<}9GAiyF8A$-Crw3Wj3gjahfhiOD$3_ySDt|IP$hTw# z^3gs(hBS%la)QG7)%4hYDJyJ`WreL7uUa4Jx zjW4%vrN{P36mi<63TEYJ-}CG1@Ngp0ETSwQp8eDk>T=5W2CU3XwgBj;zBW@P@hVV`H8GB zzqSv|Vs~!_j)o>DM)$=F?Q(j2&8+Yhvc#8QB=L^)`2I~+_|9a5553W`(Y*=yel0z| z_h*Gq>H}YhrF5W9!j-OQsv%iVsFW|H2mQNQfnLZ4bg3aNHpL4qUAA=*Rv(*kNyLuC z_?r4+deDEG73g9gphFgyY10mrt?7)em1dL2chiIYr%MBCdYZGg{FnQ{8`7LEDmZLW zloRHxuHT-zOLQHgUP711hq2ZN#*o$pPSxb|;z+#Ais>N^X9%&M9e0rs6ISCMOb_vJ zh7kMNeH95Y!9Gh$5An4bLhNTlPRPE=Fy$jAx!`zxddTN9g#5d1-IR?Dj!PPLW4Hka zvs7Cpa+_Et*Ovn3aP+*=%$oo$*O-=e%{BC9XJ{7xH9K$WNXB4^{DWG4G)>Rrx&H%t C$*_3< literal 0 HcmV?d00001 diff --git a/it/doctrees/entity_statement.doctree b/it/doctrees/entity_statement.doctree new file mode 100644 index 0000000000000000000000000000000000000000..9325969ad1ab28934d6658927f24d3261ebcaf87 GIT binary patch literal 140196 zcmeIb3A`LtnKqt~^(G-9KoTG zvs4>>-RP=2Mqe8xuR#QA@-!=Fqj}9)*`i_FxQX90O2#n%H9J?Y$Ug>*?4hbT z$kKEj87^+LD+Y-=yHYi6vwGMZtv6@Yj3LS~nxB(joS)Y0%D6D$ubB=y%W&83C1J}Y z@lPga4q7FvW|d2JPt~rCHm4V@k~z9_MtuN6FR|+bcFn2*!g9%z)1J&M5a~$}l;i)&*4EC5mUDy10;uw*0{o@; z?+pBR7XCXMP|X}HSBDL1D^)g{U!FgwoVfX$K8z~WfD zMw`d2UN_pDRgLq$(fsplLUk7uutOj_CrlCfn?kj~jJHJ# zdr1rRl5BaT9;#+8Q#5Nevzk8ARtdXZHD4M5y}CFp+~;}QABy~nHpmAnAI)c8Fq${= zx4B5?1=7cdB0Um{^zlR!El6KNNZS=Fr!seXz9xw3TF0~{suzT!+9tOah+S^eJP59J zZFjK`LAN3Yu-ChQy+iNx_hmbYvP9mVw&x+4F$s?O{P_~J_W)`j3ITihvN8G?>c;#NcZ*OMUtQm;c#+Wczz8~Na zC~JHA{T$Rh*})@St-!N+WgcwY=gX@Vw=q(w`JXng90NeUhB;uJ=>^M&&X5nC?XI#j z+e+y19!(0P^#P1db20MR7lsO`(u0(nYPn36aZ?GqN)E5}qYhqYwZ$t>cwKX4dh=!p z&B(||k1+%%8Y&;|vEWA*I)l9!QyBGPt#{A@`}BgC%D7*y9?kF@#p2LV#vKu5jCw6! zu3`vc+VHYUZZH7YjN(w*Fg)0}HzW)P9kUsq207rQ+JeI=286O>YtNQ))szrLu}l`J ziC@yIH-u5lT$hxprUwIYyN7c79Oyy^iP-fzLZ01L$U){YQpn|7iiS08?=`9zd!n}; zUuY(Au$X}UmwFILW5A3WF}UV6dJqxG7$VDClSy0I78jxLMmlgUYYSH{2-kkIY8gfA zRu)t2PSNt05&-KoFIbo!@YLtQN~GdgwWN|zZS4%IKnoqDmbXRfc|oMEzTv<=lXdet zhRIVz0HY;dj0z*Qs;J2WkVwJ-@+Xn#Z0-ylZ^ImD&e4ZvGw4!a)2Rh{icmpA#4NCB z2aP|;n4$4D%z@_Iw$Ka*t%lQ)0B4+8X_?oEINb=W!pKRa_L5UbYKdRM9Ccn>3~vcy z$W>rhFdx`K5aU$oEhAuHr+8uG*2C-aSeQt|!3w025M9xk_xal9*w~7;__T6(eV~B; z?~bhpj#kW$$!Wi@lmJG44(BN`gGlvxQ1WwlFqOoqQx5mH&_QZtTclbzd<$mm0aN*q zS?ZLiJVgXB@^N?;H31;1$pes&!~IDlIvsMjw_y%6tJ*?S2|C%9qJ_RZnId)Rv#dYR zF-9R}1;9#qoi5ALlUvEUJ*bJa4pUJ(ThdDSuI|hU!{m2IAl+?oyeWtyA-JttEqC1W zbPEU|w#bVZlb>qwz$6k#jxt38iOpr5VI!O57}oi10lD4-$Ubw(vTJ<4Lf@9Eo?Pu_ zIZhH_c++~I5RZETk0lV7>H^^{K{m#L;exg>)Y`y+fd$#`uGq64p$!R?7O)tnKj6#C zeJx}n#OV)sQ)AFVt@Wgq5MDDT2!kzm5KXs5l-{{y_VAJ3R?E(o51Z8(Ga@-Bi_{`} zi|S6CoghrgP3W;F@vO)DOd_#S7YR4JY=a|rPg}XYUCOPF5X<*;GIQ2i|MI=n@?i^e zijF}BOz89=DCu(OESg9s0a{*eGn=-vbFf+)>!8=$7QNllYEoPHBr5*xWHKadCd8p3 zXL?pleK_;3;xSEj)9fw&4a|(J(*=Wawi-=eTe1DqtYUUF)8DgNpN8cmpIfmzn~8z~ zhT=}6rfo45+n-+T@gVp4a`BuRgXhwV5}9VDLLH;%kBQEjp8jOeK|zt|tV#DP(V;RD zM~4b^&{^$8C;x zixm|>XtDcp&|&6vX@B%`Q#i3b&CBtkv_rS2qw03>VjY|=>;R{P7@8Uq22Hgb0F>b}+ey?q;c zX|Y+FtpmrZFk0zb9W=68EFUhhJt4Fb*h*Wu3etouB|DMjtRG1axvlWH9($UqA4&P1 zO2->;y4B;@UWc)+Xp1JTp3YnY08NIaL7)=2(jmvOd44NAiS%ePFpV@&C3HP_^2ZEK zgJ2bpCkN0iZ2?_IfNmZNBIsS#81TO7^volu^S6}j6tAiHN^%suwQYM|LG3A)OG8-F zeYl)828vkQj#ct7ZNHAa0`agWd0=2ES{scN5|~5nfEf<~9IUss#rl$S0@whQ=L|& zS*sl2(JBw(Zlac^Pd@0|+k(!PLu}i1Nai2dyj?dz!Qg8^HBiImFEV zb-n$od)M^!_OILAchQA?7xmgh0k@u+8%|@}j|T^NM?$d43qc2UIuc&hR>EsY!Y!Kv zVXSRcLv@JPx2_le?_b~B4=L?(??r1MUvKLQ@@ZMaOV{F0Dcu$==_0ChMBLFow{9+ji}}X2(zA8Jko=I%M}Cv^cKw_qv-Ymx9#pd zaN~jA%dm&$Qv8P%%ZJZhvw6?eJ=bJB9 zIroN?{bt7u#-lk7Fgx1{TtXnQyB zlW^6_Wt^B`nYBR{i4jY3Rb#N0raS2}t%plvm2v}fm!{MxDa(0*Ty;l2c#(-6%9fyAMTIABcJFm1Zy}^TvOyF$}5=e-&Czhg`<^Z&> zEkG9%K->D)i^*DS=_Q`WX(c_F8S1T?+1>-`ecQIAxAh=R8Xbkc{{Hk1j1mH3PdD-0 zBc=1V6bgJ$tHdbZY5V@RZNG@xzGMHM3)lBy@m61-XTq5YVV4>8+BKZ9VN`RyYx^$T z5K6c6EW7L$;t?WvUkbCrA>gQr94QX8m4Z%4$)F>CsXvW8|MYz*;2X6)u6S2>NH{*=@wo&Ua+&ZXW?8{kNNU0bR5 zk^o9P0MDoBr*18Ji;L_1&e!*;+TrxixL zbR_GuWu_Z3#-_*CRsgy6{G0>XY97UkKc%Sd%jmIH>WFzm zTQP-JJ)Lgt8vRdHp>Hdqt zMnFrgG>(RnV?a08K(^ws3rfb@#_24GUj$VpdD-r+8P3F-}WsV*7aW~y@M*Q z4rbG4jt;0`Judv&i~lHHzzb$Mx8+&}&n+p|d5+&llgY&*?nKfoLnzZJQYB`P=bzIZkx_r5g4~-=F;fs>0%b1JKeWF z%t%gG)#ybmBArCc-80S1sV!m=t#t4jXp7e(a+PgtwjzTudCjDgNjLgw$5}V!bS#=P zaNrYOKQ~Vh(;OHg@{Dfa9F!F{5A^172wHEoj$KjJ-jQH0mHV6bP`&{tl~bl($+2fRWBK-EdUt*bHr*M)b?NY;mM>w^vXy9+l zIBcabMy5eB9^%bsaYc$1_nEh%T02Vz+EF7{;yhM5eqdD!Eh}R6i-qwc4!y&EQ7uNwBS;TZ$jUrUdP^1>_oTPNT}+=a zkD0(1>j^w6X`b2^LB~)Qg(56Ve*-JM{lT$hE%%UZEM^UXc`R(c|9_BrT({sbn(je# zL5?6nUqyntzA)S4AuypP9=gZG{om_g+%PYz25S>mhy^>P6cn<*yBiB4iZHFi<&=@5 zyLO#SN!lcxLk#QUmR5m9rZ$41Hr}$`tY!1CVhkxT9e0UbD~_2Ses9w)J*jI}I5pdK z7%%MEOzpkyGk3!Y=wM>}h2<}mG92S5YPN7rAwN})Svs|*JcQH!;8orxAqRIR@@Fe` zU>BVWSu}B)Bpo-&y@Z`ERF*b>N;?#!eLcYJtMGa+cr!Ujj)@+(ZNE(aPb|HbJyOxk z9#_YQTUN*$n4i*|hne#nj@Qf_fhxRC)~&A_E)rbTDzPJ>C6yPxhSsv7(!%C^znW!R zz8NC?%I0*|pyo8Yh6pwbS1fE995ubiJCpG~NEIwDe1)OX9>C^IQ+ zoSqGXp+^fpKtat}xIw3=;ILz=v^f`7^9Wv)XRX?3gFU9RIq{RSien_3CxsX;McTrb zsEw|J;q2mqtHc-o71*^)7ThS}kOj%&gj0~k2n2P=LIn82G0(l`soN>CQG5v!wBr_v z6mC18L6MrV{!awGFV-&zlG>g7t&~wAm_W;TRL7Q*{nbxiG%QgYDaI5HLG_)2|1=4_tI>QCpaG>g7R(~>vk1~&M2l1 zY)-MWq(ygU2Q4%QfmjB0Z>W!rJ_MF3QQsR~6gsO~c0a5OQd_rOzi0Oz*2za7pY=g( zbEr-*rksOMEiukp*qpTbUFywi;OXyA;>_iO11%e7&A=;V-*}Hl3hL_DhN|Uy#nTIs zqeOg-qey2jw>)gywZ->6%0>R+f}JOm^}UD`ytwcJ`~$__fq(q5s%=SyS0U}rOA;uf zwH<5#oHw!TQ1+T!K&Dm8-cMmjG-kj+sz+P0_y_caPKi%>hSJ7v8Ut>%G*z#f5jVq=on4AHTBvqAuv}-fG&} zs>MQYsK5_Wfn4CZp0rZzZz6%F*k5C8@J=N3o7l=ovzyi3jS0|D)R)h6&21XeNUYDr15GnK8%g7NR|=?{sgX-yy_6-5 z6mv7Wqg8xy0_#gs22BMK5wk_Zsau@G@^8tc_KS`$&OH#3FGmZ`(OH%~+tbW``vZihtT3nBd5OZZMop-cetZz(No zPEAP*pa=FqUN-8TI*t0E+o%V`SBfG&T2gpzuvPdDiKkU@)P~c&3q=$cOKs{31kIho zO6`=OFb^C`P#;98A|6gd8j1Y_gh|LZvAi?sBK+U4A+O)Kak6*ey&AckV8D|8)e+QJ z7(|7u@sATSv{~sPWQxs7k5VQ-D^VK?H{-(22-D^x-gLFy`BjD!#|vLXJ(`C7E|xS> zWs}WEGiQbH(I3$EP(Gpu6TwHP1Y1RXBwH0nZ8#0R@VmHbQ&*4(A6Z5%l#kXzbcc_S zM)J{m!bFdcRwHSYnfi?z=baaNHF60)x_~8(H13J+FzsUyb;d_GA#ZFx8lX&mKB6{s zz(>64YP<8R3`ejR_MoyTMaNUwWb@Hokf^19^a6r8tbargCW4Rd3$}{*NVY1D+Nei< zD~gMyHgyGw@DbkYg!0kH3412eK;{pO9s^b412gg&mgN^EpRgY1Xap%HbN}2quN^S0dRXLt&@9~=*zBo`g$N*Af8PDt{n^hlxL@m9% z`v~T+ULHM|2v+@cuvNsWvQ=@^h7Tqb-h$#ZS(USex`MH@>Pg+*&SJ0(UmzCRSxuoaBnW?jUjunMfvb35HuOSU8g72iJ zV??kyf~8N@uq?(~B36r(smQ}dk&@uW_cna883%N*Huwssm95?i@Wz4EM&CceVn5kP z`baSr*>CWVYfE)mO~%aTULvgUpkeKuFC z#!+X{6zz7v%5ApIVi&-WtFv$zB37cYHRo(4Rxxx9IDa{f0m8VH?b5}IHNf^GxCRK` zo;ZS&O&9MY9Ps`+zl)9+!sZ)#5&TBn45bTtFcEa|@nEZnE@Z3J-t1Q!KEYCWJ&Mz$ z3vT%83KF3UTFs1;C$PgJe173!(t)50Pg+SA-($MaqKofn$nQrDpJpk1OCy({iw9ZK zNV@nNwm}5aU|SYjU5Slc^j&bQ-ljg|h?&b2O=A%IOz0e-4Eu5_7IhO_pm$rVVq*kf zl!@LXt=x3CT2(C+TE^$@=yV+3PXxOJ_PeY^2YI++l{bQS&_Ug|ca>ZSb4t6GNxXm0 z@b)d+Yo4KOxHBbjYFpuC>CdpzwX{hMVG|WMk0&xNQ*yc09^p40e7UCZTh>UmJn@WY zvYE1HP6$(;iJPHJNe?E1DK8JUikMQiDvsLlNu9z{6sO6Q+~?I5_?S|ibTPf`ca{UU zPuiSLE00HaPNOwfxAE14M?w}JHWxU{jqUUhM%MI!;WMzl*0U1!FwgC*hR(0ponN&Z zj)hGDwrLtgyX>81yg4mb*EwGm%3y8XEtxrKv2ku2=a*EeT*7~}XOuSIIW%=tZlJwH zq|9vFy}GA=(=D7Rx|(wb>cyg2%M|fJSWn$@p>Y>I$zXn9*z>r##2qmE8^((Dt;{Wq zki8anTX#f1t>TBzY4cd5{2eE-YXwC9KUjZ_=K?A>TnaPRtd&Nz1g z{wnP@$iVS7R25v05pN64y$qA~pewe}+>fkrx6mAKayLPghw+E(qroRp3U7{R6RFg1 z2$bs$8o7Lipx~LA+!sfiQ`4-CC6q09$dK6;G-}IJF1h2v<(NlY>pPi_5^(1EGJDyE z*@%+_3N~#;awkR8d=iyfnSU5P__zBiWSi=Jdx)l4InPILh!LG5349xc&OXTGZo5fn z5&s@$^hTitj&vz5ozpF9x$ky4eg)KmHXUSdu}$a~1Tbbcq-w4RZWHyg1Hv( zw1x%v{U6_DC^*KTvwdw@z$z(DW9l3m$Y{8MU;FkthN_d)ZTY;p+P2$;q<-7IGHAPB z-D+Xl1Ydr@MtO8%hA_%;ces*S@Zl59(2K2WVh*21jBKwgj0gK*Q*@Tbu!*A^QtrE# zZjzWy%XjmmR5Mj{dXCcObEK{v?WTGB6&RnIRaD9koe&;D_2Jk6V1=E9G~~je0ur{C zffwIu=h?D7(2~b6siJQ=GqS0c5U(sbgi7r*gkx=#%CO_UvLbb{Ig|$PvKb0t(Eb&1)fYb zi>-xwn3n!(%DAsZzK%8#DEAQ_fyiRkD7cUCRt*ypuSyRy;M(^HTeXYht_!wCE-~b< zu%wamMN7N8_kfN0hJQ>1^sWi$>Wilct(}cuLAAp6+U;!on!e~? z(h$Pm1HggYh0kl`@`HVV#Jg4qlw{D|RuN6xNVf%XhqCGZZcK>G`x zMD?GAt3RzFnjdBy>s@$CBbR{r_bh3os}D#Y-I$^UT{h-H%7fjhV*}M=bGQp_+T}#wfvRDB2k#C$UU$CVwVAaJi(fKO?cF3RS{G4Kb0+(qUTrkLx!HAO zxVX`-7+HvZ4vh}`#5z~xapm*1@RqfMtUXw)diGpos-G#(;# z5%k{IYd3hI_gVoxn21T^qrq0uq_J#O9JS%F^}+!Z7d8LpQ=7U1LAt-?#L>w{aJ-Gj z!GWck^9G4|uCJ?5xQBEgUaxu5N=JJG(}mg=1&6*)Lw>)pP64a5qA+Mq4ny4uE+@8XM3(lW2pOnf z9t3L|^eIaSYtMo(bt6n3@3R6~#&6@cLhbH;&%iPNg%6_wO+L}|jL8lIXB{6B1{UC^ zYe?QOKo2G&4D<(EMPWd;DvsK4ntx#)ii@Q-bp>M&0~jq@InH4j`W66|7l74pZmex) z@CA?1RmZzXDLgKmuF5RkVGq-mn!!Y%*r|b#-yQJbfWlQ8xkRAY#*#(`iiUomkezKh zWlwzfWEk_&?37PFyNCtB&S4|`RoZ6$c@!kuf_d*+83C5Qa+$gWM}^YyI8X#ivc-!} zMPxa|u(+=YFN>&1JF-xXE+Jg%k1R3uAk9-i=zS5{?CnHN z{`3CcL~Z4MvZRf=WgFfSf>6A7lz)p7RNSI?NBM4Kjr)#rzTZ&Ui!lGOq4>r{ft!t* z#r*C}x$+UBP!Nyj&XXP89wzk$2RUEBP1l&c(TyHVM0ERkuvHY@WUJz+4PU1yd=|y2 zEU-mw>I%jl-IjZzoA`i`PJo*+-*w!x+yEDzUpnwCWYU~anuerNIQg9dpV25x(a0s7 z;u)rhXHSe<&amw)#+|RB7ZKyAnwA*H>(+>Imqt{i9pk7*mll$WaRS1mW86M!t8R=t z5Q0#=7`GQCs60mzD3I2IQaHR|IYK@b!|he-Dm0^BW>5d`^V1oL#E5#&!H2*ryae?SQxMv&+M3^`T$Z2?7%`q(1~X4vq#Fzm}2ENjoOT}$F~pEzBWS;mh2grZ*T z*rS1v-`McYt->`LxkT*P!ID0EVn>-_+ga=wVR^M;2UXJ&J9yn1vE$B&inL<~)tGqf z5D+FEJMN{n>c)<@h9DF#cDw~8sJKNj`glLGCO`TZf@5;CQL~ueoher_LKF{8YP$1e z&#*m8>h+F9XqWC+aMLwr?+hC~n1~s+UjWq~bfQ&%wd=!O|K zH$a8YkcEzqx=wH%_pFHgGRDnCCe0W(3rVAJ@;gNV=uX$jC1TuEmh{;Z<5n zEU#9KqiR}W9Ism=#%+$MNIS++jV>)DHNz$#OghG0Pi@tWaW{q_6feddKnW_(QN*|b zWKBNC9fD(Wvr%)I-<>JfIT50G$WqgtCp*Tyj?^2BaWBD5*OjOz^uiri8RL9&fS+MHQ*)_UDe*5FIQgBT1av>4 zkxRt5kFliBo*4HS!?v>+_XNwU){B?}q-t7X9Ism=#{Ds(BJCJQHM+ErRE!f4CLQDE zFLYfcdZok(NF3}2#*1V$yNu_~lO5xB zl6r$N?qb|@joBOH=)pw9xP!q~QH+zVilesYBj<%EPGy0f7{^&yUBTF6+?hC>t$fHV zx!P1-Do1a(F-@s0RYbNC4RrjjPz9znjaKO1Hp;+N>mi=KO*ZvDNstAp_s3r4d8wBkOa%2#J2B8IqF&jmIBKgS=fA~Oo4SIr zQ!frk%N8x1=Z2NnLpZyLe`Q;-FXt=(BAEBowmGFEoK5)Yy&5_LNu$D&-w_T2(bF_? z2}fAMl138mMKOsNv8qf*No6A`_fiH%T*}?Xa;aTia0yk=Lb<$F4a&VCq9Sd|r5d#< zHw=`yv;)TrD#*6Wy(O)y5Yb`}&2nhe?&Pe`cbT_O8g@$FH6eSp3pt## z)9zqA=d=#z&?;G7bD48`ia2|UK1g3LrE5kSyRPY1wSx2Zmg2lUoVh1cJ0~h(LpBcB z!2w6&s2!HtdomyYFuik}k38Fn&c})TFn#24J^MF1{ZE~w?w;mHnX#&!Rh&xo2$B** z$(G+9IN9gM({TV^;>X~~b8g&oY2?8(V?Wzx|K^_5wRN1t>Yk0|{ceCb!3q!M3062V z%P|%9tpIG(_nw=@PX@A5D~+KcbPy2bR?$gADOAK%L|cQ#^RS?wGnM)yrru#ePih#0 zh?-Ohi<)7F1%ak$PLqdmD?F-uswUo|}%l|gITNzq-RV9Va#*-=3gY7ed-a>yhb zIXvS%+tVLv?*L~zE;&JG51k1upsG7s&iu)@`;>FxRY<$jdwx-ZWlY4`Lsvp%(RB}= zJ+wo^CdK^7HU^xUW&PTH1+;sGMlKPNFJnm~yXoV3_K>9yhsjzC8uXt%M7KLRd+4^f zHOFzY1{5*C+N)MyJVj`oJ@h72D{Qab*+Xy97yWNFgz($ooe=#Vja)v_)!2$&;UyZS zinE6VUnF(*kj5z*Uq#~t>~lj;(fB$NXpYantRbi$^j8A(FKFZvpnsMnjdc9UIz{6b z3@U$LME4Yp-?F@FuM;t!s%aU+^SU+0@Y7FL>r;CSPc>?f;lrTm{1lBP5i)p2^)6Wc zQ#8Wb6ZaI2RdHLPW(&V(yb7N21XHxyCgOR&j?uUao6vQRZGk%iZ-5m`PFQIU3J zp&DI6NNR0}fH3K`A>X97>aKr$CKb^Sd+U zx-UW$3gYqHd9tJ1{6!(r?avU?HD+&gqX!ca-BQ6;QFN27ilesIBIna_)uygs?9r{m zQ#39CEW&Y>d!TX5k(`;^L|E#*tlWsCDo-Wz_B+MhKzD;iF5whwS<+`ujJt_p+gXeo zV0pD-997d2<9OW~F|HO-k#>xu8eLjQD#i&2la6tBQd@On+^a$miWlQvff7`nqlj_$ zAZzk5?safXZZ>Kz^Sd+Ux*ECk09+<&_7NHaJNuK5Z?;=e|t&^%7#m4u>R5P7)L`J5#QAM2O;{Nlka2?5VaBmjvPn9j9>|Zo03m-*e9a@`yuiYLZty7Oem zxG$4>(QMzBr~Vl?U1RpfIC?M=^fAQg1NERdLfbW^at62NMzFMuV-Q7$;j5M{Vyy z&N7NqSzwFW)D?_9#>GEQ=*q25z)(^a0Adg;MLQ18ZItB87KtKz8b zeaN{8#c5J6rwMfhW2fHO$7x(o8sW^VbDYMFOiyY%6~uc$0~^01ydQ{OtC34M!fuu{ zl6c4OIE@+uBQE70W4Y823NE1vS}2#-szJH0j;KhRa;ZkwYojPP3>4ktG~O1`Vh_!7 zXw>fHx32qPUC(ELs?XjYw69H+rIPPR`PcAUo2knL5<<20NN=$#y=VHNI_HP!acNnRCd!3^Rw9>j8`AX|ds8-ls zyE7~v(iic5V8+Ptz2X3J+g5#uc{?=iOBA}VV8Bo zbkDC?rGdEUL{K#?gJxd0#-RD)h>Ela%~Yd1Xx={OdZSpbS{qaBJhYAxcDn~$9<^`z z&FYgdt1}riTD+xcR+Bya9VT@Jhrb8C(0hl!^k5=}zqbclMZ;g&syJ%<7v#JN#YJ(5 zj}6on2+n;Pvr2oQY|00 za%QzVa=3J0bF7i?#Ef?Tg(2?`ReGb{FKFmY1S+be?Pxcw1q+>HA6;~vX_W=y#7F0W z47%Uzpgq?nuQb=Dxm@k3q;*{TIWVAO-V-#g{V%4Ov5jjJEMp?ZwP&2}c6Ni~+OzOT zv$wkxNuwf_zgzMZX!jJ2Tq3?LVo4)=yW=^oy-XjDi&<-1#GiPP;JDxwyH0BNka&~4So%xAJWL>6J3q1=wqFzQK}f%3chF^*RD)_ zVEcBoO5hzB*uE1_G+q6z8lw4O{yJd(JB?fd<~OmVk*+@0f$g5L4{ZOHq2})`=nibZ z$nvUPPV^V3nwEhruUlha`~8TDv;c?;Y6EgNYc}o*8Tv4Qyqr;;8ML$oa>(YExGrNcRn_)Q(uQr@Omq z9xi7w&s7fp8kn82>y=8mS~J5x47L#n32u#1l&6f-YXk#WRUpjHF{;^Ei9Ls5(KeQ1uewNYte`8mWs*y|J`v^-KNy8hwZ(X{TZ+M(fHtt`&ZhhoO!~V>m@YAnu z?{?;y(a}t>3suuX!n|$`5<@+r_*23uFj8Wr-yDiAZoYr z+ttIctEU-^YQv3ZSCdV*Hxgt)y1fcFT{U^>mL5z5-4=qaBD$5WilesgA?G#}r%AV* z4%8Kloo-L=?zXd-RgR+9my;qmy`B)vAkDtPw4%03L8mX(K*DeK-v@qoXyg)R|3a2D zl1^WuPp9&Au9%?jz97|I9vm!M_-L+?&4O;bds2JNYHG`lZ7D04+I!t+?nW>w)y$Gv zHB&|@n>SPV%4>PhDw>qp95$?Cw|v*p=8gJ08LXXA^9NX7wMqmvQ#CEr%lH%BtEl*#XHr`U=AQFopqLWKf+bY z)E=3i3#;Z#KdC$lQh6Ih)g)z2Qkm>ndLiK$jHN4a)AcKFETsn%5lgQQwu)k@Y*ie! z{SZ0NMRBpzrmkS@vGjDBRkADPl5O%28%N9`4U$55Og*JtMrqr5rX@9zi`bgeK*sL| z{{}n_ja(wOK941hjIHZ@u{HYB@-%LXj)pH~K=`9!^gL0MEo1Al2ylYt%eZ7$`H@NZJj7(+OT_PalbBrzZePKs;Q_YgGG`-^d<=k=??jan$x>u*+26Y9=a_uneI%@oK zLMnu70~w`noQTw#v-9(jGzuBN8$1p?=W65LriFre-5L~pRYXPF6ihX0Q*bym5@e^-+vVPp z26uBri#=rQLgVXghgCjHDAlQW2Gg;ubhv{`y}fN-r`pr~rvDR|{`sgi%3a{#}F5JpriR<;mf5D*YEExQjO*Q2BQ z<6+Rm{W9p1h?aYTf(wx^D1YzE^aKT%nrUk#ZJOOWcf+=5ZC-J;xvcttq zgkvyVT#cKqae2c9J(!4aQ4F? zBL@o&QU;F}Cx>N{!Qz!nJ8J6`!Q$l_i1^L_7r^l)8o7k|zlbG`3>NQ-Jy19{P(7CF z&ev)cdt-0!$jC^KU9oaKL*>IgR;_nGeqYm%5TcQ6wO+C{(c_SJGvGT5Js)Cu)k+hg zhpK4_J-lv>(DSbm6={bas?lYKsL-R`yobi6d0z73P4R0f(vqCv%9(15lTP>_5psCq zBsGZX(-$YT5qm14rp^>PM#NUTGkj{qR!hX@E>ri3l0)o_h?*t^u{D~At&xcJMaU6` zn78x8O-vo+{OtdK!2a)G=Bj3@ciZfn|#tUUdwc(wo%aqx=RBW zzZ3i#XueV-mvDktu%wY)ptwf`Rt&2;V%Zw+ras8P@CUr;cT@ksa;YH{9TKXbr9;AN z)##9XA)+E}Hl`X~kB#b(gn=@r+XdB$_p_Zl(zd=I(OwVhN?<(isCdn4@A4bmZ(wlm zXBey15zpWzn|0?d4`JP>y*l)=EyPsyJ$U5;>oWt2T87V`tq}-Q8A> z&#+}|Yp7(EhBEjLxZW7_B7h?}_*|`0q}N1RnJ z8M&c9D3$B!hKh7X%@AfSYr{C5#vHUtR?SM4%wo|=NjI~*ccLT%LPw=|$zcMVZnpXtPQ#CC#&+FEp`R7Me zq)qcwqf7HieGfuFnDqA`UQTTlot8H0mM+o=K`7q$AYO_RRGy>w9>m?qn*8@5eh0_o zW~1gczdKW|0}-N7l#S=klO69qL+TBVGCqo%t}%P#9X*(cc=w%Pt0>;dR>e`6hV=ckyO+Z5Po_3lqsw37=6L$%KVIGZzn_Y!Z$oc6#hVM z)s1>jA#rdzBwp0}FO;C-97WVS?%eT+dQZbKx!I`M&F{{X>$4G}c<58pohLi$tpUO< zQExeJy2k8{dh}o-qTaS(t0?NpR>e`joBOT=)pw9yJv!}qIf4;6+>;i zrcOoHM^K*11Y7i`u3_u}50jg2sEU}A4E@T)spq*ayi&Iy8TOVUcd!qeKjYwN-t%=Y z5%!iKX%uokKiPF00e-SZHWBw0vZT+RxVM3U+gaSZjOEpedsIzJ+~aj?#Jy`HD$ZZ~Rv^E))lwl+c- z4})qt^khfAcaVaEk?(c5>6)`Q^3j8dht6mnxEqd;-FxBj1@2T08QkLJ*1<`A$a( zD$-FzzHVeqKJv{X&*XNa<~P4XvuwX)=BBpHcn&?;k?&?wa4_=i#7)*eguR?h$BlJW*PQ>aO#vb`F$;tLdXUtNrQnpI94DFKEJdpNIQjeJA z)G9^ByjL*=sts7gyjN&o=68`f1ocZbvI!TtgC&iOdEE&uV^khfEkCB3dqm%dHrfbgLNJtMRA`*Tj*eZ&I zvQ=^Pwvg2QZj`4o!WO-$YZ!YZJQH8aC>qwVov9dA1E0<{s}ZMQJwZC*ZhKn$tTMX& zoT*ApqGBBKQw?WFrF zh8Y|XwF~*}=_InJ;~0)=$m7}5WRq)#Fbk6F9L zgYq=VmGgkQhOv|DS#*{+&daoG+U$B4DTTA^Qbk_r4zFR#QX8wF*H>xa<9CO}1ZzVh zn{bDhv80njulF+`;?nC!SuQnvf?lbD7JB8iYS8QFA}Z3RSE^B)Uc*39)9WJvOl3=TdUS+G|=2)VE&gvi1A3YXFmA+@5&FNfKU1Q0vX$^do6hkn%gtX#{?cMmFIz z=d+}fL&DcGAmWnnb674lBM1_v3R*~**Q!CnhaxJ{CSj^kn}owaQIqfsBiiX9VGfAe z)%^Cfl3-)o}?A4Q(gz3RVknksits)YZt%{?!Ge~cLi}IrA z!>2cO4Pz(a6*PfhnRu;PHHR#_R^?|u*N#Si4(@xT9NyPmu2F`h+eex5)W$3Nybo*O z<#&%W3FdEWWD_udlO>I$+qlPtArzH|fn_#wUg5tP8gV)IFD#cDL&3RJK?~>dS~WO# z;rZ&=sLi=lqc-P;fijo63tmt$xzOd_lIC?zM2kJ_%b`*GnBTn4BJ=t$hNv3+c;+?P z?0YR?7G&Sexan%l%f9qrBG@+@Y!$JuY*ie+olSb%gz_}mm(zl}hOx6RHWWCs1k`s0 z4O`-S^q9)cmvd2Hw7H!$#3^{CZb8yf?qF(Eo3Y^G7ib{oca&uW_^le*grkhGq>((l zDdyC!gG!m5d>Ki`f5#w+OUCbFxzs=kGNuYz$e7ovLB{_SQIR$oQ;n``M@{mEfpUUt zxL#zz$n*V(OKbabMB6>I%t2B+pWoV+leN8xVXIa{JZqb5TK;dsEJ({wcy;HcWqL3X zwA^(;pjAZ6vQ=^Pb}s4d-{a~{UBlREc|%)TR;>sLUHE=3uo4Wt#_@~*)vL;s?z4hG z*PEkQj-*jx&hI|wks4AO*@XL?!IDOj_5YYvCR-S|e%jYvWwMjyRkMyDf2yX1{CV9P z7b0u&t4vmq zXL7qyv!36fS+>g~grSHV&!Hzf9zH+{4#va#aMLwsZ#<+26A=$T9c&fFL)of0dRs;6 zehbP|8DWdw)HV3xp*rc}nSc`G+ojZi_DP%gjBL>!-8qd~a@!1+=Sh~wPlJWroGDX` z;2!0}Ji~{Ofz*~?u{*zNH%_Lvkk~yS=+d+}wRf9s4p(rXZ@Gm3sx+l?80Y+2saB^aHyEljvd<$hyf%%!lB88ggR`X(h2+PxA0jMFL37j6@o8?Z$&^^e9*Pa4WHVm^Zuu33 zI{mY1SDK9ecM(mZY<`Yo*?yyu&4$uZ!!IL}79K>p!Z&cCx=NJE-^8Cq6hPVXysn^e zOJ8a(!_b~tZo0xOH=VQ6^-{WKq$_5Xew8buMt&*w^VY;~R3u*`RE`jpS&v-q0W#Pw2(41!F){L4?WhM zLUsBoyP|ojd89($n!wT9W)<5z&0J>SXr_cUYB&O{a51c?@GzQSHTdr~`^v1>-n9L66&5lt=p3}qPkvkx-E&em&I(e4?nmP4 zs_X!LlxrHpxYLFA6Ro*>W|P$(a?{2CA_b$}@2o{-8zpbm73{3jEDFGMb;+oKI8Z z8F>qZz@U!L)rTt?*XRH$yMcXeX0>D>sPAqrV0VCQ$tKmyTNT@^=gOHQ!(>Y*z-`O6 znepai76P9?Y}ppK%>|j9Wg7!U5=69emg5Y}Pnz=}j|~rC@10QY@gikr&?-VcP~c+v zg?enW%FdEDOH^PE8lPJ=Mxby0CoFU!ITZ}2Gz2>=TEjqX*9j|{^DAaW@({^0kM0Z@ zXg)bc^AzVRW4LYiRE}cmwbWCt4)u;U7g0*q0Hn--SfHUAG%_3a)93cB1*G$M&aSIA-ynbjW4tPQd{;Pt)v+Het-b=8akI8m;aAKf{-c?QgKIOBS!OQadQ zLPm0D^91{7sb(C>Drc?IAk4twg%gP>@QI*6I%}Bhw^%l~ zGfroW1hW|)Kq#Q<9M*vlfi#*6sbqY?0rpxPg`Mr%!IrUy#2k zzau}A&*$&Xza;;`{Jr_lt=lY~`}) zLD>Dl(Upar=%^PSqRUOQaQQJ^j$s*bVOrOeDQ5FzC-HIz!8JYo$XGZ=!LZJ{cUF!` zR-ovHClv7v7I5(gMP?+MMb(RR`N#8*<)6&|I{)YV(}lTHQPpg^oI;mHbUBwU%jmM2 zF1>WQj4qeZ5`?3O_vH?UPPA{(B&?=ypk?&qRSiT@*cXplP>=s zT|PpWPt)a7bon}6zCxEr>GB9&enyv{(&hJb`7K?JI}Vq>(60sbYaU%rr^~5ySw)xg z=(3(JYv{6tE|=3~FI{%g88s@x@@4!m2}xkmjiUUmM#Weo=2AwT@KOZHo6?4OM@;iqsu*XxtlI;r^|hGd4Mh- zpvx!d@-e!6i7ua~%XjJW5M6#kmmksPKk4!-x;#UdKhb3l^{-~pWeHtQrpq~WIh!v1 zbm^hXCc0cqmz{LEiY_%p-uqUaN*WS?+%;Q)r8g=^`;I-#tKxsm#O z8|d<#6LI+#UFMyJOBY@4$4IsCUb?KNB)z!Qn_c7^Y?%ZjmB$V>h3pAMdH<;-+nAta&$v2p}H<+n6n3*@2i8q*eH<)QRm{~WNNjI1| zH<&3mm>D;i2{)MeHkj!)nAtX%$u^j|Hkhe4n3*=1i8h#dHkfHPm{~TMNj8`{Hkc_k zm>D*h2{xGdHJIr&nAtU$$u*d{HJGV2n3*-0i8YvcHJE8Nm{~QLNi~=`HJB+im>D&g z2{oAcG??i$nAtR#$uyX`G?=M0n3*(~i8PpbG?-~Lm{~NKNuVXrSEKMLT<>Jczmq8* z?PPaI;de4+-^mnxCsXpB_57)HQt@N??}74umVY|`d(L;q5p6KOTR^`U-_DUySc&5`i$jJBfZVzDvD@#rSR` z{bGD~CH-Q2cYuB|zBA|-gwKp5XGpB7yV*=)y^uDQ6!`0f#+KgM?pi2jK0 z3N)cnZyxXMjZ*iad3@GFpO*Sp=&kTOH12TH@qU>14o`>P8G5h71LdOI!DUHL4%~E8 zclk=}a%yFnPV|)zuCLZ;yt*h@mUuFyIR~SnY`IQjp3&x9%w-mNKNExSSzE;Y*U|jL zF^Il%n*FlTedy+6haCnCqVGl(=esZ_K5Ao7;M{e`>G>IA!qGcJ*j%%^1`sI= z0||V5tcIB!>aV6Knruuh<8v4?UM=f!zKqyW-j|Kif$NwKdK`j8y**^JYl{nyA*pKi znc0%joFNABQ?bDdiv=p=pkti)d=>hbS0LAuIGxzbry^%@f@L zrvoNIyt43b$mPrmhhWNYVH!2N8D_U1d(ALn7(BW$)tfI5o4wU~2@@r~BjxI$Ue+~7 zk37vf#~8-gVYk?QeA1k2Le3`jRPCCaf}PT%jps8Fc(x!}cnUfEI6ClQmRuK)jaNY{ zRT^|TCbrBS6jUp8ehr(1T$ZwIOsv;Z?(j0_`F7^1`eH6dQkB_6h?!sM*vgq52z$9g zSPYqHs*EU#>r^fB8hw%bk`no>4n#h`RpjDO+A!48?b4U->ZGJgbs$}Tt8`_|dRe(1 zOo5qd8He;`%q1n`*&WEZSt%oyRMWn0cU!kw<~#IdeqmBFFY7?&Fh`Yo#cV~@GK$u% z%w27@$Zysc`EQdFd3gsSU#eDfVFZ)eY?En(y#Jst@82gS?>WiKi@qA>xtYLf{XVEK z?^lzO_uLNTy-KZL?#4o5O>h3WzUcpvl<4PmAo?b?=v>uyrHrY2wXUc2YImomAZa4~ zj1?US97SK~pV3Gn$L599BA=lz@@Ywlys`t4Bj}6XPeI=DA+w~GcZ0sXYm<_9RR{8J zSKBn-=tP!Hok_k}UoH5x`hxFHO7QLu1ix42beyiZ^Bw*$zmb&Cy&VYM)`?SiKU+d1#=lXc#b4>m`irDw?dw2R z)qIZglDEHSwc46z^=bFBrXy)0{jC1+5jMTHr(Z4X+4{nsnUt_=#!c7=&0ef8?1f1Q zyLQ}!U8mOUb^5~YOG?;v<0kBSwXkJV}gpCq+ZohUfYBrK4(u=yJ19A0q8{xC(>I=I} zQ`mc6xO@uxA70Y)m&g8Bp7LGbrQ;^`8Z|LrrZ4p+no>s!yJ_5nU8@%MIr_q0pOmnd zbs(&s`$monY<+PnNr`)T2jc3vZ$wx5E`4ENnUt`bI}kP`&yD7q-5RFfvnxFJt<=-O1MY$g?l6^ z;kI@lTnHc0_6sbfIgBk9*rSrdHU=9DPt>~ny}r1=O-kHt9f*5bt1g9nW~x{(4H=H$ z*si0Nc)@Dz4%9p(O{4?0y#t9uR-u@sHT@T**Y>YYM-1&&>C1RtQZioIfs7ZlYBe{U z#xgmz3b*KscX?9cUDbhjt6Ig&8WH4rP+zv2l9Fvl2eO64%v>=|Tdj-MAl^;h3hJ@c zY8=rQwU(5qS9c(4$Z9vdb~Yk<1h3VX?$t?2x3dH3*0vfcTdc|!Y(~GrxL;q)_a-Ig zH64iAs}NIdrk~T7@P8*I;jRuO3}G8A`BBUEn7(X3NJ_Td9mp1LtnV(B_-Vc4uo6XYOR)CzHohC ze|mLaUxbji=?i%zDIpIeBxKeor?Ca)qBVUHGnDt}3wd`^LSEN_kRc(lFcLvH59rJG zfuv-+J}KF1YI^ySzHFaQO12x4k}YCT_!E8Eew37KHzp<9A+_F~(U+ztc`+4W?lbL=>rG?x^s+3HoCB`dzR_@0CYNIb7HJWpBbatRPV~ Is1Nk~KV_RQL;wH) literal 0 HcmV?d00001 diff --git a/it/doctrees/environment.pickle b/it/doctrees/environment.pickle new file mode 100644 index 0000000000000000000000000000000000000000..4e6a0bcb3ebf3e4bd037535f86b97163a2983872 GIT binary patch literal 94264 zcmd^o3z!^Nb*A+i%}AQjjNYkYtyHgbx-60*Qf;kg&;;4GVE_VgiPcKzI`#f&I_9 zx9V2)V_Lf1H9?L)xohg)Tj!p8&bjBFbMEWEta!unE0$bA{{`#3O2IClAG6A{cGWGH zta7a$48O>?i}@q5q(|#FJW#*CzAIQ}Rx0(A!K%EQt5q#4Z&&NVi^mIY$r`Wv<+4>B zzsIef8}}-9KAW?xtZV0USrqnKB^7F=;<#NKm%zMw(C1Zi4D$uLFu5)pjp)m{wL{Bd$wEl>UW{V5rxjz#!SEFqJnxNk+8Qs z)VL|6B}&@mnpG9=^}7+aQ$k|GCY5J+CEGAO&kuT5ufMolHtLvsx# z%?i7mw@|^#O4W5xK|Q$o%&B9C#}6GllDXs9;X|2h=Cn2A7Ol)#D_6F21vGph=T_#b z_Dlh#Z#-;Q%xcXhQFJpEtC}gAnX^^Xn|7-u^IqU;fynZ&TTx!{ zV`bGUTBc{!3pWMB*7;n~&s#(tpelJgFn0Kiai->00jclwk;%g+jsO|)2emrr8=FPX z*o~%A57`aE4^`%72sO{}YIB4^U&!TEB+imSg)4)#>NR4?D|DrLtmd8{pQ2tlUbLsi zD|5AiTb>xZdEB#WR<>g1&OsDBuz6jqR<|O!OZ|3Z&i86=$&f_yj43luBDef()yHE! zNrPGOETe4B+A}77STDTD4~7|@S3^oJYQ~zev2pwpsi<@#7b-#s48M{G_4CGb39RhD zE061}?dOMG=#y)b4TUqWAu0FGUrc1ft? zbr#MNaQy%5VDN)0E&AOVOZ129NOhuKp9Fd3QF~@ALrE)Y<`jwO zsn9%qY$(2h3st|; zFP|&B_dqsWN*|GZ+=%txD%Y(>zFj?u`~b}(?t_? zOL7iXKsB>E2d0%w8{@^&3WSgAUQ>o41AWexQ2pdds&81N#cYB5k%Npi&?Kx#48IB) z7ZCc(cCBLP&dt^5xzLb&H|&`*4K820|llq?m~P+wvTYSbvLLN>I{kF>hKHJPXfxSTG68+!JeKA>9m@X zauB3y%?q2i%J-<288QxK=X|*ovvn~wXP7L^^aIf;c4RXI+bR`grDJZT1{tT0JpRkfl4N)#2fS6u2(a^&KS!d-<|2>b-CLi;LFC=ev5xj8Au%LGt? zIVJm*Q1GIn9tIP%=a=L4Llqe4zBGPI!P~&?ESWOhxW~>@Ken91-P(p^Q#mHA4$i zl(?<%Vo^evMINMe%7kvf@XZwovlGK4Xz!NIqBQWr?DdR?Q1`@VJI7-ve=725goT4q zf@f7e2O-%Yy|PdXjS&PG$1wHDkb=IhR1J5Ey&Co&;|+)bdRU}yU<6dU!2}7GKK@?W z0AT^f#gLJc?5h;*nv~CZ0Z?R+tz`&b41I^c5H+#5iwtT|n7N73Q0b8ixO}Vz%_<-W zf)Fa`d}YrvtGNQ%W-)}QXNTWPRttovvW5%+juBF(p+t6zz=zBeQ4hW?(a;KA~ZUuq6NY&f@uL02__GWUNQ{0aYBm3XiI}>=pZj0 z%ShTt>M~7~xg<#-TPiYRLj}VY)rPIi!4!bv@OfO4Tp`0YFH{@QQcM#~rE!kTjF1uA znRH~pv;9tASYcrd2BR*_Ha_y_(V9t>D8Kkk0C?yM4O|9TSnR4(Tcut{K zt9ZALkLU8`F~`eWMSHe7R<>&6mVM#GxaI912QRXvQZbt&+)!8&jSUon*hrJ1 zuqvsMX{2BJ@?9{5m&IrIFwsClFMR78Xj z_AyIPX17nCyzS1(+wk4(x4*DxkGa*E@S8Q#!!FOzm>Bd|^01Y`NH$XoCkny_UL{Hi z-OfTgEK(2ygix_Qm6q)`kwN-H{8fU#19eyQOJ!*jOBbGsz_HGUrt(%%zUEen)~r>8 zN?;?B;!6UH4WdA!9%pyT352vJ__eUzxdK^H!OGpw%f9lO8-GTspg}HDw(bGF!SG4l`sS)ov)1$eDo6z=lbQm zj8N5sg}m`#Ao_^i?)A|thD(Nl(e$LVcj*;ZP*XOj?7THgp%U2m2x(g7EMl!uu`Q~Y zgc7>?!IC|y*pMnFypjk&te$gIkWvKPXwG7H`?x~3!3R^d469lIi{nGB>Zw{K3fv|0 zH>+<&94u6p^AU)xsz}K$W0**0inv6SxmML6 z{l;rMIixR!5GV?4Qvk?HC1FEHr^p5RzCtp_wWyeg*4?FGZBnq9BCyScb-H%k_p0Ml zc6q#D`!&0$K8X=Af-AlmiM|Ol)K?i*5$sL&^q^-jNd%X&21Nq9A)?SQgt1{7V?m)u zOqI)X`1n}iC8D3QN5NoPI8`c>M!wJ=39Z<>VP7O>Q5LFRSkuGu8;&A#j93C&BQr$o zD_Bv67d;y~J@LGlsUtv+keSQY3|Z5dFGZJGA*>srG&fKISS?1$;t(a&HN1^rjajS| zFc|@*OR*7FgPX&m0$!w`0I_7Bw-Crm77L^4F~@=nYzyI_TGDk0$0%4*Co8lt{Q;;Id&EE~DBC~_R;19X@ai~3|P zsI~?lap+u{uR>b4g{hnszOV-hZ||3-NQdb&MRy7v$HNd?A;*;mrcDjGIZVu!WBD7y z{E)dq8yvque7-(5oemSOQX%&M{=X26cqSs(1!*I~0B!MgXgHn}c~`|hmc5@$>1pB> zNk*{JtL1M6df{x-I+AOQ>tZ^YUWk0`?hkPm_gc4HgjFe$#TOQtteA!)fz@+P6V+OjI~iU(JZf^&$?I!Pge-ZWw^~1W0itc zV$p6Wz|jVFGswDx%yRx!5peGuOcPiE=zAF1WN=FwHQQ7viW!w`kIZygRcQFYkmq?L z#F5U04nC$agN-Ef(BkORu!TYk7)IbBp|;S&*J3)FqI(u*KMh*)@UWO`@cpS^P{a@@ z09b?BaeN8Qlv7kerU-)+VjlFtdnJW&vT$QCB;$zD3W$}b2(;V8@X8_KZ85{EQ~d4V1vr z5rGAf8sr-mqdOCXC+tzcoSn5j8__$MbO9+Y4u~_tG2}J@MYt;!>5VC@2TSm8u#UiF zv|tO$Dg^0$xPfd74u}4OZTK_<5o*zwCdf4$y>av03X;fbvdcE+s?cz_lAs&wQOvnB z;U#EDlf^?DIVf-wfrRJIP^bl;&di`IVAi}!U*~ONJox5fvQsQ2SpzQ#xMGn-u0j+_ zqEQ7J>#NqR3@gP5G6Ysay_FHJpj8eu_|(jD-XvEi*f?GEJEuSTD#y+6~?I-4NHL*zN8QGRO!EXSNR#ehp_ zgiEQy&nUb|=~!LDE8D_!;oQ`ZFKeow`aC{pL<@Q!$%Rdrd)7gS7*)ZVXjHKL|rpM5G;e1w*Ws(4jCC^Kz`E)Kdm|iVHrSDb`ml zr=f&;7)&U*-n8BbGln4WJl6A|)H%b#Tz1ibV@|W`P|XhqYbuy{r?@fu7XgCpB9e<_ zZ%ojDB7x(O0V)}b6r2p!RHt*XZ=V%@OI;B$$sEEuW42YBW&luJ;}j_&Nc3F-(vV$F zMB@u+GCp9Z!Z=U%4H1pvFrGh^OdScMGoDqP7BTU8%&3`IKfw_~4C}!rHk)nCQ(&PO z9B`q*^JxD1_01^c$QnMsJ^e+H;5N+nmov zZ=d_?C!K$a-kyHdb`Xn_oG6Ls^%xe_|4WD_fqTuHPprB>H+hS1?nuLfG#m?|IqU=W8$(B@dP zc#k>f)nAY0k)ih}9i$uJAO*|i;z{z9f<9i`%WIx_(Il?|ragP!Sef<*Vuu2kpfe}M z0iy#|^B%eX1G_5va|N7vi2cCWiQ_oS3H({?&7-xMTf#%_qFn$PxeMSmbpjRii9^-u zP6^+6Q)aL#EQxw)5%w~hw-95SFm206B6j<%5SuaZS3k}sQZKYw7Au^oj32D5nb<^& zLzkR$0PRol%1Wn*zeOV)7k?Ifr-BFY_V5U8JGrK5VEa<06;Ty2Rl(2Ws z<0I#__yOk59GYUh7V!aMF#8Yd0RN`x`-3wEnOl&?q~-Dwj7SO$q*Xi zyi)r%Y=wy<^3E<1A+NOqBAX|%0Ry}EN_GZkQPp^3#7aHr1-Sdgq-xR=uWGVPu~Hlz9VAORh$+ZyR4R6 z@($H*J|cGkQu9TZZEpTGUE)EGdj~wW9OZp$gaxAXVx((EWV}m6Xn|V?L^i9V46y6t z*kS4`W$Zvo$is8H#Dn4t9q`z5EWYhA6R~L*_K@MgjhvamMpPSH%Rc;;3~$p*+62eC z#E{|?9WdN>yA_idbR!V!7@t3my}NNS{;4i;p@>EYT!v3uEHoI6Pq{@qHj};wX(cGWU0h3DPlexQn zoYhdZGIpf75=duUEa9uke|t$wjFZvc*C|so)&M`cF5)7 zjoJ?R8N5l`A=96C)i`8)^X6=atY6-k?U4P+o3b6U^LRtHLsk}V#&*cu;f>f1Ss=U# z+o9o~H()z79`ojFhsHqOc1)a9O93UbK0?{A=)!9f_1B>d>mjR4&04Gd=1etj_M82 zk-U7QOPgX?G$_w=z+ne6bU1>Q6MUX80(~Z*T+!xZfy_X3LP5J?9H{FQR}_)CW0x$G zw44M(FAf#MF$I0V#mDg>A}G2_tl!~~V!@XoyxWMr90fc~^wo(1z9<6mdD#B=eXV4$H3;$Q?q zFwna6NU*}u{j*M?< z!@X^EdJrz;5h{o zo$vB5k9h*$OVM|&2aBeT9BdsWbAg$dW#VV8tZYw{jQ%YU>T>w_j4lYJxId)}LJc3H zr(6m-B`p*d?`14{*r$Xr_Mf)A3cT@TU~%utl=OHo0F5LoY-0B~YVDHU&(;NT(S+7k z{To|OjwCwqovD$1)98$xn#uCiOjbbqT0O)jJqO+flXWB8+Kkta;!l61OTT z%6@7z9T~+TW~exuw*@(^W^z`$C#S0mLWy)y7lhJaf~h^wU>YD47Q$fD0HJ8{#%{DZ zhHzffami-*rJFoLJzwiY0)YYY} zG@uJYaj{PqgybSG#ac8jUev0tTYJPrYFZ~I9@HhD>WcexK`18f(FGxy$m`fHnTgtV z^rftcvwFl#YGNm5PU(_SG1FiWZ7t{a@hDyMV*MfBu1hzh89_1a&Svu0Tnb>dBrIZrkx9WmO zo!B=XqF@@oT0z*6fB&hp1X#RV5mempg9JR5xgIAwuTR^gOooU*i3uQr#Z zV}iwE&Zc3}*!2-z5RL58@X2WSkP|eFg$4+P#mjXYA_p;E{k(XC*u}4;UOLbl zqmmlfX$bqVE)kVL{g6Q{;t3c?^tQlij%q&R6_iGT@a}=VT+mpJ45%h)9wqN zBTBGgCN(x(%Ir;Emx_uJrY?xo8PSh5*}Q5kLHI{fBmBUqozL=e^k%j5kS>)Jp&!%* zkvgFVPg~QNGAgv7_B&If_7G;NxYl+g|1Dj5DU!cK7ewkL@30>5FH(vm0$}n;cL1SR807aE{N2bu)W0+c?`5I zHll1=m6CBDTm=mjUQrhD0ZS$1ZF5al&w60erRh1W3!;%B8jhUu1%(5l0YYK%JzY0O z`hvXq^pbr+-5?NL!He9-da_5-M(yk53Le)L2Gzk|tP4VM@`x@7$w}V1d&!*C4o!F7 z1w7Xy7E;4Hv2a$Gc#4G{gIGjwK6BK@5eV2mTr8SlRIdG=>NllD&0y!~G$De;GC&0S zmqT&6#OCfM75s+o>HYJ%AXJxmyw-v~Svy-YE527W!J{Rsdt+iYjTk|jek3M{#M=AjSi_HW>8e=s z16>e}tkEzMm7OVuHVqI8i;8YTq;A`1)heW`I^IbyJTn^od@ zT|z09=<9;GXj*IgG;5<14O*Q4@#fTMJseH5Wh>&`ktQqQmvo7y=>8@Kv4~pang(jp zu{?e`b9ORQ!KoVf>-4F_=>Ngg2t3+IU|PoRm$Nl93smT@YNc7$-`_pW-=_;g$@+T) z+j^~6Ix^?XWP&+Q{W~(pGn<+7q%LJuhj>C4MC!~LZQXOuggwV>>^jTW^u};*GH8Np z+jJc->^f%4zOw`fb!qkd=qHvv9sAB5NyT=3YTW6p*xVM1?b_~{vr`vDW8cwmN|awC zhBOTj3JYPjX@F2z2=iP6gu>z`U0Ijj6`xnQc;3~epM7|)M_qs#+R5W8=*p%V8Y~9U z)>i8IdZQhU+xpZ&igdIZc}sNVB{E(q0! z1;e}Q!&BX0fjwG$yyxQe;a10{JdP&xVp9(_rBg5ckS@7YFZ}?6XxmGBzlGqMBPTO^ z##+wRU|Yf6KDHevy6RJD(Uaqu**#%!Br#coO$Gv!rr!Ew_auKp7li7qpB7x}wL>$( zylKxJu@N6^ik+XBVAk@%l!QN+zytx9)s|fXHSmp5%i_!k9J|@Xy(Pe}Ta)@HmV5h| zdwbjVEy+DP4Aag>M{_3lcYSL7+b{UHw_SIW{KFDeAeXJkb3>ascy0F_+^Gv9_5Qb) zIXKaYgIMzwo(Y;fTJ|NWv2U+n-$V!Y#ir?6^uF7439p8$!@3|AiFf-t@viN>T`6te z?d!n1h3D}cUBWBg&FF$iop;xBzuP}1PvE74Ju|lF`BpwNHAlhLnwx2g7hOn=Vb_b! zwm&OaLVNGB0-fyC90go!ZnkyE=ykdzR$O{S7sMiQ=|BfAHN;%soi>*aEX<`=ao2b0 zl2~!+ow^_viAx9Da0%hpR(;jdYc3%I+qN(Ll`e@Dm;O>0MCx4H0gb0D#pnW% zmLAymQe(~zQgo3?80}nb?|pqom!OI#-_!+>I!`jplRcqp9A}EKjuWQ(_Mx;~t(}4^ zk*gKwi$tW!vDyl3x^%2I>4Hd|Fo-zk9ETb9A^x|(`e z!a=3p<$LXW)Su{*RB`2_x*$^L3QcP4ryeE3I~+iW_|l>WeKj@4&?0RxW>4JTiCELF z$NZBnVHIz_qzfW--fRPJ5Hv`hM$u}fX=H6$7WFn_%7JY1M2fakOhdqHH{ml_{75+4p`OY%ULwkt*V=#o$MhcR6cjU3RJPghg&Vs=*pgu>!6 z-T5xLtcI_?yyPi)-OaHVb&F=PM*>Do>oi4g>&k%=rD}Z|I^i@#3x^ zePfTfNNwxH#kwy26c_)SE(pcN|Edc@a*;1xy<{$G?*zE03tS)X5f`a#ow)cRUHU05 zetk}R5I*GIYf|az@tSs)S_D z6n8%p^i2u-HCe$BA2pRs8wn5RNhS}Q@`7C3;5sa>cN3NlsFP%pU#wS0nV#Ti#naR`M#)Ur9FNWDI9PfuHrfO{>&tJrxXXA3lT5VLR}P|anM zP`Y7>KkXTJR!}+iG0}~v${A}sD~InrV=7k>b@$1O&X{L;ac+kZ-9OJC4PytoMKS^j zobqw8BT}tkja|+a{k%18( zxte}<($6UUTt`3G)6Wg`b0hs^>1UjN_R!A+{p_cogYgL5m(25d zt5Pe}k1q{Y=FAF<6z(vZDY{ej`Jk_0=g}4L*Pv`jl+a)HOH&|yzJ44ETio*KmWy*J zyQ*s51EG^WQL33AKr`@tL&34}0!TGp^>Gb&b^IQ;dTyL}mj#cq#D{DiHyXA|;&i(< z4sB+gAFE=4Azxi|e498;^j~$=m$I{k`s&Kg{&e?Ph{35VEFS9y3oO9p`_vcD#OU&F z_8Nq_7i)E?)t!uwyHQt{UVWKCv^73@zgD;9?Q@T&MYM%(pS#dK^)pCkQa19tbU~y}=!I{7`b=sBznGh!KBY@FMfktc1<^=&jUhyh zg+fbdfKXVR(`|@!bf17eZmTAH@1t$I-O3!b)b;ch&U!soGjW&>E_94v6*)4}oAHL) z*J->NLS0>sH>(*$TSE4JyxB@?(?PsLE=;^!O%j!D%QzWtN{fs*Gea&whdoXhEVywi z+dYMM>w-{y<$A%SUXMw{gK2xluL=iHp0K8*JSo^`Qsc-@?5B$(B2QQoj;`=co8l3t zbg8OT=?PsBsWWEV2{#YbQv2{*Xn!N^bFp%EMY`$nUNV~+PqvMg1P(aw&gQK)F%+7( z;pvi6aigLOqLCXKqmmlfggVp!p|I%JZHOG$zP-2u+wf_Nqd>R4)NoWdD<;vAQT(_21~7Da>W;`h1QbSkhszQwKJ zbUksBORMu+KHfduKc)*pb(@a}*7bUfJ0P#Iax-4dt=c)4M>#8#E7;~NbgMr#RkU*j zW>&kA?`x^C>>y5b=3BO0-08#U@z{skuNl2;gr3@9-ex@fiY^CK=lQZOh(;!As86MV zMHkipp|E(nZbPI7{;ZY;)}7AogVu2U7>w4ovP)j%Cqg!+LlQ<(P4#)kFX^qYRT0T1}As8rtc+oqpayKfj5e#6;DSMVqMlPu)&b zMUACtt=NRspqQ|#qiI@NS&gJZD7qR+{cfyA@5 zB-HaK(ZF8J4pBop_4B{bC8p}kqm9KkF$o0A8B#Q<0ljR)l^2_WxJ9z_q=h*od zc4pU^$z-?PwZ1pqmKxoOz1N{GElsT0dyOs##onuRK}hy~ON+hQR@M3z*Cizs@0lKP zklNLWgQs+9r#N_mL9{indOuCla$3Hc7SR@(mUp|SUQri>l7Cw;px5D{*3V#f+TK;{h5&UAN<=>-AHAVQ}(*@B;cww%;Ayc`6|GT)Qu5vy` znf^jub!Ga$M7Kq9!1=~P15SH=sXgLs!(^t1wYg$4(N$y ziLk-5M|mxDmQP6{oDd}sapFbmRW}QqvI3{3*~v9PtV;`SKo^AS-+c_C?aCBgr+4Q` zzhr?YCrrBq-#d8>KB-RONLAb71(7;yFtsYqOo-O$$0NgcrpAd8%qoSaBDA{^{j@IC6yfjC1<^=&jd4m1bwWRC zfKXU`QK;BhWU zv52G6t!FA&fPzIa7|yF!rr2TzHwqOYKU}QWw65%JsnPv8qh1`vY_Y{GZnW~OYGF!V zEO25Jn|Sor?s@cPT@b2g{E}dEyPlytW=$m4H(}$G?N-ZX2_^0xYJta`%EplPlJ{x0Y^9i;e(Ivg=VSl6xqLF(Vs!?fI(a$wNC@h3_)c_$KiLWi> zNc7yC+Hgkh$IDE{_T$CJ?H~6@_NZN*{D&Xv3W1WN@9Bb29Q=+h2+6_kEX2VST*1|+ zZEXCrNuMM=l-(P9*rJIMB4_Rm_mLK*u(i8G+ zV`&i(`;f85RaB1ig`&!v#>J!Ell71;2-PEAs0%`AR>52iwWzSz$yl@%18uu?$4M9W zT-WSbGjoy`9h)$>a8B|Ozlu>W8BIA49C|T<+SH|R%St&!BU=v9$XfZVCDCY-4PTcl zN?TS1N!#siY_F_zO`&ZuU6lzNY-ciOP8~a(=z4ETjnLaht4d#HBOJ1{@wVBtc|-R^ z{&`&xO7veZ_|$8|bbD)V96EL+16ss2;rml#$5n0EL0h0(G30%^)KpUc9$gTP4AD?$ zN+XKCrvXA?AvB@}2x+N&Wg$zY_lkDiS#j(H+||kO;EA}9eX~bGM$PJEuY65c29y|m zg+a8nS9-5JS4#RNdgi)Ky%~|3h=xg01fA)akY=s87L|5s?XA%Tp~QcHL9~@q-7%`a zrEu;~jm`t3(J?GdWBguSDk(7?*9DO}p|8dq)+`Pz!C5ahbV8^dq9HjU=Pyl-{u$bj z7vh09m6UpA8Z^uQow_ttY&oq9qLD3{>R+t86go@;gu>#>x|&oDLO)pCL1^f#d(JB3 zTxU5|5Fdap^hn02Nu36u*XiGyK5<)Yvw`}f>3EQN0gMm>Trqzbf8&PYQHtafG5Eo5o?V#4+ zX=@tO;)NFEeokuS9>PpK*V>NeH|r8i3HN>m(RR@5xi_%u6k_Xco>!X8VnQ|_o>SnL zaX@`L8ow+x8t)pd2!v?CiA0DGE%3_}NhY4Rqy9^~r~aL~Ae6+P)&-$LCqf3gvRYFb zx))ye`ABL~aWU&YAJQef>U7)igxBDmV!yC^H9#mV9?~5mrPJ~ci|e$kQi~K5 zX3FC|5-4g;Cx_)jy1ZB7^8p6YR(JP4VzynaIl(cjIGGbyUsiowc171&Bq;e*T9gc~ z8dXSy_x7muoy`W|likz#30)AXgM3=Bs@JZ~l`gH3G-$z|U&R^F?bxw=OK(iVCc&oj zum}adj)zc)-73<|izPs#OB?Y=Ke@d4DKclG!?41QX-!?@`qX%_ZIlfdfda2LTBu`O z+dVUO>VinUV{8;V$apVi<6;r)Ucy|&)g$_2{dNfQZq{bFiF9}bT&t;iED zn#uloU79HYeo7Za>SW(3!qjfYEEdi1MpDe3io;Bs*8H#9+8f)sNpS?%$k?@;B}_tR z2D7IzOq!;!R|1_bZRq8?AR1YtF~X=pN@zF@5DJT5)|D|iNIki@gVe~Ko>e_oo_1SL zm%gY+f<~?CG(x>VR|HfCe=dVq#1U#`tLaiREut+nUHXddsrNEn5K8)ADj3k~QK|KG z>4T}!d7=kxUFcfLxGrOx;1vEHFuCjpGEEyRQFy+a<|Km#arF#sNPqVn-& z4xR9cB6K_?9&|Jx9&{QR9&~sW9(2eN9&}O;zN6js$5%SE`v{4&>>fzaT1Vv3d@*pL z7$I6j<_;2RFgm{64{-fg&cN+g;%+AohY5-#m^!hfVR?U>A@78ua=W+%cm0H2aK*$T zq*@&+=m*1mEti2y!m1YT>?-EDA#_96>t%y3@Ks&vjqdDHZ*+N=dZSys)Z6;R8{O-r z^5}vu^+q>+sW-avOTE$EU+Rr60aI^u8<={dYr)hT-4CYT=%O(7MmL73H@Z4Zz0nWwZFQ*U&un0lK?ywN>lDvvH4Q*U(hn0lit$kZF%MW){9QZn^MJfk-f_zQd@q3=7RwP=R+6sIFkd{#s!0hS$4~Z zREj?ptaPUw+-*U7czyr`e68m z?l4U$ey}W8sSq${)s;AlbICINtj1qSIyh^QbkZ57-(Y~-d`I<;3K}|uYY{6&T#krv zg<0~DvL;NKtj^%wS;wEQ=il$*a>$d;2K+tmY{W0_e%#CtoH9wbKgxC%c8BOk2b2cQ62M-M$GgP+X70}}^Eq27oF*?nVs>%mICOD=m;z2Kj$ z0my#T7i?1>?B5grV9(f|=#xE(Pd2Mh4out})?rLU#rGzP531t(_uLW{nz)!k`x1q& ziXa_0xbK#*Vl-~g*xnen`*l7#p!3l|osVwT`RJBQ`lw%UdQXzooyZq{CAn>}2>>Z0 z695k~0U&HbY!p*(x#_^o5mRM_rbC7Tz9B;a4>A<+AVUEUG89N^8zCKxi$@Z5Rb8S` zQZ5sP4n{ahX|&ifLG@&r;6auN9%Px|L6%92#!)AV07Z=>`vu>S{elPCFL;psf(O|z zc#!>~+PEPS+?)69**99jwVv61jc_GB7A~7?@xo=3-EiTu$=L$y z<3T1k9%O>!K_)mJWP&SVD3lV~D=gKP>IV+M90^OcCHwwcV1b0C+S2{zn{HC2+7bTd zJqMw0Ls;!7Ps&-9YDfB;5AFr0Ls;!-FNQ@~YHy@4$T4lzITGU2u5%;`wPjRX5Zm%8 zKGe2jQ=-GR@}#7$8Zi z#1tv$8#Q=;%=k`HsIjX`GPaZAMAhwtI8msb3?~Y;6Jb#(6!awdRZ|nDI5#!?BFT%3 z`69`fi}@lcyBG6CJC?O?N0Mh3Q%5A&6nSbR*lM&$QnrmuB#GIkkffi*p)S!+&DR4kSmKZFUo?+eXb6i7w zOM!rSjswiIyEf0>+B`dJ^X!GqvlBMYKG;0FVDs#O&9gr=&+gDXdqeZ=49&AIG|wT< zdG>MU*~OV>4`-eooO$+d=Gpw6XX|&KEyH;>4CmP{oM*Feo~^=pHVWrCEIZHIex8G} z^DL3f%85Xc ze9z)N$Q-3ClEQYYWbpmwR=605dJA-9b`qT|vV)ziFiPCzK};H!;5|f_Ejp2{&U!RV z$F+xHdN3>jo{5t1{o3%rMWf>4qQ*J-d6b-$$-&y_MiF_9DLx)y5%dy5LE)@0BOwRz zt32s|YyOtc5f?HgE?xxGEeWA-1}^iZ{3q(zaftg19nvg%2mN)FuNCLmJD{&dj2=DK z#Z==S5p|1_u)YW$-Ze)~X7-G=T=j(gcX#_1^giGW#^4~>%Oh5lNRYCCHNmjjL-Q&a zA1r{4FDz^XzPA-{crE)G_};dtO5n7F&d%eMTz8g^Z*RhVq7`^};CmVTL?`gEi)7}S zVDD=M8$PXoy{{8&u`XR)T+;-5e=FFqVy|bs_m9PPdSqx|c*X!*KS5avujI1c{m#R*lXRicOdVY#=mS0Y!<-?KXBkweB+$tq_?YM7A>s z)n_D-mPmvwiy;AqZ36_bYtn~FP_^%6^C^x-SQ@PeSrjIr6=2Xt004VhXuS1m{KMDs zL=U!8gIE@z$gE)V5&5UmM3JJ~I9>ET&o!_;h_rZ4Y)cWr|3GHa5%2NLV9QbdNS;F< z&jNoo;XL}POXnn$x{F~*a{~>zF(mh(6RXdnwRf3av)K6ybHL2VeZROcoj14NK*BJD z8<35XS%wW)0v=+@fm3lreUutBUw};=FB*2pUZ}I>t`gaZz|b2qfNEP6eu2vm*~Cwz z1Q&TXT^tbZOJpxW0YXY}DL10Uq0xvguDc2mr9oWd9xeb~FLuW?@Q|-!ie<$Z*z!6k z0NMsCCw6Ivk%w&>UE0A8QDYI>jdba3iivQM7hO0XgFp7pKavgk*o__83r#O&LA=)N(q|*c5h3Yc@^(O zf=FYlCi{bdNa1@iAc3)MQmA(*zH_Ell3z5Y5(U);o5oE(05d`khm9q#v`3N6fjax2 zDuZ?oii|+5JbVZX1Xj_y1m#h(8!3Is*Vdh%gRkTS>@eYtTrug7;f?$#=}h76SLlsA zcjwLc3kh$H5`I-Ayqyxrk8yroB>ZNS@LM9`os>Yctj=$Xgx{qEns0S}Pb9pD5@_bt zd9O%#j1p+_)%ksq@CQ-C2SvgkMG23KgpX1Jt>|+8SS0*ul<;wp@CiyF8`SyVBH{l; z37-@Re@zKA+vTM@Hvt2g(%@^k?@aE!k0zDSE7WkiiEF6 z3EvP2-;NT#BNDzBC465b{9BapBayIVdx-i{`~^m>h!Xll!a$U;N+b+Y0!=DALn2{> z5@>qaStk-UQUZ++&L)wtl@e(B*tt?9Ttx}A63E#h5_VDo-#vPbNVtv?_~y!IiG&*{ zfz+Y1TO?#Dfi##iCKC2g0?pJpdqu*2O5nrD4~T?YD1myhbE`;rUX<{BkuXUK6w`EG zBodB92}ec3F-qV?>@VR24(bFe=)^UO!uY}R8jjkapcb#mSwU|ql7-nrv81Kt(u0dw zRB#b<{BrHyMaXXA{NXw6TvonZ=Ipdd0Q?67^sUosdv}%y#?D?=A6PHUn1}Mxk5u$z5 z<%0Gqgr8z~KPd4gZF(VCC9L_dQNIvt)P>-hFs{`YMKch;w2I+JBUouieTtR_UkEmZ zmL%*p#0FuE&xHm169sp|Nx*VSxDW_B+OWl8OU%Ic5{n+gZ`LNh85YKl$+yCWMOGz> zY(sO6Fw7x}V_BnJmZg2d^xdRjKSV!|)6YBU=Uw#kUix{Ae*T1hK1x3yz|RFNp3E0{ z@o(Mv4I~7EhuwS1Mc2%ertyS&3D&`moUzMh(O|V?_%JImDKS7x7!A2paEcgAuqtR#m7kBWKc`KuFyfPqpdbO&F$wNuws(;O$2e5|&PTg6r!$H(@GS|w>5$M&&( z>?Tgy@4t9s0L)zwE49@T@7@9Ky|~|Z|NGwu{`=$UzJK=cw=ZG;nd|hXtTfK&#Y&~2 zRwTV+uBfQx)~wVpIv?!Z^3KkaogL;%O`O-&mR6QJ<|Rl`mX&%%lNy~fxVe_n8%kZz z+XXBytFwXpa-VsPeNE{<`*1#=KXbO!|N7IvhJPP^{ppW%5FX()!GHuSuv8y$0LU1><2qkXMufWAU+P3wkYfI_w5OY5=^_O|BpxhJNz zCvs?qy?b-AFYc-C)|kEb;(h2&~ChfGYVakbgD) zZNdlW%OvH_1hLySzib<>)dLu(K6WfO*-p))AdzD9eB^ z%M$r!c?nS8YRMIly`7MiWvP5lP|9lKiJUSkRwZD}=L`6s{n85)YN@Pf<+@a=YLe6_ zu?(}Kb}p~aRf&kb^Gd~#_vVI1T{ikyUOyjqU2NGFm9d;H5$hnV-$Mh5WA*Bomko_} z%q1;N>6ioj$fz)}QBf+QCDrDo10DHMomjmG4KQgl+aJ{s@IN` zd$xlnRZ4ZqFeFVlAKM61ZZq%eL49&@T)eOL*FTc^?J>-UAKsBmPj+NceuvAnY%{$k zlIi(Krq_^~=wkYIVp?x1l_YVe`@>;YM;y`iSlt=PYD{h}5?8ua^D#K$%I=l`gYJVI z!hXdi?Amvz!Hj=RQk%ZmB6oeurGghVqJd_EMl*MJ|;;f(LX6+eC+7$uPyhk~# zeb!~|Ih(ajk*vKC$=aq!*4{y^&5K$?X;cM_c{-G;pcoiHq-Gss8x-v6mSHHlYF)`; zjGJvLIjCPlYG4@3DUIA?ElD@ToHNFWk7IC>a=O}3a}^N@kg_6aI^~*`at*bCe>7ky zbBaaU2J^widxATNy%;r!nH#&2M~_KcBFWRD$dfQOdF1V{*K>v}<)riCY_l%uj64ye zdWFa{WJUL=qj5clsY-5E5*tR&P;=9aF~MO>>bD224dzs~1$SJcUg0AOQ@ThgyTV7* zN^_YZYE{XbA7UJz1ZSn=lj8@4LlfgPLou5A-aQ2wD?e*?O3d4EO#v zt?5?AYeo4D^YBG55~!HN&b6`ZR0HfBa$C1F(ZCeFe=v3$wI*RjLG{{0>`^Yin0v5H<(Rp;^wI*x+bUjd5ZMl7NKFbw7#fSxDXUy9q)9#w?8|w|9q2&29VQn1 zTnFU!u^?wykMTfmJ6IQ$S^b2lVX=wn^}<0j#NlE>?SHk80RbyyJQ1sD>xn)_>|~6Q zZQaQ{S(#WUL(!FV=(-`6u1c7$Q(q3i0EnA3YHQg>ur9rupi)io{uX#mBm$8 zDvzr1bX0|E=rFY{mZ?X>OdYxZ^ht@$>r&I?D{xU)WcBP*-OM0wl z`6SFvW04g~<56@VUGEFj&5^O~vHW!F@YZw<^WVww(-)djYUOk)P)dlSpbocEV#|=8 z=VK|T!^5dOp3>^@U=1CncEmE(rNa+miykzo=cGnjMdd3Z#8E(pm+>SJL{IV&6wu+p zBpy2{b-2G`4mG#LQqv4~vV(O6b9oX)n$nlqd>}PP5oLwQ%K1B8nWd+0ts&(sjZp{O$^5AeP66!aNd#6Pl)`o_V?jgc#fGXN=*er}${H6L>mGvJ-gR z+?kFWuS$+!-5N{CeLg}?N>xQStPKi&S<-yD;zWBKGkT;V;3f zj6=iDSQ?BN8nCb+`MqbsyB?7h36&O-7-v2Z$ZGYqh>Z|uKHyJ{MGMu|m)fK7*hNto zuDQdg5X&gNWGNlDR(j)#URLKMZ2>zX6(@_=itM$iyHmE_7AZHOPoC_1dH+3+iM_l` zxY@lrIJon%xcyVgaR(9$Xzr$ok!3%HD)*M zXnL}`E9-mON03#el_fE^0^OocQa8?NKo8uR6)15Vh4pGUk`HcZ?o@HWpLl? zMVV}~QlXAe3@(tJ;rw7W?4Y2Y>{=i@qgm-46x368MtkTTDkF1t zs8C0C#$wr#*hI#DL+lR3qxsB6Eml;Bp)Kx3c-=fP2r5|f>n;6rAgjdPSTXa zD%Rm?cM6^|($G|q@a)HB!R=?nlYjo>rU>v9)YF;qp+yr$H_s(;Y{CFB@Z!9N~vu0r|D-DE#Lj9{-Kacg$KvagmZ)GxTrb3;bbz3Yu z(HaPOGvud>A-CVSJqrv4IC4|C(!;70U@4QHWfkl2bbBmMaZ;3#{u%4iK2cKS*FEli zA45USlaUm8dS~B)*%{7e4m6e@=ICR?kPc^&9>osb&v*_*6?0_gjs>$bk`+569PEtr zV2AE!&d!L-&YiLB#A%?+)}~|m?$xQQUwj%UxIT4L`1%)><7X)&4dh>=-WAJJoCeBh z6*h*&PH^wk?L$6}l2>6=hM%8|G?2Fn+aJr$<23U*bz*Wnckcta!!7K7(s>f!ds8yl zBI9hwf^5D?2A43|H43d}T@@>OVW>DXSSXGa$k0q+M&GaqBePy@Ml6?ME8JiQK*;P@ z5tK?3X(G(XHnNdf!sI z=L72e_K;oa7nMLsP6Lm}*5|!cpSs$p!hU;BEsN827_!489-M1S_|VZR13Din%CdHR2_w5wRa zQ9HU#*XN1|ii1(3z$&TXKHEoT=&~oXCBMurM)e#yJseBf5t7sKdxV3N6G5S@ijO~z zV{Kwt&T$0cU)CJa|_; z3hwYzkm8vR!n-2c$z@u|s$H0V&VfJPh~0rnPu`D3L#q#UnGM#rE6^2OrVF#VmF zIvf)7J{X6Ie$zSkf`|QKM+_FDIu0>MV~Lrk9zZiWft^b_c>H9juP@SgA7W}PnP^h%`EZ&Cd6B z9TB^eNIS9rq(_&bs&J2>NX85si7}Q`G;zid=!&3{Et~)gXQ4O}WuvhKw|v;`pC0O6 zj;Ji~DNgH8#R6frC(2s$vb@Mf#^Lr7{orp#EAj#x$%lHgqMQ@CbMbHRV z|JXRdNjd?3G+LV2!0rGw>g0H2tM=RNkKw_G*}j^$u6oG1ca?fq!)f8S$8s>uIG{I> zG#0pfU8DIiemWdGCg)_Cb_4bOcaWPgTf?M2_e`^ zCEWL+bbfoFpbw1Z0?K#lek!)^d#LV{r;hL5RfOSIvFO`yW*~Hxsb1ZHLk&@@6h?}> z$0F73YDHJwLVO^?*F7-X9R=L$K@N)3u_(wLN(mF${cU}D&SZ@B@LhpUiZ+ssyA%~9Mt#5qCQEe zkKFImN_3zacGu-|lI9JYsC9u(i2Dc6nyO1e4SorPd1+b@>s31SD$nX6iCj{f_p2lO zrw7v2Ll^&G2kw2baM`em6KkH<;eM($S8(xK$1{RD2iOc>!`eSRsP4u zd(qEzz&;cU)-t=Mb0fm|3H3yZMzy+Xr3riU!D0w$zjxEuuEDDwZg&rX8@E?HJ=;P1 za4g#UNp_Djv?mwXzBTxT(d{)1yrnTGah{usU<0qP>ZSQx*?-N0yr7<&Tm=XHBeCce zHs}iDY@`t^8cs=NY>Z&id*Gn2@!1gQtl~rsZt&)$Ley#w)@D|ALv1Q$T^QUGwF0_Y z5#R^PTLZeerpryATu?HrZWe!`WFBj72f65aI;5S6C2g2UJ9+5f*y!MHuXoUcwVARY zRmeF7n{nZ10skmns241EE_=2NzDpjgo1K2&qjaazkMdO7XDF6fY}gXauA$%j%Xev^ zmG+FfO0ktDmti!s9Uj~jsx)S*)_#Jn3Un8X?pDLlF5oXbIYvp`a%7>DKI!sZ@@kKH zmgT^QNfO6n9PZD?!eFjWLXxcLy1;fnpgEdBDRMVUlDb(Szfg>HAaqTrlLhklc%XFt zUKUR0k#i_O4v#trl;zgb;Y^I>jP31OTSXUIy5#H?LE{=yMZiRlm$T^HLUC7=kX)1W zL_cFa(s_)z=cSoA#WL2TmJVOjv3$WlU9QAVjp`-OmU3@U?>L52&dkE>gX<`~e>OK* zIekv4+@W*Ed!%`9L59z>g4V*BD6KHBYUkkFigvsdNnq=JtW)%;OYAzmPNHM2{t7a$ zpv)QQa_Dw8(REy}%6;-O8bo)%Q)nM{Veq=ryJg;Z7?OZ_v6QPw%#$0HtmG<6&O*<; zwpr*ma3*#FSJkw)H9o2NhU>?v=r85D(oP=;nDxoxOwVpH~4 z`kBc_t}NNwn?Hkpf7 zoTo-93OuZlr@Ja+Ky0Y9a10|_9_pYE%NWn$d<{?4CA_mY)V#yY|3x)&={Gs(e;<+U za=yaX5{&*n>`DdX#S$e*(lVo}sja53RXiz!_ue}BYU{e``ef_sKr4{Na&&t1auSP= zQ@ys-K88Q=c8OL%kXbs(3JC7SAYo$ImD z2Z_@zbY-c%-v`QEIWWN7qzu44tL4df8BUGEyu+8T_BG^Scj1bcrFNb3)xLpSy}H_K zlzmI>Rs4zc4rwb}qAn;F>yYcK9J#(?J>WmFq_sc9pJ1Z}A+H-47-wCIsTdo0?T>xA zYCoj{iH;5CDqmU;_Ro-j6ZVghbYZaJO|KC-hB7x-jS)0DV12t^jl?wtJIEeVN*FOYLP2LjR+c)av}K(@m?D?jE$G z_6iaPMQle;vFjfgm|#OjB=M6T@yo1a9^*&(89&UyU9gXB1UKUxxopPwv!p%2j@^f4 zRBkV3CwtGrISTAi+#yrR-Htgvu2{1j$v4}%<1AA`JJ9X=SOFdfRmOpQiMbjtf+}zg zTRM-zeM-t4O8GPzQd@*U<W zW;&AJNjV8-iypD1_89&obrN$Ka%2AGPV#(&b>QBfZqCAgYp3=ulw>Z)1@a99pWXCS za}`4AJWN2!iqUDa+vH*vQOat2Lp86AYZ979)>NvgJ6OYQZ;hIxHJ#k?f^tT=Dm|dm zvlb?2SNa`NKjC>Ze!>3F1W{qJ~^-IuTMjpqJ*UK_nZ+(mpHz`u5| zCp3S?!Ar0cYzCX(;mBoof^V^;J(aEE2h~(wdJ)JBeDeV-2=asNv9mLWuQ`y%Nw}O8 zb7CbYDlNABsH-`BPN`#hfVlydBUs4fq&dtVTQDO;3DYgCOd3^p)$t}i(Op$sx~zA@ z1lfj*?AkwM&h}faa&{08=yLduf~Rt>#KlOJLpRd{T2Mtu;GGmyq)N4Qt-`;fN`wxz1T&>OvJ;?&Oiq z_puVn{p(h4Zzp0(zGW)lxSPJAf*0e_lcpY9L^Tb?JL9`xY00Qt+^7gIhOSQR5H!YGmepO0oX>MKyglxImeHRqBSDn{ zSHrbWbL6te-QQ+Odycyt8wp=SNjBo>jfB^bfOER>DhGfdY`77weU&5Ef?=~xFXiq& zefmV?jO)if*uJ#hEbFKIuz$n>AP5^Sf@^=nk!xYFx%N*sEqB{HZvSL6l5n>81|;n@ z3I?IWvu|xJN3H<$_)(6ACwuJtBnP4P{)w#~_hBRrj~!_?POcg-aE3wEL`|t*D76~m zoT$`kd)VEwT!H(ts4Kc}KcF_@HN_P%1$go}$slY9@gBlH)!r-T*@adm zx!VVu2F{FY7Z`x#VRvC7{8lfezDSgXmr|d>#mJ=;-FP#WQm=+ zsj>Us_c%BR3Ot-F*Zz_tm(AQ8ENM@jeSET>vz!n+$`~djc?x2jF-rS5>ufrRyr@S*S*VW>yR`e!0$Q=AK*H$1Gr_6CO*QJny z@^T{{Xv<5Kn!cF>g)J&Ka8x}A7;ckm*Ky=pn5ewfy744Y7S@dia4}Lh(v3GmH&(*6 zBHifKDp_>}n+;x{Yj>i!1<7gh11?@SZXUq=7M8oD6Y!bRcm?@1wS={l-V~9=(~|FE zEt5QI+oJyz2OB{S;rqGv4vt*5=$~gvduqw&k8Ou>3>^}&KHUff2=f^0>v6fJiW?Vl zO--$|%2KY?@NUtk9C3VvyuZL0CkInA9k(sTc@Mt0YiU)cXLCxOiogfR)SRZk7#7Az zY7V;Bw#kulP_f&YQyDhPCJjtQD^-~Luv)nj=l@4)>uU7pI0Pct%5ZgE`%vbs+(V;( z0S`>j=r3}hu*LfG990hjhWF~)=QwgLOswB(js6Bv7S`ym;bNplryFmEM*ms3R;1Cr zS|uyoV6(xkcI}T)9H&ONv{CW{E?%Q=aA&*r7oMV~yPHfIbLg5cqqyEeg*YheQRR_oOBL|Is;%D5P*Q|ZQ=p;O-% zt`+H2uU5$_FW78w8D5i6TrX`BXtv}BT)a+QHPBFv(hS?uW4m)fVgCg2Z_SNYx(Pi! z`bpLbTr=X2b081$1t;RQk8$L(`Ff5e?Wsoxm>$((dLN-raV{Ln6h^yq`0HxJg=BGc z+RGf&1o6Tdc`)v)(%BO3YJc&OdTYXXVAhW;)G8e5-zivvOsIJ|q; z{)8jf!W#Om)@Q5wBlOwd5!F%lY;@zz&}Uo2wIY4y)hb!t1e*;G$ZJ1eXtO0hAfV5Z zliJ25)(f)uq>gdPQj9E)amiB=@84>V;$oaViDw>R*^_vW+hJa78IuSV#jyxM%sX|| zsnt=iH1tV1)AS#i$s)p0+ z*!`HkP-@`2&YdSawIh&#+B7Pqn^#08#33joqiS2p{Kly}%p0rrVIzUPFtb48(3}I> zI&4(aQ9U1OH<$C8E%JzxbN0$_mKy=uak%6jGpgMKOsMny1Wm@1_1bak3RT0p;z!}M zhQp`1%sR2$v21l<5O%4#7DsnMo>8)IO_{5mE6l)o%3PttG!UkII?Rb-RNOKYcz2q? zfe*OYg|+gs`^0(+-xYN%q1iF1DRX62!htce4ea0t&T@lJakhyctE?xLQ2aUk?6-fm zv^svRG1PKt8m=(tuHIp`z2?RlRW&dyOTIftFE!WD@v%m0wsfBMZ#uZL76(z3ChVSO zX8}n^c~@Ikq`Jhel;#yf#vU1*`=H8roSnhFu$sO#uNkE}Y#HmFqnDZevRHS2_Mzp@ zE8q&_XG?by^_hLl-Vx=kB|~X4HAlIUIEyPQ$+3q-h+sdB7Zc5v0beE5nQ&mn>}$a# z*6xmZP4I@*DM~WDx6~yK98)#RM#o&Iwv6Z!wubJ6il{vWK{3}dW3H&@2XBNjo9n6m zI!MCToSSvv>6mNkVx!uEuUE1%!|%&rD{gLr*Bn)=lqwRL+yf>y$-u!fYafi*z$+ZA z%x0AH9eJ6#mR@C)yh|tq0=1^nnr*_Zsx5RNm0hrQ)h?;bi&cDjJW12|=ePE;}E&e0X-R*2;+X4Q7@bQLkY z0h5qCW3JaP;I!iTlB`taI{raMmXasnj=5T&717TgYoS}~AZio)ZT*D*;xep=8MRx> zGLBW2(SlZY1Ivs;@A)Cucb*?1g)I_}`Rw_8bO$wxKZm^HALSE}LmP&iZ zTp~5*Ihf%UlP%v~GP$`I(0i_DD!4`&&F=>Z34V8jHo2xtucC>Ezet@5(=vzc2s2{I|9KOEHEmr{D?-E~nr|3a+PMkb*n~ zcTjK}1xG2kn}P=@xR(Nnf@umg3RDVyiGn96Fe!M3f?uQHS19-d1;0hX?@;isDfoQ~ zevg7bq~JeO@TU}fgMz=H;D1o?6AFGr!KIfW_y>xurPwM8uBPBh3U*L%69uCb3{h}^ zf;%ZVPQft>9--ht3KR-vD43%_r{LWbJWas|DEP+|e1w8ur{Gf*{0j=cK*7JE;AIN_ zfPz;k_$me8q2OB-e2;>^q~PZi{FH*eB?vB~U?TBx%HGP{kdz&?Rn>BZvHFcXcbDK4Bn>BBnHEo+UE8=Lcc8!|z8P=5T8a3lH zE%_>HxbMo}gkt&&`ETW)SX${)>fB5#t)&>#N>@{iX{8+$V_IpHVoWO?pcvCi$0^3N z(jydOT1lZ8(@Jv`V_NCm6k}TH0~BLg=_3?lTIo|1V_NA86k}THWr{Ja^eV-eR{9Rb zm{$58#h6z5ImMV(>Z5MXw9-b3F|BkR#h6ywNin9C_E3yzr9%{BTIm$Um{vMVF{YJf zDaN$Y;}m0B>Ae(VTB$=ZrjN-?IDo~IboN}r<`(@I~Y7}H8$p%~Lj-=rARN`Foq7F{YI+A*I5! z(i(~}t@JjEF|D+nVoWQIP>gA%{S;$bX^LV@D?Lmxrj=-cY-uGHV_J#U^Gqw%DAqF9 z_-AS~P@8LT#FI^HX?AE`p*gve&YGk6uUP3Y<;Bcyc3Q2wlRuX9^3X*$^~ykrE1jpZ zOdA8`V`-%sw3gc(F3Y}iiP=wfVC4IUmPV^^Sf-9y73NP^pe{dXU;iM`y{B^$Q(t)H zz$Dt9&sYz17Y_c*i+)K@+)(POHlT(L|(}I(^Hgh)$YJbH_s(lZC z9E(@`sEpq?giA^OZk#99Xg-~@X1lo?n6nsc0Ns#NbiBng@TClA+a~XAz^+`y4Q?5d zE(lz0DRQ{bWSqLDl|<+0R@yULAi%xx0Jmx0x73rtZsP}=%L?qZDZt*90M^^m!!j2u znG4B~_whsCn-%2iQb4}78!|o_C5p-D?&n8$IxBR!6zB%K(OHhH^W;`J8RKL87#mq( zygmiS{fQX2VGmH5#WsaTvvo;J#{7PM%RG$O>9&TCyeP07rqMDP z^7H(Ve={q{+fqQ@m)y+o8fRO@^uYT?e!Tx7E4(*mj~8<(?9o1k4S6HEeZR?%_m8u} zds7O$cPF>6)s1b$oW1$S{Lp`x74(}^K))jyy4BQr6J5E7%3iaYds5Ypq?t^rwxQ!wOafcKh~dQg|(OhYtnv> z^NM#cKa|{UH>}~FXRSrjOy*gGiv)H!KbQ>mR(`NMvI0A_IA8^Qr#%_$1V7jVS%Dp1 zG_XCyxWo_kk*vUuEE?F+BQ1TYDAzil!v}ES5d_8_JzfI-7k;R( zWCis=3aAk~GlWiJKt)1K$dkM58~j*b&kF0o6j%qkCs1Ow7r6h;5AGLPfg4W&ES>cxADNa(yR1wx_bfHkkrj#F$yB3p$-4BcCbOr|FWL@k9Jje>E$pM^ZqI zu;|09b+N~c;Pd?GK9?1`qbbmhbPFl_Oe3?p?fshOzw*QUN>(tBrGQyTfSD|&|C1l# zpJ#>eo)icpv<=LflCdpW&prHKf~1)Y|5GWjMYNt$Rp;^~q{#@k@*{j(RtS%$Ko~Ju zC4|Y~#`wXFWCiX-3UI~l&SzTKIU*re*Z?ghg*+hsP$+=l^J$_5{1qr-!{df@v8KfbSLh3{+%d=UoHp+2eTx?rgxN$=4qf5Z>^Z?Xa{W&^sS zi8F?9p`}ZXF2YMkL#hZkh?v|{S8e2;`K&tDr`X7fN}FtF$h{!(&*#CY0oe+Q4-= zv21#uKis@my(fg8eI^o#TzobYdijMPhW|hC@(Ukq@z-5!@kg82E_1v1Rgc>5Y+omR`c4DP~lqV4%f2)^c`|NE7yb?pirzB>T1{r?A;fMgrCbw z&xK(ePM;3*wQ?yG3Wvi_W~JzxLlk|7;HmMg!{o8@^mtSKr63PLNC4LOI{;PuU4Z<1 z;Q#yJ|NG(p2LM$^Hbtq-VqfuNE&e3`V4Z)6kMWQ2r}#(D9f1a(sM|Eqye2EPSlSG} z@|fY3L;S=1A%OaEg{}ay^9Wgv=W<(&kP|Dzg0%8&cOgotC$Vh4FtboI|_t&+eTpl zN1qm|e#~NNdA<#sl^4&H2LnjmG}lV*U{a%v(R+;xo^;c$R;g zhG|~K^i8&y-m%5>O(-VXF#RNATCNItH*&}4Nh?%MRnB5#xN zv_;w-CZy?~qFDP+8rD9fV(nI2tbNoLYq#2B?QMv)9agFcl>!4gPX?jN2sKb3T(tzc z4Fv3Ry;c*#g^~~k9apXjVGzGHt^#T(EL6gm>YQ9-!&Jwy`=Fe-uq;-@aGr$H zxiGiOma8RBCdgw!tLG7UHC~W))S+GvgQ*fOb8Mv+u8H9+!5Bj^#)VX+b-bAlw&9kB zsL%OB6qt0jRCb2}QAe9cYOGY?bo&tW_%z@wGe12x%1n%pp@mYb%BQ1IvC371e5AtF zqH>i3%SgGw0IgNHT#eb}fQo=>#0nG7#3G8VfyN+Jvd!y7A)mu~&@t6WG2PP)7BJw5 zetpxGd>d8k?}L4FAB7h=5)76<&@>rq1oY(MLZ-~sSWwXH6#;#639x}!=#RwBLZ|r# ziU3Bc0xK&YGay5Iep0GxozX{;|BL426=1~FF^ZixI%20_!p?*?x|#6`n7DgE;b_2u zqq{X683+pI2JlG(rnFio^;#LNmP$y$;cK8p@pZo=zIepf>?AWXqN8SKXD7lIfNKik zc0>Ti5y1M3!X$#Nmuk^X0mMxdB#{XBMQJai+$fa_g^V@@%CPksFG?`y;ACK{YJSs# zu*0PS!?Fh4Xg72;T%=@kFdd@E2|FT3ktrZSrpF?qqQvPa@)9dKsEq=JNetS_lp8cD zByk2DsJA2dwuym;C?-1oE(P)dM<6!|$LK(w94)azSzcfzm~4W1-8s+%Vrw&&@xRA_ z0S0Es@I{zSD_=BVM6E_Ja3fQR!c|KSa+zh^pIleq$8%@YQ@yd>hdB-?7FVeWN5;IqdSZ^ zD(=)I^-Bf>sZ|sNnXBm78R-r?#*R_cJm?=aBOoqS+;mGph9=xlgMwMbjT36jRjwE{ z#*R_cJmiR)vXyESaik*WfTdEOk%$y=qvFa=IH|Rb!pWw#j=z9q)WeQAeAbFXWeDUd zH~_m)Vv49VwqYT#JB?^ls7Lvhfx^@}3bHJ9bQGQKj{8h~qcrx2BYxUtcs*ML`*(V5 zd9TWKEu5B2typkmmf=cGa2ewF3|KPDaBD3cPucI)kQFvEU5?a8w$i_Cz?xc@N-FGUTU{M}Gu<(v9sJr11i7X-DE!lsWO&QT zt#PZ03}ambD%8gj%VQl8XZ#|<*n-{}iiRf~(NJ?h157NCe&;&&df0Zv(wc>0s6AkM zRpB)oM+mhCjJ09Xg1t4=)=@ZnMJTlPoMM!5#3(MZWagEb-k2cg#BEOMz$22Uujr#l zmQ6KJ*)1wbX%!9hq&|xnpXr!5?H3c;>v|t3+!05(jV9$71>)p?`S3-N%$ATx|2`)u;$H#hAf1l zxltKeb;ZV+gn@&!=O@+Y*co`Pb5S5}R&10KMZ81oBqQ-)umcTwVkgPOU9p301dbhS zlwv2*8FtXK9t?KeT=bN7`rWZZ-28!K2RlZwlk6Bf0dZEp56Np*~!fuOKsUD(m2t|pcHnE?;%;Pb$-qc7$R zbcmf)P;v(v@}!-Vhupz70>=(EN@-`%5jz|)WYiU6O%bOefoUz$lm$b#YYT%^GN%}` z=F)0Vz0N4@7_l_%*UE7-Ih1B8o`$->Q$P|LJ7TqdG%RR*hIlgCKUxhFp3HJOFg)p! zde{+97j5Y&AW3AELnqqk$S8%hry6d|GRU{**^Pd533S>KC$?5IGZ>Tvf`%;o)h?e0 zJtPpeVdSkqtY&PKa@Lz1v12cR;N1Z6(}p39Z#2#V44H7G)zGMibjgIJKsZZjmg4D2 zM?5)EQ9$x%uub~dQIS#hXwMB8GE1I-s7RMPXFA4CG8h|ZFp~7aV@aS6I!U*~4n7aq z2EvX}+Ie%w*y#@nJN-Ve)9-;Dd>%M<`Zer4<%k_82^84ebTHCBJJsZiK?0fQr&u{>^s$X$bcjFSs1oq#7{sHNS}p`IAUiXEuW=@ z>9O$2T6nS!-cQ_5VpuoDfGrHprV(U2RSdX zL>PwkN}Fsh2eHBxvH=9ceg#IzSD}tg7}*K(W__0_XuUA79(fwB?}klJb;iq5v-$x0 zOC{D>M{HuKbY>P1$Prw!h*U(bF0c-;duA%U6~~by$YdG7Dq`1wPvtSeCW~lQAHO;X z9d$%#A0l+5V8x&@q|w5C*Wxn+p!By6*_}pGF||Yoc+9as@526+#7Y6;x3|R{n=L^g zJA}joX`9E`*si~zOB}8YQa77X))_LYr#vH6GB`ZQGbgJMe1E2Y&;s=B*d<2m5(pmB zB?B5rjrLAM4IMFCPKY@O04T1<9dZ4=h-(!RE?lZt3M>Tx;#OZxbl*jL#gJZ6#6zzP z7}qMbb^X;x`h+9WNhrj4IvF2k`r`@4;O0ij#nogXB1#2_AT9~8(<6EN-U-Zs01~w++a&+}3F}W2D)G=pLoh zNk^2;Af1lQF{9JtW}+;x`}?r1jjeBP3ONY$3#-j1mNNjj0 zHXM};7PdZ;FEg;m$AAa@j*fyi8&S~3Hz|Zuju6fwgrg%CHRkxKLLI=1rK0d(d>|SJ zC}lA^oCNry?a||ha;#BYt3P$9LU|9dNELF(qy{0)NFS3xA>|uE3TwD{wp=U0z#`J_Q?Q&cOc=t-SqEa%6rcGMkA2 zmBUg=Y7j&~Bo-S?;@|P~q=n26LvR>t44u<%=&(OS$>1QmLlJY%5ivW+0cgoFWM9(g z{Gx@|4@lozFm;UB$i#nWSzT{`qT?<{afc%OpgKx%IO~W*+zO}TP$#g1?3LLjR(7N! z`V3rWy7?+04R>IZ{k?5l#GXQ=EsQMc=&Fe#q(>0A+9uJ&piA-+yIEuK4kKbL90L)~ zOswB7M&l4XGQh6>)S(`rq|)J6=;)^%0U@y`!X#`%LJrcwQEc7zU3~)VSc3Q(-14XG z@WWj=v7{YbN0sW9k;R)4b+~mHJ>&koK23q0cLbK~HbP*7hVxqNn_&Ry?*o8t!4bN3 zq{(?D_zZM~H;gnQs2^tk;5dMtbPVLts7q`GyaPC>(_^-y8dAp})Pn(L^=?GDt3&SF ztK{7cI>P52agZfAz!gZ;1)8rb6&du84jRWqca|yptd?qQRw&_aL$mO@O%wZ?Un#{5 z8t|f5Fm?wj=qU2-Sn}!`MbM%nf`$-5M&p^#Nu&g8fFO=u&?FdxdBT0TL%i{L9N~~yBvk8BwvpV274@-sV312A;T2U#$$IQyd^TQtskqJpflgs zq0>Zfw;iBRuQ)=zh)~b08l)0#sD`-f+!iP4Y7=@L#U0{Cta;R;BIkNH3EQbnTHgA>O-n++v*a*_(clfx+8!@HqERWrkP!SP8J}OR;>=9 z#BG#ooKXVQ_)`aSiptq5{w@V}!x2~|>>BrtFk=hiLKlOouxh>v@#gWE1=5iI&@is% zyE@#O55YIwdh_^g3hgtF(5@ow&J$=CI~?C4 z#OPouKBRL8epuSfF*#GgmcejK2kT+V_a3d&PQTSprwxH( zuFYB_!PFia!@mr-I_*>guFd@f}I54%P^^@X^b;KF*?JBOKy}Ha%UlB;$8kc9l z(DREk`?s0cfE|(C>-I$>#yslj7}NGk6LNCIm`5)uzOoj49c^9*B9YjKG-D}$m_LHL z=M*H^JPghYSmo0nHIIywjAx2CIQ87Xh{GHNWjR0QoK>*){ zBmYS8dHh2XqH44NyZpZ!?rJH+Ucf|nuo?~+2Qi09AP`$Mp(=*a@>jCzfnx&d4dAC6fO%eaH53S=1MGlu?A)~ ztBu2}-w_SN@9r4G*BiLal#%Tg)Q<{Bi<$9s{IuE3pmCCvd7FnJQyhewG;dJ&O=P%= z9z9$&dP+*1C z#440i{8ZI&_z@pCRK?U!K~+Ue6@L;hA61hN-vmxeNWfRhWJ_Xh%P3-=njBvaMLsK9$PKTvxM8ysG3@Joc+>QqBCq2N$9L3GU5Vi)X zn=d!7FR_(E9U^ZqQS=^UL#wo!$9SQ@m*D?e1`-%zo@kWhA4h~dLh*7P5CFxNiOfz| z$P9wU-3hJuVQ9E{lYz=0?3?Paw;4X8e!QOLw6uq(nh$W05)nv~c;3OEr_&6Cu8=HF zt>RC>2RKUKr<#3S1?fzA2lwpi?||e{-qENY+=KBJN0|cgz#|@v8jYglaPuy17qU0j zGQc?;yLv$7z(`&^I?bkz!lneI^4Iolt>NqJ)zv&67qO2F;x*KmXhn0 z(cxNA7-fZRes%W3%1m-(cV}{PKQla3Uz}hs&5e)C^i4>VgKye>u`l#|C_=vq!w>bq z`#+o-jt#^T>W2lkrrz$44-O4zw`CbyrRKCrenjb~Aw9ZxC2){oQwr<^e(-7Goo5K- zcnAOK&z0YRr>)u^Hov$uqJEG*!M}YKe3p{?FA3q7U-+vzwtRU?`2$%kC!{GMm)|#5>7T`0phOr7da7)`9R8?kv zNDKD7uhyheS|cPQnGgd3n^+hLV*p7Qa#(H)IWA0dwpa$Q59iMqER6%<_-X4)RS^{8 zp6e@7rH=K@l2{Pk-$T_ZhMIsX^REbv#H&GtySx119zMgf2^A{7r zAgSO#op6-jlz`|jg961{J?p4v9f7Y7RB6vTGI;o+J?lsj7{OadnlI{`9=<5_c@{qp zl`a>53rfw^S^NV0vU6{q01qGaTDiM76P>#^_4El}GJM9?y_q2HO-Bc(GEo9gCvjz9 za6EYTieCYs4F1j}@pn3VJXIH=+DKSwM03cZ0~GeS`*VTbQv5T5(BfT(!HM}ha4i@A zLb-#TQttS1Yo>@>GvT-zp!OLfwS~MkQKHWDF5lM3=>h1yPuJ!fp{m)nDOg>bOSiw~ zT$}l`1A~Rx!Q57Ic|w>T*&Iv{WCoX}wl8hP=Em0N#?R-($;r~z%E-u$I+^S1+_gCn zk0ttt+g+QghI&XZw-Vw20rI?Y%1XybC7tz*Qd zIsFYf%!;PK$zEP@TtQPbsx5a=ls=C5Y|-z@9Ooi3}vTsUbjZe8Ftj zsuOe9Z@}k#eq$t_7#cl0%1n`^15+QYA0jR|zepjK+wcKyRtb|$_-%#OZ)*r#5t4|9 zjCC?lrkC29RF0rPN4jz{j&XFrWx`oJ)o$*fFnH(Xr>QRu5^8`5a34g~0pIRTH}=Ag zMu3+6_|?(V2nVTRFhK=eZZK))#k?m0deelu(nyY=!u2906TfZyX3ix9&Puj~PoB}1 zMdAQ8V-G7R;sdYnpLG()<|LmCKt~CKl}Hi?+>!X5$v=fS=NwUbb%}I({Q* zhRw=#Dp`7n3JQgGD41*l1_4ui<7O%*@Dw1fwW7FhZJutjWuc@j|Js2@4w%e{o0+U2 z)p)xak%hppbWo%3j86VjVQFh!+a z&T>*0AZ)X>?q8;HS8#@OjfLa5?Y>`yI0(+=6I>bIw0jYb2Z!meZJQoAfsNuBSQgGW zjknk901nApu?KlY$nt?Za~PJ7dvo0pqh)uE=_afbs$C3K|N^>un=LHe(6 z+*{&8bZH&P&9GKuW0F_~wXe;X)V}ySb{tNOyt2!xaL5B3Fyuvt%4k^z2#2E&1QDi$ z%3w+^U_Mvkvs=xwp##-v1FKm|C@Q|jx6Bj4F-uO}gCOTp%0Af%+M{JE2m*_&;Ktt(!j zF*Ii8HN#w6ao?%KM!j!A#D?_T%jhoDBWHW=Wxt+%O_-qN({nHP+{-=pa$8t+&%KPo z!SJuoY*bnF9aQYOmyOu+aNG6V%di38xOmWWFM~DHb1xfMh+KlyG45tCSuWOfpPqXe zT-^2>wJ2I&-Ca99_cDzM?75dY$>{vG^%VEq%Y4thZ11V=xtBqr_x0S%s$K)F=iom- zkd+JbOsMBxCJ|*l_p%HLdkr38s_VPo9cgIHGTqka+QGY*wP@(5M>KTD!S!1Z^-kla z-Gl3sod?%zr|-?Z<7&fqY@_S@NpyX}DSe0XQ32z!A>*e^gQir3@N&hWebuWHn^hF$iTHe>~=nquqc?z-9l}c^BT(=!j+S`a%H11HN8F|pN|d4 z(gSCc^VPxGk&#QqA*sO6@w=1d8M$_e?v(B(xIP&lO7trWWX9DG$S0!THV4D@)AO=QJz^>>vg+HWuV4fLx8?2rXem&4Kj*u)=Q-}bnBnPNXS<(he1zL zo7bs(lG;NzYW#w;yPl->mO4F24LKUgB(x`~P1}RCjW=pst~mpaq8c&VjAo>7dKl@Q zPWk5U!MPZ<=iTRg{hiPGv@^x$e$DtD+c{sH%=wZYb3R?4!nCJ24d^gT_+V2uB#?xu zllz3v)P{Msm-IK=gZU1f?!61TP<#r9g--XdQ_3Cx)4hJL>E1HtRSJ((a-Mits*W7e(LfBm2jU}@cQ63vA4;0qVPj9BD(hI}6 zxy%w<9$wC+DzhbVdRofSDOcxvsgr}LM5=u+b#gG77}Rc?r+fCiuFe=OlRnqF2Q~F0 zIRTSGYWo6{ahl+{?zvWXRCh7}2WwN<#>A?*&BDtg`Wyr;8bdljn~ee_CW7QfGn{H^ zZooQGv=5K99a{TDZ%#8Y+a|2@FnwQ*yS72q47uWP<Xxx6v%9bvtHx(=2RiH&hQz_ji+X;*o?0}`t$S(_Tsu9r zh-@5o*fpYYwNXO!)S``(!4^|JwFs_k$vls?*DvG*(qPpKY0|7$h;A|~7k%^8|9@&x zn|^-KWBS>#BV!F640NXI?#M`W?#M{dgD>X()%YD3M@GMgBZJt444g)d6Z+x{fQ~jt z2F&c;9T}tzNODfvFgr5(eL6BOXpW3uhAtGhaagD$13RVM@#DyNgsfYqBH?A?s+fZm z&|$K6lMiS2V3HNCiD5RpxIn!ZzUyl=^I7biKbOUCKvlELqGfeiH2+93tNV28yqk3% zVntTOh`Qe6Dr4a0^&CvhjsTV%pSNf%pt;ve8|hVR}$Gg5W6Z@jyK(^Xnp>3 zk3Qp>HtHc=%9%%VKW6Ec>7bSuufFOkm7*Q8t6S*G2dVa1NK|Gc>awj%20%P3ft&;f zM}2Fn$}|)rH8?zwh{p$Fs=v$RnW4vdsJR~0Dm2fNVIJHkR9PkY6L3I0k?hybh(W`W z6-Djg%I0PU0)%QJoGVun6-H5*MBU5*4UkyMLLs9hOW}fH&fS%0MY&+0vpmV!MJHK`Ap=%5x&(^Mam@Lqw7@~g|JmP^-^gEN? zV`?l@6B(9~s;%OSfB}Os^9Wg$0mFd27{(V3hCz*03Zs`~{8=%Ix0%`nc4mw@-=b#A3=R#)e3&Xm6m(^@XlKUt$t+q)n?i}K z>tTEv?e-OzGrch-NevbI^gDe_HDNXB!T22ttKTw91vmRyRudcHEXl z6OnkQ=5>OJYv%QH#_!mY|9#*-)OPe@1RWs`I3kN=r*0L05db$({Tsn+sBhiX>ce;_ z^_!FnVcVC_J-Ty;uc1-f-++%5KZ2;Hq>i6g?)V|~Fd_ALc$^$zA2!muva6Vqh<8P8 zC%FFNe(m=J0^E~1s;LI4MUEC|yRAH`S2;=MYH*GTRCq=U zD8+~LpZXPj<(ob*M4i%GXcYTwP9YomBK_-njsaG>XzHUHII6vE*n6y_NqY(>lQ=`^ zeh7E_m$iN<#vKh|C6>c$;8gA`p<+uX^=O5j%z_c6E9C?I!~H#(wO$z=t`&t*R@mlO zXD_VGBu934CMWkZ!$bAO3HH)l+abvc@r=@|kr~y6V0d$8nzJT;cv16ifOH@m;^J!_)FfIM8@jJG3ekahmw&@sg zrq4(p1egui zws|7zUP&A0B6h>yB(wlk&BXmo8*zW=fM%c=z8MNVqs7iD+@hrdQvwh5&{`6OPg#j9 zm7^gVzDQ^3uk~(f!?Wu#JRP#(MPv^;j`b|Z-|>9w6o1#n)~V(_gfBGtuW|+z{m(!@ z46Jc4VGaExbCo%4#6Iw|PqF`u#vkv7j}^}&HXMQe_ZrFsA}dSzKx5viRY4T?J+qo6~Z?i%>6J+HU#MYO&bqp zv=e>uYJFZq=YQ}(XNOc@M5?EFH&T5w0z}`B77h{$-N2z4GH^plFr}#omcIvN$bA=E zP4I~!jj6A;+d%YHO=YnB{qX7o7tw=SPIalQ>oO@py~pJvuj~06GwMKJeEw*q!h0emyoSTNbNeEvP1uM$C*$6qQPHH3~HRt z!TFrls15ZP8Ox3d(~6M8E9!tLd5v)Af_e84omk_EVt$S@Z}T8)4ZLQ~vjvmMf(zP5 z{M+Z25`2$g~mo#ljck|FYio1vYYIDMt1P}tsnczSQY1qsW7B^w@T$tto zF>dy-z-dScV&jhnij;BRh`x$wc1vG0dzJePM?3>nw)?j&XKI+=M)>F{b^8kOd7r`x zhl0aNu(=wZ0qa1f_N$?ykk3V>Y7|ZdFJ;->mLa_ZcEk!9s6WH$vG%}u_ZHmsMeMA$ z9f%dA9YN-FtSW;~J$s5M%khw+!SqSReKVO8=7pK1mHp{>T9}rn%eCsp==8vJS&pa2 z`NjPBVs*Vznp#iJrB+M%)#cTV1iQkQ!;whDKn3n?ZOyFb%Nu*y$&`40B_3aznBGYz zCN5oAjh|hQ%`64p7V)4P{N_E)Y2EX!4xL>*RQu{(PjezOtN;3XnsckRhvq_XNA>hH zr-Rn%X-WB`G90Py)p)mEJp^qfYAqS36i|hFt6#V9 zX$0|)9t2@!#cSPzAjxVcr5qC@LX;t6+R=>8zPfDV;JY8V&b)_NsoJ4Kk5H>8i}eu} z1Bc$So=ZhzGL@y(Xj(s2HM}0b-nU=+7*sX;B0t^6Xl2S!0mm0At2=M&V{KpxAi}H2y_trhRp(K z^8vyEabr}v#six2pkD4i!URB6S=RxJ>%lz8%#KwiCVkmuSA$rb)&Q~d0}sTZLyk7 z^w+bAl+3QCO0$XK>c-^UcCIqAJuU1AxkP$9H@Sk1!ru#ZcJ;h4J36zsvAP(l=E@g} z`HA6puDs>_Ri}@JEMHwuOvu^E8Gbz>D_>em??CVNH!cjvxV5vT>7ppCCx*8+me4zv z+Rm2KcrPT(ukn@T)m(piswyu}#uM`sGuw;BLVU3}lUg0$E$7G1$5)aYlPhaEY&)Oj9V$~F7AVWZMAwnJvOtqe4#ppI9X5Z zRyS5tv9&~L3wy&(Eyi+Fa|5$`!?9fD!hU`<9^#=}Vm3Jqh%Ifc@5Rf2uu`r(5o1?} z>$BzIdUmo@-&h*nW)UyRnVs1^1m{A1W9ls2OT|dTq4t(LYdA5yGYiIAJU&cnTe0f67uU^=^R2+TlV*`z|%h7k+V zA?pUQI$lEx9|>zqgg$t7H4aFv4o;U#TWiV1Z8mYCuKdmeLtm(`B~pBL75J(m3ma?c zeWWMAX-I}j*rU=WG_TEbLHY#>g+rtX2*xJnIUN|z20BHFgmiA z-q{}=NM9HYtyLz^@0F+GD>JK8+pCk4D-)UBd1h$lLUxtEFqoU15q3tUO?E9g#cV9> zO`M;uOwI7g^!ed>IJH&a+=xTVS1{`h`L%=yB)D!&%`*rIvK~!B!xBu+5_|`J z9rPjH8cX-Ms?l&}cL=`ZzRc#N%r;x9lVCa; z^QR#c)?XBis>!yOszQD?-gmkJ`RZttlzZibQklfh(D0#Li51GYKCOMPE<=Le%BEtf2*GNjVq#Qf|#LZzU^Qm*9Dx&1zo{Ya^F9z~UZ=SiDUu@5x=!;RNN?RogXFFI z+P&lC`)p#)`)IT|RfcMOk|~9T`5DoEt|4=Mpit2ikcEP(=#^I0w#j*u_91evLFLqF z>pqzLd1K7D;fHD(5Xj8Y+GfzrnMLfvvY!ZBqPg`i8b1R0QflHB7#Dz|3Wv#4l-1OX zVy9ZZDpoi(HwsO&gTacaIGASPzH!Bo*ptnwuJ6g_gHx0}+5C)Qx22tI)(r7K z@G!(Xo}IqYVyBxtsju8*LqDA675%1$*ROft75%#A3C=kS;!Mt3+z@{y6P$yy-Bsrv zSerf5y=S^p=QEIln-KP%%pK%B%B^QT)BSnfbni(WI$Q2J4ElNwgDdmi^rVh&qx2s= zjHix`(m9K5b?`$^hr3}}reuU16~)~{R_hJ3CMn6|8`>kh7;Fp2Ri zSP&#JU>$r(*5|99gb9AJS`aJU^yVPFEgH7e zC0y(xTy}=AD__2Tb;rp%`FjnHlU)~InQ?Mn+4jw_z81OdzJp;VuP$jQQMZ{YD?uj4 z8YlS_A(#omLFB1h!h>wm6uPGew($rilZot=C$STl2v;?q0PVb( z_e*OOyCTsm9z%e5GkmEtYBTHWE7KX)IcLuR?{3a%qNbh!P67kXblNk(9j9GpM44r( zvhT%TkYvvQHw1~ky4u^$y6s{*&@;f5uqYx=4q~EYXWhQW#>uXWJp){eFF7#M=o#RY z_xgGUI7J1aHnYAC$N<+|>In~*ddG_u?=XAZjfWV$0d{K*GIWOwqii5*6+a3Kt%iMC zx4}Lw*bGIhh1F`t9a?@5Q@{HVJz;tZz%2e4uISPoTKHAvjwuD@5#==bmY(2MztfgU z56*^B&WCv(kBWKp+_lE0=wUSUWEsdnC)TAL*D7LdSgPQ!ZXV0kB?%8gP#>k6H_|)k zHEyMw*TYe{HLxz^R`YmX%++f`NseqnCObF`I^Sv@xj?q(YFX{bQFrO)(E?ZDB(^3> z(8N*LQ^vtg*K!qp+@O3Z1I=&2&ye~PQmDeOn`&Y%g9i)XQ~2Ux=$f?GYM$5>#aczI zafXNIu5R8W!?^&JdO5R;PU05aIR;7gglZ-ymdo&}3{Bpn+~G=OSD2jH5n#sv2s>Hk z@bOLR3)+nvB@WjMG9_-CE49vD(+ok1I_>A-=5cOU0CbVOptREA=HWb-trwuZV>_%w zTq)2l$ClyF(VE2OI0UNIXdV+P)p`v*e{kwHBm-<7uGco1p;q%=^Med0NureDVfDPk zNq}bTX0Fz1-YnK@_AT6Jd17gzxC<26Jf^g3^L_IJ%gfDMu>Ue3i3jwQ0G?L!rV?8z z)Y$?g@dJl`t9gw8-MbZzl@O(TCeOjC&w2QaK(KrS&JW!b5I;x3RIEzerm)-Mk2H^= zuOg%0f<}O*Zpzoo)r>}WfK+lr0Fsj`Yzc?$W^xBGTaj_-^;=b$tLMecZW+nx7C7ui zl(~%YO+q1Xn#8ss3krGOoXHC^n=K(AYA>&&{6JWxc_Y9h0~3&SCTRC2wPps_QREh! z_jEg6!FOP%cujHbVuN`Y@f##|2gY0Z2^4yqtj1u@L!iTwPzJ2c-SSBDSe2`SM`@D- zZiIyz_{fcTC(Ax}I%buSgSMVW38#q8__aW2FKI(g_IXIBHku706X+BhPKhEj)8? zf`5YF;HUW=p6B1ozn%Xm{~`V}{Kxn&@t>;%(=Sg3RKLIM{VypN8_`?>zqWt(B^5X>TQiUhi!ymRdt^9b3{CGk6u}yxwsQmaS z`Eeth>k98&1Ao{etNd6cKYmg9@e%R^kAH<~cqA-a#6vUT2Ogx!7V(5Y_<^SevSeR2 z{J{OvEK&aO164CyZ(fJMs4(y^^DpsV=l`1jXa3v85JdSDufyUFEZ%^{gIGL(MI4I= z7H`JlO<0`6VhW2jELO1Ku*hN|VIgAi-B>(_MH7q5So|;+@5kc9So|0kKaa)FVezY2 zdM=1#o}cwUc%yUu=p!1{t1h3VQ~~Vp?Cy~+p)M6i<4M{v4~;8U~vYE(^$-4F^R=0 z7Ry-Vv0$-SMC)=Mi$B4i$b7|@u=pb^?gAbnJXpLFuWrL)0Sjcs;yf0!SiB1hSio>ERao$1uXJdd5{ zL71gM7^Oj&q(K;@L71aK7^6X$qCps1|jy# zgwPv=$S)HD2mAn)UM7UyAVhtc5OjkO^JPNF04dPmWkSFWLcEs=;Wh}-UM2+FAjEo^ z5Ne}{M0%MJXrqY4d6^JqqliR#nGob|m%o1J^E%Pj15iL{3 zE23rg@rr1fci|P$GA+C!TINUbifEai#Vev^K7m(6%X|*6h?e;>UJ)(xGF}la^EY@! zw9G%@711(BQEU?}b30xUEprmDh?a@r711(h@QP@e8N4D|W)-i9mdWE4(K46tifEbd z!YiU>z7Ma6mic#hMYPP1;}y{|{~51{miZODB3kCZ;uX;{U%@M)W&S5#5iRrgcty0# zRj3AtmbnS9h?cnBlRgWk&FdXqhx#5iRo!UJ)&WTVfO~^HX?5v<$gI zORxA%7ifEZ{;XR^d$Q98tc=)`cWylrLGI$cUqGiYx(K2{W zu%cz~Bp*e~;87xqmcf%1hQKfO=vbZZ^{WU`@)$3 zn9|A}oFUVC%8bEyN2v$%2$*M;vtmh`ijk^su-w#YA2qdjlzx@Gbi&j=I69;ndRA_; zwxvF~stHHlzhbI1prg1W>jFks&ZI+uS=Hj`Cuei%Rthc%-5` zqO=ty6CjxPFnFFN1CvGB?iRT()S`+*E+WY_Jz?QLfb8~4c|`UQ++O@UG%H-PBQ+1J zuBNM-*P`746Xfai#60?Z%+D4*7@<+|421z}*N{I|8m4f;TkK_*38wKtJQT`!IC6LjX@Z19(!ZVt6je zX5|j-qyB+?I4EG>*afgpy8sI#iq2NW@dVCwEb9*4 zMgP!k1O;8V3+UqQ&?!M95%8dL?lA87hp`qEj1P1Hq*Qd%9hl_i)43@f5tz^KN%FrC%XXojQcP{!X-6a&;#Dj_=oq` zgM#ks*d^}RvC`a~D7I%_B+tYB~oK-2yvhX2t&=pP9R zbfyc?2ONhP!WweoHg1@7o$mjpe?UJQ6rhnV06pss=tU{hW^`}6*R{kfok9qa7O2nyUMy8zeU*n05nynkS4g97%ahQ ztc|9{V4HA#H(aO-c@Bd;JXQ_9=pWSI4hqz>U4UxinL+3{0w{|RBjoNZ`|FaGdIa}j{89g)ekdqVXSx8@CZZ3P)>#jW;1m9#`=y|uJJ$tt{q00b zB8^GZt@kp`m;HnJyFr0D+Xa|W7ckw)^l$t__*X$eIM)S)Hqr*dn%rSKdb4k9=Ll2{ z#M()B0h`U}33z@w5~(|cC;dYh4hq8gE+DiqRuMvX;Li95?sQPVEp!1~teyGPs9}(! z?jWxE2XQ$l5YKl3qFs~@`r=W78l3Ti?$BQH4{aqVXcxPH)`nWS_<)D2=llEv*9Z!@ zr7nO=v{S1fi$epkIFpFQJb?Uh|3LoxpnzNs2*?~O;=ZEcWX!`u`78c`{A5r-u5VKDZV$yddy`|v&EAH=nwKzybP5bgF} z5)dViF|7LsPznmbw{!uZ&CV`?$&-vxj7T7bu!*_^dl8vz&SOx2z(35*pkTh(16^$6fwlf9!&Xv`~&@spnztB0Xi?Sn>A(+G6`?0vIrI(;RGlKHX^!n z>ha^gEuUjhH4w`u+Xc{eD;nr97DR@tc&unV?jOceR|aG8Cm|6C-QZvC0?cH)z*Ukl z5HP)#ZpQrsdNx2n-xfTe9w9v$|A4+FKtR6~JfI$vQ@9*8_mm!;JVZ{vrKzfRH|PP4Lv~;d}j4|B(K1fRN5~ z1F5Sj^$@)O*FT)!3=qz0H*mV@QqM4m+fMj4j7~t+D=>_VM#J25-9YL(q8=J1>L1Q0 z0)+Ep-N5NOqDe37Xxcxd69Gc{*=`_p9Z?UdoAVFnvjM{Sa?KmGRBj~W^$kKLSE}bR!*&6aU7xT?sdg$2|7xx8X|c^v9+StbN!IaTgL*dd F{{U>5NC^M{ literal 0 HcmV?d00001 diff --git a/it/doctrees/federation_endpoint.doctree b/it/doctrees/federation_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..80c6b7263302ec4bc3efc4d63568ad32fedb2091 GIT binary patch literal 51389 zcmeHw3zXc}d7k(tmk)`eL`l|bL`ovLB4&2EFOs4jtKB8FBDthUN}?!JL+lK8f#K}T zcrdd|O4f-|#|dO3>9IVH>%>-LH+Iy-K8_owjoX~Gv8vQ=PSQGcQ>Sr{6T52MCQXyH zNl)y?>G%J5U0?tV7R1JOPISb(cYuqF`+fKS|NGyI`*?ZX2mZ+yuH*mA>-C1J)vn~_ za=BJ7D|*M=Sgx1a3relkd4Ff$4|ZPa>@_zv}y)zrRVbb{KZSfzOTRhA^iLB*I)ifN8NC-qi!Q*S zTYIE_cZW)4u5ZXFLaU>0(Pw3|Pj0oE+HAW82vp=XT3JW&%nhZgtn0Xl__~_BV8u3; z+YRr>tX#U>ROUF%rYj58!+Jv|s2dwiMOT`ON~djZXvy>RL`UsYcdBd5O+}X`{95m@ zvkO=C0)eg9>_5e_GN;wFmR7In`KI3Lm}{$AP3at8*PaFFTlDs<-qKp2uwE0=y6l6! zJM;P6J7=5k%%L6*AI_<*g=$}4E|)tp+blfX=g_wXcg3gH@onqwcGLc4kp~C|z?yms zs8VkO`M2ZWo%nY*{@nwr*3Z?O3o@0JUe-}}tM|6m`_ut-kGfagcYHlE*xwGxz+64s z?8r_w^hm$($Qt#2bq!EIV96DbJxRz)s#3ZvX{CDYojGkmo>zb|pD*Bl{-qbD>cx`Q zELD}_d{a?sMSfsGZeGsoi}OUp;U%ryQV-`2jJRy9<7Y)a9=+DQEh-~9TO(INSf7Um z636B0n5z$rbj&sFrq(h0lOvUXh4)k6>S>~ z?74QUrRCSuZ%yv?I*Ib7M4ji|y z4_?c=scHRB@Ne#P@RCNFeaKsZuUSGVj<16M@)fsXlSSOS&zvqUC@mT7wR}w+>^=)} zh?L>{px*|WH#vMr%?32vdYQnDdw+Mc;TFcLRP`YKs zmX?Rysqv4_>HY-yghn!p_IhKimL7AS+Pt===M^P^;Q$lL8 zFVcarFcY)cHA+oI;K06|r>A`ibkJd9+3$5g-V+IOjy1*uxqG52YYX~mxrx3fyzS+K zX2ij40`-5pz<`7fGv0{Kwe?1U5jz<(vb#H(Co5CSWhlIm4qdw<=_&{5I;%7_xvIUu zZHk_jEq^Wnvfd_=h2a6=eF9f@DvPVGR3256>8J{n&|zwKBva1^nR?=xb7vHG^HS3! zWD(%#7LlXMQmbjdNg&8hViDv|;;}QHjvcXJ4mI~Cr)C`H(&i?u1PNKhQA38=<|c|7 zf0ApaMl6^^&3%#7ECi*-GDkK!D{Pf^i9%$V8=I>z<7B56jZ;W!kH3s<)cuhhUJ7z( zRe|2XcwmY~%rcc?9svQnRiw?59_w9#gxP5r5!|(P$`XhO~5af{w!o@o)!o>qs(i1%NnmpE=x_}si;wo z9X1(aT7e4tc0O?1BjTZ?M2Ih)uA4x+if(CRfNPbT)d({#k3i4#%%Zv9sCJrZM!hPH;gM&LCiCc6jCmj&GPo)_->wf?4)6M##hA~A) zAOj+FN01b$9y*FH^}F{*d5J8Mgc)_ zhfyWn9*P~54hS0L-rsHCr^4XAr$w0zvr?vxPz)}UouT|-HtZmyp6m=sgR$&T9+|U4 znL6woSROkxvYrh)aYOWu>wi(f@H%_;~W$>CAZY zEcKyCo-T&UQ%063Xoqg>k|WUyxp!S|{5B}@$a9?hcoyhzBqyO>vow~K1wuvv{pz;Q zV?8VoS)%3k?e$9AUvBPKV1yDdgE#q81ixCrf{W)i{xV|6V0-+b$B`w z$y1aRWn_QGx~xx_6p6OSy)Q82w>%k1k!N=vS~fdF+4w+X`Jn_lHU#N#I_Y8T(EW^k zAS#$6I}b0Lo#Cw58BV~?a1VCqe&*~9yX-s?$xf67%B*iXmhbMJy7on|K>q%zn?lep z%12}=BMT(gtfdQG73q@(}sS$O3u2u<=NCULeos?CI&r z+*9Xs$J!YEq~#^TcT<|MMRT>C8DvWhntzEIysbjJQLW2my>MXQz+houtUwdZB%T9~ z8DTWbw>c-5N|-ua7D@8`RyUQRTLFpPEG|+MwaJCs65qrZ64FP7waW?wu*V} zm?00*_SdnPZ?Z|3R9!`qZn|U1+56h`Ag^%t`=oxSopS`aQ(8jYP>++qHSw0f2d{-%Yx2b4n#~sT|@_DuHn~ zQCHEw`=lR@B%P;1Ow9}p9+HL!4@kl=H(4&FrEB?ma~?B@s~SEz7U%+|Jr|IEcwnGN ze-0huUxR2B3Ihl7^#5RSbfAEhcXXSsFAg9W7z}F#HY+vv-2$0`%bv^@MVVcR;yH49 zERwP(NKPkDN)yvlexaO~Uw8ql+~oG$oL0g_PlaY+gSdiLMw>Y}QW!i?7#b)Hj*Jf+ zIyi8spw9=?dVP68!jd0>2k(kU!NVd2DcIzC!ox@iiq`G}rb|58Xr}bUj|_K%9<*$TKx2Pe^B{PM$t7eRO(a{KE99 znd#+J=z)O(DsgZa;ExRq3=V}<=#AwnY%>=9XpjhA7NrT58-CZLVi^@3S{8?eCn8zk z3FK4LljCPS;7YqGRh27w{H-@+{3%qGdAaI(fm1VubLY<$9>MyVhwu-xl^5?D8b9?! z{zNekDaWUhkujKn{J_B25dEE+ITjG}b(kC`i&N*^3m*3895Gml;yA<{k0fS^G=Mxg ziI*u&oH`TG^%ZLG159mWADPDw17Fv>?|9sm9PY@3uT()D4o^gKNGsz!4m|-|$x``! zVrzja(I;q~@8WlfG+L0&%YA9Zm~Ro(BShNi@iQJ>t$H21C1^@(j$2~1CFQ0(*OKUp zRHwOc5@t9{1H)l+G}hpjfZhJ-p&oTaWtnerYJVmY2+uvyj$s)RX^;oU@^!lx`Ds|O zg!whJ0?=LXN2_oKhQe@dvXTdCmM-S)>h>`9ocGu3)ehKGkzjeX5rNGb=UOV8P=U_x z6+m}765X>Tlc%i7XJ{*WV{~Q&4Wsvufdj0hld!EuyD4K)B+aLhrYA#dwa>19G!Fu1 z`)c00>LE`&s?@s}P7Oa9$-yjhKwluKEpW%WM)G6H>2T&TIV;PobyjCv@~l>+)rNlK zb+c>s-EpN6X-we7OCS~p2|S7t4=nX6nnTc;NP-R$K~saH_FyfR^OBv%P9=Ga3>BJ6 zsc=p@Gc_Si<&j2$qcAWyC{3f65P-c_!F>Ux^VCn)C@KJ#?FUfVTi$;64YR_@k3rNb__vmog2ZoA`AsU6y(ZvfHvD<>D z>JnD@Q&Jx~|8)<7lS*h!a zRKYd{(vmVO$<=vU^{OuD0f}5wSrW~W{nG>K+M#QIu><$%NVwdrV#S(gbrQeT@)caX z*76L$%>lNSP_gz;532hy`r2OVziygS||CBgJY2jH`j0NFM@@r=;T zO!+!p!^T>zHl`AHNv_zV1Zw)}!F=4Yv)BAy2keDNu-3F|S~nt1p01xxQK^=ymK&IF zJ~$9S+UMOA>eYYM!|jeCB*yJ!Pw#fnJ{O7h8Is*ojP}ej>$ie!VsyI?gU!=;&p2T#uvds|Mp1q8aKMqB)2q@MZ;O8gn#C0!ak6xIW}U6Zgal-CDzpPDT-1i7GOR@p560?9nqTm`x2 zayq14j3jM{NIP?MVr*papr;-5;^tgQQp&VB1$$ihS-?L^7tn$Y&Sh^dgK)`%b-$zc zJ#u#n{d|%_3lqg+vklG!vr8yW{}L`Ox6t0Cu3}`NX$LX#Y=;I%1BHgCYKCDFx{gE_tPgpJnam!;+NXH4gWeB4O}WCjm*;bY0@n4_JPr?!d!>_p6~_Q+~GYdInTPy=bZOi^O=H*ZO{tMHr7Qo3rqFp zWo&mvqh6XKai1T36+P?{U&kjU??rAQd8<$iByKV{z{0b;>+Hv>u2a`jQ@R&7*I_IM zA1%FG<}Fh;%v@Q^9pycjc=t97^!Dic&Sqhim)2f)UD$qM4nbhP@*>ixJ1bY{4>t8w z_f*;x#nzx)=1sIk!+cY2sAADZX-hbK2*$=~G=}uXPvs`3o<22minmWwz@3uQ@G*YA zO}CN8S6$o9w2!;Mel!8F_Yw>j%|-zu1KT`Xt(Ptr-_fqOMApwAUv=GeQm((hkY7@& zRq1lAzEpE|JM(I{zyEL!GihpA_XryHT$qiV8#pTs7t_@rM&$rrVpT+X$z z*Il*MtYfdhdF&C_s^@d3mse;^2+g~@xNe?pSFz7%v5JM)f+TtJzlrV?u_xAoaNB&} z_gqD=_Ek&>m$P?V)}dPnxY@6ckR5Q?8cUHQL?So$RbQzKv}AHjY;V=c|fMlHnZj=Etg>!&w2? z9~NE}yH~08ePll6*E=LWypd@h5ni__mXwT;T*51vUgOJ>7%q3;tx>l;Tv1fD5 zegfNq;ek9Wvd@%N9wz~0*JQi72Aq2G^#txf7ygFq#gqKDc)7Ig1r?0!#rZ7|0|)%y zRWGX7?fzJG7p=P8&HFZJ>ro~)z78gl21y+ib=7?aTbzkLule!`CC3gP`hF1Ome#04 zVb6{C_va{bmLhhaus%1}B&`hT5$-1qp>7byx1gE4iMi0}wfbAmmgS8mX-A{pM7Kw? zy8e6N*6s)?iAPnP1#c%1?cVBh<6inDP9IN_EvS?=H*9MF*~=l~jl_ui#N*S)fzhJ*^4Eam^$m2Z>MYO znQ!WWV+(tjYsg{K>!{W-K*0kM=*Z&vH(rOeEYSw~O^xhw86V8KrGV{)0pDZIhM}pT z=m1-`cn>n=u?@&KS#cQL#df`_-Z$24BeQU4yN82GSxLnt!e$3X>X z(!5b6+8D~JT@4aoZ`!6%6RlJ0ih_*;A)ucfPeK3CK5KZQ@-ab3?GXuI*M^&-{{Fuc zTN>5Ea^rm=p2p9@jIpQTx3#+y(B_!MyL%Aq+1O7fx0#=Gtn`# z6%1(Y?J*^GRQ8sLTJS`97bGj8zTSnT+_R|&Z6?Mh$c0-e7tJduy*;hY4U_sTSLcq< zL;l8$$`GYo6e z`v1XR|CgTf^+4=i|2Vp~`*Rp0qYhQD4=;SU#@FG6b`4#)91h9!eLmiA58+w8d&-8+ zFeC>*zQLl_guXfJB>i{{GRos>_AzH=eDz#FmkzxO9)febHTdQ#SF3x*$E`6l9!3a( z=E>wG)L3w|48sV7+|j_*<3gui<@E7Z)ovUqYgV@NE5%_vj4XYE7gE4}EQ3mPolC2p zqSd8)WDF;w3F7WOxz~hAwdO5IWz9a|%$k2uX`#QUIN#KSgftQ+j9K|6p1AWtI*K^` zVv&Z&-4$o<+zazI3`>YvFGxn^w34-F zJ!DS7onp9$-tybQkh;p;hIx*3C~wg|4|m4g;#}b~Z)ePnItC@spT|MN+cEpaIyiU^ z-@fTYL7Y4Lv|Po}gYK|C&oh}ZH_g+a48|3j9sIz=R~qSFXyC_Y>rI#-P`iwuefH0G zvx;9^TlG?rPWPp|c;h-0t$DR$-Z)pUw`!QdA>2H^%G^p5ZEEd>;uZP;fTP~bZTKv& zHL!q!4>Z=1MK+2A}wJO)<+t?ceY?pEP@@fsm+kuZN^=28zB4e!@M(Z%4iYj3} zY&Ry%5F1*#h+&;M?Mg>oZ*Ifv!FtiVgiIh)Tg&Z*2DYKFW8U(_1LR>-h?p zt?5+t-lc}Fw9EA(4uwXl8=x~-V1nH|urZGPBufYsZc*a{*eI_ehM#C#5n6X+m2!il z53DNY7T}>lEuQX!C$`!tt;5^sr0Sh?j2qsA&o(qA2o+2jmQmxIamcg#6B4?e^a_Gg zn}-}$wFR(t@`gR;wuaL1i~!-;LRV&G6rXg%bhl8!Wj)`xiUZ+PC;1zV9IZvvy&A=-Vpn8cu3VL?oMzRz*xI2)J50}Nu zWJ?+8obSsWh|R(*j!V{CS5X92QCfJ(%_XF|TvQfhty;v{>ohWn@)_oKd$J$owK`{6 zwO7nFN^P-&Zz(j7gRBWu7}7|i(a?`p(K?Qk(QOZ&CeEj!t4G!S>IEDay`-w@tLnSd zPpPk|Z>pbDzpQ?tZQkg6hT0122z5HjTRrMK&|1A<`p;QbmrUWzVD(j`cF*eVsGkZw zidB8H`!X#W{BoP{%{c`Sj`^ek37QX6p|9x`8hNTvFS$Z)yP})x$pGNEcf0Aj*x|-Y z*3Au+mvv{a`gQed>Yu8AtbRxRc4afZ5mq)*a4Q8jQ*a*zyC^t7L4krtC^$mF2@0ku zc$R{vDVU?6M1f90gMybSc!`1^rQkgj`~(Fbq~K>L_-P70OTlL-_*Dvig@WIt;MXbm zT?)QJ!8a**i-JF=;Lj*njqf3qzoyvr6x%|<9TeO~!9EJ^r(l$VAqplac$9+E6r7~s zA_W&Hs8BFZ!4d^63Vw)!AEe-Y6woJ_%4-z-Bn3Z5!Rr+K5(U3V!J8C(o`T<^;NMa3 zH445;!5>lZ-zoS@3jTtE^=lBUpHHOu-lh$0(Sj;2Z@{QXo_C zJOwohE>rL#1y?9AD0nvoAE4k>3O+``KcwK(6nv6`U#8%56nv3_U!&l+DfkZ*e1n4D zqu@^{_@5N~6$Rg-ppQgz0|mEGa1#ahQg9CigB0W`c$k6*DL78S;}o2y;3*0e3T7!_ zH;tXJ50b;yLC`igkt|y$RK0|mzh5`hKQ+|v7%a*Li?P8XY_RwmEV>4Zt-&H|u(%p5 zss@Xx!6Is~cp5C428*S^B5ANV8Z3$ii=n|HXt4MhEP4iuoxvh!u(%m4Y6gp$!6Ig` zco{5O28)%!B4w~R87xW$i;=-1WU%-cEII~@jlm*gu(%j3Dh7**!6IU?co-}i28)Hk zB4MyN7%U0~i-Ex+U~u&tT=fQ5yTMg%aCIA8)dp9y!BuQ<^%`8Y23M=WRcdf`8eEkI zSEIpIXmIrz6{@;d+UjjoSzl9s2ZraH>bKQDx2(=;QeL(?*HetG&K(qEtFw<{Y;{H{ z##U#7Vr+FzQ;e<7MT)W2sZflq&JxAg>iiJJ*y_BGVr+F@qZnJApQ9LConN9DTb(y4 z##ZOID8^RjYZPOv^G6h8tMiu>W2>{C)R?W#4vMkW$x)20jzlrGI)^F7R_7SS*y^04 z7+W2gVr+G46l1INBE{J17!+fx^8t#n)%h63*y?^jIGYS6l1G1NHMlL4^xb-&T)#d)j3ZwwmJ&M*y=PX z##ZMCD8^RDq!?SB4^fP*&L=3wR_7Ne##ZNFQH-t5Z%~Y_&VQyDTb)0k7+anHLov2G ztH@}u)!9ZdwmP>{jIGXIim}xhp%`18$0){D=M=@*>b#v|Y;|ZDhpi6xaNFiq(IKN| z*4$dsXf_2rQ#8HS6>`0ube1b3Ua``_{elCxFk7#>J{~8%DR9wEy~&s3Cg-jE(2c(Q z(SvHXsLOV9FfaSgb!Hzr2D~JSdO({o2dfI_2^i2Z+%Q2)rEvZIK=8F;u@zyMzv zzL1VSiS7s1!J-$^ia2 z6FMvg!bv&&IC5)}VJ4dq%6P;#~13kW6pp|Jn z;ljk}@Z{wyo#S`W7|}ApJ{kko8W6I3f9Pjijfbozhpc1;`R){uALxe6hmXgj`+LdJ z{Xkaeaw*UacB8X4z~NI2<1v0XImQoVh4G#g7{_BV2G0eL$NW!|WB!G#Fz-r%IZRP` zV=L=)N(|Eor+~*p{`bit|3+4jcc*~-P<%BDCw9l<{U6Ek{y|oF@68@BoDGas@_Fg; zc-L-B+{ms%(q%QWQEktCDeyiXU%%n!ZO22uD>?Mrvx0tq3g{2VL$|8hIx{;S@WJGO zN3sIECk5bM=F2*W+CBg~9`c#wkWXa=d2b5HJlU~j#tYH@4ggxkH*Wi zb?_}oHhuE8j>C=z{=>+K*&~_JI^=4@IJN=Q*QC z8;|v$C&&8FvckGQ1=i>mO2isC(>Wgcmy<*PQdZEV6wpT_tJyvCI3DO9CkOh6Spm(b z0Qy*OpyJWX@t`+uO6+>AL()uKuR;pYkxEQ+lH8M(C9iJG5e8dx-ISl7sz` ztiTSh7}$~cn*HhIU_Y7_*pU?jI~ou6SCWJM7g>QFT_LbIzc(K2SCWJMk6D2oO9A#s zh;M=ICwcA5$?@tbO zcUDjjr+}KkhoVz`e~}#O|IP~PV=179jLgvN4#j`UYCP5( zHYawVwjyaJ4%9>nto_{%6rC&<53WBsxII~cn@j;N#2$s8`5F&*GCADwtl&y zT{;JxcAZ@skNElIh@Z;}@zE5BLuT3t=Z?l>ypkMaJ1dOGQefQQU8~k{qVe!vO%Ctx zX9e%^6!7+S!^26U@z_3@9NRz63fpuFY$0uC_ram@P=75s)Hkw%`a}w-Av5~;G|+f- zzn2`{f5{5n@f7HWyM@$$f@eI;ZzYHMf3t#lA_dGs49s|hH*HDm?rcZWOx&H5DG-KO z8%*(z$Cgiy?SZVY&7{BMzr&53nX%cZT zW<0j<99tnPZ0EDWb~zr~iR9R( zv%>alR@n4-Y;(!6m9oNiAqBQDABN`MN_6C9Jj9oiLwqSKh|i^fnD1`*oD(eL0scgC zfFH~X;M-FG3|ZL~I0X+g_N;>}aU^9t=FcX_{F$sUUrd2n>aJA#9LjinznL80uV;nt z`7H7Em>coUL&j`Xf5x-8;a=z2EP5zx&+>?)~ugp&x(xtLykb>jtx>YR$_F?di$+mLtZiUj!{*5);gr9s#>FFD9zrBxVfFux3z{@ zbTZgf)t3U#t3%eE&NXf1;+u-a;)@q6Bd@&uC-Lv6UwQjSdg`VZd+M;Y;ev9RN*$2; zojsDu+SrmILc6DKHRok(L~geYZNAe61QL0@Rx=@WO%oRpA8N`=c5HL4)AD}I z%hgMUvcPGEFE2HYm@S#0Zf+ThsTj*juVZa$%XNC9r;ez*)%DhJ#ia?qHVSt3;Hp_7 zuzJ(^Q>iHnT2pIldebZ#X1ix?XlPBPcWS6J574)moq4mZwLziY^rdy#2YYuFi-ot& z8*eS39*!I-sO_c3$Vj13cxc`zJu)KbTaUZ`r-t~peRrqj{Ibadgo9vBy#-XMw}JdS z@b51CyBq)R0aY6pbYn>-S*fs|x>tRDN4-}qtNYab>iwrSB7*~+hzzXj=Z&5$vY|&t zeUGeH?^D+U^#itE0ofY~Syff4mn5yKH{V*&mgKqujKyLJ|MM@iG^1Clno(^imAauQ z%?dxTBpa8C=5n2gII^PE+Uk+Q!AX~mA%51+#~ZFSZ=1?k&eqEf5H{kWfyS|1J?r{| zlRayF$IyD#XnJInncS>tHQCl`>$=gN`eu_@eG(Ng>o7YKRT1j*k+s0e+gA&7R12M^ zC;7m7FqB%Qp|snIAzhBGgfnh6KRkf?(B=h@Xm=71;Q!8)lsj~V*F4L;R z^tMQ*S0b6-MrNXq>4%7Ev!&IN)Sd2+hgqEvs_n6QAd=OXr&EzQ?26`NaKhEy-2n#O zf&^h7atV8fL)eZ;!afj5*p5iT9$^EaDanjgDM1>_q)5u*9#6&D2tUpB8A;kL0n)sp z1Z%(Uvi4DjwHqT@`*CGDykE+cJ(8V?vr*$l4nGbr=V~0$UE9-6xym%P%g_$t%hPU zc`|zS8j;slHPfSx`t<^aDupFQZng_;y)e&=NrEwD#ObtlT4(ajxaSh}ayp_gq>I$D zTYN+fTN~T5QCGb2A^P!Ia8@}xd;FMmV&*uFP}(i?NU5Z^l%`fIHkEeCY$+HS*%u_} zT2raEr3D3A1g+7V(paTjw8t7W7!;kXwOQ9{RZ0iJoIy(9nmb^@0FL|D2d|}U>RP{o z@y%TVFSSSvSbpE_$z(s!z31jCOG;Zt2Q6O{=)LE`2C*n1^fWVFzf?ZSLy zxcB!OEms(?7S%tr9=`@g0)h#4UKh(wJ;2Thw{|NtO$>3b!qr=sT@VhkFTko;Op*KzEtAt^yAXeqaHOYD=S60j#g9Gmx~%2j)u`+36lu9 z(`c6#G?<$bERl}ux^bmqUuZPy^@=+Ms>q$TsvDSdC?=X!tF{m#Y^YI}WZB1!d%>gO zMWHrpBak4c5KE42Q(!@6j~9>WhT>5)$gEV6nhc6`a5~DSY;moSq4+p(E*I(PKm$4? zm{@hW0^~ihAQ!mBcpYslJ?IVT&KY+`u5deDqGoK2|y@9;4oVTOznF`Kqa^fBTj zV@CG&C-Zb=X0;4O3n}Q@6H8YuOxJnE(By`8l{*nLD_g-_LS)_UCkyKVzVdurIjL-} z`cipR9nVHpNJ7EX-dLvI9A@g|GZ)S&Jg&=3lP`-9N4NMnT3l%xPDwt3oFq0u!6Y6# zN3*fx7fev|`t;Nsg}HRN$*MuVERv`p!|ZSqM@=xvHB;jkOi*)gEHz7Et+CCKL(Upo zr9FNnvdxXdRg`gZQu~clL~4(}oNd&7u^e6ub7)tA*}?)~hEB{jmHs?J3U;fXHd}k_ zvV0omq_N2grST|wEL-af$R>1bUo1cUHoP;xi1F|2@e5a4N@nA9K9Ea@qo579Q)0=G z%JZ=lwBg}Y9#2_qcu+#Y)c#ne`fT_yEYX7|{gTqmYN&i!gg6S=@G43IK~$2Dpnwez zCh^$GXv6)232N?-rKS~bWXBpB#`2_!G^DTccpx)J5qX8kD)<{+mD5wR^2+wH=A;#t zisbA|>(O^ITO*9Z@6JF*V|jc&%p);4V;Fkok*AwMh_Rdfj4^&H#YdBqz_U?`lfdKV z(QMp!A_>KMAeNA)eT1A->YCZM7bw!}lHq$QZdv0-hYWvO9~I8+V(7L<#KUQc@aNzO zBWO4fOG7(`223nSf1h0Ssz;&A410@wZo%$qCNc^sio1*|na)z|m~_zBg53Lio%JFeArt@4C4HGmzupF2C=%bclIvNM^N-9bhJb!T#b-Jv{kXNNKs zx-%Wij=}>O=MAyj5l$Nzm5JS7&7lXnwPfEd_%S|Erb;-`h&(dt#QBKm3!_HRl zbSMK)Iaz2DBs}_YS#aAK@#G)>xG4fW1?_ZhJb9M-a4b(RM(R^emMCn8cJ=9z-wL^R zU2cLlDD}#7lKyxW=twLlk)vj5Ixh=^j6&_J-#$+dut1cDzis6*YNkv@%X%=DooEY$ zXLIDIk0H0+xGf6|1vqk3xZ1-a1z5_ZW!c#Zo*s(jDNc)WvOm*()+b7f{I1?Q)33Sax8eEclsWP$v1)HlTP6lZ~QnuSec zvJ+f8b=#1SqvTl_<>BWiCky1w!j8tWbCpIu=jUdR7oK{y@OTHSpLCwY_uiB?Y|-Xy zv4d=-MH?=$Ww%}Gv>LixGfM}{2ggd~=@M-;lX%lNc7)NkUSmP7Rahv~M$;GSTYXesu^v7E9}_H5{lgQ}A<(-?B*_&ChKEJ+(ZDJCg+>aGm`icQtOWqU^-L_+ z?;)-oBub&tY1U-{0Q**7O}cLrQb{b8ARbcr7)7ej=81-U=~uW_;|hG%vx@G&w3|;ngw&K^>wGdC}>Ep4Kog_Uy{-ktlb|$Elb@}R59BY$1 z3kzBm8$A`;feqqHS`B^X*koz!U}?Nu8k;;?K76QrxMbEt&3a>PNx~T)9}nIYkAg@1 z6l5q}aSPi!G|&0le~L3IC5xmBxV5)JuoQfv?oRdwhLW_M2W{mkQ&P6BL3ZWbt&R2rb8}lF4b9fMU5kJx+gT&O9Dc z^C4^wll@!g+zTG|HwiUZ3vmQ7r(%g&p%y?RIf>6D9Xoq2)YjLizYj6BoyW+$ei(YY z-hapAt}3`A6TVi03Jy=la!5zvJPthtTT7{eV`BS6D$(a_b%Beo5@~b-o6q<59T9t! zNSix)&ZDcX>u`^tDeVRBiP4wT40)j~(G^Ljy>JqCI7{V;s686%am$C@`RSpa5~{Mw zQbg^ai3P%YPqfEz42fEh2ge@k_Mht0aAFDjYv{KNb#f zl1_pjjgBEVu{uDNI(s~_R!5xrNB7{v>|8C{S3TsZSCs~fA!_)Iu^h}Z2lNJ#`T}>Y zYqB_3NZ?VFdSPjhXo8?~ zu>>6=f@a31oW)w4-z7T_*Ca)(43!L}TDl;en>i-U6p=>4K%qP~Ce31&5Q4oy!F?Y} z@!JChd(dvJB7Y(K`B>QxlkBtS&mNj8W8+r2>|1bV5T?$i*KEU~hHTVI6XiqGk>+-* zX6kMxJ`myS9+-W?01qliptul=g5050Fpxbf9oMUe$IHH#3Y>XW*10ZPo%x2d$K5O; zDf{a&F<>u`S6bt=3SnZ37qMcu6;J6Bj`dU00J`9H51ngzvkD+kKNXAm9HBn>jL$03 zfokl#u3l0MuiJ#wB|0JQ?>rZEQ;`MK~leKr>EDO-t8WvJC4+)GNh8v(FO!78Pn zUX{AXwlWe-B?^Gg#R6p8bn+SBG&5syrUp-1?GCmQ_i3(wMhVpP(}Vehu(Q`(t^oUd zELeNnHJuxgj?d|H87kFosDju2&r*<*;Cm9?VDoJK0~^D zmeHPDW&JL~FO2ETVc;!|oy2)=DuNZf*_O-j*Rubb2YFR3H(3OM{)Jfd8h5(Vaqej( zn}+jB6$>L6^gedXSNYrpidmd&zzyEAQi__*VYiw6cw292RZ|)}95n;FLzCbK%9{ha zPt8|bKE0r1wrnk>U}K>wDK&CV!6PpG zEa4xe3$=nx;C-OXB~N;cvup=GtVt<~ z5!_#lg~6^)LYl0Zro^isupF(R7P*ThNzE+qyi|^KAarM_kp-Ud@j&VPtt_0*Bj-eb zoHXVjke4f`;7pF?jMsMUrJ^exQxR)Lu()ldCSjnLmb2)mrSepilH8e8qMxw=={&~V z^U|zNv5XCnQt&k&%h&DHR2CW?)6~fY4y{|*OZLi)CG6Vx2{k*oc$b*izwBJL{$>wX!Y2 zPHRV4%fXgv@yC(KbscwOKpI<{g)lexgrPfL zPQRK#mRsW*iI;7ZfTQW#kdXVnbdAm{_ct@Z+11}-y$qv(Y!(e#h`E8lgf=}u+&4!_zeK^l+pE87%Fe^TS(>(wtYq&J`Y_@9)`DXWdTMA3;jOPty1g55JS@&Aef;DK~mASsR7_$Ae;YmONXg zxd+&^$3H~j_W~5|v)ARw>UBLr;LYNa_w0cTVs5m%GB1-T0d|19Ku;%x*y_LR!BK4Q>K{%CAlrlEEH9rArvMN(HP;or=WRKZ*e;DM>wCzuy3>Ts;6h9uFmUp` znNMQ!7U`Ya9^eaq=&rB-v2yud;W=42LFwyJg#-Q#lv=pp4|?SGvUfakFa9o(0?EnC zzALMX;0(NYy%&(&aox%DO1*=@Gu&k>W)(9Io>RbmR-uJg=5oER!8ntfY7-R1Tyf~wI*o6l$7l`oQEro!a1dJ1w)&{oNTnO6!xE+yZ;D( z&0@50UTG-A9w=#Gp42emFk313hQ_p=YfnMU!0bq5hv~^2 z4vv_q%Wz43TLP=ad8S0T0x3 zb@_!d6w+EI!xM{uJ$3Fh6@=;sSycTlL3&{nl4;mJ(5_%nd=%#vlqzqgB+)SoJU4d$ ziNRpArt|bQXmx39G|CFKFL>h|77YoSzYcAt`{t^49)?y`mPtICdIl|`n8Z3*p%8Hi z3WkO+%3yD>J<}G$qS4U<_67eC1v6)Rj&AFPjV?TX@Qcq9!mWH^8MTO7;0bwPC`1Z{ zS-Mwju`q{~1JYJ_K~mVEzgMZWAOL%Vg%YST^b$H{YqC87cPku(w6Jun7sd}b%1Vs@ z(m0KPRre`q+$_!odDC@UX`riO9fN8xLS|aqfZ_>-whbiZX%FCS4Yofk06Fd3Ph7Y# zR|r(N(>9<_36fxkJL?uTJ0?+UfA(i>Im4q$Q0dlXuq_DSAdJ)#1&fYm*t!84PBt7X zu$2ZHyKg|@Ezb?poeCUxFZpg;pSTA5cumG}w2;Lz^59{Au&+Cu8G;y!Ttg0SPxfC{ z-IL)n8H;~_r<`7_)4<1TVybWP>qzHz?nkosNsKr|U*_Cg`m*QX()X9ErtfCZ_vcJs z@}k(+kOoP=!%2fgPGnZWAcf-@@)6`^de)`whK+-#<-ze2KAW+)1y6++GyJOG@H6$O4N9)uV)uXOi*TT0_Xk}2F?tnHmu1%YM ziYw~1IkAe+s}H|+#bs&9CLhTzqi6WKtPDZRyFECS6)L^eKf(2KcwY*2ax5_w#+LY= zfzx9z|0oG>3ax4K%vZ>n_}1a)Ge~<^;=DX8>1xb0zQDEkqfAO>Gd*kf%sDIxL^OjZ z^2*#*+U>y{J@P)s6%$m%?A82*^wmrSvr=xOr2u#7Bw4Z@;e`{Se6efL-^d_Q)L6jg zX*EiQ4|6Sknn7k(vLy=0-ss zUA-o3=3J8N!ZDasAnWGMk!<%#7TAfA_6_IlDdch9j=1s+apfkLzuFg^2QtX93qyL^ z9^_kkOcrYOZ#EyvAeR5-k*zeVX|VW?+Tstcslh&b?{(|e*_QV27F!b+Tl-DTv#uJ_Tr)s zV_-4m#)!8GTz{BH?Cg8d;N@kd!0hx@F6XzneO2&=Jl@TC%mBR6E`quTdh(2S_(0pX5flR?`u=O6ATNx8b!zV7Z?8}Q?m+1 zk1qhboA6GOK4#amHey@CyjDd7BfkahGB$}~XEeF9y4V_QMH0?_u})mml#N~MWU+VHG=d)7{z z0HF@REG}TjI<`#U;K|0P($CU&d<|blsH5ii?8&oT?@M2ZesI}@8+rNtZj7E1S(XyOkO{G zxUwCa>9rOd2`teT6BAk9VPCM;OWbITgYoH6;5;~?xG-M6cl=)5_`E6g3jV9^NG&pQ{qO+cqR|VhaBKMl)f5Mh> zlV}gzRIIJQgY8i`{f$jtcw(EA(*B4!cD-A>>2u~N2U|@j4Jw#2tf9uY81jny6B@dc z+7%S1S%)4rv?Z|i8ZWwY42f^_seQwrfT$k=GPk_?x*f$=^p00S=yN6Yix1aZ*&hk7OQLU}^PHndCf?6(B z+}7z@F?bOrC3(r(VP3(Br^^*ptE&zCgN|$<528J5tGR@|TK1ki6GYv}zj=!u8WtR$ z;)C%-?Oiy=gcgJvw3{1PW(x82rA`Y)Y=>FmV`YvRcnJ!mSIHBwXBT#nr7%15p>(`& z6NSlkW8A<-32L)6k6kim`wB!*6{U?rZmuHLrHZm7YmJIrtKmct8IZ2E(>d-2eQhk* zR_!Hgz0zFnVZ)`h*|sKV!q7(Ef=0%^EgN+>kR)_FArzm$VzsF$3nmQue)WWUKz&}F zRaaD1{eb!o_2cSC)z7P+Qop3W+_82Ao}s>iAF{5WH+t#`YXrNes+S}U+T2s0x3+fZ ze3g4)#j?GS*|$G{)Ea!^IjKKx?Q-lF&cf3kPRWzcFQ z3-?GkZ9!d^Y+9QriG63k`ilBZ^*idf)W250zc_-4`Qj!DZlT~N3TU#vcn<|*6cj0V zgn|btI7Pt|6g*48Qxqr^%u`@cpi}VoD0nLc76mU+@RJmLh=O0H;1?+PClvf+3O-H2 zZ&UE^DEK!Ne2s#yQ1HhT{5J}|OTnK}a2-wuF8&S0wo_~i1$R(zD+T*0xR-)S3Jy~6 z7zK|~aF&A86udyea};P4EKsmafl0wTD0n*s@1x+yDEJ5kAEw}A6#NPWzd^x2rQmZE ze1?KAQtnYep!3`ALO~IWM9H8KS3Jy~+MZpOQ zj!|%)f;kEa!M~v3WePq| z!Ivrcj}*K@!8a-RHU7>FlZwMyD7Mlg1r zL%{_KY81#6@aT)jR@-SDwgo}Q8YW$~Kfp{4^_8yrov!-VT~_5Tt8tfAxXbF>W!3Gn z+ICrGyR5EVR@E-6X_r;B%j(%>)$Fobc3CC6td3n)#V)I1msPOK>epq}>$2K)S>?K{ zZe3QjE~{CWRjkYE)n(P{vRZXnrMj$6T~?(ot5KI#sLSfpW!34j+H_fEx~wi;R+TQR zNtacm%j(f()#$QXbXg_3tPWjPg)XZ>msOz4)!*f+?{c+wxyrj--CeHgE?0AxtGLV6 z+vTe5aDDjIGXN6l1G%mSSvmUZ5CT9gSjab(Sf{R_7fQW2^H%im}!C z2*udye2ijjb$)|lY;`_IF}6Biq!?SBZ%~Y_&Yw_>tKvdLTb;ucW2Swi>FlwF|B9UsBM^+x zmge<_JBZ_?H-#>`sfPnO4vSLxpzf2GLyLmyrI|Jkg`XS@9F|wSDZs&07rnwzSSJgD* zw6~A}-B>?5ot+sM$+c=S#s|`4+@BZ5doo}=nuu{P*7LL_EIIJeHpNKBJd+;tV|iiT zlL2#7L-pzvj&}_@GiUpWF_R%z(nEeBFUWf{Kz=y6n&COhP~JlRYX;!Gk{<7JUU*-h zKVFQdu-?jmlk4|`>G8fVFTD3=!23jU{o2jgL7cKRe>^?(kL3mZz6{VGNrrA$wS6!& zxvu|pdcdE{3-G=SfCrf`97m_oevQ{sk|F=s^pL-i7v%jJAP+EK^qvHG$*oi}-v65( z@AvY;dw&MJCz5r#+JLtWe3PiH(qIxU128>J27dEM>LJ%IB+X^WHJSnVgUP@dvSH{0 z1|p^OXbitmO)Ns6!Q^K9Z_|T)IWMqdYXo+@IF=0d z57UEvB`>fC*9NSFZ#5@_{eS7f{va=~<7){8ogCC=>*>MP@&Y@Z0qjE&V+(vLPQuE%?^9U=?eUMK zhx@~M!9BEwa0eKvpGpt+C-Q=OI0M{6DQb5>tNmx`p?)$is7EqDO)-X&rU$j!-%Ahn z3weQkFay{$trlPh!TlfU;r>xxa39J5H(lKhXtV3LrXEEWKq3+@{-z)ja`2aJ#}r3b6#1@>qL zun|2ieWj$(xm>7s@M%}t>@naa;5*Yp{rh=AeJlgih?N;a2cMV#DidNtp4?=ACOy`l z&I{|Y3|L3|2T=5t@MLhGN)PUz=LPO~25=Gfh>kj7Z`3l5GvGW392?-HCxc#s{HOGA z|3hAIXEMNjw7)JLd~nLvY1ZM0)dr5EG07GDt@MchXI_X;WI!CT(?)5Ij~$jK#tupY z7M(V2OFdlLfTXz$mmbf6@j!pA)|TkwP{~zzPkMN-%M0EU8Q|UD53ec@us;u`$95<$ zY_l1#Mf91q2EO2p^I+^-m>d*q$<_E&dZ_2}f_gFo)QBB@c(pDM7!l~{(KYfycPazA ziGC&JPqgu_+rh7CUP=%1U3tMgodISk0cNtA{z7_$KbsfACo>?7ur}D%l#K1S(_{P1 zys(|gfGwi-w7R}rBqdEo_?7eszmylkvl$RZ3|0wYGPplW5AIL%0ymcdT)DsTIlG2o zN0T9L*`9hRvl&Tq8Oppd1H`CZIR&X1+X_MW`3J)IY}cCvZ-mGsztF)wV-Sj=kmffV4n0B>9PIqys$l=0bA4kNzK{W6#L2GE7wxfQ58vNvUyFMO4J@L@DMJ~lM~-}}?!`v-a9 zyO;rA#0Ke5o77B`9OkJK{2&czl)si9^snXxn!hu&%0u80plgP_(3Y-rOl3jR87^Kr z;sa_D4k9ME)X%2}{jc%@J)fbbBc{lXM?}E2Pwnt$?UK=cGd$NvT8#|o@l3lzr>nMqom=JLM%F1NDu~B3RCA~e}HB&X) z(>>|Oz9bMF60M~IBBepf4a9*voRD&Z3lazk36M~voH;}Yp$H*_;QOn(dwOPPAC4C( z2P|!Qx*mW1_1E`5>aY6t;16zIIHvx|Q(>D6Z?kGSj^{fpOyr2;+i{C|QSx3g|DEKU z$($?&)<)>Zfz1+m3_WZvTqj^&@?oNe)IL za#^8CK6Gbg>FVN@rEA8mHuILQ8drSJ1BHZ!V8qFB|=DpfC{Md3MYvl@g^ zB2T))W68}EaSiJ)VOdrqu-d#JwYz^AICgB6Bxk(Hqo^HTT3p=N*r?K!)rP-b1;LkA zO@kS$Bw68fceAY^vV;R^iO8x7FJgh`7srLZ=NrPfBf^Nags~FWYOb(_;Rs_%5Bueh zjH{x7;Vv_lPzuWv1}j^RA4L`hH(X(a_~lrEW2|;>Ew(sd9gckLJJ|ME1o<#XNmo>C z4Fvoju*%cs#VU_lE>^W*tS%{*ErOZl8aMoPEPxhqaW+ z^f1#+J}4hQ7zkRKX5>kNOrjNL4sd=B!*yL;v-l%W6n-9BXW;K~{CysOPeM^nY6bYR z90CJzAQJhxy-=6Le2zZ@(u)ecLy;9USjUuLzS)k@cR^P3neib{5}p$)<0t>l_{!Mf z*J;)pvYgAuNp23LOw7m=*rIgNR2SCxv)ZtMo98~2f@Ja>(%My!=r=$!t38BF^S=C= zoG;3BUlr{V@+|RL$oF?c{ z5Ac_JfcNEt!FvGVUKn53QB4{mRN%$a5TSzbPlpJVwhj?0iZlX*U4FiDv4H$nx+oeQ zibhV+NGT%dK(h`yv^wSbf}o?Hy8LXny6oq*-t0AkM;mcu3UKaLS4eJj&r(43uYl?U zIv)nA2ao{%zH|`&_6eo-z}`y-V{ad#y|_EqV?K)^T^F3vjyW(o9Vuq)hmk+*#>ham z%T2O9LpT~*;a}tz_`=OW1VLkbp40iFng1e(EEukp9TqI(a;qggoFIs`6vlw{B`58Z;$H)0Qi0(A7Y1szLbPuNx#JkQ9{!U8)| z`?xC_eE!p}JkyxdyCqjplTV-~{dycmH~Ni(LKvAs?6oa9>OaPIcVfjSI;h`kWG}R* zvW}H(>kHPgAA7sQg60s;twk6UQ!_I8OaezAlb|fX$l)|=q@QNpeGF@UEoL|k8(Hcg z)d)a65)3E?TIuL3>cZyCh?ouN;s@G8-xZD(u?6~o_TV%Q4Q0mH0DflNh|y>)D{?r4 zFO*4JS^|e}KR`CbaGzqJ8(@xYOfC#^VaO$DeN=R`Nv8^7+*-PN#ZXBFW~6BYq9=^& zMXkM~70@rYv#bD=G}Yj_+bi=6S&Cqb&fx0+O%NJ$w^rt10Pgq=oCcxlmm7_MH7sQb z=I&gc*J{dV{x7UU2`htU^E|MHbl0Km{%AjR%14(xuCX82EWI;o$1$>ca1W+9T zZ6k-1)r4)ID!Rj&YPo_;R15v;b$~Kf3S$|-Wx;7#apbpXGUyK`yS;+BSqN`K39gi0 z2J@U??DaMgSMX~g5>wzXodFt�p4L>Wcgo$aiQUrz*C$i7A?jc~0Ah`l=%CM-0|*N%LzG(&l~(p&;0REBuwe=%8(<(v0`K^JwMeHShBuWM_O)R9N$j$c*n=os zuaGu6LOKHCxm>pHLoU;hOZ;GRc|ptNQy7t6d3>)Uj|U){%i-Poki!|sK|YuqZYVh% zl|jtykGysybhWH!j*40?wOr*QR9$2;Eyk)t+-LQ|A#>gm0?w$IOmxs>>M)45BTQP7|Vm zM3}m&RV33EOayO^57mD(3Sv0;mKCh&na_l23~ySU7+!Uq(p^2)@FUToJKf1_m{}B~ z`?DbMgD~Yd=VQE;26QIfo2s5?>u!vg%gohSEl)MgppGM-u&pNSo?s&K*O=E`Hx(m+ zAaIiEuAa<;A5%w5nm7Wkz^9WLao0U!I$-O*-DlPz*Khc-mfo}-Y_%g_UEd1ZwA_ZT zr8t335UOW2I-;I-1Oic9?`<=aF1}1$z$iA((`I3tBVUPx>P@D9Ql3%uDGnyNkyKT~ z7_Q?nJ~V4~ThBeDgJ{({<%o4`HDHq-@$`(7Ks6(bs5^9l6#qL3lVifO-PmDtuc~0# z{1__H{3{iIqvG#Wd_u)PsQ4!p|DxjGRQ!jEf#WDnP%%iwFcl>#MyVL5;uIBAR7_KG zmWqd{c$kV=D$Y^yC>4)U@dOGcM_SgV!`cx~ZXU-yztvWdT9zjpu3t;;$ssNrB!}>8 zJY7g$G2+Fo8bpt4!(+0n-YDQY%iTiXGTuHwLa8Q_LHh{nNNvC@%)*EG><#(ksZ{eT z8@Rd0AsU&I!i6eP`7=@JH7d(-A=4nwz!JcyRbbTUIwm!0o$JuFy~pU~Sr^R0%h{Q) zW3)P^TRzlzqM+{JvrC^sUPpCVq^m%k*d*(!o@eZu=0w3ZBDJ`8M3+CB;1`I+0XbpE z0X^L?)5jFcaxAM+FCmuYNJv=&uYu<&Q*LiZ*noMK&}9$yr^)T&3!vxgjEMX3tPCV>%#xmx9FytnCLl zbFp>i5|+!{a`VqYImI>wWCb%FhgqjVIq0xj+`x1b8y0e`UIRS>X0=dLLWuhp7;c$UpY#P>uXF2i|j9Y&S=XzRtNHm*J zQ#qmO_L;xCp=Yq1B>qDPi9mku+dgafYvp&4drh3HT2mE;6eE5ddo3iCb+m2OWf}D$*Mumk6FxHIS?q($;sX z+98V_-`s2woF>^OQV+~5j#LP-BXeDZlnN(WrXxbD<|>n`xg5@vfnShgSWF1`Yo7|l zq~6=i46&S{Uzh~GE%j7H&B1n$!hB(~^(WvtMH&UvcnyHiMc@!6uTDNCC)%uS=C3Dc zF=JFyv%otkM(4o?s>5n~3r^Ro`axqck!Pu=VgNlaVMLKk_$=f(5!CG- z@>J6y|74cNrc4gOb&Um8!J@jF11i5rkAE;(DY9zNAcw5{h&%^Ow&1%`)yx+F|49hB zCnv)#c(+ZHiw1Y`r(Re21pBcNF-@d%O(6s|t-e+230eiuu6>+5XLCHjvJr1-U4xXB z2q_|p+n9nLz$uTB+5os0)Tj_6Hwvf8OoVZ*r=MsMcwOJpnn>@y))HU_zQ}?4Zh-~P zScFN=+UT`rvX&)W6L0k>2L)X3$f@+T9l+|=wMn}tPcUyifiICG+LS#sd zZ*tTVxG69NXhpE72yo!q>9w3Z-Bqg}#-SS2>iGw~y`eXCs2`?E{d=x?l^pVA6#O>7 z#n*Yr-{(K%AMjuBkNAhpNs0l+sd$n4y?`Q?B^n=XwXq<)KvER$@!LCmeTTol!#~*J zAML1tJ8ICqn4hO^YK}3?v4lBVnB!f{@pJwm|D&E@m}a2~RNx-V@ghtV-{Uskuc?J& zExLxRLDo+Ts8~Y~R<(dttLD2o@>J!Sp31y;sf%JMn^g@u-9;ZpJ&4GQob9ERwjes8 zzz_!x05XxIwvY6jicaCHhOeac??H}lC%2(@csvLV#w*7VNYfMMCaYMD$7K`Y7QOb% zYCFy}eZJYbD@@NYGxF|bi0cl*esECVx?~*P8_4`{_IqsLL5H&n;;7#dlJ*Na22*!B zAWst1@ThHR`T8yLYx-fU3Pzg0)np`&J*i<=x-*&vjL_8vy&Nq&(@pDl|wlYE9PB=X9fko<3%(r?2U5%_T%ByDGagv#Tm= zGOPL+WFxN@s|Iox3}v3-Aq>WVF)P5>Z?TPSY;!DNz{U?AW_K}u+FkH2wz-YLuy4OV z^3KYt%C5;C*}PUm%Dzvh5e`Bpp`_axEAMgxuTL2w3@yv zr(`Pyp;)fHv3B1t)PAmZRNt-gtC~_#vqDYZf*4s*%I8#}SbGc)_f!0`l-J^B0z0!x z!SlYjUBAP;Cv`mjXgnT&?D0&;b5Fh*|K9rClh4$|osZST-TJn9VU51pBKE6mlq-El ziANU7HF2-D!0R1+xvWYHl` zvN*ff3i&~;#1qtAB~{P_bw#LE^qpmXiQcG*9pWKztG+v9(}Z6;EOze3T`fUim7@74 zlM@!DqEwcYq83-Ra!ucsmx@B|^!CaEK;NoW7PPWd28Bw|71w4T?A;lU$DUYFpNOFx z1_xtexsdPZh{a+LEU1ZxIxPCO;;H+s?d-Af^nh;uGROmjF0dxv3aZ2xfc)F>?@s)? z3;$jWs&*_YYJsP`(#LAzVeusu@g6ZL9ubd<_nqE>1dde#640+-P;0!E4879ndS$D4 zuecSc?>FQM$j%V5tSDrcIVr0YpNL5Xen|kvcszms*)J_Is${Z~n#~KDB~=iL8TLYf zSC`}3$`TPVxGLq!;$W<+*Jfiod)Lj!%dR$UgUW`SZRPVItiwSAiDUVy>DPDl*7U6v zRjTQo;gL~dd@(2Gctfi7>pE-VD>Pzt5(SVpne7NF2=QWIDKO!!D}@;jHD1+v=U?NB7{wzKA9u*a6&Lmme04_So0 z$tLV6ldu~D3422zVK)X6_7GDLlF*#7EJX-I85c-dqt`=m*1_Ip^uIphuH^Rcoh#Dq1zP|6D$BacU` zo+I+gqNF+0QM(?4sS+y)e6buWE3pN}7-umibeN6S0evdkgljfYp9)75Ou9fRyVXV1 zZhc3YSC<6GK14g724|V+^vEzbHabEUO1Y#BCK5_XC`!3_Q79+0k^sxdxWPfzibA%` zEeen#NR3kDQki7jurI7`mm=k|6b~6QjTFy4+hBnK$J*DIUd^|uY5g+nn>#JM zR3l-q{FU93@ou1pXJ;}6q0FO!=C2C$;W@BDEcC=vUZtboY!SezB~)eOV=gl6=ZDpj zof)ST#s8(Byb4A<8MD}VQA2i?JnW3wrJETo!o*#VilaUsM=!KFatRdr2Kc0lDLd9- zCsxLeWeQSseD&2VzV2$smq>g~oaBav9BNiqSL6H=YR!_e5|>bMBv^k5bRzglzMNQ; zpl%Y-L<;UJ>UzewkZ#XnOW{J(_ zWXK{X){q=Sr$B?GN8-bZDmWCiQY%@+CWXRv^#|#cJ+>B71s4bA?Kr*dsX)gqCN}(C z3*?I%f?Q-Z#sPVFIL}K3ZH8CT*@St$anKC0KN(;7-|k|7Lk}5WL~q*oqKgqT8e`;e zeKbc_MmNe(a3(Ff?rum|&QI5zph|pRy3868tzEXfsrblxp_?p>2e`iH;>wI=a8(z} zp=zW(s(d-Lm^$2$saN=!8b3EbD=@pRZJJz3_&B=N&5^uXR?RQD2r{D>1bL%4>YJjdIo0xHD!^b5BER3Vx|E)R9TfCTpd; z-9luj8HSGp?nn zD4%t49s0)GtAs)L?H)*HLmn^sc_ao$RaI%*^0X81F?NfaF@~SM;-bln;OHp9jNowd zaC_W1S+WG{{)U8{brCWvEJ<3~7@!C*ORDRwM#CC6nPj-*x~MQ8$9<0-A|4D&ggXT% zGZqcU8q!d1Km$4!B)^jz9`y*!h%Yst#8~!#=T)Pw1q_5(_JBJ!IxUo2S8RvEiL0W} zpL2^*t|6l|$idU_+0mQ_{+bps6Q9+spC zYEdM^tdyuF6sZle(;ZJm!wwQ^$xb(yYRV3!5ji`QsKrj##@L~e^=Q~>Hbig9PET`o z*f4+O>`=xmcDgsrPDC}UCq&KaXO4MSfXT$9DMkPDFEo)W}*W0XSfgO4t zvEHFXEp~c0%uZia?D!{kY^`f+~s31})9p%XwQaJBHP+b4EIDmeOIZoMtA6 zk*vkj@iushNJCRb{ML`nf?dyuC%64$$MEpv)zgvjy`G>!l6Z z3D!V(H$r~u7_#e)U9-TDha)?NEj=tt9+o1hSw^xJPY*QYsgV>#q<{MBv`>%}xpj~I z+{KVr^F$;?j^252!|ZfNV*~ZayF=8mZb*mKNe^O&o=0p0QN}FUd1%Az^hCu@PY8B; zTChXUBWI__X6NCC>@?Cqk@ZdckE5M}1jCo*HSO zh#gT~cvn zNV@rqG0%`ON6Ir&F+;^eb>?shi|-%o>Gy#?L|NkOEJ5+GEV*c4G3qmo7!EPZjfmL{ z02bGy4Y_^|acv?IV);sOiMIe?-Rkp6_Y16CaV%FB@yL~naXV67)}MdU#~PB(mO_k9 zb*Bcno>Uj-8s;X=C6qNOuBb~`L7bN`<(QxwSoWMi{GMboLw^Pa*sl~?g+#I|PXDJe zeaQs2+RZ5Nro+m6g;+%mfv*|X&IWJAivNlr&5x#9GvS16bG z%a^gOjjt>&N?9!Q6leuDh)YO0w3(^iM5-&%olK;9hmr%wlLHBD$ycp+7BQzA60=G*fGjzV?MoV-p7quBO=|CbOzmejG8;ei z&92u!ak$G`+>r|3tc+S5PBi3@w!%3aIs&$tx$@e?#*S2?&sFO@H=ifcXa_di-&?mu z>|r8pW@y%-tE?z+k01%;u59S1)e6_qbybbtyqJrY=|9cKBXd2nGi@5YV04)V~WO0BbDmGGH{94s&nXa1JkW8hxG*xLj= zccHX?JD{Ks%B2mYZ{>ZiVcrKQ@9DYe<9$gi+)5^01I`SDrZCm3mEll>S96J;*Qt%n?fgxB8HUV!j~?a)*+EAv?{DDA|GTq-#=vC7$IKRu-koLf%~C zt|bta`RmbOuqV4SrEVI9(9p#T7_r-nw-gTB`YEaho%gs2ghK8f5aue#Nd`O^Vu z>!GXvum$&QL%6J2#f~*c>xBNQVJp~pjqMp;odaxTSHYS;9jNwX^woXTf_bhXOtVy7 zMtA5hdP`L(X4Ul)ZI7=nRd+`lP`&$hueMZOAGYA0ZwU9aA;hQKC{-`qWx?N!0NAp( zNa?3jr1rM0HVLLLS^zIJ1juyL_&HZMv(3+G5@D_BZgC%Nt(B~a5(2j(eD&tCO+ zEwC3Gf;E<1)4maIWJZ~3qfm{ink!+wc`E5c+TlEOm86n$Q!D;&9h*ke|ban5^Hq1 z5!TXh1`TsU76T(NdQS|y3ZFHBRxgfM;RbI-NCfrfu-eRcy{wd^tj47Vf_gx=OC0<_ zIekF;t%YpKB^MOU$eY2RFPg)eT|uropB8D4H6*Q@NShrS?(a<u7xmTh;c&zEUfs>XPNrf~EWo$gAptghoPJUIqQ+)lhgFfp`Nz*ts`T@;R@=B3CSkkPTdEV!efewW3@KrL;J1!n5p1YR$ z<2mGvdB_Q)4m@eu`LsCW8*;|Rc8#H;^@=7~V@1%oWg*AG&|BCPa8YOQ;p>j#3k=inqZR$}t4&9DH8O&ZfkMva94Lvq$LXREAv>%(jh^@d? z3RLsQ-VQfp*x7xbLCS%4-n3kc$xm$CvL(p7m_;p$O}>mc;vspJ{=fyOctkGKB^-$| zoV&@t!;;FEL^qt*PaJ6g2--r?;7BdU=krIVXJ~(#hCwPJ#!Io;nOIJWDR51RLJ{DO z%~{A2(<-qF+_MpM^3#@AR3(O#XlhtFhE(9nj?bC?@RV4d#|yl}S=?glUtY%S!q7t$ z#%qXry99Q*$_0h7MTgJ{d|p%BMN!~vmu|jMX4WC6hPb5FrY9Nr$11oU>xV7<+$5{4DCO6J3Cpva{9dBP za74Tt$^gQHp-xx2PJ{#DK4BNi2U`@1zQc50$38*z<^7bGL-PCZC(sw9sah$jw>0s`hNevL(y-;F;O54t@-aP?*ACHS-SO%N=9!1X!Vx+@-t>dQ9oU%+>oX(oqv z%7lye&(qHU@5XMG=H(sUUggh(c+11PV7oc2YmRmpqF>XmR9VM;aK=YHPN1cZQO#zXl;);Y;K!7t&rqiL{vlS@@x1=iyJe!iY z(%^=m0)O1_cE*|vGzomn@M;hnLR+9xiyMP4WT#m{g94RB(;!)L1=2nn=Az+dirJ3B|2_gQ7I6TYnt?YjdmH?TI&t$JUG zud=5H^j+2qwsTYYMIrKZ2c>XGz72miRJ(P22a$dHeFCb$m@>*M0W$*eRjji(>EoK8(iX)Rrx?adCS`_jv$ z^Jj<02jYlyId?9NNa?jnc``XQf1!JNWO+3$t#(KYg|YI*ImFISotb;&j5IMkE?zvD zDlJIqzTBzt)W!43_{7=u*^!yEggI-k98Hl4n7^4x{w>bW!dOKU4*CogEL z6Jy7Z$DVug-LZS?GMXXhOIUqU#L5%u?BNgd@}=Q|jdS3y0gfgf4R9R2gZt?DEC{HH zs-3KqGd!Z;;XPer_+PCj_udYsCEN_n84MYW*8>-XX@OU%M_CUupIkdLarW}1)zy4zCdrLulH>fy*yQ-wbZR}1?5-`Al#3U&6Wyo8 zv96V|+(h3Q^TnkKb_TE`R?4NCzF(A<#613$GjOj?r`V7U zog%x%?ySQPyUUhhgFv*O!DWOP<~*M4C@-l>rBwHbhK_JTPo74|>K-=kknF-M#$hI> zZ>D_B81~d8v!~=U_~Y$RG)zf;6md^K5J4LC`Cx>I0#+wGqhdB8TUEt1JZjZXGHuhJL)4Agrf|9?Uk>rs z8s+bhTwzh=b^P%bmKW*`ot-0smQ^Ko=tCgjU!?@eT0fxgam96DzXK6M!hVM3s_|Jw zBq`n=1-xa+Zwc|%#$X@l?3}BVN{Wi5Cp5Ge2>hcC@O_@x4)i|>5B(2Afbc?x$1M5x zL%ijI-gumWxYY>KA-NPH)uIvAsPwF|EhxGAnsZbxBcfNtj#!GoteNQ_#S1# zki8rIFF2*}1H=j`fZsvXjnzAN=92#*#9L-5e3M0OMZoz(*KOH?WkIn;iB3{cX!wCf z7BDKpuL!Y{Dy?8u6dUcB74qvi*(El^tL1fyM}yrom_f(6U~~jK$zrTCCE!dn_emtN zlAy-0|IHd}!FYGRW1fwjShEH3*aQu!=LCGynm53h2QuPJ9$-8K=atb(F|jNTK*7i8 zpfn7R(6CGl7>?1AFj?_q@AbWhK^vY8sxyo<2CoWv^KcnHZ|7Nw*|H$zIy;Ram80T; z^SgdVk>REv6BmxGAJ{>%?rD{@nk^K42y+An^y}iz z`^MLs>lm*RgX=bVKTE3lS2t9B^xNF$YCYi`%Jc*Se^j*3%@VIL^AtQ&h}=eUV) zunun%t&`iDpME8e6OT}+IGfElBo7B#$%D9Q9s&l|TxCWNv;|kDemzX4p0zXe0rNPy z7N<+eFZbsP2S&MawUJ_j*EG2w$+gmzo?>hM0kiG-TSGy%(`vlHmUDZQh>a`-HXUnJ z8b;G`i@)h$Z#hzZnUzm-`7~?AN(fH86#yRAWG%#7CX*!=wN?9}pP7TUFD}JnXL-zQ zV#pe&aH1s`gfhi2+aL|H4H`pigKU6p(4fHPjg77iVr-2w2G>jqp?CG$8YS%z_9jM{ zR|ySV-Iwv<-nMe?etb8LI#WxxyDiTZ8YLvJG~Vp zA)hwhImJ3%-pZ`sU=8zY+!8i7(Aht(W8vxTG2?A(MTdCASX1PDTiliuLGI;A)~ZliAJlS<(ym!r28xBB*5HP7!>)z@$mGe3(GSR6rSv^SC7E<4TZa6r zRmK}GNQDm#WF^Oz4ABx(WeMlw!WJ2yo1TIZvM6D_5e?{Jfhk)tWb2qHleAH9+eNjg zIcl#E!<(0E5#UE%zedMvnBI)9ne9cu+MGin@?tg_2NAVZE%Ig?j;P$(?t*Aqqt5y* zuk487zq@&?pk5K~9xSUBp#$f-o8AB5r#6N6wa7M2=E+0&-WB--LVX+U$*jpExDJ}P zgC`<)Mo+pjYRp5)6Lq(aZhThFJtOu2V{_waxM$|tO(P&5N*%toCJCBO!wGAbl)HK|?9N>+n;ocJ-`a45_@Is#h^tXq2%LCnMBK*(w>bY)<#;LFIDDQY{6Xim4_D|i-C%Dxl=o|kGkOOXFE#9JoS zf6k(|tXzM<#z=+O0zC5wJVpxGctSBpV-Vh{E^BddJT}Kh99Wkq_OaiHY4CzpDP!LV zt_?SiXyO%`_@X-nY(;^y3EUEB6c+nTF!Saau%LOp0*`@;W3h(Io!KlL=GL&)ry^k% zZV?+Z1lxG{*A2pMYkv?ze7rINR}%7fBbSNiyQ_4^Zd4$(N&83 zb46VxCs)mtnzz{C5<}jNwr& zjYXrT&pr8O@&|xQBIjt2YZlq)ENu3?@#_e= zzuLbFH;roFT*ADRzJ}8*E?C%mX+(KIoJb2@v^Z(hgk`BT?u?*EX61w)){6mD?U(J6FH#c6*;T}f*)s0fJ z+0`6IFq{AdS^}RZl%^4kIF2Ro7sN@ps{Ppzc)fy?1xud}@s?S&KgpuDtlFQew*;tB zCl@VPuY*>f8fTTy;UM=imMUWFyl24=*#LaZI0ca{*J10)nFALz=Z_R6x`aY7+|0!$ zuu=#HN9^b$vlI6*&0th;8h^uzcrpR7YTfjGL)HTF03(4s$Jq9RYEIqpv~I}CDhV^w}*DE-1n5(|5ebITiI$hwi87Nt+`*4lFYFF3E5C!CAeF?0ON6z}SudZc6?zawdxViD_DuNPz zqm*o*x;Bq$F4r+;?ixo8TCOt?FyA461B+G~t=t^+T(k2|Qv{qfJInsnD-RFTq8oDw z4mPS`7H$yUwgw+(qYN?2zuyD%)2BzLGNV%?Gt=p*`ON6-?DXv1LysGkp0+?7tWU_% zoxj8K4CiTkal}FnmQ7|2A8~Cd){kxEs|HKh!z~r*NI+LQ@*fjqLw)b}LU3~P@c;&o z>f2bB^sQPMZVq=M#2ILdHNn3e>QCtdhvYxPpJq)O^PL4hhJKHUwim;iPF~b<3MN9a zFy_yZ94!o6Bo8jwP(`2C_aMZuFI?P6g4OhECW}Unp)ycuX*6SVkvUOA3zaDbM@1gg5g7 z>GOJNa}DXJQw7$cH`ZFc9r_DUhVWCFq0(ed^KzMm^-K|q_~FAq{%4ekERwe{{no&U z*o%m01j2~sX2U{dWkcU#nEo~Pb!ri=)Az&GGCo_*n2)CPz1AI8d8YJT8W!WBQff8* z07SM@mT(%+B797tlYqLg18V`$E3j)B^IJBh?_MGglGMSd;Rk$glW(#@2|xB2UxHu4 z;xc}Am_Ol`3BUH0m274KM;FjjttOL2qaR#UlrnZF2(BlmuhaLDf6rp2kXfUSO$~SU z!}pa`!T}E0yHzY}Nbh#zj*!PX0^G^0N@X#V#jq*7R?_Fp7wj8*Re|=fXYv?0&DTy} zuXl)i-u}5=KOn40;0j97PJzP*AYjE>jzJG>8!TAC4Y+D2Yb!7*hsi`smHQYi}8&P3!zy-Oq#da3sO(r3zZ7ULv_++wqLk8Vxasxu=ei*sj zX;lVRPxQUOLmh6OIg^FZm@zYpIR8?sJq9ICSNM+UXbS{Wf;p7<9+h9Ue?meJP^E(4 z6qg`}d8q)_CT~2V?=J}@M*|QZG=(LIJF-s|L${A`#ceHKTF2aSk$JDK>9 zRTxfhB_X+@->9t@%lul#cFqESEp&2gP2Z~(u>C%Bse)>)fvB6Lkwf0iqd4h3se;mg-l16LqGN|qegI(p$CX$s5}`Qk|hc#y%z zc%w3IV;Tu!Q&IY08!;shfqM_2R z=v#&2N)4VOby$U@O;Cj)jS@^7)Q@t;Xqp+i1IQFxp2WN@!_FedHAlrU@tAl~OpB|c zD84~_N_hF@223L6#O;?AEe-qDfmMQK1ac4 zDEO}we3^o8Q1Cw~_&x>Sq2Rjf5&U1e+D}(|D7c-1+bB3n!95i8QqV=g2?`#jV48vn z3SLgZ1qvhz7AaVvK%?L(3ZA6k^%VRE3Z9|hEfoAF1@EEY!xa1u1s|v2Pbl~T1)rzj zuPOL%6nv9{zop=xDEI*d+u?UnzMg`E6x=|;T@>6w!7&Q%qhNr7J_^Pt7^Yy3f*A@P zr{FOP3KYl`T&7@^f~P6?_Y~A9_$3P7LBZQ7cs~X2qu?VH{4NEbqTmx0e2Id;q~JLU zzDB{fDEK=HenP>IDA-Ll&<+X?QE(Flhbf3rkfea4;6VxoDHx~VBn9Uvn5Q5|0Z#!l zy_jM3V=}^iNWr(!W0e1%g16JpXDIkC1>ZtY(RY)ilZ|dv}6t4vU0IIC;tE}LwtkA2hz^kmVtE`}_tdOg$fUB%n3g(0S4>My z(-qTFFQ+S}r6jsyT55%^n3j5qu9%j3JzX&^^$cAxE%lpp#kACi>56HokJA;?QeU7e zrltOxu9%kkCS5Tt^-pxgwA6O0_DoA1q${SS?xHKErH;`R(^3O;#kABIT`?^+M^{Ws zJx*6lOBLvfX{pO}#kADZbj7q(jjouMdIw!GE%ko7Vp{4Wbj7sPr|61lsV~tL(^AjT z71L7RqARAQenMAFOYNp=&$QGbx?)=DFkLY%m82`Cr5>a!rlrQ|ifO5Hbj7q(j;@%N zx@xveU`46mih`^F)j6Vx?)=D zdvwLL)D}`QOiS&fE2gDhNLNft9ic0xrF!U!X{jN)Vp?j7u9%j3l&+YTTBR$drPvkI zQnb&^&{8y>#k3UbnOF3EZmW&dmA((-2+YJKOVPMP_PG_$uvgr7jCe4AVdWJTl)P;S zvZy!vZrZVTds5tOeU-g*(33v8S!$X3b+`D_GM{YGJJ5Sz=eAHcX%DvF(5}s1&4q&hx}Z4$X|;J@?C8}zP}!Feu?8-6zEUFqx(@* z=wfZ4OVy*p`gWW|9j9|~o0s6BeWBIQO^CW7_0y<^zPJsHLrpOr#-N~7z_^7+an-?=2beS9MTj0%w z$IC~B_a)Keg+YZuTefbedHMc)c)YKS3hzB_;62s6e2r>sA`V%befG>81z@Q^;` z@X$|31)XaHdSAn0#w2T2!6J+n-9a%tP$4Ry@iu^-XbtqR61Lm_@4|zARaBr8ZGdiA ziD_Ya5iK$Pw(2duH9XcgM};-n2G(ZdIo6zSD&EyxWBupwV1GL*u&GS~+Z|6e2m2S{ z!G10(uw9!2mg{K+_Wy(j`;Dl;c5fQk7Gk{ZhR`O}b%+{?kX`gbl^@x2mV0)T_y*oVEyP^X7a2sI5)!LTbfd|6F9f%6<%i4e&PLNwz$Y;ZY zor?9b!f3ii%Gyzc&LS_pq^+0YQV@0p~I1O0Ll|$Lf*W} zz9u}@r=!9;+y>UpdIO5ifNu`&*TaK*M^xZO+5i`zk7&Py=^_=IO5gzShLUmF#|$u z&CBhR;jw)zDr^^`!q%dn^f%$LeKjg<7u&!VWW&(fTP{~pO3jP!$KfIVFe-?TwgE9{ z?~Qr6owQtk`)zu5xIqIi$aZu$9#WO zm>+8cGgoiTz@<-rZ|Zn+p*~?QGw>80i9F%#WJ^E(F98uVbZZIfF2a_`&D-7RMQI7Cobcd-dpFn$xD{8ma_#68{wvphvBv8iIr4^QdW|!D?Z*Ef D`ojD9 literal 0 HcmV?d00001 diff --git a/it/doctrees/la_federazione_delle_identita.doctree b/it/doctrees/la_federazione_delle_identita.doctree new file mode 100644 index 0000000000000000000000000000000000000000..f19384c1a266b5403854fe589f2a407f8879a2c8 GIT binary patch literal 59630 zcmeHw3zQsJd8TB&M-N+)E!)V3vV^S%s_q%hj9!*y%Nj`@>uE{0WrJwdbk}rMtEa1} zs-BSq1PFn&NhP~LlPpVMvw19>C4@t=kFcAQUE*~X4$EejC0UcOF$WF=5|#i9$+CoG zzyGhg_3EnbnpRC9U?1yFb=9p~_xtXD|NGy+{(I|<%ii_HuPoyKoSUttrZ=t@luD&x zR8*_utgIO2){NS)JMZl5cvI)~o$bylQ<<}jmRVLi&LZR}YkIw6s*TPiTwF)_ZM|+4 zyaHB~jhV>(+A`-Z@0>n#`IUu2;nL;O&==nLZv6YjFTC-+9c{&>j<(8KdO^KPPwkWY zEghgr7WfYnq8>dL06TBXG;FMWBG$iO-f~(=Xmholx>Uzif<&p;oyTO`vJE+p`1o@ls z?{55i8UEb^s+Lb1=8QshrH6I2t=h|5+P&JawoTiv?KrU<1?*}i6yV%6Wp)%%4BfIb zbjuR$K5Yq5zrvL(AbX6El{K||Mb^tk<8_igqf}L3EEJ0PpMP1!qeiK$o8`J%s+y|W zDDe$5ig~4A%~pws19N)C)(%L!$9*=I@x5U_9=g%8T`E&KTcXrK*ie85636xGI5+Jc z?>I|ZrrvROW=BSaDUFI=QCz8Z7Vqq6ueONQQ)qxmkJ+K5hR~i)Yy}qHu2wipt(uJ&fEOc}CJCMQysc6%nyhWKu7&qUI0kB}BT zO0f13pSAaStZhtW?L&#IZA@hCwZz(-Vm9>=`}6YvK2{;amsZJPO4-X4MVCZ$bg&`)wJlY8C7Z+4g8}4 zL!Z@M($+gqE!-3QLF}VRgP60S8+r1Wv?-B1Gl@JEV^cuh;d))NHC0ltDl^TxYB6~V zM)eAjXKT6@P)Fms1XD$tQI&=**@iU5jLCvAb;ujE);p*3Ex6+o_3>;(!K6!+vfD#M zt#X#zidj_y`w-*!BseRbnVdKxA3Hih7K+`p4it+F!L>EW7!-r7v(nHjWy*(&c}7a)oNutefaCG?{u_BV4XytZ_RZY_ zFZD=g2xY6VHOr{QiN&yAp7#efC5(IPxwEAi)mAWGD>uZ!*7G2TNEs`PM0JpJtKdU6 zo9Nl@!$REn*SDHYzcN9iYF~1W-vB|8iV3n_8YU~kPBp^LF~6}(M;owsujR$jo)||j z@i_{~7p4k$WQZw0*VZ6c$ZvSwvEM%c1? zRaTS`H~xu$hD$03ynAnwidpR|B~uM? z;GHhe-H{HoPcSj>=L(Sbq=KC09ut7vdZe!CGuBzf#M~3s_WVIJ;&?H!_TL<0K*od_ zPsHTfePW0aFB>zmwL4oND@W(cP;w;&U0YJ=s>JC!ubR42*RS)KVhzexw3HZGFA0+c z_dw`*A+Ee!E>~T-0;(nkqbgQI!PM4Nrd}Oq>d_}JoKxA%8O0Xv5WV<%iOLCwpvQ*#*V(&J`O2?`a_iyBhQ9ye*!M6=v5HQ|a0YVJ*? zW+pB*t~&C_SzxWSB`id)y79P5Qchm(uyRVs9q^a4j=C?E!^?3F-6pV_@CObsh`FjV zTt-a5?g-Q7N{{=jkc4@8T(V+$0*W3UtoKFgCS+_|DnH#iyfsyW{X02v;aXE2SUH`K zloI18s>9u!@F3FjLM%mfcsy6Y)1W#$T0_Cq_Ee_2bodc?>_L-pMQseKs6s`=IEv`- zGM)s2=t&`hB04;pC17Vj9UiWjpk_xZHO+V@J5twS%abUQNnd7rU|^0C%8HRCg*#oD z^HaA9o*iP%%PTY$)w3&aK;NT-b;2b4{tRSiDvwXcc_appnx-+Z<>?m?W9+stV~n4k z5~9h=5a=k?%Mft$;9%SYRT6^ric~_L2oZ8lt?HKT`YW=_k{P-y&C9XTBO{zQM1^;` z5W5@@@jzB0!X*Ti5j5;drNK_20TT<7-&6DUdL&jPR$5GAggp?s)$MBuju2rFgmYuk zLbVO$4k$c%LlnkqE*O2Tt>=jelI~_=kbi{R{;_o2NkR(rtP(#8!>$yIJ-_^TJ&TjJF z;&03|GM<$Ty0cqohErij-K?H>v@}xKom~wFPCoy^zBdyE#RSE7qso@&iXD-6hkB5I zeXDn!Due4mFUrNuN`(rc7?~$KqlJ-t*g-*k*%_5bda^@hlAZCsJ!?!J z@71%w4qeY#?@*zFo$-0IvnMZh;xBf5t?O&$F?mlPcIbNU>;x}!_RN!=@x1g73hFC6 z<9+lFm61C;RH%@hy{YV|Y{+;ojQxRlypY?d#YM#!+T_0&6qOy-W_bSi#f20eH$uLsLcK){oDE-_MAru>Irbi0~BE)4A~!XzKl`JY7nZr<^oV zTn}yNlB2K|@~`^bM0HSR&vP&N2{h1wR8A7DW_fR38VCi&`d7Dp-rGk5Q5oUBm5bF( zg^Heae=0l48VL91$WIqTe!ua178r_fCU_I7EX zBq<8(9{+lXp{VA`Ns0o!^T52>8O_HA+FKaS(8oq09b%H6#1380*#@GD3E4R`Z+6D= zVrMJ^J7ay=q3gM`Gv>4NU@ALl8Ys89>E1&3?9|sUAq^CrpZYmM{fo*8vy_tt3eQm= zO64g{1LZUe+l$Fg)OYIlp%6#CXJJ%En4g?9P%sNSoXXC1vV6{;ot%&!zbGAV!TU+e zOG58WDPW6YwM7KkT$AE25y5L0Tg|$mRIK9e;oT#};k`u)G?O_791&p@nk+Y!>MdiB$d!DMCjpaoWXEN zW32ZrrE4Le;&*`Tj!Yb$zm2%|kf>6<)u<{00OD4EkaXWEY9({61o5a@~AB7(TCBK4d$mG$e zP*#=e*Rje?X-!Y-WdwSv6oC!mih2cO=E!()WOs3NxHvL?czFN5;r&Ic8tc}}D>E{d z{DgQ2&IA-33R5t^GX=s&QW2gcghvj?hOyK~Ra<~JJYK~ABYTP?KxrAp{iDEF?2aB^ zQdYw1+WQ%xJCX@qpGOLalc^9nQe)zzeE#UEvnMByO&&S?^yHb-lk;iN-NQvR;>Z}l zA0Hkb8BJ)=4V5}{GZy{mkO*EDrH2|f`D#GLJQ_N&E`o(eQ(52u@}rXzhtCJV)s`vO z)vE>kHJS?k6zghLsry#o(bL5X7cUea#QK>B@DI_-v-gf3KJ#edWT^lt$E%X@y-)## z;o-fb^!MoL<1sN`hTt$I96INp2(Z6Wh`~ZsM-X!&m6$o|0c6R^yiDoHnRBtezCh!B zjHz{OBeVZ7_IADdO2A!Na7QY9p(-jkJekTNt&9se3DDyA}R%XCIIC>BmegtI(6mK3A0 z1eZeCy`KTWs-RJTwAir))>?rbW$r${ExxWQ)_ zEBa#;5kX^^{ljs9m2@(;)o7Ut7DZA#jXXJ#*s4Qb`(t`}x$m@29#?odQ z`)ep>r8qXcZ*QWyU87ruUq}c<{Cogrn^3_09wbm)NJT-rqm*FCo{=Yv^8V4`&`Sj_ zysQ}97R}aF-HUOzipa{__gFC4heu1zQSw4qnBpaP?AG8eL&hq9${IlzJs+U+Rqvn` z5U3wdMSYG?Kl)@yE75{##9f!KsAe#1qSi%PFdiN}YlfxDHEdHLKLe1y9=h=d3%F0D!sTHVE7k(7lliHxt>EKzmuEzE4zSswhV_01Q2m$D zH}+5g^T|}0UaN+T?#xe&wkp=)o7bAOJifbC!xL>ljjr3h(N+yTSirrQ3ipI7#3u%5 z)hOI6YJ3<0uq)9frJq5Q`pdQkB$%Ek06vupkag3ePll$M13u2uv9XrjLMU;UxNy^x)FKetZ{aLMs>StrHOd+k>ME9q2OYuU883M+`bPX zGwz^xdbU9O%2c#ZlI)&gwCCp8zBOzUV|jBJY@Wt@#s%9{L>qXeTQ4)*%HeYXa+Z9z zJiI4KNbc(O#4uxh@&%0f>!n$oQW@)0OTpJvjIUMB3aCW355)$i+A?i9jXm43-{vwn zFYuNxxa4d;sY=IqZz7Iwkg%j$nzXTth=N@@dB|GdJCE39tJYk)Xi?HeTf%BVm1_;; z(Kgkt&>!rEscmzVqJ~Y>ie?L|s?6e?VP3&zS>!X*Rhc~onCVzar}#WxNY#~+8!F1X zv|$g?I(EwR{4@%0If^Z|^m@o<6{-WhLXn^xAhjfyD!MfF)@lpFN4;9d zCbFy`AjuVM23cvLlNi{4l6na_j>`(|8tHc;gx;95I-V=RVIytFwnno$o-3B|?uc~J zCSG4+yCum}ZRi{oS1GBxBvZ#e&*}0nzyvA3=L~>Y1<5Gn{+i}S#Lt;>eBXeXC*^Ab9RTTDIpamZ2@g~dcSKt@y3A2 zD78y6um^FYN-9y8#G-HB)wD%pic0&Nk|gK_X)?Hu$B4TyL}A{h%t9txQ{+X3(k3O2 z^Q?y5Q2_Ejtz&;vU*OOO%BJ45y)J_hghou-=i9vj>!WGcRZ~}kkugx#7@ukUq#aW^ zyDx<=(u7TA{V}bZCSMo6ciz&8ov+h$q4U|0Z15hpW!1DfzyosXsuLd6$(SGwLqgJR z@B}ub$|0jLCQ{M;W0n6Ca$nOsq+liHj;U7DrX9619wuoqcJmUusGP+Qxl( z>hHnea!!*D32`#e4%jW3re&gy$}OCjZn04bBO1mchAfqKD!fjmu|e$@PdWkm#ekz5 z`>LQY416$R+3r)NsTN&r(l#`{vV!^AqJh{oDhtwCXfUOT+omBUI@OufU>)P3_reRq zH`MJ6z5SvK2!X}+yd?3EY!U3HOP9rtzL!g=1@hrJs$07Q*c11_83AfU#9u$$LM%djjH3UB$sY|R`s?) zUhmuz7mKd?FLKr(%%FmO$V*oNBn)9PHyLsXz{b>igFmeiOzvx+qw3R+((9cq{iQXi z{^xODd@8@)S;`okC6-;mr$vw=aCo|-hCiJ_oc*cG*&pLiPr8@mZcO4k&fPty@Ew)` z%#*Rhc&GLkDAiekJ88Q*d{u&K;H*ZfUPV-5S+_fFzD%2-fDi`}ICX2gWhQ3b~#Z%;8{3!`RobA2rR_FgA(F zArCGEeA4Bl8a8U!p%k)f@HE&zZ1!WS2mR7C;5lKt3|2KIYS2nIeH8_9P=n@Q0}4e-;mw0KPGHBVr#OK=->AqL2%f#Dq-u}?o@&8zvrBN*gulfQxVl%-l@j)g zp9u}S7rzQK>+i8E_YwRTJMw~dWFBjxj=vY%zsuqCqpQfd{pq#Wa=i7xh#67@&YG|m z5Jt&LF~$d`@Pio)iwDSd+Em+*KV&Li{9jNq3v462s91iG7D6B%)aKUId}adp>{4x< zB_;g}gftZyb%kn}v)0D&M@$%;cm5EXC*8WXRw4xS;<G_=+KaBY$~U+Iax1tk zJ`IgeU%bAjAS+MP-ulB~tpy;cX7iJfJ0KyK7|);*a&ak}IWJm^-BQV~{&w#Cv8RTa ziS^8zW4wsIxjMvFAlPrq-aFqadgr%kcKPErX9*}H9_FVD?u0J*$@%Jn^x?=^?oOLJ z&SIGzUImmLIJ{_V+L_^L+q>=xc~XK;bke%(#7|CAgbzMytHvGTCCoC_y7>5~|6$va z;o*C|iJ#cvJMMAwKQ_CRGKhRyl9@lKXB>svD?*>jgMm#Yck?enfr({rLjX3fXEJ!YBbmI{5cEu)JjH>-*q6K$FyRVQ~}C_0CNa+->* z;ghBGg;#{XkyBK>enxS4D+o_vVGd3&`AWl>Ylts=2JMQ=?nsL_2v02->OlDan%k-N z+3>rBu|Y`TTGw6(l~Y^1+*b{^CNUh;VhM7_yWsZPpQEs>Z;$@2PtSD3+oRfFQ>pZx zN4z3hi-%`_MO6Df-G6(Ea3s7G!dK>M#4^t|9=IXd2?+C=EizBKr>|&nZ5z{7W&%`$nNJtuS@Wr7b7(;FE0`r)!xs#P5?N=U6(Eoq8MbWh*| zDW+184tJ>*UumScx!sRL`|66F-Rx+CKJg=~03fQuS{A---y`4(-tW59zgz|iSchPvUf&ac6 zIOyy5b6<~oUN$DQztAB!$0Q>t=}301K@VlUxPM@=3Z9#U;Pw=$6DT$&$YfCB;{zbM zDI6B+R%t#85MP%}Q-F?kUY8I~Lhl`QbX@OK^hV@^^4#Im$8Wq9Bg+K}EZor#9_5eP z8>OSCM+#$yE;Bm_GIF+OePY1bj4MYGgW{oFDik#?=I|VE-mx>uxJX7C)bmx!+|&1&K^wk@ z+c0Xpj?BACEbUR@`ZW~n30EJ>_5EChsNZ#dV)QHAWYH4BMph3o`Uq~FuNd8$WVt3t z6F%}+BYs&u-;vsE{)EqMi}|QJdO{$1!JSTQswcA{C%bbbwx>cf><%&ih3)9x=Ppk1qm10{ z*mJ@W9)3b0uFiXYh+zdv=*!%ciArc5s1uaXH>lxV&sx?A+qV+LYJS@2>nLHsLG5pF z>wLA*>d>H;poH)hw;J)wN+>+DbV(0%M*ne+iV|HZ-haM#91C9%a)lKr^zB<-hltov zNrihhyay%`}{aENAV8MBJS z9Sc!)v{F&bH916$)C}U<#C0qL!@^Dql;@613urJ9LnWd3v_%al)LoNdVR2b_CTO@} zV!{&svF5(MOGm|blG_mF|uH3fSOODdN5V!1FD z?n)F82MMLY4uL7O!Z0S6?%G+BSrI9UkU1f7G+$4M;vuQ=r~YC^AWJ0_IiwP@hsBES zWS&JVQdp;LFr~^Oh-mL@rgPe&wX!YVdnusZFC? zZ(-7RLzuh}XJ{2~!LT<|L*xGF0`w)~;dx60KDic>h`>H^ zUV=B(G<8tqicb60y58&fY-Y2UizDmU z)bk+=aBcaW!CX)t!&8&7s?6ZbD!BK{DuKefrgeIw*|Om}!tO@M1%xf^p1iN)+!ei0Qccq^O9&#U)KwES zQ#H$W$GO>P*~ul`9lH`MqV{HVB4?djZo>1U7h*R%w^02pkfed0I`DLywRNR|H7QkE zAz8uin{-rfBQ{vY>Iv-TLhI-77%Y|n2g}_lEU|$A5}41^`qhrM+*wDjFRf6( zCre1#F3svRdXjkFT;laB*nP&YyFK1~QFP^Q=rH-?S zj_@43+~U{MYJ)z}QbCKaHkCQFxBC+kx}N$K1c%<@pcBl1wNtljbJjK0W{H-=p*LbE z$3w6Ju?cZU^{H<-{?}u0+A1`!*_zSdjk7w=ZIqKMfSe_aI%pv*g>qKnynOHQ7${wb zZOUTB)0v=ne}A&x`}1K@AC^j?6IE=jb7G})H^g$LGcpJ{r?;)>wE0WxLC^ED*JkfAcCXbS!-1#-sM`vWDeQWwfB%-M}(aNbj#& zO*~>9)Dmxx0RKJ99?XPhN!W442EBU*b(+5}w~(ny<& zpnup1UNEcpW(Wz+dQ^&+60z7|GX|^kdhGagOxvYBtxalknx?%&d$aZ-?S0yF+DEm| zXdiDm8zT46;#a=OxoOJmXvdr(#59$!$h0j*M|;{?(?Z-uaAMAJH=cJdzXQ2-9*j8m zhnx+b{=)W$*a@PFk7(H)?YZvLv|sXPT7+*}RKQuu`#xd(0x({}t61zb)hkp#X9Z<+ zkGE@I&|c8KseN7hTkU(b)p*}nTS>_sl-x$iy_9UBWH%*6N*<)-ASEX$nWW??N}ix( znvyal79~we-bl&oDfwAS-bTqkrQ{bVc|Rq;O3A;XL+Gg==vuL(iEZZ!SZ5GEii(;F_ zu+1XaX7OvY=(Snw+AMNy7PmHwTARhJ%_7!j@oKYZwOOp%EK+S2r#6dHo5iTjBGhK_ zX|w3GS!~)YGHn)@Hj7G|#iY$5(q{2!vuLzgEZQs*Z5D?%i$a^lpv@xC=H_p6)3>?V z+uY=BZtgZWb(@>H%}w0q=52G+wz*k>8twHAH|I0ll+SQ8KGV|fB;EUh_E{*VuV~-X zzT;}8o2YZMR=SyvSS#H{N34~0&=G5;J#@rc=?ERMRys>Ztd%a&5o@Iy9kEuLqa)Tz zKSf8ZmEKNAtd-tJN34}TNJp%dew&V1D?LX?td%}ZN34}zpd;2wU!x<|O5dd;)=JB% zo3mEhNJp%dBsyZPB-0UVr2}-tTIo0)u~xc3N34|;I%2KVpd;2wucaf_N^Lq~t@JKB zVy*Pcbi`We!*s-2>38UewbCc(h_%um(GhEgKGKZl@#G zN-w7))=DFE#9HYP9kEtAK}W2WF47TeC6$g?E17h}TImgR#9GOrBi2gqrX$u$|ALNK zEBzK7u~zzzbi`WeQ*^{y>5u7%wbGx_5o@Jy(-CW>#iUeNE3Km=)=Hb{h_%voI%2If zPDiYj9;PGKN@wVZwbHBTh_w>!PT*=Kisg2-61~o2t;Cbyma{f&q48k67F#Z`IZIZd zdxmUrkTqT~$H*JWNk13UD(;V)$cv;?+ zMa~dKpVRiRG$mSHh65JX6ijl=6jvPa&c73;##=h)VDe&i598UhW84S&6Nd0MyAMC6`qD2L6aOZ7vtd^c;8ugP}<_H8#{F zi&xqrEX1v56I|O0%{I13xUd(d$;d@%8vJAdEvcx0KAX%ZeO<>dx$gk=0D92{ZI0Oe%}Dl5A}xbHnkgS z+q-Fqd=kmh3YXGe2BUBhG3{Dd5Y!kyycIa=<3%Wc2 z^gXG~Oq=%^h%oCj9sG^#KtGrl(82&fAMOuytC4lu|MBdgpUVq$aRAV%otUD2c&&K< z+2R+nV|^hntiuCf?d8uAZ$U>2yL)S_zsU~vyLo{fSs<{Zg^}K1Hw|UBur?xVE*94A zg#jy%^#ePc9ju%e*wF<8+eeHa%?|c>USP)-4D5JsF|K3>tK z?n|=6y&YL|v7!zR05@CP_UW@@*};zF1@?gj13TJ#tUa9_?1{X<9$GN4W4*y@*}``@x-{Zw99j|_lyXSV^RRQrMZ z^X%aMEH7{q1At4=N3?IfN?mrpS%hy7iZ3e_rk45lH+0nf>FLWmcKsVMcr2NTx4odC+n&#hShxu>w zf_ZWPn8hA2duyA|WJmbl^FnxP0E7wJ24PLTv3)%|w!g>=+vx$YCA6MiHD(JWq`eWY zT$|azS%$2+7&vDJK$u{x62ji#wqytQvb?~Z9RS>Lcjxn>hM`A$Lp+!r;{LoKJ~jZv zq$nNo#ghgNIpg>CM*Bo|wCD3edu{-<3DT;L?CIm`X=VpElNY%21AyDzEv>p`?AtRu zBJUm^?gR2|*+KqvULY^z1hT9cG8T#NA06)Fq5ReCApdz@ARiw9WWtbGo9m-+em6U| zf1ek&C-TB(_f{{@XUF!3d0~4pFKm4#h2P4K?Jx7fb}=t(S9-VGnsu3tm{rJ{ixKlw zUfBA~lkUroZEIfGo*n>Ok_|(#w=zCh-0ajR7rs~LiLXy=#0RqD`?b9AmGZ#{YjkvEPak~0mmS}K$P3@)0q`XRNXPml zzQ!TDY6zbP=q4=$_6Ge|*+KuGyg*L{ zpjBtJzk>j8>9pG0^%Gl2RcSY;9hg&CMcppel~S;epNj3nuvG!}Iim$Two)+h>GSQU Z@t@s!Ye#X0Dzs^ux49T?G2WUg{C|abzF`0W literal 0 HcmV?d00001 diff --git a/it/doctrees/log_management.doctree b/it/doctrees/log_management.doctree new file mode 100644 index 0000000000000000000000000000000000000000..4a8759a5edfe55519db636c245fed7a871150f42 GIT binary patch literal 58404 zcmeHwdz2hkd8cf>N6(RL*~WG#Te2k&uI_n{B-^rO%}5^Wi6q;yjohy3uIZ{)Pj{!P zdq%SHS#yH3?WD*qrU?f^%pR5nvOuzgaKLBTJ;@RX33(l0d2b*l?7}%D3!K0PIFS8) zU%hTsS9MqS)P($jk9DWI>ejvA@ArN8yN|k$XV<>@hQC|I|5@A2nxyFp8o@wo~HX6#3S#213wPmeBjJ&3o3x-;0UBtt!6u+*Q&5V=4 z`h0aE@V>Uzy2-hx4?OvJCX>1NWNzT)XWxo{Z-4pO-)?E^FSfLe)|&I`Wy-Zn?B`k} zm9?&>K!kcr+icD$)__v48~R+M4hSUjYQ11WJZpWvte7Tl;(BdGS+K7*6dE=E$DESC zWT^8TXXE9C@^>w94Z?v=lZI`y%+L-fb!mo8MJGbJlnI*8* zit{H|Q0MiEUe~J?Gh>+bmbIp=SJc+=wT(G|zRqmSnRUGm3ab?%uE##uyE&7QUOQ*J zR)QW59+b5DLU~|7lBB!mjO?KSm%i0_D!#RrAKOm{E$5d_9w3Z@HSIc3rQHDXZ^XZw z@$Z%RcMGUmH(xat6q1!PYiYZ+Jq_(PZCKl@?bGf!z77f8*@#HMx_ZuNDQ+_K%8>BN zYVCGyHBi6GwksfeH6hDuYW|X}=c|?1O8SCQRDm&*$>M+hWoBopxx8-V%WAG@sA?t0 zFDxj=rHr{)Bq9zj>4my>P#T@^*jUT&ihSI++_Y^fV>w%`ltI{lj|LXUa<#0hM<-g= z>V~1WtfAz{C^4l{&ylq-ILt1E5e961& z!B7jivRbdJhI~0z38y?Y-_wQq&dDX>eX}TkB=dV?m=9;((sIwVG(~&bV_I{V-V(|5 zQY6z`$W62{eK#>}*7QOrbEoHHVOGao)Am`tGm_Pqw-b@L(GyKzaNM)qT>%EYj9kKg z(zUwVjcyeISyxosq0PO{^^`Mn$g_Wz=~loT{wXQGuwnGU_%s*z=8gU6+bwT|ynV zP}3#2-?~~sH6-a3>6aU-Syv>tj#HjO<)lhxwNjM|3L+q8K{ZTzYeAJN)e8Pmg`qF% zHfe*_qbrw#SBbq8Rf$bDP3kI#a$-09irBl6LiX=shm=qGe>?kYQ^THD8zK zRagE(BtwD`Jx01CsRP{oh;z2N{krKG)HCWJqXCO>le_zx!J`_ zCDIx|+A7+bc}Q{mDzsm|=v8crh1YgQ(Wg)v<$88rhxf_CF;#KDYFx?LH_GK=G3WJ&a!RAFRSk4OR1>AFR+tYFwzgc9 z6-D62yW!Jt(KVZu5y&M+iY3Q(F>ole)0rbxL-i@@=4JATP5wn5or-cXn>?pvr~(Jh z?F_vgC_wvNCVI}-1$j#>$ayX?KFHli%8I^Vo>2_+J<;0k9W)~jClk{DjRFHQI?Tus zoohQsfe|MfGqSrqnr|yJy)qOnq)XSWv2+!}be&TTT`B8Nah+oJ%T_Rz5LvGf$-?k} zke|Sn6U*kREtXH!bbnNZBy^eD9m~`cVWu8@Y@ffBebnu-96lN5&{lz2!+2mHm6+`+#WX?& zcD+cOZ9R5gf`vJ8Y_dXee2VVxuk;0Eb8T#IEI;i&yfIfo`*(Kw{FR#8w{todNF~Hk z(1+VGF@i|>2`mMDcsQ2NQ@=huD51;LzF4N(eE1QJ*n_6(CAHG8qY{z`aTM_3dE^9w zC?|oSfDaEw@!9Fqhl_%_)Z7tEO)Xr=j+Aw@<;fJONuTHTK;Iliq!l7d5({0P<5RKn z^A=ch;<}!S@fZ? z-$$uV1fQFG`{TwJ$u+E3#S-$cK*(9OsGD_rydt?R8Nyp}qZ~UOGQ_w770%;K=&?`4 zJxPfWQ}BgxX}B|%hI$MQ=va{bp6q$lBT|r1Y9Whp+XI1D?Xngz5aPB6#MtPxkhDT< zpTZN%qA)DE%cva7D1CFuowj>=)4G|jE~-WkBO(R&6<>?|71bL!+wPc@7g4Y$=UGO4 z<}-0HDHGo7z6>tzOe}7(NjdF;*nPU6k+b&vcb_q;i#o;>U4smn&`n`dScH0^l*WVH+HvX_lz@04#f(h++Q6@U8~42c>EaovzRJnIa7xZ|$QV;bzH(Odit zjf_krC4=5?7NkoSDI z^PGgibH5a&GR#Vex<)b5BRgZ6k#yKWLS5MzlSewTLusVW4khZcGuj(FG_sx!JDrB; zUE3M&%nlFpr_K%u=CU)^Gdn4jtnmaTYrJ#G0y`^EvM5oPo$;R8nMliaCc2iaae1Os z$pSm{JY~N_iMs4e^vup=TI_^B?08<+^UCA$WEXbmdFt%=A9E&qWM?8Rzk`Ij+Rj85 zze8!H&JHE&+RjugJ1RG1oDarcMLdy7t=8hCLJaNlJ`B2^c|s1>TwV;fUYG53M3!cg zwsJZ(IqYOzp7!^_Q%WA11PQl(JQloiMm&k_A1_9Lr=XusjVIqzABg4YVx&E#TwhFL5WA6JK2x#feyxU64`2&r_%C3NGMdk+WqrX7Y{^fh-E94Rx>5) zmaMyC*@^Z*csE6U+8FZ6jaRb3P=F&ZhG#u2Qh=pYN|v3h%hTPlJjGd2O8#f6&HF@I zk?4E8=K@1P&y$iB`F`h~p4k~orwuff8B0*c#$X+8Cq0TCdY*C{hy-(O=TOh=jHkuU zcmj6DyRbvgQ)g$~W9QyjcH%rxYJJnGOndLt^Dlx23ieOE7()4?bVQa?@<3uA^}bl1 z;yh4Fy|5{Cc7kK4UKtWN>f8&XG(>(<@<4ts>~JhQPf^R~+?m;F>7fhKu?9vzX?cn8 z-IOM5(OhkJ2H8@L=3in4Z#~-X$JF5p zuLq%7z`Cp#YKRjtjcf5u$4{lkWhwB~FL-lqvw8*Pbv@Sov24=J>D&nr zs4|xdkxJzH4r>L)3tHh$(xb{`Dl%9lb_G7|$IPZev^tM}K7<~LCG=Jz^l&lEpg5&5 zRQlG?GXbdk+edc2Xexn}Tm?_Z%JXkYo^rKP#B}b(YF?QuV_rLE$iuXQIu_GSHtCYo zl_Tp`a`tzIoHJ6M(hPlaesdZD&RE;8L5SMj)a?H{VOnc5E{`l~4j{Y1tz`sUND`ba9GxYyR zZgMz_m3Q=*?k^4_7#@kL1vaS_FK>a&&~4vlbE3_zgm|u<9*d>yL9)~7lk$<-nV?Y? zm8YJLtJwo%z?W^GJ-#}x zi0<0?>7zT62wj&fU5K->5P7D?^a=Ug%*it+W{=JuIsDk{=~J`4D0Fl<3nh+>1N^b! z;gPWjh3+Vn;hVAOM~6l5vM60pZuC>1iXIdlDT~X(gRv~|1oD~L>BHxI;A+E=%j)F} z{#I)W{$$H)Q7L<^z?oCo^B2x%@5TC=d+-mll^1UtJAC@V%!ynER*p|46H{;jnc?B7 zG5R}m>R8Ck*J5&*B2Jz2ZurlnV$-GSI$mz48vc5v~eTb>8 z+(zc{!_e3D_9s4fd6zqK;VUJm%i)Pw4ryha&!KN%D=Ag5O>8evCHjO?7r6OzB8?Vg z^KxHWF&0<^buW>2=I~jcu6nhK-4b-QKF>8V>XL$?%-3bQBUfoIoQxUH^6+@n9F5g@ zBw%-b`lu&eQ|U1mSNo@8f$-cD{TP-ZQ3>+l*lpeRMSeO~EMa~PtpM~E{Lw0$;jt)O z8|~;J&C<<`qi!E#*Li>4vUb6qjs?rBjRmb)$prh zIhbP(=nEv(1>RWKL}n^E9qv3PcV(Hq&gxuUnbXU(+A!$6uJzo$H?A}xPYJyE5kzqi z!KWzkz*0BST!PNV611NPni-jN25YgLm;5|-D#>7EC~K(s?0Na@%n^AegE%r83d18K z@+^7@A=qnFJQq;9zkN{f2lZMH>ASL@iBHis~-K=_v2q41ueK31n2iz?q7sdHl6tp`^4h`AU@^m$SU~E|UsKANm zl`89^)|e|hbKK1=qVo1VCK~L+W4YQGjY62{;zf+uZN^(w8LRv$Y5-mEzK_mxz5NQ{ zqJAhA^;tsw;3I-pq6O8Mcb&ha8h*72sk5|TT&z4xRa2Eq*rq^UQs-o)T%=X6+JYIf z$knAK(H%KIeUP3XT7JeZ+=pY~aoU7ed@bKEpGlD(`*y@5}ou58b?_>1x zGIe1-5)0GOs?g|8oMTX{Sch+1snPQIcCCsXZ9omK+g+|!g^XRe7h>Taw~hFCA6gB< zy`+Y#5dgasR4M)RRq8F<>XTr~(FOQuEI{^64?ZGvGyBZW)UmNvy@9F3ZI&zcD1n-O z`Y<1G{p_;yb-_Ls3)Y@?P3uPF=`+&dsDuN2$V9RBQS{Cp5kb5e*okeib zza|#F&Xuk_%{7f|({N7BV_*c0-usUT%I7N3?ZqhucEwv%vr)Y{%r>)MuUBh&-jqiU zMD>7f)Mac7<@W)-x90LS!7eD8Et}0>D4NfjS3s66r%T$!SklIbw6jN#OihgJ_e%$5 zY|Q6nwLqIwaEl8+v-n5xLZx86d)uGOAl&j{-R_qAE~&dhKaoUeVWL>aWWzJT90|qg zU&5_kh4v?P=+uT36s$|Q zpPZusa+0`%Kw6%hE@w(CXFRrR4;5W$n5sKg1dm%+3o;sdNjZytTOOW_ zGLoA*;pU@!8s1u43af?=`Q|ocA-c&So`iewH;FSPf-lm#W4kY;r|oUAiiBPai!LGwK%K z$A={3k@NH5y+JW@xY1e!t+tNp&V6{e7K1PNO6fncwx7k$Fc_1;He+Y1 z=m$FO#leUN?tWmUXV$D*6}2UpO9aR*J&icpuF_@tgMB--y`=_SV)suhTwlVay9<^h zTj>$FLtBOGq2zojoH>&pdqk)M*J?0>#(^%(0(AD?v<8+!qsw`*xDk zV|WvIcO_?Ww_#_#1==c&_T9uHWIXQHm#%01B<$3=9Psx9rrWRtbcbwT|gK6 zDcWxbYPD&iEd(oS+0W7;5h;N|NhzZsR*{vd78_)@2eFr}EDa5vHyUPLI-+48y`dpj z2nF%WduM3K@#Fu2M3u@4b|=KASn1>Mm6XLr+Oklgn?5AieM@s$o$hExdi-3qT$O670o%DK=5h|>7VLMN9L^n< z3>|yPp*aLxWMKPDRpM=iLH`|2iemvu!)crkreQXqQ>>$<4H=P!lf-x+i72q=4`&?S zsiBWoodG0gZ5{Z3_Np+4 zIvdB(&_l4cS?FPS3G_q-V#DU4csx2;tKi0)ZO9o zy5`<6n=2 zhzZ0=A;uA%AR0!S<{D`8)T0|t`%1qrILQmzRjXF5Y*S=K%3aE(ZnIkC|kEK+9Whez1@^cUrylnzlb<+_Mfwz{h)O`*zoDGtr=|5 z`jSxc=A7#7mmKcUQa>)(wb%xs{+fj|Xz%b@hq8zS4h+2j*PqOM;Bn^>IBL*OISciwkvp{503B z?cSw!Oq#Ms`(@CY=&RS{=V{~U#drr{yg%aX=Yu(mUXd*b!4Q0=|+2H6V z;}->6v|jkX2K?81-&IGpVZkY>FiJ||8DWbO)+ zX^Y~s`PJlXeu;TOqFaM)Tt6|2VbZ6K4Olv%DW-0UjqmGX`o6BL-4y@b1fu=};y{JA zsGSWusCXQGQu?0^Fp>L=Qv3uu7qoM3^cY|d>fXH0sl;gJP6Jf0Cz zaPNfx+#CsNaWo```uPacDZ9SYo z9!GVyJiVyy2B_{HM$xzG?q1GEf(S(#5XWs-ZWhz_Nv+$Y2D)oIBfd|#%x((}sQD>9 zoq$|N*_0_4+<0X>as^6mZ_0i{0(l%|+w%0H>{me9HAd05vhNcWA~GIVY(vcBxJ7D^ zh+k1kzXOrFDExg)OR!|4d*>(aX76fzd-##B^50KDv7>Uzwu{Og$pR`L6a=#ePF=C$ z4e^f?NaZNrmZ}%U-w4IOhq3gn_(MU(w~q~X9)ONe`_~~*7q!34qy*J|?a)v}<}Sg5 zZO?qge>(xij^ZifE{b<#3n;#~vi_3<@;EBD<>^J`H$mlp!zlVz`AodZ-QpIi_98T6 zAH)|Z@YZx13A4tjpBqz0+_0W2-as9(D`-0|3fFjch{j_-^sVO>POmeWj`dL1U988E zE?_-7Bj|HQ>txqs2_$pu$d;@ZJHokrrE3{aXXt@mT6_l9I{V8JI@2w&{j*P7c-Iws{?CB8yO1+mN0t=KN};JmJV6I<7gU~Z zBTM!k{yDwi{4UjX=L+*GohzKF?cP)B&Xsz(W|zX?Jhe^2alE$udI#)k&y&ZG{kCH9 zfzR3t?kUfjd&G0+V{%K+PziuGaEP;gnl?_pEiK@teOhp5%jHRV-WUyz5-jO#??Inc z{+HC4Tk8L1GxbJ9pCdXWjv^PQG6uW!IDXG%P5cCA9g4I%(c)x@tWB24(qxIO4A-zQ z87INo)>Zm*lvlSS9QoyFN4sS+g8>be-cI&F);DNHz2KpLv1jx+2(9!swwcbB=J?3B zaMa*8l#N~)jF9|8zT`qYPv8&tEHI8ID}8Wz0o?eBF zZQ$>wV4kzEpCPqOFuA*d>CY9+RCgvy>+aNVr-9>6 zZN{13Qjuo1BRWm^ZB#JFn5Gdcd!U3j|T9A0V9_&Mi6UA||Ivq4hEvlNKFDm&fnBV*Ivu~x% z8BG&&iP6}iDcG24J>xdX?2UXBnrTduVo@|rn$|0M1&uP?&Pa#L)K25s_(gn4f+&z1 zGpRuc7D1?$r|4)?nsyzUz+I@;F|V0ggZaEt(ai;J>gDx$&;Tlc&JhQ*ym7KT_8LND zjQL|KG{>C72LOV?BJZ2N|Kzzlq`anrdOEuGDFsYH3X+-LsXPUVIBiOqCa;Uy!)$a2 zTS2Q6Q_k_0HzD0VvECCU2*H619U{3Jc11Fd^Ff3Z!(3fF(F8+MaE*|HLmCht^@u$dAqdleXdaXU|*|26uM!At`2~i#TnREi%E!&K8{ndgmUO?bdkQiVD9BkhRVBv7e*5teAQY?m z3%`pgcY+V59x~MjwiCwQjJ(AhQ`^1@2hNjRAlF6)gtstG93gMpt|)U!ZUZFw)&x74agO&ZE(mH8tAarb)J&+DQNI^>t&t*~ zQ*Fwyr!$HDB<~k@bY}X=oLvWC81KU9FI3lu>iov+vs{pZUyX-*)vQ~rGrd`aFGVv! zadyTcNnjo&y>Geps=)h$J#(8v%IJlTF0+qyqHGhxj$QAzryG~+ZYFr zm0V8<_jejuxPv2B{RBn@ZBIh(tAe$CXr#jDP*Br9{*t7?BP_ymp)p85Q5fAeb!hkz z<+qB}h2#|720S%;XnoRe=mnm!MLD98Y<4sehAXTq1}5pxZtPLh=HN8?aTh<_!mtzSoc9@*UDhKqRu$+C}!%DfK`jf7B zZTBf_Bl@4Ts2Jxi;|IE9=-4U?HT>9Q=Y%CQl}q?J;QVYDW&GMwujX@e*p7>yBFD85 z&A8ICcFb3+^$HfV2@j87Wo@D5?3lBdyG(}&z^_eD_VPCQZT9a=g$s6rEYMEEd znz<#tuI2J&>@f(bk)!j1cVn}m)~W`U^kBtjxpn+%Yd}-V-p{qxpn6#cUFfDZOgGY6 zYi&WDYZQ^*R%d7cG0^E;z@3e>znDs(T1{)KUa2+e*fI^D9Y87&Hn212{+4x9@Ij7` zq|Rw*JCs!eG?SS5ddu2YZPcSvxHmiPZ@Yx z)|RqTDK@bC0oX3!_tiSY+lkHlszxDKP_YFhI{MhLfLLC~9e?6yqh84QQ%bjD#JY+P zF77QP0-M@WXe`vQySrm|AeC>}4L+qz32x&%yfB+o@87DKYNJriU0xt_+Kw`VecP}} zKALD4q@ZYQAt-Q*I(DvS^W2t$H>chDX*)YC-A1JKZh7FMVr>Q<49s9NDXh1}<1J3i z+&mhXX6s_h+C^8$2P=aq4iroY7NGG>hO*@SgoO@Lxq{(Tim=17jy7oP8X=f!X+0U62j)^_s>4xzuC z)AXWN#y{A|8aj}mWopwfsG1;ZC;#Rpt0-7FKf$5)=Dda>q&zfe7dNoX6yohm zjT*Ap3b({tS2%9qc^FVNPeVDrU)VvO0>j6lcxar%e(9tVE{to~DZy+O=CB)rS-%1i zG*zu5lWX&cbt$JVD0(@k6bfj}kOOI2gU*&3u-Edu?bV*QR;!i87HU9h^pH0}5r#F= zr%aTOdakY*MeIjUhBFAEXv`0O6=qXV=S?{DecDm&PVF&mR$J0E?FH>uv=3-6YM;UqY^qT!-pZ2o$HSK%aKWIPGep1?m4p3Ed{qxa4QAWJt}1>xR-*vDL6sF zECr8J@Gu4Q6yzx|DX3BKECtU{@CFKgje@sP@D>W*L&3W!_yY<)NWmXb@ZTx;OA0M=AI)1)rece^Brl3jT_M zuTk(-3cf?Zw<-7$1wW)<-D(7@DcDKDb_yg4Zl*w{V2FZ)6iiWYi~?F~t0_<@ zc!Gio1(zsznu5y|G%0wFf;Us}0tN4+;2jkF9tH2G;A0fLM8Tg@@JR|jPr+v?_yz@E zr{KF3{5=IfrQpXD3{cZ(Jq6cMa18}}D7b}!5ehOC9HQVZ3XW6o00kE)c!&a(f;kGf zMaJ!|uTb0UixiZ(l}5p5Dfnvy4QnIWH!Y^H3-rrP?R!n_XH7QmCYyGX&AQ1Z-DGoa zvMD#&jGJu2O*Y>qn{JcMw#g>jWOHq@sW#b6n{1*@HqR!TW|Pgb$tKxkb8NCHHrWiD zY=TWTzb2brlg+NlCf8(hYqF^|+02@3Vof%$CYx51&8o>J)ns#OvMDv$jGAmhO*Wq< zn@*F>rpYGLWOHeHd&?M4O)AiRrx%t@%e^!19{@FX)6(-nKAZ_pKcrSH-ed!?V!6?>%tD(38!uA?jVN_*&v zz0wF>u~#}oSL~IJ(-nKA3v|U^Nu?|HN(NoASNb<}#a_vxEA~onr7QMI@1`sEN*|&t z_DX+9SL~Jkg09#reVMMe{|T zEps=X-BJdY+fnJF&`%~u_wlsQNqwLjX-8*&5z5f{ z2c0$e_2d};S6Ucv=>y~8ju>}iluTbhM;>3wFdS-h#{A>tnEzi|m~ZU^b5ud)lVn)0 zI2{ACVK7&OYeTa$0yAAq~LFMJB6R&aqw9y&w*&E$~ZlosTDeL(KwzUb=%@X|8)&UpVza=af% z3-29$;62*ertKN>WZBf1#C%J1+d2dPv*f`4BrV`WeE`3!GjN7%7}YKfk-tlh_HWZd z`>H&YiUubpGuM-K46ommxbbx@qNdXLlKX%@ z8LMWRLsG?Lye{3r(d0n0X#vgj0rdXvKzCP@cKc5x2R)k>=xiULV+%1&b+4c%#@}we z#rfn|^J!rn?gMM5@f`Of=tyR?b6xaoa&1$JbGz>Z}`I)i;%a`lqR-him7G@_>Z0DE^t+XCk~(^OI6Jln4RcrrQMv9#dsUqQHCoYa}* za8ITM_dp+T_b1S9mr`3w4z-vT)PsFMP0)str@EEe*Cz-2y0pOF)d$!lr50ej!F@3~ z+}}zI?%jRBO{Uu}W%i@V!G1U`u=lJO*s;!a?PrpM{j0RV9$GQ5)j zKENg`wOzXd>$W6rN3BNGRGJp|^#M0osqNB2mXd?LIW4e<`v4nJ)6&6$Qsc5zY+zwN z&41|f5%6Ggs8eY{y}u8r5hF8%4hyLPR3XHKymOH~pB(F})53bB53ED&4Jf794O}HT zxJzk)o9+W#gg>GM1eh+gh(!WeWr5@VOtb4pkY;kY&!q)-rVqIHw(HWthqcO$N>Oov zW5G#h>wRZ(#P3K8@zFjIN6fTQD`O)EUJ-t|6%#e|GMrb8R_Xh3(O_uyyGt{paM^ z-jf!#$NIn))rO(Dw=%ZLt94f2A18u7c$t3c3!rTV#Zzro6%m8=ki^Y`cKI*{~#^Q7yH00w<{HU+)Pc3?C)%}JGLio z$ZSK@R2ni*q=~P~+=x4qiQylbgZidY^vI&RrgeK&`W87p6dg2#7HA; zd5oQ4v7-`gOxM{VwUWbpci3YiG10jb}y^ zNwaI4goXk|De5VODTNl&(iYm%hL%SQ9NGgtz-dlPX`xUWIKXKRuO8@u9%!3VX#4-a zbfqheq|wUSllGLH_}@Fy)xG!o?tlOL(A9q*@B8KE``6Ha))jh7R+{JYVx`hlE0W%^ zHdfSfyCF4=&YL^CU)_1Ev&-t&#ARJ=Yh|fpt$`S2S*cevso8lLZf?c+hEmt_P68Xs zYQy)u+-Ke3TvG~VqC@el4duG1>u?dmeNC}phc;H)E$_#ISU#so zixj8-e4~C)Z;1$XV@s2CNn4USZEJ%eR`H3BJRt9o*INB0mnQhNp0RT?T-6H*R&6?e zN)>5QX)1=IHub!w8y#z1U1>_4<9+P~0DX<#UeFE201DM67uRJU*t;>G&po=JJ(`1h zICwB88;$zFKrWZNeL*W69$@sXg}eMyeRSKtyUlWb+2jF)eZZQ04NxUt3*=u9|89hT zH^ILb16Au6RjnanSuwMYJSe}UE#D#+<(={_dH3=4kigz{NCMX73tC5H$>1YRWBS0%R{oWMx?@pA(d_+I%#pG{mX|81wl8{7=91!n9f{D_XfOm8zN~HB0nB zL)6aY^`$Bjad26w81li~zEPKrK6;kt<7JncwoPRuXKTee5H{eU0ga<_b*#(xjdrZH zZB6M|dy*r=#KdMrsfe~#TbJ$W$gj|m)w`hrW*lY*!YV?3AhZ@pdAn-iB-TQ^>6N@^ zJ!n#;RF@1x(uDJol`!j8^PwKp$0wJF_sx9yLz&+h!F(|Dj$C@IBa8AYU8ZG+=`Ep5 zFNZR{1US#t2C$6GADAdOQ(l1N1c2XDDgc_(=1zVywN- zW$j6awW~r|dn%N*t3p|OC9<|GYE7kC6`;@4!Key~0Ue0cszcuf2KIE@FqB-iuH>MP zYqXRcm|sI`LN}CCnz={Xl5U7O*2jq#p>vXQy4qB86%isp%!;Jx_*6s6HPt5k!wy4P zQf$(;S@*AA4sIv*k+4q8+TM*kyieK@N}d)*o&LPDT_A=|Z*a8jh%b zYrP?ARmmG4LO(tOoR#KgrY40W(^EJ?F9V>~FBGf44Wa|bLifTRBPwoAzyyVftl_~u52 z7h5C@SpLE7$wVIL;Hi_PhGdA)L5r6JdT<`tKo&;wLw=)Uy?_xQXf0^Uc4izI?)^cn z&S1`uTiz3;n`q(+*)^2IK2}9fqS#dNL;OIJ+BTk`UZU9+wOu4ZJ zy;vnTmZM17@io?AeBBhumyCR!I4Vp`c+@N}FXzQ7w3@2AlvkkPC@}gfz$8L!*NwuW z0_LUwmPm!`s&=7dU#Qos)si~}Dv51FRyCM&NIEpDR%J0jSYN#=h$6?0d%>gOVWu{# zQy@l8E|MJErho;RnaWS9n&eT`%dC_kHX0OR-*}i!+2mRwP2xCkF6Z%SUjy3Dm{@VX z4CIR=K`v5@@jwnv)iyuvUV_D0fR zM9=^e3)J7cSG?*GT980$0gYkf0pFu`TMJnTVdDWlHcVQuv|MbD!V{N7VX)+kQ6Z91 ze92OpvuAo!ie6TiBy9yNA{F+CSBv!8)LkjN(orclBBxKzy*z)^CfvupGBDiv zNZkC8a*BZ%oJ+HE)}8<0Nljf+U=fiiWI%;(2$CYGp{r<4JddD3HDWdGczUwB3(MFm zM6x&QX-#g@UNwckX%<7mRzjE=V(YQa(g#~;b#CM8HZIq~-@wYqXi_rp$!?`7M#AkiZWSd#YCA> z46Trz;rviG>_9?2*%=mwV%fnoGG_-9W$f%*89TVLo((&3OY}^4M&j9_W&X_B!GbY% zhF8o^MlEY3LCYG6Z&|?3Dzq$2l(93iVs=Ke(w)(sEo(#=jcZxJ4&Kk$?qH&fozWGu zGnN%Q!52HO)pf1%h%nZJ9lW18JKoEju@$m2nw8ywgnH`EXb-!CX=Kh0CdzbYJdz!W z1~SeYVz(n6&1cqYQBnbhcDOGFnPnao{5_W&gZ1lzoes~^Owv(K+>pagmhrSd1y31S zXe>x@^y9MNwln03AOE;9d_4K>bY?txmij;>PY;LcQ%063Xot3U=@D;*+`BF}ejAi{ zEdhl=E5DU+6EC(C%cJ(8y=Ey~FLjCWa|FfHP3k9(hE$ZvTv(jw39 z99l6u!`Y01#`D7o+So8?2b-jav4i(B9s^;)nC={2F*_q!u``l@osk~w;Qh?m8FAUU zBa)pc3zXU1bUfcZJ9X^~XMz0lQ#S_JzAzo0rHm{PKSzC8Bu`NmD5F`}I81i@Yo~4- z;y8+*g<%>zKN(pdZx%KY$<9R_`OKf3nabUBU+!odRzLB367IbzZrH-j*=z^datk+H z!j@g5&~DXLv7#6D755DlisJ>`XeQ96Z`cur+j_M{v0R3|!cF=B1h@Svf>LQgoRDo~ z+v&;nd7fC;Q2%U^1^kyVO*#^yi=SBax)jR*31@;h_V<$k0B4TjoZ~ zB^kPsSG6kaAg(L$%CUeKVB2#6;*S)ICH!;X0R0+*UZGIjm&gByN@K+Wd}@cc@%mB` zL~$sr7uX~<-Ml$61D8FWE%7?L8pUIJdNh)8C&}d<3Utzdd7#f`@9@t+zP|&M^X1%`B5a1ghjtB3GN5Ns9f)sf& zgm*cz*p$rJ-)Uq^5)w4>7koUgsw-H z4B|{AMB1q_bwZe*zWd~fnIkik6A#SH&CaZ(LiZI5P>Dk$0RCvPI5Zqmq1!8Uu+8w5 zj{+J&-$5x{<%Zw&s8~Tohn9u0a4eDq+CV-%Gc_^q0hijEP?yf<;jh{f;ZLD1RmHkH z3Y?xToWAdL;STs<<`DdY-O5Y13{T7*%bzIaLCfJ)$>=zkfPAqyK8$~-XO9Ndybm^q ziTu_%_kxH0L8b<)Q5;6h@knBpu?65rPN46SCg)BC+WIQ>_W`E1(ioZ64+C%4yYG11 zl^J(v!dI)HjKdR=9O9>N9*3TSt!AnGV`BS@RHTnpZkR$euYyU4#U-NM-S92Ud%hy?P2V> z@2^+Z4D4JaSo+!s!Dfwf9hQx&K=ykT(4CA#cR%XnoW1!B`ikBd*^ZzQnEk`T0end( zfFF&vCN^Pp04sH7DzsJyocf3Efy3-v&D&Q!+hyJp{AR~i+@IbOU7d~qOxM^WO1rCvp21f7Z` zXg?A(Jv8Pl*24F@Xy?H-Ngh^)3Yt_doEA<^PYTm{h$Fy2p*S=o%)l%m0DGMT_c@g8 zw+9OBfzet)`mF5pk!3%CWuKX!+do!>ja$Vcx8O`5bd^l6Zh%7#QL7Y2iu=by&FyAI zSKUN75W(vnn4Qc3_sWQ&I30-s-Jz6VAUh{aspSL1Med~nC0-U)s*6^8q3-N)*9#Dp z{PpNCU@s1rTEn;sp~Dm}WW{bXJf#ZoSwBYgq4Qt&(7C2JZ2=hSdm>SvLe$63a8?OF zsD^#l<#Uqeb(>J?0)8RRcb+v>mxLPlB@mXS1wpJ=@vB$4p$9Z_ZEcx1N6t?Vq-%#R zJ!1y<-blFAt-=>;p4Ca5t36h5@!Fqf_-zhgGq{R%etJ;dm(iD&DT8??5~fqD+@L#g zj{aJenq}=m3qOzVu2p`b4N(2x?OtlFav3wY_eH`zZY%Ne6t(Jydrk^=BLM82ze@3^ zSEcS}TPX>~92vm-BLR|aI(CMeW~R(eSHP2&(T1(WU7E|!C;>J8^kCk_?Cd4y%fLPm z3D(|rjo*z3QzzAvDJs=&s+AV(HyDju2#Ilf$z$FO?SqkM&!Fzk z5!zELtlt{=h0&ck40uZ;Cvl#e3V#J}w9BROwaj1hAg`$9#utI1e<%{YLY=NKMLmsR z(=acUVPOOYy?0J>l}}wDo5hJ5xWQYJ3SqN3*llJ%Zm2D#tP4X2!e&6%D+2g|^5%f< zQw!x5rxzH_E}P9?AezUT+dwY4oQ$-GBS{-Z(oP+j93LIp@3juhSX(R$QU#q;(1;6u z7T_Po3$%g_?6S9)fxG0vdMRu7JyK_denpZ(a~s8ClMU_!b4ti>|KcvKw9wwBu2N*7 z(PbEpY=?)&0)>W=s=c0|s{-DINq4(xXcyowcybKWxDD_K#^kh%yX2J~##y!lAJU`* z*)Zwl1-?BCxoIR1sjHmz1;cr-kBJn3CKOmm|+uk9Zzq z?)TE9PLYiDC?(@-A;4F^wE;{bjSrc}Qn^oFkA2TBaIo12ix=>g&%0%+-chUJA8=|Z@3f8;WblPn(Aw~=lvY?)wR7O} z3Rl7uNuYHAn7`;@m*_gYW~x)E$VDi)pjt=XK?lSNcoHS&p&Wwy-hTO-H8Z(WCvzv~ z=I7^T=fLY2%xqzG2HcD}FFMhUTLs*)RodVl1zy6|(K(xx6Vc-vcu9pNog6eh{EOd8 z=X0|XICB%hqZ>FdE4P)LfscizwIso7U2p`)@-!sy38z45_S$aaApN?bG?d)b^u1U% z*h$h?C1(?WUzjF^O@vk#S&1YL z9foc6hL|6i!Zj)=62x5;btsyfE*6oM$$sw+NrK;1#|_>D?0eDm9DQ7$gJmvN6La8E z2`J1-P^LP*LP65%^_?zpwp+Z4EyEA=RDN;HafJ@SWFE zVM!&o>mYb7J9zdK?Mt9r)9lvm-bHYpWye2!c6WYY0J?*wYJdwraC|xo2}7j;Sqf0o zZnabmCeG-i4@xwDbN?l~nbf)$o+{Ck|L z+(|X5=4R(+k-2H`6$mejBnC#!VTHg32+R_y9qSESR-T&Hu38gXhwC|Q^P`@l#7FJ6 z=en|#f7>@wWP2M~gR{uBs{9o5rz-!U<4m=OZ^c>%TQb^>yP0c6XtS?%+H9zoMaO8l zO?+qVF^osS0@A&i`Q* za6M<%o1*XC}7LL&cQbGKQS@6LPh?OKssKcT@M1JinYS6Z(9UWYv> z$Gi2`|J6Nd?HvGxb)>Z~BQ6@;ZnK6~TyBrUuRuDW+5Of=*xn+;&`;+XxiUCZu(fuZ zwbeg_@Y4GxrRP`4pyquY%f6$ASyQFY&G+K-dUYqMe(8lxK*Pc>cZ!aUiO#$o>qhtG&4bPC6Wq*)U<_9Q$Ltc$J-o zH+7knch9yLywu$0?k&tP1K_U5VnQ+{#CAcjff7tyyrhEd(mg4GVnZVGW!6?$E5nl< zO3on)v({#Ih0NouwNZyXd0=|sbc$_YkL=SX7B$+_4u)?1y<#2wRlC|tle1Z?zbe5@ z42Hv62Y$ffDY~?7wBW}kJEsyPe-3^QI6vE39e!;w)N%=rguuIyV;>YvyU?+=FRH46 zc7wZl{4#3`&OMv$M(I56nD4-qt>7|9X~9c4It4?AB(JxxNOcL%#n4O3@Q$hk4({k+ z3dqrUz`d{;{kv)gc-UW(>Yd}4TLUtjEx>;ES=*%Z3eW{Z{kHC1?W;%&?J8uq)$xA~ zF*HeRz?FV{nI<79FvMGxW~*(0-GyZ$AQcd{VH?VRICjH-qeT9fN;14LtxFovjKwU& z5eHYm5I;PH8v}O&N!0G@gDzvMoo-0}{u_aZtt+woI*Nu$J$aCo7Fb#uLia& z&<9-(oep*`FnO!MSsK`5LpIl#SAoLQZ@!trGaQ!L8}|?$$2l2G$;^saTr<51bPMZ%&}ogeSH*F>MFHc)ZCD zbOj9gzzoglSTVs0)c7Vi83gLv{s|ho4ciqcPO}Pnh_h>>bN7`yt*tGoRl@!oS|iL3 zArlz$v_RdV_}DfqcN;!j*7L0k;AFT-E07)QYK%z*fS4r%H%vl%D>G@rswcyU-i|q60=Du-^h25ghr^Ilj@l5!A9#a$Bbh0CwQxF)mM7SLzqQ ztW@PX{KI2SaQA)3+N{GVB1Y+vHZ*G;h`Ne?+dtu(fii3Wrc+^VEXy$AD?<(1%?(&4 z3h@k*b_=q=LvU!F$uR>@fC8yy{EEi23)|6Bz-cdmcyuBGWG32;5f6ts*8#O@EWjBX zx^V%DAWPtF{R!*pGQ>Jpl3@5%FTsI5FkgoS8YuQQXZ;KGwZ3RuwI{5#Qgf*TcHP=& zTN7x)pp7^>hxTEV?4cN;+ZH^6hK|sYkH~xF2jG;EWm%TrB)>*}N`6xQl>8C-^YYVe zYrF3m`z#$icL&dZk&pOJL6IM@{D*VM%NBRgg#0Fm?R8f$%MbJ4FMq20GHyKid>ipC zvI5YM6_5UT4935B(GKsDpOwERe_#G*`6u#^Y6CDyt8GAW4T=|_cnOLZqZmSwM{yX% zZ77bTxC_O7DDFWap;$nnp-@r$42nllSSX%A@ir81LGf-BzlGuhDELUBEc7oymO;uaL6DE6Va6U7}U=1`nK z@eqppQ79-DQ7oa*QM?Al<0#&U;ulc71I4eRcn^x-LGd9JA4Ks<6n~E5vnW1;;;SgW zjN&^ezK!BJ6#t5%Z!L(+QEW$X1&W(c+<;;)irpvvnalX;(I8*i{i&9 z{sTonjDl+GQS3l*6^cO=ITS?{0*XT@4x%`Q;wXwUC{ClOpb$~q41HwnCJ=3_A2rx^ zQi=yPJ!{I}H|3w0q`)RAuStq)lG2)_uqG+1Ns4NclA5HTCMl;$ifNKknxv2>DWge> zXp$0|q<|(VpGk^mlG2%^a3(36Ns4BYl9{AnCMlOmie-{gnWRuADU(TxWRen@q(CMq zk4cJSlG2!@FeWLBNs3~Ul9;3*CMkzWieZvcn4}OUDT7IhV3HD;qyQ#WzDX5tQl*iCRMIU6>CzZnpB}CRi;T5X;LMcRDmW{o=FvFQl&l7maoNX`kMR< z7@BX%KaziFTbawSv67Y9iXpNx*JFsR%q|R(l^MklS(!UAL{?@FLu6$h!Vp;*1w&+I zmM}zC<~0~1EAvJSk(GG|hRDji2Sa3KK7=8%GPqP_Tba*dh^)+4F+^78I~XD>^BjiA z%JgBgB`dQXLu6%c!Vp=Ry%-`Za{xnRWsYEotjs)y$jY3>5LuZ9hRDiX#1L7T*JFsR zOb0_`W!{M)vNG?*5LuazVu-BF(-PVer&d6Wp-eQ ztjr*W$jTHkL{{byhRDhs!w^}SGZ-Q(Q^62fnMW{0R_0Y0A}jL-43U+2D~8C*ybD8Q zW!{e=vN9jT5LuZ|V~DKGGZ-Q(^GytqmH7dN$jYoiBSBVX3x>$bT!$gDGCMIuR%Qf4 zWMw8WL{?@NLu6$h#1L8;dWF@tw(#R8>OQx?3Jwi6am;34!I3hHXOA5CD|S2>h{AZQ zv7px7AsIz|LExeryWf{$Kg*RK+U`pqCOn#fGpwtFX*qY+SOYMQr?=oZVcA4)ZRpJ) z%;Ppp;@fe!{$>~)ysmQ!2Bffx4?|n$d?Y(VcR0^q#@C2j^$YOUwZSgClTG%j(YHop zzkP&7tNSN_vUx*mLn#))+h>OF2;J3&4?!*VdR<9tVLNIc#BL?z*gp3~OP@34yv$l> zuj;LvnLRRxb3gm|M>cJ*y`NI5eE|NjMH(A)I1l-|V2x12p)I^v#KVJfH`6;&@OX1` z4o*vgc{RLLa%LVCZlUk9$-#YQrQm9xh9_KTGAy6spuThbMqJ!jA;5#t0QrM?;=z6= zIoNM!1@=WLz`iU7tmnfBW}NulKs@BW^@)}Da)`Pj<&CP}n^Hi&wHq>>p%ahprsU{u z$O>I91-hYbboO@~2=yp}xN58}a{z7uVpUVpH&J=)q znJ?c7E%A`QmmKnUvx2-U1>_#h8DDca$FjuZ?cb1iT(useW-_kYodWNXc%8P-Z$Qn) z!K8hvOFZzw*=hp z?oEL;x`*Pi2973)hyF-%=*_I43n`$FMOL$WbVoeUHzWsYW(72#0_dH+f$}Ga#DjiU za?rn-73e|=(2}v z_Hb5UM^_E(SUlJVlY_l4E3jj$1Qw2=hzHwF4pz$w?05>Ww}*@^z)O+n4b3d z7n8%avVyyR72)b6Il-PWIY6txwiW-^L8v}$07<7@WT zpx&7RYRJkAZe@}DhXurAeJVND_hf~2G6mK>-2*6e zkQ)!~FOq}%WLDs&Qh*DwN8v{o#KZl^572N3*aPR1@OXjD)%LRWt;{QyJ__?eQ zA4!2YWTy@1K0hAg)dPu#OWPr8Cc~wpDKPHsu2tJBemuNFa(H{Qf_GO6c)PpdfkXUw zY%|HR9mxvYObToveP*}+`*^73(*A@ z)q6b1YI2a3tU#X52qfp(Js#w%lY@L!Rv_<50WzdZ1pn^w*nTZJwzp=5?cS`g8S&Wu zI61cWXNB!dR@kI?Y=4s++o!X_c3)Q5&c$QTo%x~K9mAr$d_FKXU?!= z&-TX-p4H+^mx!8Ne=o?vH~q;13Jz}dOYaAOAh*PvjV-~ zftIXIt}g^~9koemmh0^b_zhF5=x%H~IJnXae!u0rX5l}h^K%{18mOQbHpg2Tx=3#? G`AK?eN94`rM@P=eV2qYxCuz@68NnlMJNH*+30%QXT?EiapSJ&~n zre>7&&w5i`^{)T_``-6ny?XC^&kVeM+a;G?LjRc?jHawK&KJdMwV_odqie3JYL)i9 z)M#~ox_k5MyH9s_nX7g2oT0V#iqthPL5zy5)T_GG=su2z>nVOqsT)N*gOwF+K9F7> zFt4%iDTAjUEf$N9pDqu+^vuuU-+z4RnRj*Nm5+Dj)#mb3(s?R1CH5P;R4a2uQ$!V7 zU3slBE1H91tEDTm?G_+Vm6s`11JyHER_dZ*;3lpI8sfZlwW``~dOv2x${AgnV{ulW zpReyTnj%46)zl?J($7lWwz;w;)+j|+9+bDq%gohfmnQsL;jnW(?iwWmt2OLD<*GEN zG?bR2HH@New7TZlT0KMI4&l)YI1q!u>FRsfz*t@n^EIc)Rr*vhLQ~Vk}Q*Nl9vJX zEtXyZ*{cXyMV2aO1f`-io+>EwVod_ZVzGq(*)OAXP%Bpyy;7ITHC>V#WtL!G)Xx-+ zvo#`O-#Mk)lJ^xxCtNlLSXw_HuUu%}7L~D_Efeb?Y|ujkjbrudnwO1Ebj@XLUFn)b z{KzOXu~Aj3qNUa5r9)l$34>U@4+5C6nH`K0g#1XP6qxe%NZ~k1q22Imo+<}js+Q|g zt0n2e`B)(wb;W#p3iZj^aq+&^U;jwvcg8RuF1#z3pYF<{{2G^O*=BlOB-7_2nO;X` zqKE0*h-ss#RFl-5o{xoD9d}gQV|8~Vt1+p$NL=k!&Bx%ltGn9*47vq5guTNh>_=_F zHbxTmwn)M@MiO=hGZ2cD%vgmY@K7d1QWlq-i?czNn#nVgwCw@XyrLY|KH#$UoXy&n zNYHW=7b?N&=E)aptBecXIgDZu=; zqz1a7g3>6wx-A(kvEcM^;*;o{q=KO}v_e%x1jMXLx*v154Sno_M$JXFjcqy+A{0~QS6SpRzKLdvGD^>Y~C{09dwwMcUi zc}o~;R#1z>mty?#dADN|{kV6WI9{HYS|a*uaX}pHI0#eI(!vk`I3pRBX&la?PcgEx70e|>)>VG8Fg@Ta z&&QP=%i^jhmPgfrY*dA6=rDCdEK^T}nY#DEQzs-g%*#xZFN+XI+x;A==UTd5l8+!e zibYT`ipS1$Hg^0KbEvtIpPFfyOPial8sy6&i5fD@HaBt91fwjN8h^zcYHo_9Wy!_kD|M>wZ1^z939&g%TKQjZ_lb2|IQpZb)hL`Hclr4xr8_h z+Hfl-W)P`7A4@?S9**Vll+}g@Yv?d_b1YLmHhe#3>_L-uMrvd=RK6@i90hE61tozX zD#=Gsz=j8-c6)fA&;%~$a2lI}|tH_NfbCc_`sM}_^k7<%jx zaXT*&{v5o@I5Y^cG_+!9z>5Xx?|psGdPG(vlv_w+obf;)snymZCPJL?fIl`~TBx?Z z*dB#P7DQpV<_@F9SVrlaOZk}frguOwD%x2|?_)-!>Ll@`$iAYw6K5N3m2xBc^vQl! z^gr{M*vHF+o7}5|gS!-q+drf{;DFe1EX&MUZ}~fp>)KfbbBc~ahE(X9Fe!o-Ig4h; z^9b6Z#muH1&Q4ZuWgYg0W7#|EX-#3jHHnJ9StdiGW}UX0>NW%Ok~6elzS%^0@`Ovzf>!q$ut*s$ketu_MB$uLZf! zci7LVGI;K_qFkm~DN{!&M*C!EtT>VnJIE-NoiSk~ksZn-cXlXKhn=zh*rA#AeAr2v zqIYy>JeeIf&7V6vR56F0@xIx~sb!6Gw5;*umIZbep=D8~4m%Tlvon#G?o6b%tZ`u? zsbzs3dY-f0p-dfiCi`Y*GB0+*A9h@;>ssY;VKRjsdY(Hw-p8D&KG~Vb%kChfRNa|K zu{)GU?(9&ej_&Ma?ueV%dqdKuDV-KRpb&?Z$0cU?{+m8^hHeR;2(-xwI@RTZgCHV|j|xqMYo{RFCzE z(jvd@ai9Ab3R<3=w8*nNcl6E9SUzK*sp1$%8ykamI4|i@?9lU^$3RpuM|bY*o1O8z z*cs4_C@*lS<1-*`QK5e zV|j|RKsmjIP2puHICtu{As&pP!s8koOjLS1dbE(#YrJ@tFgK`yVRY-Nx)E zZ7=bCH>Cwzv{u_$L3XZ5>o2i_w^eF4>zY_KN~6Q0Bc1($n}`#!jBGPY**-7S+*IJoM3&~MpWQqblX$4j>}X;w{_W#aA<)~XN`hM@7#>z79}O%15# zBj!vTF^d7f;rdW4*KZ=OZ6s2m-fq-H2LRTsUQD{LbZRBAS~Hm@PU2bA~ZceFSp{GPEut8i&siMyunJA5nmd1ulBNNlZd-n|QEg7{? zvtCi17qI2W$Afprqu>rd1sTe85YEIRJVFTfPlvj(*rIA}z#E<@;s24z(g;u*T50bX z@RfR3k1wl;esgXA^w90+LYGpc1M%Kih-{_Cfg{4ngZCXjGIMBV|MVj>$BxeQBhb;| z5`;K14)Avm508vR2y}C`4%>`PKMFL0ZHrQT!i|3FQPGE>BkSU@a5$C)wt)QL%z^2X z9&o9x3w7yy5r4I&h(D#eR1@p&DDdFX(y50|mF~p;ncMLXtCi2*I5vIk-r|vR5n7H< zB@w51KkGqP)9hvaOs;I*u?JZ_IS84N8U_TG-jPp436l^hT z6&w>=8&rutU#kn;yhx-SjV0|)BJKF}36HLpromf+BDLmNPmI2#s*7_if$j(zt%Vb? z!dVy|k6NR#43B)+?Vld%Nk>)sEX9%ju~;B%?TKeI-K%2J zJxn@z%vyYgz9Jo?vm$65Z~vG$z)m^=ZZ+Dvh)t2So<^8C5GmC`TmI-Ce3Y2(0FZi&AvOY zG$Bm+c=00mtAhw0McflhX;pIwIvGpQ9wO-A$fP}4i|xE*=i#ZOh?$|1E>%jWgcAq% z3kQpcBVeE~JTfB8;4L8pd%1+?K9tUH4;1V{tJz2XPTfz%)_pJ4edgq`J(I&&xHUZN zn{Z|z42_vyqXqvOqFybH5AT_ZG`DLNLvu6nfe7FC!0dDka9TkQiu+?xkav_a2C~P5 z16pP8*s$-T0?WK2YD^Z*_H5l=<8G7?mAUURFkl}ZD>uhz7Q(&h8P_qt8gxz=KSnRCPzUBiu`q3^`Uc(HB?hI6efau?CT)-Jm8$2d*0yl0idn(&O`9X`eopXgJ@D%`~w_PY$6s4?Gh zp1X>mkXKoC)BTe6-}7Mi)q<0&;4tubA_EHRfQ19B*AXl#PD&L_l3)OQ*M6T8u4ZWf23XdZKJ zLs@V=9paww6BlSGV?^4CL;I&DM)r8EgbLQ@DuPrcM-^=Jg`Xw-qj;g#u+q8ht!wbz z@?hQMwEvXcol2K^D(zb|mY8jLRhV5v|57mDt$r)*E$})WTWRtpMx)%Zk;zb{F>1Bu z77R_Gr+5KxH(L4y{DqUpD2-c*Box!9UA|jh?J?%EeETp>;wZ-9UW|po+@6FqSuqTO z&4j>uG=o~?PMjn)vp{-bIMTP!HK9fpNaN#y;`v)yIG#t&p#V8N<{*%lTTh3x*;vll zJg+rvbfIlX&b$$qu`oSdIB@WRg9W@uvNuUx z+FcOq^_^@92>E=I>II{%6%Ov-U1&E7E=fb)5>?xE(ojJP#$X*&*%<@i@os!>FW{p) zJ~U`LE}2ugrmnTfo#bw-9+*~wcQvmzQCX68fLJV7FZjv~Kdt&uk#!`yp9T)u0NXd);Ji2r=vBX4O%B z6JolK$uBK6u~DmXoAc{XhP+dKE&aLq@Je6Hh6q=i>o6$@e|PorY+b9I@hj5%UqfzeuXoz+ z_50Xw-04vw_fY{pa*LFzPb=}f2}gSACi-4vfqCg5IDT+x~3e? zJ)Xfsw?S5B>Ym-KDutHP)CxmG5dt0>vW%d$NDqz&VT$2TTPrBAoV7MhzZYx|IJ#2M z$YR$-jH#7dUv^D$u!6Nsc%P1oAZo<}r-fUom9dA96%7;7fr zJzc9?ZlMofPIRmqU~~-N4|HZV{x~{g*TC7*A2vAZ7Q{V#TMl{j)`JluOIX<94USww zmg$<`(YS9s1>Mvy^dt#3gw;bs%!||zoLR$|s4qhg9K`Arkztvb0T#rGZvtI@N@Hmg;8Th19W^TMn&|Xf099mfL6OcfPLo8TocX`eeWu#6gwAq zK2tx7Y~Ur?dz8eHxttv|p?--Hy)6GNHQPU>>uoAk$6Q4Nwfb4faz>o2l0lt^dr0*Y z$Req9Dy=`Rukbsxf6DWQ{*+C!>#$yamML3Ye`c}+6y&!#rzXhGkqOCe=hbB^pq{8U z4n?p|r+_DU^`D3^>$HhY=A{KsqV&L+mAy*6m#0$CyOnyuKF1-&t-HE4Tq}5L_tmN& zvB7nv`ptgDmRx{ss(yjxn#ss)92%mD3R=xx#)NjHeHj4SrJV$G~&jlLwKuZ+lXvL_vE(bx^;G z8qkNmWQ_?@3wM|55hP9%NPpB`Y)kTEK-6PN&Jt}=mV_QGg(dmfaIMIac(v+BY}6MS z$gVH3B^R)8OR|1wsHtK7%7s`v@<9@THBK4yqIy>3KQl=r4}5Ja@*5oJgQ^aHoazf4 zsccpMH5PTrtjK2=^lVn-i%8qI6?usg1+56xA(It>KTq}3NX)5@oYY=yE3$fJgcbQ0 zqAkjb(1WG0B3FlNMOMVCRdOQ_wg|WnRlnP>*pdraxD{DDG*s7WTC5G30)E?uta2iH z7Gy86!#56@K-4sa4e|x=qUtC|D%*mTSkzPt^1%Hkj<63igoZBaJK4(IkNv`})`S{% z5Ypr!4y3UTbJGeZAGo_%hdu0MqqqAki^(SxP1SI>oOMfS?8RkAq=wm&#wRWBgBzQmSX zKrZ%*Ciull%ZPk;`Y$8^Ys`ZgV=JQ9j6TAoz%}CeFbDD=UvS>4euyKLt>(YMqNdub z+m0XHUx5E)EFh;@8EmF>jh4i3l}7r`#Ut(WjI?aF=PO9tx9#~lB?{UeszWB*1D~+! zpCd7+5_1aWV%we#t0HXA4~e!Y+d~hQ!uDJjt`*rHuU5&XA=sAS(^mc0e#Mqtz`||M z%|rfm3oX5Ew90gxY8m?>T5Z}ZfJLfU`w?lFZU;HGVY<=xbviy5uL0gkyz-5*Zbj5I zRSz-^|G4TNj#ReQnqW~=t=6M~;nF_L0`EJ0(58pxln=2(&8%tW+kA956y9+f%Qk$& zE6ho=^+*NGNxPHK>jH&%d_Btek}omWVyjjaXE~P7qXPa3=X0)m}eiY8hu#SvK8)MfMWRc#(;E_T(k$irNTcyxdVCXJ~)a}7f2JoafGvNII(Hhn1(1WGubUqud z6?HmZt@;rg+&!zmj_i^emhU@{WeSrESa_%Nia@7hf5S@dYW@$N!%?Q5vvv|eNU z7L!%7uG$lU-{9aU*cjj@TK#*DRCZ(d8jJexyMtM`nsi&OqN?sUi0oa8s`~O#wCB<1fv)DETR>^R^&TP2bsIu4ur zOy7U@BFnxzj%i91>^P_n936*M)no$^Y%7F&kl_x>G^XR=Y%3SL!c7{;Hb}Tx%>{_f|^(_MXfwdITTYi63zWHc) zCM>pH{3V?4W6Bj+JZI8!(!@$x1AlB_NQ&n5roYb0NN&J(Z%Wn4YcZzGQj=k;a{$qHIImT?CimpX;DYw+RT3h zWV=HTug&~6zovYX5tpn~LFv8{()|WUDtp}Z_bh7axQkD%MpQdK4T-I zh7DBM8UW{&eiALalNgbru7s=$#d06p1Y*xk_AIP}O~ zn`yVsclWfcY>P4nhla4%uZ=xQQR|+o9^)&lXr39KvQ;8@2?Pmt!;Ytpx-H9~R7QvD^jh?VJ~pUZdJ{?pp;Q6%hMy1iIBv1( z&*8bdv)MNukw51q4o)a-2p3LvIN13|M!{TA&wY0~=$9Bx$(Gpe-rvgr1*2k~ZH~OK z`G!>HDr>`_SjQF`nz+Nlz^=L1*%X`XtN^(Yy=>d5tuJgQ&R+UzbGpgAFJC2c>9DjW z*@^_)4xApVuZv*DPl<1|%-MD>_DjxJNi9(Az;fEp;%4Ma4n0_kmz?i}Yeg?PUak5O z8+=2n{{z{jb;kjdmt26|yFAQt%{215YG^39ebM=V5ZPU9TH}sPwnZoNtl<{K0u=l35 zekfj6RweMQW&_)*j(yZ~SknWid%jN1TxmmhYBa!@@G?2fQJ)#afh^tn3@{$OJZv`J z3=NOz)xz7;On+yp{tObPbfh>Lqp7UUGm4EuaFq5k3s8$(LF2m5|ap*<^5|8 z7J@1d@9OH8I8xav|9KWQwXeG(?p4X{u)?o5KVTr$#WcmEy{4E-O?s!A_N%;`wl`$P|0E>PKww;ji9vM7`)hHwU>aX$3T3B=#2UpOAnU9Kzut~D>4vXt@;rgjucQojqLgoTXF#l zHxQQ(4H*?UbvMd}<>EoAM$S-dT<02#jo}2I;n<8=oZa<$L``ENsP;I?KwZO;%2xYT zENZIZ=zqLcWFQxHyoN(U!>`U%YSMV^E zJ6^LX4UX3==_WV3pkCt83H6o;FfkoJuU=l{@!Fe7lHu{%Yj88t9MglPFvsr-*NV)s zSF3)+hSN0E^T;mE2nEbZasdlB$JY!EVKrnE4*sPwt$t23%P*2ZtTEgbaS1*1{M$@Q z!6p~hQhQ?Sw>X#yHUpf@p?;7fmCfe|Sk%nsd3WsV^ye7JMK#Yjr8sP!snjI%{J-!# z);wE@m%u!Kk8#7L0N-VRf>D>&JlmAQJn!~Y*phB?GYsnGN$BODMSuw_exG`Ik?_3s|^$zH(>?4tE&A~~q0pL6u^>L0=b^~~XMNKu#H^t0zVl$2XwQh2B z>~#FA_%jUhqMB(O10FWhRBDo$?&5i@nYI!yftmhA#toM`yqf_EMqOGnZBx3*4DO@K zMZW92l{(NScZm)>_4g~-KkiqstJo49Dz*2$DEN$g#JQ2(YvKz==7B#gGJ{Z#n7Yo?pz!qb|9lz(f^<%%} zt+grRRH!nJl^F85*bjf0EHg$HwTqtWwd7Q4QWtIDd2APLC0>Fq`bQWyT-x$l1}GSH zX}f5f(oN=7@tWZ^1Y7KWKhEYBccGN0IL;T74fcX5=ZTloyZA|RtLX2DtePYnoM1b{ z0dDGJ5qyUma)0gYVs}KJA|AtYaleb3ksT2|Sc;D5E8$vEN95J2AF<(BI`y}a9cM>m znaAV;7Tyt!M|VVYwjH@{z-g3a*w}XJ9NoW?psYS=II2%d%Ft^|KVVV~T9L3;+uhUm zIG7AJ8=R7-{xe4^yV-o3MNRFV?uhN4*aP>FK)f)L8xHpa6j5s=ygFXBkraGU`z84D z2)|)asY(4(5zk}$B`fg~^h>uhZn)HBF9Q^ey0rb0O)1XSvDf^1D&Z-u<06LlI2++h)RE^*JO>-mCts&)12yS3Qh`-sgh; zO>hpR>XPg4Q7tl)Eoaa)P*&Sh@KFW&GYuEJM|~&BJlvzc88;()RC=%!J?it}T2YVc z)v6z{;T%l0gX}naRLi0#7qIXi6`K{cX4&)j8@bZplOzSJyIdED?X}oHVe$xCE`NI? zeYE?+Kjh#bsPH%lQ~d*uRJOu@ltoSL3;SPY@HGZ3JTl5zK`mlydv)&Y`a*btB7 zW~3pe2TNgy9|+fq46#?Me#CYfDMyf9SO>%QDj>Gx0v2wF;i4U;wWS%c?v-^Cfn|jU zy{MiEZZSzDYocv}n;htas*a;&)p?FoHfJh}n$ZMLCcJ3;6a%>kCU~+-TWhhGnH?M+ ze$$|0lWg#N@jTWBTZt2GuyxRJa3@@7HJE)Ca?f_-NlycQlaa%v0WUB>!KjOFgV}-0 z&H`MU(x45t#GBmKf{Kard)2o@fQf0$yoz~|ZSXfpl3^SCSGXBzgXzIi*x($OP6IcB;N zQPa2zHjFA5-o}y2w%A)()KrVTm(3HMJ~oXHK*E9J+HtJyxBT6E69tho0rATY_A(ZN z=5bx11ZP@%&@0v^k@f>jBR%#5_#Y-Qp=2+s>*$P3yqwtE0;n?nZ2?KsAa=#G zO@lm0#aq33c=EvgVEr)Sg!QApX^{JoLn0ZD@7G?JeHA3le;P!Bz=$_=ra{YZk(u1W zg9=VrO{U-@$@Zt<7ke7yXMw24@^^4E((==TrLg?J60Q|ley>*jh;0rj--zsz)Urox z$pr)~e{xjY0iNY~C_ZYG1H4Z}I5tw>gPVbk6;>Afq2^tRtTIl#B zgg3$;E`dM0Z!^FP^JkYe55GSJ94sn^=N-~cOn8O>{~ei1YtJ;dk;sd{$O+YvwPeF9_P=l z%n$uh4iG`;uLksoI8p_mCmRgASJ}*wtL@LuZdtwl>@xW)!f{)U@r``x_(@dE*0ohm zM9&hx6;C-8?JXP#gKXGf7Qw|uW2A3|E@ zB-)PMO)^u?i^uO!qLPB%SRGHE!Y(F|`u66FP17nVw zs|?sJtZFj4<|drZ(rzhrqd2GIoHCfYuDRj?w$RCSQl>VL_fd0oO=?IwynX6j{D3=1 z2?q|%H}PYQRZDRw>Vll{56z=(2ZabMu_0wHmOWz9)w-HP;z9 zU#HQYFQ2DF54*Ut-T=AHaz&db-=PNbyV|-V)g^YPd``i7;YwY^d5QFRot?nFu~wIw zn%*kcrL$7Kd-yVQP!{X%&jE9jbY1~h*4asRqyclFD$TZQ$ZtKJJ3}kLkgp`pZ*%jgI)~ngi|DoUjLS4?ZYMx~}PE8UF3+k`9iknw3`9+@Q5v z(K%cjdJ@V)J$yN4QPx}eMwB0X5K3%rr1~2mNd`T2;OUy{>SCkTrW3(|1-~!D(L3fA zU8-n$wOp0x5F->r{#B2fE8y^TP9c6)E7funE4q~P_`GbchiYqO?-nwFLanQ|=P~u^ zC>=;;Hyn4Pl;H+;2h27M61{h;X-Ms=Rz5#Zy0j5z0%_PR>rcrvq|z#%RSd<_%?;(M zVu-VK0%F&4rPCN#J2BS+56-e{h%KCDhkV!BG0SsG9r(~}x6u{K!6BR!2Lh%HtC08_ zT|DRhgobXSMg{F^)S!oTWge{Ew{fSrz9}_5hkt|z$3Qiq?x;RB4D$+SF9&WL#pVT= zjz&?_Yo)Ham143AAZEEG%|k*hNMsf63pWmrgVObIxEjiy?s(bXgtyRFmpSXefiq$JOp8;uJ%&hUI$R%&t`|DYqw>l$hPS_7w$waTw< zqgfjuY76^q{Vdnv{nw`U+KMcq1+^sIYLj4@QAlT)wVNnnJ#3QYFwrst&q9H;iqe>a z8aQ@gGg%6wJsXOr%#;4sHPLE}%b7)j+RV>NRkYv>sDdm>Eflh~f>>wD5)PrNm&Ixo z!(1{T9di@qOd>a=`kZCbo;8ENz>_~xyrh!6J06|bHz4WGN)7twYidtx2|`|FUen)za{@~ z`3Lg%)isx*lvNa5LBUoEZlvIP3Pvd?QE(>(w^49}f*A@Prr-ez<|wF8U{KJc;28>@ zrr<3UyorLJr{HHOcs~X2rQm}Ue1L+FQt-PJe2RiUq2Nmte4c`@Q}8kc-=W|iDY)!1 z1V5y!4Rp1Zf@>(al7gElxQT*E3dShdPr)lGI8MQR6g*DBBNV6<)F?PdL5qSnQ1E&R z-b%qwQ1BcD@1)>YDflG{K1{)fDEK%9zfZwuDEKr5U#8$MDfkBp{*Howq2Rj|tbng0 zbr}U)DA-6rfr4u(5GWX;U>^lj6x>b00SZo0@G1&K3Z9^#LBSacUPHlo3OW?Lk%G5V z@HPtGL&3W#c!7dnqu?VHyhy<(Dfk2he?h@#DflV{U!mZe6nuk%f1}`g6bxcaqpqZ2 zI|Y|ha03O`Q7}S5k%BuYxRrv#6x>6>LloRkfkeS91vjBLR(Bw1o2yBKnLh{C^k3@8 z-|EOe=r9HDFy-wq#qBVq?J$MyFlFs9MeQ&p?Jx!HFy-tp#q2Pp>@bDwFlFp8MeHyo z>@WrFFy-qo#p^Jo>oA4uFlFm7Me8sn>o5iDFy-nn#p*Dn>M(`sFlFj6Md~mm>M#ZB zFy-km#py7m=`e-qFlFg5Md>gl=`aQ9Fy-hl#pp1l=rD!oFlFd4Md&ak=r9H7FyVKY z;5$s{9VYM&6LyCQy2FIrVFK%*ssC6|*w?>55sI<8;NW z%;R*$tc*%m%*vdjD`sWhKv&Glyp^t)m3fY?n3efex?)!5!*s>0%*W}9S((q!6|*v5 zrYmM;{(-KTmH8LCVpe7aHCtw7w$K%`G6lL~Rz{#JW@Yx#6|*vT(-pHar|61V8Ii7- zm1)owvof!tD`sUnbj7U9+v$o~nfK5YvobHx6|*uQp(|!(K1o;1%KQagF)Q;`x?)!5 zn{>sj%)ikUvoeF!Y?+nWPFKvz+(1{%%8bwzvod$k6|*vj>55sIhv3b9BY5%=_qyS()FYD`sVWkFJ=N`R{batjrhbidmVj(G{~Y-=-^O zWiBNn!K}=Bx?)!5YPw=pW*1#CD>Fe?%*xzFSIo*Bqbp`*9-}L=GVBWjJBmPkCmax~ zNhB$E$`|(D4;#k>VKnv_SmUy3TRh@I!pnr{8ayq z0$P8hzK_;ZnCtxGLe^QYt0;JJqR|q@4b~lc190M5BO?DDD;~y47)Q>}YIS$0$)a8! zy6MJV9msLDQz}ceIgmeI(wRx$ew;OofE}hf#GbJ{_!?;dh<1q||ji_7fzS1f=GZQ#! zwWu2{Z{qg%p*U$1w`_)PoBCg=Crem!YYy12%9onUt%F;a&m28;j9zSm6B6q0u$))gFugs#v?hWrFS!K|8!oUhckeVZOwF`Y6D#|{-(V){wIE{&*z18Bm>r@i5=&Y>qv1l z*-Za2KiEIa3+(73fgLN3B!m4Mez5;DFR){a16CMM1N#Ghu;0%M?D(RAO;O`3wsViI zwjydSW2=cp13Qtd#-sdTOL>8vTr{wg$zYH0gPq9>?9?KGok(l5bNpZ{d4b)N0qkuN zV+(s>3#RVaY9C>um}-xo;fMQlUU2s=BHR=s_4E92ea7`|a*UybskB!6DSohjk{8(9GJxf2wE&w2_v`#{U(O5e?HSX#Nwb$^2y%JG#8AaW>Xkf>a!A|mn9m@;sD>H!QYqhDb1IPK{-j^5L=?rlB zT5ZY*S>*>?%M0vX8Nf#Lw6rp%&^}+NwUw$w3n5az2EKtG>g)4@x<3Qdh?yBeCo!NR zAtvO>P4+o{tnbVV>wyedhk6H4Vl55ahxx&MC@*jaGk}Y*N3>l5>xRx^O9J+E6tL{y zz-RkpS$>8e?x*vDdng0kJ9}kmxxr`w0$$)WpuT-n^0u}@&i?F~C@7lcJ&18Ugb1%G#m||S_ z@nf6H3){UJutoHl)w*ENo-Sn$A7Y<`=~0r!c#0qDtMY<+I0Mv(rG5CuE~bnK8vN+a z0HV8L&l2PpN5Vi=?E<2>*f~;b-$gcsv8bh`}l$Oa}K&esJH&3*4(RfE(^@ zeD?BT*wJK&gI946WmY0;E<>3U86ZY2*P*$1vY@`n_^D*HH}IpqE-$nvGoX#oR%v81 zWvb^6esH(u1@2S^aHGB23fDM$CWl9a(c$3~kPq>Lygx6H_vZw%B5DFQ+w2`1PMM+9 z`9W%VfqWnX$cQdcJ(pr|Onz+7=7sISys)*B&CC1vvHfCR*dEFYTgpq}@9|^%oxHF; zoENr~cZo0ZWBXiQ*dEP*En*9eB2yZG_l znHN4W1HOm_sG&Bg7zT6kCBRoqN~3&?AN0d{fu79=bX6DUTEd04Avv}PA9Y$%Rlts~ z6A5thh0o?|!}-%s)5d&|P`SzfB_jm23$>BK@znGpXKeu(eS5n`5k z|5%7AOCgKgPG_h|xD}mCQA+YaQlcagEZb p)Z10^=vafdKy!PXi<@0X@n5U^V_oT~d6q4m9;b(Ok}Y9unYCnF4{P?JyVL1m%a-p>(&=$0OY%#$yqepc+nLqg z?lLobck&}Zz+_AYDwwqs7q1kgfCLjlfD}#KdJ`Mjq@ZwuP*p`=_Ys)LlC1<2L%(YAG$J$sb zb7@nABIs>-l{P7wy`rwG%4ACi2w3FBN?C*AnafHwQPbcegnR1Zv=v%jZZ+K>lVa(D zDos(G6?4;rq7vf0cdlj+Q{CGPg{sxdXk7zQu5tf2xOWTX*|R`a$eplZUOuU|MV1UcvV(hM zv3!%f7*OAA=@lTm6Ool8D(0mNPsb$&B6clOUsQmiX}xY)uduYm85!+ z9+(!@3t4TZf<)|_Rm!@&FSBdVVWWqh<@vb%Qq#7m4CQRGSOda(T{NI^RIavp`L4mX zxwxe&ZF5I_WSE#(FDqry(rWXv9c}qR4Ou+_6)LKEZ$e~drt`L!ORB;tHo|9D@Un?r!if=w!qQ zd&(i~?KWX+0||Q~kg&CZgdHFQp-9n;l`uja%7j45!XA&sSuZ_J^%+RoMh|IjR*bdJ zIIMlhW^H{SYo7{aZG9kX4k%^LJ=U|`R*bY00*YDxzB zxap>n0rRU%b?AmNN)@RMn7OVKd2pY!A&@*Zh&&1UCYQW}wOU4(rHnKuPB&|kM&yam ztCx{HT~;)gI_%doFjUD*OJZHm=#9)IF(xp^q+Ywz>NCgFO}On4^|g3J!H_Oc%QkXE ztuUABqFRyM@gel%W58K)Vr*nsI5awfBNV-f8Bp6d1Kf5Lm1y| zVtBDd!hq#RPERKCK)0MaS)7)15jtq`l0a`c4QwC_1KEPt=$KbB0tB@QP1(wfBg47B zMQu8Tacfb2$vk`sjCcyh*tss0or;H@Lr(1$N9!=ey_gn9yL}wJ(cy?wD3}{SmK;+~ ztSxS=q7%zjr1bdO-DZ5fDU>f6`8s}BIC#*dW_ETqD^{S@R2nl`1saY5qrV(XBE(ir z&rK;{ZgOCW8gRX#UMyM{YPCwG=uCl%VoR4BD$F?~4VqQ6Jmn*-r&bX}k>kd>;L>o8 zsm;O^h>?>CCC9QUU_r)4vcnBkaw+O&R!R^X4T`X9D9EO)bgYmnaU9r}v-q^90qtQ- z%sXEO^7>GaQ`BNykXwdpqB5k8S*|e1-$A}$` z7}?Sp&DE9B`7#t-NJiJ@P`b)~x=u@~BG#0Ls1wnWvgJ+1N7fs8vS2-c%a7yAj%9Jx z5zD1&BpFq{5;CT?gfjJ@pQ)qwoH-@YxGphGToOKxHu4-*XLZ%ii6h94ViDwx;<9rv z89RKz7&SMtM&8>fKSE`KT8sGCALJn!ewssgPE3xEkaG0Rl)Y4{ZE4Log@_E>pw z8fM3_$nwQ;DY_$B>+_V2>Dbm#emZSt0z z+_*(zigj}+A$N0xoRTVvrdtaX@pVb%o(fymSZ|ZT$K|N7Z)bhCT_SFcO9Y>STNp;e zPM!v{7uHZDc&Ao^)s|zId6qr&5LRHGf$Dr>-isiCuH_E*m6>B%qXz5 z$n?^uN!R+h5gLJOYj!-Br!9?;HMV2PIqNJeBQeL5=uw_=S9vnS)>1~J`}ch@zq{4Ef%u7;u~jo>Ceg7S>uF+ ze2U^Mt_qsHKwA)YaSh42zs0_fg@OBSV@hT56%%DjQJ5z?{n_9?Y+36Pwk?dd^ zsk4KLGIn;&j~!fZPluhTg?pwu1JUfz;(zMwV8IwW{qtrgrIs}iqh$?5w=7_10a_L& z%Gep0H#>uA>CRx+mNg&@Mzt(p2k)nBcQ8@L&fvV+*_{?U{?|Q@)pe}$fUvs@J9s~J zcHCDyyXVQyU|Mzu66&fugI(+nrja^3m?+bop-^@t8pzo1jh&8oFq>MhMM?P>+Tgq{ zWR`hQ@b+9z4A!p;RysUOV{u10Q9}+ZS;o_z1U#i=p|K$T(T~G|)6S45e*ELa@bKid z)2Z>~TI#)_Je>>Fr<5#_-wv(o&?DXoId>gyyf!HIdUTZjxE5$%C?|oVW??8T3j_)I z+E=H29_nI&Fb%$Kr7~*9L|Mz)AIeU!1%hW&- zVh8W1JO;voG2J;ZZ*~UKVrL)*I|E(V!TYJRGvKguTPQnW7AUp3=}@+FcIwy{&H{Po zr%nv6ePKF0ODS0(evW#3C{JM)D5Y805KMNwOQ=p8;y8+)g<%>zKPg!tcNTUql%0og z*3px#Iicc|f@^woH`AKSc<#Cl zZ;}nG7qGm{V%-tSCT^fE9tQ#?;!;FXkzChcEnxAyTDTtTQ6e%$0a!(LIX^~dpm5D2i5l0F`sU{t(aI{MbvJwXuW4B+AHNnrC!A9!8Ws{30v}S9T@U~-hf3C zoFakYp(1fKP>jw(LkyRg3t_}81OUeMXeih3LauEjQl{3bS40K?cC)^obYIO%B~Ymt z@lYy`aVJto(O-Yk4~3FW8ze@@`wM%8fx<34i@eS* zMDduO9uB4KDC+6R31N6_)T@*g@u7#{u$$PLno>%z{Zqny*+5)QDMO!G7|a!R<@)ov z!r;OD-aYxfIj!Pr)=SIN0-XHecyO<{6dd3wNRTH(cqA0zaYQ(L(ASNHW>skcy!>De z{x9s#6#%8y$nEV1e7Vj&<%>%qZ?5g1F1q1Z=(=RdAdZDXr2QKs$A#0QCr%z8J2WkHK1`pQLo{O&&X?QN1PW^Tq9J>ukJ9+SwOPAhgfYSs;(x<2=hQ6e%ic`9P zSA+)ckP~3vvydMM+M}@;ZgJS{pDya%OjYKY3#XOIwV+BlbB*|-X1 zzZU@A$xw9np-xU%d(fb-=#G)?2pWLdKP();`8ol-YqV4m_6*{F8ewcCuvUBR`iJg; z!)#y8T321ZkBOZ(vrb=~*2PJshG!7H z#_KA_>^tj9gTfHUiyMJ24n%M%ioLMZt!Rv(Q=tUyL4rmLyY0nVIMs`G9vqfrVPz<% zN~PQx;ne7`Fq(xp0t^)Lg@P~!vjiXPB@*1{P_o}HD6j{5a~|olvY!qu`(7;j*y)Kq zyYsMdE1%~UoC$>1Ak(Yq;ATTq%ejI4o}oZ^WyDaN2}OZU zQi?E;oe)MErM>-m?xg}HUJ@Hr7tPjW&EEO0R7bMl~HlfrxJU7mFp4EmX z303e`Ak0dWf>^8ISy*{m^J(Pb>MU=L?4K@3#|~Y3#tiP=p>U~Ng>!7K)rp;}HCAx& zT8B2gHV3fjT*cZyU8v5>=u69#!MrCFrd_MtpgVSs-dcri>gvTN9-8m0RequkP`#&l zFSS;=j2YZ}L*X8?l=xVJTJ^%cAo;ry0CvG!rTEjWQs*#NLV__z2JpU6fMlDF-os5Z z6K1C=;9pB`!B*l9&E;p5fEs_gFpn@hd&&7SuxCTTTHCJiG>I^BvT-s&rCLq3+=Tt+ zg}e`GuX~fLSMOC9x3h*28@HQ0=FQOFABy%K)ZGa}dupEbTLo`1nmvaBA8O<}&UIel zt>EQWxm3QE`D-rZd9~c=A~5t1grZld(-lUjrx7d~PD>?N7=c0W9m8DZQy0i)aiR*& z@n)o4&}pS8PGL~0N$b8IiT~@WU0yN1xB;VX7T5X=CbBAkV`Hn zBkf!$Y5hprsYAm%ffFsgfX-(PagVxZr0F{$V^{D_F)ZyL%b9OD?RNSiA3% zIxF;paSF|C6pKvOzZ1+ZA;0~LyENZIyPLX-p@l|AVmPwxFYNXe8b+$tdVyn8lRv!?`FdtzBlxmlTa=49}ImQ!1B7D~;{Hq;B?=?Yi6 z6p0?fS(O%aiLS$IB$fpgjQoSbNv{>=GO*_~xMfaQF&QIH!j1{>g2ABH&chUy&t0biZ+)@lob;PI16wE`V6R8+Ak^O?WK z9Dild53KUgLt+LTp`kj0lei4{h(iZ688}a#VWosKW7y@47q@4mj)yLS6IZ2_v5u`~ zPH{(dy~*%*FeP{&(u7xl$_zNkfekU4rle*jPC^E!PG(7)w#j|wJN`cq;W&M(zMCo> z^ks!}u$Qm4^#PPw4WrLo>u1wW6?_#`{}eT%Cm>3o+d{j&n@h-hZuP_X@JrRN!iiAS zw$*t9TLiYt+!YVN7Rj%iOIt>l=Qg9Fedv^GSwTcJLRBJio!A;{klt#E0W~{$&Vf}5WVs>DG`^=3Y zB)X|uC98fLo^a~6uY+S&tkoXw-BeyoP`3S-QgMz}TjigRR)bSxr^ljhYB_W)O&Il- zxmvM$Pk9k|@@|yCKNa77+V|Mmd4D^SH@G7K>ZZZ1IB2X2-u2J}`nb84)h*qHU0>~Y zwmYt>*46dixVl)>M2f!BxdEQ}-r1JSRZ6{7Yhm{YF8?s2>gt|Fi>gRUMv?Sgr7P{PiO7W0@JshrNz<1~TT=(j1H{^rF)#mWz`Yi_|?m z+O7)7tOAc}=ElH?FffE@SR^YNUusrHRt(26Jmn7H<;%=9un2&T>x;I}_;GU;yMjAC zL2;IAIMS$Bz!`rZ3==Kq`cq(Ka6kpV+3yx>;GWmfZ5p(Vn=2|{j=?g5PZjt9t3v3( zce)8bR$4g~A^8jNv)BIFQfu&QHPlxTJ>cVA$gu}&{bJi(H`Qq9^@c8SH$lNxechaYmZA8;!pJ z1G;3cvC<95-+RONu(=k?uK`KmFpiuy!+fMB)+;U8I0|f+;R6MiD^R@k@CvS>mf_O@ z@FEu)I?Oz<5|+a29_TBP4W(R!FBwcJb8UI4xdx`zjiP%A62X~Hxi#H{J({-O0jYGs z8jg!KOz;Z20?gJmta|rSQRzB zCD<5&lE*7<^3DoY^a^ep)LEQ_Mg(6t zXdhc{Zi41EU36NfW5r-=F@Ck;adWM95gbg-6=kI&*We$1#R0b!x6M@=d^ABXzPSa> zS_7ii({Jl1Y=$nu&PMtO#-@@C^Slz&pw--fWug#2xzK7t7WmB%>Mm?E0DTKw!Q%n0 zU08>f0zPixi$@OFAv4ixjQA~#3vEyv=!nYDf-gc5WJ%H?ldDP)>q1eQ7L{5NzE1+v z1K6$$#qP7`#-OjYDa)!oZZ4MUGi~TXa2kQu1e!2tqXM5#fcBvmEtl1VuFwC)4f~yU|(T= z&zhWHefbH9?fA2A%byB#S1v!-c^TiRf4_zJrrZK_y7D>KrWu-O20D>~yEuyxTjo+U z3Gk5=yEB6u*z1X!xeQac?rf7^lwXivmVYI`D!)?gg?USL8H$Z4u0(MIitAAnP-IaY zK(QaiF%(Bo+>7Ea6cUO_6e@}ainpM61ciy>aTHIZcnZbGP<#}{=TLkG#g|ch3B|Wi zd;`UgQTzzSf1-E^#cxsk8pY+8gLn-?S72xrifd6^jbb~Bn^5dV(T`#n#qB6gqBw!# z9E!6jswgTbW>M%U-htw6DBg?WJt#he;{7N-iQ*F|zJTKMD4s*{6%^k^@of|@p!f-j zU!wR0ir=I79g3xkK`chG9>rP|85EmP2q<=-*oR^W#bFd9D9)g`6NQN4K@@cq7f?Km zVh)9Y;xQCYqId$uM^Jni#ivm`gW`)Qo<;F>6wjmh0gCUT_!)|yqIem_uTZ>-;uRFV zID%S+Vk3$xQQUyydK3i|Sri9Q>_>47#Ss+uqPPo%gkll}4cus0wiAbN+d;I<6{yRW zn@9ZA&5MTovLU}}kSZIb#s;adLF#Le>KdfB2C1w;>S~ax8lKUYV2C1Au>SmCt8KhKLRp2C0le>SB2DxbzZ;_S)E^Eh^)@< zF+^5pDK=xWI_oh+RwsiYvN{5W$m;CF5LunW7$U24218_ZL=2JDsbh$&&chfYt7Bk@ ztj?1dBCGQe43X9OG=|9Pd=W!rb-s=vvN}J&5Lum{VTi2G%NQc7^D2hO>hxkWCabd% zLu7Sszz|uT0*1)y9KaA+onsgxt8*`g$m&QKBCDffh^)?AFho|z#1L7Xr!hoU=VKTm ztMge5k=6M}43X9OCWgrB{5yuo>iir-WOaUnA+kD`f!bMCXAOqP>Rf{%vO3!^L{?`I zLu7UCzz|uT2@H|dc>qIXb#Tp`tPZV3w9M7~5DmLob9G69ISh_fq3gA-;9#7^vj!*p z6)PT$bzw+1J=v%^qdtmyrSGB>dxa;(6)abJXq_j0m{X}bPU5cer)A%PWdWEf&>KXY z6Rj*YU|pVGOu$re*)YCYgzN7EbdR-9!I&4`55VZz{^E?4p)+IPFXLN`HQGgZMKH}S zJM&rgro*#5X)n?Andc7zWv6wu1*Mn*hl%OGe{oi#z5&Ll+Y1v~U)@ms8um5;-$Qd2 z0($Jp?PcZ??2ceaJ~n=60%w`lclFo;LG^h`srt|Ghb`Y(*n{cF9)Z+U97JcVA#P?f zzN^A7rfkl@XJ}vs4{Nu~t!LI<;Cm@PxEJROuKH7W!ht4lV_&@6gv&qk1h_98Apgaa zXt1xv2m8NifxRvP*xMt(x^7@#ZVQvDi_ws;UK(3@H$c>RDQ{T)z9|9Zn>!)X$4R2m z^~Xn-PYYcp0lGpbx&|GEATP(!7*E8eef4+vmR$5)Jun@ge^~T9CISfP8CoHFIC|h{pT=_;~*;Exh>g()o5gUGTy<3KnMR zdn(a*KOZ0O-=>B4#sqkeMAvWd_c)@Ve>*<(e@zSeO$neMh=y)ewe?MnXu!XS5BNXQ z0=zW=;BMy2^XZFd$cvZ79%n3qsHu!Iwk3evr8(mZ75jS^(Req-$NR>#@NQ3l_fWJ> zTb}SyvvDwKeJ&#!_)vV{18D)@kpTGqXy61HKP(ZA_Rjcd$J0W4a{{#CR$Jxvw)sAM z5Doo8eCTpo(1irh?+C4E=ZgTmzy4^@kHrW5hiQS%B>=rQ3^Z(pa^3MqWBqV^tRF}V zYd!(isHs1D1qiP3qrpBKAMD?y1-7t2V8JVLG}!OO2m770!0uWYu;>jx8tkv)gZ;0x z!1gZ~*e+_kYc0 zyIorCN8>~N^R%GuO8_;-7z$m%N4MI4h!6Jf(*nCc0oXXLmi(PZ!~J1=xZh6;?kx%6 z#;e;dZT5fSgZ=Ncz}~uGVEdzMcIArLqp0N&HI-4+fdvCQ5DoUm_+U4u1@^WCVB@vg zuG4|r;={cqEx5NQfE%yXb{Qex7a#21X@NbM0Bk@{i^pTV{=cKuSc?y}nHJPL5=$NH|cuns4{x}$Rdh3+V$!F@bFxW7mX+(-g&0rn`^QFt`mFUN=b zrL^FVCV+ceXI(O{*c}e9qY?i&KH?vxh4@ec!~vT!IA_(-7=Ifd1b@*<72xiEo@^6um$v)o!+LSp$^A~dV5+> zk0yW`u=$HzNJpbP7a!f(w9p+(fNr2uNxg2LqhZd*hpDFp^LPT7xd@oi2;UnY;d|0T zcp?G90BZvqoujdRGCsCXq=juf0k(kJbG$7_BYZAC!mp%-a3TT1fWayvj0X2Yd~iQW z3*5;B;PRb~&)#4PUX`OE{ysj$-=zid&IAyHHgw=xJi0dK7UPGa(XL+^dt|c~qNXyk zIh6oyfVQIJ$dR-_o=FKL=SMjjq!=IMgK2@h zD*?!WE)l#bM`L?9KDN2Eu-%;&Ha!~Klku@VkruXl(!wT1WBYV`Y|o^H?cTJoU5Li^ z_4wGHPYc_9X<^f%vHdJQwx6bj?Q8;UL1P%)rYWGG{;HA!H;otr5562&ZdR=TmsBO=V-=uUL1|@ zSbTg((!%#(n)tfxjgaEwn@kH|F&%uiC*D@0(&K_S8uZig zK|hriXfYkoQ67n-L4P(r=)Xw|^kf3i{hgMGdCwy+#L+0f86V}pTpCKtw-@?+lG?|n zT%eM<(s2_&j+<86t_s0XR0W-VT^;T&dD}Srr-R2t(d;dwD>U0>82T@6O=kZO!nYT0 literal 0 HcmV?d00001 diff --git a/it/doctrees/metadata_oidc_op.doctree b/it/doctrees/metadata_oidc_op.doctree new file mode 100644 index 0000000000000000000000000000000000000000..a41b0d34a03c6b8c942b9a989253b6aca7648537 GIT binary patch literal 94235 zcmeHwd7KLnLTycmM!bBWyz8($v0xQccyo`TeH){^vp`~ z0d_btPMRb*<8UN_gd`ksfB+$h6LN4RkU$8800AB(CWIsp^58w3gcl(1`>Q^xyQhzu z+1}mv2mV;KJ>7MEzxAtc9bH}Z#NuZbUbNsM`p;Zr)D^XMJ};HaHN7kw9dlV(FSVxR zTC?->oo!Ec9`9^5mp7zyhTdwF(V)od2y4JLRS>yr2Fj!MIfGXumkbgD)U5kI$;oplv z)sjiQF(px6DY1^SNx8nIY*q%9Ey`A9+mR)RV0$Yh0`uaDMn`g@p&(gLkcG+(%0i&N z(XuNbyN8gK6uERZrr~Y&lm7N`(+dk>cx`UC{^WRr6J3;A`37jHO}UZ z=?W3C=bTz@Dtj`+V=fzuSy(S0x6L$ei^@pO7D`nRHo(!q;#j^q=EcKf9dlu;p?1uy zI5LV%s+HBUWLdSjAlp%1Y7nb;qW})u%npPVgz`{mDKO*hDuokN3auK?d15&<lJcm_v|=;8DwOGSp-itL zndoBrW@6f?tK~Rzr{^OJldQ*x%J*YJ-T40T$yNLy<@ zID09$jo5QxjhK09H}dc{X?-YpjWF_Lv`w76ebs8FsmK}myfjs>$_67(LaSaT@|ucj zaO$XC&!DT4nUbYiGt<;F6O6H(!I(T)H|SGgQ{ z>mvD5h_9n}!D%?-n9b~D$RQ^aNsc8k5R}6Q^859M%qdDznG$@HzT}2?hDpo{SCksEhXea| zoqNu4rINDYiV(cA7FG(#MWCQ$xYdl<-Jz>E|z zxVBRCFk*XSjBM)m#%<+buMCA}(xGc(BwghoU8m%RDpl1-Ses(>%a%Wu09jXg$-?x2 zCp`~Wwl9mTE?=Cg1N~7I$f3j3rbwn<8f5CO`%j;gSvRk5nmkbiINIRlNITbT*eQ7k zvb|UY`Mq#<_Vve(H)9Sp*NaoL4{~X9)2{`2qKKo0gxTgMiWj`_eo8Zk>My>SE# z>_L-$R<89cRGugT9Qic7gp@!K zrQ{*Vr{R7toSi;3+?z3nnr)HP)Pt35e^o_ao=lOt^d;6G=$oUExB_Hlyp^uR{8P2! zX?s|+{W?lT`Rww`>AS1HN*IRU9f4#cd3-3yBQbce(a`(udAbn<7`xod7{gDgcxbXc zaE+2}51gA@`{RaZ$uX=OBMG_BL&!~x~=@0mVT6HaCBE;zrczt8gLb>($ z<`f>C5rx5=JB;Qc8KrkF#pBjU?|^EQ^l7=#!;DDT3BpT}y+w5=&MvV{%Jt~6C;M66 z`;0TON0bRSIM0KFJ0FSL+oe3m`yvyqhCLlS zlpFTcBKP?w`#EI>&v{KsWvZ1Tbqr&uM|MW?L+P-Ch!WWu$qmJ_Lvf_e4n^v)Gu#_H zG`pS-J8{$Wj_r)bv%{wPQ)h=V=CCu;Gdn5OtWklQH5y;Dz|JhxEQ-`&XS8Q_#?rE# zvBa7+nj4F&Szw2rr>r{^sl(1#&+P0-i=E)h9anW-RUXalNMMJar_K(4p|hh$cE-}u z9YmC9J7WpDLvf_e4n^wN&dx}7WY&?fUmCj&@mM~!R*OXyU}(Mja?nxcv7Eo!;047X;&XSrKHf5kznt~Wx=gy#FMxG0GKx+#*Ka0Nox6#405$gMYS%>qL{j$9wE^{_1YSW2a4SCSxj=+xC0j{^C}r>+lA{i1lhETyDC z-ZAQJkvv5yP)eh)ofz!+=TF@_QdP#3=a+u6$W<}Xt7z2tpmrZFk0!` zn3PH-EFZ41Z$fA#u$oiLb@&NcN_Hs=**c%AxVi9DJ@z!yI-l`9EtTMa^(<@TzMFGJ#}S$ z{z*R+Njh5&aq!s4(C*ym&~VN(%}vTBHw`tfH!4^~TvhSfu|PMl^tk~4ql1G*`m=jC z`!$4Cp)fd{r~ikFI|d8*`i>sc{pmqCgF|7hzzVtMrtKj!aGTp~(QC7_kv+#w?}()A zF0#`DcjxvWKIk{fiuA}M_|i>kO-`yMEcTRX6*h<~sAaU7Lt}-Z;ljvZVQ6gM;OA9fWsAB0Ne6_wNfdW06T!T7Wk=R>1#5I|@TU zY3POBBfwYaUO~RFBzfi9{>jnp7ebeiqyzDABt*7a^pu} z{%A1|E61ynv7L~B{NUiu5&C=Z*c|~gUyKD}l6U!>dxK+t*fE3I$c{tIkw{|BQ4OG; zT#kLJwEy_YKwY1u_CCPWYSu?)^M`@A>)lT{cO{2AlJMEesKepWNDk@iIL;wAu-VL& zzfWv^q)PO8YMt-qJds8pWwTFy>8ml{+J#$*v=jSIa=MzjjvW(JxjD&NVzedYhBVpC z(Vd)5>)~=(<(wNF4O^qJ5RW|A?VlX=4#!k_OvNevW064E+7tB-e2PRhh{Lh^y4@f8 zsrYIMYi#H%K=-3R`VwbwBn;Pb%X^??>1N(8ZjLc=?O#&T4%p+7VA&T(1U7A)izsiN z0(5@Q0=g5C=pH1SJZ>#OLtBxI(OD5RiqStN4)8Ty4qI!q8WKK?r1dnp!v{i3b-*rv zG!Guk_T9X7mm?RRRZ7l=Q^NN|axlR-pf`}z7Pxa=WBHxpbU5pnoUhBQZ>>%>r3tl4 zUmW_y>vC82-Fc<4+)fWK+=Dke@W3e&o>)rCnnTdZNP>0|K?jF+*ps#Rq?dFayOrcI zGgN5ErNZgl$%FfI2lMcgLq}n7Xef6Wql5tLMKYdyP&&UkDCj}6-b4IO-cLp5eK+O( z@Tudwb_`hy_xcd2>@ z+JNf+c6X+w>Pgsv`#>bzBbE^#>7!KraL>xYW(2^_`iqo)@*;IV-RhHIO3?xMU?f1M zO?Tbz8D{pGoS|ZKt!4{LiMuSFDf?({;c;6baT^c1_=oi34R0xX?{UaI)!g_jIOtyziC$%mZtehUX>t|~r{oeQM$qZKeZQyh zSrh1t;-m(4#+#N4VWT;$HnV~^^}1RzaznerMnG4qIcyEZ$AE6AiBjET7v#;#o5f$i z8)wa}AT!RVL)w{0(ng51lZW>292?rjYX>FVm@MVwGHp=7dR+Kfz(4XAs0B-%+k7p9 z=N5-`gH!JlVs|qAQjtu17K+728(axy=g_9H=)EuMSyv#dRRm?a4$<8VJ734?8S60l^| zFmi161IkhNTai0i5?9T9;d6tbdkS3>sARq{9v;Y_x0VI{adHm%$PtkPUtDfJ9nPdk z&e+_pHC1$>WysE45fry6mviXoiE7F@e7W#V#?`Kn2WL16J9)<1I{;sdfja-CwU^~>4Jid&kBtezJh8L z&gqS_*x-uhxKugEM)(++7-6^AeY`+&;xCeKyeeipgJRBbxw#Z#&U&`a_N&TbWeK&K zTk&u)rd{xUl0PyxTT?jhmtf8pa2W@5X6x}2+bq~?MSVN_hG~y4y6B>?t-~C`PypJa z@T08P&eI?4@2PCjT6BqBLK&Xrv|B@^A=MRcwtx2CTITqP%z=aV9n4_p%EqqPBTcGS zx3D!Qw9%Yg%@{2`b8vsARpW55|6G=@inVua%4TGEVw=-tt?8y>-To9XYwc0jQ0saF zLr6VSqj=>?3v*c5!HsQxr(1ThRatA^Jd=#M8?I@uWyGPxmf=N_A{naTMZYctfm1|l zyTI{SU(aHV-nW&C;~64de0apNBL z8+W=&!F`m$=CpYVmB~DA{jt9_c1*E91S(Ns-TWijJ!Y-j7Nhmbh?blq4)n3>H z`6+W*RjO55Sg?Z4fN7ecW3E=zic-bDW)T|!(tgWS1RwGh0XCX-6#@HPn0V+K+AEH3 zL7gtERIMEi!2HytTES#8L;$y)@*rPL)Z9!q8&V=!s`dzpb!^z558{Dsr}d2L)NVCn zZxqu|Gdf931=YWy^143KM@G2qf1c5ZD!v4p0$}Bi*Q_=~ zFtWm919H7;?W}y{GUDRm#f*#pW?X0s@yoF_I|t5J@j>a(R>AL)n^TCRJ0FY?MaH@a z-dekaENtlBy}CUOJX)p3g{~m}3bZ_%Wg9VNu^%+lMEe?mJBYO*BE!;{#mpDCs}Vd( zYRzrCD!^;#HnesZjwthsF80jSwhM&HQvTL!TbNhvM*MNIZn5Bpx+a@FARDEI%66a) z1$+-hXaQc~@ylVKf(Jp^$62o88(2SV?0%^o6$sTE?6ukKsaDyk1IySP@ssf>W(Bl*vw@E^3R%ojrcXi%fc`$9!3sM-KfX3_1#Exx0<7N8Zd8!6*^qGA9)~ z7Ho;7eG1WFqhbCijw5psJF7waTMG0I<)28c{*tcOYm^;x8O=*pr)6tD-*}Vs+dQ`J z)czDv#HCKD^~UuT-aX+T;~R=UW|Qph`K~<0j4i4?Guasg%G1ul1B!F%K>W__+7E%q z-iF*d-~pSlYu_fqtOFa?nhP?#MCpMsq3}%ox=5zpZRDQg{bzgy%t-10=87WiN)HN$Xt@m(kuck1}|c6I8lv7xATgFqtRGT<*Cd1W^M##Xwe13-Yz5iIye2BhefOR`%3d=N8oH=%VGCP7@+&u4Zzk{o z9!)IbOc(1sG(B_bzB}@numMkS7(*kYBPqtui9XJV?oY4oN7$bAsz`zSdPRBYORuo? ztacQElZwB$f}C%?dJPbD^?Ig>wlKY-2XmoUZwTg!^or*yUQYb=4;$oa2BPb!*y0mN zMXzY`Un(_?(6Q6+Pytwd9?Te99(gtTT~-Q0J)ZXoAoufyopiPL2!yiD{I{6bM7_HC z1m2rq3u3Ilrdb($i|C4$EUrpJJ;%aH`z#}^KkfMv!uG5^&r=}3_D~-B(jIKat9=@Q z1&vs+Q07~EmM;s@p6?TFVcJ6v=0ba}4(5uqhvzC@8vJz$dkJg*-fOYNCopsExi0H{ zg>O$MVle_%cVhiQs2uGCCAJ)0?RmQ#49hFqZsJg^M>PhoNoMV56?+V8!vdjfg(@(w zi3;_wuWPgiGroJq589;A{P7`n2ADOae6xoHhq%4tc#Y}lN@4z)Er!XA=B;IS)U8_O zON8@vFXKzO$Xto9n#wr(uy`IB@J=?5_LC#)oh@Essx@|SFMpkYuqTq}yo&Yh~iSz5x@+$bj`SGuo@Uh!#t9jx3~{{Loqf@_*T?2fwYEYn&Al zMy`St>2zp|=Xh@l{hwB7zH0B7vh7%KrOp$5EReyeSmCt0)h)} z_T!OY5AIe*T)a{FOBdU9YBvjnvKyM+%xhu~PGG@}gqUo=;R|j`@E{1gC;-3@8~bo- zFA)gU8*HHkH&1flQ44NfDGvP=0wDa*vB{?Pm_R5W^mxIr+o&A^vDyo6?ArOpuA0@~ zN}GXf7T-d&HWx;ZE8y_Z(N2yfMyzlrMXSx1(G4Gpuo|dXuv-${5G}URTD=m(_^YrNxr!q9RTv9MO%{F78orv&E zrS0sn3KlEdt6Pqr$h(Vl7PFK&d7okA`McoPC1lKL8?TAWznuiV;P^YFfv$SI_qhI+ zvyA5-D57s@pILym1&y4&l7}F8d+7T11NOf{=Hj3cj^1o%zDEEn z2TEp1P|1Xi0O-M7i~wE~%oU9Qc&>UWHf*n|eZSXYi%-B-*LSd3 z`&uJ(RW?hX!;u8AGYsRWnD&4TTQ1j!2jdEGGchMNyR-{llZ@G41+clQHYO0tt^&i% zYodH^7Lw0M&3k|$o?XowM;fVUoXk%im{8G!xe%(~2mPM2rH5Jk&r#S{u2Qf{3ef$YPAmvgtATkIp%e?h3RVy@$3rIH<3mv z!t}o=qAp<~2vNdh!HYLQe<@*STkR`|QP9E#OKHA^>8ceW!Zd)Jp~6HD=0cdZ2XjTj z#BqbmfLr@L6W2+7kS0WSQ8 zer`wp<*_NkChIn@6sfILCk*8^js7sy*LXL zrTLbpUj?GBe$(rS&ai$HJ(vr5dVeriBu_k7y%ZaEOxAt|(e+ep@d?aao-n|}f`Nuk zpTN?#5AhoHX(|p&qt=H9<3jZrRzgBT^(g^X{8a#(ENg!u5Xu&+KWAPOh3X16z}tge zfcA{<8XX#C2PNc2$D`-5zRf`5o&RFBR+i6uUiMql{m~y0FQqSSRoUoZXAOM9jpYLP zcGCx=X3rHCxPzLaZ=Znq zsfs-UXw?C}VCtB=osDqfHzq@DL@(QF#x7&Fg20~HvpL0AXP)7$Rnqa*(Ql*J#9I4T zRy^^Qphp{>=Wq3nQBelx;r8NYs7%v?xsd7cV6I4}d9HdXHf*D<-Gu0ZM(DLZ&-AG! zE%6D=T&A(1gLN=VvPM5fWnpRbx{xqjpkL0)Cf+vff$k#$eE5wYdw6T-1VY)y-(+5A zL7?BnKx+SvdKe**!A%)VuQF>FBYc7?;|R*2DpRU)s{C#|k5pwV@EoY}A2Du(4B$Bi z$nRCVo}ri{QMM`di?UU^@s-bSm)LGydwmF)h}tb`m-8&j|3M`g6yZRCDAml&xT5RzN%v_Z7p`u)*Hy=eTe^m6cQ8cV=G~{yV`{m7G$kysG zeUFHWOZXOISnMUrCU{M1()?8g`_^k2fl#)DU(38EO89}OK6d7CHN)OE<1jS7_sB=y zfxVaN4Ru;-%0+AoT*MxOHkGs%H~3z8KO|*zBL}aduvKtzy1T2cj^rSdRRunkH__y6a7fzUjGI=2l>VhYT@6{|lnP>U?9lOnd~~=srnoipluL1(@>li?bcHj|qgbjqbzD zYod&wjFj=CSomWtA#!9KpRk@99@~-GI!#;pSko&zcZ}?CPZ$}^kBo1No@DuFM$fE@ zI*zyw_TeejI8pxro=1wh6?hIreZ^{F(^(3y!5+Zein>kdT61GQlVm2mcBE4LSGp5x zLCbSz*Km+`uQo6YN_(;an%~QG<)C|tE!rPiukeTNWZOP*lelFDCLwqT0Bxy`x^B(2 z*?SA;P~p83ZmwNi3>9#3SmhqC^nR(sfiBuNShbCBfO?a<`F=6-D3zzTt)-Q3XK^!h za7Pd3VsQ7`V6LbKz;o40vEg7EO+j=)aSHYue8m=@z|4C9mu0g?315;V4dLEN1!1-L zmjnZFTYi?6O1xFteebsmFyS|QoOq-Cx>NyC*^4cRE`H-ix>F8Mfo7k-3>(pchM3Nu5IZv0~gC z^A_jNS?Ty&>$F!Re;R3|@`m{f6j9e3W`f{-!+dp2$#Ao@f&2F1Ugi{>v)+1%^*t32 z^>s#9yfNF`fKvkKM6EUbUtor%dr8nrob*@wt%v91g+B6eMU?IFXu~qM+%-)nS4(YM z<>8jDN$!dTX}Ng2=eyLfgqPYC!AW*8s~0@cEBi?F+Sppfl0?- zO2_i8l|4~tIb_*Z%yl90@bn8I*tTjq;u8H{`9{PL*Q&VRD{GHYtn`_&^M&$m1Qq{6 zS^EhJe`&Yuux^h3%VeC`r4hBPUU*+IT71VhY<}gZs6NV~im#2mDgS(TcxqJc!4A($ zaWk~TLl5Sn!}CNiSJdI*x$33ZaHN^`FrteyP2hLF(6Acp_ylI&;kkxpvyD0qYLtug zRen;(=a;BJtd7qWQ2}{felshjcq_F#KyMOY#$OF^YMS%|_2_`~l-+cDo%PMjEMfJN|+q>gsk71aG%PXtvhI?VGJ#W=*)+Q~T&J;8XLm z% zE7De;t6qu?r|N0n>$TY86G&HEr(oAf+Byb4y0kSAkk^f!#Gcsn@d&&owL1Q4fCKlm zL4iQY*Q z;8ohIg$8&waNhuLMV6E23@etqx42p9jI?<1v&S=(Ovo@VEcK;XtFWAu7qg!{)hGK% z)!T`-(u}XrehbIxjM@nXARcRP7CzrX|32a|*ol5CZiWgyJ(vrj|7b8*B=kI2y%ZbH zr_|np=#u2jS8VYK%v|WN%w}=cT&*e8gZ_Ie4XX!zd1xqJE1qZN6K|h(_xY;=ocJri zIGFshKq#BZFEX!*5b6#5*Z-%fFsw%5vamqBPP~?tPP}#6 zZNgImjQGvJ1Rh@_5Xv_HS2C|5ZNgUnd1|-LtWn@+Ck7Y(y_1nKyK4Vlq>)Mw|2c}N zOYI4QpxW=@R$u{-w_tzKmQl2CLt4Sz_LT8)=kpml6`2kc&R6v5JdO)Kh3lh3=y{ouJBEx)7hh%vE+9_7Esr(=H=;F+> ztJvZbn0ZUG-P4lDwNm3ko$YrZ+?aHzfUMfQ)on}?BI5P@7g#9@wI@#tFz2r(F9Y8{ zD-g=ACMNTm*q$6eCDVa5IB@3hf#?mLS#yGqXEU6Nq&8&{Ma-#rAERb=o0LC58mTlX zAEt=9niPWIZBo|TO-g{5F3kP4D}POSNN86+3qLb!SN;ky#8u#!cI7Jwntr>|fRz)` zUG0ixK=JzFuP_wVdlK+@1WK^N%*V&FYcC75C8XL5aMNl_;swV~ih+Xnpu)@Mz% zAvR(|fE-Z~quOB+@oHKicEwgd-3YI7)rHK-&vz4iZxsk-tM+E*HBq%s3#qns&Z~83 zO|yULKEn8!UFklBG*Xf7hbf{i=_UwX>BicpNOHJg*ueYKZ zAFak3_D;NY>9<8@yps5<4n=im0zQv^3s#-^(C^;_3g1|O^!rV?*}HyE zBjoFQB_*Eqnd>*^Z|K7nwnc5v^EZD+JXjTFvrsI&f_|KM6;tky3UKB(zjI*vLjs{} z<^E&lHBq?*XV7OhfAf!wm)TY9Zy}9T6#IJ=QI}#91g~Pp&EME?`_t)*FL%u^IP2kl zNWKVuf_B!MPG5u=`qb&w2%5f5pNDl5Z(TZVkr}TT{)$3T{R4|Cz9ZUOMVasUoBdSg zXkL8B#f;!)===>mn2Y(FdxN>6mW1c3mtwnskb{UW&MZC6tEF%83Cz4D!TgQe2JpEC z@s|NFqXM!=0-_P|_QYVN7;nY)`v6^lIe#^I1bkNoLfO?sWnL58lM`ZZWc!%F2`-TO zSw_z6HY%@28mTlYZ=r~~8Wn=zZB!CxaBR%|wJh(VJS2<&-UB}~YgwK}3~^OBW(4pY zf~McHJPJD}-nv>Ai_CZh@mCp&%1prLkto3`Gv6)CzX4HK%kov+3~gEH!CbT~7p)KE zidq()t6qxjF@*ebuf-Ohz^t__VN*k)J8fPAe&Sk|u!wle@*-kaY@~7(yv9{%GI)PA zc^rIi5C~(=a_=6%N|D1?6xkqBaKvAm%AvUuGWPhcv}}N`e77? zki!kb#@$~F^8n=|p@n$}eu9?Q+t}qk#1LnYF)d6PLDO$xUJiRF-nv>Ci_CZ>@mC#+ zYG(pIPYWYhb>_Q;c_R>YwJ=ZNW@rmT59XqUc{Z3UYGHV;dMUP7AmnQhU7T5V66xH)As`x6|TaB6T=H&ntKIGLmH8zTyq0I|Dn2YA+zF@AXdEvS0 zrPzJ~A%_rMoPBzl7fa~k6Yw=J@m}A6lj)HG>zw*%ue8BU)#w~qNICi8A{OTIkmH}V z?_y^$-_b`D;6JSZ=jji=+*Gz4Q??z0#jkL`Puh{qQc}v4)oHn5NEw`mg%jr=!GUEm?q&8> z4j9D!$X{J1Oj*6 zl;1d`lwa*jIkAYt#>9MsrhbFFSl&J(EU)olnQ775y|$S~<6`^3jIjNr7uy5RLQs50 zGGJA0{{hAkXN6?50~rW`*knKtCvdP>J%*d{9zqb4!T3IP4|!#X_;T>j_1<}rTsphN z@`GA>&4rcrz9!D|n`kxF%)L#V?I-&-q1`*4sfTT3+e;4XQbWQi1lZWtU8tT;={6fJ zIV+SCr#1QiAS?deBHRrKRl_JINY{S;hoi+T_A3m@@cj(}O@nYtbb&h6cG(U`;kH_!2|Hybzh}%+Ch1nDvaz!a9O58PQsW`wwz?FQTNR9 zCN3`#?9E(O>?ZujvaO@5c45=;6UDpbrbGvFq9Rxg(T`=@TVWCw??={WuSU^k4VFZO zHN;L0OAyAy?+8-J%8z9`LUC{2vio!JKMZ^0Rjq3BG$m0p~DZu<+2R{u%Tmxt2e41(8oQN&~WYC<8=B#FJ& zhZ07itTnHRjAe+C%?;_TRiM#ePnc0R;zlqtkzhU+tJrhTvJ_A2t6LB=Bh{<|G zmZhqpd)2Ivvp*p`XvkA_6{4eN4(=znRm&Vdk-6EvUp#nhC_lW{-VABExniP)6ZM+K zDn>b;`0R7*mz&G!K~ZhWQ=X@0&KhI)l9q4l6YX9i8v>8Vy}h4*2rQbwLWSd3%(J^zSbBE4v>Krqd z890Io9UG%#t}W{&Om|g{{A5GNgjcQHF_+xO_BeE_uJ$PMa?D&_k!v#MH1r0dSdOtE zx*F0{9Y0oBDM1cuXYq5u{@H3&@oQC6FBK=G(ph?Hbl4UG=B1Om-mK|34wyeVvcOzL zXUo-EQ^oVNm30SqR%04PtryWVngS#P@m+1*k*hMhQ#_~Qq-M(&{ zb-e+t!qiZ;bL3)k0LOv4KNp*8O`7mg5usIxJm1kCPY8)ilm2@>_@m2DPf(nyMFF zqXVhzh6;OY)X*j&nlpZLoy3NZJSmN)w0bs z#jotF3p=c;Q(*1xOSYJ+>vEkd0O46lcP1ocpDKoVg|qP?ZX5af z1spYA%j=Cwp<`Z7K3N9fvxrs{CDcR-EyMlX=D|@=x*A6^2BN1sJo+1)=xNf1EcUG2 z$g6U5lBI!KUr?G;RV22&DNUdfm77ZE$TIU$y4Sf#)Vo_I$u=O zic-Zt*vO))PL{vYn37P>Ue-djHbB%m_S^bdtm-Aq$}(!N#d*BQ56ywIIti8;g$RAN zRYwx5k-Mha1pk%{JOu;NOYF-wR~IfNrNH)X0e>n^nUj&2WL3sROp#zVQxgzjqj>>Y zP-L0bBwSvCud_vV5?4_wmofQF0@60u+UHxsUaOOqq&;OWlxx!+^rOsWmYSdn!y4%Y zCh7L?GHD_eBVo_ph*x!j#N>L^dcw>#C{ zQQl=x8Lc;(#IoPN2vF_V)t)qOdMffIp2A1h+xs;oP-D6a!eF{Bt?VcrYK1a^| zOW}NpoHpKW%jPv!dzwe(D_PTqdYw*OW(_cl;P3EiTpJ&N^G$MUE8x(PdKw*YqtV$5 z8g0g{(H^ZDZ4al>4n-R6DWTEV$r^p|rqKrq8m%MMXtj?GQ&XweBBj*Nkc91hd&VF)kBj*G;caw95 zoQKHK$f=NXj+`bruOjD3a$ZNy&ye$Ga(`2s&cBfJeRBStoFxn4EF@&baBIYZ>+$=OTJP2?OQ=T34SAm?6kWO63RVckU5 z348-}7@vXDGMAGrv-e3%RGx1u-)$>DYBN)AGc#^86K*r}Z8OttGqY_olWj9|Z8KAC zGc#>76Kyl|Y%|krGqY?nlWa3{Y%^1AGc#;66Kpf{YctbpGqYdN5)mcMV zOm(iIE2cWz=!&V%4!UBhv!AY*>YSh}raEWnim8r9S4?%z(G^pjSJ4$yo!8M7Q=K={ z6;qvO>58e&@6#1iosZEKQ=QM!6;qwB(G^pjZ_yP~o$u2XQ=KJLjhX7KqbsI58MjA#Z>1sT`|>>=!&UMjjovLJW5wgb=q{rROcDGVyg32x?-yH9=c+x z^Fg{|s`ClDVyg3bx?-yHb-H4z^BuZks`Ep-VyZJh)tITy2D)OZb3I)#)fu8IraF7+ zimA>Kx?-yH09`TFk?D%5PJ^zP>b!!knCh5x#Z>2wbj4KXZFI#{=lyiWROe6WimA@0 z=!&V%m*|SA&Nu0bsm}N4imA>55)Gz0tLciV&ee3qRA(z)G1VEPE2cWP(-l*l<8;MT z=OuK-RELJ!Om*18E^X0D{9HoLyUF=&a_+||-P(iX{D7Pvkwb^6Yom0UrMb%6i=>9x zT!rPJ*6U~VGORl^UU2+b{U`4o>fy4x=ygs_=vB94%5Gj3xas=FK}go=niVUw`u3})y4$_oqOlDJKk0nTN7!%$uE0uZLL|_2LPw=-VnK%ys#%z zQ1I5E&}d;2qft1gH_jGVcM!e69P7QI>uiMGV)wBvywgJ~lJBBk&o?lq=e|eTab@y6 zG@Gr&C(!U3I|sJd9)d407f~CAfy3crhmO-&*guD%4Y8QCVf=Asfa4h1b0=bJP**== zb;L6poqp@42JeDy%%}$5t~4|5pr-6OsQ!dF(7SsDsvSWH7pAfmBPN=NIr1W!-s%zT zZ82ccQKtzS8hFrBkLHDV$eK9hN?MSw>jUzQ-H@x5oFv7gdzCo4C(}Zg=>y$RH#&PD zg^3qA9^;$EG5%s&7+>56#(l9EH(9Iq+=UJCn15d!^9Rzxys;0=VHFi~XgH69$`z~D z8md%PA7Rzih==@Hamb%e3-YEuAm0*S%-T6jp|X#&67YUY9PhuRg_qW`_o~GSc+u0q z>?#8sU%pGO5^iJ{!fQ{BY*gE`xevT|#+R>Ejcvq&wK*dW{o1sk-_Qs2z46ekqP7m+ zjxXyy;(&Li1$avzfRp6QI*|j@#&pVfJmk~jknc$g^42~eCsb#8D+0XwS-BREwZE@hQP78Rp58yY&180!wbzMB#w~C{EOIm1e>;vuY zNVMK%>hV}VD30~Hw6JdP18Z~(<;98)CoR)=M!xaTKQ9jbZ_jV0Z$YOS1$ixHv zjyTY7rv)_M2hd1+c2{yF51aD%9ZRaSe<}|4kJ19Wvk$O0hx8}x)gbOCmt*-vJ^qq7 z+%KdBch@Y!O%SQ?iNpPFT5xyw0e6=`=_b_L)z=93p;o|aDt)LueLxlHL*;fR)!MD% zU^k})_NG3-iqu+wO@e#7INV#)f_rlxaK*|tq0YWU9PEQ>fxTtcz>dVXwbSBYjkLh- zoi(td@nC;W9PDe;0()y8V8v=};&9+M#o@j^Ex5P!0avWnCiIX$Dh~ETX@T9>2iTC7 zmKJDaTIVyB7QPv!r2q*N=wB6w`sK8s-rfh)keL}mCo`ZDAtvPURrWu{vA&QN*8P28 z&31R7q)HOFORp8~GOdBvRJu$D`T!TAN3_NtD`%#$jvpUFWUyA=z&exovfM5XcUxL; z5B34~*6y;j@yVHLt5%U5;P@sa9`PY@#QW1ie5en^A&XAr+Q`uE-00A7E@6gkTpZ(> zv@qV$2gdE)rCOfKVO?B&5k4Xg?_65&?(75Jwr+SODM4I2;@Do77PiBEU<+w8%heox z^IBCW?L7n4_+oswIMip;f_hgUP(v2C;VrY2&?ES`IJ%Feh3-fn=tjGZl&wx>>ob#I z(>yN@^J{6rJlY4$LJZ7!GyQ=$!tbYr@a{ekhNulz_{3vd|03bu&N_HarMGje4{RZ& zr&jdoJQ-;`!a;F_xwH@-?*m~-XO$4fgS$%{+#P9wJJAQY!S2duFQA2v#zQQNLzL2j zcuyY?!xpU2T)e%Klzoqo8_VyENBeSdw2!8R_GBMuL#$OE+L18T^9FHn&!h$JR3G4m zyRB6<^j$j!hjPP%g9#wtCl2yGX@NYQ63CLI=kU$R?vcTS8Ol$JgZxBVAn)x1WJr^! zol6j$e-g*`^|Y|vmln2Wyu4g=op5vi!?dv7pBA=+LE%;6*fzjxDqWce(!zE&zT8H| zu??k#?ZLFLC5)4fiDNsG7Pg1_z!uhrp=GGKa$T>-7oQ>yQBDiu!+k)^cQ<@GgV;zY z!=Dfb_=>auzN8O;As;!ZxiZ^xC1)YUial)f*u0RNC?yo?FNtG*V_KNc^np3oU8vZG zX6M+@u6U#UU2%NxPYd5m)5MpsHsY_v@qH>Se8qI|p*K1*v?BrEzl!7gW?J~h`@na5 zw|xfcB=(xmSu!LW36*kDM!18s0A5q+1W4(CE;ppfX6^!xW1h6N2rnI*ayf@@^5Sdi zi^M@+ofhbcK0t@Gpw9aKq!x6SIK;7;L9})sv%mhH>;q+p-eMCf`Fw6Lz7$W2Lp+`$ z#D3;dBOxZdma2+FR8xf5&vaZQ#Ds-PuMvm%$`m2?GlvriF=6okE8-A;IYo&5jQ=Ac zCQRb|fjGq9n;nRYmZeX!9zM7LO%sWJz8Vr&ZHkGgYOYu1;0A z7BAoc32jp3foYS3#pGiN2_eY~dmuo-1dB^D@M!$V#oMOZCoEc(|V8Hgt9r8IpcZ>a@&NO>vG=bmT#KtGvt{D7!S_*Gh+-ZMbWc2&`7O|CFoJtWsB+ zidHv@y3y>I%WFzq>Kt9sngQsmjn<6ORGOertNY@*?1Q}q(vokLN8}yyki7HgN@Q?HDxhmcF?72xh6H6 zk}h0`ZG_`)GvA#;eR6i0cwg(Uez{ScM{Fp-hOREG~H_&IUO(w`U}2R|iP*igH-{u*=%ZHfx(B zS^GdFYnvlkdxls$FY0xrJ}1ED8BnT%(u4t#8a3E9DA?1jW>YE5)szBk+aqQ zI?PZ(sTbbVl8mNUaBQ6TG>nr}FtoZ>sEUYym{mzPDAl}FsB3lnBZHxwQ!LUpnolfV z39b?QNR$yXH+3VAwnrEU22w$hJ=xkbwhxx)ul>Pn3W(!kQ%Kn zjFv}=)>wlEgN~6kS8GbOLh(>Bdyo>i=MGpffMff5=R(RR)B2|v-`wcnr5(LOq96D6lPAjaQd5Mz78k_9_ER8-NEt7V26d2mmBWXiH_)@K!hGDg z&$sIhw=!O%%CDJ67C=y-Vh&la^OF@|XD-0bVYji%hw2#dUd)T5-64*yb2;+K7hV-m zq>m{#)^;ye*^On(RepT!?l^qi6w8-Pd>uO?95~=nbN>AKqBw_6G^d>_D(FWF27@KM zQ;4lvvoxzf`;?%VG~Czpi)HIZtu{ATcHfA~Vyh`@I$l8}1HG(KoedGTqBbXpqK_N* zhDXCwj@T?tg&cAUvE*1P1`1{BU~y8@C6A&sEmJ{k(l5fUJy9xVjjNP&$;W|xyGW@6 z9cZt^M9<|qAa9NZImXo7BN;-6Hi>0d?rt6fXD`HJ~nr({FFI&M}LS$X%CkxX9zVdur z*|99Hx?*`$9qf;)Pz@cXw#PE{#xPS4K6d(~#KXM4Y4T+e;^=BWN9y^eZkOaE$c|zW z6pZ4rbD%$V{1tPkxg|R_2cRx(Zu*rVUlvK!kYcvEiK8YMWx>?=E9OvhYb-VMVX3jy zkxkAbYo%>|A+pqs%~h0gvSa&|Q$%c!znpc{ZLu7l33F&QfziNxU>`=zQkDKZLIQS; zpEgT+tg?I(X2-F}3dQj#y1&2P7pR*fV>@E`>DJ+`85QH-se`94Hl)6l)2To%A&!DN z+=_`AL@Lk6Qc#D7V|hIFtHXmebeI~7WvWYuPh!R%G-+q0dcTUwmqm!9fDW&qBoIU; z`3MT=@L&{=oj!HAzhVwGJ7cM7gge<}O~F{6M3IK{6&?@t%~3>NA+ieoPFLah)UCX- zeXQAW9Zf~`?27Br_h5gWFbco>1~MGWLQYC^iqW*@E3(Uy?n@On%dy!e!yng2h5fh~dh8K# zcUB_&Ie3+EXt={qgZy`)xsGNG6?nNI8GfkenUBcIgmMc>jWZ?)B(?fm#AJvwCh*6` ziwo7(7u%!p*n(&b*W6)MNMx11y_Bb|H@<_4QPIvxdJi)rRVRtpn*24@oj|+N7A-fT zPp<4|MgKF8js02KaFcs=aIhEs*aLGz{-NbT2gLU2erC|R%in%N*Ul-JTXcjnBt|!c zNfETj*)%(zN6>aHW>)QJ|73Mn)?u#{%ieKMY6_FqWGeplGbs`^BjTtdXPVZY0&(VF z?Z-6fO|!W88=4`R$VvvK>=v4lSlGeoR(qDTJX+k9T^)OqeQv?-tR^xF35q+NDj4>Z z?5MEI*Mr>W+wJF689euTQ7+T1l&K>Wqdl@SRvgWT9b}Zs&X_Qo$PVR^J3ExA!_KbW z*r6HreAr2vs&`~(JeeJy?$4bas+hyhSkLU_)U(Dj^sMpZo&|Omp=VL14m;yLvon#G z>`bKgtZ`u?sb_&5dY-f1p-dfiCVFOPcV6s-Kk&F(*VW47!tNAy=y~q!cpr6k_sGsf zUU~-^rOM7kir%3-a%YD!b!2BxEISepWb6;et|6W%=4Q1xs}Mt5-4BG0W}Xm&mdlOd z*mc3m$IsGK)=^H;c0IlJmsXJsUqRgkIRDF&xj}g_{WVA;3=r5bK}X=)caz2 zdMZ+$a?(U$J+!Gyj{I84ed=-()IphNpp)ds(?I)UIf)!K3w!d?K*%W6zq4o-XYZB}IPS<39H>6x2L9Ns*^_?(UhLv3$lrdx~Qj`q&tx!+A-MVuzmRJO-kQ zIkIz4&+Lrn#m;yJcE(fKq35}?Gw!l;Z!9};8Ys7S(>=xRw^LWY_%u-P{nU-&>tB?Q zpQW5MkpCU^zF3~(G*C`&VSDhh6P!DB`;d>L8+ zR)*1PUwu}rRIr4&&ig`WHLxNm)du23EGOHvivDnapZ zm3%aCjP6P!hDXfVIARt9fW!5nSgyZ^xVDi84%_~RoZ zW%{#kAO9MKRVa<@D$@U><=rDC?7*YPbpPB4f|1cEE3ihYyJh>x4Bhr*w(OVL#i*Vm zr$=HbdywSx;6uXX)S;kI&WTSyjoofyYj#$tV8N$EE3rXbNvXnSj!u+Dca_FQN~048 zM)vI;*;g{=Lfv|0bzZ>MA0H3i9gl*0{1o(2ri1W-ScJz2;pBmk8H+7yt_64_6D9mV zy1O(Al!jK?HwJvA?p5T=DxzOq+dn;YlbO(^6zM>miiOB4HVz&WP91va#IdQvQN5=vF$jHd(SVV(vs@9;JvH3@VMDX?~#n-sePdzGnXz0kgI4nFE z%K|SXKQwjlz$p*7)Y65TbfJj9T0_L2Qcao@YwjrU(DBmg$4{5;#Xg$5@eiw(&)qt9 zVEV!0v2qboj!z{Md!Pb}BO`mp=4hZ6I&Zqi9TPi3*5X!q|wG~-u6p7#{vsp?j_Pr960IG)zmb2O;DufEL&pOlBzDw zHU+vPXtX9yz)ELfWISq(#xgweVYh#JsCPS}(qk!3>mQE=!fQ{IBiN2aJ;;M&jdi;> z`zhGDg!MJF6VToGN4s%G#-eZySkXf*OE-&lb9)$5*Z-vz?SP$*1et)~&D4o0@>pxyp3 z4?fKH-J*5ZL!Nn7DZLs_3qKso!3=XiUm(dAxN}_-#XZ^SaMm$7JIt*8R;QZcj8dar zhe74F#Z~+6ywZfQ$H$8o!CxIj@F>bWv6NOdhoF9lb2(4=svh&TcU3L~SV!W7;TLa>)hc0ZbG(NI-Po%nCs~DP_i4R2hz6WN9qkz*2a!{O( zML}Lt${5H_3kS8zzOfPCM+MHjB5K?gjn+)fUh8g@5S88d7#OgRjFlT>Gz($i6)$4O zZY@%20(SdT)Bw8ReGi?hdi$+_gZhzJ)F%n`gOB;N5^b!;`s>PBN%zbqYF(m@<9_3* zYKA1Ja91Flmu3X9Hb=W(<#{6{k;~NcesyI3^gz0LXyFAra376@%Vrfj*F3G0xm0Vc z;NrEmX#{l+ur+-RYyb41x*ww#R;UB>u~?XPtNI4rnM(||D)!^+7aO!qzPnZZFWP__ z+`qffR`nI^zDlM2$^wv*;CmL+SkXTeT?LHn$e!@v3*szj4|x@ z7&ua6|8btnieLk;w(6z(TiJilgWOZ^O|F82{tdC{6*j!WLAEx6MZ+nng2@pKeD9z1 zH9ng`=S@!3;UVvwREm0|!-_L2c~fgB6+;-^7xfl&y&}Lxl=mL!rkbfVd~!k2th!nJ zg`#<^xgBJ|^>j#kDweb{BJJei$vqRJd%fO41?#gFL8_9Y3LbUgX9@o(UZ@wWa&CL; z8GN@qShqR-J|%aj(r?UCY2RY8#B9T>!R#9Pmw@?h^;&6fVOKe}(&SByMz>?5yF-=6 zXw{liFf@Ul;>EjFZ|WEE7fv3dByJUwP)wh6`EGf&$5_kq?Zc9kp%{nzGqEt(?MX_!@jP-42gu2y4gz_(^>jEB zV>#pbU2D4NV#|=6`66iCrc@O$*vraUbZTK_ca)IakW`|dv6OfoWA5H*7N=OoQfle& zH51F%2I?x#Zm^Rl_6HS?vues2QkW~?@(CZG%|U0Mpx$te<*ZkTdAcOS0a{6KVJDPc zIeSQ%vDh4Ji2wU&Ku#-~lBD}v9;H05>vEU#t44pi&)55;7rzDOiG4;9Smt7X+ zOw6GUO`$%6IPzBY0{wx`q@qVcl>Qsz0*TMuBT)eS&Jk1iAA$g;DV8Qit-Lk3Q%VeTGSL0KX zEEdlDwd6XI3-@s1;BCZ#E1Ro*63b$`4pVpVPFE|>)U?W3 zf5Wt%A*Zw3oW8qlKmW#^u10Ym72wgfNT~{i=d3^W=H#F(#>Rhc5I#xCGu}q?5|!>! z`$|glk+WcP1s00Ihw=;N>Y7-eYhkSmdIBgh{fw$zEW%ndI5piSVJS}Q0{|5gg5i_nm|QqV}}%s~O@ zir3q(iYm+#<#WI_#xM7mV@P^ zR}mdotYA96#dN64@XL`Iy9Umt_^>ii*CFoFyK=~*yBYC3AXZ0-3`=3G;8>n$jp0$63AaV7gs73;XzdXk zQ5ICAaGj~%ks;ME)o-i1gQKdq8;6HawHnU2q$)-Nf0GA%T_Cmx-N+7I%K#z>9sVrU zT82~s=*b%9R)Vxu-IgKOf)&;3^xWBIv}$+H8B%XU#Gr@`rHb8_;bE+i6YI7^!7`ly z5ZMMlMYXVmZ(~;quN{6G(K3qQPatYQBx_n=~2ws6i!K&2k7zQ zUK&iFaa{eLDYNRKaq(4A5k2UyFmyD~fa^`yr{2sp;VhBkYNr%C7kI`}{{Y#*->~;6 zi6e74AK9S(UrO|v{I{g7K1J7CRjQ7;nx-Xd=OoLmZ?Z@RWgZ?p)sG>Iq|&Lh-nhQT z?;8GD&#(BiHp#B*cliYtwm5rc@=*lxi_ZB2vUB)AvIBSZ8$e`xBe%|ZfKPVyOGKD; zZo@|N@`Bf*^uU;ry-NLLmP&oVt<;C?6A@Azq^lcNhH3?$=e}C?(roY~s(!K8W=k%> zR#iX5x%Q=Gt{fhwNd#ICUdGgLq<*;_9N7A0tv|BY8UnEtaUzHRz1%kHI}tTaaD(Cw zzoP1G8B*EezMZ2knQED0=<4sI2^$@;nfAX_5xf7Ntq(!BS|F7sIt8P2$z6mu7>{RCONN_0(+11uR^X ztREh3XjlPqF;gJuUJ-xh0YZzP1+m*$n7|q7EOa>iaUJvPJzp9CgXG z$nP`s{rNzpX=7I}tq%GDhrV8;6t- zHBDfHe8B;%dPjy-wg%bBQByUDG<5R7+aC&-Y;gOTa_)`Ocql?-OUh4YF zyYIB-*RUmz<`Qwzi*-txRyg(Okzyh0{U`iZLoZ5CE?#k7GfZ>3^}(G$P-uet{am8WCYW*^20OqhI1y$TS}MxeUmIe8JtW`k@S| zY%%{?j+&~??mB_bqwrIV1==)cgUyPr4wJGgsnMQu@ksk)Capi+^XEw0v+jA75(RY+ z)uAul18=?RA0cr@Atd7t*oYw1X`-sDAm|0$}YyXXS0o>giQ{(QX*&FV2>HB^6Aq)mnN`jz1OC{fUgP#s(= z0-;(P5HVO%=kf4*oY|-)GFbZ(wFqq6;xEbh zHx{eFVhHoP`07}Sd!xBEy1t%1`UdA4q%h2vJvB;I$ZJ841t-3>shNVh1+IvF3v$%2 z`BsJ4ODn$Fb!({i_3-+d zNj%CpB)gZ1OBSkN>%u{&dRK;2w&mEzQB#Lx8P?Z`$jJsAy}qV`2pM6QGXMy}hUZQ7 z4H;7P20PRGnm2pEsVKU&Erj)XO5nl`FT{&mbi6+*q&1UMMTLcb05wCHb^`?cB&uDkjf_h{Twy5 ztLgk=a%S4{x^U8WI#lQYp)=)T;gz<3S*lj3?PwX+oU~RjDzY>$79Kc#`ot+-vtAMD z8O~(q6OIbB^?61#q-xP!qqBm`_UQXROkZ$}eQTzwIc9TPIu5%y`quGTl!tM7mPAQI zEN5NM-%xh1slR+VtPjkfy|jlw`3LO};P-0POS8e>p<3M7ISQJnSCb= z567#_$C@CV}#+%&UuqNCG|iv1#xxIXAaP^Xr(3P2J>s`8Ao= zQoS>Q5PeS{$;qwlS= zTx!ek%fw^YGW;}dMp_1XuoRZzli^yCW$uPXbYw?!2Gq zj2czbgQd`&)o`sycY3wzrP<(tS-lt8_0(+11uR^5Vi2fQt?^%({18c1Y|S+q@R=r+ z;Xy2NnEgC8iltL;NJ{MK+V9}j%A{+*EdxWr?(hJ3eI`RHTi0ITsHwX4;q1EBUSHz6 zaVl7!QVnYl8yE$V#+i6U{4%q%bc*;rC@)7v{6WgDOA!+&zark)#gZo;HUV$M2LyL3 z!w}bg1^fo$gx~vyR1Mi={kr_C$RVlYx?h*oXDL_uDC~Ss z{sfXHe@}kF_dQwt4oV+JLh3yD4H>S$RpO1`3H$` z#qPv6xh5q#z1OP+;xgN8&Q3&4>b@l2!A=2R>gsJ7QrT8zJ4a2mDv$PTRp5`X;Q3zc z)wE18MN4N|9!7aNnwBRhyDrm0p!}v~t8H3BRC$78v(TS?nWH+S*cSzH!jjmVeUXqu zl7J@I7XwN2w=eL6uM%%v_QfJIS&sy}5@mHb1)tBpWb8_7yS551{-)gb0!6^4koJBj zZdx`ad4L-v1upZ|mwF{7ne|22-q1slF9g3s3|L(xQF|l3*C~IOxXh-#e>($DL3ZKC zU;WJtsch~2QI49by?><_?LF-|*1=axt!8=H;;)s4A{H8W&0<$ua3U{bTTRXN$pe>O zDJF2(R(O_&pXLJW!>il~OJ^Uxi1Ko@5C1~hb=e03<+l%a7Yhq$3{PThvI0KAZcc40 zXJRR_XW$LdE9aZsD9Osi_GCs?Vhw#=yhwN%+W`8rgPYd5ojm+@;(j5%3UR`Hx;Hy` zC35J~4!#aa^S6UIBtvys_P=LYWF~9mpi-i&KF1A~+_t?brAuK4PfI$$qr89 zX76_J1XA9Y(&)ayfu*UFSzovv#H<+Hi|TanXXaTkjo{m}Vo8a;?)WBRF`EUP&%jVn z*l_fRs%A)K3)>t=O|^haI4kzO%+Au8rk7A&j;85HDZ4JyM4#fBiGg)s0I}l~{Jt_EniYa3Uy415` z{{%z<%}r~U{t`DMXT|8jQp}2dGh8dOCtj_3X|_{H`B`L_B$i#xmR!KX?FnYZT$2zz zs}=cPb=`Wm6W^4Q-m@wcE!Raxp;vAs;u z(wUa~P+pFvzheG=?al-1``@c9&0 z#x8ZK?acku=BTzi14ZvKyGU4~R*TVtrLZ%n!?hwidh;mL>h?1HDacwi@)f2*O=6jt>*AAoZ!bExR3__E&%jQwE8uuL^=yVz zwsny?YN~a4tQYHoUE{n(Ln`PBj!VPAMOxvN_hP=Wp)2Rarc}m9>@p5AO4^L^cIIg5 zOv?|Vyc|u-%amQ0X(3R4({e2~V?=Z135!icU^~X<2r8XVFdIT7dpZ3KQ<_QasL(F8 zY}F*W`vqkYhYzZ6xP$TGr-aa(Ky~-uX=TSsVt9 zXUaLPg5wV83@oLFleywo?e1XGf?9ZM)GlKCv;a8L*&MNL*lq>dYfwUt(6f=Tk~nwv z9_*p?uc<#1+!##t^efhf@}Xw-sbH;Fy!QJb^AXg3Sx++Lj?-=IW6KV?)0zh=8N6F{#`Z480o zBTOk?X&n5{z;VF6=cWE%%s?iIpn|%Fj8^H%{URtPI2ToYKWCL(YHwn4srBX8iO2Ae z@gH$BQeV=8rO=n_Hil|N`qHaaFU^MIS=GPqwb_yjSh&92M4SKZeO~bn6?TFJ=POSz zy4MeGC#JHkV%dSHX;vdB@)dA*ONLao$luISQ#Iq;59qph5e|YC$6o^c#{}@v^2~GO zPPkAN3w#24VOMd)8ZOeXut3x0ue_Ta(7@BM^C}OY!*IROYLeshipZ`!G1!vMNi^`p zUG|^uzSP2Eu_p#k$-d>kMZLVHJ;F^JbSj6<)>gG0-3Y&XRmn>;&1sSqlx-*}`!2O; zm6YicEsva> za@K__?AyvYrWH%V!=A$mC#FxGnm#^Vu-1>a3=xMjK-JWnEfHC{OH1?NDJ8>jzVOFWL!m>9_QhGdvhg;TMN?~3j_c4}s3Y<%+{yK>v#?It% z_@lqKyoDaGvlF;C*6I=+v|6q~b<{dXuP_H?vF835fH0mu4px9g}oi~hTwy; zr0beqmc@FtCh6dqs#$4v%ne$r8J)w8p(mj%)XkglU3R^dZ$$aQ2cg8~l~jKNB*~zs z20R^eopYi$`_Jl_SHKUrxf!k;HN9G{O5|1@#o&VuI9Q3EGpi6k1K7!fq2#P`p(C#} z*VAhx=4hQ;$OHnluG*S!lwF|%seA*z@+BPySx|->_zsw@8`SjPt%f1Bs#^KNJjv3P z=r9`mHuzJrgrK)!FsoRyxuIND3_7bCKhrU=U1k(7=>o6)nC-7tgytA)yWc~6iD0LNI6rJ8&Yl7 zQfV)k%cT0b4$Kc7Elb)2T^Q1+;Gh9^b!vIXXTjNsO7S5roJUofHK5Ihe_Z~E{Au|UEpt;K4V`VviOefz^p1Sk9K;-c<*cAUnmh87=GqqR zr*m(dHwTP{Qneqyh}eqc{``Qs$<|-6hlT-i1jwiS@$TDj6E1(cMfhgD3ar+YYDIv{ ze{_ib}Fc}rc|XxKPr8mmCR-EZiTe$ut+pFTgE?75Iv<&3}TCyvnW-f zku516kjWJda}}Ypo(##a%Ab?JBLB1eP5JBU8hlhxS5t5e1zRY%m4a;)?4qDV!MzmR zMZqx&rYLxVf=4NsrJzEAK|zCp=P7uOg72l^dnouJ3f@7%PgC%d6#N1OAEw~9DEJKu z{*Z!CQScWO{22v*Pr+*x{2K-TLctYRAovztZJ?{Q6x=|;wG`~6;5G_&Q!qxsBn9_T zaDsw|D0qs3Cn-=Vn4{o41x*URi-I>(@ck6Lor0Gs_+bj(Pr-XB_!SC%k%Es?@Y@vp zF$I4_!RILWOA7vpf`6dkYZUxD1uNlJN?k_5W(uyPpg_Tm6bKXyQ?Q?cJro?F;2;I3 zDR`Iyk%Bi;P^aK51d0HKPecb;oB+-uBPBB3T~m`W(r0rC{l0_1$R<#l!6B+c$|Vq zD3BxwAw6IZ5F9Ei&L9Lsm)^4W)W($__SGc+AKD07MV7SOPfWd&0^AK z5oxn{v{^LTEEa7Ri8hNvn?<3`V$fz0Xmj(ox#`>7>}_uHHaB;ho4U=-+~y{3bMv;j zY1`baZEn&wH)orhvdzud<|b@&^R-oKx))mVwPX-JCw~@-=kMjO%l~F+ohzvGvewx^ zSFCkzpexooJL!tG&ThJ5tuskitaVP%6>FWR=!&(DN>{9P&eIiZo$sP6);ix$SFCkj zrYqJu@24x)I=@0!taUz4SFCmZn66mse2%VI>--a4vDWz-U9r|#N!^&W&Stt|ty7>Y z);a=RvDVp7SFCl8&=qT)({#mJN2Dv(I(52Yt@8|BvDRtR6>FWB=!&(@kJA-voe$9! zYn_kM6>FVO(iLl+&(IZXoiET8Yn?CC6>FVu&=qT)LF&e=b*`o>);hP)6>FVQx?-(! z4_&d=IZ9WobsncH);bbhvDVS)inY$S(-mtSldf3nyo;__>%51qSnK>eU9r~r7+tZ} z`2)IQt@Gz}#aid@=!&(@ztR)cOQtaYa8 zinY!g=!&%ty^FKf;kWXZxz0aCBr|KSt0)*~(!dEr2TULv=I^Rk~@W)9+2rJ}XyMFb}x;oOv( zHTc7u@v2Gt{tp1%TRJB(=En2@M(_4O$|}%(WAWb}!u;2IiFSldeIF|P^fR^ zoYe2epCJ6e44liz{s(YIl}_XMf;Gx6Y;y*s+w}%5%oOPjXB&=2EMP(bQ#sD0i_d%S zPh|)C)hocTuM;4058Btw2* zcF6C^3-VAOkW04Yf+W(gw?Z4)Q_Vzx|?v6!^Z(tSeoTR6`Cv3bb^N4FbqUJK< zD)s^N{&b+*wXE-hw`T`Elo#kyAE5Wefp%9eq`yWS%8vE^ys(b+fi>wx-}xjrTHKY~ zZOhrgz9BELql*M~tT>ts_F{Ih=kfx(YjMB|<7r@jAUoLa%M0w-qJd2j;}2v9`!jig z9bYuC6Uk!yd)dMMPF`Rq77gs~WUzme9qeD{1$Or$ft^U}vtQ2+_CN9hyQdGZcSV?4 zd*K77a(Fd}Fi}j^$6K~!9!hOO)Le#AdlwOIijpd2hkHj}aQF2AcW;K)P3g5$*`XfJ z3+nzppk^3D3479dZ6!O{GkJl%vk$OYdM&`F!F?_}+^6$`dsiQDv$bt}pM7ay+hzRU za~-U$en)oHoxD)ry=bV%l8x?%vxEI$USRK8G_d2zU_X@|>?iU9dv70LvvuFp_k!25 z!+kX`xcBt|H(U2j87hA(JJ|oq3+#bDz($x{TDMSWT`0`8l&VBu$WuNOUAr~&U}`I( z<}#SNzYnMpQ#6E5VxS@+CgjOob}T#Ak-V@@_JMV{dn6^!rGa}WJGck)0(YmILw%^YS+f*OeB5Y>0CK$B&Mf8H8*C5d0k#GkM#kwlmIhXO!s6* zIGz{6hx$Mmp>446B^lep*|8nZ3)}HNutl_RtaG; zxVK~n_Z@kGJJAQYk?ziCuPcQfO@{bm*&+T&UJxJd17g%V4w{s=7g##8@_Uleek42E zU&;&Z$v)6VNUJouJ7ucpPqKsi-+6&M)d#p;-O{QU+TPtGqr$F{kra?$$`102d4W8g z6Ud6F3D}CUZ)_xGhH}+4na4KE5jB^w%_Dt)j4+An`4ok7b9QX6%M071d0}fNtCu^o zW80e-w#V|qmhw{gNOo)|^TPIcUf5FJCA93=YI$LMvJY%gcAi!+3e|?zNEXc(vO|1p zUJzg32gG8xanKl|p3;UtksaW>^8)yWJ^)7Sk5Pmw`{EERq*!Cn(y^mUn5m>R>aS4%0hy#WXJcmq!ZYf4oC+qsfK-v3x1$Fie>nZK}M0SXeE)1gOmCD{YJnNy9%r))? ub9OnjMyXe7ttz=VnuE6+^M=HY-b2UnU$gVpj%W^6$&Z)q@5*wpS^WQ74<}dv literal 0 HcmV?d00001 diff --git a/it/doctrees/metadata_oidc_ta_sa.doctree b/it/doctrees/metadata_oidc_ta_sa.doctree new file mode 100644 index 0000000000000000000000000000000000000000..3a9fd6f9b898c7fb42aa3b1dfb2b47860adf0c7d GIT binary patch literal 58945 zcmd6Q3zQsJd8Tc>M{miN{1R?UmOUC=-7}gQjU+$EGb4E{S&}9Bjohl~uIZ{)Pghe_ zt&waTOai1$3eLf_u$&DWARKl#*+586LY5p@NXQ{Z<$tzWd+*zxUR?e?7P2#eLtpg8wr&>J3?`U&xE)a$PM;dfQxG zR!hwVscy92(cbfh_OtClbB!i0>S|LfNp15A#3;#1t*lA)_8C0fK=BQwrswSpR+ZF+ zKzezFd82(#894i7KA%5xwm9(h=iZ5b@BaF8?`g}c&a~w<=JM0h1uC^i>^HTkR_4lv zh$Zig^O|n7&E++vF13%WXwCujcD*^L8;Su6)w(aP%RboKkbTWhjuu4 zFee)ewSj?LE_dggR=9h>p>G+U`ctjo$JW!$rv1wz4-oc(HF-OzlCJ~#H{jn6{JRPN zZU$8==T&V%q`FdJZF!e`OHrE`K(QtPkFDGOpn0>*s4fdBcIUYJpfB}FUMq+&&rqydH%7%O}w|CrSV+E)6^KtK`=50|K$=Nco2EqnBG>|y1SKGX5?|9o>*3^`? zIg}h3WhU0kN?Ej|+Pre8EkC6bs}G_9W^HB%!Wu$;BD57)c)MER1hqo5?$x|!J7`k5 zSd$Dx(u50+!-q-o-AIkh~5zKcM-j<8cwq;R%#${TznO+~t^kOK} z>q$*?F?}a7tv8f%oVe5T(N0#!9MSezy*-rGh}4NlT;o>F$KaSNyW0W`x&=9e{i;jY zFWH1`3MK4?P{KBa5_UH$2t|r#tV9u#P$q;@7L_~^X9Jv?+cT83?E%ufq8!#f=Cbx) zo3*W>tbHVuwXLD7JwvQ5idtQ%R|MER9ZFSD3>XlpQG;!Rf<4_d3?)~oDLL4!BEaC7HON! z$Cs`I*NA;Q%!rv=x{-(5q-~+(X<_6^uuUF$leJpTkfoe-L0o9mB%R3T_;Zz7bHW3y%sNtgI%XU4v{jJ9|`Ip^J<3=L2ICATZQ?! zai8zf8g6C0MwP#59=-&E0u^(}dX=B706UccJBQrHF3!|3;=Py^NBcTBy58l;CtsK< zphzE6ZmeBitfCvsmaFXe+ShjYx+#(`nfN+-SeTsjs99WG%!?ItqKbMxub>|(7z`FL zrx2SpqcE>P`xKy&U=l4GeDD3sah{FJIm9!0&hObM|`zX*FL!c@#!S1DB)o z(0+%BzRPt$-W&;Xo_mZ3a@SN%R2K9TqK3IAM%(>^X2hM@bhQ5sJ_ZC#m{B4o*H(!> zM(k+J$gb{ao~+FD%TRbF9lCZ#(pB!H>y)G^VoiCPZHk_jtza%4WL@tk3(Et(@_by` zu`I5-VtG_er=zN)h7MD^BAI%slc@(DJ$+K*VP0yQd|7mGwB659bp7%@v#`t#@zuxtIa zS<+*b<&!Wwjzv~S9FL;=()GST-5eRaEs~#Z9p0R)V*EQhefnZUO0Aqu1#;=&D5%4& zm{>ui@_Z}>b$DkikEgUcJXk}AsliC5x^(yyR_sBOdQPgRRaCw#IyegG@DfS_K~$2D zpnwh!M)BB5sl)vhbEw%9Nll}(lTFnWjO9rbX-Hq<@jz;hLh|Y$E9dWYC5}(s$}8K) znjP2CR8-HdxE_5Er0axX_}v-EP$Z8}bn-|H&S;vNdgSS5(81U>e#RI-mExnxj^ODi z$&TQ0b5A;Myec_@_3B7M9`O-!QmQDrVXaprmnF@YDr%Kut4)SKu8#`)alYfRN5ox8 ziSXy(RmP#=_DC9x2pTZ4Ao+c;?^Tb`ige`GAu-N)AduARYat6E&UnBd8fqqcN8IqNQe*9lEMuV78l5y%b^y0McKK@D9+v*URL z?NTFF(~hJktGluedxc2$j(Jj(o3a*B@i)z4NZ3kwj`H5T8qz|Io%EXvejXRL2_#%mr4l7%Sr~N5-%1A>~MLI`6E(>lyBcA-@A2&vTr=XtBj3-Z1ABg1XOsG6%q=`E9 z(3UPa@@paYsmo1J2PIy4j*}lx109UyBy`j)Ok|~jkWokf>ekN_Jv0#I;qP0SjG8G^ zr)S*}$xgTiLfQ=Z>0-$3H*U`YLjjK57_Rhil>#hf(zC2=9iHxtgpGt1`5tk-59?9Mfvzy%18tG=cxBa z@)V_kGMa@=V6qcjJ9YbzkE8fm80F#TCnF8y&B7)l*?F2qKBrF1PUjweEO)qx)lWKJ z;(KpO8@6b#wzGq5u|fMUv4htrG#fQlEbE26!+S>x!xIJCXeRI;aO?=9UB249SSn%b zaGlSC&@Ny_P|6L&3E4)rg;O>!2o<*$zOKhlbIl96z*Dc|%{jyBC9JQbvF?jxlXgxQ zkAgsnxfF?1BG*$`OIW?26mF$qw^5Y@w@OevTqPe39HYC^h~W`) zE{d3?0N`*v6Up^kh-({(l&dxC7105JeXEy~?(3Xd30y0Oc+|?rxEraf>X)DNLy@HO zR*0Enqaz1|v5~!kZ<(7kmt^QlUezktL0nVt%CSHx?6~d8Y|$^XOHn;XP7g;?_5jK0^n=3G z>`YK7E8^2n9^{D8hp+oE9u<$@63%r4RW_Eh=lm}dD zYC=uAkjG!OA>vP=CRN0mI|`gRRyh6G>B2oYKXVuUVYl-6-J_GoAIKjq<{{;HRWd#S z6_6huo*1RSGsg~hi1`X^4io)b=iD0}_9q=NSc>X6#2kqvW|4XTjpPJArZjc@WJh0L zB75J#)CL|S^ZH@O+x6}z9(N^&J5u3GRZ)k-qmdla$vBTgPr#P4R>3i`bwHKq^YyyG z&C5g@9mwY6zI0+Na0u!iBJITFNslf=RpBi`k&Jn^#IPl0O`JCbx+AEx7f!$qXJL3O zY>&n=Jn~_;e|o6*Iik{MDNgGjiv+@ZPn5$rhD1HcgJX?#yASy(II)ENHFN^dJ@7}T zaE3?2aILYTceE_s%-hZFVeGl@uUF9y*yE94`Lq#%%^K%&s++F?o!?7tjI21|yX@uG7&{iF=+aKn^huOZHx9)n#6R#@u zu7=aX4@Gh?#~jcbNU{a)TGx1fA~_w-J|^d6nRU+Ulp)S3H9Bn=R9@G(YTsQ~8W$#f zym%4()j&%;wm9xFoyO)3>m3nyo$gqb|z z2pA{~kBkVjm?d<;UM}Ie52f?l0|k9xH2TQjsr#wOx*wpr&z?HIf8Q`RZVeCn7MvM` zuCnUY4fxj(wQ^x>c>hGGx?QK}s+)-qMCW}E%x#VW?p2V3;&dbm@{Ur(K=!yWt(Fdq z4*OmzaONdZ<+f-v=W6yIcfEk9?7m0GfPHwh*chc%2pv zbgt@6TLB04!;z>@66yyY^=TzKP>p@prE`+znN8HXKnKSC#FS|NFW718VTx?xnV>uV4r6W07!= zSVDXxMXLtko|8Jw2!NdnHYxq|n$$hEm6Bj8(E<2)BtX_p4?OCdW~MAoSKwI7XksgI zm*o0qlt4{CJ(%}9diIjbb-+Fm3D(+nP3K00=@aUS6pd*03S5EA3|vZt~gv`C<5FKF)m*9JlM9Mw)y?9sBbvvW+d(e5o(^eeB1s!1(oP=eD<(!FS7pb*t0wd*tp^`l%$9_H7i4 z&9-wVm|a8v_AlS9ek<*5>MBN7nmmZn$aZvOUq_`eQnl6-bXB0Im~=PmhISEu;n*=u z;#MIE#q>#+@0M44jI%6%J}gNIigCC<8wrD5opeaDqU!>$en4|Hf>Puzmc(_lKzd;~ z)Su9e9i1$Y#>WH2^Y^mOcpf>20^}r72Z6lYdODnmk(}|`uC-Kjv8hYWS`jp^A(aIT z^pbKGo>~~*7bYY(#+B%2tVcYLG55SQi&G?HJ!K3b6B^sJyYaSBQ+EUMZ$IJcrTE=3Y}hL4$v9(IfG z;{}qFf01Gr4Y8<;>=+cwhHK1K(C0k3b-b_2E98}AI0x}?1y)}0iqd;zjyU*oWhHl7 zYwAXB5{?{IEjM_2a!*dm&C)K81!!PVQ*wi+Cihq@Y)+HXaVJ)NcKH=ogn1NmxJ27j zpFtdXTlE6{f!j~{wrZ0u;XIUat|2E56-{i&emJjxxSl&biE20Nxl@z5>6u54A3L7I z{FW!UaH1yGYPa#m6!JtT)p9jeQ*$#@6yIY)%nf;aXKkNOLzb&LO=+kaW|L~Jj?}tT zX<|7Gj@;M>o@$B6puE{UoKZzw7i`tHGG}PS)p&g*i@Kuwfo~0|vC~qUyTEw4zQnmk zdvc|gc#(MD#uWhdo6X(HsBl}`s=4GkW$WxYRK~AR8EzA=_BA}W_IfOb!P8rYw@$S8rMY!LSs` z3XbK;)y;U+%i`H`wF6N@J-FH%pExgoLo~;#$R9q9E)WfaPFJ3USqueU z^nkAq#P*eW<9eX=sW)?N zXO_ruwNr|n3%p5He-GKfN3ZuNjw5q9f99b2$CT)s^0!D^eVnehRjE4WYFgH-otG?E zxbY$xlzI4xt^O9Wh%22+>yPVe{qEFX=lSA(olUaqE?s_}g)PdSne4t_e!=nCFFOwV z%im8?fhF<*yn!r);iS@}nNZYqQIZTOy z`h@CG{TymQPPOADCP*#(=T^s%xL1SpNA2a-By}L_(j-q2ZDE>(9=sBo5RcBl<2T zI-S0nLE66c)q|8MsIRCFsq__GC|3_6aj)j@uOTnDzA}KQOJ9|VwlIA~4_*m<_2$l6 zk-qY36|YW${f}ngBC_kN+2RYxL|@TM0I_7~p>wDAQv+CI9;_H!5xs8o0d9pvBcAsq zKpx}^PM)jpNs!7G^LKI7p8D#}6L^mT@4eW*Osg_D%17FZm6nuTD~i$~fYGHK~_ z&u5UfZ{73flqjfss1B)g4?IR!e;lX2eI0F@a&9D39TI;;!kH; z%gJ~8C~#=I`z&5z`i4ioT1?^Ry)I7+k|bbAC$uX?ArdO>3|XfEeEn#*(pJ9btf#1a1aw&eea zEv+R#L?vyjK8QbY?QE_@YHZJGn_HdN=)TQ4ZC-ybs|)zTU%UDg@-kN;K7B3%i^No} zxfY>x0jGjXiqUTIWBLdoE@|oB{$8HBHKgfyL%jR=P7>jKi|z7@Bs8m~-(eT#74%eaHB-Px%9^{vZoWd0)% zbs3p=60KoIh90~UM&|cAYeh!Jt5rYE24C;hUqyCt9nAM$$5M&$1zft3xiMg5Y8d&& z+n6s?gIELJYkj>mkkIRff5oj7FQxW`{eL82CfE(&{k{6d1gY$9@CA??%(`;0rjGxpb4 zF1N`zO;QS#iO;-y@06#B)-aPn4_*nAG2dA$G8ta2`e`HkX^hElBJae;`V`A@_i#H(x zD6w_V4L%dnnbtEL1>!K-Lf5MiwU@CCb_RU*qdJ%%m2Eh7bJU-2!*PW9S{lRgF!D}p zI3DGS1eHvGhT{~|9n2x2;SiB@i3|rmhEgSxLkx$_eJaDTh%Eay9IvNDLBm0HNMJau zs>UmbU|%8J_cQM37V#O5gni|58;;)uqAtVnE}}KeaL|KS!f<@DvsPp{yju0sZ1_4& z^(AE2OECsiTzmlm!x10#&Di*e3Rs))qobP3>5xzR$TAY3f5d4Or1>`fbXMBj=$!1) zg$f)I(06)w;7pwF(8;%~)ZU5AWAdJ3=&Mi%x+IA;UG*>epB8d6)~QH(1L2-Rvt9)p zKasoBep;M4Hj*FXHxP)2gJ?LPW<|n9AkygFXPuVd&p-EFTCN* z;DYa|d2)#=6gW3i{XZn)n9A`6{jd@}3;Y8X`k+O*E|MVzA6&fpsa+P9(XTpw!pr!I zwcVz@KMV11Jp?;uYB7Mq`?V13B}-N?#DO$~ywt!4Myf;?+lF;`so@HXhdPGNC|L^9 zxf3hv4tmL^tL!?vk{tR-1y0|Ck20-$w z(etcE9dDoRsdn=^ya2>&*CM?N)Zi>iDi`N2^6@7e`>mdZ6jT)?)y?gp5#f3O(Wv59 zw74ztI5*3#b=q7yIFzq6H^9dXiZzP%qhsbe=MKMrJ!Y=f;maEDclEZp8817Vh5|RF z^EiKt!@zipy7CdR)|9+c>3o9!n7O7xM}_Gaa2r41bO`Py#DxZathGvl60e`b&jI^q zQ>)?EdP6N0=isxAp6YEr)njg%S5>2~8j|nHkt@yh`uHF%*!l~J6Xz`e0fljsa!u_m3DYV9LenFF#|bAPTd zH%k{3aAhs+*^yS5E6UPbvx59K(Cb@z7mj=-aRGPMkOw-65aF%v2BqF;(kmtSRza+` zxuOZ*t^3>Njll;+{%CnohMU2fq=93qX31!q8`Y)}p2LogCmmT-pC@&)!OAzJ{NRI* z#O5ZdzYdaQ&{G4Rwz=Lpv<|k*_pC^PcdMaG&9Yj& zut2i32^|KW{qPwDbaU+8qG&83=xyf}eA|F!b7K)7gr;NE4AcE~1#av4#zjL`>+H6tZC*n$xdMn;#MlQd zWS~V>+ecQLJ0O+|MYnglDh!{k zAR&3)+@xQ`F2D;#*Pj7g9MC5#+U7bPi{wV}wM}$u9Yk&A-_}ojXrqL!c1-P#k_?X@ zCA6T`C&4mPNK5QE-~K$LL&c^Q_&2fD!1E9wwM3tu@$|wL(iD1gt|OkZKnKC-TQ=Mo zm$OEK*euLJ3G2p1R6&*`1BF~uLacK|341weMX_AQ>Ix~4mbuyXy8?Nw&08w%d2^Xm zKi|d>nNB^DHbEDLG%DC7gZ^Q_b&FQP7Yj&mHltF!yO71EEX|Xzhe7#}e7pRFJS#8C zviySlOY%qL_sXA^KQ4bs{!G){5=cYGE;*5T)tuIr519icSt^|q6i9Phe!^VWgu(M} zESi?vYwPg~h^@d0yB+%@<`!Fj!Eow2$Ppl)@~69Rleg9{H3{FmQvq`|d$GY16o3u# z>Cq}3`Kr>1jVf(}uF`(QD(xq!(i_4mt?X85mM-Z$4pPblgl!p)*ptx{b#oQvZ#@~5 zzb=1Gep&t}`KR)at81@B>eUonOTjf1?51ER1$!wdP;d_gcT#Yaf>{b4r{EC^<|!yq zpi|JG;5iDOrQod;yoG{yQScH4zd^wVDEKcFe2juWqTmlG_%jMVN5NMq_zDHzrr?_t z{D6Y*Q*hN)2!2La8|i8t1vgS~9R+(RxRru^6pT_ZMZvukoS@)A3eHgQ1O-(JDikbI zU{LTz3f@4$+bMV(1@EQc*C_Z91s|l~cPaR73O-H2rzrR$1z(`xYZUx71>d3I?3bs>lH3hd&a5DuX6yzzmn}RziI6}ew6g)=3!xTsq%u&GOHXfA~X$1Eg1Wj`d z$ujN#vU>T~Tk^{-`KK)w?%MYP4@*<#Ub zu~@cPBwH+wEf&QVi(!jJu*KrnV$o}{*tJ;XS}blY7PS_OS&K!i#p2as(Q2_+wOFKD zEKV&Jr51}(i$$o#;?rW$X|dR}SY%o(E-e<77K=%XMWn^z(PGhPu~@WNBw8#EEf$3q zi$RM;pvBGK;-+tLv$wd(Tio0&Zt4~{bBmj}#m(E|rfqSvwzx@K+?*|L$`&_ci<_{; z&DW|@(>>pmuOpTGHTkcgc)l(FSpI>fb*`e$%UWk6U9r}=k*-+l?4c{xI{WB~waye> zvDP_3SFCl;&=qT)DqXSGS)?o0I&Y*a);e#eE7m&ir7PAtAEGPPI=@R-taUz3SFClu zNLQ?NzD8H9b-qJataW}wSFCkbQa5I;vz4w`>*VN)wT?hntaT336>FWtbj4cdG+nXQ z5$TGxPMxk;>pVkOtaVy+#aib@x?-*Ke!60<^HI8Dt@BB`Vy*L8x?-*KmvqHi=Nojz zTIYLo#aiblbj4a{fVwejo$YkRTIUwJVy!bmSFCmJrYqJuN9c;R&SP}NT1TQQ);bzp zvDSG#U9r|N>58?^JL!tG&VQgQ);j;0u2}2*AziW7`BS=Lt@A(WinY$)(G_c*|4Ub_ zb*?0(!CGenU9r}=fv#BV4AK>AopHKit#cn;vDP_GSFCkjLszVIXjaTxhkZmf&Gr64 z8mS+1J@%aPh?WM1)*Tv-JMpaHiT{oj4}%sA>K5kInmg{}s8@H~bYrgxjSQBj&pFMWyIL$VLs|3{_a!%EM!5?QI zUK}Y0?}v%gXfU0#hPt_(&d_j|)&RqXNYjj+I9QXztRCNXb5=g`-rCzW>kt%#K=Ubp-q#!GE;Z@2{|m`M ze?BYFg%qG8J281lufr1KZ?D}Y-@9_)_fV6V>#?B1mTD~$C5JCPjhSXN+1mkewVF@7jH*kf6N9a}Q6IJ^R&e((A>1BH>MxSR{qwBg9!LRqe}dNS(QCh(9O^%01@&MGs0qeU!bGoL zyJ}dM&{Af_rmvxUb3zE`OP(&sTuS+O|iZy(2l;{aJy%D@EHT z13MaTYadPy_GDII?_M&nWAR|sD`?i@y@IeA4-8ZWT%Z(A00U$ zjE(FSdaSVBlN{rnSz$b!0^{x7ty*57Z~n$N;p55SJ(3l?`%}Q%(+#gA_E4^Ra%_#P zu+65x7Gg8YHG$46*OYm@eFlEeIitY98Z0kaSTGhR%;njGO*vO@S^3WOor2HTqAvHc)9 zw(n#3WW1dnlYwC&%`wtgtw!h8_+oM@w>oF<(QF3fQ%nI9M zSz$XD-)>vCBp$?ULexwKF^^}3t;ak`NRDkND{N1sz!o-!p}n^P99TEvo9}RPh|^g? zd@=>Ze7E6K8KTys4aMXDpUMj0Yf=CVIoYKM<-8)n&ya-_JNEGDYvZCYSL)HI&m_lu zAuG&hQeYOk8x`JdCdNnh#|!O?$??6A6~3pk#MfhQ#7C3k`*2qHirL`9XmoUBUk`kr zO^)wRvch*Z1-_6C(j9$L(RIO6Lz3R3Q+^{k=)cJdw3rR(vL?grPyI=9(Epkh=(!Z2LoBFssG-++_w8E~4}h*l)JqruSx(LDBk%JbO37U7dPiW7 zRcn=csn#r$hpY-YtGWp@C%vE;1qYMwV`q5{9$5#E;XkAO=C)`Kl*tpE?J>>r{G0#( DRkRMU literal 0 HcmV?d00001 diff --git a/it/doctrees/revocation_endpoint.doctree b/it/doctrees/revocation_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..3a818eaaea632e415224d2d4a95f9a9c141eab6c GIT binary patch literal 59676 zcmeHw3zQ^RdETyeXCJcc>2H20fUa$L`F|YiDM6W><(-b$3ly z^>lajc6HAS5yQboEhsyV=nzAKViJ=W9EeHm12zW}N5t}SB! zSe;6x?kn*qLZvPqR#Lp$$yX|6DOIfi0u_0Wlu=MTb$>d~D++Gnx}(S!w5tP|YRUSM z;?t{TVTHvxxKYRtDJ7nu9w?OsMJTTc^{TqR!e{A?y4We66!)kHlO|30wa;MZ0o+w$ z1XeEUf07wtMJh@aNiHhUvQnw5d-GCJs9)-+rU3d*rJ7PIQUw&sMO$2xeXw_5G#Ys( zRemOddKemth?PRVvojKjJen%U9`7{h+k>a}w>sEk?dfq<|D}-!2;E>!yc1N3cZ2+U z@b5nSyC45v2deh1$mIf0Wu?sO;wkai~BAW|Lm6%8cU6{jk0Kp3I+a!n`~4x|n=xUF5~Lm`sa0 z(?>j+UiW1B2&st%rXMAym6DY46L)&v<7Tzj5N(Uqv!1Lrc{>n^2hF0{80NKr20 zA9Wbgnxv6-T)nn)IhdW;FL`xh>WN0=-hI+ZPx8uM zyVFM0L3Lk+FJ}d7e29L00-PmhCq_rO@v%`Fp;SuBP%I{wgrby*7KKVoDG3-EX*W2? zT2V+>xD^3X1gVjWTp}5dYGVx=3>uxRdO(&kX^Mw}>4Ox}I9W;MapieD;4Pv1;ns6!|^>%{*u3SP>)-tn^ zVLm@qE}4a~YEk?{^}_5cyEuA{$&pQs~>GnOt$;qld9H~6~0DPJP-HFbd-9=51iUtf>%S+tt0ycU(va3qZWVwgnm z)qEwkB0=56powJMm&=<;?M6PI%_hw$P?E1!M7fMPhoGQYl`<mKmZDThogR2FO;=(nTvwxa=^ zGnm+Rz6QwGH3hlCT8stq)JUF}3d$T`#$*%2>+OSPh~3G!>i-@a0~}_^$Pu$?Ek_$8 zdNjt!sm5rQtc-1!A@4#ObUo0Nu8f%OP!l`CCHY9A2p!^pCa`?2HL#+yw5*7g4=)^QtX-~r?V0YPR z)1*hs%O+uZ9E~hj9E+m!?X^Bf*$f#w-ISk39bQf4F#eqwUEC}QZ7Zh*M=CCkoH|^K zi6ukI&&HBdhr450JhiLCoh3AwI@6S?1|2?vC3?^#uL{L>6_qUs7e@{qo<>d}h;p(K zHC>A?y>Tr9(3~C;3N=?b#$VT!K#_}YJG^9_n@j%-gd8FkcD`IbSX%?TFm6f-R zH9fAOsi>R{aV`2L+iQeg_{|weS5qFZyLluA$I4~7?UARMfQzv^?2Iw|l#7ifJ%Xj9 z1U-Vq%@gf$V-?8|tVfy>a@9u2ypWZYinc%zT$akVx0)?$+@_OZk87hse;jo^wupEv zC=vD)til*HoNY=&r3np~SdjcqZ+q3lvmmb2ToPl92OO_zZOvmL#263QV`I`nrM1Pj zD4e<}3f(0)80DHWN}DXnS#72_Dk*7sO(<_;MI>XqV$~wsHZ@nuj_D$0MzqP3{w!*L zW-&1olnL{7s|*J2Xj9zwA?2t6;?!(AD`$=QpPDPnYZ4X_4S{rt(7kR_IN5U*O^;_0 zbV_crns%vuvKk9(uor8}-i#$Rkr8dx6o1=U4DnhCG1QQ;9;+{X7z?fXV_My&qC4=5<6q_D2>qBp+pUKy0^y;t*nQ`j^7f! zAv?YP?6772(AlAa8SM0Io1KtaR&Rio)$8A~z|Ib|EK1a1r+3@z^o1omeJxv7FW2YS zvcL{K4_WU}q6RyC+h(UfEOy)*JEqn(wQ?`l-+~=_9y&YLW={V$+35>Q?;xR;veVZ> z?@$_{vqOm*vNO<>9f1vG^c`ZeBkqfa)@!k(TnwEwHwF#O+{Zb4E;EMFuX9>Dc9tfB zj&l5l99pslPv_d;DI^U|1#yplOcu;`Mm*WaKV}REPfk4@8c&v{9&F0fQ=ak^k|uKN zp%V>qWYT>?c2#1{!M0iRY-98wg7SAt6`$YShmIEi@3NVQ*WZjG8G? zqh-CJDLdX82=9i-PXj|{yD?i97;m@R{gvo9tRxRaaKBL6C}@KW*js6hD8{e^_ExobQ-q8 zMRov$%zht@hy z(&%b^d+C`CsPWrEc9&gL94Q$UJleE8&r*5vaxn}0?KL^gr}8jlhe+b9*sN@Wm_QrQ?cBQ+HLl_!0?De24< zVr-@-G062Mx;fi2H)$@RqDWD>oP`B(Uc#1RjBdc}IfnSX@pzK{3=Xni3G@oFcz2Zk zPbB-}F&wp{$8>)!jv$`!>IDu7MKf<3nXcQG%qHzJyA#DTS!#?Xz5%F!Xgog9Lx0C+ zF1WHHc98NXmkdDGx99jallcjQwiM11{M4zqIIc~l}q|pg%cD}da zh}aWE+T8HGMOQ_Z;T}N}Dl4ofMqiRC^D7mO?r<{M!f~*0=Hk6xHX3{I$cA12X`${n zL}i<~7_~ps6bQ3DkuKmE615-;jyBe9Jk=-R#1ial=*XXW!jDej#CyDO9n_+`YL;$B z_3E}TwzT_em9+tOwkcS4+K9l0jdL%R%~pZN?;Sul*A(3~lF3=k_zZnTYmA0PP%mcx zSUA8*Iu3p`s%5^2)d8y1iBZp5?bPcZ-GdFYemAP!wU7s1Rcc)fqlPaxJ=Y(H;Z{6uTX1F|6q%`Br2>ZAjh`Fv zRJVsEMK%+$fpFiqz??P|aI1_A6pKw!kUNwl2C}oxfToSn_w{BNQ`cDg_ zsfTVpV*~Ehrf^xeiW6&=)(M=eHdZk4YR5C2ItSP)wu;q%T2Rf+=$p&bfVtEZre3SI zL3iLBowX_y)8)+)9glCURr^F6P@U&?Z?;x#85?kyo5H=M3Gt;iYSjsMRd9DB0JiF^ zQu=9Csd;RxO@b*$1K_o$0GV!@T(V6w+ssap;7O}eg(-1^w{()p^&#ZLT2%#%(1}c^hb-Y>IY? zWOtUKo!@5t=HM4b(dRJmmd2dKS#Bzv6?{M|SJ__6_InoOZM9tgA{gl3)D*qMI$ds* z^)#GD!-9~;!UzVv=SOUn&$>Wk7RQ(225(J>dClfvZKl0mkxNoq;Sz&hGoX7U4t}7l zIiUGgDqXV41x3@!rt#;BX0c{Akee>2LE2MIN$Vlf=Ep|{`V!}?)cqnE_($14=mCSA5$R_QU$(j53O zNeYmS!Tr-sVK7%GE=iUYg=4E9&>SVF6q$=9e$CABJ{R|NAat**kvZP6@j&tHt;`+I zB4^w|P7rnANXsmz!5QC_Gq$#?EfsB66~S05g2t@~84d%zpqzQX&Bgn@gydeo9PNy? zh-Wcoo|k6g)ReInr8M|THRbCrrj*z&FAW#rbqM`0=B`6d&10BO8Dk5z1J0wc1Fhbs zZO1ZCOmJ|<-Zi_=6)RhHDJH`2S*%>exu|k%T`sS}zZI=|Ndm{_{FtjKUbonNY$;h8 zVV@iWNw}QzPJxHz@vSq#`+KaSwr5Kr?i_Bel z@%adPN%8}Q?OD02BLmfAm4S&|A7Y?CO}l9S%AqxR9gc^|0d*(rj}H zuHlM8o@kPYG^|yafZI>NMD+e`BZ9L~v))-{ck&tdwPmhsZMD5Td&{m}m#bJPXPE#u8CY@igrh8@y|WVE}&8cJKmK5xV+ zcqo8Um60|14p!u|D6W>R#GDT1>P0mlXl8a+Tk^^ zB$we}(a|R01DL!ox{5;16|w3nm%$m>AqR~*1u_m~f}kvX9U${IMJys{atYI~f>b0w zg(#C*IcSs%@F59)7BFk$WXBnvfV9J1^c)AFA+S?#;*R>KRg|cO8f_g$`p}rZd*j)j9FLm zg6YAQ`XcpqYv80=Ta&YUOr>lt_o>VHSxs~r#@aLJH9m}I=6Lc8zO8s>c1G*djbVm+ z@a;X&@E%pThB3}z5*u~-=RzK)9b+$#Y?zX8_4bFKvHWU3T%CP;VxQM0@M_qy-> z7OuE+Cp%pIJyqyF+}wVDe+S;Y1#i0gdo}wq)tug;zI^$a&E~a4;buj1DsZEYXn(h-UrB zrcN|fv*vAG)@nw?Sk36tG>|^N@9HX*F;}PvN$fQxv2fMZ6*;qpRbraG>CPQ7ow6ll zE{iZ<#^l&qlru_Fsg`KsBxJhusq%uLxuzc~3oAoU8(x60RuFmA_%S>8_|p%2j6+7K zVY5}0<0`i;z}E0=j8!5AS_fbvD)Ne?*aus8*Z^6~7){f*+GIYoQl1GQ9#e$iWR41f z`T246h=X)1EwhyS;LQxj4(w&T&7*FN65i^nH7mtbfYLqfD&6f~Rc8c@$(@=#v$-l?myvy<&3(Q6+zvjRIt*yA0f^_tkebf7(}JiPv&a)U-_Nzx!c}0gZpBmUIJk&YCEx;TD*w0Q%_O zYltQSq#_7>UXkrJ{UB$44#8!i$&6WO6D%GdH0t|Ms){9@N-__}gSJ$(^B)02w>uaEz)|9 zvLIr=NM$*h`vU#k*60Dg)pMT@@Yd(F3_jZ;s=80Bfx5bzV)q|J6E~(>%Nu^ZD#&9x&0xM_T!ea*H`U-K&5c3+P~gCApJ!e zWEtztSi!^UBb}0?{ReY5fgHf0Ys0cGtxuoE+MR@ffnY3P?<@Bme=`8=BJ-c?z%`PlP*e=J4&?J2$kO}2u!seuyx{#J;rOAmaTN8;HX+oJO&iAE9Ci*8D+XDX7O6j?C9$HgtXo%r3&Mf>kEjTpSiqn<+3z2GAUlakSL|3iT=#R$;9>L zcy#LO=KSc~)yYD9VerO)EG?(6U7eV?abf9Ne0}M1{>H}I_=RiA`qcQja}PC?F-iR> z4(=3jXovR6@rR9}6Gg&-*uzMW;mm7I~ zsFQ6~*~wYZ$kE8i3m1o_+1yxsdNJEGJvxEEmz9aac;Y%(TiTq=&uonsuI193*B0V^ zGh6e8sm0FA>(irSm1~6=X=XE#pUGu%(}l_0^yu)`O!qZud0}1RmuI#nai8SE|>#2P?}X=Q@e$8<`8MR4tp+OA{M2i>uw& zN8-IROP9B%7B3^=>B_aG%e~W^32D0f+UB+HE1NT;Y5ZfgRJyi&*+9`fyO{0moL-zC zjE*mlR>rnQr&5a-x5j76^3uS1_rUzrYF{C~UMi2Tj9(lOdsCV5^}dz)p3=H>L&#k! zWLAb#lWQ|Q$<38vdG-8SynkKjn;-6+pS+UFGBMdZA*|0{US6J_THIW^d^veOeSSKZUh0{y%$2VthUMAx%K6#JxsAkXcW%9N ze)U>q^XlT%QhsHnf1xjXDJ@-F=}E;?!h!`y_qpZkYoq*y;>K`qZs77nUtYd`P1xMJFhAHS4#YPuPhH)* zvA&*9%*DC!WPFkz9iN^YpG|D$QQVD{l6?KTa=z!HINrTBo|)<&P3EVBi}RZoyR+T1 zTjPC$!t{hPog7Iky%%~1&h>Y%>mA&y&HdHp{%Ujo|Dd^>W1gNC;|%)PtlEK|8gr57 z)B}0Gn61Kv0{a$irBqjsic(h0<6k9-@6gfberd#;ps|fPOoxAW=WwF~M|2!!Gvof!a$fuD>!sVNTys>eleuX&V#-~{A7ePC zm%wn~?cTJ`J&CxN9t|Ol#&Tf%)q#%{;25_x*)s{*QEPN^R3 z>SEuF@f?8u2$7*JU39Qm*68!?c+_fEqmMq{im2NgeZu`qZY#iB8&tlNxhjjA+r%Gd zWjUeV+SN5GDCx4qmLNR=|4T|xU#qdjwP1e`5dy;g04tUM=A(1204FWE_Xl`ud$5mp zbuDPiuskf5GQ217&se~ZIAUASe>FJtPX_?ugbsf&xnB`Y6syS=N+J!|o-g6~oxG}$}me!;4RKS!*90{9(7-Cnzc zrSH^tq54Y7dA6EKNVS#=##T#1yv-YCD_dIYh+JGI}Ln<&MdP`Iv*XjYTQy6j3Jk=Mg0bV8#`j{88%*9%0@#va4FyQfl2KV&eDT8s!}cCC z1|(xShLlQF7V`SHc(GDr+c+^KLdtY?>Bdvy@#Ukh5=AzIHli%KKfa&j-myNS9x+=M z@o22T9n>2SEQHN5%-!s5e_gEiR+JIjo!M(O%e*Eddu2LC^~qbw=^T({Mf)Vpjp zb&-Z0_cP*7Ti8t!j~L=OEbNAGQ`>RJp4RS=uQno_vkR8CA+@&Hr0IO8nsW$i^ z$_*g7R(jJ>ZT=bP{m|DnW!X*-aSv49kH38C ztzs?{~ zv>~jbaoRGPPT3hq>H#Aui;(v+LYzuw@aA$tMtyCS)GE~rtW<%ji2zhn{_^OoCirX0 zy@$Q!pTYL3>6O+~zd@9__0*?u(^F5;gO@{3{hqs2q^GP>ZKvAcU@G@XBo|OmX|2mY zgPYe=9{sVSE#>~2YCzLXUcK}WSUvd5p{|eqG5~g`pu_W2?t1~=(gpoHENV-AboR>p z6x;Avz<3tBVCI$>?WfVkoVKIJcE`+Ju7Rk4A^S)DBg{BZ0Bu#Pc~o^Tt(w;_?LkfCE@|&vWRn$V zqg8J;mdX__3r`9j2Jz$C+lIY^cv`cfvGOLnF?Jl#b}rd=OE*@df>fK>)?Xrvn3h&K z2j+1?olI4XMFH!E*$V%H$&(YKeQSV9q1)wr7g0$jtqqGsw=KuVpfkKoap0~K1;HUn zTJ^%ISlBU0I7mk}5)t^lI!mYXFmRxir8H0HDiNj1>})j+B*7jLCJ{JliuVPw>fv!V zQ;~T6Fe4l<$+{5_F6bm?ftdmG?1i$F=M^}{B?FzJN}@UJ~* zV}ysNoKcbXIg)w+%X^xzSe`BH_ku_z$wN!2Jce&(!+w%F5%#TQQ#uO0T=6^obFigU2fCibThP*=bMBuyv6gZ8ogIA6=ZiG&YkQn;D&(otRlnj?K@{ z&M!Rvw7FENo@h+S>hd39WzIcovt?4xZYLkj7V5`s@8|jmoHoKZ>MX34?|=taXL3J< zWP+N}_8Zn}9?luN7YEC(-hS8Q2X8gBMZ>A9>E=Ma8)nLI$dEKGWHZUsX0nKx7`C2s zt6(uFq8y5Pr)NYg8zUN(REuUuU=-RYhPqGlpj2nMg9&lBdK9jNV3=D;>W^mB!^RzE z89t*PP~fs0i&#osJr0v>oDhe%*%cW2W1|DM-utfd`Kn+YOkkbRjCwGOZ4i9hTrSt~ z1HPrm;Xt8;ABVJ@V1ry-#m`RtC(P#X>qtdTCsT0EM^BY{jz+@ji4|F{&{0#{lS{kR zBjm`USS=(ssH>>s&QTmdkVOO9Y4kEUgHGA$FPJwD zmjyZjlFVbrC11aEi`psT*tzkuLp?5RNZ<gisjIib*MWBm z_qm?9lE~Gmy&q*Q#Vdd31J}#yF)F_Tl0?vx2c9|%EOo;Pu${s0TOS5qf&;ppHC(=El$4su^`wmJS2QW|474p%oAwe)Dm_dyn zD)Z~+Pe|x-YE%%MVit0kmkMBQ`q*jpXh|qp8i4TNXh#X+j^b0pP|Z)2;I;vjQ4`lqc{fON}ldm$(v5F{GGtz-~|j_(1 zv3}`*dLP8HkThGTslxDe5)zW<)MLtKvBGa8O`95++0d6s>gr*ofDO~+jVhY80-|nX zzqOzEo=O@{GZ?k^rA4@aNuvg}<_4A-g?M`vW;M@2I%K%BfzujY4Lk<{lG8MNwDiIW z(iBQH<%%a2VEBW~c&#z+Wf}=$Q%DIJwBSt?K@@}vGQrk_%&#T|oH)rR`AmkKim+lI z*PZD=Uh^xON_$S-BNW%_Fvq8%8aq!$I`9|`jnO_TN$vCrLw6j7f@op?mK+LUphNaX zXT)*wtax3V5Z6Ufd|rHq_)+l%@w4JDiC+>wS5;3q-l2|yy`^eV@W z0E^ev!&Mrvn>W@~&AYkw_<6*Z;A>xx{ZaLVuD{@8PfY#`_MQ*b8*w^Q(X3SLJ+ zf`TXok5ljl3NBG_k%DCku23LQkfNYWflR@VQ1A=|Dh1C`@IDIOOToXP;9pblA1U~G z3jPxXpQhlqDEK@Dze~aIQ1HhT`~d~uqu@If?1o>O+z;vMC|w<*;2sL@qTmb#4^q%a zK{o~GDR_bc@@bQsqTo#wT%$muV1KPdPH1z)G&uPFF)3OZmApSy*E6BOJ^!Tl86OTk$R9;RTB zf_@6dDHx$(fr2>-o~Ga_3JMhDDA=N4oq}g6_)!Y#6#NqkK1jg}6nu<=pQGSY6nv6` z&r$GM3cgIiZ&UCR1z)4!TNL~$1%E@qUsG_9#z6ZhI7z{66r7?ULP4AYj)KQ17@}a3 zf(sNZQLsosh60`fHuPcxs~io&vJ`w9Gwa+pDY%n<-cCV^f+T{fdXOZYOyRX={8CN) zc1`@-8WZ#y6Y?4p@EQ~D8WZdq6Y3fh=o%B|8WZFi6XF^Z;2IO&8WY?a6WSUR*cubo z8WYqS6Ve(J&>9oY8WYSK6UrJB$Ql#I8WY4C6T%u3z#0?28WX%46S^7`xEd3-8WXe{ z6S5i;uo@Gt8WXG<6RH{$s2UTd8WW@%6QUXupc)gN8WWrv6Pg+mm>Lt78WWTn6OtMe zkQx(?8WW5f6N(xWh#C`y8WV&X6M`BOfEug(8mssktMnSH@EWV^8ms6UtK=H1;2Nvk zT8=9AIaaC9u?l^TRpxV5@ov(>UlYFyMfJzx_r>pNT52~ncBZAs^hMKB_s|v7QfKIj zX{kQCVp{4vT`?^+OIJ)wy@{@vmXhd-X{j~3Vp{4Qbj7sPPtq0BQXilzrlmeYS4>NN zg07gB`Zc;@TI!2*#kAD#(-qTF-=Hg|rT&Vpn3n3GX3wVCRnTIwuaF)cMn zS4>Nd(-qTF3v|V_)YEjuv{Zqvn3me2E2gEMr7NbT>U71l)CcK`X{nFV71L6mqARAQ zK1WwfOMRKHn3j5pu9%kk7F{td^*40IwA4Xr_DoBiq${SSPSF+9QgOOsTIw;nVp?jF zu9%iuqARAQGIYhX)D5~~TIwIs71L7hrYokUeu}P`miiD~F)j5U=!$8n&(IaqQol)8 zOiO*0u9%kkBf4T*>brEswA3zAGE7Syp)01PUPD(*OP!`Grlor6ifO4~x?);thOU^F zdXlb~mZHOenwDZ$OiR(yrlzH6DT!$*Hk+=hN9?0EQdjB`9F=85TpB5AcW8WW#M8zr z_B&cU41Y1oE2QMSIS^z~Z+G1^V;^*+c+kj|y>!BnKBiga3eD^8aHpj|*`;=3_Q3p- z(lqH1R($gqVPPzV$?Eh!c@1Y^dzd}>Lv|IVH`aFiiFu}mUS|8(R8Jm*{`)%@w zcvRVh6<@))?Qfr~TR9(BSB62|LZw_qX;wCeB0J^L(Oh`j+Zk|y@nmi{qWZ2Hb?CF- z-RfTI%rIu3m>Hj?X()5RY%U+<{*HRRRBjg%befquESXJGq8E``nMT{&_H3^W4(^`qg3H~FH%w?EPO{VdqJHT|fUp1P6S7Sb$Hr0l1a=!T^-U{28|H;t%=J;E)Hyf_$b8 z$Su?t?YICh?ScE_y&4?vLRfeoZUgVQzf9{!@=#(lnAALO_yaEm2VMvZcvl<1-{23N z8Z+CO^GExx;Ao!>3+*FqpdDbIU_Z2Tso-ToTuq2ORog#|XT zLtuNN34gF}3=a0Ou)ucj3|OwW71-;+!7habwr9t{wh-e=aIiPR0^7S|VEg>V_$Pvc zeRo)3`*sX$zdzWY4G#80VS(-6A+UX|+U$Q04)!x)fgNZA?4urI3w+F;!^*ntW8N+G z@&61C_p4#SJ-35!TPUf&2oCqVVZj}21May1wcDcA9y=0v40QxiLm5L2wE;E27>XNc z)oQzfgFPJ<*f+ERHb|=l*j8{ygToyT3odg77UF)VK0Zd>wrI0&4i5Iou)sdnM%@Mz z z`#0I|2gmxCVPPF<18Y~~0E!%S`-8jvXy75!aYPMe$TZppI1hb9hbHuMvp88|d_mJ6 zZZtUDN5XKjMqQ5s!t1c)Sh79+oyju_rOe^(MNx z7AtJ2;24u(VZ6`=#9k@ zY#x1PCeP8QAM(rtB{`&({GtAQaHt;*3+iMWP(3XAu(i&&7!iCvIJ*B57P?DqpzCcE zQuZNvW_8bqJgdW-kW=;Os?z%PbXy*<@ z4P~@5(*`z=+LN;KT9ky;A7OWJgt4#?&bEQjW3WmH{lQHI2R9KGxVbjK#Ty%+ZZ!-& z>JM=xIK*^V5HGg@(aTDQ*5XNn+7{yn{L#KGING;{g?7FTv>wtbB>Gz{^}IhgxPKNF zxP>;rbvH_@q{!#`;|UJ#jaq>Gh2S7R9u~;OkU*w+nZvpG!Jc@F70NFJ2l*RefxOZN zNRKWtx86eGd_6d}KMV`o)v&Nt{ME}X#{zfve-{?ErLeHIm=xX{9NXQ98p=>+IV^0e z{`J-$99vIV*sg_zt;IZPE;zR7u&`Zk1Dn?vhHP)SOi3>JS6?nT#B5j)pKJr7*V#)3 zvD~5#e>6D2w}%DrO>F@5IN1f~U{P|p&M{x>Sipd1E1X5-Qt1|z`a*Eb|2!q#=lq5Clfm)*Vp#az945XNwh_M_9N&Kp3tuuEd>D=PB>G$6`_tg~{v<4X zPq%^3!$8{ACM8ATG&KaLmi|J!?|9$=&K^V!We~uJ13FXYS1R0QRS^tbgiXhakl}C; z(I0dqIOzMr0-b6Dw8!3~_Nit%(ZLyxI{mQ@1;;vYb67RMZu&w06$`GQ9y0wvz;Oh8 z6-vc)zM3H?VOetYc0Z<2N=&M-ZwG4!k#N8rqXhVvicn2!(>9eiZtN5J#HUFb+qIk8X&u+6O;g2No}jf!fuoy`@a+^nf}yZwRo{XfxuXM3+RXeuj~(KO3y+gXP@%9>uSm}sEIU5@aieR_3E!Mo^3@Ns4>hnz-5U9xO^@@e!Ih)E=#jd8K^OR2TT3!ArI3VXL7K)Xfc3wN!IiZ8x1wwz5c1w6!5^m$u#+EcrCy*G9q4 zJveI>39M1~{*)@}f?n5c-Kbjy)3V#nhN@my+s6l*^8kH|)tt9%-3En5J#??nKG?gn zP>^1nH(!)c4~Gv+nq8|74M~#p;JjIUcu3H<9#_Lp4e(|6>JG>I<&p;o`@x!a3#iiG z2=Z^ozdP~oF8sS2RBc=^%$h=FrI)p}-P)U*+P&I{wny8m-G6)|GT7Hl$iTUN-fSx( z8+v3o^vHVcK5acvKj6w0kiCtNl{K||QP#^w{Y6QyDT^vF779iD&%dnVj8Q7xSFf^A@ps5*0A(F*}r05!y3}wZOvLQ46Q3 z7Mk^-Op@xAbC0zbQ=J%v9AAfmUE4{O=DcU=H zrZtc0t%*#pBr?5~)IL$7obce*|nXLVeNcEIYsL{?Lt&P3v%U$hW|&=!CC3l?DP@&=*%=(D0ag-Tr3(5wXRnRb=59f4HcG=dqRe+ z)zz{sFQ||rNR3gKM@u6G*VZ6oP;|1+W<#%(={^+9Gg2bwe1ioB9QUtpxt4cR*ZK#r zZ|)R$sYSwI`HJ6@DPf?y&zvsRR9is@ty~l6-DklDu`pg3jVc}I4T1pKY@jK-FAI_3 zU*Byu{K5pasQoABv1?!?QZT{Jn^M_XjIeXmuies29VYJOyf``#dbra)YmhOf|%Tce+4NM;g#U z!NjWHD?r|z3UYy4OaOBCk*cECtka5#!6wY>)q`fl@oZxCe|v}l86#x85u<7MjUh(7 z+nABvowo(DGP7ESk_##5x+j&cN}R5cKRR!#|b2mIx%qwY)P@P#;sZWUM!H~{jcyoRU_V4WUxyuc;Z{>70l1q%Es1A4U zgv*fL7h)-@!{c`aJoT%?qa_qf?M-E>Lx&%Miykx?7u9;diYk;vjH8GSFXK%hh~5+; zD5Arow*>6;sl&qs6V%+FN=+l)$c|KX*zzQbWYU+}9_X8+guG&8N#RCU=KHBx1@8{A z=G`ka6_vB&-hjSi{WZcQ{Qd}JIF-j|;yefI1<^GJW(1Vs{p^*|~iPlgCNqb}-}?K&v3%aR#-D$T8NlSfAQ-Vhbu#6g$4{PNPbVQ+Ut>6kXUXpi4pcdbGJ!RWHk@9a0$&+`j5WW^L zaX2dz{^LOz1nxpA?yyNYEkNu()sN?_^ZmO|o5r#ZC!!F@mkbrtYEL0%HCWcHPR8+Yl^@9I75;=Awmraf2`;F5RO*wGI_VjU5mdl&&Whp zGU&-pp&3bq9d)yM-qF%%VSjct960&>7yI5!WE2w=-;F9;o-1}#-XCf~{`KA7bt(+5 z2dyXgn8g3N-bhRGuy*%2Q67D6WTgcF0j! z3;9=lZlXFUv*)>+`~({4a4IK>Rat#G;GTqKWIOrE<|TR2FGZ;7@l~mLNs3$z8s5AxtJko+LSsFe$|fz9E}Z~@Ds!n2 zsYGs|u-346Q7OEM>QQAf6&b7&yCFW^%gm-iw0f6+ID{TaCG;L5bZRlqV0cMmto3c6 zYayWGcYy5Hu&6|G5*0k1TAue(d8$Tz5$m^?jj}Rd#X@#0iHB%M>o}ZmwndjzT_uuk zrR2^tlsr#)Nw1fvdZ^9pZea2KL*tV%(7UKevR@=99xhUd2EL=S(6}QY=3*K#YXLxT zJ(J4y`-p1~i7Hi_^+iPhz`E5RCf#oorINW+f_RiF#JGP`N6~-yq#sQsotHw)%#Dp6 zlE+8)%ON*6X)e{a^nzh7Vg+$k$CP7{PGH${5%-UejFjllp+o#@6um-mWPgGFA1xgi zDPpS~U8eKPBS=O@lX`(0)Vlxf5Sg*lfy|b|GP@SV6LR`kDrLt=PNz@GM`mZDLb<41 zxq@wNN^@aBFJqynN-MBITv4x}&m5g7j_xmxjTA>GrbZ4O964097GuqNW2Gizk57n) z;7mZl!(j^gc&9-4cq+mZgz(5ztQ$*x)nXIyMkb2*fAm0c6eumDcxVjxik+*+*O!&B zy7qns=#FGU*W;A};%q8JUa2vCLOwfl^7M(>qq9e*o|!#0H@lh&-9J)9C60~*{9_{{ zqhkpby0cP+ZpJPj9TLI&p!87XCSMJxSVcuAmPN2|ER_XbKt3}&J#{t!t~O1%s$MGK zuhCHOr&v`Nm8x$A&de3hJ$0`52sX?-gnwAAynOH2)Tv{I6Qu&A98)C|lTZPLk&($U z`a3iCSWL_ZusBQ!FP-yG1lXSyVz3s)5yTu%C1!P)PyuTg&=V`>}Q z$m~Ci&8~M|3Aif@?ns5NRY3)ZCsH}2t#AQ{fq<=LsiHQqyCaq83$?n)$sZDFv;&*> z_jYU%dxS_kJ#{9a%Qg&zN6=M!fqP=~B^6Uyuw^;a| zOD79nbq5%GuKVltY613CDp=laL}2sAxq-?SszC934bYuVMfWtx@9UZ8%iMidXKiI(uhMSAsPekmSNpzSX+oY1@eQyvB(3w<%4iZ5#qX#@^E%xt{o=0es0z5-SQ!N+I$!BJc$TJ1pBg0S_86A~pF-nNR z-k{=o2&MQPfPy}-8>`4)l>KaK*$+|KXV0EGcwhtzw?;-n4rc~o8LWCO8v!*Gvr-%% zIXIc9Znx-`;b#&85kDV**&`HiuNMgv=TcEnIFu3$*;DegQ9d*_5}H)t%*%?wb#Q{i&AiXCf#*2(-<*H-ZHy4y3NItSS7P{n#b1E~IF^tHWIz&xJ{ z)2r2x(Vh8?(OOmOW%F`_w#RqYYIvXxsL_49*IKKg7Yn#grNTY#3i0tiYBdV?q8jf; z0PJG4O6g}%rT(_9J_)8b3V=_i0%YBE?0jgL+2`vl9g(!`CYBO+NN#vU3Dop6fcd!4 zv)BAy0rr_xuiQEbL#C@3bT{j^c^Q8Z$uUXdHsKMvGbCN1Q$gur zXSo4_u!kds9nMDp^>DL7M7Ib+|h>ngh3v{d0Mg2uJgiVQ<9D`&}1%OeMpgyfEH zZwxcm8i{= z0E}I%q*HvJg8Zmu9<)L8yFo%ZHs~gtX1iBJV$}w;jnt>^Mc~i@IAt(<8C-I1k3yF! zy5vK5k?-h!j|dmG^x}qf>yjdd38qjLOIL7@wrgpH{vfQUwr9zvLj(uqvJXz98^`=MBF%~W=Kl4+(ewYDE)-Pr=Q}hDYbcYFA_N=rK5g~se*vG zrtk16axzf#J|e{DWpjuvL;_gGMG;oatJS4~jLd$9u% zPCyC)QYF1AA$Ap^u$peXL5@7QpjbevhbmT@VgIA#ZyuE}WrbK+iiAyx6x-0$4H6lj z5ZlHYCQS!l2&{{th7P%6nQB7BFb$3cAjrWmEwvy$QI}4gmJm4$k0=l-skE@iyTjQU5wRdIzhoN`zyK?a!sXf;kwj6dL0>w9Tz)%4 ziGC|qqV*7_AP2V`ORwT4q3oQS5+q-g;>K8;2y*&bA7%N4ABhI#>tUBH)sKD|H&CeC zjrJ+qAPYhz$MtZL^)R&C^vshp(lVl?!SfAmLRz7WSZ~yiplzQ!iTET97)b7Y=#8sQ zm`|#tKndy4Wuy;W1%O8-ge~x%qNuN)CPsvHR*ID8KI)>&3KR_V4#i%tU%^uxBbLjc z+pqjQU4kmYtC2TUU0H>)L%7-QYJcw3oG2rfETDkPuo_S#Rr0TtO_eYrBeEgX#U{T! zth>AEO<_Vj^*VK{r_Pt+Z)a$zQ7J~~=a3W!^6xxglL;hKsCNu%YpNWWKs3V)%_bv) zvFw^afg8bnOrpmi2R$q&-^EC+tLZAUPNSBroSqij-E*$la1vs#ldXXU;MxPCix+Ax z!<{~#TLv;4>{DX@iV%B506u{DI1uP@r#@NhwT8wH^@BwKHAF-^7V*^;mPGQEb+qdAi{tKuyc zrHcIdoeC^I(ppMIFT=?5G7|AoVK%9x56MnL*NkCD#S4P%+kbo&VVbEv@nHfNv_aMt zs#F@qZ{!Rx8U@9MDOyJ^P-thTB$SO+5813JI~ZYli3!qF#O+jIL%sC>UR4A=?rki1 z9esC4O$njCF?J=$>7EQC?Aa0YQnqaV(66`u9|gc~-7d+2&gJi7qIk`KyMD|T^K>y02~+`wMv7F$kb;{jM}wz976wlgA~tEj zLIbF9n~UY;j?P`Ja{7r^UP6~m9e3#U3kx_wqa)HB)Hg$G@Q|Ljo)n}Ldz3mX7etz; z0c7wXLIEM3qE5>$sBzM0sm#Nh8hoGCDl3e-vaDmpD~4>U#BCit25X8?dq<;%g~Vee z)+ydN3C+|WCpGj}J}1p%r9PAf54z&|k@N}ygUN%>xBv@9)qmp52~q@1BGAQX-lLeN zayf}nGP-K4Mi;yR8-}`ES%@HySVv^H@z_nMJw>uWkO>9o7NJQ>U8N$-`kESAi@#+< zM8i7cD6mj_RE9toJ-udv6DWei$toq*OAg~ZClm#Khm$@Wcr?38p_h_MdFm1LeXmO_ zdi4G!b}g#%-0G{+dHWB(o%kx-72?&X>|492>`&7$4UO2f5E2X_IC&(cfd%L=IG~is zhze^qw0c(+z`9`lNcI%Ba6eOb3`Q!-bp%0yupP2*Rl_gtOW^n-4bDcOX~1n(fR7oY z>@s$boesMiM^&QS}v<3wkw*>$Wb6YZA65hA$XR;R6+9 z`@jckkVc_Tz3^_C_!NzVEhX#-azBX&%|L^us$Rn?L0(dpy6M#7#U{u{X63<;lW5xtq zaf)rlC>j3XhqQP}jTC)d(XW4dB2H}NcNWg5U@ zas+b;JT6$!7vZdP&1zQZVgTUHTA-UkA!rcH^DVlVY>_a>iR!|PL|}71x0V7FwDylA z>*FY;n1AVQcK%ZK)=n>FeS9AJ_;ty}YAT-Q%2jgLqKbcQ^;PUV5BJkrwijQ8yOO*b z6@EuVg$GYMce{E5-c|Ni(kchPLC8EI8CvY&-3*^u%E7n636QX64CqO+6!U0y|kN;oMM70b^Js5EnbYqk8H9 zbolG?(2qO>D*C^03tjqE%(3`$!87k zUB7W%&y`g1vfe{RYj@f2UeEz<8iL66XeYt_H}_GX0d8eM9(j?or;oDCx@tI&w(WNv zE}o!k?Cpcc7s{4IFVdV3o^-ZjX%O{XvQV+1K2%%_dbMm_COW6!4SSa?v>*Du`Dj}e z1>GB8vPixbf6ZLSf<{^t8C+GvtNPptP_eVwU()BiQN4swon68TNpjeuBP-2cF7X%9 z-`QR|iHcm(P%g{4CGkeAs>E$na`(0@M!>d5o8-AaP2b-@-zCI3e%i0a^BJVcGXT!v z)~Eq+U(5h->gcGrx5RiheWl_&7qQ_Lk;kwY`C-8q`W$pFuC+ula4fj=dBjQGsJ8+l z7>#AM3k9_6?7obxhG=kj*3vY*1X=2h`$H$k^T(NQ5TeG~clK|HcfqeX+Ugxv*lNs2G$^||JvLuKLYcA(- zhyr{LqN>U+NwO~hLG%DzS3{o%4r$S7E{S5~?m>sqhk8(@1%HV!a`6_Wht_%s5e^pW zQXTgkqKut1(4a+ARu>QcLVrUSSX`#aUde*OzmowCeC%+%=kl)dm{66&= zntpJnZCL_&BRfVbv~mGWGjNN+%ipY%*N27^Sp7jB{SZu6d-U~iumTIeS~g&7W26A3 z$6g}}G9#Quu*22x_{et&(AGfLb4Y^~%mu@dM9Xt&H7hw6&v`k+cNHCAkrxd2V#2{6 z;{*>qP{+(^#m$!{LJe4!e*M7RzXz{C1LS2J-ion?flpY{+FOhu3@pQiAYmAXM-e@a zK66gR!y_=#u&B;+g)u5IoZ!nCPP=PN{5w#>eOO$J(HPCqU@yA6Fiu%ELAekjNKgzO zEq!74n>VxLdC)MW`Fi#JXjY%!nm>`DHAnR;zU{Fj8g{%jZ=lw!#5$y~ix>^hox5w2 zOmfFVEmOxYSSc)J7|m1r4EiIIblz-ngcK@#-#n7$H3}rMi1Nqg4lS3W)uA0dAF>Or z3n6#8v54=-LstxAXR|eohE8ilvF?GMr>5qu&Z4op%1hi~G!>vpX_+eg8UAuD^1IMW zk&_9X1P6;FZ!6fAUgKHSu%IdTnklavsRxGE&P>FYfhy_}>!=0I# zp+UlB`rwy4*+MojXH1(lFt@Es8h3$Z%>C2GHumkgYmZ`mwlY7Dt{QC{jzw$%p{@m{ zw*mKAq=e{f73zZUS$T^VRY3<(J5_2}pXq)Ak*2i>nwabfHCNod3~wQJh7bo}+H zLciy7$z4rr!`ER#tu1)c*$?}SjA?}@A;PvaR($JzJc01=AT%Nv^PYzMqNfs8RA7q3 zU93>-1n)bnJTAyM6o9!LD&{sG?#p7hA1Z=-#Tx>`SCKH#i2GFFaR{=GYbs}>8%m+g z9vF;PwCkL0*u_d~B}?9=IcJMFLxH2)bIxXqde!=()pmAZXDRvDt-=Df|G*=GZLJ%h zRH|4~?QaF*Eu3@CAojTNJh6!^20;{7T`RQ)e%#=`sf6q=;^&a}vuRfGYpZRPOY?}) zLs#*}0Tj)=+;(;@7=~RpFaZ!;JbskR}es!>&0$ntjg zj5jH6l~#1D2Zyr6QVzPj)qB7{fo`N>m^PM-FRRt|@#~!-4XcL4&jDwLdPxUe*znS{ zg0lk^b-uZX{I;zqW*v0l4s08#;mjaLJ!O^3-EKMC^m?OdBaRZb)8j56Y$9CW!M1Zp z^g@ZhQ(Mwt%~w?uG*dClcH6npXxhm++!?zP%VO!_O>psTbMsAjfAm7^VP`v)-vUYa z(tM)|JZ)!dRjDsFu^a$wSMd9K9mTr|=8|DnN);7x;V>_S&C0~`Ms!l>b%+hUQi27x zpkHch8=Y-5n!(;haSEA0rnXj^wFW{ydvXU-`2^dTSh!0W-pFUbY~7-&4^A~KwOKJr zmue(V+o6UL%n6aRvD(#pk|hKt-7?nyVkAX*!F6d-2ycpU<(6`jXb;>}oGrlPZTm#P zAP9|jX9=54f$u`w*+oZq5A0s*S5d)~VFfjQgQ=|eKOvzzs9kv*63_^+Or?Et`yOXo zLu~|(P{Ol?&dg)yDy+|H+wsGdd4+ztSI4kpLL={_WAK&cU39+n|{MPAvauKPVgygET-MWkg z(w8txzo=F54>GcWqLjCtEf)6D*rm5O(X1^Hbrb(~e{D;RF`eV64J|vjc^KXu-}Rv4K%%!KuAhJF4x|p3!Et6;0D#(%!9oQu~PZ z1?_X%m$X-#&d$g)7lFTaGl zb;RBE?*62+)6-w*AF&I15npYv+u9d8Pg8)tFEt6@f+&Eqk=k{I%EDgx3vKqxE0(i~ zZgH>d)n3!SuKl_8-?Z;*-(4DlIlQ!ql3OTw10`>!IwyD51WB|lBc-=ySaNxkz7y7PD*a18(mZA$(QB_E~aBb0oKl21_bc}jkbl2i4$(p1n!N_J6l6D7MTkti9VM5g2+N)A(UjFQJFIZw$sN-C5nl<*7` z&o7;TS-vz&$wo~6F0H5J%ar^+CDU|aijrH=$1dGW$={`)ZA!M&&#g$B&LFh|`*Oo= zui9%Z?ay1<_gmZyTHFL$EdDJP{T7RTi$%W0;@)CWZ?TxSSj1Z_-YpjG7K?R@MY_e} z++tB~u^6{lgj+1WEf(Dti*1WVw#DMwVo`0en6_9%TP&U}7R?rmWs60!#p2jvQEago zwpavPEPgE(y%vjIi$$)*;?`nOYq6NMSj1W^UM&`_7K>GjMXJT()M8O;u^6>jgjy^< zEf$>?i%p9~rp4mYVo_UMs`qmOv z`&F*;t6bezxvH;nHDBc_zRJ~mwW+<4wD#AvuR^hXL;J4wm#$X3j+6sywQY37TJ3f^ zVy(89j##Tr&=G63N9l;Q8o3Hwt@a!pu~yURh_%`>9kEt>HyyE7`)N92t@bhol?K^bDT5W*T1Z%aObi`WiE;?eZwvUcj zs~w^v)@n!Th_%{TI%2K%0v)kdtI-i_wJUVQTJ61b#9FOQN37L8N=K~KK1D~Y)jm&0 ztkqtnBi3qPrX$vBuh9`}wQtc8Yqjsu5o@(UQWLDzcF_@QwcT{YT5W`mSgSomN37M3 z(GhF4^K`^otwKkv)!t4=tkr&uj##U`pN?3o{VW}^R{KRdVy*URI%2K%>vY6g?RV*j zwc1zdh_%|E(h+O5Z_^QLwRNPFSgUQNBi3rS(GhF4J#@rcZJdr+t4+}nYqdE#Vy*Tp z9kEthp(EC6e8gJq!*q_d+90Vm)@rmU!PROsujOhrnv7$u#)I#svo&l3k_q5!Eo1D> zRt?Mo_Y7J4;y%~<37;YRl+VIutj!x$->l@5Z-|}r?;ecgI4IuA5ABTPk3pMh(b-`hIEye$k(ppOh7YD_OH-iktZg6Q9GH`<8~6My)ELxEOLbjLW79iyBV z#=HB#IMo&7Zk~;S4}{kht7do1$FgI7EHBLW^np34p$7GeuMHrg7*=9&r*CzKT*(eu z$qVxCJ|I8Ty_&HU-Bfu+Uk|)LmL2aq^1}P({PDt^f&-WVcdy@{&5rkH^1^#>A9x?{ zUcYWL_7G=m&7aN={U7E9{k}e+KinOXee-_8s0o<0EgQeRm2LdJfD z9W>p=`%kk&{*QS<-rEP{9_ouGZh+UgsMfpVT{oE7^7wvUc<=86@6qlu?QSn3$tGhG z+fOmF>kj<3?7(lqt+|+7!+ijMOLyQ5*))wFhRAq!w4-^UeV`Athf>j+>Y}@}q-V{} zWyg9vFRc6ez?$Aeg|Wim)FIQ^28LR8=xScj_N-=dJG5uMs}b-o)^$U zA3z`N4Rp7Wb=d!N*+G9OFVMw4K&LihTG56m%r>v7>8_stNp`HC$qVa9A6UEjbHx1d zXkmYMu>U4I*x$2m4>MgZ)NcVE3;LSb4k`*bPIO&8zEhYc5vC*qVXu zA;xdY4)*rEz>cpO*op39d@wuMiM+s0tQpt?-NBy84)#=DU=OSj*oj_kwwfKRo)_53 zKEOVhU|Zn(xU>&0^nK8t`uIKB;l4XBxChq|ZVx5(^V#9PoEO|feZW1Kp>}(;+JBlI z>SyzUdbkg$8EhzdvRAA9Qg*Ok%nR&W`T(1y)dFlUxc@yn+;8Ru_rX5kW~h@0XJK#?O`D|vV*PV1$L?run9daeU43PUXm7@2na=sJ$g(6zArn}_vQul(LSIi zcxDJ4qEZ5=LWl`@_a^%b*|B~!FRVxUz&hM%Kp`Gy4{-lHJGjs11#Y?za0&W|_FiCZ z)H3#0V1o)a>tb(auSt-vWQY6Zyx`9C0r!#4y7cg2dn$I6Q_LI&j=ehFrT2eiNBph4 z5FhOWal%R)wLUg_NFE>EFZb}UZP}99TpGl!xtL3j^?`9;XRTIh^cBqRRd`=^c)Rn0 z_jn)h?(c+GR(j~4w`RxoP+r((`@ojaXI84RMH|#OatiP1?p}@0WQTe_FQ~`*fSRzP z4^!((4~xLgj_&Pwp*!9Oy75jS<7&5lk9~v9!;i0^g9b_{vkWcghGNDUcTIr#1UdoQ`Z|8;W$-J=H-POxK$d2t} zd0{)B7q%XQ!he+=+beltdnzw%7rWQnf5?vQ-{*zx>AbM@7$O*Ip_EnB?IQXV m!dXI>ViiowZttDLe|GylZN(X?P*6SIt<;{QPfRrD3;!2)*5Y#j literal 0 HcmV?d00001 diff --git a/it/doctrees/soggetti_aggregatori.doctree b/it/doctrees/soggetti_aggregatori.doctree new file mode 100644 index 0000000000000000000000000000000000000000..519432f0e4283ef04cd6d95e0425094540bb5f5a GIT binary patch literal 53606 zcmeHw3y>Vgc^*LE0Nmk0JV@{famgcz!x6K)hr7dz1jr-q03IF(2nUkjb1}C&w=;{~ zo#o6f4uGgf!dO~LV@IY|D#>N3tcsmTisd-6%ZegJvJA>$RJIePq_UORX3Qv(6D5)p zIgYG{E8pMq>Y1IHogK`HRjIIuzS)_c?*6|1`|rPd{_cL)zz3iC+6wlcaiiXlmHOqZ zSSr=klB9QxbtSdfs!8=`=L4Nxf3NfQ&WJIniA%cL(uz{YSb-QtS*eyZsor@G4>wW# zrc%|jRsw5_YR&V$JYd{u-BX4xJd@34pSw^PdgEOm!M|UA<6R%^$ZMbL$b-h}bJAtX zwMXoq>rknTH4PC(Xm;cc`hsW-iOr^_EVP<{Kt*1qlynr&SX-=$x{jN;9;k~o^J-nG z)o_0-h{cPVw8-KNUanOS>J5>gu4`zLE@_vfPRm%^6wCBRM;?;5%d3pRfE zZ6N;+{M&(lcj4dNplZ#cs?|g)D`nP^hvj=)@_lk%-YJjByH2b@0=ruQ2^cplXdTf` zhF%%vURfpIFRudX2TZvFvbPelqAV3J3QAF}znD>KVp#&lY&M7g*)KgeqZW#aR;)^e zvL;FO0(+q*Y8SKmr7{t5a7igO<%5|$lMWjL>|LIZN3J(*lgd!eR*6**Hsqp##IbU9 zj2re$c8pamP3ah;@sUwtV!fo4L{qAbm7^W`d7W52g$kIpm>mkL2>I#2T42K4RSRdR z7Fu<;@b0A@dnSxNHXvT^ZAr56iAZ1~%$Kq^=z0K+~khEJo zq`6tyto?I`wU1e>Z3|@W(}ApQ3uNtW#M+Xm)s=c#K%b{WsR~LH9f;JZqHlwOJ=bbB zl}x#+WYEXe8cGK0w<*=p4P}&i=7pA|H^q$I$B9?bIY}8^t*e=mhzN*Tk~E#(s!5r; zTE{=?FqBJ*N!k|UspZST>BK%4)QK5eyO9U?N!tU-(}Kv8&^Ni{O;xLzrYvQo%VMoj zm2^g)h+e%!hE5#i{}G+8LkhJG-YQyWrUDP`+YGp9EsSVraz z0kT$?icMirf)qh&)VeTM$Y)JkgN#ADlQq_e|_+J@}{o! zk73{Ju<=rhgu(JBPERKCK!?wsDb%EX6i6;ucXD%ULQxdI~;KWg|Pv$ z*O(EYRaW%X=y1dmeFd;>ZPoLhNHmx%V7{9 zwyMqCq5^f3gC_qP#ke4ck5omark@ct3^rk2_YayO_9x@3|2sGa1dNc8BSzC^jvOOa zG{(qqcQjX4X8L6)xR5qo_k_|_^3ydhX^L1?uCh)g4xvE8=smfs7s5Rq!Pp>5k(CtW{aCJYP?adn;O1gHZ}K!Qd9Fwjj4_-a+X;u z-NOr!sctN;f|QdLn^#T&v0eUB)=~F|a(Kbdp;-lb0~3G=Ix$mK@@e=4>{gyOQ+mw2 zI0>`jm}L3lxD-8_to3=yX3N;lP=2~~cx#~o`*(Kw+?9ruSUJsmQt@%*)!}ALOc_#s z97|pu?vLg2lvIa%OK3AS63SGU4nKk^deEd^l+XR4Syp$QdMBflPHo&Uu5<`VvYjR@{yI{8(opbr)K5m&9P?1wKWx$ zvn#Gk-|=LPFbKah0vQeE@o7Jg#NdpksfjI5CjlR0H}i}!{FDnvlNG_$QIZwG<>ujJ z+_*)u1?z!OLZ09VIV+VFy=hKR#Fr(Fdn;^OW1B?=AD5%TdYtt=c8NF?mk2%uw=gyh zyF+PchR}e41wmrbd#-N2t%f)snJb7Id`b%yz zDugmhA6W{g&5_=;q8HUmlGewJNXdT1twr|P)R`&UY>AW;k&`FuS(bn1GI2026VB^y z8Eo9yP~5ypIc`eB}&fc`x@qgHHw63F-CxpE{*rDgCv*Uiu+1n>OlWFN4B-B%OCVS`|N+Wf4C{bH> z_Jy(|F+;}sLhN+JliAdIEtZszq3zCxL0dCV3f`W}iDCEaf|(A_(rjESC(7h7leKx; zpMa;7G&B{&Z~ZtdIPHvh;_V+NhKDDwo=%M?S5qGd<>|RVc}htW`SsA&E;-`0kn_~x z#;b#3&pb!TkE?+WhH?^UH4FRF(m+Va*S@;-^S&M$h|=KORw`CAC2F^<2SeEj)|^$~F)c%$A+QeX}!>7CRF$*qP|T4n0qu zoe77XheO#3(?F?>P4{KHN2iW{;WUtUeCovD+83q6vy_qs;>W0ugz^-ofl?ZU?ZaTl zJ9p}|A&#TyQ5dDc^OKSWaz|lPq3m2G%V++~>~!Yw^O<8U%zn~(67IVxIc$-0w(UW- z)F6jTxa>A_twvQ9OL}fke$QAgzb{9QW&(5ihDR8=^=gY^u?Sz`I$HojZoi74lp2T= z;6}EUz1g}fl$}y=O^-dzv@T~nPu+&MV4Ky;SYBIWJsQd;xk?vKf4-q<5_A|)4H2PZKYI?>2wST+F zZskSAlagJ*)1l>g50$5?*30nUzN8k#g(@7`;Svwg_SP|k?Fhb%4~s`+2tsnEvLsqDLYPbI(;m>660z%&9XcXOGSvnREv!;8IHys?y~w{;CZTe{xl+ELI&W zaAq!d?);-%eCfXNsnf@^Ckt6fIX;z4?t==*=JWf;>F>$kB%T-XD!;_&L(o#5=Ls!6-vs7N2*j$lH^l`1ubMs9ijaFc@^}St7#2zNn&P<(k z>1wJfwntE;<|6Bf(U+7oaj_}T9YG~uH~}8cLVhC1M`INpaoDY&F6zCusPvhOUHfyP zK$!1|atzCms0F!jOk1~mRiAG#(w zYa8t8P_S&Z5rIt`=V~e&SAq8LWk7c(6x~xKlc!DRGxQa`G1?wM6Bzwt;s7h@1ni^H z(!@Gu2dGkKrvqzs$f|#I4;*IeZq~f(B9A?*)VmmV4Zk&%g9XL`eSxIDz?tis%4ZX_iW=HKi^GcJ#K8_bR0$&_Na4CvCvDB+*HbG}Y3EEEt z&5Z4}CTp>Nm-IZgCdp!ED5puq+&SUw%n@NGi#P%dh5Xo4eU`@Ac zS~nt0pHa^ws8qA5mKyLkAItlY4!IAxdiCCQaXWJev2nY}Q{Fb(XF}0FNwRyIp*`DY z{Z_CqjBbr#uv;42B+lKY!dt=X%yMabE%WzW$bGfk=pxwYpAAK?uufN)W<8By(l9R- zF);$8_t7I<<+Co(9>s|ow!yn3<$^|Y@HR7FZ>kNYs0(8Uf<{1hC<69@a>szqTMNYo zCl?gWESt%nFPh7m(?G7foHl9Cg_1T-q@6u_WZ&f2ez$c{#@b?0kV>>U1+%#DGlzc^ z&({jp+P7U_2JV&%>wdf4_ek9?^z(5F%{huiChPYEvr5Rje{r|^Ewt;@RR}FKZ5c+E z?fBSUU!h^Cn)3;|D$r95x?A<8b_IX2lVgy?t;H)8lans)mRow*S>^^lOp;<`V{?BY z6b9Ss#3#v$t_y7T1Dd1Zl_F=dB&wNt-WT$L8wlO$Yh<2xI36e--^%>)Tyl$%h;T%sT9OAc8e^FP(;c>uj;XVr)=ZG7{KmP_yld-q+2fw z+{;b}y69$XoX^SF`7Eckurf-^Evec?>~KZ%UWz2JQ9nj2deAL)pSJZ0C??w;l?XiT+>$< zu*Vw|Ft&F?VyHp2Ub2$o6T*_k%U8ORINGXKkwTW$+K9Zx`0D>V+&TNuRSYIqU!hawzZaRfifSFFzOW6) z`*;|Ov((l{N3B-uXew-W*{!KuCFLk4=r2sju^BnMLR)Ii%tJ%5y_S@Wra)<7D>k=f z53u}PG~Z@)c&Qz9ievLRz>4R-^}YBcQUFO>1Z)Nl)oy;Y$6lQob9sfim1#rL zsK3E(oY?2Y?hr()^Hg?2k(U%~*D0a;bXC)(4CWWH|0yQO`t)*(@60G$~~?4~h8 zU4&nd)(lWr?iHkUqodw-x!T(nH?eo3^{CYrDR~m3^Q%!S|Gy&CgKlFqneRvHH+ZBT zJ>vR>s#?5Qc%h{>J+|F91gNI$l2ok<7whU$-QGjhT`V*@x|_+eRA-V|6*DuCqUIIa zFkn$B-kTuak**v z42(6VqUjhb1sc#-b|Y=qJS1@)iILm=U2iSHwlcT*_sG!s?~&!g29eGP(&~sa(=$)Z zPOo(5l!nOI&xtCI zCP6h&xt#XA$y@JkGkQOy$KMot*=HYS??kr&tLahltm#dsA!5g=!{cdo7SyTHW0Yi%*^ z;2RCv9^aze622Nh!ice&71LOyH!<(H79o}-EOsRR6dqDjzel-kuY3`I0#AjoCRvR& zcpFoT+!Q81|JlJ2PV}5wQ>XH8k(jX-H)#J$oJ&I)8|x8Dm*M7IRGOVOdrZeD;F4ao zcKkOsv1V`SkYfj@fmOmy94)XOr?4o|Nv0ZazOwK+Z~T zzQ-(Qc<yX@0ZJV%_cF_1+2&eg9f zG{KC)dr2`Tr>{yGcrLM7AiFnH%=ux=K+w?J`WCU}O)rKsWwUKfZ_)M6rs32Xj$QUi zg4We>ZOR0FSmhoKXDID1a5nultg7@}H#0A)vEM(_u7 zN4xRI7G$dg_Wp?eDZy-1^wA@`x%a7Co(w^({lO)BiIST+k~(CTYs zc{{56dG=Ox2K`a9)kW`_Fbieo-2u$>vgLjuJ};Dff4tlQUS8^#muQtbhvbmzi5RKQ zno-Sm$mD-PEp-d?NaZvldYkA-rI*}p936GW7^64?58pvOGcT1dQ|@$b&=zCRiRnu5 zH9YRsH(NIJmk>3|(CY4K?gT?$i1C&skDp^vdqUp!EbnEYHE128-R*8$5%A2>=C8*9 z>(%Bs?WppnsUz6oL7vVV{S)`nDV?GQTvl;oK{rX7UL~To;S0oJ>~gMk2IL_Y|kw_f_{o-71nZJE>l)eqP-xTam z34y9yMe!|FzCHLgSFgVigCI+<*J7~Zl^GmDRH?*x%W4N@7PV(PxZ5K$rigoBI*s9O zkGKTJbR^~HV-Vp*hl7JE?@b-u10HmK5f8@sfCp!fcO1mO+BagH2UPiZzlfK+ZQMFK z8uYC$ux0!{3U9THn}S|)+r?`!$g$eRt1%eyN)8SWs(d-dTUNXHB8%FyUF1EIV@iAU zM>30wyhnWEyy(c#w_?!b#g0RNDu0nW_Jbbm{uU66g@Yaz`b)y$OKkS!} zKH5}t)Zd03h60#lj_|0)YMN%~oLEJ+`~BuS!vTh&aicxApbKSq_S3;P+?nX~_TA>& z_QaCBb57nh#}Cs+DmuOg(dqMJn9H@c=o@kUN?k7wIt$!!H}%ZbO1$S~i#{(oE6p9Z zOXD`o)zbHLnze;bViD(YFI*|G6YAgIspQtJSW%Jjs&3p87!l5{h(={KqwyH*V%x=V zPPb>dg9dpe=7C!pxk47KgYV~z4fY*2Up{B7)5!_9Ue-It7EDazTwyGMUxcF_9UY7V z=ARI&aEx(gJD7{YhzO_ z7RXJ3p6VSoEn;k4RMlo3-W1%E6Dy64@cx&irnANXE2HdFa^kc1=e z*s;?cV`EjUms{8ni+wfg7&qW!gRu>sA*xm?lqC9ugKThYDL7a|u67FXGl&mMn3r8t zE_dWL#wOSiD!w+_w~z<~YGbKYYhdpwOXxr_G#*OR_n62wn_3o{PF11Q( z;c|^+X)_uOR+VB4FY+ul-((Vk)^-UlFQ#nXSb+C1&3OWdRm!z?V_@yX*Z@2_S^#st zLAo2QnC6MCo##5nb~?Ki`C$JQa?n8qQ-USb_UpPYo|8v zG&VJ)hN}Sx4?co5AnqtWH4MYqHx0M-Y~u>7@H$&E(lKtPn5+PZS%7;DY6y-;#yZ>= z?#oYr(oI;P<4d0IxXC*!bD~$K;p-Eo*wKheO}TSoov{OASt~fL(@|mAG7UoCdD+;k zU%?SsmkTo7s;lH$-7!|vc4-}BgI?kLJ|NiU)X z&E^J{8HITJA||6>hIFWKu!kGHr3PMx0I5aV_R!S}TS-&stp#5^c7!}K6V1lBnrS46 zO>F^6SZ`iI5oAefB9ohoh;^|b;j>${AeKt_gii{jZEUgJ`ysE@MN_4{Y^;*%mpbT8 zjCH0qK@)~FD)^|$Jg3Z0a17lR6bho%gi?jr;G4e=Z9XC&m3PZe%d_&5EX%LRFUg;l zKPG=g{+#@E`L&j@)$TZC`XE&%&*sg$TJtUJQY9`#$IZmgv!=93Zm4f%EX zujKzB|5W}_WeA=Xm9-SyLcvWG+)KgT6pT@jrQk3H4^nV~g2yO0Pr>69NE9qkpi!Vw z@JKjrQknM@W&KZlz#^g8L|#q+kyPk5ce31*a)ENx`!eJVk**!6F5hD9|Z* ziGp`g@O}z@o`R23@JkeYih_Sa!DlJ>Z3L`T@>6&!EOq6QE-5Qy%Zd!;0Oit6r7>p0tL@eP@|wi!Bq;DD0mMA z|A2xH1;0qa$0_(21;0VTKc(RF6#NScUZdbE6nuk%e^0?16ueHs_bK@A6#RsOzolT1 zY@jt1Y^Puw1;Z3%D9BSFP;iKXgA^R6;1~r@QgDuf5(Od!%=BW0RhEpf2N1N3L6T+j zv`K2HZ?xsVYRf-uGf{3cF>W&vZZq+1Gtq4`v28PvZ8LFgGf{0bF>NyuZ8Py~Gtq1_ zv1~JuY%_6eGf`|aF>EstY%}p|Gtp}^v1>DtYcp|cGf`_ZF>5msYcug`Gtp`@v1&7s zYBOv1l`qXfttW zGf`+WF=#UpXtU~Xv#M{iYHzbDZ?o!dv#M^hYHqVCZnNrbv#M>gYHhPBZL{iZv#M;f zYHYJAY_sZXSE%YifNrm zx?)=AQMzJU=QLe0t@A8hF|DJ}71KJG=!$8bm*|RVo%hof(>foeE2ecmMORGge3q`5 z)_Ik#nAZ6kT`{fm=XAxi&UfjGX`LU^71KHc)Qp+d*-BST>)b_GOzZ5XE2ec0&=u1< zN9l@boq4)qTIT{?F|AXhE2ed>(iPJ>@1ZNEbvks#w9d!rifNtSpev?zK2KLn>%2x+ zOzV7uu9((&gRYp?`957St@9JQVp?aAnlaNl+v$pFong9SS|?9eOzRw?E2edh(-qS? zPtq0BIwiVdTIU72Vp``Nbj7sJ`{;^koe$F$(>lLKS4``ChOU^_`4U|*t@8(T#k9^h z>56HcZ_^diIzON*rgc`3(qLL=BV94Ab30uzt+SJ^nAVw~E2ed(=!$8bIl5w6=NYL;1wlnXLMQz73Ee!sS84p$!?6TT|T6Ih}7WF3I zO(*uCC&fWKSN76YPx=@bX-yi5-Rw`xda}Y8V!mZq-b@3V^%$sEVVlAF!SHhJ5nA?) z`yU`9Vi8UE#7h0=I%i?P!VMj!FiagCLk=@z$NcASlQY65{R-A|)a={N$kbkW>G_my zea+uul&3)5JQks#G>bUSaoLuIIKWx@&d*v(C`7DHgCN~DG0qaU*wdo7C zdUo#UX&O1QjT}1mh`(};rBrzpf4m=WgIUQw2G26MSJp3POtUp}4_g!qZ_j%&ik`u! z94nFRnG4R*=Z*N_UhfxN<;}t!TuyZ*uPB+ z>{}9meIx>`y9x#4Ra$fs4SD-uY~kI8sC@}p|bK5?4_Hs1F(bS~TWTe9U56nD0q|IjEts z?KsUdwK30xEv>DUU3xU+cf^PMwzMD*CxCn?x|*>^h9*AU^H+BS<}=WhR9rev?tO+ z`#=J;2SU->y8!jBSvfvdDJ`tK6JQPRp?It?I2Fh=j7^a~mPNPbzaJm^JJW(LB!Ip* zw3=yaB^9U5^cW8Qa(tj4NegH;0nkT#107c54*P#6KIq>{3v@04=+H)t6}H&*tk}d~ zt%vFH@8V*b!-f)Y27R=O`d)mn-%Shb zg9*UKX|({`3+}oNv8|{9L`}ttdME+hcy-&O&E69q>|JSrJ+y3K$D;-Lq4;1Aqy_fy zvVon52Kz*Ou=8nweK-Nwc&)bQaG((%ZY?dik0gK_uhsUjkl!00?0eDzJCy)zKu=3M zvU?Apj~3%!jSuzXX+eE70n~t*8FFR8HtKX1xqUW#G}bT1$NKrSupUW(b+p@nqVrIr z!Tm{maNkG^+;jqP0s1KTr21&M|0_P+@23TKCIQ@syX(?Emc8r5^=QN!HpaG_1`#zC zyXj~G!~vc*+-d3281IjdaX2lE#}Z)N-Ce6Cb_jYjyhq~0JCqi@#}dHX)eR5lpGRYR zIzF~1)512J09!zx*?ru3G}LB%s4t`i^>_lP0Umwq4D)DozYrhY`_e*pA_2OIZXxxa zJ01=56Y*jGT3RqqCV-iXfEkVO_u?b`Qd$U4B|sRUZQ#}vjqOk4WBX=W*ya*o3#dKk zxbJ9$e-j_!57I(-Isw7}W0ep_gWJ3*wk@*}QB$#H&LjYr?{0jS*DwYh(GW-DL)@7b z#J47Z804ixbMf?{o12W^7map0KH90Y(4I|zHb7eGbp8Eie0-ly3*UtV_yQcHeQnZn26i;)uf_-cuhRl8rUN?aNbG3P---|VFVX_N zkN|YRH)Z=MYyQyeXs~}5AMB5>53IQto3+w^(Zwqn>z$n-*hX9Hm3pz-Dq)v3wM;vR q;ecrz;Eg@YZFKw|jqITAkvaU=?7X`p8bc-8!Oq(0%{&b(`+os1LcL-D literal 0 HcmV?d00001 diff --git a/it/doctrees/standards.doctree b/it/doctrees/standards.doctree new file mode 100644 index 0000000000000000000000000000000000000000..93939b31d544977c7f76e8aa601c7482663cae64 GIT binary patch literal 91653 zcmeHw37i~Pd8ch@bc|$KmTdWuWS1q3C3&ikIW@8^dpt9eMjDNTMn1uA)pXZ%SF5M1 z-N#5{FxPUlq0K@(Ksc70#2m>23kw0laMGM zYGkrm|ExFFuimTozW;Z;`+LvrdS%ZA7hXXBH7==?a$50hOvz-5dPc1*Hr8bHbZt&8 zRu>;#-2J@8hZc7=)|Qns6}?tYtBZ{bkRqMa3YoH6T)Yo2H&FVjR;a{`53H`J>8hp| zt^B#J+^XDaq|L2ubXB!#K^0y#)}7F1)v`tNHlB6qH?E z%w1ZUQ5xM!wOZC@YE{&o>bgS9R8X(R>U2S=R1k^huA(x>pVnk*CHu#Wl0IElXDLms zvAU{c>D6NHlHAtZ`o`Ln1w?K|W0gt&(RfauQ{&}Yv8a~gXY}&vc%`Ie?uY)e2Q4jib81F_sTz?8cNI7|4q1OJ|ae@_KWYtPOV_Eky> zv3X6YtX9J+*3x?MS&}xVWL3}@i^cIj`&EgL>#4L>P8ZZvwydhf6w5HDluySh z^H~C7-x)1a&FzzV2P`zYSY8p2+m`xm4yC7XtWXL7tlOprYQ^fc*tn>7V6m~HR@N39 zd%{yjAA=@n8HKBE&5!JB7cJi^38=W=4uZu=Fa3^VIlo&1L=!hk$%J# z>5E;FzL}6_*3d`X>3v@_s{N*D+o<-qqUw=56o_lBstE}8Te7>wfuL283D~AR6y$m1ADSot!h%Xph;-O=1Q6b z^IKJmXoe)MC_PY9(F#ju`>s5Q#z~bbdQq1$3KAe?MlDw;*PJR9^&3TlOcr=XjXA@Hg> ztztt*?Ye~im^7y<#i~@*r5T2pY$B$18;#bM##FQ)UbKMvMmV6*VRenmo&1` zjc=>yP^VFgBNw9O{E5}DDI(oFPaIFpsZ|B-wX!4(c24v0f!rTUI&DznG7}HET!Lov z!USxr_dClat1>oIbLScdmjIBXVkTJEi(om>$vV(EU@<#2j*(1tAu5apn=rcC!bp%W z8a!1O1f;A~JMB~{E0rNv(cv}7h6yBGPxZtrM|e#hlt)HvXwIBD6H~HKqO3k2qrs7e z&R`tF38hx3#%DEHpEwMYj(EMikm3=ALN=SShJ7ieR?X>Uj6T!~w5*hwZ33*Tkd+lh zz{ZNOVYtr}o8_sHDNHwbg2PP=49dhAtz`%%( zQErCd$hbTnc+!$E787CvPXq;S9+xSInql7uY+^r59b*dRd&Vot_ z(}5i{WZYDW-)IuBD@EA2^zgC-2{Y1gu$t1?5Z&IH_BrZi%2>=(##(K7Z6=RC@Wj~3 zg_7E_ahi5~r3oXa4d*E_i%8`OC^>C-b1ECBPHnieh9**RPo!FG_$byS0F!=NEp}?C zgikbK~aw?Mn9Dzz+@z_ZIo&xu(7$dGi>ZCnS#~p3CNuSAScwUR;ltii}12k7IJybbZj=j z5Yq}!7_VbZuWcZ12@8by1-mjP41FRDEn}0a2NW1wkPIJfd-lV%GEHA=k{Yv5;K<7L z&1FKw>=THoF>s;U3aM=vCzk|cbInau`$be8T?1NsNgd;(y)mtl*5}o78#5yrGmFhh zwnA)8plvk7%1S86l<_VmzO#|o7ZwRCyIlv9?g5eR7HJZ@mSZL%JCAiTi`H6)oyW`i zyoUKjQz)CnXj?NdvhF&gW~8%0+NpcYtR3kbu-3|&2o8z}IwWVxmKdX%KS`)_6@5-!zkpzfH3w17X3SoUMX03UOk`u)*iQ~r^oLlra8+1EBY5ouO`2+ivE*DRp3 z44OqBHPN}LZFB~rlAVD-&FYs2{4@*b(EEt(4t>-_=jOK28H@^@=0zUM>RML0UmgrV zhu%kyj=ivROPlBnL}hpIp+MOg2(UZ!jmXiVkD9Wx-xD2`b!3diW2+$^h(*?Fu}?K2 zw8dH^G%fRh>}XHA@L?Et5UEHqW5x%XqCVCfm*B=&!- z6b_u6b~-YgY)gHcCr7%A*-R_Bwy9Gkt2=Qq_$kH22vw)BTBP)d^J*-L& zlp@hA{#g^JQBRz_q$nc$Gt^>z+@wgfJ=S{xA*bbuNQ!K`GuAdbebMxRhGKmobgU23 zVGh#W(4qGc_kpNlrtFNjjZS}5==6s`r#}E4dLKDD{T4b0Jkjy8K#`42hhnXxQ_H>x z7RWh1wNeQBMc)xoipTj|+wX>4r zt*v-7X1977>uXx92~RX>7j778R`P-)KN>NlCUoshd#Irsxrur20VisGw z=k>HQQ@|c~?3RaUJ9#XAH{1qHVpoc!TS@VChLkZ=p3;gbVh`!e&Jy-5G0art-w09Xq7F1*%WQdY)X{b z<*1%1r&A(iE$fnpNmj>>%A*tGPQlD74?c)fZ%S=;R!d{kr%F4r0bX3opxsOk#FM@8 zzC=7ZFp?PFn;4E)vQ4VJDl z_l+Do9GgtVAn{l_85n{|h$Rw3ee`#H>R^+|cVW|*B5tX(B5eAfZi>TlRL2D8gfBQ} zNE@hkC$nQrqsLA(>HaeH0h-X-!1~Q>PO)jlz4eWaU)scv%=&Uw)WmUG#L=-MflkiZ z7}`R%oV9ZHllcKwf=|#sN92%rOi@I?%&}_2-}aM9mFvu(jc20-v4bq1gPOe z6ZYKD2|?>XAf3`l^tsWsmM3rGEJel)cH1-t?gHlN~)j0 zMDzDDPRP@2&U28Db$Zy0Zb_1w4Dt9BDJ!DgOjw+MxGdR;z(Ukidp0^n_DT)l7iy@dRiu0W_W*G$wIz zV-zo|>G(>f78M?* z`cF(B+dG)RrmjRnn2ctGRCH#7D~3m!czn1(p0Ad`}( z`%*%lR8r{N9+SuP^l)E7Sae_oq!pdaU^Aqj4J5JC;C#QKANSdU!!NP13m{e?~M-#!s72%O)+oV3XwgM3NnLnKiRG-DX>$ z(53RegGDbt%Hgy>psgw}*Z66ZYAskVtx%K9`#s4txGHqQLzn2}D$ebf7fR$~pp~oQ zKpdnx&-pHut3tshxhYR_k8mMA(g9bUp7dm*iPCQSrNCEbtWCEyw-B0c`}0(`N$rd$wRe&19%Iy=Xp_HrxRt3GV;ZmPV)RV(4!@pb8*-ni$yz&@pX=Dz=w3^0b2|B>H zj|$9Z&7e7|Q_AoWIIqUtMt9he#$zit<(N;}{QzUy#Xyuwomjt<>WV~)1 zzouk1YLXscjCb4&_Hsptszu+c{VMp8FFaBdSCb%$3IHfqzS9d zXnW6t5M`70R8#i@zHU}r6)Wy&eT7O38_Ik?+q`4UsG+z`Oo(c?()Q-BSnl z_9X|KDve$%pJS-#GQGt>yjHB17w{LZF5RSVHL_4jLBfP6yY}d7aUVcTnnDy~VxJYs zXb~FbBBe>9wMs>1vm&q{C8s1=lPG@b=EyH6T>TJjYf?5x9svtVCu&=BIvbz^4uHa# z1;@9ndYZW9d~suQzkC{Lp;l4Nc_dihs+y6}=?jaSdu}-~=q4=N{7Mv23rJ_9W}UNU zV&#ciKrKzoG#AX)na-U|m#iDjh{k0n)pV|iaZmwEmxfCyW2~^nGyI5Ng&|ADa3I>`6cuiSR>Cfkw^&-W7TjF&TI0>CYPPJ`N-eL* z$1J?47RVu2%S+4gmbr(_tR7t2>ILr2^2k-FYyNdq&#n32#~++we?9(~Fc~#4Parmb zDgOsZd*n#VHyAN9dS;=eQdHv=WnFY`YVrmEV5+Iyng?0dl8cCJSt;d&FE-YlGToG& zO7YeNDJ^aaDf5pLh2)HEOJj|h$MC2I2R`}F((5kam8;i2LvkA{nd9927bw%Y+&>fb zpQh)n`A_0cV-0nF3iF18F>epFl<(t|Z%_W^^rzUUXH{jqRRrFu#) z0q_BQ4qtsA`)dBb;*S%6U4fviKV{8s8?uxCjPRNKnl6;U1!k?4QjnN#df(L$-uW@j z6q!pY*SY+QSAfU1)T}~m{wpY*oJaX%3B@qK{!Y_iA#RTBy1d$oPxEZM>>|S>N9Ft!sOuIm?>G2eb17?T_B`A z8H5Md{Ppc3wcIke;gm5YKZ;|su2OgyRW_t>osd?L!%0ff)o{G^69-cgrzzjLd=ie) z1xY-F*p4J|1MnS3X1}5Z%XK?T8YqeSv~pUT!>U7%GzD3_y{u%IU>?Sg!!+9DGMZ7P zqp)dOSx3a}F$sQ_rO}vlR4-SxIY8SZ?QlveJ6cV~49Ga$O0=}Zop(qgh$QJf zJESSNqnIF1IMJ+lSe=eW!Yp$>CG1-?l4v zL8D89WAL-WFe+d)*jP>DH#nxn4I{g7hX@>&V>sKm81sTRNeCqRJnkxCpOrE4ST%+9 zDUzd2t02Bx^BeF-oS|zfFMl20TeE}aXcqb5=h@8c=*2hISfw%r#6TMUp0FWXps6_x z28dQBi_5(zIEc#$PD2l)!P$$)h!%vQ%zpOY%5SIbCbuKj)t12k^8kRIr(Pycrh6`hQq-pfjb{tU`BwQVnsjxu< zW~|7uIzXHH4 zs|h<_#aZHT4`2uq2Pe*#1Lr&2#o3>cOCJN9Nt4sFk0i;SYC zh9F={3xq%lnRdOwJ12J++Qx7f`@An^7Aeg_E7K&OB$%)Z#kf;g$(RFG?OL? zu#bKLV=o$)9o4h70)ISEUZ_+TPWMQMC|*H(fP-f}(j@CwNTtT0523< z!_^ir4#Spl__t71OA0>*_=BX-$zR;&kpD=#{Ph>0$P7zgU!U2Vh|I9iH!Z^g{}#=L z z@UDd5J>gPe55w{`mNd|?l#Ub@iZB2Nty!EY^~{`7L@#2DItes3IEmZyB;3P7m$poh zNx_vQxB~~V*xEN&s$f!w>^srfBaI!Kkdld5a;SgrP#n=b_HeDRfGHoGfHEg3&ws&| zgzQ}1uF_ux>?Pz1IXvUo`!hE>r61lKd2gZ*-?Wq-juV=dew1P1t@P7)@2T`WvzyXW zsa{HNzO$5`A}p59gkY(m^!K~)aT$~z)oW3DPPxBaIFKh5&rmkTk(IozH4$^mpBHVq*6`bTQC7!1UJi0=z4qHMO>boEDGjA$a7Zek-Vd zVY}4(!yB2}4J8thx3%<5OYPv1qgm}9V_0~r-G}hrQ|)+W7qw%hdZ?ZC&Qv=VVX^eH zAy{gt-QzBNj9%@idM#?lDfgEPr{Haa;Jw|Y!X9e(7M3(n?b4HahAw`?rjcrobP`?h zG0crn%DDE zmL&&24j~6lgtr6Xe`*(De-=ik+R1_FRU6;5R2yzmnpOMaHU2Yk+wtC0wRvVY)uvLt zRNH)KsWwGeEbT#oK_eqWwRf?)FZcL-2-Ry*ZBDtrTsQ^q8VFvuONBjDdo@cMsM;A! zz+v{BbQ+3#5*_8k%Dgh2E^DQ#bc|icf#o0^tbp=LyADquo7yd*f35KTbULRLv#NA} z-2!RqwnPM*({Jpwu-OQopTaCjI1xe;oETpVjE}X8u|E@|Q|^J}K-80O*j$TiUX5vX zbYYv7yUeigZnvM0_nyklGrK7_mFlJ3<~vKdDZ*muD?+f;Q0_-u__z%1HmcX6+?;ZM zxo`@e1i{l?D(s=$1(q~Wx#xtnGGR*u8yio>Bzuu<2Pw96mpUU&o98T`>~~G?Hb%%K zC#@r79(z=w0kW_s;yjmX$;Jmm$c7X3>wx9b5ttQ}A{`@czc7 z!XE1WS1f6ux{nCzen=~1)EUf&XZQ@et>NR=$v9H+aZ>RX6^`IbmRfFG8{8jrqO%j| zT!maAC#^U-{_sbsmP5Cql5)P}GmQ@Nrobb#F^|nN#jB7f!*$ zW!m{SxK!9fQD4WB1}bXORZ&MQ{{W<~Bd+ab2RSXZ`-c!ba#D}mvh&|r{3|*?t14v2SrtC>bDAWP}iftkaJMivAQq& z92Dx?qIaBff5C7{9-V+%;Zk7_y}N)V4b(eL(7TYsR6ef^eLN|&pDv5I=(n(`sHP$6 zc`VV=^CKZ-!ihF+KhGa(7j1ubMyTh#ebG0sy?wTxyX*x!&A{+(U!RHho_fwRyXrZL z^_-3}-r3_*L|8n1NeG@A?dywN7`YtnYp>yLOXvu5%KZhyDS5a}KA&@`u!o+jENP&g z|DK@dqu75jqZY9L>vl{%W2>fl0B4lXL|YS5f~Gr9l#%BNw#HUf>;iM?Q2#Dg&62YBgpe{P|8V7f{*T(_pTB@aXE_G@qMz8pH*L$| zvf1lP3=D6}@h!afv>ZIMo8_Qly)1|M&axa7Ve#~*A$V$7jvu-(av3ZKs@Kv(;FS9d zhEwu-AbEf3Qeh9v@p+as&~m)oo~mv--e=Bbk7Skd83pEK2ljsIvl0!j>EJ0{CN7Pi zH5RI779_qleVqA2Gmb!+`@n_(fy)q_#ZIfGs&yvHKL7W-S20V%E?*bi2X*pJ2Jbc@ zSIBuc&O3kMh|+3AKb#-z!*JdlSGepJ8(?5~Ta9tN_p};3v%A&s9?w&i9ODX#uy}eh z1WygCaomNG%VITJ$Mc+Wf5C7{UJR1g>r!D4s}W~O1Fgm#LVv?)K(N$pbug@nIO$}r zHaAl$WAiyJWn&8{48mUQZ*f=sW%|0s>jy*d+KFNuD4uB-MSnI$sK0}~k&hP!2YYS( zb=h|IS_X!<{=O6MJ@uDocGX`L>)GlX@9b6|5f)GXBm_?l{r!LoBbP&e2YXvueNMT* zU^pc&0m*x{ONBl3cabFx)ZcqgXz3iC1EJF*JDN9@VM8~L@xz@BZA~%PsUZ<=EjYyr z9w+SfdpV1+xcSn#?Kp7YwK5^+NLgIlSckh9wQu z(yV?{p3e;OD}?Jo{yu1mNOg5?HKp zxI@^x^1EMAO9ID2NT8Fqec`f#hw<`FiZB<;hw`CX@-d3fG z_n!R&p4rW+P_bTC#e8R36^gKU`X55@)aV~P$Ayv0U{z4P7OTQ3_ZJMOPwAxcQ6C5lpK%Gloe+e&XC3 z6tG#x3N84ZtXL}yz{16nu-Fj{8w#`yZqVAu{ySPbOV-{ILe`vI8~_*ppj|Hdi%Dem zV=vC_MQuOmo3{OM*)R7w28Or&_*=a9v>!aPi~V55de{%^ooPQ-~Pb_tbly*-h`MSTDUd z-&uN35f)F6hTy58_Y*FRTn4>I^;-0vQ|>PqPRZK~$-B{|!XA>hizN-z`)3RN2IssW zjW-U%!-VNRP?&UZt|d<6Mm!ujJ*rj}a=>HS08s5>16VBcH-QdnzN4keP2+pwqywJcG=xD86CNEUSaqSQW5h`^C4q)4TO)1lkquzuy8d$~> zES`TY1kasl-UKwi+%B5_?21f}hZBR5ulUh7Ej{ja@hkUh28OpDui4M@J3czOj23^~uZ8A+SFXwmC2Rj);lIpzL>;gr0aA$h+HFL^&_Ndxsb4c}03 z{FH_p>N}yc;xb?GKBAE{6u82Vtea<9iCS^#pf_o0^m!@El7m}9$bl2#TY&IB7m@I= zlpJAy7A{@4uRS$k-kHPirE%PD;p!AM1sX_qpdZ`(G8=6lZBbPyOIJYhW>pb!F`cF6 z=tJl750LkG+j-)Bi0#N(>VDMiUS#$wTJWKG7fTu_^sks!3poYO5{o_35jeAsN%wM} zNNC9pz~7o<=G?U#JAn&3(VI1Wsqh_iXv#3YJxv}MF{PfxRR!?dW_nSQ$LMZa^mW-4 zwKyAkSSgx~p6x2>cd%xbLOloI1{qeTLfs1PJ*!>rEw@5lV=GkaB~-5Z^k$G?=+jn9 zpIY+@>hxC1(be!x?I+TvHocR+b1r|2Q=8t1*p9U6Ht^&1$n00NpiQq~NdvX%*)6_K ztkEDXLr*F*a2!~LDvaP4SFbVN)YuEu=0#xcokX?+l`9TyP9Ia#=EgFib$PO@Vd=>y z0b6@|G6KGQtX;k=x1L;k%I~rvS4H_QXfPWdzs!QB{5@qs!{eLWPhL$``4N5ST>jZk zRrxkzJ5rU~!IEzvvtQAIsyxAx2C7OC1EkYA`5wAiio5qT22P|9W4LMo4tRC)(C6I~ z8;6^DxE6w|KK-;>7T4TV%e6G!MT!N&@#%@(H%X%yc4)KQ zJ2g5>bnQ*$CN^_}UTajJv*d6bWVC0J$AQ!B?c%iDa=7{wT_Nr&fLYYl5Wtm`NRT{@ zUUfBiv>)G1kt&3)^Sig&sbTyo>{bbA( z@Apy0bNN4aiuWHPwj=RA1c={;%zi}+;{9fpG*GmZk)O1080V|>b=$y=G2LWU2*5)3x7 zbA7@hFBWcK!D-0{XU}j$6ln&^GR^kCsXALq^*J!4J*Aoe$3N39$IpXOjgB0X$Mp1Y zU!u=dseXt$TS_G)7L@A8l!TN@eC;RMrc(Vc%6KmSWv5d80I?k@)e%7a56J9Sw4hYq zWk~~->eUldC&y1rjhvh~HZ?LSjZWM-F)5AQIl&^NVjw0Sfrs&2o^d}0Y!A1KZ5#6HpY%PD5LAHQ7VMq0v63z(UOaLUarsp|&!Z$#n766Jmc&;1>8LyS~lB$@J8I;VDtCt1K6}zSSrAQ~#at*G4{yiY=yap)$ z>XxWo?cWqF-ZuS4Ccy1~L%eO;_{Mu(>ek7nz^hJ;j*PjQ+m91Qe7R}`(g>#Zlk}#m z!D5?5+imgb&nf-6{IIhV@~4Px%gi!?qFYx#jGTVu3O4qGENP&PedgGtG{mO);E5rT z7?6swy}kRS9XNE2%@9%s{vB>m=H|4bhA9&!sEE|ES{3pd+ac{bcn3NixCV~<>?a{E z#*)ciDLE)724wa{S(>huN`;to45NdhQr2{&k%s$rn?nAi*1^)CZvwDzmYK1Gu44Uq zyX>$HO!MXH#5rSa_Whi5oyhd%r^Y7b>G7k-CnpY|$9ylkl@qQae&MB-h;M4mB1rrS zO4!wKOXMerWLm#4&{Jr~W?;4~z~Kc0k~wdyO=u$~4M&J*wA=X*&1QXPN+H-2oM& zNmye6K{GC>5!@1C`2c$dE7(FzTLzh%5+MUx%3_7K6VfOfn=hyyY$^-AJZVlTpH_Jt zFmzFs0?q4=;WA95pXc}4#fSUiEJe`(?ros3&G?cE_J=LyQwV|Q@NsX}) z@0WTfbsHPK-lZMOpFyPK-dNHIV>o2@+xc+FZ)~ykggthVipDrYlcee66Jw@G`KGbh z@n|qR*r?*=NXJJNjVm&Gx)Rr_ab=!H*{MoN%fxW+%pxBXIE?pA7wghi5CSwVY?HI)*U<|nLP%g09%f! zA*T+uh6%l_USO6B5Z4M!h!iRQ&| z-$xaXEIH=;V*L!!vE!phrCwM=yqiH?$Taf#@m*NgTrYxeG!{^)w=lLlebsJk=8Y*y z>qVB?-*{)R=;V#v>r@;@%UkZg3*zwqS-w0hw{)5_*V|l?(J^+-y%~&w+OC91m>Q1x z0*40w8CW)AD*`srr*()u>7ve-h|)~3RS5$|TQ?!rP>U+=51+v`(DNGf1xi*%3}wU@ z&`RSknoXz(=?nBqLswg$nJH*l2)X7|s*EC)AoHY7D4f0wpMj(x^Lhapi!d#sl=es! zO)2V7Y3MapUGdR0lA}1B0iK7_^+=CDCgFlfT#}P6tMmtbe`E0pimq~1-m?e0lSi1D zV|t5SVSDy4wWOMAWNzkpT~Q8h*dilQE8c(=VbWovOMtId&A|f(+ccjEYk*rZ4N?rV zg()vABol0)ooW3IN&)>7&_-LH*{GVvDCo+hb)0A*Q!raAvY90^Y}~$@AP^vxn$Dml zW2)OG;n)9OxoMlOPq~=C%Uzjm+Q3U&1i}8==ffL9Dwqsm%`vsGz_UB!9MevQ*dgRtNx-b?}GK-HcHqAJ9GTXI^*=oxct)L7YK3Z?ZJvx{c0)(JUS3G?2+VY-Y6>12GD-@ITtzLDLKls2 zOKC+uP%LF;_Zw4NyBw$R@(p4mpW6zBDjgzv8Rh9}1f=&Olb8O6>AMS9guT* zES5$3EqWbs7Qs)nP4E>U_-o+_{xYW`Xhr9fr-UkFU1b7e$*j3{>1*F&Fh5JwB9dmA z^*nXC*q=bW#7~v|thEf`6D;=4{3A^9 zp+(|nBwu4rLX7XU81z+}od%r)>2JTB2K`D1?N1r}p$vLRd(oX3j3)-jpmU$VWYC2u z%f9VI{o6C>SE0TVQQfo)%A*0|_4Nm2=>~oKNri6hP^1w)|Avurt;*)x=94jgiwY13 zNM(UC+BPU#0m^ORLAiw`4eYr-cB+*uqceWKn}90EH)YIkR<+c849NP}_Gf@b!?que zjts%l-%kZ}HKP2upG=#*<|xZUD{%LcS^*!ni01uXCU1gyfBF*5yHC0Mo9y;MBdu(S zj@gs$*oq%EK55RjL))Pi)FMV=(~E?b&`Ia$`I|7OP2UD{a2LZoluZw54yZ>C8}6{_ zLX>5`UW$_2v+3JW-+H_C^#^3>HhtHaij|W&?5^Vrh)uH+2WWAWZIdwPbi!w_pn6x^ zP+beC9t#iE+gZ{;OaF^gY`qjKO6CNxvF_2b+<`WZQ_h!bXkw;$zNYQb0kmdmlOSw) zhpma}Y>eDI7MQhol}g4EK8?no0WPD_c=nTvh|th{hAP$7c(N-Lrg3`c$plSaM0=($ zsXc37ki=&0Q%u=}X0Ckx<+`c$JIg3iWmB(Z=(VgBWQShMv?E!Oxt1`!W?Ixb0oB%^ z=arvUFJS+f+j1KZ@ydiUGD2l|%i1)_)$ZU)lHG<+Um=bOO)cl3f6L-*Y9-j?k2Ai9 zYHCB;c`-{G*u?(vDNZDts>gb3n*6Iv*4_kLDQNdn z7G4x-w*~FVutt>Fp}@CEBj3{6OPVmVhEi%u;rBsSai}Zh*E;rqQloV|5+N}{Qx~HW zx*Cyw-H(mtpeoV=(F)zSq*f@1Jz|@)he@B%=A2q?*=TBEj<6LdnTa)yjxn*83o0II z%Z=UeK&)j$tmTX*jK&197G}!$XQfEA#m(~XC)@q~r-DJ?w(%afo zV@G8`?RwVZ&j=;H9=?hv6WXTF(95od`65KKlK)G}axUNFJniu*#I}FhgLO2K)302i zSMpJoG_Y6liZSeD?h`$VCF!_gZ!$s0wRCKJX4|68;RAI@)HygOHTGH4l=mn$i7Ha& z27aQ0Hc{i$20AU|CrY8?jLCtK#PHt4u*aFLzC^FomyqFgi@YRQ2N-_`Yi4QP_W*7< zMiQ3|%ljuGzG_%ru14NpH7&1r+WgHfpZB-C$iU4^%K`Ik?v^*L zsj_2JgP2aRjz~w=(OLp)wZ05$7&e>4#xrf5$vb+=h@Wb#H)E(PwK&yS zQ=x6n#cXAv%CKeET$hb{juye}c#H__Jv9wAQ zE!GYbykL_^KH%-DYabI%c&fE9u?Fw0H$iDtBZ|G^jg*Z z3)`FCG<_mJdiezxG&b<>x|HvH(UiHdk?LOoNIAe$06mM1i{YazTT`+s(9YoZMH;HN z8QpDMwUf%=$XgNT>7XNo@+xcun$-xOwb%`YExxnbSzOlA*nn}Kp0cCx5lGX;nc7?_ zWl0=BWf8PA4KHf&KQYy~gvGD}c*J@;s#H;H89jA&j$~=0dKP=rRJJw4%*iAKThZv$ z5|_p6o_1)P8n5MQQxkGGHr9if3S^&8tV3dqWPG>VA~r{Dp?z;C1m^_lEFic` zU(0~q>&nU*>nFtXQc@>KO)(20END33vv_pl4UG*YwUiQkTtNRQW(L<9rAR9pSDJ%2 zL|0;^g=$VO#&GZ=zSy{&QnCslWeSI?z@94Du?F$-^@)DqxuHCpZu&gM*q?u@`FUum zLgIQ_Eyr-MVV0EveUIm=a|IN(7RyY~piDKlcw|juJ7jV$WvQk`0QUHiggo5XSXsb! z?X#(zmd)WnM-BqAvY?aLudm>IWHt3b4LV%`P@CCr{xen3)3Ayaf_6LnhS7};YMJXA zP-YO)>B?FOMQlLrs#+EJa~tq5q(@KFxh~r%Y$7uOhcHd)v^f&qg065)T*=H4WQH7_ zLVXudg`BEZQOMwk*#rZ|JGHI;g zrUd#6QPheVcK9<@RdCiErU}$tib_GWsxYVc2DVjJ7HPxXGjg}*O1V_-k=(O$kL6yI zdp!64+!MJk=Kd-7jap-qBMr?=a4EfAG(HaeZF1dfI5q-0E1=i?VCQUQ8pe+Ac zjFS{7JM9~#c#7-pqPTT@)-(n)p;GK5i`{I*Vu-H6)Nx(I+n2Go8;!Tn)3lCrehZZG zOYGG)P0lb;m0i5lQ!?@}uQawcB?I5E`>?to&!kI~iX3Mv0p5U-jJyVe1hr^+Wu?sI zVpVCZRLT7%ev;oyrLkVC=;RiUoMW(P@*7CeX+@VIqU0@&Qj_O1rLh{R$@vk*kfSH1 zu_BHA^Y}%+NR-B=OhL8}CQ@%eqnG5iL1}b>hYAT)o=$%&ja8XB8H}X}8X+h(w%bz6 zkaRUx6UX@Tu6!LI&%Y2s?$^0r=2zp8SAHc0mr-yj1=mq<4Fxd@ZlvHQ3ieWPh=Oqn z?x5fV1v3<+D9|Y=Q1C1Y7ASa_f)`QnDheK@;H?zAiGue~@JAH`yX$mS7lqh&E1rJg12n8>p;I$OInu0&1;B6GVpMv*N@JR|jM!^>-_zMc2px|p1 ze4m29r{I?q{G5V|Ff_~mmYy!5r}Y$Uqu?qEc2n?F3I-|YqhOSR+bB3r!BGnCqu^c& z@)Tq#I72~|f)`NmJPKYx!OJLk0|l?6;9V3vM!|Ou*29_E#4%EP%|*O`*knS#`ra@3h()R|J$nL^Z=GSrzO)R_|0 znF7?A@Yk8(*O}1QnZVbXu-BQO*O`#lnSj@saMzh&*O^e)nLyW>FxQzN*O?I4nE=$)S1xK znZVSUu+*8L)R~afnSj)paMYP#)R|C#UdY13Oc)+!g77dCf;tm`I%9sFF&>-(zw37W0dJ)zW&tPZiCMsV z=!sdtS$bj?kPgFh3;0}mVixcbdSVvvwe-X+;2+Wxvw-iXCuRXZNl(lIeu18t1$=^@ zm<9YkJuwUTOL}4!@FFrK%mQ9QPs{>tqbFtocheKIfP?hJEZ`_TF$;K{o|px^kDizX z%+nLIfM@85S-=<26SIJ?peJSl-#|~y0=|o$m<9Y0JuwUTX?kK7@UQ8KS-@}76SIIn zq9^*t znZJ#Kw^HzS3h4H(d^ZKmrqhHrx9K#I&TaY|$*?n9wD-%5s^YOLTD>e$H4I935I7L*r629q+1(F*KNBu^8aY&FBSd48$TYYl^f|uXTKJ ztywC|w8`;(OfQtHG@o&K^S6vQ7c{!rv8o!4i5DB|;BJu|*`QyD8JgAP?S|qXMbq`d z#S<6-;@CXKl18_l7ibNh#pqo)ySbsVK+ZYLXnRtpi=U)(cn086*h&115kNN0{OxPA z3;U#aPM=fbISzhNI~U^D1J^bN&q&8ET$$ zYyPjO9rxLi-RLsrcrI+Lq=p`Y(}}4A$7r%em>$c2k$oorCH!eR%qn_FuyELS2%mxr zqT*@zLZFcz+zc55qn+gvKsD|mm9z@^AhBInW@5(7KBi`W5}wK*wo7IH2gqU5cq@kF zG{<-3dYZ&-li1sQh!u9Y(K+qv!VX`O*K7&R*e)b(i?LoLKeYprZ)_#Gkd+n1pSm64 zsk=5R>Tc+Ox{+4ugz@@L%$sU+nB6H;-&igC(|mJynunvJd3Ogiy9qHnw#w!xc4Agf z!mV=tbL$ zd2L3pKYw2mp57NnMQ=|B^d9o(FIQuO;*i?>w(z9CIV#fS4oKhcPdaCHrG$=>>d)(s zg(vtUQ4t*LfZ!nWg?$y&Gt98L41bcp7M|oUM@4eH1Cj&OnbxB~FWpn-Pw&se)BDq? z=uLD$?*V_APQwuw)>&Z0sH0`v3F_O~T7O08&emEajij@c?11o_{0V0y(?Y2~o1Yq< z+MQ8R+uH%P-d0;&7C|SB*d1;laa(xOZ;6WZ{tigL-ILMQn$J!>?C9y<@I>Dg714to z5IyWgwB2cn{Nr~_L4hQ;P0YBJXAPwdOW6Z_Jrh~2wP#P-FK{=_~O zp4hiXMeOkM5G(fw5&Nm|#C|*~V)rc@u>oTI_3*_0ZB)eGv~0u<_>1wc!V~+8sEECJ z*@zwVCwAkNq5D-ABWWc4s#}(c*nuFO-4mYJ8=@k1e+R_g?9$AdGqOh0BM-oFLx4RV z3s3GyROH^ejN}Fwsr$o|`}C;Dy{!Xs_lDqZfYzQ3PiieHQb#%hA)_yBIv40m8 zvE$1|Y`;IT|0g`L|2ryT4|G6mIIRsF4qSFs=zi3tNE%5$>R<=thSS=B9&#)^u{TCV z?4b^bb!lmtgQ414b|zM(W#oYMqC??H9gm9Ci4I70nVBK#RO9e3C??ANRdyykt*NMJ zJ=_7Uds;hCH+BRYV9T^I8>WI(qoVX)<4@d` zSBLHcU5=!Y^nvc`fVe~}axLMO)RMZ_f=++e1;&c7If~1vK-o4Nu#v zqoOSp6>X>e`S$+sw7oYf+D=79Tfji-3*l+|i>PQ*I-t$1aiCora;Bu0{Mq;Y@Ff0y zR3y%HKw`|L{bMAS19*7R*3b?7Z=)hG-2s7eD}gvZJ~WWr>(9V#;pw{yNh9gNs8P}v zuxv0Gp1!`Q=$nm(J{(3@&&mmZ{v8ib-_fPfmw!3VE}7>LE{l@HfHl2*coMS_lDH*G z5(Cx*UJ#zd=S4{3l~IxyuoCcw@Fc!2LK3fzlEi@d{||*H@dFW(xGhQ&1E#_MIy{MA zjF7}@q9ie(#rRQp5`PdOiBgm#1`KjnZ42G0S%IWWX!IS8#*QdS4CvQL;Yr*cA&F0k zlEh*Erhi{}5{Durv6J(7F5Pe5yGaIgZ%&4%@o5p#$gW&%a}~pz#(@4!F+7c@Bc!pD zBWd0=26S-h;c0wfgfw3otO|ij$e2F<#M@S?6ZCU zuez!qGdsP&f-vdS^~^`?OlkHsSdfu`ZG|DS|Y^k)PbaTD*iqcSNXQ{um>*#8{V6YzZ0{5~xdr1?o zp(F#LBr8g{lvV)st)5%~*?oj8U()kuRU>azo=}Vht*8TICX>bg?3a_Bv~qdF&X@IE z(bn}!jwM*o?6Vo?T#<-4aNa1?N(YqPV?GyQLL*e4BK2EO~Yuc{dNaF&~%nmD8$o}3^HrB-zgWV2RPuNZ|)MXzO@st(J@ zyP-nXDtf-A&g+mONR3rdhjT+2&(RDyp*g zu@D*l^Bs28&rDE?r7yZiE`pIr#soV**p{7Qgq_2F>EPXMf9e< zFNPT5(HJ8;TB8NBGTALd@tG8KZEs6gp_#53-8Qtc@fd4FoLLDse2!sJ*6|du4kG;uV~_ETbLvBe9h)x3K7Jk zcmzeG1ni9W#!fh6f|{Gg(Qr}@yKe56Hs(_Z?!LyHz8v?+w#+@!|QVqd62z^|xiJMTZ~45ItzJ&gzw36;8MJtns))Q&B!!;s*5H+gl}!!|(S%2HNuYP&1Fj;G}I^JzJjs3z`_aD$E$ePhSbq z#3KYcO6L&*Ztm=jn;=UO8Y)E_Ckf{T}|`A&g>dKVeGfdW0}-iE%vG= zhOYMK358}JQ==`HA44?rs`s8SOH;B&PbUk+d#&JUUk^N`q@gJz&Bl<=f?v;wr?5HX z$B6J0)zhi*6lm)GZFzbmR-RJQM9q3=ON$(ZwUGbR=O(Iyqz9rq$xonx4z%SY)`(X3 zrlo=KqNe)Qs-O2JXdrq=xNfClMAJ(}&AP2EJMkI_X;b8+ZH}(#q-FF%YOTE;S;R$PEWoZH1*^nv zh)?e^V^bqq`Qw*|&_itr-A;s#7n>OjuW)RteJkl%2&niSAiE|kDv>vd0-k7_pSMtc z%2uU_<=p42yf#DQW@$ma)E^ zbYClSrLtTJ;*qNm<9?);tiSxEA8t!JTNyEVVq|!~Iy$^t4GnXX=F)49k+JL|78I8a z%s^)823A355r1@OC`W(x?`OY;(JEwzc4z4S;oP2~EOy?}W4eEC2*J>BTq|(7Uh%&j zBD3jsAhWr!%q~avgq$8}OWD07rxVB3LsOGcp)6{TJ%(LwT77=r$Yb57P7AU@T-GR{ z%^V)f4)4y63}uJM#)tOr8`__BicQsebzwopmY)z0!JUADgJBAK_@+R3Pg{h?2;rge zre>_|r;2sJ8yd^v|KUB^VW4!Z?EVqp%eF2iUy;|s>YD!y&>fOOm+(meajGpuws2$O zm^w3g{N%Bz!&8UGADWszG1X0h?jFjb5Qj$r{>aeK@JLL7ZYh+Zo3ZJ~fJCruQAVh6 zaktQ);g|%W@cqN^GBf$Q! z5QF8&jv(e}TVl>r4IoQSW!sbvO`mG2>&w*MH!-!5*~o1CuxYZr^+~{8UT{Y$e7Q0z zI6T&tL)sY^a2N>Ka^@;(6MGv}iM~*+i`;yfNTUteY`bsEjaZpp?9JPKjwKLgZzgs61+6;b*p+5%xqQH&$l zl|(ftfaBS^t(*J|Y+%B28`=TrZ}_84IYT3HxYl{mn@W~$W_WQ27!#KPCVg6foo)-3 zZ9XEfY2#c;c?%Vw_`MA1PPRq&N|MQGZ!H?yie!vpfzT*={}?#H#yS;lHR`s8^(eHw zMxC07E!93={%9UTnEBm|cQ-&TJ*t$P4N=1PwdG)raX>SW)E4+-U1OQO@^px0O=6>& zx9w`Crp*~;+I$#QURU{Q-yc^RQ}>2=2_l5Eg9rgd(gRCLSrY`EYD>^QB4~1W4 zc3#r+@Kln)$WYeS^VwPT)Z`&`GJ`lO427ZLVRZ_MVZt~VUZe@O^L^ZfwK zPN9I4J|s}gwnahSQF1V3r_~87zkg&XG^xN|p4Ti^7S;M(nJ;;FvWUvu_c$=vhemSM z5gLVX(8Y@xv0IN+mWo~e6g7e_dOtwttKMESAW+}m7WFAYeeZ)Itwj5)u?#zZR=0y@ z6S>aPhVgLYXwAfa*_1U))Cp%m>@T!MAs!_OS_2y;-z|KaClzs+9>hI#}kzo3w z0Qkzb0GV#O_rXv%v&YXl1{`bE>R4IaBDvunB~a7P0OmbH&tCL*1=xq$g7sEm(>4-y z;-q!5heGwLYN3kd=fguyNc)0^p>mDh4RHHo2-3KN*VDHJ+K1bseUM~#nxQ?_W%-(L z6XWnc44kJipK*cLif93^_3~whOF4WmfZSEh?VJUH{#9+!8?4b)Cs<3PdNg27H3mjt z^xl0aRQRk36umgjhF83EdN!^%ht+0Y@|smO@{T&ZKduLKouR@lRL}?XQ_bb8A-SMv zUfw+ZnxX})`4!}%^C?Jsq%CP9MB1sthxU#Q?+a=Neb}DQt9pTaRWOSSKePBp@tSJE z8gV;V%MiL1z`8}$`-HcPOg}1<>Ci&4j<0QA3C436Uj7xj)orGOMP0eJnI;cnWZ8}k z?`g_3ELCqj!Ld|&icWXEQnMHF7mgj{ByJ6oP|T2Yg>D78hn?m5^I?)C@fpGWnYJ*P z=aVK$HXKJ~qaV;5)u&BUoK zV+pwwe9blSwa#4wmB{Qv;lQ-Cs1y*V{ekbx(oT0aTY}59tX;>JDm#1Lvd_Xb z7LAY@y2{1}(64dgZn68Ae!`**%56^Ld1XFD;j?Nbc9)y@j&N1QA)8j{p1X!)^>pv% z;J1(JjfgIZ>UBOU^R;xj>*yNnyjkb2BXF3of*X~-frpo8U z=C94}wsySuCF!BneP3!~iC|bhf1EzCQxxAid`%Q8E6G(D$%<4KPpH7)>RQpZ>eUc^ zK^21o;4-;;YkAli4lk9yFb!ykzC$M7dA)@|Qp{x`%udVkA1Sk0fa z3X3h7BBijxw!*G+11PI7*lD+>G2a%-k$e5X0E}fCYIy!#O2JSLGrwodW#RxlwtCKu zS7ReNmUx6dZ+;0cVNW-^*R*>|6W-{DWRT%yGM=ld%=*=R9%VN;H}0w1$V5e*hL0%Jvprpz0KI%d`t4DTR{0?h$s zkhhG=IjdZQpG3WkNFhQY^%e3osTgHtzFr}c;kK#*uZnmbd@Nc8c!NSY^r0NYPH@k8 zrLNfIV%T!>hL->iF4*_=A z8%|xL4czla5z{rSD)@r_l6}vY&?6Fs5@i|=Zq12qnO<%Q-8?WbMXO^M(6iNS!-^GA z1G(lRx*-xfkkPXebZ{9hN^lTmZY!88NTlL2stFTg#TB_=Xeng*^3(5 zK3(ab8Q(RiV7)L+eL)m=!uK$Y7RQQJ;wSHa{wYt)kraws=yImKm8x!&%u)?7lzOGl zsnZpj40s&|?@GTWKD;ZVoUG5W=?{|rDpt6_L0^-=E2u`u4hoF?7soUy$bdGF?ez=Z ziXQrEOJh;?nCxiNNODJk+@um}>EvG9kx|HlR8qFr4Ub@KcC8qiqF!LP4_ z-Xc-yqBZF%)TAHkwk9pN4(b~iIBdaxw-&2>ei7N_%4f9~Ezml@BtZbzI{!%mb(AZ( ziZ*{vA{Eyl`Okz}}(^okP#wvkIZw@qtjMXb|I%!daL?1A2q(5RCgz9b=XuDvdvsLw1N$hb?Mg zYzO%;c=b7slZQNTY}_(P;M175Y)mz$lo5i+4UaLF1hdE)(a0EFNL9Sh~brWx(FP5E`=L!+*l(T=R&cy9R}1!|6Ob z7;LqJ#uuZ9?gmT@-liZ>s6=rl7kjOWY4Fu2usDTAqo(mm2q}Fz?7XSzd*-8f?oSVf z#xZedgGg*X9U3NZ*ZN}^C4o++vd}2Q76A&V|b16OVJbP&J9CU zV_pw=nusaTa7hyX5slgT0~bFow$*QWX0RR(+O<-PZFSy@jPq9K3f}7Y34&Vw^YWto zZV4u${NVr<^BIX$oWG}8)WjC&Y+Q@uD_uSe>@_-=PpSul&q9l1>wQ4a98b<9x?O9xV6>bbdAEuVe z%YC>3qM;H4=QUy2TY3I{)GXm#CpI9%TFa`15f!ZRM4J+7_rMND4Qb6N`aD|rLFn6_ z9Y{^iZ?-f!-xH(*h)PiOyHFokxl^W#+4puw63-CpgW`7=5l&GxnEw-nJR@ z5~tgYeE}booI84f9`oXjrHd5~HrYVO!Sui0D>ZFT*@PXDM2NS_+!D6#ecD4Iz<{Pu&$LdukBG+%P+U z1&MsaJ{V|bords8b*R^(^q)E@x-=GA9Sm}xLq};)i5-gPBjObCq==~3@)-=4AHxh0 z8#QEeM_T^Xb;DtEv6xTAiK^&4u`zcsEnA>1K4=T^6djQ~8_q|6%Bsv+XeMcJZDR6) zNi5LFm+RD-@eU3YL;f`N#0?Pi(1N~l(6X!#vmS`hUM51zqp#uYu32Bx=Q`=@qj=s{ zUwetu)z=R({81&`tQB~-;{lfUXw;WTUvt_vpT3`Z9c+5z`}HKoyenbL!lrNmoX1-M- z73b?MENW8A;(l~OtXN|T7YlLo(8w^&cN%nZDD_#wgJ+t88?3Epn$W-u2hB$8h6aZ= zjwHn(6f|-X3mBQM#Uu&ZoB~c_EqJT#1dnVW4y_WkGkmIJPIK7!m{9k4HMBkEP;n|J z+rs$#yZq7Me+NkX+VlYlL5fNTj-)f+->q~kcWt^ds7(rW^zw_bmFg47H?LHi0%2hB zgSz!e2}*dA^QRI#MA^eJb>_zqIsj4mz*&9fSGtvt<*r>@*s@MO z0bGJ&jICUo*7}ueBWY+_2D+$F^q_8SMw}!W0 zxNU2T)Ut5drU?>=wwQ>agTp;n08~Zj+;2X8BHAD^3MXbAoPEWXs`jzK~tD#xKXtk(1yn{Y(ph94k3-(eJ4fxLUmn}zIJ--^f9G~{3dO@P7 zqWsg23A0=Nms_egiP5h^CC!MR)BiE#nM?8Io@Qfl1F3zR1QlFre?$U*lr@})Xuee< zmFT6gs7X?Lx(^+Atd7FjLKyGiN*~Ty_^du#FzL{VzHF{KS*{_nyb`blvNV9yp}u2Y zqpaj%i|KTvISg6+p@B8bW}rC`rV_^HDsaGuRh8j!H$J|EJ`bDipxIN(z5|zZEVD4g zU~yp>jtn>!B~)Z+vCtFaE5E3cSvGc}YobDZpB2mvg;??H`UfNgJSw#~f6{z^w^F;@ zbsZz!)BZSSY=iX)WSLj>z94E)(?2Oegy=I#ppSBfBPz|0OQaHgCKffRrn{#j)jYaG z1{H_aKUV72xnLY3JRse=bej2{))hF;6r1Fh?*qR4eO-d~D3>_r()>!dTrRi#ZELci z;2ffDCu5y2h*w55sh1{@$jyi-+tWbQ?s^(H+tTclNF{n2ENY@e{@!H8LjiRR9dFcV zyC*Ho3bz?>J~^n=9kw6}ooZ}&!OA2IV$r59wl5Ob)Fr|2mbWm1_eP-qX*3N@42^5q zR*@#WNyy9CX~UX|S{-vWv~G+?#fq;vi>5a4BD@~!d)XiWl3|rGy`FXugeT%fbK!pP z1MzE^Dj`PE8iw;f&4F%Zql+5WIqIjd<_j6{wu`op>aL`nsY^#Mqoq3^@zOktKh4#^ z-6Xc7I%*N4wR8k_X!4s<|CX0p?3OL(J8TL%5fKl)Smw}WF3MJ%McMT1VAb3bbJ8J18l;C*KuR-6SrCCoX5{5Ay>c$_6{;lXvZ}ZT3qL z-0)$&F##6kf_o!)9im2aF^XKg4SDm0cXq1cP33ARL9ZLY1~<8i#uk34O@pai;fEl+ zo4?6uz=nUP#<%Q4=$Gf^J`+DK!9-Mf;SfJlkOC%tJH&*y0@eJTmRtSZ?@ABvY=1X0 zd9gd&`8z%xleb>B-L8eQf`8;#OZcNCGPIF>v%8Wa1s2Ei5^QrD_;(rR=u~yHUX2zE zPNgzGB9V$)9M7_-i5ACe#5P-hodopPl;_tJJ;@29hz*Re2q-kLQhSiC<3I;hjPKGu zq{yOj>Z_uYNyl6${o_S+Ju#?5qyOcdQ|u-FOM|UJFLN&Z>hgJs0*salPQx-k*KMf; zTC;i8IB6z6v;3Q00rn!j*bawY2*#vi<@eG)Uw&76(EN%)V!%mTS}cu3E)^{ceaZ-yD*{Zl6&n(=GW_u25+@N4vq z5&|8SQk+p{UXN7GhH$fXj!5Zp*J!jy)D4WS&*MRTUP+OH+I&a?Ja3Qglt3Ki=`Qee zyF@C^(|#5;u|3)pUF+eS$}RW(63$70jOHBYhncVHHs{M-!dMMNg{K~#jJG=8fDCi1 zW37l7l=Pb&pb>u4Qwd4i_Je!jc}IV>Pa7+ zt_ob5sq_AX8~I#kyMPX!$$9e9A6IGQ?Xm>XIWvDKI8Xx4qjXlc(jO3aqgAOja#^^u+`09KI%PIg2xKR zw(wZE0ux)p%-^6~qEG*6^Q&m>k6sF5dB!)pmu7-$KsTLGr!>yIipn+)Yct=;IOuGP zM`U}sb-`+khK|ST`WKK@t_3bTJRSglkpb@vf!F`Pl|UQi2nWcSpOr|(Ir_F;R$LfYN$gCKbph$ssn3Dj{wZo$lh@(8=pf&ShiB!DwPqV0rrLT4zIT%z9 zk7sAcsaHlLFupW&naY=r*Gdo+MUAu9%*VS$z1-4)SzPo^d5<(!M&5-ia~bIiq6U)k z9tk42q&y>mKFS$RYBQgfNW~@PCt1`)N$HR8kcULX8|3hXL_UEpAJ0k962*$c*US%h zi*>o>19rvq$ym8~0a+Dx#q`NQ9$u6HF6;^kv{8<5xSIJ{iB!U_U{Mq0;U?aL#NLgAyb}OCP7HnYVR|>?J7unRvVL46-Wf z|4hhkoRa`9EC&g+QI2pXoB6OrDq%UWsEMUt=i5LrMIjs`+D67(m5a#=);e-umE>>$ zes(Q5X2b|C8=u8AZD=|V`yOa&uXU{t439dJV1=IX{IklblYZm!GJV~b)YnQBShN&y zDxCRvx25nBNa}dJq`nJT6_Pq0lGOJ|02h{v1llM^I2g`+S|XLOTv*gZNxe75yWXI3 zgyx4Kh6SA#@rWqgt%bM2pna2;<|}=fdQO7cC|@{?&irtx-&m3kxE!UENY@m@nzWLu)xSSnEWIOK5S~Q5-okfGQ?ab>WQVENOMNKT#tC$Jfw0puY-!@PEl0GN_ zI9k#;y3V|CB2!K zG)?ZZ9npR%$2{>%__Y#1qq)ancIM;V=6<$Uc@U9Cn)3hNI)0u zz69PVOE?A3d|D!vX!lvv#4^6){)$0>y4cJ1chWC!{+ne&(XY3A{Ey$ zCs@=(9kY!)c=wwp&$qkZ^0a;Kmv&78bQB2=c{E?$Et2IfZOpda+^$i12QtgcdnH8* z)ZtG`fak5sk_6%?PiMf>+ayx)68}*aHL=8B0q-Hqw*lL}fISTWga#tgUoul#{G~SZ(_EF<@&^!~fyw!XVH`{KS!833FfwyTU_?){| z>?Q~;m})aeW+9e3CC2kh{A&^=&NpCu z8BwDfFy@;!V4NPqnxA9rJTy8(hWRwtmF?tgZ#%L}7t<%EVaaSi0RzXs&42Jmr=||w zGc`HkrSN{t%tjO81ryT`oSMA*?n(b;q2H&*4;`95K7L|i+)GEN_OS0ypL}R)`o#D# zycfZqqp>MqJoTRm^OW82E8`9LprmJ zc}m%9aof&m!+Jht*@})TkY99T-51?NPesSR+NS9IXQJrX4ZrASP}>_4n12{?0Q8Ma+EHl^UL2g@ZIRPG0)~90v!_+*a47x??B;VmegPTtS4@kg(QGla&qK7m*dosP2z|d*{j`e( zPU9Z=g83oFlhjJ%53)jvMwK1x@b>}89|97B8yfcTB_+I0+$-#EG)}og?Rs$5-vA8L zZ=p(u_QC+H;7D(>$GDs8z#Q~;4>Nbz4y{nqY=@G-5UgNFxo>v+`exbQ?-%N)BnmaE zZ7LByaBTFN^BOkJM-Fv%w?4sds_Y<&qOKaXC%i$n@D6M9AMttKmwu%Lm)NYwO>6Fz zNf1hwHTlAbrIS~6+LZAX`X1YQ?sdANBHDS#<<&_44>5w>oazhoji8nC4;F`Ggh1}x z8zCv8>!s={-$JkYG7#$eg`=WD<52@~3HD8p^c&a+jnB7kvPbVK^!+X3i@F-q+Z0dn zxzN*=erIV#v;(&?{E6nq++FQhbvv&wv0eY9$1Zg@=Ib`RnACFo(Fu3GxKoBpg{2ej zT89?mREo}$yO|2VW|W=GJQ{2&@FjQk16sMR2aOKf-G9PehbA1=3o|Qt#X4vbazwvS z#gEIqFXiz1v-sJ^f1-WFuMIdzF*m2>&(c$8i5+a?Zke~N8X8VL^yKKJ?gnZFEA@rk z1)9-W!kvvc+}x<y{%U*yOt}% zC07|9I^4dJR`!3cayRQ23~+`1W8D#vR=KMR`dqz;_if~r4l!(9Tfm)lI8i*W6QZSt zyV0mr>$RL-$y?OAFS)DgwRv^ll6!shL5_UH*trsVn`PYw$CS-{ZOPqa)obx@xS{Du z(<{vE6*xL%qxasJ??)drC3df%{5v421bWKAgTu7SS_Nm+6m_s&!0*cpWbaBF$IjY? zTtUYUGT1tKI)m$kyBakOUiXO&qmV=Qd)~N!#@OAcVH-*=xP_NMpf(ih3)P%2bRd=8 zU|n~(UZWRoVt2r7#i61PZdDz3aje~Wm1=O%v% z;;hY~5*2EtrK4-z8z7boIlp%L0CG;1gyc#03TF|H#V_PaMzMsw)FsHs%Cbe0zuv(y z54GH@>!{Wah`N&f_I~Edn3Lty-jFZBV{sn3(yMM@nNf(;XX{mbVk2}C_G^QGPYpZ? z0kZN2PP+*7!WPmLaH!N2&sZS&EnAvb8CNom1hH9|(+jA!O z$h~aNUMd}S`_RM6pH;DEy|Pq#$X#Ejb7lP-=iPNq)hO`CPa(FU`#(S6ZfP|dmP&un zdK<2YN`Fx&eDfj$?pCqiP#A-`;mmH-4)dL84>gA!GG`PhukIR3%N5St<@TU}foPxim;L{X*iGnXs@V_beCkigR z48eElY7L6L&<6x1mAAqw6= z!P_YKQ3{@+;AskeiGuf0@Y@u8h=M<$;A0g083mu9;PVuGj)JdI@MQ}Am4bhvVD$oaDGL6ag1@KW1q!}F!PhDHHU;0Lpbvs)uAyKX z1zRb&nSz@r7^WaY!9facqu?k7_fT+}g8M1ZDVU?64{fNqhJq(Bbzm-1@DCVrH2IM_& z1{3B66XXUH;sz7o1{2-}6Wj(9+6EKY1{2l>6VwJ1(gqXI1{2N(6U+t^$_5k21{1~x z6T}7+!Uhw-1{1yp6TAi!x&{-t1{1ah6SM{svIY~d1{1CZ6RZXkssE+Lt{tAlfOQmm? z{@K$~mr`YCT52O*F)ei+T`?`yPghJ!(KL#urS7IHrlqFoifO4=(G}BD23;{Nb&jr> zmU=>XUTEwAA0y71L5*qbsJR{*|tn zmRe2Ko@uEo>56G7g|3*EQt66msRMMywA2y0Vp?jJu9%k6=!$8n3SBWR^*CKIE!Cha zrlsCaS4>O2hpw2G`W3ojTIwTo#kAC)&=u2CpQ056HoVY*^k>L6V)Ep?Qxn3g(CS4>Okbj7rkO;=1yy^gM!mU8KeX{n#0 zE2gD>fv%XA`gOWuTI%=cifO4or7NbT{+h0smiiK1F)j7abj7sPr4U356HoF}h+}>TbGXT56iEn3j4KT`?_1Jy1_ekuyGaYOQ$&2fdke@Spi<3g}2F z^Ed@ehmrR&PltVo6d5h&F}G4c+KdhRnly)EUO@p3$(x5Mpm8$ueF*CAhOjlr8v6}- z1KlOEZ(uEWcgXG+@jN>ye8-Civl`ap!kkt14NMkwYtv0X_PWR$*NLyPL|Y>7NB7OH zQGfBO=6CTYm$-fCmE^5D`nc$RU5**OGAuV>Kqq+3A%6cSV9LCC=@iUs9I63Boe#8l zAM`sX;oJQftl8)+!iCX-xE&g-CHa1{xRY65xUM0C(6`$WKk9 z-dbm{e<2U{lWBqd!5+Zg)d6haqXa!^bm0~|L;fG~kiVK18iO3QM;;|?W9-f0o`ybI__2oBSd=V65KA2@y4_;-qZue@s1dGV3^TZz(|NqT>#zg zjQMtX%=^>AyuAm^aTV2b7e(cYuD?z5wU4m|-{}nb0eQ$XX+hr61LQk87qfXDW4&ym zDFJU)9`8b0c*z}ew+&AMUYJrC24;Xem+xEU@xCQ3yszj1?>(K%*Q>@Hv1D!jIeF;s zP7C@iJwQL$8M;^0v?s<%P}$GP1O9MYfOqx)I7xkBMGG1F1vX^US-d|Z5BV?Cg52K& z)>(>K6N`%*gN{U>?6|1&MTyL!NTxU)>>%Lc4Sl58?2>C8AQ0r>hY(k9nBL`}uy z8t4J|ZJmKL$TY9mxtMQ}N4p~}w72$vc7I#6;xw7$lD$hF>m6xf9qa*X`xYvU6$U4X zwp_>XA$jNzrUhN?0s5Y{#Z0H9vP1ql%X3X0=&RELn&|=P-N`_AShC&zAC(9FAJPJy z?E!S#N=(bR$k#0XCiNEICy({#)51E`1J+LCIbs%hBs1Junm;BF_IJ|)yL)-Ss-sC@ zKPM0NuhIfLvTR^?cP`m~kq7&~(gHiWY+%PagT3NPX_IOLqNZX}jV&A4J)OZ0$b;RP z7T7(@1a>T`&Q8dK9Zw7F-X6f-9@E?!g*^E-7wcElu}q>qepDXr!)d|Yw~TNTl+*=z zxb<$~zWpt?Uc&xsHw?YM2i*H4iaDYBJ|&O&$GXMb4(fp(pi0;m>fWU4`^)lRe=#kv zxAg#4ruqVG65KzOhx>e5aBuGcu3XtBRNfcl!TwEJVDDHqup^xt-EYc+{Xc1eJ-BRO zM>~Vvx>eeo+Ki~Fm{WK509LNnCiV+5@^EiW3+`P#z?G}D38wNr@?a;^0z2LV*qD}< zmZT{43rew$tyZ)UB4L7TP9AD5EvR?*05xXRg3#gUUjWqzF(L0d;ViLG_$bUO7=g+>)O&k?8nfCB)6QCgMQ}_W-BeoWj`o0Vv{gvidR(?5HF*kS zULIyXEtto8fSK(8v$L4KULN6V(n5H=2ZS-&21|ZAWBX}&Z2vJWY$tla7E^jg(K?qQ zA?=LtH{=n1FfD}BJs^xRRtaHeaQ|H%+<#3A+{qrm4YgK2zM>X-v@^til!y4mv>@Ks z1H`x$EHo(3mzJ^}7#Nk`+ZpX;S4+44-%ShcsUFbANUJ`)Ct;}PdUltAV+OT{jm{UbvOBa|oQK^{*FjA;_h z^9c&al*d*~3)=%}VXJjkFFz!Y?G0&RdoV3*37x`ct7+ROA7OGaYbMbvm9^#kNg7|O`5aaeGGKh9U8Lr+Y zZMLjH)KpsbSM>leX4jLU7BYqoS4I{?iq&j&_|#og=kf`Ks>ox$AuY_0^nh7ywPxTz zXYbhXzRp5>Kpx-TwD3KeCccEV5wr66?n?__E**TZMn{JCB;c#a<2#!czB4`Gi&;F} zR3{C`Q9U)JI|-GtArJb^X@S<#0bQ`Q`I@>|cXXkPFzHy+3o170b*`!Jkq7;=X@Q>W z0d$Nef@3NDf;!Y0-$&%}J$rHZJf~@V2FWcSQmSVyZo^QxQ z{CbKId)WZq7GgrTxbGTiGiVK>UW6GG5!95d0gleTu2xTXyN}Uf z84Lt6CJiJo+&6I?Na8<%5Egbx2smWf0O4F9*8&cPu!apWXV@kDzrWvmRj*!kbyamw zYsLog!8Pitcl_?(JAUu?9$fVL^Ugc}Jo;bl!g4WV2$u3Hp?@$rRhSdI%(!B zGq0Q3_>!3iW;$!jO34%DLba4KXKLr6L@HzD(j_xLb1y!wqVg3hSB}dDmZS=kTK&wT z+ST%%)p6|k@p$~+V~LK(AAB?Zd)wm=zI`UM1t8^7)z#(m&|c4 zv+U$#Zm?WT5~@p!C9`anrp%dYZAm3LK{aMF9htS61+`@fhfMgj*rv`pye)SVvW2|- zlSrH6R^F;ug?u?)DpzJ|3v*W9oY}vqItHXKD_6(L6{`Xg7V@sL4)sC3YvOU^%vkA+ z0X_^48kx#uuA{>+jGM+v-M4huoK2A%DiOCX*8;aE!;h@qhkR?%rKUq^wdZXC@{} zrkPK0g~?>;c)UC{L4+7QVWlgXL8EW8LybjT*G-S-&9-ep%7!#skj#N#9SR#r9K$tJ zyP$9LOl?86WX;sNqGLvlCG%-3ofJ}CJHKlt^TIMw^&l89Bq`hB$B4{5zFc78t>eOB z;zBjAAP?n3$xJ75W~E}5Vka9i;gG}Tn?pz++*~BOuW-ZfOZg2ADDUljCX;wzCX>wE z?@&4;DZSE{(kFZ=y^_pC9i?v~N|%dPI!N5I`?%z3I49F67xD!ookRhYOq-=L z)tWSod?Anj$YEGhmLS@i+TCZb2giwh)X$04E~>}e-zTm0C0@yocqV+4BHoT%&ZuNe z!#tUsEauEI6E6v`o+jc|GFDlUj{LfTp^7nSCi4}eQZUAtVlkUyW`}fIYiftu+whD- zs82^D6oz!ZQg)e(P|IqIE6LJ?sm6!!<3pfXVt8oR&e)#ayJ&<`DV7Jjy9-4#Z>8gT zv(jBIniv_07ct0M-b__u<0hmCQd7vsdJ{cyG1j2LpzUO9OAA&yMdbjP9HeOPoB<04 zaO_{7Gn>B2wSEobn`>-*Nh2{}`MTrDl5RxTj~q@+nw2CRbaGZmuO9_9hzbMoUft-_ zF0ly^D;1&2qB9pUobT&PMF$wg#mp16y|bW*2AEBqXEmhGghrh`4tEo~^BCfuY8Q>R zcxZH`LnD_!VQzpfU6gW4tyiTIPAMr!?W5P08Jk|$Hl$aE=yhOkY{w2oniD5Z#FG=y znu)?x+=Aj*82xo)5|OOtD&6B2%uP2eQ33A@rBey6GPEncvrsY>iNefE3Z==Q#QL`S z*_7pu6)Kr78pzjis;w!|Hk%Sn_iH10T|*?tSz{EE>v!go)@1o`vV_SdhS$v_%@})| z@$mmD7X@ONA)`mkrbUk~ipXM2k@fY(l&tJ-mO}nO+T>c-kX&gmxkk;BmCRYE*@=`} zrIy}`hges-iG}q5SAQ;A$x?z=b)^)kcC|(-4}>Grf%GDZIy+jUjvFwWG}lKb%?_ALNt;$B$kjv;X~-~3+B71K zUS!s!aRX+P<_0%uY8@ClnOI6oVUV@|d~LKd=@lYjog}T!vXNTnmMLLW{cd0hV-d7>D93;hQmXE2R`POX}B z9YUK@oo-5Hhp|rYQOY{Yz7q@gpjP3ynQzs6xtj2hO0(=K^aMIlPcAxXmR&ERh}5EG zcLQcqXk!?Kie8o5nX@p^C&8rgeu@VREtATpEf38Mw+g1XJSmy#+eJKC*0x&&XI)uE z#eJ=*q#ypy^rS0{ocDOiNrc>8DivBDojMJ82zRNQa7+g3#YHVyKp8Gm7EmO5Zfhh` zAlYK}Y&TsrlYXa*AS334Rj!CdjOZd&a@A_I^l`ByhP$kb6!LT2^H~w%=BR{lx1fNr z$*{>y20wdLX+RCkK}ebpHoZXN3y-HYkKov21+A*kJfAfad#vCtjrk2h>ng1%d02AZbM=61=>=1|QVh;0ti zEKrBOx7qGcqc(LmH%*-_?V^r%56H2)j#VCrZ3&?ceQ!H;)V|M_CaJTzU3Lczh04z6 z5W7Qdw4FNCs4Y8N8&b#QfsEWtb{z5Mc-y=dH|3$wT4xW@w#=Jjy619A*nT}G+Hq59 zDC#IDXviU&wdu621v<6KLK7g~(T_s~N6&~(?(vUPLZg#zr`tv+WvRC}q|?2=^3*0v zp2an<8Ogbw~h3vqmZLFj%I;E8jYM1j`T1{8kO3jS)y5+PB%5AQzI#All|FR zXMOyn$ZdO^?=A}ImZwcpr0mYkO;e}8J!7D)@%{)p)(`2hC+U9Fq3>-T0})`h?A+2c zbq3l+oq-6{83>^ceQ!H;1{~@JS)jJfO}EDDXQz&RaakaJe(IEP=@+%*rc#?M zkb92$yoPjYWP#c=3)_mxj=py4=#Yy>!Lu-G!%d$ySs*nF+tH9Zr)lIfdU$A;amP_( zZxySbbo9ivr%JJ16vu4`o1G|9Y$l?6E8W#%u8>TZyZd_jdb@kJc2i7RjN`)*JVp_~ zrSW7cg|Om0pB149VJl{(izwq0adr{cte%WbI8eA$kG~q#lZN(HDc+bptUinI+7|29 zhSa2}>cjyM&}3RBiKs+eWw6d7c)Ao`Onfw%n8_HZO4N1HQ+#G>CW)-_^ZXEWXG4On zBZBUj@KVqn{piuYh4jsZsQp`EcDY+rw3ciJ?`jCoZxcMZLVg0F-cyBCax90KcSO%a zv~?c4+l>~VN$g6HbSD#HpCKVv$`e*TLF^%&Szkn){>=khJxH%5kYWxTVVT<4SASJ+U+7%H3afXYR2r%)Z} z^H20WZle3`*m8Wt?nC{(+hYU0eKFT+HyJRqQnuoS(gb3Ta~5_UyXgf2rMppnprzFjo+yjG%{aEtEQ0M8cJ zy>7~BTeAB|Tz4Ie?Ht;z%jQJ#^l2P~OIF9ntrS8-O^VqD;kvCfTxaj*?%uxc{+{mM z%{zLwZ|m9KU7ql0_u}+q45xxzbWm>;32t$dpoKnd3~y_Q;Q_*M=MIlIYuMF973lSB z?#BOnw{-Uc%W|Q6dq42&u8%igkV?9(w*0BE+ZhSFkS=W$hZ>^DaT~i1#71`?JbYki z&(O{t_Y4gm8fu22eLdY^V($Qu-`msE+wa5Bi_$rmXq*eOAQ60W%5pK+|EnTJ6O8tS z#iqi(hE(8?^W8(cc8n^-&1xx@Gf&3xw@^&tPj}9oNamcu;O;}+M~)upelCvK+>HMa z-#m3g|Bm5(@dJrCq#QdYo43LQ#Cv+S_S4_phxU5Jd=Uc2lJ4j_=Y_)k`L-CG4RCD2 z>~Bbz6Qlt&po{TIrk%qh9$i06Zr?+xRXkMYWkk;=d;J$hyOd2kGT~hZ3xXYgk>n*mZG}(*I{X-2A;SdySFAgq|1}SvJ zkhlIEpoKF|2(zI>g3g&hI=9o)?}yhiQQX5>dKs7ORyc-60fu#LBRkv>Sw5dc$hI5L zg#??6f%fmSfZgGS*xgMsIV@t(;48v$v;%_%un2(l1Dw5!A@fGHl*GXT3ag0??egVn zhvYxpg9~T*HZI;O%p)%@g@a*p`1Xc07-JgHMkM(HXUS`Gd~0-a*x^j}Su}AnYqXLa zvvPDkQ8!+fI%eNlUfLYn>Y|G(;06Z;6p13QFNJ|-6KJF%fwmEWcK2?PYqmJ?OLiW~ zOyXD|>Moh7?jy00-8*Bu<0uouK%u9%H#US>f(Pw|Cce9{w0|q4U=J$ACfc`QA8iQx zc7lCqba>mA9>j0;^tjfY8HsX%O>en^6dcJ?x_h8!+g4w5yTU3LoJL$oc;72zHrNI@ ztRowXBMq^j1S$y(WQSwB3aRb=J+8e4ZakGNFfWSLv78KiFL$FTXZR^&z~0lJDE8B0 zL>W^&pM|>>s8xs|5dam{u+!fw>>ShEDgZXtcQnL$gs|Rsm&+>A5o|VF>2|6d6nJjxGazXZl+Z@TC3Q5Nf&AwwB-8&ni%Wf5C z+?3Uc+^ZNXIQWXA8@kN_ZWR|}FSBnIu9&H5g zZipb;rhRw0rkO2vSGJIQt5QWoah>G4XOzI2ekwF?v+eAx`?Zn1ry;T;`kGFW#C9Dn z9BzTBLRHg6gq`>HcrfiyA640!)NyG%6*JS6&Vol=_}PvBsGLU&me{XV zNQ3K@LhD9b??YO*fqr2Wpk47|fz5gY!X$+5C@|NnW`S0*U5SQ3Q<5Qdw^mISGpRzKF`n{w!CkCJJ1Ty&svZY}ecQ^eV$5hsc{(Asj~v}u-X zNHbpB6-z~@s%6t&D}u$XnCTb>dQoZSUpv;b#ZO4C4(icOv5<0#V$P9j7N>?33xU$6 z*O-T1%W6wt5_x=R=QzzQ$}A?|(}|Rvi?Dcs%|7+1wu%o|8@u!H&Y0N>v$Uq}wViG& zTU>bFd43tU?6C;|%jQugvo?F2{va)8Wg#2yBHET`b%kiaaDVzRmMf`KflNF9Na<|f0+86$_018vGe z+(8~Yx)xj>r;2 zPJ%Wj+BUin)xs@y8RGX2M5C0;&bzc>P64QDGDpd1MUfG69EKxfm+35<#$)d_FvUl% zJ9B&-`*>CQrw(~NB`{kyx^OJBXx>~HAE!`^1ckzs%LGbSu~e8WR&J&#H9GE!8+XFF z8M&k}YKk;^gGjhBcua%ExJmv@FiN)^+Zbmd>&&dF{g-DbgPiPh*_W_7KnRy&TP%|- zTV{>cTEfK9Km8(&DYDt<+wtHs0R?TsIrDQ2^DqAN*_m^}|Nv z5V6kuh}tF6GwdK%d|6DLdN zxLX^pk76AJ;K;;i<;nWE>SwMJ))q1(wFTu$8fmlfMBvN#jOk7bO>XN+ zYJY9^yZGaqrd0ay+G5m(Uz(|{(!J6QvWe4|Nu=OjrhU|;z4=1T+%fqJN0vJ@sJqs?F zPL@eKK-%q|UtHIg?WvKrsAa$Qx<*;47ynS1Mcrc`Gd48RHh` zM-^rriri!^2llm#!iN?*>`Psv3?2$}B-2Pw&Kb#Fl2iNhp*;C=IIYvj{A#fmJZ8s2 z)rC17OW5B2@Ewo6)_|K&A|tm+BLH?`&R|LTd3^F%HOiJ+u3`vLpd9TOb$Fe8zFL?n z7`lZfA8Y%EF6kz-1vf{QyHYF*RdJFgXCBg47`&XXaT4#$YwgV489QxvaO&giAaR9; zn+NU8#~^waUWyFRjWew~BSA-Ok)k_$BWilYEZa$~@d$NI?P4ERDe=CQfZ;J8DH3P) za`XA>Ag0aJCYmrku{ zW4M>M(D(T+yDfTd#%`~0lu55uyF}SQ5!6oC4`8b5x&(ow?s`CsCT!F1IG00gNEhY{ z6}R)Pof*m@&2y!INlpE%fhJd&9Fd8IrGqgPUc;WQ(M*IaBnBzg6f*uNu*jakjJ>PN z=sYGj;&&o9hD;|zYp)UvI@xVs zF7`peHY*o;kW(%GSp?bmfZzsoE}Xj2sTvRi>bKF&=ES>7vRC!-`3Q$0gS*^7iq8P>Vtp_0rewjEeIg${b2&8 zfxu&=RyNIKu3T`j`{+u*-Q{Hb_JkDi?kiSpw`?8Q?gT90P;rNGBEo!VeF1UKDzeBqRo;g)ol&3(2^Vs;*CzyOS#9}PHHSMg5;^1t za}i9fGcBVp38Z(PbbYQlE2$Al$=&H{|6^hz)Lv7Dto;^)&!+ouhM)g|rh`_tc-)Vj zj2Z6ECC@*NAbh&WUIICMDnhLv61HozKj5O-f5#t3|DCwvSqPaAeJ@??M_>Cb=-ZZl z9hzT>?xNA0KycCgGWzLrOHbo@&ZQva#Sv-+(A)_ZXhic!D(OS@Er6?Ds_nO+dYgK7 z=>8mZ7>(`(gp2OmB2ZA5b=*Xe9f(jXfbOB$#+o%@x=pzY(A87lehcciwSR{PFF?1^ zctD`IcyMwKAR_V*+0ZI3Kn*q z9EL^?Of{B|-dQw>jc`g#wPbv?ioe-+@ae?@3`GM zuybGLp1r-rF>7c``nG+&_Z;nsAGq_>$gab8?wjlx-G1NJf^{@?_nkvS_wBvw?w%8O z-JZMeKXf{NPN`GA#}O<#G6j_S^A?_5ml$_y>oY;IAM8#eNIiVpIq3 zF_j%Nu|inlhC#BMtL0rM4(4~C-gmgTcXJ_m=eCpmS^HxG2M=+6$}HWyePY|_K+nO# z>4W`;M(@ksmd{vQhx6s#{oAs~b9<)xsKx}M%qs#oO&bu`nl|O_O3P|15pa#`hH?p( z64#jf=u?=(_=-xnpfoKe5rsq+bI3S*5oy1Gcwualco5SX2nT&?Ml=EiL%M)-+;7c1 zJkz=FjD)@%;>PIq)7m1~dt3_pP;F^0nV+cQpgt}~B{zc|u8cL2$>G0B0vDsv{j=oU zzesM@8Svpso9yQz_`uK9)p899zT`Jr;uoPM$C=lmXmcDw4paBA`?DaSy?%7`I~W(78(KcIhL$du zuSE#ZI8l3X^R|-*hELvFxu>{I-oTmtlAHM-J2xn7W!7+(h6Rn;+K8$4@a`NRTblhn zefa43?VCdU01ec#-+~T5lzkjeIX=sN8~^qjlOY3fc3T90p^wR^mhC)w7kClQ@@nD2 zV)#Uxqm_wLp;~m!G}Y$Mk`zw(<4)YVj}4=eYD-Z?TqwW)5^{Mj0PFzfZbl({FaFq$ zOG02@_~DIm$xfi`{+rs+Mm-!rdl7b~k?%#tPdfxzP%50Ld(R=)*vc-Qs{5oZLD!ab zb@Bakz9Ws_A!3MCtwmf)4If^GPZ5U?520vt!v|!W$-W{&t=}T})@EPAMYAu*ADvk` zsuy;3?c#82ju`eu_>ZYUf$(xyS%vnaC=e0t_c2t>tj;05O!koowVFeFO;^`wwOA~a z5Rpxh-@b@{Mj^gZE3HufTy)g`M+7AFg-Ilk$^K1*S{mvh3&Dia+U%JKt)3P|h0?RK zjTO@Mn$wwm5CwG+>kJjUm0exZ>|1GH+W(4r7ecqpDXHjw{?f=I_sa;l>U2land~nj z)RJ`n85a#jIm6NUcAUtF>t3#7i8yUv?6x;Arjj{2qkuyS1-j;j&LGf|@~Cmg$N}E# z5P2^s=@Y(Llt56NJU~>>$YB-FzleKOM7xHGrtQ_&*7^fvZ(3YDEE03L!IceCc*+fE z5#cGmrGl(mO+@5nV^sf%>>ptOOg=(RehE%@M9RVTlE?A#f*v6XqebT;vrhI(Ko^7? zA<~>=T<(e@HO}A=4vykbl-L>OLTBb|$CMrgMs+czw-IY_TuAIUxdPtl1A;ykP!F@7 zHW~uRK-Wi|K-c%z7Estm?Xq~h8~?W^vBFjEW~}?;cY@rrpk z2IFwDR5?Wkk&b53K`XHlOtFc4NDT3iC2P>OTxX|o$96m%f!;b1kpU_DZb2Ds>4&z2 zy1H-<|!)?l{7(j*hOba&;`c3bjjxlU4ZHLG~a- zQ?VCqhqn=#>F663w2}w}MZrTuM~x%aBps=nEV3KQZ9o(mw!d&d&oU(6o>i1 z%1yL0%Bcw1Z%vxUAtZmn7V<6xnc^E>SU8G;y-n=g=Z!%`>kS^m;p^?k;?yw?Vnpe< zj0}(B-~iB=Rj<@(wqjAIL!3y894gL+(+NIus^X9UUu5n+UsxA!yGas*2a-9tHyby0 z;3$^dNe8x^x*8?Asz}W{U`HV6`q1077zhWU?Yh^N$X0AcSO5`FcH+NAkXvadKFq?3 zW$|l6}5e3%LaLjej&gU3- z803j?9+8`kAuZ10Lr7LdgZZ1#C0Hvl{<=QZb^6QhM=>W|h%4|l^EIckKJ{Aa^h(1! z-H7YoU>4L1X9#i+lOmD=+=-&z!7t80j#K7R*FlupQoe2>pUh$Vna)-6K)ugSDiNII zN2E-V*<@U^IY(05L2H7I&1e_WTls1ihD~!ma%iAg42Ppx_@%`5!RWj?!@L5^li`{* z%fXO>k2-}fxfy>N$hUWCx8~NT><}t8(j{Eb<<%vLV?$kf2bycBOQLdnb?H&YKawuJ z4@JGYls(P>pKVnVm^Y&}NF(N}HTTc|(AOO*N`qD&iaXkaUrIXvE;@JqmbnA%$<5`c zUV%#edk1Ap0gbEA2$}61?q3l*(?DX4-Opf5ZiQ(AT*n)4bhx94{) zT8h=1kPc?O`gKM9>K6xf`YwU(CT@r&uuHv5U|dV-(q86IBtyP40!?&EB7Ix-c@b(! z1-O}u`mBTL3UF)}Qnnaa1f~If0vR zdwL6z%xh2McBC&u)5Bh<$et>wnqgZSHJ^>G!RWodxK+V5Ia}jN&(D;xJW^F6|#w401 zW`9L25Qfrsq;mcW;zY0{N-O!x2-xdZG6S0ZB0?=G>ObS6K338b*)nm&D)IsPREZK6 zpQh_NWy(WN0gP0`oS_Suh7t4PK4o7*7QKoY@8DdA&YD0KDIU|NE8azf2s*(obJm}; z`E*SLuIQw;KC~76HAW)T(x}ncyzv3Y?3FNZw2Y#ka3sP%J3?3b@;KEJ z0^Yb+>MP8aX!2Q`Z@2j-;;GkdPUEGo+oTV3;Wq!s3l+Id1ywKubh#>^=F8DsM7Jqi zKu8C(cAJqj@^6R>a*EMFBR|dj2sS#>KK*qB8t9ZOf^wgTP)iE@Uvg0&=cx<)w#Z8` z8qTiOmrH$HP-g1eOcc$!)%?aOF#f(HlJ9f0{2W!b@LsMjz(FoZak&ip-gUsu{MGQ1fy$7tx#v zr3~r7ZO(#=J|&8ZLqm;=*09!`E6?m-K>qM9QRfK$c!926XrDwZ$0l&2l~3Z_5mDPd zC~0RIP<>NccMjrp-4Ek>CDX_gAQs8LI|rIO30Y_&w520*5!qgMRWBTcEwVfX>yu1{ zHi@DnlPa^vls8vb`M?HoJjXa(Doo)}P|4^VKD^OM4`0SoIL;0Y$?Hpy&fI;~gt)T8 zzAeH;m_28?7op)ubFE^QU19o8R{449+o9u&BG6IyRVTq%o1`8(9$kb8`~w>_+90jI zX&=Y3L$`604?^;Bi;Nw|PFo9vP1oHM)TSL+y?wk%#-{0jkUsvro;+%D`D~Ms+M(*|rLwg{|Va6KSisTYp=Ht_{(($Ut9S2N&$VwuRF-{{hh# zApu{@4#N)bKObT(Nxr7$j&c+BL-}=YKq`4~-R7TeZ1Zcw2R1lnGg zA%9T-#=dF}C3?3Rz1s(SHxF*!V(dM5q+@5p z^r0d*>HSDYWEks`EUMxTqjiJp(mVSH4v%j+p57ae$JcEVW!OM)KpjemQHK3Vn``6i ziGAA!w%wXKb>Oh8K0@9tgi<7|{JO#3Z9P4*Su5>y+iLnz>ZAk5f_b&$=sB82N!coC z=BVKhLqxnTsSS-QXBsB8d8sbcqnL*|p@MwFW%g*@tIp<=$G8)}ELcUF*L)l91T?L- z;RDD0b@;WE3nMVw%qE~LEtogkOdOvguC{kE;hOOsuLpNGM5rZKf3D}Ep=)~)vdtVo zOA=xKY%_;YAR^lPA|Rl<%r^k-y%B0Phc;IBwEQvt0V4|WM%iZa(NWJvKtf0TjX-@O zLM;vTkl~nEo4GDRt1{b+)XpE(X;y1#W>zB{&E@xe>HZEtCk1YWyRaG?ybC2FO5EEb zpsJJoO(6T5Bh->)e*+f{RkTTc0^evkhmP#?<*_E+jmwlOAmISkGwwiA?V&s_-F0q_ z(r(O~$l=!B3eHoGRV$V=KAhuT9nbc$2n^Dx{$^19qiv`9d@pYQ3(Jli^c7qc%h=jZ3R_`3DNc>-h!H6KyzWkZ%tW3IuJJMb=+!8{u^6IYT)c^V%A*f zn3xV#R2i6y@jaq}xe!Ieu-8TXt)SV82(={5mT}Qg19RApaPeH3sRFGVCvBpv7&zzx z(}MsHG0kx8-YvCTR`ls+`sisTn!Ai}E4L6l0Fp=Ss59QO>v0y+D}_kN)B&s=am4u@ z4Oc9)E*39Ty`czT%2}uYGeovE<#`(fVG|=4Oo!$KVZLqN6p_qp^TzSg*XGfOxv+WD zUZ}|CDX5xZ+uKnyh33MvUSnHG2eY<$4fd+FJ@xFv#D(Dagh!Yk!SW~t{yhJ#N4Vw_?0lJ_A*DU*{gfM!9)v|cIkx(9QHzEXJ0~sk!;S<{(B23t`J+% zLR^D^iFW<(g4N;UDKDMfTMa_ELu{z#Ti*#&^KoWbFn60XHS_IT2Z)Yd-+Db>`ubM- zFc-dcj~6QPtqQ7U*!C{eybjGp^sT}}gmf@#--`K!T1fYuPmB=@gk$YcMV02HnG?a1 zD81^j2-xdh_1&P^y%B0jQNM?ahI-Y`QCD8S+y>9A0>LOE`a-TXP>jMVy@ta6LB@VI zvxRAHA((#Beo$v@r&sV5>l`8iAf2TN0ZfRwN6kmjTtrhM)FPyVS(}m-NIfSv-+T?pcZmVQkSw(e zD%t%Wb0Js?r5Sl50_M6Ic^LG1JVGrg=HK9=p=PAt9@2W_*E*+6jH4-U22Mj`SyOG@ zZ?pq>TB_?P`l2-?vcbgCDewoNzy+ukQDP!eV7?W76Vbt|=vU*VucFh3xlr_5yik#% zE2u*BP_xgEpym~5t|_*Kbl_I>;G#0XR_v2BF6tLxd!En2X*P*XVJ!zBSeKPCwRXIu zPfYDnJ7anYyvxY|1uGqo55+c~q)>Qqaqk=^ireGDcqia!=1X4xUzRwdC zTKlNJg+jRxFmv8FI(!HL8Djz5aFlSxW?jC+V1Y^ZcJv!NpLF;@|eLq`F3 z`CoX9gv!WSF+mFuIW2hA*^YSzW8m=gMG<(ao7F#teojjEdU<-AD|U!aty9PoGKEk^ zYYK%!FqFs_!oK2Eu8>UAC-B`ZhW@ceuckhQFWu$D8qJ~;<%fSa0u7`euAyj{VbaO< zew|!eY|_gSn?&J5>yo*Nb%VybkAJ**bAxYwCFakv-PXj`6LB zwj{QW-ZpjL@t%Xb?moEt_Ecf--rVs!cI-GI>fw%Fs+X)h8_|IX>FJ1fa1Y2-jHn_N z$y|3)a<{0D{K`~+dpW&z`?h2`O^>S8*PpSf>GHPir|`BseriG#M!sMaem-Gfw`|{& zY@S3~^PCyC0EA)OOOZ9{LqG*CTuvd}nhJ`jYtbRH7BX~Za-c6c-V@ureIOMZ z7}&NYwtY)aUu;{lcYIqqZ4UIM5!+2&V)lj#y<0YK*|vH6=FQvrC35mQFSl;qx?Kf6 zonuIMw+{#Bfgz58`uz~)tc$ARt6UpKReeBL$GM2A`Y_v!*+o^g+J-x-O13cNn`uZOt|3jhHh*>1MdDqgj#aa^EECSI_ZfJRrM>hBoX$HsyhFo z@ac<0`^ew;J6}k0$Cq|Obou%_5cxoaT9U{^Tr^az zUe}g8x#(UM-bxaq3lVE?=T4$12+SGycw)i6=0#oqlB8HH)R+5z2t%-EKu=599G_T- zz-*m^p9cqXZRg;8uZ6sU=-^!oc?Dkju7%KtxmXK%uNNv>3sF#o7$0pdP{BjJpDCVmEJ(VspW5oCLybL(*1oh0=~L%e-Tvrc!XM# zN+08*q2_6)cAwx*+*`DM6!Tr27aiJl89I zBjDXz`D^v)Et?K%f-SMt_VzmznQYXS+JsXz|C8wyJOq?GMbruJ6uEbrMb9A`p{d-L zK)r8pQ^CD9CrtBgDZ4NBv6R>1rLU!=4|8EDcX**9OR1o0hHYO)&8yK|kW`ZhYitYY zVAhs0^cL28i34Iy%kRpr1oI(S4yDz6egxcgtN9gB>}Z5ql45so(NL?ozb%70*F~$? ziEe9~&LHak2*lMX_CG%5FNaOsMq49uW6tUb72}j&kfoLy`!UF9^wl6X5{msGaZ$1xB8vn~&cQ2o= zmv-UrA|S3yIbEmqnFzI{UHCK?4YdmuwhO6(l}}M36%m~dHLt&VlP7Z{hnt?r(Ls7# zYl>Z>oJH9{hIWbB9L2IcE4X(x-uOREVm-Dc>II8G<+}dtvAH70D%1^+Rra?NTgS8s zEJ8$B(~+-(=}$6H!SFZ7^!YYz8!quNZI|JtuW6$Xb79)Hd!ZuJrl4wuZGVrNm!P?b zrcLN-NC&evZ8&esn>W4@F?SI4g>hTNrIha7#q>*_orw{s0;U;Wj25-2AfO@`0f zt7|CV44@lcohK^m(|W#Hl6xh&*Id20b<+6;N2Llo#{9hz2rAX$VJ4_f`}SX*NASio zmB}2BGvu0p!^;<*Wl?tMLOnKjf$TrR1{8frSnj=QE0rTzT9w$0@$M0XlOJ65P zALhcz{n!f?IXMMYh!4`nCjW$*pGR{Mot$7>NC&faaqXn|UK+@HWpUvp0%=EB^+*$Wk!dj(Z9Z2Jak zR?u9S`P0}I(m^}SJwnNR&HbMf?d5U}$|$??Uzql~vUp`r>eZh`z*jf--vpKZG(s&& zrAN7FsJYLE+1*)Qh&_l)%m3auIXZ$THn-~+H%*_zXZ`8M>M*7_LwtMSs;(9?&x zF!Z;0p&~=CplXI~kE7-lXfC3m7bYyEgLW8tby2!LuD^$9FAcqRefkTS_PVloWltLV zqY?1c4gJ4>N_Rx4C53y0i-sEdKXz}^Rr5(>6uGAI6G`{6E_tguR;Y2sQpFm_auTlX zq?G4YimppS=#+CBjH0Y~)6U?Fm5{V5XPrKsL}^NzK#N{x-YVs}P|2#63!AWDHEvZY zt2dpma2mp5)`a!gyJ#^#WtPk6QLSFBj{vl?_9vMu-o-1v8eYuWFdFvW6#pRC3Ff3+ zyrSlL@#-b>PatO~FK`ag5zTgf8{$=ERD!W?PQ2#Zc7A~P=p7`#8!vrrCw-U;+xeIm zDzcpls%F^s1Zutm%|*1G!YYJx;I^H?Mdcwm5%$`+sNW&EKl6#I4L&4?3dA*^Lvk{m zpvb%JIw&XKi=@~pB{nVXStR^^S5VOLw9vzHOKme{FMg{Rjtc&Sg(+B>TiPeO!j=7D23EK)gZ zj=mq;@I!q2AbUcwEhBck;Uit_EL%woW2<{x*or(Syehnw4ZaiB#j@+fDY5k;AtfGd9LMMs43L_NVCD5~^9Q7K}-| zp4M|n$D1HAwC%O~&fQK5Hn|p4luF>*aj!{ z(26rD%e2xl40ZBngt{NHKV}~0VW54nfHzToZ9y_unaMm_TXe!oS28o1_tzFsCjQ!G z@pw1>Z%rmA%yKuk-ybheP0VBxNWGoR-avxr_FCj0F2zgXwSpy-ZOR7Qko*8O*Py1y zo}80T+|Yoeh|fIf#9(z#d(4U&A;(DG#`F>LbxuNyMpno6eb~qjN0i!Y9_l7extUGe@!N>{7m)^RHf^*#&L?*oT)9K zZfeW%#JXb6N?DbeY5sg7S<25$XFI5Vhi$@3Mc$8nf}n8hz`p??ho)2W;|vsWB@?x@ zotOG*qb+1>>NHigcHDtFn(nL3GQ8$HibYpSe*?QB+PBSMN=OM|wrgj0wO%5LPwz*ggGE8EC zqR$^|mnPGbxb}@MX^N>K7-n(T+&g1mZba~0595b6>|wZL@(y{1Jhj-a`urYgC&j2G zMw0f#&Y8zFS<9isw04!dQW?r z7A?CidiLiaf%LJrMoZKY1iccnUqm3SRF~B@{Vv;)KX3f;-HR z^P_vTXr&MIIb|z}OtPFo`TML>nSrB+_w6kY-_v(+_l{Esj*s7UpLx4ol2dc^!tD3- z_if+8={nF?ery~U9(mt#ZV&Oczjwec%PB(Ep6Y!#K`f1<0E6YZ|>i_^|akb zzK~BLv&g!Gx1Qd6->LEKx1Xx)>f2^ki>L0&jNW%JyLH=Lhwdw;`dk+xo#W-N0WTdJ zeevbN3qDPz6#1!cz~>^R$c?}N_U2wJ**c37dYr0vQ6f8mvisc^HMQD?JEe$hV=hvP z387s`>P@#q2s=W zaDQclY8vkPK(=nUA+}d`MQBxK6_Ls{2U$fv0idL$=~+b{!-t3x_VEaa=~TXmsQj@A z)g+Za%0)vp>uH&~LsIu?37g{=zY&4kItwo*7XDM)SvcR@$BVCk*uxcQ_dNX+X!>p+ z(}%g(KEB)w6>SeFs6xz-ds*<{CB(NMHOse<9)yAWFt^(7#3BR0-L_De)F>agg@_We zc_)2fABr|LDLi;7k*PaEHEE$XanVoYE{x>|yik#`R8Td;x66ocHMAFIJT$(A^w17t*(ia)=ZN?+P*F=D@OdVF zu<%J^`I!j#>SKY+iAuMAZ%0?l!KzKz=TSNa&WOYqXysL_YHFlt-8P?1qnP&LE1D~WGw z&|XBNCbTuAhqf5CRLS?4%?J_SHfpJo8UY?*;s*<#G-`(<;Hw+8tB6boBUF>(y^o8A z8nycmSW^gK;=Jg3?44nbkDHZ>HRZVyvpP{t;yygOSOXE&7R6yFDX%3pVjulSb4iXo zqu{8du>-61A`1X*rWqq9r@?e~xaJiGXUzi3aSu$pm~aGh;P4z_99vwp-Le=%-Z5CM;<1zJLPM2K1B==R%eMU zr!3EZXC_3lJdZ`dTNm?Z5xM>5F89uyYbm!2JsGwg)w#lfL<*5(^xfV)RWs>bAHH#xE2y0IBNfbJ&0_GtO zmIGmP8!~1RLA3h86vm~s%)mtoxe|a7dTFyvc#c=|B2f!v4%Pv8VqrPEOW87!?uAO( z8}TyEl#ZP+2b3WF3k#AyXTMU*2C6a0j^Vk?oeI=dLN-i!K%Yd*n5{P~8KjGL63`z} z8&70k2FaoA5g7l`#!3l95f^TX@QtNMN6AEl8)wAHr`Ur@7xpG~&8ajgy0bz)X z(VW<|WR<_k5)jOfrmS*pz6T#ih|u1_$1c3|9emJ-xfpzmd!eGihk~jZz8S=~9cVAe z;E{FH_!iQ`tOp-Z`$kD*UP{E5(;Y2|%x^LAgN08Tg9jtvs}DM^BQiY@p_(MqX)YQz z=&1cBWRZCn^X2R$7uZrC?n>Rk3pEUP{Sdx440jck_3;L09;5Kj`iMS}mCX5u0gNi_ z*wV)s|44HAafV$l8a0%)ulZ0`cbYPRd5B(X7JnV7#M^x!_HOVurxNpR@&AL^<+b?V z!%JU_Pao#O;xE720~J|(1ywVATTguZPP2Rq>7gAKAHj^iQ_T&)-M08BqsCDii73&A ze>b3Ln1|CX{`EwrbrGsb@xGRehFbhL=t*5LH^9|@l(7=YDXlyOGKsUKmYg*jIF3LQ zIzF+A`O~55Bv!dnyOI@ilSmHfp7yDee8-$rnWYlPbo=BMMwimhsu|e5XB9rhyWPyY zv*Q)E)_Vo&F32m~jqeS;f~eeHuaIH5QcnW-vgj0Xz;f?9)61rgS{%HARQy&S>UtT`oQf|$Q$~=t{{h*D*pP)BkbSLl zKo&>c_<-zM?SL#bubq$m5TWk%Sr6l-@L9U(c#+f1-i<_)cQ;FuIq(jRvW$I!(3JB5 zEz8)Kh$zv#!{0@~S0~d3BGYFgRFk6fX)YS-9e%yjjQtmoEG7ScmIW&({8ja7;G($;H<#!fKtgZ-QwO_d|y ztK0f6B2zI!HA$vPE*fg$y=JS7fp(69CplXJ1n}}~8 zMSBs=r?3klJ65nawekEOXcpT?vw#H1h?czYkmU$T?NP@(SLK zC-Y*Z#flrZS53N@MDF^_j7-{nO)}od%1>c}>xnk9gOHN6#G}VFsbv@M#`opVB6ZM* zpZdnPhNx{!we4(I3CU*K_%_h8cjMb#GDw*1jqgrsIkoIA?ZQP z(-xYE_4JFDM$tH>GwF}_ip{m}y8smT3w37y-Sw_^^Q=G?ow&1oWM5CB4UedqTIVem zDQDTEV`1LHs?ylMa`r1)?BmYKaL9O~H%5?E-P;b3h`%mEwI7O9F~7@2bwckCBXrZe z)yV!~bXiY!`z^@c*8UwP{5NzPv;w1;K%lso@DV0aWA0H=oe7(X2_K43O=Ci1i;z9D z81D5-SQ_f+e-YUS~BY_pv-(Nv+>|thz_bl&cj$8Q+U>vVy(PF0hX>rwRqQ5l3Gd+n}vJU zb3SzHnJZUHvG(kTXbBhzl}Z?N3mY+@oU1;Q0W^E%3E}KMKKZ}ULxM0Stl~C;)lM!3P-QwZaTqFgWWRlD-DNw6zxRV0OHs&HJ&>MiVz0k8Wm$W98 z9=|DqEXjqQ875q?`PD}~yNJEN7onP5=y^344PEGokQC^{Xh~wc+&3xEM^GTlp-a3! z6afJp@7;v=2O?B!4(~`wfxfCRZ(O!lN(3Zy-1iXfUyM*q!#%`kh#B?oL}*ne z1(M1&2T6gJ8jhstNr5`>A)q42cZm2li1xxXRa3c;9)w~0B^$O@lL0l#Z*e~nU+#}<`7It`;s-l& z>HAJaz*iUVeMF|I2-PH+%3L(mGCf1`TfCV`s}Jv^=C^n^*9~TioZeD5Jgh%E`7Hz% zA)>1($A04a8yKo!1e)Xed>ged5lg&A?UQ)vYt-n&To|=)d!Zturl4wuZwH8PA4hu; zjhfKbkRIA$)KqA&mPS5%-gU~Tp^TcyT!0S|hg<&{0bkvy9V9aS-w4&Dc>kP>h8nfs zgacpCV!oW6Fi#x9T70N7lcZ&!o0dT^)@G?YSjL72zWVUJVQ9aotZn|d&T#P#g%-lD z&UZ;at6n$*#2wM)@@9rzx1Vzq<|!}_(QD1(A0m~w$_L^G;eruWV!kc@31XMm;!ohE zuf?Yib7Aox@mAbn7;~h}wtgv&w3#Pky*>5Dp85+i_Fu#I zhQ?l0Zm+Tb4ig}fNIuT6>qY0t*bB@jX1au6j`Oyy|fkR+pW%XZ^BuSIB`MG|h$_ytD=AZWW8;>T=sAuXzWH)U>u8 zNX)c=#3jCB;mm3TSRsZ&b0J4a$4us6FteM}vH5l(pCa0N=L>(1m%c89KFoy+`I;9h zav=(;X83jo@$G|XFQN+(wlSm!w+jg_DkEgYeqQ6Eei5=+pY6iH2w6L9#J)pazp?sA z$9d-+_Jmh?Oz9>WPQ`W~M*?zHj;Nwrq>DIBfaHHAgjSVP2!ie6peZE$v#{BP0|h?k z0jM$ihUUWfc+Se335wDxm%9*!;%T&4Dohp;q~)rEJv)SKRro?_X@WRIAm=w#a1^VL zeGs>obEFv+qZ`o;Tz;KT;^;%(w2(d(*O}AqAGY&wA3CxWA`BQ6L{bXNn8F!}apV9* z#2NV}+&9g(nNwC+69_UxlQ`^v2IR%+<5r&D(aqk;Jfey13)7Ldb*fsxmr2Tj!69tP zi3uce%_k9BGXWrQAfsfB0ZQ%(z#v&7g{`5u*m}gJjmW1+hc2omPNV^7$B~J#{q3xTE;&)QFpmJfZ~U@sc{!Rg@qFFZm+P z^_{RlyIH#IRS5`$wE@U3A(7j{=_GLlz`fzsDI7BT7}A$Q5k>eYK9a(e)lW7qNuy8{92Z$nQGpLbp|~4eZwPC- zFfoC6(gJBFgcP*13TakIm_aMe_J&j$5yrUr6dx4&lx>yt5fm?ggr^LoQ#EjfE22}$ zFrX|98Lo9jgq~R{7hr#^ct^(pA|62ju9{G28l&3`X7V_y;)$R|%aax&9q`@b0)&v- z*iwVim_QknEm8FaWUyk%A}(_UE!kkwKgvbi?@DAgI!)Yro!exTC(Ez^!Zsn-Y5^aC zbg{V6#XZ6XXZZ+?LcRbqZsbffS)rt?4sV;rz}@I*o-#ITTO1^J*!NU2M)FPvh0 zM_tbj8#KioNf{`tA5K_tM&0RrMucM@a!xZm%nKw9PhcP^Ze=F( zsFOA5{W5FNWm?uCZeL3qbkTaxOorwR7vQCs$plZ@`0Rso0_856GyEsd8MJc`M?Z%X zCnQYn!Hvg&o*P3$E6$Cf&yAtajiIe`V`woCqQM*du05)J8jYdZH+3RHceU57t0l}U z$+67x=+`=KBiIMYRbuLnSBY?2W&c=1Nn8E65nm>j%nGY!ww4J?*R zKdLW3Ia%eDZ)Wn!X*Ioavcn1ayK80P{}t@=R|CPQbMhveuB&Oh%w*!4voOj;2wY_s|d#$eRNwau#8{`NROKnDZZiU!hC56exLXHIy3{oOj;2 zh3j(**R(TpZsD5uNg6C%vzw*KX;*Z8Q7Zcgn^irSskxLM|6c^dEGMnh8BbbQ(5{ue zw-gLav$0Hn)jT*yzl;&exh*X?-g8@8zfN0PUd3w0F~6XZW4;$-s&hMKXMLv(_I!6+ z$gG6m>$5iX-;8cssWUe9YwGqugCT0x-apj>Oxs%BcMS&p@cZ=3 z5joNVutVUXwr%<_wgAWVk+!s*IAKAq zX3Xmgm3h^x)hiAV^Pvty7bKq*zCfW_0;+_H?(!-&B{v{PXMJ-b8javNMgA)o>Q z9*2iVM~4p$+r=nc4z0;(Im^gZ^Ap%P7SSb)f*m495jBK|7KfNZxCmHTqBJXf2d-%x zJ8&SrcW>MnM*dfTwNs>f#T-L`d6S(3^u&o1aRh^;;se(#eF#0h_?02IZ4YSos9qVH7W>$8R~75L*qo4aTt@ zQwWd%aPfg&V|JbM4NOUHE|wqYjS)X5WD>(fE*GDeNW?>+ig#e4u8VU;x>6$Ap|2Do zr()D77D}f!aS-I@n5Cd?AH*C{WL^o8v53*47!iu#6*V^)UCC4_fo`zrpauH68N-y6 zj2Q)05A-6G#!evVing(1Kf46n6nm%zL_)erXmW^ir2xuamVr1&0!@mbT#D;LcpU|R z(%t1j5u_BW3~obAAZ#S_EYMR>5=3&jvgf4>DWqAaJbFShtto4;qr)&_PZQY`pt$8S zW(>Jx$vB%DGy`?}>^1c-efM(J}HBdr{Ss=<(>g7o4-~=Pdg< z%Z{k&r>|wVm*S4ZSz%=`@Da4hUtJ-hfde^1pOyd6}Ho*!u|? zK#G-T8gQ2-u8Om>{dL zmFeDuRcPEp(2Z+sfqsSIUXVlsqwHre>QVQCaW%1gt@m5I#I@DQ6D>N;4@=v`PG@$Z z8erL%Cl*}qYMt2ntk182LoGOxt?gdfL)_>UobBHif&O80C3$Vy{U}O10E#@5b=Rhu zvi0h^->v<%vhv;f=!5HqaD z#sLT)X`#o<8?w!jI)S*ZQeM^3XC?(Q7PbU>Hj`=}9Ocv#NDPxoa`p?_-(|t^CMU^l zpbP_$xJsp(gdVxGiBS05@ZnA3$k+z#lv_wu!^s|0;sjDXvs5C1wD*dU1%#4Ab@JWT zgC%o(@Yv2m+DdUEhTWpZS&R@|O*xEE1{YaQA}oataw?ZWA8dF?Ta!6TP{v8j z?DCYjOs4O!V`pU6AygJxj?f7-Ns5fd+1m(RM|u&8+fOBPNK@t{uTrG}57`CsRVr0T z9eg6U3FX(}h!Qu*$ZCW;TPa=6;2^>kcI0q#p+J!?RpRI+^ybQzg~lmKipUm&Fr$)H zER;k#Iy*@ZStXe$jdJ7Iu^9-8E+AZB1oQlgA#xeewd_|ECOIM-9o8aGp?5T`^i zdU!%)b`#!m`Ct+CQRyAz(THYLy-CHW6(I~a>t~)3_#zV!A>9ZkOg zqf@cIzh`1%Bgc4D`iz^6O0V&3V_;%p5NN@!kL%XFJ{U+w>#%;HWtq=MC1PUXb~gff zoMN~{k}{EQMF5-NGDYTnTN)wZA1?`{Ty#bp9IyPNW=!!qQnq zTIH|O4>zMpM3rmD&>@vU9>0+z{V0yuDHJEYDq4?yROo}e_{?)-@q8o&T6?1>Scj4V zEyl~{gLTT}uP#7U&-m)-`>^_Z&b^q9J9=8X7aoAonX2D=+ObTHf1X8B>&ZA0mWAO) zt`odeAg5;3JP*3gcg=nL`fNTs$F>%rSR#i!!T2{jRo&MDBoEB%Fe@1Upg{N+w18`7 zt_E~ow3->#S6w#u4={?iCrwBH6akXY+_7N{W3zb}8KT=?_i-Um{0$iu0@G*an9#k` zQ~Ss>Rf(N(#H*fG7${?Vl6}JLmU|zJ?pLTg9#dTHnaE&%?pm65mUsks&G>?oAC7j~TvzDM*e1uz! zG)|<>nWs4E=~;{#t1Ex>fC@9Kvau4V-6Gzr*S8RuZ~$bI-XaZ!CA{+qw< z9@a<3zYaRsGJbs&{1ub_ff=uhck>aA-{Mw+c_ybm)FF#>!akgKmX^DMacnLR$B$aT zkE5D-g)JD8W>t03hVUIxFReE~Rimuxc_D2^dG9CX{VH=eSP%k~_q)F#W5=1-|M;!v z@&8C|^#HaTz+YRLH@8F&#l;OQE3?(^cyx)Q4t=$|-OIYcI5wx<&ualcKkfFTcC*?& z(gG~k@ItV@7s6}yXX3EvxX0t3)$Ipoo+0pUM(Q3QsVg$n!3b)eq;U^Hfmb}_6my!!4N&0K z!&v+RSYrD@FWPKg3452^z9q~R)psSfUK2-#_wPQG*nMc%;o+e}M-sb7Muta52gU5d zKB|?u3h63b!CcuVpM@>|OL<>6hEx;90wU;Q9M4gvt^dr|G8+#*PJ~sxb5@J$m_nwu zK?bG7(pF6FY9{I5)jS0@VDCN?;~rGVZmrWdjsgjGnKJ8LWTmYv@T0i9_d^KtcboI2E^!v@csH zfhERHCGxoOXXb&K?57}t*>9o$a_utTf;bb0Vg#WmhJC5fpgC8BiHNqbXN~nA92NR} z1Z9^&aGym{9nF_g5ZvezwR9_D`LajrUUg>gt$UYgC~y-fyZ;iR@C)!S2-Y_@ke&Ip zYUBPodSoB0d(|0wjq9?muARB0HQ6Q7=w#igptBcsf_mb@+C^MSxr$5hDJ=L==4D-t zqCv4m#3wysZJLb1$_Ulub($SqG!)khySjF9FbBtj_+s3LmL$f@U1b&C11Jy?@16(< z=y*Rwc*i1CYZ`Bk9W#yFjvP7ci}#2NZ&z7`_mSv$AC7>4j`u4G?}HJlHHY__uCCE4 zu7*Oy4^p$FlfIaj6y__n(hB!Vbli&(kkE1e9m0JwLNyI{<%Vp}xiJi zqzPBtA>O7y_u}R0m53OmU>whl8XP3Yltw;r4uPx4%LP3JWkZM!muj)mI5So{V;G%- zrSa6@u`OE%wy(!cb)1K6bG*+TZu|ac7-C9{KFMN~>9u!=GXu6)yJ@V{eTypiw_LFC z$iB8%+@&{@*-=||axynqE+$jvOy+v{uuM;8L#8vcasOh774;~hh_L9s0OVDD2w<`| zFY^w28jfdbOCU4I$5x)9vx7sZSi53m&(7xxP;T$>a3Httsw&1jJ&V)@p&vg7G1iTZ@8zHCd>S`{3lBUJ?4uS*VM; z26}ppJMv_W=psln?Ps5_-{{!q)!y<-nr}p@h!%Psih7yjMMSsIuOa-ejZm#Q{O9{x z^%0^OS&W0yVyp(5x8kK^G2F3N^kFWpRZn}NqG(73RWow?yTrHWqP;M7YkUjoK@3#h z%-Yb>ROj-pYF;`%Os0_{F<(j0nFT-Le~`E#WYXI@9pofGi0=)Zq^LaiPVy5>uwWsSPVz4pKfUNYI7vz7H8ssi3dV<+0?kRj zjx^-0J~(-OOLH2s22QfaxD_Mx5tDC1^D`4aK)2FNT<9sTWclAButwU4CnKPt+lLv# z{$C?hYYzMQc9BBC&O$e0%@a*+zEW~BD@#J8nrFQSVSc0HtrS-Z#! zoq0RE1V51hvl zbG@}?D1W#Ko-d6A$Mj5yG*@N`sqIrK9Ci~+`aC%=W3n!fdqtT_?{8yoitZCk_c?Hy z{q;_h`VMlM_v3p*rztAWz0-Up6D(LzrPF)`~Wfc@gc@RbDD1=ElT^~ zU}WYRzFk-%j(}L^JQa@+)}h>on=Z zTsY02dZ8kxsi0~`YTrV9`y$$l=ro1x59wjnPIHapG)s*~iWfaw3BBz$WpQP|FF~P* ziz%y7G>i(m(7%m{w=zOCDfAs&G}LjPIp97FD%Y2JgFcCaxv6BejO)GmB==-8pGs1) z670qB3)jTbJdO9fGhe`GJ}inez1Zx=x@Q!JnwkSB6rXySPjldC2kIRy^&RABcj0?O zM=L7Ny`vpvg6ZDV>uIE;9cKLWqVwQrC7C^rRxm!qplFWv?WA=vADq1CH>Y)x9PNwI zZK$JtNd(qNNBckoG<2Ku4#NI)glf%UKi`h_QKFgG(Y_roeH|@*md>^}e|PMn|p9m~!2?vDBna(62?1-Ls=dG6ia)c`7N94Fn~`h)wLOmu|sm#))-|oU~q;oKQnL}h$_v%6%8vY`Q8_S zUD77(@nM(OeCRge_lY7qBUEdSBJ=G6r-)`=7dVcWzAlhH%!Lb__CiH2P(jsS-Ze1x+>-*LU)ktDt9V@Bz#jzE0=^9@Kb|_i5KG43b!HO#ycx+y4z$v&qU0x;l5^lLx752! z>O06?eih#v&JIQ8xp$XOFu{UFPrA!*F@Ac{d2pAK%pP|s7$0H+Gz+LvUm$XtQ1^NV8i8V20B^p#yvVAcMhmCBcmADW^!)&K+CEiQaSP`LGb5>%$ zUFCC$W?om>jhDWzl0M9ZtGwL{6}d_URWnljKH}RZv=_#1jc*}6xLsv%(WgXF5yITK zXl)^~QkG}-F9a*HcZoXxyrCZGY;q;pNY?=-sxTrds52~w_|9F`U1x1IHVKitmJTJ! z<1^V0qkY%eAX$PII%NrYEGl6iixN}YG7c2E?)vd@gt#mD=}>Kj{f2G@n>kclT1J?Wm7gfj)Yj0AsTC_%j*pk_5M@lA@yX)yc$33IU$Mn^k2jP8V_0?<8I8 zT1IfFQ|27k~!z+qS_ks zqy<_b9JN}u3oWWGN}FTV3ADG0QtE6fq*n0aF8i7EqOjjq12}kHaRDNLx2vdU>@*7Y#UnbV8 zSH-efO&1b~14pUVIEGg!o4D{ z3gAlGYL`qc(sTwR>3A!tP1Ea%)mnsphC*Zk3$S>yKoU%igI<#Q_jNG z(qKj*DU@*`TO^3hDn53G6V9O z8y6<+q1pm7KQ(ixI#ydMtO-;Y(ugwvxXc~0S4oy8Ojsviw+28#v??&F5F6ZSUd9>G z&di?7rp!H=q0EU)CiB|N%QBB<-jVrK=A)UfWIkQ3U8L2a99&4lK6!?g{;Y~gzu^*=tvVVIa+;2@@1sR92FxQJCHWc{|3oXy# zphEUjD4(odEN+dAm&^$ZR#505zTU8uzFsN6azmg?7W9R1B7|6+%=q6Iq0f7+pgu2i z7bTm8a)skS1dTm;B{im%Ab9NEV3aU$Y&TiuqX|};>CGp3@r923CV5zaALQ>*YzYxX zmdiYz`9|i4nIB|+nfXPw1G#6jOXzVKJuacg_4K%o9=-I4)8iI;Jcl0p>2Vu9?xx3` z^cbf{iXLTp6zTCGJszOPtLX7cdc1`mZ=}Z`(&J%ze25+&pvNcZ@t5@YJ9>PE9{)&> zuhZjS>G1?TenO9@=yAaXc>Id~bs_z01wF2&#})M0NRJ!ov4tM}^w>#{=h5RZJr2_2 zUV7X^k1RbV=y8G`6?*&@JzheO-=oK?>G2MFypG6Jg{0TiiMvsru=JrhMvqJAaXme*qem}2;`F$M9?zl2etO(S zkE8UsgB~V5#^^CkL)MqmBfAoh33_DL(7)*Me){<*^!T^6czmB8Ptj@if1}5zXmHDi z+y9#W^$B{s;(9z@MvwQ=;}Losy#bFq=Z=U z0>2(&k--y^@(_#4G>geYEFurFcuZ$WG#+BHm}ZffW^n*i{GP;MI!hw(P&IP}G5s5v zzlY)c?*CugxyQ&=)p49+skW7erKOSDI^DLgJnlSp_T5t2ZRvw`x3oM9Eim1g-JR)d zr6y92@qaYL4pqm7*PlijS@gHAP^<^mY@-o=U2`53yJj;KyJi~{yJim*yXF~C z?3!Dl*fldy?3$xc?3!0Yv1{H0#jbff6uahqQ0$tILa}Q;1;wuUODJ~D*Pz%n{|v>h z`5qLz<}}z4yXMhQ?3y7cc1;h8U9%gCU2`oIyXIL??3xKEcFi47?3$NDv1@(_ie2*- zD0a;|px8C{L$PcA2#Q_v87Owm7opfS--Ke<{5ur8<_A#hnloTS?3#0-*fkeJv1`Vl z*fp0!v1|51v1^_O#jcrxV%N+=v1?ud#jaU~V%OXY#jbf56uag_Q0$sdK(T8+55=ze z8z^?ox1iWH--Tk=oI;J*cg-W9*fr-tv1>L%v1_(Lv1|4~v1@LCV%OXP#jc5TfbW`D zO(WGior*pbx1-pHf}M2aa8m4~cR{g}j=*B~&Zgov6g_jOSdHQ>6mO$opM3|m`@mc( z_M>=s9u<$E*!&qPEwxW0m#jjDYNAFrpiamNC)M9w_ zf^oOr0L5;NEnzs`$sqN@ZtW{9Rn7bf1=iza9!7yl#+h9xFbgWP1_cI)Ge@F8?mP1` zlC9;#YkLt0u;@gZGQgL<AV>_@n==# z^WE47=7(f+y@wXA*|UkdXEd>nI(n6u8-I9sI`ve?=!A}u>ZjxRmEprGTe8${Tv}eS zx`d;BsN)x^9`Zwn$e^DQ!h5tk)MPvsugO2ciB|p|{1=U{5^fILGt-=IJ|?q-E;Xep zxiu!rhgH%tQ_55Qqm8Dn?_aY4`H`Bu7WFWZxbm}#i|C6fQCB&xvpj1&XHdPbxZBN{ z#dO*DQuJvUp_{O!S7lN5r^< zs=Qn}Ip9%Gv=H(1CHKk&$vsw2>AiBYEC>DsN_fUC#Wf z7ITvWbI^lI`Sx_u&!W|W3ocuBB@cTPkc zlFXt@O(BWpo%-R62RqSx)HmxoGq2yQE6Bpu9g(A-tc8A@1Nw3^ItApEm!)G$X|ToI zw%5yn*JuGB?*P2i4$Px-X4(Nc?ZsNOCppkg-m+^m{FOlgS%9@mj((XIy61r2K50eM z2;=~rZJD=(RbQ2Z?$H7bJAn4sK^Ntu;q!Oo&<|=sM;xHLCWFQXE;}d-fE`;bmi4Th z^=U2Er~|91UsN3sjfGpxj`e#v>>FCJu?E4$!!a}L|Kza$)q-tl46N5`gZ*?=9AzCt zm#Rcr@rJ=#nsHnX8`XksZ5V8uxf%D#VNchBZEF~8yBT&!4x7}1ZEp~4o9&tXq8#=M zTCg1su*(8ov&ghkhN@=oN2?#-Cda*13%9d@xE7Q8o*ehPTDV;fxSfL9wLG;ym!m$X zh1%_aDu|)H4%<`vwjA~kTChtUU?op2!P;;?783^+htQ=efyFWhTv^>(p4s_w*kiR| zPiYuz-2ATXki)iW!7gtYY^xb|qa3zh3-(k8SlLr+?G9|0;|^=#u5iGWJ++ny`5HOw zm0GYX9bg0Av>3V$l`ahpmD02u5RIW*lIh=+qkdfrwZ{Q9ATtBH6oV!}407`$`+Yg< zBU-Gh99U1R51lz)pgPe!n+jECpquORFLK;JYT=&dfEzG= zo7xeNb$P9^7SEDz`gn^tQkqJaszgd_9T-opZ?DM_kLJ&qt8k$lZ-ExxItRQH>hT5= z7OPn*XY15rTkpUY@CHd{y#m%Br3Yy$8jf^Io2&6`IqD`Y)YBbM1Lld)@{WY%{g{)} zWwq#f9q3x?8!69X9DfkX~-*1O_SOTMlkhuoe1?*o#yI0vQ-?ze3C9ziD52qKnz;Z!-#oH9iAWu zJWdO6ivwW5dI8!ViVv0aa!g9|*GhR>;o@x@uvF?QIr9oF=B*CQUVSt}yT5d_#X8N6 zcB`E4d@a5UHTf(v1xDq3MJ>LIboeM5jmO$8d^gGYZqVYp*nux#y6^$dWV%rBd>f*f z|K>(}pB(xgEoeT^_am;I41iAN6N5!>tW-!1R=kLY;EJiFN6TBx&`-&sf2;+)&7r0P zoX9^JIcny6P0sh*gX8me{Hm-Vb_wn#MYIgqyeCKemm;D|95gASWkSo*ZQ>y4D7y3@ zf}jbt_=;vjwRDR;IpT?mh_7lQTGAV9<%p{l5ntCtw9Mg1$Pq78MEsj3q9r!CT#k6D z9%5h96ir4;D)kmQ&xG5UTvZIRoMk62QjfkYPp08+0KpA#AT4a-AaNZe2)A5Sx-iZc~K3RTt6{ z#$F+Z{JbLMH*_H_f$Uy6USi^>2&HePRxaZnEiSmpj_D}csIPUk)q6q&VCcK3A literal 0 HcmV?d00001 diff --git a/it/doctrees/trust_marks.doctree b/it/doctrees/trust_marks.doctree new file mode 100644 index 0000000000000000000000000000000000000000..0d2be0c08bd9957a81116f60df749d8ef84719e8 GIT binary patch literal 98501 zcmeHw378yLb*{Bbqs_8x$tx~PHX04;?ir0n%UG5@mPTeQX+~&dTNq5Mrn_dkT0LDu zFC)pzgM>g@P~;2H4&fyx1jzCr?AZu`mxMSE67UPlV@U`Q2!yPU@Zy&Tf#m(?+}gXk z>UK|!lm$Lqs;R!qIsZNP+;h*p_uQAScyh^AORl2-nH#Hf1-*PBt>*J(Bd=AP=IXqW ztIulXTJsIfoj=liqSd_^laAHk0sD1A*YRnt}ht8&Jy zFMnZ$d9(FR?>YOTbUOXW*=*0(Uj8Qh_p@Jn`BTlpsz;iIHRkfu+6AgLCiN?uM3uR6 zP6Y|IW?@}*N;P}bTCJi_)oWmZNM5Grt02!@l`E;$Dn8#h5Iron#HFvI} zO>>$x7iLSt)j5?|T|HOPs#;}UYu3$GHFbt^Gz&e2Ern&~nydp8{#t3HvkhOX8DiEb zTmNM9+O%HQYr0XcrYqH2(_CKC%Ubi;iux3o-de3sRcm?;5E^AqS_gfgcS}00JU&%< zTtPbw4=aV*Y^kS5QIvyImCT_Y8@^@u)thSt|15spWLkd-@W8@upjOxls0ud#{G0IK zE%@(N{C69mS~+c0W>unmYu0+ zS~<%ZX4T5Mbaj4)fEYfn=WB&wW%rPS#tP2s#p9lZmMx%ci`g=@1i*S+ZXj_?SJPa& zd#GtHt5@`<*(c8#6{eQ+dR`S$Z7%6+7G6>%R8OD*#w=ue!WyFRaA+&A@V2zVNos|9 z*`++T9V%KrTheMZt&+OXwh_jiX1*&1`sm`Ma9`)8KNR^LZIBOE-YjIFXcpAMV-C^< z3+eTtNS_ZydOfL$7Nidn($zUVA0_Ve`(O~&J+^4OsO}0ywM}j*5Z5@Qc@W&=$nF*& zf=)#?U_a#m_6iHIt3v^MeJEg8hXQtp6@;!uBbK8CGLWT0A#0ai3bP*0&FvWq+EyQE zZdEpF?{iRlvxVB`P}JTPirVH-)E*<$&a0KOUYyPqyHu1JuXlfPzUE zDrH+eK&>%X*3`<3=GuoC$H#zKc4F+v;ndO5BV?h}=BmS)j4`K`^?bUl)iTvN4VIDk zkb2dyq9(8+txR=|Grer1-u$1`7;09$)WVNZmBF zejfJCEjGW@Bh4O^t-;pJfr?{GV84998Q4@W-`h`}%+6{x72~zKAPlxo0vrNmPkO+w zgUoAfJW`c8^lVX?2OH=2?Ugx)7`IUi-!Si606;#%Y_Oi=13#j8Mg9ltL%GU7sW{`~p0 zI)hF$W6Y;@^dlX{U1@r??&ZfR(vRxW@fU^j3}$tYXzf%DTr1@ zFPqCx2LM}9nn|gu2OH;u3&SI}*enh~HaJRKaDVlS69KFR9)8 z!c@#!M=4b_4+hrfH0Abnp#3%y9oK6!d0Sg1r@6zxnP!fI z#RS^_CJzEBOqfw4CfA}y4Ky!mT?}GEReH+^2-x*r*o5?mx;zqQr4e8S(zp=a+ghSth5%%xc zk<%CFw62xYq_30!Mt&VGQo@5s^?6Y8>+oPI7pHD@xSv8Bsou6owdnA}@Yn+;#X;W^X4&q1%j#es0*OsSK zKmf7pyofRXREq~DD}k${G%JCN&E4H$m5)vpaAThQ*;L9rd zT8JaWwg?aI(8J*nFqk^6fP#kJwCXpXkPO)>{AelNDoLhfmQK z$bbml90Vn0gnH4ebS^;KjW*u2W8H(*O011urY(BouGA=pg%cJ3cH;~Q^Mu%H$ac?K zt`FPqYW+;kZt~vZ-+*UiNEQsr*(x;sZQ1s_SuO8qb|Af5UJbiWKBr>Gn~8z~g5tPQ zQ&r0qJCNG#=|Rr#+pXV;82s+`qD0)RRH!W!10A9>m>x(59TXIc&R}XF5*;cdadfCq z8=c*qp+lbaWYCFn(c7}KCmJ1g^CylD5oV(^*fBZ@^{hP-J!?;N&jLD&(6gve8=XBJ zqcfD0>BtUalrsGbFM==X&64i##nGt@CUdy_&ZxUl1BT}LbLN$rh6hkj2S9d|Kj zZ-?j%C8c*zP^|0>#poR>BXM-7P+NBPwM9o`L&jP#b_U|1bYi0x7ZpHgi?c9jYv!Sp zf8=sf*yDOil;cHdOxDVYGC4%CHctDyz$qaOO@suk9|r}epAk-8`^QP)!^y9w6T`{X z)Cbz)^hl^YC8UXhdgz)KIr3^D=T`?CzYdc2JV(iotAU2wViIaKr}ibKflyGOf3@o8 zeK8t{%JBBBM66~i)b3e#wnZmg10ipM__QG8^c$yV0U;koP6|hQm?R%ciS#T{tc}yb zwm7wuqJ;F%z838hCPiM| z1kWT^RSW_SPYflU9t3~e+^ z@g8vO2%}xTm1#AX!`9(4p9i5`zUO*- z+pJzhdTot$Z(B5J=XCZs0Mr;ul|UtMU4^xX~ zd}RPV+!oMn1n9_25JB&j#z5~|PQQ5=wf}ZGyWT4*zLM+)KGK$+A18WBMtKI?x#x|X zI#t5HcI=RcX#3mPTdv%uOKPqxNw=C6>kL`TQ=Zk!S!y2YGu!8|7yqt3`vOdFA(B!K zNl-jYk_QG((MmK@xWJri2h3tHU}HVn7VB3N))pt4QmU6{RGR_pTfLHS-(XXfVybN5 zL6rw_Cs7OOS041EZ9(U)5ToOR0|!!j26m@BZf??CTCJ+5jmivm5SMf;IcDeswmoN% zeoudYmi{?#fd3l6sF3O3ou>Z}WcT)GaPp3RrtkCpc=Qj1jRI@6vQxJQ%)n;G8NdJNT{RcADnLxK*nV(JJ$d3mH_lpa`Auj}7)M<10{I(n(Ck_vf1ctG;Rn64F zUjI-A{~y?!83316BXeL7{AF5qk1xxqUUhB#>2h~iio2L9Z5GGcvdB9%jvP--j-EJq zeC+7h;gN^OCdS7)Y0%yM88qU+9x#7jfB(Q>NP}LJFF`ls(2ov@;A2s`r*Xr7b)o2> zp+jl0QMkV?3cP`QbnM8;q|3NgucS)ag*5&(=2ZNXDQPom$*}@Q$1|tToX*^h^D}qh zKkQbXzhiJ@;{NpUY#LIIrIMk2Pyy-w{(Xb=@96k_0Wn{J&0(r{>zwn!<^4sr7%T=k zHZaH90&|{v09kS=KBjbd;#8ooFVc7)KxzZq$m~B1tgg5I;$oMxu_G0}ScKXb9&d{w zos4rabOmfNsq)*z;(#i_=jnC6k5>pZI*`rBed)xQ?-1181lq}wQ!ZRJ!$7nIU8_y= zNQ|*0Us0!PDf*H!XfIp}JDgMfd&2f;EW=M8-mO1fuJ_ua(qS!j>yNi(g!i84_u&{4 z^&poWVe7UY^3!o*3Hxj41fX-^k51wA4~FrzMkEikEPYH{&F%6SyYDZqYMa@Kw#@Qr zBVsmbK9>`1o(8o4UIgw=w&m`HB$E?j^BKm9cpmK?L3=R!hvNVz=~4)*QLm^t6iNGO zQe#I#TeZh(e+&;Eo~^HG@zv#A+N%^#hTXz1Xp6xVV?ZmAG!{6%uA%fkc{uESO!mn# zan5S8rcUW4I&J7zUe`Hl-|;IArS^GnaT9pSK>`;dX~$9=X*NKo+5)tn02&?GYdLFi zoR{=GB9)}!8Ol_&T;_D@)ac>VXc}o!FckU+22x{~B?Q=BuHknNm-gQ-Q_u&sxem&= zX`gIM`vIbTY;t1%-hOP{>hJeBoSBKL!K$}fLwpUjlF#hv-@h+Z-LBKChEs@#iQspa znH{zQj;qM#;&fXsC^||OhU`S@h><%m*zZ|X;KFmN!EG^DpDI~<+^ZQRkLoOqQQ~s3H$DRMX%blZoyCuNp`hm7wpCYdBf5@Yi=s-30UFXhe z6?fPK)fqZ4?j1afMpa7{5vCw@UYkm(r5QT)T9~Z{Byw5tyjLArf4WRMdT8Ml+w4Br zmR%lJabnHYI?}ZYTfyO19MACU9Pn22G_3Wf%c`>&y|7AcHXmxsrq!w*qg%R0f2-mg ze&ymE9glBqRqsR_toqOGF0@rW72E8dY0K_0A;ibJXjMPE=d|E30>;kyo0R@^o76eB z)g{1Gqs`z8+cLHdd2)66cbtLg}>RjXqwaf{@7XO!TY{&d-VzO82$T(8aS!)=)r z+pg){Nb1N*<75|&D!OWZ4*Sgq`U9NyxIcQ@)&JGy+wmbt^X(Q-b=%y&s4ce-k?c+| zx2HO6-y*`qRIND-f~RrJI5$j%zkyc^x+>mQ_I`6&?x^QRlVEfI;$!Hnk15?I`Xw?%dp3$i78~3NW>M(f{^j}9Dbenxu54SP zDS{YTwu1wE14P4875;>(k)mHQ>8_V+m5cZnfgQsnZWXdnN{@7TKDpGx&Jyu_Sdt{F zv9UkfmJJSd5|CuQT1~O{1Da#bFGY^CB&wVF@~8Sk;|bjy=w!Y;9vmp0x0eOex!@f2 zfg__1d}TRw+L)rV zIWNuP)E2QADs8-`+Tyj5y2|NFy;{qjK(NSRzrwM1OxY%dxdLIHu<&g5)F?}e;!8S% z<+NLgIgu$K=vk&x$0?{v=Dblkhu~J^;WgTKxbh`u}-fD^U0L0p>PW`6?LxQA>hn*1dtt5`ubctl-|=PcJ}q{Qbb@# zwM0Q+H3bv5yg{+%I8Ka1RO=)Gt3c!lc zbvl-xUs~6(8qO4;xrqWr%kXc!;ROz>ig4ecEQ5-|4j7}7H;56irT`6QMla7BCGe+~ zN;^0w#m3W0Anzy#x?%Y=t@plxt6}a3Zhy;cr1=+yt0b0iRfmsYdn1q(dL{6S%WyscAz;A>E>#O08$6V zpF&Yi{5k(`XjAutqXPa68RArcB^qBu(qQmOa~V1#^t?Ab@Mh2Txmz%+ieeo z(GwG4<_(FVh9LYrDs@rVWd8Sm?_J(OUdW@?R_uuT*AVxP#$D~v!w3&z;zy^g-*((k za87*AQ06LnIj7HIKLRw4uADxheDs$oWM`?wdJNW+Q9-~-wUn!uHK;;&^B#xltdRO7 zqXDrzODN2!899UUiWLFh!D3}rRS*|g!Ll&o&5{14Sl=8Y6iOGN=n&6R=sU#zG=#c? z82-DU)oG`H1d}>sk+Z_F%Z$#?#7*NI%8vkQeb&-JgQ$*Qa-va|rt4EtKgSg>QPa zC(&T8CYMWTUbDiKZZeM~(r!*a5sY@C&(=lslLKr)LU{>6qA^NGPL?kc9T0 z9@&XbR;?SlGDbaZ7A^`EvfVq$KOn~OeWcp((tu$yUbFjaa)eTClgjaX9#U=gRtHAHizKvmbjlwl(L?wa<-m_7tnZ4j}okO(xW!C?@{LY zBRT{UJCLD!F>w)ry$xS@ZZSvMVQc6%sI|zVsz?drK*t2QZE!O2Ry`x%s#H0*YNk`x zou(A@chZ!Ic<(VHFdJNtO#_&HmaJm+tyMN?_u|DKijq|JclTe)}}4h zis7F#!~3z#$?}MsyR|NFHQ`iO^m$y2kto@s$h3jTZCGjcQtv06S$Luc*F;dT@=ZT% z9_;Z73e~@b=5ab_B}Ns{1vlmj%#(2M&n0tpNiEORaZUsG-_YuM)7((dX9^|!SIZ*y zJzX(Gw$~g=b?0u^_`0)y?sjovrVQi8vQMbnX*7W&^XACtgQHN@V#-!#2NKL3Oz|-B zvPXVl>-3Hu-U&M%!+k}^tw!)%34s{?Ewug#4ahchF)f)qHd@XDB0Xq^uu z^s`4r`Z0aoI8S)1Ijs!S%}}s=U&-)ctz9(w0j7CGd$SEn416&BPLIG8JE51^=qnq2 zeaO+*H-ZC4c!h7#s2HIJp_Db~8fAOCBh4KQ-@r)ueLWlel-rg~kIRmm|7RqSwtPNR z6%T#OfQ4H^7zL|ssO-9z6LM~zcXd(gy$QhX2$&$clQ9@!q1y@AnWt!i!ZIUFd`KF) zpEbMH72zeOK1eQLZ5CEN40OjO11}5uA9^Y61q`t&JYM2mxEloX57GwYAfN#35iH_-=jW2YwMQi8`G^L!YSm=B>x*+%32lM~~LI?qI~ zQ=h!?^WriY*QY^u!PxF8O*j{r0G&MeCHNrV$JglonLw7_2TmQ|$wcCQ6-!~-P=o2b zy7*3#SRKQ1aqmU~vrU13F;VfER_FdI}b^6k47_Z-WEDa+$D=VXu98SGBCg z6|Dr19eN&|kO;AfUE)>le_WV4KMzL<+%HXD;L!%F zrMR{Xl01y@(Vm_v2lK`(F5fx?`{f{y7#Fh@qomQ_FFMH6w;kk9Q#9W>b&~waI0``B37TzD%!n^}JL}}SgyeGPe!?U|Iyl`H=Fd$J|rX^Q9%d~J@RdCRfCo_(L=ylZiZ9(sZqtzXQ z%@oe2Jzdze8aovAyfgk^z6u?S;kSTBXB$%x%i3=-tN=#7t)te~G`hxhref6RJY%Ih zl&->tAiA-&<;S*rnatJ5BCb0>b}cz_KTR#UrT9O&(TktKKejdxY>o?V#w-3A(jGgQ zKpCxc@Lt-2hJYpRURno`WfkLm%Xi*>i&;hGV#`l{-L#yx9M~OS{Nc3Yzk;LA+7WR} zi{EGHqBZdMkOoQriIW!p8UOfE_S3i)2LW;wou`a8slIOx#amW&N--jc7B?eT)CLx6 z)6OWSjhVErVN>h;?NFNPm{LUZEcSIuX?x8_Og$@_;XB+6(Jl6EkyP{xmd7b0-zr?a z#sAyVn7y$Le0^VE*kY+=E&A-2;=_PItY6|*;Sf{P9fw{l0kLIkoRPrQKgU7z(BcCU zxh%Ok#Ytm<*zRtZ!wp1>| zA8z`WbNXm0ur@YR(d@VF@sQ<+wx~E-^88>T*l4lNWky%u8JJ5?owPZnSBJizmtfRS z-#wu3&7IO04S?14Cb-nDIt_N*Tk;PV5nmq^+Fw438m#`ZF_7McUR0oY|M}Du2c4qh;0VDpa(us}Na^D2j@sCB+XWVt^LE z%wsSTlyunJP5 zWyudXLUtZp#Rv z;~!f1>uRpDwy#gDV`J|kkB|O2{Sh#24H&DebZ&1yD$#7#NO3QN7p;Q)iUD!tig!!o zvJ}@rP8vH>Z0zgvxU521&Z8uY<#1QlG!n!)-z>JLBpC3sjSzIjtVFKP*hVXl3cpt< z%RlC_yvj=Fw(_gw+5J%o!u{+bR$cLB61jZrwpY|1*VzGyQZ3h+)hov_82Fu?-TBOV z(4}}$H5BV#2VItUtrW>zsDBf`NlMnQO0egL8UgZ(?~}-7LH%w{8rz|cx1Yx#$^xAp zr7hFgeWf}_(-d`fRxe{|-QGZk1Ex4uS5~Dhvd=P3@)p^bIDNGCu`Dtwnk}+Hr3?C< z5lv7SEvWwHK|sIar?~QHIy-Bg4W~}-QYP@ELAE*^70n&)R)2?UrPUEqK~1y_ z`C&)c!QwDi6iriSum^jQJ+ltbW&?}B!G!-^`n*d4-)0F(Vi)7WFQAHjUb@p6EnQ%lwo?%UDs3 z-hib3s75adOyABdr9IV%^CMyysEUeM348{Ff@=sXTF3r1+ep9}buz*&b%n?ZwC9?( zmeMhAufr2Zif9KlRut+gw#Z`t5=K_8WCk0kak|0YgG!}OV{;oaP}zLW4DT3)y^)3N zMXbK6YVT#G6XYs-9!{F%={N-q+p`7^I*FrT*lL}t>k1YtaFX7j4cl`ZmjMh~?n)eJ zx7?LFHv#FE+hVbBmG9fRA$)TXGiXnt$QH}#S0ozHvdO6mRyfN5PIS#YIr0u8w9}_$ z!1zcPb+7j|b2Jsatks^QtyVm>^nD~KMVDwCQx)-jCOPQzy%T><4~Ep6xuud263 z08$Rxsk5Hcht4vtzRf7bZ9tQTVA45P2Wxggznwt`#p|#~fns=MFMuj9+4m<*CN^cP z)XQ}Ho~M>##v&Kg?y`9#bsmR^%gJDf`1G2~nH_UkwT9S(tMJ5SWYbM8=!hJk>bDeA z_$SJQ<#1dGG}tuPvd>Y38EkTBF>y?ySv-U?%vGqRc5x0zoR?93=2|?p3%J)Pr`MVd z{`tIGDdUx*lGSkPS*tb8YpY_JOZT>Jlf>-Gt+!I2UMM~Wd4ksY0AY~FOXVZ!MU`U=4nosiR1@jMI~RP1_#?MR7aQ^Z<8 zH~N=wlo0zTDv8tkb+8{d1I(j1RH#Q8k%oincS=0B=ane|?3DyFRxZ77l8U7cP zWHG$flh$SXs&($+tCtl&Hg_lQL5z}x5O(c=QzycIRi$) z#VjJ&hhp9jNG;5J+@vn#yX7HIBWaXz)2ahr3do-)k;{U-my^ay+HN|8nm6V(+A>2& zpmFUrqB!uWXP!>xE+POTp~7?S9V1peHt5xEvN}3&TmmY;$W_4qu}=Ay61h7BRNZVs z#^6^os%-^k4kcRxv&u^6N=roo0;_|TCHVHERRvn-Byw5OQsAVq(vpdg7K**vPEM0ANYUyCt~x zV^s%M@07@8Ny#sB(pV{Z<~UZ+D0I2P;Zr82iir2lC*AEcOB5fL;-T1~Stxo6AHJ{S zs5;`kV8aN9?ZtQU3_|HBqkNLt7*-yisywcoJ^PpwN6jt-7eC-`)-+wCh!AGe95FUq z=Af{M8n=zYx55ZlOWTGq=h2?nb@r@X);0}?>hV1!(GzFIe4cFdM;4VYx5=O3CNB&) zE53Uy;aG8Ss**Y6Cj1;HY;UfZD@CY*W?{r!b78hLT%A)9^{a3@MwdcAUEfKO?;!(J zBh8)I34l>VwyX=5mo7mO#?d*L#sP4ii6;=Yiy)L@o=- zeoh*zuV375RL63UjSV8Ek4z3)N}LYX!D7VE)AcgBPgM${L-AJ0*#S@=6$;&JEiP^) zj=k`p1pIzXF96fYPBHC3I-`?X3z=dn(>|%akhzrfmbK0ELm@Mz$c0SXgJAFMbgMIO zV2>8uvDQ6iq25E0$T&KI4j;stUfv1d8HdF||c@n3f0~ij`GA1x~C$ z=&qb9Xz&q^r2-J1?&;Yb#1Km~>Z}bS-`QIg!wPo>9 zB|O!bzC2pjB{Gb?RoKHrO4(*@8UAu}e5wn!c6YAd-3r@~$m-uA(Rcd%>s^p|@rsQk zv7GWi<8X?<+#Jt#!RgYSol!A;C!7l#FvWFdE13Rz5{jt`&onU4 zVmG^pn>_EC%6t2~dz|Lt6{E+Mj0*R(?o`yHoVR@+Bl)mY6jdYq%${*s)ZJcaD8GNE z{|bNW-s({;<}E4jO?J-S#`I8nFuhxVUfk<(4T#=WcLP@Kh-E;A#(2oQ1Hz8M?v(_?& zekvwu@%?Cm;s@}c)*T}I$=OXvRlPnYKjnH3n%yG^AuhceJ)JKF&usXPKyNDc-?}4` z{t~=~w5k^`$!dGXC5R(XI4}Tj@a`3G^0v6=Q zHv|+V-zVP4^@L3$xR!?Q_q2k*AXNPiA!hLqSEM8ivC}KQA<--RL&s~OG3*WkExE>A zUJeA;{tj;QapY69Ij!T9cl!jc(1sha&4`XJP=PT4-z>ULnSuf#@;zPlf^d?&naH2f zajURnRxjg@NaTioAg`z>1lO_P?s6&w2YobhyyHr9qs9vZ!oP~k6vS;TSdPNsLEPJp z%PR}$jk>s5llqK(hmE+QwLn)nSocZs4Yj9FSfiqEO#3HNBGz{OU7aA}+7#dA#_7(c zxN2kkVytCTP&GW>r8;VWXgcNGUe|O%<&XXwXl|$fh$ia9^!iEkpJy5I=&|Vkko>q^ z%^BUXX}{pyn{IASrml7S%By*YjBy|%b_7Z-^`spS>A5ZSpt z9BWwv>3*fxV`}eA!(zqVAI_Cg?i}g-6{6175~msM?kxNl6a1Z8_<73YxA2JuuZ4e2 z2x5+S2!cE5+iyhgu_XoKaXGfwUj#>}YC&Opx-H{cnnZk>rXE|0RvDLLoBms=T`{s^ z9VWO<|LyoG?x>G7>b-@5i`Kz@%jYSu`IJO1Yvas+<)pD2XC$`i{~k)R7!Kd2|NBTF z$@cF^FyLqV&0zb(61h5KdsAQEWPMKD8ACIa&@EG6a~WUnOYLfvzmRABs}fB3S^qh( z{$~=oe5^++3~STb8zoA$PAFJCE2$F-z6Cp_o-8LW5KZ95kdD$N;M zc1r;2N9pH*QYLYfu78}anNHEwn~y7x=XC6S7Jo3~y@hdm#iDSD6;L~)(p;vNYR$sy z%@yKGg947p;s8w3+>%ab@PB<4w*yx*RM}v>xsCPL;y~iSItB)w=+DFy7AXS@vR7H1if3v+6Igg^axGv!n?&u0E z4YGzy?J9f_RDio6?pFanj#90m#vi2p5@9kGJzQEN>nkPr^`rDQp!A~>xh#}k#z|vU zKvq@-kQ2%dM{GHz$ZIG3RL+Jx+5tu`2i_=!ooT|hh7q#p^*Czd7bF_NkL=rl>{}B@ z_DZXbPY@14wej2d7^*hths&Whz8s{A)P_q{bg%X|+bFCLK4z>8*pfPTjhDGh^SjL`%7c zG9lM)X0TtC^WjL6;=Owj$Cu8YZMnmacZA~pdh6s;*aao_C4rvPNT(NrTh}s0FNJN}>g#^{QVf{SuVYb=+?4 zg_$boOetOI@%EJjS#Z3qxBhs!bEzA;D@jkhjUoiy7!kh6l~B*$AZmPA*u z@bQ*r>S`@?!2JMWF9zIYNaG6kuQB$~vS+E6_et>U7w&fgrFTo@vV{AcoHTaCoqb?@ z?2K|+$8nFEIy=W(YZ1tgoZhr5t}8PLv1`ZDrQ!GfhfeQ8s=OGSu_%Xib!D8680fhp zIAtI{P{6kwS?gFVAFfR2hR^OB8aUt{#GP9FYTah}6gNxpBc1?{F}M1ebaPup*Q!n0 z7W0R+X0!g((ZhEtcqqh4(_94>wF{{M?E4z8HC0k89~J?Zs518E=x)AR@LlKZ?D zw&-r{?-9R(9`Q^F!QKTokGhxa5m#E>_gxdB?r+4$P<2l~Tn=@AFh~`tdzY$Cn(bZ4 zxfR7ps(aCF(G@IQ-D5*@$(S+P#sN7)4Ip&>YCEB;VIJmI@OPV_6k3Y^K?%&fVK@e?ik1Yve052 zB{eSrp&ys`0GDdwxLoP({}ka6wDw+$kD=Y4ez+Xn|2;vfsQbHAMfXmBv%MENUyb4< zyT1_U=n59z{bB97XLo!fZ1Il>d&}DMo#^=_V=vX|KQ6(qAEoyJr9Y6!Wp(5ICkFdRy&WXi?Z{6fZyBNc_OoaKZa|%b!X?T+f2$p zN+4GwX|MxcCOc1X9^Ik+ec}D+3*Th0qj~GBFI;Iwe=oIGP|@$k$52I2KU@w)e>zAN zDSDTxPMYll$eBTLK{*Q=M!sf?t{@RbkK;O_)A~8W-cs~PDFhTK(Y9Yi z{ujH^y@!b$lW$SVcI?2PhyeS^_rClp{+~5t4xFp`H9+~A#G$;>dg9jzkf5IU1$+$E z6ZFI7&=db7NEPV`m#XM)?C$};j+}2ragusM^nmCJ7Op3*!lT0&@zO)WWG9r6us7bzX`=Mq@>5&R7x_+^P)mJaz-P8zF2p0IVua**LR)RJqd1No)^QkR6R z;e1jJOjYpG(lUS&U9((h?wh)(d&$mV&Cy-TFLA#KiTjttCGJYA+T(;{P}Ls9$52&E zKU@w~`;s74q-tHNI%&2KBIf}VC#hxsv-h zw}DizyCA{0U&wz8Xw@ZhS!%VyN#oS&nK$C_;=~LtsKDw7MORHLhY{I|Z!)aoNCG18 z>L2|eudw8BNJ>}St&`%K6U@v@JFJoBQ4wT~0w!?OS){k)Kf|cQ35VgH6y5VQr&{<9 zD--wLdwlG^k<$~W#wNtQDArjm z2{el%oi-t>tS@fP-(Pe(5SQK~W=^!G9`~b5&F8wHW;oD{9rP}@Vhg}`cvl`b20EV& z;(A~IbIbUa1o76@jE)R0rylJV5!Q}4uHdWCGQ_dk*^ZF!Nf2U9*&RX_4aIfd*0&)H zZTxlDkx3EVhlBVb)`&BC7T`q>*#0r@Lm1@>Uc zcbnbm=$9lQ^W*SQ;P9%%ak$bQ{k?=ku%o{PA45Aj{ct%t`tJp)qK@uT72Oa0&G!4q z`4ozi?C3&#qbpc=M-Mv3D0+Bkr~fjwM3{4oa<~fMtK2S93gAl;Sojfq8VG(-BA2BA zKF3L86~IAT0gRQfKO9@&=tzG_!<>%$J?&n%Lvz95jtl8?IM8B;R=3r_!U}Pe!S^NL z^JDS{z~sA$V{)aH!S*d7%3w1-hAIR4;c_U0p&(VH3|y+B`>Ma${s(eijp8Jgfe_{B z3Kp&m!tSK?&0vc!pe7JnAoQl%Np1Hy&toW0kh*0xvcI##z|wl{~5dcpBg*- z{ISu=(-Ry}X>tTHARKQw3e^4ku89t6>d> z*w-v(+;z(5IgeDcQ1Kxi?XX(ouT#F%MZMlhkf=3U?ENzGamYxCS%~JgGa0$k>hQM+ z$DnQW4txw%hxEhcP=}ugQbp>}rK*!=`$OdXB@`#A4n^0FuE3`bqmx?qeuw}8?UUN~ zek?;v*!O}n^=l3$;8 z77hI&ln^Bm5z){!WbHH>`g%=7e9dZQXb(QB^gN2$>qPqf45XBRX4SuRmuC^9TlhnC zPYC=^piXN(6%GI7hztMAkSREvbq4=q%&NZuy?Z$$;J<{d3xa>|qQW1c!b9Ny`8fF9 z;#~OOwqW>wu6y|3wNUu?#lgR1m&>XU{!WYv>PW|9*dtTKr|#QV5EY%9MwaJDRAoiy z4jSHWrM>1&-YA~In4HC7*!Y?q{xgsmcD3%kd#@!RsOC8qTAUZ>BQMZDxZ%~+KTn!B zz+%PCytvSBTB~T~9Pap>J!c4pM%e0Kj^5MTSF5fS_qO6r6QR(*l2IDh6>GP zdVZkk;iISKUKwbLKeBv(Ue)kp8j;$MIw)cE&An2zGB#czr)RG0YTrNM^JMgtct z81)M7zb)30o~E`-0A0NT)@xbor*U(g{iURrwdT0Fnl>F`Zc=TUo9HsknqI1=rz<=` z%H#fq2h|cHZ#(m-A_W~CH`j=R&$y5cMXbS*R&hWYf2?{3RZE~mq^O|YHs8OJ1&o9T8nCq)(J6tG{y+C`ioA|P!ic`mP*l9CMVVA2Y z?D;d?^4e5=2IXzAW|c^R%jIVAWeuI=)rg~J!`z^k=jt^Kh;#rPb5C+^LwxXU#dy79Ip_`~vL2$}5ki(Kb3)D_ry~Ervr_H%q zi1=AYU+9iV9H}ie&Fk&M;rLul&t0q)j541KZ<^OpN+tj)vvji|`4^hzYJ5-K(Z2_f zZor}OK=Jg&E&jQ7@zH0`n-FJp3Y{olD>RR-HgADg&Sst7>8R1HxMus3d3E(7j=x^W z7WA1y3I9PxmX{2Y{B>2Ry;}CAb#&`0fZEJ|i$Aj^1UR&yy(L$G^Cef)Dx$jqWrmQH zW_=Fl=QltnVX+AK3pH>F0%YXqoQA6xt|3igF}RJTzEwCUfajrCB&?_P`C4JI8?#n}vtXb@j6M!+CR!6Eu-R9`?9l6Pty1 znb%nQD@E6rqI0JppM|GeKWpV?;j?w(Z`vlnTy5z2TnbkpanOhBa1%+9?lvh>_+y?m zYgIOJ^*qzd<0HZ`&^V^@Ac{X|v{mcoDk{`USNK}tD}{e3{C(kH3jbVOi_M?K)%3WY z9@o+14ti{($8LIL=t0*-77xa@6zKV^mv9Ie?*TzrN1`c7Zl=c#^w>#{=h9;@JqGD&1g<0L&!(Blz$JWP)wJ!a@}o*p%N{1`ocgdVS> z$4}7X&Gh&gdc2b!zf6zcq{pw(<7s;Q9z8xykN-)Juh8R5^!QtP{1rXEOOO9ckCn^t zSVoV{^thTH3O#P2M~WVO^cbecK6>0ok0bOrO^+AQL#4+{=uxJ}IeI)sj|=o@(BqZ# zc#2Zc0570xS#}qx-E@M;d@5n;?YkK4` z8vSd<$q#tjzX z28(ZlMYq9X+hCDxu(&o@R2wX&4HnS`i)VvHv%zB7V3BOFI5t=m8!Uzm7QqIKUxP)j z!D827k!!HHHCWUdEM^TBu?CA*gGH;sV%1=gYOpvpSdR2nQM4Hl6Gi${Y+qrqa)V3BCBI5b!k8Y~747J&vge}kL8QKV+S#7%yQoBI+s z^(AiROWeebA~o-&df^7r^Is`^5sK|wg?}zQE412DQVy)uHqskwwVUaUwc1X4W39HA z-dL+0rZ?7VC+Ur~+9UMFTCGTLtkurb8*8;6qc_%SucJ5CYHy}D)@tvhH`Z#uNpGyx zo~Ad}YM-Vz)@om&H`Z!@OK+^zzDsYc)mD<4V6C>9-dL+C^u}5(MQ^OthUty9+I{rK zTJ1Ewu~t**jkQ{t-dL+WMsKXu8uZ3m?MZrLt@c)WW3BccdSk8j+w{g-?c?;uTJ3Z6 z##-&`^u}84+w{g-?FaP6TCIoF1Z%ae^u}84c6wv2Hb8Hz)eg}cYqewa##-$Ry|Gr) z=#8~nh2B`Jy^P*itC{r1TJ25r##-$c>5aA82k4Ep+V9XCYqd|(8*8;cp*PlQe@Snw z)&7y*SgS1|rNmlo1HG|UyNTXdtM$?wYqcSIW36^Cy|GrCpf}cPFQzxvYBYrwT8-a6 zL4Q6&57uvQ=)oK7w`o#$tl#JoKB3>})*UfbCZ7Q7H@EH_`nUK!q6mcZO*`IAX|%=O0PO>i0^M8AHsIb&WUcl*Vi|Ko^H`{rA;8rB9P3B8R0No^9 z5uj%J;;@n_U<+2JQZFM`S?0V^Imf}SQ?LzFY}CP^7V)nGpZL38%dk^}{TS7BrRs_3 z)&O5Yuc_DP=`4_KDZUa(BfZlrtU37-bGf)ea{1W!(FvLy`<)uaS8z$iAHzRR1n`yQ z@b#^QI$#Vx9|LTKY=1>q=E^qPlHFdJ1F|)hW<}euOBKs#H5~G`okgCV<8PH`^yfNd zwD=TqIBXVrF@++}%(3SXdL1%*PXx2R+eqb(nKer3k4@I*snwpLtS7TJRDbMhwq!`}O1;cUb3%7oeDV%5LMznbUqCCrQON!;* zE?ACHUvxkp{2J%9ax}lcBhT-Llj3)07yKTLmg!sxXYy+#+4zTo8Ds7i&G?_lGyeIc z81L(X@jIg#XO?OGE}Gkal;`#zlH&GxU2uD#Ew>eI1_$@B(KWVZH{2*~bgf0wM2xOo zUGUm|g!1wVgOfyCZerLg&-xunv7YLJ^}TJInXb1s=Cw-9bnsqzM(<9F(R3G#-W$*8 zc0+dB|6+NjUzilrnJ$=a+lgs&dKn`z{*9Y0&dc*!O^Vn4E_jXd=h&;Y1L@t-+W9Bt znSE_i%nmFPv)Bn9&Fnkmnf;}tnBBcN%%=9lG5h=S%>Hgt%nmLZvoT`)WqD@*G%05H zEE=;z(PI4n;;{Yp~I9$GYJ_e3-MeR*cTn-sHmcfqV&uZ^7!Y`Iz5j@pc*iP%y1 zbiuA%uZ^*g`{kKUCB^JW7tDr?w6tqksb5fL>Impc`yXN!0q>V*^}eK7y|)WiLp(FY zoyLr+#4&Lm-DUIgysAm@dbkT-`&tbsbtaCv|02)aV@WZ0qzmRk^bwtOz;>Z|oMymr z5Ja!4R%2b|KP}JhlS#2V+6B9Jx3;ClAA(TS%QLFYI8MeyOYi&TIet%493Sn10!<_jkc+$c{cNt*bE> z!5(?;29o0LSQp&wX%$jFvc;QHnK1Si3lILwADc&ATinm&{dMU~CrYFVQLrL)# zGbwzPJa4Z^inlXK@pdk{-QFV4+fzyL_QIriiz3+BG$|!UGSW0ZBzu~**7$>KU!$F$@6z>QvAInN&aH?MjVvq z??6)gWs~6#*685C-WdKKl;>|UDgMrO!C%M*=|G=Eu;7$XLs~VaQ_jgVJ)0EMYBEgc zE9!JDb+KO6Y+Zy!$C{Q;;UHpkPkpsK(?6aR(^FkA9WsLQN&XZC*NSHG?eZ-C{K8li zG1#ml@6%my8KQ3yic7nY>W^meBl0YMC_xricfn$a%h(%Svo;&e=@;ZV{a*=k`fL}R zwr$Lq1-S3Xv-rOgWbs#$WHDw-);dMn{#k>h3$TBDUGn`di<-IC2~@%{@7C(&T&bQ% kz(Zq(;v{Zu7ciuE9RI5|U)5C2o;<~nv|=rat2WaAABPX!F#rGn literal 0 HcmV?d00001 diff --git a/it/doctrees/trust_negotiation.doctree b/it/doctrees/trust_negotiation.doctree new file mode 100644 index 0000000000000000000000000000000000000000..ae6c46c1125992117c47534581c8f705975a84a7 GIT binary patch literal 68980 zcmeHw3z!_&RiFRWK>xBd63nXn)yg~yZOG5JPvgARsB(Q|=3Sh$KV+kzT1jw=w$OjuBKv*8xkOg-C zb8g+bx2mhVt6McV4)JH*sjj+p>z@Cfd+xdCo_p@ItG|E4bt|r;|GXRATFI_n&YHzy z)hSwT+gn$33e6>}+Gu}Y`<`!YzoEU;8>yR@T&GztSZ(h*|){YtOYyBi^br)@Ax? zpWNTxrdoMxY9^}CXqPs)^QJdyHX3z%zS#f?ROOX+(M9#VwS|i5y10q!)m3vzT&*iM zYwE|mS-4QQ7C6ty<)z92w`LNl>uPn&wdxnGcGFwiFc;~Kc4@Su#g%t*Y2nt9@*Ba~?$B>Ne-yhTQ;!PF2erpbzx6 zWwXXJ^Yv#8w8Mb|Myat>867nYzgOVj9e`@hf>U2Isjl>~c4>R*u4d`((s*e{X=mx4V{1^ru4YUD-u3hK zwkeCDSH`qgR+e5_S_!J}6?_HCUQLu0N><@Q#x6M3XAFDET(m%AHk-r${L9T9aq3@ zz;Rr!ws-yR>9)7BS-0EXSaQm!Ftb{;i>BaeZ^c-<^g5SNeGCmS>mxfF*AS(rVq1Zk zx1$wKQY$p8s^)#$p>7rP6|2#(>Y2-38{tII%m@2G-@CX(xNp$wAB+5sF33ke-Y(_e z&@P#!Zwinu`ABb!Mfy@K(i=%kbRc~{A??=eVlQ^5=aW%XrzC4DRCmRq+U4y;AdUo8 z(-52rcz0_E!Qev@upbBjd!rB7jj@2eH5RZNV*z`B1%z$&Myx;?l0cS;g{<4_i7*@G zx4AuILAx~sn);MP?Lz@-@AOf-DHgR4#G-anENb6Gs9iGaRlB;F!IkLSczx4y8>S)0IP)q7C(Cf1s$&#QWI)cM zRd?yFCCjKfRs5p?!@g(>&^CLoS-vj>gV;yo1~G3-C*|>D($-k;>T%#%7@HJ$GnID>{oIbdCnCn?F*8ihCt3jP^t@ zdRc&x#!#3W;FB6sL9Xp8S3bz)Gg5kZ?P*KAUeOh=65)0H;mpj8g67htOIdRfy=Kw5 zn6=SyY-oQuOd`x?rIA~(A#QSzL=Nsd^(%RCqf%L1%m-7TyxDA&oI2(lmWysxD=tI; zTU}Yqn5KqJa6`dxPO{DNR7iqjbOlGq6iATS!`VYl-BJ+s6DtMeCV`UKy*Ey#tPiA6 z-O@1dZ)fT4PzTy4kr?>9lE^!{61l)VMiIIFP{p*D+>>SgZM~jKH|7{uq z8O)IJMa-tf7d1ruY>deE&TNWTjtq)Wd?h7ZcXoxV7=`P!RkzKGeU%3hcUZK-r9{Ab znGP200owO8to&R8tBza>s>8!U6{(>_YI|3tUKd5`(I?NGvRJPh8YZoX2u8Q+7?m$I z>i(BBfcz{1pl}w2&dhM==oORD+?5=f8Hh_Cn_)RfE20-PB$$0{xBxHT96hZw|! zsMO1dFxX3U*aY{8Z)qIn=Mi8<@+gQN8m{++>Lz(?M^}70Wq5PG4E=ZZ@R=($YiQwg zI#fyoqp%DYIbkxS?`bH7Wq34~!f99;9vhq|z5y9~c^=n6e^Z8G5HH zaDM7m>f0J>eqJf5sGc2p6?~5l*9qh34`v`^U2%LWiX$O-q+WN1);xm(B8c6hBgXX8 zS2URX3`#~>eg=ijgTrB?sw5ff-mZW=p#gHrTD0AUFi<4trMmW3H?zh~J{Wpl4GRBp zHu6{jaWE+mdI_pB5{6w}VQ6%L0TT=2-^T{Fdc;;FQd)##q&^UORrIwOLx|J|^xT-V zP;Ir`3c};p1Yxx1646XoL}`&FKPP5-hi$juT(s%~SVW5Q71fHoY#La~ZuD6y$f)s? z|17INQ%D?0ibU|bs)M9E+m&uzr93Q&*giLm<*f7j+fUY=i#Cjik|853bbAz(j1y}` z^YbZywmV&{X~%{KtFy8ay7dig zL@#+~sy8}p=1(0Rs+dG)a$s~)>RD3>de&6$o&|K4p=VK{5}m1m(V0$*cc%OHtf|a& zubu^T=y}R=hYFSGOb?9Cp0v=3F6;zSH;~FxnLT~bq35ZiqZV`a42aHjT5<;k_2r%E zK5~c3NF5z2RPxT=uIN~-$oMP7!9YBnO>NZTq9O=w4HgEaWS-81N3I};9M?0V937?E zq*_idl|vLOaoRToPAN%fsz_A(2~Y_78R4YsKS7QVPGLEn8cs@5@9&D!xmbQmNfJfn z(3TE9(xp)FG{7b-gA!Ywd-0EwKnJ>F600?5_NFC)P*9|Qb;{?xeIyW-q4%v+v}P() z_N@E5q7yHH@NSCubRZP;o1kX_p%6wvj(~f(N+Fa|=~<#!iPQaEaq7lJDaoI`9nvR` zi*(r&Jl7BkOP-XtNXeap1EVvUjt;apJDH%5O@ce*Bs~rtdY-ZlL=}^~^T5F9Or?d+ zR04FS`k+J4Q%7eiKjC#+)s0!#$eMb6pMgX~g`94_Iq+sHL*6~`>Px!vQtCvxL^bL422VW)3+gppfseZedg;456^ z4It$9YiI0Y4S8bR$hPpC&C8j^pcY!!q zdfzH~rV%QCE6QG?vr4EW*}#Xp*5}PspNdmmg#Y$Mr(n)k;K&Y_c(8W3jrDSqIbBk7 z<%zq^yjW+*`g zQ!biUuVP!9*<4t#3vl$b$O9X|G19Hq6qhpC z9(YC_FS18OFMPYOx9O#;0@me_~H=0#v$AZvQ0c%XNB> zuPm6lxb}Z4>JBBMuFoeWiL+fvWKWI5$1|soJa+Q!Q4b(ZF2nnh4$Ym4^z~&L z?;}WUVjY?7hmqCw&L;}Hg2awQ_;OWLVtBkOhO`wH_xE;e5qpq8J2`Vo!PRgagh#Ng#sZJT7)y$EbD@!;I~j+3;WF@W&WumR`Dm=f zBaL?dr=og~WR(HGB3u7NS3=nL#C{mtkf;YKa)hqixvS5{jwSfl(3Zbohac_28J~=! zYeZy^v@G4s`pvCq?CbZ}@6(dlxvs?WZX+T#Z8}#`-LwXjzn6i!lU=EM4e{iha6ZFW z(Vs@?5j2I_KMV)hNtZz!jb`1f!a6{WI(s;_RY(2y$MB%h?BC6byNdF}R;B*ckS+Y` zt{BWS2DAc6V?ki+n$GS`4u|w(k~_=9KC9CWbKb7dZo{zfx+M_%fn8}jvsc4KWzegG z3<{#ehNXU0lK`FS3eY|R=*Yw#-&l+NyCmlknj{O$P_Awja%VE9jvUGy$s$h%io*EB zL}nJVgb3NIEIik!l)n{GkOz(00OiZNpYB@s{Z#ka({uawjKgtjd|Wd)GZC)CqStL8 zpoUp5=BCE??Tr<;8*JAJ3ekv&-dDuzkOH{hha?qex>7;mQ1Vb@=Q4+#!v4u|ZBc;> zFPILuMXfns@qOIg9I|q}9v2Gx_+-8|Nmd9KQ@j|9-3GknWU#HDvWBP&-&fQHqIcK| zNU9(2O7$tC`q3vfsYDy9;dfoQVAa*IiCX7qhqyj?mL1p1lo6L8bIF>|n3YA^^;%kT zBOJN1d`TBa{!c|@AcwB~!;;)5x{}MoDt4?XsgwAtLRSdr727kyG6%FZw1)M6DpG^R z=xh6^B=gCxWcsbDDcy;`7;aUoTBu*C(f0VxR@EokAT_*i_gY(3`>-VUY*%uR2_`-^ zM5~6$yPoC|yQY03nZqZYlS4GB=&HpU{LLrEBb1J+hg!Ra?<%?j z8$x2bRq^y~N$t~JseO`ocaEt&HDLRe5f{ew=P-zt#zEp#n2K-%uM_pE>#eNcQzQ@6 zb9+}oQvcen)Z0AhW)Aa6lMyhSwhAzeKQSw|SWi&idfHV1Dr@p{9l z*#$QB*MwI>t@*c0m)Gdb5UR{>DA3b?`Oti0|?z7 z>13gIG#n_O-piu-6gWpi;3N?Tp|XN{O3cizn6YhFn2N46T}#@EAaNU3F#|;}DQ59+ zXU6x$G0E+{zNjPCC!azr*e}iO)D^KlwUl_xNAMc))rTPLBPw> z4)5_?331YL^(OXF)pM7e`US+pA}g6~W!Of5xs4lli|=Czs!?ycjeONwbQ(5qZRSX# zh*Y(TgNTk$fP}@mSu5#u{>f|*$j!C12yS+zg3_?96-%@TOXd_2K&A2gyNsf3EHxWV z$EZ^*PRA|S6vh=1-z?j}2O3tvt|5e(ZJ3qH4t5ryaBxl~VH$*kH48fLgQ##l2e z29?d;zYSsoK72L-AAU12;EwVe=nuzi4OkL^2yEPyQO*3$Qm$(Eyp5-<$`!;9G)|)F z{VB=j=-r?`--}lh_KWYL`f$IHRYL^R^0#Q;K5HU6@odF7bQtKFxo}N3wK?$*8d=Um7$EfT$fPioZ&Ld1=%>k?O%l9k)YFJ0ag9pxo z?I~P_4GW%SP{dysTv##0`)8=%88Zlt>eTN)!hsT`T|~!5v_ZSd@sgDQFTbBSh{6PdA4B-5n*1lONjSps zPHz=g$6M((iUF{biIeB;Ko5503Xn4R5iJqZi`SLrF~qPh1n+E}I}u zsKzwF?VwUMfOtuL;pKRGZ4K};lrUri>>Q#2G=}F55WV2f4LZgI3W5OM3L?A8{R_I{ z99CFJq)A;NsvvBKf)I?qM-ByAfgC2`=*Ip!q&F^I;FK=0O!3|GLdhhsW%R7(hR>!u#u`j$YQHET59Qv_|C z3Bl8^nuE!gjnMl6`$6jiTZNg*ZK|27kbuyD;m2%NE~2nXFpCAVSK+m2V6EN(hl0N= zj?f{AnTeyJuEKrKs$MmXog8D&7#o8YGB$Qk);J!MNz+F$2Qx036@>DjV*J;Pn*IDo zjd}W@>^B@E90yv+_~I4rHi#7tA`vef$~I5+&~e7bMAtb~f|@io#-pk26oC+RG)&J~ z=QS4>ZKqxZp^8paKz#vN)a`23xhOl1Rx13DE6{xblPRK_+e-0$yHI?;78^y4C#RSd zVaQm6IXj@!wdu8fBM4o2v$qm0sos2T0w#V6dBC~!5mp_?2W12GIZ@H_(sjqH-PAv}$OfJHJ$lN_BFF{6hC2cl_gj5jhp1YzMo02n;=9vg#SwqX~I;5H;s?;&l}C0<1dFax=;ZtYJGi@bZ?A^7=WFSb|BR}@9Tk- zpp}0;0n>$5u$x1zTv7++yb4Qbu?N3MTXQ~$EGLiM367MS7$3jeKc7Q}+KWzIf@7Xm zQD%A2)ArE0FY#aU&wwfaDbY&n8}KR)WN%>HIT4xtcz-iC2+x8+VZo)<4l!Ff>Od6I zv4)>q&kU`RIg4LmvK?Svy&9QSPMO_1W9<)ZdeoB$7=2X!c5Zgo1BX}{w zEx@)%YG4+}UXhJy#9N1MS2EF6G$p9~=K#;2j{o()EnJj@{;LF?<%@*V*76tdrVN3^)ihqoAXNUdK;lz(-HxBuZND>kPn#i=nM|uVoGI~$b6-*j_IoaeOD!J@Kp<` zQplmJ<9;AV*01Tb$3&-c{)*i?WDT!OygbtN&W>Oz_v$9kGtdoWEsULWC-0$UGYe*f zCNvRT!a&dK6|9rME%EAA*#Sg{NFqPglV6JovOT==N91FA{PJH3PSyoPjaf+P>^`? zi5V4jU0D|Txu_{@`sR|Ho+&-*Enh>Bs7~=xZuzhdc1K^tBu8!QiLCm{9SQi$pJh>n zSWi2*yv-8uzCb|r*yzaB+1CwpP1y}lRW*jvhQin}G=M2D7%(rHh8CRShtr|P(`;xw z?fX?Zv>v7AkwdGbtozXVTQsyv3j6^J^9JswV)#V=!&z1^Zos4fT@8=WS=fFf#=2Ua z*1<12q$Vbo2yEwo*#_O5?K#}Z$)wUpAN5T@IGhwF5;hD;Yb2Xg{E@T#myr2#PF{W# zi1_2>C%>+URekb!f=N<5*n9p?c8UF$3Bm zw$ISsQE-d{c0pQjjGbd+es{5pu)VQrwnMHXkNF2#jOi9@=tg0mi?JEFr_#V8mUjI! zI>u<0U@a_wLz^Z(7a5EE8BJL6imrN}I;kxzBRm$Zc4MY2Mj&Yq4;Mk^b&O^gB9|>ARy}g)# zi+ssWA7aUVL!>EHX?|VwuIP;fEiLPT#Y#S-N4<9?K`ne<4r;NjC*!EHOiD}iheR@L6+Ak5Sd!0PZ1cjHge*|^+MdS6SPO5U>9YfP#i`ef# z3B9!Lz?YzN5&Qjkb0Y<1MrBYBUd|J?Ocd; z2vFhF;~SLVv;;jwSgAW?ELN7tKvf|t7fuUgodTkIC+M<`)4pS%=p?Fy`}s0Yg*|Zo z9(wzvA8Fq>eB_BE5aJ7%EYPv0l^vvuY4aOYj@2G#IAfNM^5E4U%rC@w=+a3l zT!V+nU`vFHHJ?cO@xTRq#f>x-L*7A{6oy@A%H1oiZBFbouNn$HFMY zHlAI<1ObOg(;5IQp33^r9ch>8#Otr9XL~kFvy@OSwf=ZQ|$}Y_(T-1%5EzCX0Y;1E-szj^y%H_^5`S}lv;Bv5*{bK zy25i}^df1!jk=nV)wWNsktk?E4qN zR)t+0!IHgnb%Twn!`Dc2EAp2+3Bll1-^0k4X-OQ7b{Q~+k)|l=6wW$U9YPO^Wl%D9 z@i^>}7ul2|vP&@~)F5Hr3Ut16%i7SYAC-iB_!a0V(w>GX3HU$?gcZA0=31o7(42$f zR!62JQ&EV^Auw8%uwq<0yKw=4g7(`;>sIP7k z%e&~iqp%lD&@DuV3(F{FViVGeSDJ(gF1{CuITuEKe@hs8lOHz35ra4;PA}Bw12n%Q z(qW=KrE|FgXJmCl^X$FXUw7RJ2)zOpjEU|7d?=yRK_bK1*M+tOU&K!Bi&wf%&tT-D zS$Gl4=8c9Kcq5*f!LBw4Ro!326uSwwwaD2$DI}XR!{+3lPG?d4>=q zS4u$`*8_`KEYz|8i5v>39!nSx>?KU?5s?O7Dp6k+xMh=XR>j_h+~8~SeIc4q)xfKC z$-JDenT=Auf-QlK(%9H8L#%zWehgPGv;bMy=POQuJZagkAvE{CizRiNHfq7&CS(=o zeiNv&XFmk_`VGFJ=6n(HjT&{|CWh#c8!A-z4z`jb_6?CIs-$-%5J$cWPakC!e(_(6 zTLYmf=pAGT!r^e5&?L7SX>-*rt#6*y=f6SM68#?$mw3CQ+*%l#s45eWo5$Aord8+3 zYA|EAd3&UkIESRF%NrC)hzJc&Y`V;fwPN1LT`}jaie5$7e|_VaZVCRS1kLt~$O9C9 zmYXfKgy+5KYlH4UwcR^peH0)6CIb?l)ZRKa7TZh`(3@hOsuF)E0mOdKppSFU*e4bT z*=8~j2dK{qLIz=VoYv+yvU;oh-=RwfTDS++3H+1FpQJ}&E&OLdK;SQMj0%({ra&n# ze-wG-eBkU&7(X6oJ)_oq{=;m@uVePZlSp(UT9S>$d za58{r1aEu7Hhtu_c=Kw=U3C|Klb0~DxIl+gI9&Xw-;c{5)1dM&Taq1En>YOUeRwz&#wE3MUs1VeQs=yf;9xfktRz1BCD9uLEd((tYX6Ki(*X~ zf~=&yq!kLPPBTM?ee_AL`>xe&TtB0QjtKlWF^Q7#OZ=&&;nZq~g{LNOkiWYBKU{@Q zOTVBQDS+!(8{^q4$~(%@9b!Gb9t1+ZeEoy3YvNUBnn@rxd~cb9EH`?Kn6T#;&OHmd zNyriU2KdoZ)N72|d>Xwn@_GIv;v)Gdi8C}g9`|*IzGEg>vH}ao*%{>UnjmK|p~xqI z(07=AEiqUql*>br(b)UW*^VGYVmgnlS?q^Q^9a~sY{UxzKuvNfpv5+HgQ7*-U}*c6 zqhhRJ^8fg$s8V^S>$@iXEo@yyZTw)Xv3S~7Y zvo34X77=Zy>qdBQEksHk&f{$?sGrh2L%F~blCTzXv?SFRpLrqaQ$6-0%$qQWti_Ie z>`x7u8t&+egA}#fdg7%%_sa>o!p8(VQq5Sy-9J3o0dER22jNW|J=K*r*NUK62PE~u z@8El%O+aUOn8m3^+V{{P>&e!8A^-X&+yXU0dbWm{UIvU?)mV(ZtjUTb`HcDoCdgo9 zDHH0otaaJM22MKN2@DLT)D}94Ycb!B>m;;m^O^bjGowbg(sH53$JrJcy{lwLM-x^z zR9QNo$G&Rwd4O~t6-5lprBUzLg8NV)8k*Xq2?e;3r>JaNo2a;pBlIMXp0uPr_TKjb zv{ndA)$;w?iYX1-2H*RlsXbSoydifatg;eJU*Qg0{w4g8DunmaE*PFaFFXD%vAs)` zdfiBWqmD1`r~)kRu;XZuuBkpINGMIn`j@8sY0&EX=j*u#RK_iRYUQmFF$UYE8E@qB zQssbKGvSb2x{LIsaXR|PkE}>vBu$v>y<${-Ar8&yE@<}VNQv}BEYiK+RkgXh551%V zMO#7l$rIEJGI-$Rvhv?^gN9W(U5BHu{w)ExwfrT{TK+ryk&Wm5LLwFpVHzvhh7y_m zi%lXh!(!y;U(5srlI8A1R4Cqin0YTOSMKT$uM#na#`v)ftiCmuoX@FR*CuTQVF{#- z*{4>Cr44;CR@%g2{9u2Kd$O>UJNNa2zeg#mWg2}j&?HdMGP(p36b>SRD5k<8ZsY+Z zQ1=gbYlP<0_Eu!ro%ydwas`1nN#6ZA3$fl``$ETC-KKxrN7RVcvd-Pp5eRmmWO zVHop4XwsMvl3#$Dk7{im_z}H$DjZBw-j#qW!;=)8wWdu{Lh}9W#+9@JC^rGq6c|%< zEY1nTSFryP+h&CAi)ZgXu-Zx;9N2uvQQ!}onD3B--8BC8PP7bJoloh(2CzF1JRk!g zA*LJo%1{-^ov8%gfZZFh!YLAf-_$!CM3^C2E-FcR7s4(w%r7uCBf>ZWCW1G}8i9RL z_&!(x+o_s}HK#1tl^ruDXDOSQ`v{MLoq{l4uZp2DD3)FQXwd#+3#*mn3r{5ph+zbwP1iEC&)7=T&7i9%z#A!p2rj; z)8YVt!lQ#ZM(h(P!b=yN;YVo&{WaPyjIW6e%`7Qkzg=insri_3d>R8-0#nb~U*ome zZ}f~8f6q`O`UhEdhGGnOH%2>-R3bKoH%zEfema2!_7`sGgQT&Y-3xB|Mvok>M+QTm zXuj_H4k={ep%14pYD1s4OnkK4GBM7%$jdO#VmY@!5kKQsjE9O2vNN<~+~a$4_4xOR z-#{CO+>)wSpvHBC+{%xg!MNCK48sUU3YCF@b-rm=urDxJ6*I%* z7@c9{Z=oZNL0eCinT21I$V}Rc^hD&$Nmf{~QmNJ9X5WjuZe?tBep#?g=BelK2w3uu zC{ZpJ)Ja5OD|slijB14gTGVHv>p)oE;}g@`oSV3Dg|`XEnqb>|Bkw;t;cbw2_#A{2 z-Z~df%vct5aqs|n@i%OoF3ry1&}7=)nkURk6U&Ek*F2v`bHW=DQ8%$wyNw@EaVR|1 zQVl=Wi!Z^HTfKmvqyEoky@FpG8%`lVkE1y0DZaQGRjXfVYy0%o!(%JFjdTOWRC`DC$Day5b)H-VsojM5BLtC@(sE4N(J7) zcYtiwrKVT6YOd8RI(b-6k?Tf8D8`wsdHqf1kU}GW5oa<9_Pl`tGMe)hB7}N2UR*2t z19uf~1LzT7Rt#LK+ZhY zK+r;1yYklIe&+7+DL}dji_ekb>5eKsIQOpi8a7TE!SU1RM8!s_eQce#4Q#oTmmb~f z3wdF>e$Knmy#nR^GIkL!mMZuM9$8hPz|!6Z7yI%XVx7$eP&e^!UUoyraQ!FpyI~&~vbXlnYx(Qn=0eNIs4+hL2%p zMO9kGLJ4fMG;bBrgRh_pCCh5yBexWg>q6eb5i6CvSuE1gJ*Z#H+e{@>le<=BK}fad z5E{FBv5jG!f_jiNK^F!$lGh3PM{D8N`mtPo`V6R!k0M%%hKHhno&f)%aljvJe6@Yg$ z{4^*yib>wKxTal+W|Lhd>>}0DTT9u+_0H1gOP?$KP3f;n|6KZNc@+9}c`YTkQgSmT zcTsW&B@>inDWTvc<@+c(M#&?ToTcP(N-Rp|DXCN9Q1UI5JVS{`$#aza5G6lA$$zBe z-&69Fl>7uGzeLF|Q1VGiew~v4LCNn@@&!u%gp$9fc)TuR7rFt6@zlUr)&vN^YR!6_ngg z$u3Inp=3WLdnh?d$stNkQ*x4$^OT&UWQme8C08lAM9G^e`8G=0lzcBG@22FPlzfnq z_fzt7l>7`OpP=O9lzfJgPf_xDN#GquH zk_;sWDLFvNqm(>M$&-|vp`=KONy!R~p5=dm8d_cr_AXyf$!lO$Ek8lY--6BA)4zN# z{Uq<$@;_4MFO%ZxjS$b%X-uMXf4)`vn^x(cTg>t;X7?7edW+e-#Vp=p_HHq2x0tP4 z%+f7p=N7Yai`lrvEZk!DZ87V%m~C6kvMpxU7PD%L*|fzh+G6%>F>AJ%EnCczEoR3S zvto>$RBeTFi1SX15lzT8r7N#Vpoh_G&R}wV171%u+38rxvqPi`l5f zEYxE5X))`xm~C3jGA(A87PCr=*`&oR(qi^#F>AD#En3VHEoO%nvqFp6pv5fE;^uF0 z)3>skMo&SZduyS1h%5(iKasX}V&m^$=aL)S9C!mRhf+E0$U|U9r@x*>7QtK;p#ZqfEi2;^c zTj+|V)+^|WrPeOGVyU&Cu2^avr7M}rz@6P2kDBX)}wUAQtL^&VyRW6E0$WXrz@6P-%M95wcbKkEVbT7S1h%Dl&)B6 zeVDFTYJH5ZSZe(SU9r^qEM2kG`d@U#QtR*Nilx?dBy?D6ZKNxfS}&t3mRdXLilx>R zU9r@fp(~bJC+Lc$*3)#wQj5+96;kWF=!&HlIpOmrBp$Naai0flA<1aFnvi7V{m+t& zXVmP{S$-4bT+`dAYkn-;%1h`$QVA$K;)kyVY%JJh$Az8)t$~$+jimp}GK4;)-x2ws zUPFtd6{bMZ@iKr*0WPS>wcK2u02G@A>;n{LCGmkgYILi+;4B6g6fS07bx+*J|#XJOkDKawC!+{ zdj*mCm*nkWS}o6*4K4lnzP6ja;tXIs4O8l~=kB21t2!`7_>GOurwv9Xa z>|5Bv?=)-|3sg8-OUC>wYLWJSIyrGaIVf@E58;h~v=WYpq?t_n*fz503`pRC?gVbH z*T6sxlcsXLiT!WMiTz|+#J+q8VqevRSh2d{&$=;_y3(8EzerB<7t$j66+@7GZzsu> z#f;gfL07F$+%;Dq>p)$z8}}MRP&d&@o$&U~!hB@)Zo!u)r}4J5XuM+x8fSXaxScoK z!c0=9xq(&hP4m9wG*72R^PNM`9M@5Kw-UGOc9_R(1mqAwq}|>mpGr>hTv{Y=AA;nA zy_>mw35H*LbcMd^vpYBX+JD}IOU{!n5``5|o{bE}5-ZKQfM|<ug^l#bwlhe9C zEn0UCL2LIBN~aYHC*p!Ol1&VsNKX3cv`EhkLHeGq%^V!E*PEYf$q8Lbi_q*4gg(@t z(CtprY5#X5C;H845uF=?=&qfZd~o1W-oW2}v&H|AoYr@zMeFzwwDz*+$R*~9?C##& z{ENwn{kgP=omeJfC$kg1iT%Cg#C|3%Vs|eOv6-oU#Qtq^V!xCYv6IV2Y#%n>uraYp zHG-_Es8mzSM(lKNHhyJtVz;M7?DVn`yQep?uS!nr!L*3ovrNQJ_v^DyB`5aDw20k1 z1hMzW=oWr70a)yKg)1|i?JJKP$;o|vTIB9qMsoWIsqaco?px9#cmELN?n}_ReR}PC zl9T$QX_0zh2vQU1P?^2`dhM?yC-!4$5qsYd#3t#rAhsX5|1&wcpG}M0`-dPmS=;vM zvtLe5?BAtD?7?LtcCzP_rea$yi`ubXvsD3_)znNK3BPM)R_PO}E&f3TKZ#i-4DtliEy+ z)Q5&3HO4YS)LBfZNfZ<1y}RsNlhgX$Y0-LU2wKNF6)0?J??c>=CnxT`X%TmL2;ySo z5pBgg4)i zSV7v1tf?qSj|@THJ)Ptg%s%obo1C_L)1qy52-;%C%wi?u(jGP(`dbhYCwe#IBgsiU zk`}3t4nb;+M<15f%|05zd~)jYX;F7<2`mOCBq#2V(<1KV5X6mlc0S*07;>~XiT{$E#Q&QXiLV}l#5gYz~4VP-rYj^{byibrT^a0Mx>U7u zGKuv*ZFqZf0$+-(spv1S9fH7^Enaq}n6)hgb#j03;TzI;0LK`ot}*wcr;Z%a2O^7UrgcP1zL-=#$~AFnmwZtxhQi*<9Mk-5@zEh&qz z`q;3F8SF^xP4v$sC;C69MfCg-Egd6?{Bz2B)Ay<5^!?Vg(I>*k`MdnJ(O0}BBON&o-= literal 0 HcmV?d00001 diff --git a/it/doctrees/userinfo_endpoint.doctree b/it/doctrees/userinfo_endpoint.doctree new file mode 100644 index 0000000000000000000000000000000000000000..92ccb5c6a58db763b513b94511edc5537b52f83a GIT binary patch literal 77238 zcmeHw37i~Pd8e+?F*>fy5}dCEm^vR{?jkhss**Yke2iLawV^5Eq!&ql55N< z<$CKaty_Pr^<-R8_0iMEoo^pf>pW7oF{yt zN58>*r}mzDB%Mw_dMexd{L^p8zn^*j>1SJoRgbm`YxEVzl?6&Q#`mjRlq-E@RYn%- zt-?BOTGo5zdcCGjH|l^uSzfN@HDpg;l`F}bhL?EmDa&)l)9QSq>in3NbEj*{4EtHL zFjv~6Rb_&@x>{2-r8cj$8v3fbJWC;3h2FyE!g760)}{%+R$Ag`RXQg=+(GI#Y_^ex9%cc>ozY<%6Qo4*Y50AUcU6|M$Vg=<0n_4s!q{@sLs zF9uaBXDYQhnes}BwF+AcH#Z6|DfAb%6}A^{J+u-L>}Ui;pf8)QwPY(A3ex8avb=Ch zVL4FWX2=zg-A~AJ1toV{QgfB^6Df60o>hP`ozCEY{-tHcE7_b{%axSuY)w(hSq?BK z*G{Lk`B@@j&lxpeFYHMTj@WGUa9B4VFTK#X4Jt!9TP~MCSg(Ty636*!>B|O3TKe)v zO>OCY;>aj6xtv$?vLV&_(!N&VF^yQg4+St`GTR$e5QUS0rNF}5RtiU`6dGkG=dtBb zQ}Wr8Qm-pDX(6-_ChcOrGlu%;=!AG*=gxm1^V>q0_b1*eWS?vmjRlS z6Ug*>QWI@V-$6`kRW%|xMO$Rg~m zHet`0gk2s;*qZ|hyF8GvyI4V}N;G3R@*qN)6i8WEa3RimIW(7NAZb^7NOO|1So@I8 z+B;3wt_Wo91A(kv5y;xhiM2Cwt*n-3CA4`Ol&YlG(SRt`652K>*yD|QT}{oF)D+sd zxvH9i`mHNvG(#!1oO-;WXmvSdwQ=$}G)_uNtCTCLybKTUnOABWg_=`RM$ao<^*2+q* zF3l*AB1lc8EDdD)(?(x|I)hdttFNx8`5gH}#>`HN=bhbQK?jc8*V`{7ZE9No6#bhU zExc4C(P8}pj(d~$<8Tt84a|2L7=xD0~^G`aC*S2bo47N0;F0MRoO_)MTY%- zYprT$#wo?Z*YpDyz=$Vf7CSErWoOpI&VIXev*TrSanB~j(WsB3>uio(0)?>wl5{a; z``YUG%G$n6K}wFV(U!&6O`&`hh_Ay3q`i9`YR;TFla^;uYi29+X%!VmMei?zL4@2W z)iX0H)J+DOsDk&E+S#n}qEwol&DukttlX#E35WZA`y{lcN) zQA=zVCqouFsZeqZodOLqF_zv}sVNRcacU(8-=t8a!JR=mWv#7+YKn^k^L3g+dn(W_ zi;0fYwLrc&6yyxo7zgCmeI;3)(~ihB3^vid?i@5D_DAC@|La{0NEjg_MU1A66kUv% z-k6cC?cN+&8Sj*#;7nR{Z3(3-@2BgSQd8xUdX5_rty{LdvG~Zk&P^8P16=93xH5ei zT($Xfs2b~zDqjvQrnZJM^_ZWjgC~w3Rk&Z*HBGK4d>mcv=BRk4UNcj25oCHX2=aPy z*xB11JMN5G)Z8pi&0eTWlbdcO$Q4BtHKdqLZo;VXdbwa~+!?c|c}XZWbAG8Y)R9Tf zB5S2BZXq(%jmcGzax#6pl~aIkhrfh%)GeVLp7L{O6oFR71Yj49n4v1&argx68aHi* z^cZQmB+T?Q;w)b7(QOJ(Q_79lj4!^q{G7S}Av{s9aI_IP&Q598v;7l#+`e zj}G^GaoFinhr2UoQFCi3HC2Bl+gDQ2mnTuAE`5&s16^|z5SNdvl)KX9*gsV(Cv6vN zre8}_Q9j%JI`kdvt`Y{}w?`m-p*)`S^GFPi*J_ond!BX#KE|$cGsgHS6&FpW2S-OK zrU!?cySwAY$&w{lw}le&po@^B%B-r@jR^{IS*p20g-vT*VUpqY>!QN^oc4Woh`3Xf z2zLxlW-J6GNJ5EI#QF`XUv-7Z#R=6K{Fwi8nWhN&8ZJ-qSgFNv)eRXi@&~^ zkr7ccC}g|P^oPRsPP3Y`quGJ+YRS&dP<9mV$e1g{c0)XpPOR19sC*1F;(@RX2-ri}P|KQ;??JtLmn{U6(hhbOO|PK+lCr%WN=Os=_0Xm^ zIdW?u`>V~3R|g5tJV(ioqk;B>auV2UmUbqkfe?|eezoi8oiQ4S;&9ikM0(8>sa3OX z4`nA<10igJ{IoG-*BiTLfguk^whvo+I7=Ru5~*26v=&cygz^+7MG5Jjoo(7DNQ&IL z$NuhO$g6o0k|Ia%+}SZZL&@}kcBY2}>evvZ!y2Rqu|wYz?gLTAEZMoMV|IpEG49Y++)<2hVm4q zff5>p?ZjZmJ9lc=As0u{qcDoY%}+ua$Qgz04Q1yX^?Z&UnHWnw@KEYN1GArWp2W3o zN*lIlbGEgE>`aw5Tw=>^J=3U`Dso=S4E7HWWcqhzXrr0Lo4&CljJEaGX5?HBdxgt< z0ED*vs*;+o!cV|9vP~Sau^`Rbxo}lI{+enmqpiZ^X_s~0i9md3g#lug+w*oUq@VN#7qzI&Xy- zpBx(4Ee#J0O0H>c(p*YiQ`42&EOro=R4h4W=moYtXW)OhzduWVcJJn2185a8{ex-x ze;_;BpTSW(`b_WV`{DEt1hoQdm9m|-i%j2ZM`p8bnO%(RS#o+Hl(K^)r(^d?`zFS{ zLOCm+JBMR!a${yj&0(XbLOZZQTt>~K%^VoX3=C$5`ZEI~d;53q>ffEwW_{IqWqwY= z86Ou9&Krkx3E{rIzGf^mso4hL^^aum|G;Qw04TLeX7>>AW!iU- zFVD$tb#4B1(CrgK7n7s~aUv8V@6;GOEFBxa@5tea{S*84o}8GPoam%L2m3Q9#DQUe zKhWPlFceUroAM>-W}Na-ArX8IN_7=(@K=Y54hlLjFBS_2Ls{SrE-l>D>!`U>X97`o5JD~#7 z{rx+K=ShmL?PX0E(_V&g8$^Czi0khK~H%C;aFXPXAC4 zt~G{tU&+$Tv{~E^#@Ky-aYKkBI}Eq?2GrqfwK~m>r-(ofr!&)n2pw(LA^?n{U&`TL-!DtWtb7tP;LI zl!IyJfL0)>EwJahM$$XQ>9F=OStrYkb5_Ud^0Zo_(}rHapLt=|qP=!1H-gZQny9}CUHAR|K0(!%~HT|30WwPhoT^JC|Pu5r=+n;Zud~XYf*tC z&&d@oi)v%KWbSd-GVsdwdNg#{`-igCA)1BIFvJU(v0H~w6$!`s$*TvQ_q~J8R=wS3 zz(V~%DC(nx`rrwdR-yyd*ms>ft<;=m6S>aN32}GhS*&P^RD@ju>5MWh$)#C3^;($I zd=k05c*d=c%%2WOTMu1$!WP^IL*a6>iW6&&))7wC=quQGjpG?!odaxjSHYS;9jNwV z^o1pA!8{QP(=1h2r&~BhZ>cKfTor`s(YXfsNQqC7h0;Wge|xag~B~#2=SpV zO4SSZwBm0@0PM84Na?3jr1r6`E(xX-Er1V)0%YBE@Puoa*=2H?3QJn`2DTEnNv?ZD z3Doq{fqAc`XD>Ki3+%~Iu*SA)IyWMX9jP4YqEL;hny+HN`9Qx9X|MCqRj%H*4sLr6 zK^V6aJ*91-eIyj^36k9@Mtiiw@-4zHjAo8uU@eV}#5ravyal}4$XCr>%I5B)_nv*O!sjN?8pX*qn8BM@GC`v`>^3uk*DF;u zr%405gGNBts}k%$Ib%RO)O4=uk_+-?&C`dQ2Gs>XbRR*~o{2HlNvy>=FVVaYK_;#MID z`E*H_>y?vx^s@{DJ}gNB$ynT<3WdR@PJEKAYMR8eAJ80CuN2vnB~jJP6JF{MG$3?? zuabGfxOgCc?po&e=a94CLym|#@Wf^3)8b4H<&5Wcjj5uu4NbA;ilA}pN?t-oPn5IZ z&{F?skdWLEm7<%m7=I39_IYU*r%=XXa%u53?c-~Wz6vUl`-hgr(n3#RCAB@&2#>;4+F}O7})5f4LmI`7oBlwi01IiES_3DjYMC>Y+G$wAqWLjZk$83hqZ%#f6~D*g6Ux0tyD>1HGxEwd zL}8<91)C3DL#7dCYjU;VM);+}l~fzZ)FN*=*0Nh>R)=EQ^-f=9n)R?qwSU`rcoVz}%KRHC4=nRmcGj?f z_R4wK!e#TfZVCNtpoET%KRBM!8r5p01{-tOL9nf%!Q!A&g6Tns3eNFXAQSf2 zVElM$4|))LP7RI@jGjs(7zmR+6pdSmAdK@WB$&i+8}E4{tA6oPlIFI zc4y(dr)z9&=CpK)&bDL=Z?+7`7A)(r(H1z1AExpmJ$avHfD_v2=gg7`v?^&TXO z!n774--D14q^I!55~SjLDK=KE8}+dy3eh%FSo}>ytxXq}=shZ|OD?#?#SmZHDqtI3 ztDu!?P&jOmdZh-dm(ck7dh}0kPr*r%h`<&!M=N18wsI14B!u~sgl03R>^Ae~ORxBO zc(Z${Rv{73f9eEY12fsm40Iu8$X!|2SKArjB8T}zm=wU?p9nu2U4iVn_;qF{+-5Vu zdBK457x?2ZZGAZ^3tDftmFLxl^vk8zd3~j2KylFO-b4>K5gV~;bRa10uNY}lA%e<{ zdi_#VNxv`^KZWdAvg<3=NGU3Q4gp;fM77+OARL3}RDw42#7a={tFF8n62PgF*c87O z{taBSjIn21Ty8{yajM%CmuunGFD}J@MuLe-3uP}{T9&5$MW=*Tcak=5%Lil2rn2&e z(yw${A7h&RB)oHPm)RC!UKk^ONx+ff) z#!vWLuAdcYxjtaGT)%AEJ&!SiTzr`16=h*JU9fCioWM)NhIX{x<9@f@bX|s!<1EwO zrt1L3W;R{>lPO3?Xl2U(bYl9((_-Pco?qWka#1Z-9p6J+EF*A$zTs3u^o{+^(l`9V z);G^E{^(*d_03b9cdysv^$lgOP2ZTbUGml`VQKNSPB=i+skHn;SJH9;t<%TErRBpH zMOp$|CtF(Ft&>r7-gd^_t7>nZHro2g8%n>*)jByEx1;6>6CCTY^8i+~OWEmCC3o80 ztt`Y!Z_ii$4a-r8V=-FcpaFnwL3)2U3>Xdr$*aPP#1}4=BZDOuoJ-KgU zbYkx4zR6;~e0(fllyO~$Jv6_#iQ4+-uVN&Mt}xMiaH<8p^Yi-Zl3bo`U}HYta8j?f z^bG}dwot;qdKT8r=@J<#$iGCa&H(#LS04e&cL_~ADRN1xxJlO~7v<6B&#f&RtfsbF z6E?l^5yWhFvX9rBr{&h@Yo{9}+}DvU!Je5bv*xq_glG+Y$wH9kT%UD&=_zc>m$gkO z7zuYBylrsLN}~<-G(JV^Et-}KP0|*KUZfP&0k%gxoH`Y@If7Y*fd1}qbOpa2a z)KUV!x%eNf(TdCP%Nm;K_KH^+)14K$m-JgGT^dEWM;JxxEl5u=b({a&kf<2{lo1#I z+v#V(-9oN$x3Bwu14zADAe4uHuP$~Mu)fl$EiHYi#9H9rJX(NC`}(Od*!*u86wP4GWy_DqT%S(FQGvVX`kpW;imN}~0TWDR7Z(uHKi7ATVuRj* zhPXJy+EURXa2@FY*kd*^IC4%^r^6|LHW{NS0QUr_{(y2_z5 zlzktQ?`bUb>BR?NsJ)H)=3uJK{J~ms@q;9nJ)s_>gkN95xA=vI#r+@l`fgZL9Np=$ ziiBGZvr9pYdNlt;Vg>JQEcC0Op(InzBn8WiEN3n~zZo6^1Q9+=weR$cewT7hEsEZ2 z&ur&ghnAuQOh6lT_sGbQ8*laVH;UeQJ1R`8#`)`6{qVK|ue+oUP8}OJ>XT9Ls7gUU zn?~Vll~iA@ezq^Q-PGVI(%`om>YJ7kQQ;6S)d#VHr+Ms6F;{M|CuO&5-}T_BTb(-8 zC!V@fasG@e4tmq8abT<V%iRa-5d{H8hrHy(j4zUxx zk+I@mA*kKs>|sLe?0_A||M$Ac&MK2zCl)i+3!8$!)?UQ%7neO9k5P_)!owuVzPHIY z^tT@Ufe=#69{Ex95d6$fO`)q_(m0xKas9;Vj`^;j1fdr?f;*wSibsS|01)$~wlUDww)&i5%+_VnSlR{zpnaRE@Q z!I0(A0eVgx=scG|bc^9_Y+<6?o$co_Jhd8whkBPSSwh0CQu2FJCzSk-)Zk$1V50;d1G`cKyY~!?>=_wN9k}m!ui5tU=xI;NGi1UMjo#ju z2Ieo8HkN37~^HlGj1{tJ8=}qYJ=0ZeAlWj-*jGDg=rkeH@1@??g6OF z{-MF$qq_-MYD;-~Cg82IP_^F<4Gf!paSJr%Zt93MFgP?kGP-lu?tU{X)M2G>_sKQ2 zV!oS!4lA9_TAz+qU_8Y9WM$df!G)cmY>I>qR$@Qd3{)oOip!0;X{E-|9-Vr~{U10p z>*0S&1u6CVe@X?!gQUV%nQw?uQ#99J{0{WX`QksorAx#y#a{d_o`a^=Eu7mkuArrTS_e3bz@> zU&kLy^ZPo+{>jGT@4)Y&I}(VaJs(U64e{E6t-)@kiu*EqXQ848g{j*lp*I)E`a=%u*v2~RaD7so>jwo`^D0{$YcC!X2xW48guTYXy!jaR zm6m7IsRxZ|BV}gKDRY0alFtI2hTHzQ%5BH^e!a)H1ALx=W4(ACEHLB|Uv>c#YAzk7 zU$qA>+M+fZFtiS8nM?z^0u*0~C`~1{!J8o`+1GHg-XX$veFdkjFW2f=Ls|tF%SSUU z#jm?wMG0&!K8-(7^_^!6aaO^#9A%$WXz8>gHeZ>;&FHP-n-CK%Jk8Lpd)UuRsp@Ot zqC?Chbu7!%XS%$-)#RY&J>$9`Avd*@KYPm;3_SW#{fT(S`=%Yj;HtjQQOH&SO^Z{G3olGs#uD?I?=Zbdy zIl1bj*kDzm_+dmBC9Q467M*~pZ13Y(yH%4I#RjU$?;%#R1}}#nhx_jnCoyYZ<}~1U z1@L->8&(*K-w_C93isc!*H|@qy{R7QIL6M=p|_f8sty_3V6cyidAJ{7HZ3NFkSs0sRHYp|Wn zlUI%VwY4b^LyXMpRdia|UWtsK76ww!v~ZS9gIklrCcWOZA)~OPtD9F+VL+p}F#wMr zdS{Y)snzh~RG3gho>hApF9X#ueYhBE_!)n$NDVu=>ZI6U5Ty7Rq7ziZhJuMsAQ3f; zX~sY`{4V0&7!59mA4fgChq?FGCBN*M)$UmVyk6mk9g*Ts3xqO-`={7ztQtYo;0?ebXs0|buim;QH7z{~9R;!hwN(O&7Nm=A9Z?y|9arNw6{R(Ch_ z^9U;54K2Qx!pHYNVK${mytVf~4K||%+$$Rt*KfoCbai9|W#dvSzSX?}itqb?8L0T^ z!^Kd1*ZFfriqFYaC&dP1GR1%DwAi8(NJR0`-iV-Cp;17$6rX1=!Y<-Otp7O-uW^dr zE8H+bQydToWh%ZjdyQ3meb&I6xAvL4u6X~RYXb-`2pNNQbh$bSVt2)k3sB?53$ruD z`xD1|sVno#i3fi#<}_XgR%ZHeF)H&L{JEma?BpuCu6c_MhHr`mL>DLA9x;thz*Cu{ zy&giNgA5omci~?36|^$YI<%ZxgAW?BeIE#z7}PJbmIE|t7AA`V4nV%&2yN}fDr__M zDto7zAI84Is(hAi5aILkv<|~IB~ma8X6}i^>^#gw_zu={9#1w&~L1huU6k?|hZTy+ZQ)EPI{D;a;ifHjaRNe4!0rSF<6J z%QD{vWV1c;FUx#KpvcUw_}?;dos{kjO82h?LYY0vP1WB_;E(KIdPJ+0(5yvRzdR11VWi4Kg?cZ ztJV9hj@|@YrKT$xXaf&7M_Ofe7Pen1JJ1xVI_vhP@R1Nv0CF+_;J+P|0GVt#;t!MfY-~?99a6S zKq!-?KVq-3>a6_0SVU7q%w73JD6z&c~V1g5A6{f)rgcp2CT(1(lB2+00iQ6u2w zs*_@?Amkm0&M$oKNp%tyk9vzvAdyA@dqV;nfhUQ3Yt?3<>L{D1nEUAQpE*=~xd2|T za96?7fxX-oYiZIO-plYWmebB^Ras ze;MCH7x#_8$*TX~V*El9`5T;fuh)yD{!QAv>fb23=xXk*A&;Ymye$Alh#nEFA(vYH zf1irbul~P@mx1b^K3oj--@D$ID^mYXt~x2U8bW@p(_)KGAQAPCQ#gU@{}w>E)Ia<< z%4R!pA~puN8D8U>JFjqSVClsIp-lDvBK8`q{&j&V4QPHGcf_q3bOeZ+0USES2}m{< zlG=Xs$gSzlXD=|R0SnMoiZEAFF>jAkQ1;&D z@GGQ8@G?*#(T9tnke>ACiWHKQt7v`UEw*`td;HtGJx(Cm-?lmK2YOJ~4ROCXfV(wo?8tU{73h4jGD3APPyoQ|X!2Us#u z=?-<{Om%77)Dc@_bQsF6(jO5Z$cuUbsDCYS)R($Se}#DPSLr{-%fKp4A1+3f{(FC} zs7gDzimq|qVmphFpGI_oRoW2N=majjN@JPs4(p(7<*vZ0y>5eDwb#1*I#qlFJP7tV zdf_z=zn8UhU~QE^D6@*MV6U-Nd;k@@B&%~Svj}o2HHXQ>GM%QPbrJij2R>J3SMx4H z+Eu+zfG98emjnH_#L-{ss(wH5;IHa?@iMTg(}#;u)pPz_QB`+x6+m4hnm#W8z$?_R2JEj2gz5~o z(59Cam)XF>HodHb7eVOD;5AOWdZE7t(0|w|^ls4wf}s*_?nkB~Z|i_^BAVvA0|)SI_)tle&p2|HH&8N_PM zM0t)Cf0j5An;QSL0A8~ zO6uz&so&(13U6mzYFJQGFSQ!JmkJZv_8cqTg_nV9m_A$#HGI;aD^kNwt~x0;9U(^$ zonH*y-GjDbi%uXBH5_)jZl1U|7X&<~>lT>%XxTG|b#(!}Ug3TNSbAI_l&OZx>@`*m zcXCwD#N0^`y93!0pvH^$jllb+#PMG0%KUNS!C#r*kC%a!nLb>M%KRCBuBb9Qxr(l9 z-eUW4gnS>O6RgaJm_{eysm#${&G|uNEE?`LXnyc*0Ylx6<_DeRw(F~{75rB5G1%Ky zEZckTFU}<&_Vpkz)g*F3#}@rsY@Wlt*a&FeN}A738zw_>xl!>4;Jc!@&&e3`F|}yVkGRNb(!45X}ofmclF50mtss zoBdYf@7_l{qVu>R1*TnL43e+uCDU4b$RlN4qJ78lsYBzF+40G-BU2NT$Ft){k4_yu zc9(05^rrTRoF$)4oM-P?dWT`cODrAc#cMg?1_Eca7#qBiIO)D9fUC}i*w-P3sA?B6 z#NLje(L?N}%Yc_*IpL~$<+M_^ErMlPDm31A{0chcY8&usK_w8YJkoYwDqv9U)Eldo zxGRBIyHHe?qiajj!LC)Ylki5pdk9 zg&!~yWSm*RkF`chxLmA!8b5o@pN(1xzt-0)x$Lx@J567;7Ef>Jn`SDNdKuTxyS^M+ zs;?(A^RP^uU4UukIovb>%Nwx2SIy#711(Kzi0^vijZ#whP4C1qYIwGJ)Qdkb>O{@J5%R2EclRhR1x&GOWv_vDr7#w_C7K<4PkVjtpF zZPX#(BwD!BS?_7oXQW*%{RZy`L-4Z&+-YA@YT%f%nX9+- z%PNg}a11y4zWAaj&Qo>Vz=9l5=5nje`z-(EgqIX_ZHKmcSWEbX0mM%v_1#9A2cSx2Hv~u&RMz*{uu54b_ z$j~l;n7LeKRR*pn`a0k-_S3;;DnhI`eP(CW67b>Dpw0AzbYSYc4nH86BFv-2*Vg1S z_D@LYMyga0oboK>u%zN@f!2MOZ__tam8#S75+2xotU}z8eX1DxHI|)jyw=jyv$%A= zoUYVnGcElp^2r&1&n&LwLkZPUBCGLUdP)B0A(nGlyLQ@Lhpbj5Avv#KuAME{<%O($TOuw{EYWS|`Z{e+Mm>AHfoiRR zs4Mul@iU8?DP@z|8*>F2H3(N$8r2OfGld9!8WxbxLpmxsnB4~dh8j2z0jlKG@(jel z(hHkNQ{XVG&!0MnD;<%TY*fY-tdSr#uyvkC4L*x36cnY7M6Sxg*XgVR+mxlOoX?{# zMhc{CS=lWz)4*VZYvs zBdEF465m{1IH|8|l-)1R=xfNlyZQOe@U1HL&kyLEO#LMxQVrxtkk7)W+F!#cMBxh! z!Z%}OfV%=}p7O%oKukPQe^J)-RpiC^vc2$p;j4weFZ^xc-wQt|_AW(laTPgNlXE3G zH-oO{W6h@1z=QOKDlr$$bNoTtcnf*hTk^W?mpoVSwm^W?mj zoL?p9gXH`UIloEHXUO?Oa{i2*KPBfI?7wGIY-DjMb4w-%#l+h=Nvg_$ayU}uOg>K&YQ@24>|87=aEZ6XYBxCr^${&i!aHi<9K!X;dSV!^0pRJ+hlQVvZyv$Oq(pCO%~54i)NF>vdJRZWN~b=C^lIPn=FD&7QZHo zUX#VH$s*Teaci=uHCfD>EMiR-uO^FDlf|mZBGqJZYO*LbS&W)2LQNK*CW}s!#iq$3 z(`0dJvZyp!OqwhrO%{(Pi$;^hqRArBWN~P+C^T6Nnk)iMF8(GLeUpp5$wl7e;%;(L zH@TS4a}l5C;%yeGXwP%8Hn~X8HwxF1R{m^+n zPpq{*LQkxe9At<_IYthMf>C)QdA z>4~-033_6!m8U1xT94BcYpqw%6Kk#4(-Uj0x6u=8t)HVO)>^+pPpq|mo1R!}{SiH} z*7`C%vDW%JJ+apMM|xtdwS<%oYpwP4#9He*dSb1$jhYRCG|-9kO$ZeeZ9MPj;|+}o zEPqBH$^C|UvHTW2%em=F$?kme%PV~^ZQpA=F|M&vke?v4%G zSq&X{>$N?mF7z12UOWc2%)2;n+3H?UcC21&AQv-d_oOlfOloCnjWUb@WX@D-r!(B; zLr+htsQH|P?y(m1ir?eTAM2uEj9cd*JhS!ctG7RjCx&Zsq2(Tzon7lAY-5B4UjfOld4tXFc$TxKX`L=e*rCCXi zDbPuAbcd2cm+AuDKs!3~_FPOK(RJDpHMAg(QArBpi@U(MHxlDkK2U*a5?n8-pdpFI z{7P}mPbGzUOBa}fDk^3IaZ;4Z6=wcxs$5cW$1b&&(U5;e9P-NaGd(W>M`~7^E|H;4f#dlkgrb) z^7bwu$EYt_+W}r$m5s)`OC0Y=Qh0Ce0`LB4nKn!tkYr>1kc^_Cp^656R2=wJQo#GV z0DgNkaE45KFrv|x#L=orp}nmOw7Wym)|6Qo%riy|(O6$2j`f+OuMRZnXG!;#j|x6xRMOutv@2SWCA`4?wfaioepU~>CeqIu zSR}AR>49jlTg1WMloZ&(#Q`e~$AP^=9PI9-zz!`M*cdT>P#o;Bq`(d@8rYF&F|LY( zol6Sr$fAKAjRyNVaj>sV3hd}2fgOpfvp*{i_B}~~-Pr}$I|BL^v`mDVb?ahIX(S!1 zkAF)X?#GjYyK52Q#we*TiNpP3QgC;70e6=`>BiLBe{ezl$#+Xj_`kxnkGA~#iz$2N z%HOw>!n~&o%mSS$X=hyZU3ZmmXKD?+CeoR@y$i4+)fZsn;NBt*cWY8``TC&*7e397 zGRiil^1f6Y?43!0y|at56%*v4=tlRXIM@?OfxTaj3tY z6x4gVfEqAGL+BI+DidNt9$jVsw>Z`>Cxvxi7g+n+ds6aj9Jud^gZsy%z>ReQEPF2cve;XRTR zynDNVcWXO5T=fx+Z9yDcBPnbXU0@4nGxH@$qr+@`c@>$JRimN4Ssdz*Ck6Fj7f=JX z_F;`(j_DEnqBy$$niRT2U7#Co7gFAR%-e6{*K2-X9OfsIf_b4)Oy@fqb9~kO56%@l1@u`9pDRe~=Wm2b029k5(@)h-3T9 zq_CYx3R}#e@IS<{{cBR#9!d(^>F9F1<{IHn%vJE3NGImuq_D+|lLp1HWs<^nvI}fM zeHhw=E8)mxHM;l?i$k193gRPOKnyyB$q;KXWjG@aFqag-mvsR!;D{H@g{4&mMx82* z6f2UA8V)5&)47;JeOeszlSyHIvoi%l@z|mlEfFYN#fVU z@qH*MeA#61p*K1-FdBpJkHztQIw^doy1*B(Q`%Q2ap9h1s3Ba587;Km6bJpaq(IBb zfX>(CnYwfqXZbB%ghj`?l9zBIF&gx;YlV9UKTHbrbQholG!aZ}DGO46G`<_e@m&kA z7ts4L%*UCh{MRQ5F=oMLR2<^ak1E8NEj&lWA>NlD#EnUoV$86(C=PM<5<}eC-Yc-I zh)9;*;^JA$D_GFjTk3Y|;6sIK&Sp2(g<9k5Gs) z9icxFhxpk9A(oRA)R<}GzY&M{e-ecFc#;rfh9fJl6Yk_Jhu5S!0k3x;D*9U64ip;* sU8|OJrAD3%lFpJ**&CznF>Rm3fA!XDTC(1oC$qbJSh+Q6Sp84`U+Pp(3IG5A literal 0 HcmV?d00001 diff --git a/it/entity_configuration.html b/it/entity_configuration.html new file mode 100644 index 00000000..b98c9eaf --- /dev/null +++ b/it/entity_configuration.html @@ -0,0 +1,1491 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Entity Configuration + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Entity Configuration

    +

    Un'Entity Configuration (EC) è un Metadata di Federazione in formato Jose e firmato da una Entità e riguardante se stessa, pubblicato presso il web endpoint .well-known/openid-federation.

    +
    +

    Firma della Entity Configuration

    +

    Tutte le operazioni di verifica della firma relative agli ES, EC e TM sono eseguite con le chiavi pubbliche di Federazione. Per quanto riguarda gli algoritmi di firma supportati si veda la Sezione Algoritmi Crittografici.

    +
    +

    Avvertimento

    +

    Distinguiamo le chiavi di Federazione da quelle di OIDC Core. Queste ultime risiedono nei Metadata OIDC. Un EC contiene sia le chiavi pubbliche di Federazione che i Metadata OIDC. Le chiavi di Federazione DOVREBBERO essere diverse da quelle di OIDC Core.

    +
    +
    +
    +

    Entity Configuration - claim comuni

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    iss

    String. Identificativo dell'entità che lo emette.

    spid-icon cieid-icon

    sub

    String. Identificativo del soggetto a cui è riferito.

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519.

    spid-icon cieid-icon

    jwks

    Un JSON Web Key Set (JWKS) RFC 7517 che rappresenta la parte pubblica delle chiavi di firma dell'entità interessata. Ogni JWK nel set JWK DEVE avere un ID di chiave (claim kid).

    spid-icon cieid-icon

    metadata

    JSON Object. Ogni chiave dell'oggetto JSON rappresenta un identificatore del tipo +di Metadata e ogni valore DEVE essere un oggetto JSON +che rappresenta i Metadata secondo lo schema di Metadata di quel tipo.

    +

    Una configurazione di entità PUÒ contenere più dichiarazioni di Metadata, ma solo una per ogni tipo di Metadata (<entity_type>).

    +

    I tipi consentiti sono i seguenti:

    +
      +
    • openid_relying_party

    • +
    • openid_provider

    • +
    • federation_entity

    • +
    • oauth_authorization_server

    • +
    • oauth_resource

    • +
    +

    spid-icon cieid-icon

    +
    +

    Avvertimento

    +

    All'interno dell'EC i valori degli attributi iss e sub contengono il medesimo valore (URL).

    +
    +
    +
    +

    Entity Configuration Foglia e intermediari

    +

    Gli EC delle entità Foglia e intermediari, in aggiunta ai claim precedentemente definiti, contengono anche i seguenti claim:

    + +++++ + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    authority_hints

    Array di URL. Contiene una lista di URL delle entità superiori, quali TA o SA che POSSONO emettere un ES relativo a questo soggetto.

    spid-icon cieid-icon

    trust_marks

    Un array JSON contenente i Trust Mark. Vedere la Sezione Trust Mark. +Obbligatorio per tutti i partecipanti fatta esclusione del Trust Anchor.

    spid-icon cieid-icon

    + +
    +
    +

    Entity Configuration Trust Anchor

    +

    Gli EC di un TA, in aggiunta ai claim comuni a tutti i partecipanti, contengono anche i seguenti:

    + +++++ + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    constraints

    JSON Object che descrive un insieme di vincoli della Trust Chain e che DEVE contenere l'attributo max_path_length. Rappresenta il numero massimo di SA tra una Foglia e il TA. +PUÒ anche contenere il claim allowed_leaf_entity_types, che restringe i tipi di Entità riconoscobili come suoi discendenti.

    spid-icon cieid-icon

    trust_marks_issuers

    JSON Array che indica quali autorità sono considerate attendibili nella Federazione per l'emissione di specifici TM, questi assegnati mediante il proprio identificativo univoco.

    spid-icon cieid-icon

    +
    +

    Vedi anche

    + +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/entity_statement.html b/it/entity_statement.html new file mode 100644 index 00000000..2c7f9f37 --- /dev/null +++ b/it/entity_statement.html @@ -0,0 +1,1719 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Entity Statement + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Entity Statement

    +

    Il componente basilare per costruire una Catena di Fiducia (Trust Chain) è l'Entity Statement (ES), un JWT firmato che contiene la chiavi pubbliche dell' Entità discendente (subject) e ulteriori dati usati per controllare il processo di risoluzione della Trust Chain.

    +

    Una entità pubblica un ES relativo ad un suo discendente presso il proprio Fetch Endpoint. L'entità superiore PUÒ definire le policy sui metadata per un soggetto discendente e pubblicare i TM da lei emessi per questo.

    +
    +

    Firma di Entity Statement

    +

    Si applicano le medesime considerazioni fatte per gli EC e riportate nella sezione Firma della Entity Configuration.

    +
    +
    +

    Entity Statement

    +

    Gli ES emessi dal TA o da un suo Intermediario per i propri diretti discendenti, DEVONO contenere i seguenti attributi:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    iss

    Si rimanda alla specifica OIDC-FED Sezione 3.1 per i dettagli.

    spid-icon cieid-icon

    sub

    Si rimanda alla specifica OIDC-FED Sezione 3.1 per i dettagli.

    spid-icon cieid-icon

    iat

    Si rimanda alla specifica OIDC-FED Sezione 3.1 per i dettagli.

    spid-icon cieid-icon

    exp

    Si rimanda alla specifica OIDC-FED Sezione 3.1 per i dettagli.

    spid-icon cieid-icon

    jwks

    JWKS di Federazione dell'entità sub. Si rimanda alla specifica OIDC-FED Sezione 3.1 per i dettagli.

    spid-icon cieid-icon

    metadata_policy

    JSON Object che descrive un criterio di Metadata. Ogni chiave dell'oggetto JSON rappresenta un identificatore del tipo di Metadata e ogni valore DEVE essere un oggetto JSON che rappresenta la politica dei Metadata in base allo schema di quel tipo di Metadata. Si rimanda alla specifica OIDC-FED Section 5.1 per i dettagli implementativi.

    spid-icon cieid-icon

    trust_marks

    JSON Array contenente i Trust Mark emessi da se stesso per il soggetto discendente.

    spid-icon cieid-icon

    constraints

    PUÒ contenere il claim allowed_leaf_entity_types per restringere i tipi di Entità riconoscobili per il suo discendente (esempio: solo RP).

    spid-icon cieid-icon

    + +
    +
    +

    Metadata Policy

    +

    Trust Anchors e Intermediari (SA) DEVONO pubblicare una policy relativa ai rispettivi discendenti nell'Entity Statement ad essi riferito. La Metadata Policy si DEVE applicare a cascata su tutti i discendenti.

    +
    +

    Metadata Policy di un TA per un RP

    +

    Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro metadata di tipo openid_realying_party all'interno della policy che il TA stabilisce per un RP suo discendente diretto.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Operazioni / Valori

    Supportato da

    jwks

    Operazioni: subset_of
    +Valori: DEVE contenere i JWKS del RP relativi alle operazioni di Core

    spid-icon cieid-icon

    grant_types

    Operazioni: subset_of
    +Valori: DEVE essere authorization_code e refresh_token

    spid-icon cieid-icon

    id_token_signed_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    id_token_encrypted_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    cieid-icon

    id_token_encrypted_response_enc

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    cieid-icon

    userinfo_signed_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_encrypted_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_encrypted_response_enc

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    token_endpoint_auth_method

    Operazioni: one_of
    +Valori: DEVE essere private_key_jwt

    spid-icon cieid-icon

    client_registration_types

    Operazioni: one_of
    +Valori: DEVE essere automatic

    spid-icon cieid-icon

    +
    +
    +

    Metadata Policy di un TA per un SA

    +

    Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro metadata di tipo openid_relying_party all'interno della policy che il TA stabilisce per un SA. Questa policy DEVE essere applicata a cascata ai metadata dei RP discendenti diretti (aggregati) del SA.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Operazioni / Valori

    Supportato da

    grant_types

    Operazioni: subset_of
    +Valori: DEVE essere authorization_code e refresh_token

    spid-icon cieid-icon

    id_token_signed_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    id_token_encrypted_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    cieid-icon

    id_token_encrypted_response_enc

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    cieid-icon

    userinfo_signed_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_encrypted_response_alg

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_encrypted_response_enc

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    token_endpoint_auth_method

    Operazioni: one_of
    +Valori: DEVE essere private_key_jwt

    spid-icon cieid-icon

    client_registration_types

    Operazioni: one_of
    +Valori: DEVE essere automatic

    spid-icon cieid-icon

    +
    +
    +

    Metadata Policy di un SA per una RP

    +

    Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro metadata di tipo openid_relying_party all'interno della policy che il SA stabilisce per un RP suo discendente diretto (Aggregato).

    + +++++ + + + + + + + + + + + + +

    Claim

    Operazioni / Valori

    Supportato da

    jwks

    Operazioni: subset_of
    +Valori: DEVE contenere i JWKS del RP relativi alle operazioni di Core

    spid-icon cieid-icon

    +
    +
    +

    Metadata Policy di un TA per un OP

    +

    Di seguito vengono riportati i claim che DEVONO essere considerati nel parametro metadata di tipo openid_provider all'interno della policy che il TA stabilisce per un RP suo discendente diretto.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Operazioni / Valori

    Supportato da

    jwks

    Operazioni: subset_of
    +Valori: DEVE contenere i JWKS del OP relativi alle operazioni di Core

    spid-icon cieid-icon

    revocation_endpoint_auth_methods_supported

    Operazioni: one_of
    +Valori: DEVE essere private_key_jwt

    spid-icon cieid-icon

    code_challenge_methods_supported

    Operazioni: subset_of
    +Valori: DEVE essere S256

    spid-icon cieid-icon

    scopes_supported

    Operazioni: subset_of
    +Valori: DEVE contenere openid, offline_access. Per CIE id PUÒ contenere anche profile, email.

    spid-icon cieid-icon

    response_types_supported

    Operazioni: one_of
    +Valori: DEVE essere code.

    spid-icon cieid-icon

    response_modes_supported

    Operazioni: subset_of
    +Valori: DEVE essere form_post, query.

    spid-icon cieid-icon

    grant_types_supported

    Operazioni: subset_of
    +Valori: DEVE essere refresh_token, authorization_code.

    spid-icon cieid-icon

    acr_values_supported

    Operazioni: subset_of
    +Valori: DEVE essere
    https://www.spid.gov.it/SpidL1,
    https://www.spid.gov.it/SpidL2,
    https://www.spid.gov.it/SpidL3.

    spid-icon cieid-icon

    subject_types_supported

    Operazioni: one_of
    +Valori: DEVE essere pairwise.

    spid-icon cieid-icon

    id_token_signing_alg_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    id_token_encryption_alg_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    id_token_encryption_enc_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_signing_alg_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_encryption_alg_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    userinfo_encryption_enc_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    token_endpoint_auth_methods_supported

    Operazioni: one_of
    +Valori: DEVE essere private_key_jwt

    spid-icon cieid-icon

    token_endpoint_auth_signing_alg_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    claims_parameter_supported

    Operazioni: one_of
    +Valori: DEVE essere true

    spid-icon cieid-icon

    request_parameter_supported

    Operazioni: one_of
    +Valori: DEVE essere true

    spid-icon cieid-icon

    authorization_response_iss_parameter_supported

    Operazioni: one_of
    +Valori: DEVE essere true

    spid-icon cieid-icon

    client_registration_types_supported

    Operazioni: one_of
    +Valori: DEVE essere automatic

    spid-icon cieid-icon

    request_authentication_methods_supported

    Operazioni: one_of
    +Valori: DEVE essere request_object

    spid-icon cieid-icon

    request_authentication_signing_alg_values_supported

    Operazioni: subset_of
    +Valori: DEVE contenere gli algoritmi definiti nella Sezione Algoritmi Crittografici

    spid-icon cieid-icon

    + +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/errors_federation.html b/it/errors_federation.html new file mode 100644 index 00000000..fc2525e8 --- /dev/null +++ b/it/errors_federation.html @@ -0,0 +1,1423 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Gestione degli errori di federazione + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Gestione degli errori di federazione

    +

    In caso di errore durante le operazioni di federazione, le entità DEVONO rappresentare i messaggi di anomalia come descritto di seguito.

    + +++++ + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    Errore

    Vedi Codici di errori

    spid-icon cieid-icon

    Descrizione dell'errore

    Descrizione più dettagliata dell'errore, finalizzata ad aiutare lo sviluppatore per eventuale debugging.

    spid-icon cieid-icon

    +
    +

    Codici di errore di Federation

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Errore

    Descrizione

    Codice HTTP

    Supportato da

    temporarily_unavailable

    Uno degli endpoint di well-known o di Federation non è raggiungibile.

    302 Found or 400 Bad Request

    spid-icon cieid-icon

    invalid_client

    Il Client non è autorizzato perchè la validazione della Trust Chain fallisce.

    302 Found

    spid-icon cieid-icon

    unauthorized_client

    L'applicazione del metadata policy produce un metadata non conforme o nessun Trust Mark valido per il profilo richiesto è presente all'interno della configurazione.

    302 Found

    spid-icon cieid-icon

    invalid_request

    La richiesta non è completa o non è conforme a quanto definito dalle presenti specifiche tecniche.

    400 Bad Request

    spid-icon cieid-icon

    not_found

    La risorsa richiesta non è stata trovata.

    404 Not Found

    spid-icon cieid-icon

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/esempi.html b/it/esempi.html new file mode 100644 index 00000000..4f5563fc --- /dev/null +++ b/it/esempi.html @@ -0,0 +1,2252 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Esempi + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Esempi

    +

    In questa sezione sono raccolti tutti gli esempi non normativi delle richieste e delle risposte agli endpoint di Federazione definiti all'interno di questo documento.

    +

    Tutte le response di tipo jose sono state decodificate e rappresentate insieme alle loro intestazioni per migliorare la lettura.

    +
    +

    EN 1. Entity Configuration Request

    +
    GET /.well-known/openid-federation HTTP/1.1
    +Host: rp.example.it
    +
    +
    +
    +
    +

    EN 1.1. Entity Configuration Response Relying Party

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649590602,
    +    "iat": 1649417862,
    +    "iss": "https://rp.example.it/",
    +    "sub": "https://rp.example.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "n": "5s4qi …",
    +                "e": "AQAB",
    +                "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "openid_relying_party": {
    +            "application_type": "web",
    +            "client_id": "https://rp.example.it/",
    +            "client_registration_types": [
    +                "automatic"
    +            ],
    +            "jwks": {
    +                "keys": [
    +                    {
    +                        "kty": "RSA",
    +                        "use": "sig",
    +                        "n": "1Ta-sE …",
    +                        "e": "AQAB",
    +                        "kid": "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +                    }
    +                ]
    +            },
    +            "client_name": "Name of an example organization",
    +            "contacts": [
    +                "ops@rp.example.it"
    +            ],
    +            "grant_types": [
    +                "refresh_token",
    +                "authorization_code"
    +            ],
    +            "redirect_uris": [
    +                "https://rp.example.it/oidc/rp/callback/"
    +            ],
    +            "response_types": [
    +                "code"
    +            ],
    +            "subject_type": "pairwise"
    +        },
    +        "federation_entity": {
    +            "federation_resolve_endpoint": "https://rp.example.it/resolve/",
    +            "organization_name": "PA OIDC Service Provider",
    +            "homepage_uri": "https://rp.example.it",
    +            "policy_uri": "https://rp.example.it/policy",
    +            "logo_uri": "https://rp.example.it/static/logo.svg",
    +            "contacts": [
    +               "tech@example.it"
    +             ]
    +        }
    +    },
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.agid.gov.it/openid_relying_party/public/",
    +            "trust_mark": "eyJh …"
    +        }
    +    ],
    +    "authority_hints": [
    +        "https://registry.agid.gov.it/"
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 1.2. Entity Configuration Response Openid Provider

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649610249,
    +    "iat": 1649437449,
    +    "iss": "https://openid.provider.it/",
    +    "sub": "https://openid.provider.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "e": "AQAB",
    +                "n": "01_4a …",
    +                "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "openid_provider": {
    +            "authorization_endpoint": "https://openid.provider.it/authorization",
    +            "revocation_endpoint": "https://openid.provider.it/revocation/",
    +            "id_token_encryption_alg_values_supported": [
    +                "RSA-OAEP"
    +            ],
    +            "id_token_encryption_enc_values_supported": [
    +                "A128CBC-HS256"
    +            ],
    +            "token_endpoint": "https://openid.provider.it/token/",
    +            "userinfo_endpoint": "https://openid.provider.it/userinfo/",
    +            "introspection_endpoint": "https://openid.provider.it/introspection/",
    +            "claims_parameter_supported":true,
    +            "contacts": [
    +                "ops@https://idp.it"
    +            ],
    +            "client_registration_types_supported": [
    +                "automatic"
    +            ],
    +            "code_challenge_methods_supported": [
    +                "S256"
    +            ],
    +            "request_authentication_methods_supported": {
    +                "ar": [
    +                    "request_object"
    +                ]
    +            },
    +            "acr_values_supported": [
    +                "https://www.spid.gov.it/SpidL1",
    +                "https://www.spid.gov.it/SpidL2",
    +                "https://www.spid.gov.it/SpidL3"
    +            ],
    +            "claims_supported": [
    +                "https://attributes.spid.gov.it/spid_code",
    +                "given_name",
    +                "family_name",
    +                "place_of_birth",
    +                "birthdate",
    +                "gender",
    +                "https://attributes.spid.gov.it/company_name",
    +                "https://attributes.spid.gov.it/registered_office",
    +                "https://attributes.spid.gov.it/fiscal_number",
    +                "https://attributes.spid.gov.it/vat_number",
    +                "https://attributes.spid.gov.it/document_details",
    +                "phone_number",
    +                "email",
    +                "address",
    +                "https://attributes.spid.gov.it/eid_exp_date",
    +                "https://attributes.spid.gov.it/e_delivery_service"
    +            ],
    +            "grant_types_supported": [
    +                "authorization_code",
    +                "refresh_token"
    +            ],
    +            "id_token_signing_alg_values_supported": [
    +                "RS256",
    +                "ES256"
    +            ],
    +            "issuer": "https://openid.provider.it/",
    +            "jwks": {
    +                "keys": [
    +                    {
    +                        "kty": "RSA",
    +                        "use": "sig",
    +                        "n": "1Ta-sE …",
    +                        "e": "AQAB",
    +                        "kid": "FANFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +                    }
    +                ]
    +            },
    +            "scopes_supported": [
    +                "openid",
    +                "offline_access"
    +            ],
    +            "logo_uri": "https://openid.provider.it/static/svg/spid-logo-c-lb.svg",
    +            "organization_name": "SPID OIDC identity provider",
    +            "op_policy_uri": "https://openid.provider.it/it/website/legal-information/",
    +            "request_parameter_supported":true,
    +            "request_uri_parameter_supported":true,
    +            "require_request_uri_registration":true,
    +            "response_types_supported": [
    +                "code"
    +            ],
    +            "subject_types_supported": [
    +                "pairwise",
    +                "public"
    +            ],
    +            "token_endpoint_auth_methods_supported": [
    +                "private_key_jwt"
    +            ],
    +            "token_endpoint_auth_signing_alg_values_supported": [
    +                "RS256",
    +                "RS384",
    +                "RS512",
    +                "ES256",
    +                "ES384",
    +                "ES512"
    +            ],
    +            "userinfo_encryption_alg_values_supported": [
    +                "RSA-OAEP",
    +                "RSA-OAEP-256"
    +            ],
    +            "userinfo_encryption_enc_values_supported": [
    +                "A128CBC-HS256",
    +                "A192CBC-HS384",
    +                "A256CBC-HS512",
    +                "A128GCM",
    +                "A192GCM",
    +                "A256GCM"
    +            ],
    +            "userinfo_signing_alg_values_supported": [
    +                "RS256",
    +                "RS384",
    +                "RS512",
    +                "ES256",
    +                "ES384",
    +                "ES512"
    +            ],
    +            "request_object_signing_alg_values_supported": [
    +                "RS256",
    +                "RS384",
    +                "RS512",
    +                "ES256",
    +                "ES384",
    +                "ES512"
    +            ]
    +        },
    +        "federation_entity": {
    +            "federation_resolve_endpoint": "https://openid.provider.it/resolve/",
    +            "organization_name": "SPID OIDC identity provider",
    +            "homepage_uri": "https://provider.it",
    +            "policy_uri": "https://provider.it/policy",
    +            "logo_uri": "https://provider.it/static/logo.svg",
    +            "contacts": [
    +               "tech@provider.it"
    +             ]
    +        }
    +    },
    +    "authority_hints": [
    +        "https://registry.agid.gov.it/"
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 1.3. Entity Configuration Response Intermediary

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "em3cmnZgHIYFsQ090N6B3Op7LAAqj8rghMhxGmJstqg",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649631824,
    +    "iat": 1649459024,
    +    "iss": "https://aggregatore.it/",
    +    "sub": "https://aggregatore.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "e": "AQAB",
    +                "n": "14aW …",
    +                "kid": "em3cmnZgHIYFsQ090N6B3Op7LAAqj8rghMhxGmJstqg"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "federation_entity": {
    +            "contacts": [
    +                "soggetto@aggregatore.it"
    +            ],
    +            "federation_fetch_endpoint": "https://aggregatore.it/fetch/",
    +            "federation_resolve_endpoint": "https://aggregatore.it/resolve/",
    +            "federation_list_endpoint": "https://aggregatore.it/list/",
    +            "homepage_uri": "https://soggetto.aggregatore.it",
    +            "name": "Soggetto Aggregatore di esempio"
    +        },
    +        "trust_mark_issuer": {
    +            "federation_status_endpoint": "https://aggregatore.it/trust_mark_status/",
    +
    +        }
    +    },
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.gov.it/intermediate/private/full/",
    +            "trust_mark": "eyJh …"
    +        }
    +    ],
    +    "authority_hints": [
    +        "https://registry.agid.gov.it/"
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 1.4. Entity Configuration Response Trust Anchor

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649375259,
    +    "iat": 1649373279,
    +    "iss": "https://registry.agid.gov.it/",
    +    "sub": "https://registry.agid.gov.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "n": "3i5vV-_ …",
    +                "e": "AQAB",
    +                "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc"
    +            }
    +        ]
    +    },
    +    "metadata": {
    +        "federation_entity": {
    +            "organization_name": "example TA"
    +            "contacts":[
    +                "spid.tech@agid.gov.it"
    +            ],
    +            "policy_uri": "https://registry.agid.gov.it/policy",
    +            "homepage_uri": "https://registry.agid.gov.it/",
    +            "logo_uri":"https://registry.agid.gov.it/static/svg/logo.svg",
    +            "federation_fetch_endpoint": "https://registry.agid.gov.it/fetch/",
    +            "federation_resolve_endpoint": "https://registry.agid.gov.it/resolve/",
    +            "federation_list_endpoint": "https://registry.agid.gov.it/list/",
    +            "federation_trust_mark_status_endpoint": "https://registry.agid.gov.it/trust_mark_status/"
    +        }
    +    },
    +    "trust_marks_issuers": {
    +        "https://registry.agid.gov.it/openid_relying_party/public/": [
    +            "https://registry.spid.agid.gov.it/",
    +            "https://public.intermediary.spid.it/"
    +        ],
    +        "https://registry.agid.gov.it/openid_relying_party/private/": [
    +            "https://registry.spid.agid.gov.it/",
    +            "https://private.other.intermediary.it/"
    +        ]
    +    },
    +    "constraints": {
    +        "max_path_length": 1
    +    }
    +}
    +
    +
    +
    +
    +

    EN 1.5. Trust Mark issued by TA to a RP

    +
    {
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +            "iss": "https://registry.interno.gov.it/",
    +            "trust_mark": "$JWT"
    +        }
    +    ]
    +}
    +
    +
    +

    Where the $JWT payload is:

    +
    {
    +    "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +    "iss": "https://sa.esempio.it/",
    +    "sub": "https://rp.esempio.it/",
    +    "iat": 1579621160,
    +    "organization_type": "public",
    +    "id_code": {
    +       "ipa_code": "123456",
    +       "aoo_code": "Uff_protocollo"
    +    }
    +    "email": "email_or_pec@rp.it",
    +    "organization_name#it": "Denominazione del RP",
    +    "ref": "https://documentazione_di_riferimento.it/"
    +}
    +
    +
    +
    +
    +

    EN 1.6. Trust Mark issued by TA to a SA

    +
    {
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.interno.gov.it/intermediate/private/full/",
    +            "iss": "https://registry.interno.gov.it/",
    +            "trust_mark": "$JWT"
    +        }
    +    ]
    +}
    +
    +
    +

    Where the $JWT payload is:

    +
    {
    +    "id": "https://registry.interno.gov.it/intermediate/private/full/",
    +    "iss": "https://registry.interno.gov.it/",
    +    "sub": "https://sa.esempio.it/",
    +    "iat": 1579621160,
    +    "organization_type": "private",
    +    "id_code": {
    +       "fiscal_number": "1234567890"
    +    }
    +    "email": "email_or_pec@intermediate.it",
    +    "organization_name#it": "Denominazione del SA",
    +    "sa_profile": "full",
    +    "ref": "https://documentazione_di_riferimento.it/"
    +}
    +
    +
    +
    +
    +

    EN 1.7. Trust Mark issued by SA to a RP

    +
    {
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +            "iss": "https://sa.esempio.it",
    +            "trust_mark": "$JWT"
    +        }
    +    ]
    +}
    +
    +
    +

    Where the $JWT payload is:

    +
    {
    +    "id": "https://registry.interno.gov.it/openid_relying_party/public/",
    +    "iss": "https://sa.esempio.it/",
    +    "sub": "https://rp.esempio.it/",
    +    "iat": 1579621160,
    +    "organization_type": "public",
    +    "id_code": {
    +       "ipa_code": "987654",
    +    }
    +    "email": "email_or_pec@rp.it",
    +    "organization_name#it": "Denominazione del RP",
    +    "ref": "https://documentazione_di_riferimento.it/"
    +}
    +
    +
    +
    +
    +

    EN 2. Entity Statement Request

    +
    GET /fetch?sub=https://rp.example.it/
    +HTTP/1.1
    +Host: registry.agid.gov.it
    +
    +
    +
    +
    +

    EN 2.1 Entity Statement Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "exp": 1649623546,
    +    "iat": 1649450746,
    +    "iss": "https://registry.agid.gov.it/",
    +    "sub": "https://rp.example.it/",
    +    "jwks": {
    +        "keys": [
    +            {
    +                "kty": "RSA",
    +                "n": "5s4qi …",
    +                "e": "AQAB",
    +                "kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }
    +        ]
    +    },
    +    "metadata_policy": {
    +        "openid_relying_party": {
    +            "scope": {
    +                "superset_of": [
    +                    "openid"
    +                ],
    +                "subset_of": [
    +                    "openid",
    +                    "offline_access"
    +                ]
    +            },
    +            "contacts": {
    +                "add": [
    +                    "tech@example.it"
    +                ]
    +            }
    +        }
    +    },
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.agid.gov.it/openid_relying_party/public/",
    +            "trust_mark": "eyJhb …"
    +        }
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 3. Entity List Request

    +
    GET /list?entity_type=openid_provider
    +HTTP/1.1
    +Host: registry.agid.gov.it
    +
    +
    +
    +
    +

    EN 3.1. Entity List Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/json
    +
    +["https://openid-provider.it/", "https://spid.provider.it", … ]
    +
    +
    +
    +
    +

    EN 4. Resolve Entity Statement Endpoint Request

    +
    GET /resolve/?sub=https://openid.provider.it/&anchor=https://registry.agid.gov.it/
    +HTTP/1.1
    +Host: registry.agid.gov.it
    +
    +
    +
    +
    +

    EN 4.1. Resolve Entity Statement Endpoint Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/entity-statement+jwt
    +
    +{
    +    "alg": "RS256",
    +    "kid": "FifYx03bnosD8m6gYQIfNHNP9cM_Sam9Tc5nLloIIrc",
    +    "typ": "entity-statement+jwt"
    +}
    +.
    +{
    +    "iss": "https://registry.agid.gov.it/",
    +    "sub": "https://rp.example.it/",
    +    "iat": 1649355587,
    +    "exp": 1649410329,
    +    "trust_marks": [
    +        {
    +            "id": "https://registry.agid.gov.it/openid_relying_party/public/",
    +            "trust_mark": "eyJh …"
    +        }
    +    ],
    +    "metadata": {
    +        "openid_relying_party": {
    +            "application_type": "web",
    +            "client_id": "https://rp.example.it/",
    +            "client_registration_types": [
    +                "automatic"
    +            ],
    +            "jwks": {
    +                "keys": [
    +                    {
    +                        "kty": "RSA",
    +                        "use": "sig",
    +                        "n": "…",
    +                        "e": "AQAB",
    +                        "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +                    }
    +                ]
    +            },
    +            "client_name": "Name of an example organization",
    +            "contacts": [
    +                "ops@rp.example.it"
    +            ],
    +            "grant_types": [
    +                "refresh_token",
    +                "authorization_code"
    +            ],
    +            "redirect_uris": [
    +                "https://rp.example.it/oidc/rp/callback/"
    +            ],
    +            "response_types": [
    +                "code"
    +            ],
    +            "subject_type": "pairwise"
    +        }
    +    },
    +    "trust_chain": [
    +        "eyJhbGciOiJSUzI1NiIsImtpZCI6Ims1NEhRdERpYnlHY3M5WldWTWZ2aUhm ...",
    +        "eyJhbGciOiJSUzI1NiIsImtpZCI6IkJYdmZybG5oQU11SFIwN2FqVW1BY0JS ...",
    +        "eyJhbGciOiJSUzI1NiIsImtpZCI6IkJYdmZybG5oQU11SFIwN2FqVW1BY0JS ..."
    +    ]
    +}
    +
    +
    +
    +
    +

    EN 5. Trust Mark Status Request

    +
    POST /trust_mark_status HTTP/1.1
    +Host: registry.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +id=https%3A%2F%2registry.agid.gov.it%2Fopenid_relying_party%2Fpublic%2F
    +&sub=https%3A%2F%2rp.example.it%2F
    +
    +
    +
    +
    +

    EN 5.1. Trust Mark Status Response

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/json
    +
    +{"active": true}
    +
    +
    +
    +
    +

    EN 6. Authorization Request

    +

    Example (HTTP request):

    +
    GET /auth?client_id=https://rp.spid.agid.gov.it&
    +response_type=code&scope=openid& code_challenge=qWJlMe0xdbXrKxTm72EpH659bUxAxw80&
    +code_challenge_method=S256&
    +request=eyJhbGciOiJSUzI1NiIsImtpZCI6IjJIbm9GUzNZbkM5dGppQ2FpdmhXTFZVSj
    +NBeHdHR3pfOTh1UkZhcU1FRXMifQ.eyJpc3MiOiJodHRwczovL3RydXN0LWFuY2hvci5va
    +WRjLWZlZGVyYXRpb24ub25saW5lL29pZGMvcnAvIiwic2NvcGUiOiJvcGVuaWQiLCJyZWR
    +pcmVjdF91cmkiOiJodHRwczovL3RydXN0LWFuY2hvci5vaWRjLWZlZGVyYXRpb24ub25sa
    +W5lL29pZGMvcnAvY2FsbGJhY2siLCJyZXNwb25zZV90eXBlIjoiY29kZSIsIm5vbmNlIjo
    +iOXhnTWc4NHpsTG12OFJvRjg1RjJ5WExmdDQ1U3ZGUXciLCJzdGF0ZSI6InplaTJ6Mnh4e
    +jZYQUFZUHM0eUlxRzZ2aWpQNDJyTVpHIiwiY2xpZW50X2lkIjoiaHR0cHM6Ly90cnVzdC1
    +hbmNob3Iub2lkYy1mZWRlcmF0aW9uLm9ubGluZS9vaWRjL3JwLyIsImVuZHBvaW50Ijoia
    +HR0cHM6Ly90cnVzdC1hbmNob3Iub2lkYy1mZWRlcmF0aW9uLm9ubGluZS9vaWRjL29wL2F
    +1dGhvcml6YXRpb24iLCJhY3JfdmFsdWVzIjoiaHR0cHM6Ly93d3cuc3BpZC5nb3YuaXQvU
    +3BpZEwyIiwiaWF0IjoxNjg2NTc2OTI2LCJleHAiOjE2ODY1NzY5ODYsImp0aSI6IjAxMjZ
    +lZWRlLWUwZjMtNDE3My05NzE3LTQ0NzUyMmI2NmI2NyIsImF1ZCI6WyJodHRwczovL3Ryd
    +XN0LWFuY2hvci5vaWRjLWZlZGVyYXRpb24ub25saW5lL29pZGMvb3AvIiwiaHR0cHM6Ly9
    +0cnVzdC1hbmNob3Iub2lkYy1mZWRlcmF0aW9uLm9ubGluZS9vaWRjL29wL2F1dGhvcml6Y
    +XRpb24iXSwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImdpdmVuX25hbWUiOnsiZXNzZW50aWF
    +sIjp0cnVlfSwiZW1haWwiOnsiZXNzZW50aWFsIjp0cnVlfX0sInVzZXJpbmZvIjp7Imdpd
    +mVuX25hbWUiOm51bGwsImZhbWlseV9uYW1lIjpudWxsLCJlbWFpbCI6bnVsbCwiaHR0cHM
    +6Ly9hdHRyaWJ1dGVzLnNwaWQuZ292Lml0L2Zpc2NhbF9udW1iZXIiOm51bGx9fSwicHJvb
    +XB0IjoiY29uc2VudCBsb2dpbiIsImNvZGVfY2hhbGxlbmdlIjoidllobWRZcUNtMW1tZTJ
    +HcUZkRFdweHlvdEFPc3dlX0RFV0lNYUlUcHlOTSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZ
    +CI6IlMyNTYifQ.r1ei1Wep3p---8XFXEwptev-tlyzNBPnOiYk5Z11OY7cvHuRhExmMFmN
    +vyztwjQZRB92LsDMEaOs3bTfj_19S_L28o8MAMmjD5BO-obE8b_8rMNY4uVCAyNwzC6NVC
    +XnGQymH1UJWHvWGGUF_xO-8JVbWhV7cGJiwCrfaX3H-ZPyFQInHJh3NQ9uN2vk-FZvKl1I
    +urWVC4kUpe4FZKHX-2FjRe5kBKwPCw2eCMJgY-eSG0zEzukyHz5l3oUPQdk-olg3gowbNm
    +AB6nkURsiJqxu1clrEgnDIeM4yN0m-sEGXLehS40Iqds75e8IMfYBYqCQ2LgU9PwF5gr7e
    +iSQD8A
    +
    +Host: https://op.spid.agid.gov.it
    +HTTP/1.1
    +
    +
    +

    Example of JWT payload:

    +
    {
    +"alg": "RS256",
    +"kid": "2HnoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +}
    +.
    +{
    +    "client_id": "https://rp.spid.agid.gov.it",
    +    "response_type": "code",
    +    "scope": "openid",
    +    "code_challenge": "qWJlMe0xdbXrKxTm72EpH659bUxAxw80",
    +    "code_challenge_method": "S256",
    +    "nonce": "MBzGqyf9QytD28eupyWhSqMj78WNqpc2",
    +    "prompt": "login",
    +    "redirect_uri": "https://rp.spid.agid.gov.it/callback1",
    +    "acr_values": {
    +      "https://www.spid.gov.it/SpidL1":null,
    +      "https://www.spid.gov.it/SpidL2":null
    +    },
    +    "claims": {
    +      "userinfo": {
    +          "given_name":null,
    +          "family_name":null
    +      }
    +    },
    +    "state": "fyZiOL9Lf2CeKuNT2JzxiLRDink0uPcd"
    +}
    +
    +
    +
    +
    +

    EN 7. Metadata Policy

    +

    The following example shows a Metadata policy in the Entity Statement provided by a TA and related to an RP

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "jwks": {
    +          "keys": [{
    +            "subset_of": [{
    +                "kty": "RSA",
    +                "use": "sig",
    +                "n": "…",
    +                "e": "AQAB",
    +                "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }]
    +          }]
    +        },
    +        "grant_types": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        },
    +        "id_token_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "id_token_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "id_token_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "userinfo_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "userinfo_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "userinfo_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "token_endpoint_auth_method": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "client_registration_types": {
    +            "one_of": ["automatic"]
    +        }
    +    }
    +}
    +
    +
    +

    The following example shows a Metadata policy in the Entity Statement provided by a TA and related to an SA

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "grant_types": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        }
    +        "id_token_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "id_token_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "id_token_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "userinfo_signed_response_alg": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "userinfo_encrypted_response_alg": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "userinfo_encrypted_response_enc": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "token_endpoint_auth_method": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "client_registration_types": {
    +            "one_of": ["automatic"]
    +        }
    +    }
    +}
    +
    +
    +

    The following example shows a Metadata policy in the Entity Statement provided by a SA and related to an RP

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "jwks": {
    +            "subset_of": [{
    +                "kty": "RSA",
    +                "use": "sig",
    +                "n": "…",
    +                "e": "AQAB",
    +                "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }]
    +        }
    +    }
    +}
    +
    +
    +

    The following example shows a Metadata policy in the Entity Statement provided by a TA and related to an OP.

    +
    "metadata_policy": {
    +    "openid_relying_party": {
    +        "jwks": {
    +            "subset_of": [{
    +                "kty": "RSA",
    +                "use": "sig",
    +                "n": "…",
    +                "e": "AQAB",
    +                "kid": "5NNNoFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
    +            }]
    +        },
    +        "revocation_endpoint_auth_methods_supported": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "code_challenge_methods_supported": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        },
    +        "scopes_supported": {
    +            "subset_of": ["openid", "offline_access", "profile", "email"]
    +        },
    +        "response_types_supported": {
    +            "one_of": ["code"]
    +        },
    +        "response_modes_supported": {
    +            "subset_of": ["form_post", "query"]
    +        },
    +        "grant_types_supported": {
    +            "subset_of": ["authorization_code", "refresh_token"]
    +        },
    +        "acr_values_supported": {
    +            "subset_of": ["https://www.spid.gov.it/SpidL1", "https://www.spid.gov.it/SpidL2", "https://www.spid.gov.it/SpidL3"]
    +        },
    +        "subject_types_supported": {
    +            "one_of": ["pairwise"]
    +        },
    +        "id_token_signing_alg_values_supported": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "id_token_encryption_alg_values_supported": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "id_token_encryption_enc_values_supported": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "userinfo_signing_alg_values_supported": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "userinfo_encryption_alg_values_supported": {
    +            "one_of": ["RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A256KW"]
    +        },
    +        "userinfo_encryption_enc_values_supported": {
    +            "one_of": ["A128CBC-HS256", "A256CBC-HS512"]
    +        },
    +        "token_endpoint_auth_methods_supported": {
    +            "one_of": ["private_key_jwt"]
    +        },
    +        "token_endpoint_auth_signing_alg_values_supported": {
    +            "one_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        },
    +        "claims_parameter_supported": {
    +            "one_of": ["true"]
    +        },
    +        "request_parameter_supported": {
    +            "one_of": ["true"]
    +        },
    +        "authorization_response_iss_parameter_supported": {
    +            "one_of": ["true"]
    +        },
    +        "client_registration_types_supported": {
    +            "one_of": ["automatic"]
    +        },
    +        "request_authentication_methods_supported": {
    +            "one_of": ["request_object"]
    +        },
    +        "request_authentication_signing_alg_values_supported": {
    +            "subset_of": ["RS256", "RS512", "ES256", "ES512", "PS256", "PS512"]
    +        }
    +    }
    +}
    +
    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/federation_endpoint.html b/it/federation_endpoint.html new file mode 100644 index 00000000..50669c50 --- /dev/null +++ b/it/federation_endpoint.html @@ -0,0 +1,1374 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Endpoint di Federazione + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Endpoint di Federazione

    +

    Tutte le entità DEVONO contenere i seguenti endpoint:

    +
    +
      +
    • /.well-known/openid-federation: fornisce l'Entity Configuration (per maggiori dettagli vedi OIDC-FED Section 6)

    • +
    • resolve entity statement endpoint: fornisce il metadata finale, la Trust Chain e i Trust Mark relativi ad un altro soggetto. Per maggiori dettagli vedi OIDC-FED Section 7.2.

    • +
    +
    +
    +

    Avvertimento

    +

    Il resolve entity statement endpoint NON DEVE restituire alcuna informazione relativa ad un soggetto del quale non ha precedentemente raccolto gli statement e calcolato la Trust Chain. Nel caso in cui i TM non siano più validi al momento della richiesta, questi NON DEVONO essere inclusi nella risposta.

    +
    +

    Le Entità di tipo TA o SA DEVONO offrire i seguenti endpoint, in aggiunta agli endpoint di federazione sopra riportati:

    +
    +
      +
    • fetch entity statement endpoint: fornisce gli ES relativi ad un soggetto discendente diretto. Per ottenere un ES è necessario indicare almeno l'identificativo dell'entità di cui si vuole ottenere lo statement. (per maggiori dettagli vedi OIDC-FED Section 7.1)

    • +
    • trust mark status endpoint: permette a un'entità di verificare se un TM è ancora attivo o no. La query DEVE essere inviata al soggetto che ha rilasciato quel TM. (per maggiori dettagli vedi OIDC-FED Section 7.4)

    • +
    • entity listing endpoint: fornisce la lista delle entità discendenti registrate presso il TA o un SA (per maggiori dettagli vedi OIDC-FED Section 7.3)

    • +
    +
    +

    Un'entità di tipo AA, oltre agli endpoint di Federazione comuni a tutte le entità, DEVE riportare anche il trust mark status endpoint per consentire la validazione dinamica dei TM rilasciati dall'AA.

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/flusso_autenticazione.html b/it/flusso_autenticazione.html new file mode 100644 index 00000000..3034e0fe --- /dev/null +++ b/it/flusso_autenticazione.html @@ -0,0 +1,1377 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Flusso di autenticazione + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Flusso di autenticazione

    +

    Gli schemi di autenticazioni "Entra con SPID" e "Entra con CIE" implementano il flusso OpenID Connect Authorization Code Flow con l'estensione PKCE (Proof Key for Code Exchange, RFC 7636). +Questo flusso restituisce un Authorization Code che può essere utilizzato per ottenere un ID Token +e un Access Token e se possibile anche un Refresh Token. +L'Authorization Code Flow ottiene l'Authorization Code dall'Authorization Endpoint dell'OpenID Provider e tutti i token sono restituiti dal Token Endpoint.

    +_images/flusso.svg +

    Segue la descrizione dei passaggi, come da numerazione indicata in figura.

    +
    +
      +
    1. L'Utente, nella pagina di accesso del Relying Party (RP):

      +
        +
      • Seleziona il pulsante "Entra con SPID" o "Entra con CIE";

      • +
      • Nel caso SPID, seleziona l'OP con cui autenticarsi.

      • +
      +
    2. +
    3. Il RP prepara una Richiesta di Autorizzazione con i parametri necessari previsti da PKCE e la invia all'Authorization Endpoint dell'OP.

    4. +
    5. L'OP autentica l'utente mediante l'inserimento delle credenziali e ottiene il consenso per l'accesso agli attributi dell'utente da parte del RP.

    6. +
    7. L'OP reindirizza l'utente all'URL contenuto nel parametro redirect_uri specificato dal RP, passando un Authorization Code nell'Authorization Response.

    8. +
    9. Il RP invia l'Authorization Code ricevuto al Token Endpoint dell'OP.

    10. +
    11. Il Token Endpoint dell'OP rilascia un ID Token, un Access Token e se previsto un Refresh Token.

    12. +
    13. Il RP riceve e valida l'Access Token e l'ID Token. Per chiedere gli attributi che erano stati autorizzati dall'utente al punto 3, invia una richiesta all'UserInfo Endpoint dell'OP utilizzando l'Access Token per l'autenticazione all'interno della intestazione HTTP Authorization.

    14. +
    15. Lo UserInfo Endpoint dell'OP verifica la validità dell'Access Token e rilascia gli attributi richiesti al RP.

    16. +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/genindex.html b/it/genindex.html new file mode 100644 index 00000000..8df9bb17 --- /dev/null +++ b/it/genindex.html @@ -0,0 +1,1425 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Indice + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + + + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/index.html b/it/index.html new file mode 100644 index 00000000..4447c65d --- /dev/null +++ b/it/index.html @@ -0,0 +1,1531 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | SPID/CIE OpenID Connect + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + +
    +

    SPID/CIE OpenID Connect

    +

    SPID e CIE id sono i Sistemi Pubblici di Identità Digitale Italiani e +adottano gli standard OpenID Connect Core, International Government Assurance Profile (iGov) for OpenID Connect 1.0 e OpenID Connect Federation 1.0.

    +

    Grazie all'identità digitale, la Pubblica Amministrazione e i fornitori di servizi privati forniscono +la chiave per accedere ai servizi online attraverso una credenziale unica.

    +

    Questa documentazione contiene le specifiche tecniche consolidate, conformi alle Linee Guida Nazionali, +per migliorare l'esperienza di integrazione alle Federazioni OIDC SPID e CIE id per i Fornitori di Servizio +pubblici e privati (RP), Identity Providers (OP) e Soggetti Aggregatori (SA).

    +

    In questa documentazione trovi:

    +
    +
      +
    • Gli esempi pratici dei Metadata, delle richieste e delle risposte OpenID Connect.

    • +
    • Come effettuare la registrazione automatica dei RP presso gli OpenID Provider.

    • +
    • Come un OpenID Provider riconosce e registra dinamicamente un RP.

    • +
    • Come utilizzare gli endpoint della API della Federazione.

    • +
    • Come autenticare un utente a SPID e CIE ed ottenere i suoi attributi.

    • +
    +
    +
    +

    Indice dei contenuti

    +
    + +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/introspection_endpoint.html b/it/introspection_endpoint.html new file mode 100644 index 00000000..becdc37b --- /dev/null +++ b/it/introspection_endpoint.html @@ -0,0 +1,1473 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Introspection Endpoint (verifica validità token) + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Introspection Endpoint (verifica validità token)

    +

    L'Introspection Endpoint esposto dall'OP consente ai RP di ottenere informazioni su un token in loro possesso, come ad esempio la sua validità.

    + +
    +

    Request

    +

    La richiesta all'Introspection Endpoint consiste nell'invio del token su cui si vogliono ottenere informazioni unitamente a una Client Assertion che consente di autenticare il RP che esegue la richiesta.

    +

    Esempio:

    +
    POST /introspection HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88 … &
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +client_id=https%3A%2F%2Frp.spid.agid.gov.it&
    +token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT
    +QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8
    +iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4
    +MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA
    +RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw
    +RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9
    +h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w…
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    client_assertion

    JWT firmato con la chiave privata del Relying Party contenente gli stessi parametri documentati per le richieste al +Token Endpoint. L'OP deve verificare la validità di tutti i campi presenti nel JWT, nonché la validità della sua firma in relazione al parametro client_id.

    spid-icon cieid-icon

    client_assertion_type

    String. Valori ammessi: urn:ietf:params:oauth:clientassertion-type:jwt-bearer

    spid-icon cieid-icon

    client_id

    URI che identifica univocamente il RP. L'OP deve verificare che il client_id sia noto all'interno della Federazione.

    spid-icon cieid-icon

    token

    Il token su cui il RP vuole ottenere informazioni.

    spid-icon cieid-icon

    +
    +
    +

    Response

    +

    L'Introspection Endpoint risponde con un oggetto JSON definito come segue.

    +

    Esempio:

    +
    {
    +    "active":true
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    active

    Valore booleano che indica la validità del token. Se il token è scaduto, è revocato o non è mai stato emesso per il client_id chiamante, l'Introspection Endpoint deve restituire false.

    spid-icon cieid-icon

    scope

    Lista degli scope richiesti al momento dell’Authorization Request.

    spid-icon

    exp

    Scadenza del token.

    spid-icon

    sub

    Identificatore del soggetto, coincidente con quello già rilasciato nell’ID Token. Il RP deve verificare che il valore coincida con quello contenuto nell’ID Token.

    spid-icon

    client_id

    URI che identifica univocamente il RP come da Registro SPID. Il RP deve verificare che il valore coincida con il proprio client_id.

    spid-icon

    iss

    Identificatore dell’OP che lo contraddistingue univocamente nella federazione nel formato Uniform Resource Locator (URL). Il client è tenuto a verificare che questo valore corrisponda all’OP chiamato.

    spid-icon

    aud

    Contiene il client ID. Il client è tenuto a verificare che questo valore corrisponda al proprio client ID.

    spid-icon

    +
    +
    +

    Codici di errore

    +

    Come definiti per Token endpoint.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/la_federazione_delle_identita.html b/it/la_federazione_delle_identita.html new file mode 100644 index 00000000..13ff301f --- /dev/null +++ b/it/la_federazione_delle_identita.html @@ -0,0 +1,1388 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Le Federazioni eID Italiane + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Le Federazioni eID Italiane

    +

    Una Federazione delle Identità Digitali è una infrastruttura all'interno della quale tante organizzazioni, afferenti a domini differenti, aderiscono ad un medesimo quadro regolatorio per costruire un meccanismo di fiducia sia amministrativo, mediante la stipula di convenzioni e accreditamento presso una o più autorità super partes, che tecnologico, mediante l'adozione di standard di interoperabilità sicuri che consentono l'interscambio dei dati.

    +

    Questa configurazione stabilisce i livelli di garanzia e di sicurezza adeguati affinchè un individuo possa autenticarsi presso un servizio web (Service Provider) mediante la propria identità digitale, rilasciata da un altro servizio web (Identity Provider).

    +

    I partecipanti (RP o OP), che si riconoscono all'interno della medesima Federazione, ottengono i Metadata gli uni degli altri. I Metadata contengono le chiavi pubbliche per le operazioni di firma digitale e criptazione e le definizioni necessarie all'interscambio delle informazioni.

    +

    I Metadata sono certificati da un parte fidata che all'interno della Federazione SPID è AgID, mentre all'interno della Federazione CIE è il Ministero dell'Interno. Questi corrispondono alla Autorità di Federazione.

    +

    SPID e CIE id implementano OpenID Connect Federation 1.0 e ne estendono alcune funzionalità, realizzano una implementazione concreta e producono le buone pratiche per la sua adozione. Per approfondimenti allo standard si rimanda alle specifiche ufficiali OIDC-FED e alla sezione Differenze con OIDC Federation 1.0.

    +
    +

    OpenID Connect Federation

    +

    La Federazione OIDC produce una infrastruttura della fiducia che è:

    +
    +
      +
    • Dinamica. La fiducia può essere stabilita dinamicamente durante la prima richiesta di autenticazione. +Le Autorità della Federazione espongono un endpoint che fornisce "dichiarazioni" firmate riguardanti le entità discendenti. Queste contengono le chiavi pubbliche dei discendenti e la politica dei Metadata. Le Autorità della Federazione possono disabilitare un'entità nella Federazione in qualsiasi momento, semplicemente smettendo di emettere le dichiarazioni inerenti a questa.

    • +
    • Scalabile. Riduce significativamente i costi di onboarding, in accordo al principio di delega, con l'istituzione di entità intermediarie (SA).

    • +
    • Trasparente. Qualsiasi Entità coinvolta nella Federazione può in ogni momento costruire la fiducia autonomamente e in modo sicuro. Inoltre, la composizione della Federazione, in tutte le sue parti, diventa navigabile mediante la sua API, in tempo reale.

    • +
    +
    +_images/spid_cie_oidc_federation_model.svg +

    Schema ad albero con le Autorità di Federazione SPID e CIE id e, salendo, gli OP che non hanno Intermediari, gli RP e gli Intermediari che a loro volta Aggregano altri RP.

    +
    +
    +

    Configurazione della Federazione

    +

    La configurazione della Federazione è pubblicata dal Trust Anchor all'interno della sua Entity Configuration, disponibile presso un web path ben noto e corrispondente a .well-known/openid-federation.

    +

    Tutti i partecipanti DEVONO ottenere, prima della fase di esercizio, la configurazione della Federazione e mantenerla aggiornata su base giornaliera. All'interno della configurazione della Federazione sono pubblicate le chiave pubbliche del Trust Anchor usate per le operazioni di firma, il numero massimo di Intermediari consentiti tra una Foglia e il Trust Anchor (max_path length) e le autorità abilitate all'emissione dei Trust Mark (trust_marks_issuers).

    +

    Si veda qui un esempio non normativo di Entity Configuration response Trust Anchor

    +

    Si veda la Sezione dedicata alle Entity Configuration per ulteriori dettagli.

    +
    +
    +

    Modalità di partecipazione

    +

    Per aderire alle Federazioni SPID e CIE id un partecipante deve pubblicare la propria configurazione (Entity Configuration) presso il proprio web endpoint .well-known/openid-federation.

    +

    Gli incaricati tecnici ed amministrativi della Foglia completano la procedura amministrativa per la registrazione di una nuova Entità o l'aggiornamento di un'Entità preesistente definita dalla Autorità di Federazione o da un suo Intermediario (SA).

    +

    L'Autorità di Federazione o il suo Intermediario, dopo aver effettuato tutti i controlli amministrativi e tecnici richiesti, registra le chiavi pubbliche della Foglia e rilascia una prova di adesione alla Federazione sotto forma di Trust Mark (TM).

    +

    La Foglia DEVE includere il TM all'interno della propria configurazione di Federazione (Entity Configuration) come prova del buon esito del processo di onboarding.

    +

    L'Autorità di Federazione o suo Intermediario DEVE pubblicare la dichiarazione di riconoscimento della Foglia (Entity Statement) contenente le chiavi pubbliche di Federazione della Foglia e i TM a questa rilasciati.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/log_management.html b/it/log_management.html new file mode 100644 index 00000000..0a1c059e --- /dev/null +++ b/it/log_management.html @@ -0,0 +1,1412 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Retention Policy + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Retention Policy

    +
    +

    Gestione dei Log di un OP e di un RP

    +

    Gli OP e gli RP DEVONO mantenere:

    +
      +
    1. Un registro delle transazioni contenente i log relativi ai messaggi scambiati. I messaggi memorizzati e mantenuti nel registro DEVONO essere almeno i seguenti:

      +
      +
        +
      • Trust Chain relativa all'Entità con la quale è avvenuta la transazione, composta da:

        +
        +
          +
        1. L'Entity Configuration del Entità con la quale è avvenuta la transazione.

        2. +
        3. [Solo per OP] L'Entity Statement del SA riferito al RP (se presente).

        4. +
        5. L'Entity Statement del TA riferito al suo discendente.

        6. +
        7. L'Entity Configuration del TA.

        8. +
        +
        +
      • +
      • AuthenticationRequest

      • +
      • AuthenticationResponse relativa all'AuthenticationRequest

      • +
      • TokenRequest relativa all'AuthenticationRequest

      • +
      • TokenResponse relativa alla TokenRequest

      • +
      • L'eventuale UserInfoRequest relativa alla TokenRequest

      • +
      • L'eventuale UserInfoResponse relativa alla UserInfoRequest

      • +
      • L'eventuale RevocationRequest relativa alla TokenRequest

      • +
      • L'eventuale RevocationResponse relativa alla RevocationRequest

      • +
      +
      +
    2. +
    +
    +

    spid-icon

    +

    Per ogni messaggio POSSONO essere indicizzate, ai fini di ricerca e consultazione, le seguenti +informazioni:

    +
    +
      +
    • authorization code

    • +
    • client_id

    • +
    • jti

    • +
    • iss

    • +
    • sub

    • +
    • iat

    • +
    • exp

    • +
    +
    +
    +
    +

    Avvertimento

    +

    Le informazioni contenute nei registri DEVONO essere mantenute e gestite per una durata non inferiore a 24 mesi nel pieno rispetto delle vigenti normative nazionali ed europee in materia di privacy. L’accesso ai dati DEVE essere riservato a personale incaricato. Al fine di garantire la confidenzialità DEVONO essere adottati meccanismi di cifratura dei dati o impiegati sistemi di basi di dati (DBMS) che realizzano la persistenza cifrata delle informazioni. Infine, nella memorizzazione dei dati DEVONO essere garantite le proprietà di integrità e non ripudio.

    +
    +
    +
    +

    Registro storico delle chiavi pubbliche di Federazione

    +

    Al fine di consentire la verifica dei messaggi scambiati dalle Entità che partecipano alla federazione e delle relative Trust Chain, il TA DEVE pubblicare lo storico delle proprie chiavi pubbliche (JWKS) di federazione all'interno di un registro reso disponibile a tutti i partecipanti tramite l'endpoint /.well-known/openid-federation-historical-jwks. Per ulteriori dettagli tecnici si rimanda alla Sezione 7.5 di OIDC-FED.

    +
    +

    Avvertimento

    +

    Le chiavi che non sono sono più attive da più di 24 mesi POSSONO essere rimosse dal registro a discrezione del TA.

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/logout.html b/it/logout.html new file mode 100644 index 00000000..1a41b782 --- /dev/null +++ b/it/logout.html @@ -0,0 +1,1363 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Logout + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Logout

    +
    +

    cieid-icon

    +

    I RP POSSONO instaurare sessioni individuali relative agli utenti autenticati. Nei casi in cui tali sessioni individuali vengano instaurate dai RP, questi ultimi DEVONO fornire agli utenti una funzionalità di logout con lo scopo di eliminare la sessione individuale instaurata. +Durante la fase di logout i RP DEVONO revocare tutti gli Access Token ancora attivi e collegati all'autenticazione degli utenti, tramite l'utilizzo del revocation endpoint (Revocation Endpoint).

    +
    +

    Nota

    +

    Nel caso sia supportato dall'OP un meccanismo di offline_access tramite Refresh Token, quest'ultimo NON DEVE essere revocato a seguito di un logout.

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/metadata_aa.html b/it/metadata_aa.html new file mode 100644 index 00000000..f3bf64eb --- /dev/null +++ b/it/metadata_aa.html @@ -0,0 +1,1499 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Metadata Attribute Authority + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Metadata Attribute Authority

    +

    Una AA DEVE pubblicare, all'interno del suo EC, un Metadata federation_entity e un Metadata oauth_resource e, se le risorse sono protette, DEVE anche pubblicare un Metadata oauth_authorization_server.

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     },
    +     "oauth_authorization_server":{
    +       ...
    +     },
    +     "oauth_resource":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    Il Metadata di tipo "federation_entity" DEVE contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    organization_name

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    homepage_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    policy_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    logo_uri

    URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    contacts

    PEC istituzionale dell'ente. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    federation_trust_mark_status_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_resolve_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.8

    spid-icon cieid-icon

    +

    Il Metadata di tipo "oauth_authorization_server" DEVE contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    issuer

    Vedi RFC 8414#page-4. DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'AA.

    spid-icon cieid-icon

    authorization_endpoint

    Solo per Attribute Authority private flow. Vedi LG-AA and RFC 8414#page-4.

    spid-icon cieid-icon

    token_endpoint

    Vedi RFC 8414#page-4.

    spid-icon cieid-icon

    jwks

    Vedi JWK.

    spid-icon cieid-icon

    scopes_supported

    Vedi RFC 8414#page-4.

    spid-icon cieid-icon

    response_types_supported

    Vedi RFC 8414#page-4,

    spid-icon cieid-icon

    grant_types_supported

    Vedi RFC 8414#page-4 e RFC 8623.

    spid-icon cieid-icon

    token_endpoint_auth_methods_supported

    Vedi RFC 8414#page-4. Il valore supportato è private_key_jwt.

    spid-icon cieid-icon

    token_endpoint_auth_signing_alg_values_supported

    Vedi RFC 8414#page-4. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    op_policy_uri

    Vedi RFC 8414#page-4.

    spid-icon cieid-icon

    op_tos_uri

    Vedi RFC 8414#page-6.

    spid-icon cieid-icon

    dpop_signing_alg_values_supported

    Vedi OAuth-DPoP. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    +

    Il Metadata di tipo "oauth_resource" DEVE contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    resource

    Vedi OAuth-RS. Una o più HTTPS URL che identificano gli endpoint delle risorse protette.

    spid-icon cieid-icon

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/metadata_oidc.html b/it/metadata_oidc.html new file mode 100644 index 00000000..5054d427 --- /dev/null +++ b/it/metadata_oidc.html @@ -0,0 +1,1364 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Metadata + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Metadata

    +

    OIDC-FED utilizza ed estende i claim dei Metadata così come definiti all'interno delle specifiche di OpenID Connect Discovery 1.0 (OpenID.Discovery) e OpenID Connect Dynamic Client Registration 1.0 (OpenID.Registration) rispettivamente per OP e RP.

    +

    In OIDC-FED il Metadata OIDC relativo a RP e OP viene definito all'interno del claim metadata e del suo sotto claim <entity_type>, all'interno dell'Entity Configuration, come oggetto JSON.

    + +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/metadata_oidc_op.html b/it/metadata_oidc_op.html new file mode 100644 index 00000000..a6a44cb3 --- /dev/null +++ b/it/metadata_oidc_op.html @@ -0,0 +1,1522 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | OpenID Connect Provider Metadata (OP) + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    OpenID Connect Provider Metadata (OP)

    +

    Un OP DEVE pubblicare all'interno del suo EC un Metadata da federation_entity e uno da openid_provider come riportato nel seguente esempio:

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     }
    +     "openid_provider":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    L'EC di un OP DEVE configurare un metadata di tipo "federation_entity" e contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    organization_name

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    homepage_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    policy_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    logo_uri

    URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    contacts

    PEC istituzionale dell'ente. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    federation_resolve_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.6

    spid-icon cieid-icon

    +

    L'EC di un OP DEVE configurare un metadata di tipo "openid_provider" DEVE contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    issuer

    Vedi OpenID.Discovery#OP_Metadata. DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP.

    spid-icon cieid-icon

    authorization_endpoint

    Vedi OpenID.Discovery#OP_Metadata.

    spid-icon cieid-icon

    token_endpoint

    Vedi OpenID.Discovery#OP_Metadata.

    spid-icon cieid-icon

    userinfo_endpoint

    Vedi OpenID.Discovery#OP_Metadata.

    spid-icon cieid-icon

    introspection_endpoint

    Vedi RFC 8414#page-4.

    spid-icon cieid-icon

    revocation_endpoint

    Vedi RFC 8414#page-4.

    spid-icon cieid-icon

    revocation_endpoint_auth_methods_supported

    Vedi RFC 8414#page-4. Il valore supportato è private_key_jwt

    cieid-icon

    code_challenge_methods_supported

    Vedi RFC 8414#page-4. L'OP DEVE supportare S256 (vedi RFC 7636#section-4.3).

    spid-icon cieid-icon

    scopes_supported

    Vedi OpenID.Discovery#OP_Metadata. I valori supportati sono openid e offline_access. CIE id supporta anche profile, email. Per maggiori dettagli vedi Sezione User Claims.

    spid-icon cieid-icon

    response_types_supported

    Vedi OpenID.Discovery#OP_Metadata. Il valore supportato è code.

    spid-icon cieid-icon

    response_modes_supported

    Vedi OpenID.Discovery#OP_Metadata. I valori supportati sono form_post e query.

    spid-icon cieid-icon

    grant_types_supported

    Vedi OpenID.Discovery#OP_Metadata. I valori supportati sono refresh_token e authorization_code.

    spid-icon cieid-icon

    acr_values_supported

    Vedi OpenID.Discovery#OP_Metadata. I valori supportati sono:

    +

    https://www.spid.gov.it/SpidL1 +https://www.spid.gov.it/SpidL2 +https://www.spid.gov.it/SpidL3

    +

    spid-icon cieid-icon

    subject_types_supported

    Vedi OpenID.Discovery#OP_Metadata. Il valore supportato è pairwise.

    spid-icon cieid-icon

    id_token_signing_alg_values_supported

    Vedi OpenID.Discovery#OP_Metadata. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    id_token_encryption_alg_values_supported

    See OpenID.Discovery#OP_Metadata. Vedi key encryption Algoritmi crittografici.

    cieid-icon

    id_token_encryption_enc_values_supported

    See OpenID.Discovery#OP_Metadata. Vedi content encryption Algoritmi crittografici.

    cieid-icon

    userinfo_signing_alg_values_supported

    Vedi OpenID.Discovery#OP_Metadata. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    userinfo_encryption_alg_values_supported

    Vedi OpenID.Discovery#OP_Metadata. Vedi key encryption Algoritmi crittografici.

    spid-icon cieid-icon

    userinfo_encryption_enc_values_supported

    Vedi OpenID.Discovery#OP_Metadata. Vedi content encryption Algoritmi crittografici.

    spid-icon cieid-icon

    request_object_signing_alg_values_supported

    Vedi OpenID.Discovery#OP_Metadata. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    +
    +

    Avvertimento

    +

    Il Metadata "openid_provider" DEVE adottare il parametro jwks o signed_jwks_uri come normato da OID-FED invece del parametro jwks_uri come richiesto in OpenID.Discovery#OP_Metadata.

    +
    +
    +

    Vedi anche

    + +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/metadata_oidc_rp.html b/it/metadata_oidc_rp.html new file mode 100644 index 00000000..1edbb765 --- /dev/null +++ b/it/metadata_oidc_rp.html @@ -0,0 +1,1480 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | OpenID Connect Relying Party Metadata (RP) + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    OpenID Connect Relying Party Metadata (RP)

    +

    Un RP DEVE pubblicare all'interno del suo EC un Metadata di tipo federation_entity e uno di tipo openid_relying_party come riportato nel seguente esempio:

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     }
    +     "openid_relying_party":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    Il Metadata di tipo "federation_entity" DEVE contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    organization_name

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    homepage_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    policy_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    logo_uri

    (RACCOMANDATO) URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    contacts

    PEC istituzionale dell'ente. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    federation_resolve_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.6

    spid-icon cieid-icon

    +

    Il Metadata di tipo "openid_relying_party" DEVE contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    redirect_uris

    Vedi OpenID.Registration#ClientMetadata. È obbligatorio l'uso dello schema HTTPS nel caso di client web-based.

    spid-icon cieid-icon

    grant_types

    Vedi OpenID.Registration#ClientMetadata. I valori ammissibili authorization_code e refresh_token.

    spid-icon cieid-icon

    jwks

    Vedi OpenID.Registration#ClientMetadata e JWK.

    spid-icon cieid-icon

    id_token_signed_response_alg

    Vedi OpenID.Registration#ClientMetadata. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    id_token_encrypted_response_alg

    Vedi OpenID.Registration#ClientMetadata. Vedi key encryption Algoritmi crittografici.

    cieid-icon

    id_token_encrypted_response_enc

    Vedi OpenID.Registration#ClientMetadata. Obbligatorio solo nel caso sia presente anche il parametro id_token_encrypted_response_alg. Vedi content encryption Algoritmi crittografici.

    cieid-icon

    userinfo_signed_response_alg

    Vedi OpenID.Registration#ClientMetadata. Vedi signature Algoritmi crittografici.

    spid-icon cieid-icon

    userinfo_encrypted_response_alg

    Vedi OpenID.Registration#ClientMetadata. Vedi key encryption Algoritmi crittografici.

    spid-icon cieid-icon

    userinfo_encrypted_response_enc

    Vedi OpenID.Registration#ClientMetadata. Vedi content encryption Algoritmi crittografici.

    spid-icon cieid-icon

    token_endpoint_auth_method

    Vedi OpenID.Registration#ClientMetadata. Il valore richiesto è private_key_jwt.

    spid-icon cieid-icon

    client_id

    Vedi OpenID.Registration. DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP.

    spid-icon cieid-icon

    client_registration_types

    Vedi OIDC-FED Section 4.1. Il valore richiesto è automatic.

    spid-icon cieid-icon

    response_types

    Array dei valori di response_type previsti da OAuth 2.0 che il RP userà nelle richieste di autenticazione. Deve contenere il valore code.

    spid-icon cieid-icon

    +
    +

    Nota

    +

    Gli URI presenti nel parametro redirect_uris POSSONO anche usare eventuali schemi custom (ad es. myapp://) al fine di supportare applicazioni mobili.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/metadata_oidc_ta_sa.html b/it/metadata_oidc_ta_sa.html new file mode 100644 index 00000000..02ae5ea6 --- /dev/null +++ b/it/metadata_oidc_ta_sa.html @@ -0,0 +1,1423 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Metadata di Trust Anchor (TA) e Intermediari (SA) + + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Metadata di Trust Anchor (TA) e Intermediari (SA)

    +

    Un TA e un SA DEVONO pubblicare all'interno del loro EC un Metadata da federation_entity come riportato nel seguente esempio:

    +
    {
    +   "metadata":{
    +     "federation_entity":{
    +       ...
    +     }
    +   }
    +}
    +
    +
    +

    L'EC di un TA e di SA DEVE configurare un metadata di tipo "federation_entity" e contenere almeno i seguenti parametri obbligatori:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    organization_name

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    homepage_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    policy_uri

    Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    logo_uri

    URL del logo dell'entità; DEVE essere in formato SVG. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    contacts

    PEC istituzionale dell'ente. Vedi Sezione 4.8 di OIDC-FED

    spid-icon cieid-icon

    federation_fetch_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_list_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_trust_mark_status_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.8

    spid-icon cieid-icon

    federation_resolve_endpoint

    Vedi Sezione Endpoint di Federazione e OIDC-FED Section 4.8

    spid-icon cieid-icon

    +
    +

    Vedi anche

    +
      +
    • Esempio di EC di un OP e di un SA SA

    • +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/objects.inv b/it/objects.inv new file mode 100644 index 0000000000000000000000000000000000000000..99d43aa9f8a9dbdd94cf0e44e7e23e3c7813c2c4 GIT binary patch literal 1772 zcmVNERX>N99Zgg*Qc_4OWa&u{KZXhxWBOp+6Z)#;@bUGkYP)S5D zLrFy-Pf0{WAT1zLWoK_}Wgt{#V{U0Md?av*PJAarPHb0B7EY-J#6b0A}HZE$jBb8}^6Aa!$TZf78R zY-wUH3V7P3S(SRJ=oY#=Cr$`xZUoC(^dq zagpI>c#zMG(-$l$>q^qqJ)@lr0HYEHcH{HVqbw`x&mT+EGHVbyN+f2gL&5JJ>)M{2^& zVgdu2Ej)GvyYQ6fX4Kc0i48{gq^ww{b3u8Kzd6qY<`$^Pqbi7=3HkzXMD9axB_D(= z_n7|_#?LoOe-cMEq3BV`pzk09P~DCLG%FdctFoe`B<7Pg>=62PO44}xiS8hWq0Ly%saZH?W^IM^&Zcq~TnH zNde}DQ-r#!t&|e~A43JG$86d5vFR%4yQ5(tu_UT@MvN{=;6BCoq^6jMOM1V~&U<6${W&|~-t+8ySZC*h zvGd{5y96LA!~jRh(-A#xkYos>`)vUJaUJ+a1OD+0_`@auzgY)~z zw1-cErF*MVtrHDt{!S#WF&si$*3#;jxz-tdszli1d1HmAd$?(>DZI(O6k_fe#iW_E zLg6J-l4|WqtmO-k|DrzNY)~(^=#jr`2O(IA^N81gHy3 z5;ixiVy2xm)~OQV`Gp+&z9%~Qum-!KBkEI} zA^OLDgH6dengFDM4t=?Ht7{v&IB1+S0 zmumS)(r?5BNXh!7ao`#I;ii}_LvDc=KelgYxcmezkK+cHIuHDQ0S@!M!t=8JZEFH^Ea=IH$REWQ>bgAJ%9bB z!VKvDA<(RjwC?^`j10ef>!A}chL&bM<`_KTv=kNVNm;d+?#23%-lSh>{le;RM>5i6 z@Yygj&!x4#w#HY6wny-z%Q)F_BA!d#U1!raMVfhN#S0^TZ~jA%>OX)wuqu6riLl4s zIWndLAc-|OmqN=O!<{lQ3xZ%?JV7NfkA<2u2bhDb?E+%%jt zSgOacj~3zE0qZrqB*U5$Aiu6rad#@d+}`krw~YBg}26@6+T znNLcER!Yq$)efZ{ET`fS+HH$JMWa3N_ZJ?$90t;qgWn z`@JSt;$vS+{&wSGnojy!=)!8*8It1AZpWg@Uog#L{{-?KkX;E(f_xlU1Wv_q@{wF{ OHzKkR(SHGeso^@)C|bP$ literal 0 HcmV?d00001 diff --git a/it/revocation_endpoint.html b/it/revocation_endpoint.html new file mode 100644 index 00000000..bb7997d3 --- /dev/null +++ b/it/revocation_endpoint.html @@ -0,0 +1,1441 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Revocation Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Revocation Endpoint

    +

    Un RP PUÒ chiedere la revoca di un Access Token o di un Refresh Token emesso da un OP.

    +

    L'OP DEVE revocare il token specificato nella richiesta.

    +
    +

    spid-icon

    +

    Quando l'utente esegue il logout o quando la sua sessione presso il RP scade (in base alle policy decise da quest'ultimo) il RP DEVE richiedere la revoca dell’Access Token e dell’eventuale Refresh Token in suo possesso, se questi non fossero già scaduti.

    +
    +

    Nota

    +

    La revoca di un Access Token comporta la revoca di tutti i Refresh Token non ancora scaduti a questo collegati.

    +
    +

    L'OP DEVE revocare il token specificato nella richiesta e DEVE terminare la sessione di Single Sign-On se ancora attiva. Eventuali altri token attivi per l’utente dovranno invece essere mantenuti validi.

    +
    +
    +

    cieid-icon

    +

    La revoca di un Access Token NON DEVE comportare la revoca di tutti i Refresh Token a questo collegati.

    +

    La revoca di un Refresh Token DEVE comportare la revoca di tutti gli Access Token a questo collegati.

    +
    +
    +

    Nota

    +

    Il metodo di autenticazione del RP presso il revocation endpoint DEVE essere private_key_jwt (vedi il parametro revocation_endpoint_auth_methods_supported nella Sezione Metadata OP)

    +
    + +
    +

    Request

    +

    La richiesta al Revocation Endpoint consiste nell'invio del token che si vuole revocare unitamente a una Client Assertion che consente di identificare il RP che esegue la richiesta.

    +

    Esempio:

    +
    POST /revoke HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswLF88&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +client_id=https%3A%2F%2Frp.spid.agid.gov.it&
    +token=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MTg3MDI0MTQsImF1ZCI6WyJlNzFmYjcyYS05NzRmLT
    +QwMDEtYmNiNy1lNjdjMmJjMDAzN2YiXSwiaXNzIjoiaHR0cHM6XC9cL2FzLXZhLmV4YW1wbGUuY29tXC8
    +iLCJqdGkiOiIyMWIxNTk2ZC04NWQzLTQzN2MtYWQ4My1iM2YyY2UyNDcyNDQiLCJpYXQiOjE0MTg2OTg4
    +MTR9.FXDtEzDLbTHzFNroW7w27RLk5m0wprFfFH7h4bdFw5fR3pwiqejKmdfAbJvN3_yfAokBv06we5RA
    +RJUbdjmFFfRRW23cMbpGQCIk7Nq4L012X_1J4IewOQXXMLTyWQQ_BcBMjcW3MtPrY1AoOcfBOJPx1k2jw
    +RkYtyVTLWlff6S5gKciYf3b0bAdjoQEHd_IvssIPH3xuBJkmtkrTlfWR0Q0pdpeyVePkMSI28XZvDaGnxA4j7QI5loZYeyzGR9
    +h70xQLVzqwwl1P0-F_0JaDFMJFO1yl4IexfpoZZsB3HhF2vFdL6D_lLeHRyH2g2OzF59eMIsM_Ccs4G47862w
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    client_assertion

    JWT firmato con la chiave privata OIDC del Relying Party contenente gli stessi parametri inseriti in fase di richiesta al Token Endpoint. L'OP deve verificare la validità di tutti i campi presenti nel JWT, nonché la validità della sua firma in relazione al parametro client_id.

    spid-icon cieid-icon

    client_assertion_type

    String. urn:ietf:params:oauth:clientassertion-type:jwt-bearer

    spid-icon cieid-icon

    client_id

    URL HTTPS che identifica univocamente il RP.

    spid-icon cieid-icon

    token

    Il token che il RP chiede di revocare.

    spid-icon cieid-icon

    +
    +
    +

    Response

    +

    Il Revocation Endpoint risponde con un codice HTTP 200, anche nel caso in cui il token indicato non esista o sia già stato revocato (in modo da non rilasciare informazioni).

    +
    +
    +

    Codici di errore

    +

    Come definiti per Token endpoint.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/search.html b/it/search.html new file mode 100644 index 00000000..0d9e3f9c --- /dev/null +++ b/it/search.html @@ -0,0 +1,1361 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Cerca + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + + +
    + +
    + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/searchindex.js b/it/searchindex.js new file mode 100644 index 00000000..06ec479e --- /dev/null +++ b/it/searchindex.js @@ -0,0 +1 @@ +Search.setIndex({"docnames": ["attributi_utente", "authorization_endpoint", "avvisi_spid", "come_contribuire", "confronto_oidc_cie_e_oidc_igov", "cryptographic_algos", "differenze_oidc_fed", "differenze_spid_cie", "diventa_fornitore", "entity_configuration", "entity_statement", "errors_federation", "esempi", "federation_endpoint", "flusso_autenticazione", "index", "introspection_endpoint", "la_federazione_delle_identita", "log_management", "logout", "metadata_aa", "metadata_oidc", "metadata_oidc_op", "metadata_oidc_rp", "metadata_oidc_ta_sa", "revocation_endpoint", "seccons_bcps", "soggetti_aggregatori", "standards", "termini_acronimi", "token_endpoint", "trust_marks", "trust_negotiation", "userinfo_endpoint"], "filenames": ["attributi_utente.rst", "authorization_endpoint.rst", "avvisi_spid.rst", "come_contribuire.rst", "confronto_oidc_cie_e_oidc_igov.rst", "cryptographic_algos.rst", "differenze_oidc_fed.rst", "differenze_spid_cie.rst", "diventa_fornitore.rst", "entity_configuration.rst", "entity_statement.rst", "errors_federation.rst", "esempi.rst", "federation_endpoint.rst", "flusso_autenticazione.rst", "index.rst", "introspection_endpoint.rst", "la_federazione_delle_identita.rst", "log_management.rst", "logout.rst", "metadata_aa.rst", "metadata_oidc.rst", "metadata_oidc_op.rst", "metadata_oidc_rp.rst", "metadata_oidc_ta_sa.rst", "revocation_endpoint.rst", "seccons_bcps.rst", "soggetti_aggregatori.rst", "standards.rst", "termini_acronimi.rst", "token_endpoint.rst", "trust_marks.rst", "trust_negotiation.rst", "userinfo_endpoint.rst"], "titles": ["Tabella attributi utente", "Authorization endpoint (Authentication)", "Riferimenti normativi SPID", "Come contribuire", "Differenze con OIDC iGov", "Algoritmi crittografici", "Differenze con OIDC Federation", "Differenze tra SPID e CIE id", "Diventa fornitore di servizi", "Entity Configuration", "Entity Statement", "Gestione degli errori di federazione", "Esempi", "Endpoint di Federazione", "Flusso di autenticazione", "SPID/CIE OpenID Connect", "Introspection Endpoint (verifica validit\u00e0 token)", "Le Federazioni eID Italiane", "Retention Policy", "Logout", "Metadata Attribute Authority", "Metadata", "OpenID Connect Provider Metadata (OP)", "OpenID Connect Relying Party Metadata (RP)", "Metadata di Trust Anchor (TA) e Intermediari (SA)", "Revocation Endpoint", "Considerazioni di Sicurezza", "Soggetti Aggregatori", "Riferimenti", "Termini e Acronimi", "Token Endpoint", "Trust Mark", "Acquisire i Metadata", "UserInfo Endpoint"], "terms": {"tutt": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "conten": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "quest": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "document": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "son": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "intend": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "com": [0, 1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 27, 28, 29, 30, 31, 32, 33], "normat": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 30, 31, 32, 33], "All": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "the": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "examples": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "contained": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "this": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "documentation": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "are": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "meant": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "to": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "be": [0, 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "La": [0, 1, 4, 5, 6, 10, 11, 13, 16, 17, 25, 26, 29, 30, 31, 32, 33], "seguent": [0, 1, 2, 4, 5, 9, 10, 13, 18, 20, 22, 23, 24, 27, 28, 30, 31, 33], "riport": [0, 1, 4, 7, 8, 10, 13, 22, 23, 24, 27, 30, 31], "elenc": [0, 6], "support": [0, 1, 2, 4, 5, 7, 9, 10, 11, 15, 16, 19, 20, 22, 23, 24, 25, 28, 30, 31, 33], "spid": [0, 4, 5, 6, 8, 10, 12, 14, 16, 17, 22, 29, 31, 32], "cie": [0, 4, 5, 6, 8, 10, 14, 17, 22, 29, 31, 32], "variabl": 0, "prefix": 0, "https": [0, 1, 10, 12, 16, 20, 22, 23, 25, 27, 30, 31, 32, 33], "attributes": [0, 1, 12, 31, 33], "eid": [0, 1, 15, 31], "gov": [0, 1, 10, 12, 16, 22, 25, 30, 31, 33], "it": [0, 1, 10, 12, 16, 22, 25, 27, 30, 31, 32, 33], "rappresent": [0, 1, 9, 10, 11, 12, 29, 30, 31, 32], "namespac": 0, "claim": [0, 1, 4, 10, 11, 15, 16, 20, 21, 22, 23, 24, 25, 26, 30, 31, 32, 33], "descrizion": [0, 1, 9, 10, 11, 14, 16, 20, 22, 23, 24, 25, 30, 31, 33], "spid_cod": [0, 12], "categor": 0, "anagraf": 0, "codic": [0, 15, 27, 28, 31], "identif": [0, 1, 4, 9, 10, 13, 16, 20, 22, 23, 25, 27, 29, 30, 31, 32, 33], "string": [0, 1, 9, 16, 25, 30, 31, 33], "Il": [0, 1, 4, 10, 11, 13, 14, 16, 20, 22, 23, 25, 27, 29, 30, 31, 32, 33], "assegn": [0, 9], "gestor": [0, 2, 28, 29, 31], "ident": [0, 15, 17, 28, 29, 30], "digital": [0, 15, 17, 28, 29, 30], "dev": [0, 1, 4, 5, 9, 10, 11, 13, 16, 17, 18, 19, 20, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33], "esser": [0, 1, 4, 5, 9, 10, 13, 14, 17, 18, 19, 20, 22, 23, 24, 25, 26, 29, 30, 31, 32, 33], "univoc": [0, 1, 9, 16, 20, 22, 23, 25, 27, 30, 31, 32, 33], "form": [0, 1, 9, 12, 16, 17, 20, 22, 23, 24, 25, 29, 30, 31, 32], "codice_identif": 0, "cod_idp": 0, "nr": 0, "Dove": 0, "compost": [0, 18, 31], "4": [0, 1, 2, 4, 13, 15, 20, 22, 23, 24, 28, 33], "lett": 0, "alfanumer": [0, 1, 30], "10": [0, 28, 29], "caratter": [0, 1, 30], "gener": [0, 1, 9, 30, 31, 32, 33], "manier": [0, 26, 32], "ambit": [0, 6, 26], "propr": [0, 5, 9, 10, 16, 17, 18, 26, 27, 29, 30, 31, 32, 33], "domin": [0, 17, 27], "abcd123456789a": 0, "given_nam": [0, 1, 12], "nom": [0, 31], "sequenz": [0, 29], "parol": [0, 29], "caratt": [0, 2, 28, 30], "inizial": [0, 7, 30], "maiuscol": [0, 29], "intervall": 0, "spaz": [0, 1], "singol": [0, 1], "giovann": 0, "mar": [0, 33], "family_nam": [0, 1, 12, 33], "cognom": 0, "bianc": 0, "verd": 0, "place_of_birth": [0, 12], "luog": 0, "nasc": 0, "provinc": 0, "json": [0, 9, 10, 12, 16, 21, 28, 29, 30, 31, 32], "object": [0, 1, 9, 10, 28, 31], "locality": 0, "corrispondent": [0, 1, 17, 29, 31, 32], "catastal": 0, "belfior": 0, "comun": [0, 3, 13, 15, 31], "nazion": 0, "ester": 0, "es": [0, 5, 9, 10, 12, 13, 23, 27, 29, 31], "f205": 0, "citt": 0, "mil": 0, "region": 0, "sigl": 0, "MI": 0, "birthd": [0, 1, 12], "dat": [0, 2, 10, 17, 18, 28, 29, 30, 31, 32], "second": [0, 4, 9, 27, 29, 30, 31, 32], "specif": [0, 1, 2, 4, 9, 10, 11, 15, 17, 21, 26, 28, 31], "iso8601": [0, 28], "2004": [0, 28], "yyyy": 0, "indic": [0, 1, 9, 13, 14, 16, 25, 26, 28, 29, 30, 31, 33], "anno": 0, "utilizz": [0, 1, 4, 5, 7, 14, 15, 19, 21, 26, 29, 30, 33], "cifr": [0, 4, 18, 30, 33], "mm": 0, "mes": [0, 18], "due": [0, 26, 31], "dd": 0, "giorn": [0, 30], "2002": [0, 28], "09": [0, 2, 28], "24": [0, 2, 18, 28], "gender": [0, 12], "sess": 0, "valor": [0, 1, 7, 9, 10, 16, 20, 22, 23, 26, 29, 30, 31, 32, 33], "ammess": [0, 16], "femal": 0, "femminil": 0, "mal": 0, "maschil": 0, "company_nam": [0, 12], "ragion": [0, 6, 26, 30], "denomin": [0, 12, 26], "social": 0, "In": [0, 1, 4, 5, 6, 7, 11, 12, 15, 21, 26, 29, 30, 31, 32], "sottostring": 0, "agenz": [0, 29], "ital": [0, 3, 29], "registered_off": [0, 12], "extra": 0, "sed": 0, "legal": [0, 12, 29], "formatted": 0, "street_address": 0, "postal_cod": 0, "country": 0, "country_cod": 0, "tipolog": [0, 27], "via": 0, "vial": 0, "piazz": 0, "indirizz": [0, 8, 29], "civic": 0, "cap": 0, "inser": [0, 7, 14, 25, 30], "address": [0, 12], "listz": 0, "21": 0, "00144": 0, "rom": 0, "fiscal_number": [0, 1, 12, 31, 33], "fiscal": [0, 31], "person": 0, "fisic": 0, "Per": [0, 1, 3, 6, 7, 9, 10, 13, 14, 17, 18, 22, 26, 30, 32, 33], "facc": [0, 1, 26], "rifer": [0, 1, 5, 8, 9, 10, 15, 18, 27], "codif": [0, 29, 30], "cf": 0, "certific": [0, 17, 28], "propost": [0, 3], "draft": [0, 4, 28, 30], "etsi": 0, "en": [0, 15], "319": 0, "412": [0, 28], "1": [0, 1, 4, 7, 10, 13, 15, 16, 17, 21, 23, 25, 26, 28, 29, 30, 31, 32, 33], "cas": [0, 1, 2, 4, 11, 13, 14, 19, 23, 25, 26, 27, 28, 30, 31, 32], "preved": [0, 7], "composizion": [0, 1, 15, 17, 27], "tinit": 0, "codicefiscal": 0, "abcxyz00w00z000z": 0, "company_fiscal_number": 0, "giurid": 0, "segu": [0, 1, 3, 8, 10, 11, 14, 16, 19, 29, 30, 31, 32], "vat_number": [0, 12, 31], "part": [0, 1, 2, 9, 14, 17, 26, 27, 28, 29, 30, 31, 32], "iva": [0, 31], "vatit": 0, "partit": 0, "12345678901": 0, "document_details": [0, 12], "d": [0, 4, 7, 28, 29, 32], "contenent": [0, 1, 3, 9, 10, 16, 17, 18, 25, 26, 27, 29, 30, 33], "propriet": [0, 18], "type": [0, 12, 16, 25, 30, 33], "cartaident": 0, "passaport": 0, "patenteguid": 0, "patentenaut": 0, "librettopension": 0, "patentinoimpterm": 0, "port": 0, "tesserariconosc": 0, "document_number": 0, "numer": [0, 9, 14, 15, 17, 32], "issuer": [0, 1, 12, 20, 22, 28], "ente": [0, 20, 22, 23, 24, 29, 31], "emettitor": [0, 4, 29, 31], "nam": [0, 12, 33], "otten": [0, 1, 3, 7, 13, 14, 15, 16, 17, 26, 30, 32, 33], "concaten": [0, 32], "termin": [0, 1, 15, 25, 30], "costituent": 0, "men": [0, 26, 31], "congiunzion": 0, "articol": 0, "preposizion": 0, "regionelaz": 0, "laz": 0, "provinciacatan": 0, "catan": 0, "prefetturarom": 0, "prefettur": 0, "ministeroeconomiafin": 0, "minister": [0, 17, 29], "econom": 0, "finanz": 0, "date_of_issuanc": 0, "rilasc": [0, 7, 13, 14, 16, 17, 25, 26, 30, 31, 32, 33], "date_of_expiry": 0, "scadenz": [0, 1, 7, 9, 16, 29, 30, 31, 32, 33], "as09452389": 0, "comunerom": 0, "2013": [0, 28], "01": 0, "02": 0, "31": 0, "phone_number": [0, 12], "telef": 0, "mobil": [0, 23, 30], "senz": [0, 26, 29, 30], "intermed": [0, 12, 26, 31], "phone_number_verified": 0, "bool": [0, 16], "stat": [0, 1, 2, 11, 12, 14, 16, 25, 28, 29, 30, 31], "verific": [0, 1, 13, 16, 25, 29, 30, 33], "op": [0, 1, 7, 9, 12, 14, 15, 16, 17, 19, 21, 24, 25, 26, 27, 29, 30, 31, 32, 33], "landline_number": 0, "fiss": [0, 30], "email": [0, 1, 4, 7, 10, 12, 22, 30, 31], "post": [0, 1, 4, 7, 12, 16, 25, 30, 33], "elettron": [0, 28, 29], "standard": [0, 6, 15, 17, 27, 30, 31], "domain": [0, 31], "email_verified": [0, 1], "e_delivery_serv": [0, 12], "domicil": 0, "casell": 0, "pec": [0, 20, 22, 23, 24, 31], "pecdomain": 0, "eid_exp_d": [0, 12], "L": [0, 1, 2, 4, 6, 10, 11, 14, 16, 17, 18, 22, 24, 25, 26, 28, 30, 32, 33], "contien": [0, 1, 9, 10, 15, 16, 29, 30, 31], "Le": [0, 2, 9, 13, 15, 18, 28, 29], "tre": 0, "inform": [0, 2, 13, 16, 17, 18, 25, 28, 30, 31], "preferibil": 0, "ordin": [0, 1], "uso": [0, 1, 4, 23, 33], "liszt": 0, "rm": 0, "Si": [0, 5, 10, 17, 26, 31, 32], "comod": 0, "dann": 0, "unic": [0, 15, 30], "particol": 0, "titol": 0, "italian": [0, 15, 31], "oidc": [0, 1, 5, 9, 10, 12, 13, 15, 17, 18, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 31, 32], "s": [0, 28], "salar": 0, "km": 0, "23": [0, 28], "800": 0, "00015": 0, "monterotond": 0, "Vi": 0, "unit": [0, 16, 25], "amer": 0, "oltre": [0, 7, 13, 32], "us": 0, "esist": [0, 25, 31], "tal": [0, 1, 2, 5, 7, 19, 28, 30], "camp": [0, 16, 25, 33], "503": [0, 30], "washington": 0, "avenu": 0, "12401": 0, "kingston": 0, "new": 0, "york": 0, "esemp": [1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33], "avvi": [1, 2, 26, 28, 31, 32], "process": [1, 10, 17, 29, 30, 31, 32], "autent": [1, 4, 7, 15, 17, 19, 23, 25, 26, 27, 30, 32, 33], "rp": [1, 4, 7, 9, 14, 15, 16, 17, 19, 21, 25, 26, 27, 29, 30, 31, 32, 33], "reindirizz": [1, 14], "utent": [1, 2, 7, 14, 15, 19, 25, 28, 30, 31, 32, 33], "selezion": [1, 14], "invi": [1, 13, 14, 16, 25, 30, 33], "richiest": [1, 4, 7, 11, 12, 13, 14, 15, 16, 17, 22, 23, 25, 26, 29, 30, 31, 32, 33], "http": [1, 7, 11, 12, 14, 16, 25, 28, 30, 33], "jwt": [1, 4, 9, 10, 12, 16, 25, 28, 29, 30, 31, 33], "firm": [1, 4, 5, 15, 16, 17, 25, 29, 30, 31, 32, 33], "veicol": 1, "pu\u00f2": [1, 2, 9, 10, 14, 17, 25, 26, 27, 28, 29, 30, 31, 32], "metod": [1, 7, 25, 30, 33], "get": [1, 7, 12, 33], "mediant": [1, 9, 14, 17, 26, 27, 29, 31, 32], "trasmess": 1, "serialization": 1, "query": [1, 10, 12, 13, 22], "maggior": [1, 13, 22, 30], "dettagl": [1, 7, 10, 11, 13, 17, 18, 22, 30], "ved": [1, 7, 9, 11, 13, 17, 20, 22, 23, 24, 25, 29, 30, 31, 32, 33], "openid": [1, 2, 4, 5, 7, 9, 10, 13, 14, 16, 18, 21, 27, 28, 29, 30, 31, 33], "cor": [1, 4, 5, 9, 10, 15, 28, 30, 31, 33], "serializations": 1, "chiam": [1, 16, 30], "intern": [1, 4, 5, 7, 9, 10, 11, 12, 14, 16, 17, 18, 20, 21, 22, 23, 24, 26, 27, 29, 30, 31, 32, 33], "oggett": [1, 4, 9, 10, 16, 21, 26, 31, 32], "lor": [1, 12, 16, 17, 24, 26, 31, 32], "corrispond": [1, 16, 17, 30, 32], "I": [1, 4, 7, 9, 17, 18, 19, 22, 23, 27, 28, 30, 31, 32, 33], "client_id": [1, 7, 12, 16, 18, 23, 25, 26, 27, 30, 32, 33], "response_typ": [1, 7, 12, 23], "dovrebber": [1, 9], "contrar": [1, 7], "sol": [1, 4, 7, 9, 10, 18, 20, 23, 29, 30, 31, 33], "consider": [1, 4, 6, 9, 10, 15, 29], "Di": [1, 10, 30, 31], "obblig": [1, 2, 6, 20, 22, 23, 24, 28, 31], "defin": [1, 4, 7, 9, 10, 11, 12, 16, 17, 21, 25, 26, 27, 29, 30, 31, 32, 33], "scopes_supported": [1, 10, 12, 20, 22], "metad": [1, 4, 5, 9, 11, 13, 15, 17, 25, 28, 29, 30, 31], "present": [1, 2, 6, 7, 11, 16, 18, 23, 25, 26, 27, 28, 29, 30, 31, 32], "almen": [1, 13, 18, 20, 22, 23, 24, 27, 30, 32], "code_challeng": [1, 12, 30], "rfc": [1, 4, 9, 14, 20, 22, 28, 29, 30, 31, 32, 33], "7636": [1, 14, 22, 28], "section": [1, 10, 13, 16, 20, 22, 23, 24, 29, 30, 33], "2": [1, 4, 13, 15, 16, 23, 28, 29, 30, 31, 32, 33], "code_challenge_method": [1, 12], "code_challenge_methods_supported": [1, 10, 12, 22], "jwtrequests": 1, "tabell": [1, 2, 15, 27, 28, 31], "header": [1, 30, 33], "jos": [1, 9, 12, 30, 33], "alg": [1, 12, 30, 33], "7516": [1, 28], "algoritm": [1, 9, 10, 15, 20, 22, 23, 30, 33], "crittograf": [1, 9, 10, 15, 20, 22, 23, 31, 33], "kid": [1, 9, 12, 30, 33], "7638": [1, 28, 33], "section_3": [1, 10, 33], "typ": [1, 12, 30], "omess": 1, "assum": [1, 30], "implic": [1, 6, 7], "payload": [1, 12, 30, 33], "registration": [1, 15, 21, 23, 28, 30, 32], "valorizz": [1, 20, 22, 23, 26, 30, 33], "url": [1, 9, 14, 16, 20, 22, 23, 24, 25, 26, 29, 30, 31, 32], "nonc": [1, 12, 16, 25, 30], "authrequest": [1, 30], "casual": [1, 30], "32": [1, 30], "sar": [1, 26], "restitu": [1, 13, 14, 16, 30, 33], "id": [1, 4, 5, 9, 10, 12, 14, 15, 16, 17, 22, 29, 31, 32, 33], "token": [1, 4, 12, 14, 15, 19, 25, 28, 29, 33], "forn": [1, 13, 15, 17, 19, 30, 31], "mod": [1, 17, 25, 31], "consent": [1, 7, 9, 13, 16, 17, 18, 25, 26, 29, 30, 31, 32], "client": [1, 4, 11, 15, 16, 21, 23, 25, 26, 28, 30, 32], "ugual": [1, 30], "quell": [1, 9, 16, 26, 30, 31, 32, 33], "prompt": [1, 12, 30], "Se": [1, 3, 16, 27, 30, 32], "gi\u00e0": [1, 2, 16, 25, 26, 27, 28, 30, 33], "attiv": [1, 7, 13, 18, 19, 25], "session": [1, 7, 19, 25, 30], "singl": [1, 7, 25], "sign": [1, 7, 25], "on": [1, 7, 25, 28], "fa": [1, 29, 30, 32], "quind": [1, 30], "chied": [1, 14, 25], "consens": [1, 7, 14, 30], "trasfer": 1, "attrib": [1, 2, 7, 9, 10, 14, 15, 21, 26, 28, 29, 30, 31, 33], "login": [1, 12], "forz": 1, "redirect_ur": [1, 12, 14, 26, 27], "response_types_supported": [1, 10, 12, 20, 22], "acr_values": [1, 4, 12, 30], "acr_values_supported": [1, 10, 12, 22], "class": 1, "contest": [1, 30, 31], "separ": 1, "acr": [1, 4, 30], "preferent": 1, "livell": [1, 7, 17, 30], "alto": [1, 3], "quant": [1, 2, 9, 11, 26, 28, 31], "scelt": 1, "comport": [1, 2, 25, 28], "esit": [1, 17, 29, 31], "negat": [1, 31], "claimsrequestparameter": 1, "sezion": [1, 2, 4, 6, 7, 9, 10, 12, 17, 18, 20, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32], "lat": 1, "verr": 1, "rispost": [1, 7, 12, 13, 15, 30, 32], "exp": [1, 4, 9, 10, 12, 16, 18, 26, 30, 31, 32, 33], "unix": [1, 9, 30, 31, 33], "timestamp": [1, 9, 30, 31, 33], "istant": [1, 9, 30, 31, 33], "codific": [1, 9, 30, 31, 33], "numericd": [1, 9, 30, 31, 33], "7519": [1, 9, 28, 29, 30, 31, 33], "iat": [1, 4, 9, 10, 12, 18, 30, 31, 33], "iss": [1, 4, 7, 9, 10, 12, 16, 18, 28, 30, 31, 33], "aud": [1, 4, 6, 16, 30, 33], "ui_locales": 1, "lingu": 1, "prefer": 1, "visualizz": 1, "pagin": [1, 14, 30, 32], "ignor": [1, 6], "dispon": [1, 7, 17, 18, 26, 27, 30, 31, 32], "nessun": [1, 11, 26, 32], "list": [1, 9, 13, 15, 16, 26, 29, 31, 32], "rfc5646": 1, "pkce": [1, 4, 14], "estension": [1, 14, 31], "protocoll": [1, 29, 31], "oauth": [1, 4, 7, 16, 20, 23, 25, 28, 30], "0": [1, 15, 17, 21, 23, 26, 28, 29, 30, 31], "previst": [1, 5, 14, 23, 30], "profil": [1, 4, 7, 10, 11, 12, 15, 22, 28, 29, 30, 31, 32], "igov": [1, 15, 16, 28, 30, 33], "international": [1, 15, 28, 30], "government": [1, 15, 30], "assuranc": [1, 15, 30], "for": [1, 14, 15, 28, 30], "finalizz": [1, 11], "evit": [1, 4, 26], "potenzial": 1, "attacc": [1, 4, 7, 26], "attu": 1, "intercett": 1, "cod": [1, 10, 12, 14, 18, 22, 23, 27, 28, 30, 31], "consist": [1, 16, 25], "verifier": 1, "hash": [1, 30], "challeng": 1, "vien": [1, 21, 31, 32], "quand": [1, 25, 26, 29, 32], "contatt": [1, 31], "fluss": [1, 4, 15, 30], "originar": [1, 30], "cre": [1, 2, 26, 28], "poss": [1, 4, 9, 17, 18, 19, 23, 29, 30, 31], "confront": [1, 32], "acquis": [1, 15, 29], "script": 1, "python": 1, "import": 1, "hashlib": 1, "base64": [1, 29], "re": 1, "os": 1, "random": 1, "def": 1, "get_pkc": 1, "str": 1, "s256": [1, 10, 12, 22], "code_challenge_length": 1, "int": 1, "64": 1, "hashers": 1, "sha256": 1, "code_verifier_length": 1, "randint": 1, "43": 1, "128": 1, "code_verifier": [1, 30], "urlsafe_b64encod": 1, "urandom": 1, "decod": 1, "utf": 1, "8": [1, 4, 20, 22, 23, 24], "sub": [1, 4, 9, 10, 12, 16, 18, 26, 30, 31, 33], "za": 1, "z0": 1, "9": 1, "encod": 1, "digest": 1, "replac": 1, "return": 1, "Gli": [1, 4, 9, 10, 14, 15, 17, 18, 23, 31], "usand": [1, 4, 30, 32], "Non": [1, 9], "possibil": [1, 14, 26, 30], "richied": [1, 2, 7, 25, 28, 29, 30, 32], "userinf": [1, 4, 12, 14, 15, 30], "Nel": [1, 13, 14, 19, 27, 31], "default": 1, "minimum": 1, "dataset": 1, "eidas": [1, 28], "national": 1, "uniqu": 1, "identifier": [1, 28], "permett": [1, 13], "res": [1, 18, 26, 30], "Ad": [1, 30, 31], "congiunt": 1, "union": [1, 28], "insiem": [1, 9, 12, 30, 31], "combin": 1, "essi": [1, 2, 10, 28], "dovrebb": [1, 4, 29, 30], "usar": [1, 23, 26], "tram": [1, 7, 18, 19, 30, 33], "oppur": [1, 26, 27, 32], "NON": [1, 4, 5, 13, 19, 25, 26, 29, 30, 31], "soltant": [1, 26], "definizion": [1, 17, 26], "modal": [1, 4, 6, 15, 27, 28, 29, 30, 31, 32], "far": [1, 26], "claimsparameter": 1, "Un": [1, 9, 13, 18, 22, 23, 24, 25, 26, 27, 29, 31, 32], "messagg": [1, 11, 18, 32], "autorizz": [1, 11, 14, 26, 30, 32], "provider": [1, 4, 14, 15, 17, 21, 29, 30], "specific": [1, 7, 14, 25, 29, 33], "aggiung": [1, 7, 26, 27, 31, 32], "tools": [1, 16, 25, 30], "ietf": [1, 4, 7, 16, 25, 28, 30], "org": [1, 16, 25, 30], "html": [1, 16, 25, 30, 33], "rfc6749": [1, 30], "net": [1, 16, 30, 33], "specs": [1, 16, 30, 33], "connect": [1, 2, 4, 7, 14, 21, 28, 29, 30, 31, 32, 33], "1_0": [1, 16, 30, 33], "authrequestvalidation": 1, "avven": [1, 18], "success": [1, 30, 32], "parameters": 1, "authrespons": 1, "pass": [1, 14, 32], "access": [1, 4, 7, 14, 15, 18, 19, 25, 28, 33], "vantagg": 1, "esporr": [1, 31, 32], "alcun": [1, 6, 13, 17, 26, 27, 31], "user": [1, 22, 23], "agent": 1, "malw": 1, "controll": [1, 10, 17, 32], "inclus": [1, 4, 13], "ten": [1, 16], "stess": [1, 7, 9, 10, 16, 25, 26, 30], "valid": [1, 7, 11, 13, 14, 15, 25, 26, 29, 32, 33], "test": [1, 29], "callback": [1, 12, 27], "a032faf23d986353019ff8eda96cadce2ea1c368f04bf4c5e1759d559dda1c08056c7c4d4e8058cb002a0c8fa9a920272350aa102548523a8aff4ccdb44cb3f": 1, "2ujz3tbbhwqel4xpfsj5ansjkhd7ilfc": 1, "3a": [1, 12, 16, 25], "2f": [1, 12, 16, 25], "2fop": 1, "2foidc": 1, "anomal": [1, 11], "relat": [1, 4, 7, 9, 10, 13, 18, 19, 21, 26, 29, 30, 31, 32], "scamb": [1, 18], "descritt": [1, 11, 29, 30, 32], "line": [1, 2, 15, 28], "guid": [1, 2, 15, 28], "ux": 1, "aiut": [1, 11], "svilupp": [1, 11], "eventual": [1, 6, 7, 11, 18, 23, 25, 30], "debugging": [1, 11], "destin": [1, 26, 32], "fin": [1, 2, 6, 18, 23, 26, 28, 29, 30, 32], "obbligator": [1, 4, 6, 7, 9, 23, 30, 31], "access_denied": 1, "neg": 1, "caus": [1, 30], "credenzial": [1, 14, 15, 30], "adegu": [1, 17], "6749": [1, 30], "302": [1, 11, 28], "found": [1, 11], "unauthorized_client": [1, 11], "invalid_request": [1, 11, 30], "mancanz": [1, 30], "correttezz": [1, 30], "invalid_scop": 1, "server_error": [1, 30], "riscontr": [1, 3, 30], "problem": [1, 30], "temporarily_unavailabl": [1, 11, 30], "temporane": [1, 30], "unsupported_response_typ": 1, "login_required": 1, "autherror": 1, "consent_required": 1, "esplic": [1, 7, 30], "request_uri_not_supported": 1, "request_ur": [1, 4], "registration_not_supported": 1, "invalid_request_object": 1, "uri": [1, 16, 23, 28, 33], "mancant": 1, "400": [1, 11, 30], "bad": [1, 11, 30], "sistem": [2, 15, 18, 26, 28, 29], "natur": [2, 28], "compless": [2, 28], "interven": [2, 28], "div": [2, 28], "aspett": [2, 28, 29], "chiar": [2, 28, 30], "not": [2, 11, 16, 17, 28, 30], "esemplif": [2, 28], "dar": [2, 28, 31], "miglior": [2, 3, 12, 15, 28], "applic": [2, 5, 10, 11, 23, 26, 28, 29, 30, 32], "comprension": [2, 28], "regol": [2, 28, 29], "eman": [2, 28], "agid": [2, 12, 16, 17, 25, 28, 29, 30, 31, 33], "conform": [2, 4, 11, 15, 27, 28, 29, 31], "prescritt": [2, 28], "art": [2, 28], "dpcm": [2, 28], "ottobr": [2, 28], "2014": [2, 28], "Al": [2, 18, 28, 30], "raccogl": [2, 28], "organ": [2, 28], "intervent": [2, 28], "attribu": [2, 28], "cogent": [2, 28], "attor": [2, 28], "convolt": [2, 28], "sian": [2, 13, 28], "pubblic": [2, 3, 4, 5, 9, 10, 15, 17, 20, 22, 23, 24, 27, 28, 29, 31, 32], "priv": [2, 4, 12, 15, 16, 20, 25, 28, 29, 30, 31], "avvis": [2, 6, 7, 28, 30], "obiett": [2, 28], "assicur": [2, 28], "uniform": [2, 16, 28, 29], "interpret": [2, 28, 29], "tecnic": [2, 11, 15, 17, 18, 28, 29], "altro": [2, 13, 17, 26, 28, 31], "necessar": [2, 13, 14, 17, 26, 28, 32], "corrett": [2, 28, 30], "funzion": [2, 26, 28, 29, 30, 31, 32], "implement": [2, 4, 6, 7, 10, 14, 17, 26, 28, 29], "ll": [2, 7, 28, 30], "gg": [2, 7, 28, 30], "11": [2, 28], "2021": [2, 28], "n": [2, 7, 12, 26, 28, 29, 30], "41": [2, 7, 28, 30], "integr": [2, 15, 18, 28, 30], "pdf": [2, 28], "06": [2, 28], "05": [2, 28], "2022": [2, 28], "v1": [2, 28], "3": [2, 4, 10, 13, 14, 15, 16, 22, 28, 30, 31], "determin": [2, 7, 28, 29, 32], "federation": [2, 5, 9, 12, 13, 15, 18, 27, 28, 29, 31, 32], "feder": [2, 6, 9, 10, 12, 15, 16, 20, 22, 23, 24, 26, 27, 28, 29, 31, 32], "14": [2, 28, 29], "authority": [2, 15, 21, 28, 29, 31], "recant": [2, 28], "qualific": [2, 28, 29, 31], "18": [2, 28], "07": [2, 28], "clicc": 3, "destr": 3, "icon": 3, "github": 3, "voc": 3, "sorgent": 3, "acced": [3, 15, 30], "repository": 3, "trov": [3, 11, 15, 26], "inesattezz": 3, "desider": 3, "risolv": [3, 29, 32], "dubb": 3, "semplic": [3, 6, 17], "notific": 3, "qualcos": 3, "apri": 3, "nuov": [3, 7, 17, 26, 29, 30, 31], "issu": 3, "A": [3, 28], "apertur": 3, "developers": 3, "potra": 3, "aprir": 3, "pull": 3, "request": [3, 4, 11, 15, 32], "modif": [3, 26], "correzion": 3, "te": 3, "bas": [4, 10, 17, 18, 25, 29, 30, 31], "vtr": 4, "opzional": [4, 29, 31], "entramb": [4, 7], "adott": [4, 15, 18, 22, 31], "authentication": [4, 15, 28, 30, 33], "respons": [4, 7, 14, 15, 17], "impon": 4, "mix": [4, 7], "up": [4, 7], "security": [4, 7, 28], "bcp": [4, 7, 28, 29], "stabil": [4, 10, 17, 29], "mand": 4, "authorization": [4, 14, 15, 16, 18, 26, 27, 28, 29, 30, 32, 33], "endpoint": [4, 9, 10, 11, 14, 15, 17, 18, 19, 20, 22, 23, 24, 27, 29, 31, 32], "parametr": [4, 10, 14, 15, 16, 20, 22, 23, 24, 25, 26, 29, 30, 31, 33], "Sia": 4, "cio": [4, 8, 32], "vot": 4, "vtm": 4, "usat": [4, 7, 10, 17, 29, 30], "appen": 4, "cit": 4, "veng": [4, 10, 19, 26], "auth": [4, 12, 27, 28, 30], "tim": [4, 28], "raccomand": [4, 5, 23, 29], "aver": [4, 9, 17, 26, 30], "mentr": [4, 17, 27, 31], "requis": [4, 31], "at_hash": [4, 30], "assent": 4, "soggett": [4, 9, 10, 12, 13, 15, 16, 29, 30, 31, 32, 33], "pairwised": 4, "nested": [4, 28], "chiav": [4, 9, 10, 15, 16, 17, 25, 29, 30, 31, 32], "accett": [4, 33], "by": [4, 15, 28, 31], "referenc": 4, "intercamb": 4, "registr": [4, 13, 15, 16, 17, 27, 29, 31, 32], "dinam": [4, 13, 15, 17, 31, 32], "automat": [4, 15], "Nella": [4, 27], "scop": [4, 12, 15, 16, 19, 30, 31, 33], "offline_access": [4, 10, 12, 19, 22, 30], "proposal": 4, "altri": [4, 17, 25, 32], "doc": 4, "polit": [4, 10, 17, 29, 32], "Nelle": 4, "7": [4, 13, 15, 18, 28], "5": [4, 10, 15, 18, 28, 30, 31, 33], "distribu": 4, "9068": [4, 28, 30], "partecip": [5, 9, 15, 18, 26, 29, 31, 32], "criptazion": [5, 7, 17], "agoritm": 5, "oper": [5, 9, 10, 11, 17, 26, 29, 30, 31, 32], "cifratur": [5, 7, 18], "lunghezz": 5, "chiavi": [5, 9, 10, 15, 17, 29, 31], "rsa": [5, 12, 33], "par": [5, 26, 32], "superior": [5, 9, 10, 26, 29, 30, 31, 32], "2048": 5, "bit": 5, "4096": 5, "rs256": [5, 12, 30], "signatur": [5, 20, 22, 23, 28], "and": [5, 12, 20, 28, 29, 32], "rfc7518": 5, "rs512": [5, 12], "oaep": [5, 12, 33], "key": [5, 9, 14, 22, 23, 28], "encryption": [5, 22, 23, 28], "256": [5, 12], "rfc7516": 5, "a128cbc": [5, 12], "hs256": [5, 12], "content": [5, 12, 16, 22, 23, 25, 30, 33], "a256cbc": [5, 12, 33], "hs512": [5, 12, 33], "es256": [5, 12], "es512": [5, 12], "ps256": [5, 12], "ps512": [5, 12], "ecdh": [5, 12], "a128kw": [5, 12], "a256kw": [5, 12], "none": 5, "rsa_1_5": 5, "hs384": [5, 12], "intercorr": 6, "ufficial": [6, 17], "esclus": [6, 7, 30, 31], "automatic_client_registration": 6, "explicit": 6, "esposizion": 6, "approfond": [6, 17], "rimand": [6, 10, 17, 18], "sicurezz": [6, 15, 17, 30, 32], "poic": 6, "necessit": 6, "aggiunt": [6, 9, 13, 31], "crit": 6, "inoltr": [6, 7, 17, 32, 33], "naming_constraints": 6, "policy_language_crit": 6, "trust_anchor_id": 6, "presenz": [6, 30], "verrann": 6, "ulterior": [6, 7, 10, 17, 18, 26, 31], "normin": 6, "principal": [7, 31], "Nei": [7, 19, 32], "abilit": [7, 17, 30, 31], "dunqu": 7, "revocation_endpoint_auth_methods_supported": [7, 10, 12, 22, 25], "mitig": 7, "tip": [7, 9, 10, 12, 13, 20, 22, 23, 24, 26, 27, 30, 31, 33], "ultim": [7, 9, 19, 25, 30], "lung": [7, 30], "rinnov": [7, 26, 30, 32], "cos": [7, 21, 27], "infatt": 7, "preesistent": [7, 17, 26, 27, 30], "medesim": [7, 9, 10, 17, 30, 31, 32], "set": [7, 9, 30], "fas": [7, 17, 19, 25, 26, 30, 31, 32], "qual": [7, 9, 13, 17, 18, 26, 29, 30, 31, 32], "espress": [7, 30], "activ": [7, 12, 16], "effettu": [7, 15, 17, 30, 32], "revoc": [7, 15, 16, 19, 25, 30], "ancor": [7, 13, 19, 25, 30], "esso": 7, "colleg": [7, 19, 25, 32], "invec": [7, 22, 25], "temp": [7, 17, 26, 31], "qui": [8, 17], "procedur": [8, 17, 26, 29, 32], "onboarding": [8, 17, 29, 31], "ec": [9, 10, 20, 22, 23, 24, 28, 29, 31, 32], "entit": [9, 10, 11, 13, 17, 18, 20, 22, 23, 24, 26, 29, 31, 32], "riguard": [9, 17, 29], "press": [9, 10, 13, 15, 17, 25, 26, 30, 32], "web": [9, 12, 17, 23, 27, 28, 29, 30, 31, 32], "well": [9, 11, 12, 13, 17, 18, 27, 32], "known": [9, 11, 12, 13, 17, 18, 27, 32], "verif": [9, 14, 15, 18, 30, 31, 32], "tm": [9, 10, 13, 17, 26, 29, 31], "esegu": [9, 16, 25, 30, 32], "distinguiam": 9, "risied": 9, "divers": [9, 26], "emett": [9, 17, 29, 31], "jwks": [9, 10, 12, 18, 20, 22, 23, 26], "7517": [9, 28], "interess": [9, 30], "ogni": [9, 10, 17, 18, 26, 27, 29, 30, 31, 32], "jwk": [9, 20, 23, 28], "schem": [9, 10, 14, 17, 23], "quel": [9, 10, 13], "Una": [9, 10, 17, 20, 26, 32], "configur": [9, 11, 15, 22, 24, 26, 29, 31, 32], "dichiar": [9, 17, 29, 31, 32], "entity_typ": [9, 12, 21, 31], "openid_relying_party": [9, 10, 12, 23, 31], "openid_provider": [9, 10, 12, 22, 31], "federation_entity": [9, 12, 15, 20, 22, 23, 24], "oauth_authorization_server": [9, 20], "oauth_resourc": [9, 15, 20], "conteng": [9, 17], "precedent": [9, 13, 26, 30, 32], "authority_hints": [9, 12, 15, 32], "array": [9, 10, 23, 26, 29], "ta": [9, 13, 15, 18, 21, 26, 29, 31, 32], "sa": [9, 13, 15, 17, 18, 21, 26, 27, 29, 31, 32], "trust_marks": [9, 10, 12], "mark": [9, 10, 11, 13, 15, 17, 27, 29, 32], "fatt": [9, 10], "esclusion": [9, 31], "exampl": [9, 12, 30, 32], "of": [9, 12, 28], "an": [9, 12], "intermediary": [9, 15], "constraints": [9, 10, 12], "descriv": [9, 10, 26, 29, 30, 31], "vincol": 9, "chain": [9, 10, 11, 13, 18, 26, 29, 32], "max_path_length": [9, 12, 26, 32], "massim": [9, 15, 17, 32], "allowed_leaf_entity_types": [9, 10], "restring": [9, 10], "riconoscobil": [9, 10], "discendent": [9, 10, 13, 17, 18, 26, 27, 29, 31, 32], "trust_marks_issuers": [9, 12, 17, 31, 32], "autor": [9, 17, 29, 31], "attend": 9, "emission": [9, 17, 28, 30, 31], "component": 10, "basil": 10, "costru": [10, 17, 27], "caten": [10, 32], "fiduc": [10, 17, 26, 29, 31, 32], "trust": [10, 11, 13, 15, 17, 18, 21, 27, 28, 29, 32], "subject": 10, "risolu": [10, 31], "fetc": [10, 12, 13], "emess": [10, 16, 25, 29, 30, 31, 32], "configuration": [10, 13, 15, 17, 18, 21, 26, 27, 29, 31], "intermediar": [10, 15, 17, 21, 26, 29, 31, 32], "dirett": [10, 13, 30, 32], "fed": [10, 13, 17, 18, 20, 21, 22, 23, 24, 27, 28, 29, 31], "metadata_policy": [10, 12], "criter": 10, "anchors": 10, "rispett": [10, 18, 21, 31], "casc": 10, "openid_realying_party": 10, "subset_of": [10, 12], "grant_types": [10, 12, 23], "authorization_cod": [10, 12, 22, 23, 30], "refresh_token": [10, 12, 22, 23, 30], "id_token_signed_response_alg": [10, 12, 23], "id_token_encrypted_response_alg": [10, 12, 23, 30], "id_token_encrypted_response_enc": [10, 12, 23], "userinfo_signed_response_alg": [10, 12, 23], "userinfo_encrypted_response_alg": [10, 12, 23], "userinfo_encrypted_response_enc": [10, 12, 23], "token_endpoint_auth_method": [10, 12, 23], "one_of": [10, 12], "private_key_jwt": [10, 12, 20, 22, 23, 25, 26, 30], "client_registration_types": [10, 12, 23], "automatic": [10, 12, 23, 32], "aggreg": [10, 12, 15, 17, 29, 31, 32], "response_modes_supported": [10, 12, 22], "form_post": [10, 12, 22], "grant_types_supported": [10, 12, 20, 22], "www": [10, 12, 16, 22, 25, 27, 30], "spidl1": [10, 12, 22, 30], "spidl2": [10, 12, 22, 30], "spidl3": [10, 12, 22], "subject_types_supported": [10, 12, 22], "pairwis": [10, 12, 22, 30], "id_token_signing_alg_values_supported": [10, 12, 22], "id_token_encryption_alg_values_supported": [10, 12, 22], "id_token_encryption_enc_values_supported": [10, 12, 22], "userinfo_signing_alg_values_supported": [10, 12, 22], "userinfo_encryption_alg_values_supported": [10, 12, 22], "userinfo_encryption_enc_values_supported": [10, 12, 22], "token_endpoint_auth_methods_supported": [10, 12, 20], "token_endpoint_auth_signing_alg_values_supported": [10, 12, 20], "claims_parameter_supported": [10, 12], "tru": [10, 12, 16, 31], "request_parameter_supported": [10, 12], "authorization_response_iss_parameter_supported": [10, 12], "client_registration_types_supported": [10, 12], "request_authentication_methods_supported": [10, 12], "request_object": [10, 12], "request_authentication_signing_alg_values_supported": [10, 12], "durant": [11, 17, 19, 29, 30, 31, 32], "Uno": 11, "raggiung": [11, 29, 32], "or": 11, "invalid_client": [11, 30], "perc": [11, 26, 30, 32], "fall": 11, "policy": [11, 15, 25, 29, 30, 31], "produc": [11, 17, 26], "complet": [11, 17, 31], "not_found": 11, "risors": [11, 20, 26, 27, 32, 33], "404": 11, "raccolt": [12, 13, 29, 30], "decodific": 12, "intest": [12, 14, 30, 33], "lettur": 12, "host": [12, 16, 25, 30], "200": [12, 25, 30, 33], "ok": [12, 30, 33], "last": [12, 30, 33], "modified": [12, 30, 33], "wed": [12, 30, 33], "22": [12, 30, 33], "jul": [12, 30, 33], "2018": [12, 28, 30, 33], "19": [12, 28, 30, 33], "15": [12, 30, 33], "56": [12, 30, 33], "gmt": [12, 30, 33], "application": [12, 16, 25, 30, 33], "2hnofs3ync9tjicaivhwlvuj3axwggz_98urfaqmees": 12, "1649590602": 12, "1649417862": 12, "keys": 12, "kty": 12, "5s4qi": 12, "aqab": 12, "application_typ": 12, "use": [12, 28], "sig": 12, "1ta": 12, "sE": 12, "yhnfs3ync9tjicaivhwlvuj3axwggz_98urfaqmees": 12, "client_nam": 12, "organization": [12, 28], "contacts": [12, 20, 22, 23, 24], "ops": 12, "redirect_uris": [12, 23], "response_types": [12, 23], "subject_typ": 12, "federation_resolve_endpoint": [12, 20, 22, 23, 24], "organization_nam": [12, 20, 22, 23, 24, 31], "pa": 12, "servic": [12, 17, 30], "homepage_ur": [12, 20, 22, 23, 24], "policy_ur": [12, 20, 22, 23, 24, 31], "logo_ur": [12, 20, 22, 23, 24, 31], "static": [12, 26, 31], "log": [12, 15, 20, 22, 23, 24, 31], "svg": [12, 20, 22, 23, 24], "tech": 12, "registry": [12, 31], "public": [12, 28, 31], "trust_mark": 12, "eyjh": 12, "db67gl7ck3tfiiaf7n6_7shvqk0mdymeqcogglkuaaw": [12, 30], "1649610249": 12, "1649437449": 12, "01_4a": 12, "authorization_endpoint": [12, 20, 22], "revocation_endpoint": [12, 22], "revocation": [12, 15, 19, 28], "token_endpoint": [12, 20, 22], "userinfo_endpoint": [12, 22], "introspection_endpoint": [12, 22], "introspection": [12, 15, 28], "idp": 12, "ar": 12, "claims_supported": 12, "fanfs3ync9tjicaivhwlvuj3axwggz_98urfaqmees": 12, "lb": 12, "identity": [12, 15, 17], "op_policy_ur": [12, 20], "webs": 12, "information": [12, 28], "request_uri_parameter_supported": 12, "require_request_uri_registration": 12, "rs384": 12, "es384": 12, "a192cbc": 12, "a128gcm": 12, "a192gcm": 12, "a256gcm": 12, "request_object_signing_alg_values_supported": [12, 22], "em3cmnzghiyfsq090n6b3op7laaqj8rghmhxgmjstqg": 12, "1649631824": 12, "1649459024": 12, "14aw": 12, "federation_fetch_endpoint": [12, 24], "federation_list_endpoint": [12, 24], "trust_mark_issuer": 12, "federation_status_endpoint": 12, "trust_mark_status": 12, "full": [12, 27, 31], "fifyx03bnosd8m6gyqifnhnp9cm_sam9tc5nlloiirc": 12, "1649375259": 12, "1649373279": 12, "3i5vv": 12, "_": 12, "federation_trust_mark_status_endpoint": [12, 20, 24], "other": [12, 31], "wher": 12, "is": 12, "1579621160": 12, "organization_typ": [12, 31], "id_cod": [12, 27, 31], "ipa_cod": [12, 27, 31], "123456": 12, "aoo_cod": [12, 27, 31], "uff_protocoll": 12, "email_or_pec": 12, "ref": [12, 31], "documentazione_di_rifer": 12, "1234567890": [12, 33], "sa_profil": [12, 31], "987654": 12, "1649623546": 12, "1649450746": 12, "superset_of": 12, "add": 12, "eyjhb": 12, "1649355587": 12, "1649410329": 12, "5nnnofs3ync9tjicaivhwlvuj3axwggz_98urfaqmees": 12, "trust_chain": 12, "eyjhbgcioijsuzi1niisimtpzci6ims1nehrderpynlhy3m5wldwtwz2auhm": 12, "eyjhbgcioijsuzi1niisimtpzci6ikjydmzybg5oqu11sfiwn2fqvw1by0js": 12, "x": [12, 16, 25, 30], "urlencoded": [12, 16, 25, 30], "2registry": 12, "2fopenid_relying_party": 12, "2fpublic": 12, "2rp": 12, "qwjlme0xdbxrkxtm72eph659buxaxw80": 12, "eyjhbgcioijsuzi1niisimtpzci6ijjibm9guznzbkm5dgppq2fpdmhxtfzvsj": 12, "nbehdhr3pfoth1ukzhcu1frxmifq": 12, "eyjpc3mioijodhrwczovl3rydxn0lwfuy2hvci5v": 12, "wrjlwzlzgvyyxrpb24ub25saw5ll29pzgmvcnaviiwic2nvcguioijvcgvuawqilcjyzwr": 12, "pcmvjdf91cmkioijodhrwczovl3rydxn0lwfuy2hvci5vawrjlwzlzgvyyxrpb24ub25s": 12, "w5ll29pzgmvcnavy2fsbgjhy2silcjyzxnwb25zzv90exblijoiy29kzsisim5vbmnlij": 12, "ioxhntwc4nhpstg12ofjvrjg1rjj5wexmddq1u3zguxcilcjzdgf0zsi6inplatj6mnh4": 12, "jzyqufzuhm0eulxrzz2awpqndjytvphiiwiy2xpzw50x2lkijoiahr0chm6ly90cnvzdc1": 12, "hbmnob3iub2lkyy1mzwrlcmf0aw9ulm9ubgluzs9vawrjl3jwlyisimvuzhbvaw50ijoi": 12, "hr0chm6ly90cnvzdc1hbmnob3iub2lkyy1mzwrlcmf0aw9ulm9ubgluzs9vawrjl29wl2f": 12, "1dghvcml6yxrpb24ilcjhy3jfdmfsdwvzijoiahr0chm6ly93d3cuc3bpzc5nb3yuaxqvu": 12, "3bpzewyiiwiawf0ijoxnjg2ntc2oti2lcjlehaioje2ody1nzy5odysimp0asi6ijaxmjz": 12, "lzwrllwuwzjmtnde3my05nze3ltq0nzuymmi2nmi2nyisimf1zci6wyjodhrwczovl3ryd": 12, "xn0lwfuy2hvci5vawrjlwzlzgvyyxrpb24ub25saw5ll29pzgmvb3aviiwiahr0chm6ly9": 12, "0cnvzdc1hbmnob3iub2lkyy1mzwrlcmf0aw9ulm9ubgluzs9vawrjl29wl2f1dghvcml6y": 12, "xrpb24ixswiy2xhaw1zijp7imlkx3rva2vuijp7imdpdmvux25hbwuionsizxnzzw50awf": 12, "sijp0cnvlfswizw1hawwionsizxnzzw50awfsijp0cnvlfx0sinvzzxjpbmzvijp7imdpd": 12, "mvux25hbwuiom51bgwsimzhbwlsev9uyw1lijpudwxslcjlbwfpbci6bnvsbcwiahr0chm": 12, "6ly9hdhryawj1dgvzlnnwawquz292lml0l2zpc2nhbf9udw1izxiiom51bgx9fswichjvb": 12, "xb0ijoiy29uc2vudcbsb2dpbiisimnvzgvfy2hhbgxlbmdlijoidllobwrzcuntmw1tztj": 12, "hcuzkrfdwehlvdefpc3dlx0rfv0lnyuluchlotsisimnvzgvfy2hhbgxlbmdlx21ldghvz": 12, "ci6ilmyntyifq": 12, "r1ei1wep3p": 12, "8xfxewptev": 12, "tlyznbpnoiyk5z11oy7cvhurhexmmfmn": 12, "vyztwjqzrb92lsdmeaos3btfj_19s_l28o8mammjd5b": 12, "obe8b_8rmny4uvcaynwzc6nvc": 12, "xngqymh1ujwhvwgguf_x": 12, "8jvbwhv7cgjiwcrfax3h": 12, "zpyfqinhjh3nq9un2vk": 12, "fzvkl1i": 12, "urwvc4kupe4fzkhx": 12, "2fjre5kbkwpcw2ecmjgy": 12, "esg0zezukyhz5l3oupqdk": 12, "olg3gowbnm": 12, "ab6nkursijqxu1clregndiem4yn0m": 12, "segxlehs40iqds75e8imfybyqcq2lgu9pwf5gr7": 12, "isqd8a": 12, "mbzgqyf9qytd28eupywhsqmj78wnqpc2": [12, 30], "callback1": 12, "null": 12, "claims": [12, 15, 22, 31, 33], "fyziol9lf2cekunt2jzxilrdink0upcd": 12, "following": 12, "shows": 12, "provided": 12, "related": 12, "entity": [13, 15, 17, 18, 21, 26, 27, 29, 31], "6": [13, 15, 20, 22, 23], "resolv": [13, 15], "statement": [13, 15, 17, 18, 29, 32], "final": [13, 29, 30, 32], "calcol": [13, 26, 30, 32], "moment": [13, 16, 17, 30, 31, 33], "offrir": [13, 30], "sopr": 13, "vuol": [13, 16, 25, 30], "status": [13, 15, 31], "no": [13, 28], "listing": 13, "aa": [13, 20, 29, 31], "entra": 14, "flow": [14, 20], "proof": [14, 28], "exchang": [14, 28], "refresh": [14, 15, 19, 25], "ottien": [14, 30, 32], "passagg": 14, "figur": [14, 32], "relying": [14, 15, 16, 21, 25, 29, 30], "party": [14, 15, 16, 21, 25, 29, 30], "pulsant": 14, "autentic": [14, 15, 16, 17, 19, 33], "prepar": 14, "ricev": [14, 30, 31, 32], "eran": 14, "punt": [14, 31], "Lo": [14, 31, 33], "graz": 15, "amministr": [15, 17, 26, 28, 31], "fornitor": 15, "serviz": [15, 17, 26, 31, 32], "onlin": 15, "attravers": [15, 26, 32], "consolid": 15, "nazional": [15, 18, 31], "esperient": [15, 30], "providers": 15, "pratic": [15, 17], "riconosc": [15, 17, 29, 30, 31, 32], "api": [15, 17, 32], "technical": 15, "references": 15, "europe": [15, 18], "acronim": 15, "convenzion": [15, 17, 31], "fogl": [15, 17, 26, 29, 31, 32], "anchor": [15, 17, 21, 26, 29, 32], "gestion": [15, 29, 32], "error": [15, 32], "logout": [15, 25], "retention": 15, "storic": 15, "different": [15, 17, 27, 30], "deterrent": 15, "contr": 15, "abus": 15, "buon": [15, 17], "specializz": 15, "aggiorn": [15, 17, 29, 30, 32], "issued": [15, 31], "divent": [15, 17], "contribu": 15, "espost": [16, 27], "possess": [16, 25, 30], "rfc7662": [16, 28], "oauth2": [16, 29, 30], "03": [16, 30, 33], "vogl": 16, "assertion": [16, 25, 30], "client_assertion": [16, 25, 30], "eyjhbgcioijiuzi1niisinr5cci6ikpxvcj9": [16, 25, 30], "eyjzdwiioiixmjm0nty3odkwiiw": [16, 25, 30], "ibmftzsi6ilnqsuqilcjhzg1pbii6dhj1zx0": [16, 25, 30], "lvyrdpvjm0s9q7oixcyviiqgwy0wwqlqxvfgyswlf88": [16, 25], "client_assertion_typ": [16, 25, 30], "urn": [16, 25, 30], "3aietf": [16, 25, 30], "3aparams": [16, 25, 30], "3aoauth": [16, 25, 30], "3aclient": [16, 25, 30], "3ajwtbearer": [16, 25, 30], "2frp": [16, 25], "eyjhbgcioijsuzi1nij9": [16, 25], "eyjlehaioje0mtg3mdi0mtqsimf1zci6wyjlnzfmyjcyys05nzrmlt": [16, 25], "qwmdetymniny1lnjdjmmjjmdazn2yixswiaxnzijoiahr0chm6xc9cl2fzlxzhlmv4yw1wbguuy29txc8": [16, 25], "ilcjqdgkioiiymwixntk2zc04nwqzltqzn2mtywq4my1im2yyy2uyndcyndqilcjpyxqioje0mtg2otg4": [16, 25], "mtr9": [16, 25], "fxdtezdlbthzfnrow7w27rlk5m0wprfffh7h4bdfw5fr3pwiqejkmdfabjvn3_yfaokbv06we5r": [16, 25], "rjubdjmfffrrw23cmbpgqcik7nq4l012x_1j4iewoqxxmltywqq_bcbmjcw3mtpry1aoocfbojpx1k2jw": [16, 25], "rkytyvtlwlff6s5gkciyf3b0badjoqehd_ivssiph3xubjkmtkrtlfwr0q0pdpeyvepkmsi28xzvdagnxa4j7qi5lozyeyzgr9": [16, 25], "h70xqlvzqwwl1p0": [16, 25], "f_0jadfmjfo1yl4iexfpozzsb3hhf2vfdl6d_llehryh2g2ozf59emism_ccs4g47862w": [16, 25], "relazion": [16, 25, 26, 30, 32], "params": [16, 25, 30], "clientassertion": [16, 25], "bearer": [16, 25, 30, 33], "rispond": [16, 25], "scad": [16, 25, 30], "mai": 16, "chiamant": 16, "fals": 16, "coincident": [16, 33], "coincid": [16, 26, 30, 33], "contraddistingu": 16, "resourc": [16, 20, 28, 29], "locator": [16, 29], "infrastruttur": 17, "tant": 17, "organizz": [17, 31], "afferent": [17, 26, 27], "ader": [17, 26, 31], "quadr": 17, "regolator": 17, "meccan": [17, 18, 19, 26, 30], "stipul": [17, 31], "accredit": 17, "super": [17, 26, 32], "partes": 17, "tecnolog": 17, "adozion": 17, "interoper": [17, 26, 29, 31], "sicur": [17, 32], "interscamb": 17, "garanz": 17, "affinc": 17, "individu": [17, 31, 32], "otteng": [17, 32], "uni": [17, 32], "fid": 17, "estend": [17, 21], "funzional": [17, 19, 29, 30], "realizz": [17, 18], "concret": 17, "prim": [17, 26, 27, 30, 31, 32], "espong": 17, "disabilit": [17, 30], "qualsias": [17, 30, 31], "smett": 17, "inerent": 17, "scalabil": 17, "riduc": 17, "signific": 17, "cost": 17, "accord": [17, 31], "princip": 17, "deleg": 17, "istitu": 17, "trasparent": [17, 27], "coinvolt": [17, 29, 31], "autonom": 17, "navig": [17, 26], "real": [17, 31], "alber": 17, "sal": [17, 26], "hann": 17, "volt": [17, 26, 30, 32], "path": [17, 27, 32], "ben": [17, 31], "eserciz": 17, "manten": [17, 18, 25, 30], "giornalier": 17, "max_path": 17, "length": 17, "dedic": 17, "incaric": [17, 18], "dop": [17, 26, 30], "prov": 17, "adesion": 17, "sott": [17, 21], "includ": [17, 29, 30, 31], "transazion": 18, "memorizz": 18, "authenticationrequest": 18, "authenticationrespons": 18, "tokenrequest": 18, "tokenrespons": 18, "userinforequest": 18, "userinforespons": 18, "revocationrequest": 18, "revocationrespons": 18, "indicizz": 18, "ricerc": 18, "consult": 18, "jti": [18, 30], "gest": [18, 29], "dur": [18, 26, 30, 31], "inferior": 18, "pien": 18, "vigent": 18, "mater": 18, "privacy": [18, 31], "riserv": 18, "personal": [18, 30], "garant": 18, "confidenzial": 18, "impieg": 18, "dbms": 18, "persistent": 18, "infin": [18, 32], "ripud": 18, "historical": 18, "rimoss": 18, "discrezion": 18, "instaur": [19, 26, 31], "individual": 19, "elimin": 19, "protett": [20, 26, 33], "istituzional": [20, 22, 23, 24, 31], "8414": [20, 22, 28], "pag": [20, 22], "lg": 20, "8623": 20, "op_tos_ur": 20, "dpop_signing_alg_values_supported": 20, "dpop": 20, "rs": [20, 29], "identific": [20, 25], "discovery": [21, 22, 26, 28, 29, 32], "dynamic": [21, 28], "op_metad": 22, "see": 22, "signed_jwks_ur": 22, "norm": [22, 29, 30], "oid": 22, "jwks_ur": 22, "clientmetad": 23, "\u00c8": [23, 26, 31], "based": 23, "ammiss": 23, "custom": 23, "myapp": 23, "decis": 25, "fosser": 25, "dovrann": 25, "rfc7009": [25, 28], "revok": 25, "filtr": [26, 31], "risult": [26, 30, 31, 32], "consum": 26, "ingent": 26, "connession": 26, "fasull": 26, "produrrebb": 26, "svar": 26, "vers": 26, "terz": 26, "tentat": 26, "percors": [26, 32], "richiedent": [26, 30, 32], "esclud": 26, "prior": 26, "ove": 26, "assenz": [26, 31], "conseguent": [26, 31], "decid": 26, "constraint": 26, "vertical": [26, 32], "radic": [26, 32], "inter": [26, 30], "analis": 26, "introduc": 26, "modell": 26, "orizzontal": 26, "tent": 26, "brev": 26, "mov": 26, "sogl": [26, 32], "interrott": 26, "essend": 26, "Allo": 26, "lim": 26, "limit": 26, "util": [26, 30, 31], "adottin": 26, "element": [26, 31, 32], "authority_hint": [26, 32], "esager": 26, "dovuto": 26, "catt": 26, "eccess": 26, "elabor": 26, "innesc": 26, "perven": 26, "conserv": 26, "signif": 26, "t": [26, 28], "potrebb": 26, "incorr": 26, "problemat": 26, "interru": 26, "rimuov": 26, "certezz": 26, "abbi": 26, "vecc": 26, "cim": 26, "estern": 27, "mascher": 27, "dietr": 27, "s\u00e8": 27, "light": [27, 31], "proxy": 27, "provved": 27, "interfacc": 27, "cont": [27, 29], "solit": 27, "espon": [27, 32], "acquisizion": [27, 32], "compon": 27, "sa_domain": 27, "evidenz": 27, "varley": 28, "m": [28, 29], "grass": 28, "p": 28, "october": 28, "sakimur": [28, 29], "bradley": [28, 29], "j": [28, 29], "jones": [28, 29], "de": 28, "medeiros": 28, "b": 28, "C": 28, "mortimor": 28, "august": 28, "2015": [28, 29], "november": 28, "E": 28, "jay": 28, "2119": [28, 29], "bradner": 28, "words": 28, "rfcs": 28, "requirement": 28, "levels": 28, "marc": [28, 29, 31], "1997": 28, "2616": [28, 33], "fielding": 28, "r": 28, "gettys": 28, "mogul": 28, "frystyk": 28, "h": 28, "masinter": 28, "leac": 28, "berners": 28, "lee": 28, "hypertext": 28, "transfer": 28, "protocol": 28, "jun": 28, "1999": 28, "3339": 28, "klyne": 28, "g": 28, "newman": 28, "internet": 28, "timestamps": 28, "doi": [28, 29], "17487": [28, 29], "rfc3339": 28, "july": 28, "3986": [28, 32], "generic": 28, "syntax": 28, "7009": 28, "lodderstedt": 28, "dron": 28, "scurtescu": 28, "7159": 28, "bray": 28, "javascript": 28, "notation": 28, "interchang": 28, "format": 28, "7515": [28, 29, 31], "jws": [28, 33], "rfc7515": 28, "may": [28, 29], "hildebrand": 28, "jwe": [28, 33], "rfc7517": 28, "7518": 28, "algorithms": 28, "jwa": 28, "rfc7519": [28, 29], "7523": 28, "campbell": 28, "martimor": 28, "grants": 28, "agarwal": 28, "clients": 28, "rfc7636": 28, "september": 28, "thumbprint": 28, "rfc7638": 28, "7662": 28, "richer": 28, "7591": 28, "Ed": 28, "machulak": 28, "hunt": 28, "rfc7591": 28, "7800": 28, "tschofenig": 28, "possession": 28, "semantics": 28, "tokens": [28, 30], "jwts": 28, "rfc7800": 28, "april": 28, "2016": 28, "8174": [28, 29], "leib": 28, "ambiguity": 28, "uppercas": 28, "vs": 28, "lowercas": 28, "rfc8174": 28, "2017": 28, "server": [28, 29, 30], "rfc8414": 28, "8725": 28, "hardt": 28, "sheffer": 28, "y": 28, "best": 28, "current": 28, "practices": 28, "february": 28, "2020": 28, "bertocc": 28, "v": 28, "rfc9068": 28, "resp": 28, "selhausen": 28, "k": 28, "z": 28, "fett": 28, "identification": 28, "work": 28, "progress": 28, "january": 28, "labunets": 28, "practic": 28, "december": 28, "yusef": 28, "shekh": 28, "embedded": 28, "en319": 28, "electronic": 28, "signatures": 28, "infrastructures": 28, "esi": 28, "profiles": 28, "e164": 28, "telecommunication": 28, "164": 28, "numbering": 28, "plan": 28, "2010": 28, "standardization": 28, "iso": 28, "8601": 28, "elements": 28, "formats": 28, "representation": 28, "dates": 28, "times": 28, "ica": 28, "doc9303": 28, "civil": 28, "aviation": 28, "machin": 28, "readabl": 28, "travel": 28, "documents": 28, "seventh": 28, "edition": 28, "specifications": 28, "common": 28, "mrtds": 28, "iso3166": 28, "3166": 28, "codes": 28, "names": 28, "countries": 28, "subdivisions": 28, "cad": 28, "dl": 28, "2005": 28, "82": 28, "gu": 28, "ser": 28, "general": 28, "112": 28, "16": 28, "suppl": 28, "ordinar": 28, "93": 28, "semplif": 28, "76": 28, "misur": 28, "urgent": 28, "innov": 28, "20a04921": 28, "228": 28, "33": 28, "its": 28, "conversion": 28, "into": 28, "law": 28, "with": 28, "amendments": 28, "120": 28, "regulation": 28, "eu": 28, "910": 28, "european": 28, "parliament": 28, "council": 28, "services": 28, "transactions": 28, "internal": [28, 30], "market": 28, "repealing": 28, "direct": 28, "dm": 28, "210": 28, "cart": [28, 29], "15a09809": 28, "30": [28, 30], "12": 28, "section_1": 29, "facil": 29, "ingress": 29, "afferm": 29, "aut": 29, "attest": 29, "aderent": 29, "etc": 29, "condivid": 29, "sottoinsiem": 29, "hint": 29, "iniz": [29, 30, 32], "posit": [29, 31], "entro": 29, "definit": 29, "prend": 29, "interrog": [29, 31, 32], "subordin": 29, "author": 29, "affid": 29, "istit": 29, "poligraf": 29, "zecc": 29, "ipzs": 29, "minintern": [29, 31], "appai": 29, "notazion": 29, "tronc": 29, "esigent": 29, "editorial": 29, "base64url": [29, 30], "denot": 29, "saf": 29, "padding": 29, "paragraf": 30, "clientauthentication": 30, "tokenendpoint": 30, "lvyrdpvjm0s9q7oixcyviiqgwy0wwqlqxvfgyswl": 30, "usdwmnezjppg5oav8x3j": 30, "9g8s40mozm3nsqjhnhi7onse38jklfv2": 30, "grant_typ": 30, "rpauthentication": 30, "8xloxbtzp8": 30, "uuid4": 30, "jwtbearer": 30, "corrent": 30, "access_token": 30, "dc34pf6kdg": 30, "token_typ": 30, "wj848bcylp": 30, "expires_in": 30, "1800": 30, "id_token": 30, "eyjzdwiioiixmjm0nty": 30, "sempr": 30, "compong": [30, 32], "at": 30, "9sd798asd98asui23hiuds89y798sfyg": 30, "9ea42af0": 30, "594c": 30, "4486": 30, "9602": 30, "8a1f8dde42d3": 30, "1656859559": 30, "1656857579": 30, "subjectidtypes": 30, "preven": 30, "rius": 30, "rifiut": [30, 32], "cty": [30, 33], "qiyh4xpjgsoz2meaylkfwqeq": 30, "1519032969": [30, 33], "nbf": [30, 33], "1519033149": [30, 33], "nw4j0zmwrk4krbq53g7z": 30, "effett": 30, "codeidtoken": 30, "met": 30, "asci": 30, "hashing": 30, "idtoken": 30, "abil": 30, "scenar": [30, 31], "necess": 30, "notif": 30, "n\u00e8": 30, "opzion": 30, "tratt": 30, "recap": 30, "sms": 30, "app": 30, "legittim": 30, "appos": 30, "mess": 30, "disposizion": 30, "invalid": 30, "rotation": 30, "reinser": 30, "ferm": 30, "rest": 30, "prossim": 30, "qualor": 30, "minim": 30, "rotazion": [30, 31], "lifecyl": 30, "t1": 30, "rt1": 30, "30gg": 30, "t2": 30, "4gg": 30, "provien": 30, "rt2": 30, "t3": 30, "32gg": 30, "28gg": 30, "rt3": 30, "t4": 30, "64gg": 30, "rif": 30, "conosc": 30, "401": 30, "unauthorized": 30, "unsupported_grant_typ": 30, "invalid_grant": 30, "500": 30, "unavailabl": 30, "letteral": 31, "tradott": 31, "tipic": 31, "internazional": 31, "ipa": 31, "vat": 31, "number": 31, "Nello": 31, "avent": 31, "indispens": 31, "struttur": 31, "entity_rol": 31, "trustmark_profil": 31, "appartien": 31, "settor": 31, "tos_ur": 31, "info": 31, "essential": 31, "service_documentation": 31, "oas3": 31, "erog": 31, "continu": 31, "uo_cod": 31, "illustr": 32, "mutu": 32, "adoper": 32, "salv": 32, "assoc": 32, "bass": 32, "period": 32, "button": 32, "semplific": 32, "esistent": 32, "Dall": 32, "avvien": 32, "comp": 32, "prospett": 32, "salvatagg": 32, "estra": 32, "convalid": 32, "Ne": 32, "consegu": 32, "giung": 32, "avess": 32, "blocc": 32, "rigett": 32, "pens": 32, "moltepl": 32, "download": 32, "webpath": 32, "appes": 32, "simbol": 32, "slash": 32, "permess": 32, "interag": 32, "ora": 32, "grad": 32, "produzion": 32, "ciascun": 32, "d\u00e0": 32, "build": 32, "obtain": 32, "6750": 33, "eyjhbgcioijsuzi1niisimtpzci6imrcnjdntddj": 33, "corp": 33, "esplicit": 33, "enc": 33, "hivo33": 33, "km7n03zqkdjfwvnlfudsw28yhqzx5eaxtak": 33, "fornitore_ident": 33, "fornitore_serviz": 33, "ross": 33, "mroxxxxxxxxxxxxx": 33, "destinatar": 33}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"tabell": 0, "attrib": [0, 20], "utent": 0, "esemp": [0, 12], "authorization": [1, 7, 12], "endpoint": [1, 7, 12, 13, 16, 25, 26, 30, 33], "authentication": 1, "request": [1, 12, 16, 25, 30, 33], "parametr": [1, 7], "scop": [1, 7], "claims": [1, 7], "spid": [1, 2, 7, 15, 18, 25, 28, 30, 33], "icon": [1, 18, 19, 25, 30, 33], "cieid": [1, 19, 25, 30, 33], "respons": [1, 12, 16, 25, 30, 33], "gestion": [1, 11, 18], "error": [1, 11, 16, 25, 30, 33], "codic": [1, 11, 16, 25, 30, 33], "rifer": [2, 28], "normat": [2, 28, 29], "com": [3, 26], "contribu": 3, "different": [4, 6, 7], "oidc": [4, 6], "igov": 4, "algoritm": 5, "crittograf": 5, "federation": [6, 11, 17, 26], "client": 6, "registration": 6, "trust": [6, 9, 12, 24, 26, 31], "mark": [6, 12, 26, 31], "claim": [6, 9], "support": 6, "entity": [6, 9, 10, 12, 32], "statement": [6, 10, 12], "cie": [7, 15, 28], "id": [7, 28, 30], "metad": [7, 10, 12, 20, 21, 22, 23, 24, 26, 32], "token": [7, 16, 30], "refresh": [7, 30], "userinf": [7, 33], "introspection": [7, 16], "revocation": [7, 25], "logout": [7, 19], "divent": 8, "fornitor": 8, "serviz": 8, "configuration": [9, 12, 32], "firm": [9, 10], "comun": 9, "fogl": 9, "intermediar": [9, 24], "anchor": [9, 12, 24], "policy": [10, 12, 18], "ta": [10, 12, 24], "rp": [10, 12, 18, 23], "sa": [10, 12, 24], "op": [10, 18, 22], "feder": [11, 13, 17, 18], "en": 12, "1": 12, "relying": [12, 23, 32], "party": [12, 23, 32], "2": 12, "openid": [12, 15, 17, 22, 23, 26, 32], "provider": [12, 22, 32], "3": 12, "intermediary": 12, "4": 12, "5": 12, "issued": 12, "by": 12, "to": 12, "6": 12, "7": 12, "list": 12, "resolv": [12, 26], "status": 12, "fluss": 14, "autent": 14, "connect": [15, 17, 22, 23], "indic": 15, "conten": 15, "verif": 16, "valid": [16, 30, 31], "Le": 17, "eid": 17, "italian": 17, "configur": 17, "modal": [17, 26], "partecip": 17, "retention": 18, "log": 18, "registr": 18, "storic": 18, "chiavi": [18, 26], "pubblic": [18, 26], "authority": 20, "consider": 26, "sicurezz": 26, "deterrent": 26, "contr": 26, "abus": 26, "numer": 26, "massim": 26, "authority_hints": 26, "buon": 26, "pratic": 26, "specializz": 26, "cor": 26, "aggiorn": 26, "soggett": 27, "aggreg": 27, "technical": 28, "references": 28, "nazional": 28, "europe": 28, "termin": 29, "acronim": 29, "convenzion": 29, "access": [30, 32], "period": 30, "federation_entity": 31, "oauth_resourc": 31, "revoc": 31, "composizion": 31, "acquis": 32}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1, "sphinx.ext.todo": 2, "sphinx": 56}}) \ No newline at end of file diff --git a/it/seccons_bcps.html b/it/seccons_bcps.html new file mode 100644 index 00000000..02ff9ef9 --- /dev/null +++ b/it/seccons_bcps.html @@ -0,0 +1,1385 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Considerazioni di Sicurezza + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Considerazioni di Sicurezza

    +

    In questa sezione descriviamo alcune considerazioni di sicurezza in ambito OIDC Federation.

    +
    +

    Trust Mark come deterrente contro gli abusi

    +

    L'implementazione dei Trust Mark e il filtro su questi in fase di Federation Entity Discovery risulta necessario contro gli attacchi destinati al consumo delle risorse. Un OP attaccato con un numero ingente di connessioni presso il suo endpoint di authorization, contenenti client_id e authority_hints fasulli, produrrebbe svariate connessioni verso sistemi di terze parti nel tentativo di trovare un percorso verso la TA e instaurare la fiducia con il richiedente.

    +

    L'OP DEVE validare staticamente il TM oppure DEVE escludere a priori la richiesta ove il TM non risultasse presente, in caso di assenza o non validità di un TM la procedura di Federation Entity Discovery NON DEVE essere avviata e NON DEVE creare di conseguenza connessioni verso sistemi di terze parti.

    +
    +
    +

    Numero Massimo di authority_hints

    +

    All'interno di una Federazione il Trust Anchor decide quante intermediazioni consentire tra di lui e le Foglie, mediante la constraint denominata max_path_length. Questo tipo di relazione è di tipo verticale, dalla Foglia alla radice. Questo attributo se valorizzato ad esempio con un valore numerico intero pari a 1 indica che soltanto un SA è consentito tra una Foglia e il TA.

    +

    Ogni Foglia DEVE pubblicare i suoi superiori all'interno della lista contenuta nel claim authority_hints. Una Foglia all'interno della Federazione PUÒ avere superiori afferenti a diverse Federazioni. L'analisi dei superiori disponibili introduce un modello di navigazione orizzontale, ad esempio un OP tenta di trovare il percorso più breve verso il Trust Anchor attraverso tutti gli URL contenuti all'interno dell'array authority_hints prima di fare un ulteriore movimento verticale, a salire, verso uno degli Intermediari presenti in questo array.

    +

    La soglia max_path_length si applica per la navigazione verticale e superata questa soglia senza aver trovato il TA, la procedura di Federation Entity Discovery DEVE essere interrotta. Si faccia l'esempio di un RP discendente di un SA che a sua volta è discendente di un altro SA, essendo il valore di max_path_length pari a 1 e, superata questa soglia senza aver trovato il Trust Anchor, la procedura DEVE essere interrotta.

    +

    Allo stesso tempo la specifica OIDC Federation 1.0 non definisce un limite per il numero di authority_hints, questo perché nessun Trust Anchor può limitare il numero di Federazioni alle quali un partecipante può aderire. Per questa ragione è utile che gli implementatori adottino un limite massimo del numero di elementi consentiti all'interno dell'Array authority_hint. Questo per evitare che un numero esagerato di URL contenuti nella lista di authority_hints, dovuto ad una cattiva configurazione di una Foglia, produca un consumo di risorse eccessivo.

    +
    +
    +

    Resolve endpoint

    +

    Questo endpoint DEVE rilasciare i Metadata, i Trust Mark e la Trust Chain già precedentemente elaborata e NON DEVE innescare una procedura di Federation Entity Discovery ad ogni richiesta pervenuta, a meno che questo endpoint non venga protetto con un meccanismo di autenticazione dei client, come ad esempio private_key_jwt [OIDC-CORE]. In caso di utilizzo di private_key_jwt il valore presente nel parametro sub del private_key_jwt DEVE coincidere con quello presente nella richiesta al Resolve endpoint.

    +
    +
    +
    +

    Buone Pratiche

    +

    In questa sezione descriviamo alcune buone pratiche per ottenere la massima resa dalle entità di Federazione.

    +
    +

    Specializzare le chiavi pubbliche OpenID Core e Federation

    +

    È buona pratica usare chiavi pubbliche specializzate per i due tipi di operazioni, Core e Federation.

    +
    +
    +

    Modalità di aggiornamento dei Metadata OpenID Core

    +

    L'interoperabilità tra i partecipanti funziona mediante i Metadata ottenuti dal calcolo e dalla conservazione delle Trust Chain. Questo significa che se un OP al tempo T calcola la Trust Chain per un RP e questo al tempo T+n modifica i propri Metadata, l'OP di conseguenza potrebbe incorrere in problematiche di validazione delle richieste di autorizzazione del RP, fino a quando non avrà aggiornato la Trust Chain relativa a questo.

    +

    La buona pratica per evitare le interruzioni di servizio relative alle operazioni di OIDC Core è quella di aggiungere le nuove chiavi pubbliche all'interno degli oggetti jwks senza rimuovere i valori preesistenti. Oppure, ad esempio, i nuovi redirect_uri.

    +

    In questa maniera dopo il limite massimo di durata delle Trust Chain, definito con il claim exp e pubblicato nella Entity Configuration della TA, si ha la certezza che tutti i partecipanti abbiano rinnovato le loro Trust Chain, e sarà possibile agli amministratori della Foglia rimuovere le vecchie definizioni in cima alla lista.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/soggetti_aggregatori.html b/it/soggetti_aggregatori.html new file mode 100644 index 00000000..e1936b27 --- /dev/null +++ b/it/soggetti_aggregatori.html @@ -0,0 +1,1396 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Soggetti Aggregatori + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Soggetti Aggregatori

    +

    Un SA può registrare RP preesistenti e già conformi allo standard OIDC-FED, afferenti a domini esterni al proprio oppure mascherare dietro di sé i propri discendenti. Nel primo caso il SA è di tipo Trasparente (Aggregatore Light) mentre nel secondo caso è di tipo Proxy (Aggregatore Full).

    +

    I SA Light registrano RP preesistenti e conformi a OIDC-FED e pubblicano gli ES a questi riferiti.

    +

    I SA Full provvedono a costruire una interfaccia di autenticazione e federazione per conto dei propri aggregati, mediante risorse web solitamente esposte all'interno del proprio dominio. Questa tipologia di Aggregatore espone le seguenti risorse per ogni suo aggregato:

    +
    +
      +
    • .well-known/openid-federation, contenente la Entity Configuration del proprio discendente (aggregato);

    • +
    • Authorization callback endpoint per l'acquisizione dell'auth code da parte del OP (redirect_uri).

    • +
    +
    +

    Il SA di tipo Full DEVE aggiungere almeno uno dei codici identificativi presenti nell'id_code (così come definito nella Sezione Composizione dei Trust Mark), all'interno del web path che compone il client_id, questo identifica univocamente all'interno della federazione l'aggregato <SA_domain>/<id_code>/. Se sono disponibili più di un codice identificativo, il SA PUÒ riportarli nel web path come nel seguente esempio: <SA_domain>/ipa_code/aoo_code/.

    +

    Nella seguente tabella sono presenti alcuni esempi non normativi per evidenziare le differenze tra gli aggregati Light e Full:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Modalità Light

    Modalità Full

    client_id

    https://www.rp.it/

    https://www.sa.it/<id_code>/

    redirect_uri

    https://www.rp.it/callback/

    https://www.sa.it/<id_code>/callback/

    authorization endpoint

    https://www.rp.it/authorization/

    https://www.sa.it/<id_code>/authorization/

    Entity Configuration

    https://www.rp.it/.well-known/openid-federation

    https://www.sa.it/<id_code>/.well-known/openid-federation

    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/standards.html b/it/standards.html new file mode 100644 index 00000000..43964d8d --- /dev/null +++ b/it/standards.html @@ -0,0 +1,1544 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Riferimenti + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Riferimenti

    +
    +

    Technical references

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    OIDC-FED

    OpenID Connect Federation 1.0

    iGov.OIDC

    Varley, M., Grassi, P. "iGov Profile for OpenID Connect", October 2018.

    OpenID.Core

    Sakimura, N., Bradley, J., Jones, M., de Medeiros, B. and C. Mortimore, "OpenID Connect Core 1.0", August 2015.

    OpenID.Registration

    Sakimura, N., Bradley, J., and M. Jones, "OpenID Connect Dynamic Client Registration 1.0," November 2014.

    OpenID.Discovery

    Sakimura, N., Bradley, J., Jones, M., and E. Jay, "OpenID Connect Discovery 1.0," November 2014.

    RFC 2119

    Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels," BCP 14, RFC 2119, March 1997.

    RFC 2616

    Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, “Hypertext Transfer Protocol -- HTTP/1.1,” RFC 2616, June 1999.

    RFC 3339

    Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002.

    RFC 3986

    Uniform Resource Identifier (URI): Generic Syntax

    RFC 7009

    Lodderstedt, T., Dronia, S., Scurtescu, M., “OAuth 2.0 Token Revocation,” RFC7009, August 2013.

    RFC 7159

    Bray, T., “The JavaScript Object Notation (JSON) Data Interchange Format,” RFC 7159, March 2014.

    RFC 7515

    Jones, M., Bradley, J. and N. Sakimura, "JSON Web Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May 2015.

    RFC 7516

    Jones, M., Hildebrand, J., "JSON Web Encryption (JWE)", May 2015.

    RFC 7517

    Jones, M., "JSON Web Key (JWK)", RFC 7517, DOI 10.17487/RFC7517, May 2015.

    RFC 7518

    Jones, M., "JSON Web Algorithms (JWA)", May 2015.

    RFC 7519

    Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015.

    RFC 7523

    Jones, M., Campbell, B., Martimore, C., “JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants”, May 2015.

    RFC 7636

    Sakimura, N., Bradley, J. and N. Agarwal, "Proof Key for Code Exchange by OAuth Public Clients", RFC 7636, DOI 10.17487/RFC7636, September 2015.

    RFC 7638

    Jones, M., Sakimura, N., “JSON Web Key (JWK) Thumbprint,”RFC7638, September 2015.

    RFC 7662

    Richer, J., "OAuth 2.0 Token Introspection", RFC 7662, DOI 10.17487/RFC7662, October 2015.

    RFC 7591

    Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol", RFC 7591, DOI 10.17487/RFC7591, July 2015.

    RFC 7800

    Jones, M., Bradley, J. and H. Tschofenig, "Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)", RFC 7800, DOI 10.17487/RFC7800, April 2016.

    RFC 8174

    Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", RFC 8174, DOI 10.17487/RFC8174, May 2017.

    RFC 8414

    Jones, M., Sakimura, N., and J. Bradley, "OAuth 2.0 Authorization Server Metadata", RFC 8414, DOI 10.17487/RFC8414, June 2018.

    RFC 8725

    Jones, M., D. Hardt, Sheffer, Y., "JSON Web Token Best Current Practices", February 2020.

    RFC 9068

    Bertocci, V., “JSON Web Token (JWT) Profile for OAuth 2.0 Access Token,” RFC9068, October 2021.

    I-D.ietf-oauth-iss-auth-resp

    Selhausen, K. M. Z. and D. Fett, "OAuth 2.0 Authorization Server Issuer Identification", Work in Progress, Internet-Draft, Draft-5, January 2022.

    I-D.ietf-OAuth-Security-BCP

    Lodderstedt, T., Bradley, J., Labunets, A., Fett, D., “OAuth 2.0 Security Best Current Practice”, Draft-19, December 2021.

    draft-yusef-oauth-nested-jwt

    Shekh-Yusef, R., Hardt, D., De Marco, G., “JSON Web Token (JWT) Embedded Tokens”, Draft-06, December 2022.

    EN319-412-1

    Electronic Signatures and Infrastructures (ESI); Certificate Profiles;

    E164

    International Telecommunication Union, "E.164: The international public telecommunication numbering plan," 2010.

    ISO8601-2004

    International Organization for Standardization, "ISO 8601:2004. Data elements and interchange formats +- Information interchange - Representation of dates and times," 2004.

    ICAO-Doc9303

    INTERNATIONAL CIVIL AVIATION ORGANIZATION, "Machine Readable Travel Documents, Seventh Edition, 2015, +Part 3: Specifications Common to all MRTDs", 2015

    ISO3166

    ISO, "ISO 3166-1:1997. Codes for the representation of names of countries and their subdivisions

    +
    +
    +
    +

    Normativa Nazionale ed Europea

    + ++++ + + + + + + + + + + + +

    CAD

    DL 7 March 2005 n.82: "Codice dell'amministrazione digitale." (GU Serie Generale n.112 16-05-2005 - Suppl. Ordinario n. 93)

    DL-SEMPLIFICAZIONI

    DL 16 July 2020 n.76: "Misure urgenti per la semplificazione e l'innovazione digitale." (20A04921) (GU Serie Generale n.228 14-09-2020 - Suppl. Ordinario n. 33) and its conversion into Law, with amendments, Law 11 September 2020 n. 120.

    EIDAS

    Regulation (Eu) No 910/2014 of the European Parliament and of the Council 23 July 2014 "on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC."

    +
    +

    Riferimenti normativi SPID

    +

    L'avvio del Sistema SPID, per sua natura e complessità, può richiedere di intervenire su diversi aspetti con specificazioni, chiarimenti, note informative e casi esemplificativi, al fine di dare supporto ad una migliore applicazione e comprensione dei Regolamenti SPID già emanati dall'AgID in conformità con quanto prescritto dall'art.4 del DPCM 24 ottobre 2014.

    +

    Al fine di raccogliere organicamente tali interventi e attribuirvi un carattere cogente che ne comporti l'obbligo di applicazione da parte degli attori convolti nel Sistema SPID, siano essi pubblici che privati, è stata creata la presente sezione “Avvisi SPID” con l'obiettivo di assicurare un'uniforme interpretazione delle regole, degli aspetti tecnici e di quant'altro necessario per il corretto funzionamento del Sistema nel suo complesso.

    +

    Le presenti regole tecniche implementano i seguenti avvisi SPID:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Avviso

    Riferimento

    Data

    LL.GG. OpenID Connect in SPID

    LL.GG. OpenID Connect in SPID

    24/11/2021

    Avviso n.41

    Avviso n.41 - Integrazione LL.GG. OpenID Connect in SPID.pdf

    06/05/2022

    Tabella Attributi utente v1.3

    Tabella Attributi in SPID - Integrazione LL.GG. OpenID Connect in SPID.pdf

    24/06/2022

    Determina SPID OpenID Connect Federation

    Regole tecniche per il funzionamento della Federazione SPID OpenID Connect - Integrazione LL.GG. OpenID Connect in SPID.pdf -

    14/09/2022

    Linee Guida Attribute Authority SPID

    Linee guida recanti le regole tecniche dei gestori di attributi qualificati

    18/07/2022

    +
    +
    +

    Riferimenti normativi CIE id

    + ++++ + + + + + +

    DM-CIE

    DM 23 December 2015 n.210: "Modalità tecniche di emissione della Carta d'identità elettronica." (15A09809) (GU Serie Generale n.302 30-12-2015)

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/termini_acronimi.html b/it/termini_acronimi.html new file mode 100644 index 00000000..366fdf94 --- /dev/null +++ b/it/termini_acronimi.html @@ -0,0 +1,1493 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Termini e Acronimi + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Termini e Acronimi

    +
    +

    Termini

    +

    Seguono i termini utilizzati da OIDC-FED#Section_1.2 e in questo documento.

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Autorità di Federazione

    Un'entità legale che gestisce la fiducia tra le parti coinvolte nella Federazione e norma il funzionamento e le modalità +di registrazione e riconoscimento dei partecipanti.

    Trust Anchor

    Sistema gestito dalla Autorità di Federazione, che rappresenta la Federazione e la sua configurazione.

    Intermediario

    Soggetto Aggregatore (SA), facilita l'ingresso nella Federazione e PUÒ gestire le funzionalità per conto di un +suo discendente (aggregato). Pubblica la propria configurazione all'interno della Federazione e le affermazioni di riconoscimento delle parti sue discendenti (aggregati) secondo le regole definite dall'Autorità di Federazione.

    Foglia

    Entità definita dal protocollo OpenID Connect come Relying Party e Provider OpenID. Può anche essere una Attribute Authority (OAuth2 Authorization Server e Resource Server).

    Entità

    Partecipante alla Federazione. Trust Anchor, Intermediario o Foglia.

    Entity Configuration

    Dichiarazione di un'entità, emessa per proprio conto, nella forma di JWT auto firmato RFC 7515 e contenente la sua configurazione. Contiene le chiavi pubbliche di Federazione, i Metadata OIDC, gli URL delle autorità sue superiori e i Trust Mark emessi da autorità riconoscibili nella Federazione che attestano l'aderenza del soggetto a determinati profili.

    Entity Statement

    Dichiarazione di riconoscimento emessa da un'entità superiore (Trust Anchor o Intermediario) riguardante un soggetto discendente (RP, OP, AA o Intermediario) in formato JWT firmato RFC 7515, contenente le chiavi pubbliche del soggetto discendente, i Trust Mark emessi per i quali è emettitore e la politica dei Metadata da applicare ai Metadata del soggetto.

    Trust Mark

    JWT firmato RFC 7515 dall'ente emettitore e relativo ad un partecipante. Attesta la conformità di questo ai profili riconoscibili all'interno Federazione (RP pubblico o privato, Soggetto Aggregatore Pubblico o Privato, etc.). La Foglia che acquisisce il marchio di fiducia durante il processo di onboarding DEVE includere questo nella sua Entity Configuration.

    Metadata

    Documento che descrive l'implementazione di una entità OpenID Connect o OAuth2. Le implementazioni di ogni Entità condividono i Metadata per stabilire una base di fiducia e interoperabilità.

    Metadata policy

    Il Trust Anchor pubblica le regole e le politiche da applicare sui Metadata dei discendenti, specificando quali valori o sottoinsiemi di valori sono consentiti per un dato parametro di Metadata.

    Authority hint

    Array di valori URL contenente gli identificativi delle Entità superiori, Trust Anchor o Intermediario, che emettono un Entity Statement per i propri discendenti.

    Federation Entity Discovery

    Raccolta di Entity Configuration e Statement. Inizia da un'Entità Foglia fino al raggiungimento del Trust Anchor.

    Trust Chain

    Procedura di validazione della sequenza di Entity Configuration e Statement raccolta mediante Federation Entity Discovery, il cui esito positivo è un Metadata finale relativo ad una Entità e la data di scadenza entro la quale la Trust Chain deve essere aggiornata.

    Onboarding

    Procedura di registrazione di una nuova entità all'interno della Federazione SPID e CIE

    Federation Endpoint

    Endpoint definit in OIDC Federation 1.0, usati per prendere e risolvere gli statement delle entità, interrogare una lista di tutte le entità subordinate e verificare lo stato dei Trust Mark.

    +
    +
    +

    Acronimi

    +

    In questa sezione sono definiti tutti gli acronimi utilizzati all'interno del testo.

    + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    SPID

    Sistema Pubblico di Identità Digitale italiano, la cui Authorità di Federazione è la AgID (Agenzia per l'Italia Digitale).

    CIE id

    Sistema Pubblico di Identità Digitale italiano basato sulla Carta d'Identità Elettronica (CIE), di cui il Ministero dell'Interno è l'Autorità di Federazione. La gestione tecnica e operativa è affidata all'Istituto Poligrafico e Zecca dello Stato (IPZS).

    OIDC

    OpenID Connect.

    OIDC-FED

    OIDC Federation 1.0.

    FA

    Autorità di Federazione (Federation Authority).

    TA

    OIDC Federation Trust Anchor.

    AgID

    Agenzia per l'Italia Digitale, FA/TA di SPID.

    MinInterno

    Ministero dell'Interno, FA/TA di CIE id.

    OP

    OpenID Provider (Entità Foglia).

    RP

    Relying Party (Entità Foglia).

    SA

    Soggetti Aggregatori. Entità Intermediarie che possono gestire tutti gli aspetti della Federazione di uno o più RP.

    AA

    Attribute Authority, Gestore degli Attributi qualificati (Entità Foglia).

    TM

    Trust Mark.

    EC

    Entity Configuration.

    ES

    Entity Statement.

    URL

    Uniform Resource Locator, corrispondente ad un indirizzo web.

    JWT

    Vedi RFC 7519 Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015.

    RS

    OAuth2 Resource Server.

    $JWT

    Il valore di un JWT (JSON Web Token).

    +
    +
    +

    Convenzioni e Termini normativi

    +

    Le parole chiave "DEVE" e "DEVONO", "NON DEVE" e "NON DEVONO", "RICHIEDE" e "RICHIESTO", "NON DEVE", "DOVREBBE", "NON DOVREBBE", "RACCOMANDATO", "PUÒ" e "OPZIONALE" nel presente documento devono essere interpretate come descritte nel BCP 14 RFC 2119 RFC 8174 quando e solo quando appaiono in maiuscolo.

    +

    Le notazioni [...] e ... indicano che il testo è stato troncato per esigenze editoriali.

    +

    base64url denota la codifica URL-safe base64 senza padding definita in RFC 7515#section-2.

    +

    Tutti gli esempi contenuti in questo documento sono da considerarsi come non normativi.

    +
    +

    Avvertimento

    +

    Tutti gli esempi contenuti in questa documentazione sono da intendersi come non normativi

    +
    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/token_endpoint.html b/it/token_endpoint.html new file mode 100644 index 00000000..dd18f670 --- /dev/null +++ b/it/token_endpoint.html @@ -0,0 +1,1827 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Token Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Token Endpoint

    +

    Al termine del flusso di autenticazione descritto nel paragrafo precedente, il RP invia una richiesta al Token Endpoint inviando l'authorization code ricevuto dall'OP per ottenere un ID Token e un Access Token ed eventualmente un Refresh Token (se è stata effettuata una richiesta di autenticazione con scope=offline_access e prompt=consent. Vedi la Sezione Refresh Token).

    +

    I token restituiti devono essere JWT firmati.

    +
    +

    spid-icon

    +

    In presenza di una sessione lunga revocabile, il RP PUÒ chiamare il Token Endpoint inviando il Refresh Token in suo possesso per ottenere un nuovo Access Token e ID Token.

    +
    +
    +

    Nota

    +

    Il metodo di autenticazione del RP presso il token endpoint è il private_key_jwt (OpenID.Core#ClientAuthentication).

    +
    + +
    +

    Request

    +

    Di seguito i claim che DEVONO essere inseriti nella Token Request.

    +

    Esempio di richiesta con authorization code (caso 1)

    +
    +
    POST /token HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_id=https://rp.spid.agid.gov.it&
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +code=usDwMnEzJPpG5oaV8x3j&
    +code_verifier=9g8S40MozM3NSqjHnhi7OnsE38jklFv2&
    +grant_type=authorization_code
    +
    +
    +
    + +

    Esempio di richiesta con Refresh Token (caso 2):

    +
    +
    POST /token HTTP/1.1
    +Host: https://op.spid.agid.gov.it
    +Content-Type: application/x-www-form-urlencoded
    +
    +client_id=https://rp.spid.agid.gov.it&
    +client_assertion=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiw
    +ibmFtZSI6IlNQSUQiLCJhZG1pbiI6dHJ1ZX0.LVyRDPVJm0S9q7oiXcYVIIqGWY0wWQlqxvFGYswL…&
    +client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwtbearer&
    +grant_type=refresh_token&
    +refresh_token=8xLOxBtZp8
    +
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    client_id

    Vedi OpenID.Registration. DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP.

    spid-icon cieid-icon

    client_assertion

    JWT firmato con la chiave privata del Relying Party contenente i seguenti parametri:

    +
    +

    iss: DEVE corrispondere al valore client_id

    +

    sub: DEVE corrispondere al valore iss

    +

    aud: URL del Token Endpoint dell'OP

    +

    iat: UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519.

    +

    exp: UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519

    +

    jti: Identificatore univoco per questa richiesta di autenticazione, generato dal client. Ad esempio in formato uuid4.

    +
    +

    spid-icon cieid-icon

    client_assertion_type

    Deve assumere il seguente valore:
    +urn:ietf:params:oauth:client-assertion-type:jwtbearer

    spid-icon cieid-icon

    code

    Codice di autorizzazione restituito nell'Authentication response. Obbligatorio solo se grant_type è authorization_code

    spid-icon cieid-icon

    code_verifier

    Codice di verifica del code_challenge. Obbligatorio solo se grant_type è authorization_code

    spid-icon cieid-icon

    grant_type

    Tipo di credenziale presentata dal RP per la richiesta corrente. +PUÒ assumere uno dei seguenti valori:

    +
    +
      +
    • authorization_code

    • +
    • refresh_token

    • +
    +
    +

    spid-icon cieid-icon

    refresh_token

    Obbligatorio solo se grant_type è refresh_token

    spid-icon cieid-icon

    +
    +
    +

    Response

    +

    L'OpenID Provider (OP) restituisce un ID Token e Access Token e un eventuale Refresh Token, in formato JWT firmato.

    +

    L'Access Token deve essere formato secondo le indicazioni dello standard "International Government Assurance Profile (iGov) for OAuth 2.0 - Draft 03", section 3.2.1, "JWT Bearer Tokens".

    +

    L'ID Token deve essere formato secondo le indicazioni del paragrafo successivo.

    +

    La risposta DEVE contenere i seguenti claim.

    +

    Esempio di risposta:

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/json
    +
    +{
    +    "access_token":"dC34Pf6kdG...",
    +    "token_type":"Bearer",
    +    "refresh_token":"wJ848BcyLP...",
    +    "expires_in":1800,
    +    "id_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY..."
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    access_token

    L'Access Token, in formato JWT firmato, consente l'accesso allo UserInfo endpoint per ottenere gli attributi.

    spid-icon cieid-icon

    token_type

    Tipo di Access Token restituito. DEVE essere valorizzato sempre con Bearer

    spid-icon cieid-icon

    refresh_token

    Disponibile sono nel caso di sessione lunga revocabile. Il Refresh Token, in formato JWT firmato, consente di chiamare nuovamente il Token Endpoint per ottenere un nuovo Access Token e un nuovo ID Token.

    spid-icon cieid-icon

    expires_in

    Scadenza dell'Access Token in secondi.

    spid-icon cieid-icon

    id_token

    ID Token in formato JWT (vedi paragrafo successivo)

    spid-icon cieid-icon

    +
    +
    +

    Access Token

    +

    L'Access Token è un JSON Web Token (JWT) firmato che consente l'accesso allo +UserInfo endpoint per ottenere gli attributi dell'utente. +Di seguito i claim che compongono l'Access Token.

    +

    Esempio del contenuto di intestazione di payload di un Access Token:

    +
    {
    +  "alg": "RS256",
    +  "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw",
    +  "typ": "at+jwt"
    +}
    +.
    +{
    +  "iss":"https://op.spid.agid.gov.it/",
    +  "sub": "9sd798asd98asui23hiuds89y798sfyg",
    +  "aud": [
    +  "https://rp.spid.example.it"
    +  ],
    +  "client_id": "https://rp.spid.example.it",
    +  "scope": "openid",
    +  "jti": "9ea42af0-594c-4486-9602-8a1f8dde42d3",
    +  "exp": 1656859559,
    +  "iat": 1656857579
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    iss

    DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. Il client DEVE verificare che questo valore corrisponda all'OP chiamato.

    spid-icon cieid-icon

    sub

    Vedi OpenID.Core#SubjectIDTypes. DEVE essere di tipo pairwise.

    spid-icon cieid-icon

    client_id

    DEVE essere valorizzato con un HTTPS URL che identifica univocamente il RP.

    spid-icon cieid-icon

    aud

    DEVE coincidere con il valore client_id. Il RP DEVE verificare che questo valore corrisponda al proprio client ID.

    spid-icon cieid-icon

    scope

    L'OP DOVREBBE inserire il parametro scope come previsto in RFC 9068 Sezione 2.2.3. DEVE coincidere con il valore presente in fase di richiesta di autenticazione.

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    jti

    DEVE essere una Stringa in formato uuid4. Identificatore unico dell'ID Token che il RP PUÒ utilizzare per prevenirne il riuso, rifiutando l'ID Token se già processato.

    spid-icon cieid-icon

    +
    +
    +

    ID Token

    +

    L'ID Token è un JSON Web Token (JWT) firmato che contiene informazioni sull'utente che ha eseguito l'autenticazione. I RP DEVONO eseguire la validazione dell'ID Token.

    +
    +

    cieid-icon

    +

    Il RP PUÒ richiedere che L'ID Token sia cifrato (vedere il parametro id_token_encrypted_response_alg nel Metadata RP ). +Se il RP inserisce nel suo metadata il parametro id_token_encrypted_response_alg, l'OP DEVE restituire l'ID Token firmato e cifrato. L'ID Token in formato JWT DEVE contenere il parametro cty (Content-Type) nell'intestazione JOSE con il valore JWT (vedere RFC 7519#section-5.2).

    +
    +

    Di seguito i claim disponibili nell'ID Token.

    +
    +

    Esempio del contenuto di intestazione e di payload di un ID Token:

    +
    +
    {
    +  "alg": "RS256",
    +  "kid": "dB67gL7ck3TFiIAf7N6_7SHvqk0MDYMEQcoGGlkUAAw"
    +}
    +.
    +{
    +    "iss":"https://op.spid.agid.gov.it/",
    +    "sub":"9sd798asd98asui23hiuds89y798sfyg",
    +    "aud":"https://rp.spid.example.it/auth",
    +    "acr":"https://www.spid.gov.it/SpidL2",
    +    "at_hash":"qiyh4XPJGsOZ2MEAyLkfWqeQ",
    +    "iat":1519032969,
    +    "nbf":1519032969,
    +    "exp":1519033149,
    +    "jti":"nw4J0zMwRk4kRbQ53G7z",
    +    "nonce":"MBzGqyf9QytD28eupyWhSqMj78WNqpc2"
    +}
    +
    +
    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    iss

    DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. Il client DEVE verificare che questo valore corrisponda all'OP chiamato.

    spid-icon cieid-icon

    sub

    Vedi OpenID.Core#SubjectIDTypes. DEVE essere di tipo pairwise.

    spid-icon cieid-icon

    aud

    DEVE coincidere con il valore client_id. Il RP DEVE verificare che questo valore corrisponda al proprio client ID.

    spid-icon cieid-icon

    acr

    Livello di autenticazione effettivo. DEVE essere uguale o superiore a quello richiesto dal RP nella Authentication Request.

    spid-icon cieid-icon

    at_hash

    Vedi OpenID.Core#CodeIDToken. Il suo valore è la codifica base64url della prima metà dell'hash calcolato sulla rappresentazione ASCII dell'Access Token, usando l'algoritmo di hashing indicato in alg nell'header dell'ID Token. Il client DEVE verificare che questo valore corrisponda applicando la medesima funzione all'Access Token restituito insieme all'ID Token.

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    nbf

    UNIX Timestamp. Istante di inizio validità del JWT in formato NumericDate, come indicato in RFC 7519. DEVE corrispondere con il valore di iat.

    spid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    jti

    DEVE essere una Stringa in formato uuid4. Identificatore unico dell'ID Token che il RP PUÒ utilizzare per prevenirne il riuso, rifiutando l'ID Token se già processato.

    spid-icon cieid-icon

    nonce

    Vedi OpenID.Core#AuthRequest. DEVE essere una stringa casuale di almeno 32 caratteri alfanumerici. Questo valore DEVE coincidere con quello inviato dal RP nella richiesta di autenticazione.

    spid-icon cieid-icon

    + +
    +
    +

    Refresh Token

    +

    Il Refresh Token è un JWT che PUÒ essere rilasciato dall'OP e che PUÒ essere usato per ottenere un nuovo Access Token che abilita il RP ad accedere allo UserInfo endpoint senza interazione diretta dell'utente.

    +

    Il Refresh Token DEVE essere rilasciato in formato JWT, firmato, e contenere almeno i seguenti parametri.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    iss

    DEVE essere valorizzato con un HTTPS URL che identifica univocamente l'OP. Il RP DEVE verificare che questo valore corrisponda all'OP chiamato.

    spid-icon cieid-icon

    aud

    DEVE coincidere con il valore client_id. Il RP DEVE verificare che questo valore corrisponda al proprio client ID.

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    jti

    DEVE essere una Stringa in formato uuid4. Identificatore unico del Refresh Token che il RP PUÒ utilizzare per prevenirne il riuso, rifiutando il Refresh Token se già processato.

    spid-icon cieid-icon

    +
    +

    cieid-icon

    +

    Per ottenere un Refresh Token, il RP DEVE includere nel parametro scope della richiesta di autenticazione il valore offline_access e nel parametro prompt il valore consent. L'utilizzo di questo scope può essere utile in scenari nei quali un RP ha la necessità di verificare che l'identità digitale di un utente finale sia ancora valida o vuole mantenere aggiornati gli attributi che ha precedentemente raccolto durante la fase di autenticazione, ad esempio per l'invio di notifiche all'utente finale successive all'autenticazione dello stesso. +Il Refresh Token NON DEVE consentire al RP richiedente di ottenere un ID Token, nè quello precedentemente rilasciato in fase di autenticazione nè un nuovo ID Token. L'utilizzo del Refresh Token NON DEVE essere utilizzato dagli RP per ottenere una nuova autenticazione dell'utente con l'OP o rinnovare una sessione preesistente, ma PUÒ essere utilizzato come meccanismo per ottenere dallo UserInfo endpoint esclusivamente il medesimo set di attributi dell'utente richiesti in fase di autenticazione iniziale e per il quale l'utente ha espresso il consenso esplicito. Tale consenso DEVE essere raccolto dall'OP in fase autenticazione dell'utente finale nella pagina di consenso. L'utente finale DEVE avere la possibilità di abilitare o disabilitare questa opzione prima di inviare il consenso che PUÒ essere soggetto ad un periodo di validità se definito dall'OP in base alle policy sul trattamento dei dati personali.

    +

    L'OP che riceve una richiesta di un nuovo Access Token tramite un Refresh Token PUÒ inviare una notifica all'utente tramite uno dei recapiti digitali disponibili (email, sms, notifica mobile app). L'utente che non riconosce legittima questa operazione o che vuole disabilitare questa opzione PUÒ richiedere all'OP una revoca del consenso dato (e quindi dei token emessi a seguito dello stesso) secondo le modalità rese note all'interno della pagina di raccolta del consenso. La notifica DEVE avere solo carattere informativo e non autorizzativo. All'interno della notifica DEVE essere reso noto all'utente le modalità di revoca del consenso dato. L'OP DEVE consentire all'utente di disabilitare in qualsiasi momento questa opzione tramite apposita funzionalità messa a disposizione dall'OP stesso.

    +

    Per ragioni di sicurezza, un OP DEVE restituire, insieme ad un nuovo Access Token, anche un nuovo Refresh Token, invalidando tutti i token precedentemente rilasciati (refresh token rotation) al RP e in relazione al soggetto interessato (utente finale). Il nuovo Refresh Token DEVE avere il parametro exp non superiore alla durata prevista.

    +
    +
    +

    spid-icon

    +

    Per applicazioni mobili in cui il RP intenda offrire un'esperienza utente che non richieda il reinserimento delle credenziali SPID ad ogni utilizzo dell'applicazione, si POSSONO utilizzare le sessioni lunghe revocabili utilizzando il Refresh Token come normato nelle LL.GG. OpenID Connect in SPID e nell' Avviso n.41 . +Il Token endpoint verifica la validità del Refresh Token e, se nella richiesta di autenticazione originaria era presente nell' acr_values il valore https://www.spid.gov.it/SpidL1, rilascia un nuovo ID Token valido esclusivamente per il livello 1 SPID. +Per maggiori dettagli sull'utilizzo del Refresh Token nel contesto SPID, si vedano i seguenti documenti normativi:

    +
    +
    +
    +
    +

    Periodo di validità di un Refresh Token

    +

    Il Refresh Token NON DEVE avere una validità (differenza tra iat e exp) superiore a 30 giorni.

    +

    Se allo scadere del periodo di validità l'RP effettua una richiesta all'OP, quest'ultimo DEVE restituire un errore nella risposta (Vedi Codici di Errore).

    +
    +

    cieid-icon

    +

    Fermo restando la validità del token, l'OP PUÒ fissare un periodo di validità relativo al consenso che l'utente ha fornito all'utilizzo dello scope offline_access e del Refresh Token. In prossimità del termine di validità del consenso, qualora tale termine sia previsto nelle policy dell'OP, il valore di exp DEVE essere calcolato come il valore minimo tra la durata di validità del token e quella del consenso.

    +
    +

    Nota

    +

    Al fine di chiarire il meccanismo di rotazione si riporta di seguito un esempio non normativo dove si descrive l'emissione e il lifecyle del Refresh Token con validità di 30 giorni.

    +
      +
    • t1: un RP effettua un autenticazione con scope=offline_access, quindi ottiene Refresh Token RT1 (validità 30gg)

    • +
    • t2 = t1 + 4gg: l'RP fa richiesta al Token endpoint presentando RT1. L'OP riconosce che la richiesta proviene dallo stesso RP e rilascia un nuovo Access Token e nuovo Refresh Token RT2 con validità 30gg a partire da t2

    • +
    • t3 = t1 + 32gg: dopo 28gg da t2 l'RP fa richiesta al Token endpoint presentando RT2. L'OP riconosce che la richiesta proviene dallo stesso RP e rilascia un nuovo Access Token e nuovo Refresh Token RT3 con validità 30gg da t3

    • +
    • t4 = t1 + 64gg: dopo 32gg da t3 l'RP fa richiesta al Token endpoint presentando RT3. Questa volta l'OP rifiuta la richiesta con un errore perchè RT3 risulta non più valido.

    • +
    +
    +
    +
    +
    +
    +

    Codici di errore

    + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Codice HTTP

    Supportato da

    invalid_client

    Problemi durante la client authentication (ad esempio, il client_id è conosciuto, non è fornita l'autenticazione del client o il metodo di autenticazione non è supportato)
    (RFC 6749#section-5.2).

    401 Unauthorized

    spid-icon cieid-icon

    unsupported_grant_type

    Il parametro grant_type contiene un valore non corretto (RFC 6749#section-5.2).

    400 Bad Request

    spid-icon cieid-icon

    invalid_grant

    I parametri grant_type, code, code_verifier, access_token non sono validi (RFC 6749#section-5.2).

    400 Bad Request

    spid-icon cieid-icon

    invalid_request

    La richiesta non è valida a causa della mancanza o della non correttezza di uno o più parametri (RFC 6749#section-5.2).

    400 Bad Request

    spid-icon cieid-icon

    server_error

    L'OP ha riscontrato un problema interno (RFC 6749#section-5.2).

    500 Internal Server Error

    spid-icon cieid-icon

    temporarily_unavailable

    L'OP ha riscontrato un problema interno temporaneo (RFC 6749#section-5.2).

    503 Service Unavailable

    spid-icon cieid-icon

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/trust_marks.html b/it/trust_marks.html new file mode 100644 index 00000000..c07012e6 --- /dev/null +++ b/it/trust_marks.html @@ -0,0 +1,1589 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Trust Mark + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Trust Mark

    +

    I Trust Mark (TM), letteralmente tradotti come Marchi di Fiducia, sono JWT firmati RFC 7515 e rappresentano la dichiarazione di conformità ad un insieme ben definito di requisiti di fiducia e/o di interoperabilità o un accordo tra le parti coinvolte all'interno della Federazione.

    +

    Lo scopo principale dei TM è quello di esporre alcune informazioni non richieste dal protocollo OpenID Connect Core ma che risultano utili in contesto Federativo.

    +

    Esempi tipici includono il codice di identificazione nazionale o internazionale dell'entità (Codice Fiscale, IPA Code, Partita IVA, VAT Number), i contatti istituzionali e altro, come definito in OIDC-FED. Ulteriori dati possono essere aggiunti dal soggetto che li emette.

    +

    I TM sono emessi e firmati, durante il processo di registrazione di una nuova entità di tipo Foglia (Onboarding), dal (TA) o suoi Intermediari (SA) o da Gestori Qualificati di Attributi (AA), se definiti all'interno dell'attributo trust_marks_issuers, pubblicato all'interno dell'Entity Configuration del TA.

    +

    Di seguito un esempio non normativo dell'oggetto trust_marks_issuers all'interno della Entity Configuration del TA.

    +
    {
    +    "trust_marks_issuers":{
    +        "https://registry.agid.gov.it/openid_relying_party/public/":[
    +            "https://registry.spid.agid.gov.it/",
    +            "https://public.intermediate.spid.it/"
    +        ],
    +        "https://registry.agid.gov.it/openid_relying_party/private/":[
    +            "https://registry.spid.agid.gov.it/",
    +            "https://private.other.intermediate.it/"
    +        ]
    +    }
    +}
    +
    +
    +

    Ogni entità partecipante DEVE esporre nella propria configurazione (EC) i TM rilasciati dalle autorità che li emettono.

    +

    Nello scenario CIE / SPID, un TM viene firmato dal TA MinInterno / Agid o loro Intermediari (SA) o Gestori Qualificati di Attributi (AA).

    +

    Il TA definisce i soggetti abilitati all'emissione dei TM riconoscibili all'interno della Federazione, mediante il claim trust_marks_issuers, presente all'interno del proprio Entity Configuration. Il valore dell'attributo trust_marks_issuers è composto da un oggetto JSON avente come chiavi gli identificativi dei TM e come valori la lista degli identificativi (URL) delle entità abilitate ad emetterli.

    +

    I Trust Mark rappresentano il primo filtro per l'instaurazione della fiducia tra le parti, sono elementi indispensabili per avviare la risoluzione dei metadati. In loro assenza una entità non è riconoscibile come partecipante all’interno della Federazione.

    +

    All’interno della Federazione SPID i Trust Mark presentano degli identificativi univoci (claim id) in formato URL che adottano la seguente struttura: https:// <domain> / <entity_role> / [<trustmark_profile> /] [estensione /]

    +

    Alcuni esempi non normativi sono di seguito riportati:

    +
    +
      +
    • TM RP public: https://registry.agid.gov.it/openid_relying_party/public/

    • +
    • TM SA private: https://registry.agid.gov.it/intermediate/private/

    • +
    • TM AA: https://registry.agid.gov.it/oauth_resource/public/

    • +
    +
    +

    La tabella seguente definisce i <entity_role> riconoscibili all'interno delle Federazioni SPID e CIE id:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    tipo

    descrizione

    entità

    openid_relying_party

    l'entità nel claim sub è un RP.

    RP

    openid_provider

    l'entità nel claim sub è un OP.

    OP

    intermediate

    l'entità nel claim sub è un Soggetto Aggregatore.

    SA

    oauth_resource

    l'entità nel claim sub è una Attribute Authority.

    AA

    +

    La tabella seguente definisce i <trustmark_profile> riconoscibili all'interno delle Federazioni SPID e CIE id:

    + +++++ + + + + + + + + + + + + + + + + +

    profilo

    descrizione

    Entità

    public

    l'entità nel claim sub appartiene alla pubblica amministrazione italiana.

    RP, OP, SA, AA

    private

    l'entità nel claim sub appartiene al settore privato.

    RP, OP, SA, AA

    +
    +

    federation_entity Trust Mark

    +

    In aggiunta ai claim dei profili public e private, il profilo intermediate individua i SA e aggiunge le estensioni full e light all'interno del claim sa_profile, a seconda della modalità con cui operano rispetto ai Soggetti Aggregati

    +
    +

    Vedi anche

    +

    Si veda Sezione Soggetti aggregatori nel contesto Federativo

    +
    +
    +
    +

    oauth_resource Trust Mark

    +

    In aggiunta ai claim dei profili public e private, il profilo oauth_resource individua le AA e aggiunge i seguenti claim obbligatori:

    + ++++ + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    policy_uri

    URL dove è disponibile la privacy policy dell'AA.

    tos_uri

    URL dove è disponibile la info policy dell'AA.

    claims

    Lista di JSON Object che definiscono gli attributi dell’utente richiesti dall'AA. Esempio:
    {"https://attributes.eid.gov.it/fiscal_number":{"essential":true},
    "email":{"essential":true},}

    service_documentation

    URL dove è disponibile il documento OAS3 che descrive il funzionamento dei servizi dell'AA.

    +
    +
    +

    Validazione dei Trust Mark

    +

    Esistono due modi per validare un Trust Mark:

    +
    +
      +
    1. Validazione statica. Il Trust Mark viene validato mediante la chiave pubblica dell'autorità che lo ha emesso (attributo iss), sulla base della corrispondenza dell'attributo sub con il medesimo attributo della Entity Configuration in cui è contenuto e sulla base del valore di scadenza (attributo exp).

    2. +
    3. Validazione dinamica. I partecipanti della Federazione possono interrogare l'endpoint trust mark status erogato dal suo emettitore (attributo iss) per la verifica in tempo reale dei TM da lui emessi.

    4. +
    +
    +

    Tutte le entità che rilasciano Trust Mark DEVONO esporre un endpoint di Trust Mark status per consentire la validazione dinamica.

    +
    +

    Vedi anche

    + +
    +
    +
    +

    Revoca dei Trust Mark

    +

    Un Trust Mark può essere revocato in qualsiasi momento solo ed esclusivamente dal soggetto che lo ha emesso. Ad esempio, in caso di esclusione di un Soggetto Aggregato da parte della Autorità di Federazione, questa comunica al Soggetto Aggregatore l'esclusione dell'Aggregato. Di conseguenza il SA DEVE revocare il TM per il suo discendente.

    +
    +

    Nota

    +

    Nel caso di revoca di un TM, la validazione dinamica darà esito negativo, mentre la validazione statica continuerà a dare esito positivo, a meno di rotazioni delle chiavi crittografiche di firma del soggetto che ha rilasciato il TM.

    +
    +
    +
    +

    Composizione dei Trust Mark

    +

    Gli attributi definiti all'interno dei TM aderiscono a quanto definito all'interno dello standard OIDC Federation 1.0 (OIDC-FED). Segue la lista.

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    iss

    String. URL che identifica univocamente l'Autorità che lo ha emesso.

    spid-icon cieid-icon

    sub

    String. URL che identifica univocamente il soggetto per il quale il Trust Mark è stato emesso.

    spid-icon cieid-icon

    id

    String. Identificativo univoco del Trust Mark. È un URL con la seguente struttura:
    +<TA domain>/<entity_type>/<trustmark_profile>/
    +es. non normativo: https://registry.interno.gov.it/openid_relying_party/public/

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    logo_uri

    String. Un URL che punta al logo rappresentante il Trust Mark.

    spid-icon cieid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519

    spid-icon cieid-icon

    ref

    String. URL che punta a informazioni presenti sul web relative a questo Trust Mark.

    spid-icon cieid-icon

    organization_type

    String. Specifica se l'ente appartiene alla pubblica amministrazione italiana o al settore privato (public o private)

    spid-icon cieid-icon

    id_code

    Oggetto JSON. Contiene uno o più codici di identificazione dell'organizzazione. I claim disponibili sono: +- ipa_code: OBBLIGATORIO nel caso di organizzazione pubblica. +- aoo_code: OPZIONALE. +- uo_code: OPZIONALE. +- vat_number: OBBLIGATORIO per organizzazione privata se non presente fiscal_number. +- fiscal_number: OBBLIGATORIO per organizzazione privata se non presente vat_number.

    spid-icon cieid-icon

    email

    String. Email istituzionale o PEC dell'organizzazione.

    spid-icon cieid-icon

    organization_name

    String. Il nome completo dell'entità che fornisce i servizi

    spid-icon cieid-icon

    sa_profile

    String. RICHIESTO per SA. Specifica il profilo dell’Aggregatore, full o light.

    spid-icon cieid-icon

    +
    +

    Avvertimento

    +

    Il valore contenuto nel parametro exp NON DEVE essere superiore alla durata delle convenzioni stipulate in fase di onboarding tra l'Entità che rilascia i Trust Mark e le organizzazioni che lo ricevono.

    +
    + +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/trust_negotiation.html b/it/trust_negotiation.html new file mode 100644 index 00000000..dc04881b --- /dev/null +++ b/it/trust_negotiation.html @@ -0,0 +1,1405 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | Acquisire i Metadata + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    Acquisire i Metadata

    +

    In questa sezione sono illustrate le modalità di mutuo riconoscimento dei partecipanti all'interno della medesima federazione, le modalità con le quali i partecipanti ottengono i metadata gli uni degli altri in maniera sicura.

    +
    +

    Relying Party

    +

    Il RP ottiene la lista degli OP in formato JSON interrogando l'endpoint list disponibile presso il Trust Anchor. Per ogni soggetto contenuto nella risposta dell'endpoint list e corrispondente ad un OP, il RP richiede ed ottiene l'Entity Configuration presso l'OP.

    +

    Per ogni EC degli OP, il RP verifica la firma del contenuto adoperando la chiave pubblica ottenuta dall'Entity Statement rilasciato dalla Trust Anchor per gli OP. Verifica la firma dell'Entity Configuration degli OP usando la chiave pubblica ottenuta dall'Entity Statement rilasciato dal TA.

    +

    Il RP applica infine le politiche pubblicate dal Trust Anchor sui Metadata dell'OP e salva il Metadata finale associandolo ad una data di scadenza (claim exp). La data di scadenza corrisponde al valore di exp più basso ottenuto da tutti gli elementi che compongono la Trust Chain. Periodicamente il RP aggiorna i Metadata di tutti gli OP rinnovando la Trust Chain relativa a questi.

    +

    Ottenuti i Metadata finali di tutti i OpenID Connect Provider, il RP genera lo SPID Button o il CIE id Button e lo pubblica all'interno della pagina di autenticazione destinata agli utenti.

    +

    La procedura di Federation Entity Discovery risulta semplificata per i RP, perché all'interno della Federazione non è consentita l'esistenza di Intermediari tra gli OP ed il loro Trust Anchor.

    +_images/metadata_discovery.svg +

    La procedura di Federation Entity Discovery a partire dalla Foglia fino al Trust Anchor. Dall'Entity Statement rilasciato da un superiore si ottiene la chiave pubblica per la validazione dell'Entity Configuration dell'entità discendente.

    +
    +
    +

    OpenID Provider

    +

    Quando un Provider (OP) riceve una richiesta di autorizzazione da parte di un RP non precedentemente riconosciuto, avviene la procedura di automatic client registration. Sono di seguito descritte le operazioni compiute dal OP per registrare un RP dinamicamente.

    +_images/automatic_client_registration.svg +

    La registrazione di un RP dalla prospettiva di un OP che per la prima volta riceve una richiesta di autorizzazione dal RP e avvia il processo di Federation Entity Discovery e salvataggio della Trust Chain.

    +

    L'OP estrae l'identificativo univoco (client_id) dall'oggetto request contenuto all'interno della Authorization Request ed effettua una richiesta di Entity Configuration presso il RP. Ottiene l'Entity Configuration del RP e convalida la firma dei Trust Mark riconoscibili all'interno della Federazione [1].

    +

    Se il RP non espone all'interno della sua configurazione nessun Trust Mark riconoscibile per il profilo di RP (vedi Sezione Trust Mark) il Provider DEVE rifiutare l'autorizzazione con un messaggio di errore come definito nella Sezione Gestione degli errori di Federazione.

    +

    Se il Provider convalida con successo almeno un Trust Mark per il profilo RP contenuto all'interno della configurazione del RP richiedente, estrae le entità superiori contenute nel claim authority_hints ed avvia la fase di Federation Entity Discovery. Ne consegue il calcolo della Trust Chain e l'ottenimento del Metadata finale.

    +

    Durante il Federation Entity Discovery, il Provider richiede ad una o più entità superiori [2] l'Entity Statement relativo al RP e ottiene la chiave pubblica con la quale valida la configurazione del RP, fino a giungere al Trust Anchor. Infine applica la politica dei Metadata pubblicata dal Trust Anchor e salva il risultante Metadata finale del RP associandolo ad una data di scadenza, oltre la quale rinnoverà il Metadata secondo le modalità di rinnovo della Trust Chain.

    +

    Ottenuto il Metadata finale, il Provider valida la richiesta del RP secondo le modalità definite in questo documento.

    +

    Nei casi in cui un RP avesse come entità superiore un SA e non direttamente il TA, la procedura di acquisizione e validazione dell'Entity Configuration del RP avviene mediante l'Entity Statement pubblicato dal SA nei confronti del RP e mediante la convalida dell'Entity Configuration del SA con l'Entity Statement emesso dalla TA in relazione al SA. Se la soglia del massimo numero di Intermediari verticali, definita dal valore di max_path_length, viene superata, l'OP blocca il processo di Federation Entity Discovery e rigetta la richiesta del RP.

    + + +_images/trust_anchor.svg +

    Ogni partecipante espone la propria configurazione e i propri Trust Mark. Il collegamento tra una Foglia e il Trust Anchor avviene in maniera diretta oppure mediante un Intermediario (Soggetto Aggregatore) come in Figura.

    +
    +
    +

    Accesso alla Entity Configuration

    +

    In questa sezione viene descritto come individuare per un determinato soggetto l'URL RFC 3986 per il download della Entity Configuration.

    +

    La risorsa attraverso la quale un partecipante pubblica la sua configurazione (Entity Configuration) corrisponde al webpath .well-known/openid-federation e DEVE essere appesa all'URL che identifica il soggetto.

    +

    Esempi:

    +
    +
      +
    • con identificativo del soggetto pari a https://rp.example.it il risultante URL di Entity Configuration è
      +https://rp.example.it/.well-known/oidc-federation.

    • +
    • con identificativo del soggetto pari https://rp.servizi-spid.it/oidc/ il risultante URL di Entity Configuration è
      +https://rp.servizi-spid.it/oidc/.well-known/oidc-federation.

    • +
    +
    +

    Se l'URL che identifica il soggetto non presenta il simbolo di slash finale ("/"), è necessario aggiungerlo prima di concatenare il web path della risorsa .well-known.

    +

    Una volta che un RP viene riconosciuto come parte della Federazione, ottiene il permesso di effettuare una Richiesta di Autenticazione. L'OP che non ha interagito prima d'ora con un RP che fa la richiesta, è in grado di risolvere la fiducia mediante l'API di federazione (Federation Entity Discovery e produzione della Trust Chain). L'OP inizia richiedendo la Entity Configuration del RP al .well-known endpoint del RP e, seguendo il percorso dato dall'authority_hint, raggiunge la radice del Trust, cioè il TA. In ogni passo della catena l'OP può eseguire tutti i controlli di sicurezza richiedendo le dichiarazioni di entità da ciascuna entità e convalidando i Trust Mark e le firme. La figura che segue dà un esempio rappresentativo di come funziona la catena del Trust.

    +_images/cie_esempio_trust_chain.svg +

    The Federation Entity Discovery process to build a Trust Chain and obtain the final Metadata.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/it/userinfo_endpoint.html b/it/userinfo_endpoint.html new file mode 100644 index 00000000..0463e405 --- /dev/null +++ b/it/userinfo_endpoint.html @@ -0,0 +1,1518 @@ + + + + + + + + SPID/CIE OIDC - Regole Tecniche version: latest documentazione | UserInfo Endpoint + + + + + + + + + + + + + + + + + + + + + +
    + + +
    +
    +
    + +
    +
    +

    + + Docs Italia + + beta + + +

    +

    Documenti pubblici, digitali.

    +
    +
    + +
    +
    +
    +
    + +
    + + +
    + +
    +
    + +
    +
    +
    +
    + + + + + +
    +
    + + +
    +
    +
    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    +
    + +
    + + + + + +
    +

    UserInfo Endpoint

    +

    Lo UserInfo Endpoint è una risorsa protetta che restituisce gli attributi dell'utente autenticato. Per ottenere gli attributi richiesti, il RP inoltra una richiesta allo UserInfo Endpoint utilizzando l'Access Token.

    +
    +

    Request

    +
    +

    spid-icon

    +

    Lo UserInfo Endpoint DEVE supportare l'uso del solo metodo HTTP GET RFC 2616 e DEVE accettare e validare l'Access Token inviato all'interno del campo Authorization dell'Header, di tipo Bearer RFC 6750.

    +
    +
    +

    cieid-icon

    +

    Lo UserInfo Endpoint DEVE supportare l'uso dei metodi HTTP GET e POST RFC 2616 e DEVE accettare e validare l'Access Token inviato all'interno del campo Authorization dell'Header, di tipo Bearer RFC 6750.

    +
    +
    GET https://op.spid.agid.gov.it/userinfo
    +Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImRCNjdnTDdja ...
    +
    +
    + +
    +
    +

    Response

    +
    +

    spid-icon

    +

    La response dello UserInfo Endpoint DEVE specificare nel "Content-Type" il valore "application/jwt".

    +
    +

    Il contenuto del corpo della Response DEVE essere un JWT firmato e cifrato..

    +

    L'header JOSE DEVE contenere il parametro cty (Content Type) valorizzato con JWT (vedi RFC 7519#section-5.2).

    +

    Lo UserInfo Endpoint restituisce gli attributi utente esplicitamente richiesti tramite il parametro claims o tramite l'utilizzo del parametro scope nella Authentication Request.

    +

    Esempio:

    +
    HTTP/1.1 200 OK
    +Last-Modified: Wed, 22 Jul 2018 19:15:56 GMT
    +Content-Type: application/jose
    +
    +{
    +  "alg": "RSA-OAEP",
    +  "enc": "A256CBC-HS512",
    +  "kid": "HIvo33-Km7n03ZqKDJfWVnlFudsW28YhQZx5eaXtAKA",
    +  "cty": "JWT"
    +}
    +.
    +{
    +   "iss": "https://op.fornitore_identita.it",
    +   "aud": "https://rp.fornitore_servizio.it",
    +   "iat": 1519032969,
    +   "nbf": 1519032969,
    +   "exp": 1519033149,
    +   "sub": "OP-1234567890",
    +   "name": "Mario",
    +   "family_name": "Rossi",
    +   "https://attributes.spid.gov.it/fiscal_number": "MROXXXXXXXXXXXXX"
    +}
    +
    +
    +

    L'intestazione del JWE DEVE contenere i seguenti parametri:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    alg

    String. Vedi Algoritmi crittografici..

    spid-icon cieid-icon

    kid

    Vedi RFC 7638#section_3.

    spid-icon cieid-icon

    enc

    String. Vedi Algoritmi crittografici..

    spid-icon cieid-icon

    cty

    String. DEVE essere valorizzato con "JWT".

    spid-icon cieid-icon

    +

    Il payload del JWE è un JWS contenente all'interno del suo payload i seguenti parametri:

    + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    sub

    String. Identificatore del soggetto, coincidente con quello già rilasciato nell'ID Token. +Il RP DEVE verificare che il valore coincida con quello contenuto nell'ID Token.

    spid-icon cieid-icon

    iat

    UNIX Timestamp con l'istante di generazione del JWT, codificato come NumericDate come indicato in RFC 7519.

    spid-icon cieid-icon

    exp

    UNIX Timestamp con l'istante di scadenza del JWT, codificato come NumericDate come indicato in RFC 7519.

    spid-icon cieid-icon

    aud

    String. Identificatore del soggetto destinatario della response (RP). +Il RP DEVE verificare che il valore coincida con il proprio client_id.

    spid-icon cieid-icon

    iss

    String. URI che identifica univocamente l'OP.

    spid-icon cieid-icon

    <attributo>

    I claim richiesti al momento dell'autenticazione.

    spid-icon cieid-icon

    +

    L'intestazione del JWS DEVE contenere i seguenti parametri:

    + +++++ + + + + + + + + + + + + + + + + + + + + +

    Claim

    Descrizione

    Supportato da

    alg

    String. Vedi Algoritmi crittografici..

    spid-icon cieid-icon

    kid

    Vedi RFC 7638#section_3.

    spid-icon cieid-icon

    cty

    String. DEVE essere valorizzato con "JWT".

    spid-icon cieid-icon

    +
    +
    +

    Codici di errore

    +

    Come definiti per Token endpoint.

    +
    +
    + + + + + +
    + +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file