From 104a91647c3814c13cec8049970b59fe70753b6e Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Mon, 29 Apr 2024 21:18:13 +0800 Subject: [PATCH 001/187] fix: resolved cli offline mode get --- cli/packages/util/secrets.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/packages/util/secrets.go b/cli/packages/util/secrets.go index 27f0636a9..c3690b83d 100644 --- a/cli/packages/util/secrets.go +++ b/cli/packages/util/secrets.go @@ -332,7 +332,7 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectCo return nil, err } - if loggedInUserDetails.LoginExpired { + if isConnected && loggedInUserDetails.LoginExpired { PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again") } From 877b9a409e8fcd765a039d8df3690e8240e44279 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 30 Apr 2024 21:00:34 +0800 Subject: [PATCH 002/187] adjustment: modified isConnected check to query linked infisical URL --- cli/packages/util/common.go | 6 ++++-- cli/packages/util/secrets.go | 23 ++++++++++++----------- 2 files changed, 16 insertions(+), 13 deletions(-) diff --git a/cli/packages/util/common.go b/cli/packages/util/common.go index 2b57383ef..42ee74c77 100644 --- a/cli/packages/util/common.go +++ b/cli/packages/util/common.go @@ -4,6 +4,8 @@ import ( "fmt" "net/http" "os" + + "github.com/Infisical/infisical-merge/packages/config" ) func GetHomeDir() (string, error) { @@ -21,7 +23,7 @@ func WriteToFile(fileName string, dataToWrite []byte, filePerm os.FileMode) erro return nil } -func CheckIsConnectedToInternet() (ok bool) { - _, err := http.Get("http://clients3.google.com/generate_204") +func CheckIsConnectedToInfisicalAPI() (ok bool) { + _, err := http.Get(fmt.Sprintf("%v/status", config.INFISICAL_URL)) return err == nil } diff --git a/cli/packages/util/secrets.go b/cli/packages/util/secrets.go index c3690b83d..0ca66cc4f 100644 --- a/cli/packages/util/secrets.go +++ b/cli/packages/util/secrets.go @@ -307,27 +307,28 @@ func FilterSecretsByTag(plainTextSecrets []models.SingleEnvironmentVariable, tag } func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectConfigFilePath string) ([]models.SingleEnvironmentVariable, error) { - isConnected := CheckIsConnectedToInternet() var secretsToReturn []models.SingleEnvironmentVariable // var serviceTokenDetails api.GetServiceTokenDetailsResponse var errorToReturn error if params.InfisicalToken == "" && params.UniversalAuthAccessToken == "" { - if isConnected { - log.Debug().Msg("GetAllEnvironmentVariables: Connected to internet, checking logged in creds") - - if projectConfigFilePath == "" { - RequireLocalWorkspaceFile() - } else { - ValidateWorkspaceFile(projectConfigFilePath) - } - - RequireLogin() + if projectConfigFilePath == "" { + RequireLocalWorkspaceFile() + } else { + ValidateWorkspaceFile(projectConfigFilePath) } + RequireLogin() + log.Debug().Msg("GetAllEnvironmentVariables: Trying to fetch secrets using logged in details") loggedInUserDetails, err := GetCurrentLoggedInUserDetails() + isConnected := CheckIsConnectedToInfisicalAPI() + + if isConnected { + log.Debug().Msg("GetAllEnvironmentVariables: Connected to Infisical instance, checking logged in creds") + } + if err != nil { return nil, err } From 772dd464f564f00eda605d765e81e4d082dc33cc Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 30 Apr 2024 21:11:29 +0800 Subject: [PATCH 003/187] test: added integration test for secrets get all and secrets get all without connection --- .../test-TestUserAuth_SecretsGetAll | 7 +++ ...estUserAuth_SecretsGetAllWithoutConnection | 8 ++++ cli/test/secrets_test.go | 44 +++++++++++++++++++ 3 files changed, 59 insertions(+) create mode 100644 cli/test/.snapshots/test-TestUserAuth_SecretsGetAll create mode 100644 cli/test/.snapshots/test-TestUserAuth_SecretsGetAllWithoutConnection diff --git a/cli/test/.snapshots/test-TestUserAuth_SecretsGetAll b/cli/test/.snapshots/test-TestUserAuth_SecretsGetAll new file mode 100644 index 000000000..260607e97 --- /dev/null +++ b/cli/test/.snapshots/test-TestUserAuth_SecretsGetAll @@ -0,0 +1,7 @@ +┌───────────────┬──────────────┬─────────────┐ +│ SECRET NAME │ SECRET VALUE │ SECRET TYPE │ +├───────────────┼──────────────┼─────────────┤ +│ TEST-SECRET-1 │ test-value-1 │ shared │ +│ TEST-SECRET-2 │ test-value-2 │ shared │ +│ TEST-SECRET-3 │ test-value-3 │ shared │ +└───────────────┴──────────────┴─────────────┘ diff --git a/cli/test/.snapshots/test-TestUserAuth_SecretsGetAllWithoutConnection b/cli/test/.snapshots/test-TestUserAuth_SecretsGetAllWithoutConnection new file mode 100644 index 000000000..c48627f73 --- /dev/null +++ b/cli/test/.snapshots/test-TestUserAuth_SecretsGetAllWithoutConnection @@ -0,0 +1,8 @@ +Warning: Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug +┌───────────────┬──────────────┬─────────────┐ +│ SECRET NAME │ SECRET VALUE │ SECRET TYPE │ +├───────────────┼──────────────┼─────────────┤ +│ TEST-SECRET-1 │ test-value-1 │ shared │ +│ TEST-SECRET-2 │ test-value-2 │ shared │ +│ TEST-SECRET-3 │ test-value-3 │ shared │ +└───────────────┴──────────────┴─────────────┘ diff --git a/cli/test/secrets_test.go b/cli/test/secrets_test.go index 453666406..b9c8fa85d 100644 --- a/cli/test/secrets_test.go +++ b/cli/test/secrets_test.go @@ -3,9 +3,11 @@ package tests import ( "testing" + "github.com/Infisical/infisical-merge/packages/util" "github.com/bradleyjkemp/cupaloy/v2" ) + func TestServiceToken_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) { SetupCli(t) @@ -85,3 +87,45 @@ func TestUniversalAuth_SecretsGetWrongEnvironment(t *testing.T) { } } + +func TestUserAuth_SecretsGetAll(t *testing.T) { + SetupCli(t) + output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent") + if err != nil { + t.Fatalf("error running CLI command: %v", err) + } + + // Use cupaloy to snapshot test the output + err = cupaloy.Snapshot(output) + if err != nil { + t.Fatalf("snapshot failed: %v", err) + } +} + +func TestUserAuth_SecretsGetAllWithoutConnection(t *testing.T) { + SetupCli(t) + + originalConfigFile, err := util.GetConfigFile() + if err != nil { + t.Fatalf("error getting config file") + } + newConfigFile := originalConfigFile + + // set it to a URL that will always be unreachable + newConfigFile.LoggedInUserDomain = "http://localhost:4999" + util.WriteConfigFile(&newConfigFile) + + // restore config file + defer util.WriteConfigFile(&originalConfigFile) + + output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent") + if err != nil { + t.Fatalf("error running CLI command: %v", err) + } + + // Use cupaloy to snapshot test the output + err = cupaloy.Snapshot(output) + if err != nil { + t.Fatalf("snapshot failed: %v", err) + } +} \ No newline at end of file From 531fa634a26a47d3e19dcb39a0975dc8d7bda168 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 30 Apr 2024 22:02:22 +0800 Subject: [PATCH 004/187] feature: add logs for cli execution error --- cli/test/helper.go | 1 + 1 file changed, 1 insertion(+) diff --git a/cli/test/helper.go b/cli/test/helper.go index 995367c4b..470473368 100644 --- a/cli/test/helper.go +++ b/cli/test/helper.go @@ -38,6 +38,7 @@ func ExecuteCliCommand(command string, args ...string) (string, error) { cmd := exec.Command(command, args...) output, err := cmd.CombinedOutput() if err != nil { + fmt.Println(fmt.Sprint(err) + ": " + string(output)) return strings.TrimSpace(string(output)), err } return strings.TrimSpace(string(output)), nil From 85f024c814cca3ef2939215cb6e3aa74cfb5a581 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 01:45:24 +0800 Subject: [PATCH 005/187] test: added scripting for user login --- cli/go.mod | 1 + cli/go.sum | 2 + ...stUserAuth_SecretsGetAllWithoutConnection} | 0 cli/test/helper.go | 4 + cli/test/login_test.go | 78 +++++++++++++++++++ cli/test/secrets_test.go | 9 ++- 6 files changed, 91 insertions(+), 3 deletions(-) rename cli/test/.snapshots/{test-TestUserAuth_SecretsGetAllWithoutConnection => test-testUserAuth_SecretsGetAllWithoutConnection} (100%) diff --git a/cli/go.mod b/cli/go.mod index 833745eff..52c737533 100644 --- a/cli/go.mod +++ b/cli/go.mod @@ -31,6 +31,7 @@ require ( github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect github.com/bradleyjkemp/cupaloy/v2 v2.8.0 // indirect github.com/chzyer/readline v1.5.1 // indirect + github.com/creack/pty v1.1.21 // indirect github.com/danieljoos/wincred v1.2.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/dvsekhvalnov/jose2go v1.5.0 // indirect diff --git a/cli/go.sum b/cli/go.sum index 353579136..ff3030a9c 100644 --- a/cli/go.sum +++ b/cli/go.sum @@ -74,6 +74,8 @@ github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= +github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0= +github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= github.com/danieljoos/wincred v1.2.0 h1:ozqKHaLK0W/ii4KVbbvluM91W2H3Sh0BncbUNPS7jLE= github.com/danieljoos/wincred v1.2.0/go.mod h1:FzQLLMKBFdvu+osBrnFODiv32YGwCfx0SkRa/eYHgec= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= diff --git a/cli/test/.snapshots/test-TestUserAuth_SecretsGetAllWithoutConnection b/cli/test/.snapshots/test-testUserAuth_SecretsGetAllWithoutConnection similarity index 100% rename from cli/test/.snapshots/test-TestUserAuth_SecretsGetAllWithoutConnection rename to cli/test/.snapshots/test-testUserAuth_SecretsGetAllWithoutConnection diff --git a/cli/test/helper.go b/cli/test/helper.go index 470473368..b773d138e 100644 --- a/cli/test/helper.go +++ b/cli/test/helper.go @@ -23,6 +23,8 @@ type Credentials struct { ServiceToken string ProjectID string EnvSlug string + UserEmail string + UserPassword string } var creds = Credentials{ @@ -32,6 +34,8 @@ var creds = Credentials{ ServiceToken: os.Getenv("CLI_TESTS_SERVICE_TOKEN"), ProjectID: os.Getenv("CLI_TESTS_PROJECT_ID"), EnvSlug: os.Getenv("CLI_TESTS_ENV_SLUG"), + UserEmail: os.Getenv("CLI_TESTS_USER_EMAIL"), + UserPassword: os.Getenv("CLI_TESTS_USER_PASSWORD"), } func ExecuteCliCommand(command string, args ...string) (string, error) { diff --git a/cli/test/login_test.go b/cli/test/login_test.go index 0f4591413..6857c00fb 100644 --- a/cli/test/login_test.go +++ b/cli/test/login_test.go @@ -1,11 +1,89 @@ package tests import ( + "fmt" + "os/exec" + "strings" "testing" + "github.com/creack/pty" "github.com/stretchr/testify/assert" ) +func UserLoginCmd(t *testing.T) { + SetupCli(t) + + // set vault to file because CI has no keyring + vaultCmd := exec.Command(FORMATTED_CLI_NAME, "vault", "set", "file") + _, err := vaultCmd.Output() + if err != nil { + t.Fatalf("error setting vault: %v", err) + } + + // Start programmatic interaction with CLI + c := exec.Command(FORMATTED_CLI_NAME, "login", "--interactive") + ptmx, err := pty.Start(c) + if err != nil { + t.Fatalf("error running CLI command: %v", err) + } + defer func() { _ = ptmx.Close() }() + + stepChan := make(chan int, 10) + + go func() { + buf := make([]byte, 1024) + step := -1 + for { + n, err := ptmx.Read(buf) + if n > 0 { + terminalOut := string(buf) + if strings.Contains(terminalOut, "Add a new account") && step < 0 { + step += 1 + stepChan <- step + } else if strings.Contains(terminalOut, "Infisical Cloud") && step < 1 { + step += 1; + stepChan <- step + } else if strings.Contains(terminalOut, "Email") && step < 2 { + step += 1; + stepChan <- step + } else if strings.Contains(terminalOut, "Password") && step < 3 { + step += 1; + stepChan <- step + } else if strings.Contains(terminalOut, "Infisical organization") && step < 4 { + step += 1; + stepChan <- step + } else if strings.Contains(terminalOut, "Enter passphrase") && step < 5 { + step += 1; + stepChan <- step + } + } + if err != nil { + close(stepChan) + return + } + fmt.Print(string(buf[:n])) + } + }() + + for i := range stepChan { + switch i { + case 0: + ptmx.Write([]byte("\n")) + case 1: + ptmx.Write([]byte("\n")) + case 2: + ptmx.Write([]byte(creds.UserEmail)) + ptmx.Write([]byte("\n")) + case 3: + ptmx.Write([]byte(creds.UserPassword)) + ptmx.Write([]byte("\n")) + case 4: + ptmx.Write([]byte("\n")) + } + } + +} + func MachineIdentityLoginCmd(t *testing.T) { SetupCli(t) diff --git a/cli/test/secrets_test.go b/cli/test/secrets_test.go index b9c8fa85d..294434f5f 100644 --- a/cli/test/secrets_test.go +++ b/cli/test/secrets_test.go @@ -90,6 +90,8 @@ func TestUniversalAuth_SecretsGetWrongEnvironment(t *testing.T) { func TestUserAuth_SecretsGetAll(t *testing.T) { SetupCli(t) + UserLoginCmd(t); + output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent") if err != nil { t.Fatalf("error running CLI command: %v", err) @@ -100,11 +102,12 @@ func TestUserAuth_SecretsGetAll(t *testing.T) { if err != nil { t.Fatalf("snapshot failed: %v", err) } + + // intentionally invoked this here because it should directly follow secretsGetAll + testUserAuth_SecretsGetAllWithoutConnection(t) } -func TestUserAuth_SecretsGetAllWithoutConnection(t *testing.T) { - SetupCli(t) - +func testUserAuth_SecretsGetAllWithoutConnection(t *testing.T) { originalConfigFile, err := util.GetConfigFile() if err != nil { t.Fatalf("error getting config file") From 6640b55504abab40fecec9a3d3c1847508636a79 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 01:49:06 +0800 Subject: [PATCH 006/187] misc: added envs required for cli test of infisical login --- .github/workflows/run-cli-tests.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/run-cli-tests.yml b/.github/workflows/run-cli-tests.yml index e814f9143..f55581a0f 100644 --- a/.github/workflows/run-cli-tests.yml +++ b/.github/workflows/run-cli-tests.yml @@ -20,7 +20,12 @@ on: required: true CLI_TESTS_ENV_SLUG: required: true - + CLI_TESTS_USER_EMAIL: + required: true + CLI_TESTS_USER_PASSWORD: + required: true + INFISICAL_VAULT_FILE_PASSPHRASE: + required: true jobs: test: defaults: @@ -43,5 +48,8 @@ jobs: CLI_TESTS_SERVICE_TOKEN: ${{ secrets.CLI_TESTS_SERVICE_TOKEN }} CLI_TESTS_PROJECT_ID: ${{ secrets.CLI_TESTS_PROJECT_ID }} CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }} + CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }} + CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }} + INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.INFISICAL_VAULT_FILE_PASSPHRASE }} run: go test -v -count=1 ./test From 4479e626c7f4f5c52c8c51c5835c8be5450676ff Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 01:56:10 +0800 Subject: [PATCH 007/187] adjustment: renamed cli vault file phrase env --- .github/workflows/run-cli-tests.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/run-cli-tests.yml b/.github/workflows/run-cli-tests.yml index f55581a0f..f8e9d7797 100644 --- a/.github/workflows/run-cli-tests.yml +++ b/.github/workflows/run-cli-tests.yml @@ -24,7 +24,7 @@ on: required: true CLI_TESTS_USER_PASSWORD: required: true - INFISICAL_VAULT_FILE_PASSPHRASE: + CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE: required: true jobs: test: @@ -50,6 +50,6 @@ jobs: CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }} CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }} CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }} - INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.INFISICAL_VAULT_FILE_PASSPHRASE }} + INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }} run: go test -v -count=1 ./test From 3897bd70fa107824f5c471d33a136f4747cb0159 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 11:08:58 +0800 Subject: [PATCH 008/187] adjustment: removed cli display for pty --- cli/test/login_test.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/cli/test/login_test.go b/cli/test/login_test.go index 6857c00fb..d376d05db 100644 --- a/cli/test/login_test.go +++ b/cli/test/login_test.go @@ -1,7 +1,6 @@ package tests import ( - "fmt" "os/exec" "strings" "testing" @@ -61,7 +60,6 @@ func UserLoginCmd(t *testing.T) { close(stepChan) return } - fmt.Print(string(buf[:n])) } }() From 505ccdf8eaa1e3d50a4898825ee1879d5597b66c Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 21:37:18 +0800 Subject: [PATCH 009/187] misc: added script for cli-tests env setup --- cli/.gitignore | 1 + cli/scripts/export_test_env.sh | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 cli/scripts/export_test_env.sh diff --git a/cli/.gitignore b/cli/.gitignore index 5fa3e39c5..8eb54d72b 100644 --- a/cli/.gitignore +++ b/cli/.gitignore @@ -1,3 +1,4 @@ .infisical.json dist/ agent-config.test.yaml +.test.env \ No newline at end of file diff --git a/cli/scripts/export_test_env.sh b/cli/scripts/export_test_env.sh new file mode 100644 index 000000000..08b5ad41b --- /dev/null +++ b/cli/scripts/export_test_env.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +TEST_ENV_FILE=".test.env" + +# Check if the .env file exists +if [ ! -f "$TEST_ENV_FILE" ]; then + echo "$TEST_ENV_FILE does not exist." + exit 1 +fi + +# Export the variables +while IFS='=' read -r key value +do + # Skip empty lines and lines starting with # + if [[ -z "$key" || "$key" =~ ^\# ]]; then + continue + fi + # Use eval to correctly handle values with spaces + eval export $key='$value' +done < "$TEST_ENV_FILE" + +echo "Test environment variables set." From a5ca96f2df59e2f2247bb32cfed24b2858931398 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 21:39:20 +0800 Subject: [PATCH 010/187] test: restructed setup and added scripting for infisical init --- cli/go.mod | 4 +-- cli/test/export_test.go | 7 ----- cli/test/helper.go | 6 ++-- cli/test/login_test.go | 53 ++++++++++++++++++++++++++++---- cli/test/main_test.go | 23 ++++++++++++++ cli/test/run_test.go | 12 -------- cli/test/secrets_by_name_test.go | 12 -------- cli/test/secrets_test.go | 10 ------ 8 files changed, 75 insertions(+), 52 deletions(-) create mode 100644 cli/test/main_test.go diff --git a/cli/go.mod b/cli/go.mod index 52c737533..6a1da8c6d 100644 --- a/cli/go.mod +++ b/cli/go.mod @@ -3,7 +3,9 @@ module github.com/Infisical/infisical-merge go 1.21 require ( + github.com/bradleyjkemp/cupaloy/v2 v2.8.0 github.com/charmbracelet/lipgloss v0.5.0 + github.com/creack/pty v1.1.21 github.com/denisbrodbeck/machineid v1.0.1 github.com/fatih/semgroup v1.2.0 github.com/gitleaks/go-gitdiff v0.8.0 @@ -29,9 +31,7 @@ require ( require ( github.com/alessio/shellescape v1.4.1 // indirect github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect - github.com/bradleyjkemp/cupaloy/v2 v2.8.0 // indirect github.com/chzyer/readline v1.5.1 // indirect - github.com/creack/pty v1.1.21 // indirect github.com/danieljoos/wincred v1.2.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/dvsekhvalnov/jose2go v1.5.0 // indirect diff --git a/cli/test/export_test.go b/cli/test/export_test.go index 9a936871d..c44bf20af 100644 --- a/cli/test/export_test.go +++ b/cli/test/export_test.go @@ -8,7 +8,6 @@ import ( func TestUniversalAuth_ExportSecretsWithImports(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "export", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent") @@ -24,8 +23,6 @@ func TestUniversalAuth_ExportSecretsWithImports(t *testing.T) { } func TestServiceToken_ExportSecretsWithImports(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "export", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent") if err != nil { @@ -41,8 +38,6 @@ func TestServiceToken_ExportSecretsWithImports(t *testing.T) { func TestUniversalAuth_ExportSecretsWithoutImports(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "export", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent", "--include-imports=false") if err != nil { @@ -57,8 +52,6 @@ func TestUniversalAuth_ExportSecretsWithoutImports(t *testing.T) { } func TestServiceToken_ExportSecretsWithoutImports(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "export", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent", "--include-imports=false") if err != nil { diff --git a/cli/test/helper.go b/cli/test/helper.go index b773d138e..819f4c4c9 100644 --- a/cli/test/helper.go +++ b/cli/test/helper.go @@ -2,10 +2,10 @@ package tests import ( "fmt" + "log" "os" "os/exec" "strings" - "testing" ) const ( @@ -48,7 +48,7 @@ func ExecuteCliCommand(command string, args ...string) (string, error) { return strings.TrimSpace(string(output)), nil } -func SetupCli(t *testing.T) { +func SetupCli() { if creds.ClientID == "" || creds.ClientSecret == "" || creds.ServiceToken == "" || creds.ProjectID == "" || creds.EnvSlug == "" { panic("Missing required environment variables") @@ -62,7 +62,7 @@ func SetupCli(t *testing.T) { if !alreadyBuilt { if err := exec.Command("go", "build", "../.").Run(); err != nil { - t.Fatal(err) + log.Fatal(err) } } diff --git a/cli/test/login_test.go b/cli/test/login_test.go index d376d05db..2bc356855 100644 --- a/cli/test/login_test.go +++ b/cli/test/login_test.go @@ -1,6 +1,8 @@ package tests import ( + "fmt" + "log" "os/exec" "strings" "testing" @@ -9,21 +11,62 @@ import ( "github.com/stretchr/testify/assert" ) -func UserLoginCmd(t *testing.T) { - SetupCli(t) +func UserInitCmd() { + c := exec.Command(FORMATTED_CLI_NAME, "init") + ptmx, err := pty.Start(c) + if err != nil { + log.Fatalf("error running CLI command: %v", err) + } + defer func() { _ = ptmx.Close() }() + stepChan := make(chan int, 10) + + go func() { + buf := make([]byte, 1024) + step := -1 + for { + n, err := ptmx.Read(buf) + if n > 0 { + terminalOut := string(buf) + fmt.Println("Terminal out is", terminalOut) + if strings.Contains(terminalOut, "Which Infisical organization would you like to select a project from?") && step < 0 { + step += 1 + stepChan <- step + } else if strings.Contains(terminalOut, "Which of your Infisical projects would you like to connect this project to?") && step < 1 { + step += 1; + stepChan <- step + } + } + if err != nil { + close(stepChan) + return + } + } + }() + + for i := range stepChan { + switch i { + case 0: + ptmx.Write([]byte("\n")) + case 1: + ptmx.Write([]byte("\n")) + } + } +} + +func UserLoginCmd() { // set vault to file because CI has no keyring vaultCmd := exec.Command(FORMATTED_CLI_NAME, "vault", "set", "file") _, err := vaultCmd.Output() if err != nil { - t.Fatalf("error setting vault: %v", err) + log.Fatalf("error setting vault: %v", err) } // Start programmatic interaction with CLI c := exec.Command(FORMATTED_CLI_NAME, "login", "--interactive") ptmx, err := pty.Start(c) if err != nil { - t.Fatalf("error running CLI command: %v", err) + log.Fatalf("error running CLI command: %v", err) } defer func() { _ = ptmx.Close() }() @@ -83,8 +126,6 @@ func UserLoginCmd(t *testing.T) { } func MachineIdentityLoginCmd(t *testing.T) { - SetupCli(t) - if creds.UAAccessToken != "" { return } diff --git a/cli/test/main_test.go b/cli/test/main_test.go new file mode 100644 index 000000000..e14893aec --- /dev/null +++ b/cli/test/main_test.go @@ -0,0 +1,23 @@ +package tests + +import ( + "fmt" + "os" + "testing" +) + +func TestMain(m *testing.M) { + // Setup + fmt.Println("Setting up CLI...") + SetupCli() + fmt.Println("Performing user login...") + UserLoginCmd() + fmt.Println("Performing infisical init...") + UserInitCmd() + + // Run the tests + code := m.Run() + + // Exit + os.Exit(code) +} diff --git a/cli/test/run_test.go b/cli/test/run_test.go index 808f4f14f..d2c6021cc 100644 --- a/cli/test/run_test.go +++ b/cli/test/run_test.go @@ -8,8 +8,6 @@ import ( ) func TestServiceToken_RunCmdRecursiveAndImports(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "run", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent", "--", "echo", "hello world") if err != nil { @@ -25,8 +23,6 @@ func TestServiceToken_RunCmdRecursiveAndImports(t *testing.T) { } } func TestServiceToken_RunCmdWithImports(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "run", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent", "--", "echo", "hello world") if err != nil { @@ -44,8 +40,6 @@ func TestServiceToken_RunCmdWithImports(t *testing.T) { func TestUniversalAuth_RunCmdRecursiveAndImports(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "run", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent", "--", "echo", "hello world") if err != nil { @@ -63,8 +57,6 @@ func TestUniversalAuth_RunCmdRecursiveAndImports(t *testing.T) { func TestUniversalAuth_RunCmdWithImports(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "run", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent", "--", "echo", "hello world") if err != nil { @@ -83,8 +75,6 @@ func TestUniversalAuth_RunCmdWithImports(t *testing.T) { func TestUniversalAuth_RunCmdWithoutImports(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "run", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent", "--include-imports=false", "--", "echo", "hello world") if err != nil { @@ -101,8 +91,6 @@ func TestUniversalAuth_RunCmdWithoutImports(t *testing.T) { } func TestServiceToken_RunCmdWithoutImports(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "run", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--silent", "--include-imports=false", "--", "echo", "hello world") if err != nil { diff --git a/cli/test/secrets_by_name_test.go b/cli/test/secrets_by_name_test.go index 440324e1a..26a8314bb 100644 --- a/cli/test/secrets_by_name_test.go +++ b/cli/test/secrets_by_name_test.go @@ -7,8 +7,6 @@ import ( ) func TestServiceToken_GetSecretsByNameRecursive(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "get", "TEST-SECRET-1", "TEST-SECRET-2", "FOLDER-SECRET-1", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { @@ -23,8 +21,6 @@ func TestServiceToken_GetSecretsByNameRecursive(t *testing.T) { } func TestServiceToken_GetSecretsByNameWithNotFoundSecret(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "get", "TEST-SECRET-1", "TEST-SECRET-2", "FOLDER-SECRET-1", "DOES-NOT-EXIST", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { @@ -39,8 +35,6 @@ func TestServiceToken_GetSecretsByNameWithNotFoundSecret(t *testing.T) { } func TestServiceToken_GetSecretsByNameWithImports(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "get", "TEST-SECRET-1", "STAGING-SECRET-2", "FOLDER-SECRET-1", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { @@ -56,8 +50,6 @@ func TestServiceToken_GetSecretsByNameWithImports(t *testing.T) { func TestUniversalAuth_GetSecretsByNameRecursive(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "get", "TEST-SECRET-1", "TEST-SECRET-2", "FOLDER-SECRET-1", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { @@ -73,8 +65,6 @@ func TestUniversalAuth_GetSecretsByNameRecursive(t *testing.T) { func TestUniversalAuth_GetSecretsByNameWithNotFoundSecret(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "get", "TEST-SECRET-1", "TEST-SECRET-2", "FOLDER-SECRET-1", "DOES-NOT-EXIST", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { @@ -90,8 +80,6 @@ func TestUniversalAuth_GetSecretsByNameWithNotFoundSecret(t *testing.T) { func TestUniversalAuth_GetSecretsByNameWithImports(t *testing.T) { MachineIdentityLoginCmd(t) - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "get", "TEST-SECRET-1", "STAGING-SECRET-2", "FOLDER-SECRET-1", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { diff --git a/cli/test/secrets_test.go b/cli/test/secrets_test.go index 294434f5f..7af64eab8 100644 --- a/cli/test/secrets_test.go +++ b/cli/test/secrets_test.go @@ -9,8 +9,6 @@ import ( func TestServiceToken_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") if err != nil { @@ -25,8 +23,6 @@ func TestServiceToken_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) { } func TestServiceToken_SecretsGetWithoutImportsAndWithoutRecursiveCmd(t *testing.T) { - SetupCli(t) - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.ServiceToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent") if err != nil { @@ -41,7 +37,6 @@ func TestServiceToken_SecretsGetWithoutImportsAndWithoutRecursiveCmd(t *testing. } func TestUniversalAuth_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) { - SetupCli(t) MachineIdentityLoginCmd(t) output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--recursive", "--silent") @@ -58,7 +53,6 @@ func TestUniversalAuth_SecretsGetWithImportsAndRecursiveCmd(t *testing.T) { } func TestUniversalAuth_SecretsGetWithoutImportsAndWithoutRecursiveCmd(t *testing.T) { - SetupCli(t) MachineIdentityLoginCmd(t) output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent") @@ -75,7 +69,6 @@ func TestUniversalAuth_SecretsGetWithoutImportsAndWithoutRecursiveCmd(t *testing } func TestUniversalAuth_SecretsGetWrongEnvironment(t *testing.T) { - SetupCli(t) MachineIdentityLoginCmd(t) output, _ := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--token", creds.UAAccessToken, "--projectId", creds.ProjectID, "--env", "invalid-env", "--recursive", "--silent") @@ -89,9 +82,6 @@ func TestUniversalAuth_SecretsGetWrongEnvironment(t *testing.T) { } func TestUserAuth_SecretsGetAll(t *testing.T) { - SetupCli(t) - UserLoginCmd(t); - output, err := ExecuteCliCommand(FORMATTED_CLI_NAME, "secrets", "--projectId", creds.ProjectID, "--env", creds.EnvSlug, "--include-imports=false", "--silent") if err != nil { t.Fatalf("error running CLI command: %v", err) From 24f7ecc548e5d8336324acf296f3653c99532d59 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 1 May 2024 21:41:07 +0800 Subject: [PATCH 011/187] misc: removed infisical init logs --- cli/test/login_test.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/cli/test/login_test.go b/cli/test/login_test.go index 2bc356855..1ee9d50a4 100644 --- a/cli/test/login_test.go +++ b/cli/test/login_test.go @@ -1,7 +1,6 @@ package tests import ( - "fmt" "log" "os/exec" "strings" @@ -28,7 +27,6 @@ func UserInitCmd() { n, err := ptmx.Read(buf) if n > 0 { terminalOut := string(buf) - fmt.Println("Terminal out is", terminalOut) if strings.Contains(terminalOut, "Which Infisical organization would you like to select a project from?") && step < 0 { step += 1 stepChan <- step From 8fc4fd64f84d4ff780f0bde1a755313d356e795a Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 2 May 2024 00:49:29 +0800 Subject: [PATCH 012/187] adjustment: moved backup logic to cmd layer --- cli/packages/cmd/run.go | 91 +++++++++++++++++++++++++++--------- cli/packages/util/secrets.go | 25 +--------- 2 files changed, 71 insertions(+), 45 deletions(-) diff --git a/cli/packages/cmd/run.go b/cli/packages/cmd/run.go index 04fe2588b..58088f5d3 100644 --- a/cli/packages/cmd/run.go +++ b/cli/packages/cmd/run.go @@ -116,35 +116,82 @@ var runCmd = &cobra.Command{ Recursive: recursive, } + var secrets []models.SingleEnvironmentVariable + var isUserSession bool + var infisicalDotJson models.WorkspaceConfigFile + var userBackupSecretsEncryptionKey []byte + if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { request.InfisicalToken = token.Token } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { request.UniversalAuthAccessToken = token.Token - } - - secrets, err := util.GetAllEnvironmentVariables(request, projectConfigDir) - - if err != nil { - util.HandleError(err, "Could not fetch secrets", "If you are using a service token to fetch secrets, please ensure it is valid") - } - - if secretOverriding { - secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_PERSONAL) } else { - secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_SHARED) - } - - if shouldExpandSecrets { - - authParams := models.ExpandSecretsAuthentication{} - - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { - authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { - authParams.UniversalAuthAccessToken = token.Token + // user session + isUserSession = true + loggedInUserDetails, err := util.GetCurrentLoggedInUserDetails() + if err != nil { + util.HandleError(err) } - secrets = util.ExpandSecrets(secrets, authParams, projectConfigDir) + isConnected := util.CheckIsConnectedToInfisicalAPI() + + if projectConfigDir == "" { + projectConfig, err := util.GetWorkSpaceFromFile() + if err != nil { + util.HandleError(err) + } + + infisicalDotJson = projectConfig + } else { + projectConfig, err := util.GetWorkSpaceFromFilePath(projectConfigDir) + if err != nil { + util.HandleError(err) + } + + infisicalDotJson = projectConfig + } + + userBackupSecretsEncryptionKey = []byte(loggedInUserDetails.UserCredentials.PrivateKey)[0:32] + + if !isConnected { + secrets, err = util.ReadBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) + if err != nil { + util.HandleError(err) + } + if len(secrets) > 0 { + util.PrintWarning("Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug") + } + } + } + + if len(secrets) == 0 { + secrets, err = util.GetAllEnvironmentVariables(request, projectConfigDir) + if err != nil { + util.HandleError(err, "Could not fetch secrets", "If you are using a service token to fetch secrets, please ensure it is valid") + } + + if secretOverriding { + secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_PERSONAL) + } else { + secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_SHARED) + } + + if shouldExpandSecrets { + + authParams := models.ExpandSecretsAuthentication{} + + if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + authParams.InfisicalToken = token.Token + } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + authParams.UniversalAuthAccessToken = token.Token + } + + secrets = util.ExpandSecrets(secrets, authParams, projectConfigDir) + } + + if isUserSession { + util.WriteBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey, secrets) + } } secretsByKey := getSecretsByKeys(secrets) diff --git a/cli/packages/util/secrets.go b/cli/packages/util/secrets.go index 0ca66cc4f..2e9b0ffd2 100644 --- a/cli/packages/util/secrets.go +++ b/cli/packages/util/secrets.go @@ -319,21 +319,16 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectCo } RequireLogin() - log.Debug().Msg("GetAllEnvironmentVariables: Trying to fetch secrets using logged in details") loggedInUserDetails, err := GetCurrentLoggedInUserDetails() - isConnected := CheckIsConnectedToInfisicalAPI() - - if isConnected { - log.Debug().Msg("GetAllEnvironmentVariables: Connected to Infisical instance, checking logged in creds") - } + log.Debug().Msg("GetAllEnvironmentVariables: Connected to Infisical instance, checking logged in creds") if err != nil { return nil, err } - if isConnected && loggedInUserDetails.LoginExpired { + if loggedInUserDetails.LoginExpired { PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again") } @@ -362,22 +357,6 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectCo secretsToReturn, errorToReturn = GetPlainTextSecretsViaJTW(loggedInUserDetails.UserCredentials.JTWToken, loggedInUserDetails.UserCredentials.PrivateKey, infisicalDotJson.WorkspaceId, params.Environment, params.TagSlugs, params.SecretsPath, params.IncludeImport, params.Recursive) log.Debug().Msgf("GetAllEnvironmentVariables: Trying to fetch secrets JTW token [err=%s]", errorToReturn) - - backupSecretsEncryptionKey := []byte(loggedInUserDetails.UserCredentials.PrivateKey)[0:32] - if errorToReturn == nil { - WriteBackupSecrets(infisicalDotJson.WorkspaceId, params.Environment, backupSecretsEncryptionKey, secretsToReturn) - } - - // only attempt to serve cached secrets if no internet connection and if at least one secret cached - if !isConnected { - backedSecrets, err := ReadBackupSecrets(infisicalDotJson.WorkspaceId, params.Environment, backupSecretsEncryptionKey) - if len(backedSecrets) > 0 { - PrintWarning("Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug") - secretsToReturn = backedSecrets - errorToReturn = err - } - } - } else { if params.InfisicalToken != "" { log.Debug().Msg("Trying to fetch secrets using service token") From 920b9a7dfae115431ed8dc5a5f00f320a8d28585 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 2 May 2024 00:59:17 +0800 Subject: [PATCH 013/187] adjustment: moved secret backup logic to cmd layer --- cli/packages/cmd/secrets.go | 79 +++++++++++++++++++++++++++---------- 1 file changed, 58 insertions(+), 21 deletions(-) diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go index 305a1f0fd..0a800580f 100644 --- a/cli/packages/cmd/secrets.go +++ b/cli/packages/cmd/secrets.go @@ -88,37 +88,74 @@ var secretsCmd = &cobra.Command{ Recursive: recursive, } + var secrets []models.SingleEnvironmentVariable + var isUserSession bool + var infisicalDotJson models.WorkspaceConfigFile + var userBackupSecretsEncryptionKey []byte + if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { request.InfisicalToken = token.Token } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { request.UniversalAuthAccessToken = token.Token - } - - secrets, err := util.GetAllEnvironmentVariables(request, "") - if err != nil { - util.HandleError(err) - } - - if secretOverriding { - secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_PERSONAL) } else { - secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_SHARED) - } + // user session + isUserSession = true + loggedInUserDetails, err := util.GetCurrentLoggedInUserDetails() + if err != nil { + util.HandleError(err) + } + + isConnected := util.CheckIsConnectedToInfisicalAPI() - if shouldExpandSecrets { - - authParams := models.ExpandSecretsAuthentication{} - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { - authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { - authParams.UniversalAuthAccessToken = token.Token + projectConfig, err := util.GetWorkSpaceFromFile() + if err != nil { + util.HandleError(err) } - secrets = util.ExpandSecrets(secrets, authParams, "") + infisicalDotJson = projectConfig + userBackupSecretsEncryptionKey = []byte(loggedInUserDetails.UserCredentials.PrivateKey)[0:32] + + if !isConnected { + secrets, err = util.ReadBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) + if err != nil { + util.HandleError(err) + } + if len(secrets) > 0 { + util.PrintWarning("Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug") + } + } } - // Sort the secrets by key so we can create a consistent output - secrets = util.SortSecretsByKeys(secrets) + if len(secrets) == 0 { + secrets, err = util.GetAllEnvironmentVariables(request, "") + if err != nil { + util.HandleError(err) + } + + if secretOverriding { + secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_PERSONAL) + } else { + secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_SHARED) + } + + if shouldExpandSecrets { + + authParams := models.ExpandSecretsAuthentication{} + if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + authParams.InfisicalToken = token.Token + } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + authParams.UniversalAuthAccessToken = token.Token + } + + secrets = util.ExpandSecrets(secrets, authParams, "") + } + + // Sort the secrets by key so we can create a consistent output + secrets = util.SortSecretsByKeys(secrets) + if isUserSession { + util.WriteBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey, secrets) + } + } visualize.PrintAllSecretDetails(secrets) Telemetry.CaptureEvent("cli-command:secrets", posthog.NewProperties().Set("secretCount", len(secrets)).Set("version", util.CLI_VERSION)) From 04dca9432ddaabc8f3d2d762fd765d6a39c55e30 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 2 May 2024 01:09:12 +0800 Subject: [PATCH 014/187] misc: updated test comment --- cli/test/secrets_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/test/secrets_test.go b/cli/test/secrets_test.go index 7af64eab8..f5d5a7b1f 100644 --- a/cli/test/secrets_test.go +++ b/cli/test/secrets_test.go @@ -93,7 +93,7 @@ func TestUserAuth_SecretsGetAll(t *testing.T) { t.Fatalf("snapshot failed: %v", err) } - // intentionally invoked this here because it should directly follow secretsGetAll + // explicitly called here because it should happen directly after successful secretsGetAll testUserAuth_SecretsGetAllWithoutConnection(t) } From a1e8f45a8692587a0a80571af883690a60f628b0 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 2 May 2024 01:35:19 +0800 Subject: [PATCH 015/187] misc: added new cli secrets to release build gh action --- .github/workflows/release_build_infisical_cli.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release_build_infisical_cli.yml b/.github/workflows/release_build_infisical_cli.yml index e4a5945e0..af8e28f4d 100644 --- a/.github/workflows/release_build_infisical_cli.yml +++ b/.github/workflows/release_build_infisical_cli.yml @@ -22,6 +22,9 @@ jobs: CLI_TESTS_SERVICE_TOKEN: ${{ secrets.CLI_TESTS_SERVICE_TOKEN }} CLI_TESTS_PROJECT_ID: ${{ secrets.CLI_TESTS_PROJECT_ID }} CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }} + CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }} + CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }} + INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }} goreleaser: runs-on: ubuntu-20.04 From 88a4fb84e66c5a68d7e6c9819f59c48713a060a5 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 2 May 2024 03:21:20 +0800 Subject: [PATCH 016/187] feature: added offline support for infisical export --- cli/packages/cmd/export.go | 83 +++++++++++++++++++++++------------- cli/packages/cmd/run.go | 13 +----- cli/packages/cmd/secrets.go | 13 +----- cli/packages/util/secrets.go | 18 ++++++++ 4 files changed, 73 insertions(+), 54 deletions(-) diff --git a/cli/packages/cmd/export.go b/cli/packages/cmd/export.go index 983c19255..271509b0c 100644 --- a/cli/packages/cmd/export.go +++ b/cli/packages/cmd/export.go @@ -93,10 +93,33 @@ var exportCmd = &cobra.Command{ IncludeImport: includeImports, } + + var secrets []models.SingleEnvironmentVariable + var isUserSession bool + var infisicalDotJson models.WorkspaceConfigFile + var userBackupSecretsEncryptionKey []byte + var loggedInUserDetails util.LoggedInUserDetails + if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { request.InfisicalToken = token.Token } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { request.UniversalAuthAccessToken = token.Token + } else { + isUserSession = true + loggedInUserDetails, err = util.GetCurrentLoggedInUserDetails() + if err != nil { + util.HandleError(err) + } + + projectConfig, err := util.GetWorkSpaceFromFile() + if err != nil { + util.HandleError(err) + } + + infisicalDotJson = projectConfig + + userBackupSecretsEncryptionKey = []byte(loggedInUserDetails.UserCredentials.PrivateKey)[0:32] + secrets = util.GetBackupSecretsIfDisconnected(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) } if templatePath != "" { @@ -109,10 +132,6 @@ var exportCmd = &cobra.Command{ accessToken = token.Token } else { log.Debug().Msg("GetAllEnvironmentVariables: Trying to fetch secrets using logged in details") - loggedInUserDetails, err := util.GetCurrentLoggedInUserDetails() - if err != nil { - util.HandleError(err) - } accessToken = loggedInUserDetails.UserCredentials.JTWToken } @@ -124,40 +143,44 @@ var exportCmd = &cobra.Command{ return } - secrets, err := util.GetAllEnvironmentVariables(request, "") - if err != nil { - util.HandleError(err, "Unable to fetch secrets") - } - - if secretOverriding { - secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_PERSONAL) - } else { - secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_SHARED) - } - - var output string - if shouldExpandSecrets { - - authParams := models.ExpandSecretsAuthentication{} - - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { - authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { - authParams.UniversalAuthAccessToken = token.Token + if len(secrets) == 0 { + secrets, err = util.GetAllEnvironmentVariables(request, "") + if err != nil { + util.HandleError(err, "Unable to fetch secrets") } - secrets = util.ExpandSecrets(secrets, authParams, "") - } - secrets = util.FilterSecretsByTag(secrets, tagSlugs) - secrets = util.SortSecretsByKeys(secrets) + if secretOverriding { + secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_PERSONAL) + } else { + secrets = util.OverrideSecrets(secrets, util.SECRET_TYPE_SHARED) + } - output, err = formatEnvs(secrets, format) + if shouldExpandSecrets { + + authParams := models.ExpandSecretsAuthentication{} + + if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + authParams.InfisicalToken = token.Token + } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + authParams.UniversalAuthAccessToken = token.Token + } + + secrets = util.ExpandSecrets(secrets, authParams, "") + } + secrets = util.FilterSecretsByTag(secrets, tagSlugs) + secrets = util.SortSecretsByKeys(secrets) + + if isUserSession { + util.WriteBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey, secrets) + } + } + + output, err := formatEnvs(secrets, format) if err != nil { util.HandleError(err) } fmt.Print(output) - // Telemetry.CaptureEvent("cli-command:export", posthog.NewProperties().Set("secretsCount", len(secrets)).Set("version", util.CLI_VERSION)) }, } diff --git a/cli/packages/cmd/run.go b/cli/packages/cmd/run.go index 58088f5d3..0770a8556 100644 --- a/cli/packages/cmd/run.go +++ b/cli/packages/cmd/run.go @@ -133,8 +133,6 @@ var runCmd = &cobra.Command{ util.HandleError(err) } - isConnected := util.CheckIsConnectedToInfisicalAPI() - if projectConfigDir == "" { projectConfig, err := util.GetWorkSpaceFromFile() if err != nil { @@ -152,16 +150,7 @@ var runCmd = &cobra.Command{ } userBackupSecretsEncryptionKey = []byte(loggedInUserDetails.UserCredentials.PrivateKey)[0:32] - - if !isConnected { - secrets, err = util.ReadBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) - if err != nil { - util.HandleError(err) - } - if len(secrets) > 0 { - util.PrintWarning("Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug") - } - } + secrets = util.GetBackupSecretsIfDisconnected(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) } if len(secrets) == 0 { diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go index 0a800580f..cd31d05e9 100644 --- a/cli/packages/cmd/secrets.go +++ b/cli/packages/cmd/secrets.go @@ -105,8 +105,6 @@ var secretsCmd = &cobra.Command{ util.HandleError(err) } - isConnected := util.CheckIsConnectedToInfisicalAPI() - projectConfig, err := util.GetWorkSpaceFromFile() if err != nil { util.HandleError(err) @@ -114,16 +112,7 @@ var secretsCmd = &cobra.Command{ infisicalDotJson = projectConfig userBackupSecretsEncryptionKey = []byte(loggedInUserDetails.UserCredentials.PrivateKey)[0:32] - - if !isConnected { - secrets, err = util.ReadBackupSecrets(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) - if err != nil { - util.HandleError(err) - } - if len(secrets) > 0 { - util.PrintWarning("Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug") - } - } + secrets = util.GetBackupSecretsIfDisconnected(infisicalDotJson.WorkspaceId, environmentName, userBackupSecretsEncryptionKey) } if len(secrets) == 0 { diff --git a/cli/packages/util/secrets.go b/cli/packages/util/secrets.go index 2e9b0ffd2..e97dda9b0 100644 --- a/cli/packages/util/secrets.go +++ b/cli/packages/util/secrets.go @@ -426,6 +426,24 @@ func getSecretsByKeys(secrets []models.SingleEnvironmentVariable) map[string]mod return secretMapByName } +func GetBackupSecretsIfDisconnected(workspaceId string, environment string, encryptionKey []byte) ([]models.SingleEnvironmentVariable) { + isConnected := CheckIsConnectedToInfisicalAPI() + + if !isConnected { + secrets, err := ReadBackupSecrets(workspaceId, environment, encryptionKey) + if err != nil { + HandleError(err) + } + if len(secrets) > 0 { + PrintWarning("Unable to fetch latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug") + } + + return secrets + } + + return nil +} + func ExpandSecrets(secrets []models.SingleEnvironmentVariable, auth models.ExpandSecretsAuthentication, projectConfigPathDir string) []models.SingleEnvironmentVariable { expandedSecs := make(map[string]string) interpolatedSecs := make(map[string]string) From 26ea949a4e7a1eb14663f5ed1dc867cdc3982e76 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 22 May 2024 21:33:06 -0700 Subject: [PATCH 017/187] Preliminary scaffolding for CA structures --- backend/package-lock.json | 200 +++++++++- backend/package.json | 1 + backend/src/@types/fastify.d.ts | 2 + backend/src/@types/knex.d.ts | 24 ++ .../20240522010055_certificate-authority.ts | 58 +++ .../src/db/schemas/certificate-authorities.ts | 24 ++ .../db/schemas/certificate-authority-certs.ts | 23 ++ .../db/schemas/certificate-authority-sk.ts | 23 ++ backend/src/db/schemas/index.ts | 3 + backend/src/db/schemas/models.ts | 3 + backend/src/server/routes/index.ts | 17 + .../routes/v1/certificate-authority-router.ts | 151 ++++++++ backend/src/server/routes/v1/index.ts | 8 + .../src/server/routes/v2/project-router.ts | 36 +- .../certificate-authority-cert-dal.ts | 10 + .../certificate-authority-dal.ts | 10 + .../certificate-authority-fns.ts | 0 .../certificate-authority-service.ts | 268 ++++++++++++++ .../certificate-authority-sk-dal.ts | 10 + .../certificate-authority-types.ts | 34 ++ .../src/services/project/project-service.ts | 31 +- backend/src/services/project/project-types.ts | 4 + frontend/src/hooks/api/ca/constants.tsx | 6 + frontend/src/hooks/api/ca/enums.tsx | 4 + frontend/src/hooks/api/ca/index.tsx | 2 + frontend/src/hooks/api/ca/mutations.tsx | 23 ++ frontend/src/hooks/api/ca/types.ts | 23 ++ frontend/src/hooks/api/index.tsx | 1 + frontend/src/hooks/api/workspace/index.tsx | 4 +- frontend/src/hooks/api/workspace/queries.tsx | 19 +- frontend/src/layouts/AppLayout/AppLayout.tsx | 12 + .../pages/project/[id]/certificates/index.tsx | 24 ++ .../CertificatesPage/CertificatesPage.tsx | 44 +++ .../components/CaTab/CaTab.tsx | 17 + .../components/CaTab/components/CaModal.tsx | 346 ++++++++++++++++++ .../components/CaTab/components/CaSection.tsx | 141 +++++++ .../components/CaTab/components/CaTable.tsx | 54 +++ .../components/CaTab/components/index.tsx | 1 + .../components/CaTab/index.tsx | 1 + .../CertificatesPage/components/index.tsx | 1 + .../views/Project/CertificatesPage/index.tsx | 1 + 41 files changed, 1656 insertions(+), 8 deletions(-) create mode 100644 backend/src/db/migrations/20240522010055_certificate-authority.ts create mode 100644 backend/src/db/schemas/certificate-authorities.ts create mode 100644 backend/src/db/schemas/certificate-authority-certs.ts create mode 100644 backend/src/db/schemas/certificate-authority-sk.ts create mode 100644 backend/src/server/routes/v1/certificate-authority-router.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-cert-dal.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-dal.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-fns.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-service.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-sk-dal.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-types.ts create mode 100644 frontend/src/hooks/api/ca/constants.tsx create mode 100644 frontend/src/hooks/api/ca/enums.tsx create mode 100644 frontend/src/hooks/api/ca/index.tsx create mode 100644 frontend/src/hooks/api/ca/mutations.tsx create mode 100644 frontend/src/hooks/api/ca/types.ts create mode 100644 frontend/src/pages/project/[id]/certificates/index.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/CaTab.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/index.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/index.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/index.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/index.tsx diff --git a/backend/package-lock.json b/backend/package-lock.json index cdaee75f4..77a18b567 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -25,6 +25,7 @@ "@node-saml/passport-saml": "^4.0.4", "@octokit/rest": "^20.0.2", "@octokit/webhooks-types": "^7.3.1", + "@peculiar/x509": "^1.10.0", "@serdnam/pino-cloudwatch-transport": "^1.0.4", "@sindresorhus/slugify": "^2.2.1", "@ucast/mongo2js": "^1.3.4", @@ -2458,9 +2459,9 @@ } }, "node_modules/@fastify/session": { - "version": "10.7.0", - "resolved": "https://registry.npmjs.org/@fastify/session/-/session-10.7.0.tgz", - "integrity": "sha512-ECA75gnyaxcyIukgyO2NGT3XdbLReNl/pTKrrkRfDc6pVqNtdptwwfx9KXrIMOfsO4B3m84eF3wZ9GgnebiZ4w==", + "version": "10.9.0", + "resolved": "https://registry.npmjs.org/@fastify/session/-/session-10.9.0.tgz", + "integrity": "sha512-u/c42RuAaxCeEuRCAwK2+/SfGqKOd0NSyRzEvDwFBWySQoKUZQyb9OmmJSWJBbOP1OfaU2OsDrjbPbghE1l/YQ==", "dependencies": { "fastify-plugin": "^4.0.0", "safe-stable-stringify": "^2.3.1" @@ -3298,6 +3299,149 @@ "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.1.0.tgz", "integrity": "sha512-y92CpG4kFFtBBjni8LHoV12IegJ+KFxLgKRengrVjKmGE5XMeCuGvlfRe75lTRrgXaG6XIWJlFpIDTlkoJsU8w==" }, + "node_modules/@peculiar/asn1-cms": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.3.8.tgz", + "integrity": "sha512-Wtk9R7yQxGaIaawHorWKP2OOOm/RZzamOmSWwaqGphIuU6TcKYih0slL6asZlSSZtVoYTrBfrddSOD/jTu9vuQ==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "@peculiar/asn1-x509-attr": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-csr": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.3.8.tgz", + "integrity": "sha512-ZmAaP2hfzgIGdMLcot8gHTykzoI+X/S53x1xoGbTmratETIaAbSWMiPGvZmXRA0SNEIydpMkzYtq4fQBxN1u1w==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-ecc": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.3.8.tgz", + "integrity": "sha512-Ah/Q15y3A/CtxbPibiLM/LKcMbnLTdUdLHUgdpB5f60sSvGkXzxJCu5ezGTFHogZXWNX3KSmYqilCrfdmBc6pQ==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-pfx": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.3.8.tgz", + "integrity": "sha512-XhdnCVznMmSmgy68B9pVxiZ1XkKoE1BjO4Hv+eUGiY1pM14msLsFZ3N7K46SoITIVZLq92kKkXpGiTfRjlNLyg==", + "dependencies": { + "@peculiar/asn1-cms": "^2.3.8", + "@peculiar/asn1-pkcs8": "^2.3.8", + "@peculiar/asn1-rsa": "^2.3.8", + "@peculiar/asn1-schema": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-pkcs8": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.3.8.tgz", + "integrity": "sha512-rL8k2x59v8lZiwLRqdMMmOJ30GHt6yuHISFIuuWivWjAJjnxzZBVzMTQ72sknX5MeTSSvGwPmEFk2/N8+UztFQ==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-pkcs9": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.3.8.tgz", + "integrity": "sha512-+nONq5tcK7vm3qdY7ZKoSQGQjhJYMJbwJGbXLFOhmqsFIxEWyQPHyV99+wshOjpOjg0wUSSkEEzX2hx5P6EKeQ==", + "dependencies": { + "@peculiar/asn1-cms": "^2.3.8", + "@peculiar/asn1-pfx": "^2.3.8", + "@peculiar/asn1-pkcs8": "^2.3.8", + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "@peculiar/asn1-x509-attr": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-rsa": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.3.8.tgz", + "integrity": "sha512-ES/RVEHu8VMYXgrg3gjb1m/XG0KJWnV4qyZZ7mAg7rrF3VTmRbLxO8mk+uy0Hme7geSMebp+Wvi2U6RLLEs12Q==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-schema": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.3.8.tgz", + "integrity": "sha512-ULB1XqHKx1WBU/tTFIA+uARuRoBVZ4pNdOA878RDrRbBfBGcSzi5HBkdScC6ZbHn8z7L8gmKCgPC1LHRrP46tA==", + "dependencies": { + "asn1js": "^3.0.5", + "pvtsutils": "^1.3.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-x509": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.3.8.tgz", + "integrity": "sha512-voKxGfDU1c6r9mKiN5ZUsZWh3Dy1BABvTM3cimf0tztNwyMJPhiXY94eRTgsMQe6ViLfT6EoXxkWVzcm3mFAFw==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "asn1js": "^3.0.5", + "ipaddr.js": "^2.1.0", + "pvtsutils": "^1.3.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-x509-attr": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.3.8.tgz", + "integrity": "sha512-4Z8mSN95MOuX04Aku9BUyMdsMKtVQUqWnr627IheiWnwFoheUhX3R4Y2zh23M7m80r4/WG8MOAckRKc77IRv6g==", + "dependencies": { + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "asn1js": "^3.0.5", + "tslib": "^2.6.2" + } + }, + "node_modules/@peculiar/asn1-x509/node_modules/ipaddr.js": { + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.2.0.tgz", + "integrity": "sha512-Ag3wB2o37wslZS19hZqorUnrnzSkpOVy+IiiDEiTqNubEYpYuHWIf6K4psgN2ZWKExS4xhVCrRVfb/wfW8fWJA==", + "engines": { + "node": ">= 10" + } + }, + "node_modules/@peculiar/x509": { + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.10.0.tgz", + "integrity": "sha512-gdH6H8gWjAYoM4Yr6wPnRbzU77nU7xq/jipqYyyv5/AHTrulN2Z5DlnOSq9jjKrB+Ya0D6YJ2cGGtwkWDK75jA==", + "dependencies": { + "@peculiar/asn1-cms": "^2.3.8", + "@peculiar/asn1-csr": "^2.3.8", + "@peculiar/asn1-ecc": "^2.3.8", + "@peculiar/asn1-pkcs9": "^2.3.8", + "@peculiar/asn1-rsa": "^2.3.8", + "@peculiar/asn1-schema": "^2.3.8", + "@peculiar/asn1-x509": "^2.3.8", + "pvtsutils": "^1.3.5", + "reflect-metadata": "^0.2.2", + "tslib": "^2.6.2", + "tsyringe": "^4.8.0" + } + }, "node_modules/@phc/format": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/@phc/format/-/format-1.0.0.tgz", @@ -5948,6 +6092,19 @@ "safer-buffer": "~2.1.0" } }, + "node_modules/asn1js": { + "version": "3.0.5", + "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.5.tgz", + "integrity": "sha512-FVnvrKJwpt9LP2lAMl8qZswRNm3T4q9CON+bxldk2iwk3FFpuwhx2FfinyitizWHsVYyaY+y5JzDR0rCMV5yTQ==", + "dependencies": { + "pvtsutils": "^1.3.2", + "pvutils": "^1.1.3", + "tslib": "^2.4.0" + }, + "engines": { + "node": ">=12.0.0" + } + }, "node_modules/assert-plus": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz", @@ -11701,6 +11858,22 @@ "node": ">=6" } }, + "node_modules/pvtsutils": { + "version": "1.3.5", + "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.5.tgz", + "integrity": "sha512-ARvb14YB9Nm2Xi6nBq1ZX6dAM0FsJnuk+31aUp4TrcZEdKUlSqOqsxJHUPJDNE3qiIp+iUPEIeR6Je/tgV7zsA==", + "dependencies": { + "tslib": "^2.6.1" + } + }, + "node_modules/pvutils": { + "version": "1.1.3", + "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.1.3.tgz", + "integrity": "sha512-pMpnA0qRdFp32b1sJl1wOJNxZLQ2cbQx+k6tjNtZ8CpvVhNqEPRgivZ2WOUev2YMajecdH7ctUPDvEe87nariQ==", + "engines": { + "node": ">=6.0.0" + } + }, "node_modules/qs": { "version": "6.11.0", "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz", @@ -11882,6 +12055,11 @@ "node": ">=4" } }, + "node_modules/reflect-metadata": { + "version": "0.2.2", + "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz", + "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==" + }, "node_modules/regexp.prototype.flags": { "version": "1.5.1", "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.1.tgz", @@ -13665,6 +13843,22 @@ "fsevents": "~2.3.3" } }, + "node_modules/tsyringe": { + "version": "4.8.0", + "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.8.0.tgz", + "integrity": "sha512-YB1FG+axdxADa3ncEtRnQCFq/M0lALGLxSZeVNbTU8NqhOVc51nnv2CISTcvc1kyv6EGPtXVr0v6lWeDxiijOA==", + "dependencies": { + "tslib": "^1.9.3" + }, + "engines": { + "node": ">= 6.0.0" + } + }, + "node_modules/tsyringe/node_modules/tslib": { + "version": "1.14.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz", + "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==" + }, "node_modules/tweetnacl": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-1.0.3.tgz", diff --git a/backend/package.json b/backend/package.json index 85538d45a..720efb34b 100644 --- a/backend/package.json +++ b/backend/package.json @@ -86,6 +86,7 @@ "@node-saml/passport-saml": "^4.0.4", "@octokit/rest": "^20.0.2", "@octokit/webhooks-types": "^7.3.1", + "@peculiar/x509": "^1.10.0", "@serdnam/pino-cloudwatch-transport": "^1.0.4", "@sindresorhus/slugify": "^2.2.1", "@ucast/mongo2js": "^1.3.4", diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index 4776e26dc..38d49a807 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -29,6 +29,7 @@ import { TAuthPasswordFactory } from "@app/services/auth/auth-password-service"; import { TAuthSignupFactory } from "@app/services/auth/auth-signup-service"; import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type"; import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service"; +import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service"; import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service"; import { TIdentityServiceFactory } from "@app/services/identity/identity-service"; import { TIdentityAccessTokenServiceFactory } from "@app/services/identity-access-token/identity-access-token-service"; @@ -132,6 +133,7 @@ declare module "fastify" { ldap: TLdapConfigServiceFactory; auditLog: TAuditLogServiceFactory; auditLogStream: TAuditLogStreamServiceFactory; + certificateAuthority: TCertificateAuthorityServiceFactory; secretScanning: TSecretScanningServiceFactory; license: TLicenseServiceFactory; trustedIp: TTrustedIpServiceFactory; diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index 291197b0b..cd4c9418c 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -32,6 +32,15 @@ import { TBackupPrivateKey, TBackupPrivateKeyInsert, TBackupPrivateKeyUpdate, + TCertificateAuthorities, + TCertificateAuthoritiesInsert, + TCertificateAuthoritiesUpdate, + TCertificateAuthorityCerts, + TCertificateAuthorityCertsInsert, + TCertificateAuthorityCertsUpdate, + TCertificateAuthoritySk, + TCertificateAuthoritySkInsert, + TCertificateAuthoritySkUpdate, TDynamicSecretLeases, TDynamicSecretLeasesInsert, TDynamicSecretLeasesUpdate, @@ -240,6 +249,21 @@ declare module "knex/types/tables" { interface Tables { [TableName.Users]: Knex.CompositeTableType; [TableName.Groups]: Knex.CompositeTableType; + [TableName.CertificateAuthority]: Knex.CompositeTableType< + TCertificateAuthorities, + TCertificateAuthoritiesInsert, + TCertificateAuthoritiesUpdate + >; + [TableName.CertificateAuthorityCert]: Knex.CompositeTableType< + TCertificateAuthorityCerts, + TCertificateAuthorityCertsInsert, + TCertificateAuthorityCertsUpdate + >; + [TableName.CertificateAuthoritySk]: Knex.CompositeTableType< + TCertificateAuthoritySk, + TCertificateAuthoritySkInsert, + TCertificateAuthoritySkUpdate + >; [TableName.UserGroupMembership]: Knex.CompositeTableType< TUserGroupMembership, TUserGroupMembershipInsert, diff --git a/backend/src/db/migrations/20240522010055_certificate-authority.ts b/backend/src/db/migrations/20240522010055_certificate-authority.ts new file mode 100644 index 000000000..860fb8a86 --- /dev/null +++ b/backend/src/db/migrations/20240522010055_certificate-authority.ts @@ -0,0 +1,58 @@ +import { Knex } from "knex"; + +import { TableName } from "../schemas"; +import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; + +export async function up(knex: Knex): Promise { + if (!(await knex.schema.hasTable(TableName.CertificateAuthority))) { + // TODO: consider adding algo details + await knex.schema.createTable(TableName.CertificateAuthority, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.uuid("parentCaId").nullable(); + t.foreign("parentCaId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE"); + t.string("projectId").notNullable(); + t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE"); + t.string("type").notNullable(); // root / intermediate + t.string("dn").notNullable(); + }); + } + + if (!(await knex.schema.hasTable(TableName.CertificateAuthorityCert))) { + await knex.schema.createTable(TableName.CertificateAuthorityCert, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.uuid("caId").notNullable().unique(); // TODO: consider that cert can be rotated so may be multiple / non-unique + t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE"); + t.text("certificate").notNullable(); // TODO: encrypt + t.text("certificateChain").notNullable(); // TODO: encrypt + }); + } + + // TODO: consider renaming this to CertificateAuthoritySecret + if (!(await knex.schema.hasTable(TableName.CertificateAuthoritySk))) { + await knex.schema.createTable(TableName.CertificateAuthoritySk, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.uuid("caId").notNullable().unique(); + t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE"); + t.text("pk").notNullable(); // TODO: encrypt + t.text("sk").notNullable(); // TODO: encrypt + }); + } + + await createOnUpdateTrigger(knex, TableName.CertificateAuthority); + await createOnUpdateTrigger(knex, TableName.CertificateAuthorityCert); + await createOnUpdateTrigger(knex, TableName.CertificateAuthoritySk); +} + +export async function down(knex: Knex): Promise { + await knex.schema.dropTableIfExists(TableName.CertificateAuthoritySk); + await dropOnUpdateTrigger(knex, TableName.CertificateAuthoritySk); + + await knex.schema.dropTableIfExists(TableName.CertificateAuthorityCert); + await dropOnUpdateTrigger(knex, TableName.CertificateAuthorityCert); + + await knex.schema.dropTableIfExists(TableName.CertificateAuthority); + await dropOnUpdateTrigger(knex, TableName.CertificateAuthority); +} diff --git a/backend/src/db/schemas/certificate-authorities.ts b/backend/src/db/schemas/certificate-authorities.ts new file mode 100644 index 000000000..b49a151c1 --- /dev/null +++ b/backend/src/db/schemas/certificate-authorities.ts @@ -0,0 +1,24 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const CertificateAuthoritiesSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + parentCaId: z.string().uuid().nullable().optional(), + projectId: z.string(), + type: z.string(), + dn: z.string() +}); + +export type TCertificateAuthorities = z.infer; +export type TCertificateAuthoritiesInsert = Omit, TImmutableDBKeys>; +export type TCertificateAuthoritiesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-authority-certs.ts b/backend/src/db/schemas/certificate-authority-certs.ts new file mode 100644 index 000000000..ec3d6b8e1 --- /dev/null +++ b/backend/src/db/schemas/certificate-authority-certs.ts @@ -0,0 +1,23 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const CertificateAuthorityCertsSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + caId: z.string().uuid(), + certificate: z.string(), + certificateChain: z.string() +}); + +export type TCertificateAuthorityCerts = z.infer; +export type TCertificateAuthorityCertsInsert = Omit, TImmutableDBKeys>; +export type TCertificateAuthorityCertsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-authority-sk.ts b/backend/src/db/schemas/certificate-authority-sk.ts new file mode 100644 index 000000000..b3eca38e2 --- /dev/null +++ b/backend/src/db/schemas/certificate-authority-sk.ts @@ -0,0 +1,23 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const CertificateAuthoritySkSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + caId: z.string().uuid(), + pk: z.string(), + sk: z.string() +}); + +export type TCertificateAuthoritySk = z.infer; +export type TCertificateAuthoritySkInsert = Omit, TImmutableDBKeys>; +export type TCertificateAuthoritySkUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index cffa4f492..b82f1a992 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -8,6 +8,9 @@ export * from "./audit-logs"; export * from "./auth-token-sessions"; export * from "./auth-tokens"; export * from "./backup-private-key"; +export * from "./certificate-authorities"; +export * from "./certificate-authority-certs"; +export * from "./certificate-authority-sk"; export * from "./dynamic-secret-leases"; export * from "./dynamic-secrets"; export * from "./git-app-install-sessions"; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index 28a6973b7..46c16eb1a 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -2,6 +2,9 @@ import { z } from "zod"; export enum TableName { Users = "users", + CertificateAuthority = "certificate_authorities", + CertificateAuthorityCert = "certificate_authority_certs", + CertificateAuthoritySk = "certificate_authority_sk", Groups = "groups", GroupProjectMembership = "group_project_memberships", GroupProjectMembershipRole = "group_project_membership_roles", diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 1e5cb3bf9..2f8ef02de 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -71,6 +71,11 @@ import { authPaswordServiceFactory } from "@app/services/auth/auth-password-serv import { authSignupServiceFactory } from "@app/services/auth/auth-signup-service"; import { tokenDALFactory } from "@app/services/auth-token/auth-token-dal"; import { tokenServiceFactory } from "@app/services/auth-token/auth-token-service"; +import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; +// ca / certs +import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; +import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service"; +import { certificateAuthoritySkDALFactory } from "@app/services/certificate-authority/certificate-authority-sk-dal"; import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal"; import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal"; import { groupProjectServiceFactory } from "@app/services/group-project/group-project-service"; @@ -221,6 +226,16 @@ export const registerRoutes = async ( const trustedIpDAL = trustedIpDALFactory(db); const telemetryDAL = telemetryDALFactory(db); + const certificateAuthorityDAL = certificateAuthorityDALFactory(db); + const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db); + const certificateAuthoritySkDAL = certificateAuthoritySkDALFactory(db); + const certificateAuthorityService = certificateAuthorityServiceFactory({ + certificateAuthorityDAL, + certificateAuthorityCertDAL, + certificateAuthoritySkDAL, + projectDAL + }); + // ee db layer ops const permissionDAL = permissionDALFactory(db); const samlConfigDAL = samlConfigDALFactory(db); @@ -504,6 +519,7 @@ export const registerRoutes = async ( projectMembershipDAL, folderDAL, licenseService, + certificateAuthorityDAL, projectUserMembershipRoleDAL, identityProjectMembershipRoleDAL, keyStore @@ -826,6 +842,7 @@ export const registerRoutes = async ( ldap: ldapService, auditLog: auditLogService, auditLogStream: auditLogStreamService, + certificateAuthority: certificateAuthorityService, secretScanning: secretScanningService, license: licenseService, trustedIp: trustedIpService, diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts new file mode 100644 index 000000000..bfb670ac3 --- /dev/null +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -0,0 +1,151 @@ +import { z } from "zod"; + +import { CertificateAuthoritiesSchema } from "@app/db/schemas"; +import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; +import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { AuthMode } from "@app/services/auth/auth-type"; +import { CAType } from "@app/services/certificate-authority/certificate-authority-types"; + +export const registerCaRouter = async (server: FastifyZodProvider) => { + server.route({ + method: "POST", + url: "/", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Create CA", + body: z.object({ + projectSlug: z.string().trim(), + type: z.enum([CAType.ROOT, CAType.INTERMEDIATE]), + commonName: z.string().trim(), + organization: z.string().trim(), + ou: z.string().trim(), + country: z.string().trim(), + province: z.string().trim(), + locality: z.string().trim() + }), + response: { + 200: CertificateAuthoritiesSchema + } + }, + handler: async (req) => { + const ca = await server.services.certificateAuthority.createCa({ + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + ...req.body + }); + return ca; + } + }); + + server.route({ + method: "GET", + url: "/:caId/csr", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Get CA CSR", + params: z.object({ + caId: z.string().trim() + }), + response: { + 200: z.object({ + csr: z.string() + }) + } + }, + handler: async (req) => { + const csr = await server.services.certificateAuthority.getCaCsr({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + csr + }; + } + }); + + server.route({ + method: "GET", + url: ":caId/certificate", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Get cert and cert chain of a CA", + params: z.object({ + caId: z.string().trim() + }), + response: { + 200: z.object({ + certificate: z.string(), + certificateChain: z.string() + }) + } + }, + handler: async (req) => { + const { certificate, certificateChain } = await server.services.certificateAuthority.getCaCert({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + certificate, + certificateChain + }; + } + }); + + server.route({ + method: "POST", + url: ":caId/issue-certificate", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Issue (leaf) certificate from CA", + params: z.object({ + caId: z.string().trim() + }), + body: z.object({ + csr: z.string().trim(), + notBefore: z.string().trim(), + notAfter: z.string().trim() + }), + response: { + 200: z.object({ + certificateId: z.string().trim() + }) + } + }, + handler: async () => { + // await server.services.certificateAuthority.issueCertFromCa({ + // caId: req.params.caId, + // actor: req.permission.type, + // actorId: req.permission.id, + // actorAuthMethod: req.permission.authMethod, + // actorOrgId: req.permission.orgId, + // ...req.body + // }); + return { + certificateId: "111" + }; + } + }); + + // TODO 2: logic for creating intermediary ca + // TODO 1: get certificate + certificate chain for the root and intermediary CA GET /ca/:caId/certificate +}; diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts index 262e3cb20..72439cd10 100644 --- a/backend/src/server/routes/v1/index.ts +++ b/backend/src/server/routes/v1/index.ts @@ -1,6 +1,7 @@ import { registerAdminRouter } from "./admin-router"; import { registerAuthRoutes } from "./auth-router"; import { registerProjectBotRouter } from "./bot-router"; +import { registerCaRouter } from "./certificate-authority-router"; import { registerIdentityAccessTokenRouter } from "./identity-access-token-router"; import { registerIdentityAwsAuthRouter } from "./identity-aws-iam-auth-router"; import { registerIdentityGcpAuthRouter } from "./identity-gcp-auth-router"; @@ -58,6 +59,13 @@ export const registerV1Routes = async (server: FastifyZodProvider) => { { prefix: "/workspace" } ); + await server.register( + async (certRouter) => { + await certRouter.register(registerCaRouter); + }, + { prefix: "/ca" } + ); + await server.register(registerProjectBotRouter, { prefix: "/bot" }); await server.register(registerIntegrationRouter, { prefix: "/integration" }); await server.register(registerIntegrationAuthRouter, { prefix: "/integration-auth" }); diff --git a/backend/src/server/routes/v2/project-router.ts b/backend/src/server/routes/v2/project-router.ts index a199cf0d4..3653daae4 100644 --- a/backend/src/server/routes/v2/project-router.ts +++ b/backend/src/server/routes/v2/project-router.ts @@ -1,7 +1,7 @@ import slugify from "@sindresorhus/slugify"; import { z } from "zod"; -import { ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas"; +import { CertificateAuthoritiesSchema, ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { PROJECTS } from "@app/lib/api-docs"; import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter"; @@ -307,4 +307,38 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { return project; } }); + + server.route({ + method: "GET", + url: "/:slug/cas", + config: { + rateLimit: writeLimit + }, + schema: { + params: z.object({ + slug: slugSchema.describe("The slug of the project to list CAs.") + }), + response: { + 200: z.object({ + cas: z.array(CertificateAuthoritiesSchema) + }) + } + }, + + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + handler: async (req) => { + const cas = await server.services.project.listProjectCas({ + filter: { + slug: req.params.slug, + orgId: req.permission.orgId, + type: ProjectFilterType.SLUG + }, + actorId: req.permission.id, + actorOrgId: req.permission.orgId, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type + }); + return { cas }; + } + }); }; diff --git a/backend/src/services/certificate-authority/certificate-authority-cert-dal.ts b/backend/src/services/certificate-authority/certificate-authority-cert-dal.ts new file mode 100644 index 000000000..763240986 --- /dev/null +++ b/backend/src/services/certificate-authority/certificate-authority-cert-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateAuthorityCertDALFactory = ReturnType; + +export const certificateAuthorityCertDALFactory = (db: TDbClient) => { + const caCertOrm = ormify(db, TableName.CertificateAuthorityCert); + return caCertOrm; +}; diff --git a/backend/src/services/certificate-authority/certificate-authority-dal.ts b/backend/src/services/certificate-authority/certificate-authority-dal.ts new file mode 100644 index 000000000..40d868560 --- /dev/null +++ b/backend/src/services/certificate-authority/certificate-authority-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateAuthorityDALFactory = ReturnType; + +export const certificateAuthorityDALFactory = (db: TDbClient) => { + const caOrm = ormify(db, TableName.CertificateAuthority); + return caOrm; +}; diff --git a/backend/src/services/certificate-authority/certificate-authority-fns.ts b/backend/src/services/certificate-authority/certificate-authority-fns.ts new file mode 100644 index 000000000..e69de29bb diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts new file mode 100644 index 000000000..ffb4ee187 --- /dev/null +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -0,0 +1,268 @@ +import * as x509 from "@peculiar/x509"; +import crypto, { KeyObject } from "crypto"; + +import { BadRequestError } from "@app/lib/errors"; +import { TProjectDALFactory } from "@app/services/project/project-dal"; + +import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal"; +import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal"; +import { TCertificateAuthoritySkDALFactory } from "./certificate-authority-sk-dal"; +import { + // TIssueCertFromCaDTO, + CAType, + TCreateCaDTO, + TGetCaCertDTO, + TGetCaCsrDTO +} from "./certificate-authority-types"; + +type TCertificateAuthorityServiceFactoryDep = { + // TODO: Pick + certificateAuthorityDAL: TCertificateAuthorityDALFactory; + certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory; + certificateAuthoritySkDAL: TCertificateAuthoritySkDALFactory; + projectDAL: TProjectDALFactory; +}; + +export type TCertificateAuthorityServiceFactory = ReturnType; + +type DNParts = { + commonName?: string; + organization?: string; + ou?: string; + country?: string; + province?: string; + locality?: string; +}; + +function createDistinguishedName(parts: DNParts) { + const dnParts = []; + if (parts.country) dnParts.push(`C=${parts.country}`); + if (parts.organization) dnParts.push(`O=${parts.organization}`); + if (parts.ou) dnParts.push(`OU=${parts.ou}`); + if (parts.province) dnParts.push(`ST=${parts.province}`); + if (parts.commonName) dnParts.push(`CN=${parts.commonName}`); + if (parts.locality) dnParts.push(`L=${parts.locality}`); + return dnParts.join(", "); +} + +export const certificateAuthorityServiceFactory = ({ + certificateAuthorityDAL, + certificateAuthorityCertDAL, + certificateAuthoritySkDAL, + projectDAL +}: TCertificateAuthorityServiceFactoryDep) => { + /** + * Generates a new root or intermediate CA + * @param param0 + * @returns + */ + const createCa = async ({ + projectSlug, + type, + commonName, + organization, + ou, + country, + province, + locality, + // actorId, + // actorAuthMethod, + // actor, + actorOrgId + }: TCreateCaDTO) => { + const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); + if (!project) throw new BadRequestError({ message: "Project not found" }); + + const dn = createDistinguishedName({ + commonName, + organization, + ou, + country, + province, + locality + }); + + const alg = { + name: "RSASSA-PKCS1-v1_5", + hash: "SHA-256", + publicExponent: new Uint8Array([1, 0, 1]), + modulusLength: 2048 + }; + const keys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]); + + // https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey + const skObj = KeyObject.from(keys.privateKey); + const sk = skObj.export({ format: "pem", type: "pkcs8" }) as string; + const pkObj = KeyObject.from(keys.publicKey); + const pk = pkObj.export({ format: "pem", type: "spki" }) as string; + + const newCa = await certificateAuthorityDAL.transaction(async (tx) => { + const ca = await certificateAuthorityDAL.create( + { + projectId: project.id, + type, + dn + }, + tx + ); + + if (type === CAType.ROOT) { + // note: self-signed cert only applicable for root CA + const cert = await x509.X509CertificateGenerator.createSelfSigned({ + name: dn, + notBefore: new Date("2020/01/01"), + notAfter: new Date("2020/01/02"), + signingAlgorithm: alg, + keys, + extensions: [ + new x509.BasicConstraintsExtension(true, 2, true), + new x509.ExtendedKeyUsageExtension(["1.2.3.4.5.6.7", "2.3.4.5.6.7.8"], true), + // eslint-disable-next-line no-bitwise + new x509.KeyUsagesExtension(x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true), + await x509.SubjectKeyIdentifierExtension.create(keys.publicKey) + ] + }); + const certificate = cert.toString("pem"); + await certificateAuthorityCertDAL.create( + { + caId: ca.id, + certificate, // TODO: encrypt + certificateChain: "" // TODO: encrypt + }, + tx + ); + } + + await certificateAuthoritySkDAL.create( + { + caId: ca.id, + pk, // TODO: encrypt + sk // TODO: encrypt + }, + tx + ); + + return ca; + }); + + return newCa; + }; + + /** + * Generates a CSR for a CA + */ + const getCaCsr = async ({ caId }: TGetCaCsrDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + // TODO: permissioning + + const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id }); + + const alg = { + name: "RSASSA-PKCS1-v1_5", + hash: "SHA-256", + publicExponent: new Uint8Array([1, 0, 1]), + modulusLength: 2048 + }; + + const skObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" }); + const pkObj = crypto.createPublicKey({ key: caKeys.pk, format: "pem", type: "spki" }); + + const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [ + "sign" + ]); + const pk = await crypto.subtle.importKey("spki", pkObj.export({ format: "der", type: "spki" }), alg, true, [ + "verify" + ]); + + const cert = new x509.X509Certificate(caCert.certificate); + + const csr = await x509.Pkcs10CertificateRequestGenerator.create({ + name: cert.subject || ca.dn, + keys: { privateKey: sk, publicKey: pk }, + signingAlgorithm: alg, + extensions: [ + // eslint-disable-next-line no-bitwise + new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment) + ], + attributes: [new x509.ChallengePasswordAttribute("password")] + }); + + return csr.toString("base64"); + }; + + /** + * Return certificate and certificate chain for CA + */ + const getCaCert = async ({ caId }: TGetCaCertDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + // TODO: permissioning + + const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + + return { + certificate: caCert.certificate, + certificateChain: caCert.certificateChain + }; + }; + + /** + * Issue new certificate + */ + const issueCertFromCa = async () => { + // WIP: parse publicKey from CSR + // const csrArrayBuffer = Uint8Array.from(atob(csr), (c) => c.charCodeAt(0)); + // const csrR = new x509.Pkcs10CertificateRequest(csrArrayBuffer); + + // const ca = await certificateAuthorityDAL.findById(caId); + // if (!ca) throw new BadRequestError({ message: "CA not found" }); + // // TODO: permissioning + + // const alg = { + // name: "RSASSA-PKCS1-v1_5", + // hash: "SHA-256", + // publicExponent: new Uint8Array([1, 0, 1]), + // modulusLength: 2048 + // }; + + // const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + // const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id }); + + // const skObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" }); + // const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [ + // "sign" + // ]); + + // const cert = new x509.X509Certificate(caCert.certificate); + + // const leafCert = await x509.X509CertificateGenerator.create({ + // // serialNumber: "03", + // subject: "CN=Leaf", // TODO: make dynamic + // issuer: cert.subject, + // notBefore: new Date(notBefore), + // notAfter: new Date(notAfter), + // signingKey: sk, + // publicKey: leafKeys.publicKey, + // signingAlgorithm: alg, + // extensions: [ + // new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true), + // new x509.BasicConstraintsExtension(false), + // await x509.AuthorityKeyIdentifierExtension.create(cert, false), + // await x509.SubjectKeyIdentifierExtension.create(leafKeys.publicKey) + // ] + // }); + + // console.log("leafCert: ", leafCert); + + return ""; + }; + + return { + createCa, + getCaCsr, + getCaCert, + issueCertFromCa + }; +}; diff --git a/backend/src/services/certificate-authority/certificate-authority-sk-dal.ts b/backend/src/services/certificate-authority/certificate-authority-sk-dal.ts new file mode 100644 index 000000000..6c9333243 --- /dev/null +++ b/backend/src/services/certificate-authority/certificate-authority-sk-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateAuthoritySkDALFactory = ReturnType; + +export const certificateAuthoritySkDALFactory = (db: TDbClient) => { + const caSkOrm = ormify(db, TableName.CertificateAuthoritySk); + return caSkOrm; +}; diff --git a/backend/src/services/certificate-authority/certificate-authority-types.ts b/backend/src/services/certificate-authority/certificate-authority-types.ts new file mode 100644 index 000000000..0ad259829 --- /dev/null +++ b/backend/src/services/certificate-authority/certificate-authority-types.ts @@ -0,0 +1,34 @@ +import { TProjectPermission } from "@app/lib/types"; + +export enum CAType { + ROOT = "root", + INTERMEDIATE = "intermediate" +} + +// TODO: attach permissions after draft impl + +export type TCreateCaDTO = { + projectSlug: string; + type: CAType; + commonName: string; + organization: string; + ou: string; + country: string; + province: string; + locality: string; +} & Omit; + +export type TGetCaCsrDTO = { + caId: string; +} & Omit; + +export type TGetCaCertDTO = { + caId: string; +} & Omit; + +export type TIssueCertFromCaDTO = { + caId: string; + csr: string; + notBefore: string; + notAfter: string; +} & Omit; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 008dac593..64f2bf7ac 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -16,6 +16,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TProjectPermission } from "@app/lib/types"; import { ActorType } from "../auth/auth-type"; +import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal"; import { TIdentityOrgDALFactory } from "../identity/identity-org-dal"; import { TIdentityProjectDALFactory } from "../identity-project/identity-project-dal"; import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/identity-project-membership-role-dal"; @@ -36,6 +37,7 @@ import { TCreateProjectDTO, TDeleteProjectDTO, TGetProjectDTO, + TListProjectCasDTO, TToggleProjectAutoCapitalizationDTO, TUpdateProjectDTO, TUpdateProjectNameDTO, @@ -62,6 +64,7 @@ type TProjectServiceFactoryDep = { projectMembershipDAL: Pick; projectUserMembershipRoleDAL: Pick; secretBlindIndexDAL: Pick; + certificateAuthorityDAL: Pick; permissionService: TPermissionServiceFactory; orgService: Pick; licenseService: Pick; @@ -89,6 +92,7 @@ export const projectServiceFactory = ({ licenseService, projectUserMembershipRoleDAL, identityProjectMembershipRoleDAL, + certificateAuthorityDAL, keyStore }: TProjectServiceFactoryDep) => { /* @@ -492,6 +496,30 @@ export const projectServiceFactory = ({ return project.upgradeStatus || null; }; + /** + * Return list of CAs for project + */ + const listProjectCas = async ({ + // actorId, + // actorOrgId, + // actorAuthMethod, + filter // actor + }: TListProjectCasDTO) => { + const project = await projectDAL.findProjectByFilter(filter); + + // const { permission } = await permissionService.getProjectPermission( + // actor, + // actorId, + // project.id, + // actorAuthMethod, + // actorOrgId + // ); + // TODO: add permissioning + + const cas = await certificateAuthorityDAL.find({ projectId: project.id }); + return cas; + }; + return { createProject, deleteProject, @@ -501,6 +529,7 @@ export const projectServiceFactory = ({ getAProject, toggleAutoCapitalization, updateName, - upgradeProject + upgradeProject, + listProjectCas }; }; diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts index dcd424e18..f6268a93e 100644 --- a/backend/src/services/project/project-types.ts +++ b/backend/src/services/project/project-types.ts @@ -75,3 +75,7 @@ export type AddUserToWsDTO = { userPublicKey: string; }[]; }; + +export type TListProjectCasDTO = { + filter: Filter; +} & Omit; diff --git a/frontend/src/hooks/api/ca/constants.tsx b/frontend/src/hooks/api/ca/constants.tsx new file mode 100644 index 000000000..d368d3c04 --- /dev/null +++ b/frontend/src/hooks/api/ca/constants.tsx @@ -0,0 +1,6 @@ +import { CertificateAuthorityType } from "./enums"; + +export const caTypeToNameMap: { [K in CertificateAuthorityType]: string } = { + [CertificateAuthorityType.ROOT]: "Root", + [CertificateAuthorityType.INTERMEDIATE]: "Intermediate" +}; diff --git a/frontend/src/hooks/api/ca/enums.tsx b/frontend/src/hooks/api/ca/enums.tsx new file mode 100644 index 000000000..0db5fcfdb --- /dev/null +++ b/frontend/src/hooks/api/ca/enums.tsx @@ -0,0 +1,4 @@ +export enum CertificateAuthorityType { + ROOT = "root", + INTERMEDIATE = "intermediate" +} diff --git a/frontend/src/hooks/api/ca/index.tsx b/frontend/src/hooks/api/ca/index.tsx new file mode 100644 index 000000000..f03d26abc --- /dev/null +++ b/frontend/src/hooks/api/ca/index.tsx @@ -0,0 +1,2 @@ +export { CertificateAuthorityType } from "./enums"; +export { useCreateCa } from "./mutations"; diff --git a/frontend/src/hooks/api/ca/mutations.tsx b/frontend/src/hooks/api/ca/mutations.tsx new file mode 100644 index 000000000..38cb1cf9f --- /dev/null +++ b/frontend/src/hooks/api/ca/mutations.tsx @@ -0,0 +1,23 @@ +import { + useMutation + // useQueryClient +} from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { TCertificateAuthority, TCreateCaDTO } from "./types"; + +export const useCreateCa = () => { + // const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async (body) => { + const { + data: { identity } + } = await apiRequest.post("/api/v1/ca/", body); + return identity; + }, + onSuccess: () => { + // queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId)); + } + }); +}; diff --git a/frontend/src/hooks/api/ca/types.ts b/frontend/src/hooks/api/ca/types.ts new file mode 100644 index 000000000..34dcbb536 --- /dev/null +++ b/frontend/src/hooks/api/ca/types.ts @@ -0,0 +1,23 @@ +import { CertificateAuthorityType } from "./enums"; + +export type TCertificateAuthority = { + id: string; + parentCaId?: string; + projectId: string; + type: CertificateAuthorityType; + dn: string; + commonName: string; + createdAt: string; + updatedAt: string; +}; + +export type TCreateCaDTO = { + projectSlug: string; + type: string; + organization: string; + ou: string; + country: string; + province: string; + locality: string; + commonName: string; +}; diff --git a/frontend/src/hooks/api/index.tsx b/frontend/src/hooks/api/index.tsx index 61e8cb666..64e306714 100644 --- a/frontend/src/hooks/api/index.tsx +++ b/frontend/src/hooks/api/index.tsx @@ -5,6 +5,7 @@ export * from "./auditLogs"; export * from "./auditLogStreams"; export * from "./auth"; export * from "./bots"; +export * from "./ca"; export * from "./dynamicSecret"; export * from "./dynamicSecretLease"; export * from "./groups"; diff --git a/frontend/src/hooks/api/workspace/index.tsx b/frontend/src/hooks/api/workspace/index.tsx index b0cadac23..58c54f126 100644 --- a/frontend/src/hooks/api/workspace/index.tsx +++ b/frontend/src/hooks/api/workspace/index.tsx @@ -21,6 +21,7 @@ export { useGetWorkspaceIntegrations, useGetWorkspaceSecrets, useGetWorkspaceUsers, + useListWorkspaceCas, useListWorkspaceGroups, useNameWorkspaceSecrets, useRenameWorkspace, @@ -28,5 +29,4 @@ export { useUpdateIdentityWorkspaceRole, useUpdateUserWorkspaceRole, useUpdateWsEnvironment, - useUpgradeProject -} from "./queries"; + useUpgradeProject} from "./queries"; diff --git a/frontend/src/hooks/api/workspace/queries.tsx b/frontend/src/hooks/api/workspace/queries.tsx index 71dbb8e01..07bd2901a 100644 --- a/frontend/src/hooks/api/workspace/queries.tsx +++ b/frontend/src/hooks/api/workspace/queries.tsx @@ -2,6 +2,7 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"; import { apiRequest } from "@app/config/request"; +import { TCertificateAuthority } from "../ca/types"; import { TGroupMembership } from "../groups/types"; import { IdentityMembership } from "../identities/types"; import { IntegrationAuth } from "../integrationAuth/types"; @@ -39,7 +40,8 @@ export const workspaceKeys = { getWorkspaceIdentityMemberships: (workspaceId: string) => [{ workspaceId }, "workspace-identity-memberships"] as const, getWorkspaceGroupMemberships: (workspaceId: string) => - [{ workspaceId }, "workspace-groups"] as const + [{ workspaceId }, "workspace-groups"] as const, + getWorkspaceCas: (workspaceId: string) => [{ workspaceId }, "workspace-cas"] as const }; const fetchWorkspaceById = async (workspaceId: string) => { @@ -469,3 +471,18 @@ export const useListWorkspaceGroups = (projectSlug: string) => { enabled: true }); }; + +export const useListWorkspaceCas = (projectSlug: string) => { + return useQuery({ + queryKey: workspaceKeys.getWorkspaceCas(projectSlug), + queryFn: async () => { + const { + data: { cas } + } = await apiRequest.get<{ cas: TCertificateAuthority[] }>( + `/api/v2/workspace/${projectSlug}/cas` + ); + return cas; + }, + enabled: Boolean(projectSlug) + }); +}; diff --git a/frontend/src/layouts/AppLayout/AppLayout.tsx b/frontend/src/layouts/AppLayout/AppLayout.tsx index 2fcdc9339..b26f1965d 100644 --- a/frontend/src/layouts/AppLayout/AppLayout.tsx +++ b/frontend/src/layouts/AppLayout/AppLayout.tsx @@ -519,6 +519,18 @@ export const AppLayout = ({ children }: LayoutProps) => { + + + + Certificates + + + { + const { t } = useTranslation(); + + return ( +
+ + {t("common.head-title", { title: t("settings.project.title") })} + + + +
Test CA page
+ +
+ ); +}; + +export default Certificates; + +Certificates.requireAuth = true; diff --git a/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx b/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx new file mode 100644 index 000000000..655e83ad5 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx @@ -0,0 +1,44 @@ +import { Tab, TabList, TabPanel, Tabs } from "@app/components/v2"; +import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context"; +import { withProjectPermission } from "@app/hoc"; + +import { CaTab } from "./components"; +// import { CaTable } from "./components"; + +// TODO: fix permission + +/** + * TODO 1: CA section + * TODO 2: Certificates section + */ + +enum TabSections { + Ca = "certificate-authorities", + Certificates = "certificates" +} + +export const CertificatesPage = withProjectPermission( + () => { + return ( +
+
+

Certificates

+ + + Certificate Authorities + Certificates + + + + + +
Certs
+ {/* */} + + +
+
+ ); + }, + { action: ProjectPermissionActions.Read, subject: ProjectPermissionSub.AuditLogs } +); diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/CaTab.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/CaTab.tsx new file mode 100644 index 000000000..aadca4dfe --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/CaTab.tsx @@ -0,0 +1,17 @@ +import { motion } from "framer-motion"; + +import { CaSection } from "./components"; + +export const CaTab = () => { + return ( + + + + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx new file mode 100644 index 000000000..b9461c6bb --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx @@ -0,0 +1,346 @@ +// import { useEffect } from "react"; +import { Controller, useForm } from "react-hook-form"; +// import { yupResolver } from "@hookform/resolvers/yup"; +// import * as yup from "yup"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { z } from "zod"; + +import { createNotification } from "@app/components/notifications"; +import { + Button, + FormControl, + Input, + Modal, + ModalContent, + Select, + SelectItem +} from "@app/components/v2"; +import { useWorkspace } from "@app/context"; +import { CertificateAuthorityType, useCreateCa } from "@app/hooks/api/ca"; +// import { useCreateIdentity, useGetOrgRoles, useUpdateIdentity } from "@app/hooks/api"; +import { UsePopUpState } from "@app/hooks/usePopUp"; + +const schema = z + .object({ + type: z.enum(["root", "intermediate"]), // move to ref enum of hooks/api + organization: z.string(), + ou: z.string(), + country: z.string(), + province: z.string(), + locality: z.string(), + commonName: z.string() + }) + .required(); + +export type FormData = z.infer; + +type Props = { + popUp: UsePopUpState<["ca"]>; + // handlePopUpOpen: ( + // popUpName: keyof UsePopUpState<["identityAuthMethod"]>, + // data: { + // identityId: string; + // name: string; + // authMethod?: IdentityAuthMethod; + // } + // ) => void; + handlePopUpToggle: (popUpName: keyof UsePopUpState<["ca"]>, state?: boolean) => void; +}; + +const caTypes = [ + { label: "Root", value: CertificateAuthorityType.ROOT }, + { label: "intermediate", value: CertificateAuthorityType.INTERMEDIATE } +]; + +export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { + const { currentWorkspace } = useWorkspace(); + console.log("CaModal currentWorkspace: ", currentWorkspace); + + const { mutateAsync: createMutateAsync } = useCreateCa(); + // const { data: roles } = useGetOrgRoles(orgId); + // const { mutateAsync: createMutateAsync } = useCreateIdentity(); + // const { mutateAsync: updateMutateAsync } = useUpdateIdentity(); + // const { mutateAsync: addMutateAsync } = useAddIdentityUniversalAuth(); + + const { + control, + handleSubmit, + reset, + formState: { isSubmitting } + } = useForm({ + resolver: zodResolver(schema), + defaultValues: { + type: CertificateAuthorityType.ROOT, + organization: "", + ou: "", + country: "", + province: "", + locality: "", + commonName: "" + } + }); + + // useEffect(() => { + // const identity = popUp?.identity?.data as { + // identityId: string; + // name: string; + // role: string; + // customRole: { + // name: string; + // slug: string; + // }; + // }; + + // if (!roles?.length) return; + + // if (identity) { + // reset({ + // name: identity.name, + // role: identity?.customRole?.slug ?? identity.role + // }); + // } else { + // reset({ + // name: "", + // role: roles[0].slug + // }); + // } + // }, [popUp?.identity?.data, roles]); + + const onFormSubmit = async ({ + type, + commonName, + organization, + ou, + country, + locality, + province + }: FormData) => { + try { + console.log("onFormSubmit args: ", { + commonName, + organization, + ou, + country, + locality, + province + }); + + if (!currentWorkspace?.slug) return; + + await createMutateAsync({ + projectSlug: currentWorkspace.slug, + type, + commonName, + organization, + ou, + country, + province, + locality + }); + + // const identity = popUp?.identity?.data as { + // identityId: string; + // name: string; + // role: string; + // }; + + // if (identity) { + // // update + + // await updateMutateAsync({ + // identityId: identity.identityId, + // name, + // role: role || undefined, + // organizationId: orgId + // }); + + // handlePopUpToggle("identity", false); + // } else { + // // create + + // const { + // id: createdId, + // name: createdName, + // authMethod + // } = await createMutateAsync({ + // name, + // role: role || undefined, + // organizationId: orgId + // }); + + // await addMutateAsync({ + // organizationId: orgId, + // identityId: createdId, + // clientSecretTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }], + // accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }], + // accessTokenTTL: 2592000, + // accessTokenMaxTTL: 2592000, + // accessTokenNumUsesLimit: 0 + // }); + + // handlePopUpToggle("identity", false); + // handlePopUpOpen("identityAuthMethod", { + // identityId: createdId, + // name: createdName, + // authMethod + // }); + // } + + createNotification({ + text: `Successfully ${popUp?.ca?.data ? "updated" : "created"} CA`, + type: "success" + }); + + reset(); + } catch (err) { + console.error(err); + const error = err as any; + const text = + error?.response?.data?.message ?? `Failed to ${popUp?.ca?.data ? "update" : "create"} CA`; + + createNotification({ + text, + type: "error" + }); + } + }; + + return ( + { + handlePopUpToggle("ca", isOpen); + reset(); + }} + > + +
+ ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> +
+ + +
+ +
+ + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx new file mode 100644 index 000000000..b28c8be6c --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx @@ -0,0 +1,141 @@ +// import { useState } from "react"; +import { faPlus } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + +// import { createNotification } from "@app/components/notifications"; +// import { OrgPermissionCan } from "@app/components/permissions"; +import { + Button + // DeleteActionModal, + // EmailServiceSetupModal, + // UpgradePlanModal +} from "@app/components/v2"; +// import { +// OrgPermissionActions, +// OrgPermissionSubjects, +// useOrganization, +// useSubscription +// } from "@app/context"; +// import { useDeleteOrgMembership } from "@app/hooks/api"; +import { usePopUp } from "@app/hooks/usePopUp"; + +import { CaModal } from "./CaModal"; +import { CaTable } from "./CaTable"; +// import { AddOrgMemberModal } from "./AddOrgMemberModal"; +// import { OrgMembersTable } from "./OrgMembersTable"; + +export const CaSection = () => { + // const { subscription } = useSubscription(); + // const { currentOrg } = useOrganization(); + // const orgId = currentOrg?.id ?? ""; + + // const [completeInviteLink, setCompleteInviteLink] = useState(""); + + const { + popUp, + handlePopUpOpen, + // handlePopUpClose, + handlePopUpToggle + } = usePopUp(["ca"] as const); + + // const { mutateAsync: deleteMutateAsync } = useDeleteOrgMembership(); + + // const isMoreUsersNotAllowed = subscription?.memberLimit + // ? subscription.membersUsed >= subscription.memberLimit + // : false; + + // const handleAddMemberModal = () => { + // if (currentOrg?.authEnforced) { + // createNotification({ + // text: "You cannot manage users from Infisical when org-level auth is enforced for your organization", + // type: "error" + // }); + // return; + // } + + // if (isMoreUsersNotAllowed) { + // handlePopUpOpen("upgradePlan", { + // description: "You can add more members if you upgrade your Infisical plan." + // }); + // } else { + // handlePopUpOpen("addMember"); + // } + // }; + + // const onRemoveMemberSubmit = async (orgMembershipId: string) => { + // try { + // await deleteMutateAsync({ + // orgId, + // membershipId: orgMembershipId + // }); + + // createNotification({ + // text: "Successfully removed user from org", + // type: "success" + // }); + // } catch (err) { + // console.error(err); + // createNotification({ + // text: "Failed to remove user from the organization", + // type: "error" + // }); + // } + + // handlePopUpClose("removeMember"); + // }; + + return ( +
+
+

Certificate Authorities

+ {/* + {(isAllowed) => ( */} + + {/* )} */} + {/* */} +
+ + + {/* + + handlePopUpToggle("removeMember", isOpen)} + deleteKey="confirm" + onDeleteApproved={() => + onRemoveMemberSubmit( + (popUp?.removeMember?.data as { orgMembershipId: string })?.orgMembershipId + ) + } + /> + handlePopUpToggle("upgradePlan", isOpen)} + text={(popUp.upgradePlan?.data as { description: string })?.description} + /> + handlePopUpToggle("setUpEmail", isOpen)} + /> */} +
+ ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx new file mode 100644 index 000000000..992c3046e --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx @@ -0,0 +1,54 @@ +import { faCertificate } from "@fortawesome/free-solid-svg-icons"; + +import { + EmptyState, + Table, + TableContainer, + TableSkeleton, + TBody, + Td, + Th, + THead, + Tr +} from "@app/components/v2"; +import { useWorkspace } from "@app/context"; +import { useListWorkspaceCas } from "@app/hooks/api"; +import { caTypeToNameMap } from "@app/hooks/api/ca/constants"; + +export const CaTable = () => { + const { currentWorkspace } = useWorkspace(); + const { data, isLoading } = useListWorkspaceCas(currentWorkspace?.slug ?? ""); + return ( +
+ + + + + + + + + + + {isLoading && } + {!isLoading && + data && + data.length > 0 && + data.map((ca) => { + return ( + + + + + + ); + })} + +
SubjectStatusType
{ca.dn}Pending{caTypeToNameMap[ca.type]}
+ {!isLoading && data?.length === 0 && ( + + )} + +
+ ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/index.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/index.tsx new file mode 100644 index 000000000..1f23813bc --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/index.tsx @@ -0,0 +1 @@ +export { CaSection } from "./CaSection"; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/index.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/index.tsx new file mode 100644 index 000000000..9e52be028 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/index.tsx @@ -0,0 +1 @@ +export { CaTab } from "./CaTab"; diff --git a/frontend/src/views/Project/CertificatesPage/components/index.tsx b/frontend/src/views/Project/CertificatesPage/components/index.tsx new file mode 100644 index 000000000..9e52be028 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/index.tsx @@ -0,0 +1 @@ +export { CaTab } from "./CaTab"; diff --git a/frontend/src/views/Project/CertificatesPage/index.tsx b/frontend/src/views/Project/CertificatesPage/index.tsx new file mode 100644 index 000000000..a72556644 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/index.tsx @@ -0,0 +1 @@ +export { CertificatesPage } from "./CertificatesPage"; From b8516da90faa48bd987b59b0783c66ad2f206c14 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Tue, 28 May 2024 17:00:48 -0700 Subject: [PATCH 018/187] Continue cert mgmt mvp --- backend/src/@types/fastify.d.ts | 2 + backend/src/@types/knex.d.ts | 20 + .../20240522010055_certificate-authority.ts | 61 ++ .../src/db/schemas/certificate-authorities.ts | 12 +- backend/src/db/schemas/certificate-certs.ts | 21 + backend/src/db/schemas/certificate-secrets.ts | 21 + backend/src/db/schemas/certificates.ts | 22 + backend/src/db/schemas/index.ts | 3 + backend/src/db/schemas/models.ts | 3 + .../services/permission/project-permission.ts | 27 +- backend/src/server/routes/index.ts | 45 +- .../routes/v1/certificate-authority-router.ts | 300 +++++++-- .../server/routes/v1/certificate-router.ts | 113 ++++ backend/src/server/routes/v1/index.ts | 9 +- .../src/server/routes/v2/project-router.ts | 45 +- .../certificate-authority-dal.ts | 39 +- .../certificate-authority-fns.ts | 12 + .../certificate-authority-service.ts | 583 +++++++++++++++--- .../certificate-authority-types.ts | 54 +- .../certificate-authority-validators.ts | 8 + .../certificate/certificate-cert-dal.ts | 10 + .../services/certificate/certificate-dal.ts | 10 + .../certificate/certificate-secret-dal.ts | 10 + .../certificate/certificate-service.ts | 102 +++ .../services/certificate/certificate-types.ts | 13 + .../src/services/project/project-service.ts | 75 ++- backend/src/services/project/project-types.ts | 2 + .../context/ProjectPermissionContext/types.ts | 6 +- frontend/src/hooks/api/ca/constants.tsx | 14 +- frontend/src/hooks/api/ca/enums.tsx | 8 +- frontend/src/hooks/api/ca/index.tsx | 11 +- frontend/src/hooks/api/ca/mutations.tsx | 106 +++- frontend/src/hooks/api/ca/queries.tsx | 54 ++ frontend/src/hooks/api/ca/types.ts | 73 ++- frontend/src/hooks/api/certificates/index.tsx | 2 + .../src/hooks/api/certificates/mutations.tsx | 26 + .../src/hooks/api/certificates/queries.tsx | 40 ++ frontend/src/hooks/api/certificates/types.ts | 7 + frontend/src/hooks/api/index.tsx | 1 + frontend/src/hooks/api/workspace/index.tsx | 1 + frontend/src/hooks/api/workspace/queries.tsx | 46 +- .../pages/project/[id]/certificates/index.tsx | 3 +- .../CertificatesPage/CertificatesPage.tsx | 21 +- .../CaTab/components/CaCertModal.tsx | 109 ++++ .../CaInstallCertModal/CaInstallCertModal.tsx | 328 ++++++++++ .../components/CaInstallCertModal/index.tsx | 1 + .../components/CaTab/components/CaModal.tsx | 328 +++++----- .../components/CaTab/components/CaSection.tsx | 197 +++--- .../components/CaTab/components/CaTable.tsx | 185 +++++- .../CertificatesTab/CertificatesTab.tsx | 17 + .../components/CertificateCertModal.tsx | 135 ++++ .../components/CertificateModal.tsx | 223 +++++++ .../components/CertificatesSection.tsx | 79 +++ .../components/CertificatesTable.tsx | 160 +++++ .../CertificatesTab/components/index.tsx | 1 + .../components/CertificatesTab/index.tsx | 1 + .../CertificatesPage/components/index.tsx | 1 + 57 files changed, 3339 insertions(+), 467 deletions(-) create mode 100644 backend/src/db/schemas/certificate-certs.ts create mode 100644 backend/src/db/schemas/certificate-secrets.ts create mode 100644 backend/src/db/schemas/certificates.ts create mode 100644 backend/src/server/routes/v1/certificate-router.ts create mode 100644 backend/src/services/certificate-authority/certificate-authority-validators.ts create mode 100644 backend/src/services/certificate/certificate-cert-dal.ts create mode 100644 backend/src/services/certificate/certificate-dal.ts create mode 100644 backend/src/services/certificate/certificate-secret-dal.ts create mode 100644 backend/src/services/certificate/certificate-service.ts create mode 100644 backend/src/services/certificate/certificate-types.ts create mode 100644 frontend/src/hooks/api/ca/queries.tsx create mode 100644 frontend/src/hooks/api/certificates/index.tsx create mode 100644 frontend/src/hooks/api/certificates/mutations.tsx create mode 100644 frontend/src/hooks/api/certificates/queries.tsx create mode 100644 frontend/src/hooks/api/certificates/types.ts create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/CaInstallCertModal.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/index.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/CertificatesTab.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/index.tsx create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/index.tsx diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index 38d49a807..a9651e9f7 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -29,6 +29,7 @@ import { TAuthPasswordFactory } from "@app/services/auth/auth-password-service"; import { TAuthSignupFactory } from "@app/services/auth/auth-signup-service"; import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type"; import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service"; +import { TCertificateServiceFactory } from "@app/services/certificate/certificate-service"; import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service"; import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service"; import { TIdentityServiceFactory } from "@app/services/identity/identity-service"; @@ -133,6 +134,7 @@ declare module "fastify" { ldap: TLdapConfigServiceFactory; auditLog: TAuditLogServiceFactory; auditLogStream: TAuditLogStreamServiceFactory; + certificate: TCertificateServiceFactory; certificateAuthority: TCertificateAuthorityServiceFactory; secretScanning: TSecretScanningServiceFactory; license: TLicenseServiceFactory; diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index cd4c9418c..bdc1c7138 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -41,6 +41,15 @@ import { TCertificateAuthoritySk, TCertificateAuthoritySkInsert, TCertificateAuthoritySkUpdate, + TCertificateCerts, + TCertificateCertsInsert, + TCertificateCertsUpdate, + TCertificates, + TCertificateSecrets, + TCertificateSecretsInsert, + TCertificateSecretsUpdate, + TCertificatesInsert, + TCertificatesUpdate, TDynamicSecretLeases, TDynamicSecretLeasesInsert, TDynamicSecretLeasesUpdate, @@ -264,6 +273,17 @@ declare module "knex/types/tables" { TCertificateAuthoritySkInsert, TCertificateAuthoritySkUpdate >; + [TableName.Certificate]: Knex.CompositeTableType; + [TableName.CertificateCert]: Knex.CompositeTableType< + TCertificateCerts, + TCertificateCertsInsert, + TCertificateCertsUpdate + >; + [TableName.CertificateSecret]: Knex.CompositeTableType< + TCertificateSecrets, + TCertificateSecretsInsert, + TCertificateSecretsUpdate + >; [TableName.UserGroupMembership]: Knex.CompositeTableType< TUserGroupMembership, TUserGroupMembershipInsert, diff --git a/backend/src/db/migrations/20240522010055_certificate-authority.ts b/backend/src/db/migrations/20240522010055_certificate-authority.ts index 860fb8a86..6a08878ad 100644 --- a/backend/src/db/migrations/20240522010055_certificate-authority.ts +++ b/backend/src/db/migrations/20240522010055_certificate-authority.ts @@ -14,11 +14,23 @@ export async function up(knex: Knex): Promise { t.string("projectId").notNullable(); t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE"); t.string("type").notNullable(); // root / intermediate + t.string("status").notNullable(); // active / pending-certificate + t.string("organization").notNullable(); + t.string("ou").notNullable(); + t.string("country").notNullable(); + t.string("province").notNullable(); + t.string("locality").notNullable(); + t.string("commonName").notNullable(); t.string("dn").notNullable(); + t.unique(["dn", "projectId"]); + t.integer("maxPathLength").nullable(); + t.datetime("notBefore").nullable(); + t.datetime("notAfter").nullable(); }); } if (!(await knex.schema.hasTable(TableName.CertificateAuthorityCert))) { + // table to keep track of certificates belonging to CA await knex.schema.createTable(TableName.CertificateAuthorityCert, (t) => { t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); t.timestamps(true, true, true); @@ -41,12 +53,61 @@ export async function up(knex: Knex): Promise { }); } + if (!(await knex.schema.hasTable(TableName.Certificate))) { + // TODO: consider adding name + await knex.schema.createTable(TableName.Certificate, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.uuid("caId").notNullable(); + t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE"); + t.string("commonName").notNullable(); + t.datetime("notBefore").notNullable(); + t.datetime("notAfter").notNullable(); + }); + } + + if (!(await knex.schema.hasTable(TableName.CertificateCert))) { + await knex.schema.createTable(TableName.CertificateCert, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.uuid("certId").notNullable().unique(); + t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE"); + t.text("certificate").notNullable(); // TODO: encrypt + t.text("certificateChain").notNullable(); // TODO: encrypt + }); + } + + if (!(await knex.schema.hasTable(TableName.CertificateSecret))) { + await knex.schema.createTable(TableName.CertificateSecret, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.uuid("certId").notNullable().unique(); + t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE"); + t.text("pk").notNullable(); // TODO: encrypt + t.text("sk").notNullable(); // TODO: encrypt + }); + } + await createOnUpdateTrigger(knex, TableName.CertificateAuthority); await createOnUpdateTrigger(knex, TableName.CertificateAuthorityCert); await createOnUpdateTrigger(knex, TableName.CertificateAuthoritySk); + await createOnUpdateTrigger(knex, TableName.Certificate); + await createOnUpdateTrigger(knex, TableName.CertificateCert); + await createOnUpdateTrigger(knex, TableName.CertificateSecret); } export async function down(knex: Knex): Promise { + // certificates + await knex.schema.dropTableIfExists(TableName.CertificateSecret); + await dropOnUpdateTrigger(knex, TableName.CertificateSecret); + + await knex.schema.dropTableIfExists(TableName.CertificateCert); + await dropOnUpdateTrigger(knex, TableName.CertificateCert); + + await knex.schema.dropTableIfExists(TableName.Certificate); + await dropOnUpdateTrigger(knex, TableName.Certificate); + + // certificate authorities await knex.schema.dropTableIfExists(TableName.CertificateAuthoritySk); await dropOnUpdateTrigger(knex, TableName.CertificateAuthoritySk); diff --git a/backend/src/db/schemas/certificate-authorities.ts b/backend/src/db/schemas/certificate-authorities.ts index b49a151c1..da69dd5a5 100644 --- a/backend/src/db/schemas/certificate-authorities.ts +++ b/backend/src/db/schemas/certificate-authorities.ts @@ -14,7 +14,17 @@ export const CertificateAuthoritiesSchema = z.object({ parentCaId: z.string().uuid().nullable().optional(), projectId: z.string(), type: z.string(), - dn: z.string() + status: z.string(), + organization: z.string(), + ou: z.string(), + country: z.string(), + province: z.string(), + locality: z.string(), + commonName: z.string(), + dn: z.string(), + maxPathLength: z.number().nullable().optional(), + notBefore: z.date().nullable().optional(), + notAfter: z.date().nullable().optional() }); export type TCertificateAuthorities = z.infer; diff --git a/backend/src/db/schemas/certificate-certs.ts b/backend/src/db/schemas/certificate-certs.ts new file mode 100644 index 000000000..213cdbf61 --- /dev/null +++ b/backend/src/db/schemas/certificate-certs.ts @@ -0,0 +1,21 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const CertificateCertsSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + certId: z.string().uuid(), + certificate: z.string(), + certificateChain: z.string() +}); + +export type TCertificateCerts = z.infer; +export type TCertificateCertsInsert = Omit, TImmutableDBKeys>; +export type TCertificateCertsUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/certificate-secrets.ts b/backend/src/db/schemas/certificate-secrets.ts new file mode 100644 index 000000000..f8cad74f1 --- /dev/null +++ b/backend/src/db/schemas/certificate-secrets.ts @@ -0,0 +1,21 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const CertificateSecretsSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + certId: z.string().uuid(), + pk: z.string(), + sk: z.string() +}); + +export type TCertificateSecrets = z.infer; +export type TCertificateSecretsInsert = Omit, TImmutableDBKeys>; +export type TCertificateSecretsUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/certificates.ts b/backend/src/db/schemas/certificates.ts new file mode 100644 index 000000000..74486258d --- /dev/null +++ b/backend/src/db/schemas/certificates.ts @@ -0,0 +1,22 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const CertificatesSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + caId: z.string().uuid(), + commonName: z.string(), + notBefore: z.date(), + notAfter: z.date() +}); + +export type TCertificates = z.infer; +export type TCertificatesInsert = Omit, TImmutableDBKeys>; +export type TCertificatesUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index b82f1a992..b18286438 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -11,6 +11,9 @@ export * from "./backup-private-key"; export * from "./certificate-authorities"; export * from "./certificate-authority-certs"; export * from "./certificate-authority-sk"; +export * from "./certificate-certs"; +export * from "./certificate-secrets"; +export * from "./certificates"; export * from "./dynamic-secret-leases"; export * from "./dynamic-secrets"; export * from "./git-app-install-sessions"; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index 46c16eb1a..96bc4b25a 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -5,6 +5,9 @@ export enum TableName { CertificateAuthority = "certificate_authorities", CertificateAuthorityCert = "certificate_authority_certs", CertificateAuthoritySk = "certificate_authority_sk", + Certificate = "certificates", + CertificateCert = "certificate_certs", + CertificateSecret = "certificate_secrets", Groups = "groups", GroupProjectMembership = "group_project_memberships", GroupProjectMembershipRole = "group_project_membership_roles", diff --git a/backend/src/ee/services/permission/project-permission.ts b/backend/src/ee/services/permission/project-permission.ts index b24024bd4..4853faf61 100644 --- a/backend/src/ee/services/permission/project-permission.ts +++ b/backend/src/ee/services/permission/project-permission.ts @@ -26,7 +26,9 @@ export enum ProjectPermissionSub { SecretRollback = "secret-rollback", SecretApproval = "secret-approval", SecretRotation = "secret-rotation", - Identity = "identity" + Identity = "identity", + CertificateAuthorities = "certificate-authorities", + Certificates = "certificates" } type SubjectFields = { @@ -53,6 +55,8 @@ export type ProjectPermissionSet = | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval] | [ProjectPermissionActions, ProjectPermissionSub.SecretRotation] | [ProjectPermissionActions, ProjectPermissionSub.Identity] + | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities] + | [ProjectPermissionActions, ProjectPermissionSub.Certificates] | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project] | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project] | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback] @@ -139,6 +143,17 @@ const buildAdminPermissionRules = () => { can(ProjectPermissionActions.Edit, ProjectPermissionSub.IpAllowList); can(ProjectPermissionActions.Delete, ProjectPermissionSub.IpAllowList); + // double check if all CRUD are needed for CA and Certificates + can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities); + can(ProjectPermissionActions.Create, ProjectPermissionSub.CertificateAuthorities); + can(ProjectPermissionActions.Edit, ProjectPermissionSub.CertificateAuthorities); + can(ProjectPermissionActions.Delete, ProjectPermissionSub.CertificateAuthorities); + + can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Edit, ProjectPermissionSub.Project); can(ProjectPermissionActions.Delete, ProjectPermissionSub.Project); @@ -205,6 +220,14 @@ const buildMemberPermissionRules = () => { can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs); can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList); + // double check if all CRUD are needed for CA and Certificates + can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities); + + can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates); + can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates); + return rules; }; @@ -229,6 +252,8 @@ const buildViewerPermissionRules = () => { can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags); can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs); can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList); + can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities); + can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); return rules; }; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 2f8ef02de..f0253ce67 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -71,8 +71,11 @@ import { authPaswordServiceFactory } from "@app/services/auth/auth-password-serv import { authSignupServiceFactory } from "@app/services/auth/auth-signup-service"; import { tokenDALFactory } from "@app/services/auth-token/auth-token-dal"; import { tokenServiceFactory } from "@app/services/auth-token/auth-token-service"; +import { certificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; +import { certificateDALFactory } from "@app/services/certificate/certificate-dal"; +import { certificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal"; +import { certificateServiceFactory } from "@app/services/certificate/certificate-service"; import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; -// ca / certs import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service"; import { certificateAuthoritySkDALFactory } from "@app/services/certificate-authority/certificate-authority-sk-dal"; @@ -226,16 +229,6 @@ export const registerRoutes = async ( const trustedIpDAL = trustedIpDALFactory(db); const telemetryDAL = telemetryDALFactory(db); - const certificateAuthorityDAL = certificateAuthorityDALFactory(db); - const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db); - const certificateAuthoritySkDAL = certificateAuthoritySkDALFactory(db); - const certificateAuthorityService = certificateAuthorityServiceFactory({ - certificateAuthorityDAL, - certificateAuthorityCertDAL, - certificateAuthoritySkDAL, - projectDAL - }); - // ee db layer ops const permissionDAL = permissionDALFactory(db); const samlConfigDAL = samlConfigDALFactory(db); @@ -503,6 +496,34 @@ export const registerRoutes = async ( projectUserMembershipRoleDAL }); + const certificateAuthorityDAL = certificateAuthorityDALFactory(db); + const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db); + const certificateAuthoritySkDAL = certificateAuthoritySkDALFactory(db); + + const certificateDAL = certificateDALFactory(db); + const certificateCertDAL = certificateCertDALFactory(db); + const certificateSecretDAL = certificateSecretDALFactory(db); + + const certificateService = certificateServiceFactory({ + certificateDAL, + certificateCertDAL, + certificateSecretDAL, + certificateAuthorityDAL, + certificateAuthorityCertDAL, + permissionService + }); + + const certificateAuthorityService = certificateAuthorityServiceFactory({ + certificateAuthorityDAL, + certificateAuthorityCertDAL, + certificateAuthoritySkDAL, + certificateDAL, + certificateCertDAL, + certificateSecretDAL, + projectDAL, + permissionService + }); + const projectService = projectServiceFactory({ permissionService, projectDAL, @@ -520,6 +541,7 @@ export const registerRoutes = async ( folderDAL, licenseService, certificateAuthorityDAL, + certificateDAL, projectUserMembershipRoleDAL, identityProjectMembershipRoleDAL, keyStore @@ -842,6 +864,7 @@ export const registerRoutes = async ( ldap: ldapService, auditLog: auditLogService, auditLogStream: auditLogStreamService, + certificate: certificateService, certificateAuthority: certificateAuthorityService, secretScanning: secretScanningService, license: licenseService, diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts index bfb670ac3..facd70a54 100644 --- a/backend/src/server/routes/v1/certificate-authority-router.ts +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -4,7 +4,8 @@ import { CertificateAuthoritiesSchema } from "@app/db/schemas"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; -import { CAType } from "@app/services/certificate-authority/certificate-authority-types"; +import { CaStatus, CaType } from "@app/services/certificate-authority/certificate-authority-types"; +import { validateCaDateField } from "@app/services/certificate-authority/certificate-authority-validators"; export const registerCaRouter = async (server: FastifyZodProvider) => { server.route({ @@ -16,18 +17,38 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { description: "Create CA", - body: z.object({ - projectSlug: z.string().trim(), - type: z.enum([CAType.ROOT, CAType.INTERMEDIATE]), - commonName: z.string().trim(), - organization: z.string().trim(), - ou: z.string().trim(), - country: z.string().trim(), - province: z.string().trim(), - locality: z.string().trim() - }), + body: z + .object({ + projectSlug: z.string().trim(), + type: z.enum([CaType.ROOT, CaType.INTERMEDIATE]), + commonName: z.string().trim(), + organization: z.string().trim(), + ou: z.string().trim(), + country: z.string().trim(), + province: z.string().trim(), + locality: z.string().trim(), + // format: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format + notBefore: validateCaDateField.optional(), + notAfter: validateCaDateField.optional(), + maxPathLength: z.number().min(-1).optional() + }) + .refine( + (data) => { + // Check that at least one of the specified fields is non-empty + return [data.commonName, data.organization, data.ou, data.country, data.province, data.locality].some( + (field) => field !== "" + ); + }, + { + message: + "At least one of the fields commonName, organization, ou, country, province, or locality must be non-empty", + path: [] + } + ), response: { - 200: CertificateAuthoritiesSchema + 200: z.object({ + ca: CertificateAuthoritiesSchema + }) } }, handler: async (req) => { @@ -38,7 +59,109 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, ...req.body }); - return ca; + return { + ca + }; + } + }); + + server.route({ + method: "GET", + url: "/:caId", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Get CA", + params: z.object({ + caId: z.string().trim() + }), + response: { + 200: z.object({ + ca: CertificateAuthoritiesSchema + }) + } + }, + handler: async (req) => { + const ca = await server.services.certificateAuthority.getCaById({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + ca + }; + } + }); + + server.route({ + method: "PATCH", + url: "/:caId", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Update CA", + params: z.object({ + caId: z.string().trim() + }), + body: z.object({ + status: z.enum([CaStatus.ACTIVE, CaStatus.DISABLED]).optional() + }), + response: { + 200: z.object({ + ca: CertificateAuthoritiesSchema + }) + } + }, + handler: async (req) => { + const ca = await server.services.certificateAuthority.updateCaById({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + ...req.body + }); + return { + ca + }; + } + }); + + server.route({ + method: "DELETE", + url: "/:caId", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Delete CA", + params: z.object({ + caId: z.string().trim() + }), + response: { + 200: z.object({ + ca: CertificateAuthoritiesSchema + }) + } + }, + handler: async (req) => { + const ca = await server.services.certificateAuthority.deleteCaById({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + ca + }; } }); @@ -76,7 +199,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { server.route({ method: "GET", - url: ":caId/certificate", + url: "/:caId/certificate", config: { rateLimit: readLimit }, @@ -89,12 +212,13 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { response: { 200: z.object({ certificate: z.string(), - certificateChain: z.string() + certificateChain: z.string(), + serialNumber: z.string() }) } }, handler: async (req) => { - const { certificate, certificateChain } = await server.services.certificateAuthority.getCaCert({ + const { certificate, certificateChain, serialNumber } = await server.services.certificateAuthority.getCaCert({ caId: req.params.caId, actor: req.permission.type, actorId: req.permission.id, @@ -103,49 +227,155 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { }); return { certificate, - certificateChain + certificateChain, + serialNumber }; } }); server.route({ method: "POST", - url: ":caId/issue-certificate", + url: "/:caId/sign-intermediate", config: { - rateLimit: readLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { - description: "Issue (leaf) certificate from CA", + description: "Create intermediate CA certificate from parent CA", params: z.object({ caId: z.string().trim() }), body: z.object({ csr: z.string().trim(), - notBefore: z.string().trim(), - notAfter: z.string().trim() + notBefore: validateCaDateField.optional(), + notAfter: validateCaDateField, + maxPathLength: z.number().min(-1).default(-1) }), response: { 200: z.object({ - certificateId: z.string().trim() + certificate: z.string().trim(), + certificateChain: z.string().trim(), + issuingCaCertificate: z.string().trim(), + serialNumber: z.string().trim() }) } }, - handler: async () => { - // await server.services.certificateAuthority.issueCertFromCa({ - // caId: req.params.caId, - // actor: req.permission.type, - // actorId: req.permission.id, - // actorAuthMethod: req.permission.authMethod, - // actorOrgId: req.permission.orgId, - // ...req.body - // }); + handler: async (req) => { + const { certificate, certificateChain, issuingCaCertificate, serialNumber } = + await server.services.certificateAuthority.signIntermediate({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + ...req.body + }); return { - certificateId: "111" + certificate, + certificateChain, + issuingCaCertificate, + serialNumber }; } }); - // TODO 2: logic for creating intermediary ca - // TODO 1: get certificate + certificate chain for the root and intermediary CA GET /ca/:caId/certificate + server.route({ + method: "POST", + url: "/:caId/import-certificate", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Import certificate and chain to CA", + params: z.object({ + caId: z.string().trim() + }), + body: z.object({ + certificate: z.string().trim(), + certificateChain: z.string().trim() + }), + response: { + 200: z.object({ + message: z.string().trim(), + caId: z.string().trim() + }) + } + }, + handler: async (req) => { + await server.services.certificateAuthority.importCertToCa({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + ...req.body + }); + + return { + message: "Successfully imported certificate to CA", + caId: req.params.caId + }; + } + }); + + server.route({ + method: "POST", + url: "/:caId/issue-certificate", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Issue certificate from CA", + params: z.object({ + caId: z.string().trim() + }), + body: z + .object({ + commonName: z.string().trim().min(1), + ttl: z.number().int().min(0).optional(), + notBefore: validateCaDateField.optional(), + notAfter: validateCaDateField.optional() + }) + .refine( + (data) => { + const { ttl, notAfter } = data; + return (ttl !== undefined && notAfter === undefined) || (ttl === undefined && notAfter !== undefined); + }, + { + message: "Either ttl or notAfter must be present, but not both", + path: ["ttl", "notAfter"] + } + ), + response: { + 200: z.object({ + certificate: z.string().trim(), + issuingCaCertificate: z.string().trim(), + certificateChain: z.string().trim(), + privateKey: z.string().trim(), + serialNumber: z.string().trim() + }) + } + }, + handler: async (req) => { + const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } = + await server.services.certificateAuthority.issueCertFromCa({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + ...req.body + }); + + return { + certificate, + certificateChain, + issuingCaCertificate, + privateKey, + serialNumber + }; + } + }); }; diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts new file mode 100644 index 000000000..37714c067 --- /dev/null +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -0,0 +1,113 @@ +import { z } from "zod"; + +import { CertificatesSchema } from "@app/db/schemas"; +import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; +import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { AuthMode } from "@app/services/auth/auth-type"; + +export const registerCertRouter = async (server: FastifyZodProvider) => { + server.route({ + method: "GET", + url: "/:certId", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Get certificate", + params: z.object({ + certId: z.string().trim() + }), + response: { + 200: z.object({ + certificate: CertificatesSchema + }) + } + }, + handler: async (req) => { + const certificate = await server.services.certificate.getCertById({ + certId: req.params.certId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + certificate + }; + } + }); + + server.route({ + method: "DELETE", + url: "/:certId", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Delete certificate", + params: z.object({ + certId: z.string().trim() + }), + response: { + 200: z.object({ + certificate: CertificatesSchema + }) + } + }, + handler: async (req) => { + const certificate = await server.services.certificate.deleteCertById({ + certId: req.params.certId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + certificate + }; + } + }); + + server.route({ + method: "GET", + url: "/:certId/certificate", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Get certificate of certificate", + params: z.object({ + certId: z.string().trim() + }), + response: { + 200: z.object({ + certificate: z.string().trim(), + certificateChain: z.string().trim(), + issuingCaCertificate: z.string().trim(), + privateKey: z.string().trim(), + serialNumber: z.string().trim() + }) + } + }, + handler: async (req) => { + const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } = + await server.services.certificate.getCertCert({ + certId: req.params.certId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + certificate, + certificateChain, + issuingCaCertificate, + privateKey, + serialNumber + }; + } + }); +}; diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts index 72439cd10..61ef947ac 100644 --- a/backend/src/server/routes/v1/index.ts +++ b/backend/src/server/routes/v1/index.ts @@ -2,6 +2,7 @@ import { registerAdminRouter } from "./admin-router"; import { registerAuthRoutes } from "./auth-router"; import { registerProjectBotRouter } from "./bot-router"; import { registerCaRouter } from "./certificate-authority-router"; +import { registerCertRouter } from "./certificate-router"; import { registerIdentityAccessTokenRouter } from "./identity-access-token-router"; import { registerIdentityAwsAuthRouter } from "./identity-aws-iam-auth-router"; import { registerIdentityGcpAuthRouter } from "./identity-gcp-auth-router"; @@ -59,12 +60,8 @@ export const registerV1Routes = async (server: FastifyZodProvider) => { { prefix: "/workspace" } ); - await server.register( - async (certRouter) => { - await certRouter.register(registerCaRouter); - }, - { prefix: "/ca" } - ); + await server.register(registerCaRouter, { prefix: "/ca" }); + await server.register(registerCertRouter, { prefix: "/certificates" }); await server.register(registerProjectBotRouter, { prefix: "/bot" }); await server.register(registerIntegrationRouter, { prefix: "/integration" }); diff --git a/backend/src/server/routes/v2/project-router.ts b/backend/src/server/routes/v2/project-router.ts index 3653daae4..1b36a689e 100644 --- a/backend/src/server/routes/v2/project-router.ts +++ b/backend/src/server/routes/v2/project-router.ts @@ -1,13 +1,14 @@ import slugify from "@sindresorhus/slugify"; import { z } from "zod"; -import { CertificateAuthoritiesSchema, ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas"; +import { CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { PROJECTS } from "@app/lib/api-docs"; import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { getTelemetryDistinctId } from "@app/server/lib/telemetry"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; +import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types"; import { ProjectFilterType } from "@app/services/project/project-types"; import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types"; @@ -312,22 +313,58 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { method: "GET", url: "/:slug/cas", config: { - rateLimit: writeLimit + rateLimit: readLimit }, schema: { params: z.object({ slug: slugSchema.describe("The slug of the project to list CAs.") }), + querystring: z.object({ + status: z.enum([CaStatus.ACTIVE, CaStatus.PENDING_CERTIFICATE]).optional() + }), response: { 200: z.object({ cas: z.array(CertificateAuthoritiesSchema) }) } }, - onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const cas = await server.services.project.listProjectCas({ + filter: { + slug: req.params.slug, + orgId: req.permission.orgId, + type: ProjectFilterType.SLUG + }, + status: req.query.status, + actorId: req.permission.id, + actorOrgId: req.permission.orgId, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type + }); + return { cas }; + } + }); + + server.route({ + method: "GET", + url: "/:slug/certificates", + config: { + rateLimit: readLimit + }, + schema: { + params: z.object({ + slug: slugSchema.describe("The slug of the project to list certificates.") + }), + response: { + 200: z.object({ + certificates: z.array(CertificatesSchema) + }) + } + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + handler: async (req) => { + const certificates = await server.services.project.listProjectCertificates({ filter: { slug: req.params.slug, orgId: req.permission.orgId, @@ -338,7 +375,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { actorAuthMethod: req.permission.authMethod, actor: req.permission.type }); - return { cas }; + return { certificates }; } }); }; diff --git a/backend/src/services/certificate-authority/certificate-authority-dal.ts b/backend/src/services/certificate-authority/certificate-authority-dal.ts index 40d868560..3ad70bbdc 100644 --- a/backend/src/services/certificate-authority/certificate-authority-dal.ts +++ b/backend/src/services/certificate-authority/certificate-authority-dal.ts @@ -1,10 +1,47 @@ import { TDbClient } from "@app/db"; import { TableName } from "@app/db/schemas"; +import { DatabaseError } from "@app/lib/errors"; import { ormify } from "@app/lib/knex"; export type TCertificateAuthorityDALFactory = ReturnType; export const certificateAuthorityDALFactory = (db: TDbClient) => { const caOrm = ormify(db, TableName.CertificateAuthority); - return caOrm; + + const buildCertificateChain = async (caId: string) => { + try { + const result: { + caId: string; + parentCaId?: string; + certificate: string; + }[] = await db + .withRecursive("cte", (cte) => { + void cte + .select("ca.id as caId", "ca.parentCaId", "cert.certificate") + .from({ ca: TableName.CertificateAuthority }) + .leftJoin({ cert: TableName.CertificateAuthorityCert }, "ca.id", "cert.caId") + .where("ca.id", caId) + .unionAll((builder) => { + void builder + .select("ca.id as caId", "ca.parentCaId", "cert.certificate") + .from({ ca: TableName.CertificateAuthority }) + .leftJoin({ cert: TableName.CertificateAuthorityCert }, "ca.id", "cert.caId") + .innerJoin("cte", "cte.parentCaId", "ca.id"); + }); + }) + .select("*") + .from("cte"); + + // Extract certificates and reverse the order to have the root CA at the end + const certChain: string[] = result.map((row) => row.certificate); + return certChain; + } catch (error) { + throw new DatabaseError({ error, name: "BuildCertificateChain" }); + } + }; + + return { + ...caOrm, + buildCertificateChain + }; }; diff --git a/backend/src/services/certificate-authority/certificate-authority-fns.ts b/backend/src/services/certificate-authority/certificate-authority-fns.ts index e69de29bb..f7157925b 100644 --- a/backend/src/services/certificate-authority/certificate-authority-fns.ts +++ b/backend/src/services/certificate-authority/certificate-authority-fns.ts @@ -0,0 +1,12 @@ +import { TDNParts } from "./certificate-authority-types"; + +export const createDistinguishedName = (parts: TDNParts) => { + const dnParts = []; + if (parts.country) dnParts.push(`C=${parts.country}`); + if (parts.organization) dnParts.push(`O=${parts.organization}`); + if (parts.ou) dnParts.push(`OU=${parts.ou}`); + if (parts.province) dnParts.push(`ST=${parts.province}`); + if (parts.commonName) dnParts.push(`CN=${parts.commonName}`); + if (parts.locality) dnParts.push(`L=${parts.locality}`); + return dnParts.join(", "); +}; diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index ffb4ee187..22c307710 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -1,18 +1,31 @@ +import { ForbiddenError } from "@casl/ability"; import * as x509 from "@peculiar/x509"; import crypto, { KeyObject } from "crypto"; +import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; +import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { BadRequestError } from "@app/lib/errors"; +import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; +import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; +import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal"; import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal"; +import { createDistinguishedName } from "./certificate-authority-fns"; import { TCertificateAuthoritySkDALFactory } from "./certificate-authority-sk-dal"; import { - // TIssueCertFromCaDTO, - CAType, + CaStatus, + CaType, TCreateCaDTO, + TDeleteCaDTO, TGetCaCertDTO, - TGetCaCsrDTO + TGetCaCsrDTO, + TGetCaDTO, + TImportCertToCaDTO, + TIssueCertFromCaDTO, + TSignIntermediateDTO, + TUpdateCaDTO } from "./certificate-authority-types"; type TCertificateAuthorityServiceFactoryDep = { @@ -20,41 +33,27 @@ type TCertificateAuthorityServiceFactoryDep = { certificateAuthorityDAL: TCertificateAuthorityDALFactory; certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory; certificateAuthoritySkDAL: TCertificateAuthoritySkDALFactory; + certificateDAL: TCertificateDALFactory; + certificateCertDAL: TCertificateCertDALFactory; + certificateSecretDAL: TCertificateSecretDALFactory; projectDAL: TProjectDALFactory; + permissionService: TPermissionServiceFactory; }; export type TCertificateAuthorityServiceFactory = ReturnType; -type DNParts = { - commonName?: string; - organization?: string; - ou?: string; - country?: string; - province?: string; - locality?: string; -}; - -function createDistinguishedName(parts: DNParts) { - const dnParts = []; - if (parts.country) dnParts.push(`C=${parts.country}`); - if (parts.organization) dnParts.push(`O=${parts.organization}`); - if (parts.ou) dnParts.push(`OU=${parts.ou}`); - if (parts.province) dnParts.push(`ST=${parts.province}`); - if (parts.commonName) dnParts.push(`CN=${parts.commonName}`); - if (parts.locality) dnParts.push(`L=${parts.locality}`); - return dnParts.join(", "); -} - export const certificateAuthorityServiceFactory = ({ certificateAuthorityDAL, certificateAuthorityCertDAL, certificateAuthoritySkDAL, - projectDAL + certificateDAL, + certificateCertDAL, + certificateSecretDAL, + projectDAL, + permissionService }: TCertificateAuthorityServiceFactoryDep) => { /** * Generates a new root or intermediate CA - * @param param0 - * @returns */ const createCa = async ({ projectSlug, @@ -65,14 +64,30 @@ export const certificateAuthorityServiceFactory = ({ country, province, locality, - // actorId, - // actorAuthMethod, - // actor, + notBefore, + notAfter, + maxPathLength, + actorId, + actorAuthMethod, + actor, actorOrgId }: TCreateCaDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); if (!project) throw new BadRequestError({ message: "Project not found" }); + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + project.id, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + ProjectPermissionSub.CertificateAuthorities + ); + const dn = createDistinguishedName({ commonName, organization, @@ -97,25 +112,41 @@ export const certificateAuthorityServiceFactory = ({ const pk = pkObj.export({ format: "pem", type: "spki" }) as string; const newCa = await certificateAuthorityDAL.transaction(async (tx) => { + const notBeforeDate = notBefore ? new Date(notBefore) : new Date(); + + // if undefined, set [notAfterDate] to 10 years from now + const notAfterDate = notAfter + ? new Date(notAfter) + : new Date(new Date().setFullYear(new Date().getFullYear() + 10)); + const ca = await certificateAuthorityDAL.create( { projectId: project.id, type, - dn + organization, + ou, + country, + province, + locality, + commonName, + status: type === CaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE, + dn, + ...(type === CaType.ROOT && { maxPathLength, notBefore: notBeforeDate, notAfter: notAfterDate }) }, tx ); - if (type === CAType.ROOT) { + if (type === CaType.ROOT) { // note: self-signed cert only applicable for root CA + const cert = await x509.X509CertificateGenerator.createSelfSigned({ name: dn, - notBefore: new Date("2020/01/01"), - notAfter: new Date("2020/01/02"), + notBefore: notBeforeDate, + notAfter: notAfterDate, signingAlgorithm: alg, keys, extensions: [ - new x509.BasicConstraintsExtension(true, 2, true), + new x509.BasicConstraintsExtension(true, maxPathLength === -1 ? undefined : maxPathLength, true), new x509.ExtendedKeyUsageExtension(["1.2.3.4.5.6.7", "2.3.4.5.6.7.8"], true), // eslint-disable-next-line no-bitwise new x509.KeyUsagesExtension(x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true), @@ -148,15 +179,94 @@ export const certificateAuthorityServiceFactory = ({ return newCa; }; + const getCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + ProjectPermissionSub.CertificateAuthorities + ); + + return ca; + }; + + const updateCaById = async ({ caId, status, actorId, actorAuthMethod, actor, actorOrgId }: TUpdateCaDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Edit, + ProjectPermissionSub.CertificateAuthorities + ); + + const updatedCa = await certificateAuthorityDAL.updateById(caId, { status }); + + return updatedCa; + }; + + const deleteCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCaDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Delete, + ProjectPermissionSub.CertificateAuthorities + ); + + const deletedCa = await certificateAuthorityDAL.deleteById(caId); + + return deletedCa; + }; + /** * Generates a CSR for a CA */ - const getCaCsr = async ({ caId }: TGetCaCsrDTO) => { + const getCaCsr = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCsrDTO) => { const ca = await certificateAuthorityDAL.findById(caId); if (!ca) throw new BadRequestError({ message: "CA not found" }); - // TODO: permissioning + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + ProjectPermissionSub.CertificateAuthorities + ); + + if (ca.type === CaType.ROOT) throw new BadRequestError({ message: "Root CA cannot generate CSR" }); const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + if (caCert) throw new BadRequestError({ message: "CA already has a certificate installed" }); + const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id }); const alg = { @@ -176,10 +286,8 @@ export const certificateAuthorityServiceFactory = ({ "verify" ]); - const cert = new x509.X509Certificate(caCert.certificate); - - const csr = await x509.Pkcs10CertificateRequestGenerator.create({ - name: cert.subject || ca.dn, + const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ + name: ca.dn, keys: { privateKey: sk, publicKey: pk }, signingAlgorithm: alg, extensions: [ @@ -189,80 +297,389 @@ export const certificateAuthorityServiceFactory = ({ attributes: [new x509.ChallengePasswordAttribute("password")] }); - return csr.toString("base64"); + return csrObj.toString("pem"); }; /** * Return certificate and certificate chain for CA */ - const getCaCert = async ({ caId }: TGetCaCertDTO) => { + const getCaCert = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCertDTO) => { const ca = await certificateAuthorityDAL.findById(caId); if (!ca) throw new BadRequestError({ message: "CA not found" }); - // TODO: permissioning + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + ProjectPermissionSub.CertificateAuthorities + ); const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + const certObj = new x509.X509Certificate(caCert.certificate); return { certificate: caCert.certificate, - certificateChain: caCert.certificateChain + certificateChain: caCert.certificateChain, + serialNumber: certObj.serialNumber }; }; /** - * Issue new certificate + * Issue certificate to be imported back in for intermediate CA + * TODO: cannot chain to self */ - const issueCertFromCa = async () => { - // WIP: parse publicKey from CSR - // const csrArrayBuffer = Uint8Array.from(atob(csr), (c) => c.charCodeAt(0)); - // const csrR = new x509.Pkcs10CertificateRequest(csrArrayBuffer); + const signIntermediate = async ({ + caId, + actorId, + actorAuthMethod, + actor, + actorOrgId, + csr, + notBefore, + notAfter, + maxPathLength + }: TSignIntermediateDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); - // const ca = await certificateAuthorityDAL.findById(caId); - // if (!ca) throw new BadRequestError({ message: "CA not found" }); - // // TODO: permissioning + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); - // const alg = { - // name: "RSASSA-PKCS1-v1_5", - // hash: "SHA-256", - // publicExponent: new Uint8Array([1, 0, 1]), - // modulusLength: 2048 - // }; + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + ProjectPermissionSub.CertificateAuthorities + ); - // const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); - // const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id }); + if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" }); - // const skObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" }); - // const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [ - // "sign" - // ]); + const alg = { + name: "RSASSA-PKCS1-v1_5", + hash: "SHA-256", + publicExponent: new Uint8Array([1, 0, 1]), + modulusLength: 2048 + }; - // const cert = new x509.X509Certificate(caCert.certificate); + const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id }); - // const leafCert = await x509.X509CertificateGenerator.create({ - // // serialNumber: "03", - // subject: "CN=Leaf", // TODO: make dynamic - // issuer: cert.subject, - // notBefore: new Date(notBefore), - // notAfter: new Date(notAfter), - // signingKey: sk, - // publicKey: leafKeys.publicKey, - // signingAlgorithm: alg, - // extensions: [ - // new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true), - // new x509.BasicConstraintsExtension(false), - // await x509.AuthorityKeyIdentifierExtension.create(cert, false), - // await x509.SubjectKeyIdentifierExtension.create(leafKeys.publicKey) - // ] - // }); + const skObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" }); + const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [ + "sign" + ]); - // console.log("leafCert: ", leafCert); + const certObj = new x509.X509Certificate(caCert.certificate); + const csrObj = new x509.Pkcs10CertificateRequest(csr); - return ""; + // check path length constraint + const caPathLength = certObj.getExtension(x509.BasicConstraintsExtension)?.pathLength; + if (caPathLength !== undefined) { + if (caPathLength === 0) + throw new BadRequestError({ + message: "Failed to issue intermediate certificate due to CA path length constraint" + }); + if (maxPathLength >= caPathLength || (maxPathLength === -1 && caPathLength !== -1)) + throw new BadRequestError({ + message: "The requested path length constraint exceeds the CA's allowed path length" + }); + } + + const notBeforeDate = notBefore ? new Date(notBefore) : new Date(); + const notAfterDate = new Date(notAfter); + + const caCertNotBeforeDate = new Date(certObj.notBefore); + const caCertNotAfterDate = new Date(certObj.notAfter); + + // check not before constraint + if (notBeforeDate < caCertNotBeforeDate) { + throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" }); + } + + if (notBeforeDate > notAfterDate) throw new BadRequestError({ message: "notBefore date is after notAfter date" }); + + // check not after constraint + if (notAfterDate > caCertNotAfterDate) { + throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" }); + } + + const intermediateCert = await x509.X509CertificateGenerator.create({ + // serialNumber: "03", + subject: csrObj.subject, + issuer: certObj.subject, + notBefore: notBeforeDate, + notAfter: notAfterDate, + signingKey: sk, + publicKey: csrObj.publicKey, + signingAlgorithm: alg, + extensions: [ + new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true), + new x509.BasicConstraintsExtension(true, maxPathLength === -1 ? undefined : maxPathLength, true), + await x509.AuthorityKeyIdentifierExtension.create(certObj, false), + await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey) + ] + }); + + const chain = await certificateAuthorityDAL.buildCertificateChain(caId); + + return { + certificate: intermediateCert.toString("pem"), + issuingCaCertificate: caCert.certificate, + certificateChain: chain.join("\n"), + serialNumber: intermediateCert.serialNumber + }; + }; + + const importCertToCa = async ({ + caId, + actorId, + actorAuthMethod, + actor, + actorOrgId, + certificate, + certificateChain + }: TImportCertToCaDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + ProjectPermissionSub.CertificateAuthorities + ); + + const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + if (caCert) throw new BadRequestError({ message: "CA has already imported a certificate" }); + + const certObj = new x509.X509Certificate(certificate); + const maxPathLength = certObj.getExtension(x509.BasicConstraintsExtension)?.pathLength; + + // validate imported certificate and certificate chain + const certificates = certificateChain + .match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) + ?.map((cert) => new x509.X509Certificate(cert)); + + if (!certificates) throw new BadRequestError({ message: "Failed to parse certificate chain" }); + + const chain = new x509.X509ChainBuilder({ + certificates + }); + + const chainItems = await chain.build(certObj); + + // chain.build() implicitly verifies the chain + if (chainItems.length !== certificates.length + 1) + throw new BadRequestError({ message: "Invalid certificate chain" }); + + const parentCertObj = chainItems[1]; + const parentCertSubject = parentCertObj.subject; + + const parentCa = await certificateAuthorityDAL.findOne({ + projectId: ca.projectId, + dn: parentCertSubject + }); + + await certificateAuthorityCertDAL.transaction(async (tx) => { + await certificateAuthorityCertDAL.create( + { + caId: ca.id, + certificate, // TODO: encrypt + certificateChain // TODO: encrypt + }, + tx + ); + + await certificateAuthorityDAL.updateById( + ca.id, + { + status: CaStatus.ACTIVE, + maxPathLength: maxPathLength === undefined ? -1 : maxPathLength, + notBefore: new Date(certObj.notBefore), + notAfter: new Date(certObj.notAfter), + parentCaId: parentCa?.id + }, + tx + ); + }); + }; + + const issueCertFromCa = async ({ + caId, + commonName, + ttl, + notBefore, + notAfter, + actorId, + actorAuthMethod, + actor, + actorOrgId + }: TIssueCertFromCaDTO) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates); + + const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + if (!caCert) throw new BadRequestError({ message: "CA does not have a certificate installed" }); + + if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" }); + + const caCertObj = new x509.X509Certificate(caCert.certificate); + + const alg = { + name: "RSASSA-PKCS1-v1_5", + hash: "SHA-256", + publicExponent: new Uint8Array([1, 0, 1]), + modulusLength: 2048 + }; + + const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id }); + + const caSkObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" }); + const caSk = await crypto.subtle.importKey("pkcs8", caSkObj.export({ format: "der", type: "pkcs8" }), alg, true, [ + "sign" + ]); + + const leafKeys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]); + + const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({ + name: `CN=${commonName}`, + keys: leafKeys, + signingAlgorithm: alg, + extensions: [ + // eslint-disable-next-line no-bitwise + new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment) + ], + attributes: [new x509.ChallengePasswordAttribute("password")] + }); + + const notBeforeDate = notBefore ? new Date(notBefore) : new Date(); + + let notAfterDate = new Date(new Date().setFullYear(new Date().getFullYear() + 1)); + if (notAfter) { + notAfterDate = new Date(notAfter); + } else if (ttl) { + // ttl in seconds + notAfterDate = new Date(new Date().getTime() + ttl * 1000); + } + + const caCertNotBeforeDate = new Date(caCertObj.notBefore); + const caCertNotAfterDate = new Date(caCertObj.notAfter); + + // check not before constraint + if (notBeforeDate < caCertNotBeforeDate) { + throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" }); + } + + if (notBeforeDate > notAfterDate) throw new BadRequestError({ message: "notBefore date is after notAfter date" }); + + // check not after constraint + if (notAfterDate > caCertNotAfterDate) { + throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" }); + } + + const leafCert = await x509.X509CertificateGenerator.create({ + // serialNumber: "03", + subject: csrObj.subject, + issuer: caCertObj.subject, + notBefore: notBeforeDate, + notAfter: notAfterDate, + signingKey: caSk, + publicKey: csrObj.publicKey, + signingAlgorithm: alg, + extensions: [ + new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true), + new x509.BasicConstraintsExtension(false), + await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false), + await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey) + ] + }); + + const skLeafObj = KeyObject.from(leafKeys.privateKey); + const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string; + + const chain = await certificateAuthorityDAL.buildCertificateChain(caId); + + // https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey + const skObj = KeyObject.from(leafKeys.privateKey); + const sk = skObj.export({ format: "pem", type: "pkcs8" }) as string; + const pkObj = KeyObject.from(leafKeys.publicKey); + const pk = pkObj.export({ format: "pem", type: "spki" }) as string; + + await certificateDAL.transaction(async (tx) => { + const cert = await certificateDAL.create( + { + caId: ca.id, + commonName, + notBefore: notBeforeDate, + notAfter: notAfterDate + }, + tx + ); + + await certificateCertDAL.create( + { + certId: cert.id, + certificate: leafCert.toString("pem"), // TODO: encrypt + certificateChain: chain.join("\n") // TODO: encrypt + }, + tx + ); + + await certificateSecretDAL.create( + { + certId: cert.id, + pk, // TODO: encrypt + sk // TODO: encrypt + }, + tx + ); + + return cert; + }); + + return { + certificate: leafCert.toString("pem"), + certificateChain: chain.join("\n"), + issuingCaCertificate: caCert.certificate, + privateKey: skLeaf, + serialNumber: leafCert.serialNumber + }; }; return { createCa, + getCaById, + updateCaById, + deleteCaById, getCaCsr, getCaCert, + signIntermediate, + importCertToCa, issueCertFromCa }; }; diff --git a/backend/src/services/certificate-authority/certificate-authority-types.ts b/backend/src/services/certificate-authority/certificate-authority-types.ts index 0ad259829..5c3a22e35 100644 --- a/backend/src/services/certificate-authority/certificate-authority-types.ts +++ b/backend/src/services/certificate-authority/certificate-authority-types.ts @@ -1,21 +1,43 @@ import { TProjectPermission } from "@app/lib/types"; -export enum CAType { +export enum CaType { ROOT = "root", INTERMEDIATE = "intermediate" } +export enum CaStatus { + ACTIVE = "active", + DISABLED = "disabled", + PENDING_CERTIFICATE = "pending-certificate" +} + // TODO: attach permissions after draft impl export type TCreateCaDTO = { projectSlug: string; - type: CAType; + type: CaType; commonName: string; organization: string; ou: string; country: string; province: string; locality: string; + notBefore?: string; + notAfter?: string; + maxPathLength?: number; +} & Omit; + +export type TGetCaDTO = { + caId: string; +} & Omit; + +export type TUpdateCaDTO = { + caId: string; + status?: CaStatus; +} & Omit; + +export type TDeleteCaDTO = { + caId: string; } & Omit; export type TGetCaCsrDTO = { @@ -26,9 +48,33 @@ export type TGetCaCertDTO = { caId: string; } & Omit; -export type TIssueCertFromCaDTO = { +export type TSignIntermediateDTO = { caId: string; csr: string; - notBefore: string; + notBefore?: string; notAfter: string; + maxPathLength: number; } & Omit; + +export type TImportCertToCaDTO = { + caId: string; + certificate: string; + certificateChain: string; +} & Omit; + +export type TIssueCertFromCaDTO = { + caId: string; + commonName: string; + ttl?: number; + notBefore?: string; + notAfter?: string; +} & Omit; + +export type TDNParts = { + commonName?: string; + organization?: string; + ou?: string; + country?: string; + province?: string; + locality?: string; +}; diff --git a/backend/src/services/certificate-authority/certificate-authority-validators.ts b/backend/src/services/certificate-authority/certificate-authority-validators.ts new file mode 100644 index 000000000..77bf9ad2f --- /dev/null +++ b/backend/src/services/certificate-authority/certificate-authority-validators.ts @@ -0,0 +1,8 @@ +import { z } from "zod"; + +const isValidDate = (dateString: string) => { + const date = new Date(dateString); + return !Number.isNaN(date.getTime()); +}; + +export const validateCaDateField = z.string().trim().refine(isValidDate, { message: "Invalid date format" }); diff --git a/backend/src/services/certificate/certificate-cert-dal.ts b/backend/src/services/certificate/certificate-cert-dal.ts new file mode 100644 index 000000000..b2dd0001b --- /dev/null +++ b/backend/src/services/certificate/certificate-cert-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateCertDALFactory = ReturnType; + +export const certificateCertDALFactory = (db: TDbClient) => { + const certificateCertOrm = ormify(db, TableName.CertificateCert); + return certificateCertOrm; +}; diff --git a/backend/src/services/certificate/certificate-dal.ts b/backend/src/services/certificate/certificate-dal.ts new file mode 100644 index 000000000..2f049fcc8 --- /dev/null +++ b/backend/src/services/certificate/certificate-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateDALFactory = ReturnType; + +export const certificateDALFactory = (db: TDbClient) => { + const certificateOrm = ormify(db, TableName.Certificate); + return certificateOrm; +}; diff --git a/backend/src/services/certificate/certificate-secret-dal.ts b/backend/src/services/certificate/certificate-secret-dal.ts new file mode 100644 index 000000000..bd0394f78 --- /dev/null +++ b/backend/src/services/certificate/certificate-secret-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateSecretDALFactory = ReturnType; + +export const certificateSecretDALFactory = (db: TDbClient) => { + const certificateSecretOrm = ormify(db, TableName.CertificateSecret); + return certificateSecretOrm; +}; diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts new file mode 100644 index 000000000..98cb46d24 --- /dev/null +++ b/backend/src/services/certificate/certificate-service.ts @@ -0,0 +1,102 @@ +import { ForbiddenError } from "@casl/ability"; +import * as x509 from "@peculiar/x509"; + +import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; +import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; +import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; +import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; +import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal"; +import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; +import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; + +import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO } from "./certificate-types"; + +type TCertificateServiceFactoryDep = { + // TODO: Pick + certificateDAL: TCertificateDALFactory; + certificateCertDAL: TCertificateCertDALFactory; + certificateSecretDAL: TCertificateSecretDALFactory; + certificateAuthorityDAL: TCertificateAuthorityDALFactory; + certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory; + permissionService: TPermissionServiceFactory; +}; + +export type TCertificateServiceFactory = ReturnType; + +export const certificateServiceFactory = ({ + certificateDAL, + certificateCertDAL, + certificateSecretDAL, + certificateAuthorityDAL, + certificateAuthorityCertDAL, + permissionService +}: TCertificateServiceFactoryDep) => { + const getCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => { + const cert = await certificateDAL.findById(certId); + const ca = await certificateAuthorityDAL.findById(cert.caId); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); + + return cert; + }; + + const deleteCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => { + const cert = await certificateDAL.findById(certId); + const ca = await certificateAuthorityDAL.findById(cert.caId); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates); + + const deletedCert = await certificateDAL.deleteById(cert.id); + return deletedCert; + }; + + const getCertCert = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => { + const cert = await certificateDAL.findById(certId); + const ca = await certificateAuthorityDAL.findById(cert.caId); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + // TODO: re-evaluate this permission + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates); + + const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + const certCert = await certificateCertDAL.findOne({ certId }); + const certSecret = await certificateSecretDAL.findOne({ certId }); + const certObj = new x509.X509Certificate(certCert.certificate); + + return { + certificate: certCert.certificate, + certificateChain: certCert.certificateChain, + issuingCaCertificate: caCert.certificate, + privateKey: certSecret.sk, + serialNumber: certObj.serialNumber + }; + }; + + return { + getCertById, + deleteCertById, + getCertCert + }; +}; diff --git a/backend/src/services/certificate/certificate-types.ts b/backend/src/services/certificate/certificate-types.ts new file mode 100644 index 000000000..1389896c6 --- /dev/null +++ b/backend/src/services/certificate/certificate-types.ts @@ -0,0 +1,13 @@ +import { TProjectPermission } from "@app/lib/types"; + +export type TGetCertDTO = { + certId: string; +} & Omit; + +export type TDeleteCertDTO = { + certId: string; +} & Omit; + +export type TGetCertCertDTO = { + certId: string; +} & Omit; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 64f2bf7ac..961a57985 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -16,6 +16,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TProjectPermission } from "@app/lib/types"; import { ActorType } from "../auth/auth-type"; +import { TCertificateDALFactory } from "../certificate/certificate-dal"; import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal"; import { TIdentityOrgDALFactory } from "../identity/identity-org-dal"; import { TIdentityProjectDALFactory } from "../identity-project/identity-project-dal"; @@ -51,6 +52,7 @@ export const DEFAULT_PROJECT_ENVS = [ ]; type TProjectServiceFactoryDep = { + // TODO: Pick projectDAL: TProjectDALFactory; projectQueue: TProjectQueueFactory; userDAL: TUserDALFactory; @@ -65,6 +67,7 @@ type TProjectServiceFactoryDep = { projectUserMembershipRoleDAL: Pick; secretBlindIndexDAL: Pick; certificateAuthorityDAL: Pick; + certificateDAL: TCertificateDALFactory; permissionService: TPermissionServiceFactory; orgService: Pick; licenseService: Pick; @@ -93,6 +96,7 @@ export const projectServiceFactory = ({ projectUserMembershipRoleDAL, identityProjectMembershipRoleDAL, certificateAuthorityDAL, + certificateDAL, keyStore }: TProjectServiceFactoryDep) => { /* @@ -500,24 +504,66 @@ export const projectServiceFactory = ({ * Return list of CAs for project */ const listProjectCas = async ({ - // actorId, - // actorOrgId, - // actorAuthMethod, - filter // actor + status, + actorId, + actorOrgId, + actorAuthMethod, + filter, + actor }: TListProjectCasDTO) => { const project = await projectDAL.findProjectByFilter(filter); - // const { permission } = await permissionService.getProjectPermission( - // actor, - // actorId, - // project.id, - // actorAuthMethod, - // actorOrgId - // ); - // TODO: add permissioning + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + project.id, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + ProjectPermissionSub.CertificateAuthorities + ); + + const cas = await certificateAuthorityDAL.find({ + projectId: project.id, + ...(status && { status }) + }); + + return cas; + }; + + /** + * Return list of certificates for project + */ + const listProjectCertificates = async ({ + actorId, + actorOrgId, + actorAuthMethod, + filter, + actor + }: TListProjectCasDTO) => { + const project = await projectDAL.findProjectByFilter(filter); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + project.id, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); const cas = await certificateAuthorityDAL.find({ projectId: project.id }); - return cas; + + const certificates = await certificateDAL.find({ + $in: { + caId: cas.map((ca) => ca.id) + } + }); + return certificates; }; return { @@ -530,6 +576,7 @@ export const projectServiceFactory = ({ toggleAutoCapitalization, updateName, upgradeProject, - listProjectCas + listProjectCas, + listProjectCertificates }; }; diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts index f6268a93e..e04d3663f 100644 --- a/backend/src/services/project/project-types.ts +++ b/backend/src/services/project/project-types.ts @@ -2,6 +2,7 @@ import { ProjectMembershipRole, TProjectKeys } from "@app/db/schemas"; import { TProjectPermission } from "@app/lib/types"; import { ActorAuthMethod, ActorType } from "../auth/auth-type"; +import { CaStatus } from "../certificate-authority/certificate-authority-types"; export enum ProjectFilterType { ID = "id", @@ -77,5 +78,6 @@ export type AddUserToWsDTO = { }; export type TListProjectCasDTO = { + status?: CaStatus; filter: Filter; } & Omit; diff --git a/frontend/src/context/ProjectPermissionContext/types.ts b/frontend/src/context/ProjectPermissionContext/types.ts index 79c8f2d30..113aaff19 100644 --- a/frontend/src/context/ProjectPermissionContext/types.ts +++ b/frontend/src/context/ProjectPermissionContext/types.ts @@ -24,7 +24,9 @@ export enum ProjectPermissionSub { SecretRollback = "secret-rollback", SecretApproval = "secret-approval", SecretRotation = "secret-rotation", - Identity = "identity" + Identity = "identity", + CertificateAuthorities = "certificate-authorities", + Certificates = "certificates" } type SubjectFields = { @@ -51,6 +53,8 @@ export type ProjectPermissionSet = | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens] | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval] | [ProjectPermissionActions, ProjectPermissionSub.SecretRotation] + | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities] + | [ProjectPermissionActions, ProjectPermissionSub.Certificates] | [ProjectPermissionActions.Delete, ProjectPermissionSub.Workspace] | [ProjectPermissionActions.Edit, ProjectPermissionSub.Workspace] | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback] diff --git a/frontend/src/hooks/api/ca/constants.tsx b/frontend/src/hooks/api/ca/constants.tsx index d368d3c04..dbef15ffd 100644 --- a/frontend/src/hooks/api/ca/constants.tsx +++ b/frontend/src/hooks/api/ca/constants.tsx @@ -1,6 +1,12 @@ -import { CertificateAuthorityType } from "./enums"; +import { CaStatus,CaType } from "./enums"; -export const caTypeToNameMap: { [K in CertificateAuthorityType]: string } = { - [CertificateAuthorityType.ROOT]: "Root", - [CertificateAuthorityType.INTERMEDIATE]: "Intermediate" +export const caTypeToNameMap: { [K in CaType]: string } = { + [CaType.ROOT]: "Root", + [CaType.INTERMEDIATE]: "Intermediate" +}; + +export const caStatusToNameMap: { [K in CaStatus]: string } = { + [CaStatus.ACTIVE]: "Active", + [CaStatus.DISABLED]: "Disabled", + [CaStatus.PENDING_CERTIFICATE]: "Pending Certificate" }; diff --git a/frontend/src/hooks/api/ca/enums.tsx b/frontend/src/hooks/api/ca/enums.tsx index 0db5fcfdb..bdd498a12 100644 --- a/frontend/src/hooks/api/ca/enums.tsx +++ b/frontend/src/hooks/api/ca/enums.tsx @@ -1,4 +1,10 @@ -export enum CertificateAuthorityType { +export enum CaType { ROOT = "root", INTERMEDIATE = "intermediate" } + +export enum CaStatus { + ACTIVE = "active", + DISABLED = "disabled", + PENDING_CERTIFICATE = "pending-certificate" +} diff --git a/frontend/src/hooks/api/ca/index.tsx b/frontend/src/hooks/api/ca/index.tsx index f03d26abc..b39680b53 100644 --- a/frontend/src/hooks/api/ca/index.tsx +++ b/frontend/src/hooks/api/ca/index.tsx @@ -1,2 +1,9 @@ -export { CertificateAuthorityType } from "./enums"; -export { useCreateCa } from "./mutations"; +export { CaStatus,CaType } from "./enums"; +export { + useCreateCa, + useCreateCertificate, + useDeleteCa, + useImportCaCertificate, + useSignIntermediate, + useUpdateCa} from "./mutations"; +export { useGetCaById, useGetCaCert, useGetCaCsr } from "./queries"; diff --git a/frontend/src/hooks/api/ca/mutations.tsx b/frontend/src/hooks/api/ca/mutations.tsx index 38cb1cf9f..49de70d4f 100644 --- a/frontend/src/hooks/api/ca/mutations.tsx +++ b/frontend/src/hooks/api/ca/mutations.tsx @@ -1,23 +1,107 @@ -import { - useMutation - // useQueryClient -} from "@tanstack/react-query"; +import { useMutation, useQueryClient } from "@tanstack/react-query"; import { apiRequest } from "@app/config/request"; -import { TCertificateAuthority, TCreateCaDTO } from "./types"; +import { workspaceKeys } from "../workspace/queries"; +import { + TCertificateAuthority, + TCreateCaDTO, + TCreateCertificateDTO, + TCreateCertificateResponse, + TDeleteCaDTO, + TImportCaCertificateDTO, + TImportCaCertificateResponse, + TSignIntermediateDTO, + TSignIntermediateResponse, + TUpdateCaDTO} from "./types"; export const useCreateCa = () => { - // const queryClient = useQueryClient(); + const queryClient = useQueryClient(); return useMutation({ mutationFn: async (body) => { const { - data: { identity } - } = await apiRequest.post("/api/v1/ca/", body); - return identity; + data: { ca } + } = await apiRequest.post<{ ca: TCertificateAuthority }>("/api/v1/ca/", body); + return ca; }, - onSuccess: () => { - // queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId)); + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug })); + } + }); +}; + +export const useUpdateCa = () => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ caId, projectSlug, ...body }) => { + const { + data: { ca } + } = await apiRequest.patch<{ ca: TCertificateAuthority }>(`/api/v1/ca/${caId}`, body); + return ca; + }, + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug })); + } + }); +}; + +export const useDeleteCa = () => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ caId }) => { + const { + data: { ca } + } = await apiRequest.delete<{ ca: TCertificateAuthority }>(`/api/v1/ca/${caId}`); + return ca; + }, + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug })); + } + }); +}; + +export const useSignIntermediate = () => { + // TODO: consider renaming + return useMutation({ + mutationFn: async (body) => { + const { data } = await apiRequest.post( + `/api/v1/ca/${body.caId}/sign-intermediate`, + body + ); + return data; + } + }); +}; + +export const useImportCaCertificate = () => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ caId, ...body }) => { + const { data } = await apiRequest.post( + `/api/v1/ca/${caId}/import-certificate`, + body + ); + return data; + }, + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCas({ projectSlug })); + } + }); +}; + +// consider rename to issue certificate +export const useCreateCertificate = () => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ caId, ...body }) => { + const { data } = await apiRequest.post( + `/api/v1/ca/${caId}/issue-certificate`, + body + ); + return data; + }, + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCertificates(projectSlug)); } }); }; diff --git a/frontend/src/hooks/api/ca/queries.tsx b/frontend/src/hooks/api/ca/queries.tsx new file mode 100644 index 000000000..838f50726 --- /dev/null +++ b/frontend/src/hooks/api/ca/queries.tsx @@ -0,0 +1,54 @@ +import { useQuery } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { TCertificateAuthority } from "./types"; + +export const caKeys = { + getCaById: (caId: string) => [{ caId }, "ca"], + getCaCert: (caId: string) => [{ caId }, "ca-cert"], + getCaCsr: (caId: string) => [{ caId }, "ca-csr"] +}; + +export const useGetCaById = (caId: string) => { + return useQuery({ + queryKey: caKeys.getCaById(caId), + queryFn: async () => { + const { + data: { ca } + } = await apiRequest.get<{ ca: TCertificateAuthority }>(`/api/v1/ca/${caId}`); + return ca; + }, + enabled: Boolean(caId) + }); +}; + +export const useGetCaCert = (caId: string) => { + return useQuery({ + queryKey: caKeys.getCaCert(caId), + queryFn: async () => { + const { data } = await apiRequest.get<{ + certificate: string; + certificateChain: string; + serialNumber: string; + }>(`/api/v1/ca/${caId}/certificate`); + return data; + }, + enabled: Boolean(caId) + }); +}; + +export const useGetCaCsr = (caId: string) => { + return useQuery({ + queryKey: caKeys.getCaCsr(caId), + queryFn: async () => { + const { + data: { csr } + } = await apiRequest.get<{ + csr: string; + }>(`/api/v1/ca/${caId}/csr`); + return csr; + }, + enabled: Boolean(caId) + }); +}; diff --git a/frontend/src/hooks/api/ca/types.ts b/frontend/src/hooks/api/ca/types.ts index 34dcbb536..3c7eca11f 100644 --- a/frontend/src/hooks/api/ca/types.ts +++ b/frontend/src/hooks/api/ca/types.ts @@ -1,12 +1,21 @@ -import { CertificateAuthorityType } from "./enums"; +import { CaStatus,CaType } from "./enums"; export type TCertificateAuthority = { id: string; parentCaId?: string; projectId: string; - type: CertificateAuthorityType; - dn: string; + type: CaType; + status: CaStatus; + organization: string; + ou: string; + country: string; + province: string; + locality: string; commonName: string; + dn: string; + maxPathLength?: number; + notAfter?: string; + notBefore?: string; createdAt: string; updatedAt: string; }; @@ -20,4 +29,62 @@ export type TCreateCaDTO = { province: string; locality: string; commonName: string; + notAfter?: string; + maxPathLength: number; +}; + +export type TUpdateCaDTO = { + projectSlug: string; + caId: string; + status?: CaStatus; +}; + +export type TDeleteCaDTO = { + projectSlug: string; + caId: string; +}; + +export type TSignIntermediateDTO = { + caId: string; + csr: string; + maxPathLength: number; + notBefore?: string; + notAfter?: string; +}; + +export type TSignIntermediateResponse = { + certificate: string; + certificateChain: string; + issuingCaCertificate: string; + serialNumber: string; +}; + +export type TImportCaCertificateDTO = { + caId: string; + projectSlug: string; + certificate: string; + certificateChain: string; +}; + +export type TImportCaCertificateResponse = { + message: string; + caId: string; +}; + +// TODO: add TTL +export type TCreateCertificateDTO = { + projectSlug: string; + caId: string; + commonName: string; + ttl?: number; + notBefore?: string; + notAfter?: string; +}; + +export type TCreateCertificateResponse = { + certificate: string; + issuingCertificate: string; + certificateChain: string; + sk: string; + serialNumber: string; }; diff --git a/frontend/src/hooks/api/certificates/index.tsx b/frontend/src/hooks/api/certificates/index.tsx new file mode 100644 index 000000000..095d7d10a --- /dev/null +++ b/frontend/src/hooks/api/certificates/index.tsx @@ -0,0 +1,2 @@ +export { useDeleteCert } from "./mutations"; +export { useGetCertById, useGetCertCert } from "./queries"; diff --git a/frontend/src/hooks/api/certificates/mutations.tsx b/frontend/src/hooks/api/certificates/mutations.tsx new file mode 100644 index 000000000..0e128c37d --- /dev/null +++ b/frontend/src/hooks/api/certificates/mutations.tsx @@ -0,0 +1,26 @@ +import { useMutation, useQueryClient } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { workspaceKeys } from "../workspace/queries"; +import { TCertificate } from "./types"; + +export type TDeleteCaDTO = { + projectSlug: string; + certId: string; +}; + +export const useDeleteCert = () => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ certId }) => { + const { + data: { certificate } + } = await apiRequest.delete<{ certificate: TCertificate }>(`/api/v1/certificates/${certId}`); + return certificate; + }, + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCertificates(projectSlug)); + } + }); +}; diff --git a/frontend/src/hooks/api/certificates/queries.tsx b/frontend/src/hooks/api/certificates/queries.tsx new file mode 100644 index 000000000..0001ba3ac --- /dev/null +++ b/frontend/src/hooks/api/certificates/queries.tsx @@ -0,0 +1,40 @@ +import { useQuery } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { TCertificate } from "./types"; + +export const certKeys = { + getCertById: (certId: string) => [{ certId }, "cert"], + getCertCert: (certId: string) => [{ certId }, "certCert"] +}; + +export const useGetCertById = (certId: string) => { + return useQuery({ + queryKey: certKeys.getCertById(certId), + queryFn: async () => { + const { + data: { certificate } + } = await apiRequest.get<{ certificate: TCertificate }>(`/api/v1/certificates/${certId}`); + return certificate; + }, + enabled: Boolean(certId) + }); +}; + +export const useGetCertCert = (certId: string) => { + return useQuery({ + queryKey: certKeys.getCertCert(certId), + queryFn: async () => { + const { data } = await apiRequest.get<{ + certificate: string; + certificateChain: string; + issuingCaCertificate: string; + privateKey: string; + serialNumber: string; + }>(`/api/v1/certificates/${certId}/certificate`); + return data; + }, + enabled: Boolean(certId) + }); +}; diff --git a/frontend/src/hooks/api/certificates/types.ts b/frontend/src/hooks/api/certificates/types.ts new file mode 100644 index 000000000..71f2e5cd9 --- /dev/null +++ b/frontend/src/hooks/api/certificates/types.ts @@ -0,0 +1,7 @@ +export type TCertificate = { + id: string; + caId: string; + commonName: string; + notBefore: string; + notAfter: string; +}; diff --git a/frontend/src/hooks/api/index.tsx b/frontend/src/hooks/api/index.tsx index 64e306714..8dd0d1e72 100644 --- a/frontend/src/hooks/api/index.tsx +++ b/frontend/src/hooks/api/index.tsx @@ -6,6 +6,7 @@ export * from "./auditLogStreams"; export * from "./auth"; export * from "./bots"; export * from "./ca"; +export * from "./certificates"; export * from "./dynamicSecret"; export * from "./dynamicSecretLease"; export * from "./groups"; diff --git a/frontend/src/hooks/api/workspace/index.tsx b/frontend/src/hooks/api/workspace/index.tsx index 58c54f126..1daec0fd0 100644 --- a/frontend/src/hooks/api/workspace/index.tsx +++ b/frontend/src/hooks/api/workspace/index.tsx @@ -22,6 +22,7 @@ export { useGetWorkspaceSecrets, useGetWorkspaceUsers, useListWorkspaceCas, + useListWorkspaceCertificates, useListWorkspaceGroups, useNameWorkspaceSecrets, useRenameWorkspace, diff --git a/frontend/src/hooks/api/workspace/queries.tsx b/frontend/src/hooks/api/workspace/queries.tsx index 07bd2901a..6b92ae5a1 100644 --- a/frontend/src/hooks/api/workspace/queries.tsx +++ b/frontend/src/hooks/api/workspace/queries.tsx @@ -2,7 +2,9 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"; import { apiRequest } from "@app/config/request"; +import { CaStatus } from "../ca/enums"; import { TCertificateAuthority } from "../ca/types"; +import { TCertificate } from "../certificates/types"; import { TGroupMembership } from "../groups/types"; import { IdentityMembership } from "../identities/types"; import { IntegrationAuth } from "../integrationAuth/types"; @@ -41,7 +43,12 @@ export const workspaceKeys = { [{ workspaceId }, "workspace-identity-memberships"] as const, getWorkspaceGroupMemberships: (workspaceId: string) => [{ workspaceId }, "workspace-groups"] as const, - getWorkspaceCas: (workspaceId: string) => [{ workspaceId }, "workspace-cas"] as const + getWorkspaceCas: ({ projectSlug }: { projectSlug: string }) => + [{ projectSlug }, "workspace-cas"] as const, + specificWorkspaceCas: ({ projectSlug, status }: { projectSlug: string; status?: CaStatus }) => + [...workspaceKeys.getWorkspaceCas({ projectSlug }), { status }] as const, + getWorkspaceCertificates: (projectSlug: string) => + [{ projectSlug }, "workspace-certificates"] as const }; const fetchWorkspaceById = async (workspaceId: string) => { @@ -472,17 +479,48 @@ export const useListWorkspaceGroups = (projectSlug: string) => { }); }; -export const useListWorkspaceCas = (projectSlug: string) => { +export const useListWorkspaceCas = ({ + projectSlug, + status +}: { + projectSlug: string; + status?: CaStatus; +}) => { return useQuery({ - queryKey: workspaceKeys.getWorkspaceCas(projectSlug), + queryKey: workspaceKeys.specificWorkspaceCas({ + projectSlug, + status + }), queryFn: async () => { + const params = new URLSearchParams({ + ...(status && { status }) + }); + const { data: { cas } } = await apiRequest.get<{ cas: TCertificateAuthority[] }>( - `/api/v2/workspace/${projectSlug}/cas` + `/api/v2/workspace/${projectSlug}/cas`, + { + params + } ); return cas; }, enabled: Boolean(projectSlug) }); }; + +export const useListWorkspaceCertificates = (projectSlug: string) => { + return useQuery({ + queryKey: workspaceKeys.getWorkspaceCertificates(projectSlug), + queryFn: async () => { + const { + data: { certificates } + } = await apiRequest.get<{ certificates: TCertificate[] }>( + `/api/v2/workspace/${projectSlug}/certificates` + ); + return certificates; + }, + enabled: Boolean(projectSlug) + }); +}; diff --git a/frontend/src/pages/project/[id]/certificates/index.tsx b/frontend/src/pages/project/[id]/certificates/index.tsx index f7d2cd8b6..ede2e75f0 100644 --- a/frontend/src/pages/project/[id]/certificates/index.tsx +++ b/frontend/src/pages/project/[id]/certificates/index.tsx @@ -9,11 +9,10 @@ const Certificates = () => { return (
- {t("common.head-title", { title: t("settings.project.title") })} + {t("common.head-title", { title: "Certificates" })} -
Test CA page
); diff --git a/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx b/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx index 655e83ad5..d4b0175a1 100644 --- a/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx +++ b/frontend/src/views/Project/CertificatesPage/CertificatesPage.tsx @@ -2,15 +2,7 @@ import { Tab, TabList, TabPanel, Tabs } from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context"; import { withProjectPermission } from "@app/hoc"; -import { CaTab } from "./components"; -// import { CaTable } from "./components"; - -// TODO: fix permission - -/** - * TODO 1: CA section - * TODO 2: Certificates section - */ +import { CaTab, CertificatesTab } from "./components"; enum TabSections { Ca = "certificate-authorities", @@ -23,18 +15,17 @@ export const CertificatesPage = withProjectPermission(

Certificates

- + - Certificate Authorities Certificates + Certificate Authorities + + + - -
Certs
- {/* */} -
diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx new file mode 100644 index 000000000..320245cae --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx @@ -0,0 +1,109 @@ +import { useEffect } from "react"; +import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + +import { IconButton,Modal, ModalContent } from "@app/components/v2"; +import { useToggle } from "@app/hooks"; +import { useGetCaCert } from "@app/hooks/api"; +import { UsePopUpState } from "@app/hooks/usePopUp"; + +type Props = { + popUp: UsePopUpState<["caCert"]>; + handlePopUpToggle: (popUpName: keyof UsePopUpState<["caCert"]>, state?: boolean) => void; +}; + +export const CaCertModal = ({ popUp, handlePopUpToggle }: Props) => { + const { data } = useGetCaCert((popUp?.caCert?.data as { caId: string })?.caId || ""); + const [isSerialNumberCopied, setIsSerialNumberCopied] = useToggle(false); + const [isCertificateCopied, setIsCertificateCopied] = useToggle(false); + const [isCertificateChainCopied, setIsCertificateChainCopied] = useToggle(false); + + useEffect(() => { + let timer: NodeJS.Timeout; + if (isSerialNumberCopied) { + timer = setTimeout(() => setIsSerialNumberCopied.off(), 2000); + } + + if (isCertificateCopied) { + timer = setTimeout(() => setIsCertificateCopied.off(), 2000); + } + + if (isCertificateChainCopied) { + timer = setTimeout(() => setIsCertificateChainCopied.off(), 2000); + } + + return () => clearTimeout(timer); + }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied]); + + return ( + { + handlePopUpToggle("caCert", isOpen); + }} + > + + {data ? ( +
+

Serial Number

+
+

{data.serialNumber}

+ { + navigator.clipboard.writeText(data.serialNumber); + setIsSerialNumberCopied.on(); + }} + > + + + Click to copy + + +
+

Certificate Body

+
+

{data.certificate}

+ { + navigator.clipboard.writeText(data.certificate); + setIsCertificateCopied.on(); + }} + > + + + Click to copy + + +
+

Certificate Chain

+
+

{data.certificateChain}

+ { + navigator.clipboard.writeText(data.certificateChain); + setIsCertificateChainCopied.on(); + }} + > + + + Click to copy + + +
+
+ ) : ( +
+ )} + + + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/CaInstallCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/CaInstallCertModal.tsx new file mode 100644 index 000000000..4d2bcb243 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/CaInstallCertModal.tsx @@ -0,0 +1,328 @@ +import { useEffect, useState } from "react"; +import { Controller, useForm } from "react-hook-form"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { format } from "date-fns"; +import { z } from "zod"; + +import { createNotification } from "@app/components/notifications"; +import { + // DatePicker, + Button, + FormControl, + Input, + Modal, + ModalContent, + Select, + SelectItem +} from "@app/components/v2"; +import { useWorkspace } from "@app/context"; +import { + CaStatus, + useGetCaById, + useGetCaCsr, + useImportCaCertificate, + useListWorkspaceCas, + useSignIntermediate +} from "@app/hooks/api"; +import { caTypeToNameMap } from "@app/hooks/api/ca/constants"; +import { UsePopUpState } from "@app/hooks/usePopUp"; + +const isValidDate = (dateString: string) => { + const date = new Date(dateString); + return !Number.isNaN(date.getTime()); +}; + +const getMiddleDate = (date1: Date, date2: Date) => { + const timestamp1 = date1.getTime(); + const timestamp2 = date2.getTime(); + + const middleTimestamp = (timestamp1 + timestamp2) / 2; + + return new Date(middleTimestamp); +}; + +const schema = z.object({ + parentCaId: z.string(), + notAfter: z.string().trim().refine(isValidDate, { message: "Invalid date format" }), + maxPathLength: z.string() +}); + +export type FormData = z.infer; + +type Props = { + popUp: UsePopUpState<["installCaCert"]>; + handlePopUpToggle: (popUpName: keyof UsePopUpState<["installCaCert"]>, state?: boolean) => void; +}; + +enum ParentCaType { + Internal = "internal", + External = "external" +} + +export const CaInstallCertModal = ({ popUp, handlePopUpToggle }: Props) => { + const [parentCaType] = useState(ParentCaType.Internal); + const { currentWorkspace } = useWorkspace(); + const caId = (popUp?.installCaCert?.data as { caId: string })?.caId || ""; + + // const [isStartDatePickerOpen, setIsStartDatePickerOpen] = useState(false); + const { data: cas } = useListWorkspaceCas({ + projectSlug: currentWorkspace?.slug ?? "", + status: CaStatus.ACTIVE + }); + const { data: ca } = useGetCaById(caId); + const { data: csr } = useGetCaCsr(caId); + + const { mutateAsync: signIntermediate } = useSignIntermediate(); + const { mutateAsync: importCaCertificate } = useImportCaCertificate(); + + const { + control, + handleSubmit, + reset, + formState: { isSubmitting }, + setValue, + watch + } = useForm({ + resolver: zodResolver(schema), + defaultValues: { + maxPathLength: "0" + } + }); + + useEffect(() => { + if (cas?.length) { + setValue("parentCaId", cas[0].id); + } + }, [cas, setValue]); + + const parentCaId = watch("parentCaId"); + const { data: parentCa } = useGetCaById(parentCaId); + + useEffect(() => { + if (parentCa?.maxPathLength) { + setValue( + "maxPathLength", + (parentCa.maxPathLength === -1 ? 3 : parentCa.maxPathLength - 1).toString() + ); + } + + if (parentCa?.notAfter) { + const parentCaNotAfter = new Date(parentCa.notAfter); + const middleDate = getMiddleDate(new Date(), parentCaNotAfter); + setValue("notAfter", format(middleDate, "yyyy-MM-dd")); + } + }, [parentCa]); + + const onFormSubmit = async ({ notAfter, maxPathLength }: FormData) => { + try { + if (!csr || !caId || !currentWorkspace?.slug) return; + + const { certificate, certificateChain } = await signIntermediate({ + caId: parentCaId, + csr, + maxPathLength: Number(maxPathLength), + notAfter, + notBefore: new Date().toISOString() + }); + + await importCaCertificate({ + caId, + projectSlug: currentWorkspace?.slug, + certificate, + certificateChain + }); + + reset(); + + createNotification({ + text: "Successfully installed certificate for CA", + type: "success" + }); + handlePopUpToggle("installCaCert", false); + } catch (err) { + createNotification({ + text: "Failed to install certificate for CA", + type: "error" + }); + } + }; + + function generatePathLengthOpts(parentCaMaxPathLength: number): number[] { + if (parentCaMaxPathLength === -1) { + return [-1, 0, 1, 2, 3]; + } + + return Array.from({ length: parentCaMaxPathLength }, (_, index) => index); + } + + const renderForm = (parentCaTypeInput: ParentCaType) => { + switch (parentCaTypeInput) { + case ParentCaType.Internal: + return ( +
+ ( + + + + )} + /> + {/* { + return ( + + { + onChange(date); + setIsStartDatePickerOpen(false); + }} + popUpProps={{ + open: isStartDatePickerOpen, + onOpenChange: setIsStartDatePickerOpen + }} + popUpContentProps={{}} + /> + + ); + }} + /> */} + ( + + + + )} + /> + ( + + + + )} + /> +
+ + +
+ + ); + default: + return
External TODO
; + } + }; + + return ( + { + handlePopUpToggle("installCaCert", isOpen); + reset(); + }} + > + + {/* + + */} + {renderForm(parentCaType)} + + + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/index.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/index.tsx new file mode 100644 index 000000000..9ad602c06 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaInstallCertModal/index.tsx @@ -0,0 +1 @@ +export { CaInstallCertModal } from "./CaInstallCertModal"; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx index b9461c6bb..52e37974e 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx @@ -1,8 +1,7 @@ -// import { useEffect } from "react"; +import { useEffect } from "react"; import { Controller, useForm } from "react-hook-form"; -// import { yupResolver } from "@hookform/resolvers/yup"; -// import * as yup from "yup"; import { zodResolver } from "@hookform/resolvers/zod"; +import { format } from "date-fns"; import { z } from "zod"; import { createNotification } from "@app/components/notifications"; @@ -14,21 +13,34 @@ import { ModalContent, Select, SelectItem + // DatePicker } from "@app/components/v2"; import { useWorkspace } from "@app/context"; -import { CertificateAuthorityType, useCreateCa } from "@app/hooks/api/ca"; -// import { useCreateIdentity, useGetOrgRoles, useUpdateIdentity } from "@app/hooks/api"; +import { CaType, useCreateCa, useGetCaById } from "@app/hooks/api/ca"; import { UsePopUpState } from "@app/hooks/usePopUp"; +const isValidDate = (dateString: string) => { + const date = new Date(dateString); + return !Number.isNaN(date.getTime()); +}; + +const getDateTenYearsFromToday = () => { + const date = new Date(); + date.setFullYear(date.getFullYear() + 10); + return format(date, "yyyy-MM-dd"); +}; + const schema = z .object({ - type: z.enum(["root", "intermediate"]), // move to ref enum of hooks/api + type: z.enum([CaType.ROOT, CaType.INTERMEDIATE]), organization: z.string(), ou: z.string(), country: z.string(), province: z.string(), locality: z.string(), - commonName: z.string() + commonName: z.string(), + notAfter: z.string().trim().refine(isValidDate, { message: "Invalid date format" }), + maxPathLength: z.string() }) .required(); @@ -36,75 +48,71 @@ export type FormData = z.infer; type Props = { popUp: UsePopUpState<["ca"]>; - // handlePopUpOpen: ( - // popUpName: keyof UsePopUpState<["identityAuthMethod"]>, - // data: { - // identityId: string; - // name: string; - // authMethod?: IdentityAuthMethod; - // } - // ) => void; handlePopUpToggle: (popUpName: keyof UsePopUpState<["ca"]>, state?: boolean) => void; }; const caTypes = [ - { label: "Root", value: CertificateAuthorityType.ROOT }, - { label: "intermediate", value: CertificateAuthorityType.INTERMEDIATE } + { label: "Root", value: CaType.ROOT }, + { label: "Intermediate", value: CaType.INTERMEDIATE } ]; export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { const { currentWorkspace } = useWorkspace(); - console.log("CaModal currentWorkspace: ", currentWorkspace); + // const [isStartDatePickerOpen, setIsStartDatePickerOpen] = useState(false); + const { data: ca } = useGetCaById((popUp?.ca?.data as { caId: string })?.caId || ""); const { mutateAsync: createMutateAsync } = useCreateCa(); - // const { data: roles } = useGetOrgRoles(orgId); - // const { mutateAsync: createMutateAsync } = useCreateIdentity(); - // const { mutateAsync: updateMutateAsync } = useUpdateIdentity(); - // const { mutateAsync: addMutateAsync } = useAddIdentityUniversalAuth(); const { control, handleSubmit, reset, - formState: { isSubmitting } + formState: { isSubmitting }, + watch } = useForm({ resolver: zodResolver(schema), defaultValues: { - type: CertificateAuthorityType.ROOT, + type: CaType.ROOT, organization: "", ou: "", country: "", province: "", locality: "", - commonName: "" + commonName: "", + notAfter: getDateTenYearsFromToday(), + maxPathLength: "-1" } }); - // useEffect(() => { - // const identity = popUp?.identity?.data as { - // identityId: string; - // name: string; - // role: string; - // customRole: { - // name: string; - // slug: string; - // }; - // }; + const caType = watch("type"); - // if (!roles?.length) return; - - // if (identity) { - // reset({ - // name: identity.name, - // role: identity?.customRole?.slug ?? identity.role - // }); - // } else { - // reset({ - // name: "", - // role: roles[0].slug - // }); - // } - // }, [popUp?.identity?.data, roles]); + useEffect(() => { + if (ca) { + reset({ + type: ca.type, + organization: ca.organization, + ou: ca.ou, + country: ca.country, + province: ca.province, + locality: ca.locality, + commonName: ca.commonName, + notAfter: ca.notAfter ? format(new Date(ca.notAfter), "yyyy-MM-dd") : "", + maxPathLength: ca.maxPathLength ? String(ca.maxPathLength) : "" + }); + } else { + reset({ + type: CaType.ROOT, + organization: "", + ou: "", + country: "", + province: "", + locality: "", + commonName: "", + notAfter: getDateTenYearsFromToday(), + maxPathLength: "-1" + }); + } + }, [ca]); const onFormSubmit = async ({ type, @@ -113,18 +121,11 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { ou, country, locality, - province + province, + notAfter, + maxPathLength }: FormData) => { try { - console.log("onFormSubmit args: ", { - commonName, - organization, - ou, - country, - locality, - province - }); - if (!currentWorkspace?.slug) return; await createMutateAsync({ @@ -135,90 +136,47 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { ou, country, province, - locality - }); - - // const identity = popUp?.identity?.data as { - // identityId: string; - // name: string; - // role: string; - // }; - - // if (identity) { - // // update - - // await updateMutateAsync({ - // identityId: identity.identityId, - // name, - // role: role || undefined, - // organizationId: orgId - // }); - - // handlePopUpToggle("identity", false); - // } else { - // // create - - // const { - // id: createdId, - // name: createdName, - // authMethod - // } = await createMutateAsync({ - // name, - // role: role || undefined, - // organizationId: orgId - // }); - - // await addMutateAsync({ - // organizationId: orgId, - // identityId: createdId, - // clientSecretTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }], - // accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }], - // accessTokenTTL: 2592000, - // accessTokenMaxTTL: 2592000, - // accessTokenNumUsesLimit: 0 - // }); - - // handlePopUpToggle("identity", false); - // handlePopUpOpen("identityAuthMethod", { - // identityId: createdId, - // name: createdName, - // authMethod - // }); - // } - - createNotification({ - text: `Successfully ${popUp?.ca?.data ? "updated" : "created"} CA`, - type: "success" + locality, + notAfter, + maxPathLength: Number(maxPathLength) }); reset(); - } catch (err) { - console.error(err); - const error = err as any; - const text = - error?.response?.data?.message ?? `Failed to ${popUp?.ca?.data ? "update" : "create"} CA`; + handlePopUpToggle("ca", false); createNotification({ - text, + text: "Successfully created CA", + type: "success" + }); + } catch (err) { + console.error(err); + createNotification({ + text: "Failed to create CA", type: "error" }); } }; + // const getDefaultNotAfterDate = () => { + // const date = new Date(); + // date.setFullYear(date.getFullYear() + 10); + // return date; + // }; + return ( { - handlePopUpToggle("ca", isOpen); reset(); + handlePopUpToggle("ca", isOpen); }} > - +
( + + )} + /> + ( + + + + )} + /> + + )} { isError={Boolean(error)} errorText={error?.message} > - + )} /> @@ -261,7 +293,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { isError={Boolean(error)} errorText={error?.message} > - + )} /> @@ -275,7 +307,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { isError={Boolean(error)} errorText={error?.message} > - + )} /> @@ -289,7 +321,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { isError={Boolean(error)} errorText={error?.message} > - + )} /> @@ -303,7 +335,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { isError={Boolean(error)} errorText={error?.message} > - + )} /> @@ -317,28 +349,30 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { isError={Boolean(error)} errorText={error?.message} > - + )} /> -
- - -
+ {!ca && ( +
+ + +
+ )}
diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx index b28c8be6c..63144db04 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx @@ -1,141 +1,126 @@ -// import { useState } from "react"; import { faPlus } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; -// import { createNotification } from "@app/components/notifications"; -// import { OrgPermissionCan } from "@app/components/permissions"; -import { - Button - // DeleteActionModal, - // EmailServiceSetupModal, - // UpgradePlanModal -} from "@app/components/v2"; -// import { -// OrgPermissionActions, -// OrgPermissionSubjects, -// useOrganization, -// useSubscription -// } from "@app/context"; -// import { useDeleteOrgMembership } from "@app/hooks/api"; +import { createNotification } from "@app/components/notifications"; +import { ProjectPermissionCan } from "@app/components/permissions"; +import { Button, DeleteActionModal } from "@app/components/v2"; +import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; +import { CaStatus,useDeleteCa, useUpdateCa } from "@app/hooks/api"; import { usePopUp } from "@app/hooks/usePopUp"; +import { CaCertModal } from "./CaCertModal"; +import { CaInstallCertModal } from "./CaInstallCertModal"; import { CaModal } from "./CaModal"; import { CaTable } from "./CaTable"; -// import { AddOrgMemberModal } from "./AddOrgMemberModal"; -// import { OrgMembersTable } from "./OrgMembersTable"; export const CaSection = () => { - // const { subscription } = useSubscription(); - // const { currentOrg } = useOrganization(); - // const orgId = currentOrg?.id ?? ""; + const { currentWorkspace } = useWorkspace(); + const { mutateAsync: deleteCa } = useDeleteCa(); + const { mutateAsync: updateCa } = useUpdateCa(); - // const [completeInviteLink, setCompleteInviteLink] = useState(""); + const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([ + "ca", + "caCert", + "installCaCert", + "deleteCa", + "caStatus" // enable / disable + ] as const); - const { - popUp, - handlePopUpOpen, - // handlePopUpClose, - handlePopUpToggle - } = usePopUp(["ca"] as const); + const onRemoveCaSubmit = async (caId: string) => { + try { + if (!currentWorkspace?.slug) return; - // const { mutateAsync: deleteMutateAsync } = useDeleteOrgMembership(); + await deleteCa({ caId, projectSlug: currentWorkspace.slug }); - // const isMoreUsersNotAllowed = subscription?.memberLimit - // ? subscription.membersUsed >= subscription.memberLimit - // : false; + await createNotification({ + text: "Successfully deleted CA", + type: "success" + }); - // const handleAddMemberModal = () => { - // if (currentOrg?.authEnforced) { - // createNotification({ - // text: "You cannot manage users from Infisical when org-level auth is enforced for your organization", - // type: "error" - // }); - // return; - // } + handlePopUpClose("deleteCa"); + } catch (err) { + console.error(err); + createNotification({ + text: "Failed to delete CA", + type: "error" + }); + } + }; - // if (isMoreUsersNotAllowed) { - // handlePopUpOpen("upgradePlan", { - // description: "You can add more members if you upgrade your Infisical plan." - // }); - // } else { - // handlePopUpOpen("addMember"); - // } - // }; + const onUpdateCaStatus = async ({ caId, status }: { caId: string; status: CaStatus }) => { + try { + if (!currentWorkspace?.slug) return; - // const onRemoveMemberSubmit = async (orgMembershipId: string) => { - // try { - // await deleteMutateAsync({ - // orgId, - // membershipId: orgMembershipId - // }); + await updateCa({ caId, projectSlug: currentWorkspace.slug, status }); - // createNotification({ - // text: "Successfully removed user from org", - // type: "success" - // }); - // } catch (err) { - // console.error(err); - // createNotification({ - // text: "Failed to remove user from the organization", - // type: "error" - // }); - // } + await createNotification({ + text: `Successfully ${status === CaStatus.ACTIVE ? "enabled" : "disabled"} CA`, + type: "success" + }); - // handlePopUpClose("removeMember"); - // }; + handlePopUpClose("caStatus"); + } catch (err) { + console.error(err); + createNotification({ + text: `Failed to ${status === CaStatus.ACTIVE ? "enabled" : "disabled"} CA`, + type: "error" + }); + } + }; return (

Certificate Authorities

- {/* - {(isAllowed) => ( */} - - {/* )} */} - {/* */} + {(isAllowed) => ( + + )} +
- - {/* - + + + handlePopUpToggle("deleteCa", isOpen)} + deleteKey="confirm" + onDeleteApproved={() => onRemoveCaSubmit((popUp?.deleteCa?.data as { caId: string })?.caId)} /> handlePopUpToggle("removeMember", isOpen)} + isOpen={popUp.caStatus.isOpen} + title={`Are you sure want to ${ + (popUp?.caStatus?.data as { status: string })?.status === CaStatus.ACTIVE + ? "enable" + : "disable" + } the CA ${(popUp?.caStatus?.data as { dn: string })?.dn || ""} from the project?`} + subTitle={ + (popUp?.caStatus?.data as { status: string })?.status === CaStatus.ACTIVE + ? "This action will allow the CA to start issuing certificates again." + : "This action will prevent the CA from issuing new certificates." + } + onChange={(isOpen) => handlePopUpToggle("caStatus", isOpen)} deleteKey="confirm" onDeleteApproved={() => - onRemoveMemberSubmit( - (popUp?.removeMember?.data as { orgMembershipId: string })?.orgMembershipId - ) + onUpdateCaStatus(popUp?.caStatus?.data as { caId: string; status: CaStatus }) } /> - handlePopUpToggle("upgradePlan", isOpen)} - text={(popUp.upgradePlan?.data as { description: string })?.description} - /> - handlePopUpToggle("setUpEmail", isOpen)} - /> */}
); }; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx index 992c3046e..2fdb35f4c 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx @@ -1,6 +1,20 @@ -import { faCertificate } from "@fortawesome/free-solid-svg-icons"; - import { + faBan, + faCertificate, + faEllipsis, + faEye, + faTrash +} from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; +import { format } from "date-fns"; +import { twMerge } from "tailwind-merge"; + +import { ProjectPermissionCan } from "@app/components/permissions"; +import { + DropdownMenu, + DropdownMenuContent, + DropdownMenuItem, + DropdownMenuTrigger, EmptyState, Table, TableContainer, @@ -9,15 +23,29 @@ import { Td, Th, THead, - Tr -} from "@app/components/v2"; -import { useWorkspace } from "@app/context"; -import { useListWorkspaceCas } from "@app/hooks/api"; -import { caTypeToNameMap } from "@app/hooks/api/ca/constants"; + Tooltip, + Tr} from "@app/components/v2"; +import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; +import { CaStatus, useListWorkspaceCas } from "@app/hooks/api"; +import { caStatusToNameMap,caTypeToNameMap } from "@app/hooks/api/ca/constants"; +import { UsePopUpState } from "@app/hooks/usePopUp"; -export const CaTable = () => { +type Props = { + handlePopUpOpen: ( + popUpName: keyof UsePopUpState<["installCaCert", "caCert", "ca", "deleteCa", "caStatus"]>, + data?: { + caId?: string; + dn?: string; + status?: CaStatus; + } + ) => void; +}; + +export const CaTable = ({ handlePopUpOpen }: Props) => { const { currentWorkspace } = useWorkspace(); - const { data, isLoading } = useListWorkspaceCas(currentWorkspace?.slug ?? ""); + const { data, isLoading } = useListWorkspaceCas({ + projectSlug: currentWorkspace?.slug ?? "" + }); return (
@@ -27,6 +55,8 @@ export const CaTable = () => { Subject Status Type + Valid Until + @@ -38,15 +68,148 @@ export const CaTable = () => { return ( {ca.dn} - Pending + {caStatusToNameMap[ca.status]} {caTypeToNameMap[ca.type]} + {ca.notAfter ? format(new Date(ca.notAfter), "yyyy-MM-dd") : "-"} + + + +
+ + + +
+ + + {ca.status === CaStatus.PENDING_CERTIFICATE && ( + + {(isAllowed) => ( + { + handlePopUpOpen("installCaCert", { + caId: ca.id + }); + }} + disabled={!isAllowed} + icon={} + > + Install Certificate + + )} + + )} + {ca.status !== CaStatus.PENDING_CERTIFICATE && ( + + {(isAllowed) => ( + { + handlePopUpOpen("caCert", { + caId: ca.id + }); + }} + disabled={!isAllowed} + icon={} + > + View Certificate + + )} + + )} + + {(isAllowed) => ( + + handlePopUpOpen("ca", { + caId: ca.id + }) + } + disabled={!isAllowed} + icon={} + > + View CA + + )} + + {(ca.status === CaStatus.ACTIVE || ca.status === CaStatus.DISABLED) && ( + + {(isAllowed) => ( + + handlePopUpOpen("caStatus", { + caId: ca.id, + status: + ca.status === CaStatus.ACTIVE + ? CaStatus.DISABLED + : CaStatus.ACTIVE + }) + } + disabled={!isAllowed} + icon={} + > + {`${ca.status === CaStatus.ACTIVE ? "Disable" : "Enable"} CA`} + + )} + + )} + + {(isAllowed) => ( + + handlePopUpOpen("deleteCa", { + caId: ca.id, + dn: ca.dn + }) + } + disabled={!isAllowed} + icon={} + > + Delete CA + + )} + + + + ); })} {!isLoading && data?.length === 0 && ( - + )}
diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/CertificatesTab.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/CertificatesTab.tsx new file mode 100644 index 000000000..f054e2546 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/CertificatesTab.tsx @@ -0,0 +1,17 @@ +import { motion } from "framer-motion"; + +import { CertificatesSection } from "./components"; + +export const CertificatesTab = () => { + return ( + + + + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx new file mode 100644 index 000000000..8a48d4f0d --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx @@ -0,0 +1,135 @@ +import { useEffect } from "react"; +import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + +import { IconButton,Modal, ModalContent } from "@app/components/v2"; +import { useToggle } from "@app/hooks"; +import { useGetCertCert } from "@app/hooks/api"; +import { UsePopUpState } from "@app/hooks/usePopUp"; + +type Props = { + popUp: UsePopUpState<["certificateCert"]>; + handlePopUpToggle: (popUpName: keyof UsePopUpState<["certificateCert"]>, state?: boolean) => void; +}; + +export const CertificateCertModal = ({ popUp, handlePopUpToggle }: Props) => { + const { data } = useGetCertCert( + (popUp?.certificateCert?.data as { certId: string })?.certId || "" + ); + + const [isSerialNumberCopied, setIsSerialNumberCopied] = useToggle(false); + const [isCertificateCopied, setIsCertificateCopied] = useToggle(false); + const [isCertificateChainCopied, setIsCertificateChainCopied] = useToggle(false); + const [isCertificateSkCopied, setIsCertificateSkCopied] = useToggle(false); + + useEffect(() => { + let timer: NodeJS.Timeout; + if (isSerialNumberCopied) { + timer = setTimeout(() => setIsSerialNumberCopied.off(), 2000); + } + + if (isCertificateCopied) { + timer = setTimeout(() => setIsCertificateCopied.off(), 2000); + } + + if (isCertificateChainCopied) { + timer = setTimeout(() => setIsCertificateChainCopied.off(), 2000); + } + + if (isCertificateSkCopied) { + timer = setTimeout(() => setIsCertificateSkCopied.off(), 2000); + } + + return () => clearTimeout(timer); + }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied, isCertificateSkCopied]); + + return ( + { + handlePopUpToggle("certificateCert", isOpen); + }} + > + + {data ? ( +
+

Serial Number

+
+

{data.serialNumber}

+ { + navigator.clipboard.writeText(data.serialNumber); + setIsSerialNumberCopied.on(); + }} + > + + + Click to copy + + +
+

Certificate Body

+
+

{data.certificate}

+ { + navigator.clipboard.writeText(data.certificate); + setIsCertificateCopied.on(); + }} + > + + + Click to copy + + +
+

Certificate Chain

+
+

{data.certificateChain}

+ { + navigator.clipboard.writeText(data.certificateChain); + setIsCertificateChainCopied.on(); + }} + > + + + Click to copy + + +
+

Certificate Private Key

+
+

{data.privateKey}

+ { + navigator.clipboard.writeText(data.certificateChain); + setIsCertificateSkCopied.on(); + }} + > + + + Click to copy + + +
+
+ ) : ( +
+ )} + + + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx new file mode 100644 index 000000000..a740b9063 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx @@ -0,0 +1,223 @@ +import { useEffect } from "react"; +import { Controller, useForm } from "react-hook-form"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { format } from "date-fns"; +import { z } from "zod"; + +import { createNotification } from "@app/components/notifications"; +import { + Button, + FormControl, + Input, + Modal, + ModalContent, + Select, + SelectItem +} from "@app/components/v2"; +import { useWorkspace } from "@app/context"; +import { + CaStatus, + useCreateCertificate, + useGetCertById, + useListWorkspaceCas +} from "@app/hooks/api"; +import { caTypeToNameMap } from "@app/hooks/api/ca/constants"; +import { UsePopUpState } from "@app/hooks/usePopUp"; + +const isValidDate = (dateString: string) => { + if (dateString === "") return true; + const date = new Date(dateString); + return !Number.isNaN(date.getTime()); +}; + +const schema = z.object({ + caId: z.string(), + commonName: z.string().trim().min(1), + ttl: z.string().trim().optional(), + notAfter: z + .string() + .trim() + .refine(isValidDate, { message: "Invalid date format" }) + .transform((val) => (val === "" ? undefined : val)) +}); + +export type FormData = z.infer; + +type Props = { + popUp: UsePopUpState<["certificate"]>; + handlePopUpToggle: (popUpName: keyof UsePopUpState<["certificate"]>, state?: boolean) => void; +}; + +export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { + const { currentWorkspace } = useWorkspace(); + const { data: cert } = useGetCertById( + (popUp?.certificate?.data as { certId: string })?.certId || "" + ); + + const { data: cas } = useListWorkspaceCas({ + projectSlug: currentWorkspace?.slug ?? "", + status: CaStatus.ACTIVE + }); + + const { mutateAsync: createCertificate } = useCreateCertificate(); + + const { + control, + handleSubmit, + reset, + formState: { isSubmitting }, + setValue + } = useForm({ + resolver: zodResolver(schema) + }); + + useEffect(() => { + if (cert) { + reset({ + caId: cert.caId, + commonName: cert.commonName, + ttl: "", + notAfter: format(new Date(cert.notAfter), "yyyy-MM-dd") + }); + } else { + reset({ + caId: "", + commonName: "", + ttl: "", + notAfter: "" + }); + } + }, [cert]); + + const onFormSubmit = async ({ caId, commonName, ttl, notAfter }: FormData) => { + try { + if (!currentWorkspace?.slug) return; + + await createCertificate({ + projectSlug: currentWorkspace.slug, + caId, + commonName, + ttl: ttl ? Number(ttl) : undefined, + notBefore: new Date().toISOString(), + notAfter + }); + + reset(); + handlePopUpToggle("certificate", false); + + createNotification({ + text: "Successfully created certificate", + type: "success" + }); + } catch (err) { + console.error(err); + createNotification({ + text: "Failed to create certificate", + type: "error" + }); + } + }; + + useEffect(() => { + if (cas?.length) { + setValue("caId", cas[0].id); + } + }, [cas, setValue]); + + return ( + { + handlePopUpToggle("certificate", isOpen); + reset(); + }} + > + +
+ ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + {!cert && ( +
+ + +
+ )} + +
+ + ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx new file mode 100644 index 000000000..addcff7a8 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx @@ -0,0 +1,79 @@ +import { faPlus } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + +import { createNotification } from "@app/components/notifications"; +import { Button, DeleteActionModal } from "@app/components/v2"; +import { useWorkspace } from "@app/context"; +import { useDeleteCert } from "@app/hooks/api"; +import { usePopUp } from "@app/hooks/usePopUp"; + +import { CertificateCertModal } from "./CertificateCertModal"; +import { CertificateModal } from "./CertificateModal"; +import { CertificatesTable } from "./CertificatesTable"; + +export const CertificatesSection = () => { + const { currentWorkspace } = useWorkspace(); + const { mutateAsync: deleteCert } = useDeleteCert(); + + const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([ + "certificate", + "certificateCert", + "deleteCertificate" + ] as const); + + const onRemoveCertificateSubmit = async (certId: string) => { + try { + if (!currentWorkspace?.slug) return; + + await deleteCert({ certId, projectSlug: currentWorkspace.slug }); + + await createNotification({ + text: "Successfully deleted certificate", + type: "success" + }); + + handlePopUpClose("deleteCertificate"); + } catch (err) { + console.error(err); + createNotification({ + text: "Failed to delete certificate", + type: "error" + }); + } + }; + + return ( +
+
+

Certificates

+ {/* + {(isAllowed) => ( */} + + {/* )} */} + {/* */} +
+ + + + handlePopUpToggle("deleteCertificate", isOpen)} + deleteKey="confirm" + onDeleteApproved={() => + onRemoveCertificateSubmit((popUp?.deleteCertificate?.data as { certId: string })?.certId) + } + /> +
+ ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx new file mode 100644 index 000000000..663ac6f8b --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx @@ -0,0 +1,160 @@ +import { + faCertificate, + faEllipsis, + faEye, + faFileExport, + faTrash +} from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; +import { format } from "date-fns"; +import { twMerge } from "tailwind-merge"; + +import { ProjectPermissionCan } from "@app/components/permissions"; +import { + DropdownMenu, + DropdownMenuContent, + DropdownMenuItem, + DropdownMenuTrigger, + EmptyState, + Table, + TableContainer, + TableSkeleton, + TBody, + Td, + Th, + THead, + Tooltip, + Tr} from "@app/components/v2"; +import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; +import { useListWorkspaceCertificates } from "@app/hooks/api"; +import { UsePopUpState } from "@app/hooks/usePopUp"; + +type Props = { + handlePopUpOpen: ( + popUpName: keyof UsePopUpState<["certificate", "deleteCertificate", "certificateCert"]>, + data?: { + certId?: string; + commonName?: string; + } + ) => void; +}; + +export const CertificatesTable = ({ handlePopUpOpen }: Props) => { + const { currentWorkspace } = useWorkspace(); + const { data, isLoading } = useListWorkspaceCertificates(currentWorkspace?.slug ?? ""); + return ( +
+ + + + + + + + + + + {isLoading && } + {!isLoading && + data && + data.length > 0 && + data.map((certificate) => { + return ( + + + + + + + ); + })} + +
Certificate IDCommon NameValid Until +
{certificate.id}{certificate.commonName} + {certificate.notAfter + ? format(new Date(certificate.notAfter), "yyyy-MM-dd") + : "-"} + + + +
+ + + +
+ + + + {(isAllowed) => ( + + handlePopUpOpen("certificateCert", { + certId: certificate.id + }) + } + disabled={!isAllowed} + icon={} + > + Export Certificate + + )} + + + {(isAllowed) => ( + + handlePopUpOpen("certificate", { + certId: certificate.id + }) + } + disabled={!isAllowed} + icon={} + > + View Details + + )} + + + {(isAllowed) => ( + + handlePopUpOpen("deleteCertificate", { + certId: certificate.id, + commonName: certificate.commonName + }) + } + disabled={!isAllowed} + icon={} + > + Delete Certificate + + )} + + + +
+ {!isLoading && data?.length === 0 && ( + + )} + +
+ ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/index.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/index.tsx new file mode 100644 index 000000000..7854a6f8b --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/index.tsx @@ -0,0 +1 @@ +export { CertificatesSection } from "./CertificatesSection"; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/index.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/index.tsx new file mode 100644 index 000000000..277134d56 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/index.tsx @@ -0,0 +1 @@ +export { CertificatesTab } from "./CertificatesTab"; diff --git a/frontend/src/views/Project/CertificatesPage/components/index.tsx b/frontend/src/views/Project/CertificatesPage/components/index.tsx index 9e52be028..9dbd8694f 100644 --- a/frontend/src/views/Project/CertificatesPage/components/index.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/index.tsx @@ -1 +1,2 @@ export { CaTab } from "./CaTab"; +export { CertificatesTab } from "./CertificatesTab"; From 2f06168b29af428553060b00c39772a5681f1b82 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Tue, 28 May 2024 17:18:45 -0700 Subject: [PATCH 019/187] Make CA / cert certs exportable --- .../CaTab/components/CaCertModal.tsx | 121 ++++++++++---- .../components/CertificateCertModal.tsx | 157 ++++++++++++------ 2 files changed, 196 insertions(+), 82 deletions(-) diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx index 320245cae..df1f10469 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx @@ -1,8 +1,8 @@ import { useEffect } from "react"; -import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons"; +import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; -import { IconButton,Modal, ModalContent } from "@app/components/v2"; +import { IconButton, Modal, ModalContent } from "@app/components/v2"; import { useToggle } from "@app/hooks"; import { useGetCaCert } from "@app/hooks/api"; import { UsePopUpState } from "@app/hooks/usePopUp"; @@ -35,6 +35,18 @@ export const CaCertModal = ({ popUp, handlePopUpToggle }: Props) => { return () => clearTimeout(timer); }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied]); + const downloadTxtFile = (filename: string, content: string) => { + const blob = new Blob([content], { type: "text/plain" }); + const url = URL.createObjectURL(blob); + const a = document.createElement("a"); + a.href = url; + a.download = filename; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); + URL.revokeObjectURL(url); + }; + return ( {
-

Certificate Body

+ +
+

Certificate Body

+
+ { + navigator.clipboard.writeText(data.certificate); + setIsCertificateCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate.txt", data.certificate); + }} + > + + + Download + + +
+

{data.certificate}

- { - navigator.clipboard.writeText(data.certificate); - setIsCertificateCopied.on(); - }} - > - - - Click to copy - - -
-

Certificate Chain

-
-

{data.certificateChain}

- { - navigator.clipboard.writeText(data.certificateChain); - setIsCertificateChainCopied.on(); - }} - > - - - Click to copy - -
+ {data.certificateChain && ( + <> +
+

Certificate Chain

+
+ { + navigator.clipboard.writeText(data.certificateChain); + setIsCertificateChainCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate_chain.txt", data.certificate); + }} + > + + + Download + + +
+
+
+

{data.certificateChain}

+
+ + )}
) : (
diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx index 8a48d4f0d..78777b295 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx @@ -1,8 +1,8 @@ import { useEffect } from "react"; -import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons"; +import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; -import { IconButton,Modal, ModalContent } from "@app/components/v2"; +import { IconButton, Modal, ModalContent } from "@app/components/v2"; import { useToggle } from "@app/hooks"; import { useGetCertCert } from "@app/hooks/api"; import { UsePopUpState } from "@app/hooks/usePopUp"; @@ -43,6 +43,18 @@ export const CertificateCertModal = ({ popUp, handlePopUpToggle }: Props) => { return () => clearTimeout(timer); }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied, isCertificateSkCopied]); + const downloadTxtFile = (filename: string, content: string) => { + const blob = new Blob([content], { type: "text/plain" }); + const url = URL.createObjectURL(blob); + const a = document.createElement("a"); + a.href = url; + a.download = filename; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); + URL.revokeObjectURL(url); + }; + return ( {
-

Certificate Body

+
+

Certificate Body

+
+ { + navigator.clipboard.writeText(data.certificate); + setIsCertificateCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate.txt", data.certificate); + }} + > + + + Download + + +
+

{data.certificate}

- { - navigator.clipboard.writeText(data.certificate); - setIsCertificateCopied.on(); - }} - > - - - Click to copy - -
-

Certificate Chain

+
+

Certificate Chain

+
+ { + navigator.clipboard.writeText(data.certificateChain); + setIsCertificateChainCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate_chain.txt", data.certificate); + }} + > + + + Download + + +
+

{data.certificateChain}

- { - navigator.clipboard.writeText(data.certificateChain); - setIsCertificateChainCopied.on(); - }} - > - - - Click to copy - -
-

Certificate Private Key

+
+

Certificate Private Key

+
+ { + navigator.clipboard.writeText(data.privateKey); + setIsCertificateSkCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("private_key.txt", data.privateKey); + }} + > + + + Download + + +
+

{data.privateKey}

- { - navigator.clipboard.writeText(data.certificateChain); - setIsCertificateSkCopied.on(); - }} - > - - - Click to copy - -
) : ( From f9847f48b066022fcb127daeb6374f77a45d7e7c Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Tue, 28 May 2024 22:04:13 -0700 Subject: [PATCH 020/187] Remove cert secret structure, show cert sk once upon issuance --- .../20240522010055_certificate-authority.ts | 17 +- backend/src/server/routes/index.ts | 5 - .../server/routes/v1/certificate-router.ts | 19 +- .../certificate-authority-service.ts | 36 +--- .../certificate/certificate-secret-dal.ts | 10 - .../certificate/certificate-service.ts | 23 +- frontend/src/hooks/api/ca/types.ts | 4 +- .../src/hooks/api/certificates/queries.tsx | 2 - .../CaTab/components/CaCertModal.tsx | 142 +------------ .../components/CertificateCertModal.tsx | 177 +--------------- .../components/CertificateContent.tsx | 190 +++++++++++++++++ .../components/CertificateModal.tsx | 200 ++++++++++-------- 12 files changed, 347 insertions(+), 478 deletions(-) delete mode 100644 backend/src/services/certificate/certificate-secret-dal.ts create mode 100644 frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx diff --git a/backend/src/db/migrations/20240522010055_certificate-authority.ts b/backend/src/db/migrations/20240522010055_certificate-authority.ts index 6a08878ad..bf887beb9 100644 --- a/backend/src/db/migrations/20240522010055_certificate-authority.ts +++ b/backend/src/db/migrations/20240522010055_certificate-authority.ts @@ -5,7 +5,7 @@ import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; export async function up(knex: Knex): Promise { if (!(await knex.schema.hasTable(TableName.CertificateAuthority))) { - // TODO: consider adding algo details + // TODO: add algo deets await knex.schema.createTable(TableName.CertificateAuthority, (t) => { t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); t.timestamps(true, true, true); @@ -77,30 +77,15 @@ export async function up(knex: Knex): Promise { }); } - if (!(await knex.schema.hasTable(TableName.CertificateSecret))) { - await knex.schema.createTable(TableName.CertificateSecret, (t) => { - t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); - t.timestamps(true, true, true); - t.uuid("certId").notNullable().unique(); - t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE"); - t.text("pk").notNullable(); // TODO: encrypt - t.text("sk").notNullable(); // TODO: encrypt - }); - } - await createOnUpdateTrigger(knex, TableName.CertificateAuthority); await createOnUpdateTrigger(knex, TableName.CertificateAuthorityCert); await createOnUpdateTrigger(knex, TableName.CertificateAuthoritySk); await createOnUpdateTrigger(knex, TableName.Certificate); await createOnUpdateTrigger(knex, TableName.CertificateCert); - await createOnUpdateTrigger(knex, TableName.CertificateSecret); } export async function down(knex: Knex): Promise { // certificates - await knex.schema.dropTableIfExists(TableName.CertificateSecret); - await dropOnUpdateTrigger(knex, TableName.CertificateSecret); - await knex.schema.dropTableIfExists(TableName.CertificateCert); await dropOnUpdateTrigger(knex, TableName.CertificateCert); diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index f0253ce67..dfa1fd364 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -73,7 +73,6 @@ import { tokenDALFactory } from "@app/services/auth-token/auth-token-dal"; import { tokenServiceFactory } from "@app/services/auth-token/auth-token-service"; import { certificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; import { certificateDALFactory } from "@app/services/certificate/certificate-dal"; -import { certificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal"; import { certificateServiceFactory } from "@app/services/certificate/certificate-service"; import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; @@ -502,14 +501,11 @@ export const registerRoutes = async ( const certificateDAL = certificateDALFactory(db); const certificateCertDAL = certificateCertDALFactory(db); - const certificateSecretDAL = certificateSecretDALFactory(db); const certificateService = certificateServiceFactory({ certificateDAL, certificateCertDAL, - certificateSecretDAL, certificateAuthorityDAL, - certificateAuthorityCertDAL, permissionService }); @@ -519,7 +515,6 @@ export const registerRoutes = async ( certificateAuthoritySkDAL, certificateDAL, certificateCertDAL, - certificateSecretDAL, projectDAL, permissionService }); diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 37714c067..305afebf9 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -86,26 +86,21 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { 200: z.object({ certificate: z.string().trim(), certificateChain: z.string().trim(), - issuingCaCertificate: z.string().trim(), - privateKey: z.string().trim(), serialNumber: z.string().trim() }) } }, handler: async (req) => { - const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } = - await server.services.certificate.getCertCert({ - certId: req.params.certId, - actor: req.permission.type, - actorId: req.permission.id, - actorAuthMethod: req.permission.authMethod, - actorOrgId: req.permission.orgId - }); + const { certificate, certificateChain, serialNumber } = await server.services.certificate.getCertCert({ + certId: req.params.certId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); return { certificate, certificateChain, - issuingCaCertificate, - privateKey, serialNumber }; } diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index 22c307710..7d9ea02f8 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -7,7 +7,6 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services import { BadRequestError } from "@app/lib/errors"; import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; -import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal"; @@ -29,15 +28,16 @@ import { } from "./certificate-authority-types"; type TCertificateAuthorityServiceFactoryDep = { - // TODO: Pick - certificateAuthorityDAL: TCertificateAuthorityDALFactory; - certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory; - certificateAuthoritySkDAL: TCertificateAuthoritySkDALFactory; - certificateDAL: TCertificateDALFactory; - certificateCertDAL: TCertificateCertDALFactory; - certificateSecretDAL: TCertificateSecretDALFactory; - projectDAL: TProjectDALFactory; - permissionService: TPermissionServiceFactory; + certificateAuthorityDAL: Pick< + TCertificateAuthorityDALFactory, + "transaction" | "create" | "findById" | "updateById" | "deleteById" | "findOne" | "buildCertificateChain" + >; + certificateAuthorityCertDAL: Pick; + certificateAuthoritySkDAL: Pick; + certificateDAL: Pick; + certificateCertDAL: Pick; + projectDAL: Pick; + permissionService: Pick; }; export type TCertificateAuthorityServiceFactory = ReturnType; @@ -48,7 +48,6 @@ export const certificateAuthorityServiceFactory = ({ certificateAuthoritySkDAL, certificateDAL, certificateCertDAL, - certificateSecretDAL, projectDAL, permissionService }: TCertificateAuthorityServiceFactoryDep) => { @@ -624,12 +623,6 @@ export const certificateAuthorityServiceFactory = ({ const chain = await certificateAuthorityDAL.buildCertificateChain(caId); - // https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey - const skObj = KeyObject.from(leafKeys.privateKey); - const sk = skObj.export({ format: "pem", type: "pkcs8" }) as string; - const pkObj = KeyObject.from(leafKeys.publicKey); - const pk = pkObj.export({ format: "pem", type: "spki" }) as string; - await certificateDAL.transaction(async (tx) => { const cert = await certificateDAL.create( { @@ -650,15 +643,6 @@ export const certificateAuthorityServiceFactory = ({ tx ); - await certificateSecretDAL.create( - { - certId: cert.id, - pk, // TODO: encrypt - sk // TODO: encrypt - }, - tx - ); - return cert; }); diff --git a/backend/src/services/certificate/certificate-secret-dal.ts b/backend/src/services/certificate/certificate-secret-dal.ts deleted file mode 100644 index bd0394f78..000000000 --- a/backend/src/services/certificate/certificate-secret-dal.ts +++ /dev/null @@ -1,10 +0,0 @@ -import { TDbClient } from "@app/db"; -import { TableName } from "@app/db/schemas"; -import { ormify } from "@app/lib/knex"; - -export type TCertificateSecretDALFactory = ReturnType; - -export const certificateSecretDALFactory = (db: TDbClient) => { - const certificateSecretOrm = ormify(db, TableName.CertificateSecret); - return certificateSecretOrm; -}; diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index 98cb46d24..09e2cc0fe 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -5,20 +5,15 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; -import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal"; -import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO } from "./certificate-types"; type TCertificateServiceFactoryDep = { - // TODO: Pick - certificateDAL: TCertificateDALFactory; - certificateCertDAL: TCertificateCertDALFactory; - certificateSecretDAL: TCertificateSecretDALFactory; - certificateAuthorityDAL: TCertificateAuthorityDALFactory; - certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory; - permissionService: TPermissionServiceFactory; + certificateDAL: Pick; + certificateCertDAL: Pick; + certificateAuthorityDAL: Pick; + permissionService: Pick; }; export type TCertificateServiceFactory = ReturnType; @@ -26,9 +21,7 @@ export type TCertificateServiceFactory = ReturnType { const getCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => { @@ -77,19 +70,15 @@ export const certificateServiceFactory = ({ actorAuthMethod, actorOrgId ); - // TODO: re-evaluate this permission - ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates); - const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id }); + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); + const certCert = await certificateCertDAL.findOne({ certId }); - const certSecret = await certificateSecretDAL.findOne({ certId }); const certObj = new x509.X509Certificate(certCert.certificate); return { certificate: certCert.certificate, certificateChain: certCert.certificateChain, - issuingCaCertificate: caCert.certificate, - privateKey: certSecret.sk, serialNumber: certObj.serialNumber }; }; diff --git a/frontend/src/hooks/api/ca/types.ts b/frontend/src/hooks/api/ca/types.ts index 3c7eca11f..02ce1862d 100644 --- a/frontend/src/hooks/api/ca/types.ts +++ b/frontend/src/hooks/api/ca/types.ts @@ -1,4 +1,4 @@ -import { CaStatus,CaType } from "./enums"; +import { CaStatus, CaType } from "./enums"; export type TCertificateAuthority = { id: string; @@ -85,6 +85,6 @@ export type TCreateCertificateResponse = { certificate: string; issuingCertificate: string; certificateChain: string; - sk: string; + privateKey: string; serialNumber: string; }; diff --git a/frontend/src/hooks/api/certificates/queries.tsx b/frontend/src/hooks/api/certificates/queries.tsx index 0001ba3ac..e07ff27e7 100644 --- a/frontend/src/hooks/api/certificates/queries.tsx +++ b/frontend/src/hooks/api/certificates/queries.tsx @@ -29,8 +29,6 @@ export const useGetCertCert = (certId: string) => { const { data } = await apiRequest.get<{ certificate: string; certificateChain: string; - issuingCaCertificate: string; - privateKey: string; serialNumber: string; }>(`/api/v1/certificates/${certId}/certificate`); return data; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx index df1f10469..97970d94f 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaCertModal.tsx @@ -1,12 +1,9 @@ -import { useEffect } from "react"; -import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons"; -import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; - -import { IconButton, Modal, ModalContent } from "@app/components/v2"; -import { useToggle } from "@app/hooks"; +import { Modal, ModalContent } from "@app/components/v2"; import { useGetCaCert } from "@app/hooks/api"; import { UsePopUpState } from "@app/hooks/usePopUp"; +import { CertificateContent } from "../../CertificatesTab/components/CertificateContent"; + type Props = { popUp: UsePopUpState<["caCert"]>; handlePopUpToggle: (popUpName: keyof UsePopUpState<["caCert"]>, state?: boolean) => void; @@ -14,39 +11,6 @@ type Props = { export const CaCertModal = ({ popUp, handlePopUpToggle }: Props) => { const { data } = useGetCaCert((popUp?.caCert?.data as { caId: string })?.caId || ""); - const [isSerialNumberCopied, setIsSerialNumberCopied] = useToggle(false); - const [isCertificateCopied, setIsCertificateCopied] = useToggle(false); - const [isCertificateChainCopied, setIsCertificateChainCopied] = useToggle(false); - - useEffect(() => { - let timer: NodeJS.Timeout; - if (isSerialNumberCopied) { - timer = setTimeout(() => setIsSerialNumberCopied.off(), 2000); - } - - if (isCertificateCopied) { - timer = setTimeout(() => setIsCertificateCopied.off(), 2000); - } - - if (isCertificateChainCopied) { - timer = setTimeout(() => setIsCertificateChainCopied.off(), 2000); - } - - return () => clearTimeout(timer); - }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied]); - - const downloadTxtFile = (filename: string, content: string) => { - const blob = new Blob([content], { type: "text/plain" }); - const url = URL.createObjectURL(blob); - const a = document.createElement("a"); - a.href = url; - a.download = filename; - document.body.appendChild(a); - a.click(); - document.body.removeChild(a); - URL.revokeObjectURL(url); - }; - return ( { > {data ? ( -
-

Serial Number

-
-

{data.serialNumber}

- { - navigator.clipboard.writeText(data.serialNumber); - setIsSerialNumberCopied.on(); - }} - > - - - Click to copy - - -
- -
-

Certificate Body

-
- { - navigator.clipboard.writeText(data.certificate); - setIsCertificateCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("certificate.txt", data.certificate); - }} - > - - - Download - - -
-
-
-

{data.certificate}

-
- {data.certificateChain && ( - <> -
-

Certificate Chain

-
- { - navigator.clipboard.writeText(data.certificateChain); - setIsCertificateChainCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("certificate_chain.txt", data.certificate); - }} - > - - - Download - - -
-
-
-

{data.certificateChain}

-
- - )} -
+ ) : (
)} diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx index 78777b295..6ea79d180 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx @@ -1,12 +1,9 @@ -import { useEffect } from "react"; -import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons"; -import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; - -import { IconButton, Modal, ModalContent } from "@app/components/v2"; -import { useToggle } from "@app/hooks"; +import { Modal, ModalContent } from "@app/components/v2"; import { useGetCertCert } from "@app/hooks/api"; import { UsePopUpState } from "@app/hooks/usePopUp"; +import { CertificateContent } from "./CertificateContent"; + type Props = { popUp: UsePopUpState<["certificateCert"]>; handlePopUpToggle: (popUpName: keyof UsePopUpState<["certificateCert"]>, state?: boolean) => void; @@ -17,44 +14,6 @@ export const CertificateCertModal = ({ popUp, handlePopUpToggle }: Props) => { (popUp?.certificateCert?.data as { certId: string })?.certId || "" ); - const [isSerialNumberCopied, setIsSerialNumberCopied] = useToggle(false); - const [isCertificateCopied, setIsCertificateCopied] = useToggle(false); - const [isCertificateChainCopied, setIsCertificateChainCopied] = useToggle(false); - const [isCertificateSkCopied, setIsCertificateSkCopied] = useToggle(false); - - useEffect(() => { - let timer: NodeJS.Timeout; - if (isSerialNumberCopied) { - timer = setTimeout(() => setIsSerialNumberCopied.off(), 2000); - } - - if (isCertificateCopied) { - timer = setTimeout(() => setIsCertificateCopied.off(), 2000); - } - - if (isCertificateChainCopied) { - timer = setTimeout(() => setIsCertificateChainCopied.off(), 2000); - } - - if (isCertificateSkCopied) { - timer = setTimeout(() => setIsCertificateSkCopied.off(), 2000); - } - - return () => clearTimeout(timer); - }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied, isCertificateSkCopied]); - - const downloadTxtFile = (filename: string, content: string) => { - const blob = new Blob([content], { type: "text/plain" }); - const url = URL.createObjectURL(blob); - const a = document.createElement("a"); - a.href = url; - a.download = filename; - document.body.appendChild(a); - a.click(); - document.body.removeChild(a); - URL.revokeObjectURL(url); - }; - return ( { > {data ? ( -
-

Serial Number

-
-

{data.serialNumber}

- { - navigator.clipboard.writeText(data.serialNumber); - setIsSerialNumberCopied.on(); - }} - > - - - Click to copy - - -
-
-

Certificate Body

-
- { - navigator.clipboard.writeText(data.certificate); - setIsCertificateCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("certificate.txt", data.certificate); - }} - > - - - Download - - -
-
-
-

{data.certificate}

-
-
-

Certificate Chain

-
- { - navigator.clipboard.writeText(data.certificateChain); - setIsCertificateChainCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("certificate_chain.txt", data.certificate); - }} - > - - - Download - - -
-
-
-

{data.certificateChain}

-
-
-

Certificate Private Key

-
- { - navigator.clipboard.writeText(data.privateKey); - setIsCertificateSkCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("private_key.txt", data.privateKey); - }} - > - - - Download - - -
-
-
-

{data.privateKey}

-
-
+ ) : (
)} diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx new file mode 100644 index 000000000..ac5eb3fd7 --- /dev/null +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx @@ -0,0 +1,190 @@ +import { useEffect } from "react"; +import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + +import { IconButton } from "@app/components/v2"; +import { useToggle } from "@app/hooks"; + +type Props = { + serialNumber: string; + certificate: string; + certificateChain: string; + privateKey?: string; +}; + +export const CertificateContent = ({ + serialNumber, + certificate, + certificateChain, + privateKey +}: Props) => { + const [isSerialNumberCopied, setIsSerialNumberCopied] = useToggle(false); + const [isCertificateCopied, setIsCertificateCopied] = useToggle(false); + const [isCertificateChainCopied, setIsCertificateChainCopied] = useToggle(false); + const [isCertificateSkCopied, setIsCertificateSkCopied] = useToggle(false); + + useEffect(() => { + let timer: NodeJS.Timeout; + if (isSerialNumberCopied) { + timer = setTimeout(() => setIsSerialNumberCopied.off(), 2000); + } + + if (isCertificateCopied) { + timer = setTimeout(() => setIsCertificateCopied.off(), 2000); + } + + if (isCertificateChainCopied) { + timer = setTimeout(() => setIsCertificateChainCopied.off(), 2000); + } + + if (isCertificateSkCopied) { + timer = setTimeout(() => setIsCertificateSkCopied.off(), 2000); + } + + return () => clearTimeout(timer); + }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied, isCertificateSkCopied]); + + const downloadTxtFile = (filename: string, content: string) => { + const blob = new Blob([content], { type: "text/plain" }); + const url = URL.createObjectURL(blob); + const a = document.createElement("a"); + a.href = url; + a.download = filename; + document.body.appendChild(a); + a.click(); + document.body.removeChild(a); + URL.revokeObjectURL(url); + }; + + return ( +
+

Serial Number

+
+

{serialNumber}

+ { + navigator.clipboard.writeText(serialNumber); + setIsSerialNumberCopied.on(); + }} + > + + + Click to copy + + +
+
+

Certificate Body

+
+ { + navigator.clipboard.writeText(certificate); + setIsCertificateCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate.txt", certificate); + }} + > + + + Download + + +
+
+
+

{certificate}

+
+
+

Certificate Chain

+
+ { + navigator.clipboard.writeText(certificateChain); + setIsCertificateChainCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate_chain.txt", certificate); + }} + > + + + Download + + +
+
+
+

{certificateChain}

+
+ {privateKey && ( + <> +
+

Certificate Private Key

+
+ { + navigator.clipboard.writeText(privateKey); + setIsCertificateSkCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("private_key.txt", privateKey); + }} + > + + + Download + + +
+
+
+

{privateKey}

+
+ + )} +
+ ); +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx index a740b9063..6fd27d145 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx @@ -1,4 +1,4 @@ -import { useEffect } from "react"; +import { useEffect, useState } from "react"; import { Controller, useForm } from "react-hook-form"; import { zodResolver } from "@hookform/resolvers/zod"; import { format } from "date-fns"; @@ -24,6 +24,8 @@ import { import { caTypeToNameMap } from "@app/hooks/api/ca/constants"; import { UsePopUpState } from "@app/hooks/usePopUp"; +import { CertificateContent } from "./CertificateContent"; + const isValidDate = (dateString: string) => { if (dateString === "") return true; const date = new Date(dateString); @@ -48,7 +50,15 @@ type Props = { handlePopUpToggle: (popUpName: keyof UsePopUpState<["certificate"]>, state?: boolean) => void; }; +type TCertificateDetails = { + serialNumber: string; + certificate: string; + certificateChain: string; + privateKey: string; +}; + export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { + const [certificateDetails, setCertificateDetails] = useState(null); const { currentWorkspace } = useWorkspace(); const { data: cert } = useGetCertById( (popUp?.certificate?.data as { certId: string })?.certId || "" @@ -93,7 +103,7 @@ export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { try { if (!currentWorkspace?.slug) return; - await createCertificate({ + const { serialNumber, certificate, certificateChain, privateKey } = await createCertificate({ projectSlug: currentWorkspace.slug, caId, commonName, @@ -103,7 +113,13 @@ export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { }); reset(); - handlePopUpToggle("certificate", false); + + setCertificateDetails({ + serialNumber, + certificate, + certificateChain, + privateKey + }); createNotification({ text: "Successfully created certificate", @@ -122,7 +138,7 @@ export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { if (cas?.length) { setValue("caId", cas[0].id); } - }, [cas, setValue]); + }, [cas]); return ( { onOpenChange={(isOpen) => { handlePopUpToggle("certificate", isOpen); reset(); + setCertificateDetails(null); }} > -
- ( - - - + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + ( + + + + )} + /> + {!cert && ( +
+ + +
)} + + ) : ( + - ( - - - - )} - /> - ( - - - - )} - /> - ( - - - - )} - /> - {!cert && ( -
- - -
- )} - + )}
); From a2a786f392203d6d42315a71bf603fee0abe8d4f Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 29 May 2024 16:12:46 -0700 Subject: [PATCH 021/187] Transfer cert endpoints to work with serial numbers --- .../20240522010055_certificate-authority.ts | 5 +- .../src/db/schemas/certificate-authorities.ts | 1 + backend/src/db/schemas/certificates.ts | 2 + .../server/routes/v1/certificate-router.ts | 58 +++++++++++--- backend/src/server/routes/v1/index.ts | 9 ++- .../certificate-authority-service.ts | 34 ++++++-- .../certificate-authority-types.ts | 2 - .../certificate/certificate-service.ts | 46 ++++++++--- .../services/certificate/certificate-types.ts | 15 +++- .../src/services/project/project-service.ts | 2 +- frontend/src/hooks/api/ca/mutations.tsx | 15 ++-- frontend/src/hooks/api/ca/queries.tsx | 6 +- .../src/hooks/api/certificates/constants.tsx | 6 ++ frontend/src/hooks/api/certificates/enums.tsx | 4 + frontend/src/hooks/api/certificates/index.tsx | 4 +- .../src/hooks/api/certificates/mutations.tsx | 32 +++++--- .../src/hooks/api/certificates/queries.tsx | 22 +++--- frontend/src/hooks/api/certificates/types.ts | 14 ++++ .../components/CertificateCertModal.tsx | 2 +- .../components/CertificateContent.tsx | 74 +++++++++-------- .../components/CertificateModal.tsx | 11 +-- .../components/CertificatesSection.tsx | 79 ++++++++++++++----- .../components/CertificatesTable.tsx | 42 ++++++++-- 23 files changed, 346 insertions(+), 139 deletions(-) create mode 100644 frontend/src/hooks/api/certificates/constants.tsx create mode 100644 frontend/src/hooks/api/certificates/enums.tsx diff --git a/backend/src/db/migrations/20240522010055_certificate-authority.ts b/backend/src/db/migrations/20240522010055_certificate-authority.ts index bf887beb9..b8e3eb171 100644 --- a/backend/src/db/migrations/20240522010055_certificate-authority.ts +++ b/backend/src/db/migrations/20240522010055_certificate-authority.ts @@ -23,6 +23,7 @@ export async function up(knex: Knex): Promise { t.string("commonName").notNullable(); t.string("dn").notNullable(); t.unique(["dn", "projectId"]); + t.string("serialNumber").nullable().unique(); t.integer("maxPathLength").nullable(); t.datetime("notBefore").nullable(); t.datetime("notAfter").nullable(); @@ -54,12 +55,14 @@ export async function up(knex: Knex): Promise { } if (!(await knex.schema.hasTable(TableName.Certificate))) { - // TODO: consider adding name + // TODO: consider adding serialNumber await knex.schema.createTable(TableName.Certificate, (t) => { t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); t.timestamps(true, true, true); t.uuid("caId").notNullable(); t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE"); + t.string("status").notNullable(); // active / pending-certificate + t.string("serialNumber").notNullable().unique(); t.string("commonName").notNullable(); t.datetime("notBefore").notNullable(); t.datetime("notAfter").notNullable(); diff --git a/backend/src/db/schemas/certificate-authorities.ts b/backend/src/db/schemas/certificate-authorities.ts index da69dd5a5..7e2d147f4 100644 --- a/backend/src/db/schemas/certificate-authorities.ts +++ b/backend/src/db/schemas/certificate-authorities.ts @@ -22,6 +22,7 @@ export const CertificateAuthoritiesSchema = z.object({ locality: z.string(), commonName: z.string(), dn: z.string(), + serialNumber: z.string().nullable().optional(), maxPathLength: z.number().nullable().optional(), notBefore: z.date().nullable().optional(), notAfter: z.date().nullable().optional() diff --git a/backend/src/db/schemas/certificates.ts b/backend/src/db/schemas/certificates.ts index 74486258d..d64b17d8e 100644 --- a/backend/src/db/schemas/certificates.ts +++ b/backend/src/db/schemas/certificates.ts @@ -12,6 +12,8 @@ export const CertificatesSchema = z.object({ createdAt: z.date(), updatedAt: z.date(), caId: z.string().uuid(), + status: z.string(), + serialNumber: z.string(), commonName: z.string(), notBefore: z.date(), notAfter: z.date() diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 305afebf9..8963c3940 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -8,7 +8,7 @@ import { AuthMode } from "@app/services/auth/auth-type"; export const registerCertRouter = async (server: FastifyZodProvider) => { server.route({ method: "GET", - url: "/:certId", + url: "/:serialNumber", config: { rateLimit: readLimit }, @@ -16,7 +16,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { schema: { description: "Get certificate", params: z.object({ - certId: z.string().trim() + serialNumber: z.string().trim() }), response: { 200: z.object({ @@ -25,8 +25,8 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const certificate = await server.services.certificate.getCertById({ - certId: req.params.certId, + const certificate = await server.services.certificate.getCert({ + serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, @@ -38,9 +38,45 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }); + server.route({ + method: "POST", + url: "/:serialNumber/revoke", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Revoke", + params: z.object({ + serialNumber: z.string().trim() + }), + response: { + 200: z.object({ + message: z.string().trim(), + serialNumber: z.string().trim(), + revokedAt: z.date() + }) + } + }, + handler: async (req) => { + await server.services.certificate.revokeCert({ + serialNumber: req.params.serialNumber, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { + message: "Successfully revoked certificate", + serialNumber: req.params.serialNumber, + revokedAt: new Date() + }; + } + }); + server.route({ method: "DELETE", - url: "/:certId", + url: "/:serialNumber", config: { rateLimit: writeLimit }, @@ -48,7 +84,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { schema: { description: "Delete certificate", params: z.object({ - certId: z.string().trim() + serialNumber: z.string().trim() }), response: { 200: z.object({ @@ -57,8 +93,8 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const certificate = await server.services.certificate.deleteCertById({ - certId: req.params.certId, + const certificate = await server.services.certificate.deleteCert({ + serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, @@ -72,7 +108,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { server.route({ method: "GET", - url: "/:certId/certificate", + url: "/:serialNumber/certificate", config: { rateLimit: readLimit }, @@ -80,7 +116,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { schema: { description: "Get certificate of certificate", params: z.object({ - certId: z.string().trim() + serialNumber: z.string().trim() }), response: { 200: z.object({ @@ -92,7 +128,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { }, handler: async (req) => { const { certificate, certificateChain, serialNumber } = await server.services.certificate.getCertCert({ - certId: req.params.certId, + serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts index 61ef947ac..52248ac63 100644 --- a/backend/src/server/routes/v1/index.ts +++ b/backend/src/server/routes/v1/index.ts @@ -60,8 +60,13 @@ export const registerV1Routes = async (server: FastifyZodProvider) => { { prefix: "/workspace" } ); - await server.register(registerCaRouter, { prefix: "/ca" }); - await server.register(registerCertRouter, { prefix: "/certificates" }); + await server.register( + async (pkiRouter) => { + await pkiRouter.register(registerCaRouter, { prefix: "/ca" }); + await pkiRouter.register(registerCertRouter, { prefix: "/certificates" }); + }, + { prefix: "/pki" } + ); await server.register(registerProjectBotRouter, { prefix: "/bot" }); await server.register(registerIntegrationRouter, { prefix: "/integration" }); diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index 7d9ea02f8..1fdfbfdb5 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -1,3 +1,4 @@ +/* eslint-disable no-bitwise */ import { ForbiddenError } from "@casl/ability"; import * as x509 from "@peculiar/x509"; import crypto, { KeyObject } from "crypto"; @@ -9,6 +10,7 @@ import { TCertificateCertDALFactory } from "@app/services/certificate/certificat import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; +import { TCertStatus } from "../certificate/certificate-types"; import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal"; import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal"; import { createDistinguishedName } from "./certificate-authority-fns"; @@ -118,6 +120,7 @@ export const certificateAuthorityServiceFactory = ({ ? new Date(notAfter) : new Date(new Date().setFullYear(new Date().getFullYear() + 10)); + const serialNumber = crypto.randomBytes(32).toString("hex"); const ca = await certificateAuthorityDAL.create( { projectId: project.id, @@ -130,7 +133,7 @@ export const certificateAuthorityServiceFactory = ({ commonName, status: type === CaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE, dn, - ...(type === CaType.ROOT && { maxPathLength, notBefore: notBeforeDate, notAfter: notAfterDate }) + ...(type === CaType.ROOT && { maxPathLength, notBefore: notBeforeDate, notAfter: notAfterDate, serialNumber }) }, tx ); @@ -140,6 +143,7 @@ export const certificateAuthorityServiceFactory = ({ const cert = await x509.X509CertificateGenerator.createSelfSigned({ name: dn, + serialNumber, notBefore: notBeforeDate, notAfter: notAfterDate, signingAlgorithm: alg, @@ -291,7 +295,12 @@ export const certificateAuthorityServiceFactory = ({ signingAlgorithm: alg, extensions: [ // eslint-disable-next-line no-bitwise - new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment) + new x509.KeyUsagesExtension( + x509.KeyUsageFlags.keyCertSign | + x509.KeyUsageFlags.cRLSign | + x509.KeyUsageFlags.digitalSignature | + x509.KeyUsageFlags.keyEncipherment + ) ], attributes: [new x509.ChallengePasswordAttribute("password")] }); @@ -411,8 +420,9 @@ export const certificateAuthorityServiceFactory = ({ throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" }); } + const serialNumber = crypto.randomBytes(32).toString("hex"); const intermediateCert = await x509.X509CertificateGenerator.create({ - // serialNumber: "03", + serialNumber, subject: csrObj.subject, issuer: certObj.subject, notBefore: notBeforeDate, @@ -421,7 +431,13 @@ export const certificateAuthorityServiceFactory = ({ publicKey: csrObj.publicKey, signingAlgorithm: alg, extensions: [ - new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true), + new x509.KeyUsagesExtension( + x509.KeyUsageFlags.keyCertSign | + x509.KeyUsageFlags.cRLSign | + x509.KeyUsageFlags.digitalSignature | + x509.KeyUsageFlags.keyEncipherment, + true + ), new x509.BasicConstraintsExtension(true, maxPathLength === -1 ? undefined : maxPathLength, true), await x509.AuthorityKeyIdentifierExtension.create(certObj, false), await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey) @@ -511,6 +527,7 @@ export const certificateAuthorityServiceFactory = ({ maxPathLength: maxPathLength === undefined ? -1 : maxPathLength, notBefore: new Date(certObj.notBefore), notAfter: new Date(certObj.notAfter), + serialNumber: certObj.serialNumber, parentCaId: parentCa?.id }, tx @@ -601,8 +618,9 @@ export const certificateAuthorityServiceFactory = ({ throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" }); } + const serialNumber = crypto.randomBytes(32).toString("hex"); const leafCert = await x509.X509CertificateGenerator.create({ - // serialNumber: "03", + serialNumber, subject: csrObj.subject, issuer: caCertObj.subject, notBefore: notBeforeDate, @@ -611,7 +629,7 @@ export const certificateAuthorityServiceFactory = ({ publicKey: csrObj.publicKey, signingAlgorithm: alg, extensions: [ - new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true), + new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment, true), new x509.BasicConstraintsExtension(false), await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false), await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey) @@ -627,7 +645,9 @@ export const certificateAuthorityServiceFactory = ({ const cert = await certificateDAL.create( { caId: ca.id, + status: TCertStatus.ACTIVE, commonName, + serialNumber, notBefore: notBeforeDate, notAfter: notAfterDate }, @@ -651,7 +671,7 @@ export const certificateAuthorityServiceFactory = ({ certificateChain: chain.join("\n"), issuingCaCertificate: caCert.certificate, privateKey: skLeaf, - serialNumber: leafCert.serialNumber + serialNumber }; }; diff --git a/backend/src/services/certificate-authority/certificate-authority-types.ts b/backend/src/services/certificate-authority/certificate-authority-types.ts index 5c3a22e35..dbb0c52c9 100644 --- a/backend/src/services/certificate-authority/certificate-authority-types.ts +++ b/backend/src/services/certificate-authority/certificate-authority-types.ts @@ -11,8 +11,6 @@ export enum CaStatus { PENDING_CERTIFICATE = "pending-certificate" } -// TODO: attach permissions after draft impl - export type TCreateCaDTO = { projectSlug: string; type: CaType; diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index 09e2cc0fe..fee486144 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -7,10 +7,10 @@ import { TCertificateCertDALFactory } from "@app/services/certificate/certificat import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; -import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO } from "./certificate-types"; +import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO, TRevokeCertDTO } from "./certificate-types"; type TCertificateServiceFactoryDep = { - certificateDAL: Pick; + certificateDAL: Pick; certificateCertDAL: Pick; certificateAuthorityDAL: Pick; permissionService: Pick; @@ -24,8 +24,8 @@ export const certificateServiceFactory = ({ certificateAuthorityDAL, permissionService }: TCertificateServiceFactoryDep) => { - const getCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => { - const cert = await certificateDAL.findById(certId); + const getCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => { + const cert = await certificateDAL.findOne({ serialNumber }); const ca = await certificateAuthorityDAL.findById(cert.caId); const { permission } = await permissionService.getProjectPermission( @@ -41,8 +41,8 @@ export const certificateServiceFactory = ({ return cert; }; - const deleteCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => { - const cert = await certificateDAL.findById(certId); + const deleteCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => { + const cert = await certificateDAL.findOne({ serialNumber }); const ca = await certificateAuthorityDAL.findById(cert.caId); const { permission } = await permissionService.getProjectPermission( @@ -59,8 +59,31 @@ export const certificateServiceFactory = ({ return deletedCert; }; - const getCertCert = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => { - const cert = await certificateDAL.findById(certId); + const revokeCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TRevokeCertDTO) => { + const cert = await certificateDAL.findOne({ serialNumber }); + const ca = await certificateAuthorityDAL.findById(cert.caId); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates); + // WIP + + // const revocationDate = new Date(); + + // const serialNumber2 = crypto.randomBytes(16).toString("hex"); + // const crlEntry = new x509.X509CrlEntry(serialNumber2, new Date(), []); + + return {}; + }; + + const getCertCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => { + const cert = await certificateDAL.findOne({ serialNumber }); const ca = await certificateAuthorityDAL.findById(cert.caId); const { permission } = await permissionService.getProjectPermission( @@ -73,7 +96,7 @@ export const certificateServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); - const certCert = await certificateCertDAL.findOne({ certId }); + const certCert = await certificateCertDAL.findOne({ certId: cert.id }); const certObj = new x509.X509Certificate(certCert.certificate); return { @@ -84,8 +107,9 @@ export const certificateServiceFactory = ({ }; return { - getCertById, - deleteCertById, + getCert, + deleteCert, + revokeCert, getCertCert }; }; diff --git a/backend/src/services/certificate/certificate-types.ts b/backend/src/services/certificate/certificate-types.ts index 1389896c6..6ba8b796e 100644 --- a/backend/src/services/certificate/certificate-types.ts +++ b/backend/src/services/certificate/certificate-types.ts @@ -1,13 +1,22 @@ import { TProjectPermission } from "@app/lib/types"; +export enum TCertStatus { + ACTIVE = "active", + REVOKED = "revoked" +} + export type TGetCertDTO = { - certId: string; + serialNumber: string; } & Omit; export type TDeleteCertDTO = { - certId: string; + serialNumber: string; +} & Omit; + +export type TRevokeCertDTO = { + serialNumber: string; } & Omit; export type TGetCertCertDTO = { - certId: string; + serialNumber: string; } & Omit; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 961a57985..753b1efba 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -67,7 +67,7 @@ type TProjectServiceFactoryDep = { projectUserMembershipRoleDAL: Pick; secretBlindIndexDAL: Pick; certificateAuthorityDAL: Pick; - certificateDAL: TCertificateDALFactory; + certificateDAL: Pick; permissionService: TPermissionServiceFactory; orgService: Pick; licenseService: Pick; diff --git a/frontend/src/hooks/api/ca/mutations.tsx b/frontend/src/hooks/api/ca/mutations.tsx index 49de70d4f..3a8f18e17 100644 --- a/frontend/src/hooks/api/ca/mutations.tsx +++ b/frontend/src/hooks/api/ca/mutations.tsx @@ -13,7 +13,8 @@ import { TImportCaCertificateResponse, TSignIntermediateDTO, TSignIntermediateResponse, - TUpdateCaDTO} from "./types"; + TUpdateCaDTO +} from "./types"; export const useCreateCa = () => { const queryClient = useQueryClient(); @@ -21,7 +22,7 @@ export const useCreateCa = () => { mutationFn: async (body) => { const { data: { ca } - } = await apiRequest.post<{ ca: TCertificateAuthority }>("/api/v1/ca/", body); + } = await apiRequest.post<{ ca: TCertificateAuthority }>("/api/v1/pki/ca/", body); return ca; }, onSuccess: (_, { projectSlug }) => { @@ -36,7 +37,7 @@ export const useUpdateCa = () => { mutationFn: async ({ caId, projectSlug, ...body }) => { const { data: { ca } - } = await apiRequest.patch<{ ca: TCertificateAuthority }>(`/api/v1/ca/${caId}`, body); + } = await apiRequest.patch<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`, body); return ca; }, onSuccess: (_, { projectSlug }) => { @@ -51,7 +52,7 @@ export const useDeleteCa = () => { mutationFn: async ({ caId }) => { const { data: { ca } - } = await apiRequest.delete<{ ca: TCertificateAuthority }>(`/api/v1/ca/${caId}`); + } = await apiRequest.delete<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`); return ca; }, onSuccess: (_, { projectSlug }) => { @@ -65,7 +66,7 @@ export const useSignIntermediate = () => { return useMutation({ mutationFn: async (body) => { const { data } = await apiRequest.post( - `/api/v1/ca/${body.caId}/sign-intermediate`, + `/api/v1/pki/ca/${body.caId}/sign-intermediate`, body ); return data; @@ -78,7 +79,7 @@ export const useImportCaCertificate = () => { return useMutation({ mutationFn: async ({ caId, ...body }) => { const { data } = await apiRequest.post( - `/api/v1/ca/${caId}/import-certificate`, + `/api/v1/pki/ca/${caId}/import-certificate`, body ); return data; @@ -95,7 +96,7 @@ export const useCreateCertificate = () => { return useMutation({ mutationFn: async ({ caId, ...body }) => { const { data } = await apiRequest.post( - `/api/v1/ca/${caId}/issue-certificate`, + `/api/v1/pki/ca/${caId}/issue-certificate`, body ); return data; diff --git a/frontend/src/hooks/api/ca/queries.tsx b/frontend/src/hooks/api/ca/queries.tsx index 838f50726..a0e64fd4e 100644 --- a/frontend/src/hooks/api/ca/queries.tsx +++ b/frontend/src/hooks/api/ca/queries.tsx @@ -16,7 +16,7 @@ export const useGetCaById = (caId: string) => { queryFn: async () => { const { data: { ca } - } = await apiRequest.get<{ ca: TCertificateAuthority }>(`/api/v1/ca/${caId}`); + } = await apiRequest.get<{ ca: TCertificateAuthority }>(`/api/v1/pki/ca/${caId}`); return ca; }, enabled: Boolean(caId) @@ -31,7 +31,7 @@ export const useGetCaCert = (caId: string) => { certificate: string; certificateChain: string; serialNumber: string; - }>(`/api/v1/ca/${caId}/certificate`); + }>(`/api/v1/pki/ca/${caId}/certificate`); return data; }, enabled: Boolean(caId) @@ -46,7 +46,7 @@ export const useGetCaCsr = (caId: string) => { data: { csr } } = await apiRequest.get<{ csr: string; - }>(`/api/v1/ca/${caId}/csr`); + }>(`/api/v1/pki/ca/${caId}/csr`); return csr; }, enabled: Boolean(caId) diff --git a/frontend/src/hooks/api/certificates/constants.tsx b/frontend/src/hooks/api/certificates/constants.tsx new file mode 100644 index 000000000..6188006e6 --- /dev/null +++ b/frontend/src/hooks/api/certificates/constants.tsx @@ -0,0 +1,6 @@ +import { CertStatus } from "./enums"; + +export const certStatusToNameMap: { [K in CertStatus]: string } = { + [CertStatus.ACTIVE]: "Active", + [CertStatus.REVOKED]: "Revoked" +}; diff --git a/frontend/src/hooks/api/certificates/enums.tsx b/frontend/src/hooks/api/certificates/enums.tsx new file mode 100644 index 000000000..5bab7ce1b --- /dev/null +++ b/frontend/src/hooks/api/certificates/enums.tsx @@ -0,0 +1,4 @@ +export enum CertStatus { + ACTIVE = "active", + REVOKED = "revoked" +} diff --git a/frontend/src/hooks/api/certificates/index.tsx b/frontend/src/hooks/api/certificates/index.tsx index 095d7d10a..df3f39fc7 100644 --- a/frontend/src/hooks/api/certificates/index.tsx +++ b/frontend/src/hooks/api/certificates/index.tsx @@ -1,2 +1,2 @@ -export { useDeleteCert } from "./mutations"; -export { useGetCertById, useGetCertCert } from "./queries"; +export { useDeleteCert, useRevokeCert } from "./mutations"; +export { useGetCert, useGetCertCert } from "./queries"; diff --git a/frontend/src/hooks/api/certificates/mutations.tsx b/frontend/src/hooks/api/certificates/mutations.tsx index 0e128c37d..ae2a6a745 100644 --- a/frontend/src/hooks/api/certificates/mutations.tsx +++ b/frontend/src/hooks/api/certificates/mutations.tsx @@ -3,20 +3,34 @@ import { useMutation, useQueryClient } from "@tanstack/react-query"; import { apiRequest } from "@app/config/request"; import { workspaceKeys } from "../workspace/queries"; -import { TCertificate } from "./types"; - -export type TDeleteCaDTO = { - projectSlug: string; - certId: string; -}; +import { TCertificate, TDeleteCertDTO, TRevokeCertDTO } from "./types"; export const useDeleteCert = () => { const queryClient = useQueryClient(); - return useMutation({ - mutationFn: async ({ certId }) => { + return useMutation({ + mutationFn: async ({ serialNumber }) => { const { data: { certificate } - } = await apiRequest.delete<{ certificate: TCertificate }>(`/api/v1/certificates/${certId}`); + } = await apiRequest.delete<{ certificate: TCertificate }>( + `/api/v1/pki/certificates/${serialNumber}` + ); + return certificate; + }, + onSuccess: (_, { projectSlug }) => { + queryClient.invalidateQueries(workspaceKeys.getWorkspaceCertificates(projectSlug)); + } + }); +}; + +export const useRevokeCert = () => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ serialNumber }) => { + const { + data: { certificate } + } = await apiRequest.post<{ certificate: TCertificate }>( + `/api/v1/pki/certificates/${serialNumber}/revoke` + ); return certificate; }, onSuccess: (_, { projectSlug }) => { diff --git a/frontend/src/hooks/api/certificates/queries.tsx b/frontend/src/hooks/api/certificates/queries.tsx index e07ff27e7..86ae3d4be 100644 --- a/frontend/src/hooks/api/certificates/queries.tsx +++ b/frontend/src/hooks/api/certificates/queries.tsx @@ -5,34 +5,36 @@ import { apiRequest } from "@app/config/request"; import { TCertificate } from "./types"; export const certKeys = { - getCertById: (certId: string) => [{ certId }, "cert"], - getCertCert: (certId: string) => [{ certId }, "certCert"] + getCertById: (serialNumber: string) => [{ serialNumber }, "cert"], + getCertCert: (serialNumber: string) => [{ serialNumber }, "certCert"] }; -export const useGetCertById = (certId: string) => { +export const useGetCert = (serialNumber: string) => { return useQuery({ - queryKey: certKeys.getCertById(certId), + queryKey: certKeys.getCertById(serialNumber), queryFn: async () => { const { data: { certificate } - } = await apiRequest.get<{ certificate: TCertificate }>(`/api/v1/certificates/${certId}`); + } = await apiRequest.get<{ certificate: TCertificate }>( + `/api/v1/pki/certificates/${serialNumber}` + ); return certificate; }, - enabled: Boolean(certId) + enabled: Boolean(serialNumber) }); }; -export const useGetCertCert = (certId: string) => { +export const useGetCertCert = (serialNumber: string) => { return useQuery({ - queryKey: certKeys.getCertCert(certId), + queryKey: certKeys.getCertCert(serialNumber), queryFn: async () => { const { data } = await apiRequest.get<{ certificate: string; certificateChain: string; serialNumber: string; - }>(`/api/v1/certificates/${certId}/certificate`); + }>(`/api/v1/pki/certificates/${serialNumber}/certificate`); return data; }, - enabled: Boolean(certId) + enabled: Boolean(serialNumber) }); }; diff --git a/frontend/src/hooks/api/certificates/types.ts b/frontend/src/hooks/api/certificates/types.ts index 71f2e5cd9..0ea0d6323 100644 --- a/frontend/src/hooks/api/certificates/types.ts +++ b/frontend/src/hooks/api/certificates/types.ts @@ -1,7 +1,21 @@ +import { CertStatus } from "./enums"; + export type TCertificate = { id: string; caId: string; + status: CertStatus; commonName: string; + serialNumber: string; notBefore: string; notAfter: string; }; + +export type TDeleteCertDTO = { + projectSlug: string; + serialNumber: string; +}; + +export type TRevokeCertDTO = { + projectSlug: string; + serialNumber: string; +}; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx index 6ea79d180..97c56b0ec 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx @@ -11,7 +11,7 @@ type Props = { export const CertificateCertModal = ({ popUp, handlePopUpToggle }: Props) => { const { data } = useGetCertCert( - (popUp?.certificateCert?.data as { certId: string })?.certId || "" + (popUp?.certificateCert?.data as { serialNumber: string })?.serialNumber || "" ); return ( diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx index ac5eb3fd7..5b3773212 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx @@ -111,41 +111,45 @@ export const CertificateContent = ({

{certificate}

-
-

Certificate Chain

-
- { - navigator.clipboard.writeText(certificateChain); - setIsCertificateChainCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("certificate_chain.txt", certificate); - }} - > - - - Download - - -
-
-
-

{certificateChain}

-
+ {certificateChain && ( + <> +
+

Certificate Chain

+
+ { + navigator.clipboard.writeText(certificateChain); + setIsCertificateChainCopied.on(); + }} + > + + + Copy + + + { + downloadTxtFile("certificate_chain.txt", certificateChain); + }} + > + + + Download + + +
+
+
+

{certificateChain}

+
+ + )} {privateKey && ( <>
diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx index 6fd27d145..fe91ca603 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx @@ -15,12 +15,7 @@ import { SelectItem } from "@app/components/v2"; import { useWorkspace } from "@app/context"; -import { - CaStatus, - useCreateCertificate, - useGetCertById, - useListWorkspaceCas -} from "@app/hooks/api"; +import { CaStatus, useCreateCertificate, useGetCert, useListWorkspaceCas } from "@app/hooks/api"; import { caTypeToNameMap } from "@app/hooks/api/ca/constants"; import { UsePopUpState } from "@app/hooks/usePopUp"; @@ -60,8 +55,8 @@ type TCertificateDetails = { export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { const [certificateDetails, setCertificateDetails] = useState(null); const { currentWorkspace } = useWorkspace(); - const { data: cert } = useGetCertById( - (popUp?.certificate?.data as { certId: string })?.certId || "" + const { data: cert } = useGetCert( + (popUp?.certificate?.data as { serialNumber: string })?.serialNumber || "" ); const { data: cas } = useListWorkspaceCas({ diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx index addcff7a8..cf6a338c2 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesSection.tsx @@ -2,9 +2,10 @@ import { faPlus } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { createNotification } from "@app/components/notifications"; +import { ProjectPermissionCan } from "@app/components/permissions"; import { Button, DeleteActionModal } from "@app/components/v2"; -import { useWorkspace } from "@app/context"; -import { useDeleteCert } from "@app/hooks/api"; +import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; +import { useDeleteCert, useRevokeCert } from "@app/hooks/api"; import { usePopUp } from "@app/hooks/usePopUp"; import { CertificateCertModal } from "./CertificateCertModal"; @@ -14,18 +15,20 @@ import { CertificatesTable } from "./CertificatesTable"; export const CertificatesSection = () => { const { currentWorkspace } = useWorkspace(); const { mutateAsync: deleteCert } = useDeleteCert(); + const { mutateAsync: revokeCert } = useRevokeCert(); const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([ "certificate", "certificateCert", - "deleteCertificate" + "deleteCertificate", + "revokeCertificate" ] as const); - const onRemoveCertificateSubmit = async (certId: string) => { + const onRemoveCertificateSubmit = async (serialNumber: string) => { try { if (!currentWorkspace?.slug) return; - await deleteCert({ certId, projectSlug: currentWorkspace.slug }); + await deleteCert({ serialNumber, projectSlug: currentWorkspace.slug }); await createNotification({ text: "Successfully deleted certificate", @@ -42,23 +45,47 @@ export const CertificatesSection = () => { } }; + const onRevokeCertificateSubmit = async (serialNumber: string) => { + try { + if (!currentWorkspace?.slug) return; + + await revokeCert({ serialNumber, projectSlug: currentWorkspace.slug }); + + await createNotification({ + text: "Successfully revoked certificate", + type: "success" + }); + + handlePopUpClose("revokeCertificate"); + } catch (err) { + console.error(err); + createNotification({ + text: "Failed to revoke certificate", + type: "error" + }); + } + }; + return (

Certificates

- {/* - {(isAllowed) => ( */} - - {/* )} */} - {/* */} + {(isAllowed) => ( + + )} +
@@ -71,7 +98,23 @@ export const CertificatesSection = () => { onChange={(isOpen) => handlePopUpToggle("deleteCertificate", isOpen)} deleteKey="confirm" onDeleteApproved={() => - onRemoveCertificateSubmit((popUp?.deleteCertificate?.data as { certId: string })?.certId) + onRemoveCertificateSubmit( + (popUp?.deleteCertificate?.data as { serialNumber: string })?.serialNumber + ) + } + /> + handlePopUpToggle("revokeCertificate", isOpen)} + deleteKey="confirm" + onDeleteApproved={() => + onRevokeCertificateSubmit( + (popUp?.revokeCertificate?.data as { serialNumber: string }).serialNumber + ) } />
diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx index 663ac6f8b..db02f2386 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx @@ -1,4 +1,5 @@ import { + faBan, faCertificate, faEllipsis, faEye, @@ -24,16 +25,20 @@ import { Th, THead, Tooltip, - Tr} from "@app/components/v2"; + Tr +} from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; import { useListWorkspaceCertificates } from "@app/hooks/api"; +import { certStatusToNameMap } from "@app/hooks/api/certificates/constants"; import { UsePopUpState } from "@app/hooks/usePopUp"; type Props = { handlePopUpOpen: ( - popUpName: keyof UsePopUpState<["certificate", "deleteCertificate", "certificateCert"]>, + popUpName: keyof UsePopUpState< + ["certificate", "deleteCertificate", "revokeCertificate", "certificateCert"] + >, data?: { - certId?: string; + serialNumber?: string; commonName?: string; } ) => void; @@ -48,8 +53,8 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { - + @@ -62,8 +67,8 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { data.map((certificate) => { return ( - + ODI4E7G1V&cJuxqKj4D-_JW{JkoJlhzdMpDT5z(UmLDIBNH(E^g_*@7xg0L*Fl6 z3gc%Cd?32@`PL85S4$M<*d>Hu>CKHb-PHPL7zX>JJ-} zl!~5ec-zaM&TB7sA7SlJM7G{#{<^I9G&-a3??QXugf2Da-YIEe$J)7-Z2^kRvHuyN z4j!5ST;4!w(6`uTZZYXHQ?eo&=he5}oPvaB@E2W4@SI;#eyfz2Lec(*vhyP#ly+jr z>4EHBL8NKBzDTKLAf~6mUb&7XW%Zf`uX6 z$C5G2TBw_411A!C<2TL=)h)~u!0sL! zC!Xxv4}#j>GGbw!vUBkgRuO}zDG>%_mcs^v%(7lDKYTv z)M(Ux`gV3Or*}J5b1bIEX9I65bj`p@F5Xy8IjDzkimsxMYuzNqJ%|TYQ}=LH<9ve| zbF$wQt8Hle%WW;)Uz}_6-kuf11Nz<}Y-tzjR$cQ9Io3gd^R#1ENvT$y<3unQmJ{1; z()FoMa3kWnFP5BEh+kyGPSRYbrLqPk+7*43W~o!yC}u&LvrF4nvxJ+9^49##ti`dh zg=fZ~Th})B0d?66U*8hxqnRXSsqt(yeN|m?F}c5=)7wSbQb%_Z#_dw6xtTdObny7= z?Bi>E``0P|>M~h>-~?o!3g}8$BdspJ3-kVWKHeGd3M9V|R;0OgUMHZs!G5dKS1lt? zzPu9Te4SGrjfI089U`_xh>pB-w+-HT!|05BM$8^bd=TYv;e5EyvK626`781sUF|)i zqKW(lt%oOJIU|pQ->wC^twGLH`i?s!ht8lfcNf?(Onk+)W|OvSYs(}(h`;oqp9I$2 zC~iFT5lJ+LAiI^6$WeRl_gZJaxXNwpna~DV4lZeJscsXJI0rtQ&{;{0{jsu0;L{mdsUjWz#UsKA+W6~os8aD9vhi_biT%r&}Rg`|;yK{T zjja;yHFMo!tEjYmSyUJ*94)XZ&Mwb|p&K&)6j9Q3i;je;B)*)g)TisJRflmqc9+ln z!(PUf&u_$OXc8FUKP%h)JvG^sE4Xl2{!=^0HLUY<;l{3?K65@{GIhcKStsPYBPguW%LGXY?dF1QcJt^YO>^ZKL#Mf`b}CRbdEMIGIq9oo6@r; zX6Z?o>{xk(ww~o3b7|i6gI_{9l8tBXw*4UDORYThD)gRUxz>vDqI9X?Z$^|;2|h@& z@m^8W8Ofu5?y<+uSvUqzpH&cGjD^3Vki_GoHPYNp5IWEQDA9kHO`cT7H8fr4dRl*2 zmoNk<&&jjLvz~c*V0cy~X`>+TXn$LD&R|H-+F!s3u(cO{k?vQRgefssl$e+NNOxYp z2N)MMuYifs%BNkux?#6tE{CtA{&BC2r?!uMm${#6kE~jGP=^qFP+hPR_7%Nm_U$7M zKYTt_vg^EA)|ty{58CE3PTY{LxfT3Xi&nbt5FvV6zOrh^C}f=0S9xyTj)f3qh;1?O2q;PhdV+PREO291PX`~?nLf0$aG%qt!H{yJeSa#c@I|8(ogs-HQ z6p2VpOadNf78e$}(K(PMN<}%Aw1c+BvxbK=#&DjfqlMABmtK>VYQuD#$4Mn%G*bqY zm;Am$7?SAs-iIJxa)4E!0ga@*(0K)@65YdF{jiL=Ho&IkJ6&Yd0s4!vC-~!3KPdLQ z;FwM#wy?s3geD^Uw`Rs{i>k)(YukX|{}OVtm^fU8HcFL0$)r7+Hu5|b2NJbF)_aVm zroVuw-mq0}H|e`?eYjs?(sCIlv6kEKw{<9n&d_Y68RJB}eKxIe68AOQUCXo!j64x2 zFCLbEA;Q)Kb=kS5AGdM2tl%SC^Ovm=<;3L;=kN1u{flpjpY|SrYAo9?>)9A2eA>H8 zxM$i`pe&+RoR^V9$*D;$LFH$fW88J%`Vv{vPV}Ww®t_7oM-!c8U{zj82R|ChD+ z3hV<{YmXzsm zuV;P*Nt!{>=~cR)k%_i;?Q*JvGp~#9MkYx!@%BH+|PSB^Vc8Kp|2kL z)6x*xDadDR=w9cCf}(^B;8C7ykH z1OtAtluYST`J1dIvx=J+pCBfH^W=?wl*TUK)m0zJ!Cqos+xdRmY@kjgT?xIPvCr_? zabCdeZp0pou9%=>*)Ilnou*>RCI>*Z#dOT+kwI`l-@lajoqxag;kh*C<}-<88SxpH zeF0R@jA^@Y(!lvKUtV6xIODiXa8O#*gGpqv`4{t5dBpsI9+T=zebzpJ#7`_{fTQi=cJPJVb^V^InN2p zL_9=$%@~F=Rr9vX4hJX$YXEA7tKe8g!{;q&FHv0;ID$Us+}OF?21qfZDXd`A@W8oh z&`Y`LopkN%APYox^5Knuz~{ zi21*BVg6ezAbc6Po5w$AgyseoEp@ZpW^o;n<#s8(v&$**$0vGx>I^$*8~I4;*Y77k zxEKwyG)rb06LsFX7NxxL%1ZF7zv_ulx1BOicUY~nm>7UF*aCUpHm78CP>wELk6M@t zJiaS76#HF~%Dg{KlDB%=B~)pDR)H22$Kkv4j7Tu-JqNT%Td{2rkdU9fQRB4mJZN_q zJ?qw-YL>32XYKr(F()H!|04wwndiL?jB43{8db;-AFJ@FBrl_XmCi7|R@zB37BcQQ zt8f<5Qa0SHvH=c)|CmjkH#1|OS8bYV@@BNHeq%2ee3BV>^jn!m z13N+aIob?`mM}o8+0FF70^_JmjKsG;l0h0m)wFd@KjZ7sCQo$xmYM#6YkkgoS=QeN_L!d$qJFLhHz?Kd$rGzL7nE;`O#M+$=i2wM16nXkn1a4 zP$l(sdW!t+mnD{7m={hI!6$a3=^T94s}3uad~pAgJ%>9&5{tF{`D?-Ja3T0~NA=?ZdeO>&1G4*10q*BB>5wUTze`| z4Qul%onLp?Gv3TTfvkOU8KRpb3VvP&RYU;&$IaZ?&PDd(Z-q2bmxW?kboXaIPfvJ(Wp;^pOc`Nje=r9cMh+CkC<;{b6fiqO+*kT z0z4BfSbt~+i6l*B8EJU-rFhla-9y$@Zc_&A3bD_bc#22hU64~#z(gG7FmWCZY%-CEyFdlQHRd38*w~z+p zXnT0r9c`=wGrSMw@3^Cm|4O$9#L8bzTBSNn2a=05x*W!+`fc=v73fm~F^s0XL=-+p z-oN=0MK*L2YrEE)x>iObx6W<_G0U4c)oIQ5V7dSz59ff7>!#|~o`Oq;Rl7Mk9>}}= z%<$|D>%N1FZ@;kKW#)UKszjmMe(a2MFm9NVx92rqQDscU9NHLpvTKeD?2vPEnbkQv z?#|hT7SB{(ndln*#y^)LbssaIN-K+gc+QuKla(l^WWgea`&`PGV zW;9S@esjrNl|cQzlz?~JlQ9J7I2s4yZLvIe`IG^*AU@pxJJT4)6-WLkpJ>8b=W~&1T^{e6 zqxU{V181Mhz6J5~uHTb9{^`n!P*)FAh8K$DJ^Ei_KNPOLHdD~gy3|{L*RWqCg}?CQ zr5U>Q_NPK*N(npeRYkxIqK-hhPFj-OBA;Z?7Oo{p?_Yr#ZGA~d=RndXOePwjPb`c3Iu!^$N0iwR_8jJwAgv#5RCH;t)?i*i0`t;5mB+vt(X)jQ(gc z<#66}G3Wi@uV0Q)<-cl24g5!vRWP+0z9Q-8xNWcEqhjxX?l|6(#IqyBd7YOZ-ds7i zV4yKL8mq80r)}VvoN+uoGkx-r7B$CuND|*Z5+Ppq;5-|ks7M&1|V^LbLTCe zF~DlCmG_L`*sl*3F+*{Wv|hP#d;qA3bLozUIOu6z;9S7ih!+sy$P*tk6b1F0nMcz4 z&4U{=W3Fay#_$T#B@vRy+0|?-%~=9`ewTiJ0%6SCG!R|7#d`&{ML3@9@{UYlAk1?& zaYf4gVR;bgyj@f?F_~>WzlVdu?4E1gCr?oVFyTNhW#{X%Zbos#83~_I(9)cnH;@=e_E9+ta^gG%b~qvtTkK2Nbh`=Iy9$_5EL%kec? z@DTj;eK{?vFKPA`bgv>KKucY0iS1-jM@OWTEmpJrYmitg`|*6w-)}E5m{xL+$}RQ6 zCaASeq@~LXf8~D`w7e@up1=E3m1gP~c6e*$^S7GJy6z0-zA|*0@)UX#% z77;(hqz6`a3l1ZlH&=vU`I6o(R3)*?DZ`vS3Awfm~{j@&txvW(icyl#TaPDOF z)M#;uvFXH;v>WMf`0L+6*1!kZwD9$FRWNCgcIa_IVaym{t&6!Yh109Q+xI>kCC5$- zsgD>qRE_$QQ#)C&tb+Qq{H9V4t=N1*5cV~s4UMlarO$EIFsm;o40iwQuYz=S5nTv~ zN3x{LLRIzI2b~JV`1k2IZgp?$7g0!{yX&!gfP_;TOIh*?aRTm~;QLbZFzta_N?dg% zxw0>EyObG|2S$pqJE#RZzct$YY;*uyVog>eRnJ7SLTfXB1~40Z0{qn1^*a=Eo^#>h z6*|#WdnZ}f5S|s7_ejl1$uh#eIedk+Dto!^g9v+K(aXE zSm|FFmY6P;0N=w|<_Woc%ca1LHmsoPtX~mNa8MxA(iBA_eTZ}mPc|G-II4X48nvz{ z^orN-YrFrSdAF`b9zL-`?xK%`T*IEkfHU@__nxEW$aj-lc zb7Y)|gW-Q8PjrhN*4};aLEt(Kzk#hYVCm51fBOafmdAOHPMlFg!3;O0L^Z6QchQr| zV^2xfQSlrZ?taS>Dg2%t+a`{5mR^5nDEwDtV0!g!o6@%~r-cCqXm~gA{3c-!v+`S} zEBprqo;C&5Uz11m`%$~L-M>eXHiDK88tZC(UM|n@8W~d-3lsI2J?VwY-(`1dPJQ** zH{Slq_*G*861l(o!=UT*jq2`$Ul!0gRT|nU5)dG= zDe@V*|+ZMam#10{m5rFUF(T%!FedcT}!S1!0EfI!r6rSCEsp? zSpZB14-Z`J^!I6@8d73)c$aeIafeBTTS6>?02$_?P8A;f86sW~W4%7~We zxDu~Z{qi@@bv-~?W|ls^lBe*zZMIH5!_5PelUU7i*hA5`>KQG5ZHuVX$RL@MH@?49 zp(>Q*^+_q(cUI0M zmNSu2aJ;&j8V4FOkFQMji%$Epv0(p9{D0Xn|Kf5w?~WomT=AKtf}|XyLL6%7Veo9I64Gkt zxeXAh`dQ--*YvD(6Xqv+uyYn^y4X%+0<*U;tlNP0HL(w|U4hRDblzS3mBSH~X9&Yp z!P({goC%}GA5fZ&ri!zN4Ri72DC&&*%uaqaQ=V6!?b@g%9*zNSXwLb5m&R@Qz%Lrv z&8XGhW7iZJ_oc;yJn+l{x-j%;N!#Q$XoLflT0m;d@6h%R&@f1;nd$pVM%Z+GZ2Slo zlTJ?bK28yHHuL$#XPjYtJc-Wkm6+Bj8K26OkwJ7{5k|F%RI~S>;Q^dA!|( z@V}$bc~xC5&4%}6fy2xT$#AzO_IXS{1!hQUkw!lbrJnogoi>w>2sv4* z?BqD#q|(;6Q6kL%d6-=OOYg)(qTFEtT@Wji=g}Wf}<_fK= zYjOSI__|f-{%(8ie}*)-rj)Hm_;vn3%D3A>U4sbTsgFL<>?d9>#)-={oNIjPl%n8` zER{WO&pk7-4R^l~xq5Z=WJ!9?$H^bF|H2*rZ;|Z3*KRx*AYMV)OofbHgFdZr46et| zUTs%oymA{aWnw`I(YXjwQ_d|}XUy9L`Q3d0lbyGhQ4e0S^SWos@-$>Ds`hp|Podo^dz6e0%G>xk` zflme_hf4ejb_H|)czs%3r4}FH3N9C(%4#Wf0TyB6zjilz@81tQ@~P!#rs6$vE6QdnkxM*<9DesEM(6jUra`88ilSAP;pI z@e0gzpA+SE3c(%9S)?B%6n>6W<*#m$%5?X)BC?UgJ~3A0%GYx%N7B>&L$wjb{}B48 z{ZYg9Y@~o*)P(aFVfor#-5h}fDL9X{S?HgNp#a{~#}U-(8Fq4cc;2QxJAVJBD)(8N z$$Uo4gn_(6#%s;De-#=0?-4|PbNvE&_VGE@3$fHn%P(JwgQgFKzlH@BOy9H#x1pZ7 z{Nh+q%SCAJ!BA!wQOTSm<-n>(svQ>>ueIkbMp@qV!$_lqqW~$LgR&mwjloJN=qSvD z5Jub1`_I#o)#X>-%}ryA7(d!=u86$IL1&E{9u#a)pI;qg>d;9C((nZ&r^$ai*bJ;^o4tqCB#-LBGaPwa z&%8;)h%Je+L7piBod$njU2<#vj>R*+dda6x=wpGWd%~eepOyv&SgWZ(H~94$!+if` z)|x!^?pKBUAI`oys>=1Mb1`K$=Z$0mP<}>GfYLSHMW;8Z7n*j(0u5HYMd{Ntr!4SH7 zg@rNov3c0CpZMHQtCVbi2=PlWF~37=MeFBn{q@5O!P7geV*`4dlYS>zNgfIeIp;$8 zv=kcolo--VaS0Bok5|$*dbFJDPHj^x7(Dt$Zqsu+R36q%u*vf%yp~?wYA7H=icxyt zTKv-C*d9om%?;fhDrfSNH-mIkJlM&2p)`u+bX*vII8*mQEGeJ=@Y37(er+$sOtN@{L{k3i+7*etg-R^Ub zEV%T!Dxe^X1OfiQUXQUX|BT7xC!CHBYZbHPmSyhWoE7)84WP~a2N}t68f<_>rH!h6 zZ7SbGe-1O z>BMcXmThA!2;kD!m7BpNh(2!mx;+yTapWhKc7eP_C86us7bG<+B~9Z5c@&;|O6e%3 zH+J;{)VuThCCqJrxFs*9@eVK{SC@ex@TqV9GuB7y3wb|0Cx+>dUukt?cis$a4>J3g zTG&!)FJf}Xzv60$g|j4Mw7}>(_=PYjS3oIAy=olCO%o28ypsm@1Y0(Z@}&|dg5M;x zM$-)~1o~LW=5@gm468t#Q6zS3<@EeBh zWboo^Uzz|0EenTv8V&V$Bbt;vbU?aEpwyFA{}&UHM&>i3bByAGpoZI7-FxQrVa;7?4p*;dlfk;g%At-4wG0j2=H z&?Ck?kV)CT?Sh|KFzA0 z*6uK5b5xR-ygh)r%wfy9v(jXf-L1A8tT>E7E9P9(6z8Ot@<%+dLucrT^^jPynZ zCIM4!Du6AvEQD^0o4b>CM@2ChJ?->aPw%>wxTTH-uLO4~$*vW`iMI1?Gg413e=0!c z)3K3e?+B8w=Nrfja7eO)2V{)@|)>I1K>R)NW!JpRltpi zh%r=A4`K8 z`^pP|mFq&%*6l2LBE!Fl8}j(=_~V48GeDLMGans8Mj9tB76jSP0fU0Td4$hz6K{kn z(3+nEk56n_D4b8J;nA~l3%0l;$UTzWMk6>A*GV|*ru%rF=eAqYcy#gH?Az^~RC=vn z9j5`~od?Y(U>l5bp3C7=Jo4|3-?*I~tpi2@YLUl-iRqR5Hx~Iaz z<)Tu5jHqv=eT~Oq+Jg~5MwnXdb=8o+R&S%jFq*K~2Ymc{1Uxq*sAbxboK!JR=eKlV zPJCI^GjCDo*sazwzLQv%peV_ATf{!DwQ?GF9;DXv25SDu ztr~b+BLfidAm-wx3QnZ?_lCQ+wsox2+is^PnsR;HLD;wkjjX+VWJOsZBj1pOYRi?5 zB8s!Lk9m+fu>y4xUUwuYUzE2*cu2LIo%~ZzPJUDv{CV__psKIaBPo=?Z=i?a43{@+ z_C*kya;S14^IoDvqU~OJ6sE<59xT|eC3)-SH+vc znxtw41P1W(K+cFNo4ip=mF|~aMikU^oSYgq^Wt-HXys(hmKWT1Ql-D5GT-T&+xx&! z^HSq}TP|`A4>@ZB0O2rg&dS4u-+2ewJqsfUs7XsTZ{_sg0?JL(tLDTY!vw+G)2cCX zSkjbXm{7mGU*q5<|K2adgY%l(!z6`9ovo$;w80xU=k}GxWjK>=?Oc`l?zdyeO!5cY zx;4M^(GH9p>zZX6Ye0E#-XG(%giPit2;**nTbm+Ehckjw(1kWf9fPL+n*Q5K_IPNU z1L#oR=y+bIoKNPJq=SHXve;;J%#Dfk>mrCIXU>n9-+Y*J|4JcCDyVKI&Ah*1ACL=q z@}$CqO>=>HQ z0?{(LB+j!!ti#7%UeTN|Msf1X@B{`bD$jB9hu-ny7Sq@J6~i|JBR<<)-!bm#HMX`r zv{pu8N~7#O{)~mLNEdN7)qqY)TVyH3=9p5Dg@zRj%!_vSkVy}Hj4@`=0otg5ss-h{ z+A#E&;P#Uq(W=J);R7*W=>x9m+I)VkkyH zOWr1k`{P5Y&=-5s<~`?>PJbF9-E|V2n)aNo_XrpwAJh?0G})Ry3?HBY&B*5ROBtx- z^hX5vo3oGMq)5|qYDuW^tW7erMDWD6eXIV@WQ3*`ln02Yu)3yh`N`W~JzK=Z}$ndmJAdSgGd?UO&+LlHO zJw(va1NgVaR~L8b0?azArLSx%+TUvP1_Hs#%wAjP=LvHw)^Z+Z9HJ>ZbLO6aMY^Qr zfqOUg7+foN9j&$rG@$#AS8HT)z_2ugSyYZk2VM6N7M-pg%I|QEr zI=cN5qM>j6M|D}uI(1(nxh1+Mgch0Urktx+L2iW}uC1@t2Wd&g*drVn#S52p?@le; z?++!gK^X%`f?SJk+Nd|cQhPbFyH;ciTIPA1+0k|~VCa=+dRQl_2{@zfmNy(bZczLe z-P*n(?q-qQC+zgzBoX7TB#7v@8F{QG5Y z0-cPtC1q8Yy~HK6Kk>}nX9GsIV--5WR&&R6^EHZW zAf2b?9Z#A~CfCg2QtLFmz$+b36@r*PieRrC@LotS8uN_Osgns%6wHpsj^&e~QJC~P zPw)5*`+aDrwArJU;snhG^n(0@c<$ zHz~f=`t=Z}sv>$Eoa>8-e5=}U7Vb`LeA5WkAs*_O{t{vhq@>l&d9LDV&VUkj2Kz{fg_Vm&ZbhK%$V8MqFZrXy9E7+5JlJ zICHTbEW&4HBQ(CSsG~@oqBz5(&O~ zip`Z;gNT6}Bp$hF-;UI%xEUdcB%k#kSBuC52r{{|e_`wfUGYSAHPowmlELb8h;OF* zK~((Z{7+$~iX{vYsAS`NylC!mz~O|?bxgUB$_va!CRC^KYcf;WT#oOqcatnj;N4Xv zUE=81>7~B#S{dm5 zt&rxG0JPl~=WYs$ExYWxVLO3zu}=KbH%6)d0}F~kOC&_E8?BXnGhoFn~g-L9F>No*z>}) z+?U>_tpWnT#QZ;D9a~Sy^}LSTbc23-a>kAu&X@-b@w)!G&b+szTjf`SuQb%7Wwb*X zfN10iVnZ@S`N`zSb({tPv{H*~L)Dkf9#o()-kl(xz|w+b?Ihk4-=9%Z3Q&`L&Pg`} z9WCx|AHuydLzIO@p``dS-oq^<6H%ER6cZJlHMKac{QBDEJ>BO6iqmdB!EW)saoKXY zHX^m>J8ox9n89eihv2bSuGd@fDg)Nk7ffql$3azuA+Q?AO~rUsrBMEqZu`I=9zRkd zZ_VJe<(9_M9YRwEGLc-`Y;yCeQM>ibdi@pZ(Xgq!s{;9uc0&TpMa~X_`HVueUEcmE z_QwP5-xdPm+u(0d^XzW$7qWI{=b$oJs>+Kp6~$7-FSVK<;Lk7x_CdCyrVxr5km=HS zpMuAt{OdcT2B#y&nj&5dNc`@E%<|<@?T2p7Mq%wZN}djR5G%?7^v;9eu$$7+Z{WX@PcY9<3@J+H z`1bCp-A;nQ5MiCxGUTAH0zaoTL;oxfGyEad%4KG1N=?(j1*C zGrOB;&aBum4O>@o+DY#j%^PE#JQ7w5I2ckb;z6i?P-sG$Zz<1t``(OK`ZR0y-c37U)r)@;FIndTX8V2^7 z>+8xA1D6YD&iB5_ehVT$oJ5wym1dcwxUWCaImpVzc>Y_0KE|W#2%5~cHf&sHM*`Hy zHFeEtYhz72E}htw_p81bH1pKJ-pWaKW;Mb4RkidBL5mSJ2>%VMRU~O)94=gb_xq;C zpGeQWd%k~t)W`ICKK{@6(Yrg@K_LL~V z@kJghIf-b@Ch{L^QBxYBM7#VLMjHrp$T>2BSP`d~l^Wdxe(nUC1xqmx>?i&*g zn;8VB={9meUAKSsBOn#E_uKZ9idX`&QSS=+-lhEcT(qUb4^8vm!Ev$)1fP#1abISs zsM`f=B!{KabMMLZ@w1g+Uz~z^5r@FDmZMT%)`TdQJQu8YS=~Rfb_1@52|#$n38)Sa zcf+|?QUHHGFxr zm!gKE`$<%w1VK(BGag3(k?O@DQF7T1M?N4zylVZGHL)DS&{Qw zMBA*Kj>{TrK&8^%J&bVwDVnWkKL;PLt>aG96mlk}M%v1D8Ju5A*H`Ze8yR&k2mC z$;F|OmjybiJ6G#M$Ul%wFY#4E*=`kM)AvjZiGVmPu330=eQX;c#ptwmtPJ;Poy&Bh z>C2aF4%>mdSBbReH_CzR#c>?S953BA0=F!q+*}60x6&%<+@9wqWgd)0;fW99^iU_jFAO-IN~J3l zmNe|OemUD&iC?}hamh)3bUiyE>J)3Fa;b1T{qZwVhqfCjy~Ntg^q@xmRIZ#x8kc>WG`Frd89<#fcy*ke|~%*xYZXRGrfoXVd1P7a;`1Uh(5|zw7o3tFK%Iq zM_Kc2PMogeUZ5g6;<@ydoE{hg@HJjFuuo*CSkxqM*(!v1QN6P`?Ny@fY<6JuIAGKa z1yr{#*}Q7nk;BPOpaz!*kHywyu=^gFw(g;w**UhL5Il~^bm1CdE!WHL?B;7|o68A;g`^W2VhjE8`PeOnz{r3^NZFq0{3{TEC%+;gm_Cwgrc~E z#()$Au&XE$Vi`zF%f&Q**}MTQM!VU{s4&f&U!wh8anonbDziu^Xl9yguXv9b*Y8aG zs5&ItpV5#fepAFf9(dEFgw8XCaa>odA#yA-u173+ zq&YFJfa?e72w0Hdc+Lt$FPvx73QFajFybgM0vjo|>FOb28cRJ;rfBq7xPVas(?~rRKrpZGYOwxvzJun&bNgb6N5O&pfYoqQJwW zR-RjI9nE`jn;4>7z>m${3|#3Y-3{ndjiLtXnPd$g&;uoN>xr34g(3%%co7 zcxH{}i<9cLa&n#hI5)oAu|{*oLV_4Y%C)A%V&E6Ghq)r`bu{ss)-q_AGDs91s2YiN znGVAHi7N+h(M!5iaty5>>6$Imww*vT1-10#xAn;o$6h3|$>RYFwmjv7$sY1@E`Kz0 z%bzlW^J!Cadnw4Y3RN^a)$>#}Ua`&4yeZLnuM_I!pQCv3r{@?Td7krQ(<31v4U>#z*o~-?$uWdq7i6Q^O!(Y!mUxcih1Sl>0z{ zTcY`hUxCo{TvSo1?GxN=X^so4U70(?MJMiQ?goZ>Lw?*(A%ciqvd9?r87ZSTNF@DP z0vJy6oz|RNM1%`!H!Si?XFjNb=`U9KLrj|myD=~atTS!IYiDXK_t9&($iRU{1*Q0O zeendoLMddn6Mq{?gRzBD|Sh^<}Ny z@lwzw&uOMQ`bt%I$;I<31DP!RWtIOw(hmk4??7N^afE56Va64~3AgaSOD<(&cq}Z3 zhl}|TCw;Xy#3I^8n(8T_i}zAQaQ^jk<|Qb+81@XvJ%cQ>72CtXHG);zMyD{H z#-tX=ZMaJLM3!zuqb&!tiv(w93tf}q5rau3lkwtgs$R<>vdn-RTj5npUt#xS*1)4K zh~eX(bQ*fRnEB}DuIFPC*5N%^@@rZEAvEyP1jFz)rrSp3BHi~sDc-k|xqqEx6c zQJ>oC&-H?X-$|16LuYY*_^iTMOGeQg`K%53rmD>)WuibEi$u~`Dx!>xsh~hm2-p+? zfYYnd1Bc&uc8Z0^K$PTCZE9e(6=AUTDAwD+c)Lh)^Qy4Ha7C3(40hB z=a6QJJc&zocET?$6O16#;!OE@B?n(=(fHNQie;f~JtoM~sFCq#$H+m@0-b_X!JJ{R zOuJoVJdTU}ggkVzhfgcYDHQbHDT`RfR!~xZH1G>U>pl1dUEqW@N1t&qa!o@^af83z zn#aCh+{qN0)d_jG-(YkU)wwt2tD*(=jA%$#W+HSjB!Pd7@L;tzj0^ZX;;Wz}+3HykK zVEiu(+jA#s=mZUaeaa_1DnLT4ir`QHg5;*cs#k(y?XE%P=>}rE@Qj~y+*~Sf@qLL$ zzPV;B`)gbdD!%<}BBCljpg9;UJ{r})IHm-GJGBHUDzccCTWUgXEfY=To0~qHlhVc8 zrZ#z#RM-KQ!{^vhh zuNIE{{_(%v0QK}1rQ za07eD2L^!aSpv2ga2|VZjtZEo8vq-IB1j>#A)oV`VJol>WQk55Tg zvp(*=rJiN7RiYy5|E(Q3amCE%hUt%(ZE87Ht87#^yeo;Jk=Lep@OyO4$^K6R^YvL# z_|v>jp@tJhVUmkBWKvmFJjPBGkK_duk0GS`nqfbhd4lK*X)ofE?pcj7vsVmg4nF(F zhNxQ`pHwb!1>s2<)30W2=nSFDimH2z_r?Q1GV=JRU_)iCP4h&aA$I}x0%+fwN@F$# z+$U9vN<}YSuQkYe$r;ptqI2i?lOIDBr1>2u51)Dq)PAYrVngM@B?h-MKrZbg-L!wirMr|aTKnE(49_b zir&Ehv0rc6jd)S5udz6DgZ6eSr`Xp_{W zdpnDE+-q#`o-yP;XJ!Z9b2kgXNdoMCaAApa>ZC+*c;gQzY^$K<2HnG3yaq;?aZUgI z&&zy|K})uaAUqCA**V@9fDAsDe~CBMRvjl6&S}il+UzxSr;2{_Fh~l9y|cm)rgwUJ=9ku}-+H z>b%@PI=Ke$3z}F@pGB9^g);17>QF!aedqlBF(ZA?xg*v#VjavAF{==UtiCqW3SOFq zgCmYTiIR@XphE` zLpwl_J&WmN?)`!hHgmBdr}E~SBCHV{qYv&fIrU0hsMbd9o$uyqmo4VGe=f1OaA!$y zx{Kze!cCS^8L2uxBQnda7s7zhTkoyIjsRN&Y=Lp&xy)Kdub_! z+ur^YuW!6;RvfpflZ~vn>?ODIyn*j8sfEK77|9Jdijwlv@jDpQJ5=DafY(- z(sP61Cmt5X`5$zXZ%%wM%Ua-9EmxE{4+WFN*Wn^^Sseegk*?Y(SGJV52{G>0nYC@7 z-`grflxb7C#8PyhUFHt|^;k!Hju=~TRD^Lz#_InB&D1JCn2VH4yh1;xm>X<(hh8?9 z-4K3_bShp$b!=L%>y}mvl{rm3F(Kw_`-LWA@+$(QTl|n84-b7)uMt-a?nhWK9Jw^@ zyeZIG_xsi)y!AUG3lZ7nII_9PeLk)WTP1$m#!wx)_K~~)oA<=EpVRb=w1E649~UMw z$tNinhgNe~?&Ow*x6^oM=fKhFJy{CpdmX|mvz*Y>B+z>Ou+2AcPnx^)jS_7j^{-Q| z;uAzly9;UD7)wit=vlqq+9ZDtOhimoM?Qr;YvERsR;f}6qffF#;}swgwl@~v{H`6L zIOf3PN2Vj5O*~waAtc|oGlcL)d)s{N73P{mq+7l3A83YKvE|7hTCu%q3#ffs6#kR6 z*1940mmG2^rk~V3QSZtAJ54cihk>W_jEkTyn5v)jmdb5B2^>9;6rW6^JI(Bx1>wPs zTS6v}#4A8n**rn&)$6|V?^}bby0k*HuK68gU%Q9R zYT|NZxp1@Xy|Z*uy~Hj*EL5PFtq89l5d7Sm&O1O%thwS_*ub;$h5ftSXPeSJRQDWr zC`k8Uag-o8+{hc&v@oyPRXp=RXOMUwx#0dPSsUT{Sr$!t~D`l~p@hmO$EyE?!Zy z>3|hwYl1`Oi@=iaH_YsNW07scA#b24Aa!b2~#Vl zRQP7_03Cl($T{u?v4-Z!uj?&MipFW$wK)b2;>~vKBv<4uAE?Fk6r`2SX_J(FM6lKK z-@HE`v@TU7M2eJg(^f~m%o55h+6(=wWA7R4D`7S;xF1NhB ze%qj6&@47QESE~0_yqpuza|=p4PJdiOqzEMs0H39@Qkx(f_~W`PwPaY`cNs&))U*) zH?&8ze^Pn=Tlz@;wBvcvYAE)J2-(wT*^qiik{9O;I_7(>jdwII=Ga{UI-6)Smxv{|k+#CXo;1^i7t@jj~py-=7hKsZ60xliQqIoRn|=d9mDa{NSFN>b!(yWx)vkvdn3@%J|z4(@>y9~ z>eTR)*?5S7p&cFbTWAGzRyzSG!^}RfM8r>f#%Ol^5 zq)^viuxp32^L}kI;{lu^VU#W~PuK3IAWE#_yL$0m+&@Wd#NRgZ&@8Q;)GQreiYv^j zzg+H$6k@zNa;>;OP$)p_yS0j-Gb#_YJM8cI^h|p-ZigplTCrmK8$12=uBZ#!bxBt^d{aF@NX`GSXd}gAUn|%TW z;_BIGo3L{6{?JqA;8u81BK}&wi*I=Zi+$zi5mEORWXtyyt$(+!#g*e#<~uv8MU{;yRqak3JJ@EU_NyPoRX~O-kO`v z<=?LLO_4~YEB}LHc7>gr*^Q0mt9+~~!J)6YdFTXa4mxmn4{oE{!Y5|7ai)S}v|<%J z_x_F`>b08{u) zs9jE~zl`uSVMC)LXH(WQj&39EWX3-Kw8aoEo)ujxM#)tA+83)XLfqi2cuRS^`PePe z<;McumMLAu_Sp0WT2UKFq%LdS<5QXZlhcp#PiY^izQo8pDsR`)-8O`x|N8LMg-O>d zpo~hoPvOo<9z^HG9!7o_fGSmYDAEX}k65>K~g(+*D2~t;?a- zg{@?2(c1p5bXbOL+aT`zFvWp&SXd>vDNa@oO+b|v2YO1HKsMQ85=_S8p2+;aA(c5aU@^;t?5S4U|;`1k$SvYBXh@iAA^WECrpRgKN8t$k;nQvwh`bkeqo_^Mw!<=Y_NfXfy zPF3+?9c^}4Ha&A8N*3m`v$@2;C#_eE> zw$_R{Sa12e+7HLvJTumfp||wwIXk3=!zH#mQ|+V4jB;FZws2aJceOXUJr7K_!apy1Ja|L1&8ayYjZl(Alk(6&!6`G(zzO?)uB!KF4_Dn zYUXoe33h4sTw!*p=p`6Lz|QD<&(=5r-4O*De{8>^XrmttsY>}p(|iR zq9$Y9O+^M1e`ip+Q#RM}+uYBz#I$9xC0KX4wwGBm9Y-%;l425x(1l!mTrsR4ldSo& zh7(cZnL!Z$z*@XcZPqz+${B)J^~-JJXYD~C2$%HZvDJj;FKX^%iqEOm;BG)+A-bU= zcAmYD6))sO^AKRhp=C7xAVhNJ4$Tbm(o z9>2p$99<3fR26hida-%x`ueADSgC-MxM?s5wwJ(XcrCJ-*-w($XM@6ND$f;)hi8^{ z#i%+|^2YQ1uIOjAu0`nYHa?3dDAkhgI#P=z2H=60B zcjz2N(J0%2(4PMOTP%97=KBilurUupfjsDmoGwa!mmyOg0*u8$nVIQB8@qL97ZGRZ z)*IcsCwZrXEhh(5JvBS@sJ+$e!<@|8Fc%}%DJlJE;n!R+&HA%W+NS40gbWTooN^nI z$%uiE&u6gmd17USKQVi$hW#QIwgalkyvAC_xmxG}a@{l0MriAd zGl$vd6=_NDA0K_2hx86``?3Gt4aZAvCe{xpf%H7l=obwh`+3kn~ZWy=R5@J1Uy$!Vj=XURZ7t=4&Ao~?X z3S*`{-#T9tt!db|eM0y^U;!qBC+fB6kgz6LLt?k->1BMwP6n^{G592?kAYkg-isZc>jBeB zx$r+ppGkE+QV$fdkhv)<3~V@YfEQF^jf!d)TkaUoer9_9kSOtz zy1OG=q5(j5y;@wO@LQw$Ihv9?9a|^$dk5cU z>|dTnXSQ9p<3YNnn0`~FakD21o%-2i=6au&CBLhreHXy`eI{F%q6)M{6XQ8Y?-_n- zcv*OzB|O&31}seF7kD1$)vt9G>P3Hsv+#}}rxlah>?;1}ldZw)agJh_>r_+{O%f^U>1oY=RXqnzjBBG&H_ zJSQ6GbE?fYKI$T#zu|8BRR~k0Nk`Ik+7n}dNAP#PNhZ==RwUX3SqCAGBAhx#0)nDt zc{->L!pC*`x(`mOZsR$4be`|`ls3F&gFhF5yY4bi-$^V_&nenoxX8|Yi6v60M7T3) z`;ICd&*zE90(uRX4sTyK9aOb!f=jnDD^Ap4Tx4EucD!xA9^2aQI@0E1QisBp?Be5- zx-O%HexXjel>ZGQ)^sj)8$UP?PvzEKeWS9o{P04%WmWS@AIy{l&z9j)`9dvUmFgf4 zSTjCyQcHWFb5{~uAK2usC)zys@2m0{P?f#BUmtV;Rrx}fMb*wq{i#}tDO03cijO1# zvBQ;rhN}hXlek9$`*9A1JKRb~i}&r{)!x6??;U6zB_e*L5HgIaW0y>Uf2=y6)~@+V z*Pjy6!I?CYD4Z6qpb;g=W;#Ks)BaIGRx<7QIa(FdUP;(S;=t?N<&@y7!Lg1U>Sr5# zT@H>R!7J;*&65Q0RMO7h4zoC}J_-2Pi;AM;v7Qobp5l*H_d>{Uc>LbjnK`rTE3D%R zhy5iaUl%`nd0foMhqrnwOl zUWq~qOO!mOYWLcctd#_UEg4UJn0AR0Dzj@XW6GYEc$c@$pg#m2vs$VG<&>^<4eVvb z5zHpnQ43&Zk8#cHt{icN1Py8I8bQKoN0@z`g6u-Q z;~Z?9B2`#?_ZWj`WoOKP2@iHkxe(|=3rg=%eR%MZ7xlB9(n3+qtG(JYysD1D3n$;; z?*0DzU7s4_DKCAt&(HhgE*A4p4ac_mnwCrPComd)|M4%C znnxF|>l_@;9g%*#T}-9+Z7v*SmyMEpSi{oBhX8% zC~zOwFyPT@&3C@M9ZHl?P(uSbVCOP?302dXEy&<3Z|+~cmQbq^F7n>3<6}z8=Nwyz z@=*NW*$5CR@#NQ3757bIwfGTF7ED{5fs#$xrmT34^J=4dzebRLOe!voWK9FA1$A;{C;0&+4QxRwRs6g zXgK!8xRTZIz@>Y)Rdx3YBHcaiShA_C^NBGp3d@=u>uo-LS-8kOc z2Z9daSV0QB&qR1Jui$ks3M#C+_HU)0abBl~?=0r*zNN)MpMTm&|J1B%e|NmMBwP@- zAc)>#@A0Krzv^G`O8-?%TB8xX>J*<6%({HF6g_Bp9}*xT5P=sZYX?JN_4l%2i4W1t z59K9`kWvCru!+>gAPlwi>yLA(6Flg+KQA5SaQ)B#x-Ggns^wwI&uo~5^nz;!0G zc$9?y`IA&}Qb$hH&-Ci&+uF(>OI`(UNv~i!d@%>HE!EQ9w8H};l{Sifh#Tx}45yOn z&&lh@)gW}jwOv)2}ex1DN}pBa)5bsX*FsBE4B>l|nT$ly*H+A6fNKamd(^`s32 z^oG_aCDLH-Q0aJ}hC^{lnZWNx`P4ke)ZF6Ps(Y!KbS&O1tL@$T{dAe~;Z(i|+WTQ8 z_>1tk`V_HIs7v9dM*gOgugexL{l1CWqeVT-mj&|aJMAE|9PRfl;nLvk$zLdu*lK8~ z3u(kEuI*M7ns!^q`g9+D34R@ekc=T()|@Y0 zs5`6kXbSS&w9ha<%X<_Wttid!&Jrf1N~3Ez&+H1ve<+uYe@FVEyON=gD9@0Q?w&{@ zY8f>;{9bUkgDysQuKPq`z~f`=eQElv+C%L82<^q&mH&@&&5itEvElP&&I_xN{)jt9 zUrXGEpwA(&4o=DCYjjsZci}u3eZeDUWdUBZKxdu5iLd*cu--R9`| zKB3W9>_(PgTih^;7cX`qsfmzV#0z!Pmbh}?D6SZ!b3CILYI%Y#lfE3{YKZf;~VvC2xBPqneaOUe9-^TsqFua7ht1BZ4XHBo@HUaXplq#|4hh`^ zZ}pNNbOL-c(X=&=x{=S>;&C4Ruok@*q*_8=J^DsEVijHGz88{SP4=R95Q&}Pfd(%O z`>mkT|+)NE-f5=rI~EH`K#L8$qQ zQ#&=xPbR-xICFf@heW8TL3e|iWdQ{(c(qKg()MyEPR-VQkY0J^$xx^OjMC35f7Cia zA_DgFj>uH2|CqGVUQAv8!*w1y)7@&i$88W+@7)n2X`MUz6V3m7JL>alMV*IK&YBu}o5so!MUf!L(N@ zPb-cvYh9w~NgKf1O(qjwsq?+^{t_bv-RdJTRSn@bX;c$3^6<>;QLi%Lu=VEs1lxib z5U#@}0z^HI?mIEx<4HGF1=hrA;{rdF)KF|so*})!Yw)HuK zEX7oZ_vdQoZmo8IxxRSOk8WGWx6Wp_z>=pT(EHtzZ(Cpc4mlv{Odzh`K7?Chs7{qB zy+AyqVjAO<3NJIFeeCylo^5+{(P|XGp4p)^btEmjt&{Z^+#!~43g|XPFzO31)lsL> zHQ(enrDP;>;}c3CGJNuokcAundklzyt}Va1zY*ZbFy_a{QrLkr$}3Jgi6Zs*OOle) zUk8WI`Mp)#XSvNl!-Z$-rFFz}|A)1+42$Y-zrBP~BF)e#At@paLrEwt!q5naNH+{I zbT2{jFVYU> zAu`6GwBdZQy~NuB*5xPMMfUq=1=1PCK=ozzmX`q2tBUoXGxqb3_{^r4*;U)t9lPt} zkHxN76q`bEp8F|O#mE|gl0VYr&{V&PU9z}j&mF8bdV9{X)Rup>cI!ArgJSup*xu_d zm-`}W$KO^imi8|s?2QgndpBZ-OEs3OHm#~JzC8wW*nzP${IfZLJa^my$k5hsiTR{F+Mr3nLjHPs^%+Bgt4lWPV=u-DZIR@3Ua5XO-uXaADl{TvtH? zLpxV~T7(d@lggXww0R%z!wHHvoB36Y*ls ziGB9hOsrY-SB9vKYp{^iUAxH(pQs;EDz_u$bm95}gO9E;R$%;OUWmv;c@!BWt9R}W zA=0Uj?IEcs&rJYP_Nrk4QPS&+L)$l%?=%?IQ4#^z=lLpE(p_niqx*-rLCObR6z!d$ zTTxYvC2-nl;T4HvGPUCWliB$1dGe1z>Fc!Yg2{L)x5D+udEBL*>kW7`XN1D&zt^lB zf7Mw#%+WX`X>PwLKiX2mUd1{S@DaNmNxOdhYOrNHCWKru8B9a&>}*FtBW}4g_vGR8 zg@^A|AXo}hy2zCbflp)`9)8n4oRD?e&lVN#)o8faUVh{8XA|UQz(fIv>n5tO`0z&# zsmlg0&y()LnafXtFKuZiZ3#c~wCV1-wVkMrioDOHASr!dXhrc0z9rB~GpMF}5vnyy zxgYl-Z0Rl!a@^dnSGt4Jsam7C4FPnKiP!C^-8vg#&gZn@;IDH}L^@eo{e*6y5A*Ns z4WCt=@d6LS^Sj;BuXguUB!gmB!*;^B+w!>tXpVaJwc1Lt0AY~-Ct%a;Lb9-REik@z z=tN*kviL3O6%A74UQIk%(gaV}-TTk4bBpLfI4x^J2n+{qLVPKZAV`eel7OAp>B`A+ zA44D`O{K3R6cS4(OS8GajH4lvoWqY|ow<_{TkdXo1Yt0irMkf_{MI}$ziPeb!A$)sQ5s5k>ahY1d&g z$2Sw-EDRPNq)pmLMnG3zR(XR{zZ&0bsPSdZiH2OPF*!R|5Z}L&meqNaO+GXIQ=?b# zQPC^VaDBKPdys2OsE+T3Q0xWC?9&k09{&)rhD{5;O;DBOY>(6`xB1%tmgvIvg9c#c9{|J?HNtX({GA|bZ&^l3s}7s;EH%-1=dd8RpI#U?dg__nXfdO6le zG_tZA$Ik;Ha(L5t9vsH3Z67A1#Lc37#5HMrq$y+W%-|c#AT1C*kX8}PS6_b2qQ$-9 zZCUi1Lna!J^0*1gcJX{#Cj{K8(4Vx^yj3)IU}HFVs7c`$@z_!A<{k^yY|Ebyms2l<&U71Oc32JmsCVzkmHjuz?eWba(otzNcNlv zRCnvPGR2WbdZZ&hhxH`0pp?6svvu=vQe8Mfyg^eW_tJe^4R4Q} z{d)W^%5M*%gxbxAb3RIp%tg1Y$QPEA4kpJbcY(r3DBpC?i@Nh;J^>SGd6VaLuw_s0 zyIH99kP(f{?qWO@*mZL@N2f2R;x&t`AqZ z-&*QaD^RTw_?=jhW+kz`I%k2Rj{2liE}{(7FOmqouS~He_ZHs`9QPt1iCmnb=q|skE{O8LH1jj^Uc@odQL4oCq%-STa zIV}$V?%NJlVTf->Z6MzStG|<-_V~Se3RmXjcmONW=8^NF*F@KeRisBcqMNhatYuNG zeI1`ycB8=+LaCE4V?0?YDsRGnzeuQJ7(E}$JPLO}`BY3F1W`&k8qsc-aCqxO$+O*G zn(`+*zRT+PvYlW2O=?R!ouNubhuUM$8L4fBh^JC`fjfB*c*}H?Y! zh~j`W4@AV5%~SaWFK^-bGkr9tY zKzB7*B>_!#8+Iu8E3#@(T8C`^Hdd|8EL7X*DE2>J&VivqBqGN|a4Fz)ODdx3=%0%;;YCjwuQ;x?H!wej+QtfIKQoUm2opW_33qZE~)i!Fl7d z**auyp5O)x=Ul&WZ`01*KwU!01p9$p#XwM??M?6vW^|Tc! zK1RM>Niw}w71rb=&Nk`TfRS0S@d}fhht6V^W0t&M8C=~K$XtbDeJTIu_qV3Mu_t~7 ziU$()xB-%xMAnRC1T8~KTW?y4#Q2hrHQac<$kPm=G6vqmT z?xEslujFcV_-zDvRLjo3t>Heh-xT8RnmCKOR$RP072Syt;2toqH0vKrL3!p3cwAGb zR52D5?d;2<;{E7ghS=e!pBwgmdhyP#u1%}Z6pN&Eq8iQmG>lLLeK@j9s~&QI1R2er zwx^0oF^BDlxt@s~EduC>$UhE{W>y4K)zS(wq^$z^^*(5v^@=KaDqLnklKtU1Elbn-yuzccTolwU3vU&p$DOi z?jMY`2j|E7FBLY+!uc@@51!m9Jfkd4dS1w1cYrCuK(rP)(H}CSBHRi=JrgDonP@OzFOI}wO+(*%k&8fdOc{E=Ca{x9Kfj35^JtwiQ<#3&T3p`7t1%e~Eua6+ zySN?eE#SGO7WZVLpMoQxXR@$MXK$Ah7|5>^VVMc08c&-C=y6-@3X#}9nHl;LD*mwr$k^l*(*$3u4bZ=RUFz`e|0 zSJRK7DGI%(sCPyEmB~Yhi6WC1{82bfKM+#-4X*z7qrNULQRjIGm32KQFc}nhJkU>94~U&BRsu#hC<0_>%=is zjKtdz0J}0n^K*890hv)V+Z7BRi-(SLNR*Wv6AlqIG%corU!(38%$>gmF{@4<@NT50 zn2HP>4_q|Sx&PTxo?iQ<#TCekN?YJX>^HT|D(u^@PF>{qO@~ufdpCwfPhd-`%mPdZ z`n6}P^r`{)^Hyltug_Yi*O(C5Lj~?AMuE2YV?nFe+M5FujNfKhBfa1&;)r^g3(l1@ zqxEqAR-=^JC2o$X%@SwSLhLzbz~NM9++q3q{DrT8RF0=J`gcm96DxLIO(Nzjf%z?d zwVd6zt}Ip;;zudr#cAEr_lG4hoy}s-40xIlkhO;+W0P1Lq@3?(30{CiN_y|36v?~% z51F4YQ1`$l3ZjAMx!JnEr3 zr+)$rYa87WHmmb4LGR{N2EqbG#!bLZOymx5YM<=%K){krHTt!TO z=ed(jF=~y&5NtcYO^-~IE-GE%WdR`vK#oIsL+LqU9Qlzt1x*O)XF^rt2&F6AAN-Te+v@cgx33^MD`teYL0UJLCD<-+0Bqq^6}eufKa{h-=}!*RFS(+cOeU zn^z(1_Kf9AfbYDFryag6FfhC@U!K07bTRKQC-y?hMEHoY=SaL{2~d-vU_{G7dO&_- z-xqA6Opn2oGoFU5k^F1W+GoLUWS2u*^h`d%qap@y+Y#`+!H3uv)EP~ z_Rft-a)krsqtXYKY4j?okAKOERYcnE)hrbte%5qFYRR`lLoaS#Xgrj1*&d~QrHBUJ z-D4&+sFN7i3RT4m{ST&Y`_|(R4cZwPu1nd+h>sA8W@M=!gI`}16Uk&jS91q^6+VZl zTzud7ip|A-Gc0{EgG-P<6$&x>VlK!Cd2Jzpk>vFAA{rPalqVQ@9x$f8?mmjy!>zu* zz^NALO32Px2s25X?7y|jyTUP9d2KJJp?(aPl{uSW7-e?!MImHI};Bsch$9~ z%Sjp4Uk20F_bqKubV_-2wBJOb`bMLfn_2uR67e-rephFE?w^ql~$LsQ}$%8#AY z9@<@1>}&FM!yH>Hwb5;6+u6q-d(V+BAiluqt|F^h5$Fa{D00#AJ{Xd^*mh^(4~E+q;A3drrFh3I%a8 z81E(@=zPGj>=A49^1}8T|2_iHQHc28N-*AUhS_z^SA`%%$I3>`KwAeL$;{6vS$ z^s!BXsX(`gc&*)imlHw(j@3wnjK|B>VL{(9L))Hr>eT>TR8~C=$K99$Tm*CPwNvj_G3tuar~PtN~XB70afSfhYfAoB;CB$FJy9fw{g8qPyQO*r?}#DHIHA@CPE$@y}}($LDh zEGohx#HJie4wSBtvIjKUi0;4w8i8dnwq8& zwBXMe1H3b`<=)#KeinSJC5dtgGI}Vm7qVg+S8jyDec~7V`E67*zcOhfBYtu)Vn{_`H1##bXdSRp;P}jF{EEw>Zy`QCnSrPujW? z*?#{hMHRW`trZo`SbH)h?}|&%MdZeGqyJ0HZ#pyVeya-FYWNMM1apH^ zpaN7l7T)y_QE~x-_oakCFZUlN+4Kxla8~opXq)#(9X-kE6|XLtiXffN4*HJT%g;1r z@y^|_UAeNQ4?bY!d${63;&hoSj3QZp- z;9#M`A}99kg*>v2qW5qMk?t=mE0M0j!^!^boji>}@34NwMQ_+a_7+~V;l6O%`Qart zzPhJcRhIOzIef4$9{1zh-op66i0DlZUgWNu8Z9TxK=V%$1ZP&U$_JTVL?{j6tv>5S=oFV7|D^NXdB(WKs;H$t zd1;3>!_xQDpKDQM{G^l}X?kFyTzulRJ%6&I5_}}rijfUvmvY2>r&1aEp;kX$T#r_# zT5{5})dnt3Psn{uc2j>X7p1ZpUyJ=#V!R&PG57iWBU(nyF1ZH`K4*}=b;yIo%YN%a zArq)eN>Vk#n)ZEKIBgZ{3%#Py!~ z2Xt@djiTOxq_LJ+7{~``fMZ11CN@fBMjj~}--2(5BYMO7!qlBc z08Annt|PpNE)tz7qmZ@`hBiA+oAa8)Q~gT_(Fo&sCeXtX!gmmeGRm@s_x1v`c6G^a z#^+I8t=?Wx49%L%6t!e`5;#VwX7vTfi_KT;llmWAJ5IVAxEjqd=H)Ed6rSeZQ~I3) zTbX|sBEav*rza#1JaYQryJM|KSte4aPsnlyYGZN0y#1CnPyIC^qoF!QtKVee5W#>b zk})j4r&8&=((n@4^Z~frK)(f>!YVcmqJokre{!d1(>m8no&KnopuuR2GyR5B_MRW-((R~EhWz_@89|v8$%_?1|`w1Zj9y4E$N`6hQQrl)ViE~z*ec5R~Bp*XQ z-?3kun^`sFs62bVN!;P4HP56zwDhqy3YtfwTZ{n3n8Vdi*WTUVe8H;btI!&Fg57M0 zF-VYPa&ovH0<^a!Z3TGQqm}f!rR8;g`N`gXB-uLbF#0MdV8lowb-=ZTr<|1& z7^<{o`ukMID?#}cZ6g)l+|?_uGun+)!r<%?>-hye#TJr=O_e_*rR3Nt$q+DZ(|Sd@ z9ncWbq<+{$L9C11_9}Ga*N*YY-k0H*4!I{?bHvzF-5BFo)m=Hdy&wj$Tix5PDO&v` zKBU?+B2@5f%x75&zaATlpuz$Oj3;hhsM6{P!;ymCTCYXZn>E@iI-s11uzuM+jo0X; z;PgNto6ecSN!4N;Uf7n_18{x4pid?qxknG*sWQfzguda|Hk!=6);rmBl=z@^MQs^y zXz{~4aw$KgmmG+emGFPL`bn7JAG35`Y;B6F%bNNIK`9EWhjE-I%+@;|?gS-_h=&4e zYJB@f6J}^HwrZC>$eZLLv&i{Mu+~K(&xg~$^6P;cJ~6VD0506az-bbSV9nC-iX$sp zI^v7@^+36EBZ^2=I9b7ajVR8Zt7&?b#P-M}szgY(M!1SVS4J~Pqgm0HHx-FEoG;#H=z+ z0S{DhR&dj9;ju88^dK|NcV}5)sSP;zIZ%%+gjaHAs8MomiD`2DRXSU-e?bg)-yG z1#fCTqrx)bjjZEFX9`dZ_ zBt8c!WxnR*J8_pmnmUKLmpJ#JOr*hyZz7R)Hq;6l0|Ko{4x1Dh>nP}iN^Wqr9pn{Y zXPubMrwvYPJs1QjJwK3mL*wA=JaV`EZNHK(m@tl}n2TPCY@V=QMKgqJ#KrmRLD{d> z?}CIEoDx?rTPB74OxYVC)CoDMmXNqP@=e!XOqYs_Y3Z4`it31rk^$d~m-XQq(+cbg z=#hFwitp^QX{P}~YF^5tG?55txs(#i#`jI+LC&&5Ho1?L`rzkLWdU+!A=_<#vCsVO zF#WWw%4{dWwEd0M!8SrL>|1*B^p~V`bU;N^bo^)E0oQ03-byi6Md%-OWlNf}f1^|( z-it zcY9P7HeCuWo(`4)+#jQsll3T=O9o=XmHV~z)oJK8E#t!vStk!6SM>GM14)b9x9xuB zxo)?VJ9mqR$Bz!Xy7SF?DovBLgiQEVy-yYiPFmkQ@%2LqUKuWiL$RsbW%*+N3rJaV z)2VpAb5_`Lxvw^O|90&sBsm_CQ&d)`4`!i7J0alGzsaKk2Ikzi1Ad@@;hXWp1r3s) zU6@TAVUiOa1vcXyXN0boF^xrfbkFs$X9@Cgit?J^8LV-)!mx!N;a)4*g*&*NY*$va zm`!v(=i|IT8It&0Ff+lY&~g#TX2nDzm`N;O1PzDw?4P`~-SJ^`JW(=8G!h>ptKKMA zUpJn3N=W5eYrTQT@6Eyd8Osu3g)i;G^VMWqQw!Avf_38zjV^J5otvR6u_i)%j6H$T zZP~63p1+Xlr(u_&D!CzchZO2DohX8D2IsWcLXL^vuHWqqQWH%8%)8IcB*`yy%% setIsFormExpanded.toggle()} className="group"> ); + case EventType.CREATE_CA: + case EventType.GET_CA: + case EventType.UPDATE_CA: + case EventType.DELETE_CA: + case EventType.GET_CA_CSR: + case EventType.GET_CA_CERT: + case EventType.IMPORT_CA_CERT: + case EventType.GET_CA_CRL: + case EventType.SIGN_INTERMEDIATE: + case EventType.ISSUE_CERT: + return ( + + ); + case EventType.GET_CERT: + case EventType.DELETE_CERT: + case EventType.REVOKE_CERT: + case EventType.GET_CERT_BODY: + return ( + + ); default: return
Certificate ID Common NameStatus Valid Until
{certificate.id} {certificate.commonName}{certStatusToNameMap[certificate.status]} {certificate.notAfter ? format(new Date(certificate.notAfter), "yyyy-MM-dd") @@ -90,7 +95,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { )} onClick={async () => handlePopUpOpen("certificateCert", { - certId: certificate.id + serialNumber: certificate.serialNumber }) } disabled={!isAllowed} @@ -111,7 +116,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { )} onClick={async () => handlePopUpOpen("certificate", { - certId: certificate.id + serialNumber: certificate.serialNumber }) } disabled={!isAllowed} @@ -121,6 +126,27 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { )} + + {(isAllowed) => ( + + handlePopUpOpen("revokeCertificate", { + serialNumber: certificate.serialNumber + }) + } + disabled={!isAllowed} + icon={} + > + Revoke Certificate + + )} + { )} onClick={async () => handlePopUpOpen("deleteCertificate", { - certId: certificate.id, + serialNumber: certificate.serialNumber, commonName: certificate.commonName }) } From 14229931ac7bd88668dd917c66f1b02cf2be4a5d Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 29 May 2024 23:14:30 -0700 Subject: [PATCH 022/187] Add preliminary docs for private ca and certificates --- .../platform/pki/certificates.mdx | 68 +++++++++++ docs/documentation/platform/pki/overview.mdx | 12 ++ .../documentation/platform/pki/private-ca.mdx | 106 ++++++++++++++++++ .../platform/pki/ca-create-intermediate.png | Bin 0 -> 405412 bytes docs/images/platform/pki/ca-create-root.png | Bin 0 -> 425806 bytes docs/images/platform/pki/ca-create.png | Bin 0 -> 597678 bytes .../pki/ca-install-intermediate-opt.png | Bin 0 -> 632376 bytes .../platform/pki/ca-install-intermediate.png | Bin 0 -> 388910 bytes docs/images/platform/pki/cas.png | Bin 0 -> 503379 bytes docs/images/platform/pki/cert-body.png | Bin 0 -> 738610 bytes docs/images/platform/pki/cert-issue-modal.png | Bin 0 -> 381482 bytes docs/images/platform/pki/cert-issue.png | Bin 0 -> 592786 bytes docs/images/platform/pki/certs.png | Bin 0 -> 473094 bytes docs/mint.json | 49 +++----- frontend/src/layouts/AppLayout/AppLayout.tsx | 6 +- .../components/CertificateModal.tsx | 2 +- 16 files changed, 207 insertions(+), 36 deletions(-) create mode 100644 docs/documentation/platform/pki/certificates.mdx create mode 100644 docs/documentation/platform/pki/overview.mdx create mode 100644 docs/documentation/platform/pki/private-ca.mdx create mode 100644 docs/images/platform/pki/ca-create-intermediate.png create mode 100644 docs/images/platform/pki/ca-create-root.png create mode 100644 docs/images/platform/pki/ca-create.png create mode 100644 docs/images/platform/pki/ca-install-intermediate-opt.png create mode 100644 docs/images/platform/pki/ca-install-intermediate.png create mode 100644 docs/images/platform/pki/cas.png create mode 100644 docs/images/platform/pki/cert-body.png create mode 100644 docs/images/platform/pki/cert-issue-modal.png create mode 100644 docs/images/platform/pki/cert-issue.png create mode 100644 docs/images/platform/pki/certs.png diff --git a/docs/documentation/platform/pki/certificates.mdx b/docs/documentation/platform/pki/certificates.mdx new file mode 100644 index 000000000..560799936 --- /dev/null +++ b/docs/documentation/platform/pki/certificates.mdx @@ -0,0 +1,68 @@ +--- +title: "Certificates" +sidebarTitle: "Certificates" +description: "Learn how to issue X.509 certificates with Infisical." +--- + +## Concept + +Assuming that you've created a Private CA hierarchy with a root CA and an intermediate CA, you can now issue X.509 certificates using the intermediate CA. + +
+ +```mermaid +graph TD + A[Root CA] + A --> B[Intermediate CA] + A --> C[Intermediate CA] + B --> D[Leaf Certificate] + C --> E[Leaf Certificate] +``` + +
+ +## Workflow + +The typical workflow for issuing certificates consists of the following steps: + +1. Issuing a certificate under an intermediate CA with details like name and validity period. +2. Managing certificate lifecycle events such as certificate renewal, revocation, and reissuance. + + + Note that this workflow can be executed via the Infisical UI or manually such + as via API. + + +## Guide + +In the following steps, we explore how to issue a X.509 certificate under a CA using the Infisical UI. + + + + To create a certificate, head to your Project > Internal PKI > Certificates and press **Create Certificate**. + + ![pki issue certificate](/images/platform/pki/cert-issue.png) + + Here, set the **CA** to the CA you want to issue the certificate under and fill out details for the certificate. + + ![pki issue certificate modal](/images/platform/pki/cert-issue-modal.png) + + Here's some guidance on each field: + + - Issuing CA: The CA under which to issue the certificate. + - Common Name (CN): The (common) name of the certificate. + - TTL: The lifetime of the certificate in seconds. + - Valid Until: The date until which the certificate is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`. + + + + Once you have created the certificate from step 1, you'll be presented with the certificate details including the **Certificate Body**, **Certificate Chain**, and **Private Key**. + + ![pki certificate body](/images/platform/pki/cert-body.png) + + + Make sure to download and store the **Private Key** in a secure location as it will only be displayed once at the time of certificate issuance. + The **Certificate Body** and **Certificate Chain** will remain accessible and can be copied at any time. + + + diff --git a/docs/documentation/platform/pki/overview.mdx b/docs/documentation/platform/pki/overview.mdx new file mode 100644 index 000000000..259f15a5d --- /dev/null +++ b/docs/documentation/platform/pki/overview.mdx @@ -0,0 +1,12 @@ +--- +title: "Internal PKI" +sidebarTitle: "Overview" +description: "Learn how to create a Private CA hierarchy and issue X.509 certificates." +--- + +Infisical can be used to create a Private Certificate Authority (CA) hierarchy and issue X.509 certificates for internal use. This allows you to manage your own PKI infrastructure and issue digital certificates for services, applications, and devices. + +Infisical's internal PKI offering is split into two modules: + +- [Private CA](/documentation/platform/pki/private-ca): Infisical lets you create private CAs, including root and intermediary CAs. +- [Certificates](/documentation/platform/pki/certificates): Infisical allows you to issue X.509 certificates using the private CAs you create. diff --git a/docs/documentation/platform/pki/private-ca.mdx b/docs/documentation/platform/pki/private-ca.mdx new file mode 100644 index 000000000..78963ab5f --- /dev/null +++ b/docs/documentation/platform/pki/private-ca.mdx @@ -0,0 +1,106 @@ +--- +title: "Private CA" +sidebarTitle: "Private CA" +description: "Learn how to create a Private CA hierarchy with Infisical." +--- + +## Concept + +The first step to creating your Internal PKI is to create a Private Certificate Authority (CA) hierarchy that is a structure of entities +used to issue digital certificates for services, applications, and devices. + +
+ +```mermaid +graph TD + A[Root CA] + A --> B[Intermediate CA] + A --> C[Intermediate CA] +``` + +
+ +## Workflow + +A typical workflow for setting up a Private CA hierarchy consists of the following steps: + +1. Configuring a root CA with details like name, validity period, and path length. +2. Configuring and chaining intermediate CA(s) with details like name, validity period, path length, and imported certificate. +3. Managing the CA lifecycle events such as CA succession. + + + Note that this workflow can be executed via the Infisical UI or manually such + as via API. If manually executing the workflow, you may have to create a + Certificate Signing Request (CSR) for the intermediate CA, create an + intermediate certificate using the root CA private key and CSR, and import the + intermediate certificate back to the intermediate CA as part of Step 2. + + +## Guide + +In the following steps, we explore how to create a simple Private CA hierarchy +consisting of a root CA and an intermediate CA using the Infisical UI. + + + + To create a root CA, head to your Project > Internal PKI > Certificate Authorities and press **Create CA**. + + ![pki create ca](/images/platform/pki/ca-create.png) + + Here, set the **CA Type** to **Root** and fill out details for the root CA. + + ![pki create root ca](/images/platform/pki/ca-create-root.png) + + Here's some guidance on each field: + + - Valid Until: The date until which the CA is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`. + - Path Length: The maximum number of intermediate CAs that can be chained to this CA. A path of `-1` implies no limit; a path of `0` implies no intermediate CAs can be chained. + - Organization (O): The organization name. + - Country (C): The country code. + - State or Province Name: The state or province. + - Locality Name: The city or locality. + - Common Name: The name of the CA. + + + The Organization, Country, State or Province Name, Locality Name, and Common Name make up the **Distinguished Name (DN)** or **subject** of the CA. + At least one of these fields must be filled out. + + + + 1.1. To create an intermediate CA, press **Create CA** again but this time specifying the **CA Type** to be **Intermediate**. Fill out the details for the intermediate CA. + + ![pki create intermediate ca](/images/platform/pki/ca-create-intermediate.png) + + 1.2. Next, press the **Install Certificate** option on the intermediate CA from step 1.1. + + ![pki install cert opt](/images/platform/pki/ca-install-intermediate-opt.png) + + Here, set the **Parent CA** to the root CA created in step 1 and configure the intended **Valid Until** and **Path Length** fields on the intermediate CA; feel free to use the prefilled values. + + ![pki install cert](/images/platform/pki/ca-install-intermediate.png) + + Here's some guidance on each field: + + - Parent CA: The parent CA to which this intermediate CA will be chained. In this case, it should be the root CA created in step 1. + - Valid Until: The date until which the CA is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). The date must be within the validity period of the parent CA. + - Path Length: The maximum number of intermediate CAs that can be chained to this CA. The path length must be less than the path length of the parent CA. + + Finally, press **Install** to chain the intermediate CA to the root CA; this creates a Certificate Signing Request (CSR) for the intermediate CA, creates an intermediate certificate using the root CA private key and CSR, and imports the signed certificate back to the intermediate CA. + + ![pki cas](/images/platform/pki/cas.png) + + Great! You've successfully created a Private CA hierarchy with a root CA and an intermediate CA. + Now check out the [Certificates](/documentation/platform/pki/certificates) page to learn more about how to issue X.509 certificates using the intermediate CA. + + + + +## FAQ + + + + Infisical currently only supports `RSA_2048` and `SHA256WITHRSA` for the + private key and signing algorithm. We are working to add support for more + algorithms in the future. + + diff --git a/docs/images/platform/pki/ca-create-intermediate.png b/docs/images/platform/pki/ca-create-intermediate.png new file mode 100644 index 0000000000000000000000000000000000000000..e52e5735c87dde93155d9841cd42e195d5eda759 GIT binary patch literal 405412 zcmb@u1yodR+cr!pAZSBs6cp@36qI}V zSoeTWFc)JgQBZKotfZurUr9;PC_CDlTfH|!L3tVaHSWH$>Nc_Ot*5<51}2z>{`A>P z2H!9E+9;UYG|aTv_^(5lu%^Fu66xZC!J6t$MAB`tAYo!w*05&#PcjmEB)HGj7BPdq zH`*_Ho(%T)Ty3oV&YQ2l?XO2suC6zBATGWqQS5d`+V$3_tX?p)9I^#N(;oDCX32Wt+ zo)-yjUxbw>zog@37C%|9a_|=KWipANjp&q?t5BIl_m%kNNNQgDg+49cD2kb0kANanyNYAW+gvd}Muw@fok8;_bvX5^llzB$jFar$AJ`iZq|{f7 zO7lR44~3kcvij*(rIo%*km2*S#U#HpD^bHv;%n3GG1YT7j~Gp3UuHZZ$(HL@_)yB} zGKnG2ll6kZWcqcBG*!W_0S(S^QZadcvZ&5=oO>X}x|WuQ(|1RgebZYskPUYpul@|V z!7?=`DPdLwN#E};)jzaAy>61~pGG+bBHyNd&EQyDo55P=>0b_#e#04p#!Yh{N`oP| z)qEmX@;F42c-bGCK%?|r2wzw(nFExY)Axk+G#C2`1!%~QtYc(xgw%J$Q}{-^DJyzG zF2vh;w6>5KrEHasj*j7(7cD=EK=K2W0*6rxK@yZ|F%LQVY4aEfMsI)D&It#hahxIKJ)aFBwr^ z2aVEzo(2<36{Qp8KQ0V#k*ppz+7fVj*ns9N`6%7a62$}8%MTQfX48KCT~LJ5yq#6x zaa7P|yVW6D9SVEER2$I;J}8Qv|4`f1vha5_Z|q03D717=Kd{PW;<3oFZeW7=agNB%1wnUBT_MyfH4j=e&?V!c|u=)J4cw&dO*o}7s1U79+VzZ*Y~a^uZ@u<*PCYsq{DbnJnjd* z4;0BCJQ;n^j29SW7G&|jfV1iet1NMrzk?r_WwyoR_fPp}&Bm>G-@iAaFlidCYr71^ z?g_Apv3_elYR+wGZ7DS7RBn~BEya^bI>x&2K3uDDMh=2|B5*RXF|dIoo+YLTM++AU z@BXGHPu++4ZQ@&P$p`f}MQ@7s)cK2zY)IfvaAr9C`S-}8$YJwFg(==$-V3WttBJAw znYZt?YU*p8YZhFb8aW%kx(v9KsII6fm7K`UY1LW(>HNWrc!zP2VOJ`tsD78eZke7wj(w18 z#l_Gf4mBNhsZ#Y2j{%_p>_C4>>>ClwM`z!&*`Y>K74~)j7#yr5nKDQ)AJ|f6l6_YmsE0T9joJx_oU`ud<)RU$_bDSR1Xrv zt$Y|8P(2u65!64=dve5Dsgk{6<gfuh3E{=F zhXdI0mF|l6G4gL!Mi=UdAtxL933aq8of8_HQG03fIZXx`d3oKazqL#HBSf6 zg;|torx~9qVMT0ZbU3ecLME=@JwbOtJ!5i*&zj|}CT$y-A7hkz^qHQfu-JaK%EWye zJpcCQW0UZda4qx2So?IK+{yTfv^(Y1FazfFIl)Xem9JIn{D@A6s@RN6Yr3)bL?KxZUr}hzk*+lG*6@! zx!#0asa%?DlI8K~OhGv|NDSD@IhZ)E8ot$@?jP_HvD8qlc6YwAo8O;b7`pheZ*?1ZCBLV? z&`j^yvPZb5Ixan_o9|pyvQSp*<3*{ zQcBU%+cXOuIMY@QmX}*CV{dux(%|x3&$V&Uu>&b_oFOS zhN#XCJ@jwbkw_c+Uyz-XW3dj{tatZKEV>^$zka{_2;%K;$IEvk)H^=!J#DY9r_*3Q zE)TjMox?sik-9gYrwlfF9i%MP;>kP^MSemWU78#*q$u&FC8W)@{P5Z)*S{pXtzJo* zsGU5>SfY+LjgAPZC)l56_D#ph%SAhMp+*_UK(X93AyW0#20ps`8_uFErZK)xtEvPhpjmIW;w05y&v<&tlPxR zpmDeIOSe@L31{}_2DL1BZ*;u;$N>Z!W~TYdTtNYa892v6!9XQL!354wfwvec`G3x3 zQ5jLt|N0ya1tr)D1>;}$C<4bnuTQ}H&zQfD=rKVk_krICfVW#Z+Q09{K1@gd_xU}2 z;2Mggs?@7jz){u2(ag*aVrlOrmsSBFY!vJdFSQ^jD8%%C-l(tMJ_R5*>a>-brjw?^ z8zB>WTXrK;dt)>w4dQO+WaP$X2ci4>A^(1kv>C+2(dvVfmAxI!pXVAG+dDgn zg28_#`p@g{?`h^{^*=M&LH@NYV1XQeu5fU%b8`IW*}zbdKc5OITe+FN*OIof1!M-y zA;$Hbhg0OQ0spT{|1;%(4b}Xgq1=4Dy#GD)zb^ehhrWZDIZD~v0+Tw4{g1-_HTb_T z{%fEJ$Dg(Tmn{Ak^k1I>k`}`e;rNf%#BeP3&Yl8_q_C1!QUi{Fnf-a8a{xaW|2_ie z=#;+e|NWFsDg7bp(oZS# zAT(5^OI7Wu^W&_=U)yN7{!+FaJca4QY#=|QUkVPGexGU55vmXyQ5`j-jMq3`k{Jqd z?+o+X+w1aKSU?ollsP0=m#-6s(e5@czOMu?Dh6~!w@aa@*YMP@3Xnv-C_39faf$X2 z={x1P6Bi4jTzMv!OXgCz02t#LE9!zJjs$!}1=Fcqg%Yv5=YUqf;zHDG)mSP$X9D-` zo@$Y3y*OJ!W%;Ki|63*zL}*x-UA;+(>2S4~Phzmi6S;$*!|ljGma{_^7BJ_yhE#wA z9@dukL_t+5TjB8cALT=frT%S>Sva_7Vp^nVVqW6XcM|fS8Aq{bmgVVqd#~T+X7-JG z(5paX$VcDBXz|?3#95rruF->keUtS_A^-&=4C|?VF@a=Kb+MD&P*7&?!p^QsHL}8X zkJV0N4wtC3Q--Lnvn!J*I+z&^c63PWe(#Q7Lc$jK4n=sI*uvpBUXLXJlj@812)^F1 z617m1%+TRPlk&2c#)^30myB@Ie6fX%|4unx$xxG3L@gtuX4Bmc1L~gd@aX?;PyZIK zgrPBkL@WQ`Qe&^lDOa_AbACdh;Kz-^3g1DkAS*jC22J{CEgJU1&=y$1g!ov$xP z zPL;O>%Y2XbZWIWcBISZbb4W-)hn=4@DF4}2{}!#EF<`Y}p~_`Ue&3<_6c)__Eg}Q? zNWf`8PbN=KT1^R4eD_t?)6cf@+g~6z7z-@$pXB1;2ghZuI+-!QIfeV-Vn9)!=)Sl^ zaQJJ+PcKnW4Zx{KQw7{lytqp=2>3M0QByU_o}L^ge2Mw_RiZhj%Fl`RzPK#|@XQX3 z7=G1;do_3Jn?s@&Dj*M7H| zNBzMaBjcquV9Z`@$AnJ$UmtC++KBp$3s3mS!wp2_O2FN0U#aNj^eEA!=p_SMf8q}# z3umf<==5FrqEcf@`?+5R4(@7ZX)%Q#Et*&w8OeWS_)qH221Fc(W?Af7^guR^uC#Q| zJ#&K!)D0U3RlDSh;GPoa;)v_nSv3!L5MexHL|rhvzSNG6Vonc_%%HR0JFm7{32>Y( zeNn&CPy_FMz4QN1Ja*ntMe5(YVV8Po7-EtJV*q2w2Knx543wU|R|yO%#JGu(`YQ!7 zvPiY&9Ry?DQNq3wWI*n*3XpYg=~Z`1aB#LABIK(jo3UC5cjvaw^<5sI#~o*RRfIck zRizlv8o-cFE-z^*Dpa`4_B;sV!%S51yG;?IR;z{RhAOTmAJE~p{L{PplPus*WVF|E zUwnImoCr!ZIMm~@gGIggq_M_*fyJe~hR1$*=)A#%uu?OB)g68 z&H?ciU_=)AY`SJKRK`6d&D<|qg9*#6zpB2Fm6W2{Bkrt06bvvn&2sn;ZWl5jp|VVR z@MUeBXPQr{muyDRwj~WD@F;AF=_OjA=JNr$X4(F+3~2EKz5jDz*x*gx9zEAnx5~Mx zTwI))%$<(cT0Y4Dkdi0wK#<%Q^9udnCUxoC5CW{e;KGchv51|xyt8DG->(puPmC1J z8;Og88fySD`DJ*=LVIZcL?Xad=Kz)NPoV>V35~N3$oO{yYc!ux&|uOct7WQYoY$t> zWlyb3jXPM&^k11L(LPOQDVMHwIrYla%KkCrRd7C0aG(dMgWBy*&X zagasIuu$Q>1JwJA?fYGUL+kXPVEDc%54-X8*GEjgbqzIf)VQu&Dj7QqaiTjr_)nOz z!5G$3>EC@S4>aE0Y>%`yj6%_*h={Epw;4eo;qtR%V_7|b&E0veF~C}1vYOPYtg~KY z{8=me*X98D-zm0BaDV+xa7QYP1dNgS2Q2kcoTK>*2uI?~hh+)vc6Q~PMIS$>xRkxZ zHFm$_oPH|OD5y(}9;Ad0Ow81y7STmEo>wXd%0BFXK>^9-9gtkm(HfMTnM*9f>Ct`+ zgJ3flK@I>)p8ASOhX$j;E4@2-00ZD5bP!`pl{7-EaI%PmPxa_Qr!%F7xtgS2Lam?$ z%u-%b?+H)<9P)={zFf4V_ZReRp;FKbF&D7;is{se(2Dy_1O{>_N($3mXEpf(NR;b( zMYBeZMoTgKMMic$T9$DzY{g?R0sqOdN?s->vGDMm;lOIoXP@>OD@j&4k9 zDwTrlovjoF?K2R1WQ<9LBbil4h`J}LMU}?qNA76=k@Xq*yXB2%*yAj3;N-!tsBkc7 z@TF+nvvP!XIw@b-SU?)*bEmS*`8+5CT}ryU;=e|3m;+ionKQDzs}@IO04;8LP!rnm z0b0C2<#A>ln6QEoG@<)_1N@g?^v<==`*%kbY=*u(% z_*E88gqpAB&+K-(y`IOQCp$&7FVgQ}IJNAkX%7*<)65@T6G7`RZp#=?O4OP6_wev= zGP--9qrra#WUZ&)j>h5@x-yTyzE|0H3(^q!SYzEBlV894fH|b-ZNsP4R7EKuUD5;T z5*0|7->??LD9?5ETI7mPQib+soK#-$&n%jZ7%5qG%1~Uc{2YFG=Y-7#EVolS-{&1# z;pT{prKnGFMMtVC%8pjb-^h=X8^dYS#szTB5&w>3z%$$b@=Q3^wol9Oimx68-pte0V2%ti2w~0SW*s0|CTo|OkI&QXOl$P`ci@gEGT-1hm(pm8(o5+r1Jrw`x+?^`W-X0Vbh;FMSpP(!|UN!ynjLWcP#)S z02m9$MY}aIwobVa;wfhe5E|h(UprpR^uK^CeU#U^3(*7fP=x_DJ5+$fX}||S%Ux^H zkf%U6BIvucQkw}A`#f1h%2!LmR|&ul3pLbac?%*N?V$vA75qH;XDNrHYF3 z-61jggwaqg#6vadnF30lqKA+o+1q=Wd$)L6#|1h$Dj)CQli!~Ja z!zoZLSz``mb3akYIJ1@=*dw)kM+c$F5<0a~2=7O>^ ze&^%v!o_*&I0YCe`=_39jaAlfQZjC-^PxD7R34w&U`LFstJ@#mcWoMo-({0=jWZ) zdy2^U4X%J?v`O+X8jB$qbeMLR{4+UhTZpgC2HUOoZfX%zf_pPP3yewnDHs0bfBd^F zFOOl4n-ue|0TYPA0Ax#U@%UP{W%5^$R@=yQ=CC%mo$wgU_peQ^6=vbkdwuF(9S30U zIy}`+#oH>CWTKKuc2AXt3)?6285KS8A|nT#%Mw2X7n3h7xB8M+`NKvuKP;0++6VGU z{!>BuFZNNE0f^jLC(UoB-xVk-p;|V3sPGg}$4x?HF@mlOL+}r=BffkXN;ABC5eSu% z0*QKu4w9E8aO-JcoWF^DKM~a>nN~P)00L75f zk0ZJCLG59_=X~#wb@Rp9KO*hZTb3F&dQvCePPdrt&Hc&>ppS!0R&LMVOaUZHl&8vH zmhk^E(ibS2=;(Y*5G?9>lQL;K%P^6Yo9m$@_4btq3&r*UHFuiW!vxoZ>j8M2S8kpK zBSiLVhj}&7a3FBHRiMvO0;UMN4L(q516m-ysGBUtauSS z$1k3^IdolkEzRsYk`1VM{LQ<>HYOWh4GHDEv9(Zu5Nl2aY>QJ8J3{s-6@~*k3QWG- zosuj$=K#Vh@&6{g9%4Y5-w(&TkRU%}5VKkF$$zVsIiDyzYHOxC*=pO=R^Z>+?8%xM zvt5=s2pN8n+WzhxB?8APE24cI%qp~_GaP7>g5?K#s;psPk(l(uT}jL>s~pPZ<>fW_ zuIzim@$*C~P%*g@C87z6+AWs!d~19v0NnspP~*-i;3+|?9|uV3Tye9hwoB+B(%%sw z+ZL*{&fLISqQPUmZ;8|l*Vof#xN`9#;gDJykuT|vh$Ygg=oAWFJ*X z)_W|gY5QQ7H=aW4Z}F`g+K7}zJykJOvof8pbkMoK|ZJmU{KoOr-Tc-KhVCF1wp zS1B^I>$l0oK58;zQ4tQ~$LXtAJt)C7*pp_-LiOvtabo)mauI>87a+$3avcAz6{1wo z6b1&eZnox)s~o@B`52_xvfH<8IPb=;2Iicep4R;|xU)G(&_qdSwvzA{-rJ+3q&%ON z9O^7ZNY!pbjKj&^=>B>f{;evJzHgSfpPRc@yl&2fO7wSfe3OWv{PU}DMS%^9^B~OP zl9H11{C5A)vzw5o2Izj zD_Yb+2hPpjdsA{Jok0q*1LNC~L>wbz(h0OIWaMPOjmgO23VL3hOaqPl=o`H`kG?X5 z^(b3l+DAr4=C<8{T#MQy5%}*I$8r^T$ocI)B|5aVg;rqWOlWco5p%!3 z?fuHq?~jQ)4}C->!g;a3R68}|DqEv5V^r2$vd|yT)lpSjoAB)$F~fW0X+d|B7orRL z{e=b&hV?5$)`kNn>Y+d->H0uq@|4k#EhOm~`$}ux_}%%FY|!Nn8qD}8m9?&{YzpVH zVRTZA`P$W6c!HNtqqL^c`9FhZL^J`v`wLV_wElInRNGwq>mCVZ=;E74Uq6aHr`YkAw8ykZw!z_wvUNCOL*c) zrTiOCc|9+7t22Mx<9GG(X%Y1PEvk%;A6QcaDUs~o6dvC(x%#Phsq zb}aT08a>9&4qO2eyBVWBDkw{~X3;l1{C!x{8A|uv1t>63nD0z;tbXxjSXQO|DC;#1 zFwq)JvY{7GtLqLTztTBfP{r?KH!&M>3mkU-K0^?SOX+xK%{2Phb-K%(xa=O1i`!Ro zobO&u3LaW5;*zk(UmUQw{!S8v1Zh#@AL_ZFiKXN;;{ zL+=+R^OFsG-pFvwT9LAuv1luE%EGhD_^nnFf~HW%u8pH-z0}TD&nLCcBI|I%I5)S) zEc{Yub$dZDKvJg+vCdA;&Iuao10iF|Y8Q+*#j*Q@th9M=ogf#6Tz z*DhvjXXU&yQT4+y`#h#|1~WhA;0AerkhH9zzK0bDdgIJKbN}PydgV}qG0YP&3B6&J z`}NI0+II?Z1-at?=6?Sn)C|o;;I2smjqvi%E-831c1VE_1G=f$Qc?QRNU}GxGq!*B zER|4~K5fVt)quX<|H5v*uI)`46){KH&yAm-v)YX6OJgZ6)fBTst5d~yQVMT@D%Fxy z0N5!tbVutrf3;`ceZF^XIT(1{pHL|qbAF7;L2CxwztZ$o!(~}n*^-FI?;j6>=1+Nb9KV=2wLm|c zICZ{KrQ{3FT4=$P6P+t_o|$Y&QO(@-F`F10i*0)1aaUx8AAg8p&Av>ov?6+Ss>Zww zM~YZR{oWI74z(=HvuJJdp0J6|E#bKjOS9i0FDA?Oe_P;o$sNj?1xvNr{Q` zj@Q?STT0s_M#N*Z47o37*8oKZ`OI=rK$d7ga40K!t zKaJKPE2-3!lKPm$rUyR|`0M&O`)WrjGnH6P7>wJ+;HF6{j~074($ z_cXImuhE4JB>L(zUy8tyl4ad@0@z2XkLKx1!a`N`^)vmcqJ8yvV(!=D5AcGfScU{A zj^Ep-nWhYiCDooI3qyuYl*Rkg)ij?ZCim9S(xf4}WbK!7M881UWg^H}70!9+(*&7@ z_AWXMN2snYkFpRkSU8udVxD46EqkA<&LJW_VedNq-li}F?=CjE9>551FgIT}Qa#z? z5R&EJi#kR)EVHDMy56N7<4-<&#*C`es=;ddmJHw%aaP?353r+NV?r+uT#|J77X>Tk zTnB6X3s60iOE)uXtWF;ASm^7>jI$6O$|#7r?(0^X4_Hspuaw?@L=|rjJBk`ZULM5? zdY-=@xAjg6K~9$H*~kb+dMD|I9PaHec;?n#RBE+&H^T|#>igo#E?3uJf)Mk@>wzTx zNQ!k~i$Mwo*)d75ccaT*10)L`KW{Wyrn4D7?{8A7TW`Dw^Q0zt0-TMqYH}{&HM$<8 zx*r~9?2+WLo4DNn;TRlE!IiYf6aGO7L%!|!c!K5R;0&%l&sfs&qP*~A5iXmwy(#JsGg+I{c?GMK*NH(3I1bCI z>UU>JSFpzW{p>};E-IEbuzKJ|fksk=u6xet8J17ft4bjy&d0|X(3M#RG*~`Z&LB*}z9R^)9MTgHglEl* zmPh(Hjmr~7>IqjT=xDI}kC3N;s*XEt?3ZAbQQoRZ*a|MFDMi>7Rwq~k`|t~mZbgy_ zY|6UHxFYHaJJUl?6LB}TTWHuD%0d$Z@x2ByR2yRBTt2tI0pNb8_?WL~soLZ-V^$`t zOaG_c7tXO>n_%t%okFJNSUy(ms^O}c0|KUteQ{3Y`OAf3v!7IHb5rDE6(aCvt?pl~ zabF*=-j#2`&kyyrZwk9uTU8D9JwP^!L3Vz~Uoh!5Kr6JWy9l%N8ivjEMc@v5Ks>WZ z)M?LTnfiQG#*1pu#e2gE@(tBg3Ja-^q7vOG6-IAw2%fA~jH+Q}cl=Tmvb^?0oyoC< z!X0tE&N4Q_)kB$5)ZMnz-1!jN=587ha=3O=TFSoJ%jeUE=2}&@$e|KoF|_ND3@#)b zS!i-UfvTio9kJ^*tRYrQw5z#Umn(-d74;fji7=os8j~E|M=)>XY&|x+E@Nhe#77Z2@Wx2r2L+mgDuVhcFXcLhWUC;zMBaq;GNwD-8{W_1= zKm0gW`wXAlG0CE!ng76qg6HG8D!EDOSq}ilZ3>9=&%L}Hd5!m8)1$%2rV?{_BNio9guf+E1A(VTg z!g&V16GIo=obZEGd5RW^j{b3Dyg)VAM}ne3I`pIydwsG5{>5%=N!&0hO`x<^PWTWH z?&<#!Ds>K>hincdL@!Y5Q6X(M2Pt782c6+08`oz()ht~177nEG8M`OU*}y`&hJoR4 z*M1JF<|!g-?_ok6BT5DKUp*iOneETjPT6~$?<^E~SG?C9)`)Q)BpFU!@A)4y_+xR5(o z(l)SR>&LwdV@MPF7iyN$ebf7Clwm~_WIvu6@}amdEX`W$80Qi;O{nk)dG_PR_$u7W z-k#UdO_t23xNhV0Z zY5&Q>iDQJ_d{@Pux-#Q}@NRkgp86@x`rtz2#z==;XzkS_WBW8K%H!w71_%2@4vR;t z4D;1%qHfE+uC}*gp69w-URK?^GnM@f&T!oc*W0l{iDY5d(%bi=xsN2RO# zI*>RMq@nHyW9}gnw8Nt-lp0C=b1$(ji8=I5wRLoo4KHuJ9D4ipJyOuqA|AbtAUwC~ z7XX1tD6We?E`6Z958FKeTV>Z(D<+7{IKA2Dq&ydvhS32iF}Y~R0`btZ*zF`1DR^?z z;fe6lxzzgdB^LIXmPT&Ke*XL7?F?Jx&!Jczi=ho~{s9FA^Tprpxh2&T$X#2&?oH4q z`D)5)hhP_vWW9+=NUrAJFV#%ENfTQ*h(S=zrWGCg2&LZ%iafE!ke&Cl@9HPrC)uxd z`{3{kUeWD6S+PcR*z9pMqbsl(il5p@DMhhe79>Ld0*_-O?QtX3d{-0$o%q@YyR+q_)k&hWtP+_>c)TzL8Osrus~drY0)urOej)48MabiSqkxCA(iL|0pUAbOtK}>o%9W*w%m%Ddh~se(=UhCgK7;Qz@d(>B_Xydf9iP;oF&>u2AfGaZ$>MuTMblp3qyo{m{G~Q)u zs0rZVpIx=Q*k7Qd+<@4Z30g%Huxl9}`P+J(@Gr#|sOB{w^j)13Siovy4y6+}?{ul{ z44SnAVpF%2qXM(8^7RW%vO(ckm4~(Y<|R!=v)H@hZ1e?1b&66(}2+m0|-BXb(MZ zFtAB9N_F|bvV`vaRaRsDxeDY9TR?9IWapIB;CU942r0nocuv0e%(lt1QFL5B!GN}x z)3k!N2hMHhq|jhgOSXMckk=F@GH9sx#T?KnyoX=jhy6MQ9F9RhHfaqe;edugbm&!s z28&g1jmroTa2!mYu`?AM^m6Q&EYay-Gy1#>pw524Z;+%DejJUy2Z@mKW5UOJAy}$W zTwmUn`YP@BfcyKnWgS(lN9MKW|?f<;~drFD{}+SToB8%V^XbAf%51d?aqW_^~O zvzF)FO9@^y51}(!p#o|!4Q<c+xhqnp6(67_<)61*{YGB25*`MgDPbCYtkE#4 zUVZl?POkOh@|PS0xieRhZ#N@0)}K6~Jt@jv_ZBrxQDBTJu*nC(4 z+tBaNo5lFr4X9@dPxRs@%M4xkl(jac?ap= z$Y^nSVKlbB;uAZI%~=WgYqKxD_5i11K3SX)%5P9Ubbgpo2Y77d9&hxcYT z2JHFCVMiD&8Inw2c~R4P)p-?ky#Pk6{|nP17tBljH^HXc#Psws^(J$RZk&lzuynS0 z-;M9bw6G1eYl4WS_p@shh_zI;`(i8t5FBArRuY%e<(LcWvL zl2=ijo`?oxQhk;Lq|Q34`^8T#_ftHzzAZUKY>?IRPTGjQy!s&ujXI821>vgz_5AsJUtfyopJzEY> zYZ|7@cie)I`d zU8-H$KM%wNFE>K3!o;O1Jj{pAqY}@ehP~8>4`x)3j~1wYwelCwo#5?O2p@*ZN7r%z zzDNW_$C}pykWlorkY6GSsc~}BJ`F=*D>b${3l3v0>7ck5pwS+V9{H|56dh?OZRQKn z(dVzBaWbt8{p(0;_p_bqdXKY0b-iSv2^`Fl5FSlt(BZ38Mvwug_)0TPWSJ*h+UG9W zgRM0YmIAfbsqy)>`SxekN)=%0gGQOjqvc<82;{WRWX!#L*LycH2W6RfmT)bg=i+%y zZ8y+a6=TrTOT+^09$EW50VgVt!)j>U9eNzbWtG|Jhyf)pM$y%SWKE}vL7pF3x?E{J zgTG=~$z_x?@8dc-J^(qKH$rm`576rkys2&uk*+r_v|*4ifWd)&F$J2GVy=e&xu)>5 zCIs|Zm?HXY$&KKTDjOm2=6X-WN4iSyRVN-FBhLr)W%ct%ojrxL%Q{t-8Co!Cy*yis z00}7I+jr;y;V@g&6OPr%;%`~nn>!^N#m>?@H`JN5~O|p=4;%Wh! zA}L1>5YN{_2#;tN35Bxqem2_Mu|p?&^|Yu^4Mr&{BGWW429&7#Tt{}`aOZ9{gaP?0 z!u8z_KMty7XbbhU!3Xk4YOPticJnL!$8B*Tuh*3XWu&3O4=HO(i)W&B*%@v%$#fJ@ z(?l*xQ-u2?NO@l4&(|0u>r7^x57(liK85JceN^$LN~yX%#|If`gEVGrb!xwaT&``- zI>6tu+(u{UEv{R6hHx|81?&X9H*km zK*GXd9DXxwe+&?okv^cbIV&G7jumcz)mh+wL>c z3B^*7mXPcg0I5PRhxY=EZEZ{Tr*)lU$2`XlH4bES}s?KQ7rML_8QThvla(wqW~ zs1!aFJ$4prEU8n(gn;#9!BKkpvIq8{FS`qk-DiSwO|cBY2xnbK-5RF?tqRlfMuS@q z#Cgj0j)$#>C!#o{um`AcI&Km+gu%Uan?q?yKKAoi2RexK`;RC-SpDcZm@Z#U(n@fHXcQZ9;*jv zs^rw?%&@Xu|Aq@(<>P5?Ha(&ii?6j`?A#bWQc*d#Nh3OX9JViKJK|CEWOEwWnmlHW zT=H=pzIA^)t1}C3FR_`rX!+~nB*H!9Ptzz6t1!5%ZbgXy29x?z_3MRp!mIoJ0x4e$OohQL*!2mIl z-~zv=Yaf04%|~9uW49jFVu0&&H|=uLPx~~B;D72pyd=Ybg`ua3ZMoqe?TH#&LH5NYI5rwrEg_6u z8cx+n5x-d3sPry`}B_Ioi9M%c%x3-BnLssP*IPHaNxNwkn$$zlmkxQ&3y6f+ zs$am0Ws-l|Ei@4ciWH%zEzZx(SVc3Y5)s^goz@f#SC_7wXdo+yuOxd26)KbVve3ey zZbQ_S;-Ox>=jSygd^KS%vpxit+YI|S_mYI-G85aiRL=w;+K3ml#+mIhH;aobm7D8VWiach$U%q_SzW`W*{zh=^=o|j1EJ-@r<-Tx>?HGFVg@(cDxpkhyT4%-V z@hG5yWwzY>**|+8mR}k3axA8F=;e=+68M?THr1KgX057%Dx~QN+a(HrX*16wYNy6r zg(Qo3!IN44h4QJt$$ycH489cAft4J}a+8mg$jR-4@zA$ZnalB2@b$j91ewW&m%VbH zy6ZEQ77Na^1}pi0_5%3dVDK>PmOE?bzDam5&6sN}U`rAw0J;wCn+w7t*M(?Ikweyd zi71UHwNXRD5P*wVrD|;ojws#344A96J?k`NP)e;BbZ*Y@CcWLOT_O_IuEP)vwmrPskPyUf{mHMc2i4U!lXa`DV?n(`6&-R>*?8nr$gJ0` z7BX=7ZVUEGSlw{yW!|BENS#BKMl_(;o${xI|6CbV-~+qvVp^u7rLx-A7z(J=7dnJ*Xe@BdXCz`j*pK*DOgBF$m(LQ)_$%6tY*Vw$EpGf z6|#5I)3rXgVw-~us{q4I%okDP@Fu+{j2{lK!2Tvj9+bf$wRlwTVDRXjE+-%xPJV5b z^Gq3BdEqeawdo1@I1Z9(^D>~I7<#|>TVV&!2kDi+axnbdv#P1?CUkh#%T>D^Qj5IV zE%NI#IYM`Nv-3eNonPC?BTdwZ?V45Ep%EtdqXSgEFre`_B^(>d+M4CYd6TJnK#krDSa(?YEEgclm=3* z47XkJ<6=F?M&&56Z?`9%!M{ZL1V-PKNa#s-aoZ=Y&yG*8ZII+vM2q=+yQO=1XpryT z<4FC_ddkFh1DYcwr5yAQCR|E1xWbAwf{|wVk1udPuxyawnvKM$SDI=)XK2p!dC!ae1YqlJ zC-Zlm)tD^Hvnn~+IdIfV5)S=SL|yz7jJ3*9URk}%YXqXW(W3l&?suOFtIFgp!Sn6L zTEx=6fx}jZpHjl(6(#YTW$B-R-$q$LyT7ldmU1Y~YM{3ZlDGK>bvm7GXHm|aY{n!nh!l?qO-s9?r)2PftKAQb((4Z3Zs9JLeHu@}594zh!2bJC; zFM`~!cN3Ostk-)##jF0~PoGFLBuyPs7M$FcRhC*j>_^t6UjQdNx<5w>NQ`xs`8QI83AL5bmDGYoT*f6)lYa+#rdEa43f7vW3WPus~)q@_+)fDzjuw$kvRO{{|kVP{>GK|mf-5lL-J5Phg1qpK=|V% zi#xvFtUwgJ7)8oEv_!`HibD~)at^epS(^_envs#?D#ilkD?f(;Z2Z>`Y-ym^=kRLZ zlg~p*;4n}!T-p5A`@r((gHqjjw6j)G&@xjvZdyOxi5U~H$-qa>U(6pHe5-U%Yk!0b zEaGu?U0wg-S0+Sx;ygQkBZ@(;GCY23*$-LXUYqW#6cu>eh4Z~g#rt-3h`=aKpwdN? zq`eLduCSRZLo9%mletWS42C>u!5s!Z2vH}58Vkl;<>s8S&Uf%i!!7b!=R4Dp_B>Hw z3iRIbV~}KO?ZHho^1&Jt_~m?sStUp6Q0!{GXw3CWpuG79OV0CiYM;x+&~xMarn_4^ z9wv&ZLSKbEM%n|-&vxF)>IU_(9WPRgK`l#lj4V^Z5WAZV@=eWzP4Ag8*MmhKe!Inf zi15Wfv(hv%5>@C1YszG+SjF4Prse}yQSck)y?^!Cd4H|95iHm_b{hQa57f>co~@7m zX?A{5yF5b2`Pen1M5k7pB=OWBcd5y}PoyLUJqpIZGEK`#tapjC@43FGGh{RrOV-El zi^czAy04EQf9~Ft7=^>= z9B6_a1^YJ;GAL^Q(sQ*g-`_j-a0Dk?F$>15s(n2Q4v89kd~H45fG4)ZlxRP96}`o z1qJCAr3a*Y2uY=fZjc_jVTj)u@4b58_v>2T-}{e?<#NgAoU_l~&wlpa&oMJon~z=) z^<1k4Nut`)gVIk?5O~L=HCIDv@7AdGH$D ztkSjkyIs68p-fs6Z@Hn_SQqXUi)!-dwo$zCppo4{Hz{a;qSl8){ypv^aZzdl0xap~ zp4W!Yp4ABiWYu*pZ;TBF84Nb%C@3Py9$Y_Y*zi7GYI*y@tb8!%m7C%NuYTrlQS7{l ziB?94S68;rPWP>>Yn`meKHqfevznQ@n8>vt$ufg?gOSo%Cl1*3oy#{|uSK3mk86Do zJ?ogMW0WT0(67ENDATDfu(iMOE-iMAd^72~ylw}eAHk%_D zUEjASm)#RxXn_SO4yBV35d^z^j+4AjekSU4x2VdLcY%T8j~jSEOSoE>aX+9u^J1|9 zlH_h@;-H~=o&_}-rtRc`agrF4ip=WjYDngTvJC38XML~LTviap?jPWodYJ<%hMt~P zL}sD_vKnKaw+V5Gui#5BeeJ0@dA0ViGIghIW_cv(dVhi9(8G6WnM}>cwP&Y{L=pmd z=C57_3sNp4L$vYKh`0%c#q3Q^Diw;1+rrD&f=9vt?ylANo_NrU>7~UWT}L6$^vw+B zxO%O~dbn^AldKf(u{#pF1A%Q;X6YVE^eP#Dv;`-sHkimlpSbtxlv46D8t^*f&kx%>U`?iRVi5gESYk`^?=zLf0X>doF zF9*4NCf)LtSpbe=Km!B88+>)JHFPIyCT#q+V?3^F69numPA6aXC+Tm5UB8x)wsm~y z=(u+5-XJiP98dD>de~PW4SvzsoHD}&rUtRjMcbyaZ&K#=^O~@7f7(wS?twOf~3oAK_t#8oieBD=GW7VL~BjeT7!_(HDq*@&fE+(o7!S?x% z=`;yOop*+h-=XG)cAmUDcEGeMKn!~$a|hl{<+_}mo_Ab5au$ocZdVPONNU+>741Fc znHwt0TMM!lICL-aYS2!R*wPxy>4YfUZfUFaIjg^sJYvV->=e_s7bYyHO=Lf0S9`*F zy#8uqQ4*gb?hPgXOG-M+EpM>Rrj=D}+b86HeDJEm^~`&bug!U*&U?S&qBE(Qv0lD@EuUhtC^vOg)f=2t zv(6aXumb(}mEkqa zH0Eq`xCVWucsK2@5&gHmot-JW2}=p=52Mp%sbOG{00ZZ>6j5^UzOiSHcbDbeF&B<3 zq)_(EX_KE~>NQ4lomy|b)SENQxnvX7L4*?zE>dl#qx*d#Su}2S(m`@b&W=euF9Q2@ zY>#4#SHY62Jw1xQTKu7W<}tdiZ4BB%xHt@Iwh+ZS_3v@;B&WzVdglr26LHoH-#cJ= zH3>ws>lqF>yO8svb|)tEk(vi(28xxL59-Q5idkfMxb<--Pcc-CysYfDUmniJ>^A#k zhzxzFza2;oO^=E#WXiOs7t~m;LrDds*2XIwrI(Kf^M?0PG^Z!&t1qUAI^N;q@~oAF z2C3w78$JeIb`b*JGcU;`EfzKJL{}o+{!k=4Z#RV`w0QTKF*mvU|)@5&2vjALS^_O1UX8c+jNel>4nS|^W z4kv#b`X+ev>FLewrSEUu_wy#Jy@&05Ua_*Pyl2JSF@hNZgs3gejxv}&{d?X5dM~_| zx@b*yk0D*eW%e3X%uX+xwi)l<2Joh*{e9M+gWa&s>=|5 zqgB<6XBWl6!t+3vO2C12)`N`mqp7^Zm|b{CT+sfhsM8QtS3+?nt8@Xl$%2>k(QNwVk&P>d$3lA#_v>|Y87USc&=wy;X+UKolEur+G?-YnMf?K(=g7EbV z9A|s!)oCi(^=X*JI8M!)iY@3@tEOk$RML?h@x?ql5`XN#rwIpF;GL$qDrDH0mD!+; zoVSe8v*&6tFHjgUk-EM|%1Q*G6Bpl4i(JzxkWCZ8E`qZUyIW$CPd~l{y~=fdPgCaA zhs<57eW&~V!xm6Xkkn(9>+ty)&3D9WmyJAMecBKScbw%6LZUVFxFAG%G!K9nYx z%oy6!2})2y-^C~_OKt@thomS1-G?7Tuzn8|&X~P7roxc9UDI z)CT1;_KG4$o7=9RXzvgBsM0dAle}Y9DXf!tr)n{GN;0PQjlI&8> z|D0b_nb$06H*%75zy3+1pW@Z4MUE{lptrvr9c0h;ea=G6VbF+jr&l@}y6@;znxGt3 zM9MihbKwa?pm-e?-entC&aQAA>8!`aZWH>7VM>lf2d@ZF3Gppq5##H|2~h^#r)}O8 zeC8#$zM5qnT$uo^Ka@n_Qe^gLos361RhGC1y`dW9Ne#SKu_ohK zuD8nZ_q1+KQTv>d$woI-aD;d!9b3nXc)Ea{MhEPO@e^J*#=$?Qc%QF*EG>0W=2D_j zB7-o8^!yOdU{{n%i!D||3Z&sJ>I#C~%`qMS>UQRubhIp(#{tbY%Y2#zUmjL%z8alK zac;VH{hE{Xa5L`mSn0s39_e|;DG%}wN1@C^wRbm|9vGqXR;q(}@@uqtvj<;$XuM<` z*{VGE^A7i$JAxR4>_*D$@?*z(h=iv8s<1_;p7Pl1Rorh-+M1RfxlSTq7rnPOw>XPV z#_&w6M@^BU0%G;hEx=pPp9Eem*w^SS@IDbNGTxjSA}t{Xaa^qS7M><3^qPt~xwhnS zXVa|~>9FD?8A-a1mfF0LC9|w@Mn(zsdfeG2T1g$v`g3xXLJJuN{qC)V6fD{heu*h0 zky2t(o;XkzaGotZBU|Ipbzk+b^f;iGA|tKD%HC>K|N4mJTK?r6los*qK$(NFnaktx3`)cq`Hl-5FV~pL!ueVrkZgRaK^4=P zeVa4r*xVghDrl)Guh}u(=QZ#&YIQ-iGajg};JHVvkUD_CF zsPQe}2zz_GON;>z_eF)Mrt;kO0>_y0aN4vdQ#s$C6+D_b0Jd#juj<$}24nN_X!*Vh zk&~FeWM^|pA633eKyc|$da%;TMKI^7 zJ$9V-ewxBOblTkJ0ot`y%SEyBAqQdTU?5r1EqRf0Go43y^dak1{fi6p%O%LvJ_}?y zD5!%j>!*uJ4lEXqk3e(lwXoZ%CKc^0S2s3`bY%=3?zy4MSY^B-Rw&Cw1Jn+&xJ(K$C7mg zBUrHhJY&_*fKG^t`jj?ORETdX;bKHywz!0z1J5{`1=?~Co@C|++`WezH1%LCVtF>K z#>MA4KH1(YRmDa(zOU3QDTG9lqCGFyRQzFJ8eV+{_fpMfAvPmv@lrxs`hZOt9u7Sp zZ&^96{S-I4GvLS61%&qdAi4C?hg0CN)1rApIC5_ZlUD*GjON5ybWZ82U8J(~r>u+PC zryy+=6|-YY(Ef&O>Oet{Srf*y+{+U-@CrSk;grmb1Cy2}>u!=F>mGKpt!i^ArLfg$ zc`&~I*Id5ZXCKgu9@Jc1QX(+@DD~6MGHB4BPmait6|x-a9T>5Mqt>1fnC+y4vKUNY zv#YJU+G0i!)9a>g>Q_}3m(hr+BL>4MG_SLm#G2frePf%|um+~X7Y}MN0RvhcvTT@M zIqG?L0BM&!U&uXI30hYx9QSS8hO~-IV^>E@1$*3N%tEmbS;yhfmNB>^W6Sv1pS2$S z?)aHs5G7-8lXrAOye3i_e#@={oXWzGT6yiWNI9lV$d_d{C2q1P74vC42uT9a zz-szS7XeHpvSVEG+Tx8^vn8j`?&Vj?8RE?PvNBm)rj9t=rU3@A)JqRolZ>v92OrAH z2GK-mQ^&hqVF(;F-Nv3r?Mu!hnk51+#Vd-4Xj2so_4UmT^a>wSaXlvKzyA}vCah&0 zCLhnkbmlt~tKQ+x>VZ4)MKxkQ@G^A*jt0EtKd^|ca_26}#6K)}ITxta~gyY$lTD8kyfn{Y>=KB>? z2C9QDdRj8$>zT)p3-CK%l6{UicX5>LQ%N{=O1?H=;kSbpGDF0xq4~i{?|l^I%Dc|m zAT1Fx2X04$fUnOZW%mLwbi3mUq=W6@rxwiH7^h&&?;^UH_iDMqp$cq z1u9_i=PrnbZAW#)cT~GOl6e?=9WF--IL=!e8zePTClG%1ysW%0U2%Fc7+k*m;P9#n z08QkGh}uK>LCWpaDxvqjbWRd?+aH2fDQk=MQ!s%wzZtUGFfo$~31w`zOmPDbDe}&FWbnV=W9eZ;E$Ic#d0;RjBneNbADiWPHT^yQ{0}&-C{jnNzeJ_ zx~Kcj&}MfG8jb;(gO?-E$?R7suV25&_okH>0>3i=NV49ElZXt(j;4_42K*ccw$7}_ zFB`N)q05}Kx1c9SC47?2yU4*nSG~AkIQUi)^NQy-j`O2}4=teA zC=U3PD+0D<1qGbjkEq4Gd89*|Luk1f4Qc+!t-ZXZG&nG!f6$Ra^Kd}r!M@@{C*d8p zTPf5&P`)1#VZ5Xhc0=saI5#nv z*La#;0>mR~P!0nrITRSb+}4sy?DXJ;<1XvfyJJe7oG{uaiQJwp zy4i7{!PLQ??-8@Z#eAGYDXVwu?@Z*Pui5kDmbF+jk`Za2t`AOz2XtTfV?(~5CIpPA zen^$T$@G%6Ft3SIcJx%{wgTFHQe@S0)#Di5pWN_-VPr3#`I7?~n|id2%|)~hWm-~c z^n)s&{;M49%>s){ZhEgmLx7A;q`_33#@CH_JHA+~?S*I;(h}gmTgIy0b2527)j}H{ z36-i8QWdRvq6fu4uK?c%@BrNqX{9%4u>i3|EVcAqCYUHuVUrf-@2?bDlX>R(T2N5S zG@|RZmrHnXkesA(TnV~3MaS-BKi9X!4Ub4_uYryZl&9vMXs}$O4EI48-$w1PI$v_I zm#~_yV{|+-mV70{?owtu&R4h~?P-x|cjv;T6>c`R%@&7m-0!zTrBK{OqJO+aBgANR zgh#<4C3+-9_fjk|8@5uP({TD!O=KO3{7`Po*~^o`^m9T>w|yK)OT)w4jZgcS2a$;H zJUJ+~cyM>9Z{?M6pPrmqd~1Qx+SS~8f^)i*9wdn2+>EtyXis_kS_iaPenSlFOFvrc;Cw2|f3sf`!%Q!{=W63K7 zC0WGNFv>S9`|G3o?jom9FeKENi(GkKHQsl>jICcHp1jbqd9Z{@X>r>W}No)#Nm>?ZAj8EaTgl3>?!Hk z&)K0)Hb7PediMUDNj;NWoRlXo_gv&cxa$Nn$=X1a8X< z?=Pu@fp+v~vo%d`RB|cDCNTN$UOfvWBi_>@Qu+K5Hrh!?hG^*Tk=@SZwM*Frr{H}wnM_p_7r!PdPe-)BQF6%FPwW(j*A zH|oN{8%9Bs(WQBCQ5KwIB!^G+1|db=N7_m5t|UnxYRvTrx>s}NGatj}sOZNP|5&@O zYou3tHl>2y=7Gmcizi(ZjpN5DB`&sBx$?IpW9CL?3h85irTafXH)u2w2bzrEhRXnw zvW0;dVG!$e;dJB6etJa((-@HoiC;R-YMyqFYC)^KZC2U+EG&HTyQ%N)+L$moU}j(U zzoy}0J!u>EIPvP>>WG-vA|JZ5^2NX^OI~||0K&S+F!|QIG1UG#EN%2vI4N+N(6bZQ zR}gM{A{266g5D~`@(Kq8j)s{aEJ%qMX0C!cs*W1ezJ!f7QT>ntvX^0|<0HuB@f}Ya zuzXt4ed)Hy8?maDx#lXN<8N3BFFd#t=VT0<03DtrmjLgR26p-opTfxhb3LVZu_ru> z$-PU=V`nIsE+5;Dr2;)Zp;cmO^5Nk=fO7NmunnRyi)~Ov^V3ueG7O{qU)_b)m9vgv@28A`Ao?@YNJp)xm)(gqp?Tu+VN93Lj9fXF7 zz(o&X_J|);(Rqu^I(kzJHveW7=ugmxP~{m-)T8;BXmb|Ca+nh5FqVBa&cUqazqr*Eg2DW%M|KAJv6f+W$kKf z?O7c6+;9JKAF+IJ^Q}Eb^$dSb&1v4oir4#bXqlzr;c=KMbcy45=|PSP z2Gkn+OKOfa%ju%O=r7(CW|1kZ^>ukpS2iVHb4Ol4>dA@*bn^ku1L90$qa|hd(f0zH zJJy!A_C?cm6u9HL2DP27?@~+HwL--rd13k`%)1BOQzMePx9M}-WSfJ}tthh01T%v@ zw;3s~5AGnBk~ipOfHc+Lb8qID?@s+f56RjD{iGKth{h^AJBhJJXlM&S!yzhZo@ClQ z?xB3kSHTD3jL8)aqOKl3pu*YQws0pTMp^U>v@g3*IZGw%*p5|aAr6!iFc6r}PM>(b zGgE9U7+vU0zMO79Xrms(Bz?_{iFOusTrv2{zlllpLBq_A82>Mz@(fGi)@qM2A$aZg zr#8Tt7|dr=@iFT)ri!qwD~U?T{*bt=IBxSiX8c9#%D4K888^|&akuTxvbmFG=ZkNI zj_45f3Fzh8E_?u36@anFgRUygKS~izExSm;4q{}xT8_i_W_ibjwefZYmGEb=q8Mh! z-f2Ht1>&1yW-K!y=uKnOFK)FS`YdXB)L1%sc2G2%*|T|TDk6}gKx+eM%ra@!YbU;neyI=f#QrDogkFHtedtB2+RT(_W7-{dgH- z6y$3gcnrq>EzVfR49c?s>b_~?9SG;blr>r;D^$f%6&L4^O7He?0LJ6O4|x5t4{3N& zh2=VuW~~DtC#Q1U9)MZD2$XKK&jw9#_G>yO<1t*CjZa#_lJBgGc?D5v;bSB}I{kiG z?27$WmW)T37+^4UwPamC^c~EUsHGYVw}U23lp*4)SzcNiU8$H{pjUHcW#w2;k^T1~ zFnOpI*z6#gq^D=so`uMu%Sf~dyE0K};>f^X)r!ga#-Z5dJ-6{Qw;DC`br8QEJgAsa z0vUlla%^AVF8zPtP;Z9-BHv^>&g})zTUNZGF}NqJ>?n9ci5J!Jb0(5JiE(nW+^AWCkJ9oN8eITi}1VO*0dPZ|5h2lUEXH~<7+K(SdO}S)7 zz%(sDp(q_>3@G`l(qB1C%({}e*C%Sb+@#$!Ux*|*0R(2c+?O>Sn!sy6A@p~DgkgX- z?m@a@{QM9jdwQlLE%0&gBvmV+qkJsSP#$G)} z2Fu^p&*g;$fJ{f9S2TdAyZA*vAjySysoz08AuqwV+w?Nt#rQap1@`L)hMy^T`TO`| z)N<5gB=Zs2rFZH9fhjrX+BlY)zt6l$yZDg=8WbrC^>q12$$g?ARqt?n~lQDXwk|$ z_Zy8h^7Og8lEwIsV%c^A@(b|}8vT{VaEjKxfhn2X`wxOaC7vI&2jFvLzm6-v8eEjV zvh5J;rI@c>)61$;S^U8@+w*9o#42{rNx;gO^-s62uJIO#xQ$-xyq?Qjvz*K!GNF}j zipl9e%A$Z8t8h{y|6lcTEsWPVcXlZ6qfV~SWjc;(mpLl;IW5m-I0G@(uR(V=A~ABz z7r|^i7=p^_c+aE~?9rP;y;4vN`nb6OgU%(f)tjTa3|lk@lQ0UcgW;RzYD9-%Vrv9c z7u$BU?9~Rg(3Lbn;;%&2?s`~h12pVGIx9Wt5e)Ld%a=;P2n?u53iW*27=Vq=53G)+ z3fKSOXuycw3;9$lqJ~rG;SBEq zl2~m+VIfmC{n?RHjs7z9A-;<1(a_?N`2@3MZnpdhx~`+C`ty$8=h;wauC28#O`AoI ztJ>UP5*7g_m)-LmZ%Go#pd|$I&QSS8fr|fu-prOv$%EC198=!O((-#@0Q4)IKaWv# zri+00LvSHSoP$l4=w}ORY~}bT*8)$yJqp{*Y;2bBcj35Hii?oo+ z)M71UTS3+^$xF1`{2E5P_%6*#QkO5wDBQx%iXUbJV}Ezo?UkFcNOoge7C@$I8&W_2+$89 zA2_FPU|@!QAyD`Fl`EgSc84o))OD^Ol2KQzWJ%WXLyw#ovm;z5M@B5K5>yH&i}{qk z7L6U$v&%kOo2v){@bcBy^$9q5i8kagS{kR0>rqmmrtybpc0*sKeRSr`Yp2>+oPnr6NnE zC8TQVIo9?`&6ss=j@D5B(W*Rc#e1zaa zlO&^C3BnTnu8>^LU(E%?e{T8tdt~w<-4u{BDSyjrsZN#e4Bl!G0F{6xt{>`2Y7RsA zTACvS>CYt+85H{hO={7S@qh;n06gdqed_T0WLMBU|4UF$)A$c;+#G?kU|<&L+iwsKLY+_fSP#oL;wH>b5M=+le!Z@|nm9;_$Z<5%R!Z(CN*;kC)s%B ziLN#kOU(Z3U1#HQITVqO!Bj`mJrq%3+Vdn)3T?~=%$=rQn~|^*Z2`rIsS(AIBj)8{ zn%uqBXWE<`LzR)+JNz+Ea-ySJqVT-j8;x&c5{jS0_`@IBx-{fd_}JHacgZC85u$7m z6NVJ~n>D${P`zYmj@T#;muhOFKXJ~yfwf$X40H`w&;gEDw$dy@$74h9PAELf( zZEo#={SlH}*-QH$7VRs}g~7Z*AMq5bkI93b_QFCe85T-qb(8 zwwohm{nPVX$d&=CC+x^z=-$Q?6Sy%HHk2{C`_-vtRB_V}&x`5V(91t>Gx#V`zqt7* zav7;x20V)I>fE?XtdQb?@ z3oAh@^J1t@sqllhV*b3Lgbx|SvEasBxm^#%jaVv+_O^$YhYHlC2TDf5hAjPSgb5bn z3!}snvU`85FzdOw*nm{tXR|;@eSV?W>YZ`}mh>XydC;yyR2vh!+83^gmwM8! zO+fS5Pw~W@=s&DYoF?%c*+DOEfk-~&+KZlhCCPF*Mp)bC1>Wp*qeNb0N5Uu91D%<7 zu{bpCUXo*A9$`JMHNO^vcv-PGJ^-&(_#`5v{pQ51D1Y+I18J4`vHz==1rtADq*TMoF6u9sF(I^)Y(nP!0q zJokFO?|2^WUOriM8C~&UbN+)d_2M={ysqg6jid|Vj}qM`!FWTkG-od60}K6#wN^}B zK>s8&ESTI6g0twEC1E92r2fMH8q@3DHx}p%X>DgW=x6btj`f_M61bB7g`c?$(C4}t zzUvHquig?mr|67{zLhZS#f0gVt7r$1;gGB!hizJ-7*gj;0ldJ?V(N*23yan!qNp%# z`Vy!?Vz8IXU4zL>6uEuTx%p(rW9l4iO(;1mQOOVB!H7Sv8t}(I4)`@VVB7!ufOSwk zqo+^aQFT+_eSP->HeMqBttXjXugLuxz!qeuSxrvz@$d->DfuZT{zrq31qL17_F0q; z;|*-Fv+bx-R5r&bkfJ)6>qF=)ZnXg8=8of4zFjP&I=KGNWFLD>w1^w9EFETKcEB2v z)O!)Zo+GY0P-YLUk**J)AO_@`E5ZN4u|`;>Ga?5=~1p(8hg{fEQEclx9yLd1zMcTW0LnvQ@Ez5E}2 zC?i;h(|v12Cc+yAxcRR$4m+%M&ah?=Ut>-jSMLzs&J=f9&sXo08yVRzYd#GirtHUl zT4JYh7b!7v`Z2dk4`rLPpI@tNAr=B+q1KZE7KkLdxwSRd7wy2%GZR4X<#9ig_2*wv2Z7#iGt8WxP_ z^^`eRBE<>vMfx?*_ZInQEUV5yVKixt9Wgp;b#!zj>-sd|>Tj-Y9T_O@@q&Mw4o~gj z;p1x_7!`}qDs(E)sxmF9qNe`WdNQT_8u7fA*0`LL?ne-xs<-s@nv7(iBh(HuKN@zj z2)m($L5A8%2M#O6Kz!1`2Y3uP4cMc)MNT77Bm16!A3mjTCM}d&v*j+Vi~Fxb`1|+> znQ5NF)9-cIzO`!#{#1HxGPoP6_3GDM6z9cJ^2@)LWO#M_MYHBkcyV%vSc zUMn$YIV|{B_Xb^yT|96Au{Nc#Yad;4*VWb?=R5zk{eQ*wlq0M$!sHYDQOEgev&zZ? zxw!tbz6yzdzVgWwu9BbKl*o2rrO})EMadt)Os_i_TA};-3{oNu>YMJ*dW9bqfD;w`58yL}9naf;*uo&rZh-*m1BIR>GzK zJrr@8WJpO#iRt2Jb+cB1qRCHq2BP*?@qhlq6jsd4It}u$R1fz1j)or6BVC{R3mUeQ zDqdf|-m_;T$)3>=mBf?$1sMZeX*b8)BP;}-M;y)|ytW_4ySH0{q3Ql+b+L1lEx!mp zAfpY-j4pn&kqa;g#v2L3*0g^NJQE%*trBqmf2~HAEk*4B5J;AQNK#(@HhuiBot#wz zZaJBOdWUDEE4|;yg6Os*#)&r4#8S-1#_Qv?c*5{0#h4uRh&pH1Edv3>y8-i#O{hgt$ z)wo{Wb7sFoGq;1pksCyNcII|`b~RvHvDr-NpW6k#RhAxvwa0Cj-);xA=oCW$mRxGs zHg*?HJE4BAZO`HmfArj$1z<=enqgEnX{87{6*x(hK*{K!PA%uEjbZS?N|Dt3XyQ}K zP}|)S)v0a!?t3YV;JeO<77{QIf)%=O|F!VH0lnXIyt^2po&jYOUa*vfr_cWNLBVX` zekF^ErB=LJ88MtBTachpgd83mS*N&V(MBPgv>kv4VimuoShRXeFHPc}kqtU; z;1yrEIKQ;Om8<{c;0MmaP64@z2Xf@HT?tn*Lubi)sdj4DrG-aYFsM+1`mEfbWs_)G ziIK9OV)A9QdC=5pTyyRG4eTP-_C05i>VK8`r^TeGLY7!IK2;TNjJ=$v=dwa1zF5V1 zpXKX)vb$BBT+1gKPI8B96F#sZ_Y1ukt}~Jy1dDet5k9;r?#qF7DgJ*v>p4F>a_|-P zm&4?we;VaOCUD&Eg{|AwXug$eNp14fq-**KioD3{2isZ~f4`Sj2@?aVxT}gz>6t)E zk4B#Z%M-k%;`8&xkvqi>N$MkrAAv@hC<4zbSSm!^0uyH=vN^HnUpMZbl-nQu1?Eqi ze|^C1Nbw^e^DXSpKv!rb=j@t5;m3-#gUk!G5c9~9woDXW9ewidL>eMpNx!Y0AIjvZ z_WTEuMrEb_h%BPJAJArxc_90}Q|mW|bsrztK=GaLbpLz;&U;xvXnYD^s1EgQe)66U zq+`++&MOTXD@A6(4u0Chasb6yg@NQ}jN%c~ zgqNUQfYqeUDsWGT1%M#`A6C7T$Lj1&TO_Vh>G+w-kBbZ)F_J*U0RJ^|QuU(M?OpkirpVi|}@f z*Yg+A@l#}38=fwHuK&4T)}vA%K-cIfS|BHfPMH4x?mi6)&udyBxG%D1XYDb_D*$Ws zRYtsa%|jkQbn?Q68yFH$1&{7h;mI$r*N*xy`8GB&c9t-t@7J|+Zms`+R+ zA=4X*DDem$^7g>~kuj<-ItCP(b$d5XdjVKS`~%j}?1p?IJKAv#{RfN=4*7ggU$L^b zcF4=GsYzr64~fwef^CO5Df|n#{o_VR?}6J)^i}}tAGhKwE`wQ^Ul+Z`rLw@p!!&K@ z{77EkBAMI|j|6?(rQoAl!(sRb2eLNoCIeLGc_x>|EM|z8r)iJoon>9?oWi19Y>ps@b3x^$nQ zJ0PHl@8o{ABaPM>h8!g=>w&Nfs2`{~(d{?qFyOuAj_SYJfo|{#cx>$lzd*+);th={ z#H?~wUcmMxH;gy+w_ol#S~%xU4GIl(nHUQ_=MY~2?%cW%e_;1-L?ns$>ZScc5oL?a z={93IJUlwdFGFLYGUDX%yicdsD6{HXG)Vm(onMf#E~E<`@PZJ8rJ7y=wEj}o|TXS@TJd=bj<-@`tZcif?k9TngR96(b?8`%Ax05 zQt%37UWyUUIHYpme=qnbaQT0JFO8Be2E?mrci#Hf7d4Tzf}lOmv~#T_Sw5!)M3H&O zQOUr!M+1Yq!(|>X$>9ie*iIE?2BZQF;c3!izkHmX1c)CgILXITpK*V#;iu(fJ^{al z?0BQx>8Akzo~;1SOS|%sj>s*LCIX)!BmSM!LvVE=zyIBqJ2urfxcIe91mb~($QR`T zMNV@fLJVjs0DRLh^?Ahi;&nUcoD9Qcsyr!!1s+(zC?z=J48@n^evi?1>o2(Q8@3OR z1Dxwda{|WCF9iN?SYt}gH8C!}`=t2qgj7VS2HY~Cr|5MU@~G8SaO1ba{9#S z=XOFqEi6Bn&)cnMsV zzkq3-1-FV&AkPyYy0@nq$S|&Mmap>Sdc4iEMj-{DEM{?y=k`*;1VOz~&FE}Vf|(}r znb}A)5Igrg(=+|v{3acWkV?+E5#3R-d&R+(L|v zgZ`<*tLw$+sB8mk(552ZB;hiAvYSAUx%NhqbmBb*P26EM~tft${{p9n@a{@42{%bHzJ)UeGP_h}0_Zigi`17Yl4LYDkYG z$mt@3C+j<{AYo?R=pq1drpiO~%}iO(N|HrimqoKEfNjvb>_wdM;V@ zA{e@~qO+-#%qH@_vkqkpx{XqQ?8`A;6FKT~5{GpD3qy)4qc*edJIhJ2fpg^nUIJaw z!b&rFg2_cpQx{D{BJ}I?eqJ>)wEv#Dah2ki1Am(;o(nMu5L&P*dx8b;;QLsX1x~ zjhlLYdHzscv0%Dp3M#0wV5?~-0VOcqn5u_+Mg+esnuLyCO{@6S^m^DZ!A=;LlaG(D z66s;xU!PRR(`aRb1urdiUK2e$APh@0Ar*_b8lJc=ldYbgLqoQgz_O8W@4S5$`)!w- zZ5(6V33hIJXzrX0aOW6+JGZ2-`AD|6f=}*4WtA}Lm>BHoQf>^pkunOh9uEt_&#TD3 zB|w~B2NuHucCCCOf#9cq`su%KM}hclDC2nJm-{xvpVjx{5SC6oeAUedILh=48y$+v z0W#*cV+U*<-A}*hUS1ci$MYh76yY1kPW%--uvLAPi^uzTMiRdxVArNHH}(r59T zY}R9b*G_98h5V{8OdbY>1Ve4>D+&~`3a)Dj`^E8v9Sn68)q$$#L%tp0l8o!!I^f?w z8J4>5S{XDQMZ$>6gSO51n?iNQ#P=gh!8@GRH62c_{Xp2cU5XOhcoWTR0fdZBN8pMm zB9@gyV&6UdM|DcnWNZ*D!tQ;wz|dU~Ic@;DR0{Y(i!lL~-?#~Lj1$Kibb{NRVd(X9 z6EHA?nF(|1G9q7um$<_}KEV>TyQ`=;r`lSCSXtgFB^Hi27st8;@hS{cm5bvu^2~^Y zV`9z;S3Zj0yy-DPyVsWLB`Wu%2&SwPbtZ@}x#s4`2MbNl(6)wfmnqOG^OLLncMMGwSgSXvIBZFY=p)6y@8s$#K(=M9V~PR4MmdFgOQ6%5(p+3-#|1>D97Xxd zF7g4tVK4fP!)hRxk0pxD8C8FIcrCxhjAZItF(i2`ls{%@xaaA7m#2YZZ1*K<(T3vC zD@(c2%g-$d$2d9bq_N;B%J0D|9lM&V(&#K7uFxaxAk{6N>gc!k?bC^FKz}?zbysB^ zxt}FP3dEp9?CDzm7#7HVQ6w`*ze&H%L7ezdVNd$gHpCC{0Zb=56y(mTV~oCaQw$f? zR%rhnyU4u$Lg&K3z_jVg0dA++AwBCcd4g%F&A7IXpIw1td(gYI_87M2$`+1NM3e19 zPQBch=Q8Z7603Yr>2FNyFKmx{7hWF5JTS)7UFWHr;6!<#tn--F6Z2CG>a9zhy|PE0 ztp;PjG>V&R*p2{aokk3RO<2orvlzpMM;&sdW%P%CA7KphiV2NJFqb9oj0bG7s zLr3O++5JE1OAy$W;GmAIUpp4e{MHjo)F>iJ0rgSGiphuJ#y2DjYeQ)>?UZddwR2Hc>LX&vG%jHtrlkV~`$w&Z3rcH^D+|zaF09qX#P4_ zGa1jz>mK247&`qpa&-C43Y5SK@aVsl{}cDlK|YZOsZAkzP1;6;4NN{mCV}cx$I-4$ zr`9cB#+xOe%0Hcl;T!Pb&~gm{7B zz$_O*16cO0!JC5-woDIv?OMB^nl?m{jH_@I*Ehf2s#!*|Zj zCyC(t?ixgdengkmI?Vhj_G*=-noDfKN1Q8M|f3r5oA6ivL^86=ApiI zG@T(HB5n^1nQSn==r^IU2}Df|R*TLTKd-Zrwci+;u`=}WZfKLo1V2*VPlrb`J5?H! zOzBhr`J5WdPdAo}(^hvXi1QF8YYD^YRaJ6TsjJ0TsU293oB{YbblleQ%TKHMqV5?Y zA3<5|Tk4D)WA^OmU^DG~pS8x$62-x5rQX6!QprN+_3+|`vL6S;sNv>K10UCU`Ht@< zgXsQ&p^Pt57Q1=7QpF&Cog+(uOrC>ojJXV>@qD~=z5mbf{_CjRfpd!1P{5Y>6{+a_ zG_gc$QfRTBJtsTZ*{Lth&+lp_EkKSA9P)wFN~GdDW{B)u>E+2Ben@{y>&U~iV`YEh zm9uc|r82~V?bD2&ev_qeNj{oIu|V61($dm_hrWu@@|65B{`fOwCr;4M9qEus&vm#B z-zZAH?4f@HETiL@t5p%790i91N?Gg{_Cc@;sM#5MjE{7g0{CHzur! zzJ&B0?*F=kZ0Jkap|}`nB_>IkTQ>-RI-j*>K3xp^=%l%XgP=)XRqC0EUy`-TbGnryF~5U*qDMCJ0fo$c*%9zU9?6MN)@~cAL&#O8-FRy*QMV$_u8bNI1vf}+0 z^^(jJHYK}GDk?1e)H)N%CwWUtOPuoHrIxKeH^Pkj<#R44d zI1ftFp_q4uiJ(x=^y`89YAXo*49RnT-hO=?nx=s8;)U6Jhu)3c zUs>#2zwF`$Yh19QycVCZtpb<^+MkrQb}WS3)Y=M+LR*2F3-dO1x#j<9KYkeW;=Xp` zBDS_a8%C}uK`KB>-16xVcf4!w1=+#aIRjSCPoG+5U^hl5)A2Ui*o{iBSV_IUK6j(U zqhGej0X#*;LH)cRwELHByf{n;IZIWts&bt97Y71@H*12p#;h@7gG+K`!dU?s-gbPSa<$D4qh!Mz@)d zOfIt1_ttDXMUktbH{}d{!|=RrJ`%{sbEl$JUq%c{NRL^!6kw!1d?jAP1_@xk7b4CM z7}IZ(VMau)dQWJu4lJ##I&PsRv$;zXpO#K|SY^=eqGzvHfQk~h&GAAEbgHmAa1Yw4 z&kh*5ofefAJRK2l_(x7{)I4kFo*7l=&ux&FWB+^qGMxae5qXMP;r;V({fyDHMy1+$ zrx6Y%omMP$^z=OSSoO)cKyf&U4Yd4ChYL;S*L_g&?kfe-FREtyY7fHY z+C@<-$k3Z&MSBxgie+7a$GD_OsL1SFiH@v{#Ch+swTgusj)xrV-zMMOA^r)-KtP*S zdvdTb4cnpYq!0wGCy_ypo5iM{ZzMhr=k)*6Vxvao-r$f8w*`qa0L zQiR%6#8as^H@+X|NR+~KtfJUA&!$Zh6K}X~z0ZQ+2h^2uZa)+rveFziv9kV%fs z^D5Ml9v|Udp9z#godQ4Rd9O;*+(@N1&-Lo1(Oc8PS)Vghc8>V41;_U;KNCB6lEmS5 zWvB^62vD5m3HN@PUo{Wqvi@!sH0SrD+v>{R6|F$v$_&@Du)pALkOjp)C3;Aw)PW(I zHMNVh%I6kZuXeoVe_(nTLgPB_oKbO2_!J6NLfKx9FBLV)-n) z6OCHR59A zAZ%zIN##0W!s4Ldz;Q2Kaspa5J|_C_RtxbIVa!|QWeDl-XPzsOXU9U1&)H>!dADB# zD7+%;aC<(^eQ(n5GvO2^j$*9mPZ|z89qowKFUbyMzp)+kZv6i^`|@z8*YIydl0-_% zUXr3xgzTy#MW~3ZlWfTvG4`QCAAbpV2Fisi!jt*k-UE?ioM+zG2nf$TaT5puz0f zijO!^#!9oBI8?uS#5tEMG1@L?dV+V$vA_$hW&^?e2_vlZ}I zIHpuRV&+lD-Nt|`Jnkx(^YO&}Ng3N-H zkO28~6vS4$$&VbI^Bd%3j*PM@$*_wv52^Gzxa3u%ua^cAwGtwC?_YM74{E*z;9YP8 zsNOZIyQDL^*)cW_G;ONeM=JlS_DpJlYLDkfOCiSNd-Rkj_Za} z3F|MTPR5_bLL?)F-a+4NIUKv(ZeZs56(Qd}v-qPap@Ds?$aA&SphHSWh2J*pfuJ59 zWuO#7MJD@p%5@g^F56LvBTflF!j-NeK=hA5p|Mfccm5Dhj`Ku=tyO1e{Ync}u`G(QpFgYx?Ah&Phsp=c1EU8*(?``!s zLXuZJ3hZl=o1To)F5!xjUGKNEq2QqB2TWnrwzjt4?rKw#oM0mxm@Vo^d0xEyl)%E? z-D~@mRyd07XS+W|j3;0ehZCPHwWNdc?U>C}Ys@q&v*09=xjWbehFm(Mv4~XOX#QwD zSYXZqVPf&YR}UnogE=;HUh$m}ltUE&zRZs)R>nU$hWy+VgV$b$Su^;MWv%}DEsOz6 z9L+E$WwwhysoRi0&TY{2fv)^gv%GDYXtfKh_Ax66R|C+XZ~#YJJ1%rfBVdkofsJ3j zSMi}Z)^nE$0Z9qZ&2qCJ7W?*WH=87M)H4=PN`_Hxfn5OB`;{g`9czY_qrGdzN9a-% zQ<9+Qp`Z(}AKrTEf>f<#G=i|+&-PrqQU!CTDxb4I$+PV&{zoiE(7JuF9|t&WYoyBC z6K9F!oofc4rjEUKI3h7ZZToR<8OFu9w&c|MVn-6Dj&Ya;=sbJUVpQ!8fY!hUoZ*Nl z4?JAo>VCx#Qr9v#V2nzYO$S)?V`9YFv_<7C#BxQM^Ts~Tvw}j)jC0~! zWs`Et&c&AG8y~4`Ow)Y(P8RLauraFxE28E-w}{MrU8qcM(TPuTAEvG57`uMAhlKV< zZBV9QaWg3}bk4oP;}f@7w0v>%5NN+s`I!53Ps(N(BI5aIviGK3`Bwc_)qOKxY4S=j zGi-u&T8aoN+}anPF|*46Dm_V7?lTu*H8X_i)d4ftrkCr-H2ifs-EeLLaa-&8I`E7n zX}h=NK4}94)js7tF>l+K|$`8tlFtK@g+RM|tPVup3Uf(t;cOI&>_$Xljwcc{a z#|W7b--imqJ&z zo)_rKuQWq~wsHb)U$S&^>I0uoRr=Ua_5|NMcbwjm3`8Dgn*fV=chkSJT9W%Sk`9vu z9dkH2d_L}+loN7j)MuGcnsA#kFk%z;_liAS>9holTs#8X+@eNg=DuReNBbBdS#x&n>oefZqWTUuAcEa*{d;x#MM;{Lc_bMR+T z+c_x&7H-!{eLFmBT|<8Lu^p_P7^S+8xyibIjWK{z^#qfBiH5FtIU7;zQeVD+xprX> ztE{Z7sC^F?=kxUm_D*R|?NIn%YzzF4zZ{rek?MS+L)mae#TBEJ#nGsxqZ z4PI=WkJ#o-eLJM5rBcW_i1~?N-3@BQ8}&eK%nN>G&nr z!#lR@JL_|Uaq&$z=SF(5)XMYKzP}(Eto)Eb>RU9+_i933D_SR_;}hm-qRnu5&`dRBblA8y3ahjBl zSvE<|*Be8umZ`)8;XSF4*nZ;vdxLa&utFnXb=G{?w&F9 z5O>meLHrQvmxuWFCuB)Aj^zaFY_2JyadWEj0E+>o6}IUB)}<#D_zC3*)yi@tOOk%K zLigPa*f0P)68T0|ufoQU*+Ot`Dxma0YkRv5wDtO}$atzL$;w5qsC9EU_sF*hSIZ;J zDBmP*F^595eb`bsj*K%Da)*Kz@P=J2F7{q3oWZAVy!(S%XnQQX${9i+(o72Sqt0dltvJQE;8TiR>y%*ROc!5KSwb1CqSlUmTTw6wRyHd%-Hcf7yQRYz3n@ zV=ED?s#b8rG4xpPy88oH0+%e!gAP?Z{x}3psZP4fd9rG#2AM&BLXd~^VW zTQe2lUW_2M-jdHqZzbl#!7lG02l z#ZWt;?ORk#4fy#)gCO}uOwHmwbidK)5I$4ew^eb`=d%;C6y#3#W!Z+ zQ_+~AP4aBEr4W54pzV?;efn`d?Mf!YI~=EUEwn`>HolrP)TA_K3cOYxTuj-)`PbcQ zyHK4R&!?K0;entP2FHp$mjjaPo+8PnBK`4JRkNzw6JvRH0zU}uK9t=CY;2<_nt_({iQef_8y z3>gpYc%v>b>sT|_n%!PaLjNFE3qC!T5B%+bNk7C>htzg*+-*@L_MIU^M8mNJ7q&b46O{toYh$Kx+F z2|^PQ9ST7{Nc=kH9W5?41<>0`%6HQuPb6vU2fgqyEz?N_F-%{<)SyL#lxT`e2%^P! z;+tvQ^wmPNL3LP^w(<}kbaZjp?P(V0!(OX-hq4Q>&1Fc*{JlqauR=xsT{OTl5(lL= zxu>hRWnpL&;})MhXrKSaO;CMQc6a3YN0pCoFvQ&*=jAvwYALtp;pokLwe7i+kn93= z|GR?x+kvveGului7@_FlK5h0GoMK6Ra+GUn!}V+_BZV09I^`AUgD_tS1u&K@@mlU2 z_{l!fr@atl?ESU*R1~Z;$E;d@<)Zpv!Psm@%7mjPS4d=%rF_3=iq~*bP}zvKF`VLv zfH&DJoB!;3KmA5s(3RbD7Sy#!ItqQbwqSb(vk0Zl=Sg^IfoqlC0mTJ>>e#Hh?=vFw zY2W1LMutk5-NCOR+&PB+NK1WuQNU0yq=6aV(@ zVe-Q}T6J?t$_DBDZ|_?~tJP<5KJA$bfoyhf;GCd#1GZAWNX}7!t2oz&jjoi$Jy9Bq7K|^-*4EIC`n_ZVhYhV{bHpK=1oCE4e(So+D46mjae1|lcT>Z_ z^QKtV4QY8(P{F;qys?b3lP#gne{QO4ny6dZJ#`&N2+Wt$`n896NBC)pSNu0 zkn$aVQry>XoX`>_N-4XcE;eyPO_2}@)a1ug5)6geay(bF!HquF!NhI$aKHS|`_Qq) zCVo4#*Zf&f$hI_su;k4yVYYlj$zx8i?6I6-Q|MTS$zv-YqjAXAy1_KDX0uQBS~`lf zc2N7gXtGD7cTSb;(&i_lPR02%%Q5*rePbdcwogJ=k*!RvqzC={Q22n@U8xAU^@rv8 zf}Khv=4s7f{&Z8DVXHX5xPN)ER$$#cbn-n?bv|nP>(sFPQDEph`PvZV%F`$8vb6#! znMdef70xo*ZO=AS*5{ky`e2}&trygGn;*k}QsQ#*=YMtiKWumT%Oz8MzkyCKi!Tl8 zujDkM%B0Mc-tkN|m+DeFxYzv7g-l;v#In*&=^Q0`Yg~bn=-NIJ3>)&Dq?M)K+`5hAc3PVU7UV*cK-3Y&ZdbG`!Pgovtqe=+ zC@wyqExfyW=PU(_$j>assF>2?^J!2x{^oc^{O$}$*u14&Ca+6@I6*4M?cGuNC+~Cv z9fwP7@tc*5YfsHDctQkxCl5fe1?M+el|w6ScDD^^C40%qBj0ez8eViaQa89EoL@9rgG~9&A#^=NxRH633dZ@448w z^q$?f*=MdNMdstRSCY96MoBXYmd&?{UnMQw^~>)TiKWBnz=%?=we-w$x2!YS9wO)B zTn5L+$wC9to~?(VTJX6@d^lAw1l;wkAF((kfy#cVw)%Of1iV>sp;l!S>32lIF|l$c z*}K$E`JD=e@9|%XpME-y@A|WD9jzy1=-~v`_FAtk9AFucd41J~ag7tXKW7IT{+TnN z9=JAUuH=LQ*Mq~mq+cJhce`nt56TN-H)%7HLjZvNsOvf;<)^Tm@b$H;nBvd5=tO~( zZ8`YtOq-7&(#u@zO$Z9QrVD`(ZjPPS-A!Csc^4kOACj6|Vh~3jY8pz7_RBbN=%7rl zZ4w*TD?Yi_i_+3OEJs?7UycW>zU5PbM`jNO4|7DHsqTNU7%9>@Gq;fje5ShZ58i2S zOsLKQZ_*evPCUQjI3c2wchhURL$)2HZ7C~!Xj_{oe6;n|d*|(Hs3cj@q$fphy52F~ zmNIle}j*ypvD zEC>i;r7}~Dvvs9`^E0oM_02|^HmI*lzbA3ksBC0%L0_}y=BO#fMV*M1cfrT$o zI^_CrutQO@x?1UdENL}gaLRbAau@q~yMesb+>bl`aFC^^9lU-R-SgTEj!Q!&k)d?oa>{^4h`SE>wE-~=P>h8zQbkE(Jprv}-EtXwQozBFt;fPC#2QB+FKZ3rU zzv>*fruek&aTCg>e);fTZyNSucBuGL4PTZq-1Ank zZRuV3MeJK=eF~ij9Y`LAOYUMh!_R)(n~5x+`tlM#M6thHtrmJ1;Y${psD3PCqC21I zcyhj)9?1ggnDV^9B?B_x^rqds*{+#+bP#8+Zaw-;lVls2iTsQd&wen_H|-*C6LL51 z(cM^9iH$HFGq16dS@)qvH6`2AFpicCUv;$+1fIIC=sab5~oi-M=+~hyqPgx&A z`SqK)tx6;9I?`R6_>0@64IoJ!$FTpJuV>&FCdFXDMi2QgIIe{T0bL4~SN z1VbRGx5z`@x3Itxns@kZG#TXy4&#KwE=S6$$t&0G5DUPenVDPjxMRKV6KBc*&-B^3Hn;-TygzH+peBD=r z08|iEKi}}jh*d$7nL+x|zBJVC~D(CQNbM<+@snDU_Tuf*J_6uZKh^uD?s_bpPx<2OEXePynVR-bjJ#N!$J6 z!Yu_kyMCNC5j)h0kA-Y%7E=Vg*Y?K{2w5@W9h?d{+Yz{%brKc&ii*!SD;`etTR)0N z0=v3j0qgAASvdo@0E3CZ82b(5L@7cw1I@^yGiB!YoH#BFT|lqa(P7>P3p{u`L}_WR0O9;RbZ(p0%edDsy+57Yse726Zv(>;P7V0HrD zr(1|hZZyu!2OJ=3)M?L*;J$;JY4FZ)?Vf@1p^GxomvramWNc+e7SKgjZ8yu=SYjS! z7DD1*CeL|^JG@I9(_h|ut_Y&(8k+lgz(ywU`4y2W(PPSn^mR zK7zoVE*Mwl-TtUvnPF1me1KlrK$tiYz$~~FcoDV~C77Tt;CHFOU@lKjLt�@)!zV zWrv;LqSQ!KQh{thw{V2ci{)MmpaM)_!~zJr_{90Ry?V$Q_{Nk3Os1xC(~IJ(y>F05MK|=d>Wj@p44U3LrNNJXBYxcpT@;5+^lhCn5S8k}~OJwX<_oT4u1 zJ*r=8_n7p0?;~{U0|45~+v;GOKA5uhT%li$n>wnvrdp+uia7R+T{1i@qb)lh`9NEF z_5|)^2?bYELnfmnTn2&z@sdebpuq7@zlUx1@N0@~_-?u~!>L!mLN{QuvrJfETA(_@ z-KnryVbNjiR6S+E>IZdN>u>@{1&;(LL8lq+nu<|u;Y>0<%LMphzQ@nys9{oLg~{G{ zL)XqB8wB`Ud(f^(%z$tWQF@t5NWq)=rIXzLX%=~pg6gYXr&7j(0G{RFosPWP-b~}T z(?rbp60L$JNoJKdKZg9j^?0qh){YN13u+Gxs$6_x#48!OW$|l*NQl57V=2bfDl^iR zspk->Z#QKNa8FMG4^Y?eg-@rVqb#(#_{F60qpCluT2PIzV zld`jOr2s-(t}k+UL?Kbk)6HFF2nIsaLMkpFc>W9gWsg$N+)2|w=^7Z!=o@vfa(3l8 zy-2cK`Fxw``pk9oB=5N0JiCNrSs$~vmj%~uky?=-&BwuiVAom>S2D9)YXuY7#JF?b zC@+bY@NcUwI&8#y!r7?$vVA?Rg3Tfua@OhqZuOj$kf;92E3Ze9GNN+_*^! zCwYrN%(Tm8c?Kn=K3t%eWi^uol@TPcQ(IOlX#FbeW}t-Mw?rtKjDHWs_{LT)g@}VG zjfQ-`RlDU(9oVpG5{Rbi134x48E-DuKC_PY4Spi`W2L8qRpN{I#;ljal&L(i;>ReI zIt5BFRU1ofaJi3VoV$EnEbgr478ZW1RA+&OAGy%Y=F)no>CVdw6(+yR=Pz~0KHpzr zB=c*CM$WS3TMNPw>*-ffCu(D{Yxsz(X4nQDfn{_SK{#EchF*Z-j9k=Di+mD>aZ~$U7%)Uaha7^ig|?SJ5ob>T7F^ z_W9f8uZnheB!@V|(Ia^U=16T`_&2rWju!_Sw2G7N4A$JcOM%@9aK^z)tr0lr6PbL? z1HFrakj?6Uf;#fK6<`c5#BP0;#K7;*gh`<;LddNKV_o6)u=UK0c6Qj>E=(RUV3T7} z=VN*Al?vbZsa5Y}9?BT+nBo@9dprh{LK?MT7pDIJ;B$KBwI7j-Y|GVzq&Wq(d!PV1 zO>v!m_c44OPPl|i^z1hbk06Si@Wx(HPXO!7=fxo2WQqLq2m%s;zzdQvPUk8oAC#xG z1Z%J@n0gIKgz0^cQbS9VeQ&^ODwaDH0D#Ce#+g$0=m~VpGox}YOZ*@)imT2!J%^Qb z!D`uO%ZqYG%56^XXsh9;*6;6weZK9E`caerQ-*AYfo`ez1a$V)z~VhY5aAXZHgcsp z|D$?@3~5W)4A-rY^!Owr_#vxYG3u?|RhY*{76^$&B`vjKl|%#n3l46&NJt1mink zds;l2Qk$mwb8Wss|RLZ!;LR`aL( zjh#yC2Hof@Sn4<*sqF99F)6^$xqz%Ii0$eMLT>dSB=YTexa7d~ZyL;X5<7 z22vkA23ImP&ZI}?mJc;Rc4R$Nh&^2qn^Jn`}oO-;80wB$?SiWzgKY+C4<`5tD(D)o_+UQ?0I1u7S_ zEk4LG}x`38GsC?-l$Cjc%P|xbspcON`6z zJ(zC$q&^tpbTw$dn@*W!3#YKI>vR!gQ}irEnI-SrVv~TEkQIr2ROK`ejfP~?gX%H=drke z=E7%R-C(Jpd-kIx-^hts3@LgjUb}40xkCsSe@4g%&bJNH{F<_)ulIK0gI-~`m4{t6 zLGHS9A&A?V?3-dzU+Mphq$*(Fi93wnJbcukUV-fu8?q}**Yj4Shx;4Xm$7GDlIvuA zGDG!Ndu*gWSGHX2mAwQb{Z&@JKSJxJkrusjr3A~ZjzrJUq)0i%`(h}_rtv7{%+w`N zpQhk+wPjpqI{WTACOG)(>`!!SN}?@+!5=}hb1vKKt*j2Ea*3XjgMzP{~Ro$S0 z{ar7a=MVspVeFiyYCu98Mgg_hVX^o+jaP+I%A0Ez(@&Rw^bj@tv8~y8{cVe-E%>YM z@Y!_Uj$GK2rVb_(v#7i75PQ;sjgek*QbC|0F=q5gu zMrS$=l;_IM+s8-}B)wKn@$$^qIN4P{TzmlantLhvs<4XA{mp5=f#KKhpo{v$QDQzW zInV>;x6AG%0JnRt$mzpI(?cKIB3(DH4AF3{8D91St;xdbVNb+G_3ivol{yNm3xZoK zGtW8hnuu@oXi8LDcFHe@eL6M(+9)jDV=E(=IDYrRV;i3WN;x++)(67(QNzvth5*=) z?|~WAU&}~ZS8@e7l#zTBtU~OW+HwFjiVHorKV=xe%TlCgl3mN3oZ}7~q`%NQ?6-nH zGw`^rJ#KnB0Y)%QTAb0?zu-HAz(`{@roSP*V@^M|dNgXOnazf2h05GxldP!O0H8Ao z30alR7M(Gz76zXoWeg3vm2{1K3OcGMc;enE-5Df^yfWR}9wz9$>=>Yk5r#TsYO_PD zbW*lP1BN>)swWyj-mOf0426*eP*r5>a@4<|eyXYeG1K&6?gzK4ZHhpJeeF3YJ|T1Z5(p>qiSBensOPzLV-y>|x;yVj@q@1T*fI zsGfXKe2L?)m>*K6Pq~<_;`Lc5(=B+o^;jWZBGE^ ziWYlrmTa@lHu2F0bc$5drr(m=|C^|M5nq_yV-CV-9W~vYSe3~o?fmqse?u*RE0PpR z*83hRaoVq7C{^DhP#NXLEC2fVE&M6svlS5GaEqQB&+uVhJ5lxVJ%3y$SlZS1-ay4V z^nxRun%Fhlg_B3dHD%MBxB_C^b=1ehaslx zzJ9(Lj`5bD&jP*hMB;<9cO2{+!yEu{cvO;Y+f2JBrfRi6!7%u}<=hkq1p0yw8h2bV zezRCQVCI&t+c~8?IsAz;@ys$VI)7MiSsAH#iG|gp7kak+b$90dZfuMYzD8bJy@ay8&^9jvV6}kAs_HrgnN;$dvd^ z8-omYDaW)cnDM%^G`7N|EAR_bkhvF}<59L=BBv6b6q*|mhyjPjH6PXgYv$osOCohI z7%{s$adqnL&V%y>crYoKKYwj10rN}BBGhG<_8FImh1f_7{&G>L6athL#vo4ldRt3+ z!1FAe2ur^87-e9N0*nPz@+moq5v_+)Gd9AYXtOk`zE99GXmFO#&G1o16^?lKUhmns zQb5w)YOjtmLuY!6AFCC`n8yj+%Sh$7%n$;*Q^UN~9}HSx-q;^LYSH`o_UWtM=*8nq zYbS?6unx5?`s%pic(OKjU&tS${{J*YRjt5eQ8sp_sc(mB=md9jB?H9Nw3_X_r9t6I z@>IdEPF+Afi+x$oNe%zZ*Q{J?doy_jy`42fkJ>)7fae&McH0-}V$zLy=5Vm`6`iKx zc}97Q0BI*C<;MjK{#+xlNLWd?8FI@9AE^mCFO?qvd6GacmII&8VNQ23Hz(83Mg-|C`lIX zuZO91=>{Lba2gl6cckk+X+e(#h^)u90Y8u+=Pn)?HkFnrGbD?%DHsht%^G*8{5n!qjGU zH*cPCv3sr)H-Wh7P8qIsAF6b_mwmKfzMVzZE2AsMfzzbdIZ^LK^eotFG-o>JQ1CcW zZ*HDlImB4qCgZ5wgXgxhq+Yr-(j~HDueR&x@bFxoHut!(HA*mXujli`rXVJ(H#Pvq zUDRbG+{ZOFWMA6x#0J9Pvwv63PHFY`r@O*nDorB}Et)t@*R&O+vi?932 z)lGf&y*JkSMpT-ue;r}!9Y#1p9+%dC=`Qlool==ECp<++O&_V_E4n31%O!6>!JHy? z{k~lyTdHSlnVUm;Zf=LcS1qxQS49)mfG7c<$9c)P%JSuiQxVD`w9vSMdXD#&G14c{ zDKY&d0`=~K<7?ZaC=a0`T%x+rYWY_uk2m{#b!2snO->qFt%v_^StP226y*2 zwByy+*<+Nq(7&EW^4yHEeawB<42xB^|HZFuxHxK(qRt!F3*Z$RM z`eifpg26oIoJaWRA7oJ<{PP(g-=|mXKx&VEp|mZ7t?B@;JGFdf>9I&d5Zm%ykEjbG zmi@NkXEj9RSjZw9R=W^p^`1%E@1*>=8a^3~E_euOg%e6HE3;JJn5w?UJKm#KMq90u z%g8NKJCjs4aC9Ji$SU7hY}TRZvb^D5{_!Z+u)_C$v53Mow|oZ%$CF6ORunHFW;RzN zix@MSO2@+upwI~Z{BLYjIR(-dCs6&8#vh_L7qCS``a|=sPyKtV{XSI{)IEcI;lCyuJUzF8!J=4#=WWhjB%`N!V%2?>Vr* zw06b1nN99XO$c2I=Givcs;VdJmt8)AmD+5VOGyT|#M=#zNS_konlv&F9%^-Z_B0_8 zsW%ms5!Rtma3nrrwkT)y5f2M^J;zpsG;<+u-W(VpW@vf@zLk(Kf9LR-q#8 zE6YBa;nVls7Ma${2J3U5mZP=Vs``^h5Mf%yrodV|=XY38ym-dMd{ zDL{xW@4O&`t$5t9yBNL6TXxB;Kc`W@r$_CIo8;GmcRCAtgT`e~GH3Tc7o8gYu4K8u zp%An&@X+4SahH#2GF?hejE2uuY;X0Vjm5{(NKA1Jr~|aT_*ORJJ9yNeE~TLsK$CZ{ z?Y};$_JOhO?0EH-S35sqWPB8#VEpOR>$e=OIenM0j~UkvJ=?DA0va@UlC7@8*Q(7B zuXVuVb;FpK15nWxuKO&8cykK4^pnbgO~#d{=H+$9;mgq4N#g9+80;j^I-GZoZMoZe zuk#Xdh&Y&Oog*6+nO~(_ypagy7$^FvSvWzN13_ zdn0Xvl(@IC4E@-$Nr;KKESd2O$2AZ=|yEohDh%F%y3?yt%TMqzKnTtY1+VPpWKQ z%n~5XuXiNi+!1p65hzE}D$Wa0H-xvfs%UIH85}?d5%J-zXq-FnTDI?887PT`J%#K< zI=_$f(Lq|s!{53U5&H+;Dxmf7b(KKJc#3ds?CuvG+mCBS<4`T~;xpOD;7MZ`61^U@ z6FU4>{8oLy6*HvFb8g@7!xU1d-3xiS%Ol|US+&VB#x)lo2EJ{sw_ADv9{xJ8+S%Ds z0Q|R7rqX}*Eyv||4X6STR+?Js3x*~1@K+fCL%qH5U+gmuV8A~M_tHgWM*_vh0XT}R z2>nRy+G=_a7ke*K8>?Escl(AU4{zVlo9!FA`QG>lkvDq=br8 z*m=(d*4~S<<@WAk*jX>~GV1;Z3AGful=@$JpWahds6j?``xilbqZ<;ofl9o#5rTIu zWJm_1#ji38c}oE8mWU54xD;9zM|U6{JF;sGB+rWSu;To0PZhw&)XltBay%vZI)w^C z!@&33T)Lkb119Og;b%bKgTYP1ugd9NcU5R3nnHw3Q~Tnv{R;Ae1G%O@N;Y=Fp&h$+ zi=TE2Kjd7vcW&V&gSNkfvPh~n-%qE5?4kL`YPrkD57NXOkUN}UUznO1W?7hOdUKnj zSsT27yBYSs^dlMQN2|BB$%P&Lum(E{I?g7%I;)T!^F2ABODp{kmsCD@CTGcVIxhO3h-rGr>k)UjDcsDq#Cq z`-ERB*2YdVo565OxplEQcLa5R>Z7263YjNpv-T?`75~8@DHH-u@YEx|9V>Z@W&36V zQX4rp9I|*%U-Ksj3zD6;E(T}jogkNyFffe$V8sRUezieK;8phlP>USs0LL2Em|s26 z*?M~W7@jh;fN^`JkE<*TYOX&{G19W~*aSiK9b5m~w@uNQ1vgR-82lb85#rFIEi`av zdSP!>74*=i^ZVyVdlnoNEP`wwJ#xXri?e&GmOBxKdkVHSUKPps9mr+?H~M6D!Au^e zYN&URvC6xIDnt!x93-p)LraERHeRL+C}CJS35>-EuHfVHV?d~;-S!{umyV$iPzmSD zCksOZep}?%r^Z2H$9xR8nbsS;U4WT{m{h5}VsJJmtc?ypg z@f%TjOwMKmJ1gAN{iZipKRe`1n`F)hQgZ4pRfgxxGMkSVQSAw``E7Q~)3Rv~EI+*r z+puI13J^T*fAY=hgJa_bdbPmEif^9 z{E0;MO5|+u$LScOMo3r!m@J**EBg{evbID2Il{fw#Ks^ z>;KOuRaQVNYgZS1C3eSpK01C2TsyS(!kIvQNu@Z2S2fHY;3Yf zfy{kb+U4_J!sBFlp73&@I##&WV2-6gFu;hlxoP_Q0|RzG`R`&Mg&W{8oWITXZy&3g z$_5-nY2DSy!#l5doXNyr=UPVFE0M{5VU)?}yXObic1s;C_9i(JWIkLQ1Vt+Mo_TjS z_sSn9?m_Vzo`l4P;QgMuGuM(NCRAC-H!eAOc?~nIJndP)vxaTTN-J5NGpm{`?br+a zV3#8U!hNV~B~>s!Z*sHKhw3I0Y~W*0rbmV(xQha1nrSrL^M$5Nm~g58P^L+cerR?U zf5`aflIR#>SfT|2^6wR)PHsg4{*pppgkhO|T$JIxd*?Ae%dc3^1Z9E=K?@nj!FNiX z0*k8y7>{7U=pk8;21}|nqxyGF)<|8* zg%PO%k9|&u*`!i#I_cyi&a#*&dMpSn9iB3?6f-qFXHxa^T2ItETFJY;w$>kClzZmg zOYVc#9+qFih5>8Z7vuw0K-nmdy-FA0&h`1kmw^`x$(Jbf$o0=s3=m%vTdsh5Akce9 z3Yh=*bw3mYz81H9rt;wLP$9r1pj&uhN+88R^NK&A>;1E98I2u?faAQ5m`aPF;NY|st@{dq@yTDUgDEPBsH8VmBrPnG+B2SUGnSJzGONFBX1!~Yx`9mDFO7kmLa#~*!L ze2yjF4+eM2stx1CdS|Xu*zpPK5dz-9tEANgeuc6GG#dNR4;@|`!gvWkT2`l`API2> zv0CqaetO34lef-%8E9Teu80*J4<$wKS@`Pu;|$|>klBSgHO1|G-#?#JU1)T&Glt)E zcTT63Q6mC)$rhU^zZ-iN_!T{BpFrId;>dxXu3KnoQS^!DvMMSmP&;fl|z{REauK`>9uq^;g7es37H%1@lX zUly}pIE9ji?ira$#(w$oS8MY5@=(=c@I2C*$@Bl=0AC#vsvWrQkOzp*|9jBLN z*2HF2Il++RLL%c5QqH?9()f&L4kNkDapVEOrd3%G&OUn%@Wo5@}LBSnW{I|h6 zB~*@CY3mAr&K&h646n{xTU%e#ah)0;PaUeZi!H|i@{Vb=FYHszeSar+_x?l$7+T>i z7q}xKEe1{OOxp#DT$!OJnO>Ryy^eR*s(q&L^6U{GBhgwL^<&u1aIb8a=snSg_dH)X zzP}8{FYY~rAfzg|Ke4R9x?b7|W&f~=t4tSbq2%wCMGE4@>4zX10=G7v5O*%2*Ytkl zbk4BvOCY72S@FEO&AH6Cft1eU=Omf27vcOwSkd+7@580@=RReSjvuR5@^<&`nP}B} zVS`F?)%|(S7~TtzieOS&S2t?^BseYOL&;$KklUWDE6LJwN!(5Q5%&6#lF2l)n zu=TfPD8K3U_V@Q1qyooS<;O8DT+2=9xIr=edeDn;t$WkYdFvlB{w)#y{udb6JXrrR zKLJnnemYreu(Ehqb7@G?1c-?X4EQ0bkurznD?UXIj((jtwY1~T@h;5c<~xSC1uhd7 z-akt(F4oj`ZQH1?QZNwnrTV59f0RNrY@Ws?Dh^X=M4H+99rxZKq2M@0BYMZv~@yYa_ zyo)aI3F9&o0}PPjVYLQ>kxKvjeN-cvz5^(m-_byc7M&#I?{K{lyqD;Y?y1JZF7sc_ zffWN$;xmnF@JxKIojJ8a~fd!S#wCT;g6Q3YC!H9)g~+u&C>B zw5-|1OdR1z60ncN}w_SZ{L8NrGB=GE=-0gsg;o1J95x`pI&iw&p=SHpFV zT=SQRc+U18&uR=Dm0f64v)1oif{T@Q{)IQkpX;+MbaV{eCSaq>(+;yN=0a-F;e3Nh z(9h3j1@^HWJ?bm*=;)Cn=Z)>@ZnZ8PH&NMQ)9_Il<)b=*5XJ8KK{ z7=NvSRgn8Gp-6X@IO0m7P;eJ3mZ!-0Xe-W<(x)Z!GR+qc&p1{G|O)pusXr zmt=lPvzd^ee|{AbkpH1xe&qO^1Wd}XVfVkNzkZ!w7aaIBBhpZp)Q)MMV>I#4e|WHR z7wc4Ku3eOG2VX$`!2^{x8}{e(6drD|V%*1>}Z z4;a{hl)l$YNWRv9GT(LlA4~e%#sLu)-*cV;BCg1^zVknCY0?bs3WNMoa{osS2A|tv z_S-a-5AV{e00|M0{OyKA>5*TrWOSYNQS|;t3IFuTk!Qw%4(?idcC*|=93JpTcoy*2 zc1ZID2Tq3mizDrw1Kx6;QmKvQ_e2q@`af#&$3@VkNHp>=ygG32CjRVUo^f9OqmJ!U zmD@tQV*<86sa|DtN$-jg_o`HKN;^g!KmLa#^csPXM44>o_(bs-!c^f{lbajq;oqTR zz*}zco!kWd|4-K`CKw%- zj-@jH8y!sspR?4pSrcPgR?ybes&#BfDE|3$3^>exes}v1I0%ows?C5N;#cpwcg1h0 zZ|q~nonH^rwZu@$x}b&;qenjEE<1ip1^nu2ahla{3I8oCscy6&y|Xw~bm!tqxlSp8 z{ax!Ta3jc>qX9bRr?y`sQfQocZG|3`7$ z!1p#c<(M80-4z^OG552%K%Bhm_xJtb3YBQz+~hiWZs#JFn5ux6w_xQlSnxX>51ame zn8An1c5u5K(e;!8XtZ(?xbyXjZZU>H5CU_Rng7RriY{fK(Ze%_E`PjJB}1C}c$<=P z{vSs5>=_P~+Kk)KYPsB*w~TAO!JGlt0Jpte^u>XlvgYp+Rs3m?O2)05@cw?6)MN(q z9v`naqergbulsEN^>p+9Q1;bPQLf$FQVJpIMy>XTIJi?1b1n%yr|xjJhz=2IrH#`+Sz>x1Er%!wm_jOeLzQL4!wcN9K`tbOz_y zlmP~=7`+!pY*1y}d*}@=j-P9+7K!HqBINPwnhPVIccd=V&(_`eq4)T6s6TEDGgyNk z{pF%RWaWG45>eABElc$iFOn4khAyq@=8=odBn}4P)&X?68!xeW$&CPqL9q% zM{G6ErYu-Vy@P9*AInbt99ey!#Dvix3&Y=<-`z8!^MwDfELNkf1Mt{oku9C0THFz*qZ0;|Ki;LWX1 zq}rH4x0#)RP2dm8|7B+gy}-ltmPq?!*Yf=&q%H@k@1+}JV|o4K9nv;#>#L~+Sn-^k zCkp=YRrwhn`%n3Kc(i+l$wxEUIQ^JTUu1NbgRJh^(*MEgW`J-zGjqV!wr;ZYXYYah z!pbju?){ zE&#RIq+tkVBfo_9*IqGd<8oB8x+gb%Bdcc%k#0uME^x=h#FW1M;VwNxDZ}HUcxf?YQfkfA&*(gAmTWqpap2@Zskkl~*n_`l>%B z#COY>|13FD5coXiSe!FJRD_-aCd)pf)VfW@Q9L>jQwFGZvgpFPo z_6c@O|Ez{zu_>sdtY%=RmM;Kz{eiffIsI=t`Rm_T0n94r!+@x$-)x);3xFwZdlJtG zYvd@~*OG?&+Kg|OmD*DOoGi@F#K^P+K)l~$5Ut*hFlCGf-}m6fKj6%-A7bPH3=rnP zt3>?Qsu+>DUEm>nLg%Z_*>i`OOL#qm{>amSxUr=vLTDF;p$0*nW^*^ua{37tTtASg z?;+IBIr25XpTf~uRyp3RvSFGh||7wcppCDkFHt?IR@GDuENhp(Z)3`IyklQEE45(at<62)n|qOT zua3cLTBAKAC~-XlR%#yN!XH{%|2fs)hPxGFbTqccTKRtM+cD1!fPR&p5|$ciC45k6 zAqk_?L&v7J2<*;jsn=)tKBLsXJ z#;@Us5hVN#Y(f(-Ttt-?|Kuerj}EzM&M4~V>eKQ(P@&E=**&?Pg?U2CX6i*Iq6RXf z3Kzk~czC!)&nE+S#PVrA=>@qEaJTzDoG>{rtH{fF0EVC*6;B zvKILByO0y|J`tUnzbMe-RWK;x9doG@o6t#OB(Ncvt$L|-9CydrRG@&qqLXK%S`y7A zhx=;B=!z;dX|RSYPSfIr2OO#KKmJIG4W{L7vwH|*Qt3?-B)DM7cjK#YcOvKY3v?P( z2AZd33iP4F)>n*gE~Lqeh+fM##eeef1%>B5&xI4`aKv;7@y}mnWN`Rj_jtBWj~iPX z6Zy5RU7V3tst$q1TFV|TT+RyVxP>%hFNhi|HBY_EcoBDJ$J7C=xlxg3K5hvyMk2>_6tCLIEJ%*Gr#zH4#lYIY1!Xz=a)H>h(|)`wr6e9{EsVwd-elJ=R}Wu z)$J4FoHY&4S9~iGL$F@Z*Dv!W(?wz2t}w%eHteY`l^U&c6Br;@fCUhL);nr_PFuz@5*(-MW~ zZ?OJn(@&>GcpTr#(MIZ3gk5PW6*uX2i++{6PZ-;`Cr02>eFSwOYuL(-i=BB(OuS~` z=2q3%)Dp2>;v_7iC%5 zIg3V^nTWcj8_pY&Wuv9t+_VF(Xqd#e+O@iUYjyT+nuOo%hyoWK@~^UY9Qv0`>>M`3 za~5;jPuSe`Ia$YQ;C``kM)T8OCgw0IL(KYyRq~Phf-YFRI<8Hgje))Wx5lDxWVBH= zqdA(p+GZ!-9iYUnMI6jv^aya2B*dEcl6yzS zHt7TxNcHf=MtuHwi$6D>4j)jPD|-S27O%-yPPTvg9rPJxNW9+ni9G1(>odN&;9lC; z+#DGZL6e=5s|7A(#pa;k?G>x-FWa$}Lly=8rv17|FUSgO$>LL7R{n09!w^>^XLi5# zdxvx52M^sZ!&gc*iNTh%z2lzOv9LgFQghKzIGLL_lLTFGJ+4Vkc(ShN;{SI$lc33U z8nL{azp{nKr)Otpd9}5*Q}WnoCxbj;DXFQd!slTa;F30|YQEzbM@5RX-( zoaW*#s=ls2`*Ax?e4R=BBQw;yF4qqjrYSLb z8Yct-G2&|SzIFI{{cEx2u7pP@54h_JH7*=QVEV^J{Q8xI2KfJyr(|s6e*VsTNzcVt zdL~^l>hY*Z`5|fe27@Q!i%3Aj;cQfz69aG`%7!?u+8f*&h?LI4F9@4L9fbyR_HLfj zsR9sw@xg6lr~rZ|*!u&Nn1C6_7*dPcBm__gQ5C00*VrHbna}e3RkvRPj)z?-a`&fO z^~^tM^hPPABPKdhma=*r#NsVu67Pxm`>hJDu@M)gxXeE`iM`F4upuie8b;wsMcvw? zQKp`jGr-2V&-2vp6Sd+baNbh)`o4i@x%YbDnY-M_0aAzS9n;P7O1r|3@5DdF*>;}f z#NUDw|0C7*%eZ*vLkYu%plPw6F)Cvd?&_L7m_i0p35`ic_C-4&!84z|x^`=-r99ot zBv%;?5>}5TU@&A>x2c+mTtWGZLVa-$UggxVx2ne@8@{9G>}By)E`w$6Rt|NR?Ay<4 zmDS~!aN{x%g8+PzIQYNc8(!i%-coLgxa+Dxa}lx*RscnQp}a<1asF+?uF>m_(0m=4 z^cj^)?=3xLb#`Z4NQv#enn}Y38WuM-v*zBoy5&usa4o3b@%>^q1l*J#@CEv}TwI(L z)EvSh;-ZQw=(tp$=|{@NdB86&|M!>1-g9x0zN4?pc-mm5ab5nVfpg{|A>8VPz|Lig z;`>DPH;HD^=}i!;B$!-Cw|}$N_`YUtvVZ&x2Su7%$MY3Zv<~pLgm=|mepkVTe{9p; zIgy*V)Fj{1tMt$pReM6d0C&~92}ZcQO_lW*4$TjB{BY~w|#A|nW)n8~Kob@`Y=PRxWu7Mx*zu?MQVUm?3ECo7lb z2POi*pd}o1UF`rIHq}CY36K4b78QO5^?QWW!EKM0q9=bDktgi~%tgM4@#1eRd?Te6 z%#7Df?TCqu<+ri1F;h}GB;S%H|MvZaaTNaIgBQ6nxK=taS2N-eXSTk5XM!W7B#LL( ze-GRn4)6`L&x{-G({6v1fQ8i9vs>}bINLkp|MjCfhV$$uX4YlM{;XKUhMBcV21aIH z9L$<^3Rd|ET}Y_XCi&QzVncb@9I%ea7sKJe-EEwzoFg$&12!260Q0rGfN^RG_dLJ} zn~(WiO~ZLsPU9*a3oZ-6_`}{{E+SS(A*i2M#W``vYYK=msx;If%=Z zUztr+J;2W|Vr)#;W~!bNq$YGe*O?-a)BQnbDh_r`dmh#J;Vbr**rfKA+L=C))6ay8 z$8g5#>jZyysr+fhJime@vD_ZhXSH=u5?jPLVk4J|FDDd3V+-oUjoz^fm=9WB6d}Tfuch2MI%J|Ype$ZD+GZ*`Zhyg0zKxDLVC~l@|8n}$Y2X5Ti3yhemMDHb zJ6nMFu#TH6@WrtaiOWH|XWGJzJ}Y%p`t!&CG{eVqC8o-rX@p~txe}^*8~Xm+J^u8fCiY9i*$>qe`%Ytgs5u9( zz`4)EES<0m5m4t#Bf~m*n>+u1m1)8<^9===J zAqdu^C;6U_#%Zbd^RwY^E}M%Hd4?^KGc9p01I*`&3|r`JMk{eFyif@V7j0H2WtPIz zC~2COq{MduiMt6l-B-V}f&op!RSJCSWd2yz&6PGOhOQ*-^Z(+lJtv{-cEB@9`s?gG zfuR6ntab_E52qc@Rb_rq3wxGH+1m4Ppv{>txsbBi#Q@!(OP>ryV53b(VaUXUQXDZ0 z?tR=H&*a@)J6zCdaNRFHE7=1M|8X!WSqD{QZlm6-%*75X*+4f5FO^U5i@5G|g3`D8Y;m`}-o2Fo_jR(Yw)0@JGa|Y;QDa0SSH*{q3RyhU4Becpe%VgIFPXB))&7h0So(DEEXI2`7;+&N-iRL z?u8mc$IO1AS2vVHdp-pxRLsxUHyquAhyt3z+e6QU|8qA8gCXix{tD@DfYg7N@gWYX z6v7(GZzAwcHnyqHpInfNHwTgIJVE|ZR2|x%Yu@GDsDfw5rPM-`5Kx&ZcD6qF=#ho3 zl6l@7LctSOAvazF+pB?{BZ~UInhD#lmseEW5hl)(F;YmW37NBk^kOZbU2h%J%UYRZ zn6Qey?O8ZCJ8moYM;_IyCF^-*fHgIO`5-MzDG(k;q8(MPf zdC2U6MS#f?Vk#uvdb}l&X$)mfWA#L$P-1J<3* z^8(Z2Rc7ef_64XyZ}#IbY2iaQM$qI3S{(VQ)EH5h?z;6)1zHD_N(WyR*x1Yt79A>h zTH?eVnkqo0`*3jn;a;N9(1#kDm9@yteR~*e!y3m`rU|p&PgQ2( zPOC{#9BS7<(~wwZ)ghqd8m6sLPU&>T6!Z)R7h5-W0EHsM!SV^w!H}xJWBTjWWa4|R ze$%YN`s?BmC^f0;!B0j&?{3qSjwbS?KUtX{RIJ1{KFoMj`}zV$-)ZWTlTgkN@-7ZD2ekGS&U!ZH1VLY3@4(=`wiK z#pI{#Dhi(+X6vC2_m^B$myhH5h>D7uUwbO_=!+ADHGE~{qoh=u@MWmwWzu|tEtJ+D=yR=S~q5zV{FWhzx1Ve8fn!1jrThzD-OP8@3#p_FUi?(lA#q<{MJ2 zRRI^F_4h?s=j$LtoO}2;GGCmebz2uf|As!`>beNe=*dq3qG(GvMBWqAC(% zZM#4PnRV~RV=QO{998D9v?Kj6=liS+_sO{H6+2ysa%261K8Ina+AN^0d1y*QpT%6s zN*#6;=xPV1cdX_+uda<&;T3VXj+)Nm`JTx)Habyq4i_a6-Ba+u@}XwW1fYsH-jzNC>@7)UjmXdxCZDa1 zt{WLln4~Nr{%O5C?>`+nSiGfI$y27vZR@FQ0z6aeSI4_w7+MUM_dN$5&aBj7DRvul z`+rgP450?!&?oTY?L zJ9ovaUb4T#CJG`x#(!lDtZ-bj3jl+zoz6Zd;h+(q{v)=R1eOEvm~H66+eMdPhI`&% zuFlh@NIpqP`yiHcIt`0{hlZAVCDxjObEd$*HHemvT7?|nN=g96>U9cG5PFY8O`0RN zx1I8AW)y7}dbu285ETdgS}3^COeB~;c_TQ?Mmc^J%rENff)uQ7n`I*<8_>8TfN-u^ zK5)uxmx@^ZXA#-2dky8MBdGrrhsaPvxJD2cCU@!+CF_YK3#}u!#Z7{{Q#y~N`VkdF zH1Sc~mwbFy%LaQ=BcSgB6BdkXmd`teBZdn%b~{8nEUkKf2gpXB{id++P@N@(WDxlf zZ~3$wrH(MbF>@FU5D2Ocr`cKO=WjrdSz%LSYhh26+k3%}R$$fPK{1P>$I@ukOM}CM z{YBZEA(l6^Ho=6sc6lYGnRVuKqd~6L@(KEumaXu^-4TZ}264CN2V1q`rFL9{03&IJ zkrV1CRajHetOWem&$*Kj-u4VLH&GydUC&FbCjKs?6>ellhrg+)+f^p}`Wf%@0j)DP zr7M-=&gh%|2oL%#j8t4$Vd~&e<1ENe1;z+FG;0-GR*k4XG27qSkW6t8VL2xqwDS#& zV+LI?Su)Loi-TB|N;lHPfo$89^n&21Jqa0El>2^Mk7ic5aO?=r^a=4T&$4D9 z{)d90!8Ca8*jV-J>6c_;b!adEmsQxu?;SO72?&-XZtIB*G{&l-u*01mgQrg~ zji;>&)DSJppskfaRl6ni2gXF-dR8A_Ux%e((IWairVFD!kp^l3WQF_RS>wWm9TtnV zDW1SV!?U4M{1e39bW<82lHpT|6XR2g6|qWWF&X$N5BP1l2^p195N^vB{GCTIIsxIf zdRosG_pHd>Huj_U9HsK8z0FeMs+L7PiRFEuwQB9rZfSMK)L+y5fd2}vRZ^1!@&yKX zO;hr7nE>;r{kZ#fZZ#_X<#632M#?)2^aD3F03uZLMEPX41QC)5f&i^j+w?&4-K5}q zDgGg?LxY3SnR2I?oJJ- zo9^_?j7^~&3lJ2T9jQfx=a?t&_GNEV(1iveUOD5>h!h`-052Wg0N*T z<~$t@hpqI0+0x=7|H%HL1M>dH7^>ElALg}p;Eru1pw!#L1ftP#TIs5eSD#;v{Y*!Z2B~)STN5QCBn*lvIH#; zhK0DBKFJF-{wE3q^%&sYXAb)E{C-!=#2`2i`+n+`8~%CL^a*iuQO$pGcF>%(daskS zra41B&LBNb`l)Bk8eZagXGll4;rta_IzWtrbXUO-T$nA8tL@AL<24@%{woR)dBCoX`mIZvVwbjsw2ns9xpg z%aKs|c_Ys6#PcE&sk?sSn}4Pc*?(jYSv&>20jRmyTdpuhH1e=dM`R-cWp~%wSZQ4oa6J+$ZW%^z>Y0^0s zxdjD{AoN<+;p091u|Lek9i3e?n4^-2145iTckXaRZ%#*9MB1Udr+7tqcqVQ;j0J95 zljc&=3@uNE!TfE*?vv{C-jN(8&b71XrNUV7cYV%&%g|!j`~=8 zaN98qxGY}#3+KQSG0OMY4;)xuFLzpb+U)D!7+xEY(&VLW(ZvD~u&~A}SCN~xS|9*? z(C2vDO}j`c#5un(XCo!}K3%6j<+XyuQrJ%hcM&kS5Oukqm9P>1C%+5G0a|1;yDi(Q z-M1rhz`GlAqG{H^qDrQ`ay{5{(lJ7`mdFfos1BnJcF;My0LbzHKzqfJ4WL{=bqswT zXJMLu8z(P*-JG~ar?{0;uV0JkB8dCX6OpG>iQbhs62$$6bU>C;3JyGzmYoEGJa%W^ zj}8}NX!7h`ErxP#RRg0LQ<<1xY=fTm2|cx%e65m|Y1x=VLC!TFMYck?ly;#{6 zsC$Utt#Xl(X;a2gF%-5xuV!FvojdAEeR7#n#FOq{v3IL2I4T8qd|PM*Y0^)szq#ej zuN(mavbDzO+P=}O)O>$`_}Yw z*W0~NB@?aIu9$%fk7#_dsB~8$TH<|6rXiXto0@H-_c^1CslqiMy9dJOI0`aLwZYLb z%LAGXQ+ULI;z}-bM5X)(f=9(3(VZ{&b{$UbA{t$Hu}&RZ^})qAKk8g$07WNyy+;-H z{}A~|pdsDukl~#cU|2jqRd!?W40fA+2d-BkON59Pr`!$_Fg8f7bo0lk#cjFI?h`z?aZ8dP>V~c_)!DErZAzHDslasCS z|LXABPI6oh0L%$o_!!~+^wLAInz!V0ea@8G0?G1wB)s?hd@etL2xipJ&FwXPt0Z_$ zsjvA5hF;qpDt8G&2pqAO(rf)c-K7noVw{+n`EYqe9(x9$7G%Bu#n$8(g755h6I+MA z^R%a@e3;Y52Ib=GTCYt<*3;6V9@OJ`;-SL(b8jLXbziqUU;U5)I&4;^mW1BcSB(SE zE8}XEGoF@66YfrbhG(~_I>1H&uphdZbS5kaYe>}7wA++!Xn=dJ@Z+9$sFi&$Vu8Im zGUS2Nd_+rTAcQ%$X+GYxp`MftOwUU;t#i5CSP1TT?IQJ{_*LZ1&im zs(2@RlvUD{KDsDW&U6E5Y^xhz{+qlO@DziyE*8CQn+x1L$R||qTzSOP1!O9q7@y`? zLaJK3CP;QEMT(z<{kXTPBM8B5I*g^@N-6}Tf;><;{pH=6R|~RddrBfhtJ(WYj}H&t z!`m?7NEDC&nOh)aX21~>J3D`o5taso0TtUv!hj2OG+3p-rMV;+SHS(DI3z3qhi_!# znLTi#5gS7zIbymt(}*dk@bLfQu(m^NvpaoP)j|+ZnZBUpyfsxhz2(lPDHPggn6npk z=507;3nX=tqHBI;E+KW222dyIl(k!270!)?aUSx##5TK0GCoN=7fb|VNGT7_Due~G zgEk8F(<1x}c}Xy`gKukJO)62sKP{b6IhNSa_%1}$z}}#$v1P^$CZ4`|w}MoipCaaWZB2qhx3`mablezH36SLLl&NTDOi|`%OT;U3 zo=H8$TU(p>RJrg6O2zEC2`mjy62Jd%vbml~C(Bp5Wjh9XzOR?axO%M9dfvl{k#ul2 z8HTUw+8CD0f)^b`)42aOO&}!}6*a|dzYbcen8c9pz=^s~OUFtGG3@W$XVB*8CBG?L z-g1rDvmnyHS4}}`0`+KhCXaI1fjx z45T{d&m@h2W^EjmhM5d|p2y-4DkBB{(1lt}8B`HwVKV(rsChuadSWte$g4n*j+BQl zVE~fw5O$7lwCr29QVnsc6}OO;Qe`qfdF)dwPfK!ikq}h~Em;m$80^TJRGt6#?!2c0 zKGE2zeGu#%^Fv@SRN^k|OESX1uTV0`BHKDbcnMDQUbvtA?SKyFJF?a*upzf{0!Enn^J&My4;b= z9F#yCrKF_zMBner0pWWwR#>>K@#|OOfddvEQM%_a)bf9M{eh8A5)<0-lYnA0c#yNj zXQpM6>4UqxOYf{c-0UZ0TAz~V%D4`E@LdVJZYp!V_`!S`>qu<(+S5-R8F^CKYuorHs!-H}@7Q=H3G zMS$2&aat3EPhXLsn<^_k<`x##o8#i*1On(qxk0s}6-bU1KdZI3sK~10VsPJk%a$iR ziGKNCJ|pOM1SO6TLMgEZf%Hu(0o*v9yAxa*7SicXbja}E2nvXfG8kaVvPka*s~;)$ zpP1SlTGSb+m7;ys=M8iZtvY8uP%}lOD#e9s7Mar!ttXo~f%#SPK$he%KrtLN1rlD< zi$gBM*wOl`mnWJs9JmkGZf1yJEz1XD}e2f;Jvqr9F@S7Wl} zlGDi~Ld}|ln1lE}QI#K7Z*R@M|Ey~Q_uYqxUMZ-4(J5clvn~T~u6W^L@GJw=5?5R_M z>j}~_JRphQKhv+LurQ5z^Pc4?F#hY1AN|j#*h~Loz|P+JTzw1 zThHKUfQl=%>?cz*WguwoQAz7Gu&aQCQS{QBDSyp7@2;e?&pyhoz0Pv+A_8|x4h2}SJAd?wE{AbUb$``0JP=spClJkpmk z(_HWyY)MyTpjsFJ^~8;!xVQ+02RCeqwYw!^Q9J$)|KJ?~)6^cgB#~<~oW(r;bS^c$ zuq#9Y&yw~71KVmas|0nhcEG94@Cpc{nf@jMJWD>C%cCeAj)(yjQJ8h!5^8YFQqVDP zJt#@dhtTU@P|?rFiXgM15O!m7E;Mh0qQrsV+z zw(S$-7JCU5;ko(5gy&FwSvCk<-}h!B=n>xqI9R;wch+a@WrtR%oOfj%rb5*GBlR0X zr$7yC*5=4z{OI?HMh_wTh47inn;cBDGL;Cd#YldX&|rN1ZdcvQXJG7)?r>(SJ!(me|6z65qmvA5IIR3T|-4z!XZ0+n)~@A5xAnFfDDj#QfWhrD?^-NRETP8ry3#P(4O`Ah^-z)0+xTry+m|-r12Xpy$Gc zMNj&V#seJ--A{JzM z9$7pR_b-5?TY%RnFz~PdK`Q^_LcZ0j4R5R=d#aYB#mB?LGt5OX9;Dm{&g-Ni5!(#- z{$b(NF17LFTlGi;7`R(})w#OXeQQkWp+6&Q+}1t|XpZG1V2HPr#98?lH>iw~DB2fO zlX?wT73l+s6g_cq=YV6l7${-2AIIeoP7e;x&%HYkM6fx@%IQO$`;h&u`eT11uLJv= z$zTEOZ}Knu`wx1n`Hd?icA|i?ARD-F(0FqC>)SJdBT2y?onXitS7Kr!!AQBM=fc@s zQPH8mTKIaKl!1xKO>0=EB#l{4QBhAUkG`I5fd=PlQ*U!~b6uqt4=((simu(}RhZG< zJ=C5TwN*gI|XFsChWZ298b%$B}3M)Zn5GwBP`f7Sj-Jj7i^UZQ!+IR{poBz|iL zS}pW(Lvc4Y!!94Kwx1kS!U-pQzc7>o8Ka(Q*M$sxAKNzP&nf|3qaV7XRH)Et_BXUl zr0mMNfv*P|&Vzn4h@5C#nDHi9;`#bwU!+afw6p?b@V#?hV(}Ew`myv*LP&L4{CcQg zgEJ0FyUac^TQgB=WEXVTZUS-=SuySH%QHZ3fq7vy_7dc8jLip&X@(cNSRNEUt0m1d zAJTAeTP}(jA~fYsvO7G$v)RS6)0VPbm>od5M$wU5B7wfG?v1B48R)MBrpAgIOx1@7 zxdx}3hOuiJa7XwGE2W$cMK{>J^zkBkIRG_cDS19v-1fXLSIDuL_=MZRHnsUc11AIj z{{FtX_Ts~=FAbBEdd-*TdM0X>1`EOXKSzuy19Sf6%_%UMEM$?4)LT+b$6#wutQ6d=j|YyX1-={c!4C%J0PfZ zq0D(BvczFYr_-G2mJrb_0kzP~`dmvBa1NJVf+3`XU?Mhv5GP|p&vZBReSTcxype&a zbyXWEvWO#Qn748!V}M(>n>hpC@e(4t_O+Z4Y=@;vN*%j66a{>!`|9LX?Sf=@Oaq6u z_Ruusk1JU<^TkVtK|7G`l9IanXY)?({gOBTgE4q;nK6&rw*T-$IY2_I9f?bXjPH+w z`)TZ0Kllui_wpUcNcn;W?1YmJ<&k+&A2!=a(dy0{_b(>p8b<(*V(Qk@;_ zlp*-1&R`|mv;ko6(EuqL8dO%WN7EIcSY`F|~w zOG&bsn3G$7L5jik!mw5@%66{3{8My3A3uMn%_0DKjX?HdQz*l7j=y1mrk9avWeDja z@Tul50AV%~caxF0aJp$f0Ud`CFh}@R&j3p$YnA+_ognB5@|V)!w8xbPU()w-O+Ns9 zC*$V44t1Yl1o~hSr3e>!NI&{beC`eT)|Z&pB!BZB$lsf~lNzh>89gvhH$<;Mww12i z$M{E~4LHP|NYf(XE<2a0WOvEe`;DKJ=M3N6#;LY^z2ETl5I@OG<&yGkuwkYITlScK z{X+Ah51XCzB95np>a~YGx%jglfBxc!qPCllj-h(^#f=-Y2xb{B@P2w3*wG?;1v3#K z&ehS;p~G{ZY1v5_kIgz~k2SFqG~FFgU=R@ux02H1rYRCV=Nv>gF)<-D_JvI?r&rA2 z&fDaa)}adbIMA8G5+g@*fv&|Y-`xw(A0la#;z-MerW6y{_8)^xvoLF~yLwy^QVX*yfHo`x0?t1~bQ3|x3=rBH9*hCp+@zdy0zu4j6uW>rj+~c5LZhk_69m{^yJe;jY^t}TzAZ=CZ8+6Re;Tg#uKH&k#?qgCTbldg=>%hab% zDREs8iH|-OH`ws@jD>S5!S3OB4KZZ6hLMXP^+PA+(K7M$-#J;3PuxK^Bw7E8kr>}o zc`_g08a}Lc-E?HGbeIfTV8m^L>+p1}O;^37p6;8?2NDII4po~J_xJ`qZc%&XH|BY| z&%Uj%+wvDP#I^Pm-Ysmg z7J4hsRvqo{FYnRf@_lt`5Wc-y9ySTGO$LsR%oZ*Mw0h@16pgsC zA!ul1lq5TePs~qNE-sogB~;|(Q1 zUSFYEl!NB^(KAX!_e$pss5dD_*TNtF3#;PbTjQ_0gbC4}c>p9u@vrZxkxMX!;K~p$ z50!Emm=8NHie@^D49sQ=INx(S4rKZ=dwEX9V>uy)U<`dAXBiJ9?5MFOOI! zzR7>$N$7Pmw{Xl@t5=D&ac5(bOl-n(uKB)4-)GZwx_G8dLl^Jn@EG+Q46%)LkMH*P zIy||Tpc;t+g}4(8x6}c?x{grp+cH0qa}G!eQqd$oEgd>DtjifAYnC3W)>^o5;{EaY zb#AMA2^-(u)N{cyRIL^-K$5`k*a#X?Vc^bmSvc8b8M(9G(cx!SkbK zjw>p$Y&c>|8@hkFgLUMsOWM=V<&}X(;{`pHHW-5Z03dvy&0dx|`>};jbdDeQJh>j_ z%=5g~(a~SHtMpcz`MSdj-2M{@&Di4C0d$lzCq;a@Yo@J-ittrev4eSy#9IPG^bf^~ z55H)k1S5;k7zcq~95Icxi}S9o%dfwPk2IDg+P^&UAA2pJi2{* zU$s8xtJNRc`)<7XBpu(<+tG@URHG(Yj=8y!V7>|(#LyG4{lmfk$`$&1 zxGixTK6`QPcQJR83b5(rwQggBZ=BXGFU?FUL;*6Q%N5i*b;u7G+et~LG!6|+fT=Zu z(OfRr>6Y6eHp;|m8dobfM`KBP`vNy#G-Pz`8|=Tr=@=Q&XVw$q=bw-S^9TLy0`KDm z^rwf(`MuieqE;HruXBzK-6hMp!Odd92I}U|A3gw`R1hmeC$+c~-K3OyzP<+tH|?_r zDz^XmPnkm-!Ukv@STs#4o3xpg5h;D+NBX4vY!A0HzQ7mxR)Sfl7xSDq=F2xRd)sUJ z3PMp1Pv4SwOYU`a@H(b!s7yf}5kdGhr0Wgn{E9B--|B-)AR9QC{XL!hS0BLliU1#lh;P;gTyAm_-ihVd$J3skV#@Rj z9@B>i*o~=YJVIPEn48%7$k1@-ZnQE1TQU8m0HjQ}CpY9E(~iaEv*Mtv!+@!0F4_c>^QHzr4i?FK zUT30x1ptRG`TSq5*CXIgBOZ_eJmPA-4%(r#gR(5dDy!>GkQ8=?E^qN}gzQFvKsRN~ z2Rjq%X839#1OGs--P^vBfw;Hx{&dL}&ev#{2a2ygb9OFkT<(xrTmK$h*8GZuhKXsD zAgrW>V69HkaCdLpHzFS+Cw}~dOJlpfsQKB-(a-nMi*Vr=@q@Kq`xe8b$~`?jQ_W#* zQ>A4r(i5Bk^ol@0pVBlWT*7qHe0cozsC~b())TE0OOsp!QbeNl1;ETJT<$RAE<~7i zuT$HtoqzMV#C}R$5vFJIlxF`^YwnY!r3OxV+Bu)=Kauh(w@VM@YH;R$l5zLULC1SfzTMW(@%A6gDQ7- z^oH2wa{O{v*hFlic30D#ajk+Ft32LaNyuhQrQz8 zAVYigiarw5Ih0~SMN`)Jm6qkk2*kdhk177vs&wx^GMK+)(SkVp!}=;hpexA6_cjZF zgCU4mAG_|eqHeR(AvG++O=m8sHG?^orB!;vj%y!LX}IGuLXCH^yk|sqprk{-~*Y=c^p)-Tv#L!HBTYQDUR()&^_r?Cd}y3WxCZ6(Ah~N|puKcn1Ir@6)c@ zLV9`DIQYEN+({grI$+CDiMQmR->UvU*}c2aZkHnOS*rLY z-A`oq(JhjxO=>Wa75k9$u1aLV>9%(GVtxF@Nwt1Csk;Ti&rpJ3y3h1fVrJ935M+0g zVzsFhdvJ0mq1*6x5*giK9sUASL9GlaDLpP;75G@kS7UVN!pa zL{&*NyU7t$f6Ie2UCG~#$>XTD^&vKib0Bb*{<{C&BDfPm$ojdRKFQq+bf=c*%p)T0 zBg|kaxtO`RT-`i#;ikp%?Y(s-&e0z6R{cUV&8MM=g*??!j_|-#)#;2FjYnYx_IjoJ zo`G`)hSNh2P&cjP+az@ zfylPoOmpRYB>P73i*2cw)IkTvN{;LO!S_qI>WWYWReq$3IXqo|&XZHoy0#)v(D3z3`J+M_8@zr6B>B(w52ZibKk&Uz+X!b`m|{LgbZ*|} z<8$_(MvQ2g?xt;PmU`ahrF#)^aYa>Ss#pfHHK*N={N+3IR(X2gKa^_&F(B6n+@{-1 z+;Q1Mz0BThm zgIgX-EPre4qXk*J#qP<@-_2E}Qzh64w)9MTqXhO^)e=}Q)y{on`f4nymGii5=C;Wg z#tO}Chv{JL8|~X6p;>D`n6ipmZ6-dkMarPA50K>=7AkLQDA5JC{Vr9e#JTUeCU$Xwf$Lxrv3t9c`pJ!iX#0=;feiWt zsWTyr$?|b*KI_|)4Ex5mMVQAXg#*X**w~@7;(ZSCy!%A6;|2SUe#gya!}>8PlU@1M z{X{sS?%O5`#GDOTtIq^i!u!6%WLa%AXi$ z+=YRb#(>5TspF`#*;&Zzz;f2t+<^lnE58eN!T;F+K#Kzr!&%?Y)<(RgYY7A~YVR>JF86y(+Uetk&+z zr#-doE!EUvPrVTERZL{Nl9tZmuqwm=Q|dMpqgub7d*0W@c*Hu-?b&6+iU(SHm4_># zMX)b#DO5VAnu>a6wU50Ux7P;U+rh zm07V`f1l}A_41{$FQ8*@aZ>^4L@czL8~8rq_~^PbNV#&6(Qj4EB@QG%2SJ&;dxguZ ze#Dc**RNhRc4hY1QUjWYBI_UO-d~X9Z&2Fv(aGhQ?bWxmbUEEhPs`}8Dx|#2uDRsN z6SHGio#NZKt70ZKI`C{@z-WMklXKyXQ>wVrq*>?_9mjQ1Fu}6Bm_{c$*1n;e#b9PJ zxs(kNZ0y9!YS`4-868NzL*GAV%*r}lKEWJMRjw$6BNj3ID5WIiUP^qIu_IEFT1`)5 zc+GIX4Oc%yBZ9lQ(|SO$#pRimvkvt~7q**>k27M@_PI;r2NSQ~$3gCSjF<>?Sv}Bf z>IKedWu6Yt9$%~}kn$SsNOmPMjxnQlw0 z6)M|Y9D2rY)*qawz{bRcWjK#@r1=cGqILK^DgwMc(>^ihDyi$voZ;}a1}MA4dJ$Ex(GnHeElI&VD6szIiz0!@oZqZk+Gj8rVwBLsyWg*$K6+8Wq{2K1 z1p~BbE$!-(whUF0ZKdhHW&3@hgpCTH82<`VJFf(PFIbtPMlbzCtSWKs$Q6U zPeM!)wU4nF2$*o0UY%+%E;0Ml58wxp8Se!G`rNO&>}65MU=3pDZ$fQi1fk~?vL?+u z>9F?AW~o)fyQuuQTo!(+MM&F}UT5*83FTlT_Ode2MbOb?AoqOX33kn4Q-6BR7}3FR z$8xmj`8JpI4Flhq+>wk4YTL4XduDWZFHgz<{`^tYl`{DD?6th7`mpa4)rq5YE@pmo zqfG9tejiA@N#Ebc(_gQYrP?Gd&l|S2m2FJ}A{{_OWSN>)TS(0@FCvy_}M0;(>KQZ57oG#46+ z$tS)fZW2@*5GWN2L&@dE!ICH&X|Uz(3`Eqgc0+6~Y8uxZi(9{c8!Aj-uB3K*^04y| zeTao21Ku8DD-Hz&B6TU7tW59-hFz9K*Om_UD{R#E;tpF5c_9(E!^Yu?`vI8+b8E%E z`(gLq{>UM+C;&((|4Al$u0wAj2sHcq59nAu_8A2G5h0nfubUT#X#^ZB3{UXP=2wAI zVUR{T1jt*|o&OnXZ!k`K9z;p@%J079-JjFmz}iO~cyg%Gl>&mQR4}7VK0wsH`jxMG zX;$s2Q?_Ljda^@+N|>cP!&fYFL=*I5OJ+0V?wyuBqS}mf>RJHp11kh>gH^jRqYun+mBy)w3Q z9W?4}B?YFQ3j7r|(=xo-2zg)1+hO+Lx%QsWIUcp19`jnV7!U5No$e!+9)BzS+W9?% zWq`R`v1+qTU?s3wjXj#8-|F!T9$!+TJ%ZC_k6R+g^9rLh9=pXJ#wRPQCv5^p02i!Q z-l$z2DK$80);%V((q&T}bKBMCP2L7MUn?Ny6ayGd{tPYpb@DLKln|Cy273h1myoGm zMUO5t1@l=DTryW!rD_bgMl)`{lr3w`Q#-z;^VrO$EtOhmOR`9_ya=^aJi)0AHeODy zEmFapqAZkxvgb$gMfuZmJCk5OxLx7=N;q}eVZf^qsjaDrN zKP7jMbJ5}kyx?24UCHrG`u?sxORStH(o(fv(JzELZf0Wl+!xhVv(P+~hyOl{(^luc zBJw$-t?8EkOo+lE`^f{3o{O(|diiANi($aAmF?8y;)(tj?(SoOphq3h5>fN>k!vg7 z_N8ro*_tggt%HluTBENa&kk#SgImH_)s{qhjwZgnY@kHv2s)K_Z|_gy&-Y)Tj=6YE zweJ83Whm^~Laz8-9 z7H!JvI1RCh@z#!aPk&TJ(@6!Dbh4bzoE}hYmZOey0!f=irl?PL7e6t z5%K+LQ2J#G>1b0(aY%duY;n2yp0zV8aKMo6Vq*`4xbgXF3(%<>kuJRKBC0Pru{~3CY9gVvO1ry)qQE-kxQrqpRjEt&9Uym$O1VW7)Ze^o(*f zGj;g*IE`0EsT>cvt_-UQT-Gb?hWSc~g(i%Dicl+6#H_@Fs@5bCSdMW$cUV@Rp|Wnr z+Q=E2_px_gep_g{C7SKqyr>o*El_;yD4L>#?@LoVdpj|w{otjDpvkvsT%Dw14gp&I ztL{5G_1N&J0Y#3pl!K9}A!$EWDLF2?!K9KVc`W6R^ah6rjAZE#ZvUtL>qy`N}hnALy`=6>y`Z?_40*RTEpfX09H7{)1H+0R| zHvC6*KO@Q>kSm@L>Fzf?@nAd*{@nR~AwE(k>B@A=mfd}JSx*E_i+$;XymRqdFF?K0 z=%}vb3U#x5@}p*Xu*J!Y7XMmzeoF*O6+A0%3M(&zQN1o*XeG=eGc;Ko&<4ofb`e)| zM$%flu9}VMN~7T*22f@c-nAvzkNlqBX<`ckHaGv|>5{0okyLOt4^`~O%jG2{OHU3; zuHiBZ|G_*~$AtkY0;Wonr^)t_NQcTxJzr!uM3KbM zBTphI%+?Nvf3e6Y6eOewaMkCP!weIpr24& zKhFi7$ZER7HnKp?v+h!7+9VpVQGCJVNrY)sFGW`om?Gr&i{=lmj(FGaZ|MTrz^u~+ z{FaBAg9YeMu>^_76UH)-c?~h(Xv$*lEjSbWn#cS1#6$ELU47dw7jx4DS0U)?YM}dz z(6T@>g%{@L^)dUC{=8w9xg$0f0rYWG#k5F_W}DXC-PR2OWrRWc8j69{4* z*8JyVa>qqehQH4_@@Hr}Z3zxmxfEXf(5Zg`@sUR%eu{t?hQB6#cXf(7KmT6iw&D9~ zO-IL6zKu5`biI26SYR_bh-UD3!6f(`sj}KV|vx1+}Qt_{v?+ zkj%TAg|gg9F-D=b;_A%aq91Uu3`)jdA-?Y9EEig9`Bny0j%j;Tq4<3-ImWI`=IT(O z+WFuCL|?I9f&ZXQkWgEE?xZZ~gN5uq*S7h%mALNI?)mvt^BEzP)P?MfRMQkqx0B<( zHJJNjv2>J*sag3mo-6^&D#Ca_8S<=nlS`k20&QPZa`1{8_upe{JMKMJx40LNWRs~SutB)S)ddB zw@+yvO+f927jNID9z9@lePWn^9r)7w#|sZmyW2Y)P{@5BFE(0?W5SCV)DR@CWj>1? zo5$(#E6;Z0_p2&A7$~;lk*7Lti<#PF@y9L3%OX*WEv>vLb5h;Hfxs(5^)YvyYs^6( zhv3ef0a}wJeZLf7fYvY5%`G1}4VH>WFHf{4*8qU1RXJMj5Dn&4aHPL|M$bR3?Ko-} zepCG^odF{<&v9xF<_O;=@K~!Y=wz8rTWEJ%u}yJ|A43nfm?0B6_1UK`J|)Npn8x+h zwo`XspV7$zmB;jfOl&vkif+v=9yKMs`9u$Ei&_udfMXixvT?(8Dc|Gv_MLtmgK!RA zOQW_J6PLd2+rGh+JXQOxRxSDMg2N_9U%i=aaf%`q7jw$nDs~DHckaK&x29BxxvQ_5 ztzqbXltdkE4nd9!Rvm;PqRwBy|6Jyfh1%#V{#(m>Q{Kwe(vnYWSWF{?eLW1nq6;C#M;AkZ1A@U??6kDMCy&nY&i-AMv2Mh zDU0z09rmj_Wl7I$VQY=~;SoH%Wd^3)+YHl}JLPGYF6F{bZx?EQ9X1lsdFzroeQ&s< zWB4}Dff({JMtsj`>2c_L0~h7)uIU}}!MMb8GW7nUC1Ye)jS^NKruW-haK{F7g?^YUyg8`!+P~#%Rp8PKTrg*_Ps*85HirI8<15 z&CLSP)a5&l-OCeps-w?^S|jRGC=&2*hV*(ZxV0M4JbDIEEXuU(eyHl3wRoMocl?Bd^CD4$Iu9Lc7I;Mjo-xL^9R5Av7Mb_ z!)I*v*PO;NHj}7N9sb(_`@3C53bDn~2j-DP^ z=6*E$HxnXczKn6a^yR@yzzQjbZYQi80~nWA1sKoVj2AD!zO$EyC*P4Gm5U|R^uF}R zl45b~QeIA^(xYl#Gx_^{Ws~<4$CpvAeUySuMarK=VCiqkJNv&Yez~m9aYy@0>d?x- zm^nU`V1!Ha!!H(+gFhS$1*3A*`M)TC6D?(G*k2j7W(@RQ2*dY$a>UU?RC_CY(ru>3b3f_n%iE(oQ9yE|uoc8n!Y@s9MZ>fF=0J!030q)2&0^h`f>C%%J`AJ zn%S!H#FJ8)2#+alGHaS2r(?TFV=Vlu#=fm#=#;%MoePo#Jd* zb1*V!E4}$H`V=JG%Za!yB&C13r85up=qq#z&%&{4eeL zAF3ch$5N-f(E_cd+;}RALv^?8x1MT5Ii(h^C-7(s)CAPU?XZuJdgAI~;Z)jqAJ1Y^ z#B#a(wXswMo005X6RXwSc;o($!mvZx)lm)-Mz(POmdw<*SOclSv1$+Kkr7RmV%2H~ zh4~PqyO&ggKOM`9NIZvv^S2J`Xy*jxL*Z2V;^F<72{q>NF zqh~VMdtC3Ob+4&bGi3v5x2f>SdawXZ?n2;4w~Rc2jE5eIHe2uH!P#V1*BQ=n?8CZ>HHfyjz0D z4i#79bdEMo50lG7e^`mEoe(^?{&2h|C2Ve4u`a2`2uIKEiBf6Lw(*vR8NMNZwAw5v zvh|gqR49Dv)y3a|@Mlc)!lh3*HG0FfrQo)qEcpsvCvz}pn0G`r%mG0@C8`%ed$uF& z$5EaN#;jtODdINbqk^ewym>I z3)x5^B$A@VrTChg;LhdLYpOSxVM68M#1~G){A%uhVIRb6otg*<%>-TCzaB8vJ;VNo0q1{rKcPDtZ+@Da}evr%LDEOr2?3 zeD|qZYR($LJM-kvs7^LGPPn#v~5J4Kia4S1orp8F$wFF>W1A-bXtxo zoWaxG6HDbM{#Woqn06ZyzrSQ0C_WMJVQfnTMVzcY#{+h34vRC>58TL#SMvgmb3PNM zJ;u;&y8T`393=c41leWv5)B-Xo+Av>sUOm{eA9RD=#o-M_$8fxTL-nfHDG!@VOV80 zV;`P%AX62)xo$3$G2UwbA*$HNxlHO@YNqe9Jap^+Ehrp&udEx%eyTNv*`R>E2PfUv z0dFe}EgOGd{MFrKy;-;9$CGaV${OrF`k}E`{zNg&3ho;rGj**TSfj4}2GPM9xuvCp6^C(-u1IAL_pKk)&hNKsaQBqlo;7*wx}xkG zsGEO4gM6>DwqnH|VQVpkt;6?*SNns3H(*8G9c5`b+}98yA9Jo6 z{tYjpe`E;~C5GwdC9UF!gSbEGsdEjOnv6DI{Ur?S$9Nb}c<-04mi(�I(jjNcmN# zzM-PZn#otsUR-o5px0z2p-y&3N87YJYXU}QIDgBZ=HqrFm%;u za}zvQ19bNi)$@(smhCPTBahh}%@M>8wn}@Rdn)A^Selt}TRCrPe*VtD7V$8&v|^gg ziW7VT%t9Zq1~Z%ShwvKfsQ7z%dcqK4f6KcT2e-KmH;B32kDRy-W-fADj@(5^`QKuG zkM%O06$2GB%ZLuBh_j2j4#c{bwYUhT6c^!^A3> zmbUVnWhTiff&0CFDF+?@zJazAgQ?rBJRciI>RM=4$fBPfyKzTCaH7a5F0DSL0bz4W% z#{^G~?wAeO8n9vlkEz<3dI~GMAEzJ`nYbT>#2dvlSMH9Pg;zZ-EsxLiw3__pFZs<| zt*yLkYrdPwfZB%cjpr%_>ge?q&Zpw4Rr8i(ZvCSvNlA30Y)!wCoZt5QnBMCaEmFyU z7n^f#2%xAywSV<*z7POwUUKl&|`t15)AF+B8aonYHz@cTILCNgYFpQcwARxBJ`PZB< zVG`#V(R!Ft1=ICyU~4{aJP}H2LDu)dE%9IwrEX!??aeGKU}!Q`O+p7l*zgPi95efm z8oHZxUoP7#d~^Lu52;M4eqTzv781&`7V;b}u`KaSkKOr*+dYiLUolB1PWni1@H#XE zQRSG%K;ips({YX{1Iwyo2VR7T&^FU%A;OJ~E(krT)MzFva>X5ZhU$CgTaR~9tNZ2_ z7I)Bj5fwv)VKb@i+W0+34ktk?Vhog8)sD(4`51ccn`Dq6eh81%*b*(@>vUPFe@k`3 z#IMKtA$lf-CX(Z|RWFy1KY^`bn!EshPxQJwNSf=c|-0H z`g2is1T1-XM{I+mPl4jNr9t>0FYqREQx}zYIwKADzmet1F{hh2>xK@)w3D)OU$I>j zq44;Ft<;t50cUh{xU%$gWQ`SsJ05i+x3gyowcej3U$BCZhafjBYk`Ne-B;xkK` z(JZWa&4iHswH_Iv5F}Zg$5;5gtnR|?DFyf>kwwaa+qU5AL(3|8hd@3jRb{~yW`?9r-i*vAN!T9n_#q7$ zQY_kee7rZxnV*aNE`ocWJ)n%72E*!%TQrVzQ4@8Tr@b7JQW*0p^&YqEY z5<^J782gCS>l6E>BER1-=S@j#Mn~b%@$N4#Uq`xz>0<<>KDSq0R}c9wIUfYh&jjcm zC91I}a={`nL$E86>#bHF^=n_3P68!l*HJv;l-iMs2}2iY`yQuJP%4moVg|Gsn{2MQ zj#+^8S4+p;uX?2%b(jNM34+x~RjYS1G<6Jx*SrWy9Kckuiv3xRd0rlvldB~Ulr)F-d8n8T&K_{EA9!D7IyA^2wf}T-NANez|4%fW+$wX z;M|)4L)}_*J;o8+q@;hR!p;^{R8*w=ruX8967g!a%Pn>g^vUJ|kmh}7Cm|${4lMGP zY*!NEZ8cLFryNp{F_f|%XQ9A?#^Tn2j)6gldcK34%dYmtyG}7HQFqMb3=9lr{gZbe z-hko)Oq0pq2dBwCke|EPn~$cU*iz2nV`Q>lE~@zrZB+JDg9g{8?VEq0NfJ$P2{GFJ z&AigLaRV+3T{6wLu9XDkt9{za@|CjYihVY#a2EFEvC3fy!{H*g=tx25FQq?%1RetY z)u@nv7bDn^V(B*_o(lCL?OLCY3rxCOfUrFHu@jisov(k4m2cfG>3DOw!g({sPhr6n zmvvnBZ4Q&JjmGu}OTHCKm>Zlapy#{H?X;$6zi7_?(_xaq6j@?~Z2Ph_tJ-1&T-)Ga z3i8enu+?t(%4WQ+n8=M#I#*uv0X_7<#n%KBmf{b|iE&SwtBwNHD@_agwGUXp^_Tf|B?g+egr|J8;`i7@mqFO;=AqC7kM%b-MSZf${ zqedcuF9IEwM*D{RXOc86(#tej8*bI;M4{BCJ$*#q{iX$9=)Q>Mz;Je3`(^&gglld` zt0I;;r87~VKk@MLmVdYTT0`JI_i`pB+7g%4zAW6&Y8T~E zem8oR#}VaLY}7q88|T{g<0{D9gQmU@QCL-QW-G7}cP1QZigyXEmNmri+sjz-Q3Otr zfhjP>6?f)QEV2=7cc>2s8oX7ybegqJmUU0rmW6Qt%|(kQynq6bSmS&%8${6LX*nyj zVcRfxdUB{e?eP_bo1{TRQ2a%Gq#_-MVp1k?&O9n2O3>`jlFw3KDZWP)TX3zKP4+(}k3HUR*y@T$*v# zP1Pl%(dNZ>@q}ypH#aI-e1Ng;0p_V+LW?LbmL4`ax}8!!V!zfPfZ7K)hi6)?e>3>% zigu>DM>S-vUgs}(*I@=%?^5p``(81udPFzRaXQKI)^AWLgpz<2QVeJ|y2L`e8%7W7Eh1qMH%IRY%ht(KMItx45EqbsQIcMUFo0_nxoX$T;q1I&Ex;7eP&n z9H%Qp%SH1z?@mp=J>7ge(`x0OPj*Gos!6NrWE&C9TRAT`7LneCv-kM~2zg>3Df+l8 zF)rpC$=OWVMK%b43PK7Jsgps^;GA8tDzd^2x*s31FrELG&Qj}Z%w zHif(wXq~4Ru$D|S=2v`UPDc1_m+!NkmasVAVk4NHssfN8N~h9=(HWIzo62Xm_DD(n zj$uxzk^c``+mp@s_?(nmKHKIHTO;>LDhC?K`DqPtre~5HEELuiGa)aZ$sPB&K zHRkAOaa6jA9?>~7*IDD{Y&cS4Z8Ub|ymLq@)PlY&0F7rP2Rl0SQXWP=1!~3-X{{@E zJWs!2I|{Dp9a_cJ`r?;!FeDR6VGW<*uYaj(_%NUsvd?V30@xOn8Mx~edYuql(1~R3 zd4Ar@3E(re1N-^Te#vp7dod}@HsltX4>A)4U~AcV5M)gWd?s#i@#)2Y|)NcEvn6DtL}vBKXtGZ(<3Fe;ogoWYFmNv`_t+sCU<#{&{a)|sNxx8)*| zW|9M{Q?r#ZWi{eV@f;|vG7K7xfp^>>7QrKJ;XRLa@kO#!mXnp{8z+U#-MP+MzZcm# zIc+4;&>*_ey}c)~j{KVG5Tu>0zip(Y0hK{YMfj{`q0fTp9qP`EgpNz(UY~L(iVA*% z1ex;9GFPjOvT-zY$IJP*?CT6hiavn=erDjnIuk&BOV%1E^e@p9iB?CnyrhJ(M55Ul zL>$T5cD{nR3U2?P&KKM}H+qRBRFf=h^FGn7*-!W2mo#I;V^d>qwk&1@3$9+Mdv4a3 zbq8cW&2!dAd)9!1vgri)?|W-K}}GgJN{vE>C9XSJP^7iEL)quZ(|X4fWavx41u z9t|_(+e|mfFOS?^hP&+I2X1Cj&91clAjbFscl{Qz)Q@rgz!eGN;G(wGFtRn~($w_p z7X7WcPNVT^FLv)wfyv3qy_5nDElVPL!8o#gP$%T%i%(Tn{G{kALaNwK0&*$k(Y;s) zqB^XRI_GS=k590F5g+Trj~+laAd~;~@;cRBx*xmsdHSi;#w8m-Ng>0phjsDyCm`M44(vN2kph7ZYYz{|uN%3PkZ>Ig4^sAWn(uGDXYltah-U`u*WHk+29f&gfcLD4eOrMbENBVX-B zYMz$nRGr&*?nJgm>)Is>Rx%y4>mpkW72^2}7#tdD1xnXvMMScD})qM#K(J80%>Uf31FyAuT?W~EM?$|OxR@8~f0U046> z6@Buh;H%$UYGK`L|E8UL?l#=$Wo^Osi%T^|T-#B%@>Sn9H&B;SGlU?gu;GfdEAyu5 zHzhYqhi-&0MIRhs^=EzhG-k%$FgFvzwXXqCqs>+!oQcr-9T2qe+<#3!GdebANsp`h zk=c2^ELy|^`Sy0i-5|A<=EbM3uF;N5IYooTR#oWn(?&u9`ZZ8){Te3@4zlcQ3!X1J z1Z4gSR_Jlqf~QA#QTE<~Bx`(fp}7??L&FmK9*u&BS=3$}O?N>#sYOLid%9w0p;vjd z{JD#N3j@G{jJ78u&Jk36HlHJTmT?hrT7G)%$9ePf#Uc(%C4*lKWtA$G3?I9v9Gjd4 z_pG0;%`z_=;nx~MyAU?Nt01jM^N9I3LF6-}ya$79i2X=4KV6CEG|R~x7dKTS!F9Z z6!)IReDH?tX?Y#fG|Yin0M*F5OupacMB0et%|ANCw2PpmJIDnc?vf8G9Fms5m=No( z@(@w8o9oa=Po7tpM^$-vI8q|~APg2GC5^WM+%$84#q_S0XO*@quD)G4INh18y|YPD zO<(VE=G}tInLNVpXmdYHlWR#oftlO;hpSBcn{hX2#+$`o+x$E921p|#))SCo>6CZnYG>Kt7ROfu%R=|OZ1Ek<{CdfWZZE?x{DhT=eaO&zI;oGWIUi^I_j(Hb zR@;EU0bKHA6pR!ak-nI^4O)JIXrpw4Ye@El{_R`kM&!-&8F>=O=gI` zLWzfERJC$i-Tyh$`(^q@#nQ$8Y{z~OvX+O7hu5!J?|O^ia>}ohNmdtwD_t6t$%T)% zxWDR`EPlH08`a3Okn~~z%w7p->rYo|!QI-G^G!bE{71+9;lgp*7X||-zbA_dQx{`6 z-oS|5!Y73oGW=p=)cW2IEb~W@;fpjj%ci{Y_Yk{@8VT2nE1N4C2U@v$$ntPM zS5`IQ*&Jn$?;MNd!wLk4A~4dFfa(b8TTIBB;QY3r&8z)xFJk!PUO|6;2&g*q# zt&JgJZlQ5)l^?P!ZK-U}Fv2nE7bb?p)YItrgNW;L*Uq>E&)+ZswxN3Crvfb)_lRj*`d#m+&wtM?s=W@2ZcS(fXHU$j!^>2q)i{qA1q@so ziu{;dR>luV`6qO+$pZl7OzddiY33Vc)@BVR}ez#rW{!c#c9WzafwLz(6|69P=wS9Q4uL&QxQ1<&|!s)G!!h7?a-> zsC?`LD8k^5Fozo1pslbu@AQU)43yIF&EcM=&aQ^qr3|gvcWJ3Y&(mi%^A?(S5+Egz zQrS-9=Tc9w9}@$$)XhEKvP8y5o?jQt)B@auuHQ?z1)ch@VdC7wYKe*RA<2pS;19#Y z?2$V=Q|-F~#R*Udp&y>t(9pG%B6+*(JO^V78&W7D_Fv{lJRM{yqI;|4#YEy~FvQYH z#Y*4e9^KkBSI4Ww3|r6Ko9D^&V<^=HT(+L09Tp-5y90=smL(?37cw#*#tTfbf~&7~Hjk(JnCDI0qwN;MbRxJ#%(a zP-NFi#mZQ8h43C)zvIpN4}R`CVK{JfSBl(67Jx2e_|2_r=wF)03A{Smpv9R~RqpS{ zAw(xbL&yt>b85#oKMc>GS^I>SNB%SnXOAAD%V-!GzE}oaoUT!b>|zV-fEHXl^$EDO zN0nBav9xRRx4G3VG>wLDeg4`K$I!X?ETMjBq_i2xTROBkz?8hLh2C!M*$o3QQcD#& za3&XfeTiZrYGtUf`2lg2mJ-O!d#r`c8U`&J(r*NMDlFg$r!8*srSeg$Hgqo>V?HZHc6*?h}$EIig-eL6Im1~ zDDJNE9IKRJ%vaY8dCmf;Ui!m6IW0YX(0r(%aa6m)>AmB~3K+84GT%MXmKgrSX4=Q5 zDf9-&06N?H(Up&84lC<^eUDcpYZBDP`Q7gGPJqQNKn5xV(TAU65nOxb<5sy9o^SIk zH}^V8xTmGZb_TF8y3O<#cgs@g?|q_3IQ9|OOOy3!efgUSx;E^W5{vyEzFugDcKrb$5-*0Ublm}^Q4O|wT<~|*+6TfUa3o)TSE){2?g4JF z11NZgdwP3I6YJ|G^PM*XT*{xR7AHG=yn&cj%sS{p>9#VN69+FeYLHa$8GFHnE$uyr z-U1YoM)(^Al6)~_efDvqW)h&l9I5JA+ezI2Ff_1mP&DlO`bDNpvRX|#v+fBxq|#$= zEvuO^K3p<>9sCeK_dGRNUSVhul?kWoZVdNq`+n-vdP6(lvsmq*NaiLg15$RaP)0~R zqCs|>MRAvuP2*#MabK3Y+12}$5h*oQ_4SP4f&ojh!q52KhDsNPB#;WL!ZR6}q^@zQ z!n-jhW)_

11GZ()!&yyzyM1m&Hy+GKf+ilnZ8ZIJ8Ri;yg}#dQ#Xq#01j&dwQM) zQ3=f47&bFAYwb$zcd-B+5mq4m`!T(p2*^{TlOs&|x2_94Caf;QOZ(bLcw{*~E?!~m z&`87J^9JV;iqr!f+&xeLh?L(ojI*I%>-bdL0^rF*Tibk|?IoaXHJ|$02)-;@OClgH zi3QoQoQ-{3_il756ZCc2?Sad`HD;_6MVa0?Q`^=5C53>kAo>bk`+Aq_<)Ukp`%ak} z;wlH1t`kSkt8>r|Mm_4%!UDUGwyIhEBR!@;)Moz4FBE3g0ot|Z{m?8lO?@|eF zm8zu#h2Uw4T+l?M#F`ayuX(*pZpUf#RY@C()(NLU{Y7s0-mM5QJt$GV^1yj@#~X9A z)f3~q7P7K(6kM`26eqFDYF@YPjfp3Bdg7nIAVHoAJD-dKf&{TZWvmjX^{1}SUQqM) zMd-K;#@w~8(OwKjr~FB;8%ncU^rxF<`TdW8bW>l#9fuT6CjvsMe}=>$|2WQY2&o;m zI7PHwaDlBCF0T3TUMxQBA2`dPGtROEO)>oklF>(7v;Ja3_B9ByBpdsO*PmaiV|WCX zP)rK=MC&d*4`8u#65*P8lQ@g?Puh3Wla*+t+85UI%N>@vHsZ$!G%T`fk`pDzyW6-1 z$E(>1o*(V48%=)0(ZSoV-B<5FIW%;+6H*KGUe+r=;ElLj@-D|sbv^0IBTiEqPO*Z6%n?SQ15)0O z*|uayLnKj8RyKfW-#=F|k(cLoPqeVxWr(N=Qzu1xtN>HQXCRAQMrc15F6#~V=XkD# zdxV*rS~MIpMqmP>d6(Yi^;o|x%3}bdY>@Yi`->r zD}H_IM~0RKY%MH6@c2(G^V%RxYFF7u*_~^QSC^izAbyf?SG$NLo4x-Z0o8iPEe{+q^4L?YK3^$(w^i#P|`1 zsNU6}#m;(f4VLfb>YTVbztfZVFPXHoH}4{MV)SPR{sOKO;RV86LO)P=k6-^b$;Q*g ziUaYXxz2IRy(z^k`Ye|=uln|=Q5s2a-RK_a{U7>nbZo-Cmmnqg_R{zxHEcD*O)pP` z`P@ADALkqDBMM>+E|nL@8}EjXKo^8byO#Z+Ycnl~sTT_qe)*nUVk?8lm|T?y?o}^^ z)J$y?VKUd!Wgv!c0d$#Gr~vF+a*8U2|1@Ye9?L5PQYsOUDN{tgP#UsQYP9|WPE@}8 zhv1mrqNf+|DW5lRwi4+iUXQSdJ2;FMMqCpBV<|tx+=SFV z$CJ%O3y<$tNAzPQT4O;r4#rbW3D@igcFi~3{r->D5tY}^$U9ZB0n*LJ%!YwKS)Aw! zG~;1)1Up36#pEqV%=)K{5k|7b;vGby_;^U)(8@XqE8KW6XGv5*VjNFEJ3FG)!)v8+ zJqOG`TN!=?Ci|@19o5nf2*x;%b=PZnA8&Tqx+FDF@FIRR$Zn^s_e28Bc;Jut@C3=dnGN1*cCN*Q%Z=fuU zJBc%KMH9?w3p?^to9i+42Ivww>?XA7;W>1V1((%V%c07OYy0U}q40<$`r#>Z?aTk* zr3jhNdGWi#Ez8DXm@l-s$N=H;Ix6UoHxs>y{TNUw9k4y6{zsUi8aeyV07X$F3Pm!R zPmjAyV#6T1qeNR<1LU3jiuOc=>*JAarWAGCt#8HB-JtF<{0vlCk0m{}EkPGd(g0 zZqLqM`(bOygS~fjXZkNN@%X$K3(=ZkaJ6G2?)>AK%e}7$Z(o&GSa=WKdh`3b;NsErp7}!0g%isk89!a@$RqRv^ErXk@97tk z^1)kEKHn62X~*esf*;9@C~d0{tEd#n@DO>X7~mM1`0ITw8$Uoaw^^G zLjA08C$YS&(WH99?~^cAE0zF-ZWXJPcflvJTx6DM?jW{p3Ru#b^VElkiuT=lB)*0N ziXW)P49C1j3tXK)ttsEZ*?ZPUwY;1%dh*YYSxT6eoqgxdPSwf>aFQd!o?ZI`xUW;9 z*OY`GNb{|Ui)Qi%#Ydwp%cLpP^|eDxOutN)K~h{O+`#psW1DkOIOa+%5vd8sU`i~@ zU76NQ0-z<45iKspR{%moXBQ=}1OWFjyV2nF%Mp?V#~fTR40c_q2s-FZh}Pd`@LTv572_e{>-%svl^+WyG&H?etniH!gG#?G~P)k4y;vY}-!4 zzTZlWo~rL_AJK=fixayWTJ@ z(^Gj(XiE8HB@C=3V*44-pS4V2h5UlhIcr903qAe)(Gmfq4%76A!#F@KbHFGTw+c(q zGS195tmvbo54DS4%taRoWrZ*_H)(ImV+U@_GouZ%8iIFm|G3w1b%zw~h%Bobo4M}o zAFiaDlC0gpfNf}hp+(~7LFgz5EnfY#RDV5+>*ZWAA=qNCU*Tls3iC*}&;9CD`rN-h z=SO=a4p*q~+uT&y)n)^+Mt#}~-%WEHMoH=J@C+F^t2`j;BQ?0b_evBSqUeq)8|oXf zNQ~P_NJgveIfh?i0MR9;c~>Q`sFAwh1-CLRdBcT4l_D>``2_o0 zjHjg|Rmz#xfM2v#Dlj+V^SOd5Js|Z;&&32H9#GrEC??7gglz1h{y#w8lmFBY=3eaMxt7CVdM>=0cultN>UUG>nX8QZ)eQarEAL>(3xqee|;&cvBWA{V7? zuo}V7RYcXUJEk90e6HB>@)3Ox!~yrK)uz}~lUJtg|9{2E|LXz5Tqwk0Cwm5gT^i?y z)3+(2*Uw%Yf7mDE6V7*( ztq9HdruvJ2IAnmPMwf9-)lFvpk}Y0Fhw1)yVVDZT6JyuL*SQ~*n?E63e>ga{*(UXTh zO?`KdgBIp$KvuSWNB44OcTd~x_<-IbK-rReX%&^8xEmEOC>l0^;{_vE9SF(@oS;P? zt1AM9U6MCEX8+rr1=aBaA`poQKXKq(yMi4W>UmORntJBSNctFN(ftXGICDyyMX7?L zOcG1oUT1xeXsJAjbAU>^tMk1x-O_)tzd&gs?dZ*7SD=jUT(P)a8C)b!!ff)d-M&8q z0Fd$sIxZH^=?CMIdF9ow;2EAJasPItt^Su)M<3~VjeZ`PS3;vt7PL1F^Y|7VKhQeW zJ%t#4l1w$EB{VEw;Awqk&*GxHiIXX0nm$9PK~gPY-nJT_bH3=qS&USZJ}k7UXW^hf zlZlT11r+}l8vk@H5d8_9^k<;gV}q#EdljOxl4j8Ao399c$?{MsQz)Wt;dbHgo*vKw zIIQ8DzF(uh{rL;}K>vd)cO3gKT{-Xs(gHMrwGD#F1o(?iO%!7$&7aH+fnfxODzmuKCr7_qj-t{rf3NAaa@`>)|4XR&R1#ACGB z%31$^G6gZ>jJWA&%Rfs(}82+@$~lh|8fJ+aeQ0BomOK@n^1yqia=k1oek{$Rdci`9PItzwUIXuMNf48*S%+{s?iu_AtBdS*yiWQ z{MAb*!I&_tRNjde)G{W#rY@C{p&|&A`FtX<$;qgR9=F;%yJ7o%KezhSI8^> zcnq&w(4~9QxO# zGZ$FL2d{D(dpw1F=4hJLXf_+4V~M$ z4V{fI*Ozp4{Z}OopPl{FM}yEQxz|U=b?OoPTme3BIHjTRbs$>HT~(mph^w%snbhHQ z@OTm*>A?hB^D%rN^am&YZPy;Tp;06%ire7#r*CAd1HKzmqonDPvJw1mhV_HSGPSBB z=(0t(uTmK0NnP)GI!+q#^WnX|5YD~Jt+KFSSfs$v6~u&Z%;XmpwfXNpQy6fJXBZ~3 z3zfOfeJFMlPiih@gOT7r6V`LkvJ2pxj~Y-#V*cJqPP*$}L*k3m;&6++H{Sp+v#9gl zH|Me~$6y~cD5-fUCi>U6UnY9@+{}XE@;a!Yrg|cZa@r&=NLHv#>LLq9X~ty(e8hgg z)Ss|SaQ)|Kf)+$DzX={zpb<#&>r*cox`c-LCTNV2GlS2n0>}Z$s z7Ri)O$7pr?zEz5)CgzwPL6-!6LH3LM4_Nx$=dUh!R+XAF`>I&n?< zHqs^)*w^&y_&L|o^+cYtWe*J&y^)BX5fI_2kOXcu8L;vXJry$A=kdsLX{#Xg*>kK0 zXKvIyI{K=?9W$)|Pz|3w#5-#6();U4cYg0A;oJw$OOvX~%8T+m0r!akNT9xq z>ny#A!%9&9RtOK=1Nd`^g)lPlO)V_g7H+}T>ZGcrwki`Xw*_P9#+%Pyllw!5{^cJ% zMSB5^S1Xil|MvS+W*V=%5)*)Tt*zu}}+ zF}SL8Z?fQOAm%?B5SsW2`=S*18x4BNFeThmYH|x?haf2(F2nY0JS9}lmX28f{3@7P zG=ROg6mfBif_7t>P$>qunSgH7Tcm$1;P0pY2Kv-D$#Ba5{*)!wlV}ax5i>MA)WlB$ zg{!Zdi6g}szz_P?KcC^++w5*EK7_Fqmj1|T7V-Trzxnfui^d**5u*?>X5KT@AO-;eNUQhwYx z^x}?A7u+Slv;BPCPgnC8jA#PuMi2fl)*2N0T(N!eVZG#Jn}A$2=kWe>OVgHNGW>u2 zuHR2Ec^@nWywCgn??cy73GzGER(6|CV!p67;hDat3=~qxNsg*pu9=PJO?3`9A0f%1BNG#b;om%uw+BJ_#R3 zFF=q>@R9(}V4=U3;qTA=4s9T%+(~~t>{&5Km)LZ_(Es|l>A+2+d5&Q1YWs6MCKp6_nBNPerjptv}?{{M0I z)=^b%UE8=KDuM_bB$SdaVIwIm-7O)F(k$f)NaL)6d z=e*xzcyBWAslA@c}{e=FP9)kO4gS?md6bn{|8k`2$#v zhuZ!s`22v2d(^9j=pv*}pnm;#uj=4y__9~}5oFtzpPvuzLd9OTfDa0ORpWNiVOBP= zm|JExrq2o>Q_PH@dd&)27dDs4F1upZfRUSe;Qdz=yZQQ5`0zD)=STVX8w7zjFtzcw zh622tb2HL$;oc1W_1SI=fNxbESj}0c+;u{5LJm)DYkJV|SUVDU-6s>col9pa;8~F{ zpp79KVwB{D^#P_uXG{D8 z*Pk|n3?#y|W>jYXu9NBlY8MnQady02qSk)F^Mf#sWtjY6lwy}(63sfxoUCC!CpN8n*wf|?nd~ZvH0)EF6#y?sIBH+;EgGKSOtZ( zy#2L=Xb+1O+XM5)tR!xQ(@?F=0=I4Lysh*_{jIn^X;`l~z~A=DQJX$NfYtA=yG?>` zYa+Fv^7}3d_D|@r?wWw0F^P(?g+;eg4$US|Wlki74~dKeVvoP{CrOO6K#d*_fa^56 zOjOX)vM{e$p|GfePqhanBd*V1NI5D&@096#1E_*Pj{z?quY0Tmc?=4yKhp2Egs8Gy_Secz`FTD946G z2u`jIWJSYqw!Pet=iCSV3U9pS#ZW7Z^e3wv7yW5-8KUVm7-e`birE3!%~b#N7aOc6 z2;TBE&*?>7SIl#Ye8Oz_Idsn29q3=gM@2>147}B#fFNp}jSf}303wFH=Q|)Dq#|LzOKz9z19P3^`m&AU-Nc)~5Vq&j(#4-_T zfIY`eI3JRgkpGe048VDHrM)FTC_*eJ*hM_G-Mdk za4jxQ}kb+Rtt_#KsyN4Dp)U0-WtM|D$@O-Nmu5`JVhR z1~c)HB*N?b=LHjM1gNmn5Ar+^4?-Bm;YKz==z;|Z?3Od%1*~PBJ zwbNmkYo(E?spP5*Bi!F%Qb;m1_@G_0d73Z9uQ14E5kFZa(u>X40gS8ldj)R*M5UjoZAGh5e(3rI=Fp5gfg zQd&cD<>}7^NVwWU8w$4=b3%fd;v?s*g+wWvad`o|+$akel8H#3+d~el*y;zOFn-%xbK?R(e;qV!Kk4Ai&Z)YEmCN|&RyuYmkE5T8y_~eOhM+U$(EGjV};Ab!2?KDHFh?w zYkQI?mhHVY-HJ^>t1iDd9GftMJkC`qATb+wyKcQ9+L%ofb>5eJIWL&(gog5WF!>{& z*#S)vsODOo;Z0OuhJihabTcCbZFfHU>fA{^fAVP*;of$kstnSH{>Q1s%DgJq5r3Hn zek$DQfK*rVd%YtNh-B9&5x5|;VqxFyNK%pGbAQevGj$8+M3ISX-uv2|NhR6%mhbi$ zfS{;fhPa=94V@Dv7mKI>bnr@(3u1nH$Sq?G;xCsPqCjG&k!J-u93mJVe&UM;aWFdF zOTJnsff;Fze)q`B$>|iD4R^Mp>zN@7OBS^2E4E!z!jY5Rd;5{3- z(}atnMroe^=yamX0E?V0rw_a-Nq^XcrzI;x%s@Lqd%rq8UB75j_>*s#CrRzW8e0s- znPt!)H?}|Bqoy~9AmE9vwXNU2t(7up28eH(x}1<{KXj<+>QqflIZz7Gu=Vq$tmlxT zneMAXnrbXVTJsbOuEP2dLk6+o1{x8YF9(8yAKAO)2!^W_>Wbz2t%;Cs``wcH^*c|C zS6M{R7=v7<(LQeeKR~Gd}r%|%VZD-WOK@0I6~EA zzeUkZTL&?oqxU5EQl_Da)s>!fNmRPb;Y}^mFW}B(Bsqx(glFd}R+P6^*>2L&(RGP1 zh-+?B>Ak0^m&8IA=V=k%wR%{PUEq5_=I60hv6j0h7!^x$Qr`B&4UzOwI|W_U!FKChuM}vLH_x zI-3qJ_k0~+-5ROv2I#=lea;krCs4!#{O{7y?eaPf4y?cz3V$M9^1kg62Qi zN=Rg}TOS4ny|rp_u8mc-pZA3velLHK>yYef=(aw*(@&!bOHcpRk;pU_aI0^0RG)R! zCm;;aSWNUs?~jF%$#>>XIFGaNf=gEiI3s%c3g0Dy*^x24vi*vIlDS2tf$%9RMX|g-tO3$Ah z$k(K!s+EmjKofdQRx#Fq#=AZtj%%>}DIe~m zzdZZ3Fc;Je33&EzVuDek4`ueEJ9^iis>{6q@G#*n=iN-+1);@HYkAfib2QWO`XLN> z9L(mWEZombODA!}5N)RHL zizgc27v7?JnfcgEc3WwA&4@|AvI3yzQ^sB!H-TKL63Lp;&5w%`(rYC~gC6c{Z*`uT z4pgO%YObp7)pI9t@VEw<6>s5YQx0M1$&g%%flVo|r*|8->5~HV@W}xnQ|G2PkAfNI z38WjNTB~1wi0wxq#7S^^Z7TZ>=wZMqOiWhuqVG2Z!%30?!x%dyTvtv7{c0&wTY%H# zQ0BB-XINvZn!@^2HenZU-?$@y#yuZA9Qlcl6&|%5PZpwW4aE)*^4zP>?0=P8FLjWH zaE00AWpzYQE3D&~VE;6Z75vgPy2MeMayTW%Hg5T`UH@I$LBUNfbdx5@@_=<|YfehK ziP+!46dsTyO%fxz#NIF2uW0;O{1*9mmmSQ5&qd&AU824BI@!Ber%C-}-*JP*Z?1j* zIGe>}XkqTh>=?FuZ3f!syZ&6aBCq880KTX*v|Xfpr8?h)XGmD+3B$9UTD8&5V%WaQ z%U059Ok^^od3Zg6}1>cc;YAQECZDgcX%HEFq;UUv# ziN>|)R)~=ivVVU)(($~gCL}@(qb?4KXyJGiBshEWS|>o*?Z*Te-h{Ng@@$v( zgh7(yFM^NHH#|+}k+dKf=@Qo|P8?9vW7D|Mej{rbLye#X+*j~Bub{vSf90xrJ;*jS z*7KWF@W(=5Gt_aqZFOGXEW8c8w;^7WUVycoxtxm*ki)`zw7)RCv8)&R*g)%EGX>FQ zg=7*`?JJO8fY~K1R^z$pV6s7LLSc^?v-g|5Cw&?5pFVksDvgTi3j6&AG_qq)=AWNl zy#$|I|Gq5)8zBCd6$L;|z*}_zP$%NE@}vc^q_NU%2Ym3aoSF&je;WIk6>CGxjpT1@ zvGPUXSJE`+iLZ)BuuZ@+fEcm)uZmqZ0WWn%qM-gInv9cBv0BQW`$FHN=*5b;{NgC7 zBNb%74Muuc02=*b#TrIvwa_@#Y&DZX*SEFaNTEa^8vzh=ffzAPrunDJcwDKh4)~TT ztZu}jf8bUP0K!R*8H5eK1wkI)xB2Mw{4)-P<86_hyaY9**w^F`rrYlxuPe5gmgPQbx;s4`BYL2y8PcG zqn2&p7ZYpBo+Civ9VV08$OUPkvMbP8gUd{7_5pahHd#ggJ0ot9XsD;iaJv5m*=ekA z=X|w-F-B+t(mWYP^5hjznRqukI;yTnT?v$~Cu|Eqk>6g5q_Z`eg)FVB0qdUIJQLJ5 zJj7!QD5fzBe0umk*R%Oi*47tP!F%%S~%zTUh`$A;}a?xNDOH(V2Y}eci#Jhp; zVKtn0wnj<-qw&VX{yf{WeDJ&5;0L*zv;OIZ{;^?dj)nIlM4kmIYXJs=i8lsDgsR+$p>LW>pYE*^qkGFh=&OhD<@I0-3S6 ziAjK?W4jVl|0%8xX=Do|f7in{fX<}!-NsN}UMz>+4--nX`1rW^PRp}fPA#AB4Z*6v zHYAkxtV-ka>O9>DH6M`&%9x#koFcKw>g|&eJ{4Av6OPTnz$dolua6OURxCaT2{Jk# zJ|8*&uC$}#0Iy0%7jrwP1g*b0L_>k{7&agrDJJ z3`n&;nk>aaVDlBDjts$lW^Ll^xuX_kPdCT<*>?u9MrSAHjiPQIlSc%*U(Y{5wxtTS zSU-PNCU13q?WZ0^O{ZBkESd1KXW|j^)GDYbt!W-{0aD*t1;2W|tLP}|5559m)=2=C=jqtdN1CUSNR6~x%E>l|X_dv};P z@pO2LD@L767=90}$U%Dg+YRdtgUj<1VL_KLd3T)R|2s1{`6vh%AX}n|k1>gIjbU}L zoYk2LfL5F8cP7jTJrmp5BX`z9w2Bi}yFJ%WR2Qi0Jk`vAnzO?);Jb)Wl zz*}C^Ej%Y0?K$2%5nULqIoZ4NK`#^0g~YmgF^=5aa98%CTrq2+@g5s{b6+ZW8Itsd zM@Sz7-Y`y}zuo?_+};xJ75iLqfAVW2SD#-Vm%J=jnZb{;_Aijd&U}1(Zj~ zTcaiCziZ4yQ7>>p58}bLP{EvMym5d`Na9qb32)&&Mtw0Eo|A8wvTe4%MM~$q_t^QB zPeZBvcP&1{=c<5GrmR0l8vJG^*cf|o*e)0L&Hc&!zYCQ&$Mkz?D7e3Als2tOd!YT40X&PTo?4aW9 zXco4CbaJfJTrGlzP5%*l+!7&c1Z)-@Z9sp zJPTx(KpV=iODlMqghw3QAP-5c)$~Z?48_Y95A3$OixH%xtaQiIJ7d3&h;k#kh@+r< z*aoiK+W@PC0s;1Y{zsaI{)_^))N8|+efk}CwxByEP?kCG&qtit@vg}qYZK*G>>}A# zkzhVqbFa8Kj+FFW`&~lW)YCMHT}_G9r4{E!$>wEoH~>0>nra$_u%S}F^J$Uuk$KMI z8$a0LC$_4(_N&9PnuE#qHe7#KuUx?*7@)PPU)9f{xgURIcjwvB9K(CvCIs7)x2Ks7 zhuXAMq)WsO()@(Zb1!@i;fYhS!434F+{66vt;#*>HO=iQTCEfDzTdy6PhE~@eEN1# zyF_TP-zHZ++CalX7uVgJy4bW=4gAL~@zw`i(3in!5YiF7@zgdF*U3P30c5)~nXOxx zXIscQ?Nxz6w`LKi1hc<|#xG=H`sjGBrSm!CwcH2dgA?yN*$-xx^#dZ^? z-;l5}5qKPje_Ah@_q`42M+NDvOxptS3$bZr;~q zw-1hvCiSx495vgIDdFH8q|HlME8(>{&JW@!9LgekJeYQRNTc_&MTmhiluN%WW|PbB zyH&%lproOG7G53p_5?)-2f(4DPHN9rir4Kby+6Asg=fn5qtNuDvpFCqUjG(8(KT%!4)zTIc+N= z*=(2cZzoQONAh%8Joql;x@%v2u{NCL_tH5IX6p4T0^*rqUkn$v>6={zFf==Z;s zQBn9hB}Qpoymlzd01B>a2sxXAo(A1XAfI{BfZY3(p6CVnxn?Pv8Vgtmsm{YBZWyZu zxTlDDRasMqN`ko-#XYLn6^pyS86D0|W$@Vb;kr#glTPW?@NDX%^g~iK+65|YF;HtQ z30*(GUk`-R{Cq9zJnyo`Y3JZI0MUnyf`&@Ce?~qAyh-yV#(qp4aWX#k)$E3@$}G@y zq~#y?d1U~;90wD%%>%Hlm>cGoj5RQChm|!9;S!-~%x4&iTkzuCF8O__-KI}qSO%^m z?-1a$kwQA=FFsK?x`X-VD+1P~ z{MR)g6w&SLEB=eCQ8)~{#;G{-6dLIv69Z;8=1k)7>pmI@PKn&{yCoNV3yenK7@969 z*!9MO=!uhU5FARd#ues7BJJsF8Ab?>pkXY?E|NIw0Trwy2N{^dUNi6Iixs3f`3J|I zBoz&Z0c_n|dx6r>R&1x_fIWD@Hmg}Rlntc$rWCEhDfCJId0eRzOHUQ4-uuppk!wd|dV6 zE`6!_guXPZo$Ee8{oi7yCq@qg>G9_;yWi966S2=YT-3I0eT@v;P(QYzZj&DN-*&Dy+U`;cvuAI4!66RQdis>5w>kD7@RpSOAxR=StB~ zHX-M4flKWTSM`-3(GxkZzt}Q-n*&Z{@;*+2$TqGPLBJ^gruB{^Xf>2qlRJwyrjVGD z|5t$tuAvvOHOj#FSAhxVy1*oZ=yDj-YnAaO2E4L>eqInyDz$^x<{<%RC%97`D1}vz z5+*9Csm--1@s!c5BCSN+B=qp*~%1({$M(x29>2nb%1Y+*%$g%X3De6iGT*f3q~29$X}g z0Q**_-zrMR?EzNEf`t0L<6D+patEX_BjmzR=%=pPv2s) ztbNrt=0EH_id2qqq=KkSk`O(#WRurpW(d9t;nf@eUc(E-NNyGWIqfW0y+{^COmFcyoU_4 zv3JhUY%reskwUEfKD+hD>~vXJD-7{FC>O+E;Bq?^hki8^@`#F?clE|stOQQ7_)K8! ze$#6!8xv5uywtU5eJa{-ctX+)c*F?~AO;;PfIborH6Ev3cECL4){>`~mvcAwQ9}8w zKW)eHj-PGLY{SeVf<16k$Fume6;y;CPUp<3Yv}`rePddy%$0gC?8+B-R zx97@tZtfo;uDR*mv-3$V_kK1DZ+GvrPXH;g&f50w&2O*-8uEjMsgV&LwTSMtu0(Ew zuHkT;Ue_J9B!a`5^91>GyGXd3lpe!G5#1qs){P__@+6V@=f$D*gpEmFb73@7T7R|e`f@>Wa>4zvp%H_Qy6&Da)v*pBs-Y2S z>UeABYpZTenwl4kB7g{4r~bF`GJ2IBM`_p`KxkOTb193+QT# zf@Q&aV2WJ^u$iK@N4*lz_{E17!j%}^w&c@lKeb`@f+|rLy(>}pW?9fQ~21Adm(KZI$f6xJ#)KAl~Qf@P{Y8xQ6uKKdUpVV117?<2) z6G)9xZiO;ZAi6y1vAl!u1fJsirfahS2~h!RqAx+Ec_ybJ=B}<%2NWU=M1_z}&!dcy zp^)kOmX&s!;G-6)-i9EUzm_g#2(Sl#dN%$bQK8fvyxK7~6 zU$xAT0&OU-pRPZ!4DL2hM)I=jAJm`d7RW)J1=m&DrFjg$=SaA;DC8jUEKv6NF2uZk zW9d?Dj^m7fkX={0>dr;&DB7AYt-*L=`$yAwbhurAwg4Eo2xi zZHn_LJWv2JYWIwSh|C{Xjk*ko>I=U2rqiXEfY?cCX4KInNy~+q!dk5x8;0$g@Dhajq{PW@>0B{$!6;lMQkfmmzWgNqNnG-^Aaz`rRg}6 z^aEE+6jY57c4LEF^a&(`4(AIb`73P>WRi-{e*14QALR3}v;;=6oABmGK@INlLeVB= zCe%oLO}Jt&+NS`%Mf?qx;)CUdd(rxj)ss`-wu{SE#;Y6$M6e3;x~1~2s~+;PiaGc3#ya?$+AEK zAfh+!hUxOH@~RP22KOX?^U7e0dwQ*|21d!j~?q-w}vF9w^u!~s0kIYUuuUXhGN(zG#pV-gYy(G=%2BHqtN0HQbP(!3*NKD>+8#w)Cca(xnBpBm#A{Bk zS*4PlyK?`ZMJ91L(wSzQ|E^2*A-hz3Q1BNhRwZQJnin$dMQRC91@x^FNmXagIu)8K z4iOxE^I<)qa!Vhyl0SSBQfe(xum-fu*a$U0hYu)D{g^VAD@nwq#ib72Xa^khBP}*{ zIP_|&rilZ727#&~ePBTBw}T%zlWOmgj|*dy2Sb_9+1toW+l6W=UE5JkNQP1I5MT_D zU33o*kYs0&%}UU!f?Q~Py~>7p>~;Nf?}mu>|y z(VP{7X*t4;w0xM#dku$Z#*Xb$gf=Z|zI>JAjw2`~n#i}4_eNPS&ODG%@JvOuUR>B~ z1usaAPbO)ycNms~I`!-Psx%yC*UyxCyBjljn z=~8}EZ={oX%qAV?f+F6NBR0TX&(zDazk1bTp#|e2rXu;437@bDPGUVsoqXz zTI6*eT1}N={qZP9{VbK|e-^XBgbH|DlV;6n?Y$OE8QFPA4Hub-gDc|c%B!ReKQ=DM z%b!ictqg9DrH&HS7+j2oNn<+%M+3@u3i7u_`TZV^8pQYNuEULDqK+!(f#Q5$)(#t+<@3eA0bC4#^;COpG#(N=*Py!q=4+3 zv028-=ZPtdQkJ%Q=d5KQfLW`atSm7+ylv3a**X~dyI2)!oFtEZi4Q++-Dg1Q#gK56 z*$_k^S~J7V(~3rW1XV5k9z#P->hPuG8AIZ)@4j~Ry**C)aGxhl6!}9NfI~trOMV#M zPDb8&JXYg&IknI5?#Bjz5yp7V7+Z}0G!kr#&H_e)(#4YKQ?dHP7)&9!ZU10_emY>5 zF2zR8%vZZ)u308V=S<}FFerBTefFt^cL+N>zW;s-fS8m&bv~j(AP(OtEWT)NRwR6j zLUCTkWV?FWmI`W^jxQ}YMp?Gr&et^nW73FGrHha)9q~1_f^7RSyidRXgahVFhy#6- z{f4rhuXbsM>g2<^4^Xdnnrp#J*u5pmU)0usztdIbP*B4IE^se)dGGxb4gfDf?83jM zvoQugli^ZV5{kY;aP%0?L=>GwunYNQFDN==V}o+#`>y!W{V^ERgAhS7DyY-FCf;3B zIs9V5gXEx=HkNsj5sc4EtuwB;kIhyai!v!m!g5$S)F{Ha2@k^b9k%p~%8((+t?k>p z^={kFnz2W|4v7y12mC6cVtGXBSj(NJ!%Od=-Rn458~QjAV*_$s@xCXJgS&YW32TVn zusT+6hKGj@FA$$GID_SD>V~}qht1U@50&L9GlX4l&f9_q<(Ptkq9ZGh;K5t#=GhN# zi%=&hDJ+Wdx$VXYeB6IRw{kMDX2#99-%0wpuNwtO)Rs*-z0b@lvRGB&bXt!|+#240 zcuuz5Bt1#xuwc0(u#DY)M=QcZW>R#N2+8F6n%#U$580$u30$6F2?=2Y_?Bq8%=0x+ zD^5)G-J3^KWpQksKFm>zv(2=O#F&^HMF|*?3|F|(ouIjK z<48)7Pmhs#@}G!UkCGKzHl%uKXXiyT0Eljq)`wS?`g&YkfW+tNr_qCTsoI z^d>3cs@beo1@Mskv@bG=*=W6o04{L-{L#xmINp^ZOlDL)$0%D{D&G^E#I?#CD z*IKWQ4Gmdz33~CNd~zcoz+(c@XRpE!?33#mD=C8XiwE4a#D*U!+(p+%s@u;<{$={ z=wK;%C*AY6YBf65SSNJ5tARm5@zQ4(7QY*v-)U&0`BU;jwn{*#9PlJ0sOES6+&xM2 z$wOu_A0T8DG!!?$}RcB8Zp@pbpudsk0Dz1y+Et2eQ*+oB15n_5mD$Zr9G z5v>@}l|3xFX_Kj+J)p^7C%3v<@m8SIR!>OM+kKDPYjYCJ9;x?64GwWhp&8rkRR^ z`%0XHX9C_v?*^GRr+??K6kQRv*L2D$fiUUSyu2n;RiIM&W$;1KkF2b~(@87~dky9F zElpK)mV%W+b*^nc<(kaac^uSlcr(Nn2dnYb^`-->iZGAvuDRK!0R6R6FE(HgPq4o= zX3TF4ZMTz<6NYX6v-=2+UCe#>E7i1sM)9{JDOP0V4V%Z$TLW;4r%|fqDW>S!nA*SS zk#eaT3+%TYX&Tc%+&V#_$HRWpS|s9!i>GfQDJ)rza=6_=)g120UOQTwL4 zB^=W~7g_PdcZc?4!qcDbv5)-q#AmJz1GLKOyhz9R_uN1U3Ig6(=oR&Q2m%a~QasRM zar2|*M*Yld`{8`u&ch&_0;a(;RjsF6{+t8IBSFRQ0k*ZVxkib^+fr*N=RAjTQHaI#l>JifJ(`Q zo<#^28BmL=bm>Ps3Da_0!Hh4iiNJR&Ddb zK!X+Mw$^KBIy`(_W;XM2%aOE0du+$$j07^%daN`4`ykU6f-Cpk;Hm%m?;yL*NlknMR;-%KLR;m&iy*=9+wyC9&Q zcrZPT>&wGr+!Py~QG;i0T&NQ{bfOcfH@KAZU7@-`%xz>>kABw&Kfv$%YyNeAZ|?Ed zqPw{IrSfy`zr}*A@^CZ)i#srPN84X{IT6DlLJsLPA zfDd?mPv%+nBqjtHJhPbe{dp*dyY%%w&&;!{WsAxF8SkjbLbhxZgaOYWf1eXxmuN*LSsk)+43~^k|_dg z8%*kcEd*fVzfWL}Ui>tPtE!nYpcAAiYw3YMnt_!WH4W}bSgKqgm zy4}<0*g8UN8|N}%veLP`+6H>jx}-%gA*#uRjl2|@r6kU(bGY{$V#aDQl1)y}ZBp}2 z2FF%pw5+t$>43@c@pC2Iw-yY5XmJr27HXo z|NVTOPsYocWEv&T!6SnE8AW%Ga^4#PuEg0oXjR$l<88koPRCz)gHuDv`)^@UCQok? z`vziHA%-_Z{tiAKGRhwxBft^gSA^dkK!LDjvC;!dq+bkYkTED`E6yfD9cyS<#ohA-SY%c<3+dkN&*Rf@~+sl9DCOwmV zavepay^)S}BNPXVVqeP2#TP=mHS={$K6cOUCw$YHk=s_^R!KUWC`qa(l&p!#UfPAc zF;eT@rTkrL2jr%QkBTWD>FW}iB6-_#8zd|87DFAfa#VD)m1O)H0OH~x79%SWbs=FMR4fWN)MnG1{GBG z&{)7SgGOZYmCdMz^Tiw{6tk2an@)dAA~$xrN(Eg#dqpTK$c^;*{;l>X=-z2e@eIA7 z2W3sI@>FRoUq_%f-lfcZVwbSjEb0Le_^0WN%Ml;9VF?jXkxf{r)?BQp_10 zo3NFA$A*F;#YSX(Phf@g_<46?!ewYk3(auS+%Cm4&E-Zsjo*a(y!mp2*v>*28$wzt zL;Q|*RnMMz^zBM!IxK~Y(itmX7{uRb0i3Moyam^C-JB{9LT1O?8cA0fOec??Ez8OB za4vO?elCR^wv?KQ@pCy!PYn$%8Gqu&6Gzf;HPR#*E4j-vHj@je#qbN_IefIwWeF6} zfGaO%o#u)~V$|zr7X7oEE*r}1w+M%_hum77@o#J8B4xtO3k)5BlQDL|MI@-eVHgw5 ziEpi9JaU!~`WzM?6T`6UQx?PJg}&uvj3KQ=XopC2uSMWK1o>W*{qDV~$Q4V>5v1eQ zwY6}r<5q`VZS54-TYaViqd&ME7_{3hj0YcV%ySIP^EEXJ*0*bd__$({<7!=`qcdHx zff*Ec*N+Rhbg6%L>G!UK>YORcF{AfoV1+-pbI4uDD!~v-M;R&xKHxMoFrgyx~9 z#K}#jhC*}N_pA$C4wW2C9b+%g%dK;3@>N)j^F$tCQ&P<9oucH1*zm4yFkK$nUFo@J zQi9({+2K<&6dvBzLdHOT#$W+=$nGoc^0h;H z4KR(QOUCkH(ZkJ=xpEgCw{x$RM5R<5XZ+JYXp_6}$!q&-o*q#9Ux2K|GQa|>m2z5M z*?jR);A48*M*pSxki##nV~!v1+>u72nuQ6U{nD!K zNz8KU^IxBr5-G?B_sAB^=*zcYdbbZYT_+vuoPQP3E`#7HT8)&$*`OH{GxPi@Dv#u6 z%gVa@SUR_-Kz+P3;$YGsgUIO4VI0Lq!=o3F$M*zI+wiK8j!6pS{y2U&5Q0B58X7oy zZ9O`__pZyGJ0JBeEuU@NMN_jd`$|e`)NP%5js#|W|Ke_zW-GEb=q7hGR4*}(G%_mb z{+eNCY}KYNO6n1gGyhRe(-Qg3@zg^qJLy4ds@TIQP5Aro&HKtxu@< z7EA%~veI|coOk_wZ_`Mi3r<*Dv)rmlROPn8;Y=++ zXa^O_Jl4Nt=i)NW)htPI%80ZAZr+5BruOq)iTOR75hs)gAJScIVm!>c=^Qn_Etghe z8-vxk(~>o5-0ugf(WM-rU*_SEPH;>5udMMI!x0E6?QT-E8ntYFk%#;HF`Q+X#7+i3 z+D~?$J%fI*c<3127uy;zt(-S(FmM|MWh9lW$LN3+FH>)4mZCGxZ|8wE7}^$%hH_jb z4!OU(dvapEWR0;cWD_pmKi0Qa9hhvz`1-fuU8lO}L4gd?qM=;X_tRgXj}ibHGf~j- zLB#F|C@=hseZDOBLV>#rG&Y-n_sILnRkV_mjp$OxP%$D2`^=HHzpLC*W%vghBn|!> z#V%>~SfN2d!BKAcp!W7X$JU@JUX47a$}rz4XiEqh?y&_b5W<(sXz|5bg^g%>cszNI zj-;~u7>IPrx2J}eV=!;E37{4<4N7QRUe>`5R0tb=Z*?o6j(*L*&yy2RkBV~qP17U` zYllva!vdrl_w=h>r3;(cR_~p5S8)4T}zxR_rJ`oWUm@y^H z^`cV|Z1P1L$#i=X7RwwdI+mZXaLxORPmbHqAk@OUaw)nWiQlG4|4tROh^E&pJZjpB zK(DB?o0*eGIyP5JG0MYASbS@BfyZWQ8Ty{F#Mw~b%x(ndqG6J%2-GZUB0p&*apdnE23-33pEB3OV+OVc6*+aLtEvvDdymRaKrxB_e8jGj747a0I%Kg3S$2|YR zqL&Aqkl=}Jit7TM^1)y{^t6U=~#}X->~%jV;@r zu&yv?YGUGDGRy1-sG8=2JQN>$sI#4ip2yz&({_1Z(oV0YkL$zB7SgeGCfk}%pL#m= zELxe4_m;XVm&W2*Ep|Ejtf-N;Z1Z~e>mpnqK~q;@mppy%wCcNu>S{el@9HnKDe9+S z?X|xD-Pkalk4o&i)Md70#^4|wOa$jj8Emd_4Y%5($CsH(Bag%ffT0jHld#Bjs#i-S zQ;_*~*|XoT`6=7&AL0VaH56>m&Tdpsn{;gkl3E} z*@kVG&~6RmHRGJ)OloSzhT4yAOmCChJIDoU*`k%gO+cPnNdBzbbz#A=e5<|v;>1Py z^M*=4JTiR&-jUkxxYrZWrIJW(9Y)1vYefZn!t|#C?3Y`>bdf!x^%TGz!!xdI0Mx%K z_5-k4IJ%vCrM;ZFxhI4Zu<7#=#BM++*BR2y0Yv)n0FPsc!wqoKCAf)`9cJ;KK22cq z0Hx~Kw0ZuUq81gLJ2|WM1-t{}MBLq0dbPP4MBzV0cXZ)0E{EB>Ies2cEvvmW0tA@4 z634RR7MKvBZ@K*;6V02dD~)&cFNMRuUx1;6>)Zws#vs?+uNB& zcE1w-vw`tS8-{_4muxwCuGl!#=h`i)isl+=4jS67cVl^PemN3uEa$Y|9#FT%n`9T> z=31E{ou=iUYa;|Ct&lIfc3fL}62VS4ulyeY!$6$>$Mn))q+X!`GGyd`l(+!Ru%fBLsdVjz$C?`b7B<3DkSv)O%FK|hew2cTEM2hS;*|ERG}dHekphNnw7N;Rut2h8vklG^ZeTNpE}LV->g<`qoO{F zNlB?wkBipO0CH1hWRgfXa3^+g_*$X_{GZm6b!}*T+}L<+wIfH3twZ1}pWr$l``bwV zpo5*De=mgI&DEUHpD#Dm(vsoPh>*eqk1KjC35K6s7sx-bOJ6?@lqvrAtz%s)vl&5F z(9kf;)m$l@Jo-^&#Q)Fn(AOXLnP2;@Ra^E{evhP-RP5%Ny+W6=Jh&5qDG-Y{Y40m? zpiP2vwF*RElG#cBSk&k6^u*~HY#>m75CP4C&Qm(Af;PoUyOQ>P6=I_Qr5D3s+l-u|#Ft&wo)iL2iC^FBIgG$I1j?<2s%|u9sFH{-fRo0MT^% z70HbNv>yg#?z*t$X?3P^*#7quK#r!0U^19%zXUpFzHsr4mw(449bnq^g5t^79~St> z-s-^%Oe;8d{=?pR!Ks!_{fkxhA4h8hT=S#FfnW>`rubjazUla);A{`{4kzmH2DfaFk18hJc6#9;h@IrU?F&=kW17h-N27O}1j*-z$MBP-G#t1!!0`_KzLDS)f;67{Ff3p8y#tJ^lwb=7lZ`ei$L>VgyE&Gito4`q5Fd@ylK@@J|gR zBy@*k%QnftXjYrtM?P>^$L8H$8xR81NHL!SV$ruc&RzAupmbhIKL{AB>IUV-bS0>)075a9nAjZHaZZCrKXX)R8<%>kbMwZ(rp5vu() zlMr^5LDAWex&Jmr{uLiw+xzjEvH3ylC6gGEhI<<1e;$y(zSf`1r+0~riRO~o_}ACc z<^fE1oGW7-t=ecS)LrtN^VE2WABnF=l+gCfbE+HTR`piD#C1m)Yczdxlt+q)@i3Pl z5Z-H&EZGwL0T+qelN4HkoO5z?n}?apaIo-%h*zzNNi{OhG|AplpO9OerR;sf~RCNkkRk-E9=g3p6`DM!@v2rdut z`M!`K%@<7^SU*iP4x!;3bV;H{Xz(8vX-Xoyw%pb4_4B`LxN7DfZ!c&h+Bukv5 zSUY!w-4H6R;sX@dGfT<6Uv&VL>(%@?DA@q4KDk*C_Bn~v>3P~0X{eXYB=D?09u|}C zNcxD+jt&h4z*HO1S1+2riDUl}i$1`$=Oh;X7fa9s1(}1UAGbuCd*F{fxO3Y?jJ4Wu zB0oX2{hd@%Y`*mCJ{8IqZFDNa+Y_6k?<&9?)}&LqAEwW>9-QRB&I)C0?GEqw)XM6- zwt-`sw1h0CRVbiGZP)J%JUIQ!n|gT1`uGfMZj`2WPV0@pA5 z9)518+qhdX(Cl*R=Flm$+(+7vy(mTUh53 zpKT@0olcxEW38Eugcg%-Rf#>vbTNdNoSut&>s>25Hpbu3TL3B;IDcP}mdd(2#dR|Q z>C*W8i&`U|?oA+0-4?BUy`qjAEmjFZ zFSZy>5M1fLTt4cERiF%OYx%c#W{1CXF4n)la}?kdM$$U<#C6jrMiZXCHq6LOC54;d zzQT_NV^~b)VWMaWT+2Dh=*3+d7eZUPMOXOCO;uf?cObpm9Qk7<0i3C#!fCHA!=w|re~j@ zaZ<4^_!KaRd1Nt;iJ-mn`6zJw>iPn;M;-B#rm$0!nx5pw{ZOy&i{blICSbsnLYLfs zd1{awoPgsNT_FsIe#s*Ib+oRPeIQy-KYGYuQ98+irBg(69vKLJ; z9)W1&hqQdyzu5=Gij!ZT1y6RJ?0@GTdCk3C&R6fKrlNi1^?hJ~v=fMn1H&v|k3M;$ zY~J#WKgB3?X9SwBLBa!oos-Wq);6wCL@AmcUzw9|9W58d`I6bL^#( zIhtx}CWR{*fYcorj7`Cjos+|ai8*(u9K3(VYWwLw&eV-DxBU@P!593ukcta(d=1IB zWQyy{Kd&7$);%L0-V30~ydl*c!7$L?Pt2Sw@xx4vSauQ7Ms1CmMXRc~HVH1R-jVef zuE6hDGP75qQeGyk_JUbnt!%?4@#x@C5KW#q?LEq|s%msxvcr`K7e~#-T8(a!YoE3L z(WGnc`sGFCVzm3^yU7#NM}xUz+OSy@*kra^O`WKN<_k#w1kAQUy~1+RWi$C|Qc_wv z-DUu0RCIE<<>o_M<8YaM62NX}vX z+|I->UZ8K*w4SSXze#yypZ8ZTo&;1 zA(;f1P3AIlbvE~lks4-z2Sa5e{qM#Jl?gnJh`#^t8DBeq`XM~2HtaNro=uS{59NR6 zhA`qPZjD*Lsz`>I&*2G_l)IS|ztDGYhH>q8`oC2!{~U!0jtU^Y8}UXhsn4h5nSn%@ z9xNbiaShhPbs=P7hlxu_$e4V*Efa@|$JxO-d17uMpL|*#5;K`(4o%*C3^p~eQZRSX&U=}2l5TMkT2Dg_u;7 zT2mIk!D*k7W4}88g7TiEa*El8)7~MGOEe_UId**k=d$yBL+c8SboSMMU%g}>T>Bj` z=;Pm9I`BJCSb$XEH*o?2<-J(>ocJHVTl>XLeERmQS7I^JIdlm4_sYMGMmZlug%SWvbI1{b2I4r0AZAQY-PAFhUTSn8wyV9o@tylTr+eusIw_oPJ1AGHUM82%zlOk;2zYf_%^b;A=8unKP@HMs z`PRxv30l@%w)0wSj>9sAD5$0}(OhTm%8UVQ%hR1ON)r7BT>!@6Ux&A9J{4x%Y z)f%C-bAJ8dn~rXRFNFT`o7zd&-9r9uPY;>9bWR1=#}U%ztF15mMDmsF|3}(;fK%Q7 z|KoRVg@h!jgd&9OP-co`CwoU`R81A9SxZhw4NUr=hi8TS#B_h$dJlmMuBaTBX0g zip1B5Wh+>GlFsZ8JWnqS#aYcE59p%hXlSb<1>@XnId&b8V*K&s}4;Js3htHG_q0b~4Htts2Mf zy3qmWUz&Psae7GNI?(}e^%@V>&vtswzC(~?oYS_tC}jkz?okAET$-f**b_a?+nEP# z6FA(Xh$+DMp3NlG+hQWoL%K)m?Cf}483!&~^Xb5rhQ;l4H;G$9$7Re1Lr(g|+vwES z>PUtCQGwENnY>$n!oh9pe~0e}irC9Y0h-g_wO_{P#UDK={;E=J_bz&AynbmlE|F_0 zOh(L7q@TdyC3@Elr+TssuWKnOeYY^fbLJT4AaobJaIuO^*obZW?s?RL{=(F)Usv+- z;px1iYtmSiSqNoqK}Fl~T#xH$-1i-FmM-vy{i$>6=(fw9j@+SVrxCoWH|Zy`&D8TY z!RZ?&P2RO-?_mF8PSv~>x_pzj=3v9IZH{wuo(5WQi;Bt~UFg1v%A-W^3GWgnK9CoH zAswAVAa)0DV|n!MeMvklE;!QIZM8ykMUj)Z(wsEF_QIv7_Ymwny4yp#OA#jpXPfmg z&Fn&(i~C=)Op71~7-0jjOVjR~6sYJba9$;Y#)5tHf12*|FJF~oFE1O>|8RMe!JEi= zS@itg#u*C_Wtk%1>vTwia(?A*Y!CfVdFoYvU^}5m#jCB;u`5}&*-4GrSs6oR;_&mm zyqjd~*lnx3QD0`DH~&Evj<@vT~- z{6qP(Eyu319PN$A4`(p!^%zRT9J-_tvEhX2o{y!Lfc5B;sQ7jpM!%9nQ1)`jaeGKIgm19`s^`(fA}HhjorVIiLP- z(gT>oQ(=o7X;8ZUt`ReQ0N7k}WOR!ugWF4)d1YeQVCSIHuf-7i>Qxq!QzRiGfcpXN zWuWx03+s12HRTU+(MWvT1C;(vnVH40xA!aWTCR-BhR?5v2jmtv>;6QmF z6caM9a0JTQ^6y@E5sTSdT?LWtH(mA0L;ORfhOZP^=;gg+d(((RsLU$no<)k81Z-v? z)QEm4V0GrNcj*D=g~>?%4~U?cchdwynW$XgslzS4m3~*!7>s+sT`Z|QVKy+SYCCTR zrL}PCXbxv-_^>moKc}l)298(RPvS)aR_F+*Fkv)1&s$H2+)l`B*S^n&Lq!hhHaRVj z!!KeC4By2(p z95)X8R1=Ja3hvIm>3JIhqb58%4sn}~cRg_uV-5Vx^T3ioRyF?T=P_4P+42&N?{WMD zF~Gl;*}Z9TBY3CkkA!p`f5fj!s|HkBNq~_wG@A;VW325(=gN8hdjf9^vaz-y`N)gw zEF1-Zf`k;TTp}l-@=z~gV&dqL5Ssm+MlZ%BNEnC{_H$Wm=9}oOB+f3@y!=Dkvtts3 z?rG1oPmV!Eh+;#$E(c8kNwR?RA=>M=dW(T(b9E4omW(k zMV{EmDV?=Qxb|NmA)+sHso(D(F@f&~oFvs_%y!Xdm>$WclCBn}8JPJQ86vK3U!XWa zLkf_soyHEd0wLEylfTT#K2mkIi!I~o&vrs2yIdFA+1X7Om=iTt8g1yrb!#?JQ>cTG_o_eAD8``DQxF$5XI8O!2+Yyd4=ll>GdJOvLiiM z1-#Y0gj4qumuYGoL zi}`zuvEhclz_5y)qKI>bNU_dn7TH8VM&yr6`4%<#tfKkk>Ngfsh+Ez!#X3DcZcREV zG}1mQuc#j|pQ`Sna&(;L0}_Hg_Y-<}$$%bwntc{J;J~dVZrts3Up_8Jl??{@jh?fu z2X;W5PYXWnq&fcG49ziuci9#3tLfZT*f_L(n7W_4ylK}2CHN}{WpdzDciE4}_J|Bc zu1d&*5d*MMA_G>^PCq#)UDo8*!iw! zLu*i+_I9YMF7HTzwsjkz6d5#-xXmf1gH82Em*u3>sqbeoGGcCUp~;x+_r(9ssqIpCZ}ef2$H*6#)mk&0PQ@5^!)5+-t25xJim5^;9Geyk-=1Lv>`HqqGNVQlbfR z|6IemtoHUN^_$E{oW&_Bi`J`uT27V^*t1d3F^_@M!}PYf^#R9b0Wqt1Vbjw+5;w;e zT43IcpcBEE(q)aB71WvtV^rN{%dneC;jO-;gPl2_P44=wqL+Fz>8v5qn~*jVh`q>e z5DnkK#*{U>5dLMq)E;Eji8d;P^u%E4w zbTu@1y&(_&_w?9M0(*D6lZ3Q6=9T)i3#HMQaQ?Ho*^PQ?FZ;2^>DltP3Or^IZ{FQx z{-fXeyuG#XmV-rKyav+bo@`k6e3^^pB9c&#~NbJH+|wFvP^`+tKUT;`h9G5ga;ZOYuBla zCW5u|e~gZ1qL=Ze!jw)l>((u>J+aQ%%1B7u*-^$By<|&;>+>4Oguv7a0ls)8BaUzx zctjnMc^o1~QzX&ZD~t!U-I#SFE= z@bB zCUzxE$z?Px$xD9fetI6PZk6L_gjwddKL)`{P>N}WY&#KH2=>_9(Y9KD;Mac~xuJ;*yg^`LKvs#)PvHks~2n#9%-w7uWw?=KkSf z1E5sw_R65x{oOL-3a)b>#YF%3oLp&nX?1By33s)=Z~wCJj>68N*Y$p=%AN?n9vru8 z>GL~HZ2ZPLak&a}XN;#D^$mcL8Pi2y=sogsBU`;{?995$$3<)0>=VqW6qxcRr&%D)WXOhOWoQ1zn1J4udLM?1S!RQj?MN1-$!Mvqzs_?VmLn;zV93j z+3mZqa-ZA})F)TDFHF|)=OPFt%LOOW?giQ=H2Rd)&M2}$$&fh`26_Wddx zL)m04i_Z(!*Fc&iUkKA#;fk54^>AGuNP1LZHMzAjcIUW$dS~5edLB<(nSc*7dr&Ws zrrzA-gJ7vgOvjzzB|ZYNMRG~Ja%9q_=Xgl>IG_r;Xw(0s-OhaKUEKl3Z8SnUdOXB! z*@ekI_03B0BBE{T;NIp>yeSObl=a~Zwwluk-D5m?5#z*g99VD)U1H)`JwAasb|sx{ zZ!UE{%x3>h)ng4>=P0S$zi%o#npM_9l2DpKi;J*2rFf! z81rCYsjR|<+f3U57j%_=$ zGJnlE#tTch)T=1Ymk-iFhUyf5`wsAvi5@Z=jwNSN1(Y;Hy7-LAC zR%BX46j$@@p>9z>c0+8YV&b%fVs(tKqBs6`v|Pk;Cs$+t=TM;3s}HxpZGj1?q>ezU z21?6cKA6nDuP~kbJgLMmz+u%|9wxchH;Z2_oLeEZk6>IHJYDR)H(~abf;BEei7`<+ zn~XJxu($nFHy(%}`x-pDFSA|5t(Klai4RP6B|RSt*l^a25Z+5TI3ME19ng5*y70Y= zZ#*!0WgNRM1pPH5^wVXg1QwjS%Z*)+{{1`H#$xw{i{if@ZgPP@L_v9di@s^m0m|s5 zv;SFW8KV4Cbi>6UWu}j_$@9zcp2!MpfSX=s-^L#Qud@k%a$$0qU$%>aeINFtqd8IW z>gw9no6G@H@}ywYoU9Q;ZApsgO9YR;svYJIVy_QaW#z0k^xKGg9%sGi{P-2mqppMYYjGlF)-DaQF?y8b=C7W zH#j}$1}hiVYT%>nMP5DA{;q+StAryKtU6qzmzOx`haIY32xy$h7V10IW zwic7Q=ZkfXh~nVo=g)~M{!%{tQH1Bolbqc*TO1dvOvV3KE4(CT`45serm2drD=EA- z6k007Ozj41Y(j(xNSsAUV6S1*btma%Wv$e=Y?phJ-QRzUwxd4OS{yq{j-rv$1j>Ox zd9+rY=*pGYw{0P_dOdX4&OGq$d$Fo9+)tFhP~1z%bjU@^WDP58 zha;90G|b?S*Qe`yUfwQkZ)ak0k9!2>?(e7OJ(rF!m@Xhf=p}Awf4mTe2S=itC=!!~ zssbK!J(z)Y0sm!Q*2&@VAn=mk7!A98c@h^CUHr<>^P($lbGE-ncO&6Ey#VzhhA7Hmk?Z6*OmsRLaBIl-a*{Tk;*YQ zH08Zj-X$a?l!tgXXaP`&NcT!|4h)wO!lTcqRnjx(0_8NxlhcU*9a-`ncRW?If zRW|g?(Hzd`cIs&(B#so3$&Dko3!oSxdl2sO|U&`V5B~@!}uz~i^Zyfu^z+RtYAZ&@sfY(SB_ocgEUe+ zI9UGQY={9RvV#~pEA4l0O`TnAQlUi zi+|8-`*lQfn;5W=4Fx6&-3!#H4~waEkt@6;OJ#xwN}8D)D!U|kPm6wB_CKi|{vM5; z`ZFQVvtjYn7eme`RR{l@dn|AvsqzzYdDP&{N?v-lH@RobmS8pr|BV=5db&+CkSd>$ z@Vk+bdS!WWg(m)jj5NwY?GH}4~61nJG97GGaFr=}bNPVEn=Q^W^fMPHr_sIr z{TM)MiQV4bUbvL3l}AqHQ0f>B`aiAc;jAnsZb2^njY;^@xL)SFE{!z6&X2YY_6q+FrB1CdRrT^Vc5J>WM>y36-G}77KRpr6VfMg)AOxA3mDMM} zb9IztsV9lg%PZid2)fVA@&YL7!cUKo=>UocJaop&Ou=rGu=67&U*}>+RG5K@J#S~B zGs5U5;Bm~1nS@bsTa!@XHxO{T=_?$}(27u!=J;5f_Av!Z&`h!8qo zl_5_2-n{r@#VQhgEI>tVi7ZdZ&+LI}g zR#WCnRKj83Lu6qbo#J=y(pI!l!#eHn(zXCWW=Hsbz>Dk$t$xRi{h@ zOtjv0c(ZXVD-`@-zUT$X3+0UHT3OeHeSuIhBq_1097Uki+Rp=*>W-|+_MfTsw-$G- z?D($$f1psHWAk5e``4EqXe?ZF^+yJVjY(ku_9|)o(|=%L93-H-333bV&}g9eIG=1< zlsJakoS=Ych&d-DM6FkO_tPi%)oIyrg#Hkl(f(7FMtD(w^>W=jhwO-_Wl zl^ln7AD!@Of%i#am3n_|3&fA`#*g@%JiLaPQQ8IQN?KIH7Zx?umY}j>uejJjvLaO% z7x?Z&#zn5AWPdQ9xXd&v<6Rm=zzz>2>0B(YWzQp^aATy6D%@6U-!{GlpAX z$cBxq0EQeX*d3RZC78Ev6Z&3PP%s@2EPrws@kEQ_3SZ@)^3xaC%FBn4X-R3S`vJki z@5vOg>cOqjdQH@^VZ#GcTfK!Hmo7TfX7}z#6)l_r=>s;^3SdnEJZ;RXlUn#chR9di zhq0tfHVP_$DSh3W$Y1vXpNgX1`wD9 z+Yz6y7p;gbmab_B{*+0PwXE^E4P+Gw`l)|&lvP-a)@tDD0acc9su=am+kZ~`&FMLx zZ#*i(y&xr}nbgG8RFc+uZ@Dk^*tQ2w&qULGr)a-f=g89qg+j%CVXS|TS#TB(q^kGR z(xeewCLEPZbe`PXKd9;^7Pjss(+X&idNu~yJr_;W=UIW^Z?!{{MYC^dgyW0dER|wF zUeXjD&tBR61__TVUTRr5_V_bIpeTMpe2k{ zDjI`7#imnj@Xh?C8Yh7n3l2MJXn?)rLG(a|e9c?*y;+-sb!n#>vc73h(U?CNxwlzc z!;2h~d$=}anM7{K%gbi7WI0u9$fka8={d_OS(s~UPEs(kGJSUGHm)mh4Vv&x)1H&^ zOkBZHwh_J(L?mE=KaS)z$dC0Vo~p9-YuiSx3#gc^z_hOfPL_VmErHU9@6JtHp?3^7 zO8xI8x}8GuR?|d_7AWdIL3NnHk$?Z2RuT4}guYtPU ziw&3ait8D^_Wuto9xLGmT?t?xyKEv48=6xnDB1liq`SB(>B71Fijn$2!{UK<(HnGV ziiG*PSWIM%R5Fc3@Ev>ox>wfDWA3hu58n_%$B`zRg^B3#pS5DOjI@s&Jv=rWkVs_i zK`mo#l?3E_SlFD0Y%>y&udsDkYgy=NM1=pDj*IfM1cnyJ@fASyKuEH1U2lwt_Vy*` zOc({pN48|Yff3Qww|GngS{55xAqx=H*`YdzSgxu{ft){Kfp(1%o9@OAr5sJbReA72 z)wy&4jmQy!v$c|*@h9|RK|NUc%6vSmeDesy)N;NKJaz#tj}%LrL%(W92hNzcK>b(- z6J3v(dYWgoS@H#8C@rZdz0f2lmg_zC`b`^S#!1`b{%YIb_9=CANQkMOn*xQAS}G`r znq5?myF6|}L9NXw!E^g7lXarWDgMVgMbsz*zh#Id1@EKiHW~^KW8jqs6vn$WE40)3 z-^;dBAC~%w#Vt@b(;0-yU#lHEiXGA0k+cUexoDvNL~?ZL&|nJlmT%7pf&qU)wLbkU1Pm#bf1`X zg;nR_Gq~T2+R1!Jh- zLC1_smo9Yzamh*Rt=Pa74|x@qLt}??*yX#Rmd61-sjkJlFAd!wWaW70=aq89v-mRz zkYE*@N@*@<$HrG;!m^d5KC+@km<*dACqKX_KjM`7cfA9EZALgd@D~%+MEU*jnt-TP z?urM~C14e3X|vRm$maAJ&~#qB{Kv?%6AOf&)BUMVzE!5y1Ho7PxRheSZ z-qPN~`{b;^E$qM>3d{&5(!! z4fI<}pn~;$h4`Jd!R;%_EaWXLGdz@$D&C(I2a@gRD7#-BdczqAh#oRbErDLf$Rre9 z>OUgZ!hjHqc89dPk(wy zVyN1Idw@0}=;guU_rLr3r_rE`=LqdzGFEP=usRcFNtgBpY~Ds>{B~dxY=bpFn0;n9 z&fi~JXx#_Ci!M7(A!e~$T{dyNxYE`maX4RXCsJ$yw_D*VdE4etFq_VN6#b=PsmtZ=c%-9&{!F=uk%l_cyf6ND4r}Z z4%39mk&?_`pOS8CS0w9;hg0wp*w##MFp_%u$ckAWY&yoVs1`(XQcm$u5JDRTtanmZ zHjzDP5UELUku(aNShOM49F5~9?VssiJR1lkA|lcZHPweV>sO4Jn@m5@EHU~xRtpIe zPzK^W-WE6R>5Yo{*C6{^#yf6P2|*uf(K8iH9T~{-{Io6~2_ICr67#UaEpuT4)7Z&e=oJKNSjr~3_Aeg;vg7TCpH zsB(JX(@<0G*6h~pf-9Gto( zF8^)k>+MaEgS@9`B@$;z;#FFEwpm{B!>Q3ED6zyGM6M|Zq0bKAD~^ed-io~gdP%Tr zt9Cw&S7mB$q;Tmg*~leaeV$uN(~=91V3RU=-nQ>$EBCDZwoG)|`e;$}L(THRp&Rn< z*EA}x5?;P8o(chOFQtft+I9l&=Z8&S#Zn>bS|FA8)hf2jhV`a z(DolT?e^647#_yzlznY65sE?Ojy_5<){wfOwRds3MRE!28H<02*g~=Or?m?SoTr@F zIL(hgVsu&Cm-04vU}*BqpO z-xI`R?2eOtD;LaFXKi`xEY&u@qNkpYc7KV2(@9v2PCQ!j1O-m6-EiNAU%%`gqg(Cr zcd(q_M1S|s&dKf?;B~ePU+&y|vj4KS&t7L^PfoDTt)8f;rgxFvdmWBBsI@gEv1=-C zD(MlNhZK_am|Syx%rc^1p65?;up#SRpHOOLn;`7Mzy7I_EF~r71ujIP{QWF#iOr(T zfc|r8J{}&ZZCG`TAY6Hj!?q)mjR%NMaCZ#{CE(9`I?Q?Rr;a2gFv7`MBI7J3t~H4f zB(dn(l@tNIatRp!sqQy=xw5BjrOW=xhptQARJI#G(WR4lYDG=KC;kE=V3rD`d^du@ z1sOv%j0_GMv?wM6osQXNg5+ct{F6^Yr)wny$(i0SUG>HX-jeejcM9Y7Cm(;Nh*BRzHH)Wlgg9iVv<5_E+6&s#D@4SjCL&(yrOeaJ0N?6p5q<0LYjIBYIUFf@i0jO) z?Z8oM0SZG3l*+ihgTr_d0exV+qJZ7igtx|-}{w5lGnAqN{7aooFC1g zTB8oKe=+|{4zf6_q~1*LpWf=fuG3wLzv-AGsTr8WP<)vPAc4RP*^d_Z`$!_Nw726N z9y1)_szFf2Nvo*dxxOXo^@XC&jtbarxp{H3@Dp3a>>fW7TnJXpS2LxC7~}{WR$m(_7*bxMAtlnh=K)2w8)iZ3Zw;Z5k1v+ZfbX~sg$RsjYYgX)Fk~X z33>I$1Dq$M&#MXh$_G}!#6vb^Khv=z@QRW7@Fu&{Vxt!@Q}}WD z+cn)c(l;mZNT_daS5`QWaZ#>1#E`R1m9ouXJY|1cYih=gm1Z?lbwn4y9qy;eReMqi zSlpa6Wt-!XYcYH~JfOvIW?{htj5oIG80~-FCZZpHiC`P~;;=T#$<6WU=v&+%Y^U8T zeOxCldfwE>PhYP{lT&c(Nk|ZBc7S#bb(vYhRi8vbH1xh^Oju{xaDH6$+H8(08SDo+ zX#FM*qDeQs^&K~UmQmyPRLz?gv?~X1`?((3fB$Pi_}zE{0x!)vYuxSW$Ph`>y69u+ ziK;~yn;?XvNGIuCboOg?1Wkv3r7>tp=R}}QSYWxoTi{m~qX(1KtlL)ala8rh&zAp1 z5!N}ZUVn}{T5&UDIWCU=m#QiVyqs5WmdV|X9FO{QvGoY>gpsB9_G`j!rYj8I1IifW zj0yjcdpt_Pf14(*SWH%eEsx6ccm>}X!A#(5+U3fh$(ev`+%TE0AFF&BHKoeI_ddGB zpW@$MS(#*&ktWEX8SMTxl4LRpV5FK6db=7yls0A-B z_KoJP*G&aK9h}6Ors7Mzz=&SG$A^HO7pSesv0NQIYE;7Yl-Jz! zW=;>|lur_V+Y+Wb+Ja2*Zci9i<@eB6dw2+pn5#ZD^gHP5HxaN#B%>H-{SAd$7Ge!_ zGYwfBfW*=Ce29qUb2h$8%hsACCp6)N436+*IxW67C`irN%&;!Ij_XjJej?fS{x}OsM#^P_2j)K@vv6>`U7%s$RuO z1HUecx*EsL>Q{XBWdv63J~m&4{=WGC6)$X~8b%Mj)dxonRC3j3*=*RHro#wD8~7X# z9;*J$6n+W;qaTVhXeU?--i%_QZ7AH=;M74yrpz!(&P8oS(^pfKX~DucvT{@l9J=uG z7;937=_X_tJjM36czJjXb)2@v3)<(>TaAEqR-(I1(^}wDx!PG)_1YF61LbY4$G8Rf zF~geov|bs|PpyiL@;rKEK0WwuU+g{C8%M_qvSNtWgx8lX88Oq7;paLbd3;=4t774E zF7j6j8IM(TpaP}=23^qAR>r1wsP)na~(Q209R6rKiTRC?kZ((lU zSq3^5+o^f6+OghGSF^qEe)G~L59W}}02683tO%Dz(K=8tMX=??* z`h$Fhz9uz_eIC5B?iBs1V$QTG*T31T^o|Xef4hvlAw?nQ?*we#=wQ!TA3Ai5{5hT8 z6(=)c_flV-h5U7(s$fjbC^+YYuv8do&A|+)w@-u8H=#|KG(2Cc>c{T*gC%zDY6H;H zF!^;C!x{3Dtg@5jEeg=biWXV?4cNHA8A0NC`OjV1ef=^xLQ)z`*8pJfvqk=sfg*rJ zlC^~SjB8!nA_(&J^+|6(C1zxxt!r$=bDFb#ba>$(j?+Ia#?$K;wrfX5D@VyTi3FD` zruz>2K7Acmk^)pcDRm~qFVzarQKkW;CdJuh6#$&Q$Z=Wv92%Z9(`}XT-a7-WpDHhe zPGwx+cboMj-F$z`;)pBBb=9;dC~-;1LgNb^?GvK3xcmaJ1w^{Yd+P=C<~Kq`t?V0j zW{U7JVruEn*o7FMT$64;ZO@|a2|GJ3$VB4^CCtc$Q5ZG((eMqH zjrECg%>ug)EzRvm2S-^WlSQX$@ONdVR#p}Il?&_+hIdHo5(FVXPC5DVhZOr+<0_(+ zbDXUp8lvMt5_No2kK8TOrR?{1`)9OOHf$h#c@lV2NPs0Lf=g2N3`{EPxMi$Yi zg}4^fyZ-QBYAg(3Z2rg_Z<)9Mor0J2B;dXLGhzz;Cfk(7>K}pkc~UJ4MQ%wn5l>fI z)2ZEo{2UxKDYuwFKqd%Pu5G$fu#8;Tbc&#@D0*g*51CP<7L|8?&G4))Ir##&Ft26n z;kV02YxNuo^-iXEsehlxe{nE7nQ(Rz+QUzD6Eg;fhhoKpVg+XtwU)I2p_>r&OOl`d zGcfDNYB6ZkDZr!P0L$8X`GB8a>u@NOFgh!@&3AyDG|Bsuvd|BiEL7J1BN}ODU9FCW zcjw4dUhPtoP{MWQ=_RSkkq03#k5x&(9r{9Vp9oiugz7l(IZUQb49$nW+inLK2bdqr7Lf0DnWG;#9_y5qMVbglDFH5VY=>AgPTG4{6*hO#d!K}`gy(0wtR zlGut0Ou7?(2%U2-ejY5Z^~j&I%-Cb4E0w&RY3FhP-Gpa&_kFnP%zH{8>HjY!i%wab zId?r9{ieDvB1U4hd=x&gY8#*|fXnnxmVLkqe%iD}${`r|d9mYbVa_GVO&eoxe0Ghy zbcq-ZP0hT6I)@4VzSB(dZTdFvz2`q)9DL5qt9~S_?T3N+ z$((EV6^mSd_T?Gi!;Y-H6F%EZCdUc-q;|3KRN?E-9yCcHW5(b+Nl5YsIjO#3JO!V_`s`MRQ!8S1m?B8A3{BpUkGlmPbc9w zv*;WL-w~RFbSnx;J>J)3#2^QDKBq%t`27*Kl4Yz+xKc7tE7FKl(E91)j**?Ck8W=dkJ6!g~rYUibork!sh>%$p+L zj?tdrgpgPbfu!wiYg)UvxYGrp~iNE>mMbeO#}HBSMyGW| zJ|X^`6dP-owA;b^b=Ljhp)k|{;!y8AwzC|T+&|%H85hTA=`FR}siE*Kmd7H!s;aeE zcNxKk2Byv3RW$HcWVbXc3eEy=+)~%bsm@19&_+o>=M%@RlZm31_gc{{|EWBcvVZ>)RNY)(zmOW{X2e2tT`9&tj2B|BKsv?VYPi zzYN(Bfv;jhW~5o-bsR&vyGiT$6N3Ch)I;)#=Tw_WG;v@eHI{DFCqP%x58w*pe)u^* zX^vtvh_4Vw2T`!86-}t6zq^Bz395^$^*`I1&FD7dl$;Cw&H z$QVe-7d>8-{Zz_pw_rDaZ8!hT-WG}I+RFMa_#e@u|0|Gq1Y$`FC)YMy);JZ7b;G+1 zROaW+f7ab~-f1B?`1(Hms03meL(UNJ{*Ad^=jGbVm_#Su0yV}@LR zX;f%3J%Bq?f&qCsE$7O5RIyL^RchfBqmqb$D?gS9Fux|v8&IeQ41CW*1m7^V-x8TMlshUkuCFIhqvH_S!KJU)6Ct zF=(&nmgEy&yc#Wy4K?+#hU_yeyq|#&5WPLq!I{ZDxg(qPrxT{akxGoYUZ&X4{rTBl zBY+{bSNnxRPwLU%yR%#r?#WN(`*)~YW{AYYm%hO+cdexTxtAnnSk2yE_6H4O=lwh= zBI#Xna)Dv-5I{45@dUJTAy~-ttdhEf#Pr=-^ONmPz7v_gp->9`1&=lvUw12pXYv0Y z^@4;Sf%Qf`vL^(>_3HXt;$!bv;zO6rLEo#xuvYRd23K)Kg5@N}3opse>w8c~TQC*t ziTj6FTsWE)!gIB0D}RIyYmP53`|ma}PHpbp+DhHO%LwCIHQYxajCQ}5uj^<-A_XlE zd`nFWJqxo}xL><&tWkD@HE~9kGciiIyhl8?j|+kjen;2%@=^TE?lKeR0>AyLJ-1*u z+}{eAxbf0|7Y?O26^e_IwH}LKp_IHo+mEdNcM%fShdo(M0NEAFLho!x%?l`oraagn3Zfx%@!Tjk}A?rD( zd(Vx{HO;|>fbSC?kA8oZ@xy3JqQH&ge8dGwPiF3PqDNn3oEBuHS=9SQiTvE8}-w(VLB7bd{H zp!3H4o|T8{#VzL3bH-n#t)MLGzw&dbK zG6c3pxVY4lFf?#Wkzl1}p!=RVICKk_mcVimsJfn8qpnl*vs0SKTy1 z&=wgnCmzAA7Ewy_Hs8szXBDa>G{o{X%V<L6oiDB7&`y*!Aw_Nh0{Sg zsQl-fW})P3jjKFnoxb~&TA^B+8T;i<>@ybD$wV17yL}Quq$%E~>($O^1((_Z&zSXs%d45eY-IOcDgpWw^g7c4U0E#Yze zmf(nMSF`G4R`*E>)4!e=Kk`>{o&m}E!g-I?;fVQ86J6u5x#QYZWvq?V{V@~ky3(I! zq&O3zK|%fH`^MqEMj)V<4U`X;=9!jEirA4{))j#?5z$x777Fcr=Pen9-Vd*ayPWVE zY@y#rq=F!P|Bk_bANJoIzlM0M#@5MeAQw9jDT{hCK}>l;tlpM%ySq8l&u08h2^wkQGR=}N-_|B7 zrUU!0&6=fn+hWX}CNwZMwQ5U?a<&KERE~F!N#lc@`~`N#%^C+xL%eXF2XH7Fi~Hy+ z?7p06zrwiC>RNRPy%v~IGWRS%gRK0G)6c|2YFnUAyue)U=-Ulmbl~)EZHF%yfC5#@ruB(qY{=E`G^wA4k2*@GCm!BWKEBwA!|j`^21xV!IFHUb zss+Ci=Rb6)I!dJ}F|A@T?|0ums8wt-nydYckrCX^(}>v`<$L_dL@tS+M=`9nn?kdp zVyuo}wEtmZBuy+(IF17;z8WGf#1dXX!DlhG)_rhrP{T*Zt&IyLfbAaR{d;Wj2QG6I zr~~%QqVnA3p)c{BZ&Y{RpA#=2M|(ZogfJ%y!K!N%V}mNn_bGX+cfN@S)$V!?=*iG%Y^!7?x}1h^DGuN;nLqU2H$bMKCmFKpT?5+odXRq97l&y~_(52teM+N->#VElb! z#E=&ntj2lK*}}rYXtH`gUzdOgncukh+3k^r%3SCxnWp(V)VpFoI6!;w%X`@fTU2U1 zQ5SNw=r-&UAUk%H=fzyfn$q3;twWr zpKJ(bl?pAXhSfcGh_yQE5{b2Wn=u(4*P;w}3|Ni0&J_CjLAh18yD?|b#qu|poeyq^ zpj$G{UKhl0@HRD1)ZgKf`qMWob|iGF_7`t96dOl!CH2346;%uwropSGhP;lQl4@YQ zpgS&pr!tR3Bk76lw_4Ye>Nl!~DJb`oVvb55nZ?Q)KQrj5f@UGN=7qQ4T&h$|FX+l| zB3ArvDjLmn<0O1sakZ+9l3^A<;lshOmP?gsIGv`&hrni%zjLi+9H{q7J+^%Wl;*4CUWD)c}sIByV_1$l+hB)=H2Q6;& zb<|X$US!hv`;NYa0uK!zyx?w8G=ib9;c|PZj+*f`pVwupH*Qx%V(4db=-1!m-nhP{ zOiAl%-ykv})45cV+u^nmL*mMAXj&ARr=Ena9(DHXB6z{d_`?QaDE_4#|2^7vyfdT1 zTwO23WsUbEF!P1d2Y9LgF8ASOw$IU*u@n$6ta%UnwlGc(*69=aDS?2-+t)FNd!E|6aR z_lL&|`nwl&cVd{t8+6Xy?`_GVY3GxS34@ zilD%j5xPM~!qIY?x6Y~TGxedf!W1XWJPZ=tl|&&tdLV9l^(Ig+AGU@ZE+<0_g)RY7 zOp9I5ibE~HX&bhB9CVqG5?_+?)cnFF=;|rb&yC5SS&dlht@nRX3LSb^AtLw32P&tf zLYu`Og~1yX!9K3n8UEm$0(*CH8v8iq`>O`}w+OB_A>CQ8|FMEIlAAN9nZG{Ji3)H>H+C6YKlV>huu8 zNlnuWG%uzq&c3Xy;Zx(%itOw}Kn!SX8t9VF7FkgdpYPAG_(ZM-{`-1@?>yc8bwkNn zX1x43y|c`%z^*-k-=29sfe_>A%D*m*WbN>+fty@(*z)!9ra*%RvIqap-A)19qYrr$ zYZ3{IEGp4myhoP?ERgo=$wV<7r6$|@B^DD7$VqmmTVdC)?Nd?OkP+Cr<8h`9(--yx z9?a~MGF4Lp46a!-ylxTo5v-)g^GBT9DXJQq=~_%$?|Z{^-aa2>(=L9bDAe9T$l~!HVVS+b^#YFy;sZ_Uhhy3FoGbQqbu=P+w1FXu(7Z@ouHPRu!NaIxOdHEA>$$)}M)x^r!7==9;E zWcPyMPlxiV!W~b`Br%o58Sxkvc_0@hVON@uY19SYmC2$oim9? zW!G$XfS;=uie#^CI6;`Y|NrC3(#?4NaVgol#$r@HHK3h|(rC{leP9ShH~$ge-ZX5| z5O_wKew)Ib+T@B@%L(*CrOb8{`yYR}b?5dYRW{x3HKPYg*Y^$%G%vi`@cY4%`@LX< z44v@U`X^+$!%m;?0rZo5Pewm<0-4)ZW$&PRG;d*572x2`z#Ue;q0^Wpn3Yibn^ zM)5PUmL5whK_^G3v8VOB-fhJdd70$94;db+<4+_=oQ)gHKBW1v_>%Av2@CNexv*E=0r&DM z^I$@aMGsZU|;q==$!hB=u7AQUK5c|IR zLE$xg%bY$hcY$Lt-5D>S*L~sGilCnfYW@1`cM?an1?n#kHYPZHLP=ujXW}jmH33<@MWYS`YYbg2WY-t6vmnV3@^P`e z8?nOwyvMI|Q97y^CBZG~w0svA@sV<*3jn!Ol(``OFYhsYWWYDGoG_bT{QlBTm0>ev zcP)nK0LpXaK;wfu$p~^S|LM!Pl}E)FMDKcg$kZ|f63}1SrWSL4+4sKGiK3|Ya^$#q zw7K(368Se?sGCCFC>-MeJpL z80j(D&(CLb)T+yXn@BT+DvEbBFI?@6(jQY%!Hxa!N7R#y zE@!BK;h7roPi?#r+fl_=)QBJws_rpa7ConwmuB#d`yBT_9G@rgoq|t?a6ndaAfYQf z$ahh*pN7twr7H1U&_&!euJWUoUZ+`g`r|u01$WK*i|IV!futo5LZnoK#I<7DyEwo3 z=+(fzKO-%iROil~HEcJiQ6aEFr!V-Yd7ElEFO`Vv&!^r|;hxo^H>UtuGDcFhb0 zbPCG&?AfxEccF}wy8T;0Qia_606T{pSL1x@dC_PjfAW^7>7ewT5aMU7-dZnyEX91> zcU+&cxY4OQQ+#zuR4Xd{u99XMw2Z9Sp5NN65T!t4wPZQ5mHYpY_SR8Ruv_@3j35m| zt29!Q0#X7)qtX~4A}!qlGQd!hf`UP(pnyns58bWOHGqIf4c&0x!E-*(`F`K|-L>vr z%RgMsl6Yh9XFvPd&x@>&I@yPmiRJrYt};GFU&B`VB3XmUb%uQ?3B2jBKEb?h=ZD+L z<2;UTgy|8(2I4K>7}FD8?25pzS?{&$7x7=t{W{viTB&=!`sK>y%OTm;fHLp)0}#8~ zABFT+Mv;=4SXg8(S+2KRyLEUNA?%x$xn9aJL(<`>Z0$)oXYhg!$jBNjO236y&4 zfM@vbOyz-qu}u2~{0G{)5KT%x+L%VJPgTw58l%g!?c2 z9LE(K<=;f@Vi7drp$qYA*bPga=VH`ldnQuI(er{@FaHTN`{I>Au<-Za^_g6UAiHAn zNBYzJ#gl4JdL`C$=^7UqBo6I*z3YrHQ?b<&=pnb$V{svq+Nhneh)5kCQptEJPUs6t zNZzD&eP93{okd^bMzs#!B+u2{C|Nx10H^ue6IvS1rvr^D*IG;*axN346(FwL>n~)l zuP4~mJ^(Tqp}8xh5nn(9(oShr$eBH0TnheEQ;Fw!Pf!R$L2BB`gIB(N`GzaIZ_B4U zZgBso%+Aal&UsS#)%65DAP=bQT$5n@U!%dBx5ESGFg#}sd?T#{M)2LhcyZWfvBPCA z+11vl7K=UI>u6P~E%_QN-rfz4X%!a9*K3no(Q#4|Xj{CQnXLC5&W+9-JNcV&YDSBB z`sT)}kCs2Y>&h)KRVzmqSzulPi#(`q%WG|`mv^3%KGwS^J!V>cgpyv7Y`^wYK^rYT=cst6A3F>7Om7!50?y?_p zVl8sa!n=aIm$VX~M=-HI7cpi@fP=Wd5O9)K78~Gr1%BB-z!7I=IK0xdSejrT%m<9C z2aJrGg=I|0zu?wsbi~eC)WhFLTpjx#pn8ZI1F9>xaS+fll)Qe1`jIU$Lup3Ra@@Gv zT5K>WgQHt3(i8`AXKpBA3V+#;-*61X;W%jrWcIUzO*U>kIzhd1J0X=A9#^w+@|u`J zjetf;N7RR|@bK{XZz8rCDL?%BG6!yri>*88Zg8aNHZ`&IN;Q_ZruXKlJEQBF%ejBy z^X0*sU6bgO>~#v6pA;V!u2)QZ*ch@0@C*qLiN5E*N6%2mY~L5mY_FU77)%W=vjqg6 z3ilRTk+HjV%(C$TfqBvcG9MJ1<622fz1*-+8}CqK@vQc;F4;TCCpiPiMzYb_>BYRY zPx{>8xyVcqzvM4IQTNJ3G z`J1u)ZAJVB<=wbtiOF^m`~ED>)f=1hE?xMo8nK>cw6VU}2y%3~Zt_0cK6<7pPUBKI zW3e&Eiq2D<_q94JrH0&P<)!2Kz3knU#TLc!HKh)Q3lW1k^a58TSsR)FVCbD+kwW|k zNz!v{lJGh#arHW5&r~l#)i=n;;R@*FJ=sO}H>nB2TBI^%IsGO@wz0gs8k?HFWfn0m zD0;s0L~FP^5^ifz-NkyH>Pl0c8=*t7i_TYJP>HYDo=_k6E!&G(HNK%`g+Q z@C4nWXJmAntwp59JN@vpXh)5@!1|o+cIBUYhlE@51r9lq51xbh+J?5>k0O%XDYyHI zP8bV~GyLN&3z;uUQ*9BY%nEEraLkx$f5MA!vdI0Jmxw(xmuQtA++&> z=nf=YB(9;0jz`F@0kugt7-CgfWhpy7KG^EvJKB&IhehD0(%V&d^js}=YEsfkWKDcZ zE6ua+yey1g#So92!7ch5Xb z8HG!&*kAd)J$WviRB(yHuagWVXdcn6(;FluE9NgP_Om*lliQD3LrpFBeB<>Uq2n8* z=uE5Zw-T0m=-+=2yfGH(5g(yE77^_0g%+}B6 zdt|3?KbhlnMT`}E*BY>GP%;S2u`ze-e^ScW)5bQfr=R%72}ss6YCkpwU1BIrJ_se$ zO^EQEpnKO@#j7XAYPA1DZV!LA*u9Io7%}=R#>=E{vPW_jr5Hw?KrivUq6&=;aidTM zkYx#^)0l8Q@mx?R-^L;&O#nCBRleZ~a*Q~ge@?+2?_XF7QzpLyW%AuFr2lfHRB_}% zr1lHZ7m>XFzpt@AtSg3JG(i;Ca5t4SAe6quCxj!tw^yCk-Y8`Y8GLJRg>if@w<7N< zzOn5R37w%*vXon^>MIRal2WfDl47F~3SwUlRuT;_XG5;*w#&*DBSU@OS{!=J}~;797PD0~Ab0nwf9*oV9RMyxf8 z;_kBn4aKkwrj-Sg7u&|x3l^ZlC?w^4Kml)qC}MfYdJDf!N3#Il|vtZBaFv9fjAe z3c}jpX^rT4mHZXY??12ZylQM+>aa`WRaNY-6sTtwq!^;>u8(`S#;Bpkl1eCzGMP3+ zJ~=+9j2sOZs$R%sv0Hwes9WB$$=4}ChKV|dwaG45HPYb;KyLTITjWQ=?sI4~pBC!( zB1WF)C4B>>Osp&EZtp0+Z_;wQN=kPo&P|1 zo^vcWMbF`zp#TJ?P$h==ai{fYP-wA*dmBN67qCy{7+vX_-3J@@j1=blwNl2yLf~mX zU1`SvgTKitZu1zP-BN?|`?qs)^^g85<=gm2_>lFA#!q=K>Wf~Q`a&oD{JUyv0N3j> zEu;Yc%0wymmXlbrX^OO4uZJ5#cl#-GqW_IZgYo1?U{WrZ118Np+XcvyCuFU@H+l?( z=!fR$n%$n1`^%$^+}JGaSW33cX~*Jr&;!S{7mktd%b3?% zq(Z%rg~>F1iLfZw@ONWr6MLZ{$EM4&CHd>@BE{qZ@wEx%PkR{~PZzcXV+S8yA%ptS zf%7uYl;t4{n!ucIm?ajrbccuo))m_=Ct|MWv<(eNc4b?;KcWjbxW_Zz87lJ{-!bml zqXllOQ8!1g-&D6b{x92<>(w3BZCQi!L5&S&T>xu=VtYP^@!08=^wSNhtM&qS_E{W( zRfN}DynIjR#cp9>!O)<7L@|gC-baVg#1&cFZa-f41;Zp=F0Y-YA2rY|1feScVIYd9 zc)?HbTP*RiXDjT2zD&@2<{30)j0mzlbC>TjH^hcvM2X*|f~)C+2^aeo z5pk6^d-i+%5K_oSz2oTS!@Sp^59BiT4|FRaVEv+*FyPRNN2xw|$j0vSz|Qh;bvXLz zTDKKk&U1BhpKOgZd7?qc;LK(F6^=GjsY%Ob_f}nMDzo#!X1c1LtwP`}=!O&m-A@o` zFpADf>Mg#K%*@gdHX*4zBm}^FDfV`dYWbGS%-+xt(^x@+FfylJDEv_N*uZnvV7u+dVQjO!gIJH>OH$ zbc)k1%v3nNQiWoLqmo`E>6J_QY_Tko_Ts81mP|=B=|F9{xFIZ>tl$cUVn1xK=H*0X zGbN=}HR`7*Cz#lc2Kp~91Gv{JQn8k*}OFJaPf)U zt*xzrcZ+ZS1Ws@;iRWs}7w9sT^8UrEhO{IP(A-Fbsr`6a4-AUmXc@5Mm`^}qFLejH zo>b@9aQc=$Xa;W=n~IvJzyRCM=lB`<(TK=rn$u?aDis?3R@j8>KF*CMe@eV7qP7H$ zP(W&KevAIUmx6^5*tX+OwDB^2_N1$b;O1AR@3|>x=Jn8d?&GvXJLwWj7Ym(X+vNru zLnUm=$q310C=1u^n=X9Ic?GH7o}M0YJtL-@tue*}M6~Grktyn&Qj^65*7|XzX|QhM zmhG)-9r#f7vx8^PQ)37l@8B}}dbWrsKZxaYS`$R7JE|04=X zsSI(S^xpeBiXWl?$E|ZzJPv`tjzeQU5vg!-{Jha@cfGd2RiB5WvmuVZr6@NC??K#! z7`9+zS>8f72_37=O81dGvqo_68BPPB(71x9C4cTE{n>R(a9W=RfrtKr_ z#>-ZRaJ$(7T%IpGizcITIf*nao+WKGBHyIg)$_4AX*4Xy^87s?vaTEbRK2NLGp zp(m)zmvY*=6TH04zrytTVjN$CNx?yn)`X-MEIa69nyHIjRO_kvB-|*82h3QEhkBLP zQM$$EYAXk{<$KWo}6k6tT zxsQDdZ!b-#Sx7BlMFE?*gtn}Y^!7EA2FnCXWO4R47-Nz}Q+{~-aK3?}8@KdD{2M=b zN$72gG#^c|DnRp@ZFz=R8>`I4XYW{lmzl4~qvm;JG?v>EjP5nnKc3sGDQ*>V59kf_ zCF|QK^Devcb!BvN_f(MI*}*zU+$Nl*Ulq`J*(am%-~qau_Y%+wk>BEPl@*j5{|Hy16X}p{bMYv(9@(-{UVBN=|0NL`o-g3S17uiUx3aXj0 zl*B9GVMCDzT+U)7m>Qfo-~>u7K=qAq`CdgcLf=+^VnM-bSx}3Z3lar(yDvFT!(sHD zw{%=4N8OFStM0t#V^)x-$Y%S*0?lE54d?JEUkxA^S4@3@hc)3cdp`?;+!2Xf52fPP zw}|006wF`I3EHfu>C;aC>qq&ozx1zwHM7|j`h4(LH~Jo0s z4y*Wu>+9)?-~t2Sri&y(ZoQI1#!U{1;$EGuTv&#ZdQtzQy;h958l!z57Wn^N8TRv> z?`)hkxGSZp59Oegy>DxyOh&8tJQ&p@-~YQ~^b}iJccBKhrMG)W+Pyoog!1w`n@)QZ zsb3p1BjvUO;A?=?^s`0KlzY~kDn*$Jy*gSw?Be=7uAxB|BS;+vrj{GF54ryRZU37r z?okI@XfEv^U-$2{BU20-f%&@@)|bFThWAU_FbOeAkkQRU=p-`0o`$hn1{RGz01*iVGFCtO!AhadA=npUq?px>?`==w>TL zp5E`T@9lj4y%(*(_x?g0rA!~*gt#7U=MSw-mgMXb(7q?G=PbP?TqvnZ(u(=ucV|4# zdF-xxbc}ryb+Ikl0q@n)e;50ME)Bx-MintF9QgaQm7gE{^YK=wzl^_MLhz@k`yhhZ z9%2ihNNOlrtG}_y1SzHx;n^}6PBY^4qiWNa*c_819IqgJ(QPp?r%> zhU$F+Qrh>SZ5QAE?btXY0P~X^rmXl+l_U7hKm>L54-)iyOa?YW`%{w>IJ7hjs&-|Z zc(az6wgW8{b_*dym%D>~uT|<{30RGWf2~FXzN4;l{J&NsOL9d#0+ED{lL!Cf zD6#->KJ*{G>F=0;Q_4agE(G2&oM{*`4O{R$qP8At$+27i@3qiv9xTyZ|L}Fon zT$}&c9BT|+^Y|@En-vxoV-$xZ=R#PqmE?-kr=b39O1Ie2LJ!(s7sRfNYO~ghGknbb zw->;Chp9>@=Bi9@44cL?jJ_`&B)Z#W48KssD=&jlY&

1on(7tYaa~#KmoJj(X zUX9{$vLP9gKIi8fB<%Yu2K?I!+!o$@O?sS5!RLqy@cj*gC0tA6V^3CRp$kb}E5|@!d60Si?!X=AhPy?n z$romSA~-kB9BrgzOX(C8UXFrwj!`5&!Eu+Vz1*MVk`S$+a#o47ug|f4b(Pz>+^z;xg3Le>1=!MpoXd`CnBksv< z_RRrw0xCLa)j?r-C27fxP1NtzXLdC?otcbJn*6B){ekPGlt(xF}d4!LAf*7D(#SgA)*!ZLLM5SQa~@_rN%=q`C!n=0jt%I3`D z{cDjBgB2t;{@zroCJ4Z{a-l~I0tRP>t2LKiM>&I~)s?|rQQvf`v_+m6<~O*=XMGx> z+Wqz$2bnevr}r>}g|l>T#VKO55iqypYfC%{5%5@fbyAyYYXsN#^VUc+xd_WM7H1dZLqysuP|@Rr%|3GHs1APmIbu+do0BK_ znKL2u>(+y4s+>xq@eP5+ATWC2#%o^gZdCm~J=Ju&(!6rcl<=jnjiWbf;;i1%VKF~A zd0%Xs=-l%GmO$kx=o?qR!6HY?wd1!^J7?0<+iVK$UK*&+8#JyA-8r&F8J^zj7^+Z4 zz6s4=mM1`d2;%;=(MHnx8S^4AkJeA&Rd=-A$(J^)9>;0q8B(GPA!mZHY zzQ!E%ek?-aguKGW%N^@T-^IlKnfFYD`@zT*Xj)#r5~!sBlQggo0ePbHI zGnggdlVr?frKOdY^X1*=*&_~x3IgxrQu{$541q4|AZ{qDnuqp%f5L@zbG=de-es`V zXt?=qmhD@q-RFEqENsYmoB_#jf)cdbNQ`5!%;Y9(pyCMmP+vuw(rkCV&f8&b-Pm%x zWL-XI$M>`h)DTGf2MBG)vkX@TE+;7nG2x~$i>y#kU}23l?`^zjJ+d-FD)(yL@N8eJ z%*pfagTRB@qq1j4=0tN!yNEfp*9Rv0Ftj}cYn{4>lgmvCUYLrpUCx^y=4n9Z#Xnro zAS#pyBUX~iBhemrz&8^E8;_6gisQXXTd-FLGBFa$=&}SQVhuf4*Tc8mpswQ{yxO5% zYeRf|cz&}xqc)9L!x4*?&ELwS3>d(b?+c6k?-ut1hdly#)`m1x)@er%ew*6x5QSNf z6sCXq?W+vGo!TPIgS@MJ$||xroZltSp>o>YPCvRv6JUkS3`NZa$kG1-u4jDI2Y;V<32E}! z#q6oX=nxc#EOoQ?eyumDewns9`bbmd+YvD-kQlkSJET6NaVswdX{y9t&kj+D^?G>2 z-aZ^P8DoWoV!WRCu%2R=XHULGMjZm{y&`ApkTJbAYrs=}Mqk|~N3(3be7@rHW8cik zj}hvr!Xw?YhNRLuIIY^?q@JO7GPE`oSO@*;af~173Y@$ z`~W0lNsBa>C5(VUvepUgD@lfuydju zaZUlgk&^;{d4W$fxc?*nV6H@nChNA51qtCc)aDTEq7^CCu3dv0S5#sd>3Ef>Gw{0F@=|ttiTia%;~W|!uX@g!)EPPrnMqT1 zm}?ACuN?8G&#Uq=gZ{i>f8>*$5YDUdyvJlhm-j9P&HRwSW~c`_X)Klux%$X-ADG=M z2v^pi#tLc3rP+I1VNzqOkhE;r3wUq@D+Lsl;tZLpI~KIB1w>K4q7*VsU@#e@5Lx!f2vVQCz7Jw!2VrJo=88H(D)OpJJ^{;*2-|N+VCqFCer{m@rvSKoK zIWi+oiAZ#32{gA|Q$+;d>N9lkCy#|=br4%uS~G;^gG@=^)rY;@-t;elXVXoH+1x2c z*636X9Hp|MeCB&4*E;?bJ{jv=|5QV2X=EZ=b==ZwXqW(72z{ndq{>ddbTSj9z5ndQ zI{}7EbW+hJ+T9SnCyQMFp_SlxH2=2O%da8ann|IOm&EnOF{Hl4jpny)gFib!icI-+ zdO&z{p>)>eQ3>93hFTZemcsjYfrMn|0YlAva@!>yi&+e#EQUw#9+WWsslBzw1I1)UVQnbfd%OGI(CiQc?7mG3+Yz=LcQ-)pc_U9U zAP61tGvR}jzXASExQvsmM%Lt04wgFXZK9dLIaE|Z!4iETY9v{79uB=)r%=u&TB`2g ztc5+OK>H9+4qYy zH5z$>@b0a_^)sFh(1MXZB!-G7%uhp3dNV1lzlhd_x6f2iW$%Ne`rqi?N_KjX(x&An$lKY9a&c<>0-f3wkiMjsR z59d*12#(h$25mo=Kcm+^(nx06{UbBxl}{h!2VQ zG&et=JDb#P(tcl3Y^je(caMge6nep_IgkeeS4~aKt_2KV?K>cp!pJ)r@5WgrJjCtw z=$p5t2PCxmK%r$NCBA(XlMj%0CZzgCdZ)lpm!ykfq_d-ohkf!!-R%XiWo%-BUsWW| zntOQ_Qm9xcn^#6o=BQy`>Vul6d&Ui+m&-rCre-mtAMvRDaJhw1^L(h5w6XB9H6bU& zplc+1D1l>M^xfGS`(!@dR9H)KUs>h)V3Wd`#+Qa|WfnJS+4IQ)0!K?qO3Gs)!2{rp z7XvOXZYz{r3hH6QgCm@Q(R)P9II(UJ-!d3>-d3o2Z8}`kGeb(>D>F} zXMjq4d^r%}?*@2rngrxt}mNla_eQ|5L0 z%)g|%{)1j7*J5=^q6rxhk{?KlQTcPf_>&m%<9+JmS*hhn{-o0+$Tya&<4cNIgA;=< z(z%L!L-|7Q{8Y0#QL&GsALitY^abUjHu7Hv&Y+4E*B0C>;!(@C^TXV2Ur>kEQSQmr zgrrAs2D@S=^gXJa*`FqPY|iQ&$qr-*jJ4jBBh@RSPkoqwqbu*Li1oV%LaXlX?hDk; zPgyrjS<)xZ@$@jlkTa-0yv)6pG=xUh7EI0_}0 zqsNJW*qN#=Hkk|~lzpbC%`X&Unb;~6W>8z-nocVV+RC)`9=g<5K)e{9w05sSctZc;5`XnxLfJGAp=mmizo^TU zTj>`s=}Fh!*5}GoL^vHqS+LjFQ%ns0pG$OmAIAxcZ{2b+`R+e~4V*~50@&-h-U=0q z6?=})KMTqKf{ac0*LKB&8ZLhTr2*HHu)E&O4nKA!q3N-AZ&ck_^NBO@A*}|2PCWLO zR<~Ef@W=R=`Co-p-U9HpsHmxC`v@;*Hlq;;u|m3Q<6Td0%xoZ>yF-`~cFb$6%ARuh zan&u}W9m$ZbY*JY9?Xrsg48h*20B;U$7i6E5VZ=5=@tFcUu$@Ho@O4K#k;|r-<&)y z#)JbmFdqeS@7+^Yl>zTn*8A@TWe=sCF)^|a1@wtN`~idFYdIG|)FxAIbtQQ={v@c=Y0!3V^YpXl$`V}52OK%A zWQ~~7)+BRdaE)=)(90>Da-iXR47@E(mo`x7{CFY{MVK4e$b+)lfUcw4@SyN8K8*kK z>3Cue=We%sSJ#{8RJ<1o8cH(|0WuYjf0T1N5aAjk{P!+dP8Q%)MhMG#4I)ZPN&kc# zfAw;0SwP0K@r<-^DeDMmhxMzgucnB||JMQdo$vX5^5IX9{UK+E+SPFQq&^2I?KTyz z|ER0IVSD@6UYC`{ru~ybFxy+dgg^&({W*JR$6;QWy2t1tk@9BF&|&s>h!6wtdJ6<4 zQDyaO%}%zncocXWBbpEWw2hokidQRkl* zr7N4OF{>rfK~eIsj>8&)zBQDzmZq@blPP{JKXt;y8wv1?P|!+L7Fc#PV)~eV+mz`w zXVvNl0fC*O@L`XUj|Rq%oI3X9uAOcRS6e;ICo5uqIq1dS#kAJ4@wC{As;^eo^qbhe zcWoWo@Ux?-n8gcgT?kJDb!rhtNZ^o@QL@a_izHcyPd@NwfrwyGAPb&EQ}J%Bcx#z7 z(ASx6nl2|*Osmoa*W!$&Hq$0I=i%dMsOb@r0^&P2(DFG8{c$+lvJ30qAfm73zq$LE zRggU1LY2P7^`;p(#L>hLFiIrz5|_|<0I5O=u}08b6%xcr+3|z*nrL_ zLbju>7<@@$o4xq|c7ac`2+9qPxM2JW5D(qm6JX2FwQZc8tw!GFJTstsypMS=YgTGH z{#}uelNtT|YtyjA_SZjr0I6ca2a0VG&_TP#yuH{WD0U{ZQ1%w1ki$N*`zRl?mN@9) z*)$FoIOzMQvl#T1&~6oV2-s@8Y0+s*TzQyS{K!GKsfLfAP3_Uu-=@HT38CZ$@+<}3 zgyYz$DLc|zF?v5%I?vVcuH<=aqt!CU%zZ<%=?QKgfLONfLQVhvokFPW!%9ba8K|v&&Ji3N zvpsUQn_@~c>!vP_KH^>_IR%x~-V|7rv;9^}9T!q$fjN@0kCc+o)7a&vbhCNR@k1ji zSx^NXWl$3#LNS#q+1xJMUWV8j%)(L5yjlX7-R1SnN9RZNGy~xI$wZ)x{a>(HY zw10fynxsD<2!8lka^Qp895}ozFbh8HqhX?kaSnz-OdARcAPowrIEo`{x{9Z*&PChLeI$BszRu49FmYS9>+>8Ey zNP7#Qs@kr7{NaF-A|Zl=0#bs~jUWg}H%N03L`q6Z>4PBMEh*iIbR7@`q@_EgyBop( zeb7gEzw!6Yyx)JEarUs$z4v{uxYk_ z6A;*EqgjHq-vGfTU7mANoEfoH-yfp<^g z^f^^7_V$}`%OgQJu-wY0^BOkSmB+FJ-)e+c_%f-WNyC0uWqya1^7JU70Ed{IMh*T) z)h1j3#F~<>*QJiJrLXF9h2)!^dWytq{$yjMh%TCV{KCIu_Gg2<%T~nhq*p^+=gQGb zW4l|X_!P|F(T6Z!kmr(-g~cD~xvS%M9@A|U*iVEl{aB&tjmC#o5|Km`fjVug7Wd}x z8P55p6(u3aFBbIX#{ke)fUa=IvX9CN;eqIc1dB$My&y!hSkHm-4Em+lH|ObiyUAS< zC3N1=OT4P8G?%XFm;XU(;G;{!Rr?-VIe%%)-Ts|UYYT_o*i(M>N~mV+6WceYrl!`= zhdWpYH8}<7V|&S@hc-VD*nsaO&e~~Yw9l4*_nYwgZZABk!9Cg7s!L#@O@~xPQJaFW1$F5qrlbE-F%KR-wp#%ckd(|MO zR%2tmZM|B!?tw2W&1(lQzh`1HW|NkcC6O@9Fdj-RC7PP$&VTwvhVeb4`Zz^F&AiD$ zL_q=}Y4z$Siz?{pc9hU4{n7eHVKdoAAony{;#1!H#KlMV_r*=1&YhiLsMEn>N|1*A zXDh17K|tUctvxA?zP2rph5Q^or#X36>Ug>`i4zyecxuJ$_Mi2Ze_&RCA3w=GiW7-^ zkuR*VQ|0&*3FB-^;J~xmqJ8HhK^G$9aT8bd=n&a-zACQ$0YK+o z<2;n5zVrpoYd@`N<84A?c}yc~x$v(7L+ok`<=e;+mhIjxr;U4^?6{W$ohjIeStj<# znDBDp2Pkpf7bIO*yeP_*nuWAuBT|Bny?cxE8y+03f5(!raypg6r~JaVUOujEz1M#$ ziUlx*>>HR|3DD^Fc=!&J-u@6U;8jTMF7RcxIN-M_{-joSj*wzec-*o7FF4F_SGa9m0w0D($E zhbEQ^6uNQ6Tt-G|3=HXw$H3?pwd58ZOqaFPU=JwpE$ty7(8|&r>miG*Yzd?BxvN>_ zc)Ub=s?ifK?7EJk%zbDgp{b>I6$zY`&=W*a;NI+8=0FDzkeK zn9sZmSdTGG@U?kI>X7z*&p+e9_O*Te@cªGRFP`@kU5^3d0l;9b*Q#Y?~d!VD; z^;;;{IX%!|TOx>ZWEd!Kq%3_j^rcca`;J+x$$?oX5=)Fi^AM~gmPbh#q8{mm2Ghg; zW^bj3e&{O`z4E8fd7+m7zzV6{+$`=dS({yQmEBZ0)>CZH;v2iGDXoRcuR~fsMSoxF zQM|LEHkz;N_sI@s#ZGqe(g$QjKtgcG(FEIhKkRO$nV2xPGpnQLk9&QEa=pkVOUujK zAr_#bUWm5Xg@WSLnA~CeAA$St_Yf>ZC!b>Aw8}@lcrp3=kRxC(G}T}5d)}iCP3efq z{`kp-5|R7jKP%NTCA_^R&Gx0Jl;?%gRpK!i)iJ&;C zlUot}N3!j=+=kx=0!v+Gd!O{;E;%MF8W|cXMEVYhuC&gJ1z&G}Y@c z9?UqJrH7it?kabMJOtz1YILuD87U-MOQMy1v)#-$pZ4U9E5j^5=8F(t3$Nt3MN~D{ z%F?~j)_28kkvsbbzSj}f3lTs>sgf-CAaF{^g5v)Wf%C;l%0$80Bp~1-yoh^o=qO>U z*iPwAA4S#q5{(w{DCG4}w%@eN1V!v0g!3&C9U!xJ{HmT8?{HyCQsjW+SY(^WxU??%!k{J(EwzntLC|*p{rFXuGJ_0L zP1iFPt9NN=92@XBJzm(eWq16j7Gn*3`XeK2T%bmB|DX!oMnUr@Kssd>uH$;TTfz9Z zMIbVRpdCJmW!@3KNQL_oz@DSR3pK6`#xtWx)4t$(d7f;*`WQO;TOMR_RHtmvrd~q5 zal9#mj~ZEN`HSF1cCU(4?k;?clBv_s^g@RAnfIW=x@nUhvEgh62pHyHCMf<9_9k#h z6uj_zr^;o`Pef>bddA0+-yhA~i9V!n)+P-?mmewd&zkH34}p@oI1g}}&`^>ml}HbL z-4dh($wS@XVQ7bx-QUpv{QsA9uGI}ZigifD9O;tWhYGgCx^mm@k9_MZ-NUDlr-IM~ z6}G86&L(%ThpK+8n7zU(6tA5gO!OYRS>UaZha28U!d4?SKHm3iiSdSOvqoaVfzGVj zo;987$zd}kB>;B?0^FqqIbOdz#lUEt59+SxasGeoxv$tiNYE`cYwC-8uxY%nlQ5>y zV`;8uGr93{#nwJJbXJg~hx^GV=(FNJJEcCi#XUq`-M4$F;I~H$6yK3OGhM{D+H&9c z<>wDeI7Gx)(;_r($de)y&g;%E(Z3od|F9?{3d4H6lgUep4qxGzj|(M@GZ0S;JS|U z)YC{iW@!pSC8)Fm6vJuw7P7weqZDk>VMkB!$ca0A&MBEYm08FnRBgT549Ll&1Sc%d z*5q^Z8emKwZ|PBd#RYZDk3gB5lJfsy8@v&=0hcq%{bDIWwd)7jp>+B4wqm<wzax3v8Bqyj#ngE;oOScxG*MJ1n+F<6{Gy|#R9ZOsZ41B9^+ zmNWD7?PQcPDv2eW)s(bnx(01ut{K^nYiq~I$~fjq4j4ZUG@~R%?^04%2Znv6H-SVT z*unfTdSH(i{IjFt01l4+S3l3IV79h)R8}QB+ZCnpDGCc@Uq3Q^FPu{>YaUr|9=S{C z#S@mcxQ7W$_KApxpcR@(Z7ugEftP?PtWF-XE!+ANXY(4h@b$lGDjh1&)YfN&6{r{c z2&03rpbA*yeKNYMG&=C8Jrhz*WGNpQwUuhi`ww4(LzB(de;j?!r?BO( z1#}}bt=fTR3gl@rdY4i2@06f?8*T0lh80?`4CdhqX&H{ND4@P*k6wDw5ko@iu)jq6 z_E;HrtRucw`&*~7LcoA^7gc9TApt>z`I)1;*0!=AFjvh+@gOZu`D6(n z-?X)v_cmSop07|K)~27V*zx4ZS~RFgwE4D0l{><#cqerV0&9)}*-scr12Ij70pggQ*TcBBEBAR+AOSXB_toBRR zU2R5#hGX0Ok~E&E4=(LS7>9i6bDu17OhQS}&K zWkHGq1M{YtGwNv;dMDG<)BA;)9v;{z@(yDZs%w%AcSIsUtIdB0DN$!|ox&DwHceA*GAAW5?k8Fu?KJ>?%6hK+R20hBp9boH2~lsZy0aYHpLt>uRz1OOQ17;>WP)$Taj-Rk z>{r%7u(948t810#XB>hvK*M^Ik<7=?YWcZ-Eo=a8zGgBw5vi-I&+&AyubeD$?S@UB zdQGdXH&Jk?G(fj2B?zJ}J5ovsrp=I);yj;HE+h16OKMO$)$e*hR4s!fkM&e~&ZUtleF(()43H%V?_vC(>oAP>Oa@Rix@>M_m zuqxdCYZ!Y~{iC184Y9d+*m1Rg;-HA+l+C&!mR(C*a6Y=wzxWUO$o?!`w0Lsdp_AtQ`It*UNG zaqo?UnIxmq{U4eA#?Pu@WHim13X>EZDd*_&0RrJYOw^^BrYqWB64PAcES z!`W<<-@Kr`U2??XBmn%)m8OhcvbAowL~!K9j&R214JG~7O!9PFa2EDf#Z4yd`Q>H3 z$KG(b&PH&C*DL%@6>m2SRb0)*RM41gTd4v9!@YM+5}@zJ&sn>cgUiAymNOSHqavJ| zM~?tW;+5@G?r$Y8J8=#-Zhul!3DN=xtZN zL6DWRo-Z2A+Kl;uMMJlX8Sd3K(hxIX&N=5?YEFsL8jqm!!yCpX52=#wXem;WPx*bA z;`^)9;6gYJGqH+0mqg?)h;WLYhUhV3J5`1oOxI=TJ$gV!raAszg~8c*xz89li!~?h zT2Y@##oqSPl2UKvNe$P|-CJzqt31|kcLpUZhw^UqG=lV5hPEAMlfA87xe9|S%9>3C z5dQZNuDGk*4;QBDk`}Y|)}1&?ILw!@eU!`c9(0%ktNQ)>m45KGPnuy}HqT1MO|R3A zXk|GRs*S!VRY1^70h*vy{b&cGcv3_^lPPLv``1F7*$(-{ZwgbRifn}xA3xJV~ z{%x%sk;KMq94X%`WHwi_wFWj^A6OUPFX^h(*&SNF0yu0Q1B zUzf~SBTR4|xVC#>%3+4?htAQTpWfZ^bQ^cm;61~AftNQ9>O3h91PL~>ye-NNGTpAD z3K*CKm2JuVMzsYY2nfJFQv=)CKD5maI|#dcc+?M9dz-1Yyo(`_`>McsFA zD3KlV^6_dpI>shyUwKWhXlnFQx^iTjFv0rN*%{8HQWwR}oZMZgGIsK`dF*6&v-${A ztG6%f^H;+}7uL*-ockd*@cHc2m2Z2`8B!>wVjrfpn3d^1vs~(@lwS46#DCifp%=d5 zlrmEnwb7G2$AbPWp6rgSv`$#Z^O|$oaDH8Hjr+Gqy^SnH3PlhD$+0_k6ci;oo%Zp+ zj2P=^RVrNWi9l9Ix{4S=Hs0FK6j94APHxVbUCbKkfW82!0S8bbr&a~av3%O6(? z+)CXh+2PA{8y59P-(3seFV{t_E3XXpl`TIuqy}}%c^Q&%K&l+g66g#Cq~83Z?P<)e zDxln^PnyW=Cpav35rh31bV$`v;p_S4NAcG8Wz3f$BO02>Q8n-0Jt;HV3f29Z9l0G zj6@>}fxw9{;Fp4~Keh?>>aH6w*LLBT%ry=(zWIUQM|q~~dfCX(N>eOsY+f1M z(TRcg>{KdsgS`)?xommE6jdju`p_lXrs~`r&ngV{0=^v>hYHvSrgoQnav3MaMWcZ> z1RCe&=GxFt74-}k_UGwDSnd{`^+g9EPg-{gtd+K$zF=6EFK-CsLv0xG=r}Ghb+`Kv z0c`a&_vTW5V_6&1ILK#(#SFC%n65!mcvb_x*+^{Mapz8vJWmW{AQA&cvJQpUKViIy zFKy|H!s;g7f6n`}vV|Qudd8-!G$5MwW{s*S0ptz@4rT#45~Tl=wT6OdX(z^>QIn+w!|dsEb1a;do4 z6~vP_2yeU*O}ux6;f;o+Wam$V@+3@f6_Ca(*l)3Mq4eN>JCOU|?G>1mdC-R+)C5j- zvtZso`ShwvbshC0metk6Mc~EWE4T0g+=b`^A>l-=?rQ`63Mx-kDh>G7@zBPUhYsA! zH)DhoJ4#+=Xvblo=jGyx@e^E2ziC^oS=k_)pUk>-=byGj*MYr*12FKAx9l|31IKbs zim5UoVO`f(bd<^JT0j6iZ$&;NAwn4mnvV@SYu!ahs{lG2Ro0OvxUN$jUf_ zck>Da90)RaxYbX;0Fl|_;e5ts+uXMbT|rOsiQw1=xz#>05~e&48?<$6P7yS0SK^^YlRA3XQWNXBRw9r$~oVYA;dnr##2 zLi6ne#}0B+J3n+fy+uaOe>!$lKL_A)<2@z{N}z>O+M0)2ny%#*XLgw5;pyp?QBY_Z z8kS0R#(}{>!CM=dF3h(!;ByPOv7OM5)E~=6=B(Zy=dKdtGhb6HX3#iqKzPltxtn_M zz~OVLJS7SZIU+$m&|9K^Iv+=PLXO}3@JNZm6`(&?75z2n414#DQciR6(a4()u4@aA zu$``g+;2Bc(j(+)(QLFstgC<`dl4x9dl^m$GXjA^%GsUb{|pou5rKjMsFem%-UA4* zEkvIaRUrPweD3gBTlz~=Gb<1!m!t=&gxpVvH%6J>1}q zTa+p&PFLSv>iN3JvVjJ22z+})ZvE=T_k&|;=IabQg_e>7%4UFD29Xdr-m|HstYrS7 zW-ow#6F=76w?KDM@hB%ZQE^GKxkQ`YNWY3NN#f0ZmYU7#@=YIn?efKP_0U(UqA*TQ zC#|lPMI(EX!2;{$d_oms655I*%$wL&tG$KvQ)&;Ud2G8eqxu}t?nvdWWMx4FNK&%g z48<#T4c==g+YB)p+j58&swSjiqm_7}9X|CzhBgm;^WIWW@jWKeDBQP9?jSgQeckXy zi~<*vnq?+`oG}~IP#_)!GZOlcp8;s@UIh4|@J=wUtn>Dn!vcRyC*P5}X8O*lv7U@s zJB$D+aSa(XD#-{=ZoLknhafU|7x{q;p_l_xQJ`pKi9Gmj$_nAK=~nzMIL}m8}`0YXl3G>-n7&S@w6C?k^1X_g5VsU&Y;4@wF@% zO^l@<^LuEI!n;C3tQ8M+ECERtTkZIG<11cwEqT(vhPd(1bB=+u5I&oF_O~I-sKu@! zfc_BKd~ZZH|BE~;F3Kyaq{KJ>hkYJ_bp_^ZGVbyztk68xEk=u8ZJ#guwW8dJ6}4hV zu`HGMvqMJY>^ueM56X1C_$z!}PoE!4%Q_w(H(#X@BXBqU4C~ULB0=#L6ofYYAC_<% z+lj{Lqp2EV=mc7%KT4qp8X}cja?V(~yZn(W6tlF#8^_I!)(!d2bqI>DjNl`Nng3O9 z5rJDt;@Gu|ct_A(uoyWJ9UM5tHyMcNTBF1l|2j$;@bO(lAL*GQ+AZgR&vZLa{~pUW`zhmY-ogUi6&Jen?*Xne0GJuY>3cWbzB6p8da8efReMOGi^QgB7jp#1B$R?C1T;Ky|9<8c3{(qwLQ45oS?Nu@M1#a8V2T z_flR5WZxqOU0!kh5y^ib=#Z3+Izl||=x-FJ#d|TG^&=u^{??HF@=?}2?bpR@GPGcn z#EcQ|>K1&Y6rYwGd@Ri&a@|@G64I%(|9}6q3ZBgvW?F6OcCl*^QEFXQ&Z^83F;IzF&ucCgTX5FIb2Hj2BIoVobh8c+ry`*XO z_pK6-D?nXw*DjdguK}DEP}Me1JpD_WDj8C@2v9`|US4eQn8&MR^iai=4&&1Sn#W0B zfI&2GD+NhEk0<-bHw3~Gk$w?Dc<=$ zP3sNl9h{ph0|j?j#f&e%%f z5btGWQY$Bqb^$Yz@-s4MjWnrSU=}M+%hD=_v5&YVdR984SsDga>dIu+bCh~!vsZMh z{0Ebr(*2cC;gusAT-F2kYh_Qtah8=3l*r@nz;|#UK{ZWt_V6xM5H3kztD9ihkDpo^ z2@ccULj{lB9eXDIqYUQOy^oLh| zPo^xpM#5PxfLjruk`?Ur;@MYiiz2kcN~#VElWwbkYXN$hwDr|!3YoqK%3m_5TR(Ko zD|ywoW=jrIPs4=>tb@W7p{h&}c+6*$0pErsxb;!Q;o)m$B&druGw}t&y=1zQl+j)z zB{Fh;Te}jWSaD_Ga#a{cg|J;wHWl9Q&OY^fh*dm^Z8~pw$Ga>4b;csd`MzYU+)-FG z?Rl}aqSolDLcVUGv!}E^<~5n9GMa`?>c>eQXuy3}cVy>fSy_XQn)2e}V#Ki+mQiwS ze5U&^RT<1Jo;o->)_8Y~GzNm!t512R>v24kin%)t?4p~I4>Ui;v*rf|rMtpKdP*(tdY`*@bBHSUg*4*Zena~H$F|AX`ri1UM{Pm67h&@tiUxR zJKsm!bf7&(v0!V#7IddPVAL6-S$}(q%;F_fQ`(s#I*xi`aAqUAA>rpUyt1H9G#@ zB)}}m{AwaEBFRDlwJHcihFZN|nPj_pUkyhqx3-`w4_Zs1xM}cKS&Nftc4%;5U|vI0 zbM0dg{bSIER%!auKP^p$moC7D^7B>PtJ!Ud5#Yd8ZUUnB<+3NSjbw6ZY47(rmAW~W zMv61PcEur=`EnPilU_}UL$!T*_~uUVZXK}RgXUZ%61`Y*TYCcEQ@v8q!eCe$|+2t4;UAPqze?>>WyGfj7XbbYH}s_K@{B1Se4_qw|zL% z;#BYL_eWSo5rUxOmnt^7yZJ`<@T41@B(aGJAf^bt7fu|D#u!w2NPSGH`W6|gQ0mZ= zDk1T>JW7;&V7NbGZ$ybk?xuZ3v}1gF_uA^JG_T=)?l9$jsq$TFGJmdQ#eNV_J5*MM zjh*fGb>Gw zPajiTXgSWAeiL6I34@)4c!k=`)Qs77h+2+M>53DleBvVlxUn%IY7GpKJBOHC{P;82 zIfj`B`-kWH$mFC{?Nu#h!;uruv`t%Qhic?vScmy;=eQL>6$k8W?M`^YMa2xg3JhOO zDIHYvOm7pW{)}MjV=0hY*Ze8;B&B@TlPp4|dT1<8T!v4kXY$>Fkf+}`Kfi#e<=Z$- ze7U_G%%#X1^|7FtupkSb-ZUCE-ywYdWcLp&H#a3bN*! zp5DjH(~kJ~dor;CZP$hC42%CB!8}AnFhS0NsFHZWTuxW6x&TfmJz> zA5w7&m3+&ns;U_qo}i{QXF~s7WO)9C^k8`P-Wk7WT@<eqseAISj@H$zz zSXX-to0k3zmFv68!K@UhNq6nWeYKC;Q{saoJbNh2TNi4ddItKB)fg`K0cNU0H8H`fR<~c%PrRzUXB%kGyOTkG%s0RamrxJsiJjh zSts-v$|Ab$LP^D3&)%G2<=^p1-D?VFfZF?fm=suDr$qU7eb^H1moa&ETRhHYSl0Ux zmIbm!H}FKGt}GsHcz1(MgFW8NdMEO0e^&wItWz#!1cy*=uQ1}zjP`gY6>8B^0D`w=Pa4BjIZ)j@7h z@qcdg*GOQS9DLWq{gA3lzJ^FrcL>|5eB+v@1usvIxwCiQEjOT@~HcbWs!`=LB*GzXXQ z1r1pK-bwd#t09t}JMTXzj%m`*5tjY-fOW5FnYo##u3qgsWtdGh40Om+2p7y=@O6Ip zj`Se4;Xq8}v^uvDRzMf@dDpmiZ1$d#yJ=n&{vDG$|IPvkFLRc__WS%HjvfpEY&F(; zEzfOhaS!8gnfl6B?r_mtO~rSo+kvx6Hi2MpLb~^UJ=-ElINcTW!<+ZTrFA*}$E2$Z zA4P)&R0jV=PKCmsFqZi{8rCSRAUj*b11tMS%5Sl2;)0olJ}Gl0qAbu_$3}%~(Oq+G zr?PU2rKo3NV5+Siwv}8SeVLZ7aW;YX(+d?@=i4p(Tu-vYK6MLIM;m%|8B9KIBK)*# zSlH$3>*lU4iZ?bvkXBw{y>Rs_JK4u^xo!;T!F!WMrAW&51TbA*3 z$6F@t(c`j4vJ(@_DYm2(Vg}LN62abyrZzV;w!u6o(>-O|pUHmd4twrJhmRf(Rodp5 zng{w+m&QJtRPia7lM)m28vSG-wM%8}Af-?jMPFxXYG!M;wr0F;X=JZ2EF9|n3edmv zxn9@m&FE8p=K0*>iFP>e^Yz<)y3&4nMH+Q9(^H>~HxE}!PjuiUNKg!#_m{lupUb2# z2;aMP?fKE4AN>O{MyEnQlui$}v-tvBHo@Ig`0Z2xDwiXzeo{15$MxPOY$1WouoT3> z*LnH)_{Q6qYDobH5Db*G45N|3sN}L3nXR10cKELUb~+a^D3ptc;%Y9zAg}G6fu6xh zLT+Ac)w)5-$Mtr&H$Z*tYffI?-ngcyRusKX(G0zovXEXIj#aF+QfzwVJ()tA24`ny zSy7v(^Ifro-ZOn6md+k%pENuI=#zIUQszYF2F815UPvdd6VE)95j5V>h@&(P%#bzv zlwNBGO-wHgjBpsPjVZ#D^(EoTCCqOzcFI_>{bHry2kht`iQ+y@`dCg#ZP-&4m5Q`B zyM2A!%{N&8F%|evV%q>58v-4ENzHXhor51IC4cy!@Zep$E*oh=Yw@+upJN9Nej*!tT&n!PL zuVbTNFQ<1*8h4}LPd|=;ATCe4tn+=o?7ms&n1_;90a_oY`B*r+oOZl_3_sugKVM_= zC?naLD-r!j-w`u}27@XSZnMJ@2E>Hx2HDeEI6P78v_s#ijic_>d`o5wrw?a;mYx1V zr^qhv5vRfSb1vHvcIco5i+v3|Nt>zqMaTQJFcj*3m|UYzQG{`IaajpwFQ@6Tn&w^o z=hvQwN2H$wjeFnutl>GdsBCahzzY1ex9$X7;;{9HiVH}_&8V#J9 zEbKwYgM6qKQc0%T$9qGDA%w@Kd&f21{DFB&CxG&3hx4~2fnWtLAR(IbwVwX*%t&ZN zFfc5$gb|%5?KK0wnWn3xNSz_wuO1kA3=}*FJp6ib_;p^uSGq1}N-M@kALx=ys%Utg z3^*f7#n@ndAQ*qZDT$#*Fee(ZL^&0E|1sQObYCNW)ah$>+FfAZgIoGcrQ# zJqs9_S;4YW6!&cQsxjVJ_N#x>+An6xwz0D-pMUURJAJVVpW!=uJjDhbXWuF>;D2lK7Gsv}}g;Bu-w{ zX9LQR_Y-#6sqT3>m^>|>SF;!rD@QoExEu=&7QY2&V?Z+4Wvn71R9c!vV5KD~4JAHx z=7RH>gak>RN}uyJO6Z-q&72kWQwXt4=+zk{AaEXQ2w}CI72Gt$)T>R4$Gj^peMp8s zU%x+1zP5OAr&h?rDob>Hzwf*GcB(}7q7-kgo>;u*27k6Ru1;(2=D6->jGfR2PKZ8w$kbh>-X}EWU9$KL4YT_rX;VTGS@r)R7yi-JlX}<%~)eZ`Li}- zPG7~3ho8z$kx$LZ6FNDftar##y7WZT1awE;i>r@1S@33T$yEAPWH+?OSCs`bHbfXj zd%r(LKllt2>SBnpPHs|eeMtXLUxAHiv&X@c-t`ey`%z~mS7I>aVR!Mb)UY%OU_g!6 zNpjx(v8gy;Wf7L(Wb?yaK+!gM{2RJK5e(nSnr8+$fNU&2OIScT)s{$Ucu9Z$T*4H| zgLUdMa#W-6{-bG7GEC6!Jb?b$8B0Ss#n2I8*pF~@H1seJw=RJpe~*%s6rP=7)Z~(| zlrWogTbIX*i^QswfIi{|FWABZk7OhNZ*ulJby3+}MGXTMYnk3|OuiVu0$yevbSh9; zE~myGzf^MrX@O1CO>^wo*%X+mKuz-mt9%jz;o3 zi*CT*oY=+FKj8=hE;Y_&F12K&;QozDb@OXT(3^s!=Q{_p68#4iZdF2d|0<*b(d!lc z56|D(pa{@NU8HjV#zhoHE(aL~kjk;!LnuTY_X;i&G~vswU*VR%BvAgM>)e`wzqcl- zV&{{;NG##|QR&V6?5{Pe%s~T?T;ztYYnl*s!{rgkNy8Qvvz0 z{3SnhS0K(c{GX)5GHDS5c~Ikl#F6D$j!p+U;%R}@CoU>n@im5;{t;MxFbcIL{*Q29 z$`--efm|5OH(cQFe_%b-!Tg@)k&Xxg{O?WE)k0LbwaifcV0Fv@;E~V>%KlXusS#+V zj-^3 zWq)Cu3AZhqSE{_ngE6--AE~NBgyXD;xR$wZ<@cG4ESRC4O!p)@(Q8w;f0^z!{ z-atN3yIPJjr!)EH$5b;5N>?e^-M<FW>cCM{!IlA7=rk z$HJe>t?jQKC>ik??0s5j7weq#6{XsZDIAweGyx~<-g6Bl7BI(Yy~4`~t%1H?nt|Bi z<xv5z5H)PS(n7*M!F#GG2z|qkWjE=|?t>*pRS9BK`X~Vnk2yr*B1>G?eCVvEU zbbF@J=;HG(eS9V29~aMk9#-tOlQCO0bOsznxRm}w6!Ks$ zBxhu>v*Tt5HBMrtQblBlwwOPb_u?`f3G9}^N1rjsB_X4NQGuBrTcUx|z3Ny}(GFRI z7kNXn;@X|X_A_TqMH22oU82X)c>~fKCIBZhrg+v7iZp>mc)THKy3vh@DnoXR3%3B5<1> zP@#d2>GjNO{N?KfL8uFCiPW(c$;G2}*?|I2%B#D#;OceX)Sb!AD+J@AdNX9K*$g|w z*}XXOKPC47x?{!q`t35~UYfxe>bYmOpiWT+D#NNw_pBHiZ+&!4n%vvp1-;S(RqF}s z%(u%LdeZVGJ6S$_AS>?kt#Nh+Jw*fqGQZSTfhM@ht>B|4uqFN^hC)fqK!`AAn$-XH z#!0&flT*X5-+1Y61uhYwEe~7LsSnfo!a=K1){uFWww)bEe_?Tzg15%#$XIqn&e&Ax zX9}+j>4eprOggKgj>6bYeDA5XH?sS4-ZnU{7kcGn$}j2L+`?I?qirg**4@osLKsm{ z=>xcZ_WDEXZ$;O60U8Uf)OM|w68GgOvArFLULqBBgTV{VO<8EZd>VW2|rT}v= z{LaPbDbl1HXg(yZ&2qJ_fHom)k~lT9x|ZZZdwkePe93rs_pKj4+Ih?CkkFB!F#P8{ zAiH_rjT;MeEdui(V#RvvLdq|&8c{RQ%Yd1VXU3P7w1G0X){SZSW9D3Z*s&CmaZ!%stQ?i;OBe46jhi zkhKMe*lsSpwym3*N^<<+L;GXsxYA*xuFS@ZI=?b|qwGOur|A0Y!j4 z*elA9g9(l|o%q_KnCvzAcrgSXjrvqz9x4iKYP}kbJ5nS&0ZwxiDNtCK3VqS>|Cg&u ztn8(3!wVe^F>Ks~AMw$*8ZS1!JnX4THeYKgES7 z@deX@1V>ri1!ZM}n7j4HukFz*eu4yJxnaT^&gj@*Uvc+i12*ORgm4_01#8zJfqgZB zhMn87Rc=fhS*M^W>s-X?{DFGbms{QZ+s@GOBXU<3U1}^BcLmMQ$73k&`)n87Kyi|~ z$z&%ZBa`s8)NFKYCg{=n6~8R+7hMT+Ag^+Vg!b-j$JH%eakaV(Y)3i%(_+GvE6AUe z!Qvr(d4?vKw2F3va+<{KfZsC?{Ort4YT={dX`zw(0Y*k56Txjd9?a%%!I-s$9rQIL@bIG|IK0K1E9Z5Zm7aCA9q${lUGK~2(1Zn%uA%18~ zyL5fDD<1hXmgg{(Q0e-c^Z4$_PBauTRADG+I3&nTrBqDYl$xKYqz2#?<9T@pXOq@B zay8k@;E(EPPWDDgnst}6{pp0NcAjc2Z`7?n$n3(a0JwxuJ>vY`OGP;OHxT2yn{#Y= zCODhpmJJxjX2yGMik}<7>4v?G3WLdFOBy3JhCxB;8E4xDZK+@!D`SPuliB5noL3)m zq$y^=2~DQ zh`xmV{cwUy@B9VL{|?N8RI#6YN)rr$8|p5fxlg;a9g-q82PQtlb8GTsBB8Zf#AB{Y zJ>NEiwW?n$$R==8gJ4cS8`$Z$9uTl+vS_oE(+p9stbJ0^fdBdPDr9;Ur!sp-kcA97O0(1ZEMJlvQ?8pY{*c{c{+J22On%>hp@J@L)TaCd*d6&xyRp~g~(}}`Dm}dt{=I+z#>RFej zr}T5@GRUd4qd!2oqmCu8gS%Nl=h0D^S@r}Q6ZRZ}o?JDHIbmJvKoA~Tpf)#ZZ?8?4 zd58FKFck?+#Lo@=P-mhjC&_0?f_}KSoZu7J0{tc1r+|*d9j}s?QH*=IJJ|C)=JBUQ zv@~KArw$pJPd#KQqf=+Ssg!=IIy_UN4y88$4JJ&%2XF zpQ;=mI~a6LM9sio%y%U+0dV6NwdQ02N2W0?o$PbCZqTmO#T=Lm1Pgdp599tH}(ySFb9hJRR6T0)~O6_8{%J!?Q4Y$i&LEkyW&U|OUpaSmX*G+H2t+mnGM>?{W?U;UHi_f8T12>j$={Tg+`p!OBmCSQKwX_Q(VtV|i5SitTMxVjvw(D3}{;HlUm(0$;mwiM4 zjB}KJxPJlFXT_7uQJi?T#Wf!QPW&meVo)_1QF%7=`^P}N}jH$*rdTiTv0X>k21ANZI+^qT#57KQuag6gPEjVlzPlV>1A_k z_D91YtstO=7XDVyoyd~C>eU|cBTM^1&sWmqiu#Ki@6F82&M+B{Ps|-1y^2dqUwr6VMzv8$yM(uF z{0EJuX|vJNBc}T2xpkM)D1U66NgzT2M=I`?a-L4;J*4K@Qe^#iWe{#8^D5*TS$zE6 z!gA8-^c3j%y zs@GegSXlG7uZTQC0W=kx=5@}mDzwMFbTq$0WxDIIO^^+k2V)DkWc%E~xCbh_Z_8SB z8BkeuaI9>uRz;84loAWnq=zX7tKv~};Oz*0$9-?#<5v;@XGVZszk3_Dk!ku99CNkM z!>%8%ny1ZxN%(-+dOZ2Zu%~p$8T@42b%#Booxn_9(^nL+);BYvcguqvie_)n0#D zTo5~GK~l2$*KF7|gK!U(bITm|Ow?yltmtQzJ|wsZiPWYhKk@^|=#3}ZF|GEl5LZ-I zWoVX~57UF%*o=A02#2Y`(xBBUbfdONDB=Hukb&@dcw|)A$UR z78>p2?jV=&ohXZ*l8pZx8Gf$8uw?`oIo|ibb;<6|J^`*vz|^FYf2UU+#c3&1{@3so z1;m6CNj70h;E@<=9+UF}g&;08-*a(AhW+DkEB zPG3K_;L9>TtxP!IMtLtGXc&}Ccr}wMMK4Qr2{io+U*w?x+Vl^)6lwf%&hm07O+j^B z*w?^Fv45sn&mDz`FNlNTYO^)E+rM!URM4LkMG`SE$O9dJ7R+3$AsjNEtr=&kp*n%S zX%uUg;&*u}3PzO5L|r4{`m*w9|4{$ce*3V$CI@h)!_{w!YF+kM)nmX=bV8H_0qZBX zT~}F{P}+yMzj#W7(YBCGZa$e*yz)-7%v@&F4+B$1nwyyU<9a0!2aN( zM_>Sa@@nmqxrHDyyTMly^x}Pw=%f1{4d|SRkNasIr(j>Wxj&&<3;1H{ow`dbgiJC7 zuvMR}ksgRF7>s?d+1~iu!BEPP+ap2C(|*G(GyoGO-*cFXq%0fry8I}A2oB~^4=PoG z4Tm;LJ?|LdfOmXv@Ny>ENIfzI!6mE3#6x=nk=xF@Eb3KudD00FhcQRbPABi!i0$e~ z^wK*i+?m@ktOmZdaKnS!6*fnqT`L-ZjH>r#raAD9 z)ig(b*F7bgs_my0BaZz(Bwb$%XPQ%M3m)a5$=$snn<$_SP7G(D&+bccD=0_v<|lNV z{Tia*vvRB$LXLhBC;yu#fo+1t@H7;Y`m_80z>M&}0<0)GMM1eK>i9N>?0gBS@W0-l zD&peKv2bbE@ZcvXJoJ|7tR#|J-+1ol)^+%dLLM7(>_94$G8~bkUtheQk7<|oBJatY zs)dBAw7k4=zqZ>BixjRe*TI?2W@aH=<#hHVF1oscx1BaW7t1Jz+kv_7jv=ua-&{7| zx<;i*MODl=SnTdWoxWcgKG|+F9)0(q9T1V9x8PN@_z-fCJ$x+>4s59?7S0v~r+02x zh3pa6EN-Gs{)9t|@=xWQ>&wfbDmhOZgZ5NDq=PbD#;Gwbfzsc}SVVm?iiFnWk}fIV zfyGgRS!p*R@Rv5_zxDlYuzH)BxZEvq>5WybH9Y~61gg6I`LcP@W43@1|nawIk-rG6Izzd>GpZu@bJ zA&vhZXr z?rw(ec=s1E?mfPr_x|qtAD?qnX7*lt#q&ICEyATrs%0e+0U)`iD%qDzpTud;cQOHT zC9Hl~$m)pn;bQ)dI+^&ya(9 zu-c4cx7ly*OVX8Ov$(ss_00Qo!VUQ{>y3VHx~0BR>ItPceBO&(`mNV(p$)Gw%eL1v zU#VxNrO6NOO%@eDlA&JXpQKv5!N||qkFd$ub zC5=y~@@ml~-XMP*i7FyI=O-7MyXN#r8`GbaRFPO%tA1wWFjP!ars3*;`5G|O>Sp+FQ(EHj&}wAaSYJ&yniWu7W# zt|2BoVwSaUMgy}xHT=)T$31v8HmwB3y+3Sfl5l4*jwB9=U`2VHKU_x~a-?lZ^F|7w z3j1xRA{@K|(hr%9uSm^xWds2A%>N3fZtyy*Z(n|3-onOqTi_Jc9KPk_TZd^@R#xq9y?xTqfmmmM+?T*jw({ThymI>e#qio=HOd{ggB@#?yLx{Z^6%#l`Nd<_ z`j4THLJRnA;=|cAH1+uY)XUhXa8FK1EuLV$@FPQsR>pZlvNVw=3`Z82ej1tI zBX7&;Sx;RhpD-msnS^_m2OF~84eg}3bm_i9p2L8hQjX2zV#!MVqzBk90a}TEO5HuP zoSU>Cn^#-eq*#_vy@duV0)jwK7V9Ulo&-I$Fk0!U4YtiY)R3sX9IXltsPuM+p@DJ` zT5fb(nl;l{M#gt<$yIR867yy39F&_i&GpKE2$pEYLAs0YPqw~2Vq%U%;ZNgsqZ}S% z`FY9UyC=#+-v74C5Iq6aQparC*TN%MhSs?s8@cf|c+jWDjs45v6J{8?x7g&Vyd3Uz zoOrS9^^49K1qDijD?#}-*CIUTC5t%+jgzJqCRL2z5qF_WGh`wM(forVqPAf76|ug) z{)Tpsh;6U0`xZ3Yo!e$fy*TP~DA0BBe4mw1(XKqpxaUX8yc9xsJNb*WFIwJoX z$k~6AKFTKpf8~?VE!VvOx#Dun3u_SnHs%L!8(;szojq0a)|-rP1+YUkz`K!G3pU}l za^86!7LP_d^c<|UEgL3<>bE7-)&(-6GCf+!ZO7l4R!c8Xcbuml4!>jSU%c#XvQ#}9 z$!Gfn)C)=^ffyDH7^9|4KD4qGVoP&+%i`S7{-SkUX{n$k&!7xn@>cW5ds!&CB^ywW z)PhPAb(QGmY_8-37a!7(GT1H!Vzc$_B!9LZ{J4H+JHUcus98r^{>luTd+Gcf;pmIB zzYj(z7Wbk|nQp6ea3xE-riCN)7@z*`85F1D|y6Zc}gxP zUc7NI&o)~!jIT$P+!R)_U^cz<9MPc~1Qx&70~oF3@I4{sDz6=TZul3I>aM)pT-(RJ zV1W^RFe}0baXtW-dbrJUz;r5t4b{tDx(KS;3KtidLQNOnLN{a*h<}@-o~%2XRKL7hG{ALx_3G*hU`x{?gK8iVv<28OtO~V4F34^YpagZckc6pU# zUhxyN`QzbJh60RHi`?et%K%oAdoTJUSZXm6&_p>J$=ouI8~Q@l+*AH{fe~#3;=TmX z-$&xb;nSaWeuK~y&tA89lg=hj0N(1H*4J0qYWL$GkE_{?U~`*}itzP@dvvTdfkh)) z3%$8)ma}pggsDc6tK%AVrlwh6U*81S5we0hclPWywe5m({Ju(&P8ySHUOQqi*D!c~ zu!L8(<3rsyoUNR(N>38|b76`E5gwB#PoA9E9XeD~ehlf@`uGmEh-VfTSNhiqvsAMz z+*6ec>QbCxp_!(A9)HBEZ)2wFg zC|e#0xqA_Uf2%syK-Cd9C4A#|btbe9RUKe5jaZj796ei#`xFu=08kX9(ZMSxr>JC; zw#s7{sJ~lZ2)Tt03>O6;p*5jl8lUsyj!0=Ob`_A`sTPWr747Hssmhf+P_u~F$N?!_ z9oV@y4xodB9W4@56R;Ort$Q*@zqPNARb`+hi{zQy9SKqzX>5nEb4B##GDUjkV{u8c z2{m(Sn|7=(+otVFU069h25eB*)y^{x8yXn}0y@7sV`zuhW;&WLd;hX|z>7~{T)p+| z=K8wr$XIBbZftIvJlIIF5Yo8Tkn{a}1TX46y23~9Oo8pH5x|9M8SMB_J2@Zt?G^0o z3ghD9Ed*Y(Uk4RbF;5R4{g5gsk5V5#}_nttbye$?Q}aKHLQ`p2<#5CC{b$VZ*c zMawWH%Wg6S7}EXMfUF1Um`H?>4i>^x#|I2LxiW(dNC2TS-4APe{a`WhZj2ho&WF>j zayR2OcpCdCn88?xK;0;NX}Lrl4c?N2!mg6<;!|w`@_OJLm;LkX+rkH@KQ&9Op};mO znTfsaC0Oofu!Us`bZ&i^Huj0iN}qctPHt+>9c6{fg8|E{x)5zVbuUIMx=Fp<#fIAi z8Ql1wiWw|jj?~w1?QKd`x(&9Ed85x8k$IMpjHNH+`fOx6MtL^p>*kk6cAosX-$?eR~GXdA@HV7?8pZob-kKoVYmA^nyuJr7SIXy$XIJpBW0Gz!?huo%J&3 z6J}dW&!ZGShSC7+rTVJ@ifCK^dP&8c0&9e7riKd>m?w_tof0vy|8SrA#jHhj3wrT8 zFKU%gntjuYuyG;`LcH?_?NTz*TmGT2oBrr!*lZc*glSKbRr|1+oSWefoONZ)){Wb& z#pdE;XDapzP_@3-)X<3ZXPN9?$)iPL+(I9I~iIx&YhRNA<4n^%Y zJ@i&f&@^a0z#~Ya`F;=k4FgXD2eVr7)6O)NsT53au7nllJJWTr`j#Ksz*o~p+@xOj zKFP;*Ys@t;{QKRmK<3Mv8yi+FdTzan2$QI1Xfy8b*A?$-<(VFr%zrpd{6t;wMQ3d{ zm45dZBpSi6#fJ?IJg&CL_k}$D0ZX*Qz~=9hwW?1wE?B7)Y~Pw2RdV+MOB*H=&nII+s2>i!Kx;3x6{cMv#qLg%M-K(Y!_=#bi`?@29oGaaXvl(X=Y z1Gn5r36kzS*nNDXC@#d;smbOjsm9HiYGESSs{6`Ms@V|6Az@rFK}=zq0c7QpQqbx^D6pOL6nVGl7Ps(*8&Znp zG~%_V)7|5$KqSzKJn7E(o2zls02P%AIk@I`pK_$@DIDppK1)@)Q`M1$>@h1y$u*>@V=s3;VZuAVAXPg(ZPQ>PNzNSZxk<6oQcrc+kx7_&>OtAxc~wP z0%?ie$Y7jj@c0*Ap8TSs`rTTNYP%gwaGy!(0OF4Mq!);*_Ah82{! z$Dp;0^>k6$l|O#L!@EE8or(~<%n`{*zZ4_N3y2#V?gB?QMG1E{6C2E)xi)sX#2n*@0L)e{EeB}ktqS9mknOkgtxi`{)zf#inwFNgr5|ZzQUfb7-ZkxV| zQhia*`54^sFoIHKcudSm$QE~+tQP<&kYfAT*naJ}1i|-a)L0Eo1XDzeL}|ZAsvn zTD#NMB8lPOZ16toEAy{r;=A3!Dk?Dwn{>_ZY*pi&bj^W=Z-2Ig{Lobs0f~%%uu!F> zQqYy3gya3q$PA!4X}!HN3V-+re0=DsHY@IYm~om<-rjy{=;X^5&` zi|xz~45MhJ#hrZ?b*<=ufv)Vme+;jG#=k^^Z|{6xR6L(2%QGn_gZ#HgXYVuBTVyx%r~!ug2+jUq}=Qu#Uxd zB?93YX}~%D>!Lg;oSWA8INxsfq;_yb_-=zM4{;g@;`G|C%;~hA-^hzhYv1$ZeDKed z*iAt#Yk}5CDetZra2o3Gok~8Raoes1rm_4L68)^La{&|0Wf)#1*!*B)A~H1h;LjxG zry~T5OHO)MO^F}{s1QMR9aezw&t15*`Uf9c6IiAPM@QRbow=4z$dzU(x+cK+Jp9e^ zodyzo?(2^?aL^uDo?SbJzbW%Zq4%Kp~6DDxq zUR(yJQ|1XnR8^$H6>nSl$TPQpo+=pa1n(F3qNe`F#>Yo>@7p~#KKA)@?ve-nw?0}8 zXp2)XRmKWu$~3m!u!XVAq)+zt&SICyQ!3WL7;dV*1#)}b?gbN67{#En#O};Y^M1um!6xIqrmg#XWw%E7Ug67IEQ&B(T z{PF9xO{H$9GvZSxs&APyDc)VCUUDJm?KU9jzl8fD6sLQ^;9Ka?qfT9a5eFPd<;5>? z=z}MyZ~(7cf@RVPC(HIiI!sRKiEzV_Rdgjr`ugttH?NfNjehdfe{+k7z9(vp`9_)v zY=;N$N#4+iVrp@VVyX)clGIiPLGgFlJdSgfnDyzm9$U$Lp-v`E60ADUa9ftxK8^gA zZ70%W?Q6L2w+zXU^;1ZYHfsPmQ-5Jj48hi`T)KLKSJd~i16Afcrcp06IB{23Gdqd# zoEfP7nv9Gyn&vz0a_-n3Im48BAC1CFC|lqc^)BoJO?HQ(lJ}_2pFPXnLOvS1RzWXC z8;!YlHyIBrN=2*W@E%RK>2dM$+v$L0;NnA}(x)m5kGH@U4m*msf~_g?S% zKadSz=d65#B;5kIR;h8!G7(U4+1OtdJEesRTd6@Z!RsW;j1gp=P{<6lv#;J0wzJ|7 zar%DVf0(4zC>~dZ8yvSZAbGpVgi7zWboNdLekIlRP1Ml5{Fsd#3pIB73E0~HHlj>k zH2v>~dIpwxUOe2RMZR(e2qDDL1OZD(zZ52`sE*90at!2%?hRZ;KFNfM2;jP^e6Ns?Cc zFmj0-ZrLsX4R?MFn?aP~Z26n`ZRBw}zF-+G(PFXL1{98pU)D^o0%V)>i-q{?iRJyn zLZ#wdkL-$|^9pVLWpePey^;RdrP@Dlr#9uxi|vE`_-2$yF}3xV#vNbZAL>cTJiiwb<(r%L6h{OkD4m>*lIXxGlh?!_spjK! zMuz|SISYWn42;85cy1U1qMf?AN`LHA9VJWN3C_E(31 zKg0t+{Z;fG_~lZ(=b|qsXJlPl#xipP0VWgAQ`aL7tj@K?tdFOPHm|Y*KsaNL#78L z!RmL<{WAVvp&zi#56dD|CzS;a*727_jl@HKw1q-{0F*bx)?UW1d8PA9OA&A1zJ18` zNW_i>1xGIvlZsJjp{TyxzR-P|0LOf{*C@QU_lZWA5uA}jFqSzk`g^>ai%~df3qx zaCSXOS#$G&D>1yJ&a46NYwAu6(~@OffUGQ!s*~2>b$C>x@<8UD`P0NO`MYJt=HaQ^ zBWbxgCqx=4Oi$@?dcD1sOCo*lM+WJE`{T&K=-_RWduIx#?Z2^{roe@{5H@cHgZ4`3)d(RVPA!u>oEw03cA65oJrStpRT9{JYv`kPB&hCdL=Na zw@#oTVc>GN20mm(|NC=UBiMqK(aO+QoCFy&iOwizqg-WRASek4U{>~h7Hr!Jk)^rB z#Gk+K`E|lw9LhmaGW0oD6a=7a!$6*`Vr>DqU}adR|Nei}NxQe1#5wawES_pd^>v^Gaq@ z;aSbIo>JW)fdsQBj!)r}N~&~G2ba^4JzNZ%o1XTYoSgI;ICK7dJ?P6ibLNcOpGU>2hdXNlwxOM%a%cjvyk^GGIn~Q-{ zktpf!AGoQ5SyV4D`x-pCrJ<=A10)ZQj&cdL#lJ$@FF1(k8VJdZY&HZZ0XznGv-l0n zCA&d)Xa;zjd9_QIA2%1mxWhl6HF6N>>;=$^HhiU^ky%L9%8;L!yFAh~cM&hMGnlyo zO22=dUc5@W^xGD$x0Kp#zG+WwV=}r2EU)Q3aw%|Tb8k8rWpum-sPBgR_hS~%o;~aC zF~YL(?7iS#jNtnKI%zS53hUKIuKHA^?7a_1WXs&>@0#UTLPidG2Ln~W0T~Q%PyQBT zl@lZ~Vnu;OC&IJmWw%E=gV)RIw>}lH7i`^j*VXeg(gyxZd5{Pb=3Tk*mG!d4i)?KR!;?o3Su<|i8xhy#Dg2sZh*;%_HPFt#SKlT}*(zKTFv=qmVqKaWul z<4O2f{SE{?xb1;XtoZ;2t+-`K7Cy_%?^mQ1SJ2x~(i3<=8QjYAU$-*PnXeBis~pL4 z^j->H7F*fJefK~;gl9xOWJ%B|RfY+E`ugz$V_Z`BWP1T?|1JfT6nP4p1D%L3YE9E@ zW!ycMMfdv$8m@sHu|X@0qn|q=ogKl@yKmy-Tn=Mg{Fv7b09fu z^77?fmcy}~6PxpC!kpf~IKQtO$k-S{&fyaRw@kIE6cDP;6 z(ls=~1JM;#Yj^SHzZvjHP0+W`W&67eAY+9^i8ZwP4j$vnj2cI|;|~C^0sw$UZR}8; zkR@dO18Pk9%<=18-OIOx2YtfaKJtw8>|BvfO*lG|>C>Q0QfQUpatk|T5)!IaT)O^U-Wgu5Iy5SP_qSY)-3 z#jsM=MeYYUoGKLCFVp>5<~f5$*Tj-yxd1S4%c&5qUzUI)4#iA&f-Ncnbw;mqH5=R) z@IKe7&p89XnAZvFIM>W0K#x2X0D7Hp3p6j+D*$^_Yk;Vk7YTC1n{Xsx5w|TL?d8sq z$sWba(~T1h!)>MlTZgDe#-;mKg5%cc)vMc8U8MvRYL(^^!7PF29ml`1frc%T+zf7( z*tUnH`_hgq2kR#sLEqDh2V`eu`id7VGXks+M~mWOV(x{7g^lhT!qGrCTVS*N2|3vo z^$zGYD`K__Sg+TfaNKvwNI^Yq-3dC_@;!W-Cs;D@?3i=;c>o}Fj@E*&4aJj22n@v@ z`ZQj&6&OOZb>!;?ho*~{T){%LTf1%lN`SzYR^Y#eYzVeKe5!8Y(EgxwV$r99N;v9k znQ-(hPIpQlt+9hm3IXr>)T{k=95V&~;NJ**&d+1{gi288n_t_%ejGBujxf}$wIB`G zpiK`Vsw`Uw1{YZFfGp`G*w9IZUAL1=KaDLD!9%m@IO@P{z4(Cw5woEm z6*l=joQ&igIj>zq@Jy-V!MN|Chz~jcEb8Fj>cRK^WjpJ0K-z+-vv))7Zqy#`CmhZl zN`0^%yFv#1{FM~(bTCe*#t4`2_g|(t$^t8JkTh{&Nvk(^A|+9e&wNGVcp4;U_UVxjRv*D$F#@RC6=^%>b!{@JEf(gKpmb+B+wdL#HKZC0o(Gt{Q zhF+>?n^J4;R&KpTEL8++2@+p+s)K)#_P#Y2Nm;_`>|M>qqY{bzf3#KqK`Wk*#)A_X~4P4TW$g4iBQ4H6vIu^v9;do|cpvOYClfn)1@HERnIyU>|0aix?Bz@W(?c-Wzc+WVYs^$|Bh$Aw zuwF5OqR-yD8Elys-rg77Lg|~BY@!^26gtqA97#Xus)ODr>(T)7sE$6}zLLra%TtYeKK%d;+AA zxqX}g96p(IoUb6ZhAQ#4-&3475K@A_1Zq?iVav_4SSZ9%MJ@WVKm==Okl#KorHFA* zTio8Y;R8pTCuVI+nW$x^DbI0B@Q`xoU?YEQ{a{??P=uISd3@i*VKsbZ0E6UW8T3>% z3x$Nr0{fvd_8$=@CK<(0T*F()87kfGD>W7VN<6gqjbi7s-kXy4*mZ}Ih*C-u$KAgD zxL`1B*Ats?4ot=PDOUW$o*3>5l~z~{ox;>hR3wa+G#zeFO@!)3-k5p6(4+m})Q#s; zfXBxPPXC?E!lAq*Bimefh3=C;oha?hqxcnd5-CnC8i>0y5>1tAKglH+o?G~~8svq^ zUQPp(oJOnP`UptWGp>y!JZzRtJzMRtu@tE_+0WO$+ zxGe_gd6gtGagg3>FB7y$RWT|W@Z-M5fTmT z92~V==xuKsRUnyfddN?{$#^)&h@J(VC*%92YX>Q1p!5ya_y}djL#Ly2(Q8Ko`9X-stq4feVzRfYrzv3C_iujq?P_<2UNB@Py z%>KdXQQ1H?^4?i!-qPTQnJ|8nQWU=jW%#(H+0ifA^ED>C1-b?-pEu+hFkAxr5CY8x z-9aB^nYxYM9f4=Bc?A@yF-kk-Q>BzZ{w#3;Gn4DMRqeP$CCEQIHGr|R_Qz@N4ci|L zMgs@au)OFhuy&1msSbZ`-8Tg#(qbq1dAia7PdOC7mPNz4CndaXsbyY>)R(wGP zu?Je$Urx%EUJ1UTwFpeq0iT4YF3Y`8srq6M-HDb+ch-a)V3>L$k^XR5bir& zyS2Z6xNYAuW(w%z2~`YIv1-gDw^8wMHigZomwo8jE|2BxdnO={71%9k+R1_>%Z|Gl zhmBKh`yH*VR3P7CzjzfND z^DzE31)V3C#nKqD5V})u-bZ=OhFP#GlKJIyDrh)x8d@5$uQF<6OSRL67#Mw0Fctt< zqZnYS!}E@?#wdoL3_ih6FYUQxr0gQww&_i&y=%=cK7I0oSuF@|i@Ow?G`L$i`)f08 z6L^TdS2_9lyNl?<5={Mx^L&05lIc4EsyPBu6x&PUT89VwP@BZY^12C96_5)hH8Q?^ z9hxsyMP6=Kag~nvj>tbA+&viDe1Je849qbZN=0IerGmsCG5rPRD=CK)iU9z+Z)zV3h#srvU%aErhHrrl8NdtFMm{H2y_>;I(HN+&4LxG^vemBr7=_#bd406xvW=SMmclM((a5f^#wsbXJ03cm_>N`$`Ul9}2N;|T=6bCG#k5$p~0Q|EKNB^)nDqwSQ z7cYs8p7MED-N}Xp;m4oef!>YM%Kgh!dL1hV*?CXEe$K$-mrEv7maso}>Wt%ZVCj;= zKG4qBMeR2Udg9HmeRGxRKg6YolcAnPt&$DBr#RfIK5$b>%OKbcVp64|*q;^`6}2JN zA2tDPgA;v+J4Pk*0q(nU(+N~xhjs^s0-*9mut5)~or@L=C7>i>xYB9o_68xv;hQUb zHZOBrL$>!w1Xx!m8&|(i9qz4Wp?0mJx^|F7w{eO79TuFN4#<=aRi7nk0Stq~;o}%+ zihNJG06Dz(kwW6S0sVUhn>2=-Jxrq|t*bh4FkMUNS;dqIWu0;z?; zdnbPQy)tn)nzW>nF^367eHsF`L8b*Jsq<7h?rk5^V;nY%#;W@dHpCrNK;#>DRcsmP zTSSHL?KK@1CpJqv9`J((x|R9cO?E9G#2Wg(=*K|Kyq*V<4mKb-KtR*rI8@i62 zB&vlL4|g9CG;aX&#S-aYj0)2JN?my# z^*O%UaBx%aA#-Ti^;+H zhnI~ySfjmCFC|X`DS`=LG>Wg9BJ%X^H+Q|o)H)iSfEX%H;hz-|K_RoDI>U|w!ErzZ zYh~EY21!cSL_9^y6Q@ji~|F?i%do-289XWT`d0QxdmDbMhURl3x$Acar69@ zJCu$~yN<&?rwjRXK)<^5dl`q>0J8zhuI)sWJ4(-fA)!fh13CTG6-ckvL(~>tf*za| z`_e;uHvQJvFWryoOIJt`@1hRY62fSH70175sM#REc%~}+^9xjX1UQtn5*5`o{@{~4 z;&+JR)How8J1;r|L`Pp=em%&ud{b*8X6c8a$*&oojv30tO<*`k1@ZF&Q0R0Na+Ts6 zqT)&;@MgGk#izoD8_$OgldyR){{!enn`5shpmw41dh{_cP0zlWaJVX?J=@-WA`mLy z%tkBRy;Khxn)bZ*Mh{m#4|bN8J|pL2C<59NWUA-pmU}SBE?#Z$t^}S$inX@ITCUqf z4-{F~D;}<-w03k5nFNGEU0HimhbvK{F&jzhteNMDF#Ib4;^R>VGf{iDijs^vx^^Uj znBE}{%QAM|9D7~KBT~e79QHFxBhzuU|Bb!?EE7UszW#Yo$1&mpDnpI)gJmZZmS?&3 zbQux1*|dRZml7aWq(Ot;M;Thf-RE76)^?P^xvkIAa`Sd3gDZRA7~MQ3%G^Mm-5am( zu>7J~mMKeZc`i3*+q^%c5gLy%<&#kpg5C})H<;e9IDgp1w1oOwYh9($;_a7JY z2>cIVI%m6UFUNXo*(}3&y|vXV_<6tYUHPJB^H~~4j?uZQ>LidV_@(2WSQ%aACsGvy z{vXtZxHD`$9*bhmcF{~x=M^lJ&ZtoUrv+xaA@~gWiOk`1jCUXDetVONJFsjA&PDmx zxlHU9?-{mnMISkQ5srj+7&)(m2h_s=54R1UL*^O*(LUzhDx{2Jzw_SE93j&;!v|pG zRpan3A-O-s1|I|Ba<~xhK+|^hwiFoU11z1-PCRm1|M@31aOd zMSWWqFl0e=`D!(#uc`6?+yv!O<1!*+x7NM%SUj$#7+w%sb#Er|qdW!1VEEOi45_Wp zEI`@-{KF(Re?LZp3bZh-L7xWRO`vV?`{_8YnOqBtqw(9D1HH~Ue)Pvtd&|KQb-ag~LWl#J zy?ZcV*o=d$g%5r}w1bPQJL(+XHGUV-o}P(arQG6rh{e6Y2vD=J>+%O`Ggo!tX6 zvT)FE#h89r(mE8?U5Z}*|NZpl1Y5M%9jSP9&OLw6(}_#4vnHu`0iGP_RI+1q5Q=1M z8al~L`ix1&d;0QyS1JFHN~)VVXmjL$Nu&<%)p8DwgTpd;cL7>jw#g+0OIf$lV4a=ZPVHATW5#5$d(Aof+Si z`SllDP8rqLu7(&>QV~v#^j3#tfjEN@^+!W}1RjYZ%DVdd=Up_r)a=vr1Y}9CT=56r zrxuJL5yeKW2XVgmA`kHRv3iB&$oLbd&eeb_Z*0On6wJe@1qI6m&rw?=#}VP+`QF_6 z-~qe26wr-E<1oP1d$>GCCpOR>Vs-X!a0kQ>I`>1bv|mLe1x&ctTR4>sG4Fm4!PjCS zK;i&~6Z%@bB+eOaC@P-FSo-xssrNYcBHh{cSSn}Xk{i0_9D>EUK^w9adjy-ZG$JA; zu_W(z3p8JSi&i0{w>I?5rO<>_W>iOS0bzlS1YR!-4EkZc*@hID+1tibvr&+Fylq@$ zWc~!sPq=hd(BYYy?L^rnq+wV3JFo}d`$qmNIjo_0DYAf_e7kC&s{w$1@GjgD!-tZV z|3Kz*9U3{-a00w<=+?Han*eXDDnV=5mNf^$UD(U&leZx;d?r5qZLA_Gqwb%)#JWEJ z(<7Q{+M``HS%9@R|JG;xM6(}Xh#ec5md0!bNK87>_w}1WZDXoYjt;JCYir|uIiu@f za$b#1+djb;&daJzU`Jo$Rn4vp1RWu*q+4*flgZTg2myb!y>dMjK=4oc;tdcr0T!l( za4G5j{A74ng7-!chB=lhXQ403RD4$Ld%nKtT^H>n|FvA}97%zr&Y`!5XcwzX~R0^x7OM2ia7l z@334qZ16hp{wqQSMVcCSND7x^24@6PxZ(JlG?0b~7t&Fd0Uu!@+CF0Fd%r(s&fyUnRXDAWD0ugi4vfpGHn$l;LiV+~b#lf{DDoh!Km zCj9LrfTlyh5oLAe)>w8}d@#O*6(y_(2sy)yk}CK4uyN3n&%&mrsLY8+{EQBaptxkd zF#Pqk+1hmGtqFzb)U-puy2Q;OhC=>B2^bg?2o#vM!*`>@zz{CR!^JpvAet*6lRJxC%M7_xA;}g&?v1R#6&7-s3MKuuFS^X(0U~-cy|+a8!#e9nZ;_}@VuI% zFpk#4-GWB_zR~WA8!+;wx1Mac+>>uo3iJ*YbBS&;qS_$)thKqGn%9>*7iSZms9Sz| z%S^Q^S)Os9pd@J>%u<_-S&R#sTAVw7aFpBp&qZ3l`l}Olz?Z8lwFhIHpqemOzt<87 zXQjSqz7G8%_LK_|639<08LZ0Ai+##Z_Vq|hA~aP5?u;U<=sh8Ukv|A+97myzl?R6I z>?H2_VydZ30NQmT!ArETw$?4i@bGAe*W~4}C!}SAcD$LnIT?Fq)sJG~pb^;8Xs7>H z*0-7Di*lU+gz}A%BDwte0!+YD?rHOsQ!!ap#1VIbpEsI{n;B*YrJbp0aqe}A`*IlqD$v2YNHRr*v*aT}U- zR~WeW56pCN?X?2$=VSooN zVg1H@57`tO6omyH)if+Aq%eSMSl8wnu!w;Gw&HYorMP&ok}Q@gqN^u+3fTk30gUbU zU6ET$m^=Ms1!=iMNNZ7;=z%w|L%YqOm^$O0G#)qvx2ABV~(O5_|nKaQc3i=y@ zA~YiLorFq26RcteZ&RV+J0P20!5D<$AfLYx`dWdfuS!tjE7cvO{!4uVG(ijNp##dk zn$)vO57daAp9c;+mQ?(~N4MZF>5JSU3W<{d96OP>daz+DwKB(Pga(}7D1~6nzfxzB zF2d6+-)eyr%tm|oWYb+EI~EW3JLuIHp&pKlmjvDaugPn}SvtZX(&-fm8?D&3gjVvl zGMJ%%ZjIMeqfj;OFEjiAY9}Lf-bK&&!Qq)3hl31lVA_uMm)i_bit`M(&HBKL>y-GY zBWEKHoQ*cg^m|AD2h=BbqMv30Cu#}QpU2|ub|Bt{@PWa>Tcv)Hs^=fT3gM+?#sNOb zx!9oDmKsDDcMA)Pt$}&#>MR8w{R%$s55Zw;HQh#ik@uO&yQ0|jTQ6mP*suhXpJMY; z6w=-+W$VxcCI!%Ql9}K7C`7#sP+g{vBCTS>63Kp5Nz7P?*Zm-AQ)T};dELid(omv| z%P;3Ud!GatkqFgxzi$ruu_n~XVI-#q)sq`W2rPY&e-i8wX+Hs3`se!8Otm9Rmrigm z3+BOByKc=i8wA?)0igu`OHUF;XN&T0F=(468 zPY|@u&u8DP&U5OMc7o<>ZeSfG%veMIG!o;5bCbS3B>{9Y@!n=!@fvQgz|HMU+s}l7 zF%`C%QRGFuwkulJXXfAJR5vB#FSyf1z6bNrY`A8q0L@OTm6LYRLT~AMo?^NBluStT zj3H=0+c7JN3}Hc_KU^p7%LfhR#g_B-4!v}>sp>w_9df|Ke~&61 zW}UKolm1;3%z!{kjqY&>^6@bN&lag@ZulZ?KsEEg=v;@+y4qzc$G=T&5{kYACmoo% zU{@}}K?l&cV*3WL#U=3+tb<{AZgDpFhHMJ&LnHovL~3R+ls5(E`vl3t(JL~H&ns@0 zlNqWJR7RckNfU>j29#H_CHbq;$M|YlyBW=>N((Tm86JX@9e_aQ+)W7?vGQhFIC>DjIejDV=sB>Yx6R&Jf(0)^zXiUm3&Qy1>YY0rN5Fh;5&% z&k}rdCjyJFW|YCgG<=hwJBI*LsqwkWTG3SqxJI;EF5Z@f_iNiL%U4|Q{n3;8+sb0E zMYn9ODark}^PwNMU!$Yj>r8YqX-v_$3uh=$JhA@`2+4>56&swQ=o(vUa=({1EH*p4 z65B;DsK=ZqE-p9IUp93+)74dce11la+d92#;cN6-A?nd&-l^>L89!XY@YTteTg@~D zX0|s6jR*H|+4RjUVyLNyJx%0$*g%X7eNsKC4sku2{#2{&I)>W0vT3>bX8*Ol=7*T7 z0VqKZI+dUD@k0*$;tp<66h2Vjo^$@Vz?T;SZc|jEEa6oyP_%jVjDkm4R?D>Vue<(OI}#R+zzs3VYpA%iG$? z^3eP$J}`RqE>ekhST>Tu6rojvDMfo-&?NECV}X+S4xV+GuF(j58bb#Li`%?y#Y2i+GTB#XX#(vNFAYyeVT-P0U zAeAqI-*(iaxH!SSA+9kabODAGF())q_1(X|Iu))-EcfbFXNzn@x>||ytHGEKZ4e#D zq;7gq*6dtKY0ey6$qcp6W~9mCd`wmjiETjlKppP5d0$_OV2{riLVL0cRF)_CtLjb+ zX>3hs6I@c*zN!$>2H0ZYQ-Kyr3oNYGG>+GeLP^`%*;TzKQT_~tM;^=hd~GoDX*;K7 z^95hT7}$>4=&eGOm?R`4ON%uGM)p;?b&p<+)dIGdP(3w!t1w8iEML1`fzhK+`NGo7 zr?;+e`?*Tqj?Pj4i)e(>)s<_}2?Feeg1G?n=qP8&Itc)|AP_3?z*q!p%i7Sk+R@m8 zRoa@h%SNrOt@QhgPY2S|1-Pxo&07C4pR}yYn$VQ__%Qk6bGnBxbU<}P*>}-F3CT9y zoci2sUZ9b!jR;|<3T8RGh2w75kV)fB`la(~37;B!#Z(mkl&@%>m5#|%4*9kFgY>iz z$PfrdZw5Ll<5ItE!8|pWJsk?N-glrH)gRCSQdh5BblcE(NZ$2<%k5{IH4EB(#n9*2`ldh>NL7&|1MR<75;`YLTtZb)QJ72tyVJIXJRzHHl7| zPHMY~qfIpCN__mt2tm)>r<0MUyE^){t+i}TSM@*Kh?^UlmF~LlVVrt=Q0!p(Vu5DB zt)m3?YjP*(6ID>)?Kqjn=$DP#*F344tF{8>~4(E;?yxX_t#?70aww#vk+)ZE6o8c(9^262PV% zS&q|Na`|ANO?)iPY~ebNmiLR0FoVZs35M4%AZDe!rWDVx_oSn?Cmb8_mvW_0}_1-=~4Tr zTh2ot3L;utd#{sx->lm%}x$>tTM-lU2D_>q8n%qP3V##G2o^^nIGmrz-&b)1+2 z`(~zbVX+B@3TKuly-@HQi;${{N`Og5%S2eX{C&dM+X?m)8ZxCGnZ?L@!`00hbbbWv2|vW$6Uu=!Fc&xtCm_%R{%Q+f7sI)3Y~}4#;7JR z^T~oGjQw=f=^M9c_=6OEr#fO^1Q#Z{+gn%roa@XwyEr|pV131;9T1c&nETS;!h(Zp zgB*Jy>prDquHpxEvxf?W^mQ5cfmy})MaI++#>D)J=Y+e9kl2q~0-WufR;_=f=EhuW zoCKg|Z$rTf%t&oqq@Zg2aZ|JH`aRjYz8HY&I>~d-k}q~I3qQIOmLiW8#Uj&{*0LqG zhA91OPmMk9uHg*n zo(RdB`GEoE1ZlNp8fNLO+!ow2CZj&Hhx2ZVM4ztmHB$$(R>EH?>!Lj`CXC*Z7*O5M zT6I}n%s$m|-b+e0KCf4eBHi6EbPq!h z!w~x(d{^w>yN4x~}s&!^pD4VGL>_XPCmy@LJaRJWb}t_{hzz zcs;&KhY_PD>&M#Di3765qv*jV#m1q$?S5=flwzeLTK4jEwc9TNvlJF{2_>Ra)9UdllucFf7Xd z8vy*q3w91;MID!{bJCs`Oxe_9$+;6U^tyUh#4HZs`L3hW7Ww(4F`&o$&$kuJ zZx#whI;(b%%*!ho5^x83tP3$n=m`r7nzLpxyIlsjuGn;1!EtsJ>ZioxY>6B`eRC)@ z43N%U1mb4_q&rvdH_WrS%RZ%gb2+G+o{lb@H4(<%*~VK8gnI%(WqHnKU!00#q;(Vi z%~1+|#q|1-O=VJ2k7svIi3Vsbv?sI%0av8|Jh&jSD5KX#f|ljWB_qA#S5AJ28Je(n zSGozXkf{DdNVgV--VhNQUq`SpovTxNMq zK!0+hjFvlt1U8?jQTLIhDxc|}x;+8-unRaiStj^{v zKsZ#73LRHV)Z|qz5hCsf3}T@FX2`QEdvgM7C-4jmnSoZEZGfk2{sGL*hb3Fa)PC!8 zrnf8DRJDyeDsEsMKc_n-dv$TI_7sKbow$Wt%E^UM#tKv#I{D5=qfBN9YxaUzKo^-T zA3eBmhQuKr9d@*CswG#bYg7T+hCUGSjZ1-X*(EYWSHA3#WL1QQNnqUyC*PsNJF!~B-F0OEhy7EDNE z{P;6u9Ky7Qz3d8%b3RBD(sJQ1H`ddHpY}Kr`}RQIwV+!Q1;zomrYBZSA(OCeH?ZZI z`QiZ__gHxlWqnb3+Qlls+gl*La}PB(5t5g0(A}ilp8pjHfJ?{i3UO~V*J8E&^$ z65x9x7_P!$p>UWtE{mHOR^sws%pm*>{p}U_5aurSTEKztIVDl@Z9qMJb&39hq(Sr_ zP;oh`Tb+k$Vvgpq)R}3KzPr0iquYzG>k6SJ&aJyb@<60g1*{d(plBP9?v$J)Rtp7( zt~PINbDJ9|s}Ey*{`eSwvzA!0u$;fe%Bj$|sG|4W_nzTKJlk$gsmkkv&0(NpCh>Z2kGZ}Y0mnKYS+%I`)E&>g_L3Sb9cAq zRiYyd9H`L&E)+sch>zLw{kZwSId~An_rvu^TTZjcnN zZwYPy7vOAF3igFBQLsK-l^1`5DWc4SJ1SL0di3Wx+3fm@eb{q({2&U27`#!*H}CV- zEr(6#y?EdU=ba6O9#gj%Do%jqq*C8m-gk(Lu?xKApJ?H@qpY#-qJK?gWwSiSp&eay zjV`6~jb3TCBVn`oGmr#SL!($b6yieYmS-I{cJ;O8aAC4$q4(%bPJ@ql5x?3OFH6-` zLCwk5*%#aKF7TLh9K|sCEVSs#Fe{OxG@%X>%xmh2Ue;hIQs9nxrzMo`UjsQ<^1^+M zGpGl_D9-@Q`$U7WDcF-mGf#gP1Ef91L%HX8g;7!pe|iC|OqAL7`5i)9?v@e;a+kjP zb=I@pF9O)kv@G|Tgc@>Wc%kE+Cl&S#k76f4kO8OGm5)~x9$@yy&@UoV)d^Sr?Q}y@EqP8l0^$T9$U^Wx0>4t3lDsz!h*rq$iCBTb^_}q>E6RN>u!uL!7 zAQQ_c*CGjK6_ICOV~Ai9p0g@icYTB3a+RDB*B%IZrB^=cS1EYAUaw)FoNT{0Wg!|_ zxgIj?j@DI_ZW=4dQKI58D;#6f2#ykXHGUN9ZnV4=6poA84E0WZbF(aGM)De)_9(76 zjjd@znqtF;*oo%O28DCDbxA6S)u_+NynJgiikt8&gK@SjGo|?sLM6?Ex?v-X`RAcC zN`H>&*4ZX{U#W1KpBp_*_aP-;fcUSnD z?8Z05a1kPHrwT|-0U&098?)hJL{5S-ynWbqdvog}x}~P_*1e*%pBkURy|_ZTvAks> zHab}1<6q1Fb`mw_cWFr@SHs6q%*i4OfslNG-Vm=&h>L5#oG~w2fEh2}wgYTH2WrU4 z)VoSapAXBj4L;1w%!sn9gotwt!))xl`~-2k&NKD0V4mDh501#n0SQw&I%Xf<69 zHFI@Cz<@c%#k6rp*5+@u<39$<1-vVjJyblJ9DGF>616ZdbaRss%%Mz0RezN!ZCN=# z?J2u(VTwUi&eCTEOq3uYQhL$4d^hkDjTa82WWbwN^{4k zY-G1(DQ`AIn>)zr`4p(&C%sg;5|mNRCmNBRL0D`fp-cpGtIA=p&yo%PT5RYN26CpC z@~fI8$didzl#AVrHsqJ9#1b%V?oHcn6cdOw!k^KHMwNLz#EwBR1*AK?#2#cv%1tA% z4(S_&h*s6ap>+U|1aU^?9R7GLPL+w2rD*pVw)Hesza$$l4#AcYT;%4pCh0~c3y30V^ zXoniz4IhgYv_a%pM{eJ$F95& z?i#>FKpqQmZfO7b(Ls-k5&t4tlE27KCNl+2(vZ|3wCkJbumrcvMP&2c#LSzsrrNBs z&ux(rZ7J(_r^H%5dXyj5gG0pp$HG=@&I8!EbqP)*-SA|lu>L+md#}E)4W*&%WWJJH zh1K}7skX%XmK`0L9ZTkY8A zEf!OjRJk+qwI8&uQU3S|x)s^llG2Hmh|;aPoZ_dF?$xyZIVN|AwTM2Hr~zgbSYe71 z!zzpc1C|?utjRR0l##MZ1XM*0Pj)H`GqaX5YN`a|ae0pJZ(c&yXOoJ-!`A_xs1_py zB2s@u4d!$ufYcanefjrMc~k@jP$<*+ME`rg==$<-=X{UoK&YXPR_i}b#a}-@MBx_# zmC&YUU;=Y+^SJ^c;%>eAobz5=lF@*QUuoz?lQI%UN9IWDtZHu(XV7%tM(Dm7Sd7wGJJ4}OL2)lu& zSqz@$f+P$>UEOv7vY47fQbdjb3cdf)cDV;v_qs4Ha3T<}_}YBP4ARute7uyJQfBIQ zY||X(cn5$+<^FdP`=f(hlKo!lPye?5yZjBG#J%z|B$^2{7k!|LT`Pet&*alz;{1#t z<_qXVRNUhpMx)*&5*O4m|T3TG6xB4eFI4McP&wY z5cm1skFZVb*NMX>k&?QO z<&tH=uB`S{qO0j8TXhOc}Atk;Bs*MZQO z^|A?Wtfb4TBc)-!5GEf``(r~YO{xc9yh{NV>Vhxd(4jMY{=)^9XRl3xEtw+XaLb}( zjLjIV*7fVDgX)FCyp+&cXnd5*ey=?ciJH2e9N z{4T)WM4}>S|8XV!_2bucd`i{wyx|5|Y0=|zFNc{{Q!K6pFWY9th*riJVV-zj2Vn}9 zg(pW@EzM2=)TJ#{tPF)$rD}zoOrAj;Ae>UyE^5Pzr)NDYD`SnDa(#OHQ_p+d%xp$& zBt5))U8dH#&X0&kEdMJDYVoHp6)}DI66jZs>}C(*Q%iSjS*+i4*KI2WCkR6zT#Qxj zchq!@8d^KUtBiMue#sdSD_`gv>Rajf0A%>CD=j22pJqdLiT3BgJ{S70J|27^ZVfzU z!~MK0HSMjjD%#ueKNd!waWVF-uzGFaEaZjQKu}w^i#QGG8r^AP6?mEF)eeiz2iP%% zysOHk%VTzKZrXsII|q_ZqBb}EcE&`uN4tP)w$Xg6q{ORyt+J3vgK9Sgu&iA^PNI5G zd1(kd=2%W$7ao3WHLYlFDbj;gm#f#UnFa=51_LB09gY?%YwW+1b;lM7gA$<_$^ zS{$uxRs~R{9nZ?H)@*lHw(KoagT3g}O>2zm*b?pY&-lUu`t<}E;h3*`K3+Ui_5biW z#PK7cpW`Il#YSvKwl0picq;8J*{&=5Nmp0e ziCl(Rj`b`ul@#9@lcCr!n+H`mEF`49r${ccq-`OmT9$E|EO1WN)meendPd!-SIxWP%FF)QkA2LyzCX9YbrM6qzbtsyE#PMO{quyG|Ic>;9f`|ZstIoMU3|3L3ev)3ADLFZKfD*D&ORkKA7ZtHET?q;bTFB

F9;73qTeP8BCRqO$vFVO)u#ZoX z0^&LpVZjs$|&riFbXM4{p(!iRl5dARzf&vEeZZhp2G(UF~+Z9 z(lgMlKZA4Imc;MJ53Vemg$S%xq-K;3NMO26m`cw!&96m0;T67@;E?*bP_L4@wdySV zNBmP|V%RcM;Q+M4Xab%o)1+VN#_B4c?KU(EjS}@vO6P%)y?@VsQ|;C(;k1C69sLR~ z>mQ!FL39`EUy12mt(inb{-9Nc&~Vw*Nfq~{%IreQ+?BWP8gRwNec5BGdDQe&6$(vx z07kNALWm`0LNK;F#X*26fk8FsNqkqy18?W4U;^%X)_L zwOtQHs$+3r+C3AFSaKl0-Rh6`%KK$0p!&Vt9=C4QLr}^t5%@g#;Gxj|(N%@}rXA$( z=JPLqyXP%DHdJD%23395U&;`We=GQ4`4PPidt;75GYlke;aAH830`^9B^vRURFTi$ zUZvU~PV>v^&~e@;0~vHi|7IrthxaJHPbe7*?g7}HeIn?$U7#@B-g_YYVRj9-8V)!= zC|?z+k7%MVg)(teQiE;5?ysgkbA6olkFOoXa8sL~tc|MmZ&CCL$vtS!?|N=K52|Zy zlFqh#S$wPcsjY)H+MB5tm~C~sFXq&nJs+)MxmE?tt(wnVI?Jj;j!f8**&J2=rEQI% z6#3q5Tjz(#)uUH)9n2vW zBRS8Qa)A%Y{*G4LrV{SxesTFhuU(*N2E|^5ZoPz@s^Z38CT*Tnb>Y?z)G9RM`1oOS z6!%nLMTXMk74dW-ag_TwJ@Z)h`LB|_B=3FWn{CsJUK?jvbkAD6OXm}ioz(Q6T5LM^ zW-f_bt>5|NsJh^#@{Eh7z1_N;v&D~qa8tIiIF$Zyqb2p8@(Pp)mc}AlSmTP~1{8Iq zotC{JhD(B@BRTjkalF+`vSM{;-Q`g% z{ZE>`Z!!zHb}|#(c1;xv&t4HA2T^d>)$f;3+jZry%3W-QnR^rc`y)BcsKuXYFt4U% zRIaOysj{A%?`;U#(JAOG)>;S}8`yj?T4`-2UH`B;qY0ZJCKldX!$6*`yjQn8IQ2eG zLMU9IBC$ZL=9R}Y{wkZX$GPXmdl1w$G@a~oeNW%XMHRQTs>k_y?3S4@NpM4!9g1tL4yFT16sa9INS^+@9-0zR_>MHWZRF6Nt2=vO3uuX22ivJ98 zzCjxsx|wh0DGy>zQv$q(F6Wd(#Y9DyN0r>Y_1)c7x4uo7Uc6Gg^KHscb}^-4cOsna zI=_M2cuqldOibh(p~jLgN6|I9KyNF?BAWMxn*2vjM+XN}s4fJW39KmQHQRtH_py>B zrHtAKgY#~E4yNVV`)n1*7N(y|x8{6=_XeE$hmri>%!2+5Dq7B!CF_#}h2!M5+Tctk{Y(*ryhs5Px}N^EC*mIclIkB@E~O z*?#=Z*uxW`@ZBO0N5=y&?`Yq7o(0hJ`Hr$%&lSNRXq6SJM4z6o<>$%T_Qt#5dZ4R6HCq5toeZa1rD4OcVpr97mm6FN9|O1o=Rw^@iIy-L)CFT+HfPySz#V8fKS>LcSX`la zX^van)Tm|4=LIyYB(Ibw8pXJzq#uQ>F(FNUf?Y z^IC*m?E)E@_ebzI0dKZU{hP*RU~2u_Bkq5A;};S%2*L8!mTPK0AW8 z_of)Z7{Y02tKr3V#PIq;3%=o9@E@k`(|h(Fu``rGegp4Bi@%->A}m`(c@IgKd0(GRg3oQ2nul%sI z`c(>pxev7js6Vx+o1XffN`WIR9aIMI*!(W^_R1s^zOZ0;-WL4PZP5QefB69b?Kpp3 zh=>=Qo;D+u_0ZpMm}0UvZTLVbtUOzKLUmJLIP;<8~CxMs_^c-!^ z_>{o*Ujsir4MZ4@Uv9?lYQtp9T7eI8RcQ=NLVi_R$D-3cvA zu_a{|)}XMLtb3+I(<*^I&86rVBtnIHSwig%!3)PE{u>0O0IxETrJ0I#CM7N5r2fBD zUu`{+Msja?@DJjR4zH{SSJpVCvT9^>vDNO{rL+_<6EoIQRF-1o6tS z4kpsg^=0qgl)dV`(bed_c7YJ1VBLpb3y9=9-&AWO!UtijB{i-kDs4?g^H=*vE`#38 z?(~tVW2tg_rk8Ol|ND=48$|p?f4C~MPq|+-s9hj-RaU9N{lE~jt+h=>wJCMwMC;dU z3xs#a?dwIjh8-mxl6EG7v137^wkF^?zf&5i`O5b3OABWvJO;!+%nK?kP&R!U%L>w4 zMW6id?~ax#Cu(mcN5e=$AgvbpMBT47rZQ@?Q+<3)AmXz0(h0+NK^PXd{_`E6an(rJ zza9}+J?|Y#31Gw^E`w)K1eCjuflxz7)FKdc_}~*YmfA#IG(fVw!~2>3{MY&J8#Q>Q zE5>QjApPKZ7XCe3X}xbnVg&w4Q7x(CckXp z%fHvQA@y#h_+e=&t_?vHN2X^L!>&mWw*iC9i@>Vov`$e^Ueb;7_d-bg)-(ODPDLE( z_Qfd#jGv`fufAS0%S?NyAC{;7y}NUi>h-UXZGHEn-N!NMgN|oB_C`!#(Gt=i%yj9D z5M3riTcl3mn?T@qCz^M%yj;1poRQc%HT81R&Hm^O&=~_(blc8^S-IQ%N?d$y^`yny zNS-tSq#w!(nB8yP&td0WbG$k<`aBz+i^tyYwVmGLvGZKQGL=J^r2qZvAxny{x%I+z zj3E=1n5PB?d16~m4=PRyiLUIuQllZA8*w5s2&mIT7{NBvu}P$S`kZyDgp8l>r`7b z(*>8Vg!k8jgU0v1eKA%!CGnhTBi7{%=cTv$A?V^&A(&q(s-QKL|nAhO5FTEKHi zyxaqQbjirg{8^!6l(~AX$=Co@`)Q#<#8bL%TNHCL_QgzfRN9NbfTWA%wHGJ7x^+(m z^v6$Xg=9+XA{3q=O;5!h|3A(L(0PFKVX`jO(MILnrJX?*nf+iQa!q*Bp(&>q5=Vx1?AV<34lP@9)2ebr#eCZHWoJ#6_e7_ zB4?V-vn_84+JW0Ku7aTJx;KygXl7ki^ugUNj~AbuHl}XfxN)Op*>-nDz2J4jdC!xz z5qmrA)_k_3z;~p71V?IdniR0gHHN`-@fM41d{D|I5>Odf82_0>}F88Ew}6sJLD*O+ky!nLjode+`*DER_INHtQ<58?FrcE8coW6 zopP7GdEj5tyYubZ76At=+<^(pw4s%wD>$K}1r*mN^_lcM+Jb5m6>M0S|Z$I|tei!4nbu&@vW8C-V zV(Q33k_!P^`lAaVasV`dK{=0Xm5FvR@c;39S(}18kd%_3oaL5RLrBaGtq|Q10(&E` z71tP@1wVgV30R(|hKZgDA)=oIX3Mk=Y&ioCNCr{ozINbO(36+y8EXVZhT#2r<+X+)La=4vT1>7bwEk=v(Ybo*YUr9PK z?xQQJaY9wVjF+6dfu5&GSgf>6uGDX*T zhT-j;hWdo+yK45w8J)9MoW##M|N4Ln#S{kzU!?ndpS8X)wQ0m^5>{h8pA|qoe^|cF zDkbz7BB`rW@%x z&;TFMYI$vKLkhU=MuPniYs7JUeEhMn{xxEAQMVn+8+3F#Lx-%Q-h?IC3n6=)9tp1U zT{^Db8bTGMXJ)m3y+UyTM(f4XHgkTM<|?(+L(h|QvYyq8fGuGcl0^4U4cVV?OTQp~ z2(0$_1QIg7;D|KxETf87#f;pZ#WmhkXTFCq>AG<1o-+y1a6f&L(mcY)Y6#?fR)cl3}aRX2@vk)0Zc)iJP(jJ~fTO!sfDDIPTl)0}c335aVA%eXPXRn0cH`vd`do zXxpWF0|Ax?)35edft0G%je1vEBu>I}Qf9I3o0>84o?GE7Ej-lSTk6bY@X2KHkx+{0 z7F#$^qh+(+Ga?C&rpGVwY-Lbt+jMM#obs&c9`%++=>my8H*fgA@KOIyob;i)Ov-~D z)0tGMpq_Z#YR82|76M?lX5u{ci@=#MU3ISW^>;o3gM0u$YG;~0qYsRHL$R+9teD*u zXGzae)}=g*ih|UcB)T?IyAmWar08@S^_4<66B|lON?HM`o|?rWOgI!1U2Qv?9w%(e zbmLlAtNOeF%OmkQF}I6GwfBl#!F`4)nH9yJ?46E8u^+69wL~*b_hXn2cA5*pb*r{=Mhm* z(veehTHDWZIVhP+c1=Yj9>?C4WAIMmA}@J=+AnfUJJqR&dL4UQ`X3I`T$ICA#X3|x zmbcCuaPcr1=0ORm;ONl^TkN6B4&{?J;+#$*7>#$A%FQnvl4mK46zkE2uv>z3-ss{~ zFP^vOXuqi!!x%tf=qEp{dE6B#&i0JwDgmXPFE~hj_iMc9I;HLY>3Y!Zm5Ra zTlyV3YC0gN+vfs*(zn(Nmm^K4*gy3#L-FaNKu+Bf!~PJr@$0DNDeRKO;g6!?VivSa zb$5!f`sFgSK9-@bD@b`MD+3R#u^Kf(|3$5ksGH11I^oa7@cdc+3_w6(_ZTlUappar zSgbB~|NbqSjtx+Q1Z*9wT-FL*EypGrUt;$MwMX0PwwxzSDy{=P%vCSo8z2880&v_x z5jJ+#t={?5xAA{~^Enc>MV7WScEo$oeB3vO3*7LmzWmf5GyY!51Hu`_Gm+_^ITVdI zg_>81)GE)ByIDqNBLCRw`y$f@V9hfnG^LPXgttSivI zHLy?RDna6)I*VxO`Z^Y}^0infi|~(Y93Hy^ni^{Af^B=dc^b5-6FiMEdG&ijN_faz zgMhUp%YKO)H2r!N5S}~MPa6O23JTLT+a9Dp9-MmUnalpK7ZJerZh~uFpv?5b4S<8{ z5M~XPw2kii{UO!2e!m7JxYRyAHAf-&HYn5JP9ErI8!yhswAghv!@G0ObXC4q(*iWn zksL89GQnb~Rr@40JvVXJ_f|Kr7wOkc9=PFPvHB+J4uVq*{U6Y*M6!dtKkk6ntgOQ$ z!t$Zuk8gr=u7I?2?4rj-bNza_5(Hb1gfAtDx6C@#9ByS_AeRyg&<<`J5NgG(S1M^_ zzgUOs)p+PZaBKFS^t%#ZE4SGsvQ%s!nDC7dl9e~x$LzP8kzs;u!~?&UnCqiUK408Z|5C3ZFX0rk^^ZCuRx6ALd5Q|#yX z`-F+bIbQMTdZX2$JdF5+Q*tFBk}aatiA{kk@}^^*%)t6^{u978gkeF|(p4)jbUjK% z>H-0<#qf{m1f;Sv(fZFFcGqq2m>Pom&MJTN>Kctkt*=L-#!6*@(GSlG8Xcu1A^xV6 zWA+%!&8;>rT>r0b0t7t)Yu5``o$fW2P(Z6X+z2xu#rUQ)yjq4Lx zCA8;;x4fb}%l0xg5O^xt(a=@hkqKtlRgdJ>V*Z4+{C2zR(-I-T5* znj(t$fwCmwG!WHEWj)2+&i}^U-j3x2RrF%s0br%iT1ueo^Maqt0(($wjQ?>kyJZGS zz^w9hgX4h@$FGJ)@GLlK+VC#a7Ma_ZNQ%iBx{rDC z->b?~%b9^H(NE;ytA6M~$Udi2R3_!-7Mu126@==XMMCjI&dton{PFeU{y*81tJGr6{HzAI<$xN&CvczSgiz+ z{kR%RKHjj<5o^3TBZYX%n7ocWQQq2ncWFH|HI!S7-YPAUoYp)|;mUB?f1kB(^X4z!xSxL1VQVM58}%FB%1!q?_38 zz7@-nf)T&NE1bEyHiZ%gePGK+LiP=%smpc+TWJO}fV$3rovu zM+J>ZPkfn*2f9KyG;Txe8Aa@FuSRJziL|P=5QVog(^6KSbXa@z1?%|)v|1S%)w{1b zy={&cb2?ZBdf|PZ`MG6wbdELGdL%2AQ;WAZ1(qj@uVy2(^uEwvF3o?DYOdkA0Cly? ze+Nvp^LmR?ZbXO@BIUE9^!5vZ4%x`4e8}J=+Wtx|^?s2GS5JxwYJUWnC4D>|KKfBS z$fC;*C4#JSMv-4yoAlDi)8_(bQMRPp*M)}uIrEf4`Masg$_n^gXk_Hg?6u+HGD;*$ zsiY?WyS>;3AQpHyMF%vVfI8$keED4)@Q4uY(W#u=V$<7C?~&diFjG~%+#$v6VM_GC zvId5=W965Ze5ibm-M{cD3%E2#b2n@moC&M@&$R)q%wki@arjV2?2#Lr0c_KUntp|j z!JYHtUBItem-1k@=wAwi!>f~(6*$dyq}}hD8xQva$l5vqu#vUp!f17lbHf-}gZ?NL z3&|dn(=S~+x1|3y^3u4pUD#GYGfO}Y?ddo+(D5d3NphFk_Vdn=eXbgh%#xFnW2=1^ zWU;0yDbe2JaF$WVKQ$v{Oy6ainCE+6ik9c$tb|SC4fI^yjm$&fX|b7z-jSn}IGnx| zW+`YfJjEo0-g2$RoRh$w!EojF%pKjOK5#{iA&*P)-1gQ)SnD`A-S*^os^=EJ8|Y$t zf<3OL$x+X{2WM-A?OPlV>R7W#m`Iz`<@W;N7dmiNQRC#m6+2>*sNf+YBY{Z-W0Jc8 z;CbR^6q&Ymm09mSa6E9R*VmJLj7f`?#!xgRqmD-5a&zSkdRwErV?cP7>n4%I&4dhh z4^&uiPm)>>@&9wg{L5azyO#p&Kt&^6{=RF9AASY*{|M8@2=5)Ddn~X3^Bl)pf{H{4 zTrUwUBi@ULEiS)vm%w_omJa|;dVsogesmy9Q-lIJ`c(WP`2|VB>F!kfj{j0e3B{?^ zI)h2nAoY^|P_`C5B7XN^Yo3ExDyL=T_M0S2C8*Uu(T$ke9Le>=)gf5N%xcdEFQ12W zr(bWwh)_|qpBF-jm@P5)n?4cj;Kow43F4Nxcr`=&n1rWJu09zgmbgeIk3VJ`q<_Pw zi=jhvs8VF-K{Ri%`ti7Zmw43GjU!;<|5RgrZ4HDjsqqgZkvwPw&gv&T69}e!V>&@L z&oqf=OVE}s4DF8GP6Rv~Oe;s;T;`2&xBY3~FhT@KWcWq8rc(3tO8+O%-I)NM16#dH z54}ly-QKWVbeIz4&cuWsFKEfF5!m$c^03R=-}lj*O^g_YAUcsXNK?Wy>jb`viWi8U>rhPWqNv-+@wpj9R^k84zyi zUmqDCH)n7`2+1bItWjev*Y$*@A{@R8>+3tQ|e3p?EGz=yn$aZqL z=ICnoC<^ABNx7j{e#d&Eip$dj#iX^oZs349S?M9;jYl^`;@94PlOq0e09$3iJ{>ze z14e@XFcZ|6@i(_|Ky4Iz=6yDWm+y=Nn6pT=&uQ8+ZJ2?W(9zYrbDdjy_$5}GH_G8G(R5_B_BJA2N$rHFDvO2N%2&mZe>fo5|S zl+%`TzRGaP%qZSYW%|XJsmxRDr3^<|O`jCx755E&3p0fUUK?ndL`ev0Hu%oR1O#U4 z4(eMkAb+nxswuIrADC>uPz3hmL}cDtp!xtB5vTP}kpPO>W_%-C$ye%<|Ykh6JruY>w?LywlS$7+c56fy= zE)f!JUJBP?#PIfs8m`Z5df+sFpuUfid z+%}(mxQ{1j+@>eFD_&x8HS?*mssLS5R!A;TV4<4q_cva#CR>Dn!KggZXI*%f;RXXk zWUP=?^Dgbs1hw=B6-n5{wqE$E0tQzCT8do_ACJWeZPVV>C%zZ4(4%1K7i%cgu7Qe( z-Tu>p2f1EK63Gty0?h|ORM<3ivbmpFlx(8Y=4OsEHit}TzP-8Zle{QJ^2ER7pMUoP zL>l%NL?8a<*04Xt*D@?K5T&r_1*@1sT1T~Ri|5da#OPmbI_PJ!tmOkqVl{)ETX<FpZ}`&64jF;^5X6`=~Ex0q#k zC1K@6u+cr>V9(d zUs&ZYUvi6NK}#w0KONzzIV`x=CWP1|k48&+t9ELZ;h#UfkVvDRVm+pqIDSiWh$piC zBc-0A*fy<6ZcC*Q0D>ve_-^7(%!a{#aZ4Ub0dO|!u9fKD!JUPQ_-`P>zcxzgCv$$|dg$#WNXwJZjg4-p?CWJb7u#5lnvC;qz26mT_MrIFh1Ig;gZG`PXJh zsu5*Stnj-foNogDk`bQ_ZHx6~WGWw=9F|r;UGI!n#%>0CB8P_D-LB$m@hv^QiR0t? z`u7s+PBu2(SnEhEw_V)9kfB43uz zf-)jLQr+?5kznd~b7mOExf)nI-NU`WfNz&J!X zIXbn1^(aUt&=WNhnOTp2;Mi&aeGj?DVeYosKwVw!y8XughjK$$q@8Ub#}w55=p^8r zrd%SW%%tt>mQtLro+PByBcNhFW5`#xUOXfZR+@ZFA*d}|_ZKkm~6<=)7bAAddW zKbrvW5x}>y7F_Q8J2UOuga3?eiKH$T)0~N2EGv-hcD})8($%v@FKhi)pM7xy7U+Sn zS1n}w&&GW{?J^!S$zjvuxrLu~#R7W%_i!&uYubc)Ig@}LBf>`jej_Y|-M6wVz*|5H z2A*PYW;$;zWJ#8I)=!BeO9O9-$>uUM61J34xxk!G!ntV{IL^5l_&6MhR5sB!eV>=W zE-TINb$_1Rk{!#_tCR+@MQg-fXU=%LC~P!O#0}_* z1jt{Cb0u$f&C#>K;nWVe4l+)6HRiy%wTqtbp>WzNI~taRAb5?S>A>;^qteHVj=Z9a z4MDR*iBIWpS;_U6Acx&ue20l>&l4OZYjqb4NIuqg^6c^7L0>Spr=4RW4E`wUu&_{Q zZoiuz%Lk=u4Uk)GyOcK`>Iq-}V1cp7Q{`?XMNZKKw zt{2vv{q*;*)I#xfofE+F{!}_auIovi6Gk^h`wH8Q-VJ6Fpz4(OvlYuNcv}r_^_BRI zeC_=YW43+-QDSMYMe8<$*nN2_MSHk7QO*FMV|t|sOT8Zh0MrDh!F)8>-h}f&`qY1) ztXd_1OsEE{u&UHVEC`&vfA*AmT$ zgh85=B-^{mDXt$IOM<0628XZFPZd#mz;mS^jk2Jyl&T20-oy1lI8nmZw_@ zzrnu=a=_t>Ao9h_=GCD{c&84YVYqO}k{Cg{g2tS_&%*#E$7pai$ll#lRoF7e6!>Ts*=q)}V+Y=po;y zE_rOc`y^U;XG)H-*+8e}X~K))I}$avI>#;1tIMS=|GlF8?hl%l@7fp7{%zOPdRj6; z)1viWJcXgzkg4U>>vPR3_DvI!%)6LMLsx~Tlmn55H}~H^BqFrcx8}2it_mu5x&2US zqc-e_TK!36d&iC%N9|8eO6Gn3cmGH@mVL3ZTPXDRGm7wUK;DQ;@xSc*FoDOKxRi~5AUoK3u_Sn|xMF}e^D98$s?H|O@rd4J> z`oNNr=J}d^OzrO9UBaKQi5fXLjOv9~FA)9RWWUEB##Yc|2idW{SQO6bBbN6r)hhGn zBcM%Js0WRknh3$zx}f|im(rm$()E`5-k)9o!8cyC&n^oY&h`L}07{5zn%XOT} zc&#b;aCt`Xw*g%(_k;BM5~S~w{Blek`H z)7`tHx@P48=gX{-5KplnFEr?gL(|h)kjD|4`i`&b#mXzT<`vH^Hx2gmEN`>Fr=vM9 z>1MA`8%2HgUrLqKHoz~m(bg%C+U42kUh@( zQ0s3f@8Ah)84}n`7;X$12{KoENF3Z?xeUuRitJYIppQ7ZUoks7yR{H&E!s0_`iuyY zQv+;?0l*Pp9m7q;sa6{`y7+~5C>Z8BZ9C#vh7=}*(8eB&o%G1)$C)AuM}QN4)0$X< zuQVeJJI^TU6xQ+`SVZ6bmy)Iy2ksPq=8PwQHR$)U@VD>Kbi&7&E1Z25?+X1deiq2e z(n|GUov-iEiYJL5Izup)E2w#TgH%_jZvPgcrjtzS2IHrnp~M`rlE~ixiyW@lsqwq@ z?Ni$O)0)vr=e%s)@?Mz^+#FyiWr%I5_u<(*-APZD2huV!WPm}7mVw7~oo0dOiSLc3 zc0obGR#gCeRl}AAN0?9iiuv4!88KZXMZi= zsT_FVw@uZU$p|s$0-0&mS4rp3<{+deLD=xLnmGXy#Aj9QjY6lnLx)%(YCZG#tJnw& zu+(`xoQ7qVx!BecmJy2imj~8v49?QR)(WrCUr+3_EPif@&s37+bG@o{MW&q6;YLO= zX+-t$rj3YnX9nI&I#ZkkEY07kyl-e_uAeL3(e@{B|6>=Xrm9O~}Ac~EFIAv%(8 z=$n^<0#g66IY~#cxH6jru|kbt6nr(OG&JO-NFJxYnY3rg7UYEwC=K{SJuZU|TrO-l ziNohCbhPmqEGRi#Kgm1%hLhsL?&S0@MzQJHC`8avh8iJ)+5jdCUSybLJw9zJ8JfmM zcZ-4`QMu{A5vwbJOp;Ie=OyIz5Ki&Up1|N$-F2p&fuVqRBO25M?!}|uIPvsx%E1RZ zne&F)l>H4B30IOX{mkMz@AQA??_B-QOQdpt6d&d5X^}fY%fR3iGIv}{I;bKtdX$mi z_Kb>KcZt{vbT|>9Yj4ZZdD1&Fz!pHo6?&~L%3V3uf1E$!F>pgX0u;r*WI{0oHw!dA z2@<$0_6`oR01l#DkZgl<%nZrCLwoEx^0rQ?#jgEx3cyNH%}+j0qb@u&G_;sZuy^p( zlg9FSgF8q-+TOlEw&HLh?aGE$s^o5F@?+y%Lwqwqg?;bU_4MU`?_fy58#GM%XB~U^ z6+zNp?v>XYKo8!WPxt>{Wb}r9%zM#e!h=7Cy|{wo3xD&w3uE0iSkr5~PN~r$D0Y}d z_N0W<+7}q0mydiu;0+wbZ2Y<;2jZBhH#5Bye5|NQm9~E|Gxzd&BJvE*6C{eRtm@nh z7B3kJAXj(!_F4p`8Fqe|KW}z$$rJx9isH}zQEK7Tv%4-QIn;-6P&`PH-9AWxLlcFp z#_@5_Zpuk{mk*ROiC}V(+#%J$>$`@k7?!Kx_K6Cc1$r;St~-B~o`B(b_ zgNve$59GRZ7=exoA80_b|HhT9vjuLcWjD>JC|_G`hMl(!`h&4QXNAT~A01Hb+*vebWG(6%EA@?kx*-RyG`vv3 zXt&yORfCnNstf79og)NBDpdAvg4>GOvK_^RzUUXm#<@M@>J}rTqcL%~SZf5^lPAEq zk~~;~t7WkmQ$$z3!}#Z>Ye9 zw_#d;lw4VK&Qcj4`4stok@g-?O>JA-@Bu*)RGJW#5&;3FcT}2ERhmfeN>zH19-4?W z1renR5jcXdu_x+9xU?ADqd#$-^vG&Tgo)?R|ZI?@Dwkn8nj@&ssm)Fw(}G6-Mhn1{q16ou(A8;buB&FrL3lb)~@ z{-w*y`Djpl2lugcZMgm_!}sxPbX^**mQc{x9-!&#r9@|k#d3!V|O!TE2 zi;ifNayb+)xf$fG^E^x5qf_Hj>-&4RIBe#N>2CJ!&6^T`7pC?o)G|2ZBE2`0$fvBf zs8RfrC6O9z*lS5$U0w2XGD8HAetbFM>>D`|{bUHP(Ad79+?pjVGC!MzCOz9#Mt-6% zA>NcJ>QK{feSN(a%mn!ID#OUABzdCmZ`&Bh>RKAYA4u@)#Qtd5TWFINI{VuMP#x2v zpT8e`%^>u99C6ec60Uo7Cb@&3e>D9WN5!^5W=Fj4P=EipXxyz(xxa2t46x`wJ)(4@ zHg1EjYFT~+2-6sKxv2X7mKCCnd6y0^P^a5kj>>S^&mQkc8hYJh`f=e>N|^~~OS&1N z3E78^0US5K)$7k6FW&~9qXf}!OxzCvr-IJdQFBQz^LX#ZJiVc|xlw0IhQc`ji-65< z7J*^0vPX;G485ks9#2~kp>~<(XjAvC+Sra+n&@x+a7T$tDYV&WzfTVRFT2=&p6x4S z{h*}xxFKeFv_nkoxzw26!uVFPnf3Qoi-G;&TR*5m?4+ndi;eA*7K&OrQHIiwa+QuL ziEN3><2yCamyDdUJ8|4e`VXoQO>$N{D?fSXf7v_nGsb&|>bTIydWE*<4VqXJ6>r|I zRP0O=l(8*nE7cud^2A{Ar)+1v2mNUb86Yy!8S^y~v>Sp!LmwMr0aF#I&}T=gmEWWJ zKDqsWy9Sr1lt)f$JQp0i>@5G0e36H4(3?K8pd>KymC!@YlZhpz%U+;n6^t6Nt4hQI zj1Xns>0#!Rbn2gFxQXuCeRvR$3LUmyeU_{WEC`^+SimP$`K~hjGnMH7+^zmoRF2IL zS0ydzakLBA1kYbAY&&7qJi7CnDMwVXuC(Ip*w)A5z)UaHC#P3SPYSWD`p51xSP8d= z1DOI&%Q#0 z^ZkL%{?FB(KdEkSfpWImx5-pWm(9;TV{@R`r1|1bRLvu7So%6JlVYuRyIAzpVXh&u zb7{W)n9<-v4wNC~aXBIV?c~6wL4hAO&Bha}v-y43m;Ha)NB)nd3M2tVLr zq`>RPv5T|zapD#O&;P&dlm7ku$4>c=u1r6Ll2UCOfrgZ2H#_p5hwYn6UFk-E|#wYRS0T+3yL4qMY&>xyb~)v2%SiW{L$LM0Y2`FK};277d_-; zG!nbqlR-k&EknwRSKM!%kA*JWAxKdFc;P_5Z?0~8cX+4xeTIjXU5u-u(^8-Rty>jL zsQSVDVryroLXBDu>9-*S7%b!(-rhfCj+S~iGf9>t=D6JjWmO1JF&2 zt>G!punvwXZ}+WI+>w6@KL%9m;P>ds9n!k*0B! zGx!#axD?kJG(T%-tABzTYu7uR2-HY^B`HjL1(;nFF4)0))c5j$Dc#@XG;L=A0l|)C zfs~z?x3bNDdKQ-jhRB8?nw?!G2O}`5jf+nTTkUD zGmymPo=RGjhCiN@!cECG)uferMZa=Ia8Pe_zSNO17Z(#%R(35G5ii5sd2{yc;SMKTbZ^OczFT&$rfBqVl1;ZGS4}-GH+tkqC+i>~vhwkKs zC-Tz!7&W%d@fryxWX`i}5Upu84Ln))$?wr@)rX&G`orHO8KP_GIg7i#3$8DIkinVk z^bgO8s#S6#GrM8!Z8b$SZJo8}+l6$azN@ZHTRlNPj*E?reMrGAl0Odm(g*D$Tz{X3 zU&+v0+B8o7knb`jNQzIXR-mCyQAu(9#Bc@Y9C*jOq}R895n0?{B|(PV8Sr73hs9{` zT2hg~yu{-OaRJ%UHVm?@J@fWms{dRZ#FCc8?{jirnE_WwCa!JC;D9n+*fa??h3QxI zb-x|~bi`{$TGd0NgM3U($tF3O(F!3Uj_t`3=|VRImkEk!1dAIwYImgOKKW0*@-NV* z&WQDc(tCD4`NYJezdLd3ABv0HNk^Tyr1ux&qN5*OboH0`)RO*vChr6&@Sb~o>h~3_ zE<33=Wx|=bFEU!c&;a8c6UaV}b8eYjqAL2a9rxWxxah(_7IzmEe+(PFqUtED7}zS3 zuhVV2_emhXrlwJ0Vs*#g33}<$o77Z86y>JJ#~x_1VW{}Ze-m2W(<&AGN6TeLl~s#X za0i0rpa$m*0~1q%Fe^Y7u5SB6{J-`hD=>hP-Wi>c1!^?Te(oZL9p2ZDnhJkxJfJA` zCh{l0Gq6-KF{oiOoSe=@uz)L|6ylWXtJ=&bmG`6{$2wyNLRXRbw^=tV`5qiV1IicgI5;!_G=F2&2Za$CZQK$Sm>pC8y{6G|-F^Hw;&6_uI8scEq+nahKh_8CONzCut z_?HuUi-?3{e6rcw8`1_6e3llN(w8sKK)zQVX0c9X*NQ%p|Fx(cs>JkHEK8$$00mwh z9&F2BJXt@EQe6(n+w0=lKV1UNRN^bOENPSHShQ(@ozu`s&&*U8Nn4z6hs^W&TqhS= z`6Z#h6dJgb*THp?`ycB-uTUu7_^DHYjPk3|YvB44w#|2bOO8FUNu9@jo{Fkk*NQyV z#(cA5G=}CK_#wFYA4LY3-;c-9T^;}-ceXpCp#p%vKi}(-)a9v&2HW}uh2HPquP$~c zyY=i}N)t)_j|u5N?963>8=}0~Lpg4(aMiD!3`4@Gp$9~OPsV_^<(F=|#Y=l1JZAsR z8#e^A`@nPm z(w8UOVrX-x52aDh^}l$2hPO6TELOkHe=KnQPt51nr``I%clwi)V{?|MA8IJy`16yK zfd0h$;KFYLP0{0-1M?7WK&Do38*op)gp~Z)wTJEin{&(f|NQhhon^pxrvpfo;%aX~ z&%69r79BGxy;_$NM?gFnAkNR&e&uSd$Gd$iMSJq!l3QnV%%8Z$eMzp)8c0A85XJ+A zbfq84IaD3o3Cvx?kaa5JUY5x!Ajv5L!_?C5r~S9>)&S7C{cpg55p$aT_rn7AJ23R( zU9lk0fkAS0ao>U%e{8Il_>ZN8{(Kl9R7HOOZ&#)!fzdnjgKg5SXinq&ao<-{fFCk* zv1^WqXj0|*3QihOwn~6UIe)MJKSLb1E*}pCNO*h9E0p>t!FB=sQZda%>=_u;@emw~ z#YW>F*Z#!!<5(~QN$f5!^*L4yIKVHHD$n%Gp8a0hzev&m%#FJX^dblCz2CnM0NTX* z3YT>R&Bi*cz;K~Ly&TTW^cfkt{7YFMJ2MJ(5yR(+Oy%#p8J-0S@go?K6HMdw`yzi7 zPUta78wWdh1eL3Qo(^Pr;L)Gn^WLi~Lx-8j^iob%8COte?)H!M#qeCbz^G#4`V+df z9VdjuxIXd%xMGmv+RXqK%QhSwF!ukZTd0m{nN&cVu28~#(1rB#pn)m@X*P`;47ckt zDfJgC;3`$Py*R z*uKl@{a&T8*Zj$3UO)cy{*P^=1Ueq>Y`+f_$hSiv&az=Qe~aoL8z&EV%J^eIL#PVJ z+uy2$2%MAdJ6c_Xpid$lm1|tZ5gbmwb5c%e!A473b(t7ZY~B4ej*k`ka~D7SuqV*t zBRe~aA_9B3EBF7jhq>NFrj?%j;g=nUPEh_$c98bvGoy?54+rH(u}uEa4)C=8e?CHvW|?w#i4Vp&*oB z&1XC42Yv~xkOO~tFhm2sTpV(ztO$O{wZ$c7KU&>cb%Ak-e{dkDH2-aYdb9KP;(lA# zDd-y}3FzCrgYn+}VV*vZOv|;dPw#JdJ&-=!V5)GLFH!+d-S+oL*k4ue5u7P79i4n* zZYE>n-s|}qEiI_Fx`&80e*)7Dw;9(8;hQU@p29cm?CjnIN6>%88J4zZY1>+SEwb$G z>7nxhE2bGeJgY9rYwEvp!*qV@UBuQz_vG8|NT$w#zpu>a+S?add=(l(7Z-VcrFr6r z-tkjX3YiCO3R`<2vmf_nroH+ddi-c^R<4K;lVJb3p#P zrph%SGQEB{QCIhYQQGAS{ksCPjg4tGRQ>cr9vP8;guUYSkAH&&%S!)p+xgM)AW%hAHvHA);`&Z#vGe}J!@UiAKqB)-qL&*hH}{dR;oG-& z+%W7mgs%;h013nN1Euc(dZZ-(PkENKs80pyaM+Ba$I~zEv7nF1&EFsK{$MKyu^|lPilC0KF7Fo7A@-f1F1?klOWJp zp@6Wh;Cu}H%4ou26@m@UEcI6V%ExsmDC@7@=!Nc?NhGJ^YX`bz4-f7{h1lEMZxi3{ zw3SErZ}a0npP6L-7B1HeYOAsKoD<%%qelIrs|Z z4GxX?+h0Me_3#;s_#| zC2jl474V(wi}^REC&X(Hm_W_u?ImY~_fZk~{-tqzf%!X88Bj<|K#3DRzQ+k2E*`eg zrnCOLcN+*iS0d8|R#w2LC;P|q{m0tQ+mR5#r7cwDpWQjrzU5&#N$XqtiBW0k1>54W zijQF3>W@*!?ERPr=bX-CR9+XQpTr6KGUvpI=9Z<)b*e$<~xc(8cL?`uU`{) z#!aef3A^=w`?YvW(ME#}&27g0(9=$n4 z|A(1!IX>30!gQ#Q^Y{_UK_B59A-UV(ifS8eD$MhKxhjLrM4(ugjK9S<%&;rZ^W#ep z2}d1i#6|m)e#+7k_%JNeMNSL3d*osA<{j#~mJ~``!Agk|`gZcb1CgNZl&N&+M~K3w z(K?D^v5ly9YIN=Hi}#Y731`loyQ8k2Z#Pk?&FrDHn^>o=03!?$HYqKZbaq0=4)tv( zhv07<{r4$9%0v54$7e`PG2m$a5MQmttAYgL3=4 z-#6i_-nKo7b9_UrYV1!Z=;wSC4>;2v^;wNn;)p678x=JQ;Td>5!@LsS#!Wb@msO1`0RLT z=ot2sV_vHhljM%GV4h7aD07Bgy4~_d`maIw&eMgCIG6dAfwwcCY-`Q2?#nCpBt>*j zWhUomvzUU&L&2NCTUWrzXMMz#1@Knd#=vcJ043-vki@mQV;*1m@mu+rZa%II>~fT8 z?EZvryVCU}7o{>Al83mhR&vgAtfv1SKWDJkDVf7tenU*U3~Gl5i&3~4cx-Z&JJ#&g z+`b&An1nax)>UHD^e+`;F#nl2LQW3C(L60BB4bb859c4pF!Vr%bGZ|N7bocI&&UTR zz6c4KC*UB6X;ykuH>Ei>cGkm#O;NzxU^u6K)SG{$*+T~VHEK?DpH_64y1{>b2ye|v zY_~02UnOnuFx}AvM1d3`MlRx`LJ z-Y;BWdy+7Scmrz4CL-#@*AGN0+kz(#_xRi7)XseN(O%q|)x}3ZOk&N{F#p2=6^J|b z(u_KJqFiO)3Bh-tJGcOX)t@kEK@vC~?@VX1=r$6Tj;+T7#cl3Z8U;F6x;}B@+5i(! z^f1CYvD_&4>TQwDz`dSXcU~|%*2v*3sZx`I{&wg7B)_lk>FAupp0<~lQU%{rZ3I67 z^qh}@HBy+>QsE_mHGj_zDXk!t`}m#a7%|B)J~hiUP@AXUz)chO;=ojbFn-U+O_lyf zl!O$SG?C;4@&kMulwj%6zsl^t+VX03YcIL9AdMKAkLrFyG1$a)5;`;tYrJBraysD?79a3YZxEwv8FNV%b$yeXtdC zkKogJ4+GZ~_`NE01QCbLghbD09S9mC2=X(lQMJ~78>JI!Fu*hBo$yuWR3+1W7B zIw)+PVc}w#RBQhrZ^;0tUG_PctZvCMshZg9>FYC>#%)p_8Vtw(~=0kw` zT@py<<*7zF-PWg1#f+DFiQ&bk7dldSQH_i&Lw)Kpyo2K8D!Xeon%4%EGt_tmox;XO zMy@$%Cw0QZKArfyDMvY>AMo=-$&tMbZ92Y65O=skqj;gX;xyM0GqUMb(h&4Rs8b8c;VnW{-P zv3$odQR5A3a8mpbW?d)8r&*R#3MJl%Inc25peU4} z_M*ujb^6AKfNtfW)+?_s0C}aEeXDkj9MhXBPQCJ=F0PHs+OSSn*grKv*fE9a+d;9l zYG3oVU&Zo8}cL25*L%5)`H*ePLuseEI481jPwcXt9*Kn&1!p&n~WNku- z^%(9eXT~i?`QGB0bgOE19w%$JxdbL6U*g#4gEbXUVFo>F)$^j5JgQowm;@*B-T9so z7-n_2iOs}T zHJxu$w>kD>h7!T3LhBA){BE(c(oF>;;mO@X^(sqL&El99VPf1N@zlQ^`X4%=<@nrF zT%C%rYG9zTvAJpyjkMb zZe?3fLP^GNVkaaj+9mgh*K=*yxo>okBX)ivzH+o#3=8I;Sq5^J|6ebRS zi_so)%jp?%B+n+O-Ud(#4KX+jTUE6*F1Nym=g&1txR*Bv`xrf6S8c$zbP`78@- z)9XTFQdnV|0Gz~(_Co-_SdvO|Y5>3HmF*IyW2G|!l+I;XpG@tGX3=YTlSi_tp>_B@ zQAaW5Sl+TsxHPN{hDH&{xDQeL{!MSSwMMIzpnl(vCUFENcWEJ_p%N$_W1WjRw>ZVR z`@P;bx>-@x+-}>3K7Od?V14h>c{;!Cc6h?6GQv#<R+Q)TB}keWiIJw?TAqIa|K?-%FJLQu zHDVT$OtIqF-tM%~n-!(+x%10Z-q?Plcg;$j5J`C=;9FB8I5cK|}EQ#{rzsk*xOF1M}F`VbSZ(r7eGCP>IfKqB-y3!iCdOgHHT?Cm)b z=@doKWar{e$RfZMs#`l@LSa%RX6Lsx3r&!!a(}K(*x;1rj(yEJRt?APm=tdp zhBS6z*(Y%IQ4zZmi|p@A@kf~p(IKT+I*Rt7kD^Ais$B6F1;^Cr(8oTlY>g}ucFq4bVcKY7=n7*2IT=pn`$xz_EwlAcjAUzEfLX-5(^ z@KKe^6p*g45>!G)!KeG4uU=}j2wtVfRNj>6@SpUF0#qH>WqLR;iYEJ2XO$T1R@{nM zqH*V!Wg&b?HD}ncMjXVgx{+jz&JJi4XNRxMp^1fH#@zstJOBE6D0_VVybm^!T<)Ph zLhhm|EWc$gP?80hwhf8|VdC1|)xnGT-}%VSXR5;m0gv*zwCr-eqZL z`8G7i)n6gFZlS?dE9D0;V@ln9EfuAN3tJmKQ99%V7Lsl19(kul$~q)I-OgIE^r*hk>p zT<7jDB`UScw>bJP`gFdp5EaAjQ{r2W4j}}90=ax!BM1#D$u~PYs8;*mX`9vSKeuOR z*UY6lJ5vKEpnVtWYNa0V?=d$f88{wRc_ggdaJ9!;tBJ=u`mQUZ-UEr^)zh-g%F0S_ zxscE^He?>jbYsqn|E>4KtZ6y4Z&m(lwQdPPo;BZk%Oj}i;d{MaiFtbcqP3gbD?^0j zB%MdhCNC>EhIYy$hh)AukAr_tYPUNH0+4Qago~=tHU7VN4XXR?xhLv@Ic%aER2Wo! zDq}zD5>&DM(SKftfcL0%h-8-LdH)^~kEC_^OSe7Ww{NVOW)>#SfThH~4*YlF0)lo~ z9xNplg%lXwd{=or!`7%7axf_|Q(je^ILaCHiqYh1G#HK5miReF-eBDNx3H?OI`8K=kCeuL93VF!TG9EK@y> zdKY;P?h>+WyuGl{E)>V5`~0->Gthb!>lTUI&}aDPc>|jObdS59t)&dW4p&7O*jscN ziQn!k@+Sx3+NCN=K4YIOT`TJJC@>G#QTZkZH#N&F66hkQDZij$tJxX&rcD7mDwNlF z8NQ0_s0(g?hI=;76K6QVB3pRV$7Vk-d4Y2uUze|^$IOGPPc!;^x5|o|9zRzL4ZEBx z*imAqXL{6AUX8p+7a9I= zt7?+mW802lhVl;<`o}KD*O35_WCA;&y{QJ2n3_}y>mNxwx_qp}R^vh9P^8W7G=}*Q z*O;nSD^oKE_z2@%u?(LkDGx4Q>fK}=OfW>A8HwjE#s!*& zzpMP-E*M6RnYgO6vojrHYMK~Q2-^uFe7IZey?%0g3*l9wD)(|P3hf`~!#7bcgYQG= z#UZY`Mum=?V?r*{^XGpOX^+hpc_*ALzoTQew?1KMV362ZP<@`btd$BsO}P%K#eB2^ z>G(lbC>NYgywViAwfNk0N%-KDKc;mdq1!KS%)J^!4yOAWaI)2`dqzUoy9`wagJT`8 zDFoswowh1ge_clD@<~Pszu_-N4zY1w^hpd3-Y<@wjQMAxO%u23OmNG-GGAJcZvVTh z4N&(K)px`resS?vwpTC=7p5^ijZeCRh-<%47yS__NseQYicltkmtSLAouYG1mhrD| zDys9Cv8btl9TcIR${a>mDQDk@=tw~QS+hDG6W5An>n8Q~E|*RK3KCUaU0p4PMCWn0 z_Vq`9>wV{*+GYqE+$YC?PT$TR^VS_Lz3P?2RaO0wGf5tp4eGv&)+!3DJnvah&oje5 zp3{R|*4RCCAM4Oy8i{ z0FFIeCQfAmXd&j#-isft6qnBkE6A@ko3TL9*apjM&$ltSwS5WiXtGTTrJUNd{TAT@ zEjnH^*^6%n0^GaBQcCU~F(+$FDXS|qQyuJtH6v3dn5p}W3e!G+k`)xXYzG$`ujslJ z9pRGOGc;tY%x`qzl7t`O6@6E-)MBN?Zfx*t3faR7Q3`u8-VLwiD}F{=Mm)rMi}BVI zdyGmK*lk@Fv}($Ya9QI)e!O1BOMdgFGTgDfT^NAGe6TXG`+H+{NoBLqAvxCtast%N zKrms;MJenWcfN@0VyC!vvDMdI(}X}nqqSs{ktD+QtWQU3W?DYlIT!P7sCJ}3T;cX} z(3O?oPnfaJp_6vh1rqGwkAfzUQrOmL`$l08^Wq7I^&Uu96OXcTMb#!^=w9j2w`uX_ zc}HB>_g&#GbH9Sx5OY0c`LSpsREX(eT)s%VZqAp?`wQSspDA}wLWc59tV<`Hlr6L; zchu2Utxw&*U{m@!wDxFM=-Z{Ahobe(sHuo=k&rQO*1T|TB!<>PS!UMWq1j<@t;lk3 zzbTMGpv0kw3`1o84Wj*kYmCGP98(elP7POl;E?WDR^is1XUh?8`X)5n6y?^b-5pM~ z2M>xh^0h%!=PA1J?Adb(ApbpzrSV(u9~}HfVa;OecXn$gHG0f+8`9xHnApvRa63MH zcpo({n#k&f4|aZh;q8&)SEV}1Y%A^MYd%nP@5dg~(x==T{{k1E{{@0gjzC4VM1!H! z(V41B)|qI&i>i|1i2;tYFLnow-#N}Y3r&yeKue>azESe`@t+Jd(6L4~olqtT-QPovhal$7 zPLgBH(xy+-gxfG}k<46?;g zEOv(^oAM!K?t|>9Z%}^QS%mpYZ2uF%v6fBqNacRe`Kd^One))MxOFb4;Pw?VqKB-H z>KjNE_esBr8`}vbCr6h1E(^6P*s`vFIOCuQs9%EVLIP}S3mVV%G^Ek^L=x8u$e(7v zOgvV-Znb>`K|X5M7!Hb?KZ!1@#j|_V99`O~^uU#p;UZxWLfFj@p*rxLJf^y^2lKBigAY3G8mk$Q6%= zOdLQ4U7*h&9!D<{UwB)ieI)K`)rFwF-JY!GLfv@iHx3VFv2LY$M6j`{iADOLfNpiW zMf%q#%HcJu=5Y67{I02V!s~g7vS*7QvMNWbacG$(KhvWlf3z^weVaPwt2B>{Sf{f( zDCqHK!CLz(Ka}j3l@v<3zAKaySliYW0Pbl+=Q*4B>Od^2P4hQ;-Pz0jMv* z!PSYtZ2v;=KOWRPx9~CsVSlv4#)v;iTZ&jS3m(GbefH7Djt5m5nJ5{C3Ue>qqgY zH~WL*#%)$@#?3r8_nMp+rIoa`wfiNtk&8N0M1St(r7Xap8h=?%i;%+3Z;aTNc=ajj zUXSgN_IY5`ckY`U?D=I<*w9z#9gI1*PQZs-!A^2pr#kaE;ZGy19@IgWIXv$)J;Ui@ zbHDf6b~dfU<}N>|^H6D`bxM#>AR%KI%y)%m0cQ2E?1H6`_EBb1*u7_hr?04i4{g%_ zXz(D|0B0uXz;l8}hUHAuQOc$E!k2^MB#Kmn%V@s0QS4KVH(oyqGW^8_aFhoITbw^< zPi9bOE%7etm8b1+ckg6d0rF}RvGiJ5;(=(_Yx#aTB6x(<=M#D&hBfZ#UOmeA1~u;$KC*iReCq z?5&-%^fy4|DDijK45lQy$&p0K-*-y9q3{QM$j zA&iOAklv9tB2rk1XM^2_w0Dd$>VJB$mnTopr3X;@&$8Zbi`$La z1Urq;0B*fr^K;U>ZzUov&Q%{5;IuDT_|_QK7$EC;fdi~MG$bCc+=;hBUYl|i+zcS0 zIR+CApC0htAu`=s;gvvG_-%hJxjq28$17MS4JJDDF(%_pOEhm^z3tz^*c>bG=8 zQrP8aqrX}$hjP#FXZdrlN)G6tR#pTi4_b7a$DPYdln}9#8?heo!4a!#pJ$b#;vM~G zx&4}v)hi>eodhg)ziOG^7q8jdeM9`!=8~#s&hlgWm4^xFyePkWgC@wfd&8S;K{Idm z5#xI%POb2SBnRKvq?Y%2I~a;78(TTYx<6R9V#xq2P;SDH_BtTw_ikkfItd`OVhJ`r%D9HGw0_!3JhJ@d!Ywv+eZehzF91qB*lgV zhBTzfs*YmKO|tRVdt|=z>m2a+5W|(j{seDFSiyFdwzW8T03p)~&Fu48+NWH7gw$IF zq1uKyH(ek65$OqP)1u=rmq$(^Pd}Xsm%v!5eW7NX8xb7p2tp_4Az)Z3TIQj*6lzEW z{-4R2tvNt$WRaof`dssqZwWfWcW=`V*62w#q{KQ3#i zLTBgU__~jW|M+`bNvSN)bIC|NQl^OD1lzTNgOsk{Wz?nGsYnTh`yLG8h7^%d+|*>q zuCPy+k*1)T>RHEpK&>JFv{d#b)Splrb%$wjba_J)+d)~oty(rWS-o=Bs(Cki{0ke| z+bXPd>W9lu(-|{ELYS2Mb~)AKtC}x8;%HzXppvcX(+tM6g1%ro^KphMJxtObj$T-w z4y0G)yRXI8Y6&jjolJ(r;Jz;~%S}M7t&Y ziC6p-mN41N`J}L-&9Da!f(g2J0Fi7j7)o;vq8CON}Ox_nlaj6)@=OpF=0c z@jbEXZfg6L&Zf~zW#AM~8uI5U))28~?nRz+j74wC({I$c7qc0Oso}BS=MQ*gwV3$n)H|>5}3eI?bq4C3#+Bp-4g;6@xcCRD0iQsx$q9)xOCQgRp8rK zw&&L=#V16j*n=`6AfivqopQ6XT(&X1fC)%BFU5%jFCiONpfM86UUzsl z#uw?mMobak3@$tso?(3Z_SW!%9ajeeG3iX|cc>L~fD%Vs%Cwrv1n_@bVFS}z+VHv@ zgP*Y`eEm|2i9lI>wMN;aVF=qmSL_Ldz!(%`sb`()( zww^fb+OOCpU?cVQq$3E)rWy;;zp}YM(}#7>IbJ&w*AB*VtfneM==@{EL_|VM+!qxjJNH{g z=r>aHw-=jM2=88paFb)Ix$DgT*f#lF@QOOa9=(&2y0QWFAu!5Wow|@<4VDx>8s3c? z^m6Xf_~)$7vkZ>I3(RsI^auAT{gHNKmCfWk_Y2a~`xw0rpOi&1dm1B5*3sgCin~vf z<0{c4C?GpS@}A5|iURUwBH&d1>R_HT^r>0itZH4z!P_5kIKtx0V;AT7ozo02*w8UW( zNQpqRoY~pB;k)wXv!Qo#vjP#knQF21im)b0YQ8tlaBkf}>B1DCtC<|$ZMtYdtJ5Lu5xTfqA+xk*sPuuP{qW#+$Z&FpJ$iodC z%faS!n=H5!k^p#dmpm*eK`mNEGO9%TI`wsSi*$S8;lqqyPRA9fGYzlO=O!T9w7T9e zXUsAo4|)+#bNh_1dkjjJ7&C4t7znv%^pLj`W?UZsH{2-Gufw?<~bnMPO8KE-xl+aR*hi^k=XY>88(6((< zKB0;`qklRTDeT~r=QX(AT{zR@cQ7{B2PM3ATI*qb`9Bd;0Er^mTv7lU#5OYW^3+Tg zTunHdCTo5qehm#fL@8zKLa;QuyJu(cgBAI*M5Z0{Q>TB+8RK!4zy^g#9_evbDG5-J z>Dz#$0JW}bn3R_0^rXB?YL(ykO<}jJSuP67ZGrvz)Z1Qc%WtbztvW!;IKOg2b(ZDA za~L2!IGHtg!>o3!@ZQXMKpIj0WcNt$JWy

&3z3iy#EOubNQwe1tHy76&%hO

uBpc1npo;+Y1fRN_XsDV5V8ApnO82v+?oN(Rr$Sk7W=g+(Bi*$n%Q7DuHmXfpHt_yhsj0t)NtSQ2NWt7 zr}elrtZnUL87?sN7L)R~&bY*mIK;-aRmCCtO9z7XqffUZ_mS*Fd69;CFh}%c*_a(+ zmw#<{wPf0M@SUrMMl>Bso^jb%Iv=;EUlRCXhqI6PU=-x!NQgu=4#R|4c;zTe0T~$8 zlz{pSA3flyWSR07+9JK+!x{{o!llJkci4@(q}NzAmmEw7o$AQ<+mu^oGXR5foyN|dW-l?ED^;C_D9n$TgNGK@4V4Z=rq3AZax%h<2 zzL|_xuG336z8yh$lvSXWCSz`%hFz;*Tl^O%?jQZAa)$We>XhMS{wB3+&OAj^j?HRb zDZvmk^I#C!b%H7fKVPaUE9-u5|5TC-B+qR{%-3$H~r|}IK`qwtl-yeUG zwWw!`Gb?Z@|0!6DyPYz)@S$oABYsn~34dz;JMM9v%ZsLLZ?Szo{*N~@ zs>E-p?8oJMCYNWOJ>BK4@N#5g!Uh{qN0BB{a`TjK%|58V$-v8FcCU;!i6Ud|#S>(X zW+mjC#OZFZA}q8kgAfiQG-%-gtP}l?l#`0R^1CXv?FtiXnw##lBIbsqw-l>=^*{~ zZa$3V+aYty$=eg#rW>-4+>3pePkK4sK(Z4f)e2u+FLueW&z2w6++@Ch8=^#&&fk|F zf4z*;VoPh%t={WoW#lWt62Z|aDGq%clMUHzQc~VV25dQbVli0zbCNsBkw}z*S z&4+(d>HidAz2+y`(x}rlmTI3u+maxam)=1hb|*_fT)!5vPf3h<4tj@exFeqye)ZN) z17$A3t-miY8+IHk%h#D8!yH5TQ8wh==7t;8yc>ZE@5=8QR?4e{x64VNRfmF(|FtKV z1bL9WCSUF_7tnhZuM0ju0km(%#}d&Mqx;0tPtUYpaRTL97SYpLdL-V5OB$<+5dSZ) zJcytRl}}>yVlV1bN>2H@>@!Q)lVezQ;ZJBTBp)L@;d^Byq_EGlO=!_j)aGCwJV4zL zwX#M7qJa@Pw<$0Jk=O!zpq;Tk5A{;uJIxci&Q?pz|HmVirtj@WpIQ%U!1TT-R=Au8s?<4#z zA{lR9SXdYsW6t@?n`dlh!oz0|?8KvByYjro#hKBPM`O&rWaVNu5M_Uv!-?^&3|w=( zz4us@8zZP9F^3C#q?EV$rUy3Hr%|tZQKe76mk{SRsxm|2TXa=i`xHD7N|F9sbJwie zUzNp=!M7!Y%#F}W#g$gPv?(^%pMb&|iHk1Dt1qwgVNcJ(CCXZ=*XZ&~%~X+B|BAUP z&AKMZsdIKJyuz?4e6v=ZEkRKAm!kMpen%U2OPU;$Wu<-5(^9r>@?`>99@a6zL%xejsrQIW!y z`SRwMcDpmd5qloOTR5 zhgP^sOVLavVWVG8o|~Va8PMH(5!Y%sfp;i0i%kqbOFLJ2uPr-Kz((2RVGLrE4;^ZE z6Y^f4Su9Y~8!LX5*|}$mgChf^q4PI&$G%@cdA83f9=XEzIjttDNv#r%(6@(!aaV<; zSDD=(7EBr-v7P+>Rx*@S`yXjd@I(1xCCZGp{lLDp9RX;6FSDZDjm3s1?m%j`bTNLw zb||TVnEG>Ak_{O&|8#chG>hxfl;8G75TY>lKrx9yKB`^E$kCxZ^Jy9?0tB3TW)vL63H31=5IPHuWi<-80w8=o9mVe2hsNO8G^9~6bn_v((hXtx|QSdzbHtI zGHpJxsM&mzqAk^W4or}0$vJaTXOiRV#65N+y8WDTK_>27cTRFUecXD}3??P78E$~# zAsHVlMvT@GHiz@lt>O-jPr1r0Qkl#O{6j#@+dPhti{%mp5)rZ^J9}fZQi1 z@NllN(=N6AgyMxdz2+iwu@eiY;ws|J6`EBvSsX_pDqJGDxpBGJ>Ffq_M48s7o1=OH z?$tRbxKrk5tlanBds*qpzp^)zssbf7IJ@2UY9Xeg68QUF{zCc-nJU)=0WM0EExdO& zA_AZ;3;tchh{%K#$}zUzdA^@cKaA~l6mjjS!2v_zr|*1pct1N^`xq<Im8sn7VGN5wqkadT5%i?H58=|6of z*h_3GLjR{?bdCd*Mm{rzkYmm-}feFbsU}xbkzAr{l8Vd-ml0$`Y^+kL;fwo#H5 z_giLx?X+M7XUDU-h`l=wkO)ljiLM&(_7`0SCAL;D}|EJ^6aq z%Z)qSuG7MCESIKD*!jD5QkjJtuO%&SS4-*1*?{K3h}&!_h2*Q2+@63 zu%+0Zcv@YQ<>xaELyQ|U#n*QN>~?~Gp)6&Hbm{Zc#cR8WkVaG^=#XqC1v z+lT8TW0sqHuUy5zsnQv{Blw7H1Odxj0zDr`VH9koFVRb`kS0iJBEj+0GlE{I|e1vwf8Le3{Kv7dtE&05Xq~{xfORv75nNc-?g+#lRq^o%ozI+!;k04qHjA_Xyy)z4@=iRl#e{rRs8pW4* ziP*r#(;koHyias;?D^GcxvkYzXzWEbpNN6V#$pJOP5%RsWs!mtW|FV&GG1w-AoViR zSquZKhTY3xDFRuPlnwva?*8_sp0EwrMqBoW+N(F5OXFB|2$!3YiS6(=9vu;TaC~w) zb>epKSS)mzHIdYN-yG79;^`LR+&+-evQXb>VH=L(8Ly|Mr8SydjX7y_@VtB{b>Y_? z)i*I9++RoO`eE|`A@FWcfcVPTZ^NTU8@#2 z7EU3A_}MAHNQw(V!9e5CJp)_OxFHwW22;aC55s}U7DuN8AUGx&O$4tcF5&EVrujo?hcb-`v|+ zc4BPLRC~)5_1&?SVzl9_^k0lut1Or0lr>c?6rD?2U2q9C_(%tfKdp=!=<0Gh{{yW4_;FFd&y#3}QtUbZCNYu7)Ps0qy+_S8d@C6m zlT{9imb5Lu_0-*T41^kS$YPk)sxk;H#dG|oued{R7WL;>ULgY_c8ijW* zR2h^rydFf>qkE$s_){1C?eMPwbuOcfg?aqGSE+ub)!+Ts!-)Ry6EXr*`MXLdJjJ=q*Vgb<7|Ae-#UvD*o|g z0Yo%(g9BvZ|4wrS*=E-su}b}4UkLFBuQ0%l-`@dYtZsjSUu(bh4roth!iMJSJE*OR zB7fl7i&uVd2nMiU(sqxx{E%yUeaHLK?nh$szgFm&wjc1zwGJ}qU7nCHo&Lt z^2Uh%RCtK5o`nHf2EP%tO$E?I;|uWe|IfJ*x8J{mW(-5`M54$Utb|{z<4t4-l99B@1jV zyww%|`VK>pH!}jd7{5+({npcfe}3`Zmfi#;#7sIa?1IbMEw`lL{{8S<2zw*<{{MKmo{|!DQXhC{Q#U{9dH0cN3awKIf5!d&!wX>_IiW;GQ{&^9R>8NP%bdsFSUNLiukNnqC zY5cT*K>jRmYJKsC#pm^w(8O5a5B?Mp-T;3lQoA-*^H4?Dy=b$dtZc*VnBWEbSmp1nHBJTP&<=qelez;Hc&FCb?{Z}W8}=pUNI zZxI8q_EXXJ_XG5D}usR8|)cs_bw2 ztH}Jd7NVGX0$uIcGYoFiH|=#dRI5iO9Gee9-S9ckmZbn!P^(5e{vsYSd?2r}z29=t z&3-9_f1>FCFtDcm${S*T4O(=78mh zi&W7%f4*J&HE80h8v1Fs3bc}spFdu0UWAn#)ziJ$UEtc!4f*{UXnUiCltx)AtnI|+ z+s1kIPg+G$&|lmfoSUPC# z3Nd+)|4F0Yjl|R@r{XQg7rc9y=KJaX)AFoNkXiOxU+(v}#}NLG%gJeJsymY2GY+>0 z*tB|FP+qQwmIA6WPjm9~QEsk_mnzG*hLz?S4%{;$Y~wgnIUwJCKOZ_tiB|R<8qJq?225zz z6?gq#DCUP0i+_NU?7_Sz%|^th=0FD0ngpu(DQ^DcVR2oA8F{>f0~&!He0-|3+!(U%T7TvZhvd=@NvDO-FZ_?yj z#87u6w2u*n3hb@(io0j%pTf}>?qQ9&bBNVJiA{y_I8x6Vk z)hxp`zfPX$CUMzJ+KTbWS%vk;hsiy@cixf5FeJ65thuP5B`Pot!|2M2V}@f(-vF}t zf?_xDGE><~q1K!10gVL^Z2+S=$V{*!HuR}@TF*DfdzI-gr25zU!6bTzTI;U_rTIx1 zS1>=y0OeY;lkv+Wit1f>1X}&2P%-DJ`LqoR}zb;$j)&`F~?1 z?mO=mR+LCh8e0)(!8a#{@&UQt73KqKtkbX^f9b|wB>Bgi+p`N)ze&gM9YTIxUwtAb zKr@St%NS2jd}?l+7)c5lGY?Rx*3=Z_ikwPJ#k{LvhKz(4qZ2L8i}A7Of?lk5&cd4W z3&~l@*fT@atgA!!7V-eI0Upk?E~vI3(=+`a6bruV@fV7Dfv^^ze3ZICp_x@~4srRk z+GJQ-7^iOG6IV9AAK#RNqmBNkA>y@uG6Qm@Na=~XMYkfuFzlktk(tf%F<~yM$izcq zO|C(!RCY_}Loy}+w}5!f>oE?ZV%FN^i~n&KNYqDv(f23_+IaUM=oAykjWyPIdXjv>B2t66TgA6{Y);Zq8nq?bfHe0X%@&fTvW zH%35P3ShCV<5INE?oNH9zCF9Y(y0AgTKy(RguuW$E=T`OvoyC6MvRQ$*IqJ=<7a*E zU-mgwt9MG?zS_{0%|#aV?*4kDdovUo?tB(8 zx5+D6X1b9}!`^OLv5)#*n=FdyhxFh}g|Cl>6YF*SOHvK@^X2&JepfcjBxG8Vj zXR8MP?G;@ILxS(4=d8LxW956e($>C~xEO2h7vEejDIt<)B7*3&+#YgLg4Yrj(PJYmNUUzqEsXBj$Du6dCWo zVn)b8Ad!gs*otpz$9YB^8NC~ilbrHe{1nCM4D$HLkw6vqW2_R8rF0VQf5^_6^6^3= zE_F}Rf3I3Zi3`8c+}otqBZ^V&3lpGS92l-E0YlyLMHr!Y&xA&txS+!(a>yEt?dSx@x)S#~Dou3k67n!bK(ffKk`K*<@EU$i_NIgUI6uEvR@0sC*w@taK%A_MiG zrMMZ;D(O8h1s=&@T)(NoTq4efZDgKt(2U)o~5WxiXbuLCfU(9d3LpD4q?dlUQqIKg%%a(%8>Zs0lRLh== zQiggr04*oFP>t~OwlI&eu(0;LXHbPCJS_qx8Kqs*hX({+=Stoff1NQhc3*IOV!$HY z`M)U}hj4LsnG8xqZmlWdR=bC%Tg1|n6sVi5KKe@c>@Ohw3T8M9GRUC^rF>Vf8VPQ- zD`$>gdU$xWI#EbCr2-$ECUbL>o_I+i+nc#mW#xl?b}1+SBNJr7uH<-MJWy(KOHsV6 zZuqOy8mG4Rm!Y!p6>Lfig{St6D1oN}L+VWA3B#T(79fTJ^iv6+QV*Z+HtY#Ft)>^U zzg6&GjuL!0Mh~_RA1yNZEv9yWk=py1K7Ij6Wd(PmSpxV?tX}$r~s`f2VZOpXA%aY4Va1F@sVn!r2q`}HxT77`UhOCF#;bQ zGwO`}eXzfQcc7KJq@`*;zMpKD+vMz@S#@&8`cn`67RAuvXF|_`a!{2>r=$VqiNbk~eY0O|5kc!B^_&c_|iua)P~rcv+2t)L>3)dSc9C5)$%4Q{4@^x@))O{nFXx z6@D02af9Udn9zc@CI1IIl1U*^yZ$9f4FwVM(dYN@Xb1ge9bUv%Lkr`&N}QYN4uunY z<57yF#mjPdKd;KQjKhc^e@GzW>J0U%wN0nn=jV4YTRs2`65N;)3_~%(TA}N(dZz{CcJ#T+%^2jNVZ?k1@w zJs!{Yf2l@d9Fc1)D+QI+)W~ldH1(&}c*uKbc}Uy1am8MF@;IO@{Sl=|?y9k2KFf0& zfoJJT@1euPdx?0rhLIpywCwd)-(3?4QmMfO8xO&y7derY%E(lratS zRek?f`2*ANU30J<$E|4yQMB%t95iJOB(=(zMrp5!vhNCe$AWjt*+a z>niTwSfTtw@K?#F>|)M!e*KphZcj7oh(^vf3&HPhbi96Nc0U=*v7dY*R8J6#($==e zUNGNUy>2?2;NzunjfI7E$QI3@fS|s$+7GW^alv9RGlAi8Z2W4*puCbndcr-6*EguB zcrPxlW`gmX$-?dfI5;?qs~g39`D|J+^;k;E&E-+(!r1!lkl2_p_@_ABsLvr?Zm(r; zQ&@6-AUTulW@JAY@?(x_D_Q1NNc8o#J%Ym-b@=p{K~Iw*g^cfOL!2p3mF%ILK5pjb za;*(L^q8}cJOAb85suJaQ@q{ol*^3_=0}Vn#|6V!J9nKvql$hG5P36QZXc7AmnY6y z>~-c6W!Dm~PI7ED2R%(6j0$Gy=ts==;QWs?yoC zC48X#Lfo@&a?&c2QjDZl*B*lEQ=|X0Iy89745<&Wzc$W%Ab-K`~Re}3nawah?Wj1df z!YNSEd6UWXM4MF=^x+scC-C^v*H?%!8z=`-#Y?GHL`KHOEbu7!zjb%yEPy^;%RMX6 zvQ(6VPzj1v;+;(wRL@o1$7Q9k_p4pa7BFdqM$`q7Jpj9?kqffKG`ME{Td09yHkY8& zJ&D)GNp_^qt^>pYG^9M=5);>w98(aPePT^AX8uUwuL|Z?-Ta8#I>pYqFM$zUXx6Jc zI6X~bny#qTUm0!D-RmO!P|jn@b6;NRMIpD@&2CW0T^)!?pG9r6Yn{jV%39p0?{c|2 zsYx?sfsk;j3=21|%rCYkdSW zZ;qYL?zaeXGwFHsY0GDknE_Nz%J_#x1K`zdKKF5=CfAaGzyB|V)vCvmUvR`iOY%s) zd8c@vUc20$7d}6ILxNFFk z`-nw;<)N@ogQv2Z)_M=x3t^0X!vK@c*hJ6|urkYa<9cVvOAAc}C#}v&2?7v#ktGKp z_Z!q&>9Y}s%5M6>#5B)5o@cJPs}Q;;$+wW_pJ+aAia_}5?W;c&l*99v%T2SOgzDe< z>xv+@uP<3pU=wnliyOf;Z+-@!c^FCW>30RKk`tFXC?_{JhIj3r5cB0Gd=sX-A={>; zQWTSZb$FOzvlI?L7?jOdDQj$$)S7Q+a!snu^%A_W3-cInd7!PMV{N%S5`QO#Dd{09 z>M}^17#te1U=KY8DLrq42j(7Pd;%qr=B7P)MaYuEPqslm4J9Sza$^9tslGl>BkR%2Lv|LHxbuey@vMp2r0ITj*!kkr85RvXhiv88^m_AqpO;rSG>=g`uJl~v zoEO&G%E?OQVqjp%%*?z$oY{Dtgd|~qr8h}AOCg}Wk1;ICz!UDY>5R*+XTuu-`ay`~ zPUtRx#IQExwAj9M-~*D8*IzWgx(Wcz~DC6%X+42vEe3bd!X`t*Pxpu;Z%U z(vz-dqqNnWc_eR5w6`_@QG%#bT)y#>4@I<6`C=yMC8G1YstQp0AfYg65!9V0kewozZh z^f!pBKr~Iu;KLSvelBOv_Dr2#Oy(2+V7?F#M?&VK?BwRP{XJ6wsM$`g;OboA>h%-DxpBoJOLV_fS zmKxCpqW_F>gxdngB4Yb+;oC1?v;`jlR_o;^lkA);8sgmp2(*mE)S+K9`;o&yz5S@hJt3o2?4J1zy3nwrdyU5}9$kI6WLbO~}8y zca>zHCUQS?Zx)SYOTPxm1ZFcuH#|fU=E#rUK*c&s98%uL68X}(9&~Q;$W1ER$QYs!aA^9hKHy$hS!OqfTsFOPmkeKhOBW6X z!7a}=ytEOZaBH^FPuG@Ozh2t|+SRMtg;c5s0b^;l&$&C?Nd1meBah<~*3Cos!T3kD zdUU0L0Q*6*TNMs^fE7z^r}|D-3>6b z{YS0JA7I9-B!mav?L3$L3sBwrBlF4vB($xqt+D!npygdcP~eICc*gsz_{%_ah{#jX zfk$a&-Eg?eLg^x@hL~_ls3Fr=$)eISYi!I>JSxu)CnuND7MS(aGFAai;R_b6x+}T1 z#m#S-kx^6&Rb3xWwt`lRtbsL*2|yi%(pdMjxf`){;C2e2B+nF?6ccyS;`UQZKX<|5 zihi)}<^}o$w1fT{#Hs{i>9trLG;Tr~dbX#{46MkL^HeeIsfI61yFV3W(FVF5^vjlJlY2D3juIyHqC%}f7X3(@>7QMa#Zg2yhS_Ik&ONz=YxnL=7nA92P1lG*bTx zG0%>xeh8!Jps$ytWZhB;Wzj*gy#zk($C8+=6WEicC=n01Ca0dXi`~O0Z>Fd9%cUi1 zYFbROCzc!KG}A9Jx)u8NaXdTTv>S@p<_fupVY~BVVq2~09(5($cLeFHTIicBEWzJX zJqZgGD0fqMHJ@o4+Ym(4qNrim;bL=AHjV?mR-ryCW!Gx1oK8KMDPK${lK*|wNJyK- z6AZfNc3cshZv_2`5`mryVveMc2u6oE%gd8?gKE016D^wxnU=+15^AplPCh++(C%q3gzs2o))_sW^nRk>O|6Rm}z)!0GDsd=>uf0P^0OsY!p?PCD+qMbVxv0JR~^1Mp33CiWDqSg&LMAL@G_?RERpx8du9UPZuhT=tV zVut@fZA87v?$i5nX#Ed_OAmcp z^`~V`U%z%0Yiw>(F6T(m?d@YSC_nm`rU3^~eeUWiF~oAfsSBZtPwReqrkC4yY z3l6;C1Jf?wC)1Mt@yceH;GgzU{vBFLX^-#b#@|n=s_dkmQv3Xu90!j7nnfi`Ab)u5cSzAnzOmZhZq(gUdD;}rxg~ikRp0s zAdEakXIIxGuQT|B(RMPIg&%%yKyN}IA~+~Id{aTJ$Ly)t*qx?Py)EA*@gFy&kZP|F zWFoNP3%hx3gc{=#d>-tNA=P;omHb3YFL;f;`= zVRHQ+O^%Nbsg;rR0@QmZZWSoxmb zs|F%JQd51V39-^uqGo*qS|>=fns$0DJlWi!n(`c!-@2*};k1@k&${~JkgJ?ohTnbf zqdG?w8DpVVop%k!Iz_|C9sADb@Z@rnW@$nkz8Q+O@4KyOh3rm5d6tY}XOq@obj-Zl z4*I%}!p>_a6nS7$I*znMknHX!1Wz<|e?n6qhuG8__oUU)6gYi0huLm8r-vaIV!5eK z4oG5z1eN6k=5sNXquuvCthl_qe3n#nNTd5Q7`GvmwVBc(uh4Ezve*r(JPhgYV{v(@ zBAoYDFZ)_pC}>c=aR-r6tYiB?wH|$>;&@U9?ekJ=Lj!HGq z3nL+y@y*Q?zzmW;+*MO%{2yr(dQ>*+IEt7v?SDk} zb{z~F+~6BywK8_{fe=!4g4)rq#)3jZuPbZ!t?%7u^p0DgmaK++CWlSwV})ULFLlOs zbM|&Jb0*3QR!Os7&Q}r`S-f6Pi`jeHA&pD0LaR^RM7TWE*2!I3S_+%gh3ZGH-$nav z{r<9w+f;z^EWS17jm1+zI$J zYmgGUN0+}J@F*a1O?vW~ni_=L@F*>Grj=a#0&au>7X#Uaa7=;2{Mt7&h63tN%I zJD5i=Rhcjz%nGlf#TnJtfMK4=rebU%P?h!D*sEC-<_?ywM4sFQ*I7rB*gbtt#V;Li zX<7UegUIkHY3GHQ3JhsG!f@;ys~*B*MET*VL2dcKBucgrHacytfp9fIP`B$Fz>xM2 z+zD$+CZGm{U3E7(XahQl0?8;U;<`Fgf*~SOW7^yH+$gfpEr_63a|-xMU7+2JRfQbJ z@ht3yWMkVE+O5Q)o^hiH(94Zf;}&cF@M&S@+7^GmKmgBmak_@hZI*MD8eKP#j&nr` z;LeSG%rwe*RE#@AerWYPGgUwEaL<{A)n0r(OG5aBfPG(WYNuv&S*d545}-jeA+3yBSmJ%Bm}iXWzZXW166DegAmV)(28q zSxFam_dn`H!95EgaQ|ctEIj|8EKk$>qY4Q*D#w>2m5jrmPCJ26hsjBF968O%SHby? zx4m%+jxZk{u1E;Idg@D$A>+oLl&ByPiYb_NQiAZ9{bLe$_GlN|nnMz;u1Xi;PV;t@ z@tzGm+FdKEMNWD0s; zNa)lHf}Oejr<)ocrOaff&+e~x+T4I11RuIB_RGqa)|28r&>BV{Bt`_@dN}R(vZVT5 z3^RDr?5F<-w^h$9S|}3e6@lC81h>UF>#Wg!v)6dhYQbqCXwBEW}=U(sR47#`Z1wZ@`F7^A7 zsEo&k79{yI(d`wY2n^fXy;TmBxTNJ4I2wT|79uu6HL7s<260&#XOBA@XuhJJUI6PU z9bYLyU%xK+T6*Ehdiyu;lEW7dQI{F*)7F^;u}dkuP#{jYSvMz%lK89%Nvo8tZ?ao) zlxe&4HVgM5J@(VGsT~ttl+sYY|MJWL0+T_%$r8IqKwY4>U0z3d^Cn5|^Pv8&Y$OtW znznsxU>_01*%iwLlnb-7rEEpwnk;BMPr9|$h-k>JQv6A-LLK^&pobifg5dG;3tGPkz(9qDp zkuxto{^HT*gl&}L!}=hkx3RG|)tRO1pKpy5PYmF~kJ-xjC6&q_cv~$RIJ|c(N-^FE zviaWCJpS4{%p4I&4isFuo`iWu0ns{jAHKH`{zq;>xOHZ=HO9}ppk0R=8~)C?wcO+DA%a-uB?Y4?T#xfPp+xtc85mC2>>l<11A4|_yltQ18(KsaGiF~ zvZme&_4$4_a|Q>!VK_)k|1(Cuh!~0D;AFth`t!>Dsu3~WoyUnp$hG~Mo6fdcYHBN$ zH8M4UfoLbIx0UP^u2NCZQQMTvYVt&1DJ!<#w5HFu$nCeMvu02>Z8$&4gu#YY8(yw2 zv>Js~nugxBj>Q-xn7s)Hn$!**gA^9e0Wc=g?)KA|$Sb|eZBa@nLVVM1FV!vV^QJe& z>}c*_Qv?`JEoGA1mWa6Pe6So@ZHd8ROkgOgEo9D`gSNW(Yb5lax4GRP!ztEmauNiH zC9mVRCx*yUclWW#^Y1>TdJ##Y8unPjc_ln3Gdt+6?XMt&eeA3(+Z93ZoL@GSWs&t$uT0;9dUZlD{ zO;k|cC1HFQLv=4jp?L1<*Xs+yASVkEO)E($zDMjC@<-UGsq+x)*n2ljPr8Q8Zw89$ zR+0XxqxSAob#-$#{u!U|7Y17{rTA}TZ!{eT`Oa(?_HC4IWi4T2hgnsqrWy|`sSgqk$Nz2@E_#p#kCsb*2t1{zI8^@I*iGII36Il7c=-8g z9A85S-8E!af}ac4sav~E$b9cWJJBSyH`e3d4j-#Xty_o`lZh?wwdRQuem{)&IY46v zPPDVCevL^;cY@aE?^zo^%rx;>kop$KP-qqVQ%?J$&>^znkZ$=d#)G`yGN6%NB$W@a zj-NC@0ytE!TKau1C}5Y{AELtE`o(w;26sjft{eCs*vcU|$Em$--{Y_~tvE%KkwZ>Sw@V8>0fDpmuGS ziG?=mc8ue^W|=hfeqE(+4KEc>ie&1@AkaK=WVoHthvF=&z?D`I3dYGJqSLPY%1VL} zHMStVVvLP`EF~5+Zi2|%q7JeIRgn3*k0?%O19}z)sozHNIEtk?yjxZJG}fD;=xC6p zCh|GPEcq^Acu=F`RxCIA;`sF*zGz+OId)5XN*n0BhT<8DWtd04WD-{4m=brD%59d< zfpRD(%Q}2!sr44Wy6RgRQ^6pLV{Ew?d)(`cRy;@f+#{ z!W{$lj12Cs_cGY|rE{-e=QvD_(~nqBHA)un2?;g&+X=F2BQT3T#-r^S+f2Cx){*Su z4QESt_li=wDP|7S`lq}FWkw;#b~$41d)LqQ9+j2|$g?Uh1jOP&t%5J-NXkB0W=@b6 z+_AriB2_EU+ETaEt#*S_qBnWlF@^gs)EG8vOMUdUeK1Tu^7T0BU3K2%0scYQ6@mq8 zXl$=i+J83c_eE(zr0W{Vq+a|ItaA5&EsI(=Z^S(N5;F0~KI*2JHW7Q?L{ zx=iv|-71%ehO6QzpPl)HuLrP9BfFOe%{o_EaxbD&b=iy+$$&N}qpY8WG(MASCks1f zDqW^Pmkwk#+!GpJilPYH`4bC!?WhA2c{z+n0%cJ`KZw)qi?Mrfh01BG`n6fhveKbz znG$a@Pt^B;Q{$d{(^f}#Ht0;{Kv}D5bT*w6nM!*LV247C*7_OcPDwnFSowKc2Ufp# zu}3Wg7}K|gF?VOlk-VrxJ)1j;!HkcsiVL^US$v`m?jfalGt*)W1r4bu0o-M@V%@zd zjD($F?wes5w%zJAP6ijr#bim6;}X<-5|D`fu!W2j?Uiw9;hx|Z75 zHW#u0ayw@s0#iV#>B;%KX&7akOZj5!Y&%cC`QAI7RMTmn?3!p_xQ+6_3Wap`)fJ={ zx5Rz1uRNuH^v1Ze$VALx=A@C-NbEy}xnl1^XDa-l`GESa2<*&q(vj0k=;A^CP?21i zRWzYmFm^f8Epb8`Ou|lq(Ktun5RSET=HfNup`5Oc(2h^frRGoe!n%&>=DV|vp=)Y- zthyUis|g@@YZ7n&{>VRw*b;`F?4Os{JU8|IFP4G&*J^Xxh5&K+#7>D@pUO{%-NZJJBk*llZQ zV8l%Ve;IHz?O{87Y$d8yHst+ef3mo@qLtd`YuK^ncG-dM!1#nm{Y>q#mg{gGJ}kc5 zWUMITQdUT@93Yb;+d-qF_>Uqf1SqCQqRx&|RK1srIRHI&TZ3!e+?SMRS@qyrno-oO znA?oa_Gz8IC zkZXerSFw=)7-sDk&FJgPak;sj>-#x;H4&q*LaxhdY)Ct8lT>Nz_ER<^RryfW+)nat z*h3Y@H({bNQxa(+Mg@j1q)pt4Ij-m(ciXPXtDefyR-MOvCVVxb5%G z=1NFgXgvH{XJY4mvZS`w%~qUdLI^dSF;Y0jp&u^mZf@7z=a?j^G zxbpfQB&MVu8_rrFwQs)CG!|d<_#J8HP*HKs!F<@(aaRe!k@eK%;_1A}&9^Al^^FE_kqD)wXMszZ*7xOOzC zRatuu*Of18dIEO5JEpIWc?ji}b#-t&kJd_c?$7tNO`X|-v!^-R9&Jq-P{6%EGwN28 zO{cMGm(yUZgh%ZPee)^NUr`x&!S9h)ZZ%f4le+u5x5a8-eU6)A9N%)ICJK|*=P+0A zU^inWL9o)3bx&h;escJ;VQ6{B5W>s~f{f?p9X5lU8#=YVF*#+ZTU>2tBg# z!&NKi{PCp1UVjt9=c|He4z}CVHHTd`pKM|9j1SfezthsTEPPPafpYMXe+_DH&nN@+wl?CPItbZ z^7;6ln)FZyhxuj_{B#qJzK0zMar6C(mgi>}6nq6)6vb1jB-!I0u}3f2CbxO5r$mRbBV#5LKYxpD+{}&m~QXtnJ=j!XD zc*a`TdUm?C`X4ZiD1B#8c5SY;j2XyO&ZU~bMvG(DxQPOBDfN;dfqejNCU}nCn_E;F zo#B0#(PU!@GD-AU@6%cxv{?v@umSOj%g)wuQa3@13-#D2z8T@g%*+^$Z6{rq^%|`U z677dD;UO)L&gwltT%}EhdN;R5q4dUeNhbCEmy|uoZnPk1)sq1JQufM_!SKWrAtYwc@ zv(hqixue*wcEUF&*2mxjq+@ZJ)Sf#A%Wj)t7-<)E8ZEWgK0xy2yk_sfNsJGzV)^tfk72VkuD%fhY#pD{DLGeGVe zg}PLuC%zL~GhZ~^mlMp^UKF3AUe?clMD^sTJ9sTLH^cpK)@)?_>_I1^h^Q!4V&V=f z+bit1)|XCz19!bH*7fkW4Xov0-GwGda>aLJ;i4XCy_Z%aN&G!U-*P^p+Q-BYiE7P# zmV%k4l<|UAwT^lx)U|}46ez^DbPp(=sj}+L)$VrNqTmg0JNAmKbKgwM=*-BBJ_Sv}WRTUZPu`BK}IoSbZR zj9fG~kJDN^TaxE&>9aNI?s~Gf5$SGY&B}qhQR- zjm`&QN-mtx^j#>2(q@>#1Y`aKF%q+(Pj7XtD(>2e`pkKb!tyqDVPR&CRVv;d!bEuE z!h&p?v6Z^D&BbSB=KY2~9IcX>&GoH%*&`}hs!->e^F);>)O-|M+W2h=?*=>E7iAkr ze0bEhx50j;>iOPaSABgrCdFIzX7}^D5*RAH7gvX~{ZM*j`a_;(1+!K2^X*{|DOCXv zMc2hP^h@+>wrfQ+T}6=1nxv4H4QdbS_)D{z-pR5V+jYyOow+ZUtuzlkaywaOi|x<9 z$%t$j3I9xZnU!`K_}#Dj)7@U` z^I7!66JEVA{9mJ-f9lI`3}B>l&Bw=9za-cz0`dB|!eHlT7D#C!aI4Ntu2Ad4dvnd6 zj&XDyDYrgp=H5q8gcsBuZJhOqCH#yFNiaZs1*K$iNYdLK*7<<&dLYs%Y5ciOqh(RG zuFQL! z;qd)x$jp(XAd7~VNvVGivZ!e4x z#%596vHktB?5bWBli2wj{(9V~YK!ZPv)a!0v(G-8wFi=oUGv-P)E9HEjZq96o;PkB zU!FO7S7#Nqden#Uz1`iG6+5-Pl%*~nQC#NF@&6CTd-LE5l3vJNOw?ZoKMsy}1Wh4I zK?Mxdm=`gb#!fhhr0gb`Ghxx#z~(taw)OOUEN-?5(Yu#fcTWLU-W~aLLgJ|)=@>!Z zcMG@*_0aMSHwH9{w|FTk$>PyVxh9hxmK~-0YZ9e<*qWH%B>87vp1+v8$pyCv9`$4L z1!q4~&oQ5>SWlHWhKi)e8|PArxY?tkqEd~N6e0Wh^4@CK+s2dDkrn3sbY^&D&Bl=RjZ=!abWwV4mIe}l181tayXnsHq>~xwCFhw-IJLiWYb2H9XG*IL zmfVQ7%4<8;Qa4et}Oz zOtl5(5Qf`0S6Mam+t$^}yc7_$J(C<}yvR{#rsX05T03OuSZmfJ)Fm%QZFrVRV3os3 zQE#4$U~(s+Zi3r3NN=@YKj*Dr{90^?%!`T4rZqE^J2IJHR)D!uR5TAJou>$|rutl- z5PUvStV8h>f^FLgQIFmTG@7q*L9RWB*YjRwFnb}*Vu3UxcCnW>dE&S-7&jcH1#H7p zl{6*$&2hUaZOMxJ(3z+&BA;Am@%L=fCv2)Qjt7hd0{;(z`gvai)X1@Sfc@t&)@Oqc zNWVwo`}=Mum|ZrZ|VSQe!#=HfS{^8!dEl&=-_eP|+7#kFWuy0xpBG>wyX6cm!mgd#A z89RF8$H5|$rgL8Z62H<~^ej2#NN)BhffPAa&~ZE^NqB|bV>b(&>1F`QP%3jvVgB|@)LhFlArZ((DJ645k|9y7R*O6Nu#PvExa zijYnFYlgXJfQf<0tCWfNe<|pbG+@@ZTWCgpKhjq^!ZPb|y80RYCSzq%eEhf2 zuH)m_KGCuJeC2GH*RLTnq<_`q*_+VNVUb8buN`%{I&>u|AMMlg6LpMd2o^0cNwp?c za^G7dEy2KHseMrt6oin7@Q!!9wEDeG8(m`cYM@HJnHGkYst`-7VzOPV#%C4G?{jOUc}3UP zDuF$Hv^}}HH3Oyh_c-gLJ(@n-HnRz<2DzU{K|aSpYs0o>kI`xcaqxcX0pFinHV0cK zAJ^(^`uUq|GN2)LZ67S5dYaH9tfZU&kF+-rr*eJU$HPj5kW494MTLk^W=S$DnP+0j zm`s_ckSLXqSt&EixXg>lJZ5HLN#;58>~}v)`h51@z2D#aw*PP(?d+rVtoy$1>pHLV zKCkn+N%gwxq9;sfDM6h?J*K|ZsEdlos}7bY*OjruonhFc8)tk=L2~v}yuzUVu~;l{ z!z+L0B7)<>2d9R)_G$Nbg)t3phlp-c@O$j-WDU-@y07Ij%E+!ijM#K=Ht2I(AEZtV zrWYPRv6bFEm9xATV^zD$`>hY*v1`6w-4vEHWnNQLGq8?YFH^G5@z$Dzs7no1!R(C* zkG%;w@zGKzqxtz}t%0|#s!zsO9y->;FWsL~ttfC_<(N0u+jg$=Gu5KrpH^!v1{`Y< z9S`S;;I?3EFLaqp0YsM-Te1yDMMvB5g{QYqJ?Xp2A4qS1z?}RqvkgKs*Tg>M)@a5}RmU=LsX>H`77;lA18ZtFJ*tf!yyltr`YmB-;y76jxQ2}PO z&A*%IlXBYEjTv&95;&m+`GwkW*2!XHgo%N`Yt{MO}A!ZK8{ z+O0LXx4S*)eUzwD=_UO#E~*FEbgd8A2D@y0^RL=;#JKg8E%4N8WY0NLvLQVep0<8i zpH4&g+2m~--MkSh#o+X1(0+ZerN#{1gBs0U>~k_Qs(v!yfX=YOpmskOaQJy_HtKax z^rkS*Yhkv83m%U>ubA)`-7$D(?2(RPjeSz7!6zmd8~x7C8nv3pLmq3RooD*G1RZQ0 zMXlVjezUTF8$bNg@bu)149>4V<|5>M<9FLr{|GqXoGZD z%&E0100gEK4OdK`>8|FiEjUr8LOtBqoyQWdRaU$v!A#K-v$OM2aE@oL$f+emtE9!U zFXzG{*If+Sx?G2vO_Md|_=qOq27Aq$3$i;jCknN!QeJ$9JzZ;s$eRH}erpuNGlun* zmA6`@PXc)BPb~tZ(>iEVd-mH7m_Znri1VNy0cz6ooqcf%wSk_9mqB>HAl^@|Wbzz1 z*=|o2dk$ke=oI#-JAOLq`oreIs`@R0w_m0b?Q``n1)Tn2I?PJ;no@^E2#3Q_{+7E< zT3ACGYk9n+ezKPGLoCGmL~VKjAKqGVn9x8|*cis?sCef3uxh$G`7MWrNVvD)c5MTA zLCwquzD85G#o^C>27UH=n+!18m9T=U1qKJ}@@0oYKBQ->K-cxt_~_A{l_XKZ zk?Sg)>q4=vOVR~^cH;7&nC=rDxr!m01X6RKn17^XKl9^(a)pv%v?>pE&cR z61?K-+JoI(6bD}1u91<`!tVM&WS99gZdu&UXstWZsQKyJSu_0Uj@$GYwbtm1RHA!7 zf@f%t3ZCV}Md9aNKU|qZCbf+f6tpc^tQFJGHKe%#{$d2P!~{e(6g9nJq4|gl=8Mbu zC+ayzF!^@DlKAY#@fHH~wPerkh&8I|G;nrYc4)qwV>U*ece0bxg8rVj*~Lc`P^c+e;7juVs=7Wpxa?ZznPewcLL2NgkwNz~3#qqAG`on4J$ zyMSCvw+z>%AFP0(!rY0m^e~NBmU9hH+8LoPU&KYttg`U6sHCYDZSU~q_cwG;r_+#@ ztbxvlN!g${CI;iQziTyM&1x~$HxX-3-J(ZO+w2kRJZ&!i5&l5{J%lV$_o%V`Uh~3g zuGroxqFl5?_uBQVH^`A|`9aP=@oNw6(cz|%7lw1U3mxV(3(R}2#HCo<=mc%f=C#uXHuB-CsKP_vFAx<^@n6!K*3UU%z<*?Fgq2*pb!KAKnT~OSucC znZw!a`t#ennvwR`VggK$x#N;+eC=w3GVhmB>H;&3$2B6p9EQ9%grAKXX`K|S@b^TF zjSPPw#&MxB{<#D@%FiZ#s@gwDy6spkgz-1-%$7W}EbkaRX-gnZ}$;z%=e`aDhQg^LW<)r^sRY{1wyj z)G$CjdtbhK7|fm(7GUj6c&6-|j~w4vx}@~hfKx9`)1*vhQsp_Zc3R>|iZ=bM1TnEj z728nE3zhWQu>twf@n=H?oVgjApPCk*2b^^V{{q<}$u9GPv-jGg<|{mrA7(?&c3YuQ zJlZ#I*dVK@w7cahZt1a{2~khqbY(^57cjq9XSGaqe$gzseD#|)A~4`gL6Egg2t^2! zkAZ4jAQk6h%-*i`F`U?#{m-QCZ4T-Vf)*#%PSg3hv^(TP|Gnw*dJkZ~wW&1+#Ua}f zZwS6;bvY9rFm)tJp*R{`^FZ%DpZldjY4iLymS^SR&ZfNj_DrI|Dq8HY%L-zRnpJQ0 zV&$1P5qrBGOg}=6tgX_%ZnDB~B|azTNkXB~PLy}jCl_vjts1`lUzzkH)?=TH5Ehs; zN51+5vYL-Ui2=n_#A3^>Cqz_Dj-(=aje~AIIyg-!%1Hx&$l(`w_3qN&HzbH1q~CKc zGZEJhfAbo`pTq->{4iV*LPMCMJ3NfoZN$$PIDk2arouM|)vHqp4JoDbmrAmqho0;V zJ(VfFpY}2f?>4r$;b`T!(PRo=JHXwYFR8q0!N7`T@%NWm_Vb;cZ=uQt;T#~Pb3l^J z1Hytn-B_j+_{+LXeF`6_4`G!eI+^=-I?3zxd9c9etp!64+lhEmXo3AjV4(kM``CH6 z90J4WXd^@zLNPz4zx%6QqQ7d#ed?uU_5A9a`V|DG5$3&s_KTBdeK4*}k2-%Zg?9T* z)^xIMTKzQ61qSpRENJAQKE`T7&?|8X%Ng99GbL9CU;@3oNMGPyVnB(FY~L{NdQea=Hih3IPp*TCMHS%)>Y9B+%MnzKoGX$pxV=o z%zAs`lX6s^)exf^6c8MT0l`dBmn+xkB%CTGf8Sl)T;`3!vF>RB63K}%BmXe$b4rvH z%0|5t4mn(AdM_Zs@w2q6t*spdud5maM(KF4#zMy*Ba-}1R_$j6ojY}k?QU4)3pzi2 zclB_u507OKGl+tOCp{57hriin1bwW?D!9I=_Pc*;BjGBGw|JKwh5XeI{mgh_O45AO zo>RoQ)r6)+Y~DLd>CDp97Z2*P%B6$4O!eTxF{9Q}Y+WYGPmr!a*5wnshS{|4Wq*)! zHAzZJ@)3=+d&hhDf&agc0&=S~!MS(PHb)W6_v>)zL|U{*61y3C`HGR_IuE8~K!A(4 zT-SVc@YWjng?OUR_uTmn(4^|{Y)WwV2)ZBNaJZzO32FV$hdTVo!$NydUR#)kjVOQp zmDhDB%)Uj>8xw%J(5dR{S3Y!pEj;---mEwvk>;-DYaChW3v~7scKBXP1g4v8A9j{3 zPS#Hh+3@e~zb!$W3#?EoU`d4zFz2*4U0utpMwkxh1a05{19BepJ~#~Khj&Og1YelJ zCQwa%j04*sUGYI03+9>MnLFm&8RwV{Qm1*P+CnUXAybO> z?9Mq^m`~~yOQhkg{6XTvlgI0l^Cm4SKnR$h1_vwuK1yhl-%UiAdpck_O9SRgu;FJZ zA1=xOT`@u(Sn}Tw^})#ytEfGF*a;rN&4x~iq`(v$EceMe(>Ks|&n#If(Ppa6peDPn zagf}Em_T)cTP*R$sa9j*4=GF5X}4V!jfqQbDweYF08R%G8%HzK?R2Uz`_JQX^FM3) zYiDu5CmE6a`cE%)Xrq~9R(PJ`q8>c9dHMXJ!<*MB`DUXN*=A_!D0uw6>wIVwakK(c zn=lTChvXZ*fy+FY*&w&ndSf~yY%PIZBAsx4zL{!d%&5@*o5&M2-uvH6RSL{ZJ9XJ*{0Ogo?#SUjdZ_b#bQRGlEkt~9<$_L^n}&m zhry|T9*RwmC@DZ+nJ3>HPiBD5p5KC=`F;kka+ma}eB^#~*37o10BsijWpoct#|>D+ zx%e@}Gw5`ryW!jNlvbK^Mql0kcxSu#Lq=#k7jawdYlPKvb$Kc+ENiOgcJ)!4x2Ld0 zj%-_kaolvF19~myTYr5(?%4v`cSOSRQ&UrnLv-)1@+keiu>w!|;UpJ121uFx@6|!+ z=H3UM!~f~_I{;WW_&o?ZI zuHs=xI0tf@TuvRX!GAyED}PVpk&bYLQ@_fpCd^f(j3<`?If`1Oxz{YSy(;8})rX2FoFw>`KjrFwg}9odk^h1BPsIvGAo5LiBYp zr(PV8xdBOggri4KIyAi*&fSHhgEoz2YF2+jWcQGRI%j={z`)w!-k03>VwsHzC| ztG9S722wF0nXMlUFw{|CF5(QoCq*&_vXZPH>M2Z$ELjAntbw;3$UK(OAFJPCcF?dI zX)__|lW29AUor1pY?F7FdO*y6EEIdVQe)iJ)A{^%_90ld)+hAc@xfk#Lc2)Rc zz{y~OodN?I2Uj2WW3-}&#mna=#K;KpVgcZJf_n!5ke#4`3O1dp3iVu5@4K#b`R)j* zT4s|aU&rAvC&>*(Z0+zpynC@qx2`S;;A?zdyK?k*NRo3kTlCI&|zY z9RKad`&58K9)o(uaZXp%5C~6>*>4>-B>JZaC*8i^j|-7!*DSq0T<*HL)Q0gR2bB%w ze{V8b4@&4UmgszD35on8;W4hK)%zQM=1cZARF@0-=2&Zk#8S{>EK z3m2`#CU|n)y|W5~^a9XzPG$9;&!h>h*qc{p#Q#}Xxhi20QHtAG$zK7Y=Lkl~@5EvB zh+&z22Pk?PD4^)!cw?X_ta204-gk{|eLABPc8zA1>tx$f=YZyBDyJc(;P$He`47xa z=9PrD64IN4Pvw2jCB*6zheKOtU8riuX<`H_-90~DOOPplImou5dCy_ISrA9QMaF;#jh01?(Xu zdEMmg^WG&wci(jL;=}^lUkJ~ds+V`$E#gSbOKvabMzuy{C}nHE(`r1R94$GI+Mi}d zF2PoqdckNHn`pN#$s;h-&$N=CrsmQmDP@y?q3*@h)XU6?59+X4+9&{1E@*=v_Uqn% zc{J?7j6Z|BHJcM{`Xd1p!PaQ{U(Y9xeZF-l#{4vIZG;5f%}_Z9>NgstPI5n{5%A9$ zr_`3R$!NH6HOEgQcSck>%mp|5!!QD;mtD3K-MR|$%TCcOZFN~XZh?8;I9mXm8ohn+ zao5-zK{>Yzy7TzZ3*aR9?~_!&3p%9}IBpIa3V9oM!DGM`f)9^t5DUNuKNhyhj&GcQ zL@u}4*A3%J6ueuHy6nP+1`NZsVXqiZ{Fi3|V~aA@v`H@$q13=Owqq`@7&AXU5|2w- z?De`3Px=`uF?79>1Iu1$2_Ebj1?N=#cY7&z1Gds$`oqSN_#=oCC-n#{H(L$ufklLucl^Lf$zN^|KBCb+uy2 zrnf4YZrHQ(@i`Pw8Qd$N+1H5c8BQa$zz|MKa6u?{3q`{wc*G?U0{Mi{57EotWb%vt zo+2geteQI)0a3=2Bz2fGZv&AHYGd6E1}0#csLA)v8?m=*2FyJOF?G9snHz^B7fb(; z)hUWK>T!VkiiRfEKARtRm~e3=1|#ofh`=O3B0zNd^4|YE+ZXz;A{aE7V-$G8BAuXv(Ed(8Lly zmcf(Z+BH#N_BAlb8N>(X@A1L;Z{s6GKamHZjE%rI^h}I^{^8qB<*b6ZkWZyBLa{Xr{#MdqL2o8|iZlvpe!hVpgU{r@si9+JZSe51TY(Iqnz@dz5FFMgQ^3Mf@1uf2 z+a1Sje4c0i;UH55IibaQTxa`K!A)b$>P!u6bFE6dCUbnkg61-oMo&KoL+fEG>pYw! z28S0h%wQhlPxHe$P||tt6MA$8L(oO1ZQ)KqM~aHM4yWjIfM+5O@C?YNPGLp5adR2W zVbKPP+LS1|H1)`5t`;$#KhFf};&oGIebV>;Y9-DMH(rW3C!x0^DHBXahBMU?>DEP^ z{k$t(Ds5Ae`SP0r656duH;irgH##8xVD3dxwE62})x~aCRUMA3EkY^$&(DAo;RbjS z_SqG73OMUXh(%w*DS=`!s7a_^5i#S?c)fEGP<-&eP<+@EAsu*?e>~130CC3MlH)g- zLgOG);7eBU^YM*`acGSLlu3>6u{y2dIM<*5fcdvIh8C)T+;|N)$Y8EFylig#3apEe z;zs`F6VsNVlEu|Ek-shy|zM(`VC-vGsZD6LY97f?hI1~ncQaZfP_ zWgPdO`Oqguv{3^%M4&c6c6iJUi}#>|T<^`B(kuz)O2T~FH|tU-Q0nr^F^vax;yFcI zPB+(BIGj@2X&EavuuuD-`Lj%Q`tmEq^zm?D)6jj53b@8P@E@B8mo=BxllG?-tFpNl zcc<0LAMZ~s>??DV|E_Q(6GN3f0%zSYbwWf1)r5((FMdU;7pf8r~O#3#ZPd&ONBOhu>i4*^HXbCYvP3 z;ZXCn9!o<#Q<DH{$3XF3bIO z&+bVXv9ZwPArw2xE^F$g<9}#@dcr^~MZ*m!ns9i?9iz;(Ql)v+OZMNKfuGef6}$*( z@e9s+xW{I=RrPbqmYjJ&6xT!C_Mr1jhQT7i#v7Nqe-d0ai=ZKz}dzsom1H;WBZl zQ$@489*bB~m7G|kvaQA8c4$M}5qL!5N%p0~UFggi&hqjUc7Zy_r?M(XUH7*Td->b_ zJ*e?az4CeR*2=lPZwz~%=LSo9c0W7rF%l0U+jdLJcT4`&sWunc9=fHxCj8?L{F}>o zgvVX`U`ujwCGPY2sxP37ylu# zMgG4@OR2ZT;&fCkwPRi$!_iCnSoj}>k)0ICN{&0v^XP%uSyE-GT_URcX8A3~kkO_P z?oXkV(+>jCP%Dw2VKuf6bZCW-Oyj|s@NXJ=+{j@CI^6lr6lDp%+|O|ekmL{D@LXoD z)L98o%V9xoxHmcvOKvAoSz3J`&$WY7u2Qkyg>dhR5p--R+uz$Z*w&`|5x2h?cWzkL z>g+#G0@nzPid}t}ic>c_suJ7|m4N%^c?YM{levvTmZ^3exTwp6BsI8)^_hzTs?YPP zK*oq$+LfkO!fUQtaK7V8uC8W9IA#3cT8TzaxH7-iMlMicJJz0ce7Xqb-<#PTd)M7` z+H=i*)0v#>btxE{vBDHyU9sESIl8_zgOHjGz2X<@8CEpT3Tg2Qrumq%M{Dcv8iN{_ zHmy;QXDG1qrm54)PtfHvQWxd#X z|8s$D0&qZkwvE`wcvx;&&ku-?n}QB-qA)!tiF{FIt(%MM5F`5qVcEO999&e<7ss1j zFFacfqgT-j^egB^6Qc2v2fgTQw-T)q2g`TuKfc!vW(SKLul3!#Q=U-6vsauyGXUs< zDnvnxLbPRc=2PArGr>^@&aW|4C}To*>AbCB3lCOO@6VJfLyH_3px zM9J)UwDWGZk(AF7gzjq_E)m_vksjB}Fmdp}FRixx_dPa5_k2pmF%rnj1RI*K-_!qNpr~fPCO)slzG}`klaAD@rKyxY)f)gqw2P$)B1cL zMP{bur|tKmVa&!?(i9r%+tkePMMyI0yN|l6m3c0Nz6H$utE5Y7@x?I&8x~ebm4V(~ zbu?$@vCz-)FSHs}zK22D%YJ3C*D7q~@u8kqo*uMA;z~(OhT959Kr%sajc+fLXZhO9 zABtZzaDf$`@-}X#PaB%}>ps~c^_Jp&`?SqU?gNp+8 zc!lMgQRUJCmNqLr9=knOk00k$YfO+W=HIF!{KuENi|cgD_2fd?j~Y7RW)!^OW}ME6 zX-n}6{$$6OHiuJXT&7q8!3Z?&X@pt=%@uI8Uxbz1r)TW9Ew%a_XgBz*dMAN{5=|t% zfZfFh-smg?iQX;ysrCy@Y|(D-w>BqO2dibN>52=-!n6i9!hR?f7*;QB6%kRJ^$f0H z-jwfc&D`6&)@yIxQzSUwI|_`ZMgcBn*eV+R9@YE9>=5Fpih!vU=*`DQz8%@7^5g7YAc+B0yC{{k`hr^3q zH)UvQ>p5LZ6h(<@ffC$yeNc@qtvctOMs?20i|x5cwM^}+JbqCI#7PQnQ!g1rubLB6 zRk5zxhHchtfWfNnzV3SDrv)%?w&SX{xpmd?TjkO6`~{8mz6p1s7agWFH6Ty!?iQcR z%e|_Fp6Nl9fWhe^Qc9pgjV&`YhLv`_fb_k8(00{3 zgZ?K}*IQMEtK5D-T0Psof|#8R98VrZy1@$#ACJtQQB&Qv11wjW$DMKpGs)3`BBDLL zhy0o`w<~(y5VQUQQ9lVd{kMd6%p-x9hH_orw_Z86iULB}PQlv3L*Pzx4a>e|gQmHQ zv6X7^>>T-SQK(=p&!XFXhDJP6pL5 z$F+&_;`h5osz1w888T&6DdTztdx%}6zSS==JRrX3bcD!iiK zcq78|>sI;WPb^AJ1mY^vuoW}4>zmaXn%#C@0mDkGH!{jRT`q9t74n^t**zezp4`Y| zZrd_22u`sAn9_=H+*%PIwbNvZ^LLsyK|DU@87J~d>oWjmx??VAnCkS$S_}s9{7N+X zcd%E4=h)5-^N7ckogKwu%SNQ98C=vv-90|u*ZxJLP@vE+TJC+m_0|X9hmiMlw@eNj7Bl4`9As8CE>5 zg)d~pV&fe!^A^n2YTbA|iWm27aru$Ogt_^5BzQOUL=-p6%V29lt%?4lYYaQknCF#S z(F@fvqzmrXgQ{9QrVEblWyz1eY3?A(4E3Jpc97Y~Nd*m4&+5+?X!r;h7-i2sNf*wh)%=f22wp!aHB!ahvFM z8jpQPj|B><(!2W#=ena;`;61~8s|1u-64f$J6{#sM?H zF7G=}RaedyFJ8u~fmWrA!JA%g?pfaTo>|98uhzYUmYn3lLJf*%ms+5LR-N_u$H)c8 zMaPsNU!JWP#GMMq)kv33%D8|G>7HCugE#ffD4~KmO-}7nF1D&6;F(=EnGt4yxN$Bz z;H#XS$ygzE$5}xK_A^QQy{fs$v2>XdVt{Fc>?U7bvCLXyC~^T{Ut$ySN4Bno-a;m_Ne=$CY7Idyz(cn=c$Hr5pk9ESSyML|hzkI4{wL$O?12 zqM~d68RiGQxfafLvU&##Ps0DCRu(FNf3Io(GzgLBy- z-Z;geexc@am~PjSIWnrQnY@hivlc<@Qpr@JO~n&DF~D{6meU{8pZrAf71pAfxoO$4 ztwF_}ZX8$kE%(j6)LRww&#{+t3HRVGY55OOzPxVJs%s$&EtxL~&^!a9iHRk)bx5jv`paNC?$Z$t% zQ><%bb2#fcJDD{06Mt*>!aD{UtP~DA(I2$O;F;)h&c2)Lt38-WnMWplu!Rz9Et-xm zUp}@ftgBw{jssIN4?mBvAvP?Yid5+Wjq`lTOvEux?Lso-4dhJZQCBc!?%m_jOvP(~ zMs@|#^FM71>uN)Cs%8^=0?b1+Pp#)VmCJ%cDEAV;@=CixA-!2jmm7z_x9p}qRYpjmWK1NrS*})-oN*#;b1xxJ<3GB=Wx$;;U%7E-z{}m zjE}k#uzvD$;OSB2oVTyvBRYs(7s@?)-F}QwpEmUo&hjXyu5KnJtcdmaw&`a(o_A`o zSLr9wW?8zH|5z2oosX5tZYq0@?D7YZ1i>I*NQuP%N0aT>)9q zulE`S`#n-t?wBtq-?bF5tI9TRbphS)&B44@+|?*dXQn*S21F+5y4u`c>22#TlGjyt zYTbB}oIhu88Ko0yqsRH}Qn-3l zSMoEHtsb!97R^|i;K3hW9D-`Kdao3Yn*nO9NKa@@x>V?KZx4Gf3662)TK@KM*)aJPF}lZo7mpH@YJMV6Aaavo&+ zHmTg~zK%h!ZO_{R&`xCObFnpNI{zX7^sO0s7`wS9F<_^Fsvy02OP>@y=q!NTKt)m8$Y0Y~MZJzW0|0Qr>i z8MUWk&KfhT?^=iK@|#=%TX7>IUR~;w$*gSUW!DMSbl$6*5*Dim)S5(TQ%Q8B@O@}z z=_&Mc^dFoP2=KQOfHVuE;BY?$Zigc}&K<^d0yOrsvpvL*gPG<{8ypgLsSI+tluoBe zxM2dv?JlKMn+h7Kb;YXzKsb_;?I7LEYAq;G$e4g1`XrxS1`|aDB9ypRQnng!P^WP=I^3 z;$KIEG1-{to+a9_QoQxF8CPVca)hQM-@K=b=R{)h34eG?w2gK7u7a)om|K|uuhM_r zWOY+LP9lA-+Vk+D04IZ%#v#qxaHSnZ+7z3DP2t9`V6K?$q4fa@AQmHkqLd~hW zw7w=+SWbOK_fdzt7MhYRti+$e{kpcYc18HJiFRBO^oO2tgR$wZwE3}cJ;GWIkM^5o zbo^FZmi~>66+HuSmUI>)H;oduQ_Mm0IX^peZ-l%~eJ=umX+d;^wjYJ&Q)$*7T>W`( z?wnKM$DAyji;dJqM#7ERW0Vb}u5NLx z14>NF-}YCJ5HAFp<_4p_haXYLH-N9FQct?>*_!@FOFNDZ$PLJFSN(>d4c~*x=W(w& z?c%mX~mIr*794fv%Lav6SXHJiSa`o_o~jTxe=Sw(w6czTE(QZWrpSsLU@u_!M(b zZEW&uf&jZkhsH*ZcjA`2%1Smiv`l!yC-pUkwq*T5S>8I@>F6qx3>M?bXo7lmsq+?QkD z+^lb{azKV{XqDzY|cj6N_*pcWGnl-E1)QnRNm<_Cfooo=a>cr8`+g? zV)w9mMA3k|3n;!NR?Fkf^O+^{#PV{F^fk_N>J)d9Rkon*FC$P}nr>P}FORxjA~yh+ z79YeYj-{4P7raLebnf@(7Zd^P|5VnSYdO@yAkpxCa|=7B=z&R5i}}m^o+Rk11xz$- z(x3NayQE$9{m!61o7ADiq^KI)iS|ic{dWsay{KU#)cC3=)h=f)qdE)WU0V>;Q|-}Q zDN6C9&&ha1cD<)@)+6^`t?``~CIC^JnmjSe1kze9E5pa!86{~_=HXtg-oiPKh>kG7 zFyB^~GlZ(@j!8{lv`Fjmr+2Lbesn5o2;JqL7<&g&Do%}Az)>m%8>p2ox0KAUM0BjK zIV>*D53X`(*;jt?2J09y!z<74#*nWd&`_af9dTx0A$MkwFGQzxB<_Z7jdg-cKj0qg zFyFP@x+}Hb1n%Aq^Rymo2(?$AcVSKQ^X8f5 zRz*ML^7xC*rYCf#Ykqw5ml{lpb3dJ#FABIe{c3^U$p0TQyZa%~wea}lI6Wn}?4h+edWcNO zF8Y8=AnuFffnObQ;`{`GGZ6B*B~@=Tm}7MK{$1--qE*J=S0kw^Rm7@{hyG0zZ(7gO zQ~(q|^Bv##_<%5JhXK-la)iA{B++h|_#thoZWq|kl$|ym^s{i~K@V$=0q3i&AWQVj zgx1+;5x1JM<#|C~p_D+mx5ysr7wp;k)Az4m6K|xAn_GM-ALXrg4KI$clivM_qYqbB z5#k|dO>UEiDi~2#-QV~gTp}4r)o)Ptj%IPLV0XYZLbd`f@I{K==?jNO&c`8P@7?BDHcWMIBVA4H6gm)umL%FL z!yxYULOeJWKAsAdLe(|5&;1nW1tKT$Gtar0{3|V588;xWIy*Er`w2HR1J>KY_{Vn^ zt)*#gXRX28IB}WJjII4Lbn{nde|!(SFlU5uk|*nY=e6*vb-w#Lb-f>;^g>?NB2j}# zOD&(t=BH-xme_~yX1DBTd@erzR(abX3a~eYRsO++$|8+gC5Bfm8nqjrIexEc2BriW zoCAXHBZcUZg12SME&biOXN`wDV3FxBT5q|6Tb@|nQ;l3tW_z!CppexTY&dbo_^#0X z37GhrzS^#Zhdwi3wjTRvezZQsV1AVdenRg2ll|Rw{s-s|UOvahVz|-6D+ke@`;JX5 z!)|?ZJMuzg-k#!?WsvAb{9U15A*!7{vbGtuGGHDU8lf1l@?7dTIT_7#_h`;f8H6?w z{NoiQTp4?T1MX1@gMkK1#Mb#xg{yxJ>u!NzyEM#0tSGv>DwYs> z(9M_Tx~E+OWAM)TtvM4sa~co3+`%w5OhNv5c9=WC*~|hCc0tQeGjF!(3TQ@8S)ft26a~7S zwbzHNWpHEGhz?rfK-m4KwNV1xF*U>&fH$WVKU)B^p5k@kHG*K?|C(E|f34(O!TLvs zejq>)14Mdmoo+3#`8{|Fwv5Heidic*H?@X zwo-im;xFOyr7m!(1t~jabkrp%n__jaJpiQp_CELbiz{%g-M|E{ts4WVL;=OK(KJQ= zli~6D3gkJQdu|NsIC0!7v^ntD&2Wv;cG|5R^W0QEzMA1`XkBD%X@*E$m<@VU6w^jQ+x{jHH%*& z=ZQm#Ls-uO5A7vpiyyHnM~Kv@Dpas0OO1tb{#!u zgdOt4lXLs6^94mv)l!eHu=(g+{~9hT`Bb!Ctn0v{1)ZV)2-xNg0uXnq#ahDUoW(

D^!JZS$QWHKk>}wn_Ewq(QdKJ2AKPe)y+1 z4;{=}#N;y<$=tQP6S~30r|80e9uUs?2D*Pez zD7mQUE11qvvXQU4lrad7?`A&(?Mf^LhF?iaihOVyK{<*V# z0l8KqvtQDkRr1Wudz!jXRIG7ae#CAc;?yaA$SW$cQl1fymjd@#Do>z!nm1XQUl&+% zf_oX`&DY!%b^I1Q8Wg{t=J=_>rOOD7gCo}-{VUz23-I0f@%qdB-Q#Ch*&r#up)*6i z71hNQR1(lzvi??Y8Mo99t7#bQc@3F!gf#w4A&)ttUl;erO8%=9B2~d3=p^D5$UQ%1 z-gPlAiudU|N=f|8AFGl-l3KD8fX9W3Z8&5NFg~WeOsSz(&uOYfIC9+YTvhD6Z2nJi zE<%$nS0*9*r|{rU>lXQc*!mjYqXJcvoa-2^fv_(V=d!jv3oMq6BABXeyfhZsy_$7_bi7TNvnOT8lo(hU24pz>8jJClqiw)eE__9gLidLmG=% zPUE;FA9U9#Gd*R1bx#|W`JFb?vtj^NQ|hf47vAh<&x-)M#pdnG@8WHT>v@%4o zwSG-_D^M)=cUKHBq2+lvp+)luD4N}tX9~wLc1C+1(r30>k(8bR!hR?DN!t zc_c=RaLu9EvVsvik7UI(oF=OU6OF_5C3bH^iPTe^cO1Cs9yUG~xa zizpN;a<ob|CZ*b8F4{AEwx7VeH$n#^31vUV`*rVeg9z$e^$qI|wUHLZ49= zw^yR~EtB{j4*G+c44uDgZA*eWiM$M!eeQ%XFk#K$2sqZgmGj|h0F(998Jn3k43^p? zWS=~ArTcZ~1#Qjfc`iO6$I8+dZ&B?kIfJ9OI!}1+aNtM(Iu@VlkuNsaYva=DTr3Cr ze-WFin~Wk}ExMmJpJqi$$|oh#-v@f1Ip25%iI6M>5hVOz0JCr8bY#U^5VRVni(dI6 zULT|X)xI3+-#|zc5KF8HN8P|hfp%g5BPR%ErvQ5oVO-QaZP*#{N(SFh=#=## zb=anyA~QZD>$;yx!%5@$H58iH#A^Xv?O#?-+KCdeop{$e9I*igYoQF((aj7dF?t-l z9<@_s!4<*6@JBVin0m-RxBvdXWVpZn=*0{hZ;e}6Ico8GO~uT|6Cva1lYRJGt|r*Z zp3U^uDoVlj>qzzceZZ!y+n>2A0A;2e7>588B>dzR4|-}1(ZVH&JbRUT)sB1W2aie? zAr@<_IlG!nf9)!i!k5myfo6*=uU(x!MF*^8fFhJUtk2WYfV2$K7DojVZphV19U8*@ z*WlU_TqlBFY6QzLT^Q&f)#uMIA1-VBG*%iU0S(t!PlMqiDW?DSDBx$y{&3=53!_rB zXIKd{wugn(+D%zK@kb7HOwekDJ2nRmtsaOObBfeCA~rO0zY+gt3v&sHmB)pfPvFGe z(LYq8c#2tr(3#=Dq)&nw?Bu+R!`ULw!MrdljsU7}ckooz4oU|jHx7rgJsJ>70nM)br(+~c4Io@EpRuZ7&|vNZJxLPJr`~WwHeKl`TW9+jWv$TH6$tqzdrH5x@R#w zuWYB~o84vESGPNz3jq}URvg!ae~3k=v2z_m(BzsBJQ!dzY3jciFurU?a^fW^6WBpx zMz4W6&tJxj@Ue~-Ro)f#jQXvy*e#N^ookNbA9z8>zpF6I%Y>2lko(Pkfo>SOXM4u`D$xpFY;(Tu1)oI;ZQ9Od_HP7s_QXc~)vP4tM1-+|@Acsd8(Ky=I_ zoWl?Nb=;2NhMwno8nLEn1B6GIJN5}f4uK|i#X?luR@~K$8=kq+s^CO_! zKY^K|jf?Fn4hcSyR}mQUosoe~;G4UOa%uYHKnRysDUiNK1C3%ew7s_k20XC1=<88~ zg!#Wd;4krv2QFMNVnclRBtLUh#S!dQC4zRRS=&1TnxB1)mxu$CIR{D_?teR3HT0@w zIo;V!dC&NSG9VUP9-L8i_$a)C+VwyBO*}e*!;to$hxoz-+LRL$cAUVh^4eu5?OR15 zav%Sd~Ku1xNQzC^vuHXGf#)+A|e24{y*A@FaXtgpvYP2jf8n< zWMIbIT}q%>AwzS<8MrSernDTO7~m0Dm)o?uWnoR3Jqqe#>LN&8?YBlrUt?!)f4WS( z#vTWv|6zN7?=k`Pz^8;7k{&Qg=!rL7^MM*rGnI?jOR1@jhG)^wdmDq?rt#6d*pM#P zy(Pg=5&HtdkbKl;zdQa%K=#YVKLj40V(cJ>4PPs4K`<|Q@-f6F!0k*zu2Oru_XBB-d@+`PKHv9N${-*5(9|m(x z|4(Hl3k3X}`o|D=XnO}& z@{NWpEo2r|vz*${4=?uNb!%80xR*+5TjBMG3a=bkFLwSD(?H+#_x>e5VCd~@(z#2H zon<>M7UZAf?L=~>i#P#rpE$_AzXp{xB<~FYI|XP!Dpeah<*iL*a-I_jzxRh<`#3%D zqa%JXe5Ex{5_$5uI0?Ssb6B1QuOn3T8gz$#`trnl1U}73hOCyq+SB~>X}YB15=*+CbG|gCr|R-4E%J3-;BaoH7(RdZ8UuA>1GDg*$=ZI0LRNt5KWA`mR=7a zOHPr}KU|!!Nz2nSnDG4c2em54uR(gHSILr;i|Oj0ww*d1NZocTEZ}& z6lw&TcoxTT__wob*|U=D;m&CkzBXD58a`UA-yF}-;%)FI>i9Wx{_t^tV27Gi$8ZjBl-DcRs^cArkf zYDSd&%J7fIdw2n_``zS_#eflYM3q7Yi|8$EBrs{V2uD5_7W%^gyt|nE%v(~Y3wWvD zpZEY+JKo(OFt0wJsOLqv;(Izq6*wIu{IG>AzbB131=N2uWBh@792zh-uj?JaE=*&Y z>FrD};k-Y5j;oAPl5Yhvl2onox_93?+{RNCgBHV5RV5yInmtzRi=AV|a?AN=-N74lysf(zbM(%R$552K58|Uev!EyuJ-$pMd$@%4dQF34!rtirs->Pqte1?zCoeFpTzgYr47hTc7eWp^oi)Qt*2P!% z%cJ%@1UdjuL1RUN&Gjz~p@-F$90(Td4#;2Lr@*h^eCD*~O zHOa_{`Fy^~C<;uu^4~(HTyYO-tIzoooTLfk7n5v1LQ#HG3QG1WrZ-gWF0NVpX|ng1 z0%N=ndS}Sk!o}lZU?TkTTdW)fbqs(GW+{K&g}G* zcjwP5|HBgZ3=W4iNh#!Kqss9%OTk^7P22zsg-Z+;m|){-IkLiR9zn5`5=gxq~Qp!;oZBrlfHS3WtftT}Kg(4#}Tk&ZDfSby7Yk6HdUTp4Pu(7*; zF#B)cbM4V4B@(;4Pn=XAn67cv{c#F&eg2l2cKuqG%%s|qe9uv1rB9F_hm@CRSlamI za=El#-n2RhuK~*%#$yfG>Yzk~v}da1 zqCWL0ez+wx{h;D>a=Ks7Y#OMKcVKz0T`>oq7YmV)$CWtk)=kz+3+f(V~BO|6FcoMf(tMwt^4e;sAk+DvV=4xuvA)wIAh8k?V~dzoB8 z1{Ol3j3qmRpf~sY9|qjfU;*;Hi+0TKWhxb;fD}%bL1F2b3jtIarp@EhuKqNFiJSv(I&`V%dmUpul$4;UVP^c|9^1sV1gyOc_ zAMZBv-hap<{yh_U&r4S-RdfC_jylD+BAH^!qcyN}?VSRFynT)0#E&ciG`EJWKMiz6 z*?N)`xr&_TPh=NT5x*Rl&MJuw6#kg%pm;r=_dGLb(SdGA^rr-RmN;eJpLw1CHu3gZ zYqyZZ?*Z2m81;-2=tiXqjXS|At%8nASiC0fGU`S~dnY`rxE>_09Rg_t`2}R1`1tu# zjWfbTKn^2?DSOn&b`1KeDDynjb9?md zTSx@{&HD?v{;GRV5Kt`C+XLd;sB>o%_Fsc{(f;#qZ0~eTV08Mw{=DV@MvbmSR?nyu zV0pW`y5^PIXYS0kNr&YGdys674-{3cX|!4~Ir@%G8Y!`1M5}X3IFS@a3oPTWKQHX$ zvda;u9y==51y(ZWUn|K8tYqQ9=f76+a!WF3tbjj)OAS4phfCwvDuxKVJ5M@@QeR7vgwkfI7%!DZz`JDyJR^|uaKCbN#5 zu}QJ&OKhx_N1*JQeXE^$U)9DXt>w*@Q&ki(7+A7L4I1DKJ6;c~o(-nQ zxVv)~d~_cVF-vwwP2J3fRfSK`9?6G!byaUCDpP`8@6|NK(sCdy%9^!0tPz7#J$-x3 zn$kLqMdI4(I#k}g8S=ME_sjMl$|6vIlC6RJ_T9U?->F}Rq5rVpcqxK%o6YKUs~q>6 zQ2h6`{P@)P`-1Mm^eF3BIeI_ed$@S2_t?7C|K9&+G{F4zzAM+8CH};jhnt(LvZPNs z(=xLr#mcl=3L>R%-xYByP7(7-4WNBw8hoFdTd=9gCoea*<9haWC}GX!-b+#PB8x*)_4W1Z0qEP)Rde>A4s0HN%+H_U6BJAX#N1OaPxWTKWqq;Qwj;?o zw%IN(E(Uhz8l${Fck+s6{19f0!Ku~#dJ{j7UyR;S-niK6O{F${+;=}>q2W3`yXWIm zO&w;tTC~o0II+ENqe4tTp^e0K8&}fzT==3AIcwhu3i4kFwrh~l2RtM5FDM13h-+wS zrk0l4kG}2nf`03Xx16nW)MSRP4bqMpwbK;`JMonNV>$jZJ(4iM)*M?Oru^+tc$5H# zauZWIr(qcX4DJ)w4G!OXPIyZuTtko>5oELq-p5wUTvx~eZx5t^yZcj?N#9xv#O>_S zJ?xI76C5~A0~ZR3jxE|GP^os>O!IA@;VlpJq{dgSPdEUmO!9&}7R99G`w6V9FDO6~ zu>oG{ZgpB3nhHjFQ_T_u(-RYk8ZFNU-YSVGCgLXDe~<)VERrV@Cp6OVWqmUe5qD#( zzS_*ij;Hd!SVk|wpXJfWAaAxdV4!HVrX(1De(gu!56;aVQxD1f%Xe8Op@}8;!n$iA zv8@|^E#sY5RT+@U7~*6QAhPepHJAamQppf|S95QlbSRbIwz#$h&=5$~s|~yY$JY>5 zn*OI3HUb>Uxv2@`-yX+29azS@^1_gi_mn7p0sfSz<6}2^k^^kKt%)+;TNbtkgfq2! z!yUugP|-B{96mzr*4>Q_(mgNmQb^7h4K1yW`?df}#TcMPFm!8UX|bq?Zc&WSrsnL+ zXdc?^Pz^=VZm;LXP%FQ9*YRz~9r+}hK}9|((%<1A+n?KQM4+-HF`u)v7a$lZnVGGE zFO)Kb$2kEYAI$CY#LoHR=&ovCiilEP#z?Mw8o;Z<9@yQruX33G(eLWd|51j1#HaAo z%tq68EI+ghQy2fHPZ{gA&7G^PfgHsp9|+b657kq91re0;1E zpz+C-!qykA+PS}{I0mi#2)o=(}w85-7PJqe~vIQ7bv?`nU_jlC=Y zwD}3Txb^h$TbEUj7cV|~Tx{eI^u*_KHUeD94kR@m^|vSgvE%{pTfi6HOY*0s|9u&< zkzTv=A5vk4K*5N)0H?`yOXf2x=$s_b^C)UZ(P@7%s{76w`Pc=I7}uD?5F~ z$?)2GK&`KjQ9UN%L6o!C$u_^wm5=l{FWq>2FTTuMMYI!Le3_Bsm3Z5E${_Ul8O8+y z5;*9L3LrlxJur;?giX+p%zL;tRIBH)$UGtA-kVs7c^7HPao5B^V+}*@jU5ib5B|y; zZFw)R)_2l`%UDT@s z;*?>~y90^_626!_kJd>FTIq0=meDcdlhP zf=-!&rNfBRI0y;fw_&JJOKpeULrA9k0aJap`NJMNU!LsbHA&3Rq0|Oob~DAO+sG~e zwO`UfW6H}vwDpbF4`7Zba>JX9;7~^eJ*7X(`{x0d5*QBM?h2lw{=F*!OMtgF+AXsK z?okp&$(KoNz>Udw90WQiTZsZw>IqU*m{|gE3UU!`l3T~EYpe^S>>L~% z1JcCcJBz-XW7Ys|oEDrxnpRx?V6Mw)T&3a4{QMj4y36G3{!(gYgRA1(US~`C`*B&1 z1XJCJh6>3@@BDHL=7>XjB6Lx`ziz-cPdYEZqzgIsS6cMl#8Nq2=m{%MuruAfeM8`Wca$Zxyg6BOL&Y1wx4}`IHs;T zZD%}k2F&VFmJY`X@5P80ca%}6pZ1)mzOya}%$|(gSl>o*W%hc+Hi)4Dh^MyZ$7UgJ z;b@g(dpJhxO3c6Q`d28JflHMvCyJ*l>-alj(Loyav!4YTq&wc; zSMSHH#D3v=jN6C`D=9$C%*cF)j@Xk5RLi)0NggrlhkH18F3&48qTS@?;^Hb<1+K2u z-KIwS)wV^+*(#gyr`AR73&IA?v&NTr4pdXA_)#WaC%cZYhVieJ+JdrhVlfojg^pdH z+%d1^3@4{?sbLc$5yWd*Jz=V=H^bPyHkc6;DX(%yb8{_VNDs>y=SoJQx^w64{RE3y z;&9ftHhm?vwUeGw^=!zi@)8|LGB87ZuFHL_ApS&n!-MwLmjXdKFb=_<|KZx?U5I;8 z)F2q#`ix`kIj2_ddFPYbZ9X`C=HCm`LILp)}@()Y&3qNh_5U=&K zx$n6Ur0oC*HXQ5<4Eer7dk;clqYOjli^gA!FX_~FHK$2b2OkbFY9neLTHsmL7eSoy zV=oQ{dEIyQ`@XdXV6Ltzd(+&CMFFEGbR3a(=da99OAVxjvEzE<#4eJ3C_5T20QzeQ zo3ldKYgS`wW84i?XM9-4;gAa^uuH0f-pk8cjZzu|1Ar#0ztTGZ_r&!mdwc zoKByws}wtRCj$_*XD}t_&8QMwf@MK_eL>0x`sMkiicHNey<{BhQCvlioDf>dMe=V? zd*YsHYTCo>J*GglFjIy)B^lk)9wJtxZ};3LMPQ5hg@7MqcdnzeufGPt7-{rhfs z&#>D~Db^NrqC}MmOu9(IZ3%D4yMl!NIPezgZT6^p{-*6ni`p za$+k`v7N3CD173k4bN!X=#p+Y!Rx~6pbE%bL#O8C$jE&&aP|xN?P_cF0YIdOaeoRE z7qhj1LoPVNyDpR+^w@c|xXl$sFtzLOvvJQ-|MS|UruL}Ih0V{UPJXa!5etoh@k3&- zOloE95Lm~XQb)Uc;p1(TuYZN!7^$Tmo9v()KhWc1T%-%}&QM;BrKKujAGFEOp=h8J zVBc8j_^WkI$PP4Kyoh{e9eZ^}*d`i$iuw+>8Ui(T+BeJ+)QBRV$VJvwl$Fg#&ZCHK zC88?geEQw6GqdKs50&Tb7j{OoU4UjDUaJF2_%{z6dlZ$4sA8W=E1Y)ls?c9IW(}NZb^n*A<4Ymv1DNRMHm)WZyWrLuh}Wd{$-# zn1`s%O%wn9d3ITuVC7X&UWYWIQ!$B;s>0da#Ce5zk7gukd>bkpgRRE4;ns&yfxkJyJgvGn0eeZuC=|T8$!@!kX*i$$&^VS>#2$-5uN`{y_J>Fz-xAE}=zx8gX! zRmILf_^kP#ZIAUP+@OY$lgUipJe@svR7lE0|c#`_+Z6g2Jv*aKE@q-x*v-MtcG`^ zdz*RtCW?B(VAXVw<;0J&V9PZrM;?{v)lxyt z1NpDJx2o2?E zCeYqb1*X@%PZ4(g1fH80Hy%tEqTOE&lbysqT$3NnC4_2jRZ2_cWIS);1o2)}@>7{I5%#N6I7UsX9&51|XA_~kLXfKr;pB1|=**nl&0=KBR6z>J2p zH5#`K`?`5vL_CGh5P5+wW%+|~g-hFW?*K6kB`F_ci>h{wuINgPv*=1^BnlXW$qpi5 zoqnzj7rlqvOHE5=<{ zaHt{9Hy0VDtn!!Jh!2&6JQqgKc4pkoOEW77dKC^MSxEi%n#|nN#A$dx$kDeQ#kuR< zOep2wwEMX4PjQQBwOL81RG}Iavo`W8vI6BB1@OgKh5Dg>G^2(ddE5N*ag;NoO!^7) zS9|SVI}fEwriMUwF=qu@~V`tq!kJK?#yj zVH6QsS$9EhW#v=EUilsxRMpnjwh9C6AVgE9Q`OasIoIGbqn~g(h={1kb8{+5(Gcmy zKSWg!!7M^*CB+{=1u=-Rpbxtmqe9Xe|=NJ02d5msUUh;nyAbY4pg`i6~03;ERhWY0=mZzIYmSIV}8{=`V=A06IWbR2d4gNJtWF(nc2bMzD1L z;nk9Xj4QiMe2Xr{l7PJn%&&b(kYZYQru?0qi+^p4uFf4<|Fg|HtM~hh18F-_tb;nF zDdC??I~aB7HHq&|CGMb1rY)Ze2XZ;SI11qbB0WK%2y}-r`*0_J>=rdd+!lOQt#{H; zFJOnbLmE*JdNO<1OT)4iK%CPF2o}kF@;;rzjPIP=v`G@-Ig2=ay-Q0>5qG*h9raB? zK~6iYWDiIsZS#~;ATzbwO#F{=_!+akUJfgoC@OBfwrhp&7^`Fmfsd$I$xtN}49j(r z3}#wdwa4X@qu8V*6WXc~!bue&^8mVxX&R0pChid0vraB+7~gpoSvH!Hm?2_nGEi}<%pBS z=-zza&sNlYjcV}y1FW|ddoZullTqlvo z?*u(nX$>RL)zY$RLRrYQCe_~$jHrcdyeTNrHnVNQ56?g=h9x zKOs>Bgql=h&B%oZDe_5L7}f>qdiXt$wD*xPM4m|0D=(&xH5A%o8`YR`Tz0FO;b?ZB zx-sb}Fz2Uh`trJe6r^cUjt@D*vMTDMp*Dp)6<5{uH?S3@MNuCa&8Z-RfOY$X%8L-9 zv>!hYeyM%*Ip_Ti4$q@-JW3!2vFuMaQSH8!yU4r=JzE@z?;OO$A?n4Q(Jc=*utAX-MNLlS}0V*{Q53TtEXUX+_Q;DE;uuYwFyHEy4T2& zsb?DGo@NMj5%L_H&sBodn?`L_PdHkOIt$$5x8D0E7Ju0z_L%Q}!Z=V5GQKXWm!aiZ zXEuh11^Km_G0#1F3OWNQH4d4+7x$xX?y)(*_vOA~utV*EjLPFwgry};HQlAD8_Wgj zrJvH;r|~^qZpvwFoN2~sy>x8!HpXCB08;C1c{V6c+e8D~=smjlXb`w7a-N;J$>6gc ziaEO6Z(eMa-V|7px-c${eYMa2-UVMrM{T#Puq9B=Yh9w$^i^aLKZ0+?axU5j%{6M{P!TcvZ2b_eOx zy8>k>LnjTD1DD*xQDN;~aTnbQE2L-t)5Bu&qT@?BR))5ng;-;Wl^N;UU zy6?`C6MN<7R2t6+tPl;cOj^t=Lfg_#+e17X2QpTVJ-ec6LrPbVbva*}1^67TtGO{y zvCCx(T#jY+{Up$%@75r7I=(w_Vl{^9JK%{aSI1D***sz?9SO6 zmig~xxVxR>6SA{&+!U2!gkC=U@Sc3x_s|C%dO{0M>dtG347cC>I`5sjGcr+>F*!~3^b-n=VJfdj-M?NX=@3bq@4qBrk$4s%kp;`L`FDdnI zI3&80)0n{>T8)abh?y7dau`ptX zlN~RuDPg_2oO#~QwoAJEnc;_bI)GpJY?i}xTjt78z}RiMi*Rf1u7~8S=x{Va$P@{w z6^NX8VQnyLvXsSQ@goThsY;d@SjITw2r$~Q7=OF){mfXj0M?7P-{JTl>trTTxwhED zhH|YxpLNRrve?mKyfc3^5Iq%jnv*J1G}o6Upq#005nvZeZf#Au7-0qspmtLux1ORZ z%Cij4R6$5dVBZ~S4~c?^ut8V8yqM0}W+Y0OIKLBzBgRoD3~k*EpIuSY%Yf`%JX`P; zHf7DvWB{F|o7Z+!IJ#hMb%B7;I)8e3x~Q_8FfOKIkztxhrJha{%JzOT9-Dx2D&+Z? zqjIn>r3@;c;jT%>Y6hS6n-rEA@3t*G3Zvx^C4#eJ`8(5=MCgWgL=oY9YR?>ev{A0B zDG7Sm-r6Fk59GYI*b_RpN`f-64(~448B0UhV(|}TXz*wJC9Ogq$E%{Jniegm&@E_^w}$H;A3CX z4i2L(F(SFexLK#()Z$x4C&z-cn0GY~kmxt^Zy8R9lG6o3vE4{8q+V(>WyUWyoqbF) zoY=I>Fhrk6HeL1u$wAJA|G~`X4xWd>~cx{0wy8{O!``(#YW@nsKFoc1CW zvNtX~e*tJ~s9mX8=_6*l#ZDf1;hHeP+>Qx6O8}ESLoHqH`L&Qg7p7Bxyd=u4rw>pS zG54J7GEdD3W-~ni<3Ulerfn!cEjcwxouMhmOA`^eb zz18nYQIa&(Dxwnf5^OKHql`oDmRH_YE9j}{x}`&VKbVK4|19ZKhBn8{+cvLE^`9XG zOP$IT_elW(1vb4nAW%nG4@FT^C4Hky?{i*{%Bpg_6Rk3#VpV{X z{3dgWZ)7boVaiFX`_%=Zj!W~0alOmeocByeDBC<)M1{vV7Q12|xI=ljDa+jV+aWsX znIi77V4uU)k^<~6=Gfj5GGW>pVe%9iID@7oTjxZCUNiNsmoOpci~iTU2-}V20AjuL z_ddaStE(oIf)($$;XT<#hVKoZV~F*$W{KV0fTZF@>^{xfNL!kVzSPzmj=k>fM^d~B za?|Luo-_rz!f8A}&;-n*@%Z{yA6<0oJ0{3>BlI~Lii>i{g~XU)!M()YYufzrCy8xe z#VC)RaV;iUjoYEYT1H;Vuy;*#LisqTi_0PuATQMBK0}9H;=e}JTDs1qaj92FC~y9?TX>onc5iB=L0jbLC#S^8z*KD6!FwzV37rcC=Ps>&VzTU9@t7H_ z!umkldS7&VW0VOx01G7}|J7W{LgrTQ<1S1u{pu8wal6Ljj%pI(kCtOUfVC?NNI;Ll z^M_yo5mBSPsS5CO4Qy``7oW?Sd02aCPj6e$w6kRzA+cR~1@997PBK(AiV`@6%!ViF zr<2;~bYB*l(Ays$;r*n)M}7aNT*PD(UgZle_%s7?d&|{K%k+++<2E^pzi*zn%)!0e z|Bwm}nm~!UF9tRa6lr}BNcSi9391zizvnp1xM$=L`HFN;)|X+uuDa9(%X@1j!wU)b zfPI=f0J#~!T4E?sVj}LP3GPYIwPwfB-Ytv6L=Y8Q%zVdvn|#_8k@LC=smO(W>~6TVvMw1R(k2x~^V4=jhZzSE$!?S64&t%KEcODH4S-vJPr zzJatSDegHKd&bSC&89iz+TpPf#d`Z_f^9$E^^&wbp_+k3SkOu=dts`m^%!%jwbxK7~KXE}Fm zvue<|Nxwk8Qh z@ob-=8!<{!1VaDEjs+jGR=B4 zUuPeLltmGvQ|!@GE#aNnBO5G`9+!3l6c+iaX_l}afd*XpSQ>sHVv9;YjT|GxI~$I( zeohSSkmiMBHy=-=!ly9xIn-SRZxa-=4Rpxo%OUDhZEdWE;vmrR% zBbLXN9?GJR+L>yMpsOjT)3(Vko6p`!BQO~UXRECfz&U!eDL>Oqn9X>(`(AUn7OC=~E`%YZf`KnetHEpnGpmY!Ge?%d&eO^& ziTq@`ha@7Nbci9Ucv1k;&HvD!tLIBGB`LYpdm4B`bxn=jQxVs@>gv2-i*>5xDAX%T zAW=eq&dT`wT{>d#So$Z5!fuE$>#mt0cj7ZI#{>(#Dus(_W{`=!{Kdw^%5iJ0Z4$)5 zwtF!%j)sMV%>#@oTz|x~(B`z<9YZ-JFu26GDSBToY_7>m@OhIKG)%S+>~wYGMy+d< z`5R2gWvJ{ktngb4@kES|36Y+=bGCfiqS1uZ7LBmYO`9~h5q$pK!)t$nHyx)Lx?>!m zE9-BFPDh2Tw$5$Sw8c%5VMYuuJZPQy+(rjTQIV^1=Gtvfa7}+Yjc$D5;DjOOxo~)J z)3bQgsLxikE@rJlbyU4r2WayIbuvBt05to=n$}(}leSj1i$i_+FRT<8Yk)K(;af*+ zH^{I5dHp@)=}9NxI)jj+%p8*OE>=f^r4B>y6$< z#n6gOh+eGco^%kw4{3#66p%qwImk7*T^{d)5>{IDc|iE_US<~S^e1?KwS8Fz69z2o z1~x?g^X06^zEs!(If{i$Fpp^=sC(;LLx2~^D7yc>AKUb#dy)hSH3Xg! z7>-_CTpm?dKf9+_AeGGjCC`A;fopBZs2p@uyl&e^kp?35DGVGk^SShZycAF3G%(GB zUf!)T*a~9wq!Fs@g1JA3o6j~aM{Y9Gf>v8+x{($~YE52Xv)+DGKy zbwDGY6@N+GrrMgMBocw;4WJtyp`Hh##bd*(U3%IZ1p70=iZGKj>L<-&jkw(@ z-6y_Kk$9bW(8)N^T?~h9i^w@RlzHrTQr_~#&4KJUf((bsYdG8O_nX5`g$a9c&sGQ1 ztU$LHY1<1&^ZO%~rNzaDFF>B_lDt-f`qanxXDBr^IGQO9$yQBGjgA@((rjiWRgrwfiB5!X4+DpQNR3=&3dp1qn_ZY{*#IRc{smrANkf*z4&9EU;m2eJOJ~&(>zIFl*@^v z6^61|uvbV)wBUa|My+XC4f8<=uub0HfYJoKs(2x~a2)m8J{rOyV82}#-a~v&e-KD1 zpoZ!Zm-h&=Q`CxdzZL$4q@kff_SwYCtxu$?ekifPov(b_4o;`LM2T)Ng*nvl4ILR* z*!>PEn<~x|lOin$6M-rtJD&`#*GYJ7YcojCV3y0J=24ui_+m(BSr$qm+-~su#YSN} zXR`SG36Avwwu2KcAX5}C)@%AHN_M|)VwJCJD}X!R-(jpkZRxJ%obi1oL!r$9Ks1JN zzoL@xVDm*0({ez5G7y_imyFBBP}#{Qu_J@fNG1s(W|(lK2?G^+V6DnD4ANzd{qh1m=4EeA zjt?v>3%5v@G)X@&%3!@0&_sy4=yG6RBOISQ5CbsJV?ncpkr7SN#Qu3W1>EcG*mn z-HWi5j*kS4!bb$qy_o}4N2N~%(`)bL7{PB%7nuX8fH5L|_Q;Ewic16--(u8g+C~1b zG|RNT0$%9zf;XxoEYdStiuqa&0D33 zHX9M#@Xe$_s6x{^+-%vQqnlTvqZ{?wX#gbZZ3klk5XTq5fueaqr!178#$J>SXCEZv z?Q1e!`7yp^@JRIFQ@40DxtZorP-?er#X_Od0{M-rXu{s=TMh&UdPzz~kV}2_WvE1S ziP17pM?0Mh3tu*!d3uZ5xL&2Q969a@08)MX&(Ia>&pb9u;Ji}%1?P#?%hg!7M;C0A^ z3_5|ntLq^ITyajnDeQHU&bf_@SO3%#0W&k_DC&%&ko9OA^(-%Ue~#tKRl=qAQCTOt zyE+JmajgbYoFQznS$+jKyS%ISH6pI~u61ojNoi@Ud7bMPOo++wjFBN=w-;!5=!F=- zU3y7*tW7!@9jhxGmv4a09vC%q{-k1bq-m8lock`U&N9>58482B0Vq}LdF&?+K;A;p zL*Y1@Q~Gnpq2*RDqiwY1`2o2!R$&iX8B4dhh$)od^Y@6g0Ai0@H9?hl*xt`UQB#0; zdsH};T7Kw{AL#p3&~be@o2ZYJ6Gn6LIdcwL=osGm(c~K{VtZM7_Mi1DbGgu=gy0SK zhyD6EHTPS#vyA6cVVO=gv6I`7Y<|wKRlmg%yval~bKXXGM^LI^nW}hD^mO*{K+MRxb~B`0dF#}Ej(Shm z#BgEu8guD4lp*e*(klYzvi19!INd@H=yO@luRT-+ri2;C(g@`YteF!S@WD(w@z1Gy z&e8CkarJI@hXQ@L>PLp6(qhL)>M$W_6SB%`y_>tj$0Yr?+5PS?E71F0BQWT^U`l^5 z8M@b>Tpbeuhvtr{tha)qtcw=Vh3hn7%ST_?+FYG}$?iIh5#aaX-mCb5_F|M>Ftj~L zKKdzXkYwEyf`ThqQKQI>9C=iJW$*f;W)2@8DRNQHmTE2`#CfForQIY6N+aoU#BDMh zYke<N)F~VOO;}i@A1Is*F6B%-itfaCM3GZbFpWS^xvRM*+wizi&HN0crs(qW z^7_2>B&w`CL59$D#t@or4FCjYScrQ$Y!|d&$%tqdIFQA2Kt7pFxrG*zAlnS#}U30n2*z*bf`g1kJ5bNL#%h4SG;Qrlq1AI&w6yYqW4eeeP9lqvgjKAnFB} z3?saO74NZ7uMdc!(Eyfb0Fw^7m|>EJThSFuZR)+J5{tR0dxiWrnU+nj?@I6t^*UcdTZ{OoEuUGAOJjs zvV&3C)iW!gjus#HXg6ZA%V4Q#Wa}fh7SJS&qjS(%rZS6eblZ83r6w?XNb`={2sX<} z&OL?eb-K;3wZe4!#_zc6H<*<^0Cj!e!6!q(Ous*4djMqnD?dC#HCu6R`!b4s=wLD$ z%@%CV%adc4Z5JioH3|4iJr+dwbpacT!5vTx*C+DBQroSYQ_QbsdgiqCr8nM9n|kz` z6!Z0sL;&fqb?Mv$^i`TNvDZN`8)*Q;HK=_9{De9VE%W(bEUVrROPGN`5nMjvh(7Yr zbAf}qyBpg_^Qgt|r|-GKhewqLpK4=davnN}(R4WTAwpP9!;k6PpT|>w_O7*`;{i|{ zH8aDEEn2N%XMhxc$tnNXC{A1es4Sp>*lc}cLjY(|%AKU+ot1Y2nvY21rb&-mrm;q( z+#VT>(J~5F`no$~0OT+)CasvB#2WE~fE!LyZy!-gUWzU1ERBn+#!wnH$-yKRC`l#e z@3EHQUOc5f6FTtDpZLlfKoFE9lQ0egBP&Mm$(wvemX!vbt1p{R!De!CAhW#)VEWJf zcI}z}(nSBiVY;!sBRhuDGBc?MJwrSVC9?&6>Vzx3#P|ziJl99XK59~dS`TQdI}n61 ztd*&P-1w4q>4{kBm)-k6mxmSj>|7i2Y~EF=Ke)vOwb4M&P<}(fm#M<53$_ae0-oC_ z*?XA8OC+t*-9R4l)}Bq4*!#;(#>coDfI1Z2^u0;avBmg#ho&L}ICO-Mk57BApS^nY zz=qD}NNsC{GVl>(PFP=}G2xyv53i+Ct(3@H+r5{9F-zk+T?1)u1hY7@-@-^Z7J|wl zUD0>ls9(_Jw&1Q)i=NYhFEUdA{O~}~k(Qwc3*)YoArvKD=W_|0u64))$6le6&H%k` zy8}Sl_;Z4x4|CsvMW0dzN^0tSbugUO#G9nrVrxR7*_;R%@KV#`_8BPg027i(XGqEb zRI{g!hJc9sE*}7s7MOW8iSKHx!b$f2+gV#lLXB_ux&4=8A)nP~>v}(<1SSDcnnGw> zP&dd+Uz9u+wp44rstED;yf%<#C0^ZrhnQCM<)%eu7ePwu8p`blAoV*V6ml*B!|tyn1~2A!3z(>8Lb%^E*gyp6Kn ztF(BLl6!1>O6;AQ2nh1&_pD?+*YDj zsU+~ztrpj9G-mF$sG7dlGU;suv#O|?qfhzgDqSBUuIv3>dDTGvQoXM5FUH&RCn3fJ znd9{I)IybVkati6YLY#h9pH42P{7k!@JSTjgTmJv8XIp}#2hq)x$$RnBHG0vYLO*R zNl&(sb^!9abh=np=zCH8k62pXiRM=@SdBuKh@Fum(UoNDL<`d2?gi;^tox;w1L$pM zGRZ@?WAm`bkF8rCX_E7M_R$;hwCRD)NAD)V!hEyi*2UpN?+L?CtFwCbImQB-v%j-V zf2r&DH2o~lw*wPKFa?FcJzho6d#y0SrD;0`lBO!D%8FleMP)g`IJ;m&0DHxz z-Q$xPzVOguj8iUD5TFp`^%vS70&`7u)QV2R{!5Q4{kliB=4w**caJLWSC1+Wn`J>= zlw?Uc`Jq~_lV}^CiJrl<3Z-IuLz6vo&>9+Jt6XmqTO6y`4I*{*%-b`Pk0*SK*Wrdhk|BQuOd&9iNj{%041wKTyS6 zWOouK)$UwX;3nE1yJoQUq*6J*|B-{c9Ey+0Kr{0l)nStRJA*By1X*>)-D` zL?9w8w z)v`Jy92L)yFNd#Pylxol{jGp%7sDfQVWpkmF7*oC#6&FoXbJXF{k@^jnzkAS*wl1dIq@Vb$mzJZhg1%!D7l19S_69T!3R}C-6L}OxvE~f%eNHF|XBPA-_d9d59zw zM~xi*VIXnGL93Ud{BdZ0E#PFIKvV@9I)n+*(N=o^jJQ$^uGHRay%~T5Nv$DOrmUcs z`RK!FD(ZS*F6H2-vxUWR?>~;KLJF|&_nFN8@dI1{L)I)Y^_5))-AMP0N9{4c$xZN) zMWE0YeSk66k^T7BUzCFiPd?U6m4W9$`0Eg+OsMd9*H(GnD53-_09_9)(WX@(26yg} zp22FW{K`UN%9W2#y?yEq3$uUN>t9?-MQwE;_)2?Gq=_ieWEcdHk^HB-{HdB1OrPYF zd)4!j9nHGs2Bp8bAB^>u6NO#jqoYGzKU-m8VqU4~(ONawqHgMFhT5gzup#^S^e5zh z$9uoq96HRv)=?~0+WdAy=wv9M?lgqSBp(Ji1zeXOscIi%Pb7YM7-F9Xc%XQRGrV!vnQ4#C9-jZ!?&e@P>G zJ6LOQqPC&r{*n)44*0&|-~)pOnFB#h$Z@4{BRlRrCg<2){b+yewAaQO;)x;3OU1_%v=SN?YW5uDa%8 z6I(K}Y@$j%@LxGx*NkL5XLixN7!VlIpJilqPbvB3Lcp!1rsihfQRIZBuI^qMz)?xd z%Udn>)F9wxI*Iv@z#53K>3Ods>6`KsfAG!{7##p5$lsegaMlzUoMXex%v~J{keC52VCy!im#X5 z6z}gn4_LZBz`NJn!FnsuXb!$PpU!fxj_10%eKqrIFAUEln?9A;B<(lKjZ z$>RJ5wx-Oyr0icr39|H)`$Tt%ssA5H=Xa#h>8#NI&X2!^UVGEUZMzT*G47Z*k5%N~ z^WJ_YTvLeC^1jCMk*r9u@-Mco^^@#YybnA($G$Nz%&z@@tIzFb`Fdt@;FJ1s8|hxX zCOL#-jMZO|W{P~Rc#W7eg!r@8wV{y0KXt@^d$^5qB>I~YFHw4(k8^yr7rBk9=d5)3 z@a0yC;d1XZJ?NzRBhBWE>fZMP^(JzA<3%;Wrf7(}2vg?lQT1*L?$Qm(;)xycj9&!u zkgwQk)S~+?pN=);<2>=1_wOVruAXY zjcvhM=XP&AySvNdU*Z5oxub7oK8o@%#?5narLY3D$5np7kPK;GcUeE7|AytFYb(f~ zDU@cZ%)_|Hq0PxZIYZ&o$tx($oC3%c--K=!WG5P+OH9&KT}U7#38F zye7fr@d;~Gb$zKKX7{TOWU2lv-{8YPYCoapzpVA)pCZWr{Qe36B6si~?zM*;uu>;k zgk2bhSdwf64L0eIx|e^`w`+0{bpRe@py&%n%;-N-h9Z`X4DX7STF|>*WHYiZkF{Es z5m*Lp8I0yH>>?`{mlrOG(a^v@&guWXSVJrRnfa5l+FDjEu`Wdu9PQ+=r3 z^d4)dSy^Q3L90%Cf5+b~G!ZKla4H7QHllUoZ`cJV9tU?a0K-jlF5h7^li;0w>#Qt> z&)z&bouO1}5`1~6j5b8}*NJY?2v;W^yI3)y`up(yS5^e(oyEO@+K?6DSo?wb^uM9@XM zFL=7e^j@}mQS2i_{m~%pl9`cwYr<>d4aHCO?#rJH7@Et|LRuoLVzAk_Z-jFExkWLW zok;hl%cL(>YF8xudi&c@#J7LDA_w*#FF(EBd0$lYN$JIlnk&pta2jIgJIMc}Kbd?VI(*Z4f^OvP zDJuP6ZpzN55>U6sYQ6x2m?yo;J#*@m*ghObZ>dMGFEAPlo1ZEj~;4ip$7Y|Hw~xYEW%nKQK8v zmaOqZst0Qy8J-$%IaV+-xNOi|>;MEa85y*IJcHI}pV(I7^E-bc%6~pQ4ML+(&+zNg z(0q|fb?%3gD<4;Ze2)6*HZwD$l=QtN$eX*t^1uezfG4TNf4-zYRw!AkuDUjCNOq5H zf!Z@B`FT08H}11-dFlvKwtClGez&fUYq%W`v@UdjLo*gGVAHT=&xaZ;pL zLY_W!0(_v?)wJ&IfU)35N5hoZainBD_tBg5YSjLxoWdpsMclzKC4OhAQ*YTve{OvM zV-^}tDdzodc0Ow!uYDo}4I~W2W6kgNZDinKWo!F2-vPCRZ(HY@>UcwMq^o#Bew)WX z{c`qayoH|)M<>S-ls_Nk0ZJ8-XT_9$r2FL30NwOXDP#BVIFgw}69Wau=_b=w-AQo& z@(>HKiC5%PVKk(;IkS$96#vy5J!d5`zu2lit<^OP1)o^gNEVxp5ZQ`GC1NzA@XlV< zb9^SqYJNpA3S-bo|Dsb&C0GSGNbXcc3yXJm1$_fE0Id!r|4yZyy#-6B*T~yD|25n} zk+uHx*w`T_&GIIBZ2gt_Qf=XC_1=@MeM^oWGyF6BgUX80Kdt~<0&T0nZA)LLcx!8i zP&p3p(*qybLSjGUDc~(Rs@`9H){>)4R8vSOhst8V+4Cz=>HC0*CxIYVl)Ljuhh)L&nxZ_06b zAe@vx@7%Y_+8)lj1SZXqvoeYPZ~FmQHA(AFpN)4Rll!-92cYLa2@DJ}@??MflzIE>=?03DrAtoX!t=!2?Xc!_9x(^1$&> zP(b^MlUM84+Mmfk^MiP9wW}-ev>otS?TUj5f4&RzYaaADfl1Q6;|OS(_=<3)4v-i? zzFN%PCsU9c$$9a`aO@z<-BB>*>nCTmqMDV?ywSyHH|e>@rd}!l$9sJD zoJ4-Tn+RZ1>b3TGXEA}T+CHZ&7F7%n$GQ`BX}xa%g`7nS)W*kB|L`)nelFv;j_+@E zQt_~LK4^l@ZlT%!e2w@0Zv~p?^o7gas?~Z<^L35`H+%jMXx)z-BSN6-UEmx?q9 zN{1i~(jcI8mq>SaijlRTbCfZBgOShV=1QINo z`|!l{Uyjjk)Tt>xD844ItqZtBD zc$7@zP>pjx|8)+3vviI~fSHS*uvv+_zUH;r-AVK&`sO^x<*^g-@y^W0J`55a4ygp~|J3AmFwDvA(iX8pxNN1!9= ziA#?*{jRjQ zf1Q9}?2trp(>kN}5ArbueuJFPcmRn4=Vp~mb;e0nn`DP^>UGgkT^0vSLEk-*ws_5h~C)}9Du$6mUB^AvY4 zk=KdV+`!K~IOs;D=eBsh_J@f>OHLc_Jqiq=tTZV^?EBgIqIsiH_yl^VlU8L;>n{i> zy$)f8#5h)>DKzE2cjitfVs58j^%Pzka#6D<097Exd-1Io(XjRg+qeP!PjKe0>=BC*vXdwp(3XcQ2G!g1r>_V^tHKuGlCLmdtQTB^_+>3mQ6NY$x9 zr@hKd!V&2|Gg^`^AXPJF0px+G#d!MKxtQd+u@q5byjcs(FtrelmQb4gob5`t@XSRe zLZ@d3>}v5G=0BUB`>?@{dGJ2>t)KZH0KJ9yZ8=T6@BCp>2`!Bp#R<;TEi=_LeMYE2 z7-7%KmcL#~fguaxoGt_Mxdf?_Cr955xRkj;g0QahA(s%g&j@=pRzSQ%k8(@1Z=1aa zOJMs6LNNMn^AWrc2NHXonrD>IOn_L-SHY9$ymZre=waO`pb$=EfY;BKW=$GNd9hlC zC^h29A1@`4XkUczlP@c>fwiw0V_)6oU%z!rE(DAKq>CCug8&Z`z@66^P3N;s>=O@n(lK}4nC8s z2;j^n{8%;_m|+5xe_l$Hbl8p=?O2qF97SjDdzOnKe)x&E{ty-PvPbWG_^+i-w%84s z?4y;=S2u#Z*q(>zH2eQ6I!_TR7q*n*r z_c8mp{`I??c$Wc*7YKtsr^|Z^Lrp9+5qu^qCxr+{(Are#a@HRK;2;RbQdph0KQ~IJ zqMtxlKjNVEL(zqtUD@j|kd4ml3DTU?!d>K3b-e%02FwG%5&L7(q}vr9FgYwEa#WDW zkjbB;eCXBX`4B_pBY`Xpo%4eVL-!DGTV-EsLw*o9LMp%*dqmr-NcPuZG zmn0Q5>k(+a*ZFhz<}?9S2DH`|V#52g&1<<0ki8%wZ82E++c^|w{gP<@KVJBVA}o&a z1JU^lD_EZa0E83$P0AHs;}<$c1oge9wvUvw|5j==x`C7g9fpcF14JV58i2-^kbW}=JINfO0-ndoG}nL04b%MiTY zoN9$Mch>=?{XwsY6%-X>W!%qM?&8fiO|a;%9`EWy9{wk!4pYW3L0CZ?gDw8H>*#m@ zd@b{bPq<&DNuDDHI*&`{MHGb;F@IAMcZ*Ra6KgLsrM~+mF@+8hmQm#XEFWACaU{mQ zHHoNn9v%{5QK=mjH-S-)g;of#f#cAhXXdNRQK+pUK zLJYY%B+=cz2S*`T%kb~YnyDYsPn&`%v&)T! zica>^rgSU~bi7IHVQ`(7%qT8q&YnbB?TxXxJR_D=J+$-x-U7bmMSuA^enXf$os?`2 z`5ofIAyJS3))w@FTVV@9J}Yf;7#2c}oFuiar}R+*`U>WQuk9+!1p1fmwJ;EKA7t_I zo=~R|T}&C5r7Y#4*{>~1_NANtl(uE@W{@~WL-5WYXUaYKqXT zJAryO?{;9)m?M%JEJmQ2Ur%mLS>#y#AQYEN*`+x7u}3P{+zZ4V$NesD`{*bKm1Esa z#VPizGx;nbmeUMkw!1d(qrd(mG6MpcY}2~zt?0?GD9;>@{_z7@jwf|e-k+|38u&wI z`{Bt+d|jR9(Dd}SnifD{n3eU=sE<_3z#tPBTTxN*VM0!JHuJa4f&v-SiZWHqbG4_d zq%%4B*=*C+?q59kCpVZe$ev*DJr*VSmX=*Sd3em>CQ@Hr4Kcm>oaN_qTN(a*CZPpF z8I-O_ZNA$-%EB6upOwZ`G#~*%#afs~`9Ejvp&QZw4P8BNM3&euNcPaZy01ZVd7aygjC z(?m1G)>hB3=9$q6ZX~c2^t#Sc@tVa~+3tIv9p9X}loSqkAAnIr;WeyK$ zhY-1qC2%-31)hq8JbuS!;WC^XUNerSeCY6L#sWHia7?gr>LQx^fKl^?^aaqskf2hb zlcrLuU;B{5x)hh_CEWPLgwD=XosoUbabTGS+0xrzs{8xF>m_X4Qq-Rw-_Ex9k(5PI zELlmr-V+u}%Wb8Y0#M)pO=>Ief;Vw8vW_juFaBdSJ0s)i!NdMcT0?OXfFWSFH1|(3 z#*Oq$xe|cVgHtUQ$mPodxN;3pCS@B8UI7?N#w#KITA!qH#8*DYfqwLSruyym$?R2RmD8eggip6s;ENS+=Q4sjp|vUW3EN64OE7 z%^uxT_F-(Ts$njN8P|havd51puS5w|H8)?QyZWJTvln=r2oFuXx%8k_^}H1LkBsT{ z9xVSkmF$53?F9KdF+GQnwjit|CK8F1bIJhj_bGlM3+;u!tSHnH(I@Vcw3(`?v{@M1 z+q`i#`b=@`M{!eipZmO|{^1%En_Gor(Zz|!g@McC-Fw$z=S!LHD zObMxnpV+B$dq}sq6uU7`es z;@BRl9UMz|xHwmvxoES#oP7TcJ+;xz#XdG#>ol5rKBa>99|+gN_+x7;RWK$oB9AG3EFmw7OPqG&+^wP4S{>26%XZ5 ztwLN;2Y|la2Vx{{Ajj8L@Sz2cz+pS;Eo6?-DeD1V_ogRsh$QpHZ`{wmOIfVO~|J^r1^ zOkOCD5zhu`U+3a(ti{#HSl$tci$ z_ZJd(1ed_({rTtoXVy~Z~33k{K_yN zJxbH;e%nX4kiVwvB`n-jb8v8ID$8=EPgWwd(cLTDeMkZ(|sU>_44&Tk3Jl<)pA9C0tW3oqb@R*~bdoMxvg z@+l+n_g6g~kAiYDt3`!4$kKI4yh_1yXMY;|7w74YNoqyTd3hT%(_AYj9;;oLebz$; z-K>23L-iP#CvJ;~I6=-t!MinQxO?}n4J zP`7%O+T%w52RjvYhlu;bV@8|7xO*CAm9(1Yb^4r~lX;8}V)t^dPCZT|R5->h(i1uN zlg>mZK2<;$MF>5nc+R>@$c|l*RdVmuYh5(;LEm2Ocf6HR2~Tz&b2;<1i1*puDM>me zArfjBfAT7~Obt1dfPE%IqxP9@1D`+Mok{F}Fhl$xQrKJ$aLq*Z?ebJu7{7{2RW72! z1a~4~qR*tydtu~jJ?g)B+%+||M`0ASM@LRZT*_(B!Ulk@8Gr(RQHMd%gH2ss639_j zTQ&+y|5A{p7*A=iNiHI9BBDU0n8Wy; z5%wPc1Qdd7LrF3&rV3nzxraGC5X?M|giEeQqRB_1x}v4{4konlc5TbpwoeC|S9Y&g z2*M9$d;lxoHCn-^|9P%+*P`wWf2F%~5wp*Ersi$iN0#LC`5Q9m`pYdY?dy59SyuLZ ztuhsWRKbHzZ7Ye_Zc1&6s6e@F)b+W!cIjiWjjl5E`UWgz*9?lIrI+AGM=y_Tjh58R>e0u)c!6Sf*t% z+lOx!0Y+$mTWlmKvX@E~ODq^JiTh{j7``(wd5=AA_v%_^!q_tTddK2A+X#S>0+*V5(XN2u=>vMeIFkM|e! zUMU%f3dyhH0{zfh=UGn4el^J8Hfn3fF>`Ia#Bp@S zaGl}x8goA0<1BOKN9(!R%(zc>w!{HS{o&@Q4N0$;(qe6O(Zqw>nfqUH^J`f5g?zM6 z;_U=Qj33T~Ez&213Zi$CaV>=6gS7FqRL%*1Z^Wr)w~>ITysSs>bxOc!mX+z4ni6~8 z6F(?Q^6?8?6F*A6DLQkXNPF&MBQuVoTMe5kPreMv#t-})1zdYsrVqoy2q-;&BB~JC z{ld({MHK*jVBT9poWIX)b!6*MP30&AdWzlP(}@}|GX(fSBbK(n{;5Gd{dS?d~cBEO=!&48O^=Ipv!?Iv9CLKtBjzmvelbG99WCwp#J&EqI~rKO1czuf4} zZRKX~p}Q}ls3S3+!D~I?o^MPee);yT-0*WD2z$@w8N(ECGlI?%36@aRqP?V~Ng%8l zWD^|08buWkW1v=!&&)4Y!4ix1ly=AyU2HUCc z9W{EhC;4W7SIx?t;tiU+^hT2?GnlKwW31-<2g>n_5n^Cc`Mo{H)S2%q@M%<@vf1?z z`t_>VQK#t{YQ^@W^7`{nrW}`_M2v3dxPRp#5wJXD`JGPY?L0&m+;BjYKz+Ys(%L{t zse57}1TWEZ7a;X5RO+U=E6?Boqqpd96g+m_2cLS2nN5i&N*j$7Rh2Ezi2;pNMzFqN zphKt+K{mGBxgOQPPVBE%oovruMJhU2eDMYVL4t$U4tG%H5!*?wD zTQA~|&uJLq2n*^T+wo3_0i!V{qdaRGs7GoJcF?KiZILxpDQSPi?XY21$ z>~Bmn3`X0(9L=Y8TU8$mcu{*- zj&_swSgwj$cI$JBrn3Y5ZlLD~faNFE&Le*bUUjJFy!M8h+v+-bC|tm+Q$l-dTyP6N+9g#WFiRLITMa z9S4&%H|8^rSCQYg_>M}F+2t~&DvZVz@t|FIk*aX^MtZai-Iv;@@*L`qdI~a^Laxq_ zax%&&RXZN&b<^JVwtrdv2^a>j&Dq9Gk`bOpLR6J!)fGMiqM zg^L_meQ6#lhxMM#JVw_(Sdq$*B_hMXtU2iAnnanzA_FX&U+(@Z)jVjCYDtDM_ZNjm zwT6Xbt8|Tk+8dyZT!4^^tj;NWxFEk}I2VAPYHOMq)IUq5n^MQ?^g*^mX={v^WwF`k z`=47UmAvnH7La_Md(a*xZ@sQto5knBrelW=q^}=6MWv8V09wxa8!oMo^E(^&JeJyf zQYpI<4o-IBZf+{v%{thskC*1qxf%9N`PbIH3M=}ER%IL5b#(L2s`}gp%7chK&dLhn zx}rD8t?KWXKE2Px40<2xycHd7^ji-9+Fc5ayMRFY&Oa+ezx|^o=-oTAshn?&%ecMg zOyxb>J3I6oeJb^g3_$dNw> zB#8L9FphexTaEq5HlmeSFO++~^dXP)M=8EakI*Xjo-7)mg61E1Gt1!KIz0Tb^lH573U>nQ zWZ6H4F?$Fr>)SUR2A`qstBW4R_fsPiovVtp6m9=$0AIq2S$`{-dm>1Lz&)l|<8z#r zYiEEPps5x*Iy{Vcj17>;)6c2ZxyHuwPEQzjL5tLhfNFMg!V4?rXsIXWl25jy{Mbdg zQw>)DVx3olf<7Ym%!~u^oY#UHqeUV>b*yudhHq-s>`wpIt9`pYfDEVvp?YA>Tjc=! zwCbcv_mg8eUW&n?!?ROh4OLZHTOq)IV>-a6Ef0Rq{(L2MAh(POaKvgSM>$2i?(6JG z`%?_pKMLZ*$weo=OB32ocvyt)-y!a}oLcpG zPBvKUeie7tmh3iSTUsIdWA2Okq*ke8ERd|achv13p9tPRRa@CfgtBP?7S(Xig>T=e z#Qy3o)V`wf-3|2S41XczVk!*XpaIqGB5C(3{YvmhoO-;+wO{@7?QOGiT91Fuop9nk zcbm>we%#>jL$5oy>@yi=%-^SJ%@FO!{4SX{iG3-kkQr5XmKfbkI*D7-Xs9qAdB*bY zyPid|wY%#@FX6$=z=`#YdCgr?L-j)KI-Y4@h*k|v5tYax{_0{jScz70J$ray<7dCg zHPPvw!K>8C($bY7N9kPqR|G?q&HBd?bG-c;rJo}?kr z^w8aKB?+J08#7Or&!tYL6cJ>yWbJB2x)W}N`rxHB+)4Hy*v}8@cu-v{fYcD5&Jz=C z?RcK8jNJ?;@Yp=d+VR-%yDm|IxR&)m2L{aD560?9lGdEf9&1UtU0#rWaCyBju3tV| z>AokkIa*Rnq=w*Skbdy$cnNPbl2@_u_SxBl?t2;CSVP|wu}jeHkW2Z3

ZY_BgCvTF`$)*J~-j%P9lWouNBvk8J+y^*@>6NL8 z48N_hlFGbvI+Uor<^HD~sOdW#SG) zr=}h&*mkcK>F?BV=tq34EiN9Mh|0}@s@FQVPF2}B_=gw(S1v5Tw_&mq@i@!lR9&Ir zgsrho~orjSFh52$ zJGRGzB=HpP2rQ}FoY+rBX{4du7B&kSy8_#jE{i7 zwOy8eDpN$J; z?)*{ltqBOgQD*Uzyav?)Csa~dX-hIil51>aRMd|A$rHV)Oszt7yAESJ4VbMR9vkaK zPh2jyu(uz*j~?2h_nugMcc%7jyCNk}v%6Hnq~c+6MMo0}S|hQn28;r3|Mu2aN6`l< zLBTYFK<@KGY1LV!9ey#4r4y#-&)*?>UXKV0$_O>E?RH`i5D=gWx$l2(Yx@9zv!BmW zh&L?M>vcki?8v@;3=WPB=XMM`X$`{Pe&8;&Q{&JVuk`x0HhpIdGJGw(79#D% z1+fqkI1RxyWvC*D;L)QcNaCRrazSq&Lrh8v+*fn7St7M$c=*Vh^{h4%6ORS9QnDLsr92Yo85-g!aMWys|V1YS>F_bZQZC_M2) z)ux^yx*}7Q=UG(h)!kh19p1gUUiC1^c+yJ0oKKPezCYpw%v z^WG{a!Xa%*1EMgG4TyrtrWC`Ysb;^>Ttn38y_KGLEYucp{EM{#ZTWMR?tPTgei0Q- zl_JcGnSch=uR^jLqhlj3WW_x_=otY2bjbQWGPv_r6aN@cO6=z!$7$({JUVHhm1V*T z$uIMOxSH|$GbsEJI#*U#XKf}YXEu;Se`{8iPA2$XfX+Xi{b~52{5^SfbzNYjY%KuO zK%W9M-%*&DWJS>oxRiEe&;Y#7;wW2c^?PJ@Y7zODxGeT|c9Q382IxIfJu58%u3Qg6 z)dpB*7`mLpZ@$Y!Ngg&jTh!#$YRL2*XNh4BK_@4h$PV4?PVybPGy9Tat0p)s9zP8} zO0dce36Uo7ZR1?Nhm?*1?{v|1VY z)ZVL^6l>f8pj}Oj zmSu_3rQ*+-udJ+M^8{&6_06Rbte}cQ_n5TwI=j1n$d0_Ett&5o#L-$#TF7P3-A52q zhECYs#h0Q`LVtaDku7g;xcHwe zKsIdRP9Y!XMEsUe>{VfjsljVWNd>E@s(y_BR3Rq2rir4AJPlm3BB?r?bF6t^c+w_< za%3c>!xdwY$N5lfB`dY1NK~jl1>!TzSuj#>NUH zxz*HM1X4kGac5^vK5p$7m=kIZ5+q13WDE>V_9rKkKPv2=yBb4_IvwR@boV{ejDiZT zo|?Puap52he;pSezvYZe%PA`e#XYtvl zXikrku;;3f{zJF@rdLu@>#t372y8_ew2;3xx$$xuXJlsZOzTB>_VEZj-rZ0T^$##X z#H4JAprycI1z}dWj2}Eat9dduN={)U2P?R1_3zm3P}L&MT`k~MNWdq9QvQ?i?kC6# zyFIf8`)_d!$vDEGbi*qCF8o!2$5lO30Y3(!D?pomocj4NaL@8B5BJ7&+2&X`6Z`VS z!D`wH5Jg*?lj^+EL#Qif6F=J^IEgSAR9nEVGZS;3CJHFd1QB{1)-*P@vwhN8qb5y= zxfxN?nm_}OmuAU#6#KFr~{*5qGE<$ zVYtbF3dfn*j^8O3(!s%DCW{LR$Pd1H^~$jXh+AgBmG5QO7RLSK{D&L-kptLJkUZhc z5o=LTx}K@DCld*{lqIIO_H6Q^m#1!1Osl{_%2|!Pj_B{b8~GfvXLM zhRnfO>l{FT^AHH}{HjQ&`Ql5pWb8kP3fqI~{EEIHok~bZ)QDM+6Q{NcBRhYWNhtlRLc`v)oS%R^Sj(PK%larHt(ASs7Er(*`XOCwFV`sEVJjxb1g0D>Ggy`G=|Tpsl!T3m9~;bg~!K%ZnDkON<(t| zsEOkUp$-B!CgV+mXT32fz!VTrJes)AZ7b|i-hS56`@Nj33Fr*^oS3*x5Re~Iivyo5 zbR!4FKS=5-IR|EiJqQ*65_tJOgds#A~f!kwg$2yY_sJK2fOYm zzE;-W*xY!BE}E7o*>`*#^3avrFp4sjMA8|nf7OgH?~}E;$5C$WebZ!9Hi!<~v@bu07uaC%5j&QlYr_M>i(zzQ5(WPi(6hv|v9*=^kccRR z107ph;;^yp!(A>1JG+rXK1c1%^Lc!%nflqcX~@R!1;ERkoM|fGI$pbx1n;J%SGv*I zo4NHc=Vs+I0jz;Va@_FAG><<@q--AN@Zmlni_-yyy{BwiGrr8d7dRB8F+pn1d1(3o50;Osrc zQ2h&3_~lOK@GhRbL>O2VK(NOos zMx4{$m)X&MXoc4JhYrUftcU1VDI*~X=<5cg$AVq}>XSA-x}U;}(U3zYjZhajgqu-* z?5$B!UasHjo#f*$p<$NC;dWlSotUh}C@AwG;o(kOHZbt{?%mhz_}Ew`|3M`MyP0x> z)s^m&%)TaR5;Y+^jEAZGTjN7RG$w$U-z+Y)zK-ArXxF6uvG&gJcVzkOHX_o;^04RA zSd1JUfk?G?tJqs`U4lQEhNs@qY+I%++hX-h0ev!On}UwW@`SgX=(8>MvG+jUI*KUt zsov8$$&{ehybO5w8pnTSFTaCNjg5@~k60#(O~&iL7Z{i@40&)0DXp5(%|Z}|QP$hp z92(|N&vZo>bhos;_sDr;=P_J81EkkQbvmm;$fpV4?8)D34h&2>59t|jWm#y|K4M>7 zT%6(dK&U&}4bLxcCpb_7Vr4xEi9oZl@87c@K6nrYNt=5^+<#J9AvnHz$ThnEDK_>U zs|1nr`2}&zNZAN=inhK;1}?I`p5C}`C^34hZ!4k&5od{OT^N?5iAmR6=lV=4iG+KY z6fI8FMP%m_@Mo1HlN(l#T+W!cCf^6(KqtAqNGi#6wZo^9G0@BfgdSR*D*;#Z`hL>I zf9LEx$?d^wym?9DB~SLHqHIS6kl*0$%uu->Nx6Q4STNajK%hf4S;lS#H^ zRW#n;5q;B}Y_6-blZoA8W>5NSTAEzy#J1!1+IP`|^S|=8ZBwn{?c9?aK zJNIPQHXwjI*B2jbGH$eh2BQX(G13gt2MmuXb;TBxw zlq0611_qTRy}`pHgVrNU%N%u6BX`%msv(fFb(Qoog?$pThcne<%fUup>*{(*RFk4= zMdl867q@>DJH6O@t)YyPvJBjj^~&5l#Ej3Gm3qwZsVN#kmN;DBm;hqBjroNeuWrno zRLB=Io>$Cl&l#4fw&Or`GEMER6k#OrH8KBcXC;6uLztud8Q$y@T_OlKD4EDLbCNNo zhYRCC3TXT}Ph0V$w^{wKNX`WVJ~sIAu33yyWKT~`5fFsu%aip9uzo|#QWF(vYISxF~J3S9$5@L*tV$fWmq%Hw)?Okd#QxJz@dOy|Y$pa&mHg z{Uv6VXjzLZyufn8&!hKKc#k)^-I$Ka`^&(9m^+uPHx zyxJsjqZZX^CwuH?dP711R43ncSb!QnNZQZ090>D*f6}Wri$$0hs0Q%eGaei#OxnXREJfqyy0?d;Vr1uKT^WtHNDS)n5 z84nNr__hO%azxz{04ZwqNf^JIy1Lo=hHrAFRkoo5Oa z=grTPKvfZFIZO!xyVmkx>``hqrLBtVanQ`m@pXc|Y|X60t89R$b^PW*RkcFsvj?O0pV+>@nn+}~L{{zP65wWt0RdirG8Z4`_%4lh(`fLY zLs5P*1dQCdSIbV-OFdJs$RzKuR}^-1Hn0MC`4;L8$#!Jnhp{f?zhzD7AmAjIo_($G zWMI<+C)qhNs~{sGIEF_Rl_R#;dr}|kSz{kQbdLI8Qn@e;FSAa2 zd8hpE`6-?Zq_zpa*g}5_+C32f&*ufN19x(w{1(5pZ8VIhGU#X-%fKS@mwPJJcyLRc^ZqWLj8F{rJ znQptX!tSr+B3n|6NtT=v@Kj_3X?fD$t+-v4C@erg1BQgv)%8?WRgaI-vFt|2#tiWA zqp>vb!p=wqy28mH0vD)r*=rFHe0o`d|I}7+5u=75Zt(``h3jxE;X^MOnZwrz*3On? zMQphQK?ZhtAtv!r2=2`YpQ<#D*n$o0x;XRA+BYzNTEXDL=q2lm^MSmUnZl5aNFbBR zqohkMhOO_}p3YDW&li$MNM?*) zoj7}xa6xjnE9$a=4Jjz6{5csJZ9yL#`VR*w&y$wzm;8-tothPu6cxMs`#+~!Y8pXw zLkM|{%gZaIEM!7YJ%5Nu>PjTlg6}GfVfSr>qqlCXZ#0%A`j3T_3aLP+ ziJ67pT5xc1V#>;Jfe^MX(@r1}pjLZbaR1~sGuU1h0*G|3S)2rmcyN+PPXIDA99&bO zB9+MXekU=8~PjxqNdDP})Z0iC!Y@2XSzD6gWnoG|{Q z=n;h?qU~rb44<>}aeiQy3EcY4;7gBJ5qB41ugU7?foLfzmS5hfKA3iN)t$;1Xw3<~ zHU51YK01C0cO$Pmw5pg?GKA@7VY1n*8Fkk_f6lX{z0iXe$pqo}aV68=axH)1 zxf^&mxSJae%pMXrIDR-7RI`eLoY5y)uwlCLq!I~=z>KCxe-~k6dYPJv!QwGN?JWC#d_-_ z{GR;pK&rep3o=}z!94+A^D_o{2c_xEN8TBWw7ptzM5 zF5ew|vuTU`woAyHbPRIo3YDJs`jR7G7p0@OI=m5|K4)W7oFtV z^ZJ$b{@~X_=cBknvTL{bsWY2-+slilFMg3ZikYNa*ISFG)QcWB3f3>lxcV&q`iHRp z<38An1AKZ{FXNH@kOYo_CFHpYyoN~?OKg(bpeSi%{6N2Sy9t+ieA0kd|0yHZ-jBoa zM_=7)0_~=cqHQ7{X~>o0)qE9^SeMQ=o6$)oGz{{z_>vjgi~bmXI_yW7sGoQPyT`TI z9&rXh`GVD(#6bwKp0+2a@vJJ}{)#^r^#rp&Sq#Xl9!Jq?;Em>M#P@Cng+$Y9Bt$s$ zqn++j03T|$vc~Xx@eT3_7<*E}{s+$ya;NrnGUHWNdk{Q6-Q!@TQTT*8V&}Qc>1;f$ z!@gn5vROkEHlz$b+*93J(tXeOI8xr3)d+Rp?(E&9h-XNJ?M z)=Ob7R>gRlWo{=(P8rRVG`Z+Jn!H|v*>m-u)JIVmlKUQ;kLGxO07&Z4E_-*D`sc-Sm7vb?Er z;Jx0~R&H^LQ$TPnd27ZZ@oOE71V|)v1g9!vqAWC`s%1onaL(fgmOKcV&?5RE-v(Cf zy<%GyX@?=m&en!Q5ATMpaF8gEk7*Ym4k-Asr2VAu)3Y#fc+-%HDUkpO@?{~T^P<{| zVv;K>&GsYFQwk`J`#K~1|I|nlIIk2cjGG6auK2FM@?JU3UACgkyBEdB;|lgzq}h9i6K&&XxwLFMX`q6x4~&g0}EFIN$rZdBb2Ij{Uv zgdG48-Wa8HJF$eMZp(QAZ9fGMXc3$R_)kK)mj-lj_nczzegq3)&USQ&#c(-jUg}?| zC;y}Pc7fGvttr*3tT~+5>mPW~-~VdaCl~11M^X6e>)=4mB5?4tg*|KO`|_A=l~~+| zu?TpeT9Ub(5i^cysZ9tAPnOB?n@pO?b)4aY`Wh$(T1m;iTqqFzSSv(1<(@LF zRyT{^B>yM9*QbHMGE&?*{a{o*QIVL3Wx8fM##qA`{95J2qHZP9MJ{$njz+1q&9|cLn(H@8yUKjZ8`Xq+m!Yn zOn8wWC=Kv#mgbeaAWz2 zDfvTNTjX=g8{u5AZ7At#cz*FyX^-z0X9+iq;hvxv{_*V(=t1Dq z4<@`1QGb6MzW^M(R-?BvB}m~tzp!9pM7eaqH?zCCclbOXYKwfnBiYb3ea8|4u@gt} zPRuvVl+zw>L%j!FtqF#m%a;pbq94>C-aC!|V6fo4=E(r|yULZ%1Gjt$4zL5bwEE(? zJUaJ@&h2~^NYxpwhfht~t`y*=s6=WJUyKEd^A9C#+| zyam1@l*%t36|flpdQ)f+a)+(nNwb&qa;c;Y{o|(G{pcB8RlRL%=kok~`LhA<#UhQa z#?iQv{N@MM3Zh&KA*Nu@zSo5qYl!d~4S=fvpWa76`4uSqatCk-AA*3D&&SD#-1+_M zYYhGdrNRfFVj`)DLSSd3ucoZ(H<(Q)VE|k?yAyC!I2ALrtsLF@@=H6yq)Ns}zG%gq z*K>&r$9VfF=W&)E5j=P;a^}Z=4YnBlZZzmlKM)IVM|^} zff>FSBv75iboo%C@>t}$gvRGkPK^Oo{^;x=x)&NnkVjX$_bV@1qgR0C+VCd$@;e}{ zefZ?Z4H!-S+eY)(yR|EU*AV2N>9PL$6C4Q9OTEEQvJiw+w1f36b@-|C+#v6QE!QXz zQQue?PZ#;>WH*t;h@u+_md6BDr5Jk)Y`U6iKtGQ6eweLL^XvsnKH7ExY3}TN z8yd-zoRmo#!Zk|3X zY*+F#6fim(XLlpCKe_l$Hn*9x{)I(QhMzs=zn82f5bp(Z2^}+r55ECIHnl?_UQWdE zvvNA)crWEh_{w-UCOC(?C|<`%j%U^BLnGTGj8xZ35e&M=^J7tob43it#myVCXUeD` z-o6(R2M3 z#n@Jwv{ETHf@Kk6CXJ#2y!ys8oK`6Kw5IN-L7BGvx7MEK=kh;rJ>?;HCUzJXw1g0D z7Au4AKY(Yjae%IG*mLr19Z75Zd-l^MT7*DC&7RbW;v;LbG00A?I=d?Mh#|Tg&^FPyE*)oenn=7NM0&Hhg~^Z3A1TuV>XVa_Z8ZT~XD0RshD?%rGX%pha6Y@kRakga2C+AY`$c<><+etg6K-l6Zo ztofj_%Xe%fZ3-JJ!vfnUp;i+QixO?e&y!%rrB?)`nNL(bG+mm{Rgym;3Iq}~$Ws!W zTn_0NZMdR$**@H>^Gf98)&)@qnRzS%u` zOOz4+OA@^7qpAw}Rz{zz_O03qb0vZV(bIbqNau3y_zGgguz?_a|5oAKCb8S*QY@nA zu|G`XBe<49fPi0DLn)7lPSQcvCbtm;85VmwEnXJPxwYs91g=Mo6#c#`Lj3Fz|3(IQ zCD~0AQ`oi_0U?lRkRV)jfC+))8jToW25zwT6n2u>0Ec-|PR&GReog09woo*E>4l?1r`3z}e>J_e9wz;=vU%LUY+IaXiR*oQ~ zwYKp8+HnDH+n~=N*z}F(0|ZWTZQl?RE0~e#ELX|OQY`6{$+vqHTG?#g^d~4Z2SiH8 zb(&O@Iiv^O_^FZYy{T>a&RaCuc7jsd9Ub1REN|bwy~8VLOAPYi|Nl_)m`Ez3q@lct zXGF(SpM2S*`~1z!Vz5s(>_jhg;dbuZKR|MHayAVfG)2PMngGPW*<{Ib!k@n~DP`B+HIDV5BRLWY(QuZuU3B?Q%6+#lq zU_z2*ELmp^k|bn_P+7(jvdc2|C2Q8P@B7X)ma&cfdrdvhbN4*I&mX`0`|WlAF|WHn znt8vk>pYM1IFIuyXQn?c+_ErmpSQlyslVn#(f@9JoF{D*a*DH`rz8{2)t&d}l`T#m)@ z`7bk7yB`BkA1O~ILM^Ky_`7h{_~&`{oXc1)>3h#%i%wY(!nHxgE~f<7R&iw+WX*56 zncn!;NGtNdFqAq&;LTwFyx$NfU%;=$@Ra$-9L0$*}?AZvAHAv{O)_60}r?+;m7Y=pt;B_sx3s+w))@q9tuLx z&b?pp-=GSumn^IY5RcE~;Tcd!pZitFDE$WaFaP-ixX&{ttbQsogJwW02V{F(CR5!o z10~x-eqs9N;%Ah1PE2~48AOu>Ag%0gNbB)8q&>q-Z9mgYyIph+8?YvR*C=>L_HNX? z@PA503g;dS%GP?7KiKy(I@Cok@r^#Wd#X24$t5PbS%xe+8G6IfjhDJ!j8%HlB?@+M zP^0Ci9lKLS^)eq6LK^*ehkZX*p@EZ!%`!r1DngvzY+kW)q}~v8o^A|V2+Pw19@o?35f!_pdR}04-U+P7 z3W`0^OqQ^>Im%^SJfCC>{(iYb72*x{M7Lm)=cxYcom|eN@H)hs%(#UR$m- z6YIUjupxO5rST7neawJW0(e3I9?*In{^2IAL_*Ff({5&s3uFH;jmRtE?; z_W=o~{_2>b;%#-Sbb3Hy82_p{pZq$O-j{7gO1U*7yzgH8g1o_ZH{{2&Hr(7AvxX1H z*|W+c_*TSqF7=q}pU$Y=k?GW)1zVG<2J$Vdfn`qBCvmeQ*4DFlE?>emI2QCZENDY} z3$CW!lj_aQ{FJB~;msl(?gOUt6oXu5;R{;b_lniI&~tINVEZmVgA=55S)o(1TP_G; zcQ^>qi*rw+v(R!B6!b__P%;pvv&e$#rs-rHuh^aLoR7)187*I4spksX6k-`;`>!YV zm!}wDn|qZ$K0N$4`O~ILv)yo4H_KJUn;JZP)WC=iR+t+$za$M5Ql#yhqTbM94Jk(ND1WD}&im2;UecT+O5b zeP8pOQPIy_bSGsdG4T!Q9-$|LK1gog#bPNJFH4WWtSD7a3>Z5%gz$~`oM5k7C`1y$ z(!{0N&R%r^W}o#@d#b1jS6CP?{lpP=*BeMuT~BNyZ16us_DN)}<4 zMu=MTeSsV@RV`AZQHv6gvfT&Q9Z6keVCnluJOLkzl>zfBW&YrgcXm_mG+3tu34PXA z-~NvUk7KF-wspF%XU|-Iq>j$=~P#-N~*$ zyOYG*=3F+Ttb8+y<_R=)p$D*4w=aQ6-plDkTeW;19{L9-eNP`d^|I1|sqOGbAE-3^ zFotn+=tYz0cxK6>N<61)-&M~3DNhJpnfvZa{c?XYmOoA-<9bSzhh)vcTC$wddlRS8 z{e`rws-s+(HmU0HV_L@FR>3wQFaWEz(Cfz{Tm=RM2)wZ!4bG!(QkcOz)HTW+nf7B4 zk1bW%y47*8emEo4gmeMfpPHY!oaIrb7tu2HAcLd7(9Wa}hlDqZoF0-hB;PqB1K)Mc zB>enrnW;Rh5iQ;Q-sS$uHBNW(`zg1jg>K>TA~P(5$*do)5oVZeE8kaaYRNdeFo1iT z9d&1~8$VL!T3zn8lMqq5eQ{W3u@GkE>nK#p)w@$LiqXnUvevH}8$HrVH)FG)%NNEXefcyKpq~`R zI#PYgSXTI2Ulq1=;C<+WPKMVv*9g`RTG5?*S&iphW%yg9)xNkjXNx2uyif=x{S7$Xzp zZPkR5KO3JB7H`?q?L2~#vMw2bEt$sn$>(ei*=rPnwa!ero1-3byK9{qZk>B_2U~dM zQ;DV6UR{Oujaea`D2^+hbk~ zf%IfU)O48On9RU~BAu(E2F2GP=9q4vzMQx5&nrQo9EkJ(K13S(*p%rjWO^`O&I;hj?`&AFMT zl!lCaXT=zmF1f=f8n8-p)a5Wq-)?WcH*qaRE7=Q&yQJW%5_9{NJd)OVb9kjz3-j0k zTCP9H1cUubImEMX^QDH28MrjR_7^UnrXxQuNZwd(yji%?yOzQAX>Ey^S+m%JmE!(##`h zLdIj!y!UhFcFaqQ-OZ! zj2oAig?c;B*DzP~WIkpucv~Vq&B$K1wxIIydh<4@3cGN^C$wm31_VH3FXUe(vmTX! zQ>jWoxh*Ih#I$u(oF5QtPRev^fxMPnXl~WR)OLc0(qja>psxJXwIis|7V*mNU^W-C zA#@ntsWg_wyL~(i#$dXTSxJTdfjg|4Tje%=_kdq1JLK_b)CCW%{Mvd^;FwY zw@;_iUGs6eT5@#c#XyLmPG+;BHD^m?`>n>XIgT$}RZpo9@C&yq;g|F+-Lb&M?A2)w?Xm-I6RXrl>^RUA$w|LP%7 z@r;=+TFV#=--c)@-~G9BbN%y!6A$d?ZigtmyAD&z=dnvuIgErWgCq|mJ7PaTqrRVi ztOPui>Lj&D#@Aj)8TdW%4;3=Ocw9ZicnGVg0;WPv;N=c5jFM*)p{NYK{7Wdu9VmK5 zufWNmaHH6=y4bN-@!Me3a?jw>>rTFJ?`ymmkEmGj%8w5ftycLm)rUq*Etz0%$7j!F ziozePlPRUx(at zDF<`=T~1@QWaDP?mOdhfY47UNQ;YZxKAU804|5wcDY^U%Iz+u)n0d`(buI8LQqK|Jn!Z zPBLenT~v*4xJ`WCVl#?^4Hb{~e3*{3DG%6u?JV#VD@KLw>BsJ`B|9K)*pU>;v;GHB zZDO?lDM)^|K>zPd(_DB|R{ksp$BDG~VEij#uT-@i7pV-xg>E#*{Ik8V1wV)-r|a7L zHBy4UA>_#}DHBtgOJ-L2aD=+Gw%y;b|IlbF`2l{FFD)VyZI0Tn+M=!R9tbbNF;kZt zlz17&=d%~jcxDYO4-&<;F5LHh8Iepc1sG@+Lb2PPbaekEiQ=T^qAsdoVF0QVP8Od{ z-uXcR82nzD&D7Mzae#Jj<)^~Z$a;{gmlCoqG#L+m_(wo_G+1~^C{jame5|>4<2FeZ z;$y<68LfCrIQ}L9!;EUE{`lGoovG!zjoO;lty6L#Z997GUTt;kMPNyS*qYn>?+Y%& zDr8R;P-(jy3_Djl7tJY~cMI5kP}F5a2xUm~KGf3Jkz?$21DTbnMpgO%6o^V;ua^>j zEKN0p8m-Q>r05rMt}D5br$ROOeaSfM;d7F;NN*Oy?O8bi7x|r4>_HUtQ(~yr?m2&j zA0E4tT$4pz?qPNfJcHFmY`I%@G3UjmW5zNScX})KyM00{RqY*b_%$@vN6W`wLL$*E z620&6aV}pya!BWrGjyi&HKUs1nr9GM`@+z*HZSuGp`e+&@}|5`T?xd3j))fz&1B*R zsmm?1iX@@i{>`^W?#MX5Axsv3IHft+9rS8D-QAtEQa>J9DAqWs!I_+56oh_KTF1NeCDO3WTDqHJN4fRv8+TuD`;Yxwg zJ_3bFZSlpPfmi;lqI4BI!%HDAwe436D)x{HMe~fyDO{8v96G0s;ZqUG%^(Vx|Ib;} z1|8`%g@CJnpjEG%v0yd1*X0l6^9hF6knbRGnZ@)AKSITyuF#JUJCCZ?n{DfgGhkYF zoFuH>WHc+CfA&4(B>SDq*hyKhOcr&>nElj9VZ53TJ+Cj0S z099=oNn4Bf>day9&BD>$87U*+aifgkp$eo?Wu!JJw7pP^IM}SH?iUmcIdwlKY?|u+ zD>39s%C1>!RA9_VINwSnjRuKSVAY?~)l;%m%2Xa;EOQh!)Tt9s&noiPt%8wI_+jA& z3#?ew0C&xIo0sw7j!ng$6IsYF^?VnEwvxFE*THyFNbGxO2%qY!ntKb$uPsQy{1=|w z7;?qKCaKHW4BriYtaIXU-x)l(YZ@&!2n-}&*M74;ii&n$@79gJ7ekZwPBp$UL-TS9 z_m$7DJ~lQ*S8dtPPR@E(C48P$nGAiBdOi=if=$9T-I1j=TyH?L1Qg0i&SwFdHT9mO5w zR;(OXYb}2Qmwsi0YT_OWz-f z(VbAu;xhfDPBoh4zD}6CVr#n4u!@JVwdNIZs@&qH`=9hJ2HFLV-)v9)jk%v3JGSP1 zwEV(YU-yL{xzRK)=t$`J2r2Z+*JVRYQ39KDKox9-?~CExXlb`gKZD>Oy6MrH=qAyE zFIs3L-Ykaost$6zHhf&{agNJw?JQVoA5yPSmaZkovZkOhXkn`IG40Ahhpp>k!;}w~ z`&)SU-iKZCaM4!l8lyI3=loiZot4O7>b(y>OOeN)~INQ<-Y#7%A8iofTrA-8i) z-w%>x={56oSb{JSuHQ7F`rUhF+Pvo|%KrvB&yB%5e?2rNn#N&|EWHpe(U2}%Fh*&> zv$iEJ7}KlkrdwB?sQGKC+dS_WIq9^R_N^z3RKwhWurv#Oxl~t}ILi|x`}wb*BW1!r z0~Jbjyl5Ori;3JpE=!7bQC><$Duklvqa$wPmAXemTvY3MCqnM4!%M;76AUJ>(AO$R zEpy)6icxa@)57PuEh|?rxrYD7cw6YhVT|-fmzGANr~-=|hHT3$nCMdXud-hWZBxVVHVVIL zia%ysAILE|(Ht~cRJOBGWGUJ|&%B&+XgliScydgO#1Z6UVa+I9wKn-e;CxHSEYxo0 z^Cfz6&0Tw*@!^Cm2?5P$CD&BAzTOE^>(}*!w!2ZuMeWH<_`JbWM8nW-1+`3Go>AKdV{i`81lGJ$IG>ga{v(EGcE*h zi=RWrVeWoku9?j+6~VjHB*+wEH*GhuN2bm->?>Tst*{B7+xhP0{k(N+TFtcO^S1p( z2sgsLNTBSv_Wr%f&2Rom#ocdS8DfY55H}WpvBy`~LgsI_K+5vE>C<(1@1V`m0Qe@I zQ^(3OA@~>X*+EQni4Htz$ey)}nVM})CzVqmTv_CKbZH1o8pGG<%NVzvx+I~qbbumn-)Y_MZ`CKvz+U!685o+}57# zz2U#w=+?D6gqn?3o=V<=qSqd+T_iV>uQyt$M_uPMbS19yhBzF3IP=-D_jNti1ZgX4hb;GSoDxaQsj z$CK(eC&rT^t?vnTC4+w7Rh(tds}c=S#f?qGfbPv~qaRv`HJxykmoBVb)I*Z>8_NSrL6HPBl8h z8{5xXW-wa6)sy3hgWYGvV?o#j+Z#h8#A6= z@J_032ou?iTsY;5`70Y5PA@#*ATQe_52iZ?%oBF>Fv5dM0 zxwrnpdVlvlS!->46<=}J(7aBZ@e>P;N|QuD@4WSZFSkK1MLD?e>c`Sqp$X9C;-7o& zR&A&Ie6D%NBm%`KVH0ItJ|i-sZd&HqcS-!=Kb!_l$ip|Wc$u67EMaYHlFrd zi~52zUbjk&g|fou`wn*T2VKN!j&||2;da&hD!5HK3s#CDsn9)4$s*$zxvQ6hfp|=6 z#MWd1FQu7R2zoEdM5n7_&aJCjN|gl{-0OH^*kvpt_&FBiIpJy`Wv2&_g~ z5{vWg{6~^=MA4gd5D&NAhWg3JNm`W!j!iw;H_)XIUBul_6MeV@JT$FJc@+ORpp=gf zDbyeJHNQVdgyS?6eFvW+kBpni*#Jny?K@KU5Qjv&Fk_Xv^R+tkkCS0dw^qDk4ZjFs zK=mU(apf>l!*qNw8SBmpuIc;02#+48;+NeZb7wI* z583S$x@eq*uUAHBqb1O-gI5=aH8?K>CKBsD3!&>u#21w$mN6sYRP75hu_0q_;wMeN(D56UAz6Ant2@b3EUK1nUjV? z={xfdTW>wCdvxwGZPtG8!8T$(ul!m(QH(=mtaG&C5&NSDJ06qp zu!WC@F<`$1!vQAc%&j8GG*QKQaaZu?D8g!0k2OV&Z%k`+>c-=EGFatPZa zNmAt|c~V31z0pi!iOAJ^9MKaIHNK2Opc(v8oeF_!DP5_nn8X3=OTXkZtjYf)ji#Z& zh*1Asr+FIjwdrz_d6{M0cOPjyvTPawE!va}_tVSsrqgblNDa5t^}J*@+l^*{l^8`# zzC0vK@APsvc+K5O$UYGj8P^S~U}ptYQ>)(FK_{JOVptwtVp?{)7PGVsc(QmX|2!Ob zk8znpt=`Sh@lsb(ZbJW3BPW@p!s#~k-p&RhcW}O7aqj_qv+l{b`a6EA;UtBr%^vs? zFN51cUrwTGLhn1P%!l_NBkFgp9(SCcBYQE(o`DI9J-p_fb5s_USu`6{(zzmT)~eVe zv#Rgi5AaF0acv{_g+yF!+N}JSA8J-OCPC5B*Hu7&D&Crjx9-wUZKp1F5CqbCftJE; zPCXh7?6sQKDZzv4G*_kLl+(7_BIV=5i53jl37r!y+-N#7ujqvsII^)>ao{GsGsz(L zT51Gi4^0LX9Ve3aM@TSnu_Sl)qw}aM1j7z%m!NaDE*H0IsNjAeJQjM&dW&SL`K3Ts z-+9kbxir~KZ%^>Yz%6V?01ZYC(CGVn+l0oeLi$`4%qx$EZtIRG1j(M<*&uS@wOG$f zFo7x?Ey-+yR28=I%qrW+BKMn;A}k)F1SVh1f(f56STjr*h&*tP5S!ZF?>_D9`n&g% z?mt^KUaOgduqK8kA}aQX9$#));S5#!1r(FDDmRsf23+tX#+gkg0FEj%(%O$YP*{^i zT|&n_Y=gp?r9m=|j2B!V_u*1UE(TEd1rd%t;d+bZu`Zhq|1gVv@3Ec!{(;uPgBxMG z!O3fTJ9O;}4s>Kr7w(O%o^*UxDe1*PIBH=ewj=IBN<*TBI zOaX@IdDAonS5EST|9VLt^5?=sr{2Xm&!y*&^ZEz2J8`+r!(qs?&f9CB$X6wqDvBIZ zq5Ch2ts)?BP8_mC%Jkd)2ZpOxTrW=yhfnwnE%mmQ3J_x$M6}4r~;XeRLAMorE9Fzhd?(qg)(OW|M2cX zuuB-*{4Q5%-v>w(Yx-gD6t624of6%F??mq2`0UFEy$z;%+JvYKUjB}V$&hQ%^`>OT zmtO6m%kXx3M4G%Ik+boz;?Bkr16M8b2?w~Q^F@xJ)12~S@Z0c`YRo%>AR@8dbrt4p z2Jh>kBU=}azu~sAW2~KjtTXavUH=PLEk1^WUU+h&h;>DRdAXM8l^E?p86{hAZRdrOz$EDmIE1kEE-fSCz)yRnPoD^4gYcd#28P=G~w<-nXrw{;^UR#%?n++@mLF7R`KK21xgdm>VGQ#)-}&Le7xd^~7YERlE#W9bxrmsXF|`=IFsq zO8fo8Ucj8^N`1)Dx}29w)zMsaXoh=_0ao5<7RP_VOo%S7zj~d+*nA0ku)8XccyRHL zoJ{#R#}62T;V;Ste-KuCij?+hixbr-xR)WNj?X$Z(gFa2yi@rXan7Z-}wLO)I$f1E}ot+AmjcNA?D}zQ1la@syM&aDJL- zzxlJDy`T?S3hRQnYg&cE0S?<}n*DM(#968AFFDQv&rW|!YMMqGjKucGUy|#Rh2Qwl zLM?5A*|=ujuRC!tG>yRHf3#fo^YP-V^gxUS#!4vM7-QM5mga<{+x*0m$AN1#1aT%b zJ?8B6o+`ZQQt8>UrM**S%Qx~aj+Ho8zgfP?JR&sbf4oF?aC##2Cy2|Zuw~Y2^-a{} z@87?lI(&aJ_>qP&m+!>dd0vgSSv;0OccOwtCSKr*$JQ5-+nv`xqg3thG{$FM;v{$B z>$wh;9+jch(6TbNV>i+KU2O6T-s<(!(lX$9F)CTdj7IEl;ccO^CX#gU0xR0cNn9n} zlH!GaXYgp-=&42#`=kiok%z7xJAQCO`!qqka|?wci}N*V#GS}{4BP!2)7qZ~b% z_t+lM#v`(hTVpV*eA~h=!bAC`(1oO`@oJxHLRJ}PmXGkXh~p$_aFIN@-BvPtLc8QQCS z&Ak8rovtZQ4I9`b`}^WoqR#!Z(ThWY;157`0;T=M-ix2}+Y|KnC+~9l-V=!*1H-%wrJLaX3ZS~_=tVfY4V7Ca#528eP(yoeb!zy8#A-nD>yOSw zaeni5%Q>Gl?ME9fYs!L+OBnAX8`1`^bV%4CwK^fFj_9AIdljXVd#A(@ zX!?4(HlkGHrT^^(@DP4Q7!R~MA=lORS{02Cm}cXb&&YzQ$n^ucgH^ds3BkD3nu2`9 zNc(yUGIRZgLhoxudpR!I51bk`@rL)y5>{5%H;99s<_5Z1=9cEL&Z)TOxu5;w<6H+W zaf|tc-Bhg@f>e#=O(Vpb1zB^=`Vo5VK!O9U_4|#F{Bl_78mLeu0AT zp3$kuS;c{DzsYNJn0VO*ILo;f<<({whP%)Yg9`{&PO(Yav>L883=Sn@Z{r<86_TDl z{${*Yn4JM)l~7}5)}$xC`)eM~>)fb<6fHSWGHj{Hs^4kCbE&n(InYMC)Z@U@cG<^k zI#r;CP3+N`f=ai`95T*}80N9Ehz|-3wa7YFkw?LSmW076gNy9$(g@Dr(pHg1m_QG3 zY(G4}YOTf0vf%x+3<&YUmisgDRSnk#XpZIG;x5tiXQZeBH>|cwehDly1Y?B}9*YgU zR6ohSi+7eQd)<<{j(OJ6ICwMw(HD|h*6sT(PB-8#5>ev<^a8i9znFS%ARidRvVM>B zoY~6sRbiSD0>gUA1}prTRa^NUNFRHn{Lt^Mkpgz@T$8J9cP%KoKuEbm@a%`!*&eu! zn(@W_jQgz1VFf*V*8y2AHCikIiFsF}3K~{iA%b_0qJc>;cG}z)&b+MrBiZbGuc51G zlyvv*r}R!c)Gq6C!>v`h1hz7CT)X~!ks&xBk+ zs#Bw}rGUi)6s`%n_1!7W_IOxCsd|r2EM6^gX((z&6I+z0mRG9PA8ZU#!*Y$yNR78hBuVx46QKCegw!F1O?VP zgMQp3wIpg=#^v(hRke{l3MT7z27qMhv2`iw^IK?{RiCY;^uYV0<-_fVMm14mmdpzo z1vfPRIs;=J2}7=jq3DOs3V$r!UkDp<8AOi1VYj|}f>YW-@MnK+a@>fS0Y<3&#-?Gs z9Vqu!CF3MY92!C%*0Ukp&rS`;Yr6c@EPJRs%I`WR9PvrchF9N}C^0`BK@)=3{AoMg z*qxVXH;~#=ZS~aP$87X3&jRwcV?lJLwLyn7Js4X*LVXJg<|u#bZ7Tkyw`mWIQME3b z4(BDciw^-MObD(fUqA-Nvv3CvzqI5xXY|M%HHrr9P0&ZK6CAwDtkarM_*!Y(_;t)< z-jh3*(df`kNz{7h72h9SBfDGZq=p#pM$jRgu*Wk6$-PevbFtCgHLed6wu2A2cyzC> z?4njpwus|(L)EcYH-K-`YzyF{praG(7A{M}o7D_*`}cLBiRI=)bkTvr+Ke81TX+xO z_>`>%;W!$@%!*P+n}ni{;DvG+Vc|D8y_JIgiJj9!_90#bW>dmheVF=5UVj-6~YDn5+K zhmV%8)Ul_GE(Gns7d3Jzp=mNASu$Cq*l7XvB;xrZ=+RD-*~-+Tr8%;48A1fLh`yit z-nL8h8nWYT2E(Bn^M$zD@VA*bMB~BOA%@rM1?fRZyfVQ81cY($TkoNo9D)7EwdXQ3 zwf=0$?h7$1RrHW&gs;zRw-rLlKP0s^6HL^ug!};lDIW*GJbRX?{?j*qlk8`>sl^vP zHPY8EK1+Iq`x#c?^Xa(hm8g+qVt+}pk@MO`yWxTS`BK9VjcE!uejM_DWw_iRu3xr% z6JwP7ToadQ3Hlps89`8z?WK4&DNxKjd)Lc`8#;^VYdqxr${X3^KYYLb5TYntj{+1q z)YkJ>(*RDK-jBXv&yP8ScqDP=Szn%=NuliMgL@-ZPW5b9I?}!o#{z0>wMZ|GEtqtfar9eawi$k;FmX{MzyB`&B6WEn^eIKR-_)Dc`HA>tX5gHO zo>U4Rnmi{a<@bzwu zX7|T`_SZr>jh<|J1= zv*$A!F$sdj#O%~=`plUUfeeKqLJXnuDt*v;@MDdu#nN+3s~ZoxLfCbl;Qdl#^-_?x z^Ds)6ab{lpZTVY=UGfU~Eb-B~ENDrC$y5k=`mCE_`?<~tGl~pOSs`bhbvdO%FL$J8 z!-uT&Ra~>n>DtEn*d`Nf7{$rnAJ(25-ScswYe?nzBgmY1?=1!x2+AmlJ2MFc7rWA) z9)n!54DAfql`gZWUPMGex%hhOz1~SJ4cPnig|6ZbGwCZ4_4Po!UE^B!Is0m6T=S~o zU1IrO>!9P(+0@CD@8GDQlm|6zBrMo-}&cbflhGw!D+1;8@WXK!JBQeSGne9Upes)RYQK znpZNK;p2OqRlYBc;X;tQkCa_^os09CQ0-4=h;|tZ6;z`xd_!0KCEcFEZ@u7I%K$AW z+37aJd0CmTFex^A7VXv6XfE$gGxd`9b}|rarOoB)b7pl~hDIWi`ehc5eZ`JVE+e-c zhYH+WF;qAQD21tz+rMi0bpLJ}&N(fftr1c|zFKxKgN1PfNE^)k4Yau-=KyWOmF0ho zW;^=jI%+Ywb2wK?t-au3DaOwsiP?&eI8rNfCxYgU%b2*3 zaj?gvh-O6gM~266tp9YH@0c#sPKAnAMAk^>j}$%B71#XO8sSv~v)CM%+f&8gv$%u2 z^wklfll&NgWVdgxg@6N{q}r*N}hX{?v?9|y`4ZBeL1Bf z)e?kMi%FoXrUR-c*M$O<%GySwaMqkdllTY)j`e1Y7^dD9Eoeo0U>#UsQ(u5n=ak$3mdX>+By4 zH_YVM-sYIpdrhj9pG7!zxe8s4xo~^2+|?58n_%L@z(q@urI6=|%9q1Y*OjY^gX9_% zg|5{9ctw6Cfiwv(qj?yoM}>u!8?Yf*FU|3_9<}pNvNthZqSc+0EE%jTdoPFp-bOt+ zpBxsqg`msGfkGj4eu=u0$pJ(1K0(5UXWXFi(XT+8YO#YO+8yure^U0t9q7vJS2Wt& zaIOWl#MG-j34M#}`%WCZHa39Q!;|MIO@3iCO+WH_l@@*{LC?IwGm^_^m>$5EVkVb;?1Y$I-Mm z&61?~Yo3btE8&6T{I=tI=kt|HsQ}xQbJU@rXa_^36yF&N}+iR|6Dn$@m*WXq)<5TV+rC{^(T0(j*z<0C>@4sPz8sDn7_R>Vxh` z8}rnAwL$M5dd6?cyI+?3%}U}0$_`ET;}oy-JfBKjUZ^lUkvz$oNJn}^?t{3$pUBup zuhg>D7w}Lzl^XF9$XggtlJE!FJX-~F{x<;JCR%B=ge|mvE`-tX>CV6fO5ELMf}Lj} z<-1p-{P6Mlai=2(FdDG+rZxTH1$2sNR-TLb31lhKCq?BX{iT8R{x70V(YhmfckbNLdH`KV-Hr>BNG!JoaB=NJv@iLgx{1d|zZnbi zmsABQp5Y|-F23f_%62-NgW*J3vps11t;bFpo5=1k{A7?*vTa5W z8ZX#r&=l|Q-zTx>CfC36cI3&F2N@gu{j93wZJA?e^K5DKg-G96qCKB+WJ>lGWcz2| z{=Dw@&>}UKsc%S2%>0+wh)axnH{MQzZvNO)bi)gvV>Rp!MLd5!Yi()QzN8YHy7FElHcMk4&sO-D<%Sy z^tZ~6Z}0DT*){Pa&GZ*d%wf;yuSM(1Efy16!G<4UT}pG4^rBJj#@t>QuA+<)VVJgo zYNsCs)KIV?>!kuk3`y_`D?(BgV{d|aFQUOnXB>-a-*`05&45m=HoTlu`q-`2N@!pGY8W1 zSSi#@)8Zvl1~-aX&9&fjRfk4jLZHQRPiP#dW`M%*85Q>K-Rwj&Cf|3g5JP6-U5sJr zXRv+--H~gO;q#0qFN|AbeQxX4$oA*M)45}26XNaNUEu>I;TtS|AjnOeBz3xlww+N-X6I1S% z>F074itb6bRb{nR>!^a|o|9qvH4#a;bvX+7v2)GVYRWGShN1 zp4cABwBnJRhWZiuQPyI-krriL;iAdI8ng{-d~7Wl3ows;1&pjLyHeb2RT%kG9Mof) z9|Z2%x!=gl5k;-JM*%yHQY~hGhXRd*>-q zfvzAl((d@*@~U4fe=-GYs05S#4DKqF`9Eb_N$Fyv+gs1s^=P-AU3~7ZQ+7?Wuf*AA zO~>|YqV_LUc=5X|J!)wj@E4j7sjnVfhlpIVj!USwg)cnp-V4z1&D zao7Z@Aj=0=nU+mK`zpA|2*6avA;9Xi@m?5fPpGfT94;AB)B*%)?=_S8DVe2G_A*Uo zNF3lMKGL|f)TK<6I1&At10Pde`wkR{f~XHd^cyN_b;wC~^(tl89bwloEm_pV$KNiN zf3;>@<3!cw02w% zFvi@N&oSP>lnz*0L=&lHCxg4i)zPiKR`F3{etC^%GC_p1I*6f1=PRbZ9aQRSUUx8m zkjQu*Mw&|)FP=NBJ`Oz2)#01!jb|9%ZA#Vg38o2LO4H384RSQm-#!_*(0*QL`oW^l zN9CX0K^NF9`HyQKl(MDl!wkPNHFI z`>BDMaI@5Kxsbcl(C5ZdF!FXHYl&aYp6-8MWfP@g^Um+xAFuMzZEm*Z$6IZw#1X+e zJ2xwxxyx-o1ZVWhbFwd19F%vZ8wQqM&_IipZ}o$=&Cml&JC7=jE~Qg>K!wdbHWK6iX*kL{= z8@0+2T9-mMU28hJzh@pf`s_q=w766{!oz+s+EyNY_7cN+pOYMPV3h7twt-FmAw;V9 zNqZnYv>Tit@HdAIGBF{eg|p77*mAz%=R{EhdE(32C9GE{C1VYpXPh2W7 zuJv2%Sid*)jLpjR#_8Q333XN8^bbzhRII8Ggfw>dFYp!MGCG2A zEim^9#izsjlKPnp^uYA76yw$khByhN9B1j==&tjYdH))A$&h(e0Zby^*B(OLAqyV& zlmwPn!N2Vil12jqM_3n&W*4W_^d?Hh&C~_5YLgSfk|!N|^_g^PARm5cVOv$F3U*e9 zJ4dhRy#zzgKcG2Hs|GvpvDUTwM~jxkTLL%!s~HYlk+{b!v1j@IP;4CWx(Rw+kzc=l z=6(0kfjh7nj9uf_zXt(M-X;!=;W%373YZBHvQ8cUtSgXTbaJpz$N#H?< z+)3lKP9sBw$RQqvAlF{kz0rdhTlYrAu#>%p;aZXkM~7U~uGS_Yj(6Ou=7oL&j;NZFwV{n)=l1uGcJx$b-qsm3LJs0Y(cSQnlZZmwE2T`Z z<) zVVk0;Q$Wkvo^8>+z`cZLTr>dVV^IN|u^Q2`XUn%{BFWx9Oe=lUBMyE#f4rQ3e>|f? z@iKg&cb54No{=}0o}7+(-t81*09q8U9qNO)2!_*Y79I3;K++&|l)C)2(HnPd-~^WD z{iN*<7+rPDv*0Q`*k217*y3xWi11o#Go0B(_0AU@F_c|IX`sr7as|#yJN)PuhbLC& zN6gopQ-)L@uC<&npdFIo4#2c4npTM-ljk4Z!vsd%m1h>{_<}lt!uw0)7M&6 zvIQ<+)7{tjj`*%m`D(};Zk}H<$a+ruUw8Ret?p^W1E%Nuo_$#Pqj&W2CIU5PpNvMH zUe3QYq{15U%L=Bs+Aw3^Dm7142HOey#u?6TFRh1UDRA4t(O#4_6NZ;%?~|Hfvo}$TNshz)>%T45dZ>%Vv~|<)k-<*v2H7rS1Zu_9mp7Y!v*`cO9))sg zLet{;8&fY;`Nw;v7^mrG(QN`f|HJ;IbtrYYdF`OlbaaMXgp)v&b$ziF516AVwk3!b zyawxS`Gdq81=>fv{n;ja?98euW3yZIv+OK3?xoRzlEs0M1(lDFt%-tr+?*PzM0g!4lQs?=qim(tgyg`a9XOG(w$+_!%T$0 z;w#DUyaAk+CvxKWDVb=RQjy^|zxu14KEGWbqPc;~F2%TymUBJlWJv-nA3RYZ>vNIo zzh}|^=>ruTYf`-PNuc~vqi?)|@u|6YH_Zt6#NnfqiyJLp7E}@}#5(+52dVk_49yY0 zmszUL1HV1aYUy*7JTHJQTf%QM-!uRG!OYP!V3eHSp5XMn^dQps1Mmec&-j{g^a}9J zyz$#N^BKk7rKflBVb85bQqkexRwrWGY;fCRV@D?FMv?!2ov1_q+;HdDiE4`HkEuw1 z_ZIa)7I=FpdDU>YaZ+W8N4%hz%+y}pe6M3+XNcgZ_z)#lFMiFC(Tm&wCTvGuzl^9T zAvib^Lbl{=l-nZ=1P4y;SO^i%t0Bb%DS`Ib??4;%kG*)Pfc1>X+it!mo~o8Quh<$8 z=kKGfU67BHW`BoaE!bGmZBr3W-32v7ea>JhS9n)FSlc-!b;z+#$g9AH8WZ7i>OV z={qS*4a`=hbKlYb5xN*K>7FNP^S(ZBD2T7Qh43j9I_Y^5Y)5irp%{ThcsnuygU$1n zQQWb@i83ip6nEEDkl=Og9-O5~;*Mok_-)Q<#xiH=ml-_D%5zLay+v;jp5 zz7>oP_6b@O~gWEUMY(tYOZ z{_`9wn}&w1!I=C8Qqx#{cT<&ma$@ufVnxmB(675@^6Rc;4*s@9<{KX=eV^^pFp>S_ z`>UVt^>1-iu+6(G{r~=yn@^lhzx6n!?9tP_FBaSDLK&zxF{`hdZmJgezkbYLpp)Ba zrF+hDdrJ4xyn|&A=cZnh0pf|SMd@Zc@REgO>`=U9&G|vFe-^b^Q=B<49R;3xzeM=Y z!edGqb(8AO9q*2|-2&rzv0gE{U=|444_#6jz$kIPPEC~q!p}#5fTqMcC4JDqBgiNwm#GN%aoeX zIlukt=B&k2g8?9n@Lj(={BLVmJgv*)l1MN$JyPySdmudXOF+6{TYBrdffhw!@H_U2 zRZ`vu)3Wl10+*GLIh2k0w$~1rpRY>M66l0IHyn`e{phg)K6=(B?|9 zcg+DDbY@DVXklg@burGVN>p3dX==J!TZEIGdOzVfO)7A};s+z$eKZ*Vco&V)nBIcv zAWqo13YdpIOeifL`8{M>#v-ocP>36fuY{ae~cuFBCd!mCSo@kKO7Y@lJ)h9jNzALvd@(ehn5TAr&qGE4s%`pe>i*Z zc&hvVe>^7@sgMvEMU-6$*()hq_B^t;vN>kal8{YCB!q+Pb)4)i^H|5R_c$`nv42l> z4cGg9eLuI``}beBZe5p`=Xg9HkNe~PxZfe=N}&4rLy2EI-%(@7WH*diwq~%@Ze?%# zHBMyu-vpCcDSm13zhy!ILHi;w=)iL-QRJBjL&ZJ8bw7GZq<|5{1Gi&IyDqEW8AOz7 zd;dG2CcCFpVxHwb;3OYN*C1<-Eaq=}BPZcjz;k-6!{}8Qm_cpqzqvfAk-Z47{+QJ} z7nib0RhSv}xIElC-fh4ly$__Ox@(UG39W$^-4U9q06|Q1Xubp)Ng%}yg|73cB?}-_3LI83}HJNx^pd=~KU=khn*zDYS6+X-=W07v1r$SU>{gnOi6Go^2StK_yHme~Xt6{C+VMzM&dwl{ zi!+OOS-+#G{k0vxf?HmHd8*h7_&8Bk6|-&6LH=(HQm&)FOa$y?Bn_-WMvT+-NRb9v zV8Hkkh%#q?+=TeI5ITzkW(GYK0R{{<_Gk(K?!&no?`2nE>oXpo|Lt5{{c+J>KAHzO zOY{d&a%h53qVx)clR|Ykl=s@$A}aP1^sjw50ZF)+G3n2vX?0E7Ku^ZK%SwQalz?Jx zWoOaeZe{Whxo@zjxfbaFFT4dYoLMRU#Y{>PO=sckAZ!rp`Otm}bcNQ>foltNf9;P> zGMGPboL;ypi475FIHxtqIQ*YvhhJ+A%oGII4 zAb(e7K%gBYgm-?7=XOA-Lwe`U`#rKeMx5qpj&k?^7R?L&Eg%Rw0rgZ%&vNDaSd_is zKD0nM?;lfoM_*~aTn?nKDzVD~P_Uv-qH_PL|85zCOl#Gu+0nB-{lO|Jl|=^($_ zN&;yGDU9NhU-0i0{HJR(M3->J_?RkI8|G&K5aR^P1R!-`-k5PWt0?o$yt2m7rs zg7g?TbLhFXyI2{WsorHJ-WE~#_Z58Q7XSmqZ+Uh{{A|(?+mM?F5OPIF{J8da74FYX zZu$Kr)V4XXa$yLRLfo5))>lI>@w-r)hX?8zWqtFs(c}12o0;J?V9Fio6Z;N%ZfL=%W7>d)=fKpkx~mB6aLy zkj1!yQy1@ASKBWEdmfdgYIGwZMjDnTt#L-%9_|FHTB?RY*HIE{KM8rlO8tbvBUt9E zL5I!|pKvr#h#?H|{4L<8CO`(LE26)Z^CbVTbhQc0e4DTw+cSyeYT`nm9QoEUrTUEG z>ghM2kja&^B8jxMh|mNQ)wO>}R5ue=R(gK{+csRn-4!car68w&@zR$I(cSi}CBHiu_4WePyc{C@<(9~cnWP?&XIzp5pT3>{`2*OG zED-$mmRS5HJ6;^muv321z5ZmA2%zMey(mx2gNd4Zg- za&pU0+_zi@gVe)8r*cu@J9j>uesKn|H5+k}%reOj-uZv2cG7^pYW6=cp$!30ux#S? z&PlBPsj?^Y|5Dj2dR4`(5gjlKx1r6I6~WTn`K?tc|F1bcqqd1}Q;ISG`*|NI%jXT;_dqPZ@l|1jk(&+ z^#>oM{Ks!h_ut(o z{`IWQaO#w2Z_Mzz7TbN79zG>^-|D#UsdOkROtMV4Ovlz zlBvH^t-m$9D{EM86|W-9T}@4|yAY6iB@%NIehK%3xBjmOz@L`XYagxSi3%aqr6|;< z)vB*eltoiJc5c0lKVOl1lq^}C^k;AFL+LQv*o&*6BjbQdlorJ z6{#C|VL38!4%^|f0mK)cK+TI+i~w#4ybj0-c%TBaN4@wy=;$9PHQ!?($z->FVb>M_ zeTXma_lW(uDSn(v`afWVs{qjpi9Alo@jqZyaUXLMAEpv3G(d96=s~+xTO=+))X3&+ z_s2guoUQ!$Qi72J+qcRsgcjB7y?f&TmbNRiwi7)Fl5ZiWc`t1wL^LP%hnTB*NCNMTx7nKx4VAO{G`vtRX!#8E8$T?GQ44l2H)$tMnbO5GB_gpOTkzFW?(?%9!GR>Row#hYj}6g*k!@G~Xn||h6`H~) z7;{b5fSkhFSHB+r>OYXP_T{)D)XTJ1&AXlILL6(OI1K$w`q=G^`>(G!U@p!8s0Ks|6t-KZEiVobumCNp6`)0B7h->*F$Hv`n!f}CsIuZ{ai&)^WeZZCOjV})z433`UUK7%}U!S77z^&AhEA6@gVOP-<>kFXs%HYSR@mf>=-Pqzs=Z2?kb06Se==D7BS~{ zBA6~bD%p`m(;Gx03y4q@?SpAu-R<`qNk6l7Bh`jvE~+YLv7s*d=juN$d?CR_G=Ph~ zSFc0p1$jJVkIBEmJQn|v4oALZF6SDvMUICXAXL67Rxu7yB8Ode5Zp$qm z0(^Wrt5%$N_ov!eE~CFc?DwUj5(Te)kWWy|)xWDuB!?1`1n)&CCNs)zeu_;*nYk|X zBq!ll78UfinnSzPv|RQM_v;+f6wf5SuDx#y`DEIk37tpyL?e5KC&)Kvs2CPc$qg_; zYKx1vZkaJ*t!9BujWT45{+iM=DuN`xh~h^Cm`HgG^afpxK&`MSpT^KUM8wX@&L!s{ zq}|S%yd&4};g||f_q$`wr=!?sWCcX`O77x`BckLSPtbV5=R`Ol)@0(YiAH+L!esU-%>F++g zaCzr}PY$auXI4S)$cQa;KPlSY+>sN!qed z^x1rUGZU>55{SHbEqO9`{_DrlujxK-GqWH141Uv%v9qxuQM(FBas|#N+t-a&pZvKV zS(MnKl9CF({VO$Bl^MjH!^0`SI4bvH`mhT(lmT8y4-;ER6lZ*9F8^jKPES_~lNebA zN6X%}`zcknMr~qmyHs|?hks6YZ+%Le$E&J)0Z{~Zie+>#Z$MW#sr4P`qG>xigJzcE zMkA}Ts+OPT9PI8*)qReSaUXyADlxE3?qPJS1d~ZhiDosN(#Ja?q18YSrWdnXhbO^# zIS&NCKUZPpdn)e@SvZ^TdEOp1cor=1u%O$;**O5=HpxdlX>`DEJ2DZ=zx(WEjaP8= za?hQ^#`|v?w(AEnuFx!;(m|UHR-=Jg4KxOU2>m zx47OiS#YPe7apXhGTU2XGlxq(^e!)g2xdPw*b`d9bFyN~^Y-waRoGC1xYHdqXx4Tt z9`4XCRN|>v4UG@kpiaTa)LMG;C&`koP`)>w8+LE%Tv|# ztXFj7ouPY|@f{Y_)58_JlJZ<0B7*omk+#kl>O+GH&)d#y4c})f+%S3wMYS>hgNeXJ zz2Vg?F6&QRH->KP#tPlt>qS>Pal9s}t*wi;#<7jR{jai_^8|=dBqtKC9WVM-2ncw_ z*2(eL^>3oA{eFmf-Ji9Q8~k{I-RPRiNl03ULH@}EdVa-KuUs7ml2G}A6N+jisx&12 zGD;GS20iM6RT`ZSsV$!yPd^^iRvDN{<i4*Cm;wgp9Zi>`$a&2=U=D7%fCyA%<8+Zo@#$|sC8DfdWjF&%y(JK=1L-rQPXFoKKLzC>)nepi-wp(rI-(EMc){2bb97oV`>WvCplgY zIZjS!t%O8~*RgdljZuVl^8*PDuQi47xo5=GydGMWto3I7ZG@HrxzJ}lYT;i;(^S5@Anqgphbp-{+iN%^=|z(@qAR?a^~;1O>9q@mgXT(nCi}3fLq*$#2r zT&r8Er%P6djD;zx(G`ocvocQn)vSlrW(Qx5g0d~7WGKeb<!^={QYEZLyS=Fq)m zhWx$clS!U0v{DjC3&IO!??I+iA{Bqno6=6b>Ax|C!PH zA!|TtSn_m<=2+rz0y0fz`IGS-i`X{jkNQNpQk5u;Gn;B<5q+h!5@x@iy z7%NX|T-2ssiGJKEOGn+;E!sq!w;@6Yam6k3cGm}*wmN4%h~FF@8mbAsKStrfNjMYk zSM}=I+X5my;paldv-k(HiPQIeIC|H|_bcp;jYZaPvT+wQ*=cbntk>LuC88;IeJpG4 z1o2y_ZgVHLo~`Aa7=?>ExRdMYk$o8CtL);d;Elb_xifkc*M0XNKrO0c?nOU9Mw|Qa zkG@BjC*smV;Iqt!=g)7KvChusHZJRo^TWcDihOTxjTlsUakup#V(xX#ILv2Kug2c% zOu@3zyx?cde2NU(Qy{eLd>1x!oknk?I!jCn^BHrJf@CJ$@syXFz2VxTd(>ntyb&#w z*UF{WPd{Rac-peMdA|u|o%C~7{vV5ZR6#7rgUZ3%gO~R2T;~KKI}6CqvI?&(UsHMK z=be0W8Z{C{1gpRInACrW;>R#sC%cx(w7f$_OIS`rfe33hF;({E51kqM?YA7Yq~!?_ zv^8~TO@>MVGh%)W+Ce9NC@UKxrEI?yo|pNMkx&Mqo){x0iU zkOk#(apiV8Sz$=JO>L68GSnAz;5n3C$|Zt@D(DxR;1)FuKE<2+EE{TKh(+tQ|>$Vu=5P==#|hiI5R*5AT+dE>@L?L=GhukhP#YURO+ zU9|QzswT&Gv}RA)WT6|{ho!wU5BiOIq6kWi%^WP_Ss_ri!}=ME$-&Yn1rc0bZoc+V z-m@T^Rc$H;s0hxa^nGc)Z13>;j=zdUiVQ_Pr98*Jc9y1W*v^MV`8z&ysW{P}T1!;& z(?s}&#>SDzAPbUm?R?|N;Y&=!LT(sYX|JF7Cze`S-t6~oMjl_MU)7!f;2bTyjPpNU z0*1bopz~LL{Mnd4(m_Zv`GkKu%7aw+O!*jKGS25CE}vVBtwVpCKMERZSO=ouz$1HkaT@^LXd~W46^EurrCQ@B7alYNG=kZ>jCFMgHMqEhu z8RZ3SN@1-*3k(4}QqZ^0uoO|3@ilxXoowY19fH(ie*{%6){tJkOT?hgZB{@rw`@QO2DCTJzkg3( zneUm~`C?1r2+}i&Sp_@r5Bgk-rP9@TiaJW_tL7ik+wqZPOx~qA3t5-E+P>E5ox~+! zr^a;4uHQsGiHqZ9(qM6MaULBLw!INPK>>2NCDC_kA7zj?uBO?6S;vfLX|O3VE-igc zb)=S5M6~b+CvThmP55HUqJbJQUhXyKZM%cr;pviw!+cY%-46VsMe8FFuAG<;zK)x< zR*Y=X=hhn-dJ;fCEjn4i=)89BQMBjjH_W8b5hNM-drc0d4ZhfkOMxJ0m({*YW*&ce zj~-$Fa`0Mc3G|*LJeIBcs~PbvyEGW7pP5B&YksN%D)tJw^3`=;5G*)tdHoZ zU@}N1g2j2?2C>fAG~*T0i!5)I@z2-8z>)y-byTe6Nl)>uW?542-m+cQ-ZH6z(Nd52 zYR3{Dk+0Ey4lWql68qZzTQi{{7w}V$oYQPSZL=)0?oobc?YD7QeJYGwA`Mx3JE124 zXN{+9S5{OiZEkMHdff&DkRoLn>b8^rbvQ`C;c)rhcJ&{JL-BXns%Cg|@KsWM#N|_q z94pCTcTUE-uO_&qWF=fAb@~PfeX@1Y(g9NUlgrnmAKZ#Lq~)Ab`mA%1qKkaqZGvS{ zN~UTQ$GL>c?q60fy90h{7N5MBgNw{Ys}_IOL)5y+*;Ky@yOXe*>%gJ`F5qoiIz?F( zS7pE@oadCgI5&4rWAh@Gg}M7Ysi;edw`rB}Bh>8BUeU`hU#M_Hh?C>i1{Gqs?rpVL zi*28j1FA8rPF2vx>6xgClw94@VsN602lo=17z%rmaV2lvL8_z@pI6 zUAlU!lW-~U{T~-&S&9U&5L2>SB%m)ZZ$p-YuJT5o7lp+!8}U9FmJ8}Fc@_kHxBvO6 z;X^mRLXuO5X#;)v({C|v4L%KbcTc#kdiRiE$ECpz zyy_H{6igW$Fxzo@#n~JYxdvrp4T&K;UK4E%T#B3n{r%&KA@57yyrHH!Jq`apa%pnx z#+)IBabG&~uGUr6q%^zgDhPc~ zuHp`?Y_>7TVNH?LfY*KHp@PW2^LtX2$!mY z{*Eth+cj1^kAvWLTzxj?=B(?b`p!}udJ!S3{Q4Vu+DDUc0<#`$Z zOtD=N4l2YP+(gyPOjKJbIC_JA@x``o9GV+(ay+ls?RRaST9|*~g$Prua_Nmu^E;r) zeYWEh6P=@Z65B;e7A@=!Bnj^cPTLz+Po46dJn*RN+9@e64tyBU&ed*j?%7~a?b-!0 zy{Hy5Tf13#qy@qzUwP)$@%Z!WWRl1NWUwaR!u0rkjgY?j9;v0&vu(wD>sIKSLJLS0 z;C0TNQ}5U;7o>lDsWh>~(Q_O*4!`X+(4>{^(5gLoxMsW2-V~Aj1tDZqN z>(}qtY-rrURb)QYtnFQ#zQVJvb|4 zulVEw?*VN09d!*~Nnx2e)Pj6$>8vhAxz5*gzucmncDupy9v5yshWj2AlP31=?lFPO^P}{rGYo6=>S`KpH{yUX=M54knRI2Qfs> zGGk-Ar814L-LI#=`#A5Bzu~oO29L+0d-7ifO4WR)El=v{+u2+kiQ;nQ8(1>kxwQMk z(b%|K)Z^y>y24F-{nO}D|7ND3^IYiSoF(ZCnhGGk(Q7gGJXPK4;M;S_GVUq6!0P_C zt&H^a#@vcpS^xa3-Y@8Z81L7@OZKCc^Q^6}byII!Tazf>d#tpr9K8R~qZ2r4>nN z8Nb{T5t#tWgQ`9AW9K02k0cs(OfrrjC`0PVEEt z8Ut=e@ZYzCnyH3Gg=*1bZ7&lG%M|7LwPO}OaaDM`$p$-n54Vs*`c@y0H;1)#hZpy{ z4{7LWwz^gypoMq>3e=Sel7cO?z^HbhzvM4wrZZAVjWx z&T;7Zvb?qv=MBYRpd~g8ZAtrvRw)mIM%^ZdrWH0s*P+}dHo{2|v32OOSS%^{$m5L} z0wPYjBfO$9G3+0B#RdO+5GX;Ka^lrbbQV@a*H3x9c=2LocQs_TbQ?I@+%bb4Y|I;d z(GO}fE|tO+p|*~^(;|xKc9Gb+X2$(jvD;y*EenP&%)7~JKwqH=PeVhKqe4g}25;No zQNElyqw_tX^3t~~O}Jx1Lc(}$-!AD&mJ|Noz>wC5V*9~`VtX!5ctjG-;kBjto^*7< zCyTEwx{4|Q9W;vG&fwwDf)g=-vUiEqdm~CJ^P{WmdpZCkhm|&UbW=m=xTf9;5fMU! zzSO9KAa++1k(wm+GZ_HYx)j=VLZKf|r8!gka9UgMS~t3>DRgl~XPV!Bl*)681Yf*7Fex;&j6={^K%~=j zJ91M^VyhS25~{mVhhpZc1p8OVOShAF8z$FMcLDxo^k5`IunDAiuTBC1kCivL+w-}D!J@C=;4PsA;Nd!YeJK7rX1(i)+u}@LXy;+~^r?t=ej9Oz z-F>f*nCtgx6)KbqKC1qQ@y7{>%h5v(FQxg%a2q9srS9l7Gd5Cgt5+=T@#8XEVPGkM z@oof`8FI{c8|Pd>ivIKG&Q0}#S<=~9{@{p5XYmT^X&DT~4=CCOlT6Pti7^Vc!}APY zJC7mbuhAw1dym(g!eO6`liE@n+w*^U(>pYg)r7!LkU&#IbXtqL+HkABwMo^Hs^5M2 zxI*8|e(@?4t!T)p5-nd*I1kq^n^+mC61KT3s%(R+LUiUBqOX(#-e$k3$Ij>Etmn%= z4XfMZ`74%(O9Br z{R|C%fIG!$X)gV%F=?<;tZ?Yiz-szT?T0r5&PDLVR(^q!fSXR5#Tnhr7^fVi>P6tV zEXd*Uaevgzg|$s@xcWQE9KW`c+hPNyfJnst8Bs1nx*L)o_uqd}&)Swbu+3@rq34n` z8W`$dU|z0ro}A>_+xvnpl$j37rRv9T_wU4oX!59>LlNv2DJr~!v62fDGl%cD7`)g7 zuw>%=&Jz=>NlH1VV2$PfsRnsSh`0;y#yxs4&M}krW3#+|h`VU#v)?LE8Clucydo%{ z_u9(aI}2TGH(Yzhck74P51^4O-#T5GqxC7ZpjP%lEc?ziBUc9gYR5n)>-5oSnGrRf zLEL+~W+MCn4-tMU*Q>&{UDskaWn=97Nw@I{8Oj$1{bg-n3p!~QK(Cxrt*x_ZmF=~- zuP*q_N~9&c~^T=GlRG6=})&Kh-Hf@o0WQH%ZV)o}XQq!cGoa_p^^ zEQ?JH*FI;Gs4#Y2@24LZ($VYcYn>el$`9O@<>W^Y4@NAxRm-W_`z{)kg~&B#7w-c6!bMtksSFQ(3~P` z%{tK+cBmP{D$k-Bty%6b!EKaS^cDoMcq-i@rOXZEfs#GE^`j#}%&Eb5AU0Uyab6FH z)^@k-SnFAQOAsPG)IU~f83XrqJnu5a(`vv=YbNUL<2C|^m~9gDM3}e46SA> zH$(+ZFo>7WCW`r7ItY7v-%e4n-9D|_wb-|I=IY0Sn=a9Nd}Z}1OdZ_w9MDd2YY!qyqAp8un`}65zdUp>Rs;XR<*I0^rR7!% z?_=tXMcQ@CE?rqCSF^{IO(vcf3rbhfzuGgCd-=-c0fqo)*4O!2gMfPWB4Zt1{k30g zM8jd%4~O(W`Q5_JO)GD!eu%@M+_^dU-TRD~HzYBc4^2O)?ja5jN@0df-K|mWdLp%R zx&lFo?yCn?0qM42va`rO9235^^*&FTf`TG()3WrArR#B(2-GS#g{Yl|FFbl2X;CJuvP98nyNl7b!3V5Ie z=zOhg%=2!er3YtvhKCo+%gbxF^9!tIXImn(WIFXFWz{>b_}4vauT-x0v5wHo1wK4{ z&#g6-tY&$QlfKMxk>fAkYLYS<1)$A~-=NJmyxr;oAHYp#u&}WGM35IU_z1*dtEmSg z^R_BXVY2DIqZfThy?)LiVEC&$3Fd3L@Mq>tVtgHj-!A^+YK`@Q_hz*Z4b!~vcgdJ{ zm#FPMQUFz%7Ox^48Kf(UrGL&O4O+OTIqc4yKK*=*qq?sz3q@5FntKtT4`~%{tD|}M zDTe6952TxhUGy1!@RCjODlMKw^k9maO&4CrVBrLajW7_Sv^~o zfmjm`(j56|r#G`lvNsaLTJ~knLepoiZUWgF3$`;7&gGeyqL@Ms-`|-l%)+7T-lA zuo7Xjn4aQupdFflE%atS-?g_}Du-5Vm1viHZNII);AulPJ@{%9{GVE_tc^QMMuo-# z(_0-E!jIH}VCI2=ADUgKu7zGt#%Z{)rd!vUB(_^s3r{P;@NsS%KjZ}sv!|VhCqvUiNDK?E6iqC8ksBq=1abNtzw{uL z>rTG;Khpls*Ho@UptM>f!xqV}-IWV;+n5la2bRH$b8r@YC2ot;Ms;LsX^?(F zF~fq1U;Yt6lJ{IDsmSu+#>TtDoo?@KGk!=C@n>fl+g@{_*YgVQA1>MHTt^I-*z1KW z#K|K|%oeGD6nT^atW`l#@yu;qM?)(5)jDE|tLCR%sMH*$-%@s@5VMBMBo??76&IU+ zT|PMqLQKExRy2_|Oth@8T3k$wI{)hqIhpR(yBo3Iz}cctY$u-O%5VxcSQ&rQ z!--`VDR_`4cz4sR;(bZ_jq>-X1zY-_9yLiM)lePOb~V?aA~Exu4=a-bym3cK>48nT z%cA*fq<~gMJR*S!Yd4@Gfus(JxrC+BOL$?t6mp2I&Au57Tp!(5E7x7Wrp4z7sMwU8gD>I3>b5&1g_m+6ZMBQ@~!blaj0;ix!qj(7`hB!SK@LO zPFdE>puWU2k^A$Ux?3)BmCwH}h!*r<(_WTcrB|dg#|Z51>=?WXp+)ywS2xCnIy5Na zF>9<1jU!_{>Gpf|PIWMnZ_-`KOFfVp3(J4p%o7m4BmMT%WY3Q0i2feeZwW(^yzy+~ zQaYOSy~@*awk{lWmoGQHskG2)T3A5)`!CbX0>rAb*Mgl|l2r@oHVnjUsT2BE&=m&0 zheO!Ctz}_DtP9taB3&9l|7=l_qX?(rc0z(A>(neA@V!!j#GjVVs#VZxutEJmY}~%* zXwaJy0hVT}X!B<5<+Tp9aI9eVI_hxcC+Y-;PJnpOM!Mb& zXj>XUh^PVIg32XF)`Ng7j*isc!Y{vU28-BLXLh0(3 zIR*|_AD-ulDvYGvz4sh?Gq&_wA3YHLDiClj`UwU?(bykPExUSpC{koyoeLX9LC55Z ze>~>R7E1iP5zV51vgiP4j7044*o@P0mku z$#YH1Azl0SuMS$$@6yJUZIBf;(oN@cX!EnWWN;O_bri;F4`zL#c_LPyi1U<5s!qQ9 z4`RVpF7Vu2HFuF7hwwI!t~f^j!>b`Bc!^tNbvf_Fn`vuwn<4Onwva*~w+8$+#`xKm z6tphZ}mg9aWA3fHn@}b1ikPoUxc6^ z)6ck`vUZ^J?;z9%?|%`42f5Z7hx0P6UPVX$2bu5+Z(#w?q`n(6UOJeqPqyJu%oWL- z=F6N5LqPJ$Mkgs{)*J>a&?*ErJ_GqCZ_+!eqRFuPNz~Zsq?snn2o$vm%O8gu(2OoT zVY~_k-OJCAG6IllwTy=G+7}gT2OFGmP3?G?_l(y>9Wk|m!$-^IMci`dgI(AHbK6HT zC)To&r}Q}n@-}Ql_{8gkUc_3(7EVPR0ubmxbZ+%C9#M?x9silps@%Y@U8)r|+wL=K zNTh3tRnHfdV(;yR#awh@NM(!ytL+`uw++!eW4xn_RZTsQeeO$b=g)<)z68pmi7@Qg zr?2@gSCdOrq%)7u&8qaWX={@XJl$4CoE0q`JhpD>~nc0G5G;+c*o|J^C2 zeRuY$_39XLipfD2ov5X=Ix^wxtYZapR>0{+(^7nEB5)UR-}x@_zQTYjP(S(6h|sQL6!ce6ymx|1RPiVl^MRxa*Kr?NZyM%l|#$` z_4Rh>aH;)y-G+RVQ*LZy!}L9arO~b*b)nt4_LXfxV9}bHJlY6^Qu7f*NggcpI8M5rV#e0DDnA&5ZOnxUyB&C4e=7Ix$zamn)D54Il&n}qkxbJX zm7rwH=73K#sVYO29tFb)Z$0-2p0O*~S*M{DCxpgl?(orlSv-peOjG8 z!?wynm(5gDmUiDD4(DKB8ft+i*t#TgwBmOv_5AOV&0~E5a&Xl?{)5lXX%8`bFcx1e zbDepr&p6^P1hJRlT@)kBBK84-aNHT}OL6U6FqImKx`d6z&I3ISj=2Sp#KP0lg+(fW z>S+ZGXaC(*Gq$H+maP(Y!&*-PS>n-ZUShY{Keh_Sw+`6HuE=<=ZlLChOG*M~`BBe& z?QB6JC+sz6lu^J3+;6lb$<*`>weI<8`Vb;g!ZXGsZRF#DM1A<;qTX^8mmYss`Wx12 z@q-uCf?}N_utlUEO}{I8EtFb;N*+imolhyHlhmukIx;QBVjPDeulTRl1O|zf8*Eum zPF0HI$M(t0y6U3CB<^_bgeQ5$kVAdOWny`}BPyk=fJ6O(=fq8R^A1mMlL~Vb(-ND` z=PICxRw{h3q|+~H>zQ82?vm>7-VuN8eYFej=J-yKNCNBw=CQ_}O#8X5u=O3k_ z$nR3o=s(h!UrZ8-`(U`?#y^G|g5r@QQ-P4=FXyjxAMMYy*?q-nE>7KqcgBp?*?`JtbzdWvl>sucxzqXL4SX7#=yej63cQa z^~cyBaP2!`32O}vvOBTxFT^A_^aI< zO7DG914t=J)lJZQd4g~fob}H|eQG8eR~N3%LV?>usDq)w%=w$vW1n8Ux|7Wt+|uL) z>~5-ABBW0-FH&OF@(e~HEx|}!YDgO%NWel;?=i-%d83AgE*7eSZmTTg{`JC6>S;>H z$6s^a(4eyCC}I>Bf$Ue$|xGXWs$A#zT_1#q-` z{{I~9R%&)j)vsC}Pi%cIi3ep^u(2%_{FIU%DiFLR2QtG`?`UagI;_l5b-Ld>~A1ZqAy=n5hIe49Nk9rapax7C2X zuv*zW+0rtxP|lyp%VkuWcfTc4UE1Xu;=XNPMvnhVj#X6dES>5re>2XjV^FK7uwM;7PzNo0!eCIkZ>toSp6Q4t*1Y@&Vp%xHN4!&$qn*WRtm-5kBW-lyy_aoY!@eMNl zh;n??RtfnH9RKTZAQ|YQHXb?L{srG6Cs=Q}9ffb`Cqt%y~~3`V-$%}wfv|EdAH*ZiM;yvfQ&Z2>rGvs{z!9=%$vRG0x4qG{^cf^cztoJ zXNaSHi%OK{=R|#+%vg_6e$Gt@CKPnaPsryJc?oLG>0bJdwVzc)QVRc{Uu__@lg$r!%@?$7L_se zF#b+`0t^?=7>6=GO5damg7}QL=gv2JeB`2j3J3Z-w@kYm!JIX(R*tT-0L7Zloo9Wd z;vcbsk4&XpQnGil?X0XeQ3VKU+Bp2;T$hPtQxr!`tlmm2qrWn9w2c;AJFKkR!`*!V z6pLx5C`6z4wX;clv{%+q)V_xXmWK@o0+m=>vnC8s2{qt-V(wa2Pkqr7&$Cw3`X<}L zpv6ici5w4HpkIeSod-3)O#P=T{Ml}e`RJ`31y?0zz8MCyu2L;U}IwVeP{Nt;OZ z*(;rZr3F2C<)jN8o|;O5#M_+bFFfd)?%rXu$kr`vro^^85F)^_C>MpfzOqtQR;~b2 zj^#$53n>ljwr1iT0$jg@<#VV~s^-M_<))>v$okLix?S?fEZHLg+zT)YM zcRUk`N9}iC2LyJ5C|jkS-8V=Jgms4Rhexk8g=L3wzCIy+z4YENU(kq$Q>j#nV zx~6(RZ#Wk$9eD57y0rI?!VmV>dP6=fmLIs-<5mo=9ZuAj?rv2~iAcNPjmaxrcSUJ7 zX7@i)KSFrL!gAISC|p@z7EF2=7^MqUbd;*F4{$pSQp$|MW|*;*59^t*%cE7pIeI8Y z&w)`N;J8}=x3u5Xni%5i;NoikWPtGFxj&*;(qB|kR2H-r*}koYAA5oGK8#ZF28pMD zh{y*_z)ub-iAKFvjWSpMgd4;ly> z*VbZkCg;<9>MLC9{5Q+t?2VF5Z6Vl>>0Q}f?Hl2aXJd8m9Lqt-w9gW@yhBnG$KSd3 z{SJqk_m`Bf?_|96ir6o%Hg_3^B&K_4nk<6C#={5u{S3TJaECN@t_9U2*yCVr@48BV zJ51yH2U^;nDTR#6WKe>?zB(Gj1?$kK_B)iN}}j&gk)M$j`k5Al`I;E|fY^?@}H35wE-+Jh~jI-{rdI z#Jf)8&vQ`>5wDZG+z#gDtC05h+K}*vqZMws)lwzQys2IU(4Vx1Fq{LXgYqfJrCKcwqvd)5n!?6>}=>Kpv4BPD$IPhvGTk#!_ffly5H_j7Ox zkQI(LHzyut5Oj!s_h0?%qaEuei`gm}upRxzyU8f2u-5{>C2@R z?0mX7hhR4l?NXDS;+S_Q7s)R1%LScLSrn`%C^@BG94D1k;kF_~F%pZn2ZoR|YldXw z-itEsZ*1h`iSY^>ZgW4bp@wMR9CAvH@-j9r120%fXEP~20}h*1ad+$wS>1}50uufb zN)At{gn1hPt$LZ3zmn`VCntn?mh&$2;1Q%%A*OPM1=fe(mYTzFUQ7+<6&0P1H@_qz z2E~hjmh7NTgapgFNf@0SH!p7wyrQD9^O?+pDT`%RR@M>VIuy=qx{&|yrGu$XNQiPk zQ|L@}rOZll)X6Q}*b z$dZ#Mhj}Aehi?0;`Jiza#?C^k&k9wiyc#;{RQT;PO((uORJnKF_i9#`Ls~2k2@CB} z77jkNZALU#5|6g|UdPHkw2X_Zr7WhWUv8c$_({5_@r`wiS4TUgL=W_AbneO$SM_$K zd>3`s#_#A9JsRSYtSjNt(YPyq)DGXV^xsBdhU(rGF@(eE|>C0`D=d$$(0Hj~;H&bH=i<(?TzZn$iu@6#K0Zjzw zPH*S?-FxH@5n4j;`*hp+f2NYFXB}npdqiI#Im-dlm7f85@R5i}fJ89Bp@Z(#4?ZBr z4niN66cttM;#PJn8@5Qv{=vKZGfPT#gtT+z09xSrgMvh2ob9c%?kZ)`^<5_kFcSl3 z%#Wd4Dlo{=YxO{uJb)sNeq#&n3;;SMbF(DxEe}?Q*r}p&*R&a<;KRw9fafF$R8mL_ zo0Zj7Ql@4pV>XHh3F5w=k|nHxS^f6P!h$1gYss}WS{600oA7~nYX$$>7X>#^>*E}r zIHjMvyQm4Y2yQRN$|P0z?7sxX*-Ey>*SQVV<u@5OFH-|8%Fs9rxA(eLnUpo|w zQ>k)5$t-geMl4Z7h9Eb{(6T{Q^Bd1(E&F5XrhPHhZP=WFGMsiw-XDm-9p(=Um) zG$=$19OxQWFR23v|A0%69g-ARyqjfT;((c%9iB`*QxuR9=o-1QEbKOt5%MuT%W?gb zS3l-*>{wUI_Vf*5;h9;0iwmk=TOU^S;Uk_)57x|e^whgollbUmY7;C_bWya#=JO*m zKcp8$9`2UXvtm_3uhzX)6$1m&4yIMHD_#@2-VrAMMK(C9vN8gY5r=zEroZ-$7rgK4 zdLmFV(&Su|ijO@)@^Ab?kf;RU^YO({J5;4yZ2!ZV)8D#q3dwE&PolGEo)sju z*0!8l^l1HVs#WT`Yhx9^FPat}u4ZrP-lXWE$GPllQmscBl%?=6va*4%I^@ks#X2)o zy^^A$2f<8%4*9<0?%bXX00Q+xs+CG=Novf!V%&m+EK+hu)?+r4N58Q$@RBFzw8E>s zX#xZSVew~EM(S_9?1j6sGG4yi~Gu2ld$;7rZ>7_s4n;z~~4mWUB`Bt@(i# zT2WE^;VGDd_DH*)KrLVSR#oV~z85XmjC?gN!aLEGEO$%hU}|b*0^E_47PpJKFp(cc zz3;?nc0i-1E>ZOq#*+M9YMcO+@n5xu{=>OsSN3Qtn3fqc7BpR6R12YM+=h7u!(M=T zLr`me=M0~6V89DL#?StA3;@)m7zB1ph;^yLHI~ZqJEYcL45?1B25`@;2Y=1w4Wb_B zT8LfX(YGcEqW~7WOAQTYp$;}oO`r=FIQ1p8JMt0O4N=tX{tu`s^#~;2T-_t1Mr#nuY`=i?=aT~IQ zx*jf;A?1)OgVCEed{_OH`Cyeg%2Nti((4wweT=PiiFu3}>#~iR3}SOqhi1bzH>;|$ z?r6R5qn_>TYq{@M$SH>fBLE@|3PKXMF5V zU|MK4P|{K3HhKffsXA>kz_`59{#}Q6c||Mm<0t zyfwA99>Uo7Ebr{>Kq4NzMp%$YBB_hRd5+!H^AC+yh`joU7@td-*q;I2w)c8P)*48g zE-Ytkp1qOLRW%0}5K7Bvx*=q@RQrK~Z8W*z;H5-y-xW^li3ugAr0PLP|I*v;ji{$8 z{70;NE2?BG%~HSj?_Gf`?lshiEq&@;{;e8OTp0e#G7m`HYOuqQKq%gg}$s>@lwXk!>d@Cuq#gHg4$D*fXcRg`nKrb9TWdvLN7wZ zO5Kg5nZ~z|S0ZfGLKuZuQ?Zomb$liDO}*)e%(6jm{P*41?_bi>(E=Es*+3n&*zzG$ zc46Q9b6Mv%bv@=+R$M`U>Ls;jafGwrbZ2{WxcF&u%jTCN`n^Xpp&x$lanHj&PNdG!W+tR?Q(A|E^?!qYyX);ali5RkZb^hR>@a_Cr8uSaLC za}01h-nx~CmK_;h`5A5y4+CKtAEzhSzs&C*{MqR?gi>OxH zaqMTem7V+we7ZOK*`nG#_56j61>~t^H!~t=& z^Xt^7Yy1s7kN7)IU~V_#208xzC7`QImWSg8k53n&SFzBp&QMobn@jBL&O>eQ`9mqO zy+tskGLE~w`)GJ+c+SFJf$-nT|C1EAR7c+(n)tGG_xCRdEw5hix^&2TNO}AX5*YBMz2mj97?z( z&ebaFrg$KJANsOiN>yj|CgL-gMD7dVD{V>39y%M|B45Y9I~U9Y?ZAu6o7O1sN=r08 zru?zl$66?nY7gq;0nZ|79PPR|{RYo8= z6qA1vd2Nkn>{Ck&YM$={eZM7+Dp^hhJ4DFBG396`oa5dWBFKJohum)I(vB~r<;6Pr%0HO)Hkm--&3BpVpW;JW-K?w(B4<#iWvdX{y8vE0Ol5`S>y#0~>HDX0k z-Nee)Rv{5|P>_}6dDMJIhwGG=uD!DX+#o)S_Sld63yA}KrQIw=63HKyq6~Y0<0rcY|{5q0$GWFkRU~1Ae(hFlW z97MIsxHVgQjgCg4fg}$L7y>nHRVjNsyufU%BZa*2;rF&EfeU^X zv=VY#lnRvoidEQ!UrV&tnDF5OC4hcs*-fsgaQU}88R%*y|%fxp*Upqu%zn?1#_Wkryji$qzQqCMYk`TkfdffNB`T@Go8 z{l74xU>U%qGFiTnb&N^XbTJ0>lmkc?QXL12m;OJ_-aDS^{{J86L{=F|Dv9g}MM%O) zBwO}AWMv$(vmI0#MucP>DtjDzJCy91y+`(zy$-+Uq4mD5_xE%A_5P=u>sGhR^Ywf_ z#{IGGkEb5KZcoHLG(&*Z)`8sgG)G~jEA?e&__|U}R9Nz*AN}bsqr3w05|XiVMl*?_ z^+oyqAOj5n8E9z5Q2E~<0V_2*NVnr}Ht_uz zqMm3PuBw2&iueMZiCVR>URM=g^vIR_8P(~V5_sqV-S>EiZDxIL%cIGQPybi}a~PE% zsa^&wnH@Mj)(OWU1|VM^p^$%UGT!1wbAbZnS8gdeNy= zwD@#GFg*dHN&#wJWRhZ=mmf;#Cidb9l$P)i0bzT*{%h$kHVaG-SfpW$`2LVfO^65t z7Jg8uELLcnej%w0w2!GsLzT{fq0L*Vey$UFTvsyNYe^oo%j!^0tWy$MMiWjKn&0># z3hLnNubeSZ@KKu?(ma5GAQ(SZ5g*~q81$F|n`?FU@i+V>c7GHdGh+c&6(^g=@ju7| z-bzA3B}YO=Zij&O(!*~zkb3qMs4eJb^PEk_K1fcBVX~fiwDko12r7Xrv)Zo#X{~k@ zkQFlU4ygMeTYKsJVenE_^k{J-ff`9rW2eCxc0sOFzk@?qGh1H3YBln zz}RY~FCa3zehvJ_s~|&H^rIHNa)?b$Mi;|9w@6D~Ni=W#ip5%~B(=iR|I< z2CHdFC_P(aj}}GJ!ggwUfmV8!FP)r*9ClDFtouGw=1H;Gj;wAQZX@mI72Wi#UdF&l zZ6qA^v;OUuPlzsFVY& zn0^e=^keh0Sh|Xm;dO|kb8UC-5n;|G{bZhL^ zng256IC$B3?12@m!cW|ibn-b%;^^Xh#l*(Ii&7wFn~^RS_duuRYzcjS@bk%XP@crs z#PJb}b%WeooQ<3cU|T*;e!dQI|EbM01G1GWdnz9y8tV5s!A)BY&q(pvpAiFO2^tJP#v2@ zdX+65^77 zoB35~g?C%ly#dX~oBX>J8@3*@=H^;K+y!}{`Ah>4s{nDp(Eq(Sqy$!kD@nelf_}6K z(!~)ZRFTBa!zC2hi)42;mDdk}aN!bl73BIkaM3KWV;NzGJ#UXQ?-zmV7X#@zU?N>X zdhTyc=Do1MzV3Qni08cW~Iz<9@1%OuaIcqn4BmwBAk9~@wuu#1vQZJ>|5pC z34VrUBEd5d2YUS_-M@bmaf+>vOzaPHAWxDa>qC3yy~gPkX%W)Rx*=pi>pauqd?vuP1be1C!NG3b>;VKpFVQ zkmBFCj9K6^+^L#Xlfntr&r91nZ`fbz0}bny|3%#aG(GXl7-%76b5z)B?ADxQ$aj+G9T(ah659n2_qyq_FT zI$9{YAWe?aM&a$a!~}j;D5rpc_{e*W3U5WjR(yuov6NBOjQG%{+M~RM^4*?Qgs_8Y z21~HA6;?LRoDd{z1V_5`_ea9Y#wniKL@*7RO|wI>LM6RzEC*B4#lFP8p%=>n< zmZpCxJwVwbKT-DG*kHqq&AeRyTlo|S>*vvU2_?Bi|D)AFx4rNcw?O9kNfdwMzjeRp zO(@C9kAPgV^AwxI;!2Bl2wBv+tr>F2HZ0Y+f!M}Fb6o>FJs$w}!C@x?w`+vhu?S1i z7k%~K`&-ZY^MRw*x!40=sLw#Hkx>f$-Y%Nv?1SEV2yEH=EillGY~T(Fe=wZ zbll;EaeH$q3ntf1P#Fs~k4QNt-#KPw&l&?^nCQPu9=yl@yQ_s#=@8OR82q`sE!FAaYb$>eo?|@#{0g>rBDg z5>ao4`OeyCG$I%4P2L=V3kb+){UyS~-UgFfkiw6fxVIDcX{8|rjJE1PI-|?4tFO#< z)Q1VRJDY`@Y`-gysF>8fhkZQkYkB^d4v~O5vo~5eK5`Lf)#Kob}=#u7uG2Q#9S}3BiH9JnVRf z*OQ7pF#N*vzxmU3)f=pFJ~1gr5bHLv_(|XxfUywt)ch1{a^GKIJ1JF;*P!fawnOw) zpWCsHAp0_Lf1=2egJR1U>{7T%o+)FymqQy2nq=%X+;^|7v9 zbF95s6uIwR;dUyMn*Z;w!yGhWd?xUZ!-g8S)$gYmh&`tGsLI}ei`Ceq#l7SLlQ?WB zO8rHR=j&cKcX=s2iM}G?8-TNPg;g@T0L&6U>Z~{XAFS0QEXa7FxlY#7evft>fCO`_ zQu?*3bGq-`i9HW78yb2b8m5BU7B@aD8TaupZX620mm?Jr`5#nZ0qZcRo23Ne64|Nq zTt%$o8c1|{%SPV5q(}ll#7ev^ni+y5G&n3i z9IuAcygu`j3*he+ag@-lcSIa@^b`DXJRjZ^hP+$V)jtt@=G@*S+HJEnD zLzds@=R$=!yQXXb-W=%&cA5Z0wdDEt-n#=tzg0Jh9hO5FKI=J})^d{LM%PGNI;PCV zpU3*Krf|9xbVh!MINv8X?QSBTvv}r`^i4J`qWeV?wT9Z-+Hc2udNdYTUa}HGV+nta zRQwITj(voO){zjqlC~PHf?Qa#Gh-qbBxQrf5@XGfxeK)$ZHk7JrY@fWpW08W=oOIs z^l)Z;d&y8GquLHPP>^DGuU2B90BaC-y^jpSwf{*2xaUe9W%!N6y(Rw~q0hiZU>I^a z6@5YbF?$CVKTbpm5P2Hqd`K!VKVm2m5KjKU$#-Aw>ae*>iuy0EvMXw8Wq(=-?!P}v zybe520nvm}>N~)+rYM3-tG=#y z1vCLlJuIEda>dbIUZ%O4*rw7f~2`?zW`{|YN8!$ zByH-up`0>fOc$qm6J(ZO>bN)bCgkSOES6Wn7K~Q?NMH-_{<Sv2}gB&}7@VA*={&1i(X#fKKay#zxsDw=u%sks7v(ts+$(oHEq|qVanH!$Td2 zvG~a9%kbc&*wBx+gMMUXLr=8|DvO3T6sZD(cRt_@65%vDj6`MVOLkf*I?b7T?HC0v@f*{tHazUF5Y^q z$UA)FPtIF#mCGrh({3{biPQCazTkW~_97!+>Q)sKIV=bGJQABwa?Frgz5toP9@7=8 zilJ?i6VosBI>RhFwHH+N$hFOT-|3?}#Z^%NQOUf5W{oKT-jn>-vQEz_GX;)>-;R@$ z6YyaQ68c@4eT%8S#!IPt?xwIXEuQS>r@9yLEXys2uV{YZ?@zP^(*!R!dWryri*0df zF#OdL*x)fx?N2lK<%{p`7~R42hh=|iV*}ZcrPq8Nc_kZMataDm3;m#0;IY4oECFv* z0){b)%J(L?jh9UCC*JzmeSm$ILjeNvLr3sOQ*rElqBlTWPvKuuJko0wnOJN{DVpJ- z$p#HWah|=As_&l1n~~zlOxZ;JWg2r;szoheu8pYaY z`fX!aM4K?6p|SuN&Bv=O31Bo-wpR zOW5d%C$f9ua$NXZZSpwM*+kpRCAqP@{Z+DnILQu6!l6xTAKE_S+2NWmARHl?YHUu3 zO%=U-Qo+C)YnX19qLU7sm*0a!=T!}GG&%($LP-lBEbc5@#MfmRSH3PVdX0vmWP2L4 zN(>T1SSZ)|%y}+abZ4Awpt*Q)<8$h3iLwsRr&t1}#hwYiW1IIp*tE8KwA>qIw?EV3 zF)LwG7B{%$v00K?W9R5nbzXzKesjoGRD9TV+qN3B>4^!XalNJ%B<3nv(!aF%Njwwe zSS%kxq+A29^o@d+q=AWsa33gtZ}p1fzQ=kh%o!J6LbG;%OXOgl_e11h z-feJC#1HNN$f;|b!UGm`s{0c2{o9duXX*KElYpK8t>69+t&c4&$mO||rbdCW|9VKA z#Cax*yM>lw>kG|cVT~Geb!@1DnS$1b2m2T+ux9@D4I>ES%VJaYCjtKc+evN<`wFJy zOc9y2cn?~h#uOP!28Nd2Re2cxUboD}!LQK7PSkGlRf+vf+k3t0p>939-Mx$KCqc#h z0Mma^T$kL|{mo-#hV>lou(ii34WJ5sn+d2OZp)fdoTC$Up5Nc-E~h%(t_f&6NO%37 zrdF0bSbC0e975*3Q4r0rBw#aFJdk=>~>>9w%S!C;%qG8Q0(T7EeU&SsgX-@io!XqGI<`6W?!R~TJg_kQ>N$WFR>kC?b z21&g6K&J^sWtu<3S}$KZi&*v!m}M|c^``Ibk0nnxwNABD*L@m)% zVpEw>A6;82=@`8j5G^zq))ZMOWDF6d^wTSSY!lYfq@7>L_>AnC%gYX@Z(p8k!jt}G zz3RbjrM{w0|6^Vvj1;i~ysGf+YfQ=B?AVs?Gg#0%9aR^Ijqv!L-IET;`>AE}nmuC{ zXhA`NOO3MgXEp04WzzWD$#SQvdM&Xv9mb@5Fz8REMd?Q!dGEQ)Z(of9P6x&ZcEhWO z?}F|MU4XdAzeNkVcIj@YyS@u*5!bIXVi0-BwK252WZZW!OnoqQQP}N`WmsKgP~H38 zh&<8Bmi@-ZU)yA3mSkCxSvK=DNxJIhkVLV|EAWLV>ky&thm9r&7x%i+y&?{_RX@W;fJ0W!~Z*a6iJGbZ23zR+`T9aZUax9shP=l=4ual=2CQ6EZr zkT*y$pKhK0gPl2(>Bywss`Vw6{!wcPdN1Y!&^;%@ycwo;HAz!tOipChyj@lU6=$i- z+Ngh+UDm~BmjOb+J3Ez=`dd7=?`Ii7;=yqG0HT1@mjz7r z6S}YTN4`xdNvwgd-~UovQle`*#lvkv+MbF25)i^I6d)L-{) zkzKq+sE%iPbEgsO$)BF28JIn z8V?5m83BoR2`RTmyGZ&5JaKQmyz&m?;_SLbGoEEvqGGn7mQhKQNQy3McvBu(AWU=q zBJnpR$~H~G%O5$$6BVPc?bUehvC=v4oGRQ0`^lpxYWmz(>R1hs@K?&BF)Iu`4H8op zV?Dbz}ClkKYE4=)he+xc%vWtTDkBU{t^a6ilM<;U6?^ znZAULXO>k{RPMQ1ou8RXvB~tUz1Arq4V_YG2L!LG{b?f^Di$+sMmc5ATUpO&5PrNA zyD9Ikno(V^zJ{(3!FDBaK6ouiT4(x=2e=o!qrMFRta~{HM%Jdg%l8SozkWR@E_Ft? z5f5g^Ov#Jcn<^)STzkpC@vO8~pGCf}%r(3}&o$8E`!{wP*2^(Gm%4%L~Vnc1s6Zkpu7wCuH$jY9rSi}q?P_uKx3(@D3v6{ZM;ff(w$DGu4rgOjDOYa zbx-iv+YyVZ7gV=LCg=)Zk5X**ntC>m#$8JTb5ri)RX*--Xm;6&w$#!zW}ZCuq{h(@FUG=Z{3pg@Z*tFYHU$%XoPVdmOsR+kY??-*CF~t| z9%qPJ7?w1V6Cw~jS65eZYuzH3s%R01o09WJpHn?C-JT~G7hQ3OsrA07u`LW_RhCha zYz4TyMoN?`?-T`UnY@P%Wr&9Yw5H{ku((1VtTK2Axt2W1odhC4x%d9chcir*_ zNsb9v_s*-O>rhRaiKH)uBr16C5^T~Hl2E^&vk$S$?c~2en@VzW+A*{0<-`nvhUVQVXG+90+>HQ%zjgU;^T{2|9(a=T zU1lQa?HwAxkxMIzb`j49wSe`OjZM{ zeHS;u1eciZwb$Xgf)?s4TE+G=!9p|cp^+>2ZUPvGwEhCJ$DRbAUGz%NZgy{bOvbog z(%}Jz}>U9%V`6$BI zlds~Q3j*gij%w7U-RT+X=`05n0qN8u{`g1^_tO&ntd#CrJg;Ljc=EG#BX_?mh;DQ< zIN=XDhGy&D;h5}NYK^;d?por4LD9FHtJZZ4Q;4|z<{dZw>IAFfh!d%LeN zopOEpg1wxn#kXm268eug9|y4p`WoU*B^CZK5n$GQAFLr@b9V8P_k`lVN0sv`U} zfjfZGi<3=}s<#C$btfV{W@R56GoAJvT%g~s$X|u*;GZN9Ha5P2cMJ2b(+3raR+W&c;MKgcyp8pWmm#J|6MRX=ND`Gb<1*o_+Woia4sD6z_C9cep~!ui|5|= znny9K{T^GR&#W*z>v21x`(vVz#65nq1}WT8FmXJPOs5dOhCl1a3 zQC8!8C=?L1sA(iCUHV>RHvZn6;2qH!$Ynwmr~Q<<=m*7}j$eHzB(XLh#M)qAOu~7! z!z8Y6*5SSwElRd=4l8$H`oFzA9G%$(4cu7Mzp*`ShMgG4nNR84<4}B(pwr(uxZtt< z66QN?R#{m&x}zbHDzkIdpsPeAyHAaqH0RA}G8PG&PQ5q_^ua7j&V6q@%h)dX`H6$Y zrT23_D7~`T06Ni_)lwxuVL&cd8hV<8g|@F)WM}#VIi_V+bo1+Sj0kPxbe$>ZfJU->L4 zb4GUwOzNL>9`3~KbeEHU6DvvC5>=Mn@tWJqoL9mK! zh3PE;jnhJ+RyovT5#%iy&U}dYcqNF4s};r}J(Fl-UaQY|zr~i$!Mby{^O7_&FKex2 z7{etg&WekCj_k@?KOo&s>!`Y<+j3Ud5d3Ef3~?7MQA2%oe6#*Xqo5yF z>)sGdXsnawN0BPc)=u7t#X+zishw_BZo6ZrZzpU*Ne%9d0UeC2*hNk9hl&?aa9BQ3 zquB5k67{aPD+K*0TcD!~Opsvf$!KW^x=HU*;+&M{tr-+Snf?9iO1;447ab!Y^+f|0 zqU*P&*7#Z%zC%Kn-qHr=zOYwMLdY5MR_1m5~cbQoL2<@z|*}J|TI#XbUDW)IFDe9w>F`C5-=$X)E^uT;eMzy^k?+l7 zyv#h8Z*)1kAwK0JyQ8W~)|kd?c-_s?lD<60a3(@8Jfa{R+#npOfz4}YaqM8u`z`$k zn+pX~?z;<%n;ujBc_ZzE)|>4Lp2e=mg;p!e7gD1?$dmPU6D|#wbi?Yg<)md^u^NdA;V`yd;7hEO=AQOi zzfpW4vD4j*;^9@?vL=U~Vx6>j2=c{O2E~)O&J1OBk-GPA(Z;_`@X8 zQfC5z<$9?_{)-rSt!>ULHzq{`4z~IvnIUd%o4ow5;!&hwFWgThXy-nDz5Q(tW{w8FDC_E4LKEr6G8Qb#BYN|uNmx(!l=+Q}cev<%gvV-MDyqn);qlrWetkj3(I~@RHm;_ZkNerF6erFzm9~E&HK`yGCgI+Je!n$8h1?b8y1~5} z+f&aJv&}AH<+polbOYLF(HZ_ZhH?zjf**|Idhw)74y5}_j)&dU7tZB+mRHOfh?H*ax(BsZ7B1xq z&*?}O-JC~xvx)yqj>=lKf-%sB|<-)io< zTLhMosiE{1o@zJYAn_=$QD4beKrj8M&{6`&jbf@x2j}SMoW{s{nWh*$<7+|i9EqLX zowCzh9&R{QJ8;nDVZke8T{7|ljYi8>Nf&jmmhn4pQkFC^1}4A`Tw9L|q58~U%N{Ao zp{8K}sKX~*W-c&P_@z^boimSc(e^=?U}c%-Pl!0id@k@QC6$Jpo@sNxlpYfvQ^eKI zK&}p55*SnnAImL9mANmZ4Tav<9@H-Ao=C|BkM@?U#>@exg?C;DYVFFt%(wN#XzL^k zy+VwDa}LSn3RY7t6hUaWZ@v9Whtz6a4YH8f!b$>hkfvEyJ@3wi(fS%GU|rmuRi6M< z={h%>ZS=a~xI-e~J>lx62!;>f?GO-bIFm0i_G(^h}&>qaBYu9xA zhV8A0^WgW4*3e(hZ`bE8Z0{fc)_P&b|F*HySY zG&JKCy{H|M{|2|4X;ht(nN*7v;!-mE$i65leIwc`&r~%s(Y%?p?d)FbOb;bo-cC)47Id$^a4=m+da3<|w8CT=)~u*K3#oXgV?9{@4p-z{Pb&Wa|Hx-}wQ6;V-IV-f)Ii08 z=Xi%&hR%c@?UmbKz?V1n-!0(mFu7x2U5jC(BJ>GS@f|3Jr{)A1mSQ>xEKJ6gEOC zV4eqFu8T~5Y;omF9!n)A_DlsZ8%$p}dNL;Q`EwiUk%n&AqbpZ_8N(x;Jbi|~LcQmy z!f)?(UR!^k!=A%kB+Kq}u@9*%R^PZeAvXAHBJCJ^LHX2OB?E4bPZuET+~iZ2yWP@q zRYp<|EE)(SrJyk?)+;8|T0lg_6-2f_I)jKuck5nCMBSV<2npULYp~pA*k(jgx_^7l zs#C?Mc`*;AifLH#999d6RFYT)1qaieVms5?d-SdDi(*ZjT(6jL^ZjWAibbA1i?1Kr zv=dWpS?o3JN{21&yya;uvMLol+T8rcc``zHF)!YwRT^*08znES4}-CfUMAA6 zql@@LFXd(Z^_#@xOO)r=1#T2q7_rjibA@bu~8v{{w;hvQox+xO!!lkwp&+nRN{ zFLWc?S+-A{XR5*nYF5mb5tt>%qLk`QqR8G0!S10` z9|a$ezwwF1BZo9?rs2x&)rtLIC-s>2#Tn?GBhoYhn+0MF z*V}a&moG?vHJafr@^oI95j7lYbMG+J_ZLD{aDY^|0npQZ@mE##1+|IS15%&QyCFA#<>}E4?a)p=F@d- zOYPcA=oQ?u1AEp(%%d{hAbs^26hkttoWa;>%)XpV$O-8r4`OYJEbV=Ac7zg_h+25P zL)k=Mzk*~YuW%$xjWlFAc<=Sqa9{rbk7Y!W^H>7O-OF+LU>JX6J(l}zOiWCpNME4u z%11gP0YJZ7dwkETW$uo*W(i!i!Xdvn(vmwQ)rHkCb9Lo~5|KH4IDgPx4LqQIsr#;D zj`OO?RGezZ#|N>c=QUUa1DU7*+?1qq?zok;OBCVIUKhgJ2x_wLUuN~+z!jO%c{Oof zDpr=&(@UYN&cY*pB?^z(^y3Si*x;xE5@qF(jhmarTq(38AwKmzA7{q^i`#%;-P>`! z_FcJSey0{gh#j}}X6BF6t#jdAY#RHFxXv&<% z?aGkx$k9>PNzCT3lj^b6_4RmejGt>$u1eJ&DE=(Ol#Mw4)0}>xq_3cEd6`b}D_A%$ z85^IN*n%djCDjNa$m;JA+Ol7(K&v(~kjp@qL(@_fB%JnfF>qe|> zCF8+E@zxwWD`#vkr*BY|Mz;fPj7qGDdf~cJi(i}wLF!Ry;iX)nCwq^@H+&VW#HXGH z6FUXoTJcNOV?i)(e?YJi4c5)w;npb}fjs6?N%TOgZM>c}J+-fu^+19pmnrfd?3DNJ zc!+|fYS|txv{$}5+pva|x^Z@TI!M)O_>%V5r4N*Jy|D)6y+wB6+MZiwo0blFb5?r$ zt1AuMCF&8i%(BcO zJAC}+$_C0UcP_BB)w6N<=V zCO&+?xi;TcZ{LD_s@$aM{9Gw7ARWPPI7nv3!YHPX8 z%fmBU&A1s2)~)#`mzNKhn#1Zib^+m9pBre;*(R;I`5!uqgLn&~kq6#cg1^i)w32Wf zc+R>cK=?q6&p2;=Z~iKu21Qg3!t@55G=t%DlM6?#fv$yHwt*{XG5=da^yd-Tzg1Lb^D-eq5R zLrB6>7YCZmDpe^nA7EgetYkIjUt)c>(1K41eARarq42cG7*%1 z_hsxmYs}Ta6Qso+LpfA<@hJwv3NGBWXG3%<&7-xMYc6*ZZqE0P#XJZ7iFeT^HxrVq zlyp~~Q0v)$s-Fmn>+5Bp|yX3;6GeQk`n+4>mE8WT`$%NRU=3vXrH)| zz9{n&>O-uEK;7oPP-&%zyM262Zs-cG2!0%AftSi$2zfX3z^iw6Ku`Ue0{e~>Ux64E zPJ{6A9T_hAPYq3x0wu(rN__YAX0)H1<((wX$VO$yWQAT56>(tCZG$lfC?J171o#Qc zOF}+kF`3#>bm?bwPoj;rwANf9hV5SzvecRe9BqOH`)uS1ilHx|5UdMS*A3`mNzP1^ zBpzxiMyJ4Y+wD;@4Y#IlRutdBr9A=XC7xbLo>F_L+0AN}x3pJa7kn{~wO{%7^u zb7l@Vp$BdhxnSY5oW)4uspkQMgMZkXp_SzmqwT1i!p>FB8HA@zpZ4j5mZ2O6QbPmYe!! z&BM8Lb8*pQR3zS^c6)12e&LLxn}+fdf~$X;S}XV~peG!sWV<-R5vEeRS#+@u-*E*V zD-|OK|8ez*wnb6)HD-EKYP@=;pz#^bHC>7Bxz@G@7rdkR?*SbM{z8s|zuBKclUR{$ z+|UR@t$9&0^J`dyH`%1U(Q;BRT3g;|=N}n4XsjOqMGR0kuzU1}oU~>_xGEAq9fz-5 zf?OQ>eflKJ8h!DFBLC7jVKKR8#grD^`55mzHvLX%jXoM19ApTKl7j z-A=mTo^$jet__*`bug%fMe1wy5A{sW3%$MP)SsZDYGS$n)7%4fBcujUV6igsx7hk~ zw6?Xk3ryKsx{$tu`W2rfdeyXXZff^5_t^ zfj85nZ-%D~bH2!PA)Z-SBP>=6r_9%TQf67Gv}GKC?axc)~;YrQ{%~RsFavpw*A_5=k$1jWgCoegv7fVR$Y9kd*Iz zD(n+C&(hGe2Rx*J#y)_oxVeM~$apE-2LJib-;J0&1r$lAJ0u6RYW_G@EpZ_ZvU;32 zueZtKDmAyj>nYmA`!`!xm2h&zAeGcQ(AbZu;2VH;j><8d-KU+ z7DW?kykNpJ5N$N#R|1CC?3Zxqx+DjGR<*JP?tVP z5xCGn-SCE9^Whma*RH(c3n;mGrHo_Xn;8$kd8+*{zqtZ`E0?HFP__Ya^4Z1$Uo`Yw9N*AoT`aRYcSJ4=Mb(p!n!%HOuGF z8OVx%H8xf{HDY1*+WJjC8rAJWeEs(a{`e^q2Y+(1P4w*7d`%+4Wxl!4iPGPOeo}p; zy~4lm&~Q(l9PnK@J8-EmjkcX3NQJ&0lenq-(%ok@s#^&FAGM%05fqxD2z_($bc*NOilm;(1%?wAMcrmi(a=LXcMoRN=1)StKN|G>vz> ziHL~dX*xg7SkXP;#B2KO=ks1MLPX)fp{#4lpnWeAFduI8nqxMmj%`da zefYp=@_BzgHX`La_=>Ze{HD);eT6s{q>YHhsTr)<>1If$ZWDpL_Yoo>zg0PsP3nCH zkp!72JCL5?ob_ucjwaO*>il`zgjj6Gb-L2>6z=xZZ*oJHIrv*lZ@LEu4LO$9i|Go7 z%RPq&$~{~5={=fri`1vsasI8+;LXqNlI@SfwmG$Od-gTQ_v41&p8W3b@6Rvi7l<<~ zhOQKJ`YBVfMfgC_Us9$KP4*9DJH|dLzR)$B|B2K=m=hv}|9MfUY&aVpOze7-XF(#| zqODqJ(B2I5?!+4(hLN(~Phw0(@O5XB{MmPUDB-z2F;Gu4;aEbQAg$m^RH9w<0$|KZ z3y=LWeM>q3V@+p9=CVhHx4TzYP!mf7MTQ6Kd&k;`x~fU+){EQ!Bd{(U|(1o$4Ok4|R?O;@0$tN|4~^H{c-Lu(_3{OXK~S59Y=XP-cAOI$wWuWanTYl!{0VHbMd-a_naUb%o;7*h$??Jo&4`x$ANg@ZeOcg zTg%mK6V(svL2}E=zKY!4m?H5Pp%}4P`+x-*Bey@7(rZvjn-iJ8N_jlSP0BVhwW)E6J+IN z751`;mZjFqm@ybGjOX_@iT0sBvBwH1zJE*jX{sQ)P}!E|i1oRy5}4;nvXgvnR3Z>J z32q^pUoeXBdJ^{Od{3hx3%|Ev~Cyd-BtT<97Dat zRabrH)2RWqR-nE61JJAv4@tRn#8?WMZiY(;7>6q-lNLNBcDs1;B!r48XsYMvyz9WC zs1Jf7M$3ueyw1(OzBO61-`DfgnIP^#+Ie|R>e_H~9)Ewpdvm4YRX~7vA4*Svp+X&{ z{?z7Id;}gor~nLard-3v+74&pU$#RrgtvqD16&#l)CaZA4wL*{AN_e-N5-giGU|vP zDdN2+nO?|no#p|k&-W1ZVezmfh=Ibc%m^e0klHQuQSq93_B8wcG*-Vai;3c4)&bk2 z_1QcVbKABPWMs@U@2xg2f$iks-iY7-?2TsZV|?@jf{rg@QEI#Pi0B(a!OQn=_Sq7> zu{|(`+0Z0X(>m)8G}#>2qdul4tc5qA&CGkvvP@V8-pMx@C_)cJw6Y&SM8{YNvKW-n zrEr}uf&wi(3}?6^dm;f)b?THp8d4j!=*;=}F9pNJdq5=H()ezj%=&6h4)0|1f_BzM zdVxRDa%Vr4!L8r^ed1KDHUg!ABSx0dKVz$^)g(9l$-YS6LiAx4W0PAjWi1fK?4iVkqO(8 z458hVE!y(&HwVrG>jlmNAm>!~k$`f-vg)IILS?9Rf)o@&0GG{Anf&>aA0z#zvb?#A zjwJ)d&ce+Z4h5XJ=;9Kl6NEqi1vFL`;>@uen!IE*_%J|hvkM!uGG9$PmCHv-SaRP- zN?o^^RBf}1@6dLwy0$B%^gKPOLU7j7;c>BExEV!~9YU-?h-zzg@AI`%7Rn&juh_GZ zEbErJ-ERr{FK4>PlsOr3iq=Hc&94)-`F&11CGy!Z%E@o$fcBc|9PByR9ogQ z#D~R4+B}(uSd46%RL61@p=IvMFBRxV3Y%PZwLtX_nP2T*W>q}KOWKdMLplmYjp zW7hX@omWchfHEc0=l*foKP(MY%L|9j3GxRfTjx|Pg}}1DTRga3&^}R{ZuPeC*x+ky zK=h+JcCK~?g7AgxyqR4r)@fGTl_z*`Sh_BPvxnN!C?XW1LE81B*DX%~U{8%Glm8o4 zL+Lr8UV%cmf5_X;89x<-0*5n|xrNJ%qN3*mPT`ZZnTz_83nJLeO^c#X2QU)SRD>l< z-kaKw1V1lWJxg>oOJyYGn%haqzb_9XNJ%HXTA235jkE737r-3Qh%6j%gKoGt_8^o& z)=YnQB&@-Zs<`XJm(fXjTI@&ZH=g)Q(UR6HwVsy+>QRC=Pt#J$7=(Vf>|n5nC&AMN!VK*?SH`SdW&N`YRC` zO)?Enuk85G`quv|O#TSkQEXU$J0g0;VMrC|=AtQQIdiI@_`}6}|EPg$$vhEp_#hFx zgB6L_4n=P18>g2D0XSN~f+O%3AoPm*KT;F9IJhEA7S#5eHe3A5V)ui;9%jReX z+qwSCs+iZMD_3<>xId=PoU>g{IMuo0Y0ub}hJh56zBaxj$kFWZ4o z!XsP`eP4tAL%~(_z%8Qd$r#58-$k~{{fJ1xIw4Zw>zt79_|ioO*@)Z1R+r1n=v3h$ zCp75pz*BGPlRgDOy~+s3V9-T!KQ8*=hd*q`=t3A=sF4Ka_6cr}nKfQb7sZS%)4Cxy z*4Exx@2|BK^6@GwPm=8;hXq3Ty~3@{;qYr^WiJ~uYLGnrjte};Fvs|7yA7D|Ztx1h z?@HcnOf(g_RufQa3aZ&wfRcFCq4FO^B48cZZi9pw(c}4Fkt;}bQ{jD6AK~CnVnWa^ zwBtKU|8V2j!b3SWl!fy@qR!8oY|Cw0jP_v8z+z>9G!8)r$gLRSmcbp)7VAi-y5l3e z*LL=VK`p=Ys800kNMM4NH>$$R_0emgsAB)Sl9G+0+j+1P!=E;1lxRNh?uu>(4xHD9 zw(R8$@AL7xIn@?Oxa6m&52k_Pz`YLGu60vzJchrp+sel^ovSpFrlqOrU4&UO&J8Ox zX3Fz{eDu~;H9qLVvwv$oF;ILC%SzTi9*NZlwJiZ>^LQnFar=#O7 z|1Kj+jrLhmCR)b$z_vmg-wk8ZVb`3VEgFRx-_;8(G3*|jOg)%Th=>8LLw%7kF}742 zCZ;Ci3q@AC_2_DKpO#bKgjR-xCQF9*c{im8qewOXFk(M)6kmYLJ=LDY_=m$$rNFA5 z)CkLziu59VqQDt)KUR?cU5v-ZWRWKupTN_Lc;Gp%$_5IYAos*TJ|);bm9CLmBWIl` z*^2eEp*$-2hD0A~uk-UKfV7bpveMZp zy*sNjGs=@I@h?rx&D*Z%<#ycKA8((0o*0vb>TP7LZ}5=37<_p)=^P!U-+<& zfP}ONij;sTDIg%y7^H-h5YjNjsD$*;4ZkxOc)$0) z?|Of0y=(CY*IAeOe9qZtpS_>`>}LzBkqk#cGDm!d>e9NSx)V24`vhBj*LizOb52be z;A8-be5Wdu;D5`gFLOQuNtghFNAbZ1VC^Bm0DB^E5&3I%@$b?1YI z!%g_eoa1UpPG)A`ya%jo`1P?jP9laK0R^d75x%K3zWdfC>8I zS-+21KZiYUQBX-l_%8_i=aPSS_2%LCmDp)G9JuJdq+%vK{xTr7c7yUT+M-xv+hnId zbwAww@u4^3p7tLE@XwXW3vSTQIL3~DEo}~`iU%%&o(gCw_NYB z_kG2)H#{V5hwi9PRODDQGJF>8v`63PQX4(W1g8ks!Lx zeESCb%tAw}xt>;!<**>2@B-S`zfC~+B*}AMUUl?$ZppL+0J%5(MEs8|U|=kT54zh3 z6%b)S+1vz!>I_*5+4{Eb(vJvDcP0y%iwj$D54u=-v}#Tza_&4I#qfVq`^z$a+Qk(X zPzeh=Gxzt=BK6w>xsc(T?*mxObZ!^`5M3?l#_4Au%Zs(bwD!?eDsSC9-=1=*w7aK6 zS4gjijmBb{lvy9;vZR$|(kuO=W&z0jJ3q<%;sAxfW+Pv1GEc!A)&N$v+6#gl4(L_{ z(Xw1!MP}w_WP5u>t0%>e#DoMsEpF)bpp9A!ZhcX^Mz%)eMff0bt=qpmnxrC@lUqM{ z@h>}JCju3&DF?!mo0s?Xu*=z|I`}CHBo%W?k|2ovYCU@@6$c+zIaDB)9$^6m6c=kW&yOy@?g{F0Hyww z$bW+We{K9BsMEjj`<(UH`RtWUTO)+6wB5hANM)g$`7LELhf`RKz(6)Lq(WO)_38up zY&@Ea6j+N&^TuV_;)(_WASgb#e$Ki*8c?-*mcwJGu);c%UCUM|gw%psB0bCZK05TcpuQf56WzTRn&9dGyA4XiugNh$fDjv8&D0adKmF~C5T_*7F z>_GP8;sE^U8{f5HTxPJ*Gnr$nBScek<6CBCo8#L}wI++i+oo!_c9hKo zw?m*i!u;amG1@Wm9{C%giWG$@r9MlfsXB_#@k^_ z5Q@_d3K1(M!)lA<@9N&t|0H$X0%sP)BaB}c&~FlvKAXipLd9Qv_DFpU$2_Mc%__QH z;=J?OvD@P+Hr-V!dj=cbpM-9C3LjpZ{&G(jxf3K**|{{%ASg5DDKx#h=T%mIVjNK8 zMw*stJ-a|0c38G8WcnX?Bq+60zjzVyw=b>y9mcPQ@-SFt*1XH#cwJABUnk|JZ2GfY z-^z+6UGBT(ti_Iro@?zUg@9RBJ|XJ>slQ{-pH)>hu(!u^@H8Br&X+8*8^1kJd+3w! zYr&A8VZnCi`1Wd&_kTp|CLmgmsCZBP*R2f1V{0JL@PO3nF%|D2 zwm#vkw^=#P20uAfh9?PRA1NWm%e4fCb3|G*8-46yNL{mQ{U3%nh=y6tg0Pb8)#zUl(z^(7dhQV4{NZx56kSv>pea5u z>$&ox4$U*~B=QT-k|z&4A)E82!I>Adw$zSCb?aK}-uHuFm)N+=nBu!+w29q1>XEJH z%d6vi?WqEEbjh}FXJ#yp(vB{aUHsetJT89byw>w7=01yln?Xaw7BiH$O*7Bw@P>>_ zSdK^Srm~NtK_8+6^sxcI7W-1YFVbSzTVLFGcYh=G@Y#6=+7hF=wa*b~XIEwT_Kpz3 zq91htpaa|8D%T*S#9=bDZ1-N3>A^9*{>Y#}Qzl_iIW*0xrwt%lq*xMI7|D|g<|BVs z)i&q2S+kblzOc@dNJ3i~DaXFtB2kUSFE*FP`Lj!1HY-P6P_2R#aWOto{NjRU2knRZ zJfpd;t8}Uc>ATTzp9Uw_&2ld@YoG7N-_1-W5a;PDt#s6E%+h@75YNj{PR_382FW74 zytW6U40~3q%g?@VSDMoOWu!m72n!k5*b^c8e{byT8pB%F<&=2k^>W|UW%mj2x z?gy-^vsTa#MwQ&VIU^fLO&u{^X-~eEBK6OnhW=hYJ2F0x#CO*|5G$hCz1%NnXR&GQ zdaoo(*qr0iv1Z}C61m32WHodDAU$-03tHCH*o52!SizM4n;@$lXVK1?LNG+-ua}TK z;rA5Fi|dLFtv_yH;XL8j&4IBfQhx6=RBE#@1MOYj(fgc!6sW$7lAHqL*mgs!3%+bF zTyZ%emiN)%y)38{usa9NP=l)ON`~jpl=F4jinG;Zj=(yxV+-+xwJ59P+W$9%kV^NY`!>SOI0Eey9nvFKlDz-k|(WxdJEr9YM z+0yGAQ++JGF|p&kw?M;Oc6N55?e>}fc^^=2A_V@QpmFLi|F5nMh$`Iz0^Ks)tQfM3 zRhq+bNpbkzpMEuCnNoLYNh%Fo+mpgY6hSp_-e$ZFG6j64yik@xAmn3lpYCe0N1sly zn?qJcSAH1j9%FC~2*UG^} z^OcmynM%y49d4^s7L6kn4+bzX4xAhRPC@bj!6^^d@vk-Pee=iOgRU^l!UreR^j~#T zpc9u`E*w2qD*U2t}X8oZf%sfL*YM(=p5Zj-SXL&_E{PfJrDmC*x~pG;%wM z75GCH9_$-)nf{9|_#c?Op#iRV2-AfaCG_9~@L1}B*wo!ETTD0# zYo!+!FP{3BH@N_2)I*u|xf+j`u8<6ON(0UDG)?OCs8Z}|3C@=Kvm*!=EQQfYgylu( zE8s{hL2i3iVTtgl#Bd%j1(~*z&lf zBlf`WEL>5_y?OB5qmrBMY=p8?>o`Ba9)f;i5C1Pj(f=w;x>IefG?5p*4}_)8UBx>^ z3SQvp?-u~pBk(GAi3V8D+mAQFgdkuZ_lws4O@eF(F+JS9fYltx@cnwHt|YACOgmnx zn{F`t`3Jv&6%i*+n`1npd##)v1VJ=AHlzltDi9@%_xpeS;{&dj0?*Tk@P0}EXDiaS zkJj6z)&2v*UR_R`ouI${>?Jabm#`Y?+lX+U^vM>>`SIU{=FE{*3pyFru zRo}6L20YLs9pD&vl+bz{KX7#eyVom|Y*!il2w@fSoJ=a(ep93v{Ytm74<)6VG2vtX zwp0sTGc)t{%5~b2Z9vNzZbLph&egA%OMU_N{+*yPAYUso5FlUq`F)%Q)t^2LL-T+@ zY5bQjs;)brLDvlEfo8$sog>xmJxStTceUkh2jEb<{(R47#e4VS`OU=zfU*qhrgj0z zFbWkC*KBgA8XKRK#Hlr~rp9!VfVQMG>(F#~emdER-8^;dkot9r#P92*Ri&sNj zKobjEGuvWys@-gTR%4Mm*W(PqX!Ux(ciC32nsUOO7w2YVxa+VZbCC|+@nd83t4RJ% z6PMV+P9WCE*H)6^zF1L{1&Aj6FK-2nVM}B2lZEFA4lTks$6b1Q_;C_f>Z8gRqqPh= z*3h*<{2cMw@9IizblX8o8(&lTi-FV|rY^C@h~34nNQZp$ zCrs52r?;L=v%yKlUFL5@Z$G)l8?)a@d=f$P*mU?q_et?=JkaRA8vmu$Djz6{MQPiX zo(E@{(~!R8TgpyG*#NzBKKFDf2qYMO1`?@Q_9IBcYQ#)^>c*Co7Qbb_SQMzN@Y(I9 z{5OyAB+e93bErJ1L=5D+GJuq4W~Q~K!twyWwf3%$ro-&*9asBBDvtODOl0I4T>fLn zM9il00Rpw{)9}0*o3xNp2YO@?gr1aRGPnqx7RQmmt6;aqD^k1w1+k!m zTQ|^d@IZg%mE4d|bA9M*>Z#-o?c;pm=iNpoBkBE+&(z1RZ=9!ZGbV2Nnf+?r0WAFs z8w3{OjeB0=x6S)XGGU8|5myVn!7(*tDBUK+2pdv#GbLEGR5|Ku4Akm_lVabmE~ zpuk(0opteRE-2`5M>aHUB2P2GuGxukJjWI|ZPi=2Kv zn2jL_s}ccNoD^M4IKF@?YyZ)Fs;VG_EY-mASK@sfvXRBHF-lwt_h}yOL79Wzm??3) zr?Z|8mvFX5CMP70ckA92>~6hxBq0*-Rl`N}_iGlLwI?8Fnsd#u({Os0(IE-2v&vp(l&mEkXNq~fE-5U+2OZ!0e~lH(DNm9_9_*D$NdNeIHX8Y=nN* z?tr%igv4y&U&4H3LF*~$bb-FebiRc9N=AkIYJc^5k#y1kxKY-I4;zMuhQ2oP3@GI= z%d<8-RLhR(t__g*tOf}NGEa?-?dx*`)*8vX?xf>=ebL(z14Vv=3Tdj1JYGP97WH2F z#v6c6Os_G)?fN}kJ{=T6^$2S|R;c*eZLdr&BBIa}0s8~)4qUdQtxJiHkE>J)9I0~q zatF#iRjNCZgegUPt4-ZICM#kr92_n!iG3LwvPj*XcjW9$3a~e2Un`Mb^y|yj8hX!J z+IcIe%3H{8ENQdkqcg=;sGh=kEjzo=stt$s$%Gcivut(L)A3PoEeBHBF5~ZwA@Srb zHJjVh=A%XG`B7=s2)V^RpaxJ5_jFkN#?zN-J5nBRw_2%9eGZ-54{DKGTo$kVeX-Hv zxHUiS*2IU(O3#sTXvS>u-e@#g>bq;lSNX44Pg4A(kDIc$IHv?EdYt@aDAi%I3gTea zhVCT7qw3Pj!nVD&PdHnCW*eWDCStu7EQ0?4(ilPxu=gLCdB=q7y^ zSv~9mgGp20LZK0XK+&irK_It1hHFSZxTruy;5KgzCS{MI4;G2TD6#Y7HX?MS@;+zg zDT0eY?W_h}5=J()yTlN`d10!)K4j`^5JL?2h|~TKv8P1G1di%DKS72(t1LnKxk?uY zcr|e0?(hpFz#=aSe@h`EsK8}&*I(XUs!erN-YL5}UEu=yX=PP+Lw9tn54W4W5I%={ z1D{*>F+bjfS`KiN+3#)1*b0vi5E78sjw42KrT9hM`5zvRc`lhFG;t)x-y6#){m_z# zT@`j+tPcMUw3qK|B@$6{Cls6aoD|WIpNNlIja=mvtXXbM6i$?tT+4n7dQ4yK(`MAV zTr7i%EN*KJv{y^iu}S1byhSACr#z~Jg7%QCSm0}Z;ltPzE|IH_&Bte^lnLCD2F&9k z6H6kSODK4~3nE|OaNH&;;NLurbFb=}LMT4&rt-B@)wz!RLtNX18ToOTc{bnTJ_ipYPucXMagCb*8G*M1;Uf zzFaBi&CK;1akS{jH0XnO_u1#=`buE+A`5CeZqv!G&RJl&d^dF?cvWGPvMKGe% zZ!JySXe*r*)e?RxfzQ6*whrVk%S;5FR#KIPAuv^h=2^l}5|Sx{2H2_C6KQ%v$xluq zGCEBnPNc%xW8lu&>Qy9cb{w0}0+ceJo7UXJ-dl}#f8Sf^-LJ($C~I(e6|8IqE9sJ# zX-UI2c%~dTJWF;5R!et^1Lh`|X7gPVANq_xh}*uRFbxR1`+qqdFtMgVX7GF z1`51Ll{lroGZ-#iK|^R}l>+I44ne&fqx|LUBsPtny+}PP0y?>7E*dg0z#w9KzPOV= zG1l^`QI(iyN=rq|H?F2w&nq;Ik)D$571-UB*kknqw2-Gy=etqJ^5?MO)Y2f*+E~i! zmD6KRv^K2oCTppkYXWd3_AqhWm5$k;DrQekz)W)P_$oK0*)T;a#B!r{r};;bHHeM( zO%6-S+bW%`Tbwhm>Q6ws&F>owRRL|6O{C?W8)8p!SWF|PrBcqvn}~LbSDBA_UF|Hh zX6vjyG>~1|E%3Uxyr<<~MPjv<3WO>ua`#Gdoho``PC!Gr#e?+IATvv(ixV~2exa7_ zmH~_G4=9V=W#_D$d_1HvOB{<<+8Yu?YX;~K|C^gUcm&x9VwyQL^>$^JppT17xK3F* zo3i)aY2V$cxEb_)#Bj8@A7|}2xX(4wM2lp4G2_wa2qhnN*>r1C=Qd7|UTQhKx*X*7 z1n6ssQb>khi&U40yt<`xPn!+iSM3P2w=1u1&Gs9H$(0ciVZ_$DZkhFD&CiLjmTv;D zI9tGdh1uu|@s_Nith5Us6%c1S(FAQ**bswlJ)ROMrMTcZ75~;zI{2+}Dz6qO{my|j zAP{-O1WFKP!Kfte29h0Nsg2s2vq5?QXZ`pMWwXP1>V*}NIh z?%#%%h~Bs%Q8(=~x&(rkkvWI`T?K}N)^Myy35~MpBI~xEK_@#CZ}MJeNI~Slx;)Lj zC#if&?tM;$MdRtWg64}ONuFqY)B8Mwj8_iP6WW&Y*Hb9zv7fTqpJwiK%Z7LL88_E> zFMqp3oe~wc0MuY&Rxje#PR)<*&R1Vcs&?7gS)W@By4)7qmK*Ilp+_qm1N<=bmV(!1 z)@p1#?{T5up>b?_70R*K%5z~1cn-tAn{4VJlySup3bB{Y ztgP-`r5&?sM5h?shrrmSj=_;GYY0S`mF4wZ=6C2ThQ0n#l;5Rena&l$WrF`jiV z5qXO=zkO{RU4LrxW-F3VgxM(G`WlD6{XKC~u>Be_K$~lNsS&rI<-}y_L`gAfVb0un zg`qY#x2Hf!hHvt4qJ`n`ER59#BTxy>drLXXNQRUuxV+=lrF9XoitvH6b1Yvg{7;ht zZyimh>Eq*LrVV$^j;UvV0i;a6w;lRzDBovoXSh`Dx`Yr0a!DwY$Jd1F*aoB_PY^~?L4x7}?D3Vv23{$>XH1+p9ZWZ1IpQnsxr_V9sIJgm@m46+azq&>nF-xl!^ zj0q#Tc3Z#SP(w@;9Vu_1)7Rlcjnkl{RiJ0DQRkEhfJ3Y*9Q#{~)NXl=y!3PtY?FNH zw{aV-$+p9aj?<^E9~kOjqKg7MRCgjIWAN5Zsti?>L)mIC#u#TEW*|X}z24-_eNmc? z9B1DpWIX>=YjiF))d8qR-%Uj=(`Ar_$D1aHpNIyF(|0a&_F;C+sZ;v}mdW%oIt0}q z0=m1`N3(yjy1sto1QcNzy7Ii2m{!oFa=q48TT6ToPLDodw=bZ8b!%1OHK|$;`G^NXz;}z8(0g6i#Z`k>t&R5dd^hl#mv{xs zZ`RsZ&Y_hLQ)VL$!@K2Z)cIPysi!V>jq(h}VtlyK>$1P`RdqjXX1)^mG(;GLr~5{s z^a7~X;>pyEZVRz}m1YL?YG`r7DiB@C5^R#L+YD??)W334yg=+v#`gyzEbIbsIoAh{ zj_p6B4%R&Nj2MCU3tQvN4IZE2yZDfNFSGz6WS1MO} z;#33&>Qc~aQP;)A7Y&ATPoD(P%BjlZo)VNN;>IYu5-Uy`=vGotTwXvQR ziZUGQE=-@^SIi}kvAjxkF0=dLNDIT-g^NgHOpBF`#KG40ByJ&Vw?XTXa^7OB6!+9b zi(0&CJVA=W`xDS~NzKBYZ~mv5OC2V53ldB!It9kvCz8~gr7KRs4y-6d=YK;;x$6S$ z^{pOYrq70U(&74D7wjC1c94Scc});uqE{5}5@2w1ubAOc8r@}Qowagdwl-M4_YG%@ zWscd;Df#GXOMMRL#l$ChO4x$1QW6>s$;QVQ(VyS?0Ebb_%kfq4pTz~^dS3&!4>2?6 z50y^Pt3ZdQOnjT-(XFvd$RC600)xO7a=m3n%m5^t{pm8*kQ3q4IVZ0Nv}Zg6Z8%bK zL&?uvmVYGoQ9(5ejc5vGaP9j>xWLhO!gXOde)T=QvNh}4S=R{02%HG{k~5l(FK&`# zn_ND5Gam1BE(4l~D3=S0Kq6vp%;kUmVws#9cRRk74vfY`y3V63=2pqhXpYq$)`>UC ztT-EinHEN1DniOOCk>ioJ^m#HdTw^M2rla_$p7>Pzf7pNA&21Di(-X4Wg(R4++In1 zjD~!SH+eG~ppm2!&i$3P|2q7BW}xyu@KP(<@fb}f10VzLqQ9jEx~IX#*}1ZCusd@f zAcM@)R56ty66#dv&_swaAx^gpuU%b&YB@~11W>>-FlX=E%gV|crJ1CvyJ=x47wgX? zO58g$ZDjL!{NYK2A*N+%ZP2(1Syv}H^_XH1E4F1eB*A?0ZFct6GI;|!j%ZSak~51u z$qE8ZFg5l*qfm(%@d*1Lx!$L->l7(9KVB=b#F6Cx{X9LwTzm`d@2=S`13cCyVz+G zbt1JoM#~_5F7>tEt)YYYAxB{i>3y%>hhq%r9^Z;rw|=tc1V@YG+E}0>@qmKV4Otn% z)@*Qrip;-?egB|)t|?! zTWa0^IY9&6rWHL8ppK~q($I?cxc+gjizcUZ;_HKuQI_XNpikUSlUzI_{B183@3a*q zTEzZaK!vlF_u%p~HhQ50%oG5_+JVxTS&nnTYTycd`Scc{*eReDUkpd+$IsOH_~4v^ z6@^#Z>Pn{pt*U;x^_$7!+Y^+aFzdW)U6K%M;GwEjW&R_-Y-3tfVdv`$9)#hVRc78Q z=n-h*KYs?(jzkWIO`$xt6gfcW|H_Q|mFDc!0joJuOrPaT;QXRRoAl!#fJBWU91V0o z{kZ=aHv08j;bW}#OR{Q@KlXn2>NL=i%}*ubw77AIGZm)@5K(h92i_l_h}5enaY56o zTo!b6TMGF3*NCV)I&9YIL$-cG#|sgOrVErzhfYc3oy@(A+fBg zDv{y?5PD5(fMDmy5e;ee^uLCTw?=ccZ!DnrzW1IdSZb+gKAWd^xo?{#fK}?|Axm^; zKO8!pZ~4A&vmib_-H9RdfqYQ?KGvV^(yuU#;noP+jYSbCJ)53vo00eO_b(y9fH8u) zxwnKjO$uKpC4G`%NN!da$ZM=<<$a?_kra6%S*ht2U7MboHXBn3h;U*l6FAO+o7Zv) z;rXD-DPOe7VPUVQ-aqK2Ix6xi4KmV-XVce*5bxe3Kd8h4Bfkb@U7M*pP{q^nNm?FI z1Z)VlGh<%l-oXMt-4Ca9fKQ+#lei&zKVh~(Wg0gNcc$b1~GAlLA7KR0c({Bvj z%_)}?5Q@*SFIbc$KcGBQ(?X-1B0AG?=Sea+O6}PRZ2ISjFfD>W_jpnG0v(+*ocJ8| zVa*Spz+!72_?wvT+i%m;nW&#f+kkY1f5|<BaA7~D-pO(kOG&xn?`I1;vn-kJDz`Xm*)6C~1!!v;fo zYV`rI=)N=ac3NAOMlK62yv;SSdY`kzhahr0m#fvIqJM?W4W{k7h4B(dA`ofR1cJrO$FzE$i~-rZgy04#1j)D zLFISS?egTc`ka7+TeSe6ivJACKNC1>Yo`dLW(OSg*%m;>&zf;L$48@mdjF)jPnzfh z3&EM96hjXmu_p!hc&ygdy<*nY0OI{F0F+kc-*vP7J1kQP1-0ne<(zAmkKqgl{ImIW zu@Wg^yRDGGys=fj8SCgDZY|bh{K{f*Hvl^{~p;_5c$WD37 zL`gs@zQ3k+*MLL!Q3SimL8lcEk8Je>Q(c_=%3;P}T;Ka406)DxN1+mdNm8dP)n6y%3D*`R-A9qb3Xy?|i?A35svztqe?aETGjaqP8Ila}otSDdW z?_aSQk=Fwhgd?3-s%1;s9`*q2*V=cf=V7A8z9Vosv!^#nWPf8yl7I(c;M#HF-vz$c zU`Yer`h?AYubZI}R(-IC(V#-9CItcm_1XgIxD*u70CdNqVZ1%I!yj5i*Sdz0Mb#b~ z#hv19oNZS8lT=AJM{7I>@aA8Etd01op;C&dX|Cfa62{Gs)y)Q$(Mr1*!5Cewq>Hh?tfmEt^p3h4-YJm}Y}sS4v1)sb2y9mtH_FEifVtyUtZ@$ej^ z?fCGrKd??SPG_kBU)p!LM>S1C=V5MeMQM|`w0>X-Pa@Xzd=(DqXOOHqE^5HHOIP7@ zOG`rFZcf=8Rv)_CF^A3Zf-~U$>q{I*?q+2Nnq7Xy=p(EL7%WyzG=kv%tRStB?KN6K z>#jT4ixmv^NCiz_00ACAJ?=L&OV(qk7})Cp8iAu;S#wX|wBD1^K-p#UW*(1`c0wo;=b8FLi7Qv)7W zRaPc7{rK_d%fSbz{rtj$BTC_s+LL$oZym%U?{lek+-YRoe29>P*H%B*nVK~4!l0!l zJQ<;>eGjPF>a?<#$&d`!K4|)C0Y8CFn?9Q}SM8Vb$3B&HCL}{~$HQS1 zOJ!kaVpJ~peh$qeoVFX!66K^ zbO0ep85=<9J)-)(qsD4RI?M#{J-e`byaj)L3%LSbg&cmt`0j6316lATG#~{GU273kM=QK;6hC?- zIov($?W4ET0~8!8zAJ7f$!CsO68P{j`ATNuPE@P{Vxra$cA$#A##q}TDFf1Ws3CIKFMhWcy39FC4ql5~i$+|wTUj6wx72%Uwe(=v5 zOQh(TuYf(+1oq-Hm9ZywAwm1IJOO5AQ%VeR^zYe>KXrvVP-^7AwE%kmFGbQAU2qZe z1>4ite=w$&mX=h6TxPqxVu$=ygKoW|BJT^=YXDElEw>}Z_#E6QSLCh#O|-_p?higP zD}SDJ>dz8_5~G$M&p4Q%1M2n;SGrGQKao`TD?E`ZVaUCY6*+#@27NCWEnm@RY;3&4 z3szrU5pb_QKbpbvnf}Jkz<<8u2e#&=;mA}nu#8B})*b{9?%QF>-^i!3HWmKoN=v5bfx=+f5^N-& z1|gD>`d`wK_}BfwzFsa5PCC}kkTmd%;J^gp(&J+$18@67*Fy0IH+h22OmcbbdG8%Y2u03*&w*n2N8q@IA@7v4D9EZL)Fc_3NS zwW*-3?90;<4c;ySP^gbq>5muqv*vFA-QVg1N2A+uJ>@lFl%5~Yykx$O&Eof#XU_`T zw|=s+{fh9T`0HYwBth#(>w5->9B`+^HE)EIE$(zy&sAAYW+P3=G@;X-6qOW0)*hkV}Ft#~9Eb`@Wz8 zK00M^{pqoeDVbc_1n~GKU2kTJJ^%`2;BN{f`18>hNCBb!XPE%liE`k7U0nQNm8=?b zTZNA=fZ!v;-XtuM&rF@enlO}?N&JZDcIEAnY0C~QQ(+~gL2kKIJyX{k56+AZ@BN8X@$ogr)-~d7#OIP^{-vA;3Bn&E}r(vw*=o zBLeLF*2|EPnRM(u`4HSi>~|HK{_)q3{HFmxTic#Kw_*ULzn~t?xfJ&W3Tb&w+C0i*PUyPo)Z22*nWX*;6}2TtdY(y z`Y{dWJ%Q#w#o*4Pk6W*TbDxUW?F>8m_n#`gU_JkneaZ+1h=D}tEBiIP-_8o?OXFkh z+gj!Scl%z^MEB5r*Bt5D{{U!8^1tcNj7q-B95XZJe`CQ|A9!#$b8M#j8BJSY-B*H{urkkWtXB z7-=Td%AnD`PcLQO806&UR#xU%nJ#>ONX{Y^h9l>TgHI+B9QeTNAkm%PPP{snh%a37 z@_|}C45eS|$*^KNdYIgBQ`Q&fKYk4P$eVC|E?gppE?d~uFslqtN#UO8>=59 zWHYs1(P`7I>1yKRhcM17r#iz=fVpJ<@iTGdB;l5W6ME2^g7M_O7(WKOa=E`PjpI2jdMpO==_HPtX!@wz#R z$QX~}F@97`OhRjpyqc=2(K+gK?V#Hm=x4tFrpu;{yKZ5A-YGF6+$(r9K{w%^df9YzHUt64 zafu-R%DcIg{Gg!&yysK1yw>h9Z@qx$cg`CT*WZ_s38E8G??nxmUv6a6>}#Q92_y6a z!>|&cKE<;$*k0{uALR!mWFaCVq5}mpFdE!!b5TFHqlzsiR?B(}Fqi#($c6*sb;r=? zu=5u#5Gq(EBqS(0J4e@$aJ5FaY4Oc|;s5YWw4yKtf-oUht&8Qnn#Js=2#kt{@~k%A zf9y6efe8q9!;PW_@BZFxu&WcX`!Wid~lth|${-uB#l!fn1c;z6{vF-D)Jehc6x^66vT4AdfRRbuL)wC*NLm+Yg$#ivN<6SjYgH4L_x81N)#$1=iLgXqH zK6zH%`4pQcbse@kb&sFhhw=%Mizmg`?(krrk8QU4lI_S3fyl_nF^i3~3bB>#dwYBA8~6j-YHG%pFJFd;dFHo< zeR{Tjh5wo5_sgp1;xR66TNon(I~{tp@xU{|490{b0jE#j`B1L^>BTh{qYGRA^ev&drH+!nP8fmp|f?qsBJVrU@4pM-yYis(K7g5t)2B56QPN zMOl|yFFlz*LmC2OYvcYX)*8S!C1M$ZFxcL_bZs|mu*EyRVoeEYAtAOYGd!=LzxxlyR5(!K( z{c$5FDVlL1e)L;~qG-b9y`~lyMd~XnpHGd0DJs?j?*}1%Lz<|7$u zXjJ^dls?x&)<&#RP}SYp*?FqYZ{Hxs57nI_vWfbxk5-a~%v}ZW_8pr5`rWd#n5#^- za*VV%k5Av_s;trw!+fo>neIs5fZEvPd!^$%VRDO4rb#91{9-&+3akA@c_KU5x~Arh zX)b;8g+wpZ@USK01S#K3T!RYCVEfg+*~|Q?RBBuo&KuU zdurm1G{(fVG(Uvg%oOj24Y}-<4>5HgqW_Nw8QQ zP~~86xJf7F=E4YxJVdE?{%a zbKvERa=~!1-I3xfThHWs8?fxI1wv#vG2kP z=g8vf1pR%NKDAKdrQl58dEmU>s?pQk{f)rZntAe8|7T>r?t3E+*B9m1vBAi1+FApw zorx{aDDQ`=2i%Eg zj+B|Xo=KJW)%v=K%?gmgs3IePUpTN&PDud*Xf?c$_Kl4V4d;sWOV;ck-4Z+PDVnX=2JmjR%P znE>$7#&!s}4I#rbGrL9(-w76<5C$+(JD%SZpKlB?SPtVqFC5lcxYE_s&@HoXb?x%z z)hQd%TZv2udIC^Z%0xq9s!E(Q|Lu!S=M7N;RP^l~ttq=Z#mvzNB9C3=Bd`HM=R=5A=dxpttSB zmk74J*WNIEMuwK3cMt!k`}f6J2|IxcbHDL!p5iZS^kpqH6~$zS5j-iKj5bwce-USd zXZMKAw%%ol{3NuOR_=j^+jIXx;&Ycv{e!Av8o09bL?=EM6Oiw(J>P07DdY>so1_=> z0HNb;(ddfpk^S&+)t>S3rIeztxh_j2Bmny*ETnn~B44t2%cKAA`r z>H~ypcneNgIXNMphg(1K4ZRf-q-b;RUR`waRX4+iZ)qNPi6}4?>w#2fKXp)HjF8_- zPCZn@?^RcyBpi4$t9bVlRTR&U5uNE8-F_XKddi7#=5R72*E?4p=T9f-W~`sh96_Af{4k=`q<*)<3Y(T;@D9-L1i?f*f2XK% zXlJTK>IXIxxG#%qk%n?a`_S1Iy_4g#cGd4^anIo&lqul%MXtOiOJTs!k=7pq7C`CM z;Z%8MM(Iy&Hx(4xHqP5{h{3mTVdXMaJkEgoZ7e3V>wdp(n(d?UUw#D}KjtffSUO*H zXI|uZ^CyJ-GDI=;%;f#I8%m9W1>c+&x8cBXH8y^u8HdMoKEUI%YN#LPsVkr{R^7mp zBKstJjo6VuN)tNn#iLC&_v4a9++cyyxlxkfvKur3cgT9``3cW`wY(jWH8%2ibjh7N zPm!}1sQt+AUZS7svUS`4D6vM6Qn_}a^-ki~nUhc73y*n^tP0}#jeVL3h>t9UXJ(pe zj=W7--urqdT!IoJ?$(K7(lcc5dcsH!5ki)*YA01cK6p~Ic=%YX`s;;ZiK`1iZUmys zolC@>JZS&T`j{9q_>U^rw_H`G1V*}aT&EU%w{gu1d`SoFeS8;sC!&&t453=omJZK*sU&YmmajeGt*Z_o zs}s;l3R;!AB!RS9Z*-GdY;t1?8!giJV_7UoPnRM;49Q=?OiwK@ohDe^v)F5*(Q?}e zkh=1+mdWy91#Ln3QFs0IX*)llia9n;-ac*n9-VJgZSU>o_UZYB$xh$oC1T=DG0CUy zVoq&s1N$IVT=P`bp5?`b$p`3CG~=BdaaVn@Xe)4X91K2Y>7=BB7=5l@?WkITiI}C{ zIZIUPX78sImLbrtrAE`N#?q%}~gVEK4y@Okyt6Z3J# zhEnnI*6^f9)7vdS}P)rb=l{s7)A?zN+d3ZbD|} z9XUwMrh8fl#y9R|1q1=+P&)Uuoqk7T6Cg9emg4sD6;tcMjIxg<>erTM_k*(Ut)^kKSWBnvYc?FDl!B=LUs!eG(M08N5YAw~q`U$D4_iOqE z+E!VU@C})AL+Gk;M}>`&`YX>-DopyBs23}MSM))2Ab&$M-#wBF;}=;ZU)sJL_r`m2 zVMBYaUQmO3=H;^$bj&|JpP>~c$l|R+B|MdnBerct!!~zxgW*`@W3^Zws36BB&if4z z9MQOUKXTtrClK>y4ZIh-YUE}_CS_#A-~92D3kIQOL9G>1;l1COQ)o(dT|oAo0cWyQ zod4rWOC!_8p{l0q!DVM@&eeCZ`IMu)b~jocj*}$f8EA*$X^yMdZGb_foBpCcRKb{8 zHG^5X+5eQWgx8;6~)!#_KHwrDY3k`U@ zun@WT{r$Fp{!Lx2y4cxj@_MRs)012_mA^sc0?lbL`wj<8v!}AKq}U=mlS^#4mecen)g*K5Y8) zY>uVwxlcy;EhG)AAreX4w{N)BPuBUJ(!5PiPIj)@@kbK=bP&?U{Z*i=sn%L?j7OK* z|Do%<1F8D||Ff@oFS0T&myB$R)M3e z>)P{oyx-sN_w6%&|D9ZJ=e*8qJfDx}A@05NnKao_yiF8j0v3~E z!u;eUzvRc)w4$XP!OVCpdn?mw*yyT5{FDm)OdtK-3{Y|0n4T zxHZRodhq0xH5ngig zn%zRHk396#N?_WI$9Rh<3fbXTV&vvN>Mv%vSbwIar`zhQum8BUWKNxQ!S>1(*xX~6 zO^GU)NJTut?y>@`G}p+#yIWV_6)=e5JHWpR{I-@DG!uoIX}RgFu@Yv{TY@RBB$i)^ z%I4Se&oPDF2N_u7NY?`@q0;pOGH9t}Nmg@HQ}7s3&E|?f-;XF3LdS5|CiwEoR zA-@I1*9~Mh}LH?zCr{gjt>h5wKnvHe5Bx3r8Ls=XW6BflrZ^6C62HK7SSN-)>+ z`W<}=pVu@j3afx#rAK=6!JfDJBV5f%rbYk=;Xte1Sdvt080gvCJyPOe^j+3WM*ue_ z0c$Z3(ocQpD=qBE^Wi&$5V$p9v|WEA^|1u8p#GY}I+c{Bg4CQ=gUYMKF$l^=_YU+Y z&YdKG8hVU=tKik@mpWAZj8jhVYQg*?^gER)5u2W9UPIy&oqx`*zv0jz01w-X!Ka)# z?079fKoh}$;`+kQ{$vJ0IQ=S1fp;N5koyimp<6E}KJnv9czCn;4ErcSQP%}rF0m>y zrN)Mtkw94uf6;Oe=9;g2#B}N`Tw}e@5F4HUK)nNdh{pe9!C#S=H{s*y+(v=#R{{Z#|k`R+HAhuVU&D zM}3=FrbGp+5hZ|=;QfBtb2sQjeRdZJ<(DEP6+NG?6_EmRA0I}vqoW*@kuP8KB@p1t zk=lQjP1fl9?Qi2l2~i+M3-!zQJ@34EuP{gRCoG@pb-0&bfsG0a3AFWdjpCpVU#G|S z`AFjI3^hgYjWE`Ni2zeq;L|C;qRbHYy7po-CJ-z{C?ZG8ry?z6ePj_WtJo6GMQ4)_ z&~8Q+by!+8myvD&giBXXtQd;@T)fmJh)|ATlN(M1jS#pgntVhpFjqxv_@YS&F0sM* zQ8}T>9lSXO*c@@YWv9O&XiK!m;NhjM_Y#QRQ(9`CF(^EUR&r+N_Lm;b?0x*L-Ev|pZ~q?qRI{+GuU=K{GU82Q8k}g zI49@Z!%z&hj*Rm}q}p&C&+bgb?6?GJO*qqI>IItA(%@y#Zee8~06(&U%HS?V7#VTY ztq;YZ2*?e!Pg%U#hTs5U@FbrVVgLMnv_AvwEBxRcLlZkT%WoAFsh||ve7k#?sB63~ z{nx6iANW%=+dKwfFW0asP8%H*l0V*JWjRLj&o!V^s2JVr;U{J!mR>02^6UECj%yb0 zJN#Zd80S<69aSrNQv?udKYvNqJU_LJu+`ujIgf8i=eIsRqLw~v_$WbaT%4VqZPmOx zB5#C8X@gb^jX`Qq-5zT*hy^`u-ZFdbaib^$oTz5@-b=k}6SX-A!!?oG$?!eByO=fJ zWz@_pd@Pv5rWbb?4o+QadNIiFeb;>Kxp*^q$;=n~0GDy#Yul|wP30&8QeN*ePfy*$ zRJ?ZJJwOMN{@Bs@E8@f3kk#6#(S@&{i+-MOzEUKqpsF3|)wNMK8>#-Rjk;$AAs7B0 z$}?iMt9-AIr#_r7D@?6fLWuCB?Uu(=hHT9j*3nr-FU+rz+k2n#1Lq9kdhf^jMzk56$^X zZG`<)AZYuH5auS%6~yYp-MZR_14S%0a2yP?3HvKPgXvLF-{IIFZ?X>)ln;A1H2jmK z8$t^7$t(2qzCX~8Eoxz}J<6@1Nwby|W(iPSLv) zp<+*CXXcqvf63xnqq-hNz}4$2(-aVN$qUK`d8qH)U0)7C802~?=;#1&Zs|~xbxy_E zam3veh%1+dqH@kp9{;F|^RY|LEpQdr9sKlF83fv^nP7JJ_gb@_!OV*^``@KHh+gfv_Sxy@h)e_$n zW$IFl;Io=|G9D3?Lt9fSsjP*1}dzRSx{t}F`eQ1b3E_R&=A|~Jj6PZ zZ@XUs%8I`F+LQJcs-+odi)ixxIr9Aj>C8{&s1R`0y>30@+6@nL6AamHplqVweNDu| z5%Na7yRZ_~zz5;$6tC?ptFU33HPv&PtPZ^SqAjkxA=@M&Ny|K+5R4>@yP)E8nk!sBOV?seE{d- zZmcwViPd_mc|b!6)6EnZxX5LVwg+a^%Tqi8Tuqj)z{|3aMi&OmN85S2_B%FyyH< zHl4RYO;`nmFKy&i1ljF)(ofq?H-dKYKNxcg4ip?N2x3{ zqhxy?6akP9n{Q=qn?(=cUO~k4o*PLhd97)R7hh$x_O5+S%vrHXuJRzLU#>%#otI3` zV{+s4)>c1iZVdSiqRw3LOXf`0%5fq*V750-!K$;f z-ZB)cWFZe&mLb(Qa-`9Z1<;Afu>2n)VoXq#NqfT1M6J_;tptw(lgSciV#|;B>ZuzYd$&5De#~bO}Z`@q9(T*1l%`i^pBbeTuxGgru||6W3YqJLe@9s3XHK zVtdP`rx}3~8+z>0LF#$@^Z^5re?Xifz|^k1C?h>QglKzVVgguBaT+f`KN(5c!err( zW=1~d!FBa0lMc#DI*o|cuhw{@#D3%r~AfE5V*?#l&z?-iO|NZ5Jw&tLeO%~J#q8h!!YFb0QNl^=+~CqAY?_hdn-v5dw5T{$G*8#D zjsmyTSoFTdj7KfeFBANiKdT%${hZ|yz@dJb^JPBGsE}mKyp1>x-!;^716I%r|GM^a z&K>@ZrMeu`IF<#5)j-DTtl-B$I+5&NYpo%&a>eCttNZbS`=|kaX|E)s#Sh;UL1Rt0 zcfXW&-4CLI6>xs4TizkNUCaWm4%1C<|0D|Oc?V7dc3%JAdR0_{&Hd2-;FyGg?qJw7 zBNoptrj5{ZN_d42z|6d#l)VzF-$igQf|MD-e|`Z8G3~FWC5xS&CFkjfVvzYh3X+fB za?`KH3IOgrFC+Sj48Igb-!nJ2>&YFy#hhn|iHhizGuboNV0+V1-$zMz3Ufi|d&jREG zfNKL}nHAg{#CJOyv*j@%U?LP-VM1U<7DZKI^~5D7S+fkHO^xOnj!lmyu@1&OAnseY zU^DV!$QAVh(Mn>}5d9_EXRvXuW(%p4qnA1G9gC(5`-Y#z%Q56oyfA28==TJ(^|Ok{ zyG6P*yG&N#I$aV=;R_bLq0e}6!U+Jva2G>W2*3%Iv{TfeT+}-HA+;S1343z@=n5@? z4qg^?i8MXJ5v0TY$`<)7jrEyRm6leE99+<1KP1s18OfLDo>OsingoA^@m|#%T_wqe z!W=tQ=E%G--C`+9RDDb)k3aPL=w*X>x*dQt#YNE zk^Jc0RTh2Zvb*5#faQyE8dY_hv(S@a|2`5)N7dCxxjl`!Kf`={-WmRr3!!Ya{V-$_ zl}y2|Ek%G^poRU22ujZcT5_pR_@OEeNq8@Pa!5b(DhtZWwYrB;q9h%ou4x7lFBj1DD)E1{m_ zf1+|78Gy%|S=@Dl++%N$ov!0(XtaW)VY@QYXm)uI5Bd^<&hM_$kw8b;Tgx=j;lXPM zQx#e>c5n5y*lC)Ggq;tIY;0_{-;`gL?3cPEA)tV39uaP$VH~S)oB!Y7IDmR~9#3(1 zTH#*~3*N$8n5cP{L-(!wt4)kUtroKwllAm>cVjN+=YH2Q&k$q=1|+Xe z;OYji-&|*X1jybCOoN(ix~7|E@-#GWiNb!X84HL#R12X(32mzFin8?XQQUN9!LLo! zv_VK2*C*7p2nT7=-%_BM5j3h(!kC(=5wVf68nKgkr zvgI;&jV|pjwzcQM+twS`&_exo+202f+wira6t|

LUn_yw@qO&WJTiqSQRc4{pu z_ioI%nle-j*J}4m?lfy-lrr}SJ2%(K-kRo8DZdK$H(I3LkAc|!zCvLq#Dup-PX`Sq z)(g-6{3x-KN4{qbvBL#julf@fIQLkyGSvUUOXC`0zV5J}PWu59_6C^GQ%Rlo5=3wY zu<@6wavvwmZEcev7b#mGJ4 z;&X+Q=k5Vberc^88BMtsA)n>Ghb%5p@gOifL7oe=UPq(PYSw8M>i2)Um^CK9VJUw` z5x@@J;ZP^yxbi2epY_*Q&Mv-m@qZ;=`=xH9v!`?yvu42b*t;TH&AOoD>W_8=7IU=x zIitL1({YH?{qSD1Ib#uraVWO zfq^IwS;JP?MB8B`NQ}kV)%6NsgHddP4JvT*-Petr^_lV=qDv516u+j6iF(po5XBSF z&h^rx5=Wc423X!%1^YKMzRx%;<{{aOskzMAD{>@p6i2T7Ps0pCGRO+`PEK(lUgTKa6CX*#elSa7RDtO{{sb}#+vOc zCLm32HP$ygsBQ?^*GA^4Y@~zvL$hL@eaPUg!Caeepq?$=#iIB;mI`Y+6VrPoyOA_I zlCeI}zZWo8X%p-~hJew^xR2xuJJpW**HwN!qGXW1t%j<0^Yc;RK21MLxfNG@MzyrK z9-(cFft4U_Auj%1d*XoP5jZqyu1T=uO4s&?dfZ60 zWzEG;`{70F=B8N*nsVaPMFSpIOVfl>zpQ?zDtW&-p1WS_6bSjyJB?Sw{9yFE`w>-+ zxinl-!G}9FrnmFg9SksRt+7BwM+UA>x}tV&O6;^Y`HUoErdPZkim#&z?Fna+V{L;7 zH+rRr=G?pvy#07?CHsbg!UQ%Y-g2yuj^<{m%b(l&F>LjeU+OX4?Xqjm1r49{ipGHO zX&M~7G#`4S+Lo@Tr{UH;%no4eG@4i{yd$KtcXNDQ3*i;C>1!xePA+ta$PJvKfr7FKp^ zwG&3)9PHyNEQ%n@&Ch2|ptIY)plrs7Uim_|mYR}MhEvue%@gBGZSjT2`gOimkF#5-7*t9KTb0HBzWvguo*s zujs(m>-}eZ+BYnOmxeZ}+G?RZ7w8GKp}`Tc9)Uor+M|$j`x-wX$vi|OUN`eR>`MNuf>&07-7CHR#!{3h|TP^glYTCUN1;} z8#m6MCfUb2uiE@TfVTay0n>HY{XeB!t5FR%Q=&lr3$cIp4_Zv8+5^FF@^K8c4vY3> zR}F;uKzv`Dl|J!Y+OjdOG_R;Fye!sb*kZyPw(D?6*6qH`bF+Qg zTua`rx##?Ix8Q~J*vrA zBAcuXx4_(dl`!;goY!(n0Lv|Jy;_p|&!JGrLfuQ2A^V$v)YbOhn4?a=5XJ-g5+-7tgKz zwfyYcy!EuE(yOW&m249L+(F$aW16IqgORoZVYs)-B$ehpz#*dSX0IS3%VR`Uo2oC# z3QyOSh`$|KSo(ctKrbRGhy*HQb$25K8G>@i+4((?D?L3R!-s29zeXP9Hr5v}?WBm+ zZyZ0?a7=xC^$TzWIyODz;464IMvyarp^l{Fxr!~?Sc!KRIa~1o4y(pBPP1#_9IbWt zS>G^o{BDFJ-w$3f@>oQJ$D%ML1qG7#J(k`q#%_dlIzN8QL~woW^X0S9Odps?F+FkF zr92r^L8h%Op65J;pWIlPzvgg&CwyS$^L z748`nA?qcLnQ9*yE7z7F(rJhb;e5#a0~<{l(t0X^<|XSri7@lkYDXo-+#KDO@ZI__ zZMqq3nIFzy4eN&O5?{SSV3OyYDdOm9%(*d!Q|2G-=7S>2mHjSn1nkYH%6?iLEyKJL zKIsrbcY2S1O(S><(_FVK<_7&O^S? zC2n@7en&}kkdFDFQI-#WK1>nIRuQ}SyR}u&pY8!-1mnJP5f`3wp2+Zsa(Ya(pqA;9 zW5h0Gxfh83M=xf6VtmNqO&k;_>+!R;uj|∾{oie7Kmzh__a*KslaoSns`#$ZmZQ ztWm|YJFYyt2evV)CC^^_c|bB>rlpkwVDNimQB`@a8zpKDefq&;N6QG^e@8dZ<2@P9 z3P9#WNqWdKydlmRz3Lx}2WpSSS%a)bwlRxfXpCG=q6m67A0YCZBh~i-8!vkgDR0Kj zAPyo7w{pGMFtYF)WLf;y(nl1VM5`GUIC?k?TciGqJk-2b-KbXPE=gyE{Ob#hZ3@@q z6eCeUwJftT44%rT3#ddsu*6i+Yh8U9{epKqjO|*ACFb)qJlwd(uIgYE{C4F}y^F@R zs-dRsgfebov+=PvFPPQ85E6APCf2P}MVy?0usRryvjeL;Xp?!e>%LW_m((~JPL6kS z37MNF zLsi!JtkZNyC9(I|5jMjcgz)2338~h!FSXa-L^X)+9x&M(W18O%-RZAv;~m%BTVjI~ z)&QpKYj$>0eS|7DV5?#tqelHv+=9xwf|ML(?b^{o1YY6tPWF?Zk7#yZfhq(N=}9Yz zS*#Niw*UxM2*b}qH~H$+9fGx7R1Fc7B3AU3wq7YIDFTjp_bt7WhS?;U2KxIZts7`x6d86Xgb%GkhoN=fv8?C8;6d(wE|H!?Pea=nu@YZPzv&}($kP)>1C6KT6L>D=wXUROxr{4MF`}Y*E z$|0y@&7FEn7^Ls*9_w%&5k}+;TI6PWF_VQ*<$3LZ;b82(=-dI?y~7$bgtKVz`c@8o zMCt|b78%q8R~Pgcxr6p&k|)uxz?(ZG4(Kb0yYz4LNT9#{Z`WS^lXw7%JfM^O?wGN9 zb5C{1du`M;n12cglKuF1KKGT5zdRewo6MH)KU1ZM&99#rfy{_{TjIk4 zba_cNl@Udl1{af1F-lez){$yy?`zP)tF_KX;jWam8)}E;FUnuU4UW2tg<)s2C*Aw| zUwBk^BJ$?lo+=~HO_t}Gr4`v|WH&y#nbPQG>FYa(R$KaQOTl10@49e0y&^mTRZtvV zPZGut;z6!%dIuAgOl}dhSM%U<#5zC=`C;OD?fAzm`^yYc#tgM)GSA)VH%;3nWHx0( zEhX;`z8RRCyVf7AxsR!ZT|EMr9p!WZ4NE@VHwk7w0>7&mhN7aP>YOQ7mme>XE|A~G`at*2Naw%q~kJ9?9tS_^rqQ}f5Qk?=9uqO^x!n3hQAtp>OEi9m>2 z>XSeLoAyn7Q#p6a?7B{hBeHT}54Fv6O?cWCdev^RSDa89RoMPGp)=r`u%xMVkhRodhg^-PRTgc4Sm_bAd7dT|kX=#pv6+zf_)Ht-$K8}DH_)(XTCp-RGLrD- zTb6UU2jCD<536{DMuDs5%8Q{c5DYg*+0vf}8<;4x$|f#+hVfe;jV*6bqihcj7lJ5C zE1xvWy?9={c1G=6q=Q#>mB7r`KYw&!@Oy|CY*1V%ousTP!;WR=|9SzKktO8!%l6yf z$G+e0Dq*FwQ9w+GOMxsp_x%pK-%Tq%z>vE?qta9bq%BSqTG~*csN-dp<(EjQ{*?-f zz|f@h+9O^?7DChyX?zLUTG%pJx5Ox^H3WG-pOLX#`lr{b$kQ#1`d_!O z5T4zQXST#z%Y*GTBK9CFx1_|&TaAr}Tt`PIZ-@r*@h&Y*UG9(^@qxyH)4`EK++hP?ex@E=B??`E7_WA6QctDCm{z#XhM&-YPKVJC9Tl z20Q(Nk-p<#3^u&=4rm7B*IK*n=K?a%*1He>`Tp?D8`gBz10b+NDlaQUhx~ZEC)2CJ z)k!V;s;{@#N(1tt!FqnG&flmuGSDjGhMNiS+BKkJV@=rdwaN)9qr>n}T7;DgUmDzN zK^JFM6f;j|9oKNQ#s=>bgby_`zg3jHEM5*s$TapUp%56`BUDhe*Zp-0mLk|{!8WI_ z^=p`_7RV9de%;S5Jn%4_YEFyrfI)g0NRPOZ^|G4}GQNOz6KU6OnDV|gB+~9mfuVt$ zcMlHQRH8gpvX1&?Wj{SYJ}Gpe-Mu5!NVioCF zGran61LU+g{+W-YsGQ48+ON;mc5o^AHQNKWdDRHp>h#Bq3a^9sDFXJDZjxBu*5iU8T`W&@l65W0M;%EKiJ`WEU3mpC8yzKLqRPIUQ)48z zfye@s$*b;o?wSYwGaW+R@zvaNig0RdjrG?zkNsm~QMv|?k`%i#nbWd)~@>Pr{vKN0Z85#K|5ZMqJ2xxT%buyF^6Kqo&Hh=1DTOf^kd?tNOOZ>)| zQdOp6BB!n!&j9t0pEaKp5j-t{kz_Q<%DteAj%U~Z={4j!py2om zaQo+z#1--f)Vnexnd&A_!vTHq&98vE{9MBMEkFb~y?^}D*|x~n?GKuzj_=z;i3_ad zzq}p-s3wB_ZAXh+;df5mbEw|u&!b!ro5Y!CB2#Qy^1y+j0boxr0S5(cl4+txHUy-;O0jMa*_&3NoKmnREwufu_AV_yE6dDcTsYYeB>-P3-HMK?e_#K! ze(V+JzUf^Fi=nv|>Q^z4!qJTP8!x~|NWQ=n;h%!q_|PYJc<7!{4kW(^r2}NqaR*cD zHqK{O`Q0>@aU%P#wy=kR15akYbIygc(?t@Z-b=LK0oQsqaSAkNcZqhv zn%@@BBIR0Zz*0W^dpfIcF(oZOH?pGXKWEps8yDEsPSgv{WCyC7@)q8wW%7a14`()% zT^ZBML{K*?p%lJ7imtZC&2KAlEL_5yy*cnzTUfl5wBMEGs(V?`k*bzc-8RPax?-OY z{#SYar3|5ej}tI_sw5d?;WhufL{(B>t@rPLCbFy79ub@txHBwK}_%`eZc``Khvbhad$M^oX?dZ?d&&@0o!ZuCSDiYRx>ock@a&BP*By*N+^TR} zSL;kdo9Iuz6e_vX8YeFJ*A@ukO9XCHn}u560B9u3$egH3NqrS2L9;8<{#xtb33z{p z^Oyx-6P;S%WG?^9LE(Q!kyrL~z87wD5cXKUs3sVUJnml#)xYWSH#ru_%KpmJvbJ^p ztwxi~vwI#$+s+V&{<%)HJk|3S5NzGgzN$aWK#`y(SmdZqo!WsW-2pVQX zqRO-59EA9tAvdk4@dC7@BjsP-k=!f36aR#H@7T(gB$V(X5VwDWy8d^78URE%*>bjH z@@!NwE~E+$*fH@)`0ECE+o)|%3p7!(9)7SIIQzuKHpUPKd&nBJOJjs#5QXRB;GjvPd+r-8l8P(|6KD*0KYji zGp%*zU=HOHymRNSN!dMKZta#P^tKUkxhPl%91sM9|2;>I^+{7tll-i5qXcGG4t1j# zPaV<`-Vj9@K=C=t{dqMeh9F&s6+Z*DpG`bfc}`s&z?3h{|8eOcVFC#N10QOPc=`9> zu>CdggU1HI=s)ScLFx?b1yc`mq{09FOXpy~b3F0n7yU$~ ze6jKGTLQ|FE&!XS0W5;+YSk`bV7dbodPS)JfAeID8ki^R{N2a@EI-WP#YEtT3~AUb zSbE^`WZlzP>q$C@u$b6oz_?+7rwvASxx`Y_#3a?k*jTEotIPT8+t~&|m+n{LeM<9NrVSWje7xzSo*h!y^*(Df6a}T{f|!GkSbqn7N@oi zKlcX%Fv$~q-WCf9wzh53{D1ZrV0%{uRsx(|(>wIci0~$=TKN9u_RL6+E+Y`A`vLmk z@N!{N)CF+rXxasT4x2AOe*7rRHc@JL)W%Q}e4=c+__xo7ib!X z_Gn@EO|R=PbHdllDk}U*F?Jn3$A^2(93_b`a}p?gmmAJb!1=fbO+K~!{X;!h)*vF@ zsUBcOY+!e>KyitzuC$EXUG`#2iyY9gs|Y<_=$PP3tAVgZED=p55*ivLtDfqTOtr?b zQUq`|y(@c(X=U_46SHde{)B?3jv$$Qy;}y%#QA=te8m)IHq;kkZeWL`C(0RmA~?R!m3K#k+013t+iPV87I5D<5J(fdtMc%b;vAqZM6!)L+SPG@X@vOM^u14N_WUzOojBg zi72%TS7;uf_Q2LBb2KzTpO3 z|EO3{D4y#y^8b17n0ikbHUVZn2Gdp5wCo0AYsMWih#v>v{*9HeT_8%UG zRXtt4XH2yDQDgDL=w@2&u>3JH9h?biWaqf(#KDK{2wsPUmFcj_d#|& zKa~AcnLX^1bmDWz#N^`S{`?8J{X_^bERx%qJK>%)Fb3R*%3H_nCI5LSD^aF)XK(;} zFW^p_zwvMZy42Z81Nbg5d0l%E(j$=_d!q($-|*C_x2pRfjzVqN=4oQlu4Cojk8=RC zktB-Ys$S?_Yrdzbi{Bm_8oo9Pu7z4_(`s-|c(bywblSLQ9=-uOH~rSJAofX?f~`#) z2xO8Scbf5_@BpnAtr=g>$!%w+<)A7Hikp7~L~$A?z4nLNb@FUu3(P|L#%-4g@L!n< zpbv57O$L1Ind|JyQcVfCENpc0&CR=e;Uw@$YYWUHi#sQLZY^A+4Z#gSGx2i6%^h$` zOiVOY{YN_y$xf~{tjh4rOx6Uf;7#A4x0s)6hZ$fy{^x_ZTb=c+JF_B`z2eE<3(I>C zZ74{VRQ6wd3x&2e)=vus`Yb*yw#!bF81R=)^5S{+p=Yez`p3872C_~RF!^uD$S%u@ z;7pxSfXj@i!U8{FS=1g(0=JDzT6_!~Oi4?V0VtjuDlEQ$dU#TAJpjDQcTaBpf{HnN)(ID}$j~ z37xdo3DUQvx`SC9Mwt(d<$<6hkMkj`E@}F!bM=G|tP|hm!2x5MwNVv|1Uk8E*Dl!* zYCf?`k~%j0r&9E#xMHH9LB+WI- zSnh~Ye(K}XwkeMeSy}4)fKKtSvHAIHaBw$$jay%D;tF6CwiEwMC^bm!7x}t}HL0q2 zSHpnx>nqNT?AOVi(kNBn30z7{!WVvBhKM~tMJeKGnDJL)&lP?Wtep~Gi3EuX3AKzp zf0Q5MuAV>8DndqFpJ|aOI9cO{;fT}?Z?nFqfGFK3Yn}9gI@v1{$p9c)ZLEPVsKp>8 z>14;jDMr7|Z}&Hv@{KOW-rP#7iSTKB@q%&Z{=m&N;Tf*GavLN zKfl-skW*;ACeWV8+i{7|3WVz2J{RnH`o@GvEImDAzI>T*J8@8~zu_R@B7t^qLX)vj z{Pz&YH2K^y8}(r9rMUA_Q%r@E77Y2}%^1pfA|86S(c@X1pv?TQZ(2 z$Q_H<8H|kllhW9zRs+_LgQQ{~WeiG-(Gr))=%)Rp6Rg!pl|63cJltd<)g1o$^GSCl ze>0ERT3fw6X z!8IurO!@zL!}oN^C(h&=bu$y@9edf5n=&#QTRV+a0vNJ0f3I0Y+IlG(lwi^ z9yp4l9qPPm+Nr1ew5XLX*k0&7KO+u`!}W=`lVz~1wO@(8%v)bG9;ndT#og(xL9nRt zo``*4dRyK_2zeW#UPY>s?G>Tb)Wk1mEB@mEkYa?Y(Jee&^Cp12rDhoEumyl=TwND| z+|2DAL?)E8`B8qO^Lv`wac{ooq7nc@Qx<6X@O(Mha&>NTW{|lQDhPN!e*5@wq>D)) z5%3M4nyj<9&=3M9EdyMMCb!;~^JN$MT|{1Gv{?Fe2uNM!DoGmwQ8%!Rh?_i-cM z9E!#T(Gq;WH`BX@S-fG~AeN@I>;3UbS_B6!% zOHZCOE!hN&T|AVcn^B1tnD+hQ?sl*~&LIc%)Y}%KR$>6$_^?;y$G#j3R?<=PwNH?IwULp(qVsi%nY+$VAA-5qN-IR@3R^~F71fN#`zF{zsc z8(U|Gw&Qa^K?A3G@=C+U5ceaF5=y3FGjjYdW?)IxgLW@ny5yR}xx$Swt6lFX0sV(& z;ctxN9$#T)sqN#6^}@UF?LV#GLVjGnU+i983M2s4eAeOr03jjdGMc=006@6qmQAG$ z+BE|^_cKivfBr1=X)oWQq^l2~bICD`cMWK)ExkO;t=f(3O$GY!7Is{}SSx{z!J4fj zf+XGK)WX0<=c0P601rq|_cTqCM0ASVO*k0)k_ErlH2e4>gcW8h(#_(L*$~B`1?Wc) zcxrbjQqxr&xxzM<6pX|MMtm(_4UdnnMzpUjSJ`VYI`jCfl=n&E03|9B+Y}iybmxt! zQ3b-{J~#qk^rNNvm>_o}Q zx@hm}ott01Cf{|b@vz*jPg86F2KUmx4DN;zV3aOuy*kgay1f=u0y`;r_aD;2zmW)M zzB{~<6n{oadc?FhKgGlpm7Ong+5oUIr^qn+e{oHe3N-{`vT$sZ#U)eMq=o+3=i8Vl zZ&d_kAAL8y%5OgwFRf>nv^Qv9yO3;z7UL!WPuhpuI?c2unIa&N6Cfr862Q5(J~z|m zN~HE$(w#3~fH*^A$t*fMteZukI#BNcW@yA$S@1A#Ff{Q!H}~4M$8C6_+A1j5JxAVu zXSL{HH-xQRiaGE@8L#A1YhMp#U5wA+uBU++7eUiYnfGb#o8|bDQ|^xC3%S&C{)s%( zBm1XM&)2lF;9Hm-olHa9w&J2?0MuqNwy*b%Ek~tS7mIclUD;j)g>2wXeyGr`?$oWq zvT>ASlqgQ;*$?-EF^OqP7;Hjw=Lz7;9Icys=Obe06~3K0w~2oYb=WQ(`Zq!%XAHQ! zM)n%2|4oo*hecp$t5aU$Lzx zcQ3Vj-13z-wE+^=vFO5ov4Ks6ot_b2!tVaK?vK;pG$W*Q4xS1!?H7M=YumU@*4nkU z!rZxAnDLq40uOdtkdSf;@&G_+t^|AH3@PFiL!Xm;&+gy3reU07D$rdX;@)GiY!sMn zY3;g`(KcFb*}R}X%M(Sti~UjK`wZw#$?QEOiBsfT{7|i~m*$}ehr3Wx!uUeG%rQnL zCXCc0ZwrTtsBs-k=<@@Bq*t@MvW>a(x9d|D-h=DK)4$!fC#1ACWGMbW z+rgl^m6PuX*VSQ1?yGThQ70;EWv||?!GW+Y{p!kD{YN`%=qrHlE@-IlA5)&*NCw3^ zVf!z@G1E6XDF}m+Uch!dGmx!1dG(<*n}k`RirG0OT@2NWdyi)M+|77zr2$sI)Ay4F zzKsCsBmGFOx)QLmBw_NPw^qzaNuPGE7Z}}^QA{_)Ec)S06OY@NWgAgY?AIBn`Zqym zYxTPFS*GLi%3;=ULbyW%uUB379z{StRsHcXi95q?S7ShEUNowDd3hNFsV0y=teOc0 zPf|4Lwt$l!_%A5^W`D@YTCfTVX^zQ=!@R!j&0G@r`DwPpB4leW3{kJr*X~rYmYp&1)6*yuqc;f zBzdE$83Hu-yaIUYs%at7UC+P)mEhaal`N6?s(0_+Wd`bPk&*{jLcP}~U0X`p!95Xp ztCaso+IPoO-TwdIL=m#G_YR>5*)uAHtn6f!y*I~>tRg!*n}qCfkdb-py|VY->-?^x z`@VC3?)&@K@4xrsINs;FUi0}H*X#O{Zp)FnVTa;o@z{uW&p{zc>jN`rUGW`UBnNej z?~& zI;Xv`&8=&`c6N0J-l#|3#!)qj9~rP`Zf1QE<0)U0MT3vxB=%EOJ4_QahQG=<2z7wj z{sgm=J3f8;Zu#2SR;GBrh?8~l+(J@l-&_?;`Y5Y8FJHfo@{)){2Xn8(9|dt0-tu$> z8v%zIAQm`P8TimFnvE-w=^J8NVNq&B2B_)Zq7-~xYFSV+G``h#;Jd4MH}PT%8&E|E zrlgyJ>UQngHCih&Ym?A5e?O^a6{j15*0i(@O4tz>$aNP#KB&67*w{Q>7{KBPWPP;; zT$m813sC|^hg^q#b@q+x_sCa;Zef2cU*JVMa#%O{nt5)2+Q;bnsjDV{AIy=Yf$}mL zLIvh5#hjfh-k1vo&kg=U0G$~iUr$w{=F)*v`R9G!1sf$7s5TZy-96nynEK6U~zptPZsF3?>bMr`?GF;r)gEvM-gIYB% zD%k5hvUQ6KP>*x}*tocNt)Q>SSm=ED35ZH;K?@FjZZKLa&c=Rk`j?om1vsz7UMOp5 zyb3C}H68}HVU2BA0w$0y+Eg%2qH;Lu>M+cWf>wi`?uNcTu8hpg79h0P@^=}6cD}qV zzll3fL1>*g+8JNgG5lgpyoPm0f*uPY*bwj}~S> zmUkCnW9R&D4w2r7nCXbmigzp!ZC6ZkSWZzs07GC4m$#8D9ZWz_UbA5_!B-aLdS4q! zH#dN$JAa!;Wd`Jxy!W&>k1C+_LMWWJ`G00yw4sKgn>xA`s)yyr*lJM zre)EN#=o{_8E6d421W~ZU|=ni$phX1r;+#qbJxVpZTuakv=r^+*$l{Kkv}?SvG5DP zw)a8$qS9LZD`eB8Y9@D+$wo#-S<_&KIkY;0_vH=A}1vxKgk0n znc98h4${XjZE@?$9KkRwQ2F{lE2N+-Dctp|lKXesdmN>gaI0x`(g-xrIW*r)i0VMa zZ9QfK-Y;bmj5wiv8sz(YfARaaZ-A4DsmU4x2=|z1&iHKR0(>b$SQ^aQhOyBGKsh3x z`f-7o5jd!c=B1PSRZ%RWbPT$_Np+8fWmgwNAQYVUoZ&)OS|M7gFw`TTX1>+vgW~qs z6`Va%V)ceP`B!f}yHOaW!HD99<3LNFmozavTwdY4n~~1~vd`vkOR>gm7x~xq1d*ul zsBdq4NRyV$p2dY3?YX1))lH~F`;srVNGO;MM5~|N3Q~K*J&w^L*?rSzX{*5x!-e@L z&jdp1sYsVx7%)w~5**KLirMKXf-}%>+`B;8Kv+wi1>H;scuMohLcR8@QN-WRJQ#@D zUHjv&6jy6^^fmQg{x15LUZlrMF zHWMcPc%Yo6;KUKk2x0Z)ppS1=Z+Tqjcr7+aOJm5&@a-<tH^oc;MiUhe*!JXn-{fvNWW|7?99hl!20Q$l9L`r zQE4d;>lx+_ZNT3A{QPscg%Wd$NeMOxV$8Hk*uO!=8m1fKbqmqt2E0+-3TF%6{Jf97 z+Y7@T`l*8Z^V2!aJ8q5zBFXpZhUq$|)>sg(g?XK|)z#ft1evy&lM|OQKc`)~yf8s1&!5c?rOIK5G79L4Kvb_m z8RgFb`+p;ws}KLtYe@gK;+Ow8Gjj!{`26ezzt`xgOunm4Q006u5y98nuoM&RVDPzA zj=d3`5Q_cQm+L$jv@sG>s>xcK#y-ipd3S{paT+26i1@!znM;jr9zI#aw@Sld-SzlpFwzl2TwfIf`93?k z43)ny8ldJ zJf_A*v`F0W`N4j*MPiQI>l?tvtXR9<(dO80&O*=E$kFF;k(`S1a0>$O4QU!s+JDd< zL7bj8$8l1XK_)}AV_`|a-dzQQe=CZOKj;bJ<5D)ea|K)05i-0l_2i%|b33RbDwwJU zzzQd+t|v{pN&i*0Q{u<3&C#lFxkHoU)t*p)0{{Qh%*hXBCjvYj^L<(S*Nq65y`qeW zI{uTmyFpg~00{f#fkMg)t-Tp=`P30bdGwJKk(Xol0{J7QJ3n2drKIE_5U6Y5DgApw zuMk9On^s~egWI=57MU3&_&}4%#&)REL1W`lj81E-x%+pEu?>I*`9?f=;{NeNe{T5Y zE~1>b8;q(ce#PmDB8#Em-8}Nk z-k=j9Af980ow1#6=%nf3-yJxgr2(7vj_&hb;lm&3dAta2uUJ1O%V`LsnOcXZE{4uccR4s> zkB^V@+#wP;+O+FlsDbMsC)!z9>cGXrV`6cj!+W?ffwAWH=1uGyGn4z$p(U|3r?=w3 z$bBOtqh_roK~v%5t@Ap;3MWo=%8Fs$e>B+qiioL&z)I3v!YckDWiM;c0h$OJ5_Opl zl72h%iwT@^V5hS9hR*a~M-W1hjqCloAkQq`>yM(@ejiZiXf|UlxCh3ufmVmXV424= zDJe+1%WtV-S_8N9(2glDMrRki-cprlS6gk!>~1fgzN!ijf4-{=_kkF+v9ffw?G*93 zE-3BxQJv4TkTayGFT`_H8`K^QDgo8vM*xBNrw8%rQLVYOn9FI_3*5;424% zLrMOzeQH*OO7y-#71~Od2y_1Rx91G+<&bn=j49J|3J8!z`7VNwIT7~7PBF@S%t*)O zn789vn4k%c3E}m^$%cmNi5WJ^fMd`zi`lT+fYaq*V$ypy2HAzi7Jk5WwGa~a*wTbd z;BVPGYTtvypyxw6-17tk3y1KZR3uKrK3~5cHgoSn&f_7=+CvHOox_W|wUMeRN^q7Z z*49{l%V$yU@5(k z2OSbrLR<5bzAu9io1~6L$Ygt3OKAk?JHPBVi@O0^5jo1A;$fn48pdA~>jnsM%#DHO z&0GKLoegK+BkEHxAMBe*`Cgys2;2E%R;TId5I7rJ?8NxKp3T|D> z&u{5qMlTfLav$;^qM)D%&4y-W4WIRhoKuBdFgovssC6zoLJXs#qVgQ;!Kv;in;j`J z;}!PrF~i1Ja5b;4|5ttSw*~kMBO;jU)q($56PWHNdv!!%w+eo>P8q}j10BoQw)6O9 zF}_u!T93AWx12{usN<&xkab6oA^c6bsT$LZ6%KgEo(|NAFpctvy5Hv|Hf?!Z4h!p% zsfk62&au_{_z2em$Hkg_#FyLRTyrwb07bv2GWQ{)p@+L&oqOpbEDv@fBW@3Cjew}$K7{C z%QV11FA1&uN=3_1owEj-ZD)v^;a#z>@o}VEssVTvwJ~J$^f|9EXRO z*Hma#kIGz96PNPn5I!Ad)iw&>YJm^?k2N8o*l}^yCtj=1kZeGeFjIT3WfB!d)Vb4J zWWIQICRC94IJ+=uiNn|Do|WYAB;K+ubKC7g8bRVz*mp;Nv$!9}&#S_Utg)75o~C;& zUt7_A@zJXJxrpEmTDcg%?H38PbswW5<6dnm1PBun1)}vzww3*iSX?wT^Ioi5DRTPN z?RZrosEH7;0wb-F=c*GjGel;_IC}2&2-_{Y`<2Ee)xGQxs=zL`z~rTcXmZt%&YNw# zwom}ihng2lbR4vW!F%0KdTyk=;x9{_s5*>;&m3M*)3!xmh#coa?$EWVq7yTS)VaBy|~nDKBEZ{D`nb2ID5-|CckJq_6wfpf*{h)lovTA9%-xVJRa z*{X!CN%KOB>rQ#8!lfa9w1+KCoz23Su@1?E;sEQ#%QEZ{ZFg<#FFEcp7E zY+8Nkd&G2?R<1w6^L80z)e;xc*FK@0 z+vpRB;s%9Joqfp89eWdWzO8#+alAI$=K#lsw~CbMtmO?sU*`{tW@V+A{(Q3mJ(Y%T zYBz00H7^kEQk|DT-!ws*w(6K(34CrLyiPOW?S$=nZ&Tz90x{ZnCg*%?zc{?@u*>Ul zxHX(_Sv<$G`AvRtdAXHOIz%e%o;c}kX}#NbX#%&r9FO&?c~;SyuM^&5B>sxY zGn_Z%W_p%y?b)QWmh^oTPwKHaCte$0$OF<4MiZN73A>Jywwu|mITk7tl>>(kQ(L#~ zhR`>iVXlcvwgX)In}?r--JjQNjrXmb$cgBOo|Jgd?@lM^9(^lxhQT~UYtDCaWslQ| z5>;x1gjR}JdE?C72X*)vbYkJ%_3kU1&_mvonaVqq%@r4nrq$1b&ul}HFjK1U z?~k)|kr{}#D(>nWY5C&xtSgDe5)0n<}S6C0tEKDYw* z`03`Oitx0T4EhOL3t2Cuml#?aJeJf%Oo}!G1D;9houAwpnXIMc?j9-_6<{PoQjhO? z%oI&-cv=HJ#;~`7>nN2?-9$eUK0g*H@wAM(4?nB|%g^Lg{{yl-1d-|d#NAHrBf#w{ z`IR_9(0ROau%RAle{t%JuE3+KVln#=vL(T|n)u+>ioU_=zIDm@xqF;avG7S*CwVLD zDlW~$Pl+4-j_@7L$|=Zaa7j5)mhMq{u%~<@gmw_Wi&pvev+q&?yq_=TOdaDYCb*wA zSAppDyj=my$O0GRUDmVEeuDZ0g5mYi3hna=$BXEN6+!r@=56fQ$IV~(Hr@8UlHd%s zp9;RUT36#i1FjotgZl;SrD`3D3yPZA3Tjg?HbpMXCj~j9F#g2=a200l$|y&w-xUUk zAnOxuwVI~MK6{5Ls2MFlaSDf9YV7rm_m&?N0;^WhQ3rO)a(k0+i-U-Dd6g9jDGq3q+oNWfXsa`?=&z&se7LDT8Il5Co2)qrNz! zBs4LR!7hD%F~}s6Y19$(W`*{X>r7A5ioO?>%6AF61rC8?qfW)Ln$;SqkFWjg!j|bQ zsjA_WLX3yxAX#P2!=DqDF61G5zL#=iU~-}=_+G)20{GfUu@SptNP~$a#-h$tk-E^q zmd{GZNQYtt1|j?NSH{Iy@5(n|cFm3Waha}L9=Bdw zNheCW?=7i5XVAGmA#&<~vjieU49jt%x;2of8&M3S0RUSwn zc+hm8?wT$+#mS|{B=@7>Y(>W1xu8~9MzLvN&P@@oQ*(kXaJGZ|iAbjRhDbYJ7EwqOe_9#-MRAs+u>bP9Z0VCd`Qf1<^KB3-ZR_JzMi${*f&U6hUMp6mB z*z`wcrGd912h42V?P%xM?V@Vo7jL1NVX>WPNKHIxinx=fvl zWG!?g7&nH99B+s9@4|%V1$fj4MGRLS(7AlfgV;A$yZ_1u6<4+;vh*OV51!7aKN%^ zI`U3sWk@70Uf|AG+a~jQysg03>rnTFAd`bn6^uD)(zkM+|5DdK)OLjvcS0qNRZH$3Iw_fen>z)zlbF_S(Job}kpwtZ3 zQ?f1Q!&CL(F*h^o6-naBxy~kOYWCjMXVhvWawTePa=oH@7b8hkLV`~*meqna+EYGs z?7SgCm$!i%eJ<(Z!j&ImGDt_Z-uo>0{KM4A$0814ht1J1wY%$<&fpp$d5`Pxm1tpn zmXF2P#Y@$m@d^ZxA z+cc%!D0c15Xo`kz2g0&iBLq6$cXB|JFOI1$25&9i`rBFkDOM^^>n?;;J$k;x6)bac zs&AKBjC@k}kGF1&_V^s9_GImfi`##kJclgo>}Uefk*edpAJ%_{x;s!^5qp1y@|#}?a3l{J}6Hu#xju*)a$D9QE2PR|8s78VXkq8$;k>Ev*A&4+HBH&eMi zNf3%pLV`8laa6N&Jn4V3&ji{`R~=B@fSb~&I~35-eNn$(Vmx$fpLgn__#RiEL+3tk zj^p??JZ2|wwxypJx~-CAj)$aMOsLYfU2bk3(T`li1k7S@%SxAuQYK8HFY}pNgaE&C z72#&Fh=A@kQ&@CQhaIt`Mk19zh@?5@g}%=A+0(*bs89vpSM) zG~w1dAehHqEIKky%ws?s#&BUC#d_Ylrb-JQ`9`e24<)!ujN)h`K_D z)3M4>mLv4=oN+DrF^phqe}6wmoueMfu~^n0F`=C4>ncZpIQdY$%5;``S(U6PjN z>82ynLSO=L+LE8|SV8_cNVa){F@dDV;8DLT<0-8)h4F?FDT*5jrrX=!UKOEo3j4r> ztDF-S{qYw70;)&Kr0~sCUMFG{)3u>_@cYIA@sQWW1!>C*^>)xAoERqpNkq?)fd+%N zWO+kW|EQ_xzh(hEet;lln_v;h&wTXi~6WG z!8Q_BsvyT~bTd!+J^DJ!aw2nwh=FM_QwbB|gACmkZB4vY=R4r9Pa?-2>enZl%S)`SkM%Sif1rwiwLdh;F z%wwRBl_UKVQB9?8^S83H_-OTsiHX`Znr5+%G5~Fs>FP(7^_9{{m#7rnPYkEFx~=8{ zItukd_)Sx~#KTJ>=$bR0#iqvDsRpyNm6DN@?}bF$x00Jj>V3z5jeiAh%M*`4~XeS;p1;v`}4b(W`icse}2o#BuBU+5sEg8TVZJ>7w z21F&9z$b+=be7`J*3QOskKE-k4~FHbo?}nKCAiFbKRfJKLE+L;)l66%HCw?h)00$j zNrepG#{vv~wqJY_c0C~9Z-se`#9Pp!xbK~>-0B3GdOO8&vU$CWk~ zZ~i0_8`6PqOgqi>_~`mSJw);fu;95TYz9bI3?26~grSQba=LlM&(GhVqr%#`2L^Jg zf-6u}WTNi&AlFE7&^t5PgMy>|Od~qoxMsCMVVtme+z4QOe}3#AgV$Tc}I6AJ74y!b_o zpFv99Cy!w*E^St`{9c6Od`E1t$>wB@p3ygirOx65M%KhaMjZ#`Ce9DE&|t;V0MCLy zip&oC-}DV2061HNDL0$+Evn~J#|KH-iHRF8ZiLsbpO9Iq0F2l){G_>54=h4#`ZpG# zXKzoU-;Q?1;cPi;${_s{SBt73{LR3a^wt$N*o(gG01jD=<(Q>mgNJTX6apDh1oz-< zBvNv#Lw)6)@5GIuH^mCIf$N|8qo#hSmr%Lqc1 zzV;&H^)8`9tpqs^E@MZ>urACPXT{g2VC-3kI@dsWQ;@mZ(s^TG#L9HNkF&c)aHc$n z4jKgMNH38nH4=&&cX{?*bmT%{)tY7kmp{tdlucexmTXs&$(9PX)|R>gpIiXngD8h} zJ*DWl35w1JMdG@7#pO>Hgk5j1{``Jp0NzWoWTslfAQP1x=5|)r+0lFO7J69GP4^~K zHX+AjpI0~qTza|qhz}fdi#>DSgge_Wj}_dr#>B$Pft;LfW}9o4Ihk@&oM`4=RDHhz z`KdO*XA0wz+u?$j)gDW)9QDu*N+MK(SNMXY#HsZ;{$fO!P~Jw>q6NonB9>00E72FI z@_8oq8PQlHZY3r9%`4l-C~CrM-J%wbfJWI zp2hR1K;#aK=CLp_bHItyQ=Kz#62qFd;8Rs)rE*y!#LiCAm}!}_R_lK1@Dn%AFmg+7 zl@@C27v?kdKC!{xuZ%g=&X`8f4mYPPtI844Le?9EI=Hy1lcR_O%z@z*Uj8Js>U^t3 z*ih1rb}1r>TRurRJ<(%Ek#3xnlCq~(Dx}VG^30EacaqIyWQRcKfUkA%@Em@wX0oYS zRl_$=^Lgt`d+nS2uM1Xpa3^QDGT3N4uHf;&hxz^$=N-T2#+T?qmzmX-y^bmGw6 zE&=&Tz1Yv~chOKsELX>N{d275 zm*&4X^a#NrYc+Lzlo_-+kBj>vx8Ep*c8APHPL)~xe6{bTduDjPJ8yQrYn*l*Yhz_4 ziiNpUa3O5_aqaVy2o=!0hPx5yB^@$H;ZoTL8~Mz?)s$_3r89 zmF0Cs>3!T9ZS91UXp@E9xTOr&OsK?+H7- zh7wjJDDE73HU&jzFLN0ggppIKOz_M6)b&`EA83teVX)iG0oLryFR1@5WLHT_kh%Wd zQIQhdyBjw_tT4Ug5!;KekL5OEUNyRg^C`ys@biSdoF@AXc@PM|D~Ab0Y%68&QU6S( zUD}j~UU9d#o|L{H(uD|Fu1fAP&hS>y=T2-)RPCB|soRE{Bzrlyhc&dg zn3Hz|to{AjO0pv%N~9UEZs8~+H%W?O)9aV14bc!>AVm6PZ8p>j2&Cm5aFaMd!8GpT zcvl2I{uYEl7$J{g@5h14jyk={pDh#YU;o&eQOyul?^FP zG90}){{m5k3GbH|=yGCuY_mevO5C>{g*PI7Q2Fp)6s>9(Zfk^j8DvK2R(_E2^=}Xx z9GjTPMnrw8>l4KSo152~Fpg%1mYSXaLjG^U*F2}rn$;#YUQjli0oOMu%{Z0EC}+|) zODelo#8FgZBU!X2UqGmtI6%@t#NKsQa|0;}`#!;Mw0{W|RAc}a9k8JAx|*0k_qva9 zG#43F-HTB*7EBtRk~SXA`Y8x+vGsl>24M$p3i%+(Nhlx5iJ6;B$(Ff4VO=X|U$%(Q zmT0p$-JWIYPXQ;-`SvQe8ZbJ8?k$g3?qh8>Ww1_`dki8jFb zDC?~^1g^B}2kl3)Y6_T3@BYAOB3+2*K`eCODOg>}2D!BaHJev(d0TK7VQZb5pbTz? zoQb6xt7<|TkHz@s1@;%oq-3P_3w-D4knXaUsRIx>5hb~6)Eu30F$V2{@li_#GnS*@ zmRE#CPHjy-T%ZzzY`)tY_ZYq+6-j-0k&6JAjaa6E7LjvQSPKL`y1ASbZ!2u++#)dG zpXX`07-}x{V3B0C0jNlX2K~dK2NRG@?0y-3_QP;GYmxmC4p%u{_)`n^f*$4{J+-ET zi3N`=c(eFy7Y!TzbMOh=X>!jL*Us*|BKAY5HqcxisNI#opOBOM#9 zjbM`E{ycSCyNXBf4mWzb7k#uGt)Frgyz{E=`wi^47k-6k=LS>r z;dJj$xi#7UM;&ppEC2~|T;TzfznPYN08l)}n)OFd%g#9Nk=cxo!h<|aZ5Wum1CgvH zXqHcyG8c`Jz)t<9gZ(Fb#j}<&yy$ews0*$;XrlyRheyj&F;KClRt%O1Ki^{6Xw2b>4;`4?x zo?S-0hMZ9bvJ3)m$qQMd4Q{TX8!Y~Kv5hF?h^`|Hy{l{6J8B$xU@`=$T(17)UwK5& z=V(VxH?IH+YK0M$=DX7oLm6FfzO)U_v#Ybt<@nLrMYC(?gyF?o4AMz&w&7MQ4*3!3 zWEI;RxadOMb6a22l+Ys!J0_+{+aFZZ8Nh;OWCajz5P_n_X!~gtR>2MjPHq(o|1Wm| zhG_=D|I{$a%s)bedHQ=sNV-~9A>8!S@xtzv8l`60>KkB=$7rc}JSl~}4ym!2Y&?$~ zn{I7KzyF@1vSx`VOy>y*Crch%#S&t)5eSkFoqVVwmlypeNof_J0-p#zvUOtV?Q9K!2 zY&AK6h38b~o{}!e$XO-+iLQLqzl3oGMawtU9-XT%t8vnJ)kD<&@eQm)3_hMTH*U3-{0XOxNaI_-> z%I#vC`J38pS~I!Dxk~%{2ic&=#qD}|Ha!q=YFf`>5u$bTAP)tp1q#_&bR=0DQ{fZIQC zMC)22u72*-#)uHY@f}j8r*)1i-@s%Dh|X)?H_ z&&~Wwp5d-s4f3+?B6HJC$D`$SYP?{Q9_8WTA*IoVi$X~Uq(`Gpigq77c#!4gg|w^k zI+W1e_e~kpr(a-{i>spJW+gL&>+nw<5i1 zg|9M5K^ReUZZ+-qH>;j?_O&?1`H9eD;I;h#RZK>hXM9Dof$?S~cyfl&+dqH*uSbO{ zglKL|7IFSIK3=2L3Lps=g!)^9J|aS48~kPw6qXS1^mGh&#_Nih{`r`^gYXj7LNv6$ zUxtKM4t}BH!JSLQcqO&*SPbm+=4;IVdQTVPJ;hkY6<3z4A`QMjU`~Sc>qWN#{S*ye zzZK2L%W_AWsy}yC0jK-(EvQ!!!u>z|PwoIiHKYep8QMGUwuDhI@0!iqi?}z-a@7yA z#dF~wU$i!=F=(x zD8uCfF5E4%Gn$*9`pU~*S@d6z%1B;6Kj4-aEZg8SgBixd_r$NZ4ai)!4csQf-Ku!_ zC!Jz}4`=0iIWCbrgVqny`Gac}If@vEzyapQksV|0ymQ?{L;E*38BqMCqy~D^+xr6u zcM=4x^PZ;O!j8an`>FN%YKhhZff^v#>PVNAG626dtLQ0OgPWy|lyv4}CnJ-~Z*%mX zl!P*;EX1(puTA_VGk~}s14Q+eisPU!Q%K3l6^x%Hv3wW`wD$3|d{xfH`kVZs$B1o+ z=o|e~1Zz;Lv-~8=g@wZ6FS>s7Xp~7_736dWz+BONkuOQgog*EC1U`wP|I0ogwpmWd z65qd@oCK?zjDCBQQ&pw3f3T32%59n%vRS3? zR#z4DlCQw8-itl-_aB%GWi~lj8!^f*dG9Vy=)q|_ltI4<9u~JJ3I$>SLJBJ z#b4@L%F9uU)v4i+{h+td4OCc4VtMVMnCR9q!Mi8FJaStHS&e`K zFiafb$179gNcj|a&x^l5{`aq%;}TQ$z@MeUDfCwQ-<+7{;BM|8*yZZ5O-ATq=J{bD z>9VcSnqD!HXo#kr;G5=`DxeSvESbuDDeeQ5X3@IimPIq`3DngP5kArkRd(F%5;+q! z3fh^zxEjTC?45FRRf5P@#> zGqOF7Gw!8k3%1GCA-IDA>x|Hd3X0qQwpsDhzc-{1hOpYRUy6+oA8{kX-Vlqs?cSpF zUMDzPtvioC4ULcIjoR_lmPV=WhVAyU!_h1aTq`VlI}m98f82m*Cw@1aJ^UDYDC52Z zyLRq#El1aQ0#u7~n70$nn2>AZAX)0vf3H7F6M<74R@EPZkGw_!g$fQ1J`#vgCyJh< z9o@abI%nELTMOnh4-5}~h7{NKIM`mbtAFl3xeF~gG&t+S2fc)Jhynzw|Fad$f*Dy@ z#`}sYh~^{EsHs4k3qmCN?*sPRS0CT4d4}Gf4T5I~T#OQ#6TR-{vag45D&U;o34fKnX7>94Ob zuwHRm{{X@{F+e+5CI!Xcin0JIJ=fF6`I~N6#41Z1VSugr(0;kMb&rWz^YR}-2Vev1yOK~w50xdCCT--&UiHfb}&f!(fsDCXe2^P4aua+FIS0! zfN&4UT&NY|5n{DaTg37&l>rB#112rNjL@)}w{8Q9o< z>1-a+zx@3lUMCDd{X7m6BmZ8jmj)ueI_Ma)e_0))Ln!O(Vs#c2Oz;{(w7&^?#Rw$p zAk27lf>FZXe@(tXd;}FTzU-Ydi2@6Yo6sP4M_bqZpNuyNMSN}SIpGy%z6T2o zyNukx{`?VtA9+fM49498Dx&z2{HEfcb^+n*T@c#gfua8UBTrEjuzK8=uP;+jUMmQr zb8-+IKy!}=e7Ctdtmp5QU)`4rViSoqw9kJtzzg81YR`g{6fy1xD;xt^pYt%ZF8^2I zDYAwL7e9ZF)Ib0!MUSI)VipF{l;j6v9W>e7NQ=9Snp%$aF8Cd>eVL3bcNVU|ssB@9 zF8|>5j#{A@+ci`O>YJ$}wqsXfs0a*VSTG9}D~kHUgrf7|el)GIIi z{WysfH@l}y0PS7`kiU@wZx^a@_>ay5%l45rFQ^BR7da~jfgA@*;%yjqcC$auQa zv#8J4dn9kt-}{L97T<<|tDu;~FmNEGiR}hcvGot3u4m0ppr#z=eqY3eF+#9c%kCeY zuE}oK#NPiRXY^@|mM7N5XZJ=M^TMa$CqnG8>{Exyrn<&<3>(Le(#|xG^<|qY6sw>P zqLNyrW1K%GCe*nMp+Vz6lGCBmVLR9#>pI_)>zlqOi)D3Qn0!!St)o=>emgB9DaW6f zr(Q8Vi*A|~^^u!sava()jE%y!^zrptlTndZ|4HIjptLewH-A~AUj$yERj@^_#dTM< zIGS%$7`OSR)lzcvFxE7Lu;?{MSCt`(8=p}+D?y1;dOS~m1X+;gEz+^K;v3curLYq0 zlbg9?)_U%5#>_A;wjDB#COe3SnnQQbkyyA3OMX^<31`Sz7yzaQVl@NDJrF9UO@xO%p z4gxCDdg)zh(o*0?F_EbwigSi-__0b@x1$~H7z%f_TLp2rI<}%#ev2QT6x{9QzRhL1 zH~JJm46zZHG6eU!4k`}BboJ~7*z-8d<3s92CcAD=#gojA4qJPus5c`cC2iTfIgUMb zwV^*(t!I(}JlR|Lfxew5)@A% zaSMeAxE~b8lw-O*lXVVz{gs0u!kSv=#fA8L^abQQ3)zc@m1W+W%hqd5>$)5J|&%bzb&LAl9RnLqULPY zEVpKn5uZx#WNhgnd1jC&Y-jP7mkZ7N)4akYYhXeRH`ST`gOB@&98}Hv!`0uyx-Ws) zJh=MB#A?_%aP^6rSv-Q9JvJ0WIo)(W@r#aFE+?=l>dJXJX8V{3Fa5xS zX&l+cr`ViEl}3*5Mo;>ZJPMpx7cIrskW>gM2~wVY?B;YXW?Wy1gF&@i@q_S8byPkv zS5~4!I?Ch+8UCk7Rr~TE@1q6mYs8ZcfN{qc(|Bcoo%a>S#gb>xA5uLZp#`X5>H+eV zc=fkULL?Ss{6fU8vR*V995ttX2aX`AUi10#u#x5IT9CFTY>L42!xa7m-rfTK*CQ4W zsz~PP2;vEXdHh1QFOd+#8QM}_n41~ao5dnlW}^df+X~?{GoSU1n3s3OG?%eQZ>;L+ zdwaBKV0XptG8Ml)ygqxgtj+l*vmX|EC04wUnO4B*OC=4Yqy%;%jSL2+(g>F?Y76^A zX7qzf%Gxj9hGA}qcelB81@71d@f58)NF62?+iRZBcZXF2tD0Y;j)jdCDTG0VEDWDi z@DW|dw-T-|dW7Ou0$t6+`7gJNNaG0~CaC;&yTIS$BiA-(NCDXUQK62>(($~AaB;wL zM(EJB8=1JQUTwQ758Os9()F^Fv#7lzGfP@I*b^p2ruAsFQro`Y$+7mKW*LkEe{Xek zq&C_8DefjevG%`FpGDa~BvS{kL2gtRas%)p|5$M!RrNv0|-mu8= zy1WE)jKMziBX1qf2Em%qE$X#7hW0uD-vP$v<`kScW|syqm@jJvA30LC?%1v!VV-t8 zaLN8dtZ^PA(20vf@D;XanIUu2OoRLVRIx&^H0p?$Fs*gAP7XfP$ezp=2jrDEM86=A z?fN=S%Ig@3g_QDYj{n_~)%lILk-DE^W{E!usD%aHGbT`PdvPr||giL3>E< z=#Au@`?d~Dq!eOUVYwTwwht|J-pSV^TwZt@?ggWg&LF%k{?60V&On(eP2jeXP7x1^ z8-qk39hx#a@Z{{8l67hfn$j^>#P;vUWJJ&AI~4z`eR=~pS?EZ*wzfe%Pidxi+Z|Tq z>lUjU6;K{1tWZ{}rZzomAE(0I|7SUb@6=QDym1#lbu#=~mvCBe@d zm><8I5g_UMN1`2}w1FBUT6HfVCo6@Fpja|L+OWJPg*l>eiQggg&XvgiZ*(Y%Xtg1b z!F0U>WlU%k$dGFZ*{1u{_>qzhYk8}Tt=}c*1&(_gJ!|G^VbSa$2{XPfjBj9JG9_-? zdC=teg+b&(E2xBL^^hg@f}Z5a;Bir`jqSoyKdI};ZCJ9ZZI!$_uMW7Fg6$S<+x7ZT z^~>x9x(2^DSDFt_n#Tv&XpwJd%&a|cUaz#vyjdAUuw|I=!)Zv@gL|pON@yB}zZI+O zaI%cPcS=!-@s0;`voJr_^+)fS((wiTXdx25c1RfS)MTlz;dDf8iWrJp6t3fCTJsaE z0O4Yo%V)0rTiHOeloEiy$TB9$E4WgD6xp6*+E(Y(D6kSaj`)XI@#FgFsjp{1gWVFP zTJ9>JaI$u(KM_(3QZHQIaT=j16&tc`D1FV*)VXj{h+k=5UxdXtocJ{{p}{F|1g1r= z9}9C~j{5OpLH0+=XCuRaA^SJ?{hK~X))8@b*;Dl<fk>=0D?xy&%$33>u?+?jYyx%~AGUm#?l{H-d#LqY|F9;vJi;t>Bfdv(MBRJLCu zW;3ytYijFTb4E4AUH8Fsi&6}C^-S9h71m;1BBkG^`f8maQAhMLqB71w{!=HK5ucrQ zrBOXG?iOkw%1X}`s8cEss6YDuTuFb7r{!nr(2l}Tq@VAU_A%7FH^{%gR4Y%t3uDPv zzYr~B5V<8Uu~gmCRc7Pf_z^z~(=e|8LO+AOE4O&~Mba~4?-IVj*wh=m1x!OY@afkA za;%TaE704NpVkC26X7%G1Yyw6Ykl}}^N6*ZVxu%bEHqomZv4824@@tzQZJi55_Ydj7GYs}s5mVLfv^v+MXG)-OCg)n|F2edd#<&A9bJ#QIn>e5NbtGtT>Jq*(uVI9pHd z+~01odz8mAscZFqc8Zx_)oXCNm|)4_I{zcn+cot)LZM{Zl0a5Je3rUiOaJk!7buDh z!vxkj5Waw=^yo@L=Qq5GM5Im(*KhRv4R%518^pN6ddqjzy){TgOj^39emaH^Ek0w;+BGl(LQ_5U+Q4ZGU0lKn z-Pm^hwJLv44s-@HY6TYLuD7ocen8o5``W+g3YNx#IQG^yik*68#dj#YD)F}X3Y^YS zil0U$KV#JYsJsx~&7Kk~B3eecQHOTafoyw@g}XyNr1_c;LEyH|+bih-%?}c39l3;y zhO=q;XETa&gNaS5`Yil-Yqk8ut);u-QJ(&oR{s7R>t^h@`MYhBzIm6e=pf>`82(2s z+R5BU^|t|i2~}h(_rWn1Ml^qXzBezCK_eUeqZ=sH2u-})iKVP4$$w@GSP)5tcN3(@ zzq4{U#B^SjxL_xayYEr$7@tAxrob*Avk}jnEfj<54gV~wp0N9U`C&t+Y;`Ndp(Izi)#Bh;rn+)2fgW>qp zC~khGbdMmWn(-vu4<5$6vU}ri(C_)(x=KecrIe-XJO4fPjckI=jyZbS*PBpqhte0Ha%<;^p&iYX(i&3zDt~z8Fig8$7zKeejsq7u z`G5JoMo>Q^3VQqOw~h80%H4uy4VMU76}8cd9%&XnfHKd)Hv>FMcHTZ6X(SHl+dF%F${f}6VCCp{&{1S&q zh?hPl_Lvz}_?PF|3_AaquvdRVax`8({*`Q8)}@G9(ckF(_bv*embQ6{&2g;U)HcP( z(%sSx(y(Zd?(XjHl4maWId1kj=l@>sx5eUy>z-qdj^A+LhDB8| z5)GrndrHvFK&^Wp79um)f&-W1;eLb%9ZAgn>Vltyi;s_g;$~z+qkPl)ziJUD(1iAl z)6ctoH_*YdA+>9E3^(y2hr(;;)B^M5j1l~A#Rm?@@~JN8>g&9_tZtbbzy%T%TY4&Z zg?d^^(?vN?NyE)T!?N0~pyRaUWv};*Av2fN4}WcHE9=#?4@E8kPVqbKN4)JlPnMXW zx1r_fvo-kd+ptg#DM5wN6am=oJR|7l+-{|kYMu6GBKza5$0=@4 z7i~{Zln0Pe_v0>c^5LEVk6QjV*0GpAC@iuOU)^^sQsJhskzV zNTSRC$~rLi^?ze);QKis?nT>g3ArQ80zOoW*X<{*`AlOtXJYHM0&LAZ9V5*Tst}O1Jqd3i$UuKFFGm8>G-y z3-h+uvKd(?TVwb&U>-jQKRuLi8Kx81A#(Gq*A?JIg>E5 z?12zzoAaL^HRtT*XK!}xoF*^?e9l6HioZphk8Ue(RvQ&Eyx5(tlC8Vk%w58wIl6oP zzgUPY9+*?aIat`gIp@hM48TqfA8roGlD_rsSkB_CRrwgaDs=Bdc|+#&jmD0R8DH2( zxijN~n(0ge+nkHDS=;Oh_DJX+TVCtIGUgF=7=OfDLr&F2;sA9OY2LOT^o3Wg-vTm+ z?~}m#8jc=)kEMXxCh4g+Uu}WQ?cOehAV&%!Y!=l#7MMAkG0n`??p}oR-MX_`;Gpy* zz11|Ct{mX3iesrywcQ@y;A+KDw+>N(I9H*y)PeTj&7UD88cCS^a4g!ZkA~d(xX#Wm z+j0+Q&md!6u&;y`Ap6rtn+=WkFW2s`RXv7daOyR-xv?3GQ$X9VJM5%{LC(3u0e^k; zn1ohHY|kPi{+M$QM{+4uSV&69wCm=XM#mSCi%7_rUb)jS_VRfCv|NVHL)M)a;vT#* zHV?dxgQ_~#W)<;Dx9lGZbjy1g9LEbMye#ui^nK=FxHFUxFDOmo+y)WxK=dz0vC#b* zJRsyVbxn3lK)1JXDPJF7-Q3SvYtkX{{v z#)vmM^Zr1;u&_WI;SBBVTYR2=j@dD-T@WOh$0(jwx0{jASYw#Yr<}(SW#c=`e0!6< zxw{)g;NwnO_!6hgo)ODT#)sj)sBr@hP`D-DAIEl%&8>>tOl#Cse`NH_h7Y&JmolZtv*I ze*x^xwsn#g6W1`e$8gRUUW4V|JZP!e+IW*y5LuHlq5jA*$cD8Ejtmbk>wdwoh(nkI zW11LmpVMnxzZcZUGjoB1xBmEerg+e-U9g7;pjaA(+_pVNMRic#iH&0*-r6dxkq}R! zoB46O?_KrCc~k+;{gga0C8e>*ysli!xQ@5_2^bid1HI$JrG4D^9ksv~6?5wL#m4H) zu<11oxOP07q}Bdj-+?=2cIM3gmNrznsDCBss7-I}Tix1!mv`ZSkwHdJxtout1Vn_# zG)*b=%UcBjK3ZShm&gzA(J~fh{Vb#cOwNseOpZ;ohJZ%M!$Y@0%(I|a&=uS90S`v= z8-fkOFguV0MreFd3-B^z^Yil!8$IC-cWWICEuCu6bU_144(Nf*x&QES7I%WY^~=?_ zO2lo3V@r`#%Bgz2(J9ME_5gq(fz3rQf!j)jkjqhS>|xmln%fx6lnF2i(mif4l#vZq zQ5&T_NC+wD3*g8TFsXBKNkr&#^Z}?lLt9GK*4cD3CA$6{P2^j(%Y&jllDA!v)JI-^ zW_2f#HreH-GdYfqj>GUc@rBxkENtGI4i_u$dDYWSt6Xm!N4~?m5wkmOq(>bt9>+gK zQfMGohJETxna_DLACX1!;)hmDgkHKgNJEff~nb6ck+}=hf@Xo z<%ER1L$}Mg)YUhQ*Obf5l3Ztxr=^>E?g{>vbV~_A*?d5+RPJv!*9Tuk@HMPKe5{W@ zmQNTUacT^3!8C`<@6=Dr@(U`ov$BnKQdj?$&jVNp)EMO!RCgl$?xSiILkvb`=Tp|@p1av z;b`P*h1nat>pWB=$}yr{T}^J2WTkJG5dYc#V3 zmwdiv-V=G4&1f__o%1*>DXX_vB20ZZh{JU3?N7!mJ+8vKuknvQ2Xi0#pyjALtV9?> zuo(@p5*&Y3tpz;qnXEaRP^q--VH(3t(*MyQ9@HT22xI5 zEKA#*ZpUyc0-@JlU^Cn0v>9p3?TIHQRx7uTiA^cR>?C!f*j^EBiKeaH_l)JR16S1i zfRtEpg3^e@iHz@U$IDm5z4N4tbtsPU0a0|e@#DIuPVeigc2LTMkSWm);5VfIBkvK!SZ;l`OrParVq(J1%O@G>FnIT?}OuNX}fb$Rt zDHL-=${#KswI8ZgEnvAjob66V6pd0wA4yW#DfrKTM!@0lplsl2jQDf{V?7ck$(_<0 z&!)|Q8l{+MjlmI%85^V}<|_{A_MWORJEQx?-Jw+J zd|_ECfp(7a`0>U87dyrrCWC_W`>WNSxCk8~Yk@d!eYra^@9&SvyHL-ohFZVzkKIi+ z1z%ZVnjX%MA%%5we2^`su4cH>Qc8TBDWCI;a%v;m>E@ROLqTcozp(&*#p+|Knx_RY z4JS;x#lA+W3fz`tQ(k^EgZ4mrHJAVcPpzEfq=7GJE9Wf=NbK#BEV>nePD$f71pu_b z>>BWu=LF51Te1}Vt^?kgI3rZd%2F)Hrye@^Cm>shOBczBJm|JNX*IGbpDXSb#l3hu zAVf5D!-h7qeA=-&xm74ns4`8On$KmnBVE&dkQ+l{w!%8yMO!cCUy~8jz9moHISJAB ze%%$4A6GE}k3G2$)I=yz!@nd%mp=dQHjFTX!WEke^R&c;OdexKp(jyC%RNe>Ue< zUmRvO`K7nqzCfkIG{K=9%-bAWG}6Wect=(dI2m7kS&_6p?xwP5vVVR)p!=q(!BJ?9LFNXxw`wSauWrRko1x=ZtE0h}8vxm@=?bB~ud5J^qJt}DNjDGt@r+Lbo z6bUPm1-rX6C;jhG<4Vpoik-ixd@r4`*~oK?)0{Cb*{?dXv$oDsHLDvL7iDHs)*FlQ!jp za2R@5u+eW-baSe_E`{Nujz-|WW{KS0`5M|mgWKQAIv46O;(+z17Q&Uult+{FQ~KhT zd-Q>CdYK=tS@w9kNNdyE9@Ifw59~}GKE|FOqF4)IEi@As4A@a z5@%_WoV}prY1H4$#bhXQH+f$XLowl8Ab%hk!J$GPd#v~l)+$cK%Bx_Dj^MQKI(a`R+d~>+ohWg9ycks;-T9PEOXAX%(*Is zy*ai?cqDI)W?ip#R-;wX41~+eii`~c15peMdJo5P7&cKhmTXYL=8U#37PK$E?ou>t z1@bfpM)mytq{_R?p#ThoB(AQLdOnWJsl0l(dP|H-D40M#*oZE{sqSVcDqFWJGBzVK z(Xq3FW{f6>03href0A2EuuD{NnpI)g1I^4fqs>Bf-LAm+#AM2Gq8eDt4oSX^Ipd6X zYrNR3EnABrtvenRH3UGu4qah+LBx+EMCp-51O=)hx0XU#)T$f9HJwcSCyTXf$afh6 zC(JC3OE?uRg%y61C)yKFHUDGg2C8^Bp#u<(Zm>#k|0LtH)It1vIIM;D+W&~1mHd?z zewlLkdMgt$H~XDS+s(n+?`Yzat_<82X@1XNR>hra{C%cOltVH8)^VHCGp%n}5fPpo zJBEYId-ALxl&fV)Y zk(i&j`3|GH*$0y+Bkz8_7P|FoCk|APgi0VM{hd_VXU|QiY}h zj)U`hYGKvqI19?MvT45zncEM_x3q1@x3--^S4?}S*|ah|g-Rk-8_4PAEW4;hf?ys$ z3!yylE0TiyYB{{+ayGNp#jg)bvk##5$=|8`knGrIv09}fF`p{4%5;?1=L*LKfO$I3 zuk9hfF1I!VS!SQuK}3V(Ap4%k;;P}FEI=N@@ZxZ#ZI#>Q*xbx)HKrEa)-V_y7QfPS z2|tWs(075D2)Gu61_T~*`aG8#|1ZR#dvIPL6_ktV?HrGtoF!3#e=29C?E44YRnyGsSaa++ z{>M6nSrf)?!!svnx+FUV>XTKA*JIk6Xap`95I@xTDQ(;Co8}$cOTkvT?r5F+E(*I# z=;nK0!?z9td%H}-N|7lexbJI@Q&lm$yhNVlEYnfk(P-419<^!gL@8G4vuCW(_B$gp6ob2B8LZ5V;$c=|TJ^GY33yC| zvDvh5yeR&N$-it&iuy8(eRN%|<(iZUgxc6NOG_1+wx0TFvz!hJKxnRwG&0JRmpHaE9*f}^xpa>l(ai(ufEW>jMvQ@fCn}A9wkYCGVBc~iT>enhm zBN+`fwvyT1+#OavUp1^i0j>W+Gq+0zSo`7w%JsnPQA zhd;i*``+bNp`s;Kv6`h?Ns*{!dWUIr3oSELFWq$)rCfmLFF%)vM)&vEJoK9axDs<6$UDI}Z6F+-P? z)27siPw9V|)}3Gz>Th`=oG-6!h>w}kYY8k^-QJwVZCg~#*v9$RQ+@`QIXC&JBGxv>H`HD$c>bLdzYAol^moiyPv1z>1B{j?F5RdsV~yMaCdOGTh_p2v@klgau_;i#53 zvC(zLu@}A=#)5@NQ87BgO=k`nJ)%7atejLg_SwC!oiq>qWR0PFbZ%Aplm$l`Ks=%q zy#Xa*KTtCf)CDz@P~>yd>J2g`mrLvB>vmMmWH6G;cj5nS8|u?~GAVA8H*uiB`27?Q z;;&mvbP7NAR=0eaGwzEZQBv4pb8vZLc*3?8eK^Weom;ju4*#*Ll~T= zYdFbim#xh0_E)X3HE~<@c1f3<6PU&s8%s-c+%(X3137{$hojY)!<)0)ah;hXf-TQ( z>Kl9(Q^p>!+<6mn1@*t;r1y7g_Igz-@V$Ld&FXJ#!_fAQH->Tw>ouwSl@GikT4u(g zc8|Dy-6e6UluP(c#)}$#aJ{{~#RO}e{dRpGb{zCI62uqlnB)6t! z1#qh!PYhkC4h(ESP@S-2(O_%wA31}29_-LQ=U$?Fk$+c545N8akk1cWm3k>P%tY}I zhk6`bGQRD#&1qUwr@ym{j-#e!tvABi_Rr76!^OpLRrvHP&-5Aw=f%eDVY{NZ=74D`(WpHFoZJ z*g+0Wuhm(gpadEoE(>pV<`&4v+B~w1kZG_R8Bxsrf{cw@AIx`!^O34)u7q5m54`9E$_9r#{E412cf z4t_dk=Cee#zwn?~{cwSTli36nA zSwSO$%kSIax_m#_2s_akWZ*HoKqB-=FK$M>O`v}Qvc%!Mh^x_GBqL0%Zi(55mi?5x_GjJA&P+VK z?gLdI9UTlhwfbJe3bQ?Ko9%Nt22+4yW$62iT(XvxVeUtSWhPir0VPML z-S()*B27aw4lS_Linyt#RKM?2$fsPDRDsZ=V+N8we;*NnCyoG-je`p`+1=4#;A55* zhz>TdVLn{^G1JLkp+(lXt)aGwvxb;6FWvFW@E{l7NcOxBV%VPD7~9CbJIAUvlKn50 z>_*<|RW6ZyQXM$~*J12;6%g(e25Tiel8o}>p*E6j6hk+rXSEpX>(63zpdrAL`=0BZ z&iv6)@&k`UP)QX6l~n9~-}&tRlSu6Ky1d}dvM7Xog^d9HtzK3A7JJjL+-SYZFGd$WN0RB_twGyU=f%leP=eQZbayKIW^aBPIfdKCaFUYqr!bkb1-8&Wdbe9 zG5X%PoXzT&JXVR*+G|BPZ>jJ>AjL>-Ay)jY()9RlO!5Hw+B1Ojl{RLP?ohtW7NRe) zd#W5#!%53wxBkdwiXQKB`+E9LIsUH<83d3uckf33%&H>G)plHL+_2vY zC1~G8G$n z&O(Q9?!>=TL2zr;U4YO(Z9y)XD5t97B(83;BF|ocJ(A0?!gaj=P6L4$7ZWB~t*{;< zurpiN9=A8gV_CQYKM*eilcsLSE3Bf|P{eOO&p{`@5VNm=jw-G0T{ynfumM1;9 z9pAuZ^DEdVTy8O2==3gKD%9qJGsvn{`Ifbhvv^3r(eODEE^pz zcg)h|-`w0+VI0eUV8i_5B_Bn{=-A+(G5xCVys3^gzfIx}Bi@BhZ8xE92di>3K+ll# zPSjl8+TLdL=Z+vv+V1?rNL4k?f=DeYfnj^MKy>lZ6i)GLCP{q%H(0lp9afm- znY#>lts09Mn#9-P+8(-MZkqL*qkVDeiqU5H5C2>9NJ2G_)toZZpD-ZnA^7T;CQ9R- z!UJhVVb32H9mry;&$hHpZ$2fJN3Y4)E!Q*jC`IU~J75H9zgtdir~B#~O=0-13r%!b zO?qbnmrr9jiiCZM;Y1C7^a+-^ADE~TXryxC5L%B+eEsaj6Y+)%f*vSsaeBzqgAqoS zMQP9?zaY*bIoP^jk~CSi2O1t|`rS@rAyJpisar)$dt>9wIuD5pT9e@|J_C6PsRNbq zabLr@_ld$|+re}*N0HVv+jpZIsLPmq2^IBUTsrW7MExG@0&v3(Xwt{NMeq*Ghdwt^ zJN(L#XH0~?rdz46f2FlMs+;J$Ypz~>L#iCLWnSAA;{R-qr_BM9g+eWaD{UoErmv0L zSMe)*jiTu5tN7QeqM$9ey-JwbzXL+v_58l(u-+i3SOx^TAF;)P78`tgX~8vwabvsC z*Sm}UvL()@jRGXGunOUBuJ5J#iXB}fAOTYs4p!?cPe;hXA!5eDc{nA zH5A3S9Lat-Y}MLAgd^s6q4q)}-e|)rX@8z|LllDv7Q#2Y0bIX9khu?mw(D-Zr>972 zsJ7V}F466hvkK#WsziiH)ef<>v&;2<=J@IuchMR3$A6eHXov~M_CTwaFoxzGqDSy2 zo5DG#aSQvoA&aEFup*^(z1=W`ar4+5cVVZk)gISbwIJo#Wo1D!S!%FN=L<&(YDf3n$jin?TeG*kH?z?*Agn)E#U1w1?*b?YY z8${>w#GS|ScP9)8;JL&FFA=Bhn*$9ej}0=UgJ7TG;!5?sz4c^wy^fyy_Vf?a{~aAK z@qx+I$`5+ze;a8J#OJ>|;Zi~fnmA!%DDygFeAlS}-;2ml1x8Jafs+{a7DR_`wKyy! ztTmN|No1=!IrZUx?}@i?xK?*+?|og39ibkCJh|ilQGNnh?8%IM0kvsCGz62l0uC9K z#W$hLcff_SC2R<5mo=5i7P3!=aNblEo>o?s-dYLpe5t*ioPiSLhV6Z501^{@4}Cgu z5o&i9E3$)L6B>Rpe-Eul@65UJ05kCl?a1O!Z^a!R`UO}&@U4~Joe>gTB5+whlF72N zg}ot+8kSZMui|W6e@8!G|$c90MJF}fS-FIf!qP2$E$z6 zJ*^+sPAmGS4x|#@>8xL7d;9xERXAG@?@Utsd212qfcNjV%0KJ`Kuv}t-Oc(PeB;{L zv*J6RuCMwea-trfr0<9J3-Og+M|ALX{hV!9z>0sqP&xj{nKx;|fh4v$mBMUF309b% zImpgIQQ_I%QdOeXs-mGQcN_gL(T5|BkE}JUuR2TGUbR~+#nVYh2UbVm&hawPC44iY@_322WtsF1KGJ^hKuwa)imhCN zuJpY2>mZ%*%Ph);Yan*Cs4z)MLTp9|=bgehb59U}C#edp`SA)4|EJRhb#{470A!IO z{?$*4J9_#M>UoJxw^&^Gg#LJmW}be4u`=eMoS+{%HZNv;6@MUMWx+ z-H!~ypgqS-+SmU>knVYOLUGaPPd#4UIf{s6GT1l7D=f^~02*y{el_c(7@=GqjomO& zGa)g`&Hwkpg*)8(`=gXF;92=W z(0HK3N?_cZbkh(H~M9|7E$)7yXLU18hfHwipU{QI+1UZsr#FP-RgJ= zhmBxE6a$X1ra>XATNOmCgD9qDq1@~1D#I(2<@6)wS>B8o+8*4AWb~jeuEz`OJ#q%C zq6`_)>8%&RTgaMvFCOi_f^!xDDy;fF6n01V#k_MQG>g><`!w@E-xq4({{wsAw@7-> zgW>lurP`8H)Xq`ZRo6IU{jA`AK@QG!CaE!b&2C$zCa3M;Ht%l5 z@tl2YkIJJ5%a>N99A+7;u6rwB2jNcVt8l4?F@N35)u-X z_gO|Lfhu<44)>`~iq+|sw5zY1@J-fh@lo{<#0Zn}m^j9#wZ~!+pEsxTmOf>U*QxZC zw_{;cG5bPnxnn#*(?5E{-K1Kol*-P~ctI$y(^KG5>nX~h8B6ELm5#ZOnCR)0K-SBs z?We2~e+!PX_Tn+`EP{7E!AK8UwSyOQoregRm8R;#-V$igca!*W7CPU8_%}=ZNg~S& zH$W6i&T`cFJ(EEl(B13KLp<`(?&}I_1rF?*e1Q(-L(Yy*7hU1CW~Rn+IaSI;=(&5% z%^(Rwr-}9}Kl|tzhheRDD2{AKql!}ID3wyhPI`6wMO5^0N_Fhm{=UysJkvqvSSA(& z47!BCDk-X6f^y^bNk>R<(K7~$yynLhrY3d7drO2mu@{2@14V=|%F^p;ZCKM=j20Pq zvfYEw*4Zx@{_noAG%Wzt8T=Rps3T~bzV3upK0r!ctI1f!9+@0W1*MIXzM#O>wG{hw zhYt6p{|0n|&KtbR346BA@{(P+Wq#iMDK3Fr^SjTh>LLPPlv6)|Rwsm)rgzi=1#~>6 zjwuM%v1aEk_vNw z^}P^1-lOOb^aKk(+bo&OBg#4lAD9e(jk$4~%PmOUOiWCi80Z`<&}iJXRi?IA0E?^fOYR{Z5S>SEXMaCi)E63-j2R`O+8n7M4ooV6=yGF-Sjx)iJk58^A2 zFaaKT=jW>YYmrTm_&^yJGJiKY@ix#;G)ceZl4*|M!$ z*TCR(XcCDd;cFvNIxM#~85x=LOUFF8@CM-*^L0`1-u}`JLI)b^E}spIjnRu|sUXU4 z!PeOzq9m|eh2fB@i~D*Y_3x9y+&OkU9^A`jj9(nAx3cy&;!K_bjL{hxdi-1MZbUpY z=jXVvFT|2(uJ*{02?CMMvCrY<&LaLzFzCNQLYIOe>JP6T+qlJOHw}&~74D?_5#CB> z{6)DQf-ik$h-O3U@5V3wE}%_OMALKPS{PZQO$I;p7dB(US#Z^QrB>;eW{j^`@eBi5 zOy3x^gZ0Eof6+}MSaj!2Kz7{m@M4-iy*2!3>cxcr)-LSg#31qFW?HGXWD>9RTLGabX8gQcg1*eATAcrmcFpfn}dQGfYqBX->^nUu~CGu#*e=e;E^&YZ(6J@yQ&>llWKuw|R*K-bAerB?beBNC&yGz3^J^_6M(hF1%UE&HDC%?m((f(5vwupKyBVFD zfcocu3E}TQE7VWL0~T_Io`hxCYwYX0+aUTAeHo^i`)EDFA(n2{0b;HpHd zvEHPd)Q2@VZileey4S9W`inonCcoCq!a!JVS?RzZRVR9m)t%ep7GUi>y*%kWStOtB zjbjpa@J;!7_Sovz;!Z;HOY^7lj=NE`mXvl}D?AkXj|zoimIi5FinF^qtR7LozSpS3 z-`aN&FUScW8;pu%=2cOBt%13PQC0|cRn`7b2dd)`!G4daaX|}xUtV$Sxy%vzMexqe z&5a&`fmLpW^=-s|Z-Uu?#K<>2605%p+p|0=~&HxC0S)2PX( zeplMUd0=2E=I=+tve$Cz%wiXtP`-HsE<+e5DW>ghtV(yAco*FnD{+T7UWa=m3rxnr zW^FU)96IGHXM>9HGi=3Yq`lE9Y;Lw_g>O_pQsf%G@X2Fwy87Dv%jI2k94z-GUefC| zCxI-8-y3vk_!ec9W_&3ztz-vWPzo>dO-Na`0|kziD)e4 zoT+OdLo{cg5w!vPMm+O7mAJSKevPzK`35^;Dw{lTyI&ChO`@_N<tSiY|O0p z4m4~Q+oe8oPySyT$`_DG7;MQFQ+4t-Xm-<#j^{KL+@Hh2c9e#hHdCgY}(Ub6@(!$PL_foHQI`B|ZmR8nxA z&CU>&M4}Dbe2|M$A7a_|;YE7xv{tS}Ot3ijTb7dVRfjvPW2~P$hAKxxGs1ce7`~TP z#YikO8EV2ilQ+qRd9O&Yix$M4;#vRQ;bU z^vZ)F=H9JrhnVeX9w`3*`g~N}*a%PbMH1dw|Bx`>NbzrpY*-{qhUHe91H`GN+%rL& zDu=y~jC}rRaHW^{#Awvojs$kD?U~P+AgPO~t_A|+1GAaT-kZLP7C$!BB85=zp1w#6 z$WGOiF4BxL(s}aNyqs(XZ&bXugkX<&D^#)HbsxASoj_YNUUg9 z7mzV`Yl`P}1hSqKqLJ^J(ssoZ#?v*ZRd-U`ipu~U)YlhCWl-Q;bHUX6;gGSQ?EA)d ztI0Zb~n}X4Vp5hn$bGbPb0lfbQd0X-ONg4qGAuShU_U8OeWGv{k|R0GxfS{`m-gi}HqfMi@;p z2BVyu(u~X+tk>2~Vq^@kFmsRiUF6`UBUVLo#>^H0bAz2h2 z0;KbCvBK(GoGcj~MxmLZF1p`4^7Fc*b!U2f8Y-p*=e3d4ePHzQ6ne97Yi~ZO_$QD_ zJ}IO&da_1gV{+hnfw4N)-*H}9xzyU1J@=04ovixQr^kc@3^jI--8JPJ^z+B74)wc7 z_?^QIN0%pCCBDmA+>WQYLrQ-%+Q}9Ue)%BnZC)Wr=@-A^xEAF1h|NQfMQDFhLb5?? zpuU04JzQ+UgLb!%tD{Ug*kaq1N}M)Y|A*R>BL)e0X9pa9N+3VcIIy!$a^{tw)=ik8 zZm*X|@8V=ja;dRW+b=@`bp!v9<k7tP|7upVqG4`uWtVEj=R+N^^|;DAnzI3d`d}{7#;n7E5ii5em64A-VGb88Wk+0 zw?Oxtp6AQNRK=7W*sWuxVT!}_KlSbWqnF=0^m=kejEV*5jV^jRPBv$t}R4J@$2IQ0EYUchyd?_s+X3nFcD-S+}& zud6@ZC5i_;58zY*TA5h>^!53occJcPLmAJ)Is#&iZ69P0JU5B$Np&l_+TIZwdcV#1 zBhIduNQkkWbVeS+1z(Leq;kZw~JfgGQ@C@_1AeIlIn~e{V&~WMeX#FcZD6=S= z^9Ak_MlXubRz56beaCPa76Z4`8f|KnuPEj0u3 zqJM<%AMQ`X;`3x!NUH^*4c0#%@Q(sMwV%cmqp!$7<45m!_rB=P&H&}n87+x)_r9s! z$1dH3n3`6X=ke*&(lBvWESRx!Fq%H8+n*1;KCB?0ryiD-%+S#H&&W0Aa!}J#jB&2P zC@E}cUnj!A!TTV1T*O_1BiOp{lY8>>g~aPo zTX=hlvnO2>qDQp#`OpjcrG&MQ$3RE7K=S*D5=g&!58RM2OupbhjOHK5!~?M4e7%Hmp)x%mC-?Dv!S+42S$@+a4m>;y#=!x)5~IwZQSMbG|hm@c5}iz_zOOU zkYIJYyk3Z)SuFbFw0EL9ID~T6*!5R=*^DD);;SFN@!8pyKV1r2Ly6kJ_vwio#N0CA z<0Zf^QKpP8)hfKcXs$ZS>&|cT1-L=}VHs_LL&L*5PY-0(1IyA(4IPnEQ|ZPYPS2{cUZ-xf6(jC4-K#{0n5YN4-D)6 zgJ&500L#nJo~bQUWPc4nI3Fh!O_8PfV#+K^hXwD7;2~B5)%N3~i3t%|D#XdtbNjHY?X9430RM5C(zcS0GPBPkL>?qQgJAgULIy2{h>2d&*5Za zLX_X8Zkv35U-)2Pf0RdRY+?kfZ9*GqhRf+Ry4j~+KR?1gK}%u{@w{K+U>@2ivAJn@ zzy7)XXKgT{lJMi;d>8GYs^%pyA;nC~5>|xO4TeV6t9##lph1fiu;(x(2TqkpPRa$={+EU8!8IKtHGYgBgeYtR`>VN+No>#f#l0|= zRef!{%_OrCy_>G5;haqqQoe*Mr-~n-nV6X99j%J5ds*kc={k)wt40jj%Md7973@ng z?^9+BrLbG+l-JuRNtfveFT`xsrN_JYNHGI}aHAbaOI3jBx1rBOXipb885mG3<{mS6 z{j?`&=e`!EFd(MW>}*?i6C+VmSJ&-j-!lGwV&Ww(NE{#W-mT*H#5U}Uo1LbGA{C$^ zJmF89WMBr#G^W%hEN@OiW1~5LPH9+_hw+)_xkYb^w}DlPnP-GoJb%~9kG)V zthSNPy+(Yew8GX=kyjl{vBAo~rT(GeT5fD~WQO|ayMrpq0aaH^3%?4Bi7c$h2MvVf z*|h1aBH(tw=RKAFJ1+a1%*k-rXn+Z+Q~k3=|M7rQI2^zO#YnFlyHGaLjleP%6PM@> zZiH2cSJE=f;PEcWU3;l0oIpA}-6MoF)33A{K8TBkTeTaa3r{}#t740JY%I(7=SykX zfuMnMV*LfFXdD<#@h~=f^X`{I^IaED42L)> zf;1O;YTLZ-tUz7Q+E{K|S|_@OxXNMm_Gdmh^nS=YZG4c=E6D`sdyH%CrzY8MLnE=+f0`0R48PVV z-gw2X*m+(=a^*!XOm?){G>hw~0-!8j8Ds8?C+NTsok(Hs=BrkW0_vG!pUIHL(Sg;b zyeiW(yf5nr>?oh-efv=@R=SmXEUzG=gdZ9}xb`iIX1;j_Jqzo#y*4IK#-Yv8fYvL^ zW{ckDX|*G#)41VPCJ%B|7%#p#1zVa8Qp|IpC9*60uZYJTT`2(S_2U-i6bRpa-~%0+6pZHP zNPL(Y>4;2LaGV`X(w=saFCl1@@17caOnB^FDYCKlbo#m7E_;>Y*lzE|X1h-5T9rcm zTVughE!ui67K)8m+lUOADh>J@w z1t}2T7N>yZ3Vlf$U78&!PJQn_zn{Ttc}X!H(VMY`zTx^IQ*6^}rq6;_)OI7Zx$Ih~ zH~dA`NV(Q5$QVA$^DrvOzc#Qo@ZPX#eP~TV8c~oir5w58shQVBr#X41 z;jj^d_}GfpR%`+oDcw(R3W<$h-y|0Wo}awx(fjDMv1GMGuyFi~H+K!tT7)*k$^7*+>)}6aj>z*sV8{p8 zTUz+C)%_VS0kl?Uz{ajAGd>HAcclU5+o4d;;pZ#al(V)!ay|Jdgt?bSI$j7(4jjhS zf1llIx1A!@ujwWc`5x+@8!Xx4IMxQJt`U~sYLt!A=_zEAFPg$}PnN0ZL0qr1r!ZP# zYhZ+RA_LeTr3ZTPF#~|zXL<2u7gI){na*#d(m+{N5yw{ytWD8{H#Sc#FIRBoH-0F+ z_Q=a@dOkeM=E)@8O}=bTu_RcgJ8r^{G?Tc}1rT$^*H54>!+gW@YV8xHtMPGGRwXy1 zfx?0U?sa5dqHT$1N#PL8QAA4X1OYAiSURBBNLQ9cpw zr^Q6Jbgi+CA2^$2m%abCh@!aFV!2bX*ng|xSCdA-0J%|FZtjrrpn%NlD zjAsx8gEMjy)}$EXTDWegMTjA3l}5PKVu~2?QeML1OlEML@pfs6@rx-sZ$8l7ptxzj zXVRDg<~hta*V|l!YYMVd5p6k0{>+HLg@j74WaorR=m`Hi18SpAoOyXJ8n!jZm z%_`lA59UnGN0P*jr`@9*X6>aL>slHG1>$$b>UY|q=sDEF@~V;9$lU$i{3Eg_82c8b zy;BHWyl*0&EEb80^Nm}hi`qQbi;X?IhiY&bUPb+Cc$PPh$qg0~?Pl4zg%j1=uUJoO zr+ssDt}?g_!$FhpUA8)9SEo*>`B^*X+j9Sj?^URC@5fAUchpx4-90RGuqhMatfDC@ zR-*pUl}-qQN^IQRreJRkd0egN6M@3IIznPLgdX!f%av<w8gwmO)k< zrhUM;`V1Pn`@OcH=J@4eF%&~wW&HIFOEvI(vBfljkWlZ!4~tk~$)%C89(1&|lX13q zVYbM>Q6XwIeuC9Rl(7y>4ug1L;FDo_*>oY6@3bs?LPCN)4LtR1%#1JbuWKI@NPZ+5 zD*^kwh9*Wxwa<+ZZftj^N!J)#AqD+z8L*~H@gHP@FJ3>(;urcA%pK(U(1d`4`DGJK z@4JNr%830Wz6Ofn5tiXNY;!XsRZp8A2*_x7S|XFNiHT@!$6#Nt-1q>|T&4uVIkOO) zbLr~kRt17~eNx<8=Lp@EQS4E2g7Z4687~R=T+1}BaCoOH6pHyHgZOFfvlvD?Itxp3 z8EC-c&a>+>KnQ}sU6u#%iuf!^+P(Gdb>en?mJVd|`o?<9+8IGaEFj|)6K8sktYMdQ zymndT_0QyG|I?ej$4THGwsK%`4jI;3mpkPZbThX$#khkm#B?~Uhv{;%J3 zz6i6geXVt#$2!-ZE?zi8Q~IvWrw!doxh$!Jdl{5Z660tn{=`-#Y^N5l#5#@EbgIW3 z3e0d^M=n2QLs{|Tkwho!HC-&7&Qti8|FWKG7IKa`s*#cVKUn}BWjfec24CGCVHw!j z*-5v#VbDgM%FC|sUsQ#|2w6E3@}CDAz)tEAZ}X?~+!|w=NmV04I$gGJQo~S@PUF$yzC4pqoxEo{proPkXnbd8 z)2I6N82v_;4O>Vm-vqp%&Tdhk>`DI4FO+jpGtEgs|x%^99h-`#38AvIzx{# z51p&Z+;T+g>N)W153a0-8Pqu;=y`Oac(TFG74tggAgs^4al47specc!kHh;Hu<`c# zDD$TNcjayw@VHD$Hh)`i{JmD6xO2pmsa)>9nCHINQPueWvn~Zqf&1O9e{{R+-?!0M zCcr&W?B;dzP-b*mI_2h<90+eqd|uyK0*>y8aQa=87tmroY)d08Ap^>VJk=l<8EWb3 zMe7EAtk@1R&1%Ds5;a2!h5@=dRh@b`sKEu`@HJ+wAB6cKSe;|{;@Q6IJ*0em$ZA?7 zpP5$v@@1)f77-R`Beq7e%}tRV8x&f@fIWAypszszUy7FEb){81{g9Gs>XbG~Wy!A3 z0v|98gq>xG0Z10<(5kjSTyR4%NJO7YcE;q-2TBk2z~h>S@g&#o#6SSkz29${kAR`? z4_F|64Q)qkq=S&#a&6V{jP(=N+|DGW$?#Juj}1Zf&Uccly7fU7*DqkdrMz+rfKQz)wLzxYoH|>@0FgrNwgbD zO4;(3@9TyG_3f+et_xsKdKYHP;wh&9_Cl(WeE~LdoPgb+a$I!9Aj4`#q;ZueDYGT= zgCdq_t9+aJgYdOAp*x^}E785qjg4OhmjTqW&U4*w8WY%gI9gYgm(-IUPeJ8^-rE*I|Wpk^hUo{(6jxl;XHX?4K%U!eUv`f z{#p(JR+#hQ3Hwq<-ckekKv&KPS#@!BjGLG3hWv!cMKjdAgiQGJ3?qzR%#O_yVl>Oh zm!3fAxP!|g+IqLuupD&U+yvAY%YuA0>*f4)#K$oYz@GHptG}!)ETmgampQIiMI*!O z>g>v``#wv4_CtWXN_EKm5l#n`ntdnS>Y#}eE`^2r(%3ILQLiNFWZZ^^ls{|MH55`8 zdM2w-W{Z_M#wLg)BdNm(^7D$;);6K-0a~eb<#V~W1RYDczBlk&2 zQlG)h?B<*k8gB1`tcB56l4By7#IDw@1F$8Y%$SvNGZAkupuk@|U!PiyAnX=3BVTN~ z@oa)|eSN>kQ`*vG9^7ynNPqvpJpO#Z#W!fvX(KsAVygH*8?b)>9l>3oG}^CjV)_&F z?*|S}ijM=+d=Gh^3disMCD-!>md)zyRM4?&T41}*jvDyQ<->$*{#n(mAG6i>k<{L_ zIE&S>L)fabAG6uX%WuV)tN0?Tj-XW2k$j&^L?_rI_POHvN`(X`Jld6>@T>c)0|uY2 zcONQG1;MT4wrpB$T7r7z@ri4fs85b;ww9IH$O_!HQa^;+jCCteELW9Ll3_?0ql4L& zLIfsO)a{wcj_rq|?8C1$8Ha3$vrn|K^2z)cZKdm}K_C(U<>eyJuC%k!E0ylglCUAk zK2fvYcoR-yAE;$WoxP-%CYMD!u=+C>A45gN%u(LVl3J zDJd>{s?+Low+oLhWbEcW)fgi7L2qwQ#U~v{GEBe|B}Xv`T1^7q1Q0hRa5*IOD{%Jj z7n|wu@+?M~VUH?C!{woe}3$kH-cKxqL?putXEU-8u^O@>vx}+&8TN$Ik<1QT7 zWHrS@H88|caK}YbBDBxzw-PQmIVz<+i;Ra~I4nx$v{yKQc>12Sn3Y9ApkEOIHY?#) zMb@)d622xckNNHBjEQQ}C@YsM2wt}vKIPw_;^;^6B zZEb$PTY*8kaZ@pYRwIeBp`v$e0DtohKFMM&;&W9mol>}y&pT4L zH)`b?&eSXK*8GY5Wu?JWFuKy1Rbw;Uk7T*+Ft9zBc|7 z1o$%uy!0AJB78LlO6er%0I^XY>^+E-??Xy`u0@>bKOQ66&TAp#XMMG^FaCV_)$otw z)@7P#YCSt3>LVb{UY2ogw#6#3`8$UqC5{i^Nx5nQVftrxbw3Bl07T*f5fS$Iy}#Z} z*#Gus%6Y3tJZ^}F)~jx1g%S5bJRsO&-b3a3Q460i)LLS*HnjEk2Hs-Jj4lw=$mDAN zXTI@6ZY>G;-qhQvXNhB7s9Zg7%j-ba#*HIvq8#j_G&i?OjA|0?6y%r97J_9j}36Yl4tA;-Ohv)V%n9`M5ZfDV-=M!^3jk&9+ClDNt zeLRL;62T>it#F%}hK_%VE>UQrOMI( zI8Rr{CsqnM7ofG^1iM)g7D_mKlXboV?VcJaSRc-0Ey)@6TyZ_t{m%~cpYGIN7$E%? zx7^?TWd2Vd0)Q(Zzyzv8`&@ z$+{J!LaFJziZe7yZmLa|)~I~i;9%FBFYPnHdz_kH0+mJ{phl}n5c_uWK0*nsx5b73 zu0E{am8~s%nlQb~0NIcDX&U>aX2IE&k8#(sv@j&5{9$SuxntPZh`~6&3EGHh3Cg5u zR%ccejX;wt@z?J&Wg?pp<~#!yD{;(jnRl5wyq^_H z^iQ}cKJeMu@h1wZRvRX4(QU;%_xFg=LB=3whAr7Yz26`wzv9UB-NzwSxp*h zG;1dGM!nAeVtOpRXdXWKK0&gr&Umee6B{JJS!XxP-T@v~#G30-rWyKN`xNZFvc5&d zpLW*%OkmJ7j-Pz;ceMvC<;%(FN9dO)5VWL4oy|7?*07PDV$*XcCMT3eh)4o&@ zs#D&BX6{9nWo?`siTahJM#8DNSw3;j1y?DEaol%8i^-O-Fb-}gj{P10- z3SHkwmmKs0guZVM+12-*2MwNPk!xe6Go7hTOlbW~Y=!>`69i$O9VrnU-<=o|wOD<_y-DvaH zQ1L@9vtKDLS)~q<^R2$+4Qo9#fZB8WyrY&$r)1>`@MlPSBQ5m!2W8Ua=~MYotJW{v z{u~mt!p@{*>H9&Y+Xr@}R}dym`U^PG&^0~UP2EdOee>oIrFhgy+ms(#bguSe*m+Z^ z=-dl~N(Cg7I;+VSxTXjKm2Aq<9a4;K= zOZviEB|}c4v5$lhQlYRuU4y#;Ds^EHQ2Flq?>zr^BWeHU+qvD z7c+k9chFdTA54rgt17Ab{nK$+8%||v5{LXYjh|8<9e@oT{^6tRWJwtY0e9rRX>ys%VODM33la@b#{5})r5c4=QjqWTFW7c zU5^IlW0IO`@|dtd0=4I@udtCTZ(!pjwhHW_Uv0Y&*S?bv54)Ih-B9uO^j5sKf;+MpZ%gse8(cf=6k;Qt^=AN2L!tr4abIn37cijnDzEA&kw1@ZD_9*!=;rL8 z4r_Q%x%Fo(WKD{f1;pOuALydM2aQ~j7pFnKJ}J_tarpKa(ec#8R z#PwUBlL%3VN#MD*V)xl2>Rtur9L|4`AWbr^s?A?Z3;C?$k+?t9dl|t&jgG)GxEf?e z2S?vs5*^M|*Wb`+bKCL~r&aOz^-bK2y%BRRFRlynIK3QQOH9s@d!Q%|Ef+-xgeHfI z?!-QHsUS4ag&%#!hoOGenJ1oKBtqFnOqZD2{l$UUo#t85vqgjZYKC#5ct4zU?1?dR zy&O`ojZ}kR2J~Z(2a&VOSBf(tgFKnnFfywdbLRbXqPrN}`!h2S$QI9#*TkZ|2N4tv zhh5)vKi-_)kbDjox%DhQAK$oTo`OTlylnP8k498msm2;o53ED_JYX3sJo%#5)8=nw zQJ3ecK6ei0_8)oYO&>Vi9)HAtI#Nf5XO!4onhgECh-y=FI?-xnIKv;g?f`ayp6_Qz zWG2?@*E-$L*(W9;S$YDak1aY&bSXbS`cwHo58dA1L)VmAKm6_AJ<+->11Z|!TM*6H zyDP=EnBnMSNj@{zJzZ`KX?r3TYStYzE4E|b7of^5L=rtL= zOPooRByoo?xj4U;I@Q5s3?D{2=-{Y0>!Rb8cbhNq@`Ix*fa>I%)m%%r;fGX3y!ZtdFu5YUhyM+1}lazxZSgRrw+N5(n0Mg%9)hBVjd7j*g;t zkm8DLGj|j1X4*ZHQ{OCmPixpCHIEEc(?`kqb=ZTYHyZM$Pq$9Gy_(Lxt#lWZE*(0bvPrtVBGT z?rmEl{52aOy->Y77t1VbDx{rtKP-LFZCK4abd=V#+t1CopYK$Ewxj<|=eiRw>hEcrnRbe1s5# zIUkV!bV7V$^wBV1y0o-VO7AXor8LRj!lDfZB(pOxML-2)?o$dTt70vh?qA9a4s336 zc3GAlMs_+^k;jcKs`?xUKJ-V7fK!K|Q@Y0-BXJv451725nM#oeMT5gn7OTR=AFpic z<~}0NYl_iV8}nyW8zZy6$DBbH13_XNOt%0EE=su+Aq+q5?I`dtxE?ou2w~x#IU>3_ zT634(Ck3SuUv!&SUNqh#dwS@3^x+uNKhG@g89WH-IoN)!>TSk?YTAyT9ioI@5==3b z)9~B!kJMv4fJXWC@D`-}WV)}Qu(X`Qx54#sI0kvTHj>)3SFb!g&r!CPTv2H>pk^NUTSg!?aZaZ3OzTv6&{Yjy5CsjaEO+fHv!6t$-_>@Ayu zYBdT`MeSE*UK9ug6wG}1pKT=3-${?hK%V?XgPZ+llaYaCPjrQm%SA?6S- zc-ER+IG)^}Bsw^-ghn*I+sxozKvA+%{O?%-97!sEZF82H;_5QvPfA8a7wY6PKlI;s z<@4!cRi;s!ZgQIw^QsZb6w-;6%0bsT=dKW7$$ta)5mp1>gd1owkQ4)Iodnd^(_j*chJ z?W(x^YYZq6VBFo7BbePw_%6YUloTu85f~*^H2YlI*Cfl&?p7Zk!_emxD|)q+oZzNs zS6-5tU1e!4x@U?5Rc-6#0lC!IeWY-jUSwbJQU=E9~-0V4a+Y$FycE132>EMWv9v;l( zKv{$LP(Y6h-q~;braZ}w+W@a!fj23pp)PtZxSGfWw9PeAY6k~@YHSo% zR&*lT3w?r7T;HT9iMkewrs-759Eh^G5Ecr?hmoT_#%_g0gahzlu8&jd4|-_2Tia-v zhdIXQqkq_?jik)c7Tz!^ZN({Cu)kj;Ishl;qu^iLok)F)0MVdFaTfTtS>pa0LEaJo zO3M31Pd@mvBe7XQ+J%-2H%r%Gk^N}a;HG0|af&%J@oFbmen5;PS6jcTc1rXN_m(ww zbQ)pY2!fsIm@%ub^*dohBN9)KlfFS$jLAZOLm}&jZbEQg-!j|1AU@RXhKgS;@U4@yUdHoi99rqNo!z*#P>eLH%o$AI&tzWK zg)!2}aj)%``<^>hIc=w#QFU<0;+YX@Mwgb`@p5?l+Ge2D0mr>zIJ3%4X)zke%uQG2 zh$5{NTVhoe*cPx(fHu>Eu2D@fPxuo95{Yk`k1c7{2+FUA1%~$YW}nV*L8!!+)ewAV zEsJ*#tUtW0tzGbFY9Ndyy6!MXeiJ(~81gu)Pqbe<0#?-R@rqxLosoJEheKE!FE4#z z;PLGn<-VJleO;TIRRXRE0*pS!pj`Urx(hd7E7PF~zEGV_iYr{+J6+d8oID|MMXV>={5*WI<>$S!eW95Sir2oV&;Vk8&9UQEN z*LoPN8afrVZMrIkG_N<`5Eli#T`I0(z!$VTJP_obh8t$%)=}4a_=rtZzWf0 z0F5a>QqPDN!3SKADf9!pV1g!6NA zLz{JULy{0VmS*yqHT{tn?0*{<-3Eh^56iZw-XS=5kxv zS|;GTR!c2qutoay9&Hs;|L&V_wG$7r*A*yxJfjH_{+ju!4#XPhwl_yjh@tYg`~BV2 zQ3tJw%HN%|(Rn%(xgRl?l18prS3JT+ni)Wo^CX~oD3u@5uaIuP=CaZfE2$us- zIoC1uLHd&sp}{$%4Tm3laaa^<@#18A-Z6OpW!)SYdl2)?dzuwJ;qjy}^DK@Q@8;!5 z9@?%b4PfybG@Qty-F^S!9jK3w&P8IO1*F)nUj{CX_3DnaJQ!Vd8hg+a8cCZzG#Hx@=Sv@SSxQ z&#_8+W$#{bsWaVfo!y4I96>96yCV01D$nz1a6=Sil>|KfwgLvXhwrkyFV0c~TJDlv zrQ}5ibgTL4OZr>g$Y^%9>jC(X4`0@(5TD{PH~ur9IELn{m)HqfXun6E50{qafnvr%3g6(w_; z)BaRN9Ghv0{#UuKxu8OEH~OBQhXTj|3pdgOYW(98G;!=v5vk36O9!?>%STJ}GFs#? zhl#M8cVV2WK|V{?cH;S>hA7N-8`-7PC1&Qfw5!ag)Odu`{5iwD1taEz?h92$ zhlAm#pRCx(+7UbTKT^7%Fv_QX9QlyzSlaEuK=n~%d{cc>OOG!?-hnQ^IL@1tF)F`{ z=E@Ow+b!5BT^(z&hZy{InX6JioKs;mMNG$dy)$b=RmEv6RxNE zA&OT+iXUAy@Eyfp!>|nQ(ZIX?m;ROGr<%R#&jLa3&KcptcJ>jK z0i5^;45K;IQCBpvwWSRW+WbEn4hD!dY*B|kYtJt9;SYrbrj&JnWj2agv%b{^*>es) zw(A_Be$m*_=x=^#L4J8RDF(wFl*bKT=p=L9bI(;mZvkUF-0bQgu+)7)=go>O&}QPX zHa%rJqbo6Yrlz#3R-nGLMD7ng?dK#b2od0_M`_#cAb#oNGJs`9Q+ge)^)$(39G22det6vA+CIYRe zPn{-+r-Db`8_Cg%QnC7hBHp&Wkdg`v89Q440D#awzuUupjaz$Ptbn-iP9Za?S}?|W z7vHP&b0~P?DHn>=u`G}@n$;@t)nG4qCHdWG`F^=*TOep=BA)gI^p z>j>wWR~xS5;Lj$|W#8KR=2E94{cZO~A7$%uO_oK>atnv|p2mT#XW74-TcDB_v;nTo z{puFpKS}>?ib=8k{Se>p+xk8Be2I80p#PrAfBEBM%3XZP_Vv=~T|+dBTBRd5E^HXL zCvPA{*l9w!snUb6_AO_Y%J{I^ORMm^#a7(Y=ucd9ddiyecvv7@uc}QRUP0q~cz^K^ zCjQ@o_iWxwaemLF?ab&qGV4|LGN+Sv85mrWx?bOmU75xYs(-M|6IN!PJQ2FpZNJc)Q16X;R67lBZDbf{sh)H(F`+q-JZk+a=`z(mIc{w99LiFGnwY? zDxhvNPQym?eX8BHZo8&;u0$jr8%a!x9>aT~-)~blPcNHibWK2jF-%BZ^E%t*>1Dz; zsPJj7mT0SUTvO0k9AyaNo*vERw7&xu&O}H{2Bib*XMUqgJDzdf_B61zIQ6Q8!Fq{} zZi0e)(dnt>q923Aqm4j>do1^I?;xfWalToIM=B2o%A5E0ahCvWIv@DQDh_b*pm(KH zJ`Ag}lkdBnIS=&sn7#|fCp_!)CEWYi*hanhvdo|C?es9OPYxvKp%_B#bXa6x6i!5A zZ#TX{Xyl3mtyI4EHM(|_MnIo+*lF7p8)+mSY%78TqnQkq@5|1`huH?T;%f<%mp4DF z9dvn4ffjOPzWwF>%n}C~H}b*!4fa(Uq2k|$H%9(7UZiVJb-_lO8_DZOGrww-a4xSN zV$Z(Ec=T~V?t^H!#c!6}80#;sGEn`>vPMtDt%O2uAAe0!{S&Yesxp1+%i+_oZHvT` z{52$?56X~(podc2AjUIEXWDeGUG0qv#OsR&$J~X>Fgp*u;j%@JT|stK1ksPry~8Q0 zy65e{pvwmIdeKZ|eB?3PN10(*!m<;8ax7)09%k?zp4w`JzH68+WCqN}eH6igY67(A zr0w#{oJCrCo!PlD}FaH ztIvFYgK|4>T6i`BSC2g-DumO}bZ&ekd^FGJGeom!^dXSEN8r`hi_&u6LX@XRI(-y= z9Eo>Vj_EzZn}vgX#Y3}+f6XBM<9)VmDg0$rx8v1X|ErsQ`jrgR);@a?HAng7du9D# zHCb#1@9)#Tuepy@NS)Ky%+_fE``0h1R1BkSb-J@FfcGHUcqJ_BWRsCtDkadu>esI- zdH)Yanq`0d{36HB1Kz&OaV)DlT zUTQx~-Uvn!U1$QNwW?d3b_0yytJLx9A!^Ty?pDpG1emLK(Ffk)0=emO-WE1C{-oA- z@2#@$*woG9!>V5yQCtEGt@!6K32;x+B4XkP3OGpj>TaM89-sa`eZwAH_LhJke?|`r z%RuUG4!i<{1B15-aB@;f%BV5pI;HE8q9vVs3w&Qp0B1=82bvFCdB!dPq1GOe^)HNr z0@M9Z*ElGRA$!_?lq#DnCuB7uZX7qTh#)(3g7$Z=$xg^>sQ@yhvEyVfzz=cS@GM+( zs&rfC4@gvsn10T0^P7jFC9kj~Ef&y$G{0Ory9J%s4|PJ=x| z8z{v)Y%&g?anhizt9RYZtKGOQ20M@$f&u-Gmh)ipMtF?YCqg~j>35oM zQ-2gbck0!<9Ae3y4%<}8uL$A!{dxkK+kRZO-;+OgA4h}qt&yovrndoOM{$AV#W-OV zO`$_*C|MK<7zxyg4`xAo10RUVE#L$nOlcrxrWJ+nO(##-<@$e>6u#;bBfMCa5q$L` zK_+GK^kr-<8eWwlrO3n|d0l!VcL zZ0dLbR~_qzvKiqn(^K|$F)WdP8PA)CxUed)YaDrFuOm%sS}|@%8^!co-ks>PVC5PB zCJb`)A;SWRe!+(kU_)i^t+-z_7~Rb#@Z3thJUtD|B=1tI2uoE~;_>`3<6@;O#-C(U z$QerNy?@6i$qeBw(-sQ%DC0~AM%Y#_G~SpGHoCOr7gAeZR2V56fpW09!$C4|U6Py= zH9*x;x1SmtW4{J;ZM6@l61f6UD0{ZQ*CGuzRQfb43DKSRD5JecSSJ6Y>=I*eU~%P` zjseL5Bg{yT7dulAf(vUPZ{&ZnWJ8KpmXu(i)P2$a_K=NT-KoS;>=1F~H9aqW-ZK6P zMr3(yY(oH!c#r6s0M1>@-*cydm5HZ90w_&Ma)3f?{P)6q)H$$mH@v^7DEVRClUGQm zp=*#kR`!b(4-zs5Z7Q2x6Od1)Co8$}z1OAM*bPvztU7@mxfl?7gm;7$5(nf4M%; z0ZoLM9&w3ofBG+$2Wa_T{Kb59@U>oh|68+(1By=)t;N6B9T79|Kn$^lZ#OccX6p;_ zQs3rG_oXH9YLlO>g>yu;bB&`O5RWA3dEFyD4^lC4B8k?($d2hM+w`QloIc0@!s1a? zXjQo%`d~-87%7(VL6S~mW^Yy;N0N?zfP1IUXYNIHu^XQ;b`ANOA<5(H!WZf)?;zYn z;6Pppa=wALTAIA@z^ees&z~te+Q-JUtGs8i@as59CQT;}jq!2(U23$eKAEOk+DQdL z`8RY3tyJQH2&1~RzJW%kO9MLrYJAM5ol0AsY>@E|(4|GT2{5HjkvTlNCj&vpgHctl zcx~3@)!kS-&yOk>T*1d~B6a(mkETh@y(qvhY!{k;+xB&mJ~?oUI#?C8$n4ki>yXcRHBb+qV&7Mi=uW9yzQu zy2$4Z{)82Ty2oG(5n@>I`xxlhgYPOPyl5Ajd`@=0dH3>l|AG{r=}~5dfb|@{zeMr; z&+e4oo}R(6967Xb^snES@d2H{dKKw!)}MXS;+&%)%K%4*M=RMysRg_c>LlCnVzbD< zt-IVsKWRy5zB?YV7ziD1!8~5){D2E{@^dlPVg z;u9I;9+t10zeiUvf+&-9nQSI0Tu8_Gq?CFOBQmc>uMR22AIvI4nmS(?&Y&8g{OYK;dGS2Xlr0GybE3^zXn4qwdoawg1F@P)g58@i8SogR>vAC5N{r zgu=-L-sdy%nR)OlP_K18)ZoAKfmI6Z-CVjT-x6Pe`|d&5cDvKk+H(c3yn3rWAYUfl zI#0;mg4Vc+%sL4Cfj-D?@~Jzb&xK8sk8w>iLb^LpQ{g*G0SEf+@X=Y9?TZPwkcdsGN&lb6UcHENdFl562~4E#r9Jyx5#eG2`1LipDWMDNKZ<5 z0x2}-+K3C<(|EJ__Q=+l>ieu7|eXcfr=;-N@H;y1){e# zHouEZ_E>rL(z#9Z7MBE!mQa(ePnHGB6Q@?an3(qa_-86B%Y^H@MG#&1z+~w*g(Thm znLbaYhKL)Vr8xjmhg2y^@ycU?G=34vm-Eb<2Dy?h0)b?O~{(#E1hZ%k$!|WJPXmp+&J9l#AhCHD99(D8?)X>n!bL`)1l4DYDcQHtnz0cLbK!oel z($WI<>poVmmkk>Yb*LVZ_c=}{JHvePHeF3)t)gLdmXjkhWu^i`D5ssC21Xst+BPZI z{}8+kMWw90!-bL2Vm(4i8v*SXOyxrkppL*u(F<08g-wc${*i+s6m_uO)YS_P&7}2{ zZa{+^Z(@%tQ_8vw9`OOwp5_9UIiQZ?p?GLw9S*3K)Naalbq=(f9+7#SNo_j6MUJ-B zYUv(6lXkF8s5A#y^|_-x%Z$^(4f#f+0K+d0EpYcKJpD^_vy>54t9?5MM)Z7ZgnNTQ z9W?OcA^N~*bNtMQ1*URwDuA@Ey;@V{-q7_0-dj1!;hXLTHH>=bMq-*FAboo1@Llo2 zeuP;r`Fi3z^!~jP-?QP}&wGizFaC~6kdl3ui?(Y$d3F@f0h5j1IAv>G`0IHXdPx<9 z{j!=$rbJ@mjWX+6w|<$;c>jQu{JQ&Z#tndw+qPc+?Tt2E)XM*>H-Z4YkwnMrg^TVg z9~c!;jgrO@_y5DZkl;v9h-m~cF_S{T_I+3!@W$#Vtsp03p+)K4W7_e$BFict6A^F% zV>We{7X?4)rLJ^S?qe69MlEKcWvj=hMU2rY!Ph44GM@TUOHbeVjdd)7JzzI&Xvp1aCnGwRdEomD9{9Uh}7djt+XgS-S zd^&TbYL@j40AhB}==)&*%3(oP+UL;)X)2fZc5PE_cwfX+V(dL?(`aLU*@s3z4W+Sp zkJTX^9%+-7%xdc8HDxl?JSqR?KI5#PH%zHT;p^N``o>Ojz`WoM_juv zbEX}Jbb-N}((a!1&!$&GtTJL-7Rg(^HTjL*eEt zT8okp3A?B6_A23IY2MLmFml@OoJA;LL&)F<-A7t1o3nscy8@rtPyhnw@UiEGrd*GP z1dN;>t8t(A#ykCRk&M^c5}`bW)4R85?CotPZ6@0>&V2UN46u8>0@+sl^QMCR&o@F0 zVZc8WsS5m`crE}}793TP9uT|DIE#%YhhN{gwI-Oy8$&X0N;Xow7{u5I7=o@q?jy6S zNv-T2DTZU%JOC#-r@^2sHS& zy`g2kE%NId&VOqr(kiiZ^%6)ahE^FxU1gJGCQ}C^43N|HTh>Pft+#lhsqFEEKUO*u zTPKdsK=DVu*L9T1%I4{i-n)0N*Tc_{kTjj=Cas^)xDU?ONPNzNPv2ji+}zyynEGI@ zfvw-NsvPc{kRfr=o7d_;n z{=|v%IT1g*230REjQnm0y>udxPFawct_=Evy+nxtfPE6bEi`b3-)em9 zZHNYcBH5?{ODx#czQJi5T6ln&_m>Z-flt1w{95vw>Z5~!3Cy=u8e8ma&Z!h+Ve)Yl z&@o=)AlvA@w{~}3*4IuFbZj511!DH39(ab8?@?JrCeFpzzVt!3>%goJ8|)Yx)L+UhG0aef;BnAPg)ALZviKB^!B*^Ru4A{U>{(J%q(^DrKy6hdk*IjFYc&BT>H&V39w5{~f zAP%BgtT?4d*|RvCWc%nfApZA1gWFG8hZK^XMXQ@jseQ#iMK1qxp8o#Df8sNM zji?L^WUKu9IQhp&D78^ejtuw%zzCOm*V|}6lFFXJjCqKBjw0D3T&20ZTJai}Dzk}o zm0WNRIU?XWb4&Ks5CLXWQH5Pv{9|V7JQv~X5{8f5X0x?{q-<(;f`8TmK`hz!);+uo zrh6ABie%{~Px#;pJ)flUR@2@bR+?19lVZ{hqsTB8kFeQ>YfNS(I4NgKS&FgMCK6t? z)w$Xbd4ki625I=VhF@VVO6FS3^4$ReS%5S7;aH*(;O_+1r)sEf zlO}2DhwUL*22^TK1C?cEuMItgw6JY5q_d5jNhu4XW0hDQl8?L@(F$LvFVyzel5HLU zrx0I%)k8LRAU_T%D{g^!M{A>Yj5SsoxgNGWKx$m|+_;>$3}x zzmX>qbE>WTB}v$xfcC*39&S*}H}SpUFI?#0;A|OLS;mPE_>Wjgzao^L_V&4@g&xI~ z)9h>hnf%e`Pfo`@|3qVby!^fms_{*U{6VIPr0wSglJcFEprqsOgEcOqa*Fc1+hJ2O zc9o^4ZsCOxi3To=0A8&C ze8(OP|Ku0~yhwCSUd@p1;YA%|W63q`x39pijf(-n>^3*D>aA^BHbV>P+0ozTeoOLNJi{`YO@5B@8dK!pV!O*V zy??u(xGp#4!+iKcP6GB!WS{7#V zm0H^Vlt{)M;jts0d?~((U1*lOIc~7n9VR3?${A2Xys{I||+C zaW1DOu1rooUFWm&lzV^sF84>-NGB@$Ng4@!7O>EmHs-)w(hff0`i#pQ)@F1ntF0#^{)b6 zbI#7cQhycCGQP=ylRzbogS~ZVyDxO)E4pzFftM_w;mS(vZTjAsnZv zY1^=sVzORap2LPjsEtD>P^+XezxD?$kl9f6IhwN8qRh}C=Qm@Gi6l`TFO&AE`Ke9U z<>NoST;l@JHtM5$o}oXAbBVXQ46fSeha=!CY51k1(wmwEIAAVcpVnf#u?7EHzAd|< znoARyj;QOAJm|)eVw}qjEJuc=Q>NUQfM(mvvCt42u1Yo0nl_yABt#tQtnW2No?ac7 zQi!-tWxa2`IxWb2jv8RjEwgZ z{%p$tjDl=}rR|#ylL5+ob_|^YkNubr6|lbcdXlNkl#c&Nnf7c1JpT51Y=)5S$B)yn z)$9Gw9I0sCh=0qy0H<%r_%~MWRlUNWod5i+Em=tdf?oRLrPCVg#mGJ##<%Rer=AAb zCp4>!WqA0jOA1uL%UM!$QU;NoZ=0*7fbT9U z2_h$3IoAKPP|1o0^qTqo0KRpc+3)XWxn_C+%KT>UU%dK1SpccBb@#?bzE`P8hE-g(O&{ywyLx>_S{~9q_vi zpC4YXHOJ(@{a#M3Ta$Z5-SPp+EL4>&CO{{@xL$5cWv;DDezpVvMTVk|PVht0({7NshmwZi!X1^s*jkAKwY zO|}594cCr+;p2?p#g+9HkcTfzSx!_nJ}mM%hCAQbwyrRV+9laa9ESE2x=&`wv)Ajg zEg;{o6IPIx%r#qQ%V%(P#VlpSx`Fb(%uYlqba^xKnS?tndy>veAQ- zd*a+7%L4g0!JF(lQ3YNrW{XHh=@bc|g4r^Q)$f;GCt{8{s7-L?p04JBf0;5C7JgEZ z+`CSl%USb~*$dC;1+3yR%ZwD@%?GsqScx|~+v|ku$F>UzI9U3LRmp!#;bYUPZD-f0 zr5BiNsGlb(t{drty?$5@i-!25VH=;VtY)1+uMWbs2G+Gs4vkJr3 z_kkPcB~MRy9h3_px+XtW0e77J0+`)syL$M)MVWZnq>&7p-Q9Id_{UlpFgKR+Bp4QH z(Ssm9b$BHr8+uoehOUoLS~)$Ls>5gM@lgF)w0QcM1qU6 z+I`6K`2fJg@kFbfTcACkEmHVwXQSnf3M)(V&dYKaWsmZ|QxnCpgwyc?E$exE6{}i= zLY_)94z5(VXfr&q(#O^@f{Oa0 znMqUvol;VcQ5GTc7<96#b-TKM@PoSjQ#;y zT=%Ehk>AtTUaPkBUF}}qszmQMuDBiny3?!Zc@Ei6&6oyK0)F0LOM6Si8J*CZ)n1`* z-|`0ml9Y3?WqsSs+W9AOqSnReU9wf4%p<#e3S%f`Z2B41?YxxF$H7a)+5e*Jt)rrD zyEafM89-ntX&8nEDd}!0>6Qisq&s9N0U5fa8TGD zANN|!TFf1L?`vPX#zuWyN*jQz*3<6@r%T0KXdPQ z%dG4~R8yZy>3_%jzpT*P`%Z%S=Nqb9|K;6&^b0||+D!bK%({G9`w`_?kl=iHQOOVl zDitP-EWb00ZX=?ZL_UXYh7=Z?LbAOEVT|2&t>$NW-$=l$ zSFtZG4lxhoYsZURWA4-J%D_2Z9HTaaYlt5fy^&;PPPM3|Wa_bK^2F#TbH}fI93TsG z{Wk6D#*=)I;g;N1H4uvWIr$WhcH!;=6?k0ro?~O*KOnp{`0VYG8Bds-O*ls*B?^3Z zl7%}0lkABXk<#d@v=(9$cTIkxA6x%a{h>2IJ&HE8mYQB1yX_09##v2?cu?tV7+a#q zBIAM6%}~Q6(9(I~`^bK}y}f)m==Pay$$n51*LQ<^dJ&Dj!TRe9pg$wzI}>nzoBsdH zqPUd6%FF_*?n~!3o4pqGa*9+-UT6MdVE7bmuhlItgGJ8OcC(ZTd4FQpRbV3*R7-JO z(8haNf4LO;Eo|)KYC9>2D3no$vG<0t+c*4nYPM18C2W_}=sCV;LshMNfam0wKZ;6G z%1TMhi(ZA+175az-|g;BKPSox|AvizwjbJ6FUk4zMFG0f;6r)c-URMvVS4Ip+hb^S zx#|9RFPyOlOMNoq7w;u|l+XOyF>QhXb0m^)C~bd9+aFL)uYv7>*B{j6(~-8sm%f9; zdeJ*qsW{r3&ku_Y|7azLJ#Gb=EG)KoL2ErE5XgDmC@$bK)ZTjnLR*s6sBKqd(p04C zyU!&Suv>qzaQao(>i)Ri0J1}cV6}*?`*R0eOIHJ$KAd}+(9UJ2Q)4OH*WIF_n>u}{ zvUh@kIZbF%7flDszU)(ft}mhOVMHJ$z7Ln}k`!*){9DbZJ@yU0$3wlpB3dZ~c`SV% zk1ZS+2-39J#gdoRSzOCEEiRtNwkC~TUX_FIeuYn&EwzfArW)PN?=5^O&Pu15d-eaR zHUgeDpTT{&*`)z@=fB!N`r*pn2Mg-OI}Ao8%Izww-M4<0TQvHyg+o;3%k@-f)R)vYN~lyc>cO%KO8v^fJEqc}S|$Nlt( zQhr@|%wziDgLws7@NTHUNQal$#i%(k3bh$iG1w8Ys0qDVuM%==94LC5(POUVI#D9E zva3G}|ER5UMkSCrjjrLhmkvQ}#hs*Z7aesN3thFAARE>AgNwHglA~KgOinD`y>9Y_5?Wr^&lu7uqpI<$ves%C7gWq} zSLDwg@zw-;H8|!QU6gW4Z*Q*{*xW$`C&c{4Sf+wkXmE=L2f6ec)>uk!5>j$GXO_x{ z_iTA+Zg0p|g?~NUwUYO>Mda0%uj#T_21;#04ev7*4O7%Nfx=@Z^+qwaW}S3WU?2pyv2 zO+xp;0#X`HfUN5tA)6^BRm<)UX|$my;{oC9Xi|(>-w+khcmTQit(0e4@4IpIp1c~< zd@Q%dj&cPx5zdXnF=`npeObex$)7fQzB>+VT(fORxlx;KzK_8iCk$nMSJO$!fufF; zIi%&~|H6}`-y@7m=G?pgLKta3k+~2l4<6a?@;ZrjQ`_~BI10EkVsUfvBN$=x#J#A% z`AFdpR6g-}Ve+VPnr}rS1Z3fZY=VD$0m_(sR5TJhHmxVC+1|F(>9l}$!0bpthyv)3 zaC+=b2cD3Va(DI7RZDE6}kJ>mFM7U6v|%%+9oWg_0=&yGNz0m@yWR}S*YK#%ydV!CB&N}NZ|-y z55{U2L}B)>fR54AlNq_?1Uc2?Hp^mAHT8C6$`YV;q_y z@Ju8N{*flMvHw}1hdTJ%8^>_W3Ei{LkHDhg@xeMCd@p{qgc66Ra_mlCLW<$?ed@_D=Q|N9cfL1S!uK&MZRRhwke%8I3hZU}9P(2$^Qkg~q?K8Idv?fiPg|zC zAYCM@7XP28{`5&)qi%*lTj`|hngpWHtW{cPo(Gv;e~7hG`XM7IqWDn@@I@E-tsRxe zc|6Bi_2!jMJd>XcG_$@fiT&+dqbdqCBCp@RS2d@=t^UW$;cW|?NO|ZG{zJc4903^) z_A5q`2L2Dfa6cXd2Z%H$P!+~dIaA7*D8G5r`%DsjA%e6CXUqgYril%RH{s(sw&ZImV;x$Aa@4vazD0t zN{~l%jwq>XlK5349xm~PGd0wvg(>iR#V#&+NwT7Dqef(vNhDQU=206z9 z5TwkY9~Mm9bTEaAzA>KVyYKRwMFx=F|7pbK#J5BA-w*kJr;QnN-~k@HX=`I6&%-bH z_lRWy8G}sn^%$?VYpOr90Xa<4_(uI<1Y?R+8;U33N$4)n5NApe!AKbxW1~cHbo?A{ z9BD-fU#Xh0;`GOFoU5Y{<7#5!jQbotIwB`WHf7dhU$XA{#I4$v@a^b?m>4}1bl?$H zW$^%@Y7(Fkwh@J8;%CjzayB|V9-ltJ{^NTw(j^|bI(t*&sohjuqAA5-(oR$nj>$v( zWcuj#$l_1-=;1Xn{jJRtC_NJ0r?j=Q+~MPm(``|J4Igh3pbjh z3_~lE&HS$B8py#0v69gkMZXG(*k6iC3zA@SB6A?EP@HrI`CQW$QVGH@-+i846300# zC5^3N8Q%5??!_Ra6@KSghkvBYPF&uue_gbJKdPnsaKOcWLIxz$zfGc&TfAB{g3}hXDW%mY^7jeJI3KU%1ULlI~i%D}a zh2!a_fi8yBqLPV>*z=VPxbfnilb|g&N_FGIuijJJ#E7(xxwS68AY^sPR?E<6-rae{ zwfnefcqBb__ygwe=Y8SmzjE1)pH1#=bK|KiJl~?l0n5K>MIqA-qjqIMMI+iIf?vMY z;p~fPI$_4WV9C15xP8U-+grhW^gz+vvR)=~*#NwY!WY75I$J**--w9}lU&4Ud|UTT z5Z1q(MZKsmm;c>;I7H2EbWGAL0Zj0-Z_QXvc?e=^t3Y>P7B}K^#>iEN_O+!g!wqD2IF@doI zY?>$EmOh!a&SLt2hfxx{b@6cwwsJI(^trrSdP|nrjcX%p*u8(Jo6<`((h?J{jVQrU zdJGZ8*y}9c4bR&IH@Ljj*vxqTg&_$Qhw`Lj)gk0lI@4EPe0(ch@F5FahYkG1ZcZTg zz4#ebCauPPoM+COb1C1q$4|_^WySzBcObvxNy<=^(E30H=HnyIuMDkqr4qnQ_O@3X zA1QRnWcELLX(&{G(FiB$V;g5ex5Hz=qpvF52t=iRRgS6oF{P&Plw{~*yal_Nlc7+Z zoE{lRsqpuxOGzg#AD89)TGK2y6Ebhsm0-s$aY@5U<>fH_rxQvfp!XP#xgpbhRRVjM zz3cQhjzQ+LZoV|9ii-_y$+pO)jwnOLf@gG=(C5c4Crav}64RtzcCOx*GD2d0gM+fWv{1lmEk)smxW=uZa{ zfABTB$uZ3-DzhaOYtu`s@Y?3(OCi(u?d{N(M-#8SXJ-J@h+78AyE~gZ7}OCPF46aG zTnv^Y;7p*HJvMD@AH*XH*#^a*yVhgk^BYQj z>5nWcle@Fn-l&ALf1VtX`uOD^KaD3pnEcqWCi6K;97YGl!gF@r(5_5Xbr@FFYFB0} zZ9t#j|B-1h-B)ZodCzny@MXe9qb8YEXxhnQrx~9-E_8TVcfh&ov;*CCFKD403$D8H zN*}zE_A%jy43~b@xg=#qTM!CJ-Xy?+JV%Y=qd4f5NzO=Vhm6H)p#U)cr?lRNWYXrvSPkwBF zelCO1xZ?ijTCC}edZ7=V|6gsRgNe+rtcTh3l{@+o+TTx!IU+y76@;s!F3YogBf0|7 zC`J7Z0%a{ERys&6rQ3a?AbN^cA{(o)lb2d%4q)}|4W)pPpZSZT6LC#?LSzX81B1N$ zd>J3t6j$gXDaj5;K!7)N9#1Yq<5CYF_}Lnv%VUF#1d zBUO`zj4RV~bM&3uo(FXKWIPC8UKOqj5DfM|!_{Fa{K^Vmplb8?_aT@Z9vUj}uzPiZ zp4en{p2)r88xRn%`b7!F69ZZs@H;K^z|=oeQ5~hqiIZXU1!1?BLAtpQ)}dsf8oyxv zF=RV{0Zi!B<@|k$`7q=T!Bg3-SOvV=7Sb;#Z2KxGz>55jgR`PJ#oT)B>sA3mogWPh z!0nZfI7?FE7AUn}hoh$gpfO(-`+?N_y+{8EML)#WiIz5f@_+6wTI?5|F^b57B=fJr zitHV=1?>1n0qJ_4DsLU8BU{3;k$RxLrIQ|dkK5atL>M)>(uTEz6e^82MD0BUG;zGS z6%N`>kjkaW5sEh}~zS=HU>qf#2?cW_8 z^{0VHhx?}|inTw#U$-QCL^ZSN^xjyWy6aQqh-3zC)&p^;UG|M#|9fKn>O*Q#& zC%$;IQAp;FU=$v+o^GGo=zgLYLEr*3o_$1bQJ|NBpbvI90YuP}8)54UyNz1=l+|Xq z^1mobns0W1NLtsCo3%dFqSg^&{phgsihEfkl@d))hc1&cf{!{B14XpL@nMvJtMP%r1)tW5)z#5tmt@mgg%+9cbp5_Gm6H*YxG5W5U4e>}Jp9J0ZcaILD)fp?>g1yJSIy)St6_V@?(S13f-bNZx zZJnp#kJpYSKIuw&g|G1Gmb^98$V^uY#i3f`Mp;x~AZ5hMrfh@Ex)gWWF10S$EYwcS zH#?4}3AoDJ?7xD1e`30vpQ-KAZDW~Z(=DC{zeRjifJNN>gUQVlDO<1NsRd%l+M>xp zj4ieK;3SIxFY<@!R0N!%^UHHNuf;S`-;tN{J%aGf3fA>U;;UN62#Fyfa;43|RU*ERmcp>F!0`9MPCy%(;VVT>he-`m1O6L_)bFg+@E=l9$PmBFc2;N=t6_5i zB3lXBZlJL%(Dw5NW3bWXXH^4~U=AYCCE|}=)Z`!3vDZ#HUwefv|dZ+Q|?Yp>%!lyaUQ;sfK%appUp{ zFEHvs6B(xV=HTq-_)fqC6t(mj@lDrc%ifo;YmEXpzvlY(tNwZMWVuQl|8&su`x=zv zu`NSKEod!%$Fx5ZDtD$rB5TU-RC%#%S$>lYO7NW2e6R@U1On=QEH2~@q}mo#9DLsx z+>G6GtOH#_>gO7q6UmC3lzP1SA}Qhq;?#uI%7#;UnUPAix#Y>iWhL_2~YX(^7hwsl35&8D1S}!z0gYAw2HtzPWL3QQybP}UdFfp9#8-( zHayz4BTbNgVlLN-1ljT`2m@M%Qz%=f8fg>+-(By=W4hS=C~wPDA{j4)^Y;84RkL%M zQ?xFtlMgiB-rL(rbb-d<_0H?eW76(8J?2ZO#X8?qbYn^fmd{bJ*l0u>WVP9|kO#FR znc$E`_RiZWkl86YJzd>|Y8IR>UeC)ZTxz{{aDaRKsvLd#sM3$x#KMBZy~6P20mc=? zZ8wg|@~ee>(cEyzHnw#DDze9MP=41})hh3IKUi)o-q`XL@c^wmMI+mSbnI25^m}o> z3D2U&q+0L3SgLRgfFHP}gd95-R=XRTnPIJSb8)?PJDf3VKb^C0n-G=|MNVpR+y6*y z-&d0YnO=iihTGy(En)`#u-YI+^sAlmT>1yL{4XYJ-=PshSlXG_E(?9|UX0Jd_oiM!`$FBx zdE#>;rIbK=`soNxBR4WkcI>)UpuT^Umi@f9W*iOLN#(`gQd@k*?eg_RF9NYuG8n7S z@1QdXXrPn&WEv!@;9$Jq2XAz<NJu+NJvR94ZFb5_Q&7WrYRc z3oyP!c&*Rx3Vt>TsViIj4!uP9y7`v5^chb!qO?Y002u4N(A9F%)EA4<6i1w%8P7U< zO4V!l&FUQL>Nz7^k@;kmp(G{o8ytZq3&UA zuJjHoY*FnurT}2yA2FCEA+|nY*n|2f;5dk2chRB1SOSLI9}4{6wXHmW^LQ5c@)REc zh6-~KAHmg8DZLa_xBT4W9vGyC<_i!?z1F+~Ex3HF&yS&_zha#u{L_6G@oL3=C1S{> znVpa~I!?)9+q&?G@zb29KO5C@YFg+?XO&G5zlM)w5Vu#!Gvrrbn~1$>yAM*2J`}lw z6IML^_^=S!;SD1h{GW1!nh8{Y+U`yQ8lVfOSgT};dE)A31FoszEaZF>o}BW5y-fY) zruxRH{3=_5a!(ZvtFKZb?Sno#3Zzu7) z-h3nJMKLE${>z(Eu$FGjTGBfjb2E2515ou)jZ|(zDIp$4sF0V5F4&fZmGvz_ z4U1Zfow;2vnW&q-v<=v2MOG6&%4*P9(l;nUhBEdv@Ez$oe6q5VqZAgbQvj>8orC+l z^?e~_uC6X#BMO>vczGDDQ5L|C1?2&)ya43$=A5)zexX34NRn0<)bl|~7H(!pl?$li z-gDB~MMjw(tgv=0L;?5)1bGh^XNIRR6qu-&d%7{0=!ymJgD}liItQa;u%)$S5g<`z z0G;&U2ky$Wfs2!7S`W1i)(5cM3gNk5t((9mO=;q@n zEFA2Erc;!%3K+p>L$#|&S>Xwii3H_A`B_AIA_O&4aG}Hr3fLoaXpa>?m zWGd!4oG+mUmO#1O^ zwVy;Wg2Wyg;4*}L#dt5eH&IQdYr{6px*L1DtIrz1bl2fOQYmAvoVYk76Hl;KXp z&2WzYt1f`WzD#>zyG2}IU8YK?hG$J{zqZ!0!b!Wqvt?4AU@Tigld*b=m>JqmHc;%I zrgVvV?jRa;Qv0r(cxEWnD9ow<#6|{TsY4QVxCH2^miDESv#C~Th7Uf#WBasnv9|O^ z>1K1+UNH)|>2H_>KOtgGj%#!jk4ujpJI*gJM~BWH!N`Pf(%}tK(fJaM5m5G~B2%7< zi7lCZRBpP1@+bq|-$=iAqINv#BgqM~=SrsK&-sqUVW2w*r2Dw~E2$}m#=8K&!;^Ss zrW`!Z2y7~<$ethvr6})sKE4lxBJL8h^fJgs1eBmXcF{=`6KK%^c_OtDRa(_3X353>coQjj zvExoSRc2U*XWDaBfw&YpgH9*$;E{ZLjabs2FJ=v6EMlGbtx=FGv#o`9q&cz3XJio^ z6`pB5+bN=_DebE1{N;36b8A4khdW|!MJ>TMkX7PFfAy^m##0^YZf)=;00@b3It`+k z-l_2`NgCr69MK_);3V26?0A7|#ecZ%O{?ORX79|wwe*@8Wxhzzn6m+0THJ!ZV&>Gw z(JL2dVZ`rFVwQ1Qj3D@ z1loY{4eK2YqXMP%^(DLflfVtI-xE_LlxQX}Ho!M1JOCyL9AOYnhMY@yxB+l{cpDGus+3x!R7pPVM9|w5VKT|)JnP_e;7?9EY)eZpO5|d$;5TMc; z>5I2su)o@uzik)Ex*>Pc#ih_09Z842`e@}ou4c<#;J{ld0-snIx5XMzZNY$Q33*+F zqu=5}#VZlkO7&_1kn$&;&k>q}?d;O8e_B;uu+ICu%Akk}E7h@(5ANCi*x8T$0^?WI zS_DF|G86lS!iM-dsyJ;CgDK4B8J`=`C;@DB(6+AyQ!j)Fvy>XCDN$8s_yrJBskd=` zBc!!l+#v2k?O#i~45RxnJON$q5|v#W#U|XiZ0QNQu3ey_Q+jaYf6a!27aGv8aIl|O za3eQOml4GN&MQuLa}WQB1rM?y_rTZCdWMjXNZER>;VIW!JiHV+_iOcDMV#U&#=!G8 zKSN27VS-YYuIk+ar%qh298p?L_aoRU(E@dT&YXIsmACa2r1(18T|1j1Lz`bE)^p3W zTUd;aB2nvn+Aar1(~Fa33x4XX6Kl_ZDxr9n|Es>Buib9CLN(BId@~o+0_m0{5CZ*# z(1k5o`xl_$K(^njU_kli?UyPgd+hGLu{GO#Bm^A>#JCm9RQAIg%-!>CJq?Ed4>oWe z)#37tUj^8VZ-7U+J)i20DOp34KFaoOf=}?+%@#np32OMU z@g}R^uDviAJl~z#C|C?LSBbotdmBw>PGTZ;>~NKC;#8 z(oT4XNM=4m$n!Z#yO0hu6V}0Ojh^)Tf)Th?@E4~&HlD%IqchD+`j_F4^RO5H7`Li= z?9Y7Bi?R@5n|RzoRc{MKjOyB2;=_-{VLBQy;vzdzfsuHNAj%EKbF7q@M)7uR$EtX7?<@N z^*RF|x}GUg0HJ`NOVF#4b+0zQ1OLS=)w&fJ-NC=~miLwJ_iAH<$n0?&d=d9%VH6mu z)GaqD#?{^qGHIaB!otG4A52V@0GL*cOlhIf+&;&^sybu9+4oPq}^LH#cjg-hv1yb~tj`#=F zps798DmxSrzV=bVBWWlvu{#Q^pgp)jCbtSAWl`{a3vdnZ&?Bc8@(4B@0$GbtRvBLD z>yT1ttmEl-s0THx24QhHk_))VMlDLCh-g$JmBRyGd5FFSuQ9d9Ndqh}iyAFhUwI&n zSL!9)yK@$zB1O<`$iL}vc_3__PKE=!*waPo$R=2z5`a0L9r|euHZk?BO6Xg%F{gB2 zMVDZ|SJ2=|OG%lmp;Btc@$#RSuCRE$sG^ZyUgZK}QAIoQ(?Hyd{lkPiiWSL(#oDx* zawvp;wdYoI8!xk6OU6MDK>*?>$wWNbVSeR$fg2Z;pOrKDOZ&EGm(a)_+58vC`wRHQ z=n!tzLntzvwy?-$&Redp8(z-2{jC0@b+WOQ`IwRZu9C)aoK?Xz;~^}d$wHQD=iP&y zhKS5J`hKmslrAS>J`W(cQj?WpSl3>*uJs#TXga&~6z&hsf_yOB<~r@<*|V1c5RGO* zksE@{wtRfe@^9R4eni-RXy+zN^)$HLZ_eJbC}8`O00aTwLHJojl=4?SMVORMFvgmJ zfw-5C64Ub!&~{ffZ`Al@)=*1KQ$AN5FL?hEMrS#Hp(*Ov3@}`+8XGF0QQP%K+H3*( zI3OBZ^8gYah5`#QAE!%)eKI`FYlC5qT+rcc|D7`lGPHz)7j{2?>w=9M)3sx z^hMBDI8;&zU_H|o@QFbKOj&Mc)Kww4|&q3r< z=cX0Tkx8kfQ^`ADqc)9|Cf2^MMx4SYzg{ITA&sX^Oa7bkuSftbXUZKdAl%u)T5f-J zo()wKC;A#$UWOsIx-E%sKBSwYWdLda_%fng0^kjdAj^8uKo;i;PUA562&HPUS@DJF zUDc+!b=yI$_k{@D#4DhwTe2h7MQOr~wj0gfiHv%%A`r`>J^B&a52F52MV zKV!-f35^!*6Dmz`{8!+MU!d{eL@du9|-*78~5D3>PaUu9!LaCqC3^U;b5PdSrwnEdU0Mr0<7{GHo zJ+arnR-zxiM&L-(T8x{o;QhLvQlcK!RD*$Q1Yd*T2l_c#GUy0OWC*%zNxy@S&y8DG zD3OJQd$)7+X(7YUAzQX{FEqG7F{^>X7f?Y9HO~aQ z^0rZv+Fn>NSUH@YcsmyGfEW5}=Z(+t+C^iQm(r#%v84aFwUHDZnrs09zu%*5+Oq#V zA?tWChUG8~x=!&4xPbIWXfL}`8POwO@YP=0t-pvDTKtfY-{K>n`!0;7W1Na^!x{D9l3hZ(& zD_wWK8(g!qI84fWKCMAUg^@k4Rk-tk2?mY;u(+fd^+?uj4{0hw<&xshKJI565SrbX z0XsORBW1VMSF}zp&^oJOeF4Gt(PE%1kUrN-quq3<)sE`8!pn%TWLS!fPlgH8&7dq4 z+5$vW7E=?AgZHF;tPxBZ9+rh^S`D;=B={t53BMK$#FTpXrAmZd!c`CikshGGAd~{} zX6Mu+0RW(x3BVG_mtV&ofqRBWMv_D1LTH_JIzCIpd8&+AzF=ZnRR=fZgf3PbrNn(g zW~c0SUKZx!D$qorst*wR-b#FA#GZ3QF&XA+R;pzc%)gACP(T4Mf+a1XV~jm6ms_Xv zifkdFpoq1|QwT~j27^%WaBymGq!El<&AEjES`aPLjz%TS?=(NAq9FwtCib1p)Z-7n?M!h5}z8=C2v}yJ$~=`1w*)t_s79fWnR5Lay->?_R6=e~IqC#sNsf&#R$k zRqSuh3Kd*MEiDBEH$NjTRcI{Fv96M7EXPr+OD`jFB(|&{YJ?Qadf|D|>O0w!%z4E% z#gJL#|9qukRTtr>tcAh^-UNz`jqF~xNfn@G6O{ExlU+6zAeM!Mpj~4e2Zpv(sD?(p@X?+`jkB4NVn# z0{!d*N+-dj!|o@jM_jQ5Us8W#)grhp%f1O&WlF)*XWn8+6l?BF@6aEZ404| z0eqM;NNbcRD*M=f*!|AMznS-hU+`&#n@~(&oS*NIKzR0IizMKjOrEB;rg4a;EtiOl)ouI#PL=jQp+&ufK-e@$f933cz+bPMM`$dLSQVOk-l8M=h zTX+Vw^fiNol!knFP)kS9`3%M_l~VU{3$JtuyvH=1ugE=s%)qZDh;R?UJE)Q+p8KvnygH*&1NR;1`pXqkQDp0(<3#{Cj0q1U;y%H0PYqG}D2q$a`MU<( z{CeW^r_EEn``4AX>|IHF*uTlRAF`OS_?yiX7(Ip#bk%7a%Ja=m@7=71@_HPJ zxJ*Z42TCN0-b7ekdevYQ0sED5|UPLUk~`urbAxcUe$Oa$LjJBQyp8?S09hnF$YFF=teTsXMRWV9w2Os$ zcSW_y()ipb(+&z8pW%@G5{>Wx1~zay6}r_5m5;F~MDrIr?~QQ)x=V-A_byksNhWB* z;mHzU=#t|cy?{<7yF__1pT)YX30K`hKv;Varr+la_^JZ6osyg1 z3nC!yiuh&0gv(e?r$+8CC*8jrUgY1Hq>S;4@CbMd=}q*mbHVgdi^QneS+ zL;eVWZ$)pSZjKH|Ih{`^mlY<2Z&6Pt{up?@k^JOm|KrkR7MWZO2`#ka)gve;)&2uVElR43k|7n zGvz>w(aaLl#HVRCzAF5n$s@&+FFZV-A$butUS`bIolWau+{2y`C@`(VJm)LC4G;RJ zHJeqRZtVBE2u4TP4E`*E=}en(bI%STN_VnC$}a|48O#a_m>aOA6MD>m*!AfO13)<& z04}NNw02K2uo=c3ZZM?_6R_kdj=58(8JDz zb+A_!HhF)>N9Ac%8_o7l?Ulx|&V%HmHG8YJhB*lOT=~iW<0iuYfgJa3F z$TsPW4uUrav~TSLCYIk~Eh1G_9eJ#@Lk|%ufu{F;-lFaFX9}&|y~Hfq=0*0jx8Jx? ztP3uTm_Oiool0@hxDgpjCkq(We^EWio@OJ43fg_ATVqXvm}S)iP}@{Q_mhwWZy5S7 z*(^=uw9)R0hFM^XG=Z?2e1u=5VdTrq|K_f@r%)UJ@ot!HGpVDbL%*7}A5G$T@I5j9 z|54gQPMz$n#3d&r-6kllT%!q~D;Middwcb!i?SAHsPR>;wm^uEZo>@j~Pb8af=byocqRWlGUSzQ!Jb?WYosu zJJ(iOOl8oIuUIQRw~rAioZIO(I0Hqc)+O%MWIhLuth+ zY%gcb6h&thl!Pn?WS>osAhvlF#8jrY#Tc;H)kLoKl}ZJ6E84`_#q+#uH1~ni zC{`VmWU*V9$WumrE0qYV1w8W&G``G``y}9#Gs}OC0|8XN6cGG#n`POQ{|B(ss00Cs zJ)j$T>0N?13oi=u(RCUmNIbq$tlfRPjNIwRcD-&IcGNe6H^AgG=5y2EAFa2k2OF^o zRKpa~^XlBc={K{RD5cdiMLA$^*BZ7b#;c1PO>Ddgt^&4MtNCNj6v0T5B`H_?`5#Lv z%Rmv2j*Fcw4PzDjVT#~l#A;|4*(`-W%lEY(Mrx@Cv zQT{A$c#D6uarA849HkYJj|}Rc2l%yk_hC-O;32>NA|?K^mlaTuN_!o&)?e;#Dk89` z_It#9#HdkRQYfZlP;|4B`sSJzv6V&d!_eiyBBNR^Bd4e+we%WfFKjC+RqF$O6u*&X zUwVkvHaWW6$=;V=NJ}0*XnRBg!`^$+6!kHre+1m}e0l)}iTY`^7V(NkwuHb1^qsfr`Gl7F8=3}{Pf#1YiD z)470CCy^5O7r8%N05QBQzj8&M(6F_s|Owg5E>RqcRr=XxoW202)$HD=$*Fx8+AE{3rO$n~eBj32)STp)k1`Wz_gDo~N z8&A8RJta&8Mp?Ecr|xoDjE1KaC(>)S2U}>O$TX}tq0Wb(&%J?4S+jO!$o^ATeS6ysG6(`RWE&9ETHXtodLgb5a*E6YjwEs6ImM{7c5=LFw@` zK!;lks6D3fM??(4R;vNh8Xpk`KV%&LS!YF{skBe^ruO}KXa>;HDiAYQfkr1mL+{01 z3)kqMr}s#YkB`4SnCCUEwIyZ8z~Gf`r~iG0C2&h25E-6ux=|g<*mXO9P%-G;$g}ak zy#Tz?K5SSFDCG(rBbO!d1P8UaVWwd78`6%p;ULBtfy{{xGVDJ>9ssm_BI@&TCnS1__@49YiaKd7#0GxOf72;TACqUL)?qywHhwQIG{I7+7?S00- zo;_vU!;F6h2pIiJ{~V+Bcei)^)E=>pKU+Xpmh^dj*$5W@3-@pHo?BYubG+7@gn1Dz zo~D9cVhoMa37asPbR7N(f@B%Q0*}m3l?BXJ9{jnTo9uPX@7n?DK~JWMoR2y9dm7`=oihJW>M!V?Xx`%a>pE5EKYSel?7^1AA!)d+!b zn=VIJ>yWMMrgKU^Lj#iBmly6N=AM;6Vgqu+JRb^dgKsPpSqmFLv%El}Q{6kaL}sdg z!vhe6L?ADm6|?r?y=&p!oBxF&jX(H@Um7(ozjQwLaC2i#5^kzXirJSmH#P`PPEVcO zfhj{$-~O7(&xjOStvm~A=}derOK-Z4|I*+h-$3uR{o3mhi_$bt zTkW%*aJecSU2W~UyOi|(=p8R-HSa^1hl?FMMSWcSQ*zgomOS>g z&W>iy38w*!$*i_T{TUerRCQ^bbQxMDD9NxFQTLC^5c004z0Z;Ip9Qc>SDF$|4Mb$X zwt6ot8{F#a>{+S@4W&mlRl{?dLvL>@MG6H%iznib8J17`Pcx9U1QE8>x$jSC_A+hv zA#D8nE_90T&0n$LsOvu(qkV_|e-uIqiW$*K3{$x{*?sT^|7}K9VA5lP%SHjh;e=92 z=<1yD%}tY{J8z(ue*`n@dt-XsW2p!i*glR~lU}`yV5^WtLqy-_Rio|Qp{GqeRx@G( z(mKNIX(L!0!AB?ZM5Zq%X~Z|Twxl0bTe2FEaVD}F@P=U&bWfFr>3qixN&*T`ky|@c zdj-|E4c}I5>Q^0mD$C$=j6+CVDV^BN`sg@Je{mwwKRbUhT&nzTdf%~hep_0Ce+sMe z$gtquf+50E?9W}a$of3L@|}^f3}o4?B)?Pt`)o*Nx?a_P#{-ty_vw(kBOLY*{_g+c zzA6Uo`XuSa^lNWv*vk~RHypv2p_(*o3d#VqN!~}*=b{$Nf!5KfQ6`)Q(lyJn{vZ@GS-~5fF)jqq}IM!ooH|G=)_hcB(5+g~k z3VV1(=}L`-r8%Z@=zh>tZ@i_kRYB2y9`#YTsOv@PWzmX!uM6+I<1q@XEICty0(WVo zh3%boy_?V6=pf~2oBLDx7XWsMTLqy-w>tp^KHT?ObK@wN?f+-<`uCfkZ!t0dugy~f z5OJVfmMIQN2Y3*kE34@GC#B9rtanVaA%|Sll5AS1b_@OUZl99L=R8bkzvH%fj9p(S zc@X>z5~q`Md!t1&J`y0YK3`ZM&Xmj_>&MWdp?`hPD2+4^E% zfNcrhZ_B*$4cUW-{6I0X|fUfNs z-^FXzDp;c^O|Hhpu+BvaNzHw`Qxhp;8I*MFX=?V zP2;&zBhUVbL5K$UM?Jr%uDZpv+vo57M6wuH-Cs>8>UH|+DPA+xy6H6Sjh(c3I;Kg} zz2BJm^}BvF1Sk1Lgz@7fFN2W6!9~mPW--s-{mZSIBl150oj@aaSyorBY`?X&Ie(xx zdvNe`>^d(m&+cb)S~&6~9m3W)=e^G3$wV$o`8P@npslm~?9UH5{+px*VBpUYLb*3i z6qv4sD~Whz^?I9fFXQVO-4q3QDuzjvMgT75>8B#^%4tYhXu^6L9OP`lccG;727N3R zvGp4#)pFRU1~1afM(5X;jZZgb|Fa{+jhUw3wdr_WSih`4;8}kG4jBdB0jaK!?Uh;XR zsW3BTbI-63f7UOjUy_@rvm*&CHccfMxV$_x%k2JIRNTG=LSCg+V6NQhmc3Jau4NLK zTd1_&{pw84%fINuFrwuYZC7H zv5h)z8^gWkyPNSF*#W76?743fqO*0=RKBG`5_L&rGJwh50k-1a32enx_j}a8-Gm>q z7SDYy^2Hsy;Dep|-`uO)8R^ih6Pk(7AB=tyH&2Jmbt?wIHEq5~T;JV!@5K>i`>{Qa zv*I^JB35uXwT;WeKLR>R4h64uIUi7u7py$t$u2ZGHQhR&%1lITg}DJoGWvmN@U(8p0`E4KHBTC9Dufb%oe&CG#^~5RR_QSRyd@Aw;L$%-X1swg^^8RKLF-tzD zy|Cum=QaEnN5ehShu;GgT-=PIqpbCqJ~v(~$$9C{vIOq=pXl~EEw8M&x%=U3?hV;F zl?5?rZVm1vwG3`!I_Le~G;g5uDby~ubU)8eKn8;!$^kVw3?!B;-rJNEg`}~E`sJUs z@n^snvH!e>eEM)lmOTF9=&-AcaVGD9R`YzB3+0Irb&iO^XxZ69rNksyK>{^wV>X*HdX9*hmMXQc@+KuiQR*{ylI8eXXfEQNEx= zh04CrSaScn(^SUSyqI|MI#s+80(+a1P`lRm6@g8I9HP$aYf+QKl~QW0av?2|6LCHn zJUZ7f1x1Ul59M`Q?ZI+!yV-uDbKph5YI21Dg%x=Bg%!B3KKwiQ^e1=$_|^oqR4;=c zJpQb=$Xc2xBIsAQTZj_bLY2|>q)YU|?*+GZkEbgbOX*~HV$lfAC;s2xZLp%7frkR~ ze7)+EXm+QyhITHaclo1tCa6>`R3J4fGe5$-Z{PdQy6~rvJNlIngr#{O(1zRU>gp_M zLD_%^A_A|<0(ezXqmTdntpo24ux=yX8%6(IjUTeq@pC>tAds*77;T73?CtFUIt)RX zRcIrR*5z$8M$AM>R#6;h}`m&PskV=8baM`tF2k67Cy z!IrrR@FqPibAS!J@+L*A1Z|Exo5Vrq^v$qVZs@vX&1?fgWq)S9W z*dj`|gi0%2n+ECblnz0qq*Vmz?%06RDI&e;u1&LP-ihb<$T{c#`|^I-*SfBSuC?YI zbHqKyxJPPSW?dtjzll6KOaXD1d3yJ~U9(HUVdg%nun5TCbSDQ6t#T;9kHUocqT>r( zlFFPuxL=>NLRhAz_)zsBaQZxRhv36K)$-gqyko@=s8 z-a%ER+~!>jebsli2U5AW&s+nn6Nx>*Iwp$!ySMJKKbzrIu;K4@VYj4QT3%BjQXC`N@gighS8k~cm*`{D};{NgN~rJc0_Z7D`*KR#W}8g#t( zcroX7V|jjxA!CTg%aH;u8g$RVr%C+nIG%DX9eTHa_yRGdyA)I3i0^+F?ut&i{UZ}N z0u}>r49BkC$G?n@)x>k^lJgkG+pkTr#OF2w-p?;TQu>YaccC-NZN-ra-ZxvAj+#>n z=LZ;YUfjR+ye-t-v+&y}Q{iVRns+Knf)O+A6M4C04&|8$1Lt!Mi?CyJNI|Q1{}(c< zatFtyducZ3jz^rQEbx?Sv%+1bn?5z*p`1W^pLN%PaK#J-#4oJCmJg$LKaZ&4Ynn5@R7zHl39oqHkm3JoP-A>}(_avGOPoGCoobxOZ+8@SrxY;5S! z(5-3hJ7s{vOqa=;V*kNH&vz>O>RVW}pVqY#h1A}C%+);@ViWKYNIcT?uzS4NDciW& z9g@_);PDs+p}S4>tk`FAfMz~+GfCwAMWmQ4U>cmZIPD&I{aXlPE*mWWe+U7GEa z%Ol8ZL)yo`8++YvjnMnW0lS@XX}8(Yd#A4o#oue&ad7fn#(y{%T(#RbN$y^{Awl95 zN_*y|WzJ1PY+D)}u4LTCgOCL0gcJlCh1FrqKAS~6XHQ8DCD!5dOqHK`;+ftO()4dB zS|U%p{p>2HS-BKVOf?%#r=og7(~^G`v~0-rE=4L^n6~tWynP@8H@datG`OEjVKX|g zfG+B@Q?2=2P|^AR-tf3%-VQ2k-qZTFz)M<&$~3@yeF$Ijv$|nM^GA^Q$0B5}oVP3I zpfVZ=Qf0L8($z+OGiHDl?2_IawJ$NT^pl;UYa@%yTd#ZaD`*Pq zGiK@5wnQivRv0pk7I6TFB3hh^qEqhtPT_o^n!`}{6 zpl5fKGXYw6u9DH|$qENXV;4wmrR$KyVZf`|JNl}gF9-UZO1B&tUFZ!LF}_pK>Z*-i z1C%yy6f;9)v&IctT*<#UbqV);fxl#Hzym_JhuF<&j}Lfwa1P@_V-SBu^U9vyE)oaG zU!^!t(5t`b{x$6TNx;`))(Obbp-0aNl z?KA=3u#5>_8+MJu3ok(dJtDs3PQaLa((^|f!UEvg?=VTKBDL%GmALR9ORDa086Y}n z^`c*ah7uX3Ri^zlTaFkV6K>s|c0dVw{xN{QoyO)z0sC~RU9PNl%TOz{*TVmZ63=ik zAoK)_1*5sh%#u$g1htlA5j%fXmXyVsE-<5t4R6`G%I#5N-@b*BmPsA<_6>#`JjOS$ ztjv$At+68zqEeLjL0p1gawAAA;S#4yo#Ado(7gsWsJt#-FD zIno4N)-gUx@ZF^#yEJwW4TAoka2LHFnfRqoRzfU$HADSz1?{==w8bM97<;+++j$Eu zU=F|Pa({0us>>r{xNV`5mm_kgWzcW8Fvrlb`@y*{+dK>M}*U1W*jcKn5yHrAJQ z^@37Co?>WRY&x`)Qr9HSYl@vqRy=udU0pb>RW=>(MnPy&`xm?P)TtNgZ@Sc_{G~t9 z5AwFHzuKr0$lhSXvLJab*v5Ri=VrUa`XPNr(H;g%<=Fp_mSnM9O?_Q;T8lvF_`RqA z(9IT?x_P52sypF|UwI{9p#<@5At#gOKXL{x%2-eeQK1gxVqnm1UrA>v-f&fJUSno^ zFV(K~T(#yz4v(EiM2onffXnFuXe#O&-TYuk)Y4E{C)54TRt_FxTXARq6jTotDcp2g zw0IBxB;oA{u*pT1z)O?6j9W$(DXzT3U(Eu7yxW&S-h9P_dsmIc9io35iyul0kK4g~ zfe0GbT){5eH?^HOmSO94oSWRKxr6!cB=IdzQK0E(4grL3WT_%gice2)JW{|rJ?duU z&RPN_A%R|D`le;?PeEcpw3!2xGT$Nk_aezPb`t#`ngR7vGobPW-n)7-9|Z!K*}ap)l#@Lj4NknP+oO|;No`}!OyH33qE8)z#xKsshjB?>w^tvcRy3FM zS>V4YEnd$}v!y-x!O@q0z}ZlZa@KqUDTxZhV0+qp&xK@3{oF0otFuQxfAv`7BB!w9 z2rOx5)B$+Mg+EA?{k+-#5&msl#uLutoQpD7OqgPvXef^78}XU(7wwuqL2Me|RFJoG ze@0V{Te%6MpIG(G=;vvYyF={nRiyd%Dvqlk47%JMSra73SK?h(n1v7Tc7ef7Mw{J$ zsc#9aw~F)V0Wc=~4@7w4t!#1KFAWNq)1IyMfa)u~U%5Q}Id!?a4d@Lz=4#sit01nR z5_zhZ%55lRq2{VAfWSW053KLFnqOgoV^(9KUe>*}`)8A^vbTAjj|$1)9>U)u;C|QW zL)Jo2w0FZcc3$U&`8o82?>G;yV%*)a+cNolYBKHXR0<^u-5 z-{YdWBACB*q1jWg)IlL;SB(j9l+Bf=zgMP%B=a@^I*kR%jAKo)ho!!K4JdYaIj#1f z4Aj###j6s$R~``VY7#xcIiyB;V*X~ieSAyGJE7@IX*m&EEpA?*$H-)@5o>Sk4`M-EHhVsE8#7#!&V( z#LokY!9GqfeU;vMZQpnq~OrX8u5dYqm7!Ywl`Q*#~!@!H6>Z1#@8I%*kk>r6#jVF_;ufQa;tKt)4((KD2(o$QCeqxa)` z@8#vk4)g6vR{rQJ*V8-@d;?QcHmwCw2|Ub5=Un;`?xF-xGIB-!-ZruWZl)>rmY$BQ z0%*Y5MIAkxNKHm`iiWd|_agy=^jVlT-Z0Zv=T52D5GAq#AF>(NZS_48 zk`S3O(nnXWYU~iTF`+7^YSsP7kB9D$cR7H*0LPuw!q=q*~wdiq91}R zlu`o&xdm=k{9;Tpa$Nqw;Bawh(Jl>Sgh5C-$Y(Z2oEvkJ_t<{O7e2@Jsp8 zi;HZK_LKh4Rn#nNdZ_EQh8Io$^ucu8IPUH<;K5T*j9B~hQddtL!4OXw%i-!>6d|T; z7j@0TgC+%Q@sGplx+ZH+qW1uT+Trg4ma>OYPsHc8?ud35=;sVRK0fY7Ow{%qY>a0d z5BY*oFG~7-^YdS-?dF2`+*V@}Zqf1J;u4)avY@-Q7N7t!0T_+ps38jmx<+=CXrKC{B?hw!k=Y4C~PMTZXg$TzZmtWKLdQFsD z#E(|mq(xqwl=>u5@z_XI2nkKR2;6kbrst(^Tb563INKO}!I^%|@;`(e2z(>XW%oV~ zoHX-4pajz2P(qTBT8#cCRl}q^3beoSErRm>dS`gkj^S;loAB7wJZuN%gPx9T{pBDG z`Jx5xwH_79Ir{;vAfE|HOL)lbw5@raBjpK-9m6VBvGoyE^FvbE_=E086%69B$uM;_ z!0p&korl86FO@(->a=)L!?XdMLhNd^_tX>b_^sk^oZ6-FI1r_w!hEk^wi92{k+_j^ z59jz2stg_=CM*#3NZou?49+wkvE{%p3scFm{rzDmRY>aD@XZh%fS>vh^M zUCqc<+u5VVoy3yn`oboPR>)lVWSvW(SuMEH@A^p(p^vM&$E3%Fm&4-TE7M2TpHU|( zth6$IP7v-_X~M@>J%-Gc&R-N&6`2);`fhd=!XBj$OOeFx=vCUyN$u_pDCFYiEPL&A zuq@7ZMBfv5Z0iko*c4h!t=;TTt(@{6*RFHzr+B>hQJL8D0jZ_I>FLpKsNLj$?}cbB z2%`!ooFk6F*Zy-ehM7op+JEaC&Vyu#c$ZX1F%Z@3vac32if`RvvX@emk4Q%Fiazll zaU9JDmb$fS{d5)6?2T_B#il~Mo44R_CwUiHc$2n5h0}K%+9`-jWLu<)})8|iH_Anr@?Nb?rdm0Bd3DhCTe+t6}920 z$A+=^RzLzB?81-F17Z1T*#eN^EM~K${fq%cN{SI`@2{b`_6eWljTY(q!_>|X+tj+@ z+Q(0|MkW|OYhca0ySv8-OuF#)x{5a!>!j$IOw^!w_07~{>eEg}XDzy%9e;qg?OKnO zbqMZub17jO)E$gjEH3sWDM3}|PNptk)k~?Ojlosq9NJGm;OA+XdLM;DmmOXggAHQi zwE6ad=f9o39~hV5mcN`q*ws7bm+;W=T@IL=tufPqcL&J8G|9u3@43X5vxUWxFntw> z{PoxNaR@XVqrf2xITH66e^L|23Ha~!e2V{KAqnQwetlKRd9l+cvp)Cr9lUhj%psMA zic193Vy59m;}Xe?5U|}2z_F9ocgV*+q-Pv!@M);NI6o=hp+%D*TJ=OuxVSsANIWSj zCOam0CdomK8|JM%=e}8wq*S%C=+)(XUW#3XD%{*kTtnm~Co4NI4{}f(iDr6d$NP&* zA{W&#o8A-w(@D3b6tiwCOEADx@ceM@o!P~&mj_xmGS|eL-*o__y5-RGxjZIDudFmjcj=+oDVn~n@kJHj^TxyjPMNTGlO@8i9Ih`tZeEF)=Zp1W~(c;kR1wkzmf|8XC+7bFO@Er7Crt;mi?)=2;3XtfK{ z({I>ThDs;ljzA}#T9ixbVG{AWT_UoxNbIn%LpFTh{K=_*r@m_or1^WHWcGBhq1Y}* zxBt{=eB6AyZgETT=Y#lTnbh{d#bA+PC&w>V(@9R~#jlxOFD)%S;-R8*W2`tcK4bW@ zinSYJWkeHxv=-vo(q}K4rt?JCyXe`{hkB{_>!&%|pv4iU8j}#OrGY|sYxHsY8{9Q1 z?fGP1BIF^`HkhZGnXB!dR z|Mk*+kNuq9AMqVSx7xImz-?k^bOi$+PD z1t2}By#@;YxABv`HFol?9s%eb_G-T4Tkj2LTwcJG{7;M`Fj}{5>pKiCg4kIgU$d<_ zNPO-SSK2<%cRR5jV`ww^`Ra7R{-w#ltGenEWlKb<@+$*~bLVhm?TN+7i`GDz!=2Kt zl9#R~6}3Nxsqn;I{RETpv|I|LR$9+H+~Bv0}VHzeAm`wKO`J7~b<;^)ti4m|d*@&W(4oOLv#E566AFwE+;NJ6P={+KU!w7)XgoQybP9cc~tgOGcSU#?}F10Q2$+Djw@a zoU*sllg8+txVYgpJVc>lbr^S8E-PF-hTlq+iOc7yo5j`Nf&lYZ7C9qv0^45Xba&wV?f zyEv>BTr<2^nIhmqIWj|$@ZR*8?!uK_NvY4pcOnR%YT*O?>mcT4dc)}gq@T7L6&AXU ztv^|a`ds;!=Uh9L$=+BN-HXjGP)~?}Gt4$g57Nf+iJa{XbgQrbHv;A7Ob@(Ff%O{> zSMOv!0bV91HWqBZ+asSulU1Re+^5Qf3pSli&N+??9hpx2J!FcxL3709a_v1R0 zYwc9h-Aqw}d5l8M!Hop4!~G0pCPBBIFSO7ap9}BuwknJ3VgqVWFEZ@xUw2PYW*Boa z#cpBJA;nM8iOcJe=N_!2jz^8XJ=^;}Fl$=x!?qfQTcEe}I%>Ylq?a_hrZ?WmO&!%n zz+7h`e7yW5VNRdSOJCvQp2K97ozTMM)5c+zhNwx%=O2L4KqA$-&ys#Vf=O@6eJwvm zuSds$4T(NmA5821RN~Y4BkB29qYMqzfc~&&7@9y*f^>_;+Hfz?g}SdW6X#)UW=~z5 zBNI3q-J`Im?dl<)M+X=KtQ`HABjGK?^;PHFQ9fDpH?7nfG5yw?o2%+D8@`^lwH74t zOu7oae4r)O$U|??2ne#U2eNJvf0od_YUVGme-vCg0K+MUlUMJ&!9oM%Mmm(Ry|ThL zbvSKS^jL?lAvM5v^$mn-^9#vYV?ZO!6~AU9LHZ_PKOb)ii&T>@Uw*C!*xx6!mvZx@ zFaWL!bLE)%c<0%Z3#(MRK(fP~(MK);U{L0c(W4t+)b;P;^V`!}4c`7(+uj8sio~1c z!@A)CvMun4kPg%)t^kG7($aT)&59mK#N({>;7%tZe>nw(+#guNYhT7_a(;^4by`2< z+&yX#QNT(D9GXRVGMF3-wU4zXtljczzebNl~>sa7L}DCBWgzBkTTm( zIn%Y9uq5^2>&PiO?87@OEXucn1>0;Qlbrn59IZn9j%FGFoj?z{%BHP8zB<)V4q2}R z^@5s)zwcVVG~FQ6i|a}w$;vKIGU_C`9`W9H*fURUKgkCnwIK5=OSvX}YjNeWbOs+5 zZ+=zZg5t094I7`_??kiy7DMRoSQk;!M1X|URBAYT(;ZMJ+s$~HIyit~H416mmj|&s zT0uB_kW&BprUXjxoLTjx5s0;mV1M@*zYgl!>#ptRHWF^94 z+fv!e(gSI5ilTYk@*!P$&#&1IHK?%9w>47@`{#|@PFrI4Ez|_0KmJ%}{vsYsLp&Sf zhvl8#6gFzqY<}xgWYiaRUE=umkG-9*@k)2^Qx$sF$XKWJNFZ8xI!@oaNTx2ZPuzte zN-KG?+Q(KqT|ovAfjWM>=qB(UmGm!lkMqneg>0hWwJu1*TPT#>W1!Mzii2!}HdI29 z?pbU-;1ycg%q2q2r_;6Z-q}(pW2I@9fwtF8dGA_1DrCDU&VpvWS+^UhY=s*cN^{dk zx!nI6L4(>{R0@ki%1wsp1{FMXlp$_D0;Kc{eSE8srSsDzkyq3Lp={IN4?Ch+95>oA zg^_TNC|VM{6H!kdh|14NF2fn6tgI}TDdZ-Xz`U7~c3Tu351r3xamDs^PFq3N$bc4i zj_2h~3LJ5lDQYEL{Cr~Ul-3H&D43L6;a>=smbr1N&a1>(Awu?HBtDhFd=_9%Go zkO-yTa`0wtoAh?syPKE+QENnYvK3}kApjCI^x*>u8CC=EUYpZG!Q3fc*2A{^kjs`Gun+cHu4icK9_9?35n`_qe>e3W#VzA0dyacY`ggx}_c zGIg@q08u&OPGm`SeRu=sGbQt6I6?)O+LL(bd3iJTq{7A7)Wt@SUebS~^J8HkLu6I1 zBO7<+&PP-~&=!CmT&0}m^i56iZPpj)z3I}3WHry-Uq8D*DWOwm$>-d-r4hVq=d+2# z4$N&>D%d^poLrV8D{MvZ>MmiKf~X2E7Fi8ufz?A0$ry#y-fo-M8RJLXv!OU?-^59! z0yWSym$IHH-FQ@lon-N>(Pe8|Y#3GR z$br2>owt{4&LGXRJYqh}@tPjN^X9qL*Kl9#>^Cn@Z0Ng;QfkIhL}{RaZ!9#s zB=VbT^s96^SYn{~*!6^ruHV{@uUl!CJR(2JU}Dd0J7VM~Yg5y!#*plL@hOd}*@nku z0ujG{E-Q(Y6o_6THv)Aqqpp%#?~*IM(P8U&(ftE1`*o*n02Y6waR88wNB+N)ZNu+< z`^Yxy?uj!ghiUab=6z(O>w4}+HY0XxpOCmf3~dogRPjlCQa9TA%#oDl6Pt9> z`An?HZ8X)QDOR!rTfw^prM!%4tb0epu(Ok%C<3}61X3c|wUwBqM!Z6C0#(ybr@|ZW;mLsI%Wv{1v|PZ{%IB-$jEaUnw;CV&fj`cnDWK6kpjEC4jqoC-qw zF$Z&IT38bC9>&;*L?kEM%Z5=oBP2)`$p?qU$}MG|C6Qdy!07&b9#ynkXqp;}{N6f! zwk2}0D}t?`Y18HL-)Rf=j?0{FN9}j`)#xtn3B86N;q&MS$k!Y>-)my@piQoQX8c>+ zZ!`AtW@rICSu-_VKx3k!p{mACb46{>gtfDw9i*pByr`_cZjq^1&=p=06i^HopXSjo zUyBx2@vZ!Ou;b_l7}PuNS=YRd5afdMqc7xH?7x86e}!kar)$?ZluK%%`YGL-3@frPDdbU1vjCy19vyW;#jk zfBH$uS}>C}cxmp3RM>WBs?<+YPZ};xg0pJ$jEK04RF%1(;AtZSts`yf{8$6xpA^pH zvUcJV6ucB8JI&SBKovfm!_rnh7%zKOiUW@fZQSO{Ccx@fd*|ENi;t2{WG#+tOU$gs`wT;lM0!~h1x!)P6#0uf{tJGDn}ammg!ydp)e78c zRbt@Ml$+FOaZD#Uz?$XQ??HDMr|Ji*I(bJuskOdR$R@64y$fHPZFWdBSJHGGT*1)( zWaVSW#w=I6#KxTFNXt8h(^W;{x`s9(2Yz z6tNc-U(a9biWA;{pdt(fdy0Tz}Wh&Ah0 zO{pXsgVWvZKDpE8lpn>jO`klq=bM?I#c9z!8=vZy%YL{7E%1dX6a_FjGW<$PAwfyQ z+F##agI;K&Tb7n`F|K>GIGe(R?}!&~2skf~q+RTpa`8RRw&H1Pcovxz5bq>(af-_t z@ua-g1pDwoU(g#W;9v?;guree)Na;UaA?>40N&&H_+<(JFO@x{lYaht>KK#=`RUDC zRmiX+ey{FteGw&cUbPr>q)1V++~-bIJM$Xi=EXkr zV(>0aVyYfhlmq)E3HS(&R7Gq=%+y*nnXP<{4ro*lj+)$Z^>~Bh$5<<0H@c4sBw~T-0z(?8I z7H1OEl5*F_?*}6kANl5pTtZWta*aod_?NCqrEw|s!qMJKoTKEBClKN8EO zZ++b!2w0ov1#C0-M8H08gO6{LdlQU?&bS~B`M{xFrDyBO!V&Vu5*;RJ_Yy<}g<-y% zCagURScl#x<5T8!fJVfB&LzBn?qa^pK4wezvD>~%hh!veYbjrHjkhqC#1$Z0js=W5W|SL)_q zOKPEn4pX~`t6yAL$BoQy*)Ffz>W(`rrDfd`qt`enIT2y`Cay@0rV3 zI&9Bdk{d40HuZb|hrR>k!GXJ3Z6$lP3*sZ1UlCyD1MqIDTOl)}@rOJe6zCzoJqF29 zX4~5SX8lZOrM%$RZ2dfXHZ~LS@_B(80!hOHo!oIYW6AVX8BvaMr} ztZpf%L<5X&7=BCv7Fl6xd!}KgscuqigZdj;L%}&-Ro0chgnZN0hXCm|udtbl)Vj5gVEZ0LoB#kNZz~vd4lpq~ZdkQ(qQmlnq4?bVcO;pj4Y1yTXSRO7U=0Kp8(u5I$a;Q=F)JYvv~f57Z-)SU>NE%pE%w;$uIBm-a{K&~X!`fX{|U|m+9G~5sQZ}O+RD`U`TN2Y9kB%rPtK9fE>(fV zdw^B|a-AAGmPhp$be`1P-%{?I)|k zJ*PeApXfPgQ*Eu6DTwhcv>XdH#gadG(t`a~F?&>2^LyTMm$N`=bizP)SDX9j_Tl8g z2)%RjWc&|!_N#~Tp7CMi=p0i|hq3RkQ7tLWzZ>)J`+zD;h-Gsbtw{W_2$&&Jf;&%@ zV?l7z@Br$w@02;+jt+BZlizJupzAN_iiafeOnJT>=LJ4(%q+jdVuTyWfjbz|)W}4R z*I%HNpY4Q0dg7s8*&Bl(Q6*~iJqW)hwc&KX(8Rz~d;FXbYo7jNfM_TANj@41-3|?9 zOqhp)h~e=u=blOLlRXv3!*0sY$5WST3~nexj8zYu&a;Rp+1-(d`v8EViA3pC zUqXwfMB5a8r%sTrr>__!IRD?E;j-Ez$?Dd?Ri=!)av*3>8-u-{$uDeFi%H!@FEkB; zQ0773fyKj_x_yo;bE9gY;vI^dKHgMR>oHnal;*Sb@|1nX|L~=m`ddR~d_ykDeZLH?BSk?RWLm)^;>=n1s zk|`-F25xRtPCZmB)O|Vg0yP#s-B*|O@n9r9Dp8-zxP79 z{}M6d;<1MR;6!3ZYI-dueC@fU0RCe8Xl-QVLt-8V$`lglzh(6oA-{x==A%g!@*JjM z0zEU|#ah0}kV6ufY-mFtxgccKU}co3LIGHR%5IxhlyZHqt4gM2MA z;<@QDHGr6FQ+P^N9mN>^&_WlG-MbDkJZMR@wcPdCtdG~QyYadc(7dj4@qvUv8(ivH zoLSY$#V6(Ct{XT99mGHTgpi)MBTm<+(h`6NXR_$;`EJ0UP}uAMfgh=L5a^hJ=J{UW z;F=vMM)*p7(VKjRAc8(_Q!7jYOqHVd^1ju;b~O_oH+b5qqHL5~UW z@nuv>S*Vi;yQ>{c*%q+o0OBWhVElBc$*x|7!&Zue2wuO_$yQx3!gUf+B_(`fns!#b z-h-jT5~-1rni_gQ);9_=&HGPvL;7uL$Qef37_my#a?vlNKQw~pDq`#CI~S|Dh2NH_ z4Zcqw3A%3ihTv@u!M6=Xd1wD{0SISl+7XD035rzpc5;5(gzZLFOwhg7nPefdrBzj; zi7XO!UjM*%hp(segxOWZv0XhFl%sGVCq1HY?lsxTTSnDw*HF;lOB9A^0p2++EVHz@ zB?mJztjhjamT8am;LB$4?rhL^XiMHN}cIOD2Rnv|$Vat61%;0H6XnQU zln{r?eh?F9KcKD(>E&46PP^6CpLIE0>ABwF-16RDo*Px$m!R0)`!*vW#n30wUjD3> zepbNy^uvfk?&hQb;=#Dfx*`MJaU_U~vVK+q6Rv(eXGkm=y_izs9g9R>&|HvRKDpl% z179cEARfc*6U4I1Vt8M}j|$56sD}pJBa=8Nbc;>f`F(=B5sMKXmxhuU4XQ2rp*2!^?C0(-n2Gqm(H@EcVLqzDj_Bb^Z(!yvN^6Kmt!sb16?AIQ9%=3=E z+ZcD6qK7r_y6vy3RK>yQNjQ7z(z!wJxS~hDdenHhH*7lOq`tIC;rB?%;s1KZkAaQj>0uYxM7EgWdARdKStYNvb9NTcZI%86fOW(1M?OAEtBMMIuH8- zoiQ)VU<&Rx!k&rpMpP~lKeZCiK1Wg3XVycJuj-qWB#_ZAawppZd-IW;@H;tE#}tw& zY7T{qxyP=rclkTBQXT6nlup*%zv5f+3#(rEx@qL_I@wW{HjyOMcqLc8{NWP~TDFpJ ztP$OP-gsm%;95ON`ziPRjXSlcJ6-i3V*{LT8!`JaVqS(WYotTuY1aD8$zlUe_nw?Ui2iM}c8`Owif2km(xp@U=~! zF`Ycck`;G+*fAHl0C#%s(3_$x6*Jdf<-9TWs&8&)^6}dft%C5$C3m0aiip}NP(^~s zQd=J2%(Q~ku0M2mhySW`ukT{d&EZ>i+|mIn)2n{FeS1)@BHB&oj$zIB zNNHN3`{PwFhpwgVxdEv@@sn9$yWhwn_A8j1Rm1yCqyZ5qH!-(E`9}_Z3qw}oH56Em z4rl9Mv3aXX{}~lJHZfPpCXFt<74A zLXp^OlEc;c<7u^m^GpeuH8owT7w?BDpW^CbjY_i~JbTRTmYfw3==k1yzPQ>2ZWpZfPJVIX*+D&` zX01;0MKJ>8rX1Bg3KxjWhqb-Rk(#XI6ZT!~R^wm_%#^luZc>NiZVyiaC`VnkaaduF z|8O$q5VL}Nv4ielvKY}I4}EI(td(QHRCqVxhlAH%dSQ7ioI4R+>+wd=TH&zHSp}HS zO`h!IS3PxxSW+>Jc8Gq~>t^iM0{5D>-p#l1>dLKI-2CPG&LpB_ur^(0zwKOThr=D!m4$Y#X5(+T~+jr3<&n?^Y*CI5OOr9LI6SAPqnAz z7Swc(Lv_365-$ZwQk$G29=>#=XuQNY+?3w%?HZ%cm*W)pOHesrhO4@&9zFK#B*ds% zWd5QQ69F6dT*!s)9}|o#d`sS0p26j)DntTX7bEg8biA`OC%@CB9pg@eVH@|<&B^GE z+obnCX(Y@mb@NO(mLmBP5Vr>CD>fVJu}3pjnNjXTUPgFoBchpTJj{Z3k@0Xg*(+Ly z-d8jh9cxSFXqD6X-&zMKK3+d}bXXPpjp2@9XY0c!OT%@9f<`W^Th+oFAM@!vxOr0o zK?4U5)jD%;OO%ij685|{YU9E8%>H17fl$l2NF{ffQs|yi`fwR?Z4vu*dI*ALGx1>V z>q-ZWVU?V6Ll2iZ%$&BkT5VUw^`b^W9a7V4HE|AKU?{wvbYmKq(|{Nii+<*o6e2FS9R?-T!iAK6RSq*mg^twe2 z#Cm^5_1(Fpn_yIrhVCD|C&bOY$R6i?Tbnd_kJ_j@FMh-Ey3L71HZo$I^vEz~Lu%tz5J@Zjc%a-W zHP899H=^qEdW(ETQkj?xUyvZ{QFj8@WOAxM;zZu5_Ir!E7UYETu+HU@IghXegT@gspodxv#Aiff6h9xYv@bpWFEU2MfocWI;G9Y zq1_y$q%Wj1W&w--2WTpC%HFoG$2`Z_7gVP%T0l=Ub6&opi58sX8MF?xxjl&d^5Rp# zJ)5eTpdSycW-v3J{3Gj^3-hrH745JFPZs(2V0e*asZB?d26+|{4K7ko+UB3@Lkn5A zB+(Cz4lQ<;wNq+tOb_&Cya_9>8h->8V9JI3TKh3_`_|As1>Zt9f*wE2c;+6{(&wvI z4~8lyh$jT{|11iY!Ev|-*`U_>!V$sHv7fa%oqktIKxER13v=V}I_wQcRoFEs6)`S& zEh3bqT)8=B6qvZ)3Ywo2gkB6N9KJTosp9X+I=mK$s4^Ic%Wgztp`7j=%NVrEc zbxG8gvG_kO#HH!L5c9n@MXxQ{i}F_rWG^kpNakq#J`6Q&m%&=EN`+v{&5ow0y5rvJ zS|eXYU*=?y({OUF@vRRIb#P3F<6C9%{YbkRQ%aAlkyyT<7mhv;13m~FsxI8}{Kj!a z5XaL<{`kXjZHJe_<2EunFoEvYr1ZFI55hlJ6DOs!bG!dIogn@RZN^B2114@OWt7$W zf!%Bn?@w2>$vj^-eo&3lX4h}xL zS&ZISdZ?a$yJ2Zgg)*mc>=q7)A$Pj6y<1$-CwiP-s$MF4UfPEVEwrr8#@&iL2=W2r z`J4}iEqP(<9LO+FOse&3(Asj^leR`1%*R)rc0Ow+0vZ?x?? zJ4ZhM^?tn%-bGqz$k(0-CdUoh9oH|tUk`*&zb_Nbt8-%7bK_bX(|x9@G}K#Lv@A%O z#T;E1oL5PmTNq`T{}HQ0>NV(L|NK)hAqQS>SNpdDtr6!5eq5orNG4vJsPV+e@LM5> zrGg>h3FBvl-;bY-vG6um3C|8m(zOXiTaq1qJ8?{tn5+o&cu;H4J}n~5Z7`%d+}+t} zKVBfoLEotM<&GDFBAA4=W_T&7tlB)SA%9%jzs{`@IelaNM1;`4{MySe&tbUqZJTh9 zesJaVxN&?h*SG0w2@FgY`T_`EnWDHE8_D-@ZkxZ(O<#0C+@xI%;}7BJ^LnuH@moF# z|MIX#00BeQ173(feyz3sxYJtmo;rWzbe)hjz37nejR}@2sS`YosHCV>HtV!$qPgP` zEpjhBq--bA^e*j8#VkgCdRwXsJ_@YPemz)J1wFYi>Qd}-+}SC3{zHTQcF&0*qP~#H z;PSsBH%QhFnA^rf4{}h`lz-&Di9kd3Y$_f~zh4g;;ngMw7 zBRe$m?|uoZx2Nrn7k2i}nn-k4^4{@$A?E6jJdC3E}zWsE^{CC2#Y%#>gg0piY< zp(`Ir40PbY_VcmtN7TyXrWP6g?v`KFz^8bYYxdmFZ+=rIoOv+Nb>ccUU7V@|N?L-Qy?9sNRR_}Mt3cN@QRL|;_5n{hE9A2mu zB?Nm*W$(p9%l|o+qVzyVLQ#ow|C~w`G*-5^C8%l5qVq46toA+qcWdeF@=8=6@tzG!T6ijG3ijq;r=lcYj@@yF@ak3tI7m z9x9hIz_P>!nI7y9g70KT5so!0%NO*EwJUXV?k-h;-^wZB*pVt{nJ!@KY}**%WNcj0 z3#gY}qnn``$|$|h@gq|@E_Gr!9~nH5uv=n@0@L3_+o9n58oLT!Pg&M7pz#_uFI4Mt zXYhY4EGYj~5dU0B`(8`)Z<6_E&;0yu0EPK=>25aelE0Epa><4_u9y7J=c|jL5|bT1x_e`g z^=-lM(NKjAim*Tg1C=WkEiLzx145EZ0TkUt8&Xy4$vGoY(=XCWXJ{N|*Ep8^m zSX=C~@%PZXLBan#`43p5L;54F!+gBu$$mLdFkTBw(|@(54(U_C3qFN)eEAzPihKEz zA3MR<s45)WD?)bfxPOEcGM+H}dCs5z zRg?^Uy-=kKqB73%`93>)VoL^dX-VC$VQ2{=)4B(L_2hMm$7^B=Wnn1(c+9;n=(0yoTPmy zX8;)otY`5(;rYKeik}3mQUaX^lcJno6Ty~M(Tvd1hTDo`V3S9kTexYp|$s^`SbOrO6C;EfHY-a2CKF-DDTs~SwmtXqh7gT?W>F8AttqLoy*3`)fOawR6_a_0!=kAyf@Bi~5|5iku zcc%jnfphG(l)5yy!RxhSw2-?+{Qp(<-tkob@BcW*CPEpdj0lmGiZYLS*@a|e9+H)v zmF-YeDk3Ct$jaWwo($;vJ z{A1By-uzaTXS8;F=(@t?>V%l)xj5gI67e!XbrF@)p5RM3p*~q+nXAvB#U!K`t3)p3 z)VY6aT3yY*>RGQjoYq5Xc@Phm6HKN0ruFrE2JJN+}sXkZtIQb}D+5s7{UP z3?d7zu`z6Xd%U-tSSD~=x46a&w7gMOhNK%vRF8#!fF)>}Tg>mo_&4}BKm2{AAFpCh zK^pkeCd;tzY&EsC8lR5U@(InNjX=uC#puj0ra;$7+BHTx^bFKlMxi7XP#rS$v8`<$G&MK>dZGxce4B;4N^3bPc=Q*9{ZMRG9e7x$hQp%kR8&F1 zWryvaSM4t^HdT?M6K~yR`6Yfh-<~03Q_R$bR3he5NT!@zA1aYl*fE8l+PgDwVPGzL zGYs$tdv~77lwieH6S=rbS3H0b$^LVHF<}TE8QO6`jZvd|+T0sN8`Z~7RYg2|`r4f+WQjR0L0pJkA-TXu~zs! z+F6GA@GsW?G_BW4fa2mzvUq7ctnPaV?0YMAcxcgYnDxRHvC zzt#i4suQIBc>VXU_FuszslZKFNJh{H5QmE#51)YReF-r($>pSg>*fD}A7GuX`po}8 z3i8)@ozTuC9{Uvr(L&kv*!4*&(4I#k)Zl`zo>1>CpYkXOb=kS~IaH5q2Ynte+BU1A9k*x9rEdzMZKP*&?a?;wXN1zZ;R zqW5724|dtsWj(jP)hRxgydNy)vaqCivSe!U!_7PY;>9P>Gk+yOc-)&&5xBUcX7D@M zW>;l^$K8zLiB^$V$X=OR>uZjr^sweSyRRSbfqtC(-hLU9$Y56yb{f@SKVHD_yTs&ZhB0|Ta&^4u z3o@DF_jc3+d?kPz;DuOlrS^b$K{^sgSMs(Y@P6LfjP1>TcN56bVT&Q>*?%h1Pkz(# z;=OA%eHv1~pLz$}$tb8qRX4InpPlWQ>}l-#@NP^p1Tpv3a&MJ3_!S_}<2Y4iff!B7 z_?}bz($All1)~Cevc$W6Umf5mEq5z;3a=$#Wd_*Sx(u#|Glf;E7T<`D;z^gBYdTEXOVw z#~bftHZ&-iT3FN}T9)quyt3-aZW}fMx$d*?B<5N$TQYXyw`wEoGcz*ZPE45O-PcVr zhwEgR$}Zr9#Ko;XX;I||#`OpYoa=QyUE=rXayx2cgVa0iGkCaSZb+q6CFeoK!GqO9 zu#6(QA8LSK8E+vp4+0AxFsOF`IYUKW;XU#3{sk7v@!ZiD`WZ-mqS#RC;Zovcy=CT_ zOZh?+Oa!*$z5Bhz%rytNWh)n@FoCA#J*1`cmpo@*Z}tR81t$hxD~x{kR!9n$S4rDH z)mNVy85t>@tQ>Q`aCqw`=(E>#})}wqfx7KAIq^V7gQd$-^RszFTr-|2JHI8t>M9x9@W?H=K>V>c%Vcgd3j%prym1FGvIYNL|o5JOODoei_D-AzNd^3 z)keZikGC}IyO%8-9&~U?!nNCYbar;XWvg6N*qL<5bC|TYb&J-{>73404)SOmYm8^b zJv723ZEjv&N!rEDrVk!P;+pkK8>ze(G;(kmz5S+5I|ZivUj+mOqC$CsqEtM;$4`z( zkXcO>&XeYl%`Mm8j1uWi``$bDE*gR1qhz%IN~fE+c!QHeOcvX!HHaya16tlm&)k>q+P?X%gT}zY)s0mYk!U>+ zcqfyv?^8eaVH?Q{@?G7LnENbERLh)0NEQj4Vqai+ZeUU#za`9I)h~kCm96;(qFI9? zorzP~;kgajMyA)ev6T<1PT=}xD-8Fzc!EWw;H=WySCrO*uAk=`!v%D4Hxok!Sq!ib zyeql|ofrG84Yu36Hv+;^?dXLal1E41rgZu*a2n0QFS#B{e>5z)nR7U@-)2*`e|@pS z#9d&j#D46NNP3XxxZk91p^HJWa*g}pvTeDhu}t@8z1jBhOnpbLQ_N=c$@SOAJ51yh zZkg*}EfQbWWR2c#JB&-*Ty$BK$L*wb$~N-DFkixJ&npG5W>n&IF1kFB1N(qvx#=-_R* z;K1X=eV>>PP2{m2a0U049KEI#GnQ!!m%Y*;JT*84$#Z>B-`LdjHu3Z4`rK8{Di=)j zun1~%tk8@yOMmrx#2eTKTjh5xlOyO{k`2ktLT}^ioen$Y>{96A0{6n+Qp|}wvth41 zr+#O_C)_NJF_9O%S6>!J&U7SiFEs3Y*Qng&#@^|_Idpz^OK{lI1~=*LeCb|Fw#(*q zR?|%P_Kx{6huZQA#sznUYdIpjwJ$*H8PQ~8Hozt$|_Hd|V+o%p- zXkZ+{Mh|;MUp4k~UA%NjJ&RQ-1K;~-i6IHs?mTt(v>hl?>6~hTPLT_RIZA&YCF$^Y|m@yub8j2 z@@M9AR9tA89e+ADi5Xt^R}X5(eV!6;Nqcuj?3{qWmgk8)%&6D`ju&%!FMo1i>obG+ z(T+s*sP9hXaAH{VrAn{J`efzl`j-FR#1*-LbN87>QIgil+g)ZV6nKuGYjWxL{4hhn z9TLCxlaMevz#ZAzFV?a1r*!FTdNe7blo{Ch#w^x3t9WQcyf%j$hrK~_sXVB~G&NXW z?%wL0b4)e_DHGwKm*3a~&jlGoBP=yPc6jRab6m`^2;G$m&Rfq(=jU(8i2Bq>!WM^} z9CmZk1v0Zwf2IEL(wZ$Cq-Kb$36~Lr&xbja>d{>S|J# zo{ig?Gfv_TT0Y4t#0gRu`DN22wj(69-)O(W&B|Kb#>k7_@3LI~%6x@9w!h9iYh6(|mAAFq-^s#PiGU35mDP zozJ&exi@yC<;$IW%{T)s5HLx+fL4?9q0bx=z{4$6ka(M5IG0)_e`l^M@S}U}2wjOp z{3Mk83gm@|M|^MTu3lb~CY^4sbgC^4=A1qd3%G(Y^q6j2+d-U zSitqBRv!~OS9Y zVcmb9$YpILa-I|3mNm3tf+g>dT8Mwx!ZqYF#v=U2p`|>?^;3{UyZdX@^pgw&GZk%L zAF~BcZ(H1CcaxUQ_Iu0~*vxP=tJ`Od$=b}~F5P^mewtmnFI2+wS46b3#Lr-GsPc)m zMVqHt6SvBMXuA7VO>t%S4zX>vVsAgDKm7?4qE*&qH6%WBa%#Q5!a@?wgnBA5`H{`O z!1eoWufBfSR8;xqTGj=@tpcsLDFXdvCc8VIy)PrS#^sE$hQAZ!dqxJ$g@zG%4DHq~ z>}pL!^eV@Q8_}?dt4bN|=H1wp5hB(-2tsOjS7Ny?8QYZETwCDgoQts1LV&b2eg2-3 zl+ywrKbFeIAaM@jArsin2C*PMKI|=gJf+5E^s$uTxce=NP=Rx2x%^YwPb5b4uL@PU z%umzhSz~D`Lxy-Hx1?7JvbNplXX@k4VC%EpQ8$rlF*nE-w=1qfLT1{Lb9ublw z0ZlEJzwkyY`m|6t)di5;U0pSk?4R!`Zg6i*d&GMA1mB!Vx|*l0+t%w%G}(|Dn6EXR zb(lt-RRw!Q#p^9*+JK@$;WS}ng4B#sA8<(pRX1G_8`+y(3x$ykVp$zyG3a{^CY)8t zqe}WbW34j71xy34PZR+PpIq`K?zA{)Y(P1<)$^paj@kvoAmxUHTa0Mba}SwhLpA>nffCcP}P*aj!bRuBsk z)STV3LoHA+;}jOrOvjr8we(RTEiswXWH}_-opx61Gc8Pz$OALr84;N$T^o3Aivx9> zP4r=F*<7^ki;NJL-3HcsUh7kc1?$R^lDm7mu-9y*#K)+^q#NTR^A_O5j)xXVY39VGndJT%4|iQK%y${y`y_+; zl=pblZkTN1^Ut3@_Z&_Z?m66!v>slJ&R36n6BTuvK!=!;AsDL$N(R{o8rYInA(@Ez z3C%c#{y^P2e@og-q{Ec5;0M|YWQBSSRY%7~`>3N8FMpgB$PmBt=4TO1>@^~~R_ct( zA&h&AxuWkXZiO2r*~AnKBzH9s48uzoFNtgqt3<)J6Q^8<{hqXy4s8l^juvMt>|}s0 zSH;#ji0zub%T7e`&P9Y!@WYCp9X; z)^xo-%%P-~=p4o(cAEMH7hnLE)vm71v^+#&%=NCy+HEg;!qtaL$9JUWu>)QWB8_VZ zY<^@^hE%3z&C_o2t=c9cLGLH9o2X2bcS{*&(0lqZZXic$K(pAr<_Kce)&&*kH`#&M zdQ*%+bD$zp$0K4{9XCH(c?Yds4+0&0lZS_P7#&RA`sNgORN@IMnJVWm55;?$e6E#R z?w+K;1vxaV5dU~i= zbeNr%NK$~*_xmgIELTEjKrGluHoR-LZl5H0@yL2xrqG~AM|Y#yZVL|{EVz@AZ>Gve zx)%<2%t^6F1P|tWep|@ zyh(9wUu||h7e@o$2QG(3XR354k`zw$-FFqmRiny#cXU~IBr2>NW=sxW>Xw*EF-=%v z)^$D6A}6^asXcL%9^%>M;MI9};G~q-z;-8M_o;UFR7#~eN1QChH!yg}d+41DVx=56 zzO(feR@vgQTUpURUAI$MZ-eoTC~J2K$D+$opi@U;xGo$zHa-2ub(%rzEn8_4t6eCK z&Gs@=(^S?jS*4)oQVq($H{8!p&$U{Roi&jCA^wRLmu{P%@!3zz~~1lIb& zgZln?q;91}+M%5nl?@u}WmzR#w}!Sua3cDPJgo6^D`?2yvOizXW`hvO7BN=)(qyPm zOYCdQvHR=0lbq|jpXdidpRJ|wBbSHD$;w+4b?&;gT`WI-uJ&L~M|E$@mrlY)XMrt$ z)R+&XfI(F{%TSv4m7|jFlkIscEBJATI|243{saicR%hKR>R7swhRlVnx*>YrCzO-^ zYpmODIjot|Z|}P;`$a!~OcHbh;_*GfsQA2`epev@f_i$@@>Er~pzF&(ACIj2$+BY= zuMNZ0$3kmk6`isS3p8z|cK#({PdlCFBS|M$;|}Jgrj!&G-PtY9$JUvw7&nF|dY%*` zllz(c0_oTza5vz|SH5VNBI%x^b1H5o>l0ERq4KxavNYN~^aPw^&+b!|5rDqa7L$os6+mr%3^<%D*;wJ}-W2Tl?Y**}7j=@A zNqf_aSrNBpBkT4tyZ9}RDyF15A#ecq5-R_oh4riUtcH9jidw|x9h&tfUuCCthsWSC zn)1DD`T;KspSnpnl5Mh)xLl%Mia;P%Bx^fHVjNqSJEEo|9c%YzL=edbhjkF;&`qUyiMo zLWXHrKDE`mDFp^jPPfJ9Adeh5Vw(17<6ds%f&-XCTS*BECqSq>v`M9^>!;G7 zkj2E&Q6n~Ol(x1ozHBz4HmkmTS`w++Fxo)sHazDpi$#mw+^kva&}VFpDM(xonzOn$ z=iloXpI{k_aB%Cyd0%K8h-fNTE?2o~PrsTz^fw#bXI*S5MBsvi z_ZRQBLB9^M1IZ`}dih&$70Knsh>rpYjvcS!c{J_-_Ga? zdw{f&i|iMk+OC{A(OwKF_BANB*O%3`Ar$cmKgt>?8mhb)0P2zRoaTh%Ik+&)^p7O$ zzyD>?y8>~fCNkn#g8fD;S1B=)U9Jm!$zURW9##Sy0D3PCMW9UiebMgDM?8i;W})^61ki!0+H_}+Ijz@ z>HP-HEX5D!IyCtvqk%)eWEo|{*5wQi$EZ*@Ra)LCZyjPW4ma`g5#%C{OhhOnJ2A=w z-Sf&@W-ww}d3w9=Zli*sqJ|O&xcSqIhEfpkA>L``GuMCVE`W-Q04iE=Nh00`S=L-Q zFhog`(xKDepQazJ`c{EouMVkJZDEpVfID}lil;LVWauUW?5+iwT$ffOInT`XdZc;% zWPj7fhJWjzPhUvLg8>~8g zfu)RUsP_1XZVtovJWF-j(W&(~LQ#<_Zp`YZq??PT0$HcgF5^S)7d2ivwitE!Yn?v9 za~qx0BS4mW@wPAlKcP-N`QpL<4HGqA8)pclj` z9D71*O{I|9a>ak)eU1Br=VhM$F9hd=z>(_b9#*(C1G&oLRVA{uPge#1@KC^?hU~-x zLFdXvId`-R(w8EZ59~B>KB@$8)bHrl_Eai^lt<&en?x~3WPVV~bC!6PXOyIF2@kr# z2xVNos~X&@nbaXcCz9Cn9xS7ti4kf4(LdK9^`%0hWJ=lTxC#Z`=o>r~7wb5MokI8w z=}&yK@Um%sR}e%MCKp;i<|ooy3sHKb$el7PBf}fUXFEsQ>Wk57{~%V(Hcpq}o(Rz& z^Lk|$IiN)UE!5rP!Tt83mbKbZe~AzsA`eknispJ8(i{^ZrfSgOIa480ZoQCuQTS_N zkzH4MpCHe&S1WsTdIY5d7$zZB?4>qpi(OwBa=$&KOFtfVftZJ)zOGnlt)ZZk!C`q^ zfhBct#+tE=G`eEAzj>Hdrb4!k)Bp4%9`Ag$WGu6t_BptmHV;f|{MGRB`Oqv1HIqy8 z1HMzo-?bb;22!CEc3rm)z2rxU?^kSAv4e6xRCI(}5=WpT!(Mjecl5R&tFsYbi+2^E z(ly;We~sqp?@ysF#QWH~t=3gCe0a{|84|&;0n+BPTI-6bWnuop=c)>UzaJk*M zlxrBwUGzfzdxruF1Zcu;<0 zwLt-rJHpI{V)ol_s40>D9_8*snx8@yAXUpTih#Sh!=%_JeNF32--M#GjYCxL+C3N^ zUS#IFf zd6_7youxl;r6aQ=>$944XVGp+U8V7&M<0!YRdTf=q~j{OhXj6&1Y)~YmCnj{Hzzac z9|w5=kf(Efuovz%#PwQL?m83!Us zo7mbk9i%OyJM7Uqm`0tgZ7uHHy#Pb@8-G+$8&%@=eD|R&oc5*WG!+%PPS~iUh??8t zD{p4~2$(M2^yTT6v0|d47P>9j$TKh98)9SEP~IIP`z;V#P5p&c%g_(KE3u0b_ea?f8PiT}pMuN=XA{@uu1 z{k|vUOqmYwu>K54(-se}Ot#DwL>o!*qu2PVrZkI`QiUfZX*#GGlzV60bU1EY^XWiB zdbYRq%xPO?VsaVkLC=j*C&p2?F!wEsZ2MaN1U>Lzv@^8|QDhXI);XAgPf2dfAX78v zpLeN>Cn#3JaoUb6mBlcy)OO+(k{%L{`4s0z#)+lMw8L=$#Z| zIIrW!;Kj?l-*JmEyJvJK?3y*j4k_FCT$tJRd}vtJy3 zo)^OLsw`N>wHX;}vwY&M=N|`g_yAvxqKNIX^QG+8m)Dq_9hseF5BQ@uAZI`dpISt8 zsk?>JLwBCj@$^^D+ahdnVmWn^&W@J2ocO%;rGn%IW2<;>kq8 zge|;Jx&-Qy9%05$P@rY>Ey6johe&EF<(4(*HL?9p==Wp+(}s@o&weA=&sX_Wm!$OX z!?b!rKKXIksP?E%lmGUV;9eAmtoy`|?Yh2Ccd8WW+B|9vv^JrIs(N1c1ZYeG*pyAS!8!RG0)q6z?KiI{`y9Zc~(_W$JD|LH(3MzSx z?jQZw7PNZ9Vemb~!-iMzPA`9tEr{rDCpXT|TiG4C2u|1U&C~mW;p=4?dR3n!9l_D{*)uV25lXtF)_+EaP)+!whk7-$>2h;l))|=ZiYP}({yql! zVS?;`RpGbSv%JWV5H@Au#xS^Pow&Jey1s%jfLh-N(W()#N$oy|N?@m`*0SIFqe zys#9;+v-VuNb4x3m{3pUp4R97cvjKp_Jh=()uP1YdQXn=&|G$<^L)=}03rbe!e67P zg0rDJ$w^3N5!&}gtQ4FIyb9cyS7ibx&)>cZ|DdYf{?yS;YJ&ka4_7`RWz*b80J8&k zNb9|F%lnek`B;s0P?Twm>ErWIvsOtf6tHX}AYg4&_)A)ycx%e)V@AMnjm`0Q@gSvM zHrzqHQI-Y6V%)ds%OqZp($!R3hF?N(S4Dga$aEp{P%x4jOrGvKj3(hnGkC_n*%`>{ zz7Ul|i9d=N@#uJKa`viA!-FR_wqgXyt=6Zu4ur^i;1p{MA)+&C@T4zxneSiwUiH&g z2IhH`11J=%-DsQ>dULS=30TGxKUCpax+||kF@HkB?OWP4CMQ{AV`I~)O#PwR%etQx zQ`Z$9$|ixMb|%UYIlKCMg<*1bil1{w)YGV=2Hn@)g63a41srA*O5NjF4`*#@u=t(`vm_tx-hF7}(D zMn|`BIt2s>Ju8Z7n|E)}nb?%uJWX90{bk(_$m5e|bQx|ZgGJ1}#^7SOt9ZtG%H0du z23}CHH@NE#jR^_#*AkdTlL}YKkyNA?Li#yEEJUDUv?$V7M2uk`oS<$z7Ylct>pfQdzC)V(*y7K*%O2+(hQ~ zP)NPzX>bfly(xyYUHPbRv7^J()KpeWj&$Q5QDLsZ9aYtu%VI8zm*R!lc|%!{4n)%Q zBVzRQ1dbp7QY%nN#nf@(6lHQabhU3JU34z%a2{CX>X#3`#pcczmss3;)#Zpm#0_>^ zpR5k75rX=CeK{8<@FLhUuZsbD{+wK!P*aVsqy(ucIl>O?lRwlyD z_qRsW?OaG+rcdchw>dnZIS}~cp}iIEgS~Z!Z1B*R%*Vz@hei#rI57U!tvOA084}5x zk{@1y6w{hDRv)e+JL+$E&%pP*S@XLk)))NJrzuwD@0fl3@*=k{3PhU;Q>1U+gMw2U z`kK)D+HMtUr)@!uaJH9HwY_p)m*tqnYWZEiD{{KNSHztA%&UQqTjpvcX?H=5+oC3Dg1-_7TG zh@P_c(aL;!V{Cn?@5qbVV+|fdwdRMdd;~{5IZX#awS$vVxEI}YGBo17nf@#ip>~4h z_h$DK$N5?dZs>Q5X7XP8c+i2+k1dD5^v;2Tej42@-0apDk4o_H@oZlXNqyEX#Wz!* zo{k9{YI&Ds*c@RR3AN_p;;ClO@K44TXAqMH_3`Q0BnoN^a!94LG8JZ7@dRzY4t}{h zro0$`dvIdWvUlnY^%;c^!6^fP3xZAZ6Md}Uyl40l3K#6iR&UQ}bw&MSrUo_oW{=#o zO+iq5=S)I|`I+h~F3*62>l|G+oJYKokox@`_Kq#}qhe!67#SPke5R7yO)%Aw7wcAT zP>tntSDA+sKqi>XaWU!qV+++BB|PwPwvdWY*|*XsETuCr3R?kk%9$wrVhTaEi{S*9oCC5h7trnGwkMRv=JJ zotPQB?^K+BmwmMK13|Rtg2m^92?a!uj*GLSv*GzHyDgO~y<&Z{B>{6uO2TYi!KV zIMnNL$aVfDN#-}jSIbvcyl!qey&-^AW)jrO#CAg@I|1!YT}}VC`?-ueb^8-F0#9iU1XY?uzuPAtNvH>HS{?2Rxb`sGTV3 zpK=wbW_O+cz(ku%C`!?6G6RE%?)%*T*Msfa%R#kguM--JM4i z_A%_%fh21y3H$_T1Er^fj~j5Fxs^oep`RVE1cH^=Wr$5d^?T(cSSRM*wwF&3rH72Z z@|H9KsCt#S(Y=ONO;JHm|HJ8sJpqwu>R4MfoIsl#J-|jsY4&0WY^%%wR2v${nt%sf zkz6mqw{7qVuya%_EnV1MDs)wmWo4)+Dr$|8o0@%tBS2`5bTCK&bnU)wMe`VHLaZ24 z#9w!w&!Lx@_s={Q?kMj~;mk`!GgF--JqPcr!49^wgr!UPB4?%CyL$;R=qt!RLAmXq z1L^1~)!bFRI{(|`7orbvX3xD;b%M8>Oel)ProxO4^cMI)KR_RlRJ0Dhd)$O43E?4S z8*v-nV*h=wssP$evW;K8<+l5`hq>LY2*GR6ty=}K_Q zgbBX$pPXFh?Ai}-VDFoZAO1R*N$;1w?pZZ`KxX9R`Jf5ZBgW>#3dloOfHLsEewKl6 z5K3lLbqD&9zLfsaIzh{+TK!s&B;bSt;ho1n^c7kXLo_l-S5C{>jVe2ppP3%klr57Iw) zrc^PV{`i2H_6gG+GKwN6yJt(?Zw|Ek?p-yE{tif=Dr1{2*8^?m3bx*&$y%9$WQ`bJBtvR6j6U2u) zu7atZoU?Axs8~>#y#%j%lgN@MFNGLy4F-1RT&g?AnJ9qBvBi471e=zRM2-(Jm zDlIO4PYxfb2?_a%#(Mh&y93hMBcP9%e4*e~_WowFryg)Zy04(YN;J!C`Z)t^mCztjtScZ(frn00vi#9o!+{^j8n z_)-E9FYL@j%}=< zAkTr89w-fd6vYWKVHbOPcQ1-cw^MhEG*^Um_3oJ4H2+9LlyL2FxcjtG2{7k10cf_Z zC(OHfPsG3Z$sR=@U2bJy1ytv!rd4e*$Y)k1Z;D@T-#nTDo>~mru`De;Mv@=xmzjO0 zIz&w!iLaTp2yWn4T1&p>99Lt|{xzj4g6oqTF)gzmVZ|`pfMrAEADvJ6RJ5&@B1V7f z0Uf6^&!|e44iJ}kJbzK#N-Q7#%mmB(u`{eQSm1{hLoYz+kFy;+wgwsFZ)o`J_%@yi z;&HXL2fvG*f3#af@rN+BIH2TNY_lhh9F(^XNeHk!n_ zmqd<))*hqjJ^%QIxNIS|SM=*Ld>oBjWM^@#Fb z7G53;%2S+uMl9b$Yp2y7t5olI-#%k(oprZFZVlBx%cx+|FcK^(n}+x7fZ%4&Tz^aY zzg{t`;&tf*)bAW>WW0RaAf6JTF0<^*aB{UabANS35HOqJo2+b^3@)>R$B(^g%HX8I zpLq2%E%rBppzrV&U|(J*n(-;Qzju=ZdvuUvvqAaM#!>(MhP~T_B4vg5`B52}8N#LC zyn{q7qRJD!z~r9G3@rb4GXE#LvKR4F21M_+-h1TyekCIV&z+g@IK_~cZ}xAX1G$bY zOH&_Yu~B~*=B>q5rRD#W0Cp@BVtgPg^Un0obyO5WVo{NY#s_4{6SD#%rSRN{uqS5&c&+$XFji2>~hmCyNqCJ_I| zsUK2*h3`2(ey>$i=UMUkQpCcm< zS@c;4Fz3ICVpnE&2LrfOB9r{aLvNu-tO~^90n_YjYn0o$ zo0tWqG@>rQIefB^rnMgwgBYkEtk3&5Gu(eqo_-p1A?uyLPIOGcx}Dd!d+L~v^9Q01 z*FI&E)%)gBd&^2JI&M$YNr=oZ@spskEe5O6@L`0fL);KEUZCfs({qffqhMg&nJK!v z96zojEh8q0^{=VC{1RI@DC&Y-m;t%H|6aonX}}4Y@KaC5Wz={P}xY z=~q|0sPn>4t~y$$HAKsl{ly;YGh|y5iWkoChG2(VA*t@5E@)p;(UG{hFSFr8fc$@P z1O81XszmYR^BreYH6kWG7 z5KEF_&w{?is-Q|aLX&G^UfytT+pNg%RW6Jn{{|2LPV9I-x`22?bj8^Af8k13D0GTp zV~e$C8cWdCfeU$<8CH56XyCP1edxpEz8)+_IpP z6O-84@eQb8xF$v*8#FiKTQ>g{?*2~v`H{T=5}%&jr;_;^lHN+lAnM~Z7&*)DyT{jx zd{I@2B0M`XT*PMl_q&SB3&UaqG}5=Q`mM>vB7%HY0j$dh|)m6 z{{2uF2%)*7qCR!IFhwL^jy%T5&VWoh5UK;e zi>g$1Qxf}rt+0d8GI>w;|9>023SCJEQ+>$m>3V|I`7VfpG_!I@<{OUo;WM8o$J+!uJHI+W+$PG8%oGtVykLZ%fJ6^^t4}vb5BceXb}NF& z>%TDbZ`b`pmDusbD*3j0JhMq&(bgFh(Mlt0k9Lw&O2f7@3ItE^ncJz>(!T4S(6@G~ za-;pB({X}kAIxOMf+3%Wyg#pZ5!s#0W>ws?vXA|*2oUf0{ht480niX=IRs%7#t|D^ z%2jAzM=oKQeRDBPpq=6;eTrkz^0g<;ZS%>;X{YCR()1onNa%;PZ=TIq)Ex!9d@RU% z{m-M0f7^0nYxiVo=ue}!2Md{+hZDs1>@HD2hrL0gb;PjE`0FFaEs-^r^34>nW7QCaV>{gWuRy2)TzRpQ<90Enr*x9CvQ&@O z(@6?+*!11=NBFYn-P3ruOI%QA4|GE>lTC@8R7%A;Rh8u6jqM*BHvfFeHDvi*@vXr^LF*X8xqjvT zibG|2e)J=AjX?)G#s1r#@2EgN13Rkn=bOdvPmJ_Etwa|4uEXO)P_g&|NNOhYFUgvt z*Ow+c9AnKG=b;fDcm-&}C1awIO~wdfQcW6;kz`4RtvIu_khE-my6R+7o-=Uoa zu;`X{FlyZ*@6fkW?**Fc>yIlDyEQa0TeM-CSyF>j3?p2bqKiG zIy$AXOfEuQ5@cct2+P?z3e28dthSQqaS|Qblv(Hqg&Hg)eA3nc3*78Lsfr-CRr+3_vW_@ zn>VFIgRdCDIO0{W8{KMgSp>`H9KrN8st=C;%!d6FwyOvzpFe;8<~!Jbr4t(xS7Wci z!r@%eN9R^3?-f%@)Pf@SX6XC>0B;;TXaE2J literal 0 HcmV?d00001 diff --git a/docs/images/platform/pki/ca-create.png b/docs/images/platform/pki/ca-create.png new file mode 100644 index 0000000000000000000000000000000000000000..35096c721c05fc4ce838cf2cecdd98c032aa41c6 GIT binary patch literal 597678 zcmb4q2RK|^*ESI?TB;s|AdEh`K|+w|EjklKFQYSz2@x%N4<y^l^1ZH7@I z%4nk`|Kxd|_j}*}`@jFXzHsK6GyCjy_BngjtbMP0-6v98Q-$gp<23>T0;;D^9_tbi zkRK8dkeHE?;9DMDCUp=HTq}1_RMdW|sK}=60kL&(wjm&R5}A@ls;#$48}usx;-5pz z&c=Dj^@KYp`ML=K@g^JZJ@V_S5jDA?JJ47~0J-0hTUb zrB}nPOvq>Ysv0m)f!lgkwe>Me(RVQ0wS&wOrjH0&)3Y>aDD#@JvAG=)|$myAHAYByJg2n=5 zewsAp#eGwWfP0VEf1)KQM{#g)aB~ITlOT{pP!bfmkK0Mn5!A{N2xO!CIU7-OLmM=- z@j<+!SEbts-V&%ir(g~S>|JePBX}L;cAe^G8>o$Fla1*~n?ePB34zl4tIhPEK==;2wup7g?p!TQVkc zm759rk6-aAy-D!MXDm`NN$^3_=03Ezmn|$wN!8glYXuT+e@jnEQ%z8PyP8%nvZ!6u zQsB9(F@K?(k7$l)4%z93x2?E&A&5t)=%Ury zY?f(PrdR7wjBa-B<_#_g4G_EW!jkAln`EvKoIVzAEcOqpjRV%NlcoDee` zIrl_wF=qDUmFDi`nCBlku8Q)DN@Xx)aAuH-$%v8Giq;@%t!fWyKGkSC@NAHMLyY9u zjm=ENjqZ-Os*h!NWU#-jvQ@oI&eW50)S5b;qP3@UlCWPI`Qresc+5?>Tgk>%M0-Lh8V~+0Uh;ChWl4!)mr2)vNwP8zw57fMsoJ(%<8iA408l# z7^Q+yiBJwuYBEvMk5e{Ng@)OL*-?UpYUuftY4cvW2MgQh+ue4)FEM8`=^*OtY{_ih zG~UpD8cE*&+9A=HvB6=u3*vuupkmrluC6#ohn>aQ9f?*!Vc$JFAqv_82cWb>dnmhHVN49n-|qAZ4y)H)s532qpCD zU(~y}p1jQ%B3n0ExA86cl6@|6lJp~6)=c&ViwfxHVa?Id;ll1$`A(~_=RH{rvKBoS zX65D<*C1iORVT>BYpfisWm>gJAov!zW!GX!F7*x|#5?F{4!NkcIZI4TBd_hkh89Gz`+U{LxyHjQY=~PeJQq)2D|Nk!xK-_5&0%Xe3}@NA z-Y8im`-WCb-tpyRxP9x!(O8@npEX+8rSend)5_XPR@4Pb6?J=m0+rSURvXp0&Q)`N z^_KOm6E5mu^0(DcO-Q1euFm+kMp{qoxRfz+OEQ&r9T{>7eWR8=J2aXR;fXTmhsIFv2FGs&) zU6}_)7z@QrXJCTsbYT8UK^{Te=hXV+EiG#KXBVPX0^a5r|Cu8h@n!J{ z@r7?2)s+SM%{A|9>?VdZG;E@)R;x}jF_0GBA7(9{6b@0as9g4vT$|#}X)4oJg95|F zqJv_`*@AkP;kvka+&tvR-Z!0Ay_a_VBZBf2FI!px_J(@3P;Z>;!jFY-$dj%g4!=Ti zYC9I+nmGencW&+IO+KDB`{-R<`mMbFW#C;i?s6u{c(3K2N54Y&kLr%TFm6zBhPU0r z< znpsOS1eGzj4m8cdhL242!qrqzD`jO(GiU|f6Vd*y}wpiaAnVjm0QnAF^C!1e1BTUb0r%#LL$|tq&4v9}z$I5_@w@T#=Nd%k8sV85pSVwvndRtYWM? z5K=hd*e-7aOZ%m^^sDA!`Vr(9To0g9Hw_GC!XwyJ8>6ST8X5$=_M89f z%l=mnY5e~0W5)l*;;m7yj_k_B7S^Dw2dUE`Il7F4&v5lv- zhl87!1H_f>_jxU?Al_cG?Cie>`mevguhYiQ;ol>8Olh$_dvvD?h?BIf*YW$_iiHM0xg8mxk|2g#UEB)K_nWv41 zBE$u6=_U8?FY6!U|2+8L4gVU`_}^m+i;MhUWB$jX|1kZ16Vkdio)Bm6-;?;v)xk?n z1SI%BHUD=j7#z2+QA>CMW#Q2>;pkPk)f$ z?=Sy9oZ)Xz`>Pf2YI4^=g8${Va@X2RGl2vI4+)+=ex&b5_`Ml=;bQn~?F%Hcg@at< z_LZj<7WU7yGZdoE*dFK;auVw3Wb5;^=svj@GpnCMmYh0W=o}Hm7L#jl&mQsMV-T^A z7m3c(_hj+!gEGRdx-uqaE=cquJWFbQd`ILki(c>^l95^KvfA~G?SSLPpTKXecYS4! zSV%v+s?6La+f;up@l2pTC7k^m`Z!Bw{9N);@J#Qi6RCbA$N z({x%V@!7{x(;h(k2A+BM`PzYyH3pi|aOE%8KkWwes5mwWRXeLe9>u9JN+`ye_rTKo zRa_8olm3J|qjc|9dTZ2DNEdYcY<9XONRP(Ta76t8t@$wyeyB?Uy6foBlsCH`G_ioK zPv*c$-9-rFy7gXX1m0hX4Mbe)MuUD@G|RnaKt7azw?CZ1P*~2W<(Feas;KcHc<{$G zZuTCK^7O8Ar`y^cvQKeD2}@R-f~&c#ZX7?3R6P>*9v+}}J#WR1d_B#{?{i!tf||6U z7F;_5N{9XYSoltHL@OVTacg>3YLcz;Bd4+GXSQQ@Y%YO(gI&v=`=6;OV)wm&{Y;=t zfkkC6hs)kY84M7qV>#+8*P-{>*{=M-RuLa0c37EU6(df?ImTus^S(EyerPBk*+66U zt`=Rvm07f^{wVyzKYR9z#Tfe)R`;{DH@CXK&OS=) zS6-mU1c%9?K*XQ>njZY>>*r!F^q2*?Rt^d3oyAPjo~%z4`n#Sl7olQx!0AA#Jen)~ z*0YwnJHh)bl4`(0c$+Pv<)dNT6=8C3T<I;%Bzd?QV%TT>l11-Caf60ThMb?fPK z9GW^|cUhS_`zk*vuFU8*4(%}>0OV*Q_}zs^Jb`i;23CiB0GM>ACN?rPWQr)jJEDBe zQ7LJ@$%J-36?O40R|+(Oco>G94-%w#qKP&HHM)Kb)hh$Q4@i=>uo6;AkN(8532(e* zTZU{zDd+l~=+;o=aK0KQV^G0+Ipg9;FR#B`5nCDm>*0u&~7xsJWykajZk#MF7r9i^_*p7W9{Q1#8I|@!T%{(;^>r&<`f2Vg z4^0JhDdeCf52NY6?VYH#EQGbJJo~<%6#}B{)MO2aB|L{-Yn335Ez^= zue&CWU=6SiU}59v2DX^=*Y8=h(TMS_Fk$-&^-GxkY)*|Hw=Io^Pha=q^`i+tdZe9~ zVEvr|GR1T^gWs@T&qyHpjSkZ>G|9151Te`IXb0~4OFXg=8b`;vL=T0cGImf6e3#>460Shqa{r__ zkiD@&t9n0BQw%M3C@#}D%!Bg)^(C)*ar{Z7V7n4UcFJ@H0nl7O>HiZ{l9A(WW_X#BOy)B()!cJW1D z2rSjfEwYeAOf%ph-OwubXw%u>KaBKqmK{vd`MXK3jE_s=;nmAyB{_p+|L+}?)N334wWjWzIUg_ODash z=A!PAF!WFwoTv)pVi~G0C1qf--xwrxX$BY7z{8&OT2cxRTh)rSxavx+$_x#WWyuO? zC}YsIi2-Q#R@ft2@M|$$mI&-d)R{$U5@|v9L|C?=LhHkK%0T4h{ghM^IH6+P#0;3E zCD=QQp~?1F1SZaGeaffzWfJm9(k;}!=<=;+^@e9RS^Rn=rhKB>123fa7rK;Qx-oKl zEmHiv1elRroHixg!raj+)7WX~PAx;Lwem=e#CZX;-|FM`(VnVh%!RuEl}r+udE2st zSi~sv4?C^c?j*$?j)3c*vLkwe0j-iA`~BAMFg^%6<8?XA>F}_j+11An|6nWlYk~uL z7rSroDA>Pw?y1r<2uKsrxf|PNvIOyK_`0}}Hvb;e8HfKB5tQZ8aMFo44?*!b;Ub=V zSl@GtEz|u>o2Ba=CxhRv-2RZbWr<5Mea~i8t`l*9-Q4hA-pltZG;-D%$GLI7QekB>Cm`VN^V`IT+SG z`}Zrk3;QVH?VgS6165^{VH%_teeOkxX_y+XLq&Mz`Nu>^K1cR&3X-XDBK(+XWv|$* z9;4Fa ze_(}xrzdhph9b@C`ftm7m=>gfhsv|QJW=|SIeq+`obaV0tBJ~}HcFOxn)T661q5e5_?y?#>mL+g}A&r7;Y{KV$E(qns&M%qP~03HK-CN#c63r zoI*t&7*~5I+tS0T=`5lIyAX^ODSc{N5^4Q$zu}1MY4qDivG?R5&H(od>5zGL*{c`1 z_O}_uXu+<2Y$O|s{WgutSt9ZiD-YnqetQ%VxT_P@ZZ8Ewz%U64$+?1U#-+DeSY^3S ziy7d_3_Gk@;B|Btl$l?S2wiW&pZQDCx|sBWJ@)y*T4Vkn05Lpjs|b1+sL1-6&#jWw z(lmx|dSMJ=-#5*v#=0MK$Nbhuo{7}M1=~nlmxOTAXtsGnvLJXRqr4zeZhg|%v1c=Y zan0x^O9bJW1E|(H9uQkI;8jE2M951bum|$m7Skzx_PVl#llL&TK7xC5 znW4}2y=w6yarYFw3p%_@HxKPmm%&hQ%4myrJcDmDq9l{B8|I`Jr!p3wM(Ccqt?&Ua zRt+O~+()}Vhk*;Q&BmSi{@2A4UtAqkR~9fW+E6`pdca-lEGp3=?yc3(a$jFdy7 zXVXp$cPBb{$*GeiI>4nEM8UXcdUAdrJi>${hokHC)f`6TX(HHMDYSZu%sBrrN3glN z#dJ39Jza6H7i&^|MfTi)YwA_=U(r>;X)(g7ugpcuLU+dic1NFoz;N+^CQONRMrpGo1pyiPkSV|z0Vpn117Lh7Ag zP?ZtUPV9ld*p}B4<+M**G>Ujs3czSY%i$$^)M+(J;*e?@HfO} zqPEgpnc@TO|DlkKSq@ ztOajInT(C}SI?e2ggEp=O6oo{2)53z?25@AzX5omJ>Oo4PpMnr(g+}b=$vkQzbCm# zgLsGD-Y{L;%M`taI;4aY4@DM47wB9qmDr1#l96W*DbGXJgdBdCF)lSWO|Cr)s$RID ztc%(Aa0PKT6U)lwv;^KN+$~}{pWO>Ws}jic0g~wCmwR2-MO*706i$X6xT%`W^Wcqfh~ z|ATV~4BI2e?QmD|S zv?MF=0X{y2u10t+(DnxB_uoSBmG|xkcYN>2&kP2)4`6AM&7>e`omBJafb=~U^K!%u zt!z79Kmrjn>J!oqIWL519RFg{nQ{l8Q9U#E8^WfivP6-xk+Bs&vRNaYs*=GeYQJ{NV zGwNK<*Ly(8=sMt28FTV3x#zn0>%(NyL7=TCiSP6C0lYJmSH6P8E1E3%DBPtQr01bg z2s#`THSKoZeakv9q5nH_0nNqFE5s)V<$u)Z_XB|@(jY*Bj|?aGL1Emx+^4<3c>%SQ zsb}yM75QQRtXbgZtc$2tJCG#Zhqvxe6ROImJ;<+LwMq)NeRf8k3&nQfmj@61of;fg`83` zt%fZ+*-0ruuM2XwoUR9jPHKMEq)sNl!)o@J6q*|j-j`A%b`^PJ+h!RpdAAQG;IqS zH{#zrzAOXTNw`K_*XS4vXtL7w}M-w>}D5$!+cCo?ScS_kB5la%yC9@F7^#=g5wf0rd1^ zxl^)L;_N8o1Al=Vt4AkiQYnbBlVyW{*l| z%Asd=@>um-fdcnDjV{^6$rvauGfldnZUaG!)3;ipY}Ucv;4PW zyfmk|a80uX2#1R1?(}{`v8?@;L~Z~*?l)ghbPxm!VMOXf#Yq7n4aRr51;JLVN5dYK z9-gdA`Z--h2LzeC*%E@IBMR9}LYE#?EO^9=X3)AZ!i++Txob7@YduSfFMCVD3O6@mL zNyI_ELv__Ys{L7T5NCT%6*x8*G(sb~y{s^(u|M6nydT4)z@GL}S$em7qp*F^rIq?p zMCn6AZcLwR$28L!9^m?E^8#4TqGhw9H&zf8 zS@58Q4Y>-`Y>A!-x4OylURi~7z`e)xXoMrnuakwAC#vTn0GEJYsE#(bMbhwZH9T8N%@Sl#^?4fhov6L zWeKC8mbC+ixj%4)+^YE`-DuKcaTuM>Cv8x}Tf3j2G84%kRb#*uC}4f&J>a71dB^e4 zgB|EQtKSP*X2PPxnH+e^k=z-6pj&n&(`cI{E0)W!3x60#Qr;@l+Ug|P5tRBeLhxm| z1?$bff-hzB6S-v6A;&NyjzmiIQBEpPOtg0srhjm|T4R$A&W|?8ZslXfefPmL;ib>; zP=b$Dw*IRDkQKMzn7Jy^JB8|@;3O{F43qk$Kz9&bAj>i>nmMs5quBIv`NPG)C$yo^ zdfTWcQ_p5zK+;$3k<}3B4qDCXL;I*oA^w-~l8?@zlz)1RW=edL^Uo*+rt7njVWc&x zk5Qc@Z$?PL48^D;WgmQc2CUcWZEA_zWRL(JAY#4g3zr@yRGVXp*v+NLt<&qeD#vH6 zvhb0rg`-`yNpE-w0F4s{lT(y2B9VW38tgq*ETS0;``hON8s1xx{ zo88PvzDt`CNMs)9tvduL*MH+HwL;|trvhu&jAE(aAmj#>=SJ5aBOUK&KIh%p#gSCG z3Fos8ZlcbR$!jQqRdmnYO}i;SOB)2q=7i}e>ekk|<@K2-={#YXLsIFe3DrdIZWCI77U z592wzfX1GQ*TdV_1Vgi0XUOJi5E8(5O$~?^Ua17?OOG|x8AAEp9t9UBI28hkDQ6M< z(dS^zS&sJIgB+sT+3#i5f8<#`jG8*l=`wOb3jR})IQLzM4(Dz>Xxl@V;rWhxa#AnD zJP!cX8^HKFxl|h~=fU6g2;0EJ!DO?iluZ>XCDiaA{1uT^j75KlB{+YF;entq22sqi z!Yv}X1qsHOyJB*f8+O0QbZc1}D~D@xQ+*I}q6U_*S`0|b7N^XT`P}VWFor<=-TRgB z@0|EwrLwF}>ZX|8a|Izvfu;=_RTuX!E%_=H%tEfky}1`*;nLmwz8msF>7G9yZMyW< zbnY~%=UYkn#1(gS(jsrf8X})OTX?p3iAlx>kV8pi%HkAbSV;w=iqN%~)7O|sg*7K3 zgNkJ<5-D61>ti9KL0~Juf*Xn1CD>-$TKR7FvG>GKUsw9qOcra7I7%EoRXdZQjq&(M ztYN1FA%s&qtf@#y(c^-89{f$745;>^18JdUx{LrAsdQ@N&#c8 zMR^iG)&PA~q5Y-~qc>}3PZ(XD@5*Kflqk2X44tVhlpC_}t>@v`+4mWC#~oaOdY1fZ-wYt;I-J*ho>DD_2u6uU+h@NxKO zc-GqxJr66EGk!d$Rm_tAHJKx0#0|$ik|D=I8@Dfo^cxdv1s}YalR};n%3ODR(94&# zU#ZM5rnxJCh(5IJ-WVG&i- z%Y;02T*G#Q4s+0SnakCztT?n`6`HDY#G&8_7<4NTM>-G^0r7bVd2;xovg}unENa$` z1E0fq3CD2{XOOlo`Cn&w$oppzc#v#T;&95~hH0d2=p!Pf@_W5K0dSCPs%fkR<5{J$ zw0h5--Ny`m-;?&KT0>N*YMTD*TV5U2skL9eB~njJ1&4tXgu1#UuqA6}ZC z+;6%qeE$5={FV?+U_p;(F96luuU}gjO+F{S}4vBB|EgjU)wT9^XeDHEl%L~T`%i^ne3WBfh-Tsz~%s~SAu$`RX_-6)x!S@U_ ztzUyj=aOX_!{W%~a3oz-8k#CJRM!xC1#5msoJnbe?^1bjYpWgAXMK|gow0*~Yd5sO zN9kXypgng69GxxXUUG^&QIQ)IJH=OqRSNAx56oKpH*W1~5M23tlsx&JJl74wO+Ub-x#7&SS}l^wS!iB=6)E!?_?ij9BP1m3~*$9tY5< zgC2$|!l^v7_7nV%j05!X6q|Bn*QRh+!qFQBs6QC9C`Z2w?Fn$yio0Wm88dtr@Pi9= z>mv2}E**lbZ=O$JGQz3k#&5EL5?>m~99jq>IxJ{7DriQ;GH;*eG!9{gA4r`wg@KXh zJ$0Mn1D->?iL2L2&Cc*q#KU_8>BXbYGz|03jGiwUqX`4U)@YN8cd_V?F--ChSao0@ z#GGSc4g-v>UrplvrrF3Fd|NXbmCz&RVl^we2nxG$1 z$GLWXilva{sC;|!euKCjQ6|@1%3`TYgBbBAtHbmdnqwCD6&Dtwyw)8JQ)F%7da+>E z&ofiK=aPcVq_c-@dNLgtm$es-=k5Y%icx53I1%`jYQHF=p z>zCK=32+Zz*)%TyL->_?qav)u-u-zV(QSUI(l{<^as46t32l+qh3VteiNdq@E-v4s z6R4BibGY<{wFT@DaAjHY1AJm+U3@2v9}7rEtUl4P{vGR8%j9;iW235%0Ja~Lq!#v2 zgu;(Cqo$@$KR;cI*c~1EnAPNOmJ!XIt&hUUrq>N44jwWW3NnsvwQpi>s~i9z8*~o} zf&gh>B!K0TV)G)xknjEc>r?8ANT{rN+wMa-GPGgy&f2f;tYua?&0Bc>Gke7DkRMfv z7!;rBlg2%@V9uA9jJf%4m$r4OBhoC12=$R_ri4o{mM(hU<38f4(s{NGDz@I8Y= zIG6EYD=e(;wx|T(%q$3#H+Y3EK(218&q{-7F9}*$(X=oB9Vt#6RKrbAA?14!aM74^wzqG#=m&L zWMpqc_BtiBH}--IGSf^|R9|yMd97f3U3wYKE+*vG7oX78E(6z*(4MF=+~q;zi@C}; z?$2v8D2IyBs?>e$34{|{7no!EJx^Z>^2&RBQxAc_>FSb9W4LJD<@t4zK|gvtu{Qt3&oMd#B~H}37D2-6{n`uC2P^FiARU_+L;}a z<}J_<+h%>0=aV1)9FjnX8RM3(xA@^hLpd?x*m9^)~xiBNIvIFgU|;+VNBq};csjX0Y|cp&ZX(pDo4eb;l0KT zZA?!HR*G2SoCXTD&g5hXP;=P~kAbN7N?w-Oe#Lf#xRYG^3_SZ8WUT6uX~2=Na5iA_ z#|!~plGH7ev=>&rsD#|B%Xo?-;j9UIG1zOnb@!f8mnt- zud%E3VyX@}>UX@v?>0QqaC#tToLJ~^H=!HE>Kt5O`utm zylk>X8T`Dd$}w||RR;Z;MR2|bQ@TOb%Hn~R7TsN8FN{fP0!6JcoVL#-?7=#X5|}aT zE65FH4fj#b3!&B_pv40o1Jfo9QQ@x3E!bihXyy{$pF~Rx#Ih|@6x z=cA!=kc7Uu#Fq@KNlDmFADj5N% zUPIgGZ!J)=kOK8yjqP)Xt)@sxk5o_s9vEjax|h@z?^cIJTZ^vq8)^-B&*Dq0c$VPJ zlsJ$}3qaEWJ!}_DKFmiD9?rSin%V=gKD*r`&J zc=voI>XXy9#rWtGS+iKkdt-m}5#`w*XcYensNB!-Vy?9NQzt6jGHC@c=QPyX9ks?R z_zxu|r&YYyhXG)UMROt2txcTwqli2FMMgsfd$JC|Q zIVA747{En%QsCiyu-t^`rYzNEQxDyb?BhpS`?v2YMXPAwxtRZQW=!UJ16AOZ@NdVe zG+w_~&H&GZ-$i$O9irWUM zP#F77cw1eW9;GX#bV{KTpKe=jHX7SpzDuJhKPBJ3X2HP7IZ8H`%&-~eqIWnr8C8jJ zZar|NTq63qqnd8ObQt2c_!`r0OC6mWKYKrUaf*7#W}Y{8nXW!ZZ~(ttwMMfx-XXrC zCU(HUtsU*UZ4sYYnqWnHIIK3bI$d8K(A9D);cr}hS@-tAD1N-KN+ZzCM zg5>V5)B*HZ*dRa^&khup4}|oBvK{72$N5OxxPB`gx;5bmFHL$-lR7uTKE*L?gA6^g zScgyg?rtepdZH?A@5+lhPeH}A;mX#xwClaYgIKY~(k!*FSHnni@ye96?u@}f*csg9 zrDzk|FUtz?OnvwRzPDhQ2OnwCBJLGkOPsnAzC6F&5QLZYkkJ05++bX5r~l2-b_tS# zr38AS?3xP20l4m_EsiL;Ka_kh;FmYWFT@$NJ&Zgeu>urkJeiJxD2sxX;=T?OX)hJO z?Oq>gyykY3!{yL^k~)bT8G<_&U-Y9$pdlO;G(chI=X()z;_C7_pa^8uey|q&7AZF0 z3CAU0VE$<#6#~L;`L$WOg|L;`sFqcdfP4Mn3qB?s97T5znNI!oCcPm+W=LSeX<=Zz z9fEPv3ULvJ$MRh5c$xt8V}S{9uJJWecvGIS)B@oFy)}I zbk_}F%*=PdVBN)t$QbvM z=vtto-J1kF6v<#cS-E8sCyf!dPzeY zR-Dm@uSte-v6i<>)Y4o?pc>+St#IwqD9b)g3WqB+7jS8|)^ep)W#P+W9bW@u^D4gR zV{Wo~gGhR__R$!SyR((LlC)X$1kzDGZuj*`^?-(CFdoZ>_HRb{C%73wvhkueEvCZq ztzs9bj%n1|-cRru83`R_`+Q1Ot$!jHP4gcn2IBWB=9f5Lu%3DbH^iOTx#Ym6Zu%Bt zqTYxbh#I@ySoFUQ-^pAbZM580#*UU+ZnEda6e2e>TlV@1rshBn`!~2%ems#c?x6rc zw~8djrA#u>SgTBrg7#xtJ1+2)U(dO!Magrt-Kl%#hXJC47)Oxa+E?Zh%2iu$L=!AB za5RL%z_n~&&XlS*7>zthUC}kA_@D1@M~Da}(~rrZmLgcA z-LIk=Gp58YVD#trwKTK!TzlQmaEquFL^M)9Qxn6JO@S zeL5yVyz$3m?CjkgT6^7xX;%emz;9K4)3U&(oCB%=^{3hV>UG?o*>gYGCiruc*{)W3 zZvv^PZ-+#skgiIfjoP1(YetkD^#Imw{!-e?xoP0tbs)rV5?>JkKyTuOwhVCfFZ%sb z8G%Nb4&wD)4mTjw-zN+LS}c);bELB4R%`33nr2$99}b{{)s)$-A1=0(JDeR9 zSju}KC9K(MCR=24)Z{LtmYNbR3V7gtrYua`uYiZCX*d`YM&z~ShQzp$$;?C{dm6?w zMwTHY>b%6JheHuf|1rB=*>+02dq6~U>0^x2!K752p8ytDY6pw)4^v0kKs$aO7wdJc zX1r?Q{b8bdsHZAm?|dM}F>J=Ex%5Et^rhmZan>FSX2rP)!?2`WNkZpAU1s^wBQkQT zcPJ*%V_)Jt_&F*8FghtICHzB<(w4MWDz3p?;B5xWpy~poKo%1tTA+1+(w>zv15&d(g=5X>dJ;Oz5n6yh z6ya%*eLp@SThUND<`r1zJ+Dc1a8BMHC{FbVXnAk1w|3CZls=HTHX3Z1;`)6o#j;k2 zUu+^p@-pAnh42k2)`OBh5YOTjh=;-rVpt8PC33q5rq7SXBe5F+TRn0EgbZY^AMXPX zlRo0tj+e!KladwN%b%sF%HtvoB6}kTzslmc71t%<7o5%j?cZX{OlQNmoF;{ zZF+G9t_M?-{e0uk=$X)~K6&oh3?SuUtH(xvoylG z0w>a6pWocfXt`PL+5udgnZ0WB7=|7z4t7dNq`+9~h{Gf!?#N*h^2#%pdqvf}Yh*`W zMFl=s$G^K5n$Sd99iv%F5;e%}@uP&o`h033ZC%lf5duNXK$e zxN0xK4wfQaSS12Qx+zwtBX^5rWetpCP!4Y(4_4(~ZFyQ89R)9kSk9p^gItB(VS_!D zdEiETa?!vPfL}wiE{?|ON+Ye7dhn9`o%BbscoG>D#f>pwg2T<0M#W|6WAr9>gIgXX z&N%gj!Ygg1nTcn#FZtx+S$}r6Jtn~^6*9829%5>sa;C1QEXyuHh+p*`w8Rtv=B>-C znbb`wL0S<)#{mFl%wPvQ7&0q_hi+z4FZ-No>!;9$6yxvytQ1+oS;4e(XN*R8+UT9T z*RvWr*-oY{>fM$V_G0$HIw4~X`?@`Yc$=+vY<#2BV=5W;$L&6wGft)a1Y_aKnb(fD z|Ml?MZ$jelhtE7RmGMuX@#B@-=>BUPQC#H@@(!%$KFl!-Q4G$hd8&D8XIBoTN$lAe z_~$Ey4W}R)vhcbnY^q&Gz|T~Vrmu@_X%{_6J!@%d!-aa|%bml(pIYc4jXI>5 zN>cJ)`T%>L6j{v5)w+{nD!D7^7RH!0dmEfo9Ei6em6m3sMX7!ei!+5J4p^SWhypp{ z%Ja089L?MjMGR~2#fv>k0S$>;o6ZGLRQNj3tS_48B<75e8?Qc$Q6G{tSb8Ag^x~UH z`S5z2ABNiVVs(-~=2Ypu4v+m&3J@P%?kJ(QuvqQRB9F%vYpU|4a$gg>Cqhfak>&bx z(bVA*$DN?VThiT8h*T#;A4Z}T{42|??kAn?;wz1XUqjXB5fgM81ZWA}l3GA_=I}yV z5RJsG=~HF_ay*LVCVu*{))4XAb*2yT+U5FV&{~Qr!-o?pYb{pe z4IGKQL4*P4?UwX29qYTF1%4|W4)T#T3$}PcMEn{kui${>^W$f*=^vyho_ zq67dYoE6J>fGrT6d^=yNcd*Vh)zEpoRan2??C09~m50&wBh(X&f3(staPo6kHDhrQ z(lo5E=%6B)N-~jEOSTX_;C}Xrk1RPO%15~$_)_~83`N)0Q|3}*V68-n*Fx8QPG)T! zcG7PQ`L$>>);)qR4?}n4!Du@+XVMGlw7oUwOvr_{UcZSepXut637_0y^ojRTd!G|> zvGYr3oMf)d#U4jfa5=mXB_n#gGZ*@6r>>{9)44-Oj+_cUWA5wX`>l4yN5brvO&k@D z8ec>%%9@?dSzliU!1j(xVc+nNRyd{r{*>cPZgUmo^*f2-F;N&@7Al%1SkHgN^68KaDJ}ivlAu8)@?1rJe)W+kyzAJFFc(H|7 z>YAAH`^I4g>vm@GwUwsBOo#Y4$M@9UGSLKfx$IrXnubcybX_s;PuQ+nI9uQ%#|$zl(Q8hh@ir8lqD_e_9szt5~VLgZFv^B$8ThKWKppE?<#ght9ga z4~w3Bv%urPSiFopLk1{PNwqwk$u8Va=|S_i*dgrY%i0G~6TRt` zzZcl!n@F#rYpxA$`p8Y>)ad+s`TxV&o5n-^zilE3S zv5#$LJ`#$UO2|5)$WE5QFk_c2L-u71#=guLhB0Qlrr&ja|2MDe`}yCTJ06esc+L4b zkK=qE=R3J6dFw+(hx>GYD`f78fwP13CKx_r3^TA)V3I@Jm(U9lWzNtqK0# z?P2W45+y+)vtGXw28y^tk56(~>AjC3@;j%;!dFb+X%uizc5k;?J!!iW2^*04Bf!YmVum6ID&xE%kgdCp! z%e>{IM)AGuw*5#KVOJfA3+Jc6A6_`zd!jlQ#M`BZ^-cNTL5jXpR$GSOT3*@w5FQfn zFO$?!;_?m96T!ZcDXiw~ckX9$1utRc6YD)di^hmKBKvbwQ`i%o2O5u`sZ+IgAE)uq ztGTY@L#d=YNVi#0gr3Zb*n0KKMr{svOxGrTanldHyzm*M&1K;~;Y65BBlV*thkl#- z>9Ty=@`<81^W>y27M5>v;}_5N(ccS4tgA!aq$ks4<>wMu1ICp1iZgGnS8RoqiRB?5 zo1Nf{x4mGx{U?8+Q#zl8iW@zl%9ffq%irXw>wKS&`S?PKW!y^+>XvNOEA3>NQ?Se$ zTDbA<+2~^r{<909>$uKBjSy2lq`_4!;f^Um%0#;sy|r% zi8JHR90F{CivK^l?OYK?Ba&|o<1<$OTe>uVBMO5q>)|cd$C`Y!})6}6r{AfoM-$e`QFZGZ4 zuU*rn-(YE80wNb{wKF`0QaasDxn1^`PtvX*gWculhxpEA)~)#Q^`<}51*@)XE%R{+ z%g2lt^^1P8l4V>ZBd_iFz)I-ivE=kcTj!I%yo(k$G&APi$3Em^`oU1*%!ks@&CQkT z7g$jsJp?#?kl*GvIDYjwJ2Y7%Rhyb*0fQ7>H<~eP{)Rart9FMt+wh+%B<8~0bqycDM5Y5Ha);}5DG0bro%ib8wg@F z66*$f)w9tpM?&kQ(4+f^hdh}+)9pNXVNgvLWAOe+;38+p9M7Q>yXtT@Ve6^d+h6C- z@Qe5!I$(V}bLpcG@{!kHw)jssPqTV(?=^&T@NVOc!EcMcxwb_q{LalPX8N11sb6l| zJkcT5=N*10uf+1L0%b@Yl#5+ZyMq89DWcW@+7`BY}mpNIHFP)#SxPpqYdnS*w}I&nq{MSQo4K?eMcSn%#G$?(COfYsX8~(s;of@=-)|aVXkyW?T@=Wg>BL2qpdTt z`@naxk166g_1f}W87F6*a(?+ZCp0y4>_Gpg%8yPhPd~q09c%nNaqN$xOU+Dp9Vrw; zmP6;U`tU(aYcon-7<>+!(JuvwZos>P=z?r~$o~1;mL`Vb%O=CT|h7jGkn zbqUKRJf+vq`v`t9xLhCatL5k*IbtDAp_&tXtyt5qe15oaQT-X${rjkC70 z^XJ`k+6cN_8<@_Wz}D1z_pD!Le&OE7L!%x4#a4tD(wmJ zxGqA83xCBGd!#eUUJt|AI+~?rLh3Z6 zzYHDnqkdSrlR1@19{<(Os~%`0phMJY$k?)`UHYK7_;I992~)1hOjpxUo6@(OqzXpm zpgwKhp3H<5$xhD9d5x6d(}U7Xl}$-wq0b>bLlp3gyy*+?KN5RhV&miY|Ahi#UphJJ zgE9qfL4xBZltb2UPu+lQNryc=v=)}~Same$qpAt~hHLN(F9Y!J%41E)5ZZ;hk%r|$ zt@=ykYHz6;%57Q(km*fJi7l=0eNK7*DOr>Y5lnm*EL_ms)63&aSyt`+8xM5#)@9Yl zOB^3_c`%Q?lE4O?`Rf~b+?XSO{u}3oS7dtriqgZlBF1-|OBst_X@cxlEL?l!W``6( zDiQuHseGcq&Qkyis$1bVd27Q@KE#cWn{*}}JEYUfT_K>wvs*W_BI`;9eg z_F|Hv-#*13cM`A=M(|1@(=55U-JKX}b$haToa1s&pXj`AQHwf@H^ydN6DYi_ZKv%! zK1AcIBSXh+!Ad=0KLq0aXP%kM&;o-shYOBJOSmFk0k8%%X8g8BkW(?Of&L;G1XiKtC|&lM`>9H|HnxXRjz0|u23bNNa>D?8P;#Toya4sJicQkMz4E0=txNLQ6G zI+3y~^Qu*h1yG7nY7e>s1vVYwWIQGC$Y^kV)^?^k0*}GVTF}6j7ba&$MMb#l+r!5*1 z(bHcq^r}1NHivBZV#B#8w5UcpI*&W_$+=t89qwkkx7w%|c zff-xx5knV@kM0%J7>bur6Wp8&IPa9|oWs7VyK9+%64O1Bda61llFx)@#&vSnO&){i`eNhu2r`_B7p4|47ih zB-`7Pl_3;70KBrW@-Jbu?*{`J=y#huaAhSs%IQad{2lT09P0*5^8&Hz9&4Vv73NVb zvpY0nEF)~Qll?P?9}w~qvh0|w+O=`KP*t9FYrBHJ_XVeR?WSG**5T7TDJ>#JeDP;F z&&!vw^jsn6iYJ9QgHSIIU6(7Jxs!To^-jdUL2f1DJF63*AEaJ|`} zMe#L#p9*2uBVF*=)0etBzBujZmUaCpzoDNb-``j9acWbetN{Q^$iSw7xuAf&9P9n6 z=*hDa`ZH5ePY(0)K9bD4d(I(!fhxS-f>TW8koM-uSr|M!`RZ$uY!K>0`Ja0fHPpqBJ zY^1r3QmuYRSu)-)ZY_5BVtj6Mf2Mp)W^vG2wdv}~ij77fj2V5z*g=A#47+mk=Q!=| z|3I{98v{1MW$MI_JB#k%Qc*W7$x4|zW3>PE-~C<&UTI6~i62)){!JrPvwb*7PbNgi z`+K*GvhE8JE5p&sLd(_~2m9ik;oHh{f)ndM&1)gv%0d8H5y=4Nh^eT-i2Z4N%~BdQJ;$To%{WH!`X*C%TS zS`1{MpK+cR$B=q^53Bgz=tPbRbxx}NzIzhB<{-1mm?aifV5&lw4U4l%B@f2ln3Yj6 z0rt$?Lcn;SyDc1JT9LC(1$xz%93x;bGUg0uKvVx17E>sWcru%04Rzj(IDl`+9hVZ2`jgcFjgM!HP~sUZRqt zC3Xgli2TXTD(zwh@-_OIlryRpUiPr@ziV&|xR2(A%WUyV1}}DPHtgU7qa;c=zHfd( zykCSl*8D0BY8Q2T)t~oons{!U`a+pd&!r$@-{bO02aV%=*eZLWS6}*qln4#lp$wm< zL!vv2p;_G#{wknvRpQVf{Q+GsN2_^*Yx}bMnd8ho{+>2A8 zp8IoWT*X-b=w-gACE6Ux-A07XsU>d4>#qDDv1wQ&&@c1M{*gl~^PhvmrcN{pOCz69 zoMI}fIa$a7gxyB}=&&wluM{v_6xPulah_T15ob_x#fv}g!ouF@UJ6bd&4>i;5-NJa zuAhKs@6mA_G9JfX!|m?aSx*`V^|h$NQkiR^-7Xz?!QGiPHd2fWgy)pHg{qfM9{Dwi zlN%n-b+p5EWQ9rkF~@I1-IQd^6T7^YQO|rg>ysj3?gGcVBPwCYN7(1z3O1MJY8UT;>Rmh;7&RRUK20z{5;SGfS2WY@;|axnch~<_Z|fa;scZsts}-^5 zCa(pokNpi2OQcMt;fe;jTXYBN&MnE0oHeFQop{~Qcjl8O%L!A0o^Ix^>ssq^h*;*4 zA)6E|FXgGIRyF8!y|J&@$%a%RLSCfZm#K3QEl{snMX;x3LXPPAQ7|N?pxwC6^eT|l zrlw*y@m1-BK@8x7_}G%#5QD&B1DQ1Y zYZuIYEP{amBt83vB6$o4dq%S*Y-eB;b-n7Ab4frB6^Mp3Fo1Qj>%etbn?=}tngC&= zjPwx^_O0P&52$iXXXQyC76PQT0GN{2C$;J}|It=IjnfN$B|*6Eo`+g?B7PsQxl^!{ zT`K-J?+NNm1UCOt`sf*By+Q3d?Y`j*5i8B49I1+^-a2rGEnFGYQo0D`nFx^R@lEDe z%^#5zZ69&Vb$G^3IO*0O7JnSzVW~&xH;}=zI`UvZdG98CX+1L$zdZsXWOz4I@DMc| zAbHAvAl!>E#Hf=i*}Y545@eavYH`p^J&EO+XqkQ}<+mK4`|nOA%y@!x*w{|WK-aaY zV}T$4rO{@7uwLjeSVZ$hkN6V#U0|YX+&v8($YAhWu5&`)feiNr^hPs38ZpM%_?_d? zG-gvVbNP3f_A<(?(&vWu37iqoF)S21P>U3oXJ@Fv_P$E&Y3C=u6ZB6pE71c5;WoA| zUp3T&jt^kKW?LgrJP+D-C(jqG=`A!6s$>p7&!yZA>}|Cn{br7?tg#Q z@8}m9tb@Y_f`7f*kNa{V9i>mNAG`KSQWwrefATV5R#Zb<83W(Ga9@zK&J_3PkOlQ@eI{f=>Y>Ix|j>fb_82;=p1?p}^ zZCG>p2PTtVaq@3k9xE@ncOrJzUz>w~n9YrZaGEStH z9cfkcP7N`B9W(pcw2m>gIK`gW?HS3KSf49p2suZ6cfP|`z|m_zpO1Y_a9v2FD=hW(iN;-29b4p%y4_*#{Li#T zs)|-SDyMd3+qTS7mBzmztS{c5N|zxm(3z9YrORw8r*$G1vj~8iLpt-YgAI##BzcM% z6^rKVH1qjK%V3J$IaO-{x;Abv2XAEgj?UH`;=>yGpxrxqN#Vow(W_A`23iohp@-Ki zO7ZwR2y|fM9qLf5sfpj3An;Z$wU8974lx;06AM?q3Y?<-8UD z^0Kty9ch;c+<2c1g58G@;~1Xoc+!5s-Bi*P4FiF&>5C9in~iePKZ|#q6N=R|<`we% zL7cCpt2=8`4q$XB1QJ<%zh3^dG*Nc4Y16tX8RQcTA+ja>o{mUCyPx1c8c2??nykS)JuhJek9`Mr#r1y}!mArVruBnB|WIk1fg^k=7T`F(HB5SsR}Z)xuR z$U$?BqdzrkYP#)>Nm*CrmH(I_eQ>sm^jF9j9Up9%C>t0po=thJNMJoY2XEPUn*VKslvm{guAw+JWAHz-1`)% z8C=}JW38JDl-ip-j+gcnv&1iK4ijo?u7|9_)vFlMSi+(Jl(B>FYhWOBCv+BkAaX=& z{0D$&GSAJ%2qU?_p>PCr5{qg_?fR98)l*~0gPEj(eUVciofCs}J-D99QS zT(+Y&i&{BM`CM-nhWl63oF!S9eg5*61s+tunZbHURiIyIp~av+kxJFWHNH|yISPAwAf7IoLZlZL` zLwiaal1xRGy%@!9fY@CxKHPw~Onq$}%U!(*ybDxtHvE@3xo~)fi^FY23Gvf+TMP~w zUYOd-JSpcp*`~B>FLUQs_YF^0iZdH9)wgJvhTvDMRNJ!k4##z9DnGb)C*^_;@gt_U zP2~j-6Y%BM8oE zu$WBzK-UMmvZ!J7BZSx<)w5lxT*-)M^8NLRb4iB zn|29ak==|#q|$Flf%k`!{E(h-r=9Dg^+h7+7THSA%+NKW^n}h%IR`V+9ev+G(&rv+ zR+M8;`w*>L6WUV*MQxq+J8 zkWyA0T`NO3Ml9K}3M}kr4)3eod)Ym0v>ViH3A_?Ycmci?x`>`y_ldWtLhqKYM#?ar zlYyHsl!}?Xmy^@ODJC_>g88U4MUgk+dhhOLGPYYn$(q;58|408n_RDUW_7Rq0fEPP znp0nvg|hOHyndHUVmh>qKgi$%l6_9UXTKr@b0Zr zaQhKLcXU;)?!^YNyclg7p1 zB|Vt~ow4;>!49KTHVutry_-s_Lt$A`cm!(~zHUdWBWwcpzrX5I8QQ6cB!)tl4M9KE zx>!!M9KarNC+{|4&iw{ooDMFieSka1T3Le=rB0yU>Bb9h?`bj;T7Jlc0&tsbDv)F3 zdaL=ma^s9K1a^+E#As22kL`}xW9uH0Nwy1dHJS;F4L(YPjcj>%HCxr!9#e{P)>!$G zQ{R751>VQLx7h_^$BW5_X<)whk+>{x{rJNj=6h+RvuV0mU6|CF*)eX(=A&P`+1nH5u~ zG-Z)8W1XHE3iQf5)s{b3aDv{`ixS&GWjG#YrY4o!B zN#u0fXzqw(vhBF-Mn6B=(3s-<(kCg~X%d|OUF4!`X%@IcWD+}XEShY&>xZtFroBN! zupBhfhoL%<2jgI8`xauvDbAYK0RyevD6qRv3XE*ZA-KG`8SA8-3!N{t!*ewf#Xv=d zv)d7{$lNqstuC)*lmaM3snllgtdrzUAiI||APQQOmI2WGI9;imc3MGpv*>P~&$Ts8 z5tesr~DftSC`- z8fgt=R^|lHKauWtDY6fPp|e8Bx7J>`@b(Lbu)_!#H3!ckK|sg=CWTUcOJ=cdkSnoX zHyqh`hc~ydn|Ic~Al?g``)CjV4EZC}wWfxp%j1C!(~%1TZ*S_7>$fz$_tpt}J%8T6 z>ul=LB_bpAbNa*uIqxfwq)=wl1Yyed75vloKEW3$k1+Lqox5Vr>HRtj{fM0tBPK>^ zbK=39O4a#US*Vk5#yj>oU(72$UFzBO29qg0(kOnh++L!UsoV^S9Aqx<+FwI1-MZ za(FGMELYUWGn^>YGO^r1(t#-vJ{?fY@cZ*n7DB6|#giJyP=w6k;z#PER`)HUq)s?f z>D10cIx@QIc^I!P1eeb-rR@>k15lyk%N>EVT7uN0Ptkx`g?aWQp=N1XeDAmWw_A>q zm2BPq_H7JeQe+w`7%51$3|jsZicak5g*NjW@;6q|~vEkEiS3L$qk$xt$PLCBo_Rc<|+L5>>=!O zbiNpW3s1{vOvns+Mw>T8X11|II@EK5PQN(F!*-tF@6a8;Obh$} zno$p*5D#AvfDZRHdR?Nbe)VaBnpeI*tD8UEc;m|yZR)U(p%lTb{AYh_bk1Xz5f|LD zI{$1e@syj>C!i8e)N_ZD3834czytxzQV|$y0H&NYSR-XJKM$Zsu%rZhq)fvf4rHML zLGH2i*!QX}@`03S=4zfq)S+x?8)hp0Uh8Yh^`YmJ4cv+u*PwwrtwgETwv$cw4hxpP zAX3{{yBNN7xqS_|f5JL)y3Zy`*yS1*c^7={Fk8~i_p;%+t`+q+GJ1-2DpP zgCrQu6fMdg+(LutNd^HyJj6e%sqQ7qQ}kX41i*>K4nn^e_Zy13Pu)4$IN<`K7h-Sy z_W5l~`qR)MP9+B*84wN=mmJ@|cmNl+Foqw1ZvY^&NE=QoW6-948B&l%R^%{s=8bD@ zP=1TOBnEo`z80^$w?yJ&V`c20|JR-^>gs_V1HR&yzZlS2mdTIaVra>L`orF>i`Dk} z6p=*h*-b#LyMWV^sG%smQG-Y6M;!HoczPrqZHa=jFBUTx%Rl!dIP11+z-D|OgU}-5 z^GFQd6&&DoM4`dbZ@T&FVx0EQLodJ!kIy$hgz!rB0QR#hH273H-^u_gh4zi(QAF5DueB)wk-@ym3J0efK7J)zx zTYaqwJs0#3@{j#@_0RVAW6^TsjJJr*9LW8D%rJ_ZLkZD=r z)Dwc!P=jU~jT{&8R?E?k_ifQNy%+paMm=EMtn-9e$NT4cf~v*D{zGNA6iF(#hG{v7 zAQO+t`7=tYe<~X_@E7MAzq>wNJ0f)X!TV5KhaQzzM>`B}VB0;m)xHX-JqLWzay&X} ze|098$0hIx>(=k;LZ9tlS5u*QSGab8cKz%wE#*25#Ge-?SfhPke%zA5# zH{{$E&B|arZIWSq;nYq8nZ89N>>iqoaX0S?8kRn zMnIwF3;G*0HrA`|rk}RvKSE*@v6`i3{-bI1?5%8Cv?Mbx#tE~u%Z5)Xx-1~})~61i z*?-~1!T0~1ym3Ik@&Epz?8b?=>3tUd3MYG|?i%R*m|Xv0UkE5*F}8`d_&Rgl5EPsP z3;Uf0l*zb!zw>7z?9x)Z5BJ?zU(ypVE_&4Zh!WXy#gdZmM&<`)MpdSa&Hy4Z;ZDzQ zgrYn_$4CQS(ipOqW(Cb^@PYK_bdgW%h7&bj_nLlWWNS+CdqiEExbV%6>^V9 zNj_L9qylHnWc#m=Upkzj?sKa28#(RxTb*Ry+J(}MqrDBj3imFSZusRR2c93q(nb&I z@_1nwjb_s7?RQex(-A@snX8h@>Ydtj|IVZP?}9f^Tk47=Q4w*<2LefRsgvGx>hFhy zlE$PHFv&|D=;U`o-*28Ubn5@~abr#+gWq%73i{m!d9K~iB1w$d`&A!w#xHK{MlaPCNwli1G((igp)c4O?Xg$V$JZjBS5LSS}zy6YXA|tXp)N7_jvl!`KJ|1u5QgYws z=AH{s+a8_DpBHjdh&6dxmE@yQI(dnnSXG$6Op`=2eY^U(Q;|n8=Zo_C9 zoLoWRk|BJOb2diRXv6^4b@Egr#3#kE*`Pi8!VG?;5F!|tjur(4C20n(eGq!0UAeA0 zahlf?y*^CcC8}QHsRWj<4q;EHu*e->6c}FE4CpPXrm^5{q82%sf?U7kkp6T=*diV zm16ZB@@(X-739FBTYU4oj+EU2^9w!jFV|%b1rJFUXcmxP{Lnq%zI$w=J3#wW%Jdy2 zt3Nnt8BqVh!&pCGQ(@eofQzHa#}5g!mwHvoSc~gK1RyITaQvez%55k{*e?;7S?yX8 z(~2HZ#O!_|M>s~DtUUt3o%DLgOXbcYp2!mJ)y(ipoRT(Oy2Pdxy2}^p8z*`~8X*`=JaE18!|@y}I8}q4r*k8p*A{{{H04XNUHOK@{qiIM`scQ8AtZ`~&&i|j z(%!na%ASK!a{PEuoW_F;pK>qv^gF8J3Zf5lha!B=i6 zBtUO<#^wH$MTVq?&~&5I7B=2COF<^X?ZPOROu~I$Js1cWww2x4Z44zf;F6~?aqk2k z3a58EZmsNW>}ZkuGDCOfQmaSpmFnjH7)HDlh#;ZKQ!g)^cHTI43iQ~L?@-q*x5DG% zUtmuO{5b4wt@V1Lku1gj1bQ>%?yW=Bmv^)*!tD=F?mnuD6!P_nxcnJ=@@n;7P7LlJ z4%1anbfUh@x=Lhwo;P^#`00l&a?_2mFCU627VFxcD6Li?`g4aJB=m%`jsO0s;#z&d z;BTnHm*bU4*WHbi=H?L%ZwR(VaUP$Q<|lqXTwE^Qzg=i+{sh}HZEB+XksZ<>Sx&gR zb$|zkobq85D|@aehb+%qEVP}%cBV7dQGzP&sjQ54!XZcTyq%7J~m^xG0i61YUm*phTvx&)a50{yelY`A59y-y4{#A9EUp?(tvk(dyhl8*R}+B5E*&pPn^%D zq&MIH`u-bIXRVcARlIh3w(8Wr?1xl4VYya}w?ZURw?jot;Eei*y5eidXnqBC#8e2w z)9Y@Na@@dz^0!vTCPI!aefkiF*bzr#92OC1Z_9y|dI^#-TXrV~>H^&B_6p>dxpm?+ zQqbCcy=rN#0(W%QyJb!XJ}-I&5dryjr?=LtoZu^J1phw8y8Xo)0C4?TXh;uL1BMHsy-rMIU`aq!3HFB@aNM zn43JzSWop8ovWh$k^fN1=z8??h4`Vn;m{7CX2Uvqe4*ZtXw zlcOhLzi$>ey3-rlGlKOMH97TkNS&xjd)P*Js4EIj^B3qQv+c@p6;J}4!{gsN6YaRb zStTfRO1A7Xaarrjf_fd}b?*MMZ1S1)N&o$BxQJ`z+tAOx^TcXS@Ia6M3KF=$*}84j z492qJF$}K<;~(h%RrB?K&K-aH?X@?$mCDn1OOF*EMroRj|JnS9yA6B6g{Ws)yz&jh zef7<;sw@fFtRG^YcYU*RPfutJ;R*sD4pHmsK}Mf=^=s4eq$R`;lBz)HY2EeQmo2=N zgm9_lI=T6q1&X?A>FbrFMxYddRbHjjJrI}P78T#Q2d)bdADhVUWHY}4IP}x^`e2N8 zLk=C+kWR0_=@O%Kx$hv+Oymk0hdrmpe@63`NSw)(-RPiT;7wW9BZg%Ah46iCn~Oux z7q6x7%CyV9P~5F=D{1A;aY!FTY>{sKs1}?%;}hGV^$7+>2Dgtcb_agHI%3lD$Mis#|`}}Z{h;V;3>Kp zr1~ud%}KRa9u3>ixNsD1fFTq1!1OXOcY892)@LNFtuUNN{F#`i^aWJV%w0KhT-+@9 zDe{@PP6|S;jmJw@K~bgf)sZc3=Xp+XMtc0um*-XT*s`EYo+o0V`^!*E5{F;y#mY7T zSwHq$`4?UHv5$wY zbauFKc|bpbmqQsVKQxR6j-(H-8m+8JPhiHJ(%KJfWZDL7S5a5oOFNhka~z`Mh2hwX z4!Ua-$$|J{S+(s;9oah|4J#)xG$gOnfic?*$aFi=vGKk)Cmxkru2zC}%gzKjnp zXWxyNzdW9-RP-(5kn!=h>f0MWC6@UG347d>-?1Sf=EcJ=mr4$+eG7EmmPnen>AAU2 z!B4wE!TQl+cZwlxO6AI1JS@-rHKQoacE?3XnW_`UfefipXGX8sh%uW59)3|Sf5Uu1 zMw4|l9{{x}pSy(PExZHjrGqxkY0iI6pvx>-*!bLcYp`(_R|Gw)J?EP}Uc{9S)l{1}siNhjmE&s@w>yLQB-L$0WO>{u&LS4E? z%PZGzb^W=V=3yjJYcS)QaLEnYu5*CCrHJ|PXfm~FQ5kbiP2tex?Y&j-HwD`|Z!e>! zhfp-R+TCO4+rxxqF1C;*{Ooxq>(^;z`a`QoDVN3}L}77i;8Pi7w_4DRMSUS*EI{L0 zY;fitbm-_%Nvl*^(r(qsFac_L+sw|KLT71Zk4(%7_mcol;2~`}PyClTGrPL|RfdJ! zzVA{YBP=v@rzqvk<+}SKmKU#MV$ijIlpxRA4@#?hDyNd)H|-7N8s{it_fmCtzbe8- z5^mmC_3fS!+GA>2QSLvjtG@Es8?sb-`_c8%7XgY()prb|Eh+~aGt(+(AU$Gh3vb^_nFxwI zE6e95>f{SH$ove+%q~8!SyFw49NDqu8Ap7jfN5?&zh4x-no1SF{`zQaso<2bRJx`#90%q{#7scYluyaHd0WH4$`QO8prc}|F`DV(L)SV*XOEEJue404eC zUhO6~G8&nyZR7H+mJ`mWo)@3DY(#rrAI`(~gloG8O>vR0`=X$*t39bIX~&rZP1NoI z;8S9I+>st(_oDs?xOyK}n>NW`*`=TrEVq|w?z^z?wQ=36#`3Uv=b;3p2U#~>fn~mvD9-R zNXULXgsii&u)@RcuM`ij??q%SeXm|QOS9CNpELcDpmpfP$O~tkB3cIYj3)4%dc7lY8^m>cPb@iAxN7!~w*7oPuf)Qc`R_J^3V%CB z^7`@sJgZGqk%pGFye=IV-1&Wmn3X_uLx?F=o29o~6b|HZy0IOzTeHm1)|Tcb;y40h z_kdII0a4ESd8;uMaB{6KW6e)qW`iZJWmt}zf7swp}I=c zwNt9_7g_-3Nstl#(V z{3wp;SYO#*M-loJ0cf}xr1paXP$p#QWrn`BXKiHeV!~d$#)3NSNB5JanyG1-X`DtL zDs*zya3vcAzt1C_bc$5rj62fqJuWi!9BS|_msi^$!U=swdPKdnKR0bjeUX}Q2_TXz zfJ+g|ytVL&7bX=Q)uS_KqMRn5@`?xZtXoL!Ggv5O)f3gvMLB`$4GQGDIfkWn&NY|o zyKJQ&9&O7Q*90+ovx$<6!Edqqw@FZp)>R(|$TcF{e`jp*50dTw*8TG22NP||>C`oo zCHHY6NHy^RP6ovN$c=TS+?rIcOV`MIM#{mlK*eEwEW`e%#nf-jP^UyBIJ((8aH z@`1Wbx8$v#BwRLLYjP$YG&sb{^1w2!8w_)MyN;|Q7LnZfp#-~$B{DV7zGERf0y*JW> za_TL`g%c54Q3}|#Pu-t`);6mrmh&4@UTy`v;D#cyNO<&s8~)jMr&xtYEl~nF`+0bM zP4|vL9#QJ+xkT=@!XhIsrkPXiIbO%{EK}w#SDzZXkIesSIVIfu*z`wIhE_nfw9d1_VdA3?7RZOYiml^a58+Y`@ zI|F5u=R{Jf8YpIjGsTjT-Oy>~Ozmxt{Nm*2>|OGR`Y#;Y|G5>f-2ZyVnwzZnanAEb zr^}Uh0;17*s%Kp9j~iqKnpszSJS;4}Yz$@XZTlHRiP^*^K|}0vKO1 zAG`UPS%1m1`0{43sl^w}US-|;h2M{r`RW-Y>n4XlaLtT<9Wfq#EgM|7tUvCOBQQol zkqzD?h{P($gNTF2RXnbn!R{BFRW|Xf0Ks48E7?5AGcQeb&l=q2t=j*@`tVS%MO;#p z9^1WXJrSV$k-DMgS^Xo_Z1*SsrFYrcmyIQH#uk*CU%YafEGqx!;%0NDC}xtUqX6{L z{eWL6o|>zc>&h%2s>@2<%8IL=Iem}Dc>T=g9Oq^UymraHZee`2;CE~X4m2w*QBRDY z7|1SpC%5`aLzxsWp_a*pc4YW(tBgFY65y(kt&3G)f~oFzBZWO_`!&spYS@T zgZ1NOOH}!8XM(J0THxjxKkadL6QiZ$`vvdsiO*u%WCfHxWhI21ds2;8!8JZ@u#&n> za^*n0)IE{i*V2FE4j->->QIx?>fHu-ZzR`D9JGVAzp;1KM>M_|5m&@A0r+Fi{ryQi}3E&2ns%`N65Os3RS@T{dudg!yNDogpGi9|QztFz7(J6c^F^1saiMc2 z)#Ju}rR5zh4~v-P#yb&9Tn8;{!V4RbYn1YIAXT;Vzb&DsPyU#FgSjRlZ7-lwa*`W& z7;wo+HW?8Z`l3JZy(@lBl9BiXrJfe3Tgxvh?^ z!Qn`EZv8vgPnf+5ZCVc7dY6^aC(0Mso+3B}*CH8}2afuPhHxSTP4x@>5;eXHuD)ov zHBz@)qNi3P#EXU`a|Z6DXoyERRgTzk6s2IT{clWre%m;}nCDO_ZYZ6d>~NBD4G=*8 zAY#qUC4KIX(p6^SeYXIn#DaioPeRINJ2QOb$0G{1_Lv{xxj!p#%ThIcWi`vW zX$J#~)zqH^MkbE8=ax3?SW(+oOIyR9I1CqAk`DF==aft`6f(31dN_6c8TRNvFCoyg zPw#|e|GXqMz=?5c6?c7EE|2RcR3<#v(w6-qlz5R)Qn2RA67jHcs^!RZI4j@0Fv+sz zJ4;>6H`$hU<-LL4B7KpTJD;4eu-JU$tHKpp)~*A_stSOs zr{0mNRU@`QQI-nBtn)z)Ui`o8y21+%E8p`IHnDkh?Pp`O;c3sS_KsHt(O0Amo?;SQ z><(7%6`CEPZDnKy_FS_*vh~&KTj`T%I3U9=IBU)I_46>cjUqZVs&>3N?y4RN)*F>r z*lViw_%qq`oM26PM$Q+BxY&tLJjBhMK#jJdCGGqpx|Bj&boLF@ft`ZLk^4ITi?X+l zin0y6cwfb)LKv8QSGU1779it+6d2z;Kpn++-Y1=hwH^_4;>dj@y zOfAXLI?mJlouN;$v0&)&tcAVj?yOi~Fz8xT7cV|P$sje;b4j&+Giv%_bbJYr2`_wU z_5P-8W2`Ua$QA0BL`=(_Ts>>P2}#VdD6g4!eK+gg4h23c`!!E_ruWFh!yRECCuLW~ z>7RBD+wuafmA}o!Ryy43$E{%X1yf}Y36uVM9``?gHT3wt^x|G&o(ajRL&E4=`5lP{ z4f3b{3EXJ#ldlL`)!ESAm&U(Bsn+~bMA@3M^Z?~xQ zX4DWkLu*sN5H2x6auw|@Y*nsQk46Q`aMqr+y!vQXbzbS9bCj9f2^F%uaH2VpKzErn z{$zpsGb<`A3iudIyW;~{@8EMQKsRC}v+^hfS1)sXm6Ci?-S+_7Gut6Ys*g8sx1-wN zcEF-$ITK+ZFln*3(CRX=DCt+s=+=$`jqt@^9$gNoqN!=HSYEg>CZF5G5T+Y`j2w-8M(EWW2c=fd`Q@ z4d8top}|a$fZoFlL7#g{X?&VpzIbJ$1y@q<3K~|;Ye+sYP)!U_9^t&cdp8~k7<{{% zvkZY1I!|IAu82lyGU)quCV1*{dZN+eE2}+T9SBh4Tn5T5!z<6Wq+c)fetpLi1qbH| z1Fxg6_0~XaeqgdnZ}T^AKT;0!K+o$aA+W1bCXy;4P318Xo9Q)lvD>8in2ablWf$eA zmwC3f@U~)xmM-h!S37ZS_eQC%U7JW~n;VgmyJdWFG~xm>tJl7q6sZ2RS5NySvthT8 zzu=U}_w-u0^=2_!k&xW<@7!&pJK+y_Vn+jKR3+CyKf@#~)m~?pJ7jWLeCi2cjVYK& zT=Ld)D30Nz+`XU`VY{ynvp?V5Le1%aR!KCz0F>w0lNW7y<9$O`Neh1%U=#l}yTE+l0OI%5p z`G~9!O$g6e$WNEI4jZKB``%jsA6XRG;+9vi9j3NBWnR1wzBt}4l#a+>-z;k>NO@<` z)|oW$ShBd{bpLFb(l>Rg71n3_&+bQ~2I2BbP43`jNF~#$^pozkip##yUFsnIJ;UdQ zV&lQaXHU`J!{+@UChW~9I5Dx2gc<|NmJb&PKNdQ7sp9_XjE0=T0 zl0QsPj*)n?nxOWEHWDnXA?h!;^f>C2Ai=8QWrxND_eoK=U!LxDnEF2X7PL3A{Q+`s zE*@qRb+XQnTBcd<9wS!YHPf>>0+*x`X*-(cE28< zuf!=^cJ)za)6?w1sHBT;9Qj*)gp|Q)5yJvC@imoX<--EVPon$}x-}+zOX)l2R$4+2 z#-2`JaD`x7yRLKm#!4eh?AGZG1ESsXPwR3ZNm_GpUUI`dI~v_}&bYLk&#PZNq;2Dv zK(CEp-tmr!CD-1BwH(Rpobia#+NJOysL$~kHi!#(M=^^lpu+bc)z9-#JHtU@sRmcfj-ck1i_FwLH@3vJk~}mZ4&|sUklR{o!2NwTI-6yZ*g29xDm()pB@! zUZK^_dK0MR#9WO14$SbnJEJkl4TvY9^OaZI=W7HKPRG9#80wcvh8&MoVs{{^e?3kJ zkyv)z7ncUI{+e7_B?J}o%ub_!W9izvtr^3 z{DqhxY9+hIJX*W8%xT%7m4}sUeRH&htuHoC@cT`HtB)i1yn1xBD_b2B>LFU8G`|qY zs(dnlYjn{atsDFoo1|FQ`?-h%u?(@Gr+ikt(33xXex}jb8s;V8KWb|3@Fe{myt1A6 zLGvxk-v^X%6$(_6uHZ5brUwUa-6QMdJ&4+`otlIj$9C(IEuw}w!Cw%Kk_!cw;Tq(G z%KYkuc(6vGmacWm^uOVI*>YP?-P0xu$syQNPc*opj`wsnUzwd#4q1+^YP7! z)_YD>S#cS%cR2%|wZNoeS%Q|%aK^o9iT+2O27nx5xY#Wha^&GZtFA1fv(Y50l;wAQ z*XO!3iN_4}R0oPKy;Hze`a{B4&LU$nqO{>Ucr3VFlIWV0y=BHJNRUY}`Mt8(5zo=C z_)p%fD@FYV*L-%q`L9FYv|YCAHwUUtmm<37dM&biqJA6tH5svrwOhvbHjIE$yyu!~ zdJsx!nroN10i}928=j%2<8!}tK<|a!!n?1wsa0ZG+0V!LmPH8TjLmS(qphBgGVnZ0 z2yb*ZbelE9KJps@x=`&$Cb8+V^90Wx6Zm8M`DcIa+Ab*8)oqPLtoJZyfhf6>{#FSn zjCvoyXDb|dGo_2xv;8_G2T9Vnd|Am?vmmn_JK7F%4ZL4rpenhQUApgU8;J7 z>sp_A1Q}1}IQIW&_gaABQhiiUL#bu-cSV)14u0 z*a-zCLx|8@ExOVH(`Yaz>p}I+t^33HoXu4#Z-vTE1YLfoz_7m$aD(Eb)ziBg!>?d* zu9F_jVqC?lxiTAY6`nx$mNr)JFGfxdebM47fF}~Wqe0#8nWX0_*mQ|Pw7NIA+7`(z zGx0bKegB!%NO`sV0P?%aYJ_$Io9;z-wYjQ`C%n7bPCS=gs$c&(c*eWewp11FwtBkX zO)Cj>dC0Avu5pED!r5^?^dcGB6+1iXfFvw;CkQd%#JNY3S}rcL229;h%^v zDD&7%H~{O&TJO_-1RHorbLif=!Q@1&r&^ccudeqiaEi%N+kLw_)$+Ex_MTdIsj+^g z)WA38fH$svti5<{kqPCP^_lR9So&Wh?YKO7{NV$0_7*op&4X zT6&RF-6^Nd?FSyCr7c%SoGz#y<^saI%`v$$sx|1}4{Vw~0m06-BQVadWdRp9X!RSq zjRup81$(3<_KpJFP=#9Z{NG;N<6jIt?k5!Rzb8uIot6EIoL1KD&g#Mw&4#=eDaEWf z;F&Q??On%)@FhC(?mKA~&TGF_9y!(V!Dw?V$=Zz3?NDuAPkBA3t;NDz5MBiK^C!%s zr;hI)!q(775=1K!pcS#7CHv!Z0ebJ|UBGycTCMf!>O&1}Rc9aU{;N;GUZ1^k?{xZ{X3r;ySuGY`};fG@X-%i%NB)iO?n6Caktc6l|*| z!VLB;#;1-RMbfHX4#tG`<4P$HVAB1UF!KbT5RWl(={i(?+as1>W}@aQ_#@OSda49Me)y)i+#HMVL{icf7yGv5zeK_5_auXxcn zEnuFHe@k#%R81HCt;bxMLhS5#dsb`OX1AGi(hs}r4BaZ1#jI>;Pneh_0tym{7g6&Gj(L+~^Ro~U_ zu7b{c8={1-^ZLxi`n-0ph}RYZhFFm;D8SHvOsjnYZm%jF1X7^BvH65g}4=VEEFK~^%+T863>vL)!!du zZ2mF_yM5R6X-D(v>gWvVAgs;OYwj|EX?#}}C_ZCBZrO`ejvr`x&9N|t<{70vS5Um( z*>jCC@+0hYEaO*fPvi57+Fk`gXltW!PWJqbgxkE>%+&(@t^6FgCcmDEXKdwE<9&^V zIs`4;PDK=gb;hq_UUo^E+Z}N{Ge~$z=Z7N6OgddW+!bKzQ5-hHtB-k-+Qyk8v#off z{lyW9hmnBlsxAnw{Fvo=AhCaLxxrgGDpsNW%+!*!@ICI z=~+Z<2bd&vVU0RO6+ow1akQajLVd-CACsT!H%^)HU~t%i zGyaM^dGt9SoJ@80Tm2ZhCI?3I;Lg4nZFL*C&o%hsvfm+kiALOxhS$EFhu1ZlPX93l zXs*rFb^ou$!$Pp5ARt6STwoYov?7UuMnr0ToTva4XA6 zR)}0@M)_M}boykqjT#6c{n%QbwTg$a3!tr3-eCvQym2#>rAm6kVksvyaHeV% zBEao-|GftHbDxn_^g>5MKKDi!RB}T_SRcR6(>Jxc_`HVQreI`>^s<6KzF8H6z^x`O zB(0=CysDg`0gz1@2>Q!l7DrM^o4?^~1RpGn;%S@k2b!7$^@0tGx2CDSbWln_p1ddU z=@wA$eQKpHtb3&>&Y9kGeW&H4Nk$?9g>UoYKC*oqmElyZgMVtQ)Xc4Uf^c-C?*H6Y zDFeM!d0~2p;;l0qD|4-fEOtb?EO$p0Fs9Xf@1!tnqY&}?JXKY6IJzQ7myhU4O1Qju zad`!!!D*f?@e9U=mv}k3J`(ro<=r?b1y~CghTG}ikZ<*1nV#}?l$Noc2R$%n)0_ZU zoqE&WgWth~)H1WJqN(tqpS))Bb-^z(LRZnVUWwLUMg$Aa?hFVtfqnm_76r&peC4^( zSC*@dOS?(KIXf{cRuoiO!%_k+Yd`|}q7FF_*F<26ZD@Rsk%tSiED?ZWYJOUXznzFJMY)wAw@b@*=Z&WY<^s{|0nq0nj48GH=`32Ep1h6beOFZ6V2Bogex z<$;$12K1zbuKw*qbBz28TuGbR=>(17ozixLy~lKSfq2Gl1i?urs9^OeBF{A z=7seFS&0BI;$R87nU!Uu;`S|@gx{|2jNnK>a$7G!C9~TR;stF>Qi~-H_GGhot$g)Q zQ3gCJ>-h0O?Gy+5g}Mel8aQ#tEN|b&6lLVosM93!(WU@Hj3a~x-(5958AAgUQYSX;7dyk`hMQtok zPMtP`S;%>nAoYCoX)2c_onYpi5!Q9*I7ei7g}K^tuL*5sv*Ubq$71X`6#FfF> zbSXdOP+-6EOEtxmPlejQqXWEWbtRDeJ*ZIX5GI`#F)?@ibXF zA4U7kym{iQW)N=E+6fEFa8jRjXjiIR?r8-ZdSwg^r9z+B^d~*^J zPI<&E$?yZviH~Q-`z&|Ax_K@u{6)X<--=2i{xX(!?*l*qAMxZS_7{SO;=heh=0%bS zMRo7XYe%vMeScOr_B%60hxa2h^)Pt>9F2?Nj%}pL0mKBD8dS3M{ftu*X*gL+)m_c0 zjWU()h|yC5Gfv zLWqd0LcxU4T^t$o2kpX)N}B1z?4Kl#E{dqNreT`C4D@n{Yx&O9%kEq^t{W;wATDv}3t8*9aCVy70Ta~AV8JgkI}3A$)_ zqd+#>2is2VSkqsBK=dOisVlK195b(c`c%q>d-kg^*DOP1M!;3QUR&lmNH6WJ^BZ34 z>euY6piRVXml)5%)fNbowv%e(aCb(u2axC<>4^X;ZyDtq{#UpZV+e~oic$xAIg!Am|2S!KjU!|vE2)O z8O?Cnw~60x>mJAnI@T?PT0_wFWZR865YBV5?J|P1*?o0AUdW^A=;r-tQ5n8p2$OP? zce`lj`M9B9f5}~(XOv(hnYm0~_;-Ik*}o13-`MLq_A)ov5u;V7omF)X0qKG94LJ>ZOr{lP8ow zEJSg&cfPQH!=R0@;Wg4(gAE)7kxZZ{qbPSCu}W1;Si;+x`^@B7wvo69S#lMsd6P-z zJ2v3K7|rq3{N3@`yA}t$HqP*Iik!RUto)IHwLzTQrsWr8Qd1E~P{d9Z6{yEcL?V3| zm=@vO`s?2U?o5hGG%<7Y2NK~rRb=-0-Q_PY_&9%Bt>CFe_Sels#Aj=L{}{yfzhg^k zkKfc70r&xF18;&tEbLr;%=T3}whJ9Bb6Rd_TU>NergiIn(f}zNR+IlV!>#+u0=>Xz zpS$=Q+G?G&WpOfd>0Y*69=zk9<+U3LOl7Z6w%)UriFh;e8g{&uE$D1M>f&}lpL#m< zHgr|QVANS|imVZ`LgD+bdqC;Wiqxj0`O%LDF*#OV-MO+9!Cfhxv zXL=Cc}FcANh6!7?a*79xH1D++n>(P55p^%%0oLiS>poO>>n6IzW z9mpHTwA>QHyI;yPM;LZaHwX0`+5B<`7|VEWz5aUR7R4Xw9J+<|42A{vcEhRpv-gn- z|9$lsxV5!xv7cM=j9*%rlC>yG@sdUhwM?zUX^^*(c>N17t6pHxRTjX9DDOqsNb!F| zc(!E{J2lCi*TpM-ESo_UIgNNg#tY9qaMT0mmkF4{%O4arZ>lDj^>Wli4VJ6V@zA@7 z+Zw{AfJRvb34s&ZSA5BQ7P9(wOikuWank4uy_-vRHPw97H?WvEMyn9ji^Hd4=RRer zu|Y@5Nnl{q9PON4lfVMNSoA(PbD-5%pQCe?>gBS@W>;Vq-^n^w&Z9q7Fm4YQ=XDOr z?NXWv^HECYD*$W*#{k3jV2+9pl5;CFbuIOy@vHR(VUs*w)fbM0WbbBYCM(-yD_F<> zso{KS71FYMNLV!SFL@>$1rEE*{M4yxPu))S2$3Rid!F#D^qV9MM2qm-QI;>dze%8%W z+zlMqxAoU^YUq2(D&Fr1yzopS&E3*JXjC$bK^?yB5tfx4D^a20FLQ>BIX+cYJW!M_3Fr6#bDeiR~G0`p3HbF&4azE|99O?a!5A@l)@9k^p#rDR5m(iIM??(y=;_&c>CzBJrFNlh;L+eqbQvJI-t#~!XMM-Qdl_$2Vny2QP?$5EdTmUyjt1r!8k?hN*cy+lo- zad(yurISzAsvIh-y)JIMxI+C()Nh`QE!uT-bcR<$x@T9b2y*$-XrD@YgB%qClb1;bD?y1E2KvWjA69$>#9gsHZomGV=UN z2Cmv---Fk#Paqj@@1t`XVH*|NQ3SZ(fdz$AMH?sUEC+MBBCRhVY!pYprCK-c?3c(> zR@Z71J01>mHcl2g^6o@UMM=A6cS_!lXjVsbF)9RC`v!OfO3C||7sw{`Uh+UmZ zPC*dtn=fZ?_m{8boJDhGf;$&G#;Z2b;|4H7zM1&0DB2`GJ!ILZ(E^v&v!M~V8 zJcMW3lm2a-<2{vsu=nj4uf_IYhx2a{v7^~5dD*pw-7%;^{};ceQ&83pd8Zoh7zs?i;Gce9wB!G3SGVxk-{Vsg>IFJyu zQ)U^jIQcWN#@ZA&-!T$>(}nLJ#)=g9g-XU#c+C4I)>QgWtV`?eiC*-@@ebC6{q52H zT>d*rmZ5*Hu^#R=h)m+8M5-3i^301s3&fk1?zry3!v4Fbyj{=jXkWBdo2zXW)j#R`{rKo(?v+3_hOoO@B zvnrRo-+uq@)M}~%PHppe&*>;(`kUP=O{}MZ@3*lo?$lA7%-rGQwsSjp0U=IW~i$|@pd`<=`2lGfSZDLebV@BLs$2`pa*iyDx1Gc{lF|xhS12cEUldI z&JWR&#sm4fmUjoSISiCa9Vg;@Mh3}|e~XLzOWcmE^=aj`e~)3*6=ZVO)}d+RF*d!U zqg1t@T?LUOdScQ%WvqjBm4TOBtC$IWaqRKU_jxecRI&)XH}9g5wOcymoQ%D9Ylf*y zWV{ppTm;QPdR~DP%+V9tJnq6Sk^|ko$afn2$@#xp!M{e+@<-Te-p{URe}Z^nW_F~j z+hf8)jdHiZQHul_MXZ#9MDq`8XUQu4yI|6!WREn2-IoIhf4MJUXFtk-(yR2{`^sD& zNat?CR7%Fql;6 zJ>~vUi>t2LO?Hd*RN2DKLTdp!T}i*}BulW)g=l27Z{ip?shYO4%sCw+!(j z6o^MA#C0Ju;13@0t?n#WA87j3m*npFI9v{OP<(dex9J`;3!6X@_Al)rXf1F51No*9 zk9EK}PTvP6yKy}?A7jaR*J(S+*@iM1L%-Rwfj-w+GYcKxI*b#JfQqNq#5>q}Ll?+g zv0ZMwuNa zYF2h&PRQRBIvR_^o>}C%aFJX7ou;st#yIp5#1Ts#r!9HcO{mt#(Nwa00IDyv?@EB| zMW`I^x5mh4mP~2i0Vn7<=48!3({cD#3_0@7Bj6WrjYvZ*y*F`ZtJ?^6cO#>YcV+u3 z_un0%GZ8#3IGL5x$bHXIv(WeP=i0S^Y!P12pHqaTrUFiLbO#yV=F>_>joORQRo=sQ z)%`-R^}bT4KKRmI58sV7ON^GY=+9A7Deh+`$SQs|W<*?Ap_WhvKu@g7&INrZT9ydm zY*asIS{v6&AQG94pdy5{zIf>Cum8kvWqY|K2?Lv{(1a6!_V67%jUL*e5ZcSs>UQT> z8p4LWQ~Pe0d*ljQ<#qS4Mt+~`@=6>X`{$DnOeUh_5@|p0XSEDzm7bw^8T{U=F4Yxr z8obS!QU07;RGnqtcIQtJL;?p=b?$4rsf+k+;C3aX-f&qFf$!W1II?Ue1+`Q-s`KM1 zXX1M7+y&ce%5shJKf68#lJr!K@FpVRt;a(9fy>;m?WRF`tBD_rBF$SBy(&QK={r-d zJ>a5OHG3?K?OI!Kx=UC>#m@;{`4v;QzJFmV}a=iHN@gsT8j z21|48%j==-#Q6ZFxso_iE*Uc8NX_%NFp3#~IU3@pzGEHhH#aOe7ql$-pp5r4HeVZ$ zL@>N=_>Tqg<;SDn@!AG7f=wAE$>hLYUjy^}Kky7y<)F9y{%Qv3mtYCkzE&^Ni<{>+ z87q}fh#3G+BjyRPpt+Z?Hq;x;q3hn1zMNuB9PM71$DjCqsMp@Qf77E1etpAIq|HM$ z$j7&NRaf2BslmTmQDJDCw?gP(S5sKL$ZPdd1M)8_K6!g)D~TerwE9he+$k|M^d6sb zXDEF%96wPIsvkTW$?VJ`PCfq78j0F7(IBBN zPfjZE<@%%`;Na2`T{pb{Xu6XdkG}h4kI^KFViJm13@BWY^?xC$|o#*f`Yd#mMImPJIFnNn1>IQ^z zDWK~!f;gCD-YuJLJON!Yfxv*6ph7Z-D#QebI6fVK5felJe4@pW09Wu=SL%YG%RvsKYU`FQZEg+`4_{3v`E~%e27xJ-mZjNjFx`$5JWEpB zyr2a*qBK&NyZ9YQJhJrk!i+NaY)AakSl<%}bK?SL)&d`rt^vAVap(n*1<^XqiGl)! z%Ruyy8cH@d@4DGyxpX?5BEDHxV_+P0m*kt9&g_>$3xhI`Z7Ba!4#$%W3_WqgV2?ao zNqh<^p{IS*k?Y&$Dah=Xi>fpLF-bA+Pfg&{ShSw5Cgdm4A{fgxjgcm2N!ad8G8l+# ze+U>Pe0`B}M85lz-6``hdRd}~pyj}(#@+cLhO_9qzdr+77(Ol3<=85MY81%>aonT)^NSl@pH<5s zu%fJc`$1ay75tg~xH0piUMwt;lF}ua@I_91PPNm}{!gOQS03^lk?olt+l8K>4cRx{ z{dm5a=@0nGn_{b}73yncj(b0%tFce})TzDhri4a5tCc>}to_cqYmx9gDq?aYnpLY+ zjifUj@acnCN9&lH`n6iLWz@FRI8=e7aY+=P;(>v-fNl)C(12DTV&$xC55HCjjVde+L8(Irx}nOeGf4f~MeO8*e|fc^31o7L#S zxJ-aqN*BLKTeao3(Qta&WTgf6tJ+R(Q7$QPD%BT$a%=(8?xWCg1O3H8r*!Azl)&K5 z6*swU;9+FsgD!Q*rIaU+=1AiM;Q7f!`WsWn6S}AR;@799s-cn8e@ocw-6ouEd5Ke% zcp=dG@w$Af!SQj->7y}e$2VH-=|ft6{_+fqBEW^Ng0d%NA~Y}I$|NAD+J@yTKr1)W zXgOOmCMwjBP0D9BGw4cP?OPjG6D)tsaH=RHJqCH&mkwq@|S!M4#&A!Trb z_ml*1Byq+CQRyY{iTLs-YzW?6h9r$?l=gL7bYxC&l%e9V9vqGAE2<4LN0eVgtQub- zrO2b$m@%b%;~M}h&7{^P^EFyhr}-q+4ACMnYp%z7vUCRE+g}%#1e%TGuzMNw;{xIv z-Ejeqx@T700L|N}IkCZ+os4J<)Ew(-HUh(1>9(0<7CPdt6_>k}L(eL{X1Gno$Pipa z?OdMNRsj=4Uhv|6B2dc3+!m$}HiX_?j7gFncbg~7hGh-dReNGH+?>=GR*-J<>yrJc zeEpHrPQC1FLD z4>x)_haUBEW|6gBi}|#To-LdLNdu?leXq5BS$b6Dhg{v3GO=7Tur>pKX`fNc^_6qG z${>K-r&0%eSowf6nG4$8gO2MZ01qWB~%qWGQD@=h(TbV7jcOtuEt z95Y=O^_SowLwqVTXVQu9e+#8K+@abCll0DvdAGzzulP!gqR-U-T-*Mo8qq71x`Fi4 z5Ayjl_g5h$*P$iXBAB@3x7{~|wD6~_R^F5jSL2o$Nz#?NIPltZS!ZdWP)X!UWd0_S)UPG9!xvzP{^)V7_vi-8g5 zatzZ&Bta$+|Iu*armg;R;`5W=aM-b%P6^?`rosihC0wb*_mKC zA)fJedUDR_AfP7UA+W^xKpAAAi$BT(8INXq1S)wC=E$!9z%kH?&`&aR;?qg0`qVIt zanaj$DT#i>;~YrQ@WNF;arlt8kOQG!36S1piv;P1K?T`koNA?ph=@HCa7QU)N!ma! z^23gV;$oTI^GkfLJ+LDw7KifG@<%{7L2pJMZxZ0q#|mYx(ukT9K-Z^4ZGZ8y zUVlro{*y)%^O=*+(EWV|NTINRYnS)N0=~?ODcnKy(qHH4t&7Wvl(M*9^6maFDhWi* zmREJ{oFikKa!V(!{*RXIqu@QzmR@#fIi9i}rY>uVb-B+she#{|6Kt(0sj~N+>TEG* zd8ZPIUj7O%$^xQrKzO*hEo=4t^5Wt8Xi02tK@=%NIVqeVo z0K=C6jU$We=YZI*ZeX^54;4Bv(%Yu#oUzmkiqxPKf3{fXD^i6vY}$aR#TkC$TMLeL z9q3Y_4DnK$s#ncYbCTt!I%sDVYJwcG_&j=$#K>xWhq0EVF4{TZuDE$YB*IYR<>MU- zbNGss+CX2#k5=m*6H3>IzP|4G=gh2Gs4cO&C5Y z{MMjOY{-jW*er3iN_azACg$-L?pkkB<`f2}1v9l7H_Gxe>jqIj-p^3aq(!!hEXi_I zce3ccC8GW$bvkDNq{D=+-qasePmkWm#+y3J%u?x;R0LX!fz<4u7}A){urzedPwfVZD>*#F8unE-Eyj#? zXE>-qt`#^hyx`*fVciOx_{-$!^gCv6(y#i+wPYED4Z$w!QHXY{! zL7Xmck9*C^rv?d4_lU0(i3ATr#~jjS&Q3{{3!)e^Cfcd255Jex%!N}w)c%vel}_>@h|uO=yd5$mV7GGr(Ovju3Km zEQ;j*Fo-U`6z`&#U|lccI$V=o@;H#D5nT4E`h0oA*)pY2l{F!q(RMB^jTug9^n(6T zuT~!rP-ABm6nX8sFUslfA(UAEQtqMbTDEDL_Z#}#dGlHyx-R>OQr&N zlE;3QFWpF#DZ6RJ2OrLR1qlN$;QR{Nf?C~daxg%E03Vk?Hw|0|IUHX;)b)V3jJR4e zpN5rOn@EFfRIvNz`2s^r8~{QVqAcS4vW-5kETqvJYiIA*_={h|W^do#*>Ntp!i z42W#%{RySc^tiUHN}&gb#Ai$efVk^9Ja)T6SGmnf|Hxn$(mtI?41JEd&~FXbN+&*et&SLjJjU-!n|om}0cZ`7@t0v;AB*b!OT0Q&7|S z)Fz3tZOx6_qBK%TF@@I{5S>KJ`d&t=7hvlFw@5b4re1nyH`X*-xE#(jJ9C#bKph6k z2f)U(y;Q5eQ~r$ZKwkc2K9p9bT51oT!6%{!Kb!0-l6E@ymT8d3C*uwz3G0}8faW{wQLL{YS4xt#=F?)yya~v8w2u& z4nEvdXCMve%t05kU$`BMO7~8nQvJ81+$1#u{C`~lP9K1lK-2IdUokcc|1VAARWa1p zg>83*OP{p)^7qwoYdYoVoGCkX+JH#TJ>)3fC`cX=|2{f_s?J5P#5C1;?INnol#X&= zFMcxM;uj)5IS8P-Y#NuJ9>m;9PBd{22T1Qir`QCE{|sa)EWpP#2OBBcs?J4GBS0Pj zdI1g2;o~Y-T1|#dy|-yPYakbHKb3k`LnfX_Q8;TwIk|iW1hH9dpZ#|3bhd1Q4ueMz zzx!LoDb>8<>FA5VkA}D<2mDoH}*}oRD`y=woRfyP>qkDIaPFX%F<(IpLzIX-Y=^G zl+t=L<4h0qSF~_v=bHfW53(tvT%}EQobQoG_ByZ~ z6hM@GjQ<{(Ccf=0k(DkK7#BPf-J4pV{k8j2;LSv>6dF+O4`O6`%a!a3&H zXUk^|w9gue9S0qZ(U+qQ3zJFvNIBdw=>~Cp=2G2w)9g$yef73O4H1S2TZK0OB3J#V&R5>0F}C0|b-*&N4r4cF zop;y0(&I4zN?&p+cA<&JB3Z-(_kH9vK|;~xMiIWgMr?Sa z61T6;PhcQ@t!2`~p^uvM6rfuTKq17RAjct~@1xV7M0d?X(ze%uA*NUK3SoIGJ=qmt z4@X#Sg~ob&tfV&+X#Ie2|9YY>b~iV=_jmR8<<-6vNuW4^{%U(k;bFfKv<}#aaBE|t zj@sv)(R*Vm?^Vy@I-;hFxr?Cko`1akh=f)gJl7UwV)BI{EiXB12%&kzRTK)`;ikHWg0zUpPuY6dni3J4vm<8 zvU4?1_yeG`0s4b1JblIb;b?@XbC3v?GDF~8bEpo$VSFd3cZt_rE4e9{yCk(Dp>oV z@q1`qf#b4?p!Vu3+pK#p1V=TKMg_8B`oDiYEbsm;|+_&a>Z1hm#}q1!^uAy5`5F1?65vPqDDNeD)v+sUA~9Zi`z0B*eS;IwMV) zc1|_PvBcJYvz$Il_rE6F_g=O=5(bb1Gjzy(KxWibf(Jk%SnspH0A`@ATZvh_{1m5b zHlJPn1oSk3bL4rKV95ASS2LU*Em*h4R44qORA-LHHT$t@AB#UR)-@o=1~6pi3XkWq z0Np0lGsBmhy~Tw3yjPk6%q1*-xaI8GkdD}s^Ak8K+scm?+aAlO{;vxM7HTyIbYE}S z!mkfUm5Z)*(k(K4IBcu-S9vUl7IX@5=~n76%m6!NEM3Gye&;f!w5McCQ=>PXm44qF zqd7k0#8xbUJr>IfCZ;#2CIDu6D$(oHxT@CRv=N}}OHEVq_3BO)&d%jDMt1aHe?0sa ze1S6(=+Xra$niM=Z?ctlSDm8QHGM&{k~O;%2`ACA_r|+}3OZ@srV{E)>xHr>xi(2U ztgMZ9fH$QSTggZ!FFVs<$nGm&ej{be3U(nbt`vOc15x1g9J598uAP#i{9th&eSClG zdwjY>Rb@NgihRCc$-t~C?RGoMZsp1b9K6m$yBee?ge3jME28OPmlys<_X=I4l~W1O z2+)A^(k?>ga%(FVxaP*UsiUG)VSOkgt!9Hv#^7buMg_cK#2sl3&M2DaMq=yj_3=)8 z9@s|yLI@pfYubmnzf-fh+O^-`vmRpA%GA5_Q|ST{8`X%#}W zZ54z`!WQIpDW&dNnFIYqFaX7`FHrx@O_4#22lOq!0-D?Ss?dqLBY#Sax+1AZ2TLa_ z!qi2`JqoA6Wut?|xG*TrmsiXsMVtB z5TkJYh64+F=5(O$I$fOER3~R9iWa1FR3Qv0tC%F-UbSG`csEZ zBG|iZm=%*h3iOahua)k~uI7{ieKte4E_SiMccgmRYiN)*ldxgbZ##xBz)f35UOuRwH<(xhwVWW5$m6L z!M2T6xBGKkBU6!!RHJBU0Q8fV2a~2;m?2oDY>Ib7qD$E=A-`UMcCZ3K@up4-Y;6Gq z@+F3v07-R1#4?Bq;bajpXUF=AuYJcd?!hz9?BVc z{#!+D=6mj9Uqt(G;+K07HW+Q%q#&qJzh>H|;|?qG1D@^UeZ-yWQ^$K$yOpeH?pW`1 z!z8wndWIH$yIiS~C9oZU8jx+c8=L=VoEqr4e%c9{)Z-%{xa$2dIeE(7{5$c^)XRSYyAXz9$syw35Vz&=SqdRaC zH0AsK1;K~uNjB`B_gg&CBk3)o{R=dDp~yh{8t0rll~QV zsGLlLy*_x|HjwJ<(jF`08;o(Fi=GlAlv=%qN|}glu%UL2tIQ9$<9tcXxv_(H!)!@EGkK&4gbEBT7GRAh9dp$8KbCRzD z0AEj34NG$8#68?Z@7DKi7wZ{LK)?{ADs~#i+HV~)| z${l1stKsG>-I)9t-Kzj}thb3kWYrK6)@lLWW{yBx0f1~e|1Yw6{JOeuit8=~eK*|o zdj*%>YP-Q_{I8VefVBDuBey8RJBsEcCxB;^POz0Kc4oSdA*TG#CrNbA_C@%Ww%_Z& zX*0(8K_cF*1djdnm-_#8F}}aL~hNOcP|x{S0oDEp*5gle3W(UWDCG7>=3S%<=W%1>t>+rDvHY-Ra7ED<&|#9iHwb zN|gnXQ4~cF3(Fg=f-AOBN>_KR-|3(qefww*_2P*H*s@&$%sYG`$q|zTJg}At^M>9t zz&aIv;vDt{)CH);H}?PG>`lX=4BY?GO3{W?5(Y_sS(F8A&0G z$-a%5Q1)H6jC~pVWGA~B#?Fkf%ov=f@AvmR=YL+E%egMEyyCg;=YBr-XSwfJxiPE|bHTYlv->bUr)<>Fs*qK6)Wt}l|iVT(~u4`nnsaFye)ZfCG7U?}XC{v>ryQRyF! zyN~#8Oz3D?3dN*UK0@7ZoPKVi@w4W_Of%Cnr0mBY64J&5rN;_E#?)Bs3v{SN2qVSs zlcmse`wK>mJ!^6=e4jK@AMlcL&xFGTpHBALT%4?TmE)9*tchvzdsn7 zPTrKh6s7gUR+^FJT(%jy#izSwsDH_qa@wl{1M}4B7$))%(bl&6{cevh+=Gm-EqW(4 z&*Ql}(Qbux2D)H_{_;6aJK%KquQ|B!asyUE3nb*-rO|q#(j2qnXFBz@Tof;S_s3P` ztqXBB)7bTgh1Rc!s;cJH9LRGf2YcL_=L!^PW=Aw1OVOUF!LP<+d-z`gF>Pvzahxv-&-c~aAa*shrz;+jkbpDFd%M?Bjo z>9#)b_lC1Xk3J%7t49hIM+g;m-LARe*n5rN+=qsL-y}zuNjzxHo&_G_lm<(fNZenw zY{zdW?i>4GNK|OTFPYtW(3o71M^StQg^JLI(`WQiu5Zq4U%`2&Nfeh+-zZRy@Q{^GORr%$DK@xArdm4EA; z1}x+0tY|B`x=_&`xM~36bK%hbY8?k}zFWe^8rW0doknVMW~5Y?&0K`vf?j{MCIOq{ zyq5Nc|Asqkwmij)d3Hgku`*~dyxY|zoo##SIiLKMngv;m_eGTB+SgZ3?CR~{-Jg7k z_K3@(f}AFlUmMJp`O8XcTc%SlFgidI^^~Ysmjsla0~z?+#_YZO{k&M9*nMuH3M%nN zvt11nI9}}F98?GFO(biLu5ULvBd@w3;4?2u1ByZAUHt}@f$~Mq8Is;h`vt3frA2X2 zHyWwWX5cJYcgWx<-1`eV0Ya3JL$m}nypY{UN^oXqjt!~V1o7E>Od_e@dHH7v`5rj0r!%AI*(LFN zeP_nCHQ#!+UFR*5rp3K$oEmdSbM?;J-Qc8kw1m^-ojMe{Yd`=&D$UkT?tdJ?HKcUL z8p*o)l}|Zp?xIfBg^>W@qIZcZ&S^3I4(~@7NEGv8I@XpdaZz>*LoOxmn}#xHYX(c% z#zHZ9lizL^fm!;-49cPjBi7_{ZfUY93_#L6m#Ek zwwZEo!Ibm6e9m5ioNYUWn)M^+ zVyn~Z3?hH@-1_mzpU7s8MW@L$+~jq7D55#DdDwvV7-0_%W6?WA(~(1TO+c-J?JttR zyQS2SEp4NRHMyh~7BCIi;jr1<^q#yBYN`k#jnO%(wcb~*w)1a4Pu#6DOtsT-F&AW< z+L&B-M_YTJ+xuz)FTYN2>ea14LVsrw5uPVw^nXbAwnUl|I%LBXE}9b_WP3CZCj4-H zZD_-7D8o{d01nuK0PP!&1m1u9nF-%>h>SB!#h!j(9Ra- zegm?ISHs8G{{%*u+J7QItEsK|Z(I4zlWfv*QLrbqthrEQB1y zF|f~diC+zT;T)09miwtL6@&tpInL{45({3IMb|?)dasLts%$C*sH7PQAs>Xc{S42u z)0hFf;|S>Lr5f(lt6GtF<{uv0z9Kc=NxPy(#LL2-28JFxt=>NH zueEN+U&)apLLKcCX^Fvk&b5wtvU!4H((PmPv@QOH?qZ*033`f6k z^j`h&@f@(|s^kRk(2FZZa&dq|zcoM~r?9PuDQ)YiTb-{UL1}MwLi!y^36Mxoy%Vr5&x%WB7;2zwj;r z?33=eMC@Q~MO`|XuQ9%pfEnqCf+(6O{cd!NkI*L-WJQYgPW|D%Wtz7^4@u8wbf8PL zrkP5felMSpC2HD4dcu3FS<5_vpLds{UTHrJ<(XOSUuT}D;smWsh}7hH9>G#`eN*c_=}r;2DT9=henqE-U?#x^|!-ql6&*ak^%F0Ob_ z(pGz}ZsQPlZ$OgM`9&0 zhDL&C*T|okSTVEIH1Ch!Do>R4wjhZTsG=qF(e}?AhXyo~EVxUMeE?2FFgdNj)emAe8`8a)9T-Mp-Ne90p$tw@; zuuj6U%N^QN`a!+lkSxno!nFq)TP?g_@+Z;)quIAWYMP{y9%GZ~rqn~Sd!Tp^G{Pw9 z9QLlxR%<8R@UugN5XZ1$^H-O{&mu&U9T_``B=zip1_cG`v-+g`;%jpPxAA=Z|R@`6?xm-xB;-(6Z=#_n+ZApmOnf zPAbLWsq=@(K%^&(fO8UQTNr86n));|ON zCUD8i0j<%C+s#!vOe^Eca_);5Tu*WMsc4ua$%V?VM6_e)*s~EL@oM)Otk!zax>Z9b zU1#VlOTAGxq&A1S>}G`rw%g=4+A5R}JcztPLxFU60YuHSX~(~k;}ifYjE33TJ7VuL zTO9JPa8Gd1zciQE;p1_%%H&Cocau@9Z*!d?hy4{DvZ_Hs zAK-b>vx4$`M7M!CrPesnlevcT>A{jQ6`{Qf!7>x0wx9mubrUTyn;&64JMz`4_Pt)D zqU_N0^`2W{-D^BRP_jtxMuh}EB;`225xiL@l)_H%NJR$>W8~dv=(5bhUwP?TO?;+g zKJ-QZkR6N=(SX-Z%(klWaagZbfAGELTbdIY$fmSRno&agCBr#GzN(FpBu#FKg*%L_ zayy%Dn7HD%%Rc=b{cF@w2?9K=ReU!2;t22l)1U52W0H@2mY;0YSqbh2M4SqolO7;F zAL!*#rEi*gk_)DI-AgJGF_f3x^3_9+3O}^VR`j0TTdc}g1jgT~ zI@*6jWHq<<8e~0=9q))k5boa6u$8Vp>)3O#g5qaLKcSqalr@Th>8_u}2dJM>uqXYZ zvLmYdpmU4-v)9!e-Cq$CuPY15x3G5U?Fm-h8;OT1ykQXeAk1E9i!6qZ#z!P6cs7Sn zx70t22}HiX|D^uEv)SfE55>!FIxU!=Fc<7k}noxAmk*xD~`-i5yj#TM@FE8}j3&YuGSf-DSfR*Ii=8J!Y z=J&Z8Ue8OHUU(fP9}r;wGE_)gx)*A^T)ZBN)%8lqd7ks5h|(=PE)IvoMwl&>j1;ys z6&0Eu(Q%nqIk)5DFMF}8)9kwemq~#l+TY`2_~FqkFp@2D2PfsQO~2zgam}usJal&!Ym(h?g-{$S78Nt#^{|E$eMHh7S zHN`>@BW3tco2;hPx%VOmd(M^rzG`vj)U>`s&T_FOI6X*F;?fRWCp}aa$aJFLB1tyL zCm~X_gQT}OJ+IWcWj5R1?elBkE+K%uKLik1k;7vL%VzQ9g^WAop6un@QwmhHC$$YdxW@{;z@v`v z?&_MF!y$##L-C!6v41Di*F8|>btQD<*ehBx zO-ZdQgxk0xdBCpoBYTgQoQnt7_C2mt6BgySA!vMG*_Nsd7Lh0O0zaQUeIxF34@?{$ zetFkewoG(gsq{A88B_t1InUF$e;Y%2dfv{-^7qXVEU8|b5z_BD?c4H|<-^{@Lv4%D zz#jLLnu>&I!3D3$hP^@0W}hR_n}Wd=h|b%A?GVN@%d;FkFbPkjL{xPK&-_F0SG2bn zN_2`_sDA8r0dkHu70pWuUaW9R>LV?C~kjM8*)-p8^l(F%QZlNc5;UQJvA|0c z5HK3i-)v**19|Hy!u#V~$W>)4QDyTa@d_98IO2?l;+99xl9vpth|6 zQm=J;u83Tpf4$tm`C3=%t|fZBe_@gr*)=!=f$8)VIXS9uRxLrgJnVy^QN|uP+gV<* znCR8*GwuK{#~00hOB2iPHB?h`sMdxjn_RT8$Py7=^8F_`l*fWL_~Tv#Jo$?lJO2uf z_X6ZPTt*Yi9QCAkvV0z0^8F*j?xRiUk5WrQ z$Ep#r#wi|OZm7a$Y0o~S0hK} z!w||7M|(7Y98O8J530cKqtsq0q!MC`i;gGaHMsIH6qD9)?mqx21{|MP$J&&SVdUAZ z%&y}3%taF06jq}1X{VgG2Xo+l`pnR z&?!jg!{T-g2GqX*fqP;fJW)KPR^o?oAmURZh)2;K19@e?>Fj9s_UGgBr zs^;4r_#$4;G?Cc2l@Z!}O1cK#c`1BerBKg4u>ZCFa;x~(uVI5z?z%pA$dOO;^3b@H z(Z&@;f`T7PNx`lEP1hF4#5PBPaNDF;^OeRdQ&ZNGHyu_+WiNnkqHQ{ANjVNWg~GCeDY=Fz%ffHgL+ z^6BAG&6W$RZUEYE0S5^%KPK6del2%%gW9i zj9S00 z&xL4iQ|#_!N&3T{^H(ITrYcjfk40EFgn&@uilV+35Sdi?`jJ7xgf_xW@b^83^k|48 zsyZuOh9BOeM_Bvr?P}_{y8lWd?Piz4pD8Eq&FY6wrH0;4>O*SMWTOc}6~=kmqWj}k zoyW+vNZe)#EQq;%1QxzN#NEW%9vi#}*JdwZ0zV4!$`wWM;UF(w*rvuN4vj_eiEp`FpcE=8mz+SdIo z_?ZlQpWYotWL0*#n>8A?-s+fVFZp;pF|7G(v$a$?T$OxGpGFn#m5`FgQR8-2j{XpoB6JyWL>B< zMp$11Hyfw^0-@?{OK2wfu^sb)y0A$Reed>-rPCdA0&~H#9N9O6cxfXEY7K3G0tvq- ze(RM3Ej~;d_g5#TPT_lUQMtjQC1Z7!fBSL1x2#}LI$N0!8u61^_2>?N*Qy!SZBjD! zKOGkQM-M9xOmBDJvI>4{U-_q*5oWfTg=|n1=|d?10VH6gr_h;nkD*B8E0CR!Xt`j) z@)gtyyZ1{W&*`aZ`zR(=obu|=38KU^#4%1E)*$!3(L6{V&Dk?@xIh-ZB0jrt_8<(+ z89(CDyyl9dchk(sXQ#`XPn0MkyoLMOHy@n&pL+C)3)5C^HKROdsI;-%k?U-}#lO@% zuVWaVG$4$+#*H`l=J@=EHG1#6{0K$9)&7)iEqCy%>5orVc_;LbP$8&WHP?#r{f`1Z2`%k|I;%xdYjpl|0nI6or?se zTO{^1h%hyDm(?6XcJ|JKj+~>ed@kbBOr98M^Qs^G7(QYw74nk|u9zw)U$?Som3~tU zJ@`u>oqxGr_?R)|eSPXxuUDEu+fUe@7WiPyxmVM64o7+5Ux3PLX+EpRT*rSO=D?=Q zj1&}b-QcXjTin60%SuJ#9uYj!4UIs5rWE>ForRqL5n6y|X7Kg@t(hIBj=ppu`advz zUym9Ay@>fF$ke^a^87t=@s<>f);^OCHg9_mk*H110w3q$Zb}w6ZRI7~Z27C~@47G| z6P|tyVivv5?+?)D>mLN~suP&I5kj_gs-}PcPVzun-Ey^cknV`d!QC62-cnt1>Knh* z=uP=&pQdzYaxmYuk_%$^p4>VDIfMVN)|=5PquFOiDm8j#Tg>l0HKtmVtK&#YsBKx! zh>#%1Mr^BGKYUPzM&^kAE>`nb1z5T6l-lKbS$km;sBRD+pQ&c^;tk-GplActKztP9JdEA zi}LClf1zGbf6MFk^ogFy<^T(J#n)N(T-KHl+1}nIxd$d_HPfi1#&xn;KmopsMK8yrZB>%^53ea66WbxcE1DG^A;50~b6W^i$E@0DIvZI8ddnk%VM@h; zB%S^7bLD)n3&A2>%U{D6nfIQ!ntx`~XghJjLV*J{p4K-%#Dd79IFLNfUl8{05jl}3 z8x0$6;5s8&Z6%75yy_93$?opGN%T=6H9nf(k}H!lsqug zBc%O4qpB!ROtc>nWtGbKqd~ms(&@@}b=v#)wel)jdXUWP3e-DV5(;m_8niHnotCu( zuwE~%*WEG7RK>iEx|;Y%zLF*lZ22^QH`VJ|Wx|D#==b1;FMo^yHG|XXm>Lx%C;Q5T z>KHt~ZDz4UJOl<4*pv&Q7N?UPB_%kDFKKFRsDPf0l5^5$Xy98f((#&)gH!K@dutW)#de0Ueu%N0 zvVWs1Z|+PDVs`sZP0PLH5JfJ4NJpVR^hY6VYmuSIV{*>-{p}-bJzR9={hH zL&>x|A1^q)&MNd=mqp}Kc92pn>#uIByN$CUYQD7Bq6qwo&L$L6LQ=Gc%jFv`D&mNw z>U-RU0$NXdXsCKzc!Ir@##Qay%DIZ*Llz6k&;Et#Qr za0~4&Qg@PeJJ)gLd!JY?!2i_yl$_QX>~%i7{$DRgV|iW@7pLt(h;7=out}UFa>OsaOaF%lc#PPj9ci|AT4O^(Uiqa2et|>X=uD zS6;T*d~}Bznto!(_4PHM{v2mu$`51y9zb+*%F)=$HFq+;!fO*_`=S3OZV4Wrgen9E zGs0m%L;&KJpugF{Cd{uCXfZR+Oh5`%o8#ja!db#{J<62fkv4=k5L9MI5h5lSh%U;+^jJr zJ5+4vo1n)YHQ$du$fY+3FoyO)hZ)aZ6!XHG3SEg5p#Y?ZcSCVqfT;$wwp)It zt}gzT5?&wLZiOzjmDfFzD$VlyfMTS$U-nGrLqzc9u$ak4HNly}FW{&*Gu zfElb?CXF#(%1)$>@PTlAqa42bNaQzu;M@QJaV;DbJoDK-47zSgzcYJ4K>6n9mgM|F z9t`?}E;~i%XN9awQf~YN5BQ~?^)GvZ2o>%}I`|i}2leWN_vZK2xxBIkiQYd8YPI2f z6e<{9LR?Ap8{#C=hTdEJhPBnV|ECxo3&w4Wo`ZzyFSMHVnZchZe^r==hmf>YM%}P6 zX_a#-62MpMX>0q3H82G!Yau9kwz8{PCIiJSDkiV4tP>Tsc*JthSj*SAdt;u(tkXYIm6~|- z-z3FIJLHmO>%VO}^%R?MiMjUU%kis-s(x9-35B=fi=*})&HPAHiIb?1J##>Z@1bwq zgZU7h_?8&%AoNAC^b{6AsLqn@s`@j~C|ms^r!IQ2z5^&38NqN9t_!nd93GfP2V9)##UQR-N zajf^A6*8P3KOb`Sl9g!9X)olxLb8PZg;2fU2P1hW!G76@g8JF@?fcmp{wf?n>#kWc ztpV$4+s2E5HzebNfz=-&P%X#FId&J1A?w@KH>?vf&22vkxmgR%fKG8=O zs&4rvke9V_^z`JX!SykQi<#A$>G=yiprbG9zDU9-cF+$2}@RQ}EHI+^Xv$dZK2 z(mOKz*b6B!JZ<(q#W_isFNL)Z8^+;zzq;bYUl0@QLcdL5Zk;1XH{xvM>;KF59_n)| z#X#kLA67~XtkI!YR_fY4C~a;LmI4*+$6I^T;cD0?Sw#c_VkmF?0 znqcv5%J)f))>zx^ED^7R&^4O?{ngCaRZ_dlRq0(fI%$r3G8z+D!?%3-%DWEtw6gY(0;ST7Gh z-;4<~8oE}21OyX4>9>-We~kVabKc$zvisR_zJV-X-Wffj`%gI-egoPxb4X)RUU{!e z52)&RHy=S}Rrp^2A-#ke0;f?rn}o%L3hmXR`}GjfYFI0**rvvv4^J`Oa?>&x*_Rkf z3bV@d<(00De`+zaoZUyyC0Nwk!r1rYDJ@=duAIJA>?EN*_%D4Y)Y$qJ+)(qWzRzt9 z1lcyzDNv}QGn!!Z_KNZzyK^wV?YJP>mLImAtZR_p^qvOTs?oSRqthYMteIi(uIvQE z2-CW_`9}nYi|P5k6NNcx_p!Iv6-^JW8h?%C`C!aK=327Idi>7yW+(Z}4-|O7im!ue zoV4|>gF@*dwmg2ADFbpW&1y__GMc`d5Xx6!hu-^KB;3wB&o^^x;;LPlmw`8^`)U;d z&$l1B_+Pcnq#_n+4qCY^DsAe(I~Ve3g)dz>Ih!?{NA!iWkYL1@$}R{ovF*J49Fdk8 z)bHVBe)`6W7b4WcGAAix7$S)#);!LvNZUc3Tn7UM)^dxn_II4EI$;kWv8W&(-tBE*J@)?spxW>&fAyK(m^wnDv(l?doWRPQ?kf z`7-XR>4Yqv<%i}Me7cRtJgDnAF_`KMLerhs2kX{O=vuvM#Sqw)tkwJVhmTj2kGs>V zn#DO10~<~mEH!-Sg*Rt2oZ?aQh59)CQ#M^R``XgAYz2idT-Ci#Vkm6EYaie^<%@A84jWf@;K^$x;U&MHlVKZ3zID# z0#L18rILJmXE$ywH^|8%nVv8$6t~G>x4tD&CcnKyAS)tP)#{%u!d$JUMOlhSi7NSJ z{-fE85DzkiU+wbwo6n*$NsbkFS^Fk9+wE?Pbo6XC0-%eZqUXfWhpLCgqxFf^*CGZ^ zl{9m!`x>~yTOXJn0bFkkPP{o(bK)A%t@}L6aQ50{BoD`!FgLxTtX9JzMS2n#RVCeL zc%^ab_Y@9R+XYW27u>+PZ}bJnhV=x$&T-zJ`f*hAkwFSrrm)9x2=GuIOB3kJIak6^ zMO`WH(!GId0{3Z$d3qG3LfUZlH`@v@zXPQ9KevbKyI*L$zrh~C&!3LXl3TJl%RO-| zP*&E0p|sj@GqdUg-xV?FMVhJ@Gj1~@!dg+|3m-lJ=P2)_(HbJvTgEK!ltIF>AQ$Yv zv7-S`#1OxaV=XX~mT#x~e6xnA-s2-4b_XmGfTnz`4bY7>^ZuuzsVpw%kR)UMmJxd+ zHIs7)FH^REPGA`UrHZ6n7UjJvho4vySjc+6klF3SV!HOQHB7GGZmP7htvLq@H0CWk zBX{`KnxX_KOXJ<^bQw+4{Rh^D#Q`q=Kb$<2b39;H|MlZwWW>TaH0|#*l>2S78!<2& z%|Mb#1vgGj4T%nF-rme{)}v^9bZRQ=oj3E^mbd%oeNZutYA+Nd(yXt!lq^E@eyn>? zT5R-JTg6?6GRSvS;`;|xEvlcAc};Czo{!vl^!&uMz0=eGPw#`pKkoxi=V_!`V@O

dh;p7>!sdfwvy(Beq7mrJY81)VMC?Fzwk$gGTPjO)jOKbSvDJSK7NU}m1gqj`)P zg?B1M{-C*bek9ZBQ%(EH;$>yfO9MMlT!9{V`(qQ-fflO&`hV3pFOmPMaRgR~`TCrl z3UtIS)KW}oVv;Aap#8&sAaU5~Us~vpr0)+cMCoFlwM9vNsjy41^iOg?G)USOcUe#( z3>V(DWx*?9$&!QGi_0t5+zubn7S*r5kL(Zc{i$x!p=LU9Q!P&|8tno-MS$Jl;B=da zbMUEO2h_MNY>f|w@?|hTsd_Nu1lG;!CLhE%|L9|74GTUO0VSe0i-7ni9$T>5T?|Xj z-s)Y6-;RA!iA{87|K@ZUy6YuX9f4x-1Ee!RaiqE`0BNC{!&~<-fTyPcM%xomAWlhC zJCF%1) z2{#q7bMa?8VyLxTFQ$T#TGz|W?l4lqGhB%WO`HafN}$z;!Nd!Xi#O#v^Fr67)rQUu$}KD)z33;4^d@8lEzsnP*9u)& z>|9f>c*Qjjzv*ZY#s@Wu!MTnCK5=ZUg^=t^~=(^oz-b*qyZy|ent>6(!TePK_%V{ zToQYHKwNRrFB=laLpF4}R(Inr`koN}ypsm&l&=$<%f{H=|z44Y9t}>5JanCMm}>rboE-91Ye?RQAg{U z^Im-+%o}|H*!8rnNA|JLELA`NoACv_WWJxxU1{hQkoexCsd zjny~F6;#DhT_)?dAz45t5iB7Gq!!(5o)2OD^%uOWq3!9_E%aRDuzrokSfUwjJ=Fc= zbv#F3xJNp>GOAaBKT=1Jzj6PhDZ>HjxMo8{u&XDg7TW|8Ed)Jv?4wa3YD9gngo!8B zz!+oF-U}Z=@qe&Qqk#L^l>6<`%$LE&AAUyhPgDv_epcGBcX+^BdcKu~v00pFC- z!`QdLoqOtH8jD`f@XsyKJlJ$V=jy2fgilrKiCU)oL0w%Ng>Bn?ZJI7|&Mr`cukD`6 zgkLI**Cuv(>HK%=IeFD%n+a7u9k-3diT^`mkX)OC|DQ+(y9>_q{ny1?0E2N^4dROt z{};+|Bn;%Va2l$z?i@{`K67ri=_GevZNhcwBQ%~u@p62~bk-`z9dXk=lhk{O7ZznZ z-}Bt?vrkyOWAf67oI595!vTmSYCG%*@AZYCNL-g*bsY*BG4UVPqF$db zZi&8(YvM;h^C>2ac?7a$&qb^n^f66!9WG(`68hMx9Ez#=Enr$)5?PQOc~TG&bh=$qwkliA92b(9 zIgSyO07+Q?-uGYcTo&BA_{hkxdSiSv ze8JI)4cN78@FyOQDd7_Qa`Wzqv6(oB#|I>XULDUF{}b52Uheep2sV{^{2@*_S1|k? zXP<+B_u9IaSUSEk!f8%2Ew}#^(E~2};^Cr1u za56YuBA^{H>kW9&CdMaV#KDJop{DEn+Yt)bvJL)is-mWNFDJte!Gd*#Av%G?TZ>^` zS1e>%W(zE|)!_M?3yPu$G-KX0dGud;j1aXOUn@k z^GUU@Wwm(KCHoKbeq$rj#LnA|z$H++k;)e-C5q53bXoqj64KY^4y$7l$O<=fb+?`h zaPr&X-3=l*t%SV?`_t#-Tl*KRoTLzCnvxiJLe`CD@ERX~;)(05ZgB#TyO@((Q;CsW z`sT^m9YlaRie;KV0vwdw?&t0Zl0Ew0%<`U$<;8b6MEanlo*_V6*4*nYC3@8Q*`Qw2 zkVi3{TKSp0$u;s#3mF1R4BvB2zb>xQkDV2gL_@?L$P8u3)q)+Dt2fH=GtM>6i>}NY zctzMxMIWQ`xK!H6g3|58o~@HSi&gsN_O`i?11MR>iz5e5w_O9Sc}zeW70%0WPQ1|{ ze@9{yV2(YN|7nZvx`~Qp#~c*{*+&B*jJpe-o;aOM&2;5FZLcnCm6F38Lb@*_dfO$+ z%OTC}{IgfR(}*nC2xytWZc9GXwdfj~(sZ;{XNhM6+SfYn%sLpVN5ub<-B`B&Mx-Sx z)ogD)mWkxSmqm|mAL<7Dl%)67@+I~P-@dqvYa=aD&HT(Y_Vah_|6Jyh7AZ|uaJpA4 z+5rTOokvPoIro2|hWY2WaZSCScPnm0Rof1f18HM^=B?LoS@R9j`FQ%HJD}f}Ym_>p zEur&p?@9fd40~ttqOddp{$E8e0#Ni&>(T6Q2fYs!b-RLJc6H_tZ%;{l2+cG}bpQh2 zrBu2w40x$(wlyid>jQt+B~WH*W9v_z9*{%}JYn3F7~t{di1m37dyA(Qx5Mte0qmvV zq$zz{>&~@5@p#II)SOG)Y7XB<`d#|xFQi*1u+P+S{xdi9*QNH2?tV^*`7qw01}Y)e z%jA@YXf^A5x(u-nw`dqD;^&h|(cIi9rDEqBcXKe=G12l~KTjbYhTgmv#P>3syDA@6 z$aL}1HTTTuHk*9>_y33~mzk_gu>~N1=ar%c76;Xp``-mQSXvASinul%$2Me1N@Fb& zN$c|ch%W<&tX>#;P)JRW=98Iza2OI*Z_olyK$o+>C>i{#_SqSr;k7}~c)v>3Mnbvp z+lILAoi-%yr7iLjU48VC9$8}y9u4Iw$6HTKV1-qYt| zwHQ%6(q&2;neCC7_ls0NPMj}1wx7b5&m5b12E*C4iF$m)I@@uKj&6SzlhpD7c4ugE zLbt!oR1`bGM~OLs*7jSqCKrbRTTd95NPzQKVXPM;I z=OxIvlTRC)cy?xMv>39<%Wah!zdxrV?>@|;#Le{ zVxgj~8AWYS2n%5bxuucX0QEP#>ueVv>F5CmAHd@|Cg2Vcvaa(uoBGZjGc!rQ;Mn?} zCR;TXfS2AMQ`p-bF2D843P|F`j?VfU@jk6be z7&zsPVP7jc=l&9w*f*27w=x*Jfu&|*tC>yGjEGww7FYw{R?qX-n90q^px{f?Cf|8w zQz#>KztJ|-uX4q6m&!7+U)3H6{mc?cVXr#Qgz)1LDjaL zeKP-oRriJVm@UgMa@l4dC%cH`7X#+~#kobEMr4>o;*N;NUL3>4(xT%Ykge~mF$5Gz zY2~1I^MJ$YXQKGNZxnH@Oi7NzWdcr4lGM0Q=CDza@#W>f^ViRE%mh|8nMoD{mHA(g<*8T_WHF)^QsYl)! zT+W}pS8kSC0OqIHm~CK=T~6m%7oJ%zQ+B8S-rwYp1$MwmZFUiomajIv{Ic~YTcI&P z-!}7%gfqi}uf3(1D&edfOta32)tOb(%t3*7E!Ck00&+7+qFXJ)ZT00C!3`@S`Q7Gn z6I`k#@cZj{$96So#gcfkQd5tyP^&Fur4(XydEAC7?#%dlVO&wuw12apu*BNiv`{|y z;ZGA95VA;nc_X}xF|=r}rD@_so0a5MHj-7#Q+c)LLm;n8swTdZS_kL7lbaT-RqI;k zFRN}|bwT`k?0>8>(%~dI5Mbh_0kMg_$=Lc^TZv)G!-G)f_l|OKmA5Gb3V8XQ8#g^q z7X427AhI0ce{C&7)MeA6z#6n=YdWT76^FzoghXN0^LCyZ8V zIAQS(7@tprI0k1-pd?#fA`DKYa%uSnOc05`B?hHU_o96r=%qFL?lEkF9+%XA6@&Ei zYkqq-=_5Knm5r7Rj=_9Ks0sSJb<|L6s299Tz|tWc2oK$A!r!b2S4Z4PCs9ngt&jJx!z z@BYq7>GNv?WjGnnTEmO$d--Ob&nhH|qE9Mp#DpIUL9Cc*&Pxu4Z9qD*muT8R6WAtv zFy~@51alt(MsMA4w%FW}?Zcftx2k&{zidy@+W5OP-o9lp+COnvZ6NqKxG5TEBeg=@ zl+pLHi03v2@?v+`61mpB(;VE@i_s@)#6Lhy{msQ{w&l_+(dYr_WjF5;eQLblSDe~N zC_*LN3njESp1p1l-F;YG6<0=K4%gZ+i5|}kyv#bHk*eQt;P|})tKYYk7cz1cPnsSs*KwETRxDGaUr1!q(;N18sI|Kv45X!*k=3Se_J1tltJls!K9!02^r_W2 z(W`uSMl9#a`(LE5vyI=JujWL&p@;cyOSSKA`Tj9Rca*REmS~UlY0{S_?6>fE2zvit zl)YzIlUvs{YC#YYv4Yf~G?6A91QHeLO+b1HNbkLqAfljD=~Yl^iWKQR5s}`c1_&Ww zXrTo{AOu1<+536FbA9hQ-@DJ*zmn_9pF8(jbFDeY9Aiwf6ZpWyeO?wBpRb1VV}G*j zx+iD9f@Re@ft@ZZw49IO1c~m}R9XNjslYC@Xz$G=Me=X_2Q;N(pcMx(F$?UFT$yXq|m@m11pmP&f@F@H8N^KXBf@RerK{nf7aD|YD7 zT^JltJpK8Q4m6%+Y@JcNm-YI$!+KmbGzMHkY=`K$BZ6g^S^JVAd@#RJ`iTKtCdew} z;isp6@!Dqo;54PlC+3CVzx{XCAYN&|y__QR(fvI#M>qc+@!jg2 z3HkMflEtD6SE_IB+w5Lzu;T=JD9fXy=bK+QXKlOO!78b}7B?3ya7#S;-N_^dI;a7d z0|}o()o~X9djh_Bwf*=uTXOO;>=@Y8wy6gFap2%yeLhkwK7=dGovJ4`SXVfCG@aZvl ziQZ@A&?$T+;!-n zS-$!_bT9AjtDlM{@5T#$FWuaD7BAo;mCcU3ZV2U-!t=()Eqa zRM@@#G9SWiU>eNOyDy}Ypi(GKIf;89dVk72q}zmT9HKWrES;K3Pe8_6`{+!@1>O~p zgE?1vD*D+z&HR^qFFx<$HrHOTynPjC&KGz`Z+F=&b8f!RWjpB6)rgMdp7GqYfzq5k z>1W4#y~<2tMA(Lv!*H!vgf5Kt9nSo|va({&F28`n`<{&{0T7?3N2)?TQ6B}WKmK-l zl$p_rgSI9hbMCdRMFl?C?tvcCWq0p)6;R9^+6Y)3DM%|WgTyvG@_B%!TTB$ND_=7~^Hl%VS*q&qpBHf^jkp2`9AogdO5@W`CuJCze#|&*; zdOa???#6VO#Ug*-iE2Pq2Xm5g2uqre7VnmeMiqQAwLnxOd$Uoqa+p=Y5USE~Ikx4q zZ57R%+DI)adHFNtrFs>X!Y@67Fv*3(g;lYwA8%{IzZx470VhxUq$!ov@$yyopLpa^ zn(k)SzT{`3OP!)hHuS+`mAZ`rcOkvc~e6 z)0LO!{l`-?jsb>fbyHg5z7rw};3ZTiEej$|DQaJroF}ie*7&pYo(Z&}m_#gRZjPKf zrB;6mpoKdBuIhF=<=71|9WQb?(r>0!s6(uYN1IZ0DB`IU^NCbPYxFqC9WWj&Q)7E2 zkue^&*b^J~YWzpixKlrYqg0IT-gNib1X|3ExR6HUr}uGNt5R}ZiUnQ(qb>QyCy0C> zZQA#$J=Cg~WydX3?aqv^r(0#~GqY+>DtF(?lEb;$y#~(>Kc5Jlnv``-U6`4Kz6#Ro)^H^8>TQj)XiFa8)bny2$R9FoYYIoJD7xJ6)CD<;%fn*U}IdNth)J> zLsUZoZqjp!PjyyilNfQbK{>eJ{ln{Y1#U)}Nuqp5T6n_JZ4t7lebqX9wE2kFdd1r; zz_LqO#drl94bb-E?M1)l%&@3eQ52ttMFZZ3p345yO7BYx_|q zgvTPkXjkipT>HikFC4DcM?OR%u`{%Z>g7@9MAqgL8*wGA@#uK|VobVsob>wtwo4SO z`Hx*I&)=521=|Z^g?$IMN1lnH(Ll=I2_TU)NM?0cn1d*QgG=A*olF}={yQV|ot-tDA0`pt{G zpF_zK)fMdXe0}rd%>RG}o@O+)fC^OAr9g|sSS5#0r@k$9@*)asWdnb2+p zr60KDr6S%gO*{V%7oX&gsmL9@|n%}5n#Jq7X z(2t^WyF^R5WH(=%yt$Gbh+mrxZ<1gA&qWly3O?WYSTWfvywB(39@Vl;&C{>Gyg{UA zgK6z)Hru~c>qR~aQ3i)BUmbaLIac{nldIen?Va8}?GT$68;@@LsjhS}?JQnJZyxOe zj+2*B#QEG+9dGiV!+m@KC38TGJU8;og+aKsOD+##-8dJD^u@K#U%SH(AZW;<4Kn6} z&=5X!c|?*VoryUn444I*uP-Nc;W>N{hG_Ng$GT?op}`WDr0 z)letk2}jkdq!$O_R;+nRZIQzW(<9I0=|rTAiyoj!a72eI;C>tJ$l<8$A?c3vL>4lr zf4zlvmV3J=I+4UfZraiqx01JIS2fyUIT>aHSNJ#{he=q_;!QAnd;PYjkh2!U_nj6 z7r9@oni7A8v>Q?gDyO?L7~(M(sHNo*C`mra)Qe*Lb^dW8RfbwjA5S%7&`SB2#fJVl zQZ!KE)P|1Nd!l1RV_JtwS`kciv$1k6Z+NLDdowln!GWBw($0_b1A64cfeaJ!f!8cS z?(X&3Dk!yrtWzZXR^|#{sr77>jP(h|Kox?CadLw(EuU==#I|EAt5>UYK0Urw?bs{a z({MfYBw4)DL3NUd+x&5U5K@t2$96VfZBgRD#qDm|ep>thehhc2HgKK@`u$YK(_^Nc z2&-iej^4NMn~F7Mt*h`~*1wVAkdZRymhce5(U=W={>r9p$wr>45#00VPSFMzxB4cCPX!=+|$O;`)2F zV0UW{$h~zsP5h$^HBF6|mtQ~S_fjPO0yfR>4+kBAz77cEnpU@$jUo<@2g1-EbgS-) ze-um3BEVuNu+ZDvVq^huTiaS!!S)TVpiagCE#O{lCYZDgc4o88K)?^AtzNN&4>Dw; zNfqdw>45NCX2UN}*I1yIvZst*!4ThA9$9tkV5#s*%XXMWj7oT+CFtt1eCDh-4c+NH zvCS!DX)z{aqw?uC5*M7m_pa|pqPch1ssL<_Zy*j#X62${!l3WuQ~((Ypw7*HoVW-1 zET+b_5!Y5yY`b4OX-HuQ+&=nDQcU-dU>xU~JmMBloeV0!BUAHr$)u$= zPdhAI;>O-@@E5XD&C#8qzxDO8v%j4og&deq@|`6FDv=lird1fLcg3ZCCzcUM|(fL?{i@(V!)uxMiNhuwUSN3ZGZ6Pf51SX#}^M_}2(@$J)PKXABLV z5fT_0NoUMYC-mZWRN&0wm7}cu9*$%o78u}lo3C=gr}f~25WsGHsTg=40jrFMpo!tDc;+w* z8;&ru43@S9yMgH#puHEGr!;|C(H=10^>K;zLIMJ|GC80ITd-3kiZsr(gbx>x+Loyg zYv>@h^dn%oKYe-Rgd}E3y;FOddq5lPtlq9~EWaHU;UncrW&}zw%(4k1Ht}}8Mbgr> zSXO{kAf8ikbuC#)Oiv3`B#7MZ5@FeE8Y^8fo*ABsANx|}Et=tDxch;LT$aR$DqKln zcH9y|+!mW}eLTrbbbB_-@j(X}YbV%rg2D%ty<#iyKD*9}Mx`XGx;h(ymx6C`MXdcH(WHfE+&M9ix{Dkk6N^ ze_%J{nJY)@s=usjHBft?5(jIkF0a&ic zqQm#_n@BIQjroHq+2fpPF4Dkz^aC#Gqvr+Zld6p)7FQ`ojfZ*>+YxnbI~d^Tl^r9P z?0hf=KMCHG9k2xoA9fW)G%xqbf9>52TXE9K^Fg*%ejgn!{LbMu@eQ>@rRmE$#and$`$9B1W@Au8T;tfR^|>>c+~Sa`Z5f%ihFw&Ih$@1h^9zJ1}Lz(m}olWo&0 z27SrDGk(aGe;dmaoJ}ht78$Ns(1jH<{>JE5(UyT;tF}^@Kek!MG^u<80&XEMFliKn zN=jLh1!OFF}wrGO%E@{zNI+y~m19}uI=jR;fc zhk?_aAr$iI@%VrMd~H0#qJVsJ& z#S+?u4;QEreQLR*pqZFNr9)W3C|)N_2M2H_QEIEs#d76n)&$;CzIV3`@o<@)G9_yy zIj3ZEOpfxRgz2~L2A^zLx01Jopl&3&uv+daF_IQ|+v`sF9y|KGBBh(!#tZ2;?6zTMQ{J(%cXiI0qV0NEs6Jm3hh4$DR5}2*ei(cTz8KQ0F`tj$e{0p3!mXMs#M@xYZ5W_SB8 z59Y(@F%1!&i#dR1ok@6gU+$ID+lSSy%{7a^`-_QG{7@n@xCG-$u^ug}C9Vp2ertRj zAsQuy>3xR@GORCJJ|%9-`{zaBoBy<>C*e2zw8j3V0kq`BCH5mcqjI3Zr?Aee?cW@f zih=R_SI_CR` z3g1`_{FPY^b~4U)69=7?!UD3G=uWJUAn4lgg_GSt*z|VGvKnPqt94%%Mff#o3k%zZ z9^)B6$K%x%LkIP!vMx05+eUiNljc#1iw*9|7Aax?uLnNR%TU;|0f#L<`?D3KI6_n# zY4cv&iJ%m~M0CF`9rfBvmfsdoVxH`Z5}K;Zi|a85<1Tb7*)ij*-*roT=9G$ZttoMBO!_d;*o2-f~mcZ$eweg?0>fJ{hV_b{kzf^LX)#5-^m?i1K|`MP${v zgqv5yO!AxyGDx)`qip@?^kDJhLF?hZ0!ZN|6;XFCXl3stRoz+7)fUNct37j|@!dtt zV>*im(2^@{y;xzD#1sL!W-OXxsO3c zVt0>-GwfV$?TCr=M(N>!o>2j}7YYBeV4W85?gFd44x!BQw4p9mfy~`rZ=I;#?hZ=~ zH!tMkYIlmIk`n6@fE<0_$HYR>Kkv4iZ|AYNQWj$*ujAh$p;IHLn|d=HFuMLWJ@S&C z)n8ef{$&YsMqFcO2zq}D-9qjcI}Mj@6t2ltbDsym@Ije4atyldFBnP1$GsQdwqN08 z234u2~L{@4MCfcC~u zf1+WH^&Bx*!MjL!bvPm@9Eqn8+v$+AD*5d|e6KPjHUpzXOXw(!VE%Sw-LFU<5uG<-)IE&1L~;oscmGs0wwz-xDsVN{ z@5Zv%S5FJ4L$&-^c^MS73I)Jh8*52!gYH=Fnq{i!qb(&zWNvk}d7y1>AVrl!aPDSO zo=qneoOm;rm$kfEIT{pY+t$sm8&S<4Q!247Pbl0?TK5%Sw!k zb+Dj{*1G-Csf~U^OAhC#sU<_|ILrR$#TV^F+MYwrYH{Lyl{M9W*8mKpw+!m>1L5@_ z2E3FC<{5qJv(SMyO~Y)jj`v78=>jqVK=a7P`zT7@s;FM`mdk*SUijyey*7a5yw8Xd z^ery(c%$Qo^voKA2=Ih;q^9v0<>^HXBjdYU=fBSdtZrn)Y}w2K0gm;&EHdPBCv>&q zmW!T6{$WvWX3#7<$@+8_A&je44(EAEW^P*KueyO=`9#tlRwN+%V@03i@k^O|8*Fx; zde{~=bsS7MiXsSgjz4od|14Z%0DT0k{N2~~cZC1^5Ro$ZHbp2sd+t@O~f%`%ywZwf^3-#eVap=FnVW|VsXCAz?CNRFY)LVuV9j;(H7@@i( zrp`AO!?ml5M@t@~+jbEt83|V}o}687$kU7v>9<5KTWYODXL^ktx@otP6l;>z^v(DU z#{h^A=e?|W$h2(BxPYagkjFz{n+%$S@Y_~P{VB$DbLBQ%9EwGZ@cpyO$T#fPaW&IS zT1u$fr0X;geN1D>$KRp*r4wU&+>6>9r?$rP)C-X(FXIXUVhWVHulZklh7xfweExUk zXJ>NmQt=sjjf;^q*EOGbeKI+(naOWeRCqBKaQFVDgTza*(-h5~Cx%yD44#JSao5qL zJbOaVM{|*{2!1-eIXv$-thCyGY&{#+=e3KP$^PI0_uIBQ$?{@8clG5N8tyY^FFrc+ zfBgDU`MUGiy$fbJPes(<8N6baC<|gZdqY}wd~fU=e~a_Wcfm0S;je9mEZrM4a&v1* z`Sv%*g^EN>>2?4m2xboR*|MHp*W(eKiSH-+I%9{+P4weor`l%{wXf~+TXq-wWTUfo zYv^1dO*DSO`3CJB&G6vfW3} zZ{QMMqWr6)Y`g9((MT;h@~2!$x2>UUh~@ev6sU4WQkoyQoK^iomEuA$8;8>T%&i{pj#gHH9|f3g_LA8${YD>f)aFq-U*Xbahu`22iOmTMKm+)CKxt6~>$ zlWqTCz@H$w7G7e~-}HHbgJm(j+>`xU;j|7yeB8f-D<)2>m(dP|6vo_q^GRi2`GRgs zd0zgi6ZBKezHl;BPv*s=s{yr$z6Yw)hD$eYS|vQcAy&&ETidg}+#+>!7iPfrem!M( z;JHxrMJ{R3xSN4%q{jP_%)TAYON0KeA6l#A`?%xE{nGk+2WAsWEl+b~_$D7JNy+{c zN#IGBb5HTflKAA-FO@a#`8DkQyzR9bwUg2(u@=r=)G>;w&}5Umnx{$Zaf+YAlnSP~ zGA+^hi-zF(;i(s)%~GN=@30!(LlaoX#-Uk%_5W$p|F^gQcYyrnjx0&j{F3E*59?Eu z)^cwxU`TxV`H;>zJ}Fs4-RLv)UYRfHIC&3U-pBhVy6TsOWtnGM4lJ?n^Ttx{*Ie=e;ZhKC|C8&&h;h2mw>%>@&ovJiu(ztm+^5~5~ zy7LU}3GI@`n;$$72`B?&?~#~grG;Z~eXg~L!?3!>d}M6A|EMyeoYTMJYiYs)>Su6= z+MvFy-(&L?Ap0;OM@rZBLPoM~6Dxemev_4KvFL;|DjW;OLQm$knb1$N<=vZXSwr}= zD|X^KV?_Gz8mL(%3*WO#E5kl+cvI+mK(^QT)EE(=L!_;DiWXaMY0wV)?a|?ry?Y`w z^VYLh&b$??p=vEt=I}Irh466QCj5UmdH&yva3)gbs&mbwhY6tMwb!>V+V0*9@VPe6 zhjHA#ue`dsIcA~xCQYO6X|`ee=f^D4f}f-x8rS7kjwLyWv&pwlwaZz~zSXhojH^4@ zz)Q3USG%6>+Zr;f8i^*v?Mo_YWNT}cXIbBGAC)oS^H`qp44wO)69D^e>*v;3H_85B zym0W+Op5pS7f0b5Xn7<$I@6Q~a<{?OC#8Ez#P~ z1NGKpyfKHX2z$570An>iR5=!rw(d$qOTfS96kw%Y6r;emHPq@DhXmm6#HME!-tUu> zNPU-Tx(GR!>qAkSB3ijpzX_5vk6?F=5`0oG1gi*F>`HoStly}GTIYyL>_rs^jtBf{ zVm{`Qx$jV6FbHxM2`^z(1B^#Wi82mME0L)GKVmIxNkvyS%=*3;rWog;1Y*2Au|=ED ze9x3GA+A0*-=3k!`PKjb)5wS>M>zdG4WIM7F+z^nXMSN&@`dwn-ly0wZLw9{y~fD) z%peW=_Ej#n`S8XT^U5V#ma&RkC}xhp#mt)~TyJR2)GeY~0;(9Dj=f6b*)NYDw=ch%`LL7)=aW3!Fqdc(}0swf#GP8VRnq#A}D?nsi0f)pXouTj3Ns zG~TJTWlwK-OrN4ztixUd4Qak7x!omj_t_0GjIrPrWL(Dt9+BWH1=Z|`m>~S%YtxZ1 zYxX?g-GF#jef%y5+*vi2A|L>4&2GrS+O`+_k=d9u?dbx@<#sC%R-U2{Y)BMXKq35%Nb zXo)UPVTc>=aSUyCPXn)WhOkZDcOjRf2(vgV)4K)#AJ^{xw)sEmpR-ba`z9#!qu1P6f8tAmnF1N2N9;uo9s)lq6}KGR6UdGoWtcw<$7z`Fx_abdT0rv zXrhLoEta~da5D>g@m;DqezPV;fyP?Z3C%h~0d5+B#8Jg7-(wA*@*P1Psx*ruZgeDlw z;6HYE&k>oQISF@2D_|(oxsj2^&Q#g? z3bR>m8m&WS+N*&UY!MxNw^M?cml$Wyv`z4NeGWbaMQdRAy+(s$|yN1BYZcvxuD zh$7{8rggkbL!mXlek0-V?s4`B&++uNmTv0t&mi{HmZy7QzV^OS!gbOlcJ$c~c0rzh z$U6VG?f=);M;kObPd>g&deTdytzI5gc0KRvd7eu{j-u)e?3X0`GgNxH4K7K1txh2< zdXZ|RGTOXwk@vOoy@bDx z;iGMdCm*=BWZGzov6oxK(T^YYsreMTEH*?k+n*PUXY}gKu@-bNgB2ZooRuk35m_`W zE6FW3*VN+l@{*!vY+A)sqt~CVe}#ckFnvaifUD$0AMGJ)qiS)vj#jvP3Bvx%sbf^?q>2Fk;+6N2INxrJ?NLt=PV-QeT~I{c9)T$&BV~@Q3)$ zY*bU9ah++a=IJN!<=kNcx5MSdt5etK;Swk^@5}GEpE*aqHX4g=44mxLB>jsZV7#$r zKH$#RafPDy`C8lNbq8IdO#Qc;jS{HMG2tzJ+S+cpFVyp1wlw(SE{l!|gF#zLLExn@ z`V~{zFm?xTqTMfONuxz{arffSd3#~A;_$ap?c%IG>L=PGem8Vhopp{hqMQh_N<5uU z3JZh{R4daO9_&fBTSnX3xBd1EO_{gM9iF;9H|e=0qRy%n%|vOis47Dd4m4Pc4w441 z)g25xP_2Mtx6)v_p7Vz}Tn-6ZJ8o7cNgN{&(q`N^hD1e@HQR-E#?jYzCBh!Fu~5@p z{^e_jtaczX=ils^VbBP?m6~yIIMMn3~G*IdieblE5h8ZDHW&`cA!oXD*ygUVI$M2#S4nrkPq|ycrNmd z_QwjG&x~(y(!dv+sDHYq{khIr8H4Sz^lX=SxTT^D^^Xz`jT64#vk#Ua{^n}U4T~CU z75VX*VINa($b5jPv~`z_9wi)9m328x?_7u9ZS}Me*PR+51omGTtg2wIF%tWTO7m^3 zK99Sgi21pMfU*2)K)#n^OBi@BUa{g8suR8Njhds#&-9V%X=miJ3mj5})*ZcS2X|7l zr1YhkD@Deb4a3o~EhG_R7xr3}ENfAVWo#sCV>!nIZ-);yV?`P=*RG%2;{V+q79<;f z_(0ZgMOXkg(H632&hbqxiA$H_IGDA#GMHTmyB`10f9)9}ta*9v*J{3Bt>ciZ&tr0q+*Q$W;%+>0?`cxFpCOx}VgUmNy zEzEgI^Yj2a-XqewSwkT@R_01L#O5l61qQ^Z%t0Gb>w9C8;h87dlHImrxt(CYs;a-Funm9|iUW|9vDLK=o z{Yb;~{pI!3evHr)@+avqP;<0wldLEt2poINWXvfnMW^gxC$ceRwe6!5B{f_~om^(u znIi>Mp)L?Bg89)*^dE_>mj0%dtEzmQuL`i~WAHOn0?Tua55RHHP~EaWpt0yd8^wWQ zpIVk~06{F@-*3lZS z2YK_C;8R?2zKjZEwh5Uz<_k`9=IIxpC2R%J4(5f)mubTQTgNl5FZ1Y9Fk7U)oSSxU zCZuQUDm23i$VWwN=$?b;! zH|q!5;cGE~{8uFVQMyB$t{0EcrA$h{PDpwYy(9KsBww{WL0%DW&lRD-9$A$Rc_R~XPWaafc zcdD7#1n)?{%i5`t@6Qv3z3@_x%{`R8hq>+_h&3$jsrL7P=@-3~uo@bxETjRM#Z5>U zI0=pp<)=5`n(m--6K~0wejXSj$A6__2s3x9ev53XH|UoRSemtBSp^|Wfc;eSH``k+ z2MZNYYBqNH#sInIWyWcd{Dxg<70U zK2%nWSs^^lb%_j@?CO*?(T4(I^`ZHO-#570l1P(;?+p@G;k5^O+eBUu^H&y+lOO?S zT<(tsyp3=Fs0G*(2%G_DdmbF9W5;*EmdXU8);ma)RJ-lhFgze#!h5%HBO=zI`H;W% zTc!C9Q%iVRYNb(lDhj8(&s-Eb09`J)=b+mES%8~$?cj6*3f!AMyNyxUT5FgN_iG%D zW^buzobBIg85rK~<+&21;0}lM57w`lOdqiFo#A7*uRC)6HpzImBRs{!qxZd$;REof z%aE-bf2ut;71Teb@@T$L007uZe2Cu}vjG;4PE0K69+G#r50IXoqa$RNhO~W{H`{U*A@7xvnZw_CTnb14|nwzU`gki8*6&-IB$L%4Vn zD1V*vlZ5ByjdvYjF-AA*xs4Q?=B);#Ok;dIu-UnWO$Kkh#5_fxHZ_lN$S~t?Kac+) zN0yA4+$t-C_XIF>|IcXP-^mzfB)?7=ucMaW%^NqeUEjrOS1pUAoQZj_{FU$P*_#q? zX`ZOB{;n`G!*TiYzG>4LYq!qycwK)OXyN@JwAMqI&6S-#+L$1k5h@(u<$jvMQ=!|< z80~Umy)HY)Z%s9;b?I~|HW0+{`I*crRsH75v~7_svjP^StvQZph3&ZR14=TrFb>cX z0ke(~F2nRXmx}fhWVAb^M3z6n?jy#8Gi1iOq*U9R)l))wBM@_wg#3vVqE>?!rr;6X zr9P~3ZyHsnOe@(7Tv^}E5GT*%a79;a%wGhVrP5eP-|ys=ju2)H3ro9O@ z`Gtv!cZYljDjJ)qopB|sLGm{tzFzgpi|P0mebU3l<|@k`~J>(tWu4GZm!IbPTpaj zV-3ej6mWU=xe!%-`G%cHNc9{aYV2>r2v;b~8FL%|+0t=N?n_IfLc>l$BPzYeJ5cH3TO0shIdz8S!( zrD-QIC_I1t)eV-ZrpxTk#kn3os27o@#n+@Majtp851s3m!pmDLXZ$4FpEyP{8L>W( z?fYmH&c@O?Q>~$%|P6(aU`!YBDPUYEoIbByq!M| zXO-?5h!s=`7}4`OA#~q&5qnF8R*JS~nViK^utsCdHd`gK++D?qjoV%Gv7ghd`o&() z=u~OA(L<$2K6^r;Urc}EQhmN=K($GFONIhGbhY1V3+}X8Nu-x+Xr`4g2h=tiMR#a{ zIvcg2h$rF@iv9FEyvM?EZqrRF{NR{3D27eeV^sUnmu4_1W?L?wqiiP;Y!u%AQ5xE? zci+Xb0!3)6o6>&yxuE;pb&vb1BA4IAc={mT1MuhO*c?lEi= zFQl#GOITC;VDFi7Sx>BO=SfY_YfVE#B1cT(_Yyu2##Qoqx#fcb8j}J-u^6IV$hUou zj|Kc*LP?Vw8xlb&RM?bM3k>ERQ9Ld`#tW7jR~pVkgienT^~OUQeY3<907cG8`78g< zn;UxfJjkR6YUPbs-5q=)C z>H}XFTz31T5&>55ZOl|)wppCVvrNZ>gZ}UE3&|aN`Hw!^vB&Gl(CA=)p1e-bw8NeF zf#pC?a_(Jr3a!5!P8g4P?ohqfgl2uScWfs z=7mX+?bjjv?o4W`w(D6xrdr!~coI>80Ya5cpL0S9Ym0$+1l~FbwZAfEyUYRTm9_oz ztABqVhY+jR3B?va7c;hol9oTyLj<|GS;rIQSH8^YM&QRKH(rr`J+A!7Sv_OC{Z72l zV5MG(IF0I)Zj=oF?rfGUR1q}mQj~f*V!Wh%H6ME95;O^-U>%3^j8?XdEj+$hxK-5G zZS5nhgY0?|#*caer{^K-hQ~*n@k85#1*c|IIxDCXc-7B7p zK%cl+A&y@@btMJKdGJ^5;(VO=Xs;R==m#u zToXoA)|If?E zL@kkQdIY5McB8fnlYnF2CP04EpMY+gE!)Gb+r9|P8?Uqn=I!XqImKVRPR02)xUW^E zH4+!HeMXx4s@hA2JVKI)NH0KRb3~GfnZqq2exRyJzfe`7&jzWU?AG=MbA{4+oEQ;J zoC_;xMVuO)7)wd;|6|Oay?E&SX3_+Z@h)vgU0Ae`dsTp|*aG2M8OGGtHdZuaB6awQ z;Tluh%fAEv`x*MfD9u-=)T*%}Lego_*Kc)r_r?;F6vI8KR%+FgB&e2=A9ah$02|UH z+@h;2&lMUdX*d%!^eq1eFbr4mSb-KZvx`ANfW4*Vy%BUXopb^f62acCu*L4&@Rb(X z)cgwds|%Xv=^oNsCKESKn1J41u-)if`EQEPG-|d);AH&6*EBVz2OxTFvw%q>%cO0k zIW6E9-I}%i1B8=|bb#OScCB6x{!=6=1P#Zm z{l7BT=q51C+px*zHO?VNnzzyi(A!{jk!y3X9N*;uV##A3NdIgCL! z^IQQ5&kWqZey?E!O6NTO+Nq}movLt>US05TVWCBoY7{`fO$R#6rWQyh+fP9K(JSMWlW{y%49X&jZjPf;Zq{fHB+IO|X>k6&5OKWVq-_}Y zK8negCGWJ<9_;eFjEy(+v^}UE+n)7sxt`$p;TVbDIMSuSQ^y{9oFjRl91u!|FTc*{ zP&Fr@Qy&%Vu_*BRbYoBc@x%oI%?F$8Rfu!SNvC9%xv#*e#prAsb@|4Ic}KbrWt&Qr zQ6@M}mxMo^G0~octLEdkvrHfVG<=G zi(aFx;GneXR-eEdPxWd;GfuWyAftEwF}eRD@ViL=(u>A33UReUy~a6^%_kSLdiyJ_ zatUBAr&^5(v9k>SVGG!ty}Cn}PU9AU8#O%5Fq--V#y)8QcvV##IBTRA-8UZTIqfUREZ@&C;3^?s{Fbio!rEH)n&}<}Cwqc3By(GZs zw>mU=*`DX*u&ZWh%0ghgFiB~J*DpQID*Q*j19RG@Q%dCb0;UxtsFrD?Y0A74a!|Wi zb}8vw6-;%5{Ycm;*Yn|%4cy_Gh8iI?zTT}Hz~h-%U{;kWFEwmwE}?7ADA3O%1Cbtc zv*LT^)o_{>jVS^8o7FX2G8V1U2+Q#aUgF+h`J6WuwSC>5+PY~@V!wP18rB#5y=~BNixs|M|gj7l9G)dS#r>uW(*-`6#o$G@+BG+Gs z3`BSmPOab>(xOPwju3%-?>5?385i8LalXKh_&*FIT4zlhabNJ?^#JQo=!%|DroeH= zOZYV&8K2|L)`&~m=~p6}m+lTdGMzLV{@w}l%YsG(At6=w8;!RZ)@SNuM)lRW@-3Gd zHETANsKrE1vo4#i;^JQVS;$w+-OA1N+CGQ#*qU)IZyaaP+)Bf2Xlq*a=q%s2r3kO~ zW;}!i9zgaQh+>+<)QWn}zld(}`mn1r0_5M>Y{5W^#cde5cV!S{N06mP%)z1$3_QxiUE}z=VIRBf# zdm=B`0kKV+z16{BfBy2={m4lZu+pmJEcliwvwKEBXb+v6#xt~Ud*|dET-%;!gV~1f zhd);VgU^kotb#ZJSEp2}SjzF&TH{k0SKRu7d>SHgUu%{hBp58<~PL_|)f2CL!N3jqb#nAcbe9shs? zl?Iu!@jf!kPuiJ(u{UIpq0na>QZT~ZG%15L$yf1p_fD-XcSJS-T>IlVAd;=&Wm9 z_&?IB{@13D?7n#T681i|H-_gImwtByYq9>Nu@pjEZoq&HadUF~lz|B_s22GjyieHk z9Ob2XWe|W7Ha2K;J;X^Rv2Eoi$%)P)Eu&d)SWA#vTrmBRisgK}KGgG*|NGCEw|ot$ zi`v=FxCyhD_4o>z)G%+1u{hjO59LK)xzMrcaR+ zn>x?T{?hs%cWQ-Kt{sZyYrh`E2#|BZXdS>RPWGF8b-t$S$jtB}OkU;j)~0Uiy%Iep zZj@F^j4)fcZ+jl&w#u}+;V$FzekUetIAgE~O{97!Mo)1uXZ4NP#xV{d(Mb&+?09LA z=soTH4NMYf+mW;pLsum+-8WfM0~EA4wkhKiq?V%s4P$FTzsLhiV9|EO#lM-`M;v#k;R zJY*h39@X;$nk^q7ao%)XmRt{V_iI~d2Ko!^_0x$z`c;7M@p=(J^hETM^l6*Kg=o#G zS-tK0Dwx}p**V(f`yL@seC}bUmRKOw0;o_%>!YVklko~=1$*bEAqVWZ9ne&*m!Q#+ z-^1l6brwR)O#eSp3#l>Sd_J<0QYkldpVwfI!APA1I{4-#WKfCV%c^43J7e6q(O397m7#Yg zcVDpIh&JYjXl)V|>pwYe*^u(qt^9FRpll1HURLgPp7 zE&7{nM>!GA`asNLJCGsEl9QY=lIN&WdAA|n_(kgG3*#lth1`?L7Q688dG_Hc-yq=N zMHRQeDB3sNYT|A9{%`R1E2<_zCp2h< zg;MV5*7%ADcAdNB0J>pk+(Mc`_9j7u10w7vzED9GsW#He&7d_~HC_NcEy@Yko?>0j z5xi4Mt*2vwaTb~7Av5l;WDm7dyUL^RO5_zRdTP)OA13A9b!$9~(3PqiC{$Uec{JcS zncChLB$_L)|H=eu$V{mHYTijHn3a{*C{dWHx=CV$Za16%m`Tod3o(r8GEIIoPmOnB zl_oGIqO|-nN7H8`BgcX+b}twM?|^~NE~iub5M$WQ5357RT1|G|bLRa9)6mqS}iJnx)0 zap+bW`XxXj{v_R|bOk7${$d;HD}RoQM;(clK}3f3gj?N3s7K019=hh>pba#hzi3q54Hw)4rA>9ii9ZN4P zsl>8$FU|i(dFOlH-~2y6pBaYP!Etx*>$=W5&f_?*eKSL6lJSa?jmjd;BD{)OD%9~( zhGDW6RO2Md(z$Gb2r~AhAiGwJKdE;=o}5R`xVT}zqi|``(FZal7vYk7{x)U^(jakX zlinjn@Q}c``x6s^9feJ`@5;0hGRm>xBxcK+1@CD5buSwnLniwL6B6PRp`y}NQKw3K z3tpthIq@@Efq(BcYBxgy?!7bbxj|a?Nt&zHO6ZFgnN4%hxG$}u-RhWqXL%Q6L8kjx zhZXAz+2Gbn|H6wIZ#7TW>sQumH;O#tBm|Glwuz`{xX99Lu~#(0EAEA!Pnu5gyPU!( zJyr*5Tpl@PWB$ooycMdue!%2HhZRAn5#A$09<108FzV{s7C%RuG-S)Qo53}fuz$aS zS~d0wSw%46mE+k{4X&~-KNhMtk=6>ByNp?aR~D9J+B1sn?y^p{S3i}Y<}*RqiU~F;0{z*g3Y+@i}#>ns$E}mBt4LI{f|od%J4XcHEtXCR{exmI zw=%FJ)D;Iee~e({hA_LVRg8Akq_}?Dl0Va6Dk!S8$m^ci`h*&6BQUzpZX{{LnIRt5 zhYDeY2%b5vhl>(8P#j(nI9&Ii-4yqzTCDIc)wF0{*hxg}|6?kiS)IXiKsoi5ZeskiW&QM?ZgV@X}lYM zHpn%aS*#-ws`SOXUbooqWSL=?F_1BQvblrzSgbU;!>R7>@8n%bg1)~D%!VG=MG1%w z-VZT#>Gj9zC8&JNGNF?dj5H)~WuzqgcBi}&H6*xOhl}CV%?7Q%*8cix9B1j8PJ=r= zsFQI-(j?C~uD}>qHpMWD1N)P4+5N84oJtN3ZD8)8hR0e(GPX^pN(PCLs?ng1mp7!h zySV=6y!2}~g-pq|M(fIH>2um8@uF$Ujbgr7%eP1*rNzb>i3t>S22v>Mie}dnD857W zyxQ5=L35NDe$QpmfNa8u5FjHk_708?p3OJZ9cHg^66wl#?+jJuruK%?Sb|x*-8UMJ zLrLOJ^G^3sPcgiV$M-ZePNWlLGk-F`KZ9dPbzC39X`z1Gb%POI0G@-WNcKMcwh{Q| z?2OQ7)#PxdN4e3{fmJi7ymO=H?06%`hw$iT1!U54hRX+RbpMa5uV>DXMs`GtR_y8r zM?}DSV&6$RDJa}2l3W!*uX{hf{J&{Lx0c2W0+Y_tVTp5ohm0H>ha|l{aotVGQ#mwF z+V}18!}yqIBqc=QOD8hP0;d_1^s#8Tko=CY<{C?+N?xI{Fiug0)7jzP#*Z>d}ON;}XJcgj1Y0iR&$0XJWuEXw5c`R&4Ef*Ix|cQzpWc=wNnxBc4}s&ZG1SDQu6z zJaVFpLc7`X^A!?zBcqr#loAsYleKVo+_vW#(MB^K#R}Os9U@a?iY7cqaQIAuN+N|i zN(YN=1<~u}0P>RRv7K%?#GI4SrKp_q-lx6#77z7J2q8oTL&$bqN28ZlilI9BG7Ed4=?)a7u-lL>ODYTUWO4FKVu2|X3Yu}S zELzJEJg$intoeqH&j=l!i6g$z{LO)L2S}_2*L-Fl)-*o;Q?~-+dbzw1$8MfxR}-l+ z9v%NpgZ!&c;;9<6LFa5ZPcCCwpHNz!6nmFEJWJJN8mM)zl8?E??f$e^@8`t|q|*<% zb3KZM>84tG`rF1v0nJ!rlGs(_Z3eMYkoxQxFl%w4EyRPK*E8R=SSk7J)lw2UulfRw zPmE3F?p{K?fSITwL`(O$lONqfkgmQ?`#}C(EP%D=4HVM|R*LrJ6n4FH<>K%vnYKP} znA+RLP`4z|R4&6M&~RIr9O=6AWe+&>PGFtAFs`ds6;6UdgXg8)#gZ6a>>Dw0=e;45 z=17t_yFpTgH>PK+44o3C4yTJCs1txiOLFD$ZGDegM?zmPnQGpNA=UMKR>k55v29p` zawk36rZ6yVovd*jsUOcy(kSydT!@=+ zEvMwDDR+ef0uEgy;5$%Mc68`Z+x`-^QW!@V-tDCEvg)7nCTw^WSq-8jbxDQ^VQ_9CBSmxjOEZD$pp8EeT^xoXSj7-m0T|MCl zLJ4bJgSuYH4)zwCI$`#Mgal|+V?TePZ)6=>=vm^A&7gKmt}shAsz9Ich2HsHyUm_5 zSnctKj}Rs86}cjVm`51qMD&Y(+~xYX$0d5=6R}3>?t3H4tJWmBM({xbpi@zse}Z;` z*X1eaELxo&qhYAES0wXg5lxMzscx$0Ml4K)<&hJfJH3;PemEdg?_m7=m z2_Ffl@x=o7Xv-bJq1v&C!of0A!YYKtVNb-UDm`7d!B^&0Q<@EbWB2G9y1D68$Yf4+ zaHil%zn9IF)95R&`3_H^Vl5wQ_`U8OW~SrS25>^nVCB*gb-V2CiRbIw#nJ30V@5 z6rW1gA;0pQ-e*@{2Qp5r>RVB?w7q0y#&ig|@KmV*8*6@B;y`z2u$vKR`itGLigfOb zHC`C$;mj;JTmcsp4QV&yoE(>pN%o?cbUUJRH}Jj;*!qLZX1V0%>4 zw)^Tk0yTS~(JW=S>4E7!jFEQKB+$I>hL<3wFd8#Ee3~X*Q!Ye zO>)bFP5t%l?z6-<1t(jCP)F$bR88W70{f|T#X{`pun9LX{FMlKPF(uE!mY{qO?Xog zShr9c#EhYZJmG;PC|X@WWahibRFCO~^Rr`l%rKTKs^o;{J^GyzjNQk<>0u$>)g$Np zdjk?2N`kmwB3C0@OP@k|;~IBcC&^*F=kI>*a-Z5JG>PG^9_^-A6oCChVu0wwdcD%%!4Dk|uR*Ca zhOo8=k!^yAhR4FU0$2D{NnnNz=)iUo?OxG}hYV?ku#pDVxP5P zE!|h6I+le-QRq~?#`k`I4EJgJm;z}E4mS=Tk)bmejbDMO&8q}aL@V^lX}T@SbN@Lp zve?hBYxi;T|9EqIYd4CB6}T%tXY{e0tuW$VkhzP@R5`kJ)xB~{-?9kBHDgt#W#?bs z$yrdhR$HKHx>nJvQpVh{EzKfndUAkp`g~`%qJ6y%9#U3H_<02-dzq{0t&7#HjR-sc$2$dV5+9ZTIk~FETv?+dz+gyVN$1= z+v9Tz9aq1t?{)G|MT2yl&@&!!b*Gg{Q}bY*Hxl=C@HC>_&K-AHYMvoJ^X+c7aJ#q# zu+NO;v{kcI=0a<^ko8w$_|XV(SoJsN!xWsM6-{06lW& zxi*0x@_Xa^7E?X?iYE)$ptJK{_2-RsQ+NVtKz(8<>;~8I&`#VTg`TLa zGyd4{MrvL(=cg`68^4&$ALrT^N?(Lhotn|ee8c%O9(Vtno}E;Le7qZjhotx_?nu27qc0AKa`W{8K-|QnY%SqHHyc1< zGdsPR0H=-5)}3iADn9Qf!40n7>8o?VV2I4K9$p%->1L@^gvY3oFBMbreKW=I6y>nS zzgO}OD&VL`F5X6k?%|NKRS?5$Urp3a*jUO4eWRQ$Yp)>452(e=l{^Bh93c#;o`Z#a zX2uOBsyxMwM;5gNxZjrt8UkTf;EA&GFiKuldm#M)-(fR9jwW>WJPiR&mb>Jbi}UG^ zYDAdEvuvM?0#vSs{ex7G4ds2{7^iwJ=S9;M6~ly_Hid!4YdLt5ccU?5qs@J#C`tRB z$JrsN!%<|KRn3U=`Z}+zi)A4vpS46$U+=XVpgz5Qt!}+B2UdIFJo;rOZ_RnElmGBw z>2A{#vaxwyFf+C1rY}X!9K)wYF4UcyApLLOwZbEMs`8;E>eC})#LsD0#=Kw+&&>vk zY~q+xTU{i$TmYQmMNKxm3#4!!TerI5BZcAf&CAk9tU89DvitM;e2xNU7~0u#w+O5W9B@4V!|}8 z+vEoYpILa6AXA3;;fw*~RYm@VzkE710Nn`VIp&XgtLAq8Nvu?z%2SdhzGAHL!7fzS zxrX=55h5qrsWE?OMN<4t4xgB~a}eFxfOf2!a!_`srlT?4_bM+^;M>aNU3Y|lR3K9@ zANyFH2@3W*fjf_mZQ^&ne}vVD65_%46Y>9uLB16-#P$pjV2X5;l#Whx%gsIJx`?tz z%UAxROys$Z!Q0Yh3>2bfAbvKnpfzU!=SP?_-;~<<&Z<2C_-#^^w%_Cf_Q^qkV^FiF zL+dK%d95nenL|qbBaE8>4@JhL6H&RGUr@a_stF?PVZiVO=zV@svMM{uMvYbxJ(`hM zOLWh@)ptY+W!e@dY|nLB?PNwDo_uQdgz=x(dsy|vm#4Z+yR{n^!=ksL*laeX#z5mru;eCzvyo8g0R6~?l7Kn>*M zRq{e=u>nAvA+R*HIsq+j-A`he;eswFA8kB;9KSYtAqdNUk%MAL-sCRGKiP3ZB6k@V z*nAE(Eh4X!(1cyb&?$wk306j3VgxMcK5Hv8 zzeNKsPmcS__o-w`=7Ij)GHrG77s&_fE>JWU$RQ_XC6R7tzTIV7t~jl)l(QXZRq)n? zs(V|0YHnKe`?JO-&G?si!?lc-tm|wg;`8+Ot#qfu#-Mdw9#AQj=cQJP0 z^0-ntoE~D0b*(6qpPuFOO-pO7={qX|9i|CUE6#MczI^H6^xKxDa@~AL{rWZ4nEokk z(r_Dvb*8Ve3DFZ_qC1K->KJslSTt1uj!qSDQQ2F9&cP8$G6Bzcm`!E6rhU`fdDc0Z zw9nCA`_sHvNBIxum7SV{j*pm(SRD1#>w+JuZ@dq=i_25HKLa=CKYl12u4!G7Wnxu! z1!U=SeoE-M**jFDCt*ocgZgk=zUXswkGU%CJu5|(krF_NV>e-4m7;^iN+vu(v`c&Q z=s0aA+eR+&cA3Sr*r`?i{$!$8SufYfMx)VgRMV7!khbM%me;EW(gx3xE&4Oi%hJKl zjZEyfGNXh0Uuq(}D&}cmVD?byE4o~IHCY0!T)6dAKYXA#$2-cU1;Fr=B`&XG+7{%8 z+ey_`Gj0=8D;)WK$>R=Bt?j+v{Fw>6j0 zcm*LrgF_nu=jDXq8uCTHEpp}hg1XG;XMeI)y5@%tF*!Y) z(1dgHam|>pFQWU*&5!OJJXSx*#|-#nD4C`O5okCa3Fe3fe{Hy}&F&^;7uqwfG`n!Z zM=@>)^*+^dfoZW^GS9JQE|4BPY~@8)yC2cxIY`fL z%(Q$j$$k8m)w`Wn`Jn; zyBsKj*1Ndu1_wYzUtGO)HVelPISOYBdk@u-E;STDA6fN7l)mh$0> z%q4*Ge?Ll^;jR9+jh>;OS^IWNzUPuE6Xvb+%Q*+1mfX0+qvx=9oA7c{ox4zg?tqt0 zvv0}Ni(L0c>Yow2e|~Zk&Teb6h(LxSD_oJD2!ddlQ;c~}cX_guZ*S&kzL@=)?`M;f zZk*2vBo;$`0GFyy^K&P`9HVNzs#Pq*X;n%|8CH zvgOgG)r8zB!D439>}>+~7*fF6-^e2DLRhf`|H|TiJ@YNxC4hF{u81LBq7m>2;{Lc& z!o0Rq#P;>&f+1=3kST@JyAI|FN2~Q;P@~j;&b$6g#6(V$hT-)vL6M33BlDi3$~9=) zVhi5oiL$@0#?_Ggyp>J4AUm!*f2eHEDl+Du3;iE9#Xn5%e_r;hUr;RKWjag|cr}4H zYR5T=An4r46yx?UM87{E4SQZTC?}2TE!kAnin-ZZc2F=5nIL(?6_*^ae1#pj;x`tE!2qXOWa+-y|1$YwobgxTXZ}xKIpQpFr^waet>I<9b zPZ#x+)#q9&vCi1jv8kzaQoBCg5>SXz)ize4bXy+IvstaS$I~YX_?7zj23&uSr7$Moji~0?>q2=l*DG^Gr}C0it9_c6cX55z0e+lxel!azYYXm(p%c8D9Oe}yE8g- zoYX2(j*Su28DF&8PBat-UZmOg)Zd8T`g_xBy7)5Rcr?2^NL>sEZp7xA-L~4k;F`+G z)y_{^)ooN3tiX#Qh{fI{spj1e&H&b4y2o5E$Sa`9rv^YASm5Ww#h&9A znp;$@w)y=Rc4^1^Rq|kHp7M;d&(V%sjlk~)N{Jorl1fd5AB>>>-Io*}eNMM2_C0@j zXKB_+Ck`HLvOPHYe`W#v?IX(2`-Z10yd(2`tm}AlN*Tqm$=NQ66ZLg`VuYW1v;X6P zmCFSn92M--T6zH|vw3g5gg1DgwW6?B zrNXDhDQuR2)LhsFmE|M11_%~nS4Imp2MgH&iF2W};BVVx*1(LkQWYIv)7w!}X!*QO zDAZjKW;lI7axXq6$eE$%+8?*)AJ)?pDfGZ-X@?gVVC-eZyGee&^O~hgkE@C{qb4JW z)mt}`xcFWVSPPw<6l$ltrM}n4vjVQkc7kiey$-w2^K2=8WpU@HBH5MlEWh<7-_sU)*~-U z`L~`9+UvQs5gCv}koY2;$&h2< zc16wB???Mn^)Lk8z|n3fziR2hhaMj18ObzW#q;aPIh=U#Z^mQY!@ys{!~G;8|FHAv z-J%&5$?orQQQmiCw1&q#gGOZ77u6GZU5a>*S9OyTGqES9T!(xng>k6TDyJJfaw-js zE7CTdhvrc+Y7Jmaq~cs{;aiA}{YZn)RpurlKQFnYyNWPi|~K!H%`eBeIK zv8+ZW1a3)&{^o1yu7j{&Iz8n!f3|_=bt?P+690JFbVuw#RC;j;*&(w=IuYF? za)5E+?h3FvMpm4n9xAH?8l|Yw)(yv2Vw`HAW1L?Jj45ux-}CiUs&&~|_jcN6n+jrU zT)Ke3K<>k4=tjcpnZNc~C`3rp?}#?uHUePT&{^DvP#OWbsy&da>aeu{nQ_{GpN2nW zmA?D808fuM?r(HUPVF^FqeIq+`@^!ab|8VNn)A5vP$KQ@x6(~ILos83N+OTpb>VxC z&w$H)%Gg?)2-x6Sj&i5Gt3!dcWE>{dIjQal?VV!FDFB7he)h=Z*MT7Q756(LF@Fl- zd$)~MylDq?9?MV*gY4)8(4Bu_wbE$?@3Yj|A9g=^&C29>o0A7_fWB~Tb))@t3Tucd z0QG7)U1}HH!|=9^2^}c_vt4j&t08Ce5;jTJm8^Ts7cB}sbJ_>OUUThX#gj*m2p4yl zzV0Y+>~(fY6AEzv!^0K^i1|4bD6#|B@)Mu?`zE!v^e6x3*iZ#-;QjO^8k z>j(@EwyC)Cp|Yp`o~LPVVitV9YuItI#~yq-2f;7=*^EQob=a_vuw3VzIc;2-fkGzC z+bO4NSBmC@wWG`LbR?H1P^l{(^(^L+1?1 z9>#<0>v_B0+*8!=d%bV*Q=LlQ=`jW7SzQo&`^kNCQYSJvNfE#DjmWx-|hhxhr7tZZzb_umpSBB%FW)CAIg|37r|9~d9r3_a>`|fL$~{4oaR); zc_VAc*L9wiYMA%F8W6X1E1cF4DrI|9ZbBcso0TH;EZ5fl>JG}WAB!#3(f#Nn zXR&5mgESeeb-25)GwW2i%;&FDVuUPE{yrCu*wBbR9LQ9mp=LCiuA{LC3vruVt7%`a zEl=h5sJ_rFgbAL#oKm8Dx&hFeoB@7)WlDTW^R z)*yKR74-HOsPy&;9_t(3a|F0|{#sGBK|U!HzsD&15%EO-#ZoeNV$7 zHrlcI#{U{=^`vMv*UQndR)Y;RcwIA0a_l_oCHuu&uBA1@xS558fHryB> z*#$(ab{DZekCD!7BS@ET0H3Thf5IfGaOwwyyT@r|RBqxL!Tlw`piKex*ouYS%oAM! zZa6r4t!jqVwC>y&$MLAVr+Wlw&f*jFaR2fjYSP!4_w@u|<9$#OrACp+#-H4#?%~cn z8aauL(R`AXe_enzVbb(xc7FUBs8z)zrgBcU`#7l~8ZeMy$?L`NM~_IxYDv0;F48kz zfFV7J3lW@V8xPbvfC3%L*C4~Tn`i`}nlg^lZYwMwl(wk4+Tm0Kw8dZV<>jP~y2DcW zRj8kvg&&`8^f^T_K(nu3*iT~Ob5wd|cXi|fo8|@0zE_%#E8(1XMxdoPm0$DpqIXtS zH2ljZ^d1t0)5t0`EZ)nE8*2EuHbQpry=K(LyVqNhoAr_i^S^G=KdPCuLhM@Uz*{bg z-A|(78B?E$@{Kf2b!5-N__^A&y<1~y#y$3y7e=)l@gYvO3tCTS3X0{O&jEUG^2Ubu zd7xITAnq)HbEexY^{3b93E&PM??7O%J>rGtK&owF-?B*UcSje}R}M@9DK5reF1_T# z^(Ei9kB!}^!=aMqA@)?7glD7!s`1zU)~)*XDF_X9nu|Pw#>EV!EK}jD`+(*WXxl@0d~mCQ%c52$*UsxQimZQrM@}XPo@eoHe`w(hFJ5{I z%r}8p+m`a8tDugNw@cJ$EoaDPjw+Aa%yr?G9&~96(&+W66l@Y{-ru?f5}@^QU{(9s zWx zs(xolz;GBzA>GIRJ4NBXmE$Wvwhw1bf%%=tELvSkVAv65>f6Swl?H>V|9h=|)xf@o z5BpVkj;pawZsuagm;IckV34BXsemDe^7mj)uuTXjSM7B8E zT>ufEf^(JWuOCiti>UvtKqohC)?>es)z;C^Hq-w>j2Ry4NvH>Pv+yM7u+lkF|5?cL zU*=aHCZ6ZmCv|eM3T1 z01Kk~sS=s8`nvqNcQ)z5=c(&u!vAnNe|%X&`wN6DN*6JB1eLLb*^Ygo-zhZveMo!> z6q-UyK9~C^P3{XY+|Sun8848xQ6OK*Iss#@A6Fi-|27~ z0F*Piu*50qkg#tO50NC;lsW=~LobN~7TCM9WkaweNB5Emb2Ia!{5NGd31nql6r6v( z+YbQJ75-8gpGaZniKN(uClmQ4R@*{UlF>t=G2ELPCB`rm#16;(H^u;D#q+n8@06{6 zyzahadg$L}EI|6IfaAyIHZJL5D@BgG_7m@ge}%E}xZFxKa2^UO^|Ov$_`lcW@_6(?Rs19YXo$j4ybN8$~?Ap)~bQ zhYw#427CY4V8Rt_4Tf7ByI0!{Y|`s>Iy%5{ZMl1$o0q`do5z@kenqh#VI+BLD)P-b zFDSj(1$U~1!~c0|{tWV^J;Qt^s%tlj{jw2}Yh`t#{?Y|dMhlJjns!$>56Ku07R!fCv7i-SjfR9?qObk0a61x63F}vDa=Jrs zlE;+?8-6zD)RK9@K2N_w_tpOIe(3+%qNQ+bgMdbp-Y)oR)D0<}hY?EK?whv>t@lHk zdySS_{?k@czO@;s=E%2MicC#*+ggvP zHR2BFGVUe6b8BRmpn`@3>oW323vE5d!_g{qktghXm{V9i?^Krb1z+T{S@SoZqM7s`fK_)&KqL)d7r6Gd*;bjz}jCq@)?i@{=RXDMl9VhL`*rj9|{4e%9^5WZX z<2r412GGugOFq#cO&I89EgbkVSi}bWBk@oU~9s{{T{O+`%)%uquc*eaXDdM%pAl?O>x=M zlR-jI!fh?D#0LNcF%YbRL#D-2mKVSO&B|S#4Go$Live8}#Vjl@X)YJ}FV+)au>dD;){5JoJci5v0G7%* z@e4u$&Ow?eQ9L)zwcU!nCZ?$ve1i~RDB!;Vci4U7)7j>UmVZX!OEspmHr~lZ>4%30 zbvWEwSOA7KdMfJP3^#L=*SP$$K_N{&2^^F4ZfA+E+&lBLJ9M9<^8!Ef1pPtm;JeS`ui()u@pLi+}E~YJxS1FC+1?ClT+#H;pufB}6Bu_AWRDtmWZ+xcx zu@tg&-{vZH8S~v=c>fw&Uq1ATqCzU=+gs1eQ1KU*1xy2d3W2s_m9)0K;Xyob)?lsGe)hYN{C|AJ z|F6fAxpA?`R_zWqI2rLpHVGkss$@6e==w4T*YB+YTD$^@XTC{WulOM3{7XH>tt@v_ zKDh^_nE#nr@?Qza$Nw0c)CXF^SERbQgS)dcYCsdzW;8fKz|6pXZT;JG%3mPit+!2& z=w~+uPB;C~7n2nCJfpDW`|2LFbY|Da1CZe>c+0C;$PP#ADw($Dzp255G362^I&gT+ zzGjLzxu)uNYfUz@#b(v@7t?MZ&t;x&(T zxSOagSe&e=G-z*HOX*h;Fq>0*ZWb!+&ONni5WSxks2rXqaJ2*HuRW;sqyEf?I0Cnd z$8qMfHnDUg;spjc^lx0{H`ApcY(Uchr#@d3QXlu4=F* z9H9Ja^-}xvH#u)V7iJBBQxB!lsmj{Qeu}%w+3`3VWT`jP6SjC@67v4KH~F)rz2qLJ z?yG9Knof=;l^URpqE-{m2Cvde2;wG}1J)py9uvElcR)qRJ@H}~%&t}2C;)CRXA4P& z#gMV3cw$(OaT!p68ZgZ3o`Hvu5(qVYZmvjmIoq67y%Q^Ni1b9oA#jU;Xs$glOw3~Z zC%QIjhr=eM%OHSzXo7{~gmz5s-TH3zt=rH(U_7oh2fnwDvGf!AHHpGpU@TSuFqL(5 zIc9LWUK)q|FHG>Vq7ZuGOCRzz>iP}*lE>0B3~h8~W%&9w6($=dWXH_%ExV6fUN#24 z)cuefnLa)#OOGDDPeLNGWdm?EtkZ(5g_2}IdU#;-7Z%5CtL?DIj`01dPc{@ER*KgI ztslR(psU+NohACKc8~4js*Gu+>(&_LQQ7$2!J=vNGfW({t?r zVvmWet8MD%5Ltq5=M&YR}8!*3KbI$DK4Xm`i1NQiJXUSsqHO-)Wo=A;% z+{-35Vxv2SNYhF3m^ScfNL=CgE|)+6x$ZvQHeg8meTpHvAFs z{FwAn59KO}tJ#dg5K|VC&hmQ0>9J)kFqkl#X`qGlu^qd2#fGIC^}m}wFLwuh``f*j zxseg}_c$a}{78WNNEIb@V;YOGaYs-labHCp^Q^MQVXtQ779$NVMqbYeSR4 zMW2oLN+!qFW0bVl&NLTEv)3+M$W20lgS?zRjVwW)2uL~iLk!^5zWn?sS& z30cFJQ@Ih6zB(p)N$FfARrhib$7aclSu>J_kdrPkz_4^#(-arWPpedJ+y6lmj-QNOSqq|{l>83gJUzVb7cFg#FHC`;db3irvPF+e836<4H4C>9AM4#H z&hbBzmPd;&OevT36|MW9ey?F+7Bza@dYZ^x37_m~csSmw6q@y8`}oV2Sw9t;I(81O zH5-x5WcS1&A65AbDwNkY8=H1r$3wLlwkwUIt|o{I;3(Q_iIX)QGRd_5ekDTv{L6Pec?51#ETFM#OoC*iRks3C=9o=E<}(2JeL>wsW0|9r}yDEuVN! zcR#F-aN)&T{#GWb#ppeY?GPP2PSuW^^D!q~q^jzAWfMwnt@RcXqVrX1olJ-L3X^zh z>NEzC6ZNHEC11GwoHj^pBcu~ots|T_CqO&a;7(Ysh6MIrD~)SLQ`dYQu#gaR|Cg8h zWnnv)*fxWBg&axt1!ftY<1MYkO*fw=N}+P5au@6<5{WY@4JNo}tKuTqCy6Hn9;rwT zm3gsRoy`f?7#+!~nOj^-Al}Fi8PnhG2z}QZ;W|ZE5&f5UycX(wkW!B|p)i zA+9-b@*g^QGkun$h5vk%A#-lLN#CAysGOOg6JDP#fNKUzV^^n+nQ3{;d_D-R<;(+_oroP z5b_CKA~??6`mDB-2D}uk3(veP)NN*wJI_>2N-?pnFgY#kh&(7a9ih6CouI5><##`a zztHNtg!P>@bGr6zKK#SJO+!SMbSR&2;jqAq+rg8uj0&6GHm7gJ91!wz^28ce;rLeh zy*PdO%pceI*Ub^##M*R}5QRFG?Vy~3p4p!K6HJloMUor^d^KVADR2}lZMp3 zgo5_Ty+u<+leAFO0zT!P=7yA;OpD~9^B`4$2ll*0>mR-M57ga<$H2wD-9;)~Bzq{8 ze|P0w?47aJM(ml2r+Eo&eg;)?c7yI7(R_r2-W~rIq3Ocx@#TdQ+dU}~kRs^Q zSb4TC?AzI5Ow3{aDqC_aFNHMf$B*(DcWZ^&veaw%$0pRa-@7z2t%A48MYs6A*NtZT zWVYc&EVzBPmPbpFg90l3E*zn(%{U)os0;a#xSut#-XNhX%sh^ff;lNqak?~MtRpj2 zVOAzJHVFk9suuMpp)kTqVuXN-ry0{z@SdJJh=B$u$Z26m!>z93YLb>iy3r6Y?9+EL zK@NP68qde==3vSlQT#?>8*v&MB=I(h^-f3kN|~5B{HZ+TwZnon4O@1GoIC}S8y!@% zJSwc>7Tmzt@Y&jOY7;5ntIvkAd*n5%8pbrL)YA@*Gr0q~y2bxufq~s9i3ZlVF*%_3 zrgPRoc3|87z_cqOI=-Fqwpa0n=TnLGv`sl`GPsrEk7|FemI$(>vPXP~@Tp*M8Fr1;KTqw`X*(6KUa%S*q+)V=*@l55 z^V9r=wb>9DD#mf@@bl z-Ll*39=7IKvb8#*xSF!YH5`#syvD|_BT7+m)kOK8GS_LLILMU~s+-=LoitZoHKOH@ zGLtv=bO-Nfwu8QY_geDu_M)=hRl@9D8lUe(hC2^fy{{KfO#TFMw)jypO#irTDAqVqTuzZ^qE%1NP!lH8~@7_gwCiY zxJGkMo1<+qJ0}krCz)3#F{|XIwDH@^Wr274}wq#v`|Rd*GXh?!W+8qYHwe$)_loDd z!Sl{|J}al;*7 z%WbUHn%VjvMO5w30>-(54s03+G}a{@oZjPxpuCnJmZC)a`Agp zTg64dzxB~sWac|Tt%*;7wW7I|CXokuwXJ`bQUKSf$50+|O=KSFi*jo*NSi&vPKcX|nMl?9BRAn9>@=Cqyeedqg@zSnNq=i9EfFRr|hPYqGL&n%oQ{MK* zbkRdD_B@X#K?~(w!6(T>(@JP=s8lXLLtVCIUp948lR=B-0^I5?(_C-?2U&YU5!g@H z!*5(#JKKG~8E8N&F~Yinl1cKmc6@r(dD@$HvrphNOS)#FI-*I@OF2_R5&{|wyL)!g zRWD*TUWK_wpO>>Hn*symIdT*x=o^FR#BE;+{q?$eVg?d!I5XJP=J9&}d=CnO{PdbR zo_3j4SmE8pwpyyA2ivxPAC||RNi*PmNM0dgl5H;-6xU_G^CQZ9f0Q22kOYCZXYsr# zgywbZ;G8i0TRuJavs1+c58f$5F?c-0Z!GPZbIX%*^yeP2^}>d@o)(-;(+xUn%?E{+ zpP8dN&Dr346wS+hT+_a(>t)EW`$aL4Ogp+E_)cfV7&1!~n;k)lFz^wdOfJceRE07mEL=6f7QU1MDk(|12+kAk2x zrb`x3wNgaS@T^bTb@&MPj_-yIr$XJ|K~6KDTG!bFE>6_L0?Gs3tVl0za6AxfqS}dX zKQL(ohB`YFp7hR?W0d~=nIL%Xt4X!>VSViDTw~tG)P^_Om;b@yCXG$qTnrc~rB-I# z3R<0{g|v0ObE~_ z^A&MjW7=VGm7i7Seyi_@2d0DANo{Q{H|Ta=wk`UiwkEsTnGeVxcN_djIE-qusXa6)-nT8c z@8zBZNV)sa?6Hb-Vt=lkweEH`v5#-BfB2i9rWV=R`jjr0v9qFJEW=GaJ77Sldpwi7 zYwS#`Nst3}#72F5Y25u60oM1&B*DaaU+Y>=UyOG2rUy*;dGf8^>C>0bSmQ1CT>0RZ z?+`fq(B?r;wG%^jNXs}58rh!;XD(c;dLe=TU9vXtlyFTnuv-89(6`F6%$`@rx>m@5 zVzuc-N345s<7!~gpbzUUZd(Rhk1LOC^pb{7U7I=ehh~;d@FNV}fNt2A5b*XVc6Vpi zmI=<+0-?L$I=G@{wWgMvd?$xr9aE>RnJ#MU+o$feE<%@U6iuIF<)TN%x;&>RRSuuA z95Taa0}*z;sQb`mG|EIgwS4*M6qYvZ*?K=c1=3)Er+D}s6@@ofX{U7wYQD=Yu>Y;L z<7Dg+KkoL;17gP}7F%#R`PG-7geQraURZn(?~Di;(kTqCM8Xf!v)>ig3$HD1jO)y4 zcqrPL2fxg$n(_8<*p6W=sYDOUgACGlj}yz~?8TleY-Kj6(FEx*T%Yyfwg(cO zqYghpzNfbz#{Hc!{4$u=m?snLXQRPTZt8N&IEE*35VJT5;;oKH_eI{z5fXjkCn8$c zc>x3Gla~xF-j=87)qFQ!twcs5pPYZ!f8;5mu+$gj&7%1}Z1{ME)3sH;d^v$DWZ!|M z!cd*-HN}S?tz398b3dAD*PoLn(vzb@v)2d*!{krM9gS#IA$}Q@(%xG3ec4dPAvzbC z_FYjY_6B=IIt%nF{@2@JhXp?(uDZOF4r@m-klWX1Ak>U14THk2rqAHy{h4Z-%nw8( z?1O@2U+uf`*t|nwmcxs4co0EW-qG2);(d0PN7}>h;2$7mC{us$FBHMf8ecnO<_tZ0 z2sz(QD223Ic;?{;5gddFLexDPtYwkXI;oCVftsM`72P@iOMxUNJXq1;6{CzKyD#+~ z5R!LIY{noskYy!WC5+^gyAa3x3^T@=JS zRmZyaCgz!jbuq>L5Lf&n~ftz;wSZFh@d zH}*}dCuDgGn{t-?3vD>ioQ~T=T3?Nxt;rc8BaM^kjD&Yh^^M;c(d6mog_vKX=0a

|OZ4umhfNsZig#!k;CVwd`*GR zc=Jkv@v!o>1aBHkIxYIKzk-Bb>GvVZi{jxS8pAp4tw8Z@*HM=*VM}iqX>_nX^U>z+ zx?2%xzidm)G6o(}eaIjWo#9K+zB@BII{8)y* z?>s=kbo|vUpQ7F-u2f?VpE-L#SM@W_Xfwk>)-8G@B)dhMTsEmXoiDFmtDbM`#bmAB ze%LO%K*czN#9L-oJh-5Z)@}zrL8DrbmKim7KSx3IhVi*5lT{pcz+CA<&}(X!An+qX z<8v0lC2aoDmHB|8IL(rYEp_E@Kk*Do6eq2Q3@&1SRjE9|ODNI&W1p0O(e^LBHxF*s zz2@0qfQ;SnV!vMCfA9PI((TSaR-9$?PSj) zT&N1LeHHt+-qRl=RYU5$9&hcSRhUPUc$|u|Y?N_ox{enOlQzHc`$*H~!%FXjn5i^E zoD}nG2CJslDDHs<%-wERuilFxTbw3^)lL{U)+iP^s2+dZR1KOdrPFZTxOH2g%Q*R$ zlxkV`h91{iEGx@i2Z5iZqejU)&YW#cL>Gxh={(utQdSm$-iY3n{(bJ%N0cAS0IKMVBHQ%OD1ZB2`dFYCR*Wso4l(r%5 zpjg*bCaYyKY9D99m!v^M(O`FX{^9opa207scJP0>Fj)x1H5VrAk@ZNpC2(;GK#{6? zmZz;%F$Qk9vZ1pX$aI-Ms^Oo|G063|sE&-enM9=T;cr-L(}!hk-5PVzR0aYDTn?Qd z$>=KX_4^`ha-Qr|3L(EH%zRusKA?x8(N0Av75wF9Bdev?)#T?khTcWhksjBd-xHly zDuxe#(#GdDlSi%&5h|)CpV&_FMYlXjXP^HuMCmhD`u?$(oK(7tK#$p+$6UjcsF^L3 zhU70iudGu^$BmwP5~<&(>tnf~)Yg1pE%IgCU<*rxZ(XAJkCpd}7o0;!Xr)JrPRA6NK8fv)j?s3y03r!HhYk+@hh~OGg)3@PB6NZHvOG|yzD%x z7YDhM7+s|~ZuecnD6X}}b+aHX5$NDOV8}?vQCK0m?2`rMiOHCc{0d4&upl=?-1hQQ zdTRN$83|fVt6L{FE&S5@^9H>Bh0Zhula#?`A*tpB)Og%fkBwYEwvu3~<|Jn%Uq6eR z${Z)n>fNA&a)9L0f@`hoC}AAkc{V!od7Xk zfAtf(Kj~J#E4IzoP2WXvCB=NgvYosjqhTME>W95I`tbE#W!96&6M5rIWH|7&*t_AS zjj~b{@zNac`Z60v&P@J1ENxd#9;y1qQH`arTvkbi6Y6*JY>Q)TbSsRx%rjrfa+f^) z%=0DHYFOjFp(;6cL)CEgT5edD*eQgN0|(rzd4=n1@4r2^k*%2v;3n-vo~5YdDsii~ zzP0GGdBu-*M>KFtCE<`0yR}g`Y++oNIQ3?gh28yG#t8Ry82B5g|7#w_7EcTzxJHnj z7EZDI+v&VP)@! zoJ;RlW{c`@3$rlqML?S=*hxKe_659u&I$6yluj>zD~p&9$`gq`1Q+oiO4BQ*L0onc z)D<`;fh6_zOXY*Hv!L*g>>ypx>yqm%RsFtU8X-xaQLKIJWV>Pnr}_Pg0pS4(8|SsA{!b|(o2+fOe!wAAGy@>YUbfiOvAtG!#VK&@7x+afJ`hM{hs4qq%OP~3r-+FxK#`% zGG5Pli-Xe+(#SJ(R7=^&1NGXJVHBb&eLBCj5~>KY}n zX(}K%w10s==vHsE-uMo0IHiJpXm)4ZZ57a5LHT`h+hQ#Ze3lE14yoFRXe>%90gCFR z#)Lfuy^6ic%|huWLq>!E1%y(;RaqH2pOT;?yIrTUzWcu9m;0WT3tu_+Um0Wkv z*vRUGJ9$bPOclDx+0%#c{X4aqC9_9 z18HgyYyj`j$rWp_KXT>-6uI@>yI~$2xdKVD4{Q6i1WHZZ0~mKIjSHV{g>C=4%G1D+ zg-J6~utL(4bm+!2XRDZlyYdhE2!gsa=2Hht;>90eil2M8^~KV<`THBI-SoSasa}Fy zr=UT|;{v49HZ%gcLCcIV{-iq}R<3%^J2kFBPzmtW-RkadfO{u;);sw>vCQXgLPxGk zjbteKbI9&8zX(?6eebittPQHiCPSBR#I2`#=uyKchN%W$?K{S{A73hSYBI{pU3`Tm zlx{zje2z&yTD82)iM-RX+Yy#jiIlr-!xb)J2jXr z`#WtjDX)5R>4%e`gQd%Z3C^DE6l^n}jtyn{)3TJ8C^C#5k2EgkocmvFef+rJc6-U{lDHMRP3^Ci`Mvs*(-BBy zZ)FLgHPjNgr}+Vz4IOSxzHP4MGSyEAr4}`X5BiE%w6uv3=#nkMgUQIUKg>*s7O@)I zt1-R3nJ%Lw<#XD&>*`N!bmz)i)fGC?X>ut7nbCWeRMg{V(Ipxtf z$74;atw_k~Dz7*3XAO`_2N0$_ zgRWNr&BkFQXr}M{96w0m15u@@G+~(1ZVcA%bk#%f>6FqR@oewMb&2isIuByL9 zxrCWYt<`pH)W3hZLD|xee$R4rR9ssn%2G5&@<(3)<=@I<@L(3R7GjVu z@GK5xJ8Dh&$=mPQj5kW4Jr^C|MynN4QvY($1qb(Q$Doz-X5=2zOf-&-nmc7XD+S@h zTfd<$t*7G&;?~khb=*cFgv9Lk_1B8Sa!7G09fgJS;|r9=qk#+~yv8A%_T1~$XXbW3 zn<1#%l+nrPi+4N~SgHvH9zTk}ofkUg)hh`WN!z;}K!uh~s?x8P7vlnKemi=;@;ffS zbkA;mXJXrB8w-C~<40Tg^a!O%f4kKf5JRpHD~K2|&Q$gm4HC@?^Z$8z6s%ZDf7?ge z+Y3m_ZekIEdmFM)uS9iz81fH0xJ^nHc;!U0506H@u)r(d;TKf?wq#NYT$DHS|go8)Fb7wZ7 z%(Lhg*X4CyMpm;ulER4Rf5)YfaFvQc0gwl?Hbvv%1wy7ZR2u2^dH>R3%C=v{>U+_o zw97noR8P_VvbvxJgt4(6MUqh{Z!<=<+HLK!&>+nc-};~=v4N_LN3pi@%Oi3ZDYICm zVOYRe$}8369Uw*1PF#nBBF^IJIS?0v6SRw9G0=MH?8%x*UtNXWFrFlg#&!@?U zs~{1LkXe(06310kkvMgfl;*0UN!rwYlhhoov%CzM-h=S0LgfnDdTVW0*Ftj$w=nC@&bG$AXI(o48uAF6Pk0j_AmaU z=|fy=`fi1lHS(LppH3MPi(1?Jmz4jA@C~;9WSdOLp(zX5epL-05uIeW5{ku?trx?e z!a@K^U%YQSh>#tGf%3%PjKcokH{Kuj%Hef-aaByRe3%j70!h<3ER$LT`^C&4{Y{kC zMXLHNvnS)?jmYDP=l2QBSrlv%Q}~|MY(Fw)xn|r*EcXs+jBu$^@G;X|+9*71Zh)SD z?DNx2qa6Hc^#Zl;Z*?U1JHJRFoCK5PY+1M}tOpsTIIAUHV61M~q@i;8*%9g!(U6^y zdFdwU?O9NMjJ5o;ibK5QQol$vlmx!p?ym)~tTWq(>d|-?R2G%1nF^5e5kPAK=#2j6=&61&yPgW}{ z(1G5a;IFRv{G*nXXTvYN)oX|G54>YN*chXK1EG=bnAv_ENhM!ONp_T~TU}kM{S{lm z3c<~GO(Rl_zCRsmWI?O{Ds2r%PGj0TJDx0`T|UjINFM0tFx!CIKRy8e0Ye9z{uiG=EyMFX8MaK)ck=|rurs7+#FLV&WzGeP)YZ0#&2pgrxaz(d^*&Xk|X0`8? zzW*{{jUblL!<_+rH(1MxraOhRk>ZfjiQfpu{coej&lnrXQLLCr$(XAwX zB&{szhR02r*r^swj}eA>F{JbBW-R8F59W@!MUJ2YOB&{=zAcdX7;oRi-VZW&7JhxaCh)6l^@a zA;gMwLq`tsLeS98dS}mHW!HY7`WMM2`hCdXTmO^;uwTbzot8dC)?HjPBkf+id?hbP zPoxy#obwV#dxSpsX0#rSudUCn$VFU}&r<3_zLoK_xedsXrREAG(APP$> z`Facar>{ZpyQDr@pW4hGIPC4oEOu*6QqJqdM4Byxm6cH!X0FI8bB)pnQ!jnU5vOCF zBQlIje-kLy9gmX|em;zklc&S#rsEUF*%tKnk0`jl4Xc|H`rpuSqd%|guo#8a zJUN05r!$PTUTpcXIGXA!?;_TNTt&Up(}8GXT@YlxlNIYVW8SD|EgIt1gu*OKsDU#r3DiN z*HDd{(P=Od5PSK8U7;tQ#MbL0 zokZd-(9y{^-l}`=V@kG1zp%%68-}yQj|hrqZ1K{1IaP*yP7g*jZ}|sLJ&$v=ymg#1 zX7zilrT&V8nDumwOrIvYxcutqZPO3l^c#`-{;S9RO#DJ=gG7pmd4xPrvolmi@YlU# zmDtZzylY1iw+fQv#D|qcp7UuI{gNqv&_UKn8QhrTv!-_T0W>gUng3>upjysd_YP6; za!)~)k1{DUOj7k#DaB)5N#f$LXET&F+Ygj0>E;^s!E?vzrnD&1yn%p{V8crFl!f(h zGK=bmqw{*%M#@s3?tZ?fho3IwyvM4P5k7tRg11p0P7u_wqrRBS>KF@bfJ<_ANC-qe z>}}du8OepbNFUZf=Y+-f0=~cD}X=LUioVZ z{8D9C6D<%Km7;gbrBx-$}Q0S{@jjfGH&GX$s-2%T(<|vs8GOH{<60pNKAZ9nnKx zQ?pcA%24}NtuoB)>UH2yab|$#lB5rRGJqp$A{Gm0P(jYNvGnY`4uMvL9?peC6M2oa z&Y`LWFk1ziQHh+BXCkR0$jJGv7k%{G;!D?nrhrVE)X)l42ZahTNMPcYcSt|<`JUgF6#>6p*z zY05SVti;#)K)u-FWB&vblXe z$F-nCgx~tXM5_Zhf?KdQRk(IICJTl077QkL0Ys(<;^Q7KXVNJ;8MG91;!fAgkoAPL zRJc}vhS+9eAppV`u#eNI;yYfoNMD>5C@zDIjTgl)VuiIdA=Cj71~ff8%allKfO`DQ z*qU&TUOVm6grJcz4am9ZdB)Wqd~#BoDmFbjTJ`L4w2!uTwEK;mO0Fra;|i~?Y{hwb z86^;w9#$-hy-^qJ-ka=}$%9RTnVeT};Y)i0&wOEe44m5cn67k82{;l``E`3xnz79$ zkI~#VuJ1U5xl3}SWzhY}6wc14BAcT^JVn}u<@mMCz~jKiMT%SAFU2vSs$W#}np>iW zo0}lHA!}G{7g-q$#`GJO0v#HgUp1dYa--}1=<=#$znV8()5433<@a(HSELS_JVyIx z+pF0lQV#v+3f`9u_FG=FZ^XVncAf#fh-i#>YfixakS6-}R`Eadn^%zUzqDHYRo)gY z1&aL)ESY(N*{WJt-!vLhb!gS`pF07ABNy`OE&YNZbPn|%M`-Qp#i41h4xwNF90vGD zB4UW|?R>b_Ih!g&xe2&4Rb4|8^GuyhevTUzfO7~A4324o%L>KJZw| zUSIIBKU5XBCBUw7w;NuPwp?tN){|=JzgYtb;G~*Mzq(Qq7Z$dXIBncmSpf!nq?bK! z)xlX_2}uRg&iS$ufCJYkn-zWg_*JJ9K;LuE9edO{WVH_>w#1JXA{QG?dd-B50p+`+ za$ZxpJTTSO1jpueJcwwpsreArz~W+4IPeriNR4 zcw9{jPwFb9y^!g>tK773Sv?4u8WEVk$7Wc;#I9QDwZLqlAAYI96qY*E6m$4iC$AqY~IfjbgBNd%c)4uD&;XK)yfcRN-sg+f)3+iW2*EGa=SBhuZ)PUEP=rg8Ufw z$FbZqk+@~%Zzfmnom)Ny^%g0rCo48A5y5pULUDA zs);e#`asUR>@I=+#crKzG;r>`nGFg*d>ymyhvZx@q7XoqUgdc=G)+JmiusZeC$| zpOay8qNMV9=_e(i)WRh7%^{m1PFNo5DIc}}1PrYc-M)x=@Vj3?T%3a-jrV|A$o%z< zIypeMCyMK~*ex@2a~Y*gJsV$zxiTLyWt3+iH~{U!h{~sbu3ozt-XF)I*!sG|u)ziw zbWn|z9rLf(V5C6&8``oevdz|dfH~2$i=DSSj=D&Tv3NFff%dH0wRWp^A5g|Z^EXca z>@{yWJ417^-iXEV#7{QuGhJYouhdv;E^1!g9ioH9=yB_j5;K(x<)io2?(EE`$X+kg zeX_=X>3jjAjgdIGQd!Xbjd_(Ly8^U;#>ET^j9u2~&CtUUMDSs|`)jBRRy09_#9Gfv zaEZ07jI0|^y8psIba%j|V?)k68^3$SHSyxEjgW(~> z^|4%|R95DI;lCx@|MVxHxNZLZkzEm5K+{k!__Oyahtir9UM$I}J@NcQgR0+GZzC!H zld&bhu;bVaiJ1?MBphIyAH>BrhPqxG4^2$hPBf9T8-B=*in5zFd{kz8voCX-m{R_h zuUhB4b_mBpU`Pru&3^HN_#4>F4$OU(iJ|eeZ1-gBeV>1>?sukWWV6@~G-H+Xj^-^i zG*~en`)QYmOyPlUM$O5C|Bogr=97@n9*9fVk53MTZ)QsI1{tD>VLl; z_gG7e2D_`Pi*4)Y&z~KS(ztJWaie60&#fg(b|o|F4tkQ@#}qqWlZH%N7Q{$7DW60X z6XXwqBciWgt;{L{cZw~?uu|&{i`B~Y~itbUoO)|5shT%a-ThEt^%|VRZm&6;D(bsva z=Bv-X)^j|ZBMG#xa=>CQ2=1fx^&X;MMslzaa!>O-v)B6fvP}^4^Lh=Y>71}!{xCiH zy0vtI21)VzXkgdG8!&kquP>uS8g%y5ibM5;&W@xHmZV#g5K z$U#t($ZbcEHAz6)8&WH9E52vn%8!GIuYC(F2sM|Lx!AD{~+^sbMahkY0*4yb)SOduH3O=Amolj*x&|1G(1^v5p^yK8IVsZhk*RuiuD-&(cLCe@b5#Z|Q_r@`yLT*YY}mFd4hAh<-CKO-(0u&-vE#G8z76X;o+EQ7v!=&V zwXBT)d`25q?EU-R4%lEjYUWd%FM}i(HDoHq0sotKyYPsS%Y22+s7h>CWHu`$< z;aNSmfzKHka!t?H*mR!p6m9>nd}EU8-o{JM>7N#@2gQwI6}FrDL$rT+@`g^wZ+#Z} zU$v9^MX*ehRAJ&ckfq9AT2waCW;SS_)??!-(o)&m%457TEjo@9oOaT9<%hdf)gne$ z-N<)B`z_Mvmn!IZ6_%3Dakl20Yv+4DQsuHeEt;N1P0aJT!f#wUH%%d~*Qy`;JEMLN(iJBLh)R$5 zz3)G27!IrHL#dQR7f%6aCmM?Zuj!r>1b_&8pN}XYhJ26zKgzy4s;O;zR}n>;C`wUE zM4D1WK|yLzRGJi#jx-SvfrMTI5fBiOB1o5}B25TA^dMDw?+KxI5_$*(@-}+TZ`}Ld zyYJmI#{MG-A<15A*6*8Z&QO;bHHq&V8zG;A#CK#LsV{oB0e$})K<@E(cMqr7Oj32R zzTW%YWRlldxuZo&JO3Y_G|mtF?$pDweyry%TVZzTMH2I!)yai+=Pm56a*R&&|3HQR z#RC~u3JbTONDh%%HP{up1sZy7gJOfED=*dplwXXD@pEq2E*;NCSt~riDJK!-h@eyz zmgf#n_kpgBgO%EBgj$ELilw6Vo5<$c;pF|ql5RQgOsv;b>t<=yO5a=@JWkCgZ+7vx z$kJ~uSf2P+PCHM{XAmfX*|n3x^rD07{*LPYD{Vi?xOl&=)@k?(>uT;9s?-j>kl>5& z(_(%Gcl98~4wJE-I%C#za!W^4oJy%g^a2pt$GAVXz(&ssx~CqlTCC-|yOM&~AW9M# z7iUj_)ITd_XHB`xznM;&r-t<=2lLg`zJH_5xQALzrb;u`i8+#(x*-36QHAFG)%#u= z52&v`IvsOO>mj@LXVm*IcdBlMi@7CVZW5n9driRq^l9t2X;+o-d@c|0cl{_C8MWS! zkA^0&a&sxp_zDsHTumKv3gbF7W*fItwJ=}pj;~yK_vY+>f8F7^Md_QRb?IBk7>!T5 z`=}hQsJ#mk+9}~K$iT6jUo$V|zQhYhIC0=RCTz@D}`QKmre)17aSElovof$)@7ZoZW z@Q*Sas610oxz|e%s;yj#J3164pjQ{PO#1_D`oC9E&$LttmyMwFirNJDpfzja64qT? zYMJ_czQKD&6sUuq0Q z2(=H?bISxWsH5lFEwlBZYU4Y6+xlLBFN9|^Y-fRDY{~WfdMS8@W+tgZ!DgPhH?mKzx`GSKk@pip; zqvxK-#k5|x!7E5Q%_<>(?yrmkt58lpiOh;?g^lzXyLUQlnb7I<2`R6;dbMMs)k)Q| z3S!n>E{fIU0G~a(8sE$ZPM9x`48Gim!s~7-XW3;@C*)6sy*#DI52IB=+g_m}wfuW7xjQ08-utAyjgYwZU6?Zf#Hz{$1*6-Cj z!fRRn<-p{GO6~|4$_T7GAw9Kcfl*)puR>6V=PK_;nI3MUDmo>`g@{M1+hXVeT5^;N z2Vftz!{u{&T2y@0Ec@U4){MtK4*4f$qdJ_L?tVI#F1NqX;)N%fFCMo0W1}_p-c~>2 z;({9d$h`Z|%;v0+enA~1f%NffxLbtmu1DfB2NZ531#xm9IkuD=yCpy`LVCO@vLBdMV<8rp{FwD~dMyrX+gH|}?)q9^xp8b@{@ZKai?_!@hp1`)O9Cx* zhm-O`Nn)E%df8K#kBin6$673HMn1HQ5&69RXm|#Cxf(A$f&0E%9S!upla;U?D#pbc zL0z9^9yQ6XPX+{H>`<68oCQcW$Bgan>rV%*5%8Dd+Hx|uw;D|Q+0}EM-W5Q65XZK5 z7`&eo)GbH&;XUa`h3Qr&S9s4SB)ACv(nxXmJZ{&o)=4l$ZCfITQ@ro-6xkOx%|n`) z^jygM8E|)CoJKC&vDFCd_8DqE+W%3E36nT%SSuzNVUpa&2knbm`EVJ5A{ElO@_u8l zB}?2s8|37T=oon#07MZ1XFEc!xTYrH75-hhey3YjShVdOhtNSNlUaV5HEk z*aJUlVinnD#lCbdHf-1jKZSS1%b1a8;eaV~&P;Lh`n?MUE|gW_E}v0=1lR=7h6AFBBW5DPuc;Mk5;Pv5Eyol zWUA2$+gj*$M^ta-@Q$T}Lin+}t-gxzX?;SE0>gNub&6-Rtb}(N2cn|+3g3qOcy+~A zR2bE_EQiy~ajZb?#;& zrBxHw8?>IR8x>6QO2GD(=Oc~?92**t-Bn2(oQ&_*e0H!Nd^B3)iI9yBKZVA*O;mf< zYGD&~FP!&2oR_FwmfP%|UW3vG>_5G)^MH>s{e@|!xaTGhVYK@t(?xuxZ4l!1-kf^F zfC#YksuXJiI|hMr@Vj<`PchVZ=eClEEXwgw`l3KF%0=O6|@X*-6jTIZP+P$aPQ$Q`iDSr~9*CVcfVG@0ISozm%!g4ZamZ zKRBm;G{JyzW(t9Aw+O!lh9BA?k7~$AR2?727mwBt_%j>p6-asTEoz@6yP`sAl5DUe zjfBsBC++}Df)W}pYQ)nkr<0xABJ5=1Cu5t)TmAh})} z*G7B)s=Y`im9RE$%LlQmFhmix7TF=OKwQB5NGRUVdp&X1ln5QjD$Nu4oCnM>zFqlK zMAHYS03yco);S`PSl?hw)J`bb=}Ut6IP965EAP|6@K!I6BQSBPyV4t9Bhu-&>|VaJ zvOd*-`IPKl)L1+dA>Hh=VM-Pz&N4u%mq1}T?dEwA@acPmb?%67Q(3>A*42abCSsNq|}HccepKv+u}b`tsNJj@%@Q?&4N7l7_c}9n zm&?YX8ZC1HcZZ)hq>EmQV(6{gw*Z0pyg6d2lvqw)&=;W4P3Y#|D%D5DsG_aIg zCO&c7cJGUO?S2J_LH>zz1j3bVgGX{2X~w=3Ck;3iz&u-yzQ6cWJ^GTjf}JrxtgYud zecY;>=98)#CVaAtq$h%q-FzlzE@HMLYyw}(-Sixt(<_HdF44x4%5YLEJ?I#jRZK7s z9R2=YYDb(D>8E?GchNxu9&Y=ceh3tY7hoqZcbKwlOU;d1rwa0H_2NBKM~Ji08kMfY z#=}t}A02+Fz`Ma@|AVOrUpw%&NV`FC(UvvZYbB=YKus~Q0T{y4w1&h>qnC3Lkd?{1 zyKu6*?^+@hJ}wt1r>%e<#rp0q+vW?8WE=-J^nPPBu#6S9+%VBrMB!?Z{cGlb;=TNa zFZewOl;hb-A8hSO+IfZ-k+dIkA=Cvh?6z-bE$;3j@x{;iwvF8n=}Vt5S8qpo2WU_l zRm3q-Atzqv-jNV!T&ryV^ev7-hpUD6+&~$LePBoPd5CT=jtEy)3!G%Q~?d2`KhR3_lPlIPE z9_*YNd}x+UZC5zQ49OKnI;{ZN4p%zIaNKCIbyW)pj>dSlB;$79=O7e8J|#x>Bd=}N zQjfYdI0O!2*#v%Z9&UV%zPxor+D=WXT`L=}^iffsZ|wyM8J7H#-CeZ6-6uG`f?+rd2D!558T@#Gz!}mh(B96-R;`3?JTA)g;hI4Mq3bw4T82okita;Zd(LZO_Ek?nw?NC$8vbpk6wJFj$=2aAuCa4OV3&gjmgUAIGSj{lsg)H z3_8H0u!l?4U?wz!=JQqcm@d^6#9!dsC3yykZ{juA(7BTS?L+y=3)`{VMEHzQZ9$Ro6&;X#uYCoy7Sq zYT^&RP*<~Vg5z2>yO`C7r0Ry367VBf@VB4VsrIoRwOy4fm*!2{^;E1Ln0n%gJ2~MW z8%@<0jau}sAFV6Ot?C+B#?+rjclpl#`nX%X!N)e9Xr1cn#x?3FYud^Z5{?nq9?$kca}1aThJoA5JqZv)1iRq3Njd16yV*4<1cVOz65KD z0GWM<4f>595Pd@LIz)YtPLdxcv4Xo)j9gJD+NXKaycD z6yd|EmEX)@vBjO@_fmO7ZR(xlP2?-=45-GYwtG%U;~y96qzhzL$Rr z6mrRt7lR_afKA7iAQ6qCF^Fg+r^2nLWFc2!; zs0H=(nQwz{8lkj04_p!#b9iRCVO4}k<7Rq95RpVrmyysj)xKSN>@NZ)OxL=qa8ATj zoBqry)ZTj<>`^zq+=l?}F?L>a<%nxOswKrBDlWTY*TTuO)_oEc>%p7?JJ~==ye)jP zYLf_Ou4gI;E3xINuGhK!T&(7?ci8GU=5^UH?Max~POFAbk!S*<;{^7c-28||+q`AY zOv7#M4tXbxJTgpt?3d4UyhaJnmd+Y2){MNzFNcd<%;fuR&U(m{XWDn{+qwps7B{$z zB`;T#v+o$07Zli*8F?OOgR}MokLA;YhYNnacG?0+TQ+3zQ{-!*7u;TQH*3#ITvfh z45JG5Z!Db&2X|p>Y*tQU`es|BjRe@vEe4g8|EtP7sa@4sRCq!0o`%afJ)2$VBffN) z6OxLo9qioV%@e6wb#mVlMwY>HUlpvn7T_%=(4LS^4_ZuWvTsn;IDgz-o2;JVALGE> z9Bw{m)HAPdPiE*0EkWsQq!7 z+Z*_$%v3il5l29?$dL__+#@j9*@=x^q(RiAmdH11;HE#w+c(uXJ(43^!D@M9=A{xq z-zy|@U1zp^kz14F19p45>tnVEdn9Xm9%8OOkoK7? zb@l!C&~po@rynF-p59(hw9Q}Y&)5js_CHPgdZ97z$w(a~C~=O^B!^aKg*tHG=k&I0 zkZ6jyH+|N9KEXP13FsK?xaa0x8^$3vL~kUks@v$>2L03xv$FDi7yjrs2r6(^sB?!N z9-UvU;RGFmp86Ocm-irE?_UgTTjxntAQqNk9@4?!4^;B_84Y3n?la%b*^OH&v zy&OruH52=uxC`WK6~Q3idr$%PuYLC>7#=;icXYEIK6)7*Hwg^`$QBe+v*!Kh@u+;+ z&2?^9L6BKluHg>BsWjF3sJbTQ^}`!^nEK@LvBf( zxN#$JJRd$^oO%PjY|%HXjJsyaRE8R}h>*2H?#_|Q^HV(fLIN3nl%Zd@%V{hgbdI8I zJf9_aUvCFmH+N4ZrULM&Thc+lC)`O%>0twvy`t~B64|@!Osl<^=@iS%I^W6w?RP$D zhTU;E7`c)^B}K;uasD7V_-BDCxeM+LBLTEqk~BO1mipo<^GXR<$P9}$$^Uf*`bDU) zA>)J1@T~72H5S=~h66Lq<03R#eg`u$jPje!2w!4uY#s<+zY!=hLz=5cl^kkqg1U$S z2a7FoiSs|>vNW4Qly3l;zxPz=v%P8Q<`P>J8H1+98({=RQyB47Aco;fq=3 zimvB}-(gG^w?lg;@*Y}LhRoa2D*dEvJba;L@{k>-EQW1ESWo$X42A}0R_bIROHk8-L=72>q&qfW*yLdMbXu=a zCFdON-cAzNaikI5S#>HG(^T+lBOm0sIMiAE$;i#Qg&v>4C!Y| ztv`qynbARD*quSZ*4UQHevXg{8b`P{8=R{@O28KunNGs*+dj`0F*(dRG^YpfNwv9{ zBE71r6yiWyzcwm>d4nV#8Tvhl^L`p3LE;{YD|`@nB97g)l}ob zMt)0%X3ZK-Sl7bS!rQ&Cd_b|$U1G}6P~Ca$xd!Ap zX=Nb_P)QNpke?^4RnOQHS221HDIo8?m>x`v9K0NFOh2Ks@%-yCpTj2Q@~ZtYc^9dw zbz|Li=<v)_Hix_sDCYNNwxJMOhBOEs0B0&bewzpA+UMx}xn zG)_+MJH@y(%IUNHv`S3~!W5di$riW0A`$|95eGH!=&m7b4?A%zG$GsDQT?BZxnf3) zT(>XeXT}`@+*9L>#<$cICU2>HE~?*x>6gKMs|SeYs`#G7Yo49nY`^I~=d)Jge7M#` z6A+iKH8EpG!kAs2?$J6{$sSvZg`*90J@%|p{DfmB2WH}6)p&1H=*UXmUkPd`nGRhm z9maLuxx#(Csm2$}k1AJaEi^+)NKNOp*V>T=#a0!bTk~^jkYEnC>x&XtSaAc#`OQ3x zu;-R<`!XxpYDV=lQM{Msh;`9z&zk{R^@wg;uB7%~J^H3C%$ z+5VJ+U}(3`6c3>We-uZ2vJ2n)>^d)kDOu|Oja`TB>d@|Dp{4*Sq?>s7>Df`HSD|m2 z$#gC?j+K1&aMfCFZg+Q(LIgFfa!}x_n0lfx6j7&HduRfNW}AM8FK1^0kTp5|;B&+U z`{~9tj5%Iz001b!yX{_y+LR_Dlv-BwS$DLrVx_DuQ9+b+GXNSnTq>AfUO%PyNB+%5FR(7I zjF*ku8)ZHAr^(ll*?60TBX?l{AnD>em$)SSw?hk2xPX-Zv`h zK*Q^3-VMiTARR?Uc2FHOv6!N@29u7~c%oWb!a0l_JSUH+Xr!26)R#jzb?B)B7m~eA z_MMT^xbBOr*=!T+WZK=BX<-SPI?RA6P)q{x_!gfx1C8mI z&!UzpMTiA3o4=Ordk{^QynA@k4aiq35%8^X955`XmGn4*bM82V8`ba}%0<*R8}~DSrsIaQ`$SMA z8u!_Q2nUagbkqz=E)5#B=}z1enhN0Di}MF@aWkPeD@WGKR&GLujq5>OiaxUnIG~Qj zkuc$n-DLFNy+IKWdqQBFs{%31INbATi-nwL9)(Q{Gh}1?K?(3-ZU^&Q;^TJDMy};s z>^YnT0|OP4R^9l?2PpCiZhLt32-2Vnns>wc5ZWvwS=~brxN*?%h?)eZ#7T`cIRDNa z-t9a9&p8c-Y5oI8r3DwaFxNiMhx$2fEjok)zi3tx2a{+DP zP9%$o2iKv=XASM*?iVCf#$3)DVqyFK-bM?j2+wvH`)wx!=+7bP1At=+mLsKaTYjOw z$afFj%!+i<`#0v&4+4;UT_=4{;(2c0-n!UUH2&zIpG=hOu4+7g)1a*mBAcsH6SUS4rzmICO=ujxp7Yy*t%=G`x1EIQ8Ji0dTfvx^{O5QDG4wJ(O46C3V^zEy{sU&H0_U z6@-#Jf4D5h$9p9XiVUq1{ses%`rem#jP>*F0C}8J%f0Jx^Y1;9C)&O=HNEzm zBfO6tjCE*vm(B7-SjZh9l`4RNNHu2Bzq9`TQAf42mjt$nKeBFpe>|kKZd;@Y-okM_*B5%OPnxR%598V^P{cg4!(R4l{*>(|0q4-QNd*Sm!WjBEVw>BZ zfph0w3?CbGRdaB?R}my!RiS#bV!(G@xWDsIqDnJw(h+X-#RyVS%FA^Nyf>+Ujn=b` zAj6JMp93e4EohM93|V+Klee3Il8|LUwbshkkvAGaYUMHO0L)-LvnxGm95b`wN0x(P z5k-jT4FINH+ZiFD*HX5sLE#rxyeGULj@o&du4OtoU4ArqSEWv1vt}$!6qFxw8_b~W z9V`F2d$^(Lf|o(<o&l`7gfdo~6YN{OAOoq%Vp#Uj%v~u4FUd|T{v7gZw}f_f^TH$I?s@}5CN=@&IeP)wa8CLg1ZGvz zCXidgbDA&M6847By-6PkK9ghYy;cg5HkA)Ro_K88$PMw zFV1*rRSly0{9Pr(kI$)^84NC@W1p`<9LG&JVCL>7K(Df1n_2@{<;C*tXBx6|>tgY2 zU09%5ai{N@ExA$&z-RqbxT-T?VOb+(uz#YQVK-y$o>e3c}{|;?yMLTj`9?s%k!5x!aakTBZ@cjT)FHP&G;b7;-(k)}N?z zKd!FN1Y0?ZIVWuel5s*iwt!k1m@D?z2Qff$zh>2$IM|206GWoQo%5`$xGAFQHs_-P zAcyDuhH3l&`9$(oOn=6v77t7T=bwJb&Z0byj$z*8-8ycrjr)+A`gB;h>i0gsKQS>= z?%j+5;6$X#%*G?l>V=PF<4eAKMM|}6z-%GU!Eh|0mQXsfd8S&?H3QY(Z}#e|V%SZ) zQz3(x5*NmPQdxM==_$Rleq(N?e$+LY?lz}8SHfsBoBG`hTjx-P}SE6IjKhx5B*b9 zkG8&X8{l#T5l&gNk*Go3V((~D?0PFoxoUJiDdTP3osZxVv|dT41Z;gk?YLZF^^^cl zccFdRs1>fTh10nqm?5)uO8i-QGS|3@Yy#L0QCp9_xzt@R@aW`-zu%4-6B5p2_ z#pHVV7g4HRe;Um>-TZh_=!A^(WhJ*c*}t}j(T@rQD>&bEObw)X&L{ZiMLX>b>Sc;t zt+|JP6wFiOrbCeG%=A58yG5X{zOlP8S32}?XV_g@W3=Md&P;^tM3jq+<8-6H#>LZ2 z2WJ!>V402VdbM2d!mB28^f&Q3>F|yb&6=tQ=Jk=R znP>c61*Fe;c2BhQ$AI;C=TeEguy9iMGWI3|Wl78Zhh|f%w8EFqQ9JJ4XQ~FMFr;NL zcTmLj5r=X4GN-$>z^GVE4qYLL5sAb2L}0e~B&>Ho`%ftUtleydt+(Jq^zqz^K0Jr) z>s_a4p5;~OZtMzYnG}}LBj+CZo7Zw(IE9S4A+d^p(I(iCulowt$ULt6od?wQU04iV zF@m}m%!EttzFq`I_l@T|67MS&Df%nbPMxaR+;L8_FH=U&e8Kl?fbD}%wT63t{6p7f z@x3u3Y*K}AtIX%l^W*{mWfAY2w{xU8@eLDtUu*|*1zIkL7&~~JrG>F?I8bc}VuG4Z ztg)-EfX(YE0scDt`V%oiU^oF9L+5V<;9W{3*T!-n9okK=duFc`D&+R9WRQ z_ysw#WUwt?zMs-WOK{|zTf>e-yv^0o7y=K#?gOx78vg7t%?Zg&HiAN1nbreyy>U+& z&w3sM`7VklPys_a=!S#O$O$J~^Ll_9xa3kDyqO2}%{BYFnE^l0NqG=R#3)+UWe2=pn_5(y} zrbCPWwyM8HARs_KV($7LbZL@hKr`@c2<^bi)}>7%t?(_MczglTW zy-NE`FK*Fe?MfdzCwDOP6`sArq<2<8V?_?Vr`&c<{k(|+aU3JaK!7BB5@xepcZ%UhGOMY~@-{(h&CC^ey&6aT zd;x5ctGcLg8nuaU7>6M3{YKZ2n2BkH;3{jhae0PF?FqxU9wd=DNt&d67v`8T{U?-3a|-R9F1vb<-nG6P%b1U`3`w z*q(6P>(L|=7D}dfpo#+=qoi=@pstay>jRJ+-2u+M zc16>XMdyTcDZuD;AI^M-UqYYpH#R@@S9JAfVPXZ3LpzUlj;pLE1n)mnjFE;-@n9k4 zT-u>s;~p^JxB)ZcK9KD$ty{JMxC`Kw`O5tCJQ*_{Cso%LpKv;M<{l=6##iT`HjT@=#zeMVkWpOrh6{&<>Y`cvv; zZl0!fpQ%Ks+otTw4{Z5?Phi}Q+UEpaBk0mG`Kqo^xeWL1+S)ZIg1Th859dT!Du7Hl zJ$J+D7;ym-xv=x=EM-h2d-q7Fns?mbRCO3lC^4PMn=otL5i}*XK;97ikiA zxypB_1*nr3;1T!df^vdhRse+&1NNxHT}Vg#?LY~>4Zc~xGp=cl;`dh!v5R(2w)EP! zALvvAL%6$*=TPtbu(YF)njPJ$u(c_?EP7%<4Q1;U?CHEPDp4R(K1or@pODIZd7S+d z>gl;*fPqJ2obj@d)Ea_gl3k^;sumX`5mLFt=f3fXMVbfXHeQLbKyJ009xJLzJLUfL zzHUqAGIqh~g>>$(p-#t{u;X2DI9ziX$K<%SZ_QL5Hh@SyYXGQ^3u8m|G9CocU5-M} zccN<`)nZP2eI75yPGX)N6l>q1S>dk zL+UqVH4drCn;V+gL(X+c68Y1KYHAySdA9Bw`PTybKSIP|C}h=(fxCVq(8>< zubO-&ypCpu-|n*y#dy2VbH`_U%m+u%gx>bcIl*}=D2_W#a0TDJcTw!!diCA1+lOg>X*v^GVib6?(?sWha`0SL8&7+q=zP0A6+vghE?*h8QPZ)u9gK9 zTXhy0(THE}*OU9I7*PiG=KfiL3+t>k6a+IcQY(I7H4nMC#nR!f0p4*zMD1-lFYEv9 zUynUE-mTcq`a%7XKyLnvVLsUTQG0LM;+5DK(!bvQ!?YVGVH;<3Xg7|SCIX)M8$EN{ z{2x%qL-?Y;WsHt+b%lrwIL$m?*6Twa*=v8brbU1;Ju#A(=OrU{@2t+d$Slntzk+WQ zs{=2)*Dh{ie=X%&Z%~tkcbvNqo|&p;dj2sD53gQW)VJv_+KT*Yt=IM>R$x72+2W@# z&rXJp3s8%saRRi>eHmhNMPPZ#`s$U56CCe?u$BuQ2^Qc}g|$O};>lMUX(IX1H9gkq z8l?i$#9c2dA?1DT62x9Q#4`u!*T)RpU02~$JohLHLa0zFN@PEBK z+DQdj-w50MsyKnuKjhn9{F8>rQ^qn-l*is?VUTVvjZlVpChvY{wD^l!`|Cdb{-Xc* zG>wfy;YU#8O<|6qG8|QiAq#|VLi9Xsr55z^bUpRo_<6K`CKub=u(OtupU-x zr=V-~RkqFstDKAahlP|ulwJ=kuaVzB2hK4p{J#h$Kz%DevF-2Z{P{?mixvvl_@xehi`FiKB4u070_dYU znzDs_tI2_#o)@8Oo-FyB_sjyKN4U~*F*iJHC8M$QqVRj30G){cv@ZYm*L&jY&hyN2 zB``25d%O0b*C&(0vLlDG|1elUd8x_Sb^q9L=;)>V59PaoDc?mUGS2;*Rrz~Q|Mi#u z+vBtgekn{ZEV^mk*zVxyz~l6$&q6j?bfE2f{^WM`Ru;84LmN1A_H z=dO}Qr9;$e=SU0#PObclj(AYNeP42NP53cP~y9Mwt#Y zQ2f)Qar2ZxX?>A8b6XZ;%1;t#ScxjWr!jXHgp^+>KZ$xLPW|_C3IRP%OlD0!ONfkj zX=zWY#_a!S%QIH9pKuVKV-hn`QT)HF(0>x2o{+joO~2~{OfPulOryG&>7E8Zq>TX1 zAKXVy^q|a+LURUKJeB@P0#MARB$awV+G?WTsMjrFF46WBF%(N4ZhmbL|M30)(?k3p z{^JhdF;pJBnlpSLcr}E<=hriN>pmM16`n)K@IYEqr_eYdC&3*$SHayMi$Qb-7gV$U zI^R_%%Kc`g?-*B$-OGW|veaCH6x$Aqp#pEt0wwynYzW6}QPXN*40gMartm*9%Ik?- zJq^p=F&DT(7=&q5m&KBIzkFjOnV4)Akqyim)=oMb_?t#eqm0@0+K(9?0(u>?7tsa66YVGVp;F_r6%Gkf z$-BEzu*F9;aYc3A-J|U`G&AL;PIV;n;rXDb`_1 z5gEhlp2PmQM$1aNp*QzKwDi{$^z_NoYraB;q23V9 zmRxn^r9mej;R{YVWi+mIdW_;=mn0!pctifog8E##TeNQk??%gDSx;w1MDM3kc?sC9YL&c(vP1* zY&HSTGue9a=Q#|KeP@<{bISjD;s4J+RbK5We(*!+(z5K_<7){NKEEvfGDPO_Z0N&s z|M02L-_^g_GZiszKJ77rP5G`IwgIvP_u;<7mon z7kuvM8n{;n;isT`8I=P?7I!*laCA_~_%P^ToZ`ax@v9*3$MUA(j`KRvvXtDZO zo!HQ)2kP4rNNdtMT~MP)($DTb?HBy7CQ=bCX6rHmk~0@v#-vqOPl_Sq%n?8P&pae| zaQ;{Vp|i@$11te^~t9ca0cBwDRuz_z%4RcaOzj z|7f7t}zZ?0Y z_o0<^fx+~3_Lk)D9xL1T!ZAOEWLlh-mzm3f9vh>-T7obWj1m(2kuiFZ4~OX~|BM>WiJ3Hc9AHSM*gXV0Q< zIBdR}(&^-FdbzI*qd9&cii@=@KlUuXaSYBTe~R z6Bb#ly7TG+NA6=(+5J=R_P5>`xotg}5Y72!H0c)wsyzHRzx)3W;r{l_cdi0wBVsNt zN-aGpC~iEP8mZfJSZ^hwjBDvr(t0HIs@Ao~K>60a1@u?0t{0O0;>M#8YUT<`=H=5% zRDo}*x2Y`M-SpZtlUg(3jpn1_c8Ozq<-LmB?VB1ACrfKq`g3cyqEC>ug&WxPZEd`1GOKV@>D{qwcR% z7FQCDTerxfBilet@2ZDII3Wqx4Z`NESLUerDewN9D3 ze65Ku#E~aV?}5^of{lwfANzd-j|1)f?ADdZ}tu5~Vp|#gf01OKIX$hN!QS)H~Nd*7@mjUshZs90Y-OH7>V| zIgDg4e5)8^{2<-z>4kG>w@UE-bbNTkw;ZvE%F zz-0{A>uLHAMZV+jJcGYJ3D&>}wQ`EHiw7_nZQoNYIu_397AlF3fDEx@w{c@bzGg;@ zJrP|p;N0(Q7@ZAL9V9g_U9D#&zw&<7Yl9cE7wx)8QLJwt$Sj-xd3C_K=%)PGmgu?S ztJRnnt*0N>2reyjsQEF`NbMH^{Z3uC-_Bf2u?SpDbi36R5D0o@&GI3O;>>a$0 zJewFt7w$U{_xOdKTCwchewKx2$rA?V<#fG&nofQOj=r)ipAUTTm{na?E$}6cHplDh zAK&^(MovTqJw<#PeJ_4f=iYm_<-0`(G`?lUm#njTV%?r!hlV7-JvFKAn|S1g2-eOmysxweQj0rM~+4lDQN}ZYDj!%lR^Q;rUhZ##^7J zmkq5+*_14LHr?smh`z1l?-4R>UQN{J-I*;ODi=SW@w|V+^*Gu|JrQ4MoN>pfOS(70 z>we-iNK5`sqrBj$hOs8!W#z}dpUd>3jBZdyN=&mRzrwU;ASPKVnqy2Y-wde2`d0F@ zYo>@TmPVG7<`GBfHjkv7=&beF^7F_iekL>+@pM0vQyb_vm_2npMQ32eQlDof6H?TO zxZ$?{k;URmO0wmw(WiOD-|6*#12_QhS@f5W&;h@eI-z{w6}{zlI4;ZJQWQrAZlQoD z|MSav(Aof3mBx9YZ_fHAk4IofAEiHtH$Q?dE60-V$xvRJvG~lJ5Goeh-M!Ef>uOdX zfE zg#UBud3$YDeP>}Em-oBpqy*O;V`n)tpX`1M=HQi{nO4tc`3ACUAYCth27M~2svdMj zH(l=1cV$7Un>G!-DK3!s-LzuqT|)?Wc(K7{)2GcRU``Rpah`M(y9Q)N+{T(Pv{w)} z*Ytt1?mZ=C}t_d+p-J{E2I#&mbcuW!Ew0tyM znqmFl&1aRQcf2ll!BjtQ1tk6|&=?kI; z?Y(e)(WGZfwO^#;eM|YnP&#L;!?KUeh|1m@DFxi)Ux~5PPkhB|;8`DCfm+-vK>@!` z`PfvjDsATWOeNtnQ(k_UfH}3?htBDg6r)UDsE*tpImOwaabM$P)6uu!!oU-0Z+|-G zT*1sMwR@VfHO{HcXWq~l*N;$bOdcDWRyn%YNH0s$jF8cSKMi(||H|V-_mgpLz}6BS zqc#u9;VGX5GnHct*A!*;xf@RrQB!v>v5wKn@v#{R z&Y&kG_jHsTT6e}h&&ZDTviLgG&0NnG32PilwDRuSd5Y(8R`_3>y>~R6?br7mkr2@m zf`}l3i0Hk|m?WYL5sA*|ozdG2f*_*zPSnxs=$+`jcf#nsGwOTh_uS9A*R$Sdz4vv! zYx#?FS=Km@eeC_+dw;(6um5{U_n+t%K@Tz>x@Ee`<>-Bhzb{Re{r(Gmn7!^-f4#;H zch1io&z{H~x@S@sFDZ(3{gg^%Bn-e}fDgC!hbP(Cbd2JMV__7Hkn?G_(TN1*$?xl# zt$`yT`u7MNqZX|{Z3fpTyD=wMakCUC9#X1ZJaiBA8{jx`?Yi^GYtBf}s^M41xvjHc zeu2T2P4{p5HjP$qO?3l=d#fWtE_1C`bCKoj1F4iWH)mt(BkNhS;-k6;NsCvU0(+Xw z*O-952cGE!O}OE24#9nf(?QnZJ8kKV&I77C%$!?*mRXy+`$Cs&YsgX0dX++-D3%{ zq&h)r2iv@e|3C3wLG+-|@Oe1(At4a+`G(&xuUrV#slRMvH1JSuWYpw5NR!vIyhTSy z9$reYOGh9GEeHwoe8D!xM*T}a>kDlDhW_rf?(?)`DgtSXI4fyRl+%M>Vops@Z@lRy`6>wrFRvP8AVavB&vB%2|CtnPD}I+pAk2_2aj?qt_sbVIYrMPUV_} zHXF%2HZ8PVJ*BKGw9wVKX&q!Hhj#U8^k#jOUJ6fh+v}#BAW*X=dnpYs*pfs@2&&iosW% z{x*A9UcSJ!*x-6h7&FYVxcZLYMpX!@PY`kZN51|AI7TMvG(2!o`k&qh|E0jH+$(+P zCS~=SLC0CFJMxG+`cZ_mY&J+Kk>~jbBG{UyV0I^Q=?&}dr!u^BPWC)03geuhGU0E_+H*S-4_IOh37VMl z&Vf`i&+3h+SN8 zI9A(aY#_Nn@6k6;B^WFC4tj@nGlQ+oa&pYqdZgH#BeFlwc;R<-_ZRhzu^$DX)frO*CuDv^Dlw|x4#^+=s$aj z|6DKlMfV@JLV&85cx3eP3e$V;r`w~Xgh}!)7wUVzhkI0D(<=rNBgsg(3DNkdui^Sj?T`UT7?ePti ziVUPm2T7CJw?pe3?L)6_X>gn&Da_T|e^mO})t$?)XRkRVeHY1BD-ALbh6-*YlQYD< z3H@yNCo8s2-l*xX^6oJBzEn52sn$DQmhgW)!!$Y+;qN%g!ss%E6MxWZ>2L(%0Z;2U zp(1Ft>6ky^5UA-}SrA7U9epYaUHlsV@|yT_rH>9U);6CGa$Q2qf&bET1faS zN^JO^Fq>y5?P#YbkOMpR3kpApeUnk~qUlMIq4#JT9+9V??gQCpw3~PotG%=O7r4HX zA_6Abu{^tV;_c#}b>1mh<%r}bRx5JI;5=G7@h+GNF(Z5-x;O7P7YmYGo1=tsFk=6> z99RnRWewF?&+Z7asWME^g|(eiZG}myjt?j;ks=j9otfI)cN*V4=T2Z1y#;Z+XUf`X z8apa89ky3IlaPl-`@Wh`0C&EG$jY!3Hbu#W(_^95`K~$(au^hpKgq(`4}e>Mgp9Y@ zFGx6x&CWcFrz8N~6>%yTLgQ|lP_2H5C?j-*Y}!0K>^c8#Y66Q=Wy$|x*cI{Qb-JGu z-p#0nK@9Lpub@VGq~&!Pfstfl2YwA!NXjvL8JupP$6Y)Q}X#e|} z!PvK{@1Y%vQeJNZTEb=IkoB);l=qM94){_0KV9XGDt%AT)LtB1?54#&S8q%BVuMW;&R$lyx^jn50@8NwIG%9+wDHbe6Ug9Ea&#=aSk|G zk%__((c+fEiftpMs<}im+Q`}yl3Z8&b*1_J7mNr-D(yl*O~N5juH`6I3(u#GLB4dG zyfF@Cm$>M+PMekt^e-egLzfLNyEZJd(7fftt3PLskBV1_On=Un(meOE&&>>V55EHa z{$aoam$-;cSw#JaPvTr|M|!%3hsg)X!vj8`=vD{C!JYX`BD5R0A>{M(s>MnI8&E@c z{c-4^so#*@K27rg=pzz*E7OdbV1wA^MbTBE2pmIUqdb(s>JHO0vWJBB*D{Gea7XLE zD=@h)M;jn~)$J$ouMQReYZ&4m$C_!Q2w)K5pkP+0!%{lI_x)LegzB z7GYhR?bO#QQo^-j9>=9@GsS~ismLZy7fa1H=X&$!?NgH zGU~uq_W`6l?iXbjHlulrLL_%i7|hRYrnABm!=6N`3pMGzAox{a-~;ZLrtY!6*kus1 z0i9^eB*VBW4lxsv&{aQ^mig_(AD~t>Z1{Qz4V&BKAdA(+=&q=_)08kFU9+}`#No6&$YJV;YqiZf+PR_B3ews32 zG5!QLNU8Gb`ko0_=o1AsVr~1punHhJW{@5DB#r&1Is@7@LTHq48_T32^hlZGvXL{7}`%qO3Ib{KBAD8+Go@T--xQKCYw;=uNfHWRT0E!Jn^R{9iPEoo%E zHvUB$bcHZjYSTBzHdJYJ4O%YxA)9={s`c_7JS*h}LI4oi8y;A;b9Q zpq}?v0A@tH%K!t)&}IfhdOVL>w-~VXASVoX-?2tFQ2Ke}OIRm3BpR4!Z?j=({*4jrf7@-uHkmTA9#Dw`3Q-NlExnts~b zE3d20e-8}|m&T7I5d9K*sBFZqdiSwC>@8nf_;&3>cN?aB=P&dcEayH+9Yf5N>DmgO z7|()(NOS%l1w8*SyKEY+Pw8L|V>-jK^K;cwy6?OZihJ4k@K8v4^jph07O;OS^9%etM4d z9|epY%VgE-!hgK1sK6R3syDa~@kS%tjuR_bHac)__vIL62&$~#$1+KxVthPwY!wtV zzX1&^RgrBns#gQn5@R)3I|l3sjE!jSYS$1T$3qI2XiCL^9UmTb_CsZRX`u9 zWNlY`xwWzMvLaY8Ht+uJ*n-5bPpL)dM-1Y>#C4@DvqrQdwY~!JpFRi2?z1xEL++A7 zHSva1%rkP?MY{Xs`ONcrnrgE)oV7XeG-iU$Pik@`y9C`hK7V?zIV5CTY(PQK@1WmM zM^kG_m=XHKp|=l3PVn7VnLa{@h5;P-hNx$$WSeQh)MivVK%iGCc*3@cuqZ#}N}-X$Yi$~N9NJqOyO z9M^0(pinsX{x>Y&PhzfQ7xBPF%i#GtM8ft<6vMzEG4hw4i>!lgs<2ZSF5ERgI!D3{> zJ2>A1{_Vg8&s{dMi(yXLKW|?KR;sr6K&1SQ96S8YgS4ZkS?2Wih^jW++c~W`=Qq^1>Okb)HJo3 zGsd3$mUdR%aMoqr7-4fuhBa6pwq5xUQBf0;`NX>Vy-J)yUNXFe;L*v8E|$8gT+9@w z?a7rFjYM(U^YE_TU|iHgpl`lRYM~4Xb}e7V{3i7R?pKvbiT02Y{;1{7pT?#G(R{dU z6egS77EByeOSIW*7~R!XVWBX{f3ARv=0IqBtJ9zApb@8N#4EvIS4E(*tu1z5hlOc1 zxOat(C=M7n-)B%4eX)(zFl+0>Mg#-vVhiN0diVz_Q&DUD`2((CJ`tRWt<=iZArgK>xVYF1RKQ%GiPoQPnchNNXq7_DADu3b*wleHokLWpg*ujmD9yw{!n^vfTpqtuDp_C5%drq3}L9!E8X6i9F?9&gfwmtrasyD zDTVqe@*{gW@xmG4b&^73mEw~xy!`!szT zLhDKFR72kz7O;}um3?|xPiUCxMeB#@3N`oS6P8i_VfMQAZ_XdurZKIUE?D+9R>83B zOFNaBuwkA73l(vDm$8@Y>MF$%+vYZr1S|{uEY$4ontIpyx!jYx`(kB5%A&eO7p&AX zl?8X5Hv0@G&5n)l0D}pS=BT=&f4V0*+i!*-?iw|&k#NWszPX#T9BmV%5Ucn>N<0Z< zikyFg=1zv{y8KmjW{(Z$zO7z(&oAEVyjxO#1Va0h+V6^@$)dY9Y$y-67^*Flhl&i* z6>f#IYB)~H`vKmU#c5FI_E;Gi(LM$zwEi;2DC<8jzH_DgRq4&KoOQd5wEN<=muy@m z;gQjFPGyYLVcBDwrzdhov&D{DceO;|vz`?0VI++iPEPSiWY8LI^(Q0q&3`>t^@Hr< zz4rSuIw1}q#PdZCiP#aRv*F&CU>HJ0L^J65KNU@FmF=PQ$9rnju6#vo`#!$23L$Up z$Ez4Z67XxRdypFY@TCFr-dU)bS5n*@RnLJf8l~j-`#E!AX)qfmWfYo@%dySXt{5E{ zaO#zy5~>y9t2AKnqw)zdg(X0M)pEq3wFRYZeCKb0$wqV4>76yZzdYZK4VUh5hHSnI z#|K16##d#)iZC9sp^@#BluEi;|Uo{j_+M(C>H_trkC4pTAi z+UYoWyKIcELOs^NN!l5xeDVP6kzCX=9x3^9i>0B9`V4s*)9nM6DUo$uE|4S55zhwH!9Cq2iHg`!(C2Nqb{kvoAGdmsz}gA!LuqtQOw~|eeYzp{^Dt;7 zcW-n;80jUMwMkb{2~{*V#5Oldl#?nZVk%zvzedyk$(s*6<7xC)$cY{br82;KF6!-l zngJJ+tLy1`e_s^x@!4v~*5TW#_>;0UCHY`rIQ!$23sdEE@!0cVV3Septdl;ZW~->N zx&C}9KvxjwGTQh4*!b_o3v_$6mQ&o4^0S(7s>*r6v%kGw% z1IURN!OVd?K_JfNSoj(llw&j^@Ji6Kh@tZHgBP&hT*5;&5&2bq&w-`@3#E#C6xQb= z_#$t)li+QYriS#JA4B0MFEbP6tw2;;_R|shm$>AQ+~`$A*&JMjYY{Id#fJYQ_Dsr- zE6f@AL#>v)G?M13d_VOz2GdsaMJ0azmt{aa32-t(RToJa5su=~I*Uio5aHi9hP0t^ zMA~ZdN`t~%vkcccV)F64L)3`^GdQjBp;z>RAd+~x++ z_=7gcAR_#O*CKoE_V&Enda4zGU9bnUoK%(Qw^tb_$C=s@Pz#S*;<-B$9NdQkNn5CHYeoK4P9^oK2>$hG`ZAFnsO2sr(fmLbGoeC} z-!r(CD~;{NQ%OagAVfM11Lov&cnq}3S*c^W92vLAdaM)@uK4)giLih5pzTPcLzQ(6 zIi;@=@SBcXp0%dZWb|zlZ!r$E%51o_Jr{&{Lp_D{{PCk11!P1{7`psDKNm$z3afK4 zq^~+}zPc8B7a|*~ANoUB8`sPrfs`3A6n=e(EpPEHk(-i#JXaEaPq!=L!8g~)(Fop@ z<>+3AT{cHn&vq9t;Aa%y+sL)c3$7+P{uNaHFJcIgjaau{W?1NOMv#Sn2*)N9RBZ_r z;EkO7vY)UWfe9Agq_+Y{@78&RH4l}`d^1F^o}YvfC%6MEZfkE&+WOjLJ_CoW;qrV) zvUU!jnio_p{an4B)DNlt3xZX-q(TRSS4l;Qt?xVKC~RtwL|i<2A=Wz)T-rp{wh`l> z*qii*OHqJw{GloD)98Xg`r4hs7&X&|$&~6;0WcHWeU$oaYx`4`00Tr6*15y^)kNp~ zm;Ew9`lBZ>0_F|AgH>zK_e+C%#Pu}#HfXkkjyvW+1wuG;FrWog1QmsARcc2+%+^UThJS@G&)GO{Cn!euuSaK1ygi%?Q zp!l~Xh|CM+^&<>n^<$~F&aIq0iw~dgsf%?jj)g~cCC&f@u~`8A#~KH_I8K<0QqeZ_ zhm*RcEzs09cAdd?0jrxv>#aGLBUYD;P|kJiSddE^;MCX^-Rq}utPS{I>;hmBC)~QD zJAcXcRhE@=?bJv9>2tu2|JG_>5*2!-|Gg@uPnJ!)jXly#7@ZdutwTccku|PBtVKGt zR@eO@T37h-2?GXnIK>n!vk}DQ|2NZH5fLkWX<(9dSzfx>cBhxf7*_F)kiq3QqnWP{ znDa(HTys6)$$B+~S_>ic+Tp3|CO z1aM^SrQVA{PBJ2~&GCMX_>)uy*pM+1Ad3>BugkgRVQ>!E!o_=qo2W;=qd}e9f~CuK zg2X4Q!;PC)?In)krvyf>YZRK31(>h<^p*47tkc48n!T@trIX(t%dU|UPqRuDK6VPD z5{f?O3ghIEmiyPyvh(XY3z4oN(xChv(W@4ejBK{p*Q|9Fsp6vuRj&^k8y)TZHUKua ze9Sk_aeS)L=I?S_0>r~}2G|pw?R-qnIt2r^wktFaN=csN?xfm8Q#(#JpBx{@?jRxH zJ}sBAugd;=seZJMTbMU)z>~lcn;Ey{)%B`H_lwN+G{`_>S$0v}+K?m%9(kbLkt_Hi zFlzOlo9grdrTVCnc%F%Zt8IF1SF{z8>@Hn!s6E+dxkEgWR6X@cX}WjFRsWYnIO7RF z5jN&@?l_@=Y*^ouP5KveQ5+8UMezgILe>nikbQ=(gtWFfF>P<1X{^OJlME5$;Ktc9 z6*ZxL$GxQ9qAE~KU)Szkv`d=`f5c@AH)SKrA~E^4a8&wGA950TJ+<*6dxHtspUQ8F zNjs%#(+-cM zH8=gg$GrZB?$TS*yJD;d&G464#2wNvBT|3i(k{P?1qXXt>F3(R#LBn`GlVX20mMUr zV+vxE*$IHSYjD#VRUh@&zW>@l0Yz!-S^a_K)qa+nZcWY?7jhZSh#dS&*sN*`pqOcZ zHDJgg9VgMVxVJ<463DCIM@0fJt?Z*2vV5rzaHOgG7ps7A&S60fE>pHLT^p3wG5?5$ zAtxGxdN;(jIsdd*oVsDCUbtbBcGY4^_h|r|p7iZggRBIhset-pnPGBIh2wN>me%;@ zxsVcFM*or_nk@esm7gQwAx?gfi`siYAfo|wzoyiK7>rvoYzzvHMPsLKh{IjO zL3C*;NtzWOjw{i{W5KvV($#kJIqLLNR~BFp2{V!H372_S4uUf@#rI)$P^S zI#h~`^pMjCXq8c$j)e_q`Q+EC7oqR^_#_Q7hlHzp^y|2i-+y-3C0K!%2$yD;E9oAs{ z^b%xo83QGSlU)6a>&UNI80o%(h8be~^5nx|{`H;4tG0o;XXb^bn@$Z!T26pfNR}WW zk!xvC0+fJ>r-O;rj-^dy`uy#e{nq)GZ4hPPh*CRg)I_y%ocz5o&UGTnFz z4Q#ARoUL$pj3riS)-!N4Hg4XjI$$@nRv^2+noVpF!Q4)X>^UpszT8Ri#PWStdiUi< zTJ{TR>-!X6o|C@7;Vfp!{?L}_IC1BpkrwuAoKKvo`JVR`A4_`|Ghj=7`t->N=Mm$% zO#fm5aubAXExJ70f;WF1M^0eCT5F>@N+&xFbslvmLevVmgL-tBpb#9+kj}d}ChYeq z%Wtri@F8sOop%;5p%eZx+B9YDMblzV|J~8~p9Wq2KFJx_wC$=-9rNoeb`TS3Q3YxIOY4*Dl#DM4 zYqlyHtyu+-sV+o_OKIOw~fc)!3UDxYxfde|uFC-*PRT086I1J@1GaJ)O2AHeVN+ zdt8=Wmp`h~Zb`A-FmvK^O5(pHIFM58FP#Nq^7huLM` zRIq(E)Vekk8h8F6@@U+qE{8St2z4Oueh}c7L71|C&*+nVf1;47!(|4~jU_;b-uO-` zFNa&VcMbRq7I;Sb95b{00a?Cw!N~K~dQ-(Hj3%C}-X3S5R-c(qGDn|f(BAC(A*M55 z&E6BZY9B)-%yycWD%*fduY1)IT*iJ{`_dM{wQCt(odNDB9*6+=`j1LV|9$RMdBe#x z&otM36nrc%=OB~%S%Tg{c2JmNvK-Hm0Mpslm&?4e-;2_QOKqNuf(pH9q2gC7S=j;VGZ96am#dNZa?2B9tE{IUEo?5TC_l7u#We99+ECwCe} z$iMtY$2M)BcG+vH$vZE76RQ%hhY|bx`tJwZ*k`V6sf)xB zr*yXAAv7$iecW8n;_dU?j4F@1x27F5^^yCQ#myJ)G7HfPQ`|}R!(HyBDSMwS$(WAR z0-shclsKs4%x@@G^KF~OxAFyn2YY?%f7uusUbD>s{J=73r#|iFB(HJ*@CE=D+xH}4 zgcR$oB@MNBE5CSyA3KDH=>5(A?uh2JTd*#qV7CWvGU^&SoHyKlds02c_m=5gFEt*rEuM&3jGiw+TFuL`$=8Dk%Fvj z#%K{Do>|mxq;H?ic#@@4`{8q6ezKCQZUIy+8C;TjR6UIxColele_KlM)SGsvq{m`- zO)~04vZ=Q%kzP}o9WA&MPh;D;M%9NfPP8$)IPZXj72cp}?FyN}{qgJz*Sk(GV$3)K za|R=*1^DSl+VdvApTt(hP7Yxd9j3%8hj#PJhE%*37Srw8j6*#f;fC$tZe3-GnJ1Nq zqF1IcVg5y%(%}%8+LQL78YXbO&r$vM7jz7~%0fXylB#@}(=ti*MfEZB=Tnx2L7HFI zSSsvJA_cW@R&8uz!U-TmlIcBD8Ae#j@%|PbqgZ9MPM`U8!mL@$!44t2xd?aix?FnmlqYyHt(V!Ym<8B~+J=OC|?m z5xrgx>hm(W31-m1zpls}=ST6C%U%BD?E10}Hx-_5d<0Qv+5K@v01}1opaY zC*JvFtG@_DXJ@{OR7-DB?UCs$et)&v(l6b(v?KK#?=Rcd(TUL5$#z@I$ys`&r{>YA z<%%QdT|s$iUg$RWXC3`SrgJVDOWp(BmE-cIwXL`+=HxHDnQe0O&5o4%l{bGnLv*`x zEbS0qN>sL=%GBl@|ESEXzDvH=1ApSp|JC!5#W|gor_cRlUC@IS*51p zyzLfl=zqZVQ3-Ri@}_`b{_(dj|L*MjKK?;^(Oa44;Yl|b{|ytC2mbL2PZO-3l<~w} zb6y!?du9&3R#zVu)%y9W0&q;|g)~w%qbZQ*zyWDg0DL%*#LlfRNcpbODL0V~`#xgV z5w)@$U?$7zm1t9d$Wq`ZrK08VRUKumShF_|XEQWXbXrtZzBo41p0Oo%9`d>y5}TDY zrk7^=pv*)Ot2GIFTKb$*jc3x+eUmDlQbo%!3UxtGYl>{qqHb=P(~x>3lJ=!$$1Wwp z@g^q8ZO%g9HK?Tej~D*Pna6&s{YGX?JmmCu6e&`j$OJKK7XlszEM!qA0IZY=@Jl$@ zc#YPQ&U)-e6(utpXRXDwqmSCv?H6Oyf}@nxx#}?=VKP)8U2oLzPnHaky*d^xn-#K+ z$Owgx3*gOKmkA>*muiY)bbxkb^5KAjbchxVe4Dt_C$Nx6J}n)9>%KW+Iz)!Azc+15 zY;vk@UJ#{yxI}>@6qx2LC|`}=(1y30{Jc8AW6FZLqp3FLFGICP!CwGphOaa za7XePseoHrl7Wy2U@_MCQBZup5kSR`xS1IB&9HO9{g0!Ho*UU1W7ZsZ+U>5|A46LU zpn{6~m5tX03wu@QfZ+gWUBp7;%?V7-JpUjY1z>iNY!%M7u9K}a(GAx-dszdBRUV<* zKQ*P`O99}6HEm@AHP3sK<zV0ScdL=!$6ll^ zXJuk)h(9ES=0%a(KT`6kbHLc1eh{MvWe>XfkQ5uq@SGg#!cDGW$> zOm~Ov>ZeRMs%2wbW;GE9jN@M%wbds?Qveu!G(Z*PHO|Q#Hf+4q5AV)0 zGC+S{WlS6vn0c1CIlRD51{OmjKP zssPDnJDCAY8Tsq47jEVf9?saAkX#-vLS?q{%jDs?le9OTk|SpgP8JoItIyLm9TZtk zR~;VCJjOPKbDAF4C#HUDjZN{SCB9qg-ME`uMi^uJkj_3Ur&$}xX`=*}%y;ZJG`&N~ zaFJQZ8LI@qbq*UC1r}Gyh-ny&=iOLKXLj57rj;6S=`SnedxKBGj`Hn|L0%Tbl_sx{ zj9a(>@V9d>=dW79 z7*G@A9H%!J$Ld0+6#{7ekm<{vd?@2W&8}k;4Rp*klsAd%0BhRyR`|9F=eubgCu{VU z$t}lgQ)`y#sBopWkXhe1Dm6Dr`x+aIA^YJ6)n^`~<^Ur7bhxN-{AT>tccQe1ZLfC0 zrenvWl@(R~Psd_F_78gFNbA)F7VOaryc>Q+B)C=A^w+ob1M%^$fexQlTmAXo77wJG z{nCNUS00+$Q19FlYPnah4D+ml>30qfJr1%OGV|jAOy)Iaz@s8!>n3(J#nw#tB36H! zSD2Szk)l2S<7Ykq$u!Jg z-1376^7kc)#PnQ8bO09AO6s~kWHM#X^>&SeG?|hRG6$`FSqWC*MBruoAYb<7y5(?L z{!`+AOO8LcVY_o03SSkDwYleaFkNbX^nXg{)N{X zWZ`g%V#J*ek`HudY(hG4czA!&!5V80#!98f6Hk*-twcktXAvoh(KpwS`Jvdgkv#Kz zMY(BO6BD~-3V>C{T=%1RSy@A`V)P{fvL0pU_RG+4v_Mggmtq z-P$hO2D|3%@fqg`jT5+_7K-X@5#5wHH}2M+Gh5oXzNkNk_qCghiAAe;j~64`+sHL~ zuZt;e+}1=Eq;YAlglOTz5&Q}%w^wW3WgS;R0`u#b)PraWTSNn&GH?m(WahT*z|IrZ z#TJ6c2UY6HPBvKz6OCt!yZqBp#@X$yq%NT?F3o{s?BCGDY4VMmU4)K^yH_3@CQh4T zi3=H$?;4KL(r#w!vX1XJrh~-^-4G%f|1>o255D;23z($Y#RnM)Xj<4m1o)pWpf%;7 zjypRb%M{p$)_@?QFT4a%Pc5p-bj&AntTkZeU)A?YwlcrcJVsLKhU67qh+PbY1fNBm z75{aBl!YN$w+iB54@c&k?0eWMFHG$P!-zf_t3cfxgaLC&wb6nbOv*@40j9`3H8tBU zjn?kj*9r>*>MzJ0WhbO*vzw6R#EX8diUlhXs-P_v!FK~swMORnCN#*oXnA)2j9_20^=}qeHS>? z`@QZ2M;$~^>!1(jB75QH!d{V%DXc$@AD=vnJKP=+JPJGxcB-r8wJ5A!P2Zlwgu8h; zF~S5vK(U^cq!*)>JEk$c8l!iVRC9@F&G7#+5OWW(idm+7crKpeBk*czS; z+}M$8~i^3t^b2Q{_TOBcasJG_}3jm3wW%=lbSTsLre#dy45R&>PXks(615!{eJHZ{#??n4WdTN_i0C80I;B*i5t<26 z$6km?xl%Zd>rWbvAOBVkc>iUV4G1y)bu`37`hxddW@4PHsz>7E2VeN%w4j486@}5g zJoSn>i=&*e2ZO>#dQKtaq=ENnrqwJTeH4q;JR1r*^<_FwOWnD`?++2@zt+F}u+Lsw z_gu*|WX`E_06%4mn1E}D%DX^WYvr+Ntz`;6MdRth?H$OwkfXCXcoCng+hp7?%wt0J zBG(m`kr*P8*=y+Oa7+fkUhLZ&A~^3>*|E~h9bjBi+rHkM$UuA8CkiCcwW~WmRC;dd z(#V%wKhg2{58%^wGP3=$tn-fwa7tXG+OD$r2-6-D4&bH8HUJ%)*&Rj>my*4pl=NWX z?s$wl6l#@%0KWhX3etzQ#}xQq34ORiw%(JwzZ5)#sqK!r zR>Z5;=HbI4J7v{?*`%iHc`NPi0A}b^;OMfaK&W*375UKwdia6mZunJX2gOd6QVo-U zObfo~pNfTs%V^_}tVY1_afh%$MbjpVk89VkFH+J)G{ki@eHb5F?46Y5VzE3r-HVp6;u~I)GFi2P$PdEdHt&y7o;TQqa1FDPY@)Lo~l$&ki@elTL(ggfsTq-FOw`@lnd{%Ophi6)2?sCH6XSMYkVs8-qs>#+kRk&C}YE z1wC(}h(5ukK8~|5usO3Zzwf!RWeIkkhh0LAQ|f~@)Jy^AmD7{XtrM8D5@pCQ#XT<{ z{E_<<+L8PV+y0_;8(9ficJ3ESk{-2g+A$M$$w!IDQv+_z9d4}pGj>HPBWyH=whvV;0gijDc>r4bR((L>Bzkq{NFb*gLF2$^O|asxdKp3TLb z(O>&*7fC2ETb%gq$C=~p^@56^_~f7Oq_2j4)c_u2momI|G_IYg<8U9$n^!jt4M#hB z)AL-LU^P`;b`xi}MSSR=txBM%%}<5BTaI0G^MWA4&h;oV#Y$HPBMNkf<-zs~n{Mwv zjr!nY>e@w_o-eX89rB(*G_U;tp$;lv#~xre%+HN=qM(Y zz=_=YH&+r0vw2m`*fSp$Fn5<7e5g8*IdK%sp|q`sAF39gIdpK?X3UK?YxcmyQ*d|8 zu(NiB!xz@P7|r zJ(aq%uz~XRb!^q*l^UI&(3 zJ59j!^IGtFdku1i1MWpL)NAb6)dZn$Tlb%&wct9mKA zbn5?gfDKX{#E-Ze0|$5Z#)w(^?r;bW?VCd(EgJCLIVIO+dbGXhJ)wgPQrRh?q0j3a z0}#j}AolbgBP8Q(IVOYZ6a83g2UcPhs!2rd* z2prfESuxsp#yppl(-gqJk8Vz%i9>no57{?%=qI;AX9tf8A>G5gmPy+Lv>?9ccp*=J z@hfTCCFgasysrZ{g}s%lH((L9FhV!;{E{p`v}1X}Gc+Tc-P`O6EvSl% zbtEV+s@Z9D)mbbk;Ot2}Jmt{m4`?S1tB*wT(eeu9y4&<(2vBXAL;46RkK`?_bko)A zFw4Sbc3E?8Cn`232C=So2Q)j2O4GkN2Q)z_BCD+t-3ep2g5y*Zm1nQ{ufyLBeED2EagH*Y2+_0L?^y+Z zJrl0G;`fS~Tsg95&HEEGhg)gLnX=|An2r}mlJi@W%FxfvCpBJOF51-#k`di*PPD~n z>IHdMW~!))E&7f>I9p0`M3HV3vZc%yY!(`GqvU6pIqX=Yx)$Sc4v?Zdrg$z#u7?qo zQW}$x(_cDQ(Hh$kd6;RJwWRdaBFFd2*GI+Y7Az0Ov)mXpoNDa57-Q^d5f$V}`iokw z>N_5vlmG#XM|OVl>>$J=e-dp)b5_-{vIb(g?iNh}dEDeUnxT0Rc!w@GM=5)^p(B~6 z8?(0;MKHC91^))5$O`UBp;P_LYJ*z*!wEHG>RSUgQH@KWq->M71%at=R$8wqRRU}% zh;tQ6PQx%fzs>WjjcRTNCT1#zx|gSy(0yMznIX3o^%t8V$EX9lE=CIYj$zZpikHQH z-BCY_5=#*({8FO!D`kb#(s;YzTI$(skVNC=VLlteJi)q{B9luyQ}OPs+XT2|5-f!9 zP&YRFDRF_Oy)_V}>1ux?f6o?>ZO)Cuh9YYs-K?f6OK2xZGN*m7+TToIDw4uLG1llS z&J}-m6aLnpl;-_S3B$JKG$9<_at?nkCk8kK&x@{)lcYMBp1|;=Y_(qRJf^-Tend_o zaJY;=XuJktf^C{Ne6@JHJu#UdkKCDF5}50FtDT>td-==#|I+#Y|JZTTdFt7Abqv}H ze^74cGdQVpTk}M}{?-DLLX|B=+(&6Xy`gE6(dw}BRV9n3UvMM=qoYp~!*Xbw&SjSJ zzFg^CS?hkn8Yc8`3q5zDLl}=`^X5OcTfp$nS_*-dlUZ)MyoINrnx%KwNqoqqIDcO+ zTQsr2NmP-uxZv7CC6KOd6r2)wdu$cara*mqgva0F;&k5cdN=fMn^AVpF zMV_!#OzJf}{}}q1-}d;@n!}+))LDmyz}S`z=t%r{Box2e_^Sm+`fwe+xO#y(%{ZU8x(42Sb#z%XVFIw*KT#5K4M$YdOH3y@Q|>4cV} zsm;6C>{QuoipW8brI4=F+dLg zE=k$%XuU6$eLvaxwafi_A^DXmb2sX7$NV#A8vX(OpgH!01mnlJLBE~`uFU;hmD6-y zc+@}QGhTQhsMkys6iY~DcMdsg)vEBzX8Tz_w^{x|?{w?Sg5dZiB4r27`umECzoUaC zS|{W+3A}~KF4otsoL%p{NMX!^SZhiZJ1;dl;C6u^s_qK*Fzm74tr>rZe)eIW1#8=R zww|S1VukrCu4f38?_|c;QsRokTuzvbmRLkG{C})z{*MQmbncerMPQtVKj%{m!SJr} zo`1)Wr?=i5ek&evKbnVNOkqajmHdpxnCL`J>rsj^Q<l+LIqS_Ww9ys77>xw-e zrJ@zZelb?G^QF;Y#5F{V!?L=Kd}DI&_D*5n^SSoIvSC0u5386q%QLxYb>2}2l&O(f z!?fm~$P1U8a?*C+G1GT;y1|*;LYgCj=r{cVEv0Iv{*2L53eGJ!<-NXhyA?Be!_BxJ z<4Iv>fHohltnFf0*}NKwIbw5V7|%llulh-_@b`pl%3xfQo-?f62g82>2joD!6SnP4ZCuju@Cm(A3WBk1#>=c};_?GxU)sXvE{`3guwpPe6@#am^$}=S z_rP24C3K&K>0WGa9<)=5ngLxc`WQ3d{R@Cz?%9WbEIg*?Knci@hbnMY9~>KMQkZF{#sWlv$+LitQPToMh#5PFLCt2Z&eYB9y#?UoxA!D zu7&Cc@m)n!#+pL~5AZ*lK`(}NH-KVLjzY^>(RC3&8OC%~5OzAX#y7w15ajm8iTM(= z1yImc*(x>vBh&9u4oJbbOKRP6o#M<29XphEqBZ*Eugcn6T(uOhLtX9OMlbMEIq2v1 z>957qk1DXV&I13U7}0%C;-!is*G;7qby4ZsYsZ-^Z-`wnqe&t8alCnvv|u&y#A*U$ z=-Gw5e}_fHq+K*v3Y7MlqT|S}4zSnV9&KFdg(*)rJtH{4)65S@arYT`FG3eW5r208 z9Fr1ok|bm(121J)M{!cSuBUDca?osk41u{EB@D|#FFuEyOrDI(0+weVY5?~>nd@b1 zK+w;OkQWw8vOnx#b!$2c0Fh zNWvfrPj$@bQak=&Nsjoyo+6sK;qh+-$iMTudjL86Yi(jlG3L{K7W2MY>-3;s*=I*R0-L7sXAzF76DISZda%v1<6Gf#azJFbl!(;geW84RcvmU% zQ=bu$&@8Kj<^$ip179zh8xLGp)aeqh@`a$wlw50}rJQ`!G{a2{ZMH|&yZssF5 zLV3#>QzZ2W3$(->NS|Udg9>c&G^0nToo2(V%F9irw|)k3Ar8qXL>1xHZthMf?S$it zH$m#&AD!HS*<*i~_BInt(uq4wn<7Es`7S#F8|P?`M0bPR?5ed!w=;N1N`~M4P7kv= z=Gw9!(dYw+aKrB@plevLXqjUKUiF)Gns-^V-@J+#L0neW@>S{2VC0j*o=)nn_>1bPIhoqgE!smeFV0_%!pFV z11v#AEua-<4cByL3TnsmMS>J}#1$Snk8t2%tZs+$CG}7XlWm$=W7ze=zL2ge7CnPk#S!5hB05ka{|#gS4O7amu(oyS+)N zU7Xr$=&%wMRiDg1roFv^?fL;`WXHy;G`d$f5}Jn3vnbIPk)KmK+zchj&Vv9!(#6KD z#QZsU$=*UiQ1Uoq8~0Y9Ze-~Hq3k`Qn(Vr@(MJVQX(9?pRZ)=Mn>3LsRYZCR=_K^f zK?FgmBE1VJq1O;Vdha!qkkG4?&;o=K;N0&0?Q_N%pL>k=`O8RvtlVp@Ip@^|Si@y` z>nptm7}3V%HknS(WltK0lTDi~Lj4p3-Po34MC{%orMicFdm-7s)FWvwUMCoW_1IZGJdn+2M`eifxvT6h zHf!wz~Uj$Ex+Ft8djaem`Bud$3NnUjF45^`|o$6t+8GYSa$K{*AjHa^A z^r_$4ArP3M1kE^>-tci?e7|h+pw2riv?+q8saDWX$VT5RCVD(cH^~Jx5-vK_WUxv> zt`XxCFO+QFg>SaXN4hd8cgiSCeWq<6P3WBb#;b=m&#rp1N#`bFh9KB3G{ND^bG(dmqO z9~Xr%@!d&j0!9%-b3`EOblRFhVGU1U_TISd*^Ir<2VjW!5vkyMAn6x4p@9Rw&hre& zm#@&){4nJJox#-1Hw7%s_5*+Az2);C4SJu+-KuKt>?BX(&YWVfR0egVnVyG zs_S)V^C`wj0yov*Q+C*=i(2=@pxS6}XB`!<|L~2XH&HoCy=K6?JsO; z{n)c4JPRO!V?yw3SC!%&%QR5r>Z^w3X4zS_VYmK-@tyVBO}YG%-4eH<6>a^J;xXB8 z=MZ0UO5v&QX}@h=)bL;7b`48^rXfGYx9`7dmdKxd5M|DJc1EEXAKFv`NA>xC-ShK*Q%V|7 zzNw5+H#vV6!ef@xFpaoO$iZw?iP+XS%y}^fHZggXo+-AQA{HAz^y1vnL9Tvy>z~eG z^2=hO>tKs>$KSqwr+Ykqhz7hF-d*||f0AcJ&_MPN#40dSUMtnDVcFu0FE@$Y`A zL_So98Um_AO0VGz@tW;m1cB$gBrUuDUGm=4A3#~=0kF2DyQG~WH8irk+V(d9MdKk3 zvYNoO163<+6jtX^4WM0~^KC}$r0zy(oRN2NoxeoB2{RD$A#sc9zd!7>E;QwSF3WUg z_F|dDp%}LH0oT~}hv=8*-X*dQM6*<-S~fmn3Z*Osug){9k3JnJ7tp%I zF+Vx8F~iO=##}L^WG`XYV$I@LvWBBtq}1z87t@QX4G$s<`53X&mK|#+`96AdLtAO) z;o|cuVA=XHuO~ll1zbw4r#EH~DRkL6>O6^0ked6`+`rimFHc|~j59S9VEFPc_W}#A zgZ(Doq?mcsy~(}1r1yF4k|1!I3-Vx3|2Op0wXwn8?V&=tk=ocJD{cR#)PB*~+#LsL z+r^j3MA#RnKbU+isVxG2w==;N%9xN0o|_{^>l*5kKhrC5yI1?s?q_z;BrEhZD~Mdw z?5e_U4(OpE*XK<(Je!;S-q(=(@7>s#9uAm99s!d<)q4FZ6riP=+mjWT0#0HKY%SG6 zunXMp5afa+iRsE$No;+tj3P8&oHKox3`b_^*Qg)Si zY0;4gB|tKDLVk!S{g5a4-~QWWcQYoJ5|HQmhU_N43ln40vZ6@ zUym<`Ps$pPQ6~LIQzlrE61(ZuMBK%0ZSLun&V^ds*xG*z=InW@ngOFi$@(;>U;9p} ztL?h_6SynIvnyZINLG&1*Zz}wZ`HTkzo;DZbP?rO&$iUy1>ysw-^eifbJd=?-*z}| zg_@BA`18h=>AC%{1-x5PAay!5PJdVuXS4B@$8Sg@1z@^w3l!%Q#Tq|8m5M>^OzBbX z=&m zc}v)fUv{&4Ay7b+xoT1la{cYO<36!Tx#ii#D)AGeQlgt}ySPjoi(pf0jej=9?vFTi zxYo+0&@5OjNRzcP>i$lR#^R1WbTz|mNP|);0^Kz7&gPI1aE8ze+RgUD+_t7G!$wpY4KiPb&;M8mA}6WVo} zqspDvKBHv;37Pd6$VPLC7#XV!#2C2_BnHAld)9vxU3qydzLFXTm{eVKwA5S%$Ol~- z7eFK=?qnmpDX;4`#6ufz(NM{eRg3kOuzYXjGm#Lebahb1qcLR~=-=)^EdFp*-|P5@ ztyq9=o4>g)n(~QhQ$KeAzr_@`zF&O`e>T;;lQppRBBZ@BtO%stB_^#PnZeI=Wa%G? z$V_>nbQDN2&b;a}M6SE?fKW00+jGjy%(Y*=lzH~2<8<RxD5&jS3|s2;o2Ca6TR&?6=ZVoJ(o27F0ttT#~w(20Kjk%bsaCyWeuw0>$<2F8Zv z&oE~+on3C%+!9mcgpp>!hrbo2UjPAjvzOCz4rTRlGxJ8{aKtqxCvWL7so+1s>L^+% z9wkph0W;84sa5cL3Pzcu)GTXy_R*le&xZS;P~d@v%<^p7oJXL6-OmI>7oAgbVoltS z9he69)!9-6rFwyb^JafC`HV=($x$6HYPgzK*ncT+?%fv+1787_peVM_8fo0H^&#UI zpxVXI4T>1OXIynF_cm&hOj5Zok2?L)F$^}_JMOj1Bu6q!Q_s!(+S2{sxQA*_jg_d+ z$qLY_ColU>!NulA!bF>2lLra@76J4^H$*ZTn1AO zJS7iVRIg|^Y|F0+e)qQQ&R1wR19v_|zP#n+_t7m4D$V78h9LSW=9Z}JxYW)DYL>Xd z&ouz}LockCg-&Gc&tZ0$>Tj|Rtruc>K}wZe4K1~9q{?5ND=)Gmizz0*9Yvtd%am$S3S0+t8~NXEUfAIrJlpA|LFk{3qKBa!%@oo? zhXvU&yS4xMYS>9UZw{-n^ zpKeo|`fXpivqKr8JgAcZkL&ZDViDKp?THkw?CaXAzfeco@FdMUGRgr~pp=ZGwyc1P z(a+8SkxsJRMDgQDpM1+L>_qih z?g#qmE;~y^s-ato+8I9on<7E6m!Kne)gwvsuITfpWBo2q;1^Hyx+myaczz)mO9_@6 zdi#$-NRwppvBo?x7pjrTx3>hG*woHOg*!pwGjeHmu9BEymVkY(h*zSU;;EW;=aN5W z3%Yg#2##;QyLH(#1cDlIaUCm)KZsA>B+X}G(Z(5YFV^L?_ucE~K9Z^^D%*cJsW?P)?{t(u-B)RIHpEa(uen)j3 ze`vD-~UBCTXr^il&=a;BTS9?*PtRy z-D>kN*O*OUC|uIz$X@l_TBxSHh;<=FKhpMX|1!+Mfaf1WpBR$2`F*>^5l1i~+eh6- z-A}o|r+G-RP>~Cyna;iDW>C`l7Z0T59a}EkudnyI^#jqRQ@huQu>WjTMt#a=Q0AuJ ztrFX5l?WnXQHiX&%Oe_~r<7H>zk6RFAq2l$)&cDsoV3HT)46rrLa=&|d%BWI$v zHoRAw+(GB4+rH)%2KfEo+N!8M{`kmbb_n5K;vwW;;{Y57L#<9v|a3cQ{P?Ppn4fRtN?iX_v)vtFXo7Jps){YHf4s==Aeo#7d) zwX=I2)9whh#tQNqm^1eJ`)ekv9j!XXgD(b!c-%xBKSYRb!yi_Ib;XytQ%?^pk|cJG zeTCoLk4xzNXn+u=7uOj3MnSx16-P|t5hGAvjOo-$%~uueE4Wiw-ZAjfccr7zk6`-8 zneV#(cN=q|(IN79*7PXvmP^KWSWW`+;e5lmcaa@D-knb*5^mE+G3g}YBH*NFULhX2 zp!IJ?uJ_iumH3Q+iiy3B?*>XLpoux%=Cg2X_$_!9FiQDbd+^0DmjqF9<5ukT+C|;7VcB_fd7#X_L zH7BQ4*T}Jm9(VG)kjh1Pld}pqBzi!?bFpu<7>j>YneM&kFXJ` zdNMJt$aI%2wYN%rBq+p~o`ED0N?#4XWH@=s*g3Q&65`asEG?L|XphW)Cd|pBgf6`Y zey~#~Cr3U5zt&ymC+qv6%_^iO%4H@20?p|o8hN8@U$JmfUxSOm^M15*ExaFmN9KPln{ z?|`_(ecJERiZ~Lecfy0loI_8`=~$1aCANKc>%^NSLMQ*n3&7ZYv}}wet%J>9WqRF{ z3C1ziTN;tryU1s72Ya0fPl^BNRjneAa^W|(R;sUErBi-L{*ig-R3_Vsh`d;%|Hjd} zb?FYc6~LT1K&tiPTXdyVgQeTU*DZMG3X-E^bs9Uyq0FpjY6~OX(8%?V%%uHw*IM2d zGjb}^n#J%uN0r>QzBk;EvG3rhg1+hB05?WMTB=XWp}Kd)D)!1Po$%ju9kr^k!gJ}? zadGkK-XCc_lk0q{13t1)nEgoK3rnBLEY-p9y?5c%lLxzgo(MX4U;BDS zVLkQ+|HHCahgHS;x8#=A9lbh2gNundy~AM#q8MdX5&CZ&LQizIl!5S@&NAc;CZbbq zJ`dJ^mnYDEOHku?mC$I}UD9X2Giauod0mJFUlT&*a*^kBmEOQmA-R)N}ObSIo6y+T?dbjZ3cIZ4e&V$eY~kS9IRL?OxdF zE;7%xY3=VVcJ6YMZ7W7jKsd(Obm&Y>!#A0Vn^VFPfDgncZWeuH7NAmo_JI-PyuHxP zE1Q5G$=W`vW+(A<9Fx6(bvt}z$2hJT;aGJ9Rm>agEbj&u&_j*2s08KccvP_$%Li?Q z=t(%h!t!x_2Ff#y7mz8s-}bSq5VUJ&{$Qy#Dt&-=asNwxo`Ts* zNYl(cOGzph-D!$)P!gyisNI^#9&q%f9ixR49?jj3@MtF$$wO#}OKvwjblp3xJUs;O zG~!IQf+CbrM~A55eotW@l%)`>GOq7^eCkaXha0^YT-q$PSQe@H6m04JU`WD#UJ8?? zFDkV0nN<#u7e}Z^2KNjhl@Rpz*4C|!LWyB-wfk5&|B&)*qyM;=`kg$3@+2o6B6Ebx zi7~aDIr+p8`%C>Rvk0!8ywqfnT)1I72~u-#k;8<^x%6zuaO$GO=ru$gIBHhCtOQ(G zlzgp~O(GTO)Osy!UD?!}jDf;ZrvQwtwzNj70Gu`Ma@3NfM`tLcW|8j|yThxCG z=mweDhZw~4= z0zk~;I5^GfrNor)hIXXF}Cf@gPm}?FLvExMdul(Y&j-F4jt%B{I z@5thalu__=O1QR^x^D;Y(C2X7^w6cPv#zgc+Ox<2(Sz#8<2tkxN#N9se~eNH=sYb&W7bW&3F?JrF#3V1nv?kE`t0Q!^UW1TuZgO?b&WHqDnn-9`8cN^e@?s#@J^21pod4s z@pRiI)%4u4Ytn|D3w_kZ!i){^p%%jvO8=7b#(PaXd)VMnaZ1iKZ?dA?MAPyI&pwwToS*@f`soy|*_Z11y6gMo?|;%*8OT`1}i@rIW5kT*)6xxr?8 zml%VL>$fh9>^ijbWb?~;$YX6MefOD&V8&xIjD;$DWcqK#dfOG{0I7j&C5hv0Z*!En z9ra*^1P*e>AWZy28p9oR_sffhyQY{<7FH^``sd~kA6>S(Jiiw? z?t7BJ>yM30NSJUd58zq?Km&&*g4y$q zHUiDek~=Q=Ik$k+SJ92`TR+6ff3KowKxD97A&<-c>Exu*2caWmLpQxn%X?fQ_vF-M z`sv7Z+8r`d=3C)KKdTzfZ;H83Njj#RbCG2^%@rdb>S9{Ea=t7NhMY1wE283roNR`< zPsSLvU0s{kj%VO`l*BzFX@33ZD=%qEmvrHSi&#tkCW_LMl|C2Ls9$KfvK$SBw5nHV zQg8Cc$zy&Wc&J?`&swvKF4;58j-Xop!g zO|^+GERLo$*2lqj8O}b!YGCc_(=jx9;KdwAKf{zhE3gQU{^ia4%SCZZ9T*#Ra}Tcf z_&DsipxJNn;rmehbrKxMFE2X?oRBw!?sd7=E6Y$O8ak5C=ZXoqE5<5zuu_MzW-4Y_jTLFBuBnQh@P{dY+ACn>5Y80 zswJJZcg)8i{drY`=I|X@g2qBn)iIE-oJC<}6>@ZnwV&R8;$MQiD4jwF+m2=H4 z^9w&iQNdAz;bPq&jn(5igZx=R>8jnGM@s+i2m|NAuYKZ#)8rBNbfpQE{bBn8MUm(Z9;FR-;S0@ z#B#ct0}(nqeI66tjm!kC%8hl=K^L@{;)%HgBFXxh=EmL-*ia%wQ4_a}f6l zIKDMi)FXtPN2(>2e1YUY+KHFiU0n1}asc~-^Wl7B7HDtG%!>q`udHUTABAno+ac+h zMh6Nb5!|$dtCbd%SF1hFpIFBtIIuM`OiVwHC-rg?n&NTX^Qy&Om9eEoLCWnlR;#j&nL@!Df;Pz+m-$$+3g?T!sJ0o6;f_iW}sz|_uD9w z*u`_G>D0)0!%?IbzRcb4{U5O&c(VXU3ZhKRX_CQuRoz!k#a!4@P>-58Z}yGbk<}!P zvBZ7-Zq0;D}(=|OU{1+^}SrAbK;Sku(d?V5ID#*zLAOXdMmEZSPC ztUVyi{s*d1Ite4Qz&m1nK|y(v%7@_ zkErMQhSq$Eutt5hYQg=Upnbw)*JaMhGqwES{0vtYCNjAe`_E{M)=JN3un1TJEtPMm;S(nF|wG0dvu>~kjzvwame zEWxW3d81#Y5!^Kgp{tr8#bl@E^5qvu*S?ud5^$WOo)!PJ)uG^Blp_6xj}#L zPYs7fZ#u$9!0ewfkKsjM%*;(T@9Cx;4Z2oho~+_&;pt>(MuIlQKNu-_PNQmG5FIy( zNKOST6$&Jt@FdELk29k|KUcaw+Ibf4_elb|6_D>y1_z-as~n&qjZfEm4!m)**7|#K z>XsdjqcB}xmcd&%zCj|$9N)k;cJFC(U)Q6{ux&mjICfzH>pw6yHz1lFJZ#-Cylc&#;!h#o)>xZzM?%d!QnPD%gkzPJScxn0GQTtB{L zw4G*VJy|`iOgBFprwjQFQil=Q+uV5EhLo0Ln6T%`a+(m>2&peLAqMN}Gg^NtK@O5w zyMHt-x!Y|~k*2vNjIuMcvHCa=3DmVA%Pf}cV5=99Ap}(dL@PyeeCsx0@omDrimH~B z^aX(A9l)eOY(K7|N|_)ra{v91KRrvd4Pz@}33jrw*CD3r1~v)y6f%DVS@0c&i%I2l zad_$AXW&^|2TOl$!K+S1t<>QW%Z3Ag0iGD8`p&XeqPm(j4mw{&u+mr7u};Gf zmmv|MvV}h7Q(XA>THEe}IVu?PSmLfw zj+w1XnD7013*xDsf=a$T zLX)_#p6X7?w(OSh8{OhwLU{WI(Vgsr+Gj==OcvHfijBg>J;0Z1@0I~*LfF4y<i7wzT)Lxh@0mZKoTj`mD@Iq8Nw_0!NoIh%kWoro*W~S7c*Tk#-hJ(O?j<4o*0zZ zJ}g>`TUVJY$IQQ{1Ml^R%YNhf0eND zFrf<0_@gsXh=SgqFGb9x07@|5K;~J?R2=*HyqiDfeZNg!#lYm+5zMAoQ<-dPCFqr8 zznxulP`Ez>hDAj0a}+~YA>r+qZAITmpGhQrtm6IlKVw|l{zWD%ECS_RP3lJC$+V8A zIdbolC>pdgxI6C?8g5W@C0lAfXvC~gohkfEH~q=RHArdNW&Xr&)fi*x&cnys!oP(c zFap0R1GPkbRRWu!cVeq^&V>Ag*SIaYeU~(%=qC=bRtKI2Xu$(&!{6u?$-9b4e|^NI zp9Y<6_<8)JrL~-Pc9wby*g|{!)wvfx&k7Vrt4~~LDM}ev3*M+jQO4o#|7f6s@{dL% z;-9eOAdYE_g)NZUZ|_u14Iw1ko|AmTWS-@KvHPb6#^o4OlBxUVd?s3x-7cn^;0lp| z3)AFAkJXJy3B`)X+$fSsOW!5u?uLu4QJT_;^&KH`r;Yk#x6EkHyTVQ~gF9A0hhv=x zzs~n$Nig1{Gn&C;P45t^whdM64F=XyxNSB4yq!-~mZGRha_7R7kw^HrvdAt@E84s& zIZTK-s;$u2mO2VKaW3l{8GYY2#hW4)xbOPInR3i$B=d?YUW%x9tYjH@LVepP=jhK|$AO#&dhMa<<&;!QNX`FEn z!~Kl<+gp_wDAy<)Gy^A< z1@=K@;dxyYQ@wJZIl!gO(egCznc&f_9}aJHkv4K`x)tWZt(Vme%v09dW&^PP{cEDu zi{kd{E{^Zgj-qD8V$K_8aldUd;7C7UFDF=Vx5<;$0xWe#@Xscib%3e6#&;uYBfs9w z`03J?KQ&5VTrc#a1h#O<=+-)sLwuJrDL1bx($3a8I^16p!=m{A?uTNS!=^q231C>1 z*gijYR(o8gvn<~`CSa1I>`ZY&4_dr5tQ{ zLPkWHu@3IyeGe%^8MO6Z)2&~Tw;bb?{!67UWBcgt{{7FPZ@=GW=SFys`~$Ph<>drI#Jt<*dwM-I)v67=ZZ2S$L!YYeKVNfo$6I6iLpOUM#h+SisgF8l z+ZaSUgfi*8qn<0{MD^`#tWNa7%S2zMt!ge2-0nXfQH^E$$=toOWy=hK*qi{J7{!sE znA)(|O$p$%)_iuGC;Ohrf$usN(27uPd0g}UjKO-y7&{`6_c*u}5U z|GR+zybFS66di9aHNn(eB5*@IHNjepvHw45;QyG2~$!W>>W+$2nj z`|GhLo7m#$bXj@Wm_lylrDbF_rJ;9Vhev+OyK4lB(mX%9NhSz>54AwQv=eRjL(aYV zY~`HwI@oxq{=J-U4l2}JL$^jbKK888N5x#vc+*UB*1ptxdgU_lktyaaCbHgkO}5gz zVf+hUy@Bwc2`*g^yvSFBtSezAtfkwk@h=Ktu6C@Nvrj!D9e?{lSL7|z7Hwhf;*%;! zV=%_ZOoFtiK)YPz{3N)&YGeJ~euR=q$vJ|o8j@{fk61hTY|zRWiblX?m|}RrFwD0b z;Bcm_AHyi15q+lE^avJlyl08bRt~V`=a~90z;|i4glhEak_KW;tC2rq5yWZss}DC= zRTF8uPD&F{t5ALEAieVX&by|&e>`6muNFSKIcm+^dKeSq+a3$~nT!8=BX$2w@QDtV zG_AqsM9qhOMOpeF{K*l=-#3ebnZ3Qeb1!0FekA*H51_BNE=a8WHBfsGCu;_I-APAV z{3*vh8A+PTdvFp7bRN}=Ljm6z9U_0l)OQ+JRCJZThIk#}E2XHEe2drAzGU;e#T#Ym z_mHX?c~~{l<6i$rA~u%<{&`U6TO+<`Qe4eyh4Ccr0S_a1rx;12X#Ylcy*$}qx-JQJ8(o<+irP9e|HP7}ac+xT&nI_gkbXx6yg*s(x`s>!X!Td((aG&6rpvnR}gaq%O zv0$S{GxW||NZB)^BM!Qr4He=qmJ|ONrmLMS&F&7 zLLhL3F2plUoH;D8mJ)Bjk_IH!T_gW`@?s*5p`X!f%x_L$9DkizH_*v|2PUHH{aDI) zj<|^_mo`=+{c414_55C-(5-G9R1vfLvqBO?ceqc6K_;S84%DndVPPA$b{PX^tnT$`zF-O;j2uI@x)y$Oc931 zp(tS++w)Zvp<*q3wG&cveIiR+Xoynh%(^g^$yl{wfV!$X5G4I}m0Mv^#9BemY|HFTHNQ~W5TF#;Br zh}`8!g*4iRwVyPNt<h zoH&PY>qHSBgTzO_lk+EZ(W*vV3W6A`W`k=hUuU5cfgefEw?GqGlC?fdkl`0%GjKkz z<%FgoSY)&6G!%0L;pQ+;{$orY4sy{C>X?AX+L>OAUTS42MwiR#d!m6e#+uVA9bRPG~zYScz~>(tR)(lLCX&QhWXE2o^fhs4GWuor|CAs|Ge)@4-Egk zThe{5m}n^-?AJ8mcGI_vn*q9sXD-lUI6Mtza3#3O59CB0CPVr7QBT8P|Gn}j7y8p) z-@fWHcHB`JT^1QSl1af{+}sgj!x24uO!(J%h}WCj18cpCs{~TJiREh{eow}JzgDS` z_Th7Wa14zS@oet1I~Dy04Z5>y;GHC_m1JD}QN@Q!2_kt_ zqlB&@Q2l#kA=KD(<553hZGERF;-j!56ZwI5oh{FLYsUB-;+ehDM;#0q z9f&cvE}ZZUV^2vd5Xov?J2||+%cK*zEMhBVvyc@$Sl96j3|vpUM;N1$@V0~K!>^Gi|=lW{g=8L`rqp62Q<7G)9HLPi|(0r zLypwnS=bWpw|~1;lh4{f2mVswE@Ug4ReTerrFA}fPP@~f|9ChIw0?KhMLM@N7+8gdd!(BDyFo_ZfRIe>fVRr)Wuo{Vb9vHIU{8>8BO8SlOV6 z%0C%2jI@o`@A4Hc4Owya0r^O~+GV>IReQcktVhPG^fvlEkH%W4>}?EeBez4Z(=A*S|+15t;xP5d6j zCa7%|6BNEC%4w7QI2`1B`b$T0g2F?rU{Yesa>(k%E7#h*Sj}kbpt=n0` z1&m4+C{#a;VBJu&A7oV+2CoLbl#nTkg+!PJlV^e)n#|WTzTQ0TG$aUbtte^qJH>6D zK6Wl1Hup(#X-aY!qQHM8t|gs73ZBO$t=rU%atHFx`@NypP zhT;5MF~!S#y=uB;6kHr}^M#iLqotcfw)6T-Yt2 zdTB@1&8)GQ2W3%S`<^CNkEz=bK~GlwT3EBrRKs{JGLd$B;tjgUV2-n;o5JmPa1mF` ztDMTw)t+nSHhE1*k-d+KdkLo!voO%tPn!B>05G9aRIXXhQ{|V=;SF(Y-ve2BMaLO8 z>pWZ_qhF@&p{!f=D1}w=)29yc&cpbUvz~kW_%O;k#Gt~fA$oFpkSfW>x$Zk*sV(kJ zs{L@4+qSh1GwNj7m9}3#FgeOtdYq`Yq^CcgWoD&u8H^poK+~9*x>c*2&yY!gr|s$3 ze71Lf10tEUH{rqG4UQO51Z!FR(wMrbOmfVV_{P5$LBON$=#=^L*Q(r8!Ri*0D3+)` zaI`D@t!d=Z+~~{xaq%8x4`1Qj8(rGrVwVnl1$Dcsj&&mL{pF2>BYtK5E@x)ihYtcL zyCdyH0QLtv6I9ZIUs-LrnBz@rrVP<*tNN$u0_?(m+xF9fmagwnIh9R$2VXjF+r{2? zwVl#Z0o;{qtH`pBeJoO!b7||~n;4!CJHhTcTc0pRfqPy7P5HMU9LUuPCoMwc?if%Y zWP=-xk8l>N*gqXXOjl|5jUNU?o_RiXmr^V4D115N#G4=TlmNt+VmvANG2+pb!uzC|rO~36H5cd5}3_xpbiZY>GW^=dYXy#y$eZ zzN{H}ftxC zB)DOHkCqV3+{5{iPv)hi0FBK3anYN(kJKrmv~nz-C|R(ucJSHXA8)=v_JM`=lfuJy za`Je&YuSbhKk44vewWEB)0r?iAHezV68_+6B%ATfC~Wk^6wZs`&Lj+Ws6h{C%Fw*C zbODYDAX9|Rd6%%0>LB7~h$amux`%q|7MI7V#P|b;aOv*n0l*or$4N|<5cPU_Dn%e# z-io2|#^x7uS4Pk3^J}CcT@`ALbDt@8Ql-O&5N;V24NcFwB0#uWKQ+Z*O(B!P@Ol9H zxO|=*w@x~)Kaph_?+tSZ=Ofph7<^@^zdDR?Juy zA*4N4xfyGmd&NB+U6+7V39<)DfyUU%=ddLr5x-c(eW65tITg#8^u|tT296P-ppcp7 zAQxfeCRa3S<9>ewsd^<6579j6#o||AIiFofp~dL)x>Rm`LX`52L&w)9z(lV)BJCN0 z8H&iu?hE=dK|SvfvNGXrdNd2sJmX-xs5*FGM8a)<&|i_DM_Pz(!p6<9llJe`nLuWX zs^cbN3Nv&vrB3*N-#5iM1P$54)owG-R-FuEW;Dgp9%n9a5qJvFiUA!Ezdep_?0?u$pV)H|E;6*mj-wIDf5M?Gd1 zYk8|WDb%gah%I~E&MrH4%}Z7GlCP$cEC1mlnFo4SC{UH-=n=7L+{6znw1Ft*&QHmv zu09Frd(molUHXLY6-;&>IHt+?qWbpg%*G@2-e}ZVBj(5Rs|*yyr<`Q`I5|EZPalT4 zDmdj-?&&Ynr{;@Frr!0Wq(Qle<+vs4a3|VDs{E+U27M9B*>31ik~d zvBv0QAQ`s%qm{3p{J`0ZnQn6Mfq&N7cd5T_IqMhKGTcQFS>F%-l6M@GB5Ova&i0Eu z>W*k*ex7LctrBw4!CO&x&AS)nY)xAp%Y&?@4-t&-GTl3F_gtGw?prN|cWt#C&p-ri`>^R`9@_~9s8rI4F#T@+G1##H3@vIP1lIL4xY?SR&+HfYCw`|~gJLK$! z*m8c@)|2P1RvBFKZ<;HGRRtvYxNCkT+v+p~ea38h@EJUvNo8E5q4Hgo6N`b2-de|Y z6*QmA=l7I20tCFUZ^Rccq6e+cM}=bgJzpz%qYKu4`;DAL$PDa2~ z?Lv^bw$bo;R*}NhOdT*S*Cab0dzJBDSesznX zMk+C6GO^I7o-V&gpNF`7LU>-Q&)iQe%vUIrAQk=fhG40thcMJdzqQqTS85TVU=^!p zc=}YiafLVMAF^{uB7Z6_C;Gcy83&$zxG%)5Y2v)^dR~E%&gO1e{b07``t@Zyy&+Cf z>3RChlP<*DqFJxF`}7qzysJTH;`Vsj2D>!G1;u2PCLG#%3Vu{#^n5-n@f$VqF7gJR z24b`dmug>V;k}IiNiA2$gG~P2^q?vN^nj_(JNsyUmv9& zFTo39C8gRm>T|X57teGy(s~b{4H2kww8`!yRSBnJ(oC<$t;QB|Z>XC+KAa+;jVWyPb~V*Ne&9 z0aQ7Rla|w=wvdlm!VmZ^`cg}hBR2S6V=ik^Jym4p#ceU3< z#k{XSXK^Z5^ziT|ls;4BI6ZrDP)SM)r(RQ6FSAomCxj&slG(962XcNW;Eie(DJ)Zn zA^RoW25ltgT+QBCX}p9!FUF*ESAk410L+|(r>&`$IC=XI3v)@a?9A_Oqdy8bzWZ9` zq)GJ|Y9Ua`;{3|Fyw~+_T_e2PWBp8`OxqQ>Z{SD9*Xzh^-vw!GM{&TA?r!PF?n1(& z(7&wj=N6KuynGa-ex(p;t+G$V)Oqi(mR@OPU2&3;mP!4kEqqC!qi}t0Wc`BT{aclu zH>1T8ZOI@BFr_jSdSkki%<;vIme>V-3{ogTyC~?uhFj+QoXgdDpjvNIhRk=53$ofD zq?CUO>x)!w9PpC6Mt_W^|Efw|rmWq2eeQDT|vqjVQG5;)05QM*nAe;gh9+$Fe~`j!FS88n&51lV$} zKmW@G&C^>Vv*CZaD6R*6`SJzkJpbwTnRCONq^U$YJQbJ0iWT<@=EFt3D*L~PdV*4v z&8TR}8$3Jd?ibTpyvz;ard2Gw`MDSEa*I%s%2sj12*i5aCG@=~TWV;v(cW#kV|7_C zf+hA^RH)20NIG37#a*K?({MRAL7(FaoZ; zO})@Cx7p7aFJ&@o+R{CNs+_^=;o>~tX)z~~E@C^+ShF&pMkIrIDmf<)&lflb;OkB$ z`L-B{*7(O14&9;ij)Zd7?)43)Tn2D^W7~d$bQ@?1z029Pwq>HzyD_~n>3K!(wNI#s zoN6u6j4@1g59Bwf3N3A#$t`9;ejmb&^+IAG*{bOQsNitXT6-Q63!7~WFN|oya$+ne zLx^>#a$xHd(gt9SM8OKZ|G#LMdn)N$c#vya0MmZDg^3mQBLc1XPe)h|1plxmge?s3 z=5^Lv;1C9--K`NfdiWV{SCe3+{P&GuaNTwVi`dpdkuaTf=Q?cN+P%-Ml(9F*HS(+eAG*FfsHwi|_OXG8fQW+BsHljPfb=e+AW9KX=^!9Agx(=R zL_k46M0!&ZA~p2hdv5^(3B5`QEd)YB;2z%Zes}K7!}|}DVVGe~&N=(H_gZVOrTjV5 z00LUVYNj>m9@bqjIMW=GN(%zLbd_kEYy++>45DqxDSW+g&f$@q=9ArR1Aq!g3=0Fv z-bQSFSZ1?5?Jkg->fnQPfpQH5Hg`ZsejCcUji>Cpiqg{D>?@ z-Jw8;no%W3CCvK|qi6IVYu1~7CMYXKMpR&guHO1eH-BKTOOg@oP}oqLw!^07cu0s< zVr!$sIktemz%v-wWk) z4rMT~v#}aJRft^R!l+mKyICjb?+;_3WDS?bl2*LMGqOCE7?;K)ksf*WUtS;S(PGi> zpkq=Jrh(gx9$XtN3yZpMFwxn)gzXbLoM%GpsXY>cqg zkV{frK}-((X%+e0;`*?(YNlMQE;oOSx!XA1p@&B1dl@o(Mc$;`^~SSYfz_yq&}uVw z2sX#HDP~%t^u|+sB2XtH&GQk1&F7A;%6nBzGFf$)(r#iGzNWfVMnbQY3R5#L%>Z4n z`dyZd$JI7dSr(}2^!T+-%M4>t9!GJ+txI2khSa2Yw#x^QqPL+d+fsKML&?eA@53)L zre~Na37p0KD&u|QvCc6VXr7E0f;D72dn&5vA~qU|CE#^5^{g})4dC8~)L z-oXtWmqtHR9m&DI!qBw6JBd#INAyObx(qQBPfBd&`<73exGf33!CuJHR_L~o_+``h4cOJ5Lhkh3{jivOznGcDfL?I*2Hiz%1{wd5Gv zSX(x6ua&;7$Zl!w@mP#VsS>BWzITziAN^QtGEjUitXIo1hpT1R$-*vcnpzsCw@O6`~-L1O8Pvj*p2@V$X?t>DMc`|M&t>SBPfvIm(jdkWfjdA%%A# zX;BkJPl2@q|M494i0ufuhDfva*UX=g;R3qVH$gK*uTW(3k{bW!d^@xa<)t0OO#AMP z&PW@W<7x>=^Un9#cJ!Z71zh0CE_Bk2$P#M9W_cgI(#ES=rE%i?Rz2WGy6?}dz z;>LhYJVZj)jU>+oyV-L|j^!`ILApt9AnPF4fX$VX%dXsEnmKA!JR{WQ@*ZPOEEvMa zkTlckb6;=h4Jerc-{L*--)dvd1slBbLUr+_i|5=zisHYe6(SG|%_Ajc-)= zmsY)5C7Y2CnL!Yg)jJ959;8_OGse`Yv4}EJ1u;bS&{=TM@ zNe3^*H6O9PRG{mZwoJ6MW;Ls$?DG1xZW_ji`_F(qTI{i@-}?J}&E=Cl=xo0%Isd0z zoLlw2T@%rB>*=@ijm!r~;u_^lu5(;Kt){d3PpxLq$P{0~yBJ50LK=EFwLZD5mhAwd@Im*u#j0Q>t?Hp!SX0Ypq=DpbCWTb}32TL5*~!8Y zU9Sqg$3S7Y5G`EN3O=%Wg5wID*H^)p$ffAEY+)uc>vKNor>S7YT(>_6NAAV1^6eDq z5uEiUXV!LFwq>+-@Qtw-wy&H3YZ$U>tGPi_!cunygsJ!OKo=(;US3oAz zoX@+|ls~*-!DiJuA&*so%-5D}zKR@5w)7>Byu=eQTNdK&T0A|f-%-Z;)*l-&H8nP= z^jX?Yd`ngJX544A#7+e?>?6UMuwRQwW+Y0#2zDkQE z|4gglyt7xJX^Jge0p)RhasE}ne6 zad}XyB^z$8iMjEa45-kyT>W0wQYA_KVN5^yM=nhfsXccR<6^u^+FyO_52~!1bTd5CX}aEtXG`dLr6$ZvrwN5#JFI=Afdb>Dfq-%tBr z+Ig#g0$yiiY4-Yw%vin({ddjI5k2GhcTGugpn*>8qMAR&^C(IyF_B z64abO3{`|8mR#}Dm}uTMC-0?PZhrezYVychvr!t_l%Xw=V^uu1sV`Lat!6gBAiCP! z;yPD;14v#fd`rNLjq#vIHrU}9W87#^czWtB+$ejc`3o|-oJ(8tI>_T`=s9<~ktE)? zJnM{#1%;cEa)cHO*vHQ8o*#11Uf$c%SNDvI%Ao67Ag~8N!RTdaf2VxzMH#n_%=+}Q z&&Xsz#FgaAh5MCi)7N!(Y55}zdWS~gD)L%6Oq_CK54RaYVzy*Q-X7W-C_y0H1s6mt zdk@VynZ$D1vU;KRGOmHcQe`+*srI3oDQnUm<5019(vg`=s*>17*~s7HFIfwm{uTmf zN2L&-0!2e{a7=UPjS=Z<>}8N^pEc7^FC}(wok}F=T$G(iA`SOQ=uACX{5SXj9F%$% zQ#Iic&i_aTU8K7t8Pw6DdDlheP_p%6-WB=A!xCo<!w;O|L?#m0a6zH=raFK8Gd#fTv(iK+WF#K6ozJlS_p_<-b~IPa z_}FPVg@HF}d@XO2jC_8K^(DjrO;U4AhP3;Aj&PkHLUj0TN2NUXW*k>(=M6puDXL%9 zjvp~jF>IHsZx@?|>w9x}&$8*%M%=#=CaaR`?vGSnx8pE0gTDcZ`)app#5;lpzUHT> zbbFOq_^fLQm<#=(cx~ms@oujPPFZWf=uM@6N^Liuj9@EhOV{`nA0Son*p`9Mntb?- zAK9k7rD1B}U7EUAa((>OY>jfc*7-vYkYOM#`qqbOYtEvT%|CZhpB`0b>IL5ROXbDE zEpH{ORGV^h%(YA6el7K3Lxxg6+zligaZd_lMit z;Ksf?JEDfm%r1WoS{~;}OBj>=7SQXP$g!LFg4V)hzczZ7H3Mt~6Z=gYO4r_dnf^QVwhz4ZMVF0>Vdw0pyeE6cw@_RI z+BcYI?Ra}-&5>qCnH52Dck@~srA_$LZGGRl((z3_s}XzN9JsEM)f&f~RBRVN2$F_YQ;Lm6>O3@OJf%#TyviEefH(jApL zNp+Lv!w%}xMjrd-`^YW@@>Ij_`}Z_9BC1+yi#j3M_BbSpNg>Fo5KF>IA5J`vA;wIbP2DW{@k zYPXzPx+9(e=%vWr$tdq%%)=j}sZVF~b0^MQ{WQC)AymXJs;bBRK|;n`=`1@_u40S5 z_`@FwdHd((b4o|{2MbhwHO!HMIGn-O+x8_BP(WT~44jY? zhFXjRYfK-GmJcn)8K=fh`#>CF&4ji+!qFG!RS`QAPZQ&4jR0@^8tE4=(;{M1#%OvS z#tO%z%toK~qVV{#yK2M3pmG&nq#|srJYRjYG$&i%`o#eU%zdioj#|>1dkK_eNErX+ zP+KTIf8Tw`N)gHqAB}XA_V~ECqk2us%)9;@L%S`@UBSq25@Nh8?Z!BZ^GL;iVApT_ zJc@8_n=|00^x;ee&4sLPP0HtgzQu{L51efLEVW7O-9&7*V; z4`~0MaUDE?tp8ME9%}f0eSG=t3nKtcql&RJe)9PlyuV@O{pn1n)y04iLlID+rrMvZ zNdD8JEDIho#V__UbbRIEqPws8TS>=Mt$&r-Kn&w?`6Ie*{7=-f3Uv%%JkxFi6~Cg) zcfq_rMFK2G`Ed>vrNR{@KK_nL*)v7KAMVq{bR>$an5SQXAd(Y-7!nj}XR+I&?@`J^ zgAZ$gT7QJLZeh}ew$EnqF%<6AT@nVBGXiXS-i*jB(;Myjb0?Y7DoE4bJ0L`{^cjva z^s?`d?Ip#}USoI5bUh2AeUv>_a#5wvH~YCPBU3$n-tu_9XSPR}3Qa$>?LV7u_-mYA z-HG)9CGBs{UEu(hk;E> zuICN)F69!H*-W=3_~XwRYfg;~j1&S=)GOfy%-y(LF80p1kzBndrh#UncuuE=qm=zwvGwy>E^m zFZ#f4>JTX3W4m-&=DYjP@qS3-Z6kf#wzu|+&GNP-DTom(?q+4>nDAcd{$e%Rh9hpRpT?6 z90qd$v7zmChGV*a51uzUQldLT4wY(@mUuHLGnN(F#2a+xtpN9z>C1 zEqE)pDEuDu<0Xn_JHgV*@6rM7(_JvOyWJK|bdxeK=!^3hHM*a8JU2R=PlSfccrJK< z=Y^dAZv?^3EhopNdG7f5mpUN*)0nikmUm|8VD>FGcP{ee|2m*jf4c$5=u4Dbl`mVn z)0zSA&%*t|T%~hLqXmOd$zmEYg+#*9QftUKdfj2O*AH;cS6$f^Va`~K6Tqj2sW=oq zm0mBX*8qDp;)les{LeHG!gvt0;6v}K5sj6w(eMW$s~^jgTY&ee(TDr-?@-^^f!FI7 z9shdq5S@J-Zsx`=16RFKdE2e7UT=@)>s{@mfR8 znH#8nfLN2e(DIB{CrPQ@iZTTaHd1!F!R9IN=g+TE_L(na(|3SQBYD%nu9V#)dhsmL z1h5DI=mR@sT2ObH)Z}z}9SpbyfTXGY)7j3Lf28;RQ3&SL?d)HUn^?~TlAYUL@0dTs zT$E{XaF`P5ap+Lu(~Z~mnCIx z6I}U_9}wNEgTM1TyRhqWm)Atp=(#t0AWkO?-ng92c`gD1HMe|BBy~JKP4vpg9xxJh zC6VpGe9Q7v}x;Cl0WzGZ!?T%5=5l92323X=MR6%F@mzWELx=bZ7*zco)S5M((&M@k&(C|-qnmrE0 zW_uK7Ilj&@B%E6KG=7k}Ci~8)jyFa}8FVqNdKGC~s&u9}30#%!%&HjV2#}+?rp{ET z+hb^*;yy$*`a9$#7E66OWuIFifdNRpHob7oq8`XpI)r!vvldR&x{tI}3MAg$_njbR zS0yOgNJTmRsQZK6>FSouGt+H$Lw|RB@H9d3%r}v>Kbj9v90oAy5d1j^x;=X65C4zh z?#s0|X-8YM?Ey-F+mklx+D0?ZaHYWkWzf{(5fq26|~n+aI1R{wbD@d)h40G~i#*)_GSeOc;m>H&xGw=xz=1+)qVReJ zpaYaIhOjIg88ljq$vQ{gveo5jdd*Qesb_b_!o>TbRiK9DGHdcU(r;Q;G3=R42y5K* zmh8LFYKd%>ui+TZ|GYIzxI+Si24li}(6_r94)b;q*Va06di$Z|`|MI5yOvJ3ZGD?@ zufPcytfcFyMJfT}jasC}{NETO05+-xJ{lR2uyaP3HFDTAZ7GN37oA}U=dlTXFkHk#2w) z_P}B&(@}mUY4uMCD;;n=NjQqXN^1=z6)l}Ow|Z#svAn-__-j&B#=R_adHmWJpY9j+ zz$B!@-rdttrYX^^4vDoL+f5S545*ngFBsuJkx&ipOUy0R$Ah?Qr|UAC+0 z3`5yQA^|5?$RWUFTXpVcOHC^L;QxK?Q)fldkUjR?>t|LSOvo%_|cAw0#B;HgS#2pqA#lv>ie@n=O;!c3iRl5B2^3KjhY& zkLB0@cJJQ3H&f?h5>9R5A3SYfCyhNCwAZwC?&#&2YW{F5^^fR}kVt3qf{AKCqCz(hggNd}ef>(Ucj(*)aTvhbxLYZYkG=s$r>f3{1E1|S4>a1;-w6hJG8vKTxF22kbFPy z;0}gE8S{VXaE`L;sd_wG%vP+@Hvr2fu=y1;WhXHcuFQ|z=m)apKdJtx-7j18$XsZ3 z#?0G>EdQh6Ado_L(nsu(bLvbS51Fi@fzlCgi}G)!)4Z2BBMn&i~6YD*!_OI)oAaTueqwG=E?5GLrw^ zZmWw~Q~}=9^{?|^S@6-PRL1ugbBE6}rxf1j+%DpNv&sR=T>!}N-M2w+jQ#~i08R@5 zwpX`;~DSkuK@(B54WB>0+){>;-M$JjIRYtw{HXvr= zECU(A=Qka9k)y3s@LSf^Tb1UmoVF`NmQ#O1?ltUX!Q}_#J%Av`-PHX$aEj}mRB4s# zmH7s$#?Dm;x_@jJ@V{dX*(gD2&>$|(VSrF2+?@&$bG!U@+7CS7beZ*48e()oBVZSM zWUoMYPeHAZ7o#@e`_;RFprZm=p_ZN08!b!oeTKrvS_W5@BH)Wp5}XW^F1+f7CBQ^Y zpBbizbigsMYbV71$3ONg<#PGrs3Bq!RGt)>W*eR&G3n>JV!HE**&(fVKVoL@AiiDJ zY6kWnb6LbBl0P1A!{SaqCO$pjQOW@R*jxfU2NP8P)YpT?Xmxv2?{G9979Tgwv|PmxON?>leOK|@!RiXhQC>axggO=qVfuR?IQdvHbOk_L zOBdm##KG_{POsTK0XV8NChC$SRVZ}#RPdwVDpLau%--JcbsZcHDN|PdbGmFbChWb$ zuJ>~rpA(JB_vpw(5BE6}qIZ+FKG$Hj)41RVD{3`CJBd81rju?H<6jR0HV;k1s=c=7 zR?pXR*tCXT-!m;sPJkbDn~F6rZb>?CCcE~jCqe7h>3B2%crbfo zr7+T`cRG_t&K3j$QexPL#z%+8>Gw0DH8qe2SY2{*ai26_Bsao}66hf)R95aD{(+AC z56ceF6Dj8H&G+g&10UMBESPK!alPUjYhJi0t4MD)32L0M!G21U$l;~k(ZZuPbY13Y zA6NhVpEfp%rzK{>@X#)(;Js>0&CVTPjs)v)P-Qq`;aUO_-5{R!6}lMJrUSh2Gh1W{ zL6sdPs%Pm%lNR{{9gJz}z?+UUmBgIuCYttrEQ=E?L=;L z$f>3Jx#mBJ-PsQsYHGhfU)VcWnikR=)FyYV&p~qfqbm0Q7ykeIxuH4c}XT4 z5ju3sOv0w>{!ykJpc*S{X|^Qj#Zo7x%z$|~$0>_pU`^mWZqLhdROQwYT^BGc>w)P7 z=H#)Mx~NJY5t-Ob$Js@6d=9y)5xO;Vi{fR@i6YjN8lMWldOq19{B~?{UZ_u~@`XWV z?U7azhJYz*Yn9f!g1fb79)Y3{Vqsm%QR{;HM~E*0Rw7UbJQ>{~o>{(H+$x+r!d#g$ zLTAqa0G7-m)7NCI$}_n=t{{|QdLyu_l?64nd37As7caGHM3oFNv=N_x zahYhOYwDtTIp8|>ta78wMH;a1eAUm}G+$h051Srwi`M#QHoXoa~;f9X#-OVM4-%=0fh|(B+Mm84SR%0UR%~!+H4}8AY>Y1Fd zPg4Q;Sv=Q;y)lyto-c~D4QD4leIkBoOf=6oJqX^r5z5OswUj;`eA@jD9?0BD*TY$djk&F2Bm~~J=3rGqf7+IgDn9$L!T0@mj}m0ly@q` zY@Fz1%LVJjjukGlVBZ-+=U=V221}b77wa>y9XphQFvEG}n4!3tH7|+DcTCleqqDwm zmGcofbrTc0BG_ABM$>z44r|(XL+*1Gzd=xUc25}Jv*NIlNFT*Xt0#3(HzaAB(qoEj z={5RgRCL()y4*`k-nE?dV@q3hIy1SV#W4NNS@c2o+H=K9lTfk%XeVnWTw*fW+P%GY zypX?X=ZMt4xBS7v_rxl9=mvZs%GWwM====F&B*%uBmKcQ^9-=Vd^xE8&#dokk zQ1d%kEM{7-^G~mEZx2)<#1gQ8T)9LBb41DDG?PJfMsI?E`7)fR)yBUS`{dXrT;25} zm4dwGY2W^*2DQ5{>ta1-d$Jz^Y~h+Wui+^N?@fR$RH8jgk{_6OiT=wkoJNM8O}tm5 z^)tu*PnZXl_+zgMs~f>0obIoA?zXDghZ9qkB1w9{0Ie%OIckv|+^-G=LYUp)&bu^H(4S@ollZfcO96UH(w1;qx* zHLH`z1k$k(;`Q0C?VO&^!TzmLwqXZ`zk!(7d&7WhZM`O9ywis#?Qqepzjptvk9R*1 zI(K|mZYL^I4Tw>}cO9}uP3})vtR*Io>cL8P2P5I4dDR=zE7S@^ zGtxka!neI~>rJ=!h5i!`)#JsfF(H$m6|-mr34CR4<`Nudi7P0f7W*KK zi&$z2OWTtS{np5v-^2c_=%oGt*2AB5@iw}v9QIU+1mcrQC6)FW^paGUvIBfpc$w`j z3M54s7fuHReQSI$5S51#=-*5t@Eehof9gKyo+?LpfALWG;w!+$!-Ux}w4skvMrQ0h zdT4{jUAUgUqn{4g!O##FlJ2_hFp-foYl$QwwD2oTQ!QWd}NBywD~$O)~*LF?)|X4 zZY{^h={^iWMb?hfrRQX{+m}Q2yANKro$Fp*Xp9$zjIynC^Y{z*rYY3dwbaFWMM%uy zsyCZHE){v!ljX#@1f-#qre%dq*R?YPUqjN)F&uX9E`t3t77B1>*v!ooOFGy=01$Af zV~?a8dgJk74sx{jdZiT%ca~F2EIuOjvEdXej>p>N6S*jVp=_>idy*u;wX<|cO{Cu< z9}tuv&o|kkv-bs;3M4FA^`}niolByFR~x&RN}M%s+K9yF5k1E(UldWR{iNlk^n zD=VPm?Y}Mt+~>GMpye<(>B9`Lx<6rJIb$u~&_H9NncHNN?V4vXm8_A?Ke9{l;V4CF zt_5+0RAP%96P#Z9Z^Q0TGXpregSOWONJy#`qk>oHps3hyvy7~TMbd1x_T!s(qaxZ(!;k?Y^`41is*%mDT^i0 z+u`${jO~Ujv9oBRTX%lt&Bl%#IU2gl6@S6v6m>$T za1vAK5j8v5BN-;@xG_=EJ`YMu-HX#K)oC+{rj%?9QtzQFN10B3}O^J1+UnbZlbFVgN9uR+KALKpptr?hL z$uC5vf#|l_E%&CHH>NOx+u`=6CU$Jaz6Neh_fBHMDe!oJI)eeR6r;Xl1v*AXijU2| zs#xrH4xt$0Zm^QU4?Darj?Hyxtki)c&Ucatlo)B zqpVv;z0#k@wuXchM&|mi*Qul@fHkOVZUG}wt34+~n*yktqOGv1ewI=W93~&1M&C_3 zxH7+Ae_Wd;+K~dp=eD~YlBd_!I%(UK*&UNLWVdy~t?CRND(_PEJnQ+^2LB<=)Nj^hrc1rqM&;Wsv8?q1K1h3iw|3rb&35iVyiO;Lg_>#jjVhelUJD5e z3(vc}X*#t6@-8xwytK7;`DU)%DY-9tO_{Qq9RHmM=&+V(JTL2{Ok7i3HVi~7Qp*Y8 z$~Wt#E|zuPOB(ik!S^QjS^1Pt&hi36>}Ta!U%LB=!WAq_gHt_w-aFBIg-Gs{Ez}Yh z&}?V!nds@lI2|J%zGTsiFo#W)sP(@ViZkm~zg3zoXO$nhCiDfV1*AOz`&KmzTO|{T zWd%H|lC$U95v8LB-AR;GYg1P;a+9R%A7L#hEh10^Y9Y=t)NjfdmAl#cEQ!$b_9wVM zn%>rQ+(&+CeIhzQLCHj@P8TDapB7{7A;Et5q-h(TbFJ}ratDh@ z-MYE!wm{I73;Tq^;cO(v){h5))t!hMHFPY4UD(6}10tORp*vx_wfo$H&qn2PrYB{s z9^fpDHwn_rN%)~=({E*1K@Gu{Z$L7oIceSc$h4|8ks+%4tW4<@Q-RA?lDrIvO=F+V zj5qssD_h*Zer`=3AAnX=_cUgF@YBai(&Tm5!zl&gO*wx7CKw&h3OI^+ zcpiLEkz0*gnLj27lP^utF==#@Czj=tQYp#x4^umC*SAZFCT=vWPajdHQRq64Z12rt zZ4Tz_TJqmfEcY%i|aRlr^_uNJJ45Q`^~&HuSG`n?oo- zO?waTJHCUV*iF->@TvQYoV*u<`K~3j8lwO`RU3_nx3)prL)qm)hd=Cljp;Ks#RF&D zBcjeQV-?P1+Q7|jco=jU<^GfUNQI?RUDx|VTHISjGBFDKdv(MDCVT5h`l&@Sa^XuB zum5cJdo8=N_PGSlC*cbrUlPlFd#*oE1r$WT4&|VNe9d`IL10RdMAq(BSb3;XHCxi_ zBRkh?S*MFr?lCo}dWsMderOA!R?*9D5%!}_b+u}e@K;+9~ zQSNK%D)13#Za}!dF7sm(N zn(%LMx1$5wEU}+vx~3A3qmuf2@ozQ9vfRPtI>+(~X=mep>ub!o4|OKPaf;3|}c z1B_-Zjg!qZKtDm=iPrPs;tzU#Y-WJqVcp*%{jwsHuKjXc^JQ2^&2}zdBWZx&l)I|2 zN)D;_*9mMl3#t87{ToPXEnaDf)_7h%S=Y2Y;j;!^ncov*m?pMKba6~cJ`j<;E)9_D zfuKyFSq-;M5X0YEz7bi~C%0eF zH{MQRJbxuwgVm8F#Z{QCs>f_GkRAz#NC`8VBFH3kz3`;>GDudu4O!%Qu*Ds*8~m(g z%sfnBNQ7Q~%!0Ugr1jMQc)J~egcH6$jEE);-1MRlMtf{n;?uPlyT8iqc51?lB4_8J zj^y@TGP`5X{JuW-I<)MV5pFQe8pfRA=udXDo`D1^m!)eE3oA&7qLs7=<;Tn;Oy$P+ zv`$RLG!0q%hA%bOGuGYT`QU$*kWuQ4c?xp}e6{cI0m2`1*JBWernE&kr8xZoXf!{ttDctFCl<8BvdOJO} zCilFmWl8t0->#NrdDAk^$qsXddOeO_Zug1;F9T0)3T&@(>W4=yOr1aRb}Y8jFAQwT z!SnT}ZIgz@V{R(*bk*~|680pBG{Q_*8VcN;`+XL* zv$X0K&aLBbMm`6&LM51Qb@5#|LAHCCw516pNJJR8vSs-?hxe|ejPS;B9YLVH3}eR! zzRk7!mKG^dK73VvqrzX6jIsT)hWYGY6TC`kX;(1Qap4r85G>;m z_5S#2vhNk=DuRhS;q^q5=EL1zFD5PTgWKOzO4@8)JhncGRC`Q$TYJuP`Yq;|SVEd3 zZ_3`<046%slR+z2apz(hdEFY6s3CQoXKVavg-6&8Q_@gpp`7?4UP5kvViRGFk@*4v z5Ys~BWfP+|Z?>Cl^!_W;zdboz?FDZ=Y}Y*&*Lb%(F<1K;`V~TB?ax4E4=ki^1?046 z)@Sjz)b1%(n|6kuw35?F9T(Da2K#1%HNMQ3aUdq~)IvN4d?orXEoA#Fy9J}2iBa=j z2F^{Ibj)va` za437pyX$7Ue&*e=DY~)F#V74j$uyiy>X>VNaaH3%^;T0F!j!UVzCSxGll+fvz7e&E zm9f$)!9`d&KAeMtVc0x4CC1~8Ama9g`ak2c%gMy&dR1$o(W}4&kunPKma<97LbM4b z$n|!sy&3>XM?ahewg6s84(2~-2)@yFjfXf}BIy^C3odUo_88B|ttZZfg-yqes~97z zNUJ52W!TsQ7~#Vj7>HS4ek+gP4Ris@o`BNq=`BfX{&2IoNRB(8%Fl>;vM^lPa@>U(09 z`x7wDK&HfOA;;~jkeO~Y(7G8zd3wZ z&maR`P{?|9`6;mL`7WR&M9e%YP2x58eh(sV;R6!oehqpTM6zYcTXxugHhB_Ib-DGL zeeZhyEiIW~nD({wKJoEl)>7N=%>_$-L+XY6y|IJiaO%L+A0wdT-qwMUQpd>@~Jw zdtxy{twDU5#UwT23!V_M)wCU$=kQD*;CN12<){-L!P4 zAcNW`Athhe@vo~@B^TB9@)&;$tt-Dc4GLXSn`UjA=J)qj$QXLOZ~vZB{wC@oT9f-~ znJ~Rh7`I9fgO|DaFZ*rmG^KB}^}|RFHjBS(WZygbL7hBHZq4k_l5}JZRlpXZ;*-|$ z$9Dsleagj1BVf~5Z`jsHhD-!kL4BIbXDP1;qL1z2MBUt;Tcakpfa&b93}udGl;d+r z4VFfPyM2{ngV|-^YreI7QRep;U9_ZzObKCzR)NH$yE6xVGL|byJeZQY+#HGQkT#`U z7^ZUWK1dghjbWnLOE+t(&(mCg&d-0mv>dB~&F$%s(y&r-NY$dS&`XuY4syMD6`e)& z!Kn9&d{HEZ*pm`&`EMF@cZt?)a0!RtFvjqXpU7>e4v>rx{XZ+GsvE8Z!~{09v^+5= zde_+%^`+?4tb`k?H`4}Kda3Odom#0AL2C2AxvLeawH$;X5Yd4}s*6dwj(>94ZdT#$ zxQ?1CKx?+!j;>eK7cor=R{f1@R<&?6vakb+L%AHFwX-lKk*AO4je~TCue2!?kFM@4 zl_eUFq_C8(aWm61*i1#};rV^4F9pLB9_o&5RjczLTGw}2H*8cDV{F8Db@d@fJ4QP5 z@9H0Veqk3SOj_{__a>GqC)74+(7Ju8lbEp7Npsyd_KX3nDmVl!0vf5tKQ7^ar2?pz zswwes8D*6OeY1pi9C+kO#+4)J#K#&Y8|e#sdNw^_@EXHB=k}$f*et*LZ*XvNRnX{{ zvfhBL^g-M35%gAD4#2(}J|2Cd#nx-zcd>f>*>%FrhX%qMdd@0Ui_BrRENlhhg;Y(X zMZ5u_WG!c1Pk-cv41}KJ^-l*<6phG3wp<=>ey*`Xh!c7HO!?ilZO6RQk8)piP-Gy=}0pFmhvavo@7)bbm0@_4C_ zemRgdDqq#ps{Y!s8Fxg^mHMOaICi|fc|2&dL(f z78)myPhf&53TS^f9c(A2P0T-sZj!O3<>N&K1|Gcqus;BtYVOdt>lPK zd9KFi91CsHeMFyYc~)ZH;~x7{uA0(&WAj6Wo3etqql!riUnc07C^z)R5NheleGD*( zX}}O@lA=MJ2`LN@x{GF9t;F~(1iQTfi{_@d=XczPr)3vh zR=8{Vfd6Y5Uvfnz!Y0vjjGQ5L?zn0!Ijo%z+_AvXiA+E81suj)fc3TA{Rb<0k8J>R z@w9Y#^qj+w1mx78_QL|L+DZo3F&pB0o}ceeJ);=d0{k9N zi_Yn$T&Y9?0v@)Vw%~l_W=^*Ixwo2@3ePa`EE)UaN^Juu^)#N-6lYtsv8U>Cs;k4U zk{K|Pe|gVOSb?nN5A|T+6X0^1=j4JlhMr&s7fSY z+)Uq$ET8$*Oa&w|aJQ zQpHs!R!h~6MYIQRi&fPCVYS$X<|^nnaDOOO1*x^lPaFCkp4<8w&FL{FpS_=79{TtzO}HYw zh8dP8=?#pEcHxiItP1LtF_yQ%;R|~7cmbiHPHYTf5}Mwh@VehN*Ev`Vbm!M2k>Z^o%%O@5WEGQ_3 zYuu<=npbx|&Uc3Y@s=xlg)!#@nDXqjWOFKl#&|V)R8WI;M)UG`5%)c4hj1O;Q>>ojq2&_r9${6FwI`HGsx8 z=<+!XdqG!A9Lalc=egW5jioP7+jE(@#q)NW{CSVsP4r3i6C3Q_?2?LFmOvN1C}Gwv zEA5Jvk}NO(`p6K_<__)mNq4g+myKH~O79LR4V~cMClL8iX5^TtToZh044rXXC6`yB z?&-UYI>x>0x+V#NHCxLbkEfG&zawO&Y7aZOhwy3p6T3au9Ldb`i(vbH1x>@Aw8$Pq z(W1!{=gKjYw=E5RM+*~X#T)sgqBfObww{M0SJ}%#Jj1od2w_%+!qzFJXhHX-k-A+# zm05q)d>XbNrarShBQCPWR&14F5g~O?4rl9cYg$}wm9>VQKG3MzpYoM!JAqjN6)t#B ztne~HB^N!$>+HJJf}SBQ)I7bcqHJ6rWY_cJ$h|AxGXz$HdH9GZ1vvN6;9aLJ3xVBW_Iynw47VnPLJ~%k zaPTyX)OePOE!LyV+gA?*LzBC^F0P7GY9SDHhkjMQ~S5WseU8g6kl`2l=eg8hcvY}BezqtdDDP(yR@BU5f;Q|I}A~s`*A{9`_OJibbWH&-Uw2EvR4{# zxf+iQ$A4_JrviGWKb4f*)EK2uxw-7Vk00pjBfrm9@S?gOq(NQNxrPI*sz-E9C+jg@ zy``hi{VVW&2DQAfwWMh^fbpF6b;U3n_Gp46k0>jpNMB<_okfJViuBuK$`I-ZAiraf zeouYcL>LImen36VcpBEXi}Y>X0B|2Z6flCP)OmDe9TCclt&vHo_~hl^EFk7X*KEPN z$1Y6iW(MKCEJIMgn4Pr4PAXd{s*mms4tzhlSeR1nRJz>=A=!6)SKHQ2U&hVLR@9a))!odP%$G0Q;SxMUL(+*fD zj6QYR-+%Q9ZP)TAbvqV{WxwoH%2HSvY&RXHBENI1US-|2j}kyR;x8jgokLA}PS@JM z_muO2xELz{kjU-= z4{o09N8sZ@xb{i$qid(T`}0k zo+-0gA(FD2&<{ul?$njVqF8yHlxsnhvG&8YU!GW8Vc)uI8d*(xaTqmpVK1hZ0xE)sL(_6tS-2+*8@6jxLvWC_3%%cgds&HYNt(M?BZ-(yYBryS#op7P)`p$G+V&*trj@_h~zAe}oC% z4$nBG*xEg5us)O@H>Q^Xw4xW)trpD#Hh%cqJ&*VzMX%t1MJ~i-6*e5Q_c7P3g3l~# zX7&IvN=3jv_<>ZKxl(k`554e7?r^<{}Uz zcH)N}P6l)_VQoKeyF6Cz53M7JiDIwhwU| zV8(#aqV3NI*yZHs)qf^`tb7Q!6KL%;n{4}Rqo5c)b$qyajM1F~xKkfez~~Rc9R)@D zUehFps?QP=KZR{AWCG}TNQDPu8vCoZrY z@*6|LVLZTHbZcV`ySnr*o0}s@ z(eRl=eW6t03!75UiN&4gwHyeA>_|Bw;?baR)q-~=qIg`W*Ph?DG6fTx5VLlSVx6pUPasz(2%}Z z%PUWZ?hLY|Qq#05|y1Q$TZiJy^ z$f03q+{Zrle#qg9y_C#(y}`9_W96VoZC4vV z_VdokDQyWgy0~Acpkur={P}Vszn9Fyf(VHjf zXZBn-x=0hw&=H7^HOQGVt#tXizM(MI`!W!f_@Mrhpfcg{@l-o!+u7Vs!u{O~7X>!r ze(_L~DM>jwUN@CTRGv20qai4r+vafVTLOe7c`$+I?QhQ-?G%Z;vGaZGdbS;B7(jCe zz+axS72myq;;^ zH$Nw;?_|ZOt-tR_fzC17`l*gk8-c6f{&LJ?5!JWMAJbi*LIKnt5DC(sCKC06OODH} zXRbErz!NB-^|eEA=84C~M@!W$bF zAA>z$P70>y>-UMQ(7x|{d#(*A3_7doYoj!bl?F#W)4VCk){U~womscTwu}4@@WH8g zKT2*A?`L;{QaK`6mwmQn=wFZd9Gp(-`(4Ta_;46<+(7Gf}AlRTze-slJi7fNoCny>?T4l6rnvq`^In9t1M?*&d*0n z^!}D!$i#7izEp!hA=im_8H2j2uBuhrVQI`MYa)|uZ1z?d{|K7g!KClh=g?>-Q+1!* zj&iG-OIpwLSoUWnD+NTS(fY>qyJskPy;FPZgSnq(QZ|?527Mw)9LdhaKZ{bBIREk- zsNX>u`4=yq#pZ;C@0-$=2u$6f946oaGjv@6%aU>iicwB+9-Ky^X$blK-!fusu%p-t zi5kHy_iv3ZSlU(>*5!QP>r@vo-f*J)0NyVyihR87MwLb_1YUJBK4O!pDk2@(Ki>QPN= z&B3kFTI2L2M|frmt^__v4$xEB5jAYpS7j<*rVQ97m$zT1x%N5us*8u6(AZh%3i?G} zSq;#-9}(}BH}CGAP2u{cX_QK-Yu&rhoHQVW4>AV|3MG&aJn{w)QO!?l)zn`58Po9c zn$hN+aMjz>+LVdJ`rRafuq zj>nvSa{K)q{rrpIhK1^!%>JX;!HO=64_aj1pjxlQc@h3kQdZ;?oJYhWQn3uz-o;jL6lFSX>jE{sG*u$6m0$Qvzvr)yXDmDT%h5w5btvn^>=;BOH)EA z`X}WZ4Y1pRd3(p$Xd$1V*fNx-MvLDD=P1MXb|bzEvFyPd-wDn%hw)ppO_}qGL>FZA{o7Qaqj5yuwwIvIkE_tpi?@X(!D$@(E$v|+a@a{XZ z?ty=)$h;Oa#NAiK_syeqEV5k62aM<+nQBs9foqsDn%a${zm`f?(3MtDSzzUqfO=x1 zRle728f;FP*o3}np{!GCFhgZIw2bXG|Gq}t4fG_6x{Rm!?ALYF5fh}duDT&c+~5!I zujRNDQHxgRV|UoXZq#ageD)pP{ioShtM;3Ys*qPJ&e@;kePUiLKWS$k7u%oil8bCd zeC1WzqeUi-II5S7-BA*#ETEd;oTUX%hS`Kqhi7hY^z%j+%YGi;o{kN$oF_DS-bP^f zt}`{1HgziYYzpAir?Ok(we1w7PhO0P&-nqxaj9yJ`kugN|JXw~b^fRpw~NJZZ%+t4 z1trW&B&>se7NHMDQo8P;p@!SbtEI9Goomv;{?X`KPyuC0 zsc9!ZH6Q8X-Jgh|W=9P^AhOP@bT$=mrlE9MJX!7vS6O%WmOSEoX%i;FK@EVm;k++7VtZ@a)+4EwK1 z2j^AGIsoZEY2j~M!un2*OG}AI^dU8V@RYBKuXK8<3M9r3oce&?zod_IGrzjY$=5?~ zf9u&vq*+n93r>uf-lM=hy;7_f?0^m>G%#O8;RE&NEd&1U56Jc%Wrs=&-j%IY&|Pmk zFBxOcM1`5~3Q3EH=y^m?aUHrXrbco=vmoMhehGY&tgA$@IP)k}T8}g|WW)>=8B}n+ zOvWu4@+ex>UKey*zQe+$QYha3rSP=;*k*p-mGCC))mz5l)^GeGvGp(P2hD8j1ftz) zYtk*u=Y)DH5zht)gEh*nFDVO}w^>ir2c`s4fBIm4yiQ1dwO zyfXLAZSX2Wy5)Tgim+$7!!J8_k+jnl>?Kh4fgnE1lV0{NH@=Eg78;18{XdLEDtC!G zt-u#svTZjlzB7RGh`%wpTwRkkB1=KyJYK<>jrHDF&K|bySDWYe^0$$-$XVT{=!1$YU0Y*i9~W4=+f|wGLdM}2>QVbP z0q>O06LLL$#o2l+k ziLXhP7(QYV+&=b|Ze3uWGxfSIFO8*~MFW?a{Vwlf79oq z{Da=M95ma2>^q${Q&*4`LDA~>&hqEpB_|x7J@s-Qe@RsE>`iH}Tt?^-;(c3vC}4n} ze(>U@>QRY_Ag&SH)O;Fl3_tr8)`OB<%J!a;k%}#H(LyS*UPH{rG{HMs0pAqu$!t57 zi;E(MFljwnvwVtjxzPlXxN`AUFBm$c<+`qwP zMQd5-sypoe_U!*Ze>74;uNmL$%A4?uI(8lD$GLYLwn{J0;>zuvR5W zx;R~d>RqI9HmILFiub1-8+c9IOjeuC%@um`(a}uAHNe)Z=$_wN;>fPApt@6A_}<6| zz>PzcEUH@lcao>L8Y`l#mLEL{%<-PHljj4=Qi8R3>~F7!17Atg8%6SYXr_)yq-Qy^ zRK!a9PDJg-w`OpR?l!uPcog{kjOuofR_!w#cZ(f`$S$uAA0N!L7br~u>%H-#-9gr@ zjNhkAha=|YY)?7OG{|=q|h|!>>YIzYHU8*>fF4NX%_Ju)m{R$}1iUaSabx zt#H-#A(6qX8Nr$`4MDOER@f}j?RRpP0UBR5szn}KFELf(oRk>U5c+TK$PuC#O+oRm zzc|wv08INKX%jXrCMRtP=v2@)r)n4+{#TW_~FMIS+iag1OmU z-w5PxtN$JUjJm@9AD@1}s$tVm`%_LQY7{5KN;hG+=h(YrUC(f1b^7ev8-V5Ggo|wb z`dX|f8I>1+8>%G-zpb;{Qx&mm&Ds;$cHS|2`_|)vvyw!*GpP^+lmmD!(Bhz)b$zJ%?T;jE0gNd7 zGw*0OV*O`|Kv`(T+XW@mu$df?JPvnVCKz+^o3`^W32O1A>M3>5if0XAKw28ODtK2y ztgN?s+q@rABC@KlT`Er2!_DCn^*i($Wad2kWXdsXC`9Le_VdhR8bZ67Jb=o_7C`R( zu|NEwcu;3ld-D~TingDdiVAn@b5x&^_b2-PlAp=K;inZlH7ax|ao0KnCTW%)pF+29 zwVQIdatT!X2oLElA;#Mw7~!*hgAzU#9oy*f*W?O~J1ER&gjUS;L4q}^b`Gug-d$O> z)L(w>jLtXvn`yNF$Ds0m{?loR8f6MC2)UlAN0@FvG6`KhWdhyQ#|>>=wD|gKQAQ^e zlBk=C>xjTyzR!MbL#8{-zeV88np$!_O0Hc1Yj-OXbv^mIQ(`E_tnWO?94)|aUtjUF z4JEtrT3@Y(5kjj%>UUFHk7JNJLBl=Cn&$38s+K)-1=nY#?bu&BP38!*J~jLlxB)Vj@S4|K>k)w8?T47T%f z9X^BHB@h6xm=bW!2UON7Y_F+*fPn#JdEz^~)V5Jm2i8G7pY*Oo8omyBhnOjNDIxWk zfD$Ea4(Z=6(*>`T)dz=i#SYWxApZzv0E& z(R&Yh3gvqfc%dA#{N36uTK&G#hBro2;S4-4vLk30&Lj`|X!dQe+cGvMCE()E@i>y* zVLY|+?wxetQsomTH@|4ZxtM5Z@uXrcN>n^ugq2lz*!lZsv=OM4scc(<6&r__Y z=z1fA9dQ@5v3IR!ZEO%zRx#RK9_|_Zbli3`J+j566~;B6Cw7MvR87we%!&zK-?dTl zBrIT@JzG4#W6xM5l!}e<1m{&B(ryWw+WOt&!f}74|31E|nq_1*j3M}Wrm9~;YMU|S zhZ>ld@PF;fyrp12H4`yP7`-Mhb7ITJWQSr9A(NzfcYRxm%pQd|E`UZ^5WsFwuQc`+ZBh9Wc~|>)*XQNU#_WH!SYxRIDwvv z%KDiKo;I`uPPy?St^T8%p7f9Q$A1%F%{%lbq@V^b_9O;b)07;|jA>;SQprk6Hry6X zZsuxd&$=8aK81+HyPJPAm|dC$quH@Los+g&D(^fu*$Ppd)kj{|X5b`np+ zm#t!0;g>fjTLrtti9*WZY6&G@pEs$okuEl?<%OFB2B@j+Jz$J*l_vpASdyH@ctjnK zigehQIqdrgOF=w-7#v>2h-{{qwyrdspYQRF>ZMA?BS{Y;uV>_1alVO ziFVXp%K0Ncry4Ib_D@76aw7g*fOmyT726tnaV&Gjs@{7CDN_f0sc*xD$5_wu>~-Zn zeddYfk-3{SjwW$JzQoM`OcICwUJ6GM?FGZX^2MJS=ThNdHX*ngtw*D}7)`ph4V{Yu z^VFobrxH7@2i7qb>4o(jxPNo5ZyWJ3VXq&fhT*o1P zD5V&J0|}Q~qij8aW;@Of3`4yvrM*+joW-ufc;5sz4rv+iyniF1p3D_snmYDT3ApXJ zkW|$!VU9KnGj)%pJnaFe_1=Y)c~rRJBc6>7%V5tYT&a>sUC1?tdWd~g+uSv@9lN0> zDy#3hquZ^4%)tt9tg~=;>z*oiq+Benk5r8A2XEgfIWF9!j7dMUsDMu?((Wi2ILb>d z7l^>?Gb(64)&+V~zF&DaP_1%D5l=G$4r>&7U#K_M+YsTs4D32SRq#nN-TpAcbO=Cd zM^d-@%^@f~!d~`|;R2OwW8>efXA+M16fpzN&erwG-u#P8{6Bv)YD1k9{C&??f%OE$aj#O|rM;L}bz;uH;CV$H9GUQ(kh zJlTeIt2nck5>7Wt`fLa@k{`xAlr!RnBi1(53by`qlp>tHn|};(E47=9wHr)j_#)!L;0*mz z!-~%Lv?WT<>OgwnQ%Y;0SM5aolc|Nh07h^O550s3Dz<_y%@^h42eXJ1O7n$dq71Rr z=pMntcmnxdAl_)*X89fm{CAu(b+!Yt@^I2CAU^eWNQQ3_d&qvHR0sVx&gly0lK%V1 zZmUB3V^`zC6fVUy?MMIaen)#zDeF&bSuT~Qkzq+*_R%(u!nF2fC1W79@P$;^R}Dxu ze;{xohBYrfc>}Ko%Vptd%|W0hTibfN$t3wOMP7PyuNsEKh6t z>D^vwU~2qDT=?S4hJ@JXdHi85(amgBb@ATy%SR`DYX?}(Tee^G8f)4m-e2u!tqzEK zN)9HQ=8KkgkaX^h#0|AAhI^2UoV(4Z5FB_srZ>)OdTGy%Noh3Fclgaiz^od}o6}?h zSh(_N-~VWT-|UG`gE<7qjq7B>^-YROSTcIL252bLrY;$>M5Ffc37O&n^r~#FT)2zC zBfF>vokK{qVUz^df^4mOD|Ru4$Msm#t7`!DlB=upIBSpXY)J#(^`4pl9F@LNE?#Z0 z$FerhaGmA*P!0WV{Uwggt6{dT(bXR)EgXL+Sz)dYx&L0BX3oqSU9Omt9(6FaT^_>A4|o&qzzfWME zqA@Gy2E~1H+X#zCju@$1l#TuRsk40HocAi}O(-yF<_eywU*+W}bpEt#xwK?Dov0e3 z7p~uutrMAYeem6JldP5!1t^$gFTSuk#22Xuv^SjJ86EarC<;E-3S3$dn zE`cZCbr1wZwymK3XFcyE-f8^Y+Ne-V#VO*?DjcsM6IyoOAHxHdSt`n@G$c5eAL`@p zUcl?^)(U%zSm&I`=shj8rJn7>8}zcg@wJjd@hur!x>vOH}Lz2P$~6eAT{ zu4KY3d_fL6&_nF8N$OW{9JG+CPzuLxwiN;1+aOGQ#6NYX8kRLYqaoMEM(9QAK?wFL zm-~Q+7Pby`_y-Ok$>D7oeXy2w9j?Qd07mz00~wW@N6H=Jd`K3dyhT81f*Wiqw}Uvp zu9k*F<0p#R zdFe6FhzF=v%1s(a9Mjnk8ZDb9!X0NiQU~amRoGorT0&L4I3q!XEhlxpGtLWh0FAH0 z^Za=VDuY(^#--8EhK0zG@xexuJpw61k(u7oS|QXqW&7WxA=@t)+VP8I=oFXdqJ66Z z*jUG{%ZMtaQTT-d^3Wizm#`s+K38to3hsWE4xf7K5?*0h&rlIoGX5;i8>g83^UC^sQEdq*w_duITC<|x(Y5s)Bj*29aJM?o)E z#GaT`_e7qUV1aUJRgIXqhHBy%Eqs8FBVg&zE6LN?S;i4Iduk3HbbG;cQC6Q=noyw6 z#VvMs$T3Q^ADTa}P0si1aLpU-Kv2?7Z9S@#EN`-QZ1%1AwHC~3lv-nVP}FmhD&E7W zA!~KZgLd%Au3My;z{{{;jvjF=0^5z&F=~_L@$o5VI@oIU(k+I#=QzmXO;=m@rCu)+ z?A!5az@t8UFy@#YbY%Pd@fki(IL|Axr&9=(vvn6)_~}O!a@nmXIpwK$O>x{b5Z+H` zR6QE9_UH=t{V4fq60#jCMjGub(Sxo5$P!X@ygO|$7#klj+z$r#s|O7*ZeAJTiR@!u z`66%My(vEoeQ^M6id~G;jABiH`AQQ0U`d0qf&3qUm|}FX@$63G;M`&i4sQFAIk>q= z?3>amH_MppC2HU>cVG!MmN;GysjM|clXBd-z+@@eUNlc2G$(WG#41VypJ0n?Gq@lw z^}5?W=8?H?x)7d80!5vHc@pt(mPbe{!(BoA1iH3iZeLhI-4E@G#VTy#^iF{(#>h4k z2Tp>j&K?zmIJc{py7OE{og5*O*_(-B8q~rZ-31RqjB{mFydw1uek|6DLyBuuW(`H$ zw4>Qm5D|2(T6tsJ_`}^{?3U0e6C$ttD?&B;u&S_RQBwc~wf zaS)T49ABE3r*Zv*$Rl3%#Bdb)i3|&z0CI= z`buJq8~tBH>i+{HrEu8a8)3KZK9>0zW-M6y?ChFeYC+n7o9oAGMIQszB3v<5t(QZ5 z=W#AW&L+CAhdDL)=Rq?1d>x=bT0UcwL5tl}y;U99uK=}K(-*^miC_?GtITlj*|?rh zs=$wwOs~}de6zcveV=Ht&mXlkRkBSJe~OM!2BtHUU8L0Q%r`a1U&K=)Ra0s{+Tdj4 zeS}DhC!w8lB9)I6-QM{rr%XjwLK>3~wyjU_8e0uLW-M}ivj6zm&NAT+)wZ(XH3esi z;*0E`Qm}dE(sVQZA~9)TdOY<4iVhpPg(k1nLSUl@PP+q@Z{x?vRioGh@Xpp%-o}H? z>wf=EpR!BM6qUnTl<*(JwQ&E~@jY||Wa5uNMp5rqoWBxZUkZK4LoYp$an55Nv+f|p z6K{M4bf!Lua8fAxHA#Fq-Wv+bOC?DE`Y1K!U%w>%_tK}osAPp9247WCa6G1v!9xtQ zWr`@H7JghSkVlF?-?&FY$J~AlZ-1eJre`h>zp>(&!$g0ry~<%-Gj*^?Wnsz(Yx`>$ zkVhl;>aukMv$g_?Pho>=UYgW1=kdB%kKM&aui*tlNOX#R=vjmSz(F-XTz*+5a*ZaX zeGr3XHz-S)%)^k3#zsf1X&}N(!ccg2;Ya{5EN&~fSuz*r6=zJc@(|J#)5@Un6Q-jg z+1MlL$zB8N+&2pv;axFDQ;5Pl+|B`bX91F;d9#M+3TSJ(8p71xg(qQx%i3$O8_2Io zV?G&Wb*lOAD2UBoYHsfFT(1$jao$4d%4f2G@r#so->O*czFKgawU433-T5sAf-SBS z$ngyQ+=q$pdDILi92fKvvj(n1$dpqqj~^*kLr0(IZ3N7N1j_{8n#$=b7!YX|hXAff z-jiQ?1?B4M3~%%GskEc3S7?QP0xAX?xXc_%Je%uX6N|e|3ZHUoY9iRJ>NNo~ zR(~Gum^H+SzKPf+!ycAcf?(W&Nm7^JjswHzdL{@?=3GGq94H?$2wkBaOr7KSy0K_w5-zR z9o`lW}2*UxHLf-f973^gU zoJ#4Px9?j&#kAVI`u7V>siqP3HAkxm&Z;tv=_qm7`0!^UoAD1%pN*GVrX9)0@KhUD zt{f3o@kU*!e7eWxJH8V>{4|4m-mhq+??O?y-X%$vXhzq=JHkSUGPOI!S_HRAu>3gT z``W)(JmO^A0zTtq2PFr*z1x{{A=nW2CHd4O%Mw#MR4T3_W-`WXe=abU;Kt_=!kpFj zUe$mk=6lo`z2eXd0BZ~azs{yD!T8NQGg6_q=(F1hpw`}uIjdh=ANU4NcT+JL>TBBe zCTBVtlR#wew_dNk0oqkSC7zJ1{LtQOZT+>z&#L?z!KvP2(CAzaHlZ#FvgyMxRwc2h zyDgjEx$Uhfi0}663lX?`1}oQg)hlYfSGZB2D9X`_(^9aiWLAzkjJ%f}_DCc9Ma9A( z+cNB0twGzhF3vMd!!7(Vs@@1}*1ClF2mb>+S<(5VaXKM5_Z#4ba(<5Rk*OFIcN0_f z71b(-Gdew6rCx51qnwYjT~W}8cOS5*5He2YRwJ=8Nk)2s_wG~LhUM?0OpG>}(aSgd zb9$Th`FipP6c$=D`cUH3qoU8l8KOo5n0PjO;+~EFYDwU-h z1%{U!c8n;jj!F#bvN{CdI+wJ?sRG>c=|NqTcb@5+af{CF&Sam8@p1RazhI90QGvP* zL~kyrLzbxC7b?YuJCI)CGuu#0_)S}gggp6e&4o~bMZT;Al~S*T92x=-VAN`ZZ2iQl zq<)`**B)QU_fkfM&BVg03hCXa{{dp;#ca*t8r6-MrC^s)$LJ^Q5k38(@<=6tycU<= z*fXz(f;@B8!bUu!?E&g!OH7D`nG~w?1^kx&~AZN3~qv8=5W9?l#P$Ecq-GBn%HM@&gJO=hwgG zE>ekI@pn@pvoQ;wB~g}b7~D6T)hjGv32}p%aJjvL0{Qx>#DygvH86SaC9ds|dtJG2 zRJRrV?2O3x1$rcQ<-E7k7KucVQuMmSfUBR9!RvbWk3co15zXxVu$;>TRx17;kCfF~ zOWeL$?Tvuc5dnn2*R&!=1Z&9bHXZ7R*P`7@@P4N7hVUoo*<5rAQK;j5^eH;uA_i1mRrsklW z$KarnVfQkITv>nYPtHx}NN@8XKQR=>LsHQa$68Hit|;*e zHzb~yFj99oO~n1XJ>2ILnvf7FCQFrsn{C4sag_>8dQa@iIWIE9P5{>8*p zj~ht06KCxE-GNR5is^goAE)BrKJy47GPQvc-;LY$AL(`vccxGBlE?Cm7q-SHEs#t2 zvAKN{Et+WAeP2eWP+y5%Fc3Cn;CPDXHO6^+ha5U)A#DqbOvVZnO*(FD6i3f8_e zveSS9m!~aK^6Hr&(v#1y2Sqn;AhE$d%F+ih(|aX674YZZB(YM<%J?+5s;d{ciag;# zn#*Vkk+jN@R)?gWH`d2QB{}V;JuYeX7_xicvH4Qv#>6gq<=H@Gp$hg$lzXE10g~x? z_c`v-R;%)KfzKhSViV9vQqSf72076306e~|KsJ0uWLT`Q85IN@Gq`pzN{0rR;}jU2 zA&wv4QJBAosaGhcm=@7G{SlD&Z2M_m1vOG9GOiard&d?h{b&=D^%+@m6VoGH&hVPg zq$sAHce69om>l3-qjnpZ#LHyS-n`X`@zN-20%^53x^E`3Fl8G4(GRHX6xw~j*M1Q< zhn-7g>F=8kd-5y<&l@fXCtbH5w%WqOc>E6@gaL||(a)f3$nT0-YwbYe+Lz*^#@Y`K z&B=I|`~(iPD*nZwG#-x8RI1%gz3r^(uwB_^&b>PnLaZC0f%~Z*$8I6?27mXsjYrJX z!e=_KQBE<9I!fsk2V4+pTTt%XMg~l->gao6Ry?&y7BQ#4JK6?LT`T&0#_A}7$jby0 zo9Y8T`3&K1FLfHU8L%SK2NXHBv<)|P4{ct2K8SR5MK`2V7X0p&$(do{-`=vJ1QCj3 z%~ESe&cnD{ZsP?sgP9Gkyn~>grJHWO5zYY_`WKDytBlmpIE&Y7pI=A4e>eUEL7X1H zYI~1Z9KGmwp3uD57sWN6 zXig_x&lGZR0=!z!QMXowLqitP=;;LGLAL5HZuidckmJM=Q!rV_7u^Dee^7UxVx9*P zr!CR6>GpX_3$aEbj!NcgG>NKJw&<2WZ%R-4dtn&wIt@MBha~7@kKuJyL5T>@Uz~C9 zrNf%01qPzzCEq!S=@!`;H&N(y3?@uDL_<_=g1$>9^VQntZdtq;;GcnW=W6%JMx<&51F zP6AT9!loop1L;gG+)E<#BAu3iC82&Tow)>7@Jsh-w3z@^Q_pdiCzNPt*hGW4@=?D+ zzaen+O6g609;FP$ExPDC6vxwL;Zf4%(A^HuB+aTA@bI60Emp50S?UfrqAQsn+?rTX z)SBDf#ze^d%Wb9qzA+7v&abi3uN?vS8CMhYWcisBiNlAN*98O3u?@}NhQnq>3>LbG z6U{3#EVm}&-aIs-fQ)|tJ>;U%r+St`HC+><;8V}u!!B(b=x?{aZY9kdE&#nwadA?R zqGtbQ@`)eLye@~-S!Ewydd*=O+agX9TlipTceL>(akoM=` z;pR;grvBLAPJ{>{yR}}hEF3yszM#Cm;HBC&Jh5OU-1S*ap72vP?yh`H6oZS`c(_dM~ zokGh1vSAnWF1V17=|tz?N!WV>w{Ee{^q)*$Z0m4wW{~69^PGw%}*Kfe}E*jJ7a`{pNmff`NvZz(`Fl^ zR`um2fieN+KDx5XCQ1XVl|VCZ^N1am?3I9JV$rC52GeMpPil(?)j-^!8wvB%0;LX6 zo3>PCD6cL#!u$Zmt`vRL-bg)O0K1g6s5^C-2}(nRwJTb_-Yk;^m8E(#?XMZ^+gujW z0re!XkQ2-4g1-np*`sIu#;{I;IzDY%))Ldw=&mFjO~BCZC=`RIzMrs2lJVLWj-C!Z zg_HVRL>c4^I}~ZY@czC!%x|L5<+{jgeyt~26yo|+b4R{y7Eto|u1$6^`XU+_HDd(^N5X>wbF52#RjcTrGEMh$kV=l)0RTTA4KM^B~$Xd>ZCopt6L1 zey)))--a($P8u-q%a49f-anWc*Hy0q^MTXBS1fI ze)*Y#I(LsfE?*#hm6S7C^+!Eaf=A0&MYmEZh?dsOcg;<6oih=)G`V&(i=;KDi{cDc zdPZdRt2h~-UFa5%d(o+Y=7)U7f2Ak=-^Jt4miITq*?TO+A1DI8K~M97E@iNn_f!~+ z8OS|)7#Z*7i9yGXaUjx}-1J~S(tWJ>XqXUa+BdnX#RoqKA*XIPM{9OjSC9y=FN_VQ zaQjJh(cleOD{Ux_bblzsy24yl##dNlKlaHfla4QmzoK?Do7MI}oZoQE6whVWDizsC zw1OEH*}eail2OlIAan;S>^}-OKrFK42a2<$lQ)?`5rdR@!wEuRA}jU9)Uds((k^pK zq*kc1=Sshf!li_QEw!0Mk;?)PqS&4^k71>6J#Nh8KyP!9x>xVv5IkXO*@P3r2tOIc zh$T?GMSxFaOOM?!=+4IpD%SW$h;lNyVAjQKf4FsidfAt!aQp>5+ayJa;3mAd$M!*L z2^HsV@F5csbH=iN@w2`Ea-4bs{*J?L^WvWIzJcWpNKPgur}Mxj|jLF$p? zL7&xQo=zkZvXW4yi8o%beGp6fnat(j?ixcL^&i}d3uJx(6K)2=`tD5#2@h(T?gGym zceMNJ&nK+u!Zjo$)iuSxbMmQ5&T5)CisHX6@lHh>i_&oqpeJsy^feq*aLsKO2CzZU zrzN45^~*b`^!Y*sWJvY5b~)rMm<6YZpdfh+Y{_C6#@<;kyZf7GsK|_AsGo+%_DHtl z=XEF;5460ZIABc$bAV*js}wGK=l2IB^gZ$BeE#5yJop_m9(Q!R2Us}Y@JfP4-X#*5VGvpa26K*! zLA#YG4@VdKvGeLko>)F`Vj9h5-bFB7e3)+8pJ6+m`)rxiVVk=LuiTy@ zYMwI2*rlObd2J)$@dS5~h1N=(%hfX-c0s2rZ}sFw>Vpv`jQ0Hy=?bej%5%$oIHpLZ zuZ)L^1s=*+`RX;zH1WmE5(3}KKBdJaEf(zxuU}uG@dTdAigjwJE#-vkaf-x_AF|jz zX=Cczm4H(M5RqGpwu8w=sp4c;0(!IDwj+PrDfitO2EOzcDP!Td#+c<( zC@IV@ORp(AWKr-hoaSDwBDObUZZYt1ywC!^;RJGCcH0k~5!fLFVXQP`SzI1;UOczl z?E5x6rl13&Ne(#s^XYC9i&+4$m68kag$w1SS^8j4fBevBgKfnT_m2jq&+MgC-O;n= zXW;mMNBZ(tnL+ic_ktv--F4I|x?-Y908wNF_1_!`w&)&JP3ovfz3KUU8YBua`2Z^A zGN#~+?@Y*m=5-BgfJ_G{+9cp{r_@68Jbw0y?S#p*nuv1^iUV_H&i?dUZ3X%f@#KlN z0R;aDs)9=;kU2l-SIj7@IqWy<%bWuBSWheRr6Z797P2QZ z!n|hr3Cs$US4?-#t4G^jpq2GaJ54-pQhEP7Mxc-Mbu#fqx1~K%XrjGKqrr;jN!!|Z z0DD)O&ETtlf<{U@A=^DtF4S16BxwpBr*uh;X`B0cO)(s~JvjX^mnY(^y6Vn>9X`Rd zlutmH*Mdi<954HmFrMV$8`eBn0-c)?nkoCJHI%*Xcuy{Tq98l~pC@mXF5Pi)c`W1! zilXzdxxBokf=t=80t4rV1M6Ysd2z7X6K;#lB)8ZGH%2|@%g?`S{>o z_zYb_=O0FH?!`N1vS#%~&5(Vb=WxJ@;udkpZ(K9!y)h0k9!x)?i)}U1Soac`>nbKD zWn5u0nSyp3B3!<>kCO9yknx7H2c5#{@@y@PtGm-)ZGINFO<58b?9=)|NY}I8DDH|L z%XQN3YgA>9uYD^lU-TTb#XHY+u7;7qjZvbil|dN(83`9pU~t=Xks~ID!kps@|N>)c4-+?3RAL|o^`j%tuIDM_z}Hrvk+LmECEkQAmXFhGArx{wO8TX92%Ftl@C}lI zSbgw<%Jc=hJI%DZN)*-49f%ti2NEw=@Z1+G9kMFK-n&uNcB7_CXJJvtT5Gn+ZiLkX zdv*}Qgi(0uWk z3)JJ{Q^>ARaAi0QEO+^x-c2`xosb@&i^Yjs=pzF^O_EOD9I0fArIpvc)fn`5FG=^>wd2LLYB~SA~nC49-#N{*212FD(FDzCH8hO~WhCmXt z6`P4XnEwotJEsw5Ot@B|=b`$iTx-e8UD2MgZ=_qKrh@upYhLrae%KRuv~c?ct67l~ z%+V-hmmut_qq$-P8KTt=)m*Hw`QBbMSKa+97^yw&sLFpNEe7f{2+84L!FKxqVZ$Es zR-cvA`@nTx&BZd$@ZNGeLwAg>i&r6ZP}W7g)2Lk`y3*>$zNa-`p7*;!+P3BSmH|q0 zbnG=SW{q#G<>D8>SCIa%%#T}xh4J7V%8|FjnhUraa>8G&(lA(Y_BwKGHftNc@?V33 z;kezrut)3eiHB^j-!8zV63LW7#>^{ZOcznO@P12C8xUh2`t_J@)9D%Y_SW>2;cX|k zv_c5Sc9m^}6{>-%*~dE)2}H>O*1EPTvnjpYofW*2wM`^e)@yqx!b7vXO@0dA;`Rv(j%k593E#$JHcKWf7G=vn zGNjL7-Q#&CVvpP7@VJ-^_Y+z=QS;{Bn-epR5Ovv5@j1_fUe=9o?`Sl~81g8Dj!@dTO7%H}P14<%<`XO!{D zm4&zDG$!v9VO!`Pho^OWRxMCNctjh30*J{2SD1?f7mQsn~vSB7GIZ4yzs18}t=j>pPeZgv?T$1po zqe!3te9BL;XDZ~|Ds;-U~ks8=z!GRX587H_yRtG%cdBmG6uDwr8C3nAE z^BuR=Og!IWvqPf8Pd6Wz`~99pgp2FWKyMUdJ)5uDfDh&#vBMdK zDgSs*Sx7Wdr}-6khSQVlc=9t@oX9q5Y_~7u7a6QsvZvC-_`GLI7P}^G2K2-Nt{#Ts zaf7ze>3!uePHfXS?adKzf69;x<&qEatT87~rrU)5sDVS^`b}!2wxRl?bL*l*p3Qk; zU;p7xWHm8579A1QN` z8zqFmG(Jf1T_^bnPQtc7Av-pxtM!OQ_>|H}Jcskvvsq1Bg1Fvx3!i3F|7k7mp4y(z zDA-53xIsIHWWOY6UA~sj?;?PQFB8QOI*&CrrA-mfoAVlKb{OD7hUQm(B@UrHJc56@ zk)QOYHut+JNV{4v!s|xot%j{CQZF;NNyp!Md*_89Md+v1cgxO)Vd^pFBbAqk#s|$@ z-4l`7xqm|Ln&(cY0cSN-Sl36re9QMpsF?A_>SRmzJDvF}Zt`+8%n&RD?jT2S# zJ85*W={u6M{x2^8YPi<(_%YpC;fq_2nfU7*K_JH0mOdr_cyWUp6qNDqcrSI5YUT;^ zdAT*n_P+4wCZ05eCVTNE{QMtC1lT_ssn)t>H{k=)L|GbzoMdg3E}Oh`O2kX~Dyrl% zhsAB;T%VsyT+rBYa=Wkt`LGqF29A!OV=T``Ui|>H!I}y*YR=h435I>Fz4{fOWpzQj zynP^U^_CO1oCR$^R_7nOhcYgFQ0gg}?MZ|!%xj+LeaJg&6X&t*UTr_cYY_3k2r-mW z&q}9`Sz29Yn9W~&G==|8-8qTJ=+7gy)G@2#YFI-g<}G5Mv+2W#i|fPw%!W4~Q)8 zfD5*rb2~g@S(tq6@y)3HEvk3(cY&zHM8$GX)x+Slbo8<#k$da^2%i>bG*ltl?^AKlC>CLD|J0Gc5S@&AR8noMZZX4bH0IHxySN{oF-f2wlFbRf;bpoj8;R_lO?+ z+?k^hcPspImaPk`RjPGG!BU*0lr|>*{$=C zo@EC@CCaz}pKrD{JT=;AZFqC2*jRuL$tS|pKYr;bVNNQ(8c<|z>Uw)^Cq5@@uv^OBvmn}8NfUN#HFvlcof(%xV z5ImdJ($urAi`c6~`<^ah&C zpLIQ52$uP&EVMM;cKxy9!1uC;o>Pal5QJ%PduRYdh0dcL9L0FF=H1L=(o>5_UR%&D ziC<5|9{lt;fbHP>NS>QY&faZ0+?h9+4m`=a4_vtqJh(A z6kIPwj(nH=sBGSz1tj~ zUg#Ic1zZcXTI?ln0@hP* zQ3;ibvXd?QI<}cf%FZNL$sQGzeaX()mn>u7$6zql84PB|Y|q#4KKFB<`?{Xz9RKPx z~v&Xweqa%I%M5#z3=)Tz?!~Jbp30;&SnT@g`WIDDfLQZZ*r&AhEhrieKR|i2GuOmWoiI zOvl>=U*E!l0XZ9k4xS#fbjh>Ur%wnckbM`fRiEh|?u1Jnt|)wLpLAV7Y5?A`>{hIq zy5MfIa>I7*M#Bn`y!kOm=!CkBRd9*F z==v!J`uFYOg$UEs7f`C3S|7p4K`4c;QZO!YurJLlx1qd@L znFo@M(kZnBU-_W%uA#3L(WEiObXp8A4+m9j%$+^rZm7fVc7WjZ{WsJ}&4k!saq1hc zvy=N_R76>KgdQc|9iBVsTv#`S0BQ++fW9s53Lw}OraJ9!ONlfL&Z6Rk2!r#?gFKcAyK7nmd*dQMDhS@#@W6<#~SbJ`{Kr%*m9f#=+H zo73IV{CwK#{kJIIr-%Xz8YMs;_1;s7#mqk}PPTu^m@01gY(iP!p8akob{Wbk1i2EM$ zwmFg4P95v*P`=S^eYWiT8(N@j;w34n#KO)_;-NX4M-Gyc+nR|%6#{~iJN|R!F`;zx zCPJv@e3f~;YIW;>EF5PTN>7Z> zKD4;LV>{Nv|7^i3WIiqxCrpeIV0dsv-IVF`BKxd9EcUSHmkVZ9t_x`k0)s@bro0Y( z<*lyVFr?jya$fw(D5d$dDkM=ZjD`x(?9WGZ=dWdQ|NDM-Q#?MkX#iU@KyEE#CxN^) zAPAKG{1mf`O-sbqOw$U8K=M6;Qpnyb{8qxNxzu3OtXqTtimiNl1*SLXHHplML|SJg zd)tuxJ-a*Wvz(h7XI~4Y3WF$UZifKv!?^JQztwbLwiy2Zoh^Rt|50U+F5PapHTd54 z)`B(4J8uTkp0cnw2Nndx0OqFCV+w7KU$nI&m36*YqC@1?&x&h&BiJ0brJO1J0m&;b z4$Da-%n|Fa?22z@%egN)Q=ekE+N3@twF_@6#3GLn?uY9Ma1;=2NC zDzGp5RXDOrOi=B>s@D}wSFRp4&QLRq-Qg*=Y?#p*f2DG;wIsVB_)-7I(%;i8vP(gL zts{WL1E!+Ke90eflDu1g26gYtNyS&5Q6Io%LZ%reg&$`hHV&Z>U^hkceNa^ zbR2U0DQes&p<}7KQhL_4sy(Uka;+ZH+NZD0%IG)if;);s7$-0rqX)-bM6v!+OOisZ5o%nAg|r_YIFYOP=E zB_14$7MtWZe3skR_ibn7&wuU_KTeOpu^i~mGH*_U)0ze6hQd2<4v=e12rd`ClWUpg zy;=YiJ&&vF-wOebWtGovQmo$uq=x68=l|aTP^IhD>z=nWlqLQNt9JB^Oh}p76`d&6 zYJM&LNA8t;wCep^0!rlkTj`J5jbg81?9Mr!R>_v)osYU%`^)vNqy%ByD*R>%(pGkH zWVRx^-kO;bYHRLqXTKy<| z{U%%JX>iOEFnub$MB$vlWJ1O`7Kl6~$yHH565n#mEs0Ybxcq>+LS_vIujbd9<+hY+ z921M%F+ujLibobiuWq z{ZWUd&`2G_`OUPH>nk~q5-V^BG05*7;7)UZwQEfGLk+08qln?1`jy|gFM+yq_a|Jc zCRwEY--JOa-q6u?nr)EZeoFOAM0~+bVZN#4`#!5s{Gu>>38{>ED?zeCc&=I5>XK-DlJcu1^W! z3;s&qtw8HnylB}A*PNHY*2A!)NP9e6Ab3|XW8DL!{BP$?rLXjL@7tD)%-nRfJL0WR zHE3s}^3qQB-aPK}Mx{2#d*ugX!TWmF@-o2@8+F6&v3qBN9$LMG#~Ox@ z%3zjn7>aj16l$T~F=qz$j3y561uHKU-PiGb1$S~Vcie5(RFAi7f90~^R^J(z?iO2d zX$14r%SGjPg#lk;Rn56NIp@#Io)bMw%A+F8sSMGS z)9|(G_SlD8W%P?9d}{03cVuFG+HZh(!XsyO9KGvk2Pq~d831@l*yK zt~swuJZB#v^UiPU?NB(dHAy^Z7&}xFSRe%~ui_Zlwv~CzK_j*FHpue@x-{0HPBWw) zQENT)%jTlWqLch>|3`KIIh#ZtA3$owp{Y6o=aPrhH)9-pkSqeSeqpUYbt}&S+=WaW zKB8qiArUS*0NyP|0mUOA7UeGTDz1Q_oP5e+OHY28=vx@nKOe#9cMP%r4y(nB{mA@H zcy+kv5_&Hez0&h|U33KGN43T_gElvaNag~21&Eyg=r^&d4qz8kVPR;=IL)ll@2z3H zN}3X=Sx1rTT_D+MpfCIge{bev-dI#$RJn?Qv$i5ooMoWKdPg(}!a0>c_R>hsEGE9d zAf7uJyn=L`>G`Mca6m2apTYm5s_d3^P!KYE%y7v7(b4%mZj6hvH-?YfLBZg_fU^cN zobrBotNaO9bHSh>g1%OYf;8}!kX2m>C+TBU$cOP{VchJ zujV%gXuCY5{TjOm3#eNwvy{?^| z?j8)?B#^E7$U0P2_HarN4i`@AVQS8OHXROG?XQhnG_R*Pwb$KAm<|Q*YB@R~oP1Psee;^VIdVckOIN^8!2+0MVus}!BJ6?WF`wQa}(dOb2krX6smfW>ug>WXlE&?qKdg{v$FhUb2a%7-w(R@dCG;OH&9Y= zUJP-qD@;Fso)!!hxJ3xBENHq&K=jrYwnGs6Be7lJw0a7!~SvaE%h!WfB(F8`Lp=z%VdBYVonN?MW>**NI^Zp{@ETS z7Y%3caJU5pEn$HuKzM z2x_90$eFa$xXFo-Z0*#=o63D1lPt{;zH~66kgJ{Iq~wo>@U|EH7Qn3n@QduGg^P%j zr|{HZ25WnEH(E`2C``ZGam5X1>zEzXsb_IR#C;eeDKk;POR1*RRV(&texrB`?BL-; z2*W1IaitetGp8T2y0duhiKH*g3bFEjsB^dEMh!AAf`uEu%nTh`!=$}>Z`w+ZL^W@e-$I6rd4 zb0y2}Nl8oiDOtZu3l`qrz~bF}Zy5-2$9G8;|KbLr)Xf2PN8uCq%-P=Mb4sOr(M0Qy zD%U$=eEU;st>p9#yeo}c18kB0galkp7K^Ny=HX>x5Pw#*(&CHs`PRU% zzq4<}QL_a4p1-pWnFhpfovSo{Hvl~=qTOAA5| zCY0jw1hKgmJJ;y=t}Up(CUFzB z$_t(IK%v^ARO>fmS@GdiJ>*(6ddb22sPOe^3XCL8w-u*l9y@{uN*;C+s2;b4j|f}! zJ$z#ne?6TXjaf#J*eozwy#DL20~}HZ=Oo`vF7g7U&mcx7h8=E6=bJteF6=~(RF+pe z6U#D*nQ&6Z*NzgWL=wmUPKU>-*`7dcISI+OR^}HH(5)O>t3r6zoN$ z(qYK*wiNAUZSA_N`znO_%Py+|`(?1;HX`SQ0r{=%$qE?QEcAwm{aYOzK3Idc5!~xIKe|O+zyr zDD9X@059`L_!M=ZF-n(yzj?-l z3{2W}4AI8GVCb9a|E8MEi~wp#gw11?7eDf6W8t|Fp~ja!-nLSFYjrwDWejp^JI2cI zV~9b?zfhkKGNRIg55<3??Xg8A&-xvszrJ&0qtzs8Hmxu;&}Hz;Qs($aUGo>Zi*Z%y zb?u7Ccki(WSx!=<%$`fC5zYjwMuNib8$lbYPJ`7a$%CqN1E&h-3ggs5>EI^t%I4nG zl*gKjfxTN_K^iLls;9Vk<@8}}+Uk*=6RW1}FF?#dQD3_(Q=O;w3bk!_w(P!4d{&!> zV;h1|caLJWD=so#a|Z6-JF5}%A<{EF_?(VfS3{yeRjk9=$(L$4#K8+^o8BW^IyUSt z;Dj$YGC{jX%Y9>ne8K9s9VA3-hr|`g6Ah=@k+cCq8LD5_&irTC$+Gt0)8SlewkL8Y zjnKfox_dB3t}Ma03~ZJ$)%o^_WoVz4_P_9wkjd|dKzn`RwVgbj-$D-ZxTc&)?JWg} z8q2rnGGtc@?n&~pRf`k25Z>dgXM0Tebl;ahK3_eTfyO^aPu;;j0L8CtX||j}Q|d^v z%3t|Ic%GWPGm4`s)Tt?K7_z8_H&w{itVtZpkCHrEo1K~+*7oxm4G27UUxN5Gwg>hE zM|e96PY$2JwERdkTj9A}2}`sHbm|xJowJRk6{9ODuQ}q9(?vM80+SeOqW-BKKGA8Eo!swRj#e{{ww&3UYrf}WiJmtMQIQ# zpY(=9w`aZTa?yOB8x#fo*>gc$DYTg|fd~Df-3bpi>DfRX{o}f$jxX)-!wwMgId@(M zMUd!b9sLt>8*u9{Qt>ExDDpZwclA!GxXAEHkp8^mSM5-dBZ%o4Nq^OI4ym3xp6y`f z3>VZSnRY#dR8i#l)!Nmq8z6oQcq@@41f{0NxuCwy&<;K8rVb;gG9^yZZD*K!sw7qlQ6Pi*&U*>I@+)Ug*;0J3XphY|O;4xnBI2x= zoCM20puZr%=RX-X9@2m$A@xTK^u&S9_P0&sn9QOPf$+9q?%_?4s9<+ABQ)|7zm@=4 zN^wWQTQx&t9iHRnPQRN(u%9yKE6V31%eLEB;ca3L6D-cj5=!H&&Eam&1M(}~dyk%7 zG~>5^3|cp!``XH7Zzhit2|k`_#WzQWj9&_X`MY`5*5iK?)*u|>Wxu$ryG_=_1FIn} zNkq=UI*fH${5jt1wkgW{SsjKt*5H^27S~}GUCZHjTpe(={RgMk__G1;$jE%jr?Gc1 zC?D3vRLy2`$$RCWpz%CX)w7tl`}(x!*A<04C!|i+r$44 z+E3}=cZS#fTa=*FaO8`sMW0K8rexqF>Y%*ML$By%Kk8nh{NF!LUDw}46bmcfcCQ)! z-w_@859W>Tr9DwLRU2{t>98@?{5DR_XW&0{fl7XZdLcAN$z^u__pI*0f@^V7t1}dh zLVD?_e)Sw)ZZnZB%7^d(-;F9)cS#`w&97Ml_f)oZc^r!x1%)rD8Tda+jXM&TfSfSe zSqe2`PqSH+1V1i-4XbjKXGqFGjiF5?X*J5`?#7C#aX!831RpdR$uxisKf@$YCMv^$P|pS=gwLR;@?4JBY@kPdHfOnh4PBR~MC1{$Zk9LDdnLKp=Wu3!2kqMC zf^39zIvn981rlnaEQ8Q|YBO)P;v4+sCUiPV&X4jzcdODy|BG4I0?{e|NX&;!b7=Vf z%sS_B;qk;K*IA14J8YHgEdh>Rnd9H-AHu~Z{|TwPethwLD`e&kvqoS&@r&AJMljtt zgc_<&Zn2l$Bj{{ADPLbuy?3pqege{~u)6soNWwDW zvHYs(TNxR<_n(EFW5m~tQEOCL^Vt=kJ(fEOPXr+LM z;j6dZF~RT3kA6G-S&7y#Re9IOzoh6($GdM9DSrdAEVdNl7S0XfgOqmi@p*&gTUrpy zM|=IqhyY2)HbS+EZz-$wi>lH<@k=gMwPvGU&WZQyF zP8T3N)I)Ii`b>HFEe;Mez zoEt$`mH1LU?NdeH0j)^;urQ!5uzbM_5s%Ly!wHkPO`LO&EU+CyOd<9kq!xQ<<-4JL zkjh8t$Bj?)aK669(d1Dk#g%z%@q;$+xoS1^CYS2jpvmixV*EU@zN3G(p9j^M_hcW} z{x*yyc~acaHS2`fJJhjzadmEJL3u&j$-|*X@~Y@>->6yh=wDY$JEjj`ZtR~Kj(0(MhX)51s^4E+1Pde4w?Ad;k8$M%)d8|H5E?38NS` z0k-Rcp+K7@@q|lFo!NX(C-n7@b;wQ?mvyDFQ#NGyle8c1oVIQ z7j~@+_=fS8w~V+>U;mO~TSYn!>GSL`$rcasrlFHU~q`oHvgx_b;%TNa^NJ-79YJ-Baimy`f2Xe5~z5_^`uY zyQO;vf4j{-QfFT7j{$20T-ebz5@vL8TW7UA*4pXy&Ux$aZ8Oon&7mmxd6(b5%m&EP zdG^nZBb-Ub-SS%gPXr;T_mi*O5g#W9Uq$X2ed>T6S)Wg+yak<(`w@`}pLdlk?2x{B z{NGUvm9p11ei_1lYXH&B)pT(`OS*5nIMy5JUM2FeXZV;DHSe7%n%tlGS?5u>Yj4lG zn!<5?VaMaQY_S6&hQDVTmY=7@)$RW7v6oj{<&6G}KmFs^W^+omNPc#(`~68jWo@FG z=P{n!)O&iVd#%VfwYe*E_iZ97ya~N-%XL-2khl(_)hMA-YT|wb$n4OG=wR50Z$ZDi zF`6$3t)0=cxR^9{2E&<5*_g_D%*(-Z%kU=iKI?s0eYAZ2mt8ziIs{Z#Y5x5N#;Lug-+GI@u{M3?1;LFLM@7wBs-~=`lh@v$m zy`L!l(NOM*MYME5>9vYmt3p z;iPZ?X*GP|y)$f_xcV#Fxv**kIr6Zl^YXu}xec;F5D~PqL*!H*t%23I+G8FzZKX0l zvV79@W{XS96~C#3Yi?y=?f)C#_GA^`0Im+kZrFNFRuN)U(f>tU7L|P0a?`2MHIZ6XE9p>T-0+V~O@JFP zzcfZ*mUOY7FL3)H?Nw#2oa!CV-ZH3i{u5YZ z^xiOWe@`kbz%t<;*!Gk;Ta>y7a)ynE{e&8-RUDplu!oIST||%MP%M~~{DE-Q^_E5_BSGi#0EXEa`Ut!C%RIG2CVeiyb`RnT4~c$mOB08sN+*4+|!Z z$p1c}r)rO{MF^m>T$@uGia^N;=ncH}l*)=dtS{dw z@Ir9??xf5c;K;5&F*~f12LuxpSkygC^-VB3Vmc|OddlaB?#@fi6EaOgR+#~h{r&l- ziltU^g?4P7jTvW+W`xWd)_Yay?=ggI)h{dj76w9{E#!kr$I8NVT0n_rL;iTTP?%+4ywst-U1d)LK< zLm9JTkZUlv;MI)!XW4y^N?w0$eA9CxC0GU|JkWPI^nWPgL`wwix2ujf!%_EPEg;$y z?=d{rcg4e0d~$d#ueA4CPcRh>aMat;mW(W9-U0yG@j%Zl&!YVOE4J_axGKA;VGt)D zJj;!(B0&>~5 z5{&jm057{8j#7Y-YRP`a0X6eUjEw-$t`6iPeCxhckTwpWgw0+HrT2zM0+0I1b>S>?5T89LXEvJDYR4w%i?9 zkEt)1-5E&x`-j=M8DPy{ldD-PAp%_cpXOuHLJoBsd2WQ>G(_E}#9fDB)AcvUTP$u+ z*%A{$D6}+vI|mA`VE`~ZVJ-FYf9TtVGh>a=ydcH9D%T#WcAH3P558ICvDYT@ocR-C zV^?Xt9`Qc@TYo5ph6(Zp!A&(AMnwG^La?ER!H+20 zId>ItzjozMqHeDIBx2V1>fKqns=5N_1;^#*CicQ&{ak)}!@52N*Ee2#aFv{g;{1r2 zVS+r^#H)q@Ua;-Qx-dW^2WD96&sp*#7Nm{+fL}ae$=>s3@J0UP9AoF8H~!LOWJuLT z?VE;%Q>y8A;WMrZMw;t+&QA-agm?vCtaEbs0%~lzV^<+ zCQ0CU4{&w{*U{&tLLp-F9$DQg1TWHRC+&&aI`YG`P5^-vTru*| z178s93i!%b-rV`wA%p3K+t_Cyt92nOInlK}p$&&5i?=4^mFlIfZmi9hItDhDKD`gz z2ZmqWWADfC-+1y+HGVLOJZR$ctyghxQ$_af*$#oFFW5T=)s?Tg4D<>xgixYAjuA!b zPZEKm0UpnszVgnbyMR_zAQi#7(0{ZB2<`pxTYI{_gQswK&`8Lu-qLp9?00tejg`*p z@4f5(Z4L{WtUaW*ehle}Tq|x5l-<|#`7pZ3)}9PK_}C;$PjoK?hZm<@S)5&dY-ck! zmx5#1!}_$iXx&;|pfXQw9HpLKM~s6-WlJkXo}WhV6pQtEygUm%!mlrZ+@K?`(=W)IHTG%0W8bD8((k z*jy}5Z7$-Y5F~kTAEW9dA=SRxXmH?asARY_lxxBvo4K^`D|Ld+cSBh|tXb)d3!Vo|= z*72MM%NyajC2hOTt6D0ux)3)#4FJ7ae`Xc$;m5pdrI|x~;3`uu;3C@Iqt_H^avA~?SIq%+50`yHX zj_q=9*Nn>3N6E6f0!yVC%sk?sLO?VUPlgPMA)7YuHI0@p^^4F&Ddyi!q6WQ!PqY~2 z#|!kNhEJkDDA28QF{vjtBn>jhmk9SDkuowiFK^VJjR3zCFJ1}mnq8SXKLP-7kaO1f zQ}nm(78b)Fg6>f~ptx(##{g@iU(ID4uZ?Sgt`{QhUYwWGzmH35#kT{Hu#ceOC@2~S z2)xr}cw-SR4UM{lw2iLB-f7udLX$>E>3tn7%tU$PiEn^EO?eiU|rg`ccN>?9~<`@F3PK=yD3}I!Y(&lC44L z{!YLSjucW0h|f_qXbtYr7PmnU-YlT>|1v`4yBZILpyU?R02#Xfc=NY4N}^u-bLbNv za|U)3VwTuE#mH7B0oyl)1xOVJ#DdI}E>%=z{-Wr+2O24C+P;pSwXX$sk&A=)AkiMr zoG~fZ29w;XhgKW+|5JnJOJ{sYSjWX|Sw`Pjy*1zE*)u%4F(A@Do*I=Q#U-kS+wi0E zhyRb>LI;`xyor}+?*$XhyzbNLE6_}A4&YGB|vgxCWkYJ z#d)$^s$D2|1}_<6-ouFqTQ}l2U-{~#3lHgPyI(fxpS=BhH`x*%IM1FClAx#tjJUR- zt#MLHr@X4%yZZCLY{)YsnGNY`zm6h{8bFs!?*u{;{k9-)8w;VSs2HcOX-I#48DwQ9 z_Vyg!ck{hxGY@+T*ueL8E1-_4{&SJLdb0Fp>8&ti76IdI%7NH%QAFl;taTae5Dw;SjqqLURr|ca`o3(}; z`WmbG5r=0~Q5G5D4GHHmSzSn08c}tPZ)?9TZ`s)ibm2iLkK}cmH~n$y4Cz%8;1F2g zt`(zds}uPVFNpC+d`s$mJ8mxPvH(?CEj<=T-62B91(T0DSw?rX9lwg0zb6hDfC%xs z{MX06ttoy9zqT(@H0OIqO@+HRr0zm=Vr0g0 zZXcMSJ6iX&Tb%0To={o@f)6;y-ceq{rQhwiI`3HHVkGambJ9M?N7|Vg{uQumO0ixM z*qeB=b!Tf~DgBaxDg0gD>l5nF%UQifIYpDwv|G@LUz87naV^(X7t5qBsPp_=9?j~x z@&;XNx#t`2{3)GGP(5xLG--MKCERNY8CvXZM-q%g`%}Rz@?rWpO0fx@&wH_6V zq`AF-Z8UNvu3~+Gd#|AS_iNQrm#r`Dn)X|eik@|Z5c5TX{_Xo>rC{T&#Xtd$1q+CuzbVJg9iV-p_kt($t@8wfn{F^D% z48Z+CG61g+5l2}V%hd@|aZOFH3gyzMWBo#V8$PIm+j6_9p8_7+WFC>~${H!0lv;7Q zS)SXx?>;D5cq%E1u%E;Gjq)(yd~Fc=nj)=^KAg%%eB84CCnMy~n<)r*Put1zq&A=@{n2;fop_Jx0A34o@Eol!@AGn)6i zmzAExedvbIr)yR}uD!lp-2b@cxX>A!*fadGdv{|LzP`C!{D$+SewNL*&=wuls3)hp z4Zr{V`H$B3E4`22pIbD=yrhrkph-cb1Bxr&+v&a|02N<1!cL{|dOKj@*+uUB77h{E zn4;VdpcgiIhB;u=fOPQs!ytui^M+$-XElqmnVhzcH~dy7dl1*lQ<#?}lIcZwap9ds z`7fj%5sUCv8|#Y)T?c1KTSjwJh_JF z*mWTa0>!0I3h&pRqPjby|1bd~hctX6H2kI%th8e+nZ3~rT}1zgMt`WouXBBOXJAwZ zup{rnMzeM5XuQ@R#meaCPgI>8860tP*L&E?@0Ti~dVO`gw|Yv1GQ8$NnJrHbr=3qe zK`}$=NBxvNX1m_8aHBB}0Ojxelt(T|FaP`ou{AEfa1nt=)U2251Mt5_UE^uwLC9PL zD#rmF#6_3w4C+aIFL5aDCET^{xU*aK_A*2&Be-^sf8;C|_eZQ(<>y|zmnC&EhGG1T zYt;93zvsp$NlO?rCf8Yoms2HC%Aw5zTXWq2-414@!uhR$m>w88i-S#E7}x>R*aule|D;^IxSHD#`o_> z|4-i{P{r6_dE#Jg)>aUkUZ+F8Yw0P-*mzsE*(O4FqfphG0JPjM1BTrhr9t!X`P_zq z0||eJ5)3r2dJ1OShKTtT^9IRw8b4yXuqNnO&J5b9P zKVmMQ9JcY-rnX6_y`r9$-#98L-x;`GrPp+V=h>LAXRPwbMs^*Hf!8?Y$5FGWI{Mvr zk$n9=Pq@`^nfWsbG)x3{eQwY?9xl2?j7W z!l7%}t5JAg+O46GwhjVBHCbabxR%gBp?Zg!6Z%evRcO9ZM!2c_nC%XB4a8{>mzpPC zE7I7t>(fwdN?)Z?f^igYKG_P%8$PmLD(}>zw`Dey*g|8>)vr-Tn2a-JV`qHwb@S}p z-;LKQ2})8j%!D&~>TilWPI7EMydgCdN%GwZyUUpK!(o&a9GrqdE%K3gOchbZ+AO@OO?Vi z3j*=$13yb2Hyj3hY>ZFa1+cmm`d^_`l5Y8P_Hqf;tpi9A1rHidV5hc19RTJEu1A z*)KWzt@MvHw?)|teJ0L&{su+FHXmj^QN;L-G_QIF48c~L`TXq1E$wGaw!z5s5AIGF+ciO=gaT?Sm3?{nstJK6f|myH z{FvJXHStCH!+owgJbXsiJcGaN^gJN5)u3?tq{DYmDpKp_&X7Qw2J1#$U0u_R3q4w8 zF_epMR8MRCL7H3WM~J-c_3zQ)3_?&5oPs4GhGDg`voAW;R|L;1@5VXu8hcw^k6E8BjcysXET_h(&~t zUZB(opW8_dXiI|Y@l1R!<5g-+-Aq$tJnJ?&Oz|Sis>rX-2B@!>4G!p8Y<;wGwmk2y zWa*hGt&})p;=|7JY5t{JhE2SOEP{q7T(0=8EWhmSIW-!m=Z@$~sk?eQR@0v;T|dEP zaTPl)QLs+FwW_!GaD=Qy#02zuM;$BF5%bl2isR}(9ed;t&h&vJ z$=Le6;lf@j=G&#&H>$K?Hh?*pJI4$739e6CZxd@say?#D#2BQ=_M)Fri^8Z%@hv08 zxP2YU4|Ne9>KH%uPhn6#3cMAMdPtqi7(^sVuhu+X3GQ+f z{RX|;oAZfhw$cSM7~e^^jbn`)`qp5xcLlRK$pqCfZ+|%>{SISt4?9K?vxTN+z3>3j z^Jny3+v~aIYC9}jyKaVEe9)j}f0wV6Fo&O=*H?~szbK4SzkOj*613SNdi94qe7Ot4 zvKaA=HXY18H5XURD$3=XO!JY=&Fi4rLke zDH~+$ZO5}rBZx^PAZM@JfR%!zuTvJwGMOV|z=ZqHA_m=qa9;cCGaW$q0qi66`Y_c} ziLhbS$@(}}_hYBlGtbL#zw6Eez%Kifh5ah2q^sBITdc~KaV4>2)h(o1up;41B~S_f z!?>1V#}XV22d`OQ!Wbe}2AA#WTGk#BQqHu6>;XUzL;2r>22KTa}jM5rfzk^ul*eY_cfT%S7Y`m`RiQO&O(LGgPgn7nF59-=EvRWl8MqE zK{2UeIVyWC8e$m!lgI%{ zQH0oc;2?OoFPa&%#0chqcgMa#hAPwlX%vG^#mALpU}wi0F@qCa$(BVaM$9wcTr(t? zAwN0vWgV~G);6gN;pd5UWTnmr(B`EeNxN7W?j80LZG6lslqYN;y_lIv6*Wkn`Z!X1 z5yR;x*s8dbC5Y~TaXAxWNc^~pjGe4sOPLVy2#1gA->kWz4vUKKGvebk#D9}Q+d;5e z(%*_$*BcFtFCu>Rnw^LvQJ6=#Mgp}}KA@OHjIvZI1PP(nO1cJql_wpnhi;1jhaKG6 z(5Bh>*CyBxQ@87~1_`hF$yXydhf!3@mF+CPDB9N@WB*F&?`)72^Ohti`Dz8unm(-q z-Lvqdomu9#q`qZOYB4e9Yn8^h7yN}1klis`CI+UoR>7w!?VsKEZW3npioN(=Oxkig zOE7?pz;b0!XK_YL4&xIqHqaaVgJloTi~i{Q$9JN= zbI<^+o?o{+LEN3Du)J@QYS3U2+8(~#gZIZL~%Y2qAHYe5V!QPTC zlt{tmOsXY6{=&`-5AL(nGfNq%yn|nWvhXzn%-!avD#bGuUPuoXWr`2&tLD)AG%!o~ z^=5;2*}5O*>k4ucyxf9keiCgpskxOd6_gHAbbeL7_1Ak)-2uf~$8+!n7jDwsO3$CQ zFR>t5hl@X1VKfP%9ieK}hoKxf68SlkxiFO4oQGMqb775K-S!W8vUB<)_Rqi>%1&WM zIxoF1T)lOnUl){=KC&0vT-^*@_aD>QhiZ@HRBMNe2mVw(NSvY_JV^+_9&|_6FrTlZ z^crjo}q!iDaGrV=D?Fb@4|4%ciiO->fgWV1OVA-AyVv-}IT_0&Ue zs&`t&zV~CLVmf&6iL5p8TJGK+Wy+iKq(?hC8rZ!4_YY&|R70Hh*e53d_1?{RKjqaW zt2gyeUv{KrU<)s#)E-k}8CN@=0-At)+t$^b<9F)$GxD%YUzSiMq04ZYZB%REC_LGM zIb6hxuqacCOS;i4?{1^oys)0=fP~>mj70mKuGdeFI8qx*Ln{)$9>W7{grTEo!1*|? zEZ+HW0PHa2b{pp*#{~8?Phu|G_S}J-1_qL&VLJA;$9Kx1Q=j`>B1!KP#J`|O#~inACy--R zr_~+{xPn>Qj~(E3%NF09gq7!>O*_8Ri5+B$Yjh^-H627EW`?WO3QCbux5!gId_$3< zMf|Nlb(X5U3E8^&%%9sEpTvm>|IjmjCsMZ?O5c)7#~L@YaoB(QG=FIyzH{sU{9L|N z^wxFpJ${$-+n(~}SQT&d9~S{dQKUY57xEtac|zks0OsVqjc}(IUJlvTk@x$(P8)ls zFX?)v#T`@h*UoI+XgjweQP)~B(M4AVCnDb z|A(@#42vpU*H#b_kr1Ryq*O{uVhE9L0cjYzq@-ae5d@L$29?gCd+6?NhGu}FVd(gl z`&?(Av-h{_{NY+_W`1z3^}bKs&wbzTd*t@s$KwoYg7OG0VSK`it6oNhy9ubb9{D9e zzx0vOm}Zu;E!&*{a;k%E4JL7U>`P)g^%lD?G-DPUZTfD&I270J=X=s?;zd9oXj4@` zsx0NxNjHUr+#v6Mao1k_Og$ixyIu-z`qnTosgpyf#0U4b!VLu%hASJnHeK3buLOp! zv%|qYvgubl=HvsOUha+K#|`D&v&%ds=d`q8fMRv*p?Xv8M$*xF=fJ=#BNfHSL=~e) zQkw=?WwE%U6l+bHZD9+z#uf9vCyP~%OLfTNU_+4uKlwLcFVsW|RR}u-5PtyFs?kz? zfhzgC%A3vw$;tDtO}bM)V$nPo1+L9c0=*0tKS6h9Y^L>A1v$+Yd$)a zqV#rybTFUFOzC>0`V9J@taQvX?2+Qyx?#Z;{5Jz*X_LT{z$D+$z03-x8{a|lSD>SO582zR&ylFQ(nmEL zfAu1|&OX_m+4DQF+p4H$FuI5o(HK8=3P{w{X7PWyRpq3gpRy?f-l4^hh? z-41IcGUquz0~$df-#ct(yqKz*RJpni|uJ}PY1 z`$S~*Pir0j@E0pF*y^ub$Lv}|YVX0DKO;(+_wwAX zGJO3fL*WpkTt`4vOMVcSiG^2Bu_71vKT+pT_-Rfjx$hyC&%-<&e}@;PUoyU{uF*v8 z5)(?Ak%eatt-m0j~<`)@CYIHP}8UgT?3!{t#%yCJh|t)lWNuoYVn{; z#%Kn+bj+eSNN!Qoi=mak>+9~(leX}4aZ5L`vH855lo(+^ZaZtGRdq1`A>2pH1iE-4 zd;yqsu%BLz4G0Q&BOlk_{DCAC>-VZWX6pP|x*6k5!tog9FCHx@lfb zF`97b%;awU&ZVx07yHJ36t2Lgfn7r@ANh;wN{!6lm$~#)#>8)r|CG^|Is^MLF4Oji zim}0Zqa=2h;ikq#{jtYH?$j3U!fi+G+Mpymp&<>}QLH7ERg4(yY}$@a#4a2$H-+7c zmw)K@X0v1;P|D3BwW0Ql?}%$l8^grWE}jSGQ|m5&Cj}G%UZ?U~?>(qkb|daim)ow1 zIzGR1ob$F@SagRqyG)Adx!t@8zd2iE-)$)8S)(OOzIrw6)5|YE`@-9u9$*Hr-OePxMLK6ou#~kM2u@ z-d7Wq!SVvBssQ{`$B3k~Z`Zlxcw=D+$E!fQ?Wwwb6IK?&Kbk7?ML~Fl;Yq($)L?~b zIBD>hpoeMauRyOFZqzT@J+dLUx?Lkzd4apDyX3}$i#u7spJ*{_-6p;PlG>p>T%M6DVu?&mkh%b!xb8((*pKy>0B zP4E>j>BM7Foj|wpl=8qD9+NZX>xUg%kySjmiXgzi%3Qtz#*1lnTl5XaA`qj`- zEM&=X$>a7_REu_`h4hn+3`1U;&8GUp>aDeCB~+9A zrDr~LguGqGS=R#F!BC?>1%6H1#loTv0+jVCR@&DjbG~-Jt_-egR>S20d zuplhXKd=o;D)QoY7PM?T-|_}Eb-Zvq{J9IOkx*~MAT-ESz-S8BM~@EEkR2rpLclrX^eT)!srBPYy^1B1h3Pw{L zg9!Aa>MCr;B>u(ofT{X@u*Ys9Fd}r)x3Vu7Cftdwqn>j(;1>K9qbPW|Hu@6ifQ4or z9={{r3)x&p9|FzBc&0u2nSsE3(OTuMzFgZM!Qz?RH&>SGpDObai4ij168v;Y8pdMm zN7}{770nPOarlTU;%x_B@(>;=EB`fq^`Xm}e}59EL($GSC~8PyFh@{IVu<8vIZ;?E|%s+xgVd3bH6ZS^u2%QK}r{Mgkt2ZjG4Yoic<-SbdvXui{f;()~rmx6yC zGJNfH)8M|98LfDjosTRHp!y!k{@x!r+C9S$;zEPp?=PybpNH)X2j+iUJV2G4WCca@ zo?t$cnX_y1ngyVOexW*r=hch1GmRdL!dH!)dak>b$~glI+dY#fG2x*724*4T%+OKV zvyDLx>7AuOs>?}DV;tT#1lcqOD^1fa3VQRy5$RAmaC4;5D60`oD&c)1yA`Kno3~@2 zQ{Y-qlxAXVKktl4-I^JKsPn+cvLkZ>OL;tbURL_OP6CdMYSVH^c~uo4H0n@wwG502 zbb@DLf>SO8f(Nku%KMB01q~~taMEx@tm6PXffDw9J^RhJM$>C3Iox)xsOZ-|Z{%m0 zlw2FP+AJ=zCx*cUY84oC?mSx7U|A5nk88XFHRpi8GVTt^H5;iOg zi)yJZ7=uT2h70-I=Gcxc!0A8@v)>{KcgKSZ5w=s(mEIrH-?d`&og0ois|GOS7gk%U zKmW?L8qTq{#M7k{F zXl*P}y&M-SYhjyp8`f0jQ7Q5Lz2MW9H6IpDm26XGIScd?qYshL^b$w#&Zs$hZDMGY zyA&sB*gbxETh}?9Nw+uYQAabkh?6WWy$9e|JD)7Dy9v!aUt3!UnjQ&YO*e&3CP|zPdhC8`=@n^jW zjkr8pL)!7f<1pO9D-`H5ogX!#YQ=_H;_% z+?hE=luAR^#bKRzhCt*hbd$0y{e3=n=U%`_Pl7&+$)dBnbUI}9tKFrYvt^_UWSJ%TK$ZUn8+I@fmEQ@X1 zv~Ves-}#i=SiH?3Go|f~Ze%wGW|vq&s!(KI8csKclpL}8%;45d6q#h0^%F|g(rhm+ zE}0C&;l~G4Q)v)wfr-Yn!;_pjW_OX4l4Q!H`BOLe-d4@(VehDkf@)uV%AVynB8`*m z=2&%zTjJ%F$aTwDkZN(8WCnOLK8qtLn`gA!&;pYS{wUgFFR8~DvR|UfS~SFNEEa#Pzi zTYC#cG;m=3Q7`k%myQzqCs!Escu%IEj+LsPd!4rhW&v8>nXXwT?(PMbIUCCXo~aYs z&p~gVG7Ae$uxNVG2b7O0e&dMReaKfWpVnj`%Id;aqV^_DkNd=sw>uw=El!NKYw~26 z3B~-1Xpje+#4?dISxZ56)=B)i5_fWKn(4br`ziY)5TzoiHPZ9lqpz3r1iXC58P*9HEr${i%Rkwtla>7oEV={+N zzGQUQXqGIwSZ&q|6*b*LPAk2&O()bEenDq_*{^HbR1&F2@;__kEDb6aG702bSMfSH znfkygAr9LZ8dBzF{OEh<-0A^7YV0T$1%MlYJqnnjrGqben_O49(oy|R*H{*t$+5Og zH({gQ&TGn2Ie>;}e)qa&hGrWEO-(+ZEx5Y(&(Dq>9A!BODMN8w3D3;Ks;O2{pl_+T zB>mNlJjvV6iPr#6D+!l>&98A%T?zi$rmlx^tGD3%^>pr?i_M#%At`nCI$*tKVHb{p>Fo7=M{C4d65pM~x1W>~jl9-jp$ z3*II-@ZB6>BDw~>h}$w&Vz3LKUy-ML*RqOfvSEf(^AiLcI6IEyhWyl#7rOmvTEHB^_uazA*>(lS|rs2|{d~7DDD=(1Jz4Mt>cFl6YVzxVPe;$FS2R0%tHA(dlLkmB)MI}Gb<*d(_?V?mhP3aRxvg( zk4lML+Edt0A=`v^%K)D61E8|3L=PT-t;gw%N>bQt8arxuyImfJv!m1!Ko3hk>A502 z>o#VQKQ3#!geIX|AZ??H{G11ev7ekxV3COVz#KVmPnlR!!a|v*UE-Jme-lY}9@Pc# zp80eEqV}jwtrj*T-;x_+p5m?!LF$~zErqNCdaBCOxBi0owBw|f+Zd_wDa z7Mu0W#gNBukbp0k34*V3O}7^JVY!~nv8d8Z|hyV@c$D8mcr8cA*w^8m>lp?fW+0_s*F80x!n4hicGb@ep@T)fNm5e&7GJD z?)iad9und9@Xb!-&eytcj`eaWuTz5@QXr9QZSV8&WP*3Qp3rBnozQg^j=^JpwzO~cX~cLg&)!k*F$ zIhKVvBVDFoqG&dRBR^UKLcock8oKVLb(^ihHY`NEqOeK%6+^$f!z_g#9 zuE*&&PIG*O#_!R(H+gk9_(b5}T$6JgabnVVK9ctqyd0s(-c5&jrID02qIT^Z`Cv}_ zu+Y5ql{m;v`KY>%5QEJ*VEXb19O^MxyI5((vc_z>)%Is9Vms5eKjJRj0C);T3yWlH z=(^0YE_#H_8hFe*KPW**x)n2ocGvEqi)Z@hIG?OG*f0|B(tSq>9uXg;TPUEm#!n5AEl2pAjp=-c4Du14p8djLy?Zrb!9O z9r=-acFLqL)3&8U80^=dlx4!19aC$yp$kw;yPnn#BjmqXV}Bc%@O`)N6GAtN;Osk= zA89hcnY)JmhlR!?fS0X?`g; z-2@;)pp4pI@Rv-a3%_>Kc8;x0t&3QlJN2=e1*!_8#?&Ff$V8f`2@q)uWhv2`KFUD(g0aYrXQZb%T%Y8!!+g{SFQ3%cJIUBsIEU#K6PC~iLnf7 z6Cta~ofEse(_ard@qEtP#!$z_Qp37-#eH-J+EvNoPc|bKE!Qu4lqjDzl6IxAL?ZUO z$JTn7Qa|i)H1GiqrK!5FgjUIv&VW<64`0v`4UKdmAwggIJ>662B;(?5*P>c6_U^8S zFpcQ1cRT}lUIMcg7^y6CQH6@Y^(sxU{TiA`bRT<@uE5GccrBiy2y7?E^4B7BA(1eE zbh(;dV=1}4FLk6m0vH}_!b%>qV}ft9jd7$K9-cLyHRPNxp}9aoeQpzWHRl2yOjo8t zf}g{t-4mT=E%n*O>>y*wKrFX=X7#M8V+$b4C;;39>V0p`t0s{<33Ff4y&bv>|M^{? zl4{e1BD;ojsYp|AdXtP9#RX&FZ08<<@yqjefvAuZM;tbT$Dp!SzK`+aQqt+#6ghhw z{ovcc1TBgPa5Mtndz@mFupm@*KejY`=A(8wWq~%RZ{JmTf%QjNvX2q3(e0bmY zZ`OHI=Sh3C18oX>mc?30rI$351G7=m{R79PxsLB{1^yXe@Q*(?Ab*hU8P6bJl8w1I zm@8dh(#bhHl7e4P_AOOl_PGI`);xbv)bwet_Xl=P{plnPu(N61!SCQ}ASPDYLSbiR zQwQ*+Q13`FFY~NN+O2CmAEtJz7nh+2dL_@nsGx_Uo`;%?E{SsnH#nZv4BQ6du*%DZ z+ay~;1uG-+QI2Zw4>S?oX8;(f2s~*DugO*FtLc*gJ8wEYw`GZ~{B(WO`rixDZvnFB zNhWKxyj4-9S&--P0B_D%qjz0SSpQy=kMgX~9XbK|q1jMcDgbvNoi3-86iDk3&2`~*;d-d)0YokDw+L>#X&w6xq9U1trunf?}}4_a9MWS z^^4MQ8u0d7A2)l=0ot7DVHWjCi5Q;DAHvMdB|6QyLESN%)hR`dp?5tUQB(TGD8`;H zs^T~=Jr;fk#mrg_ze>9L)4FaEvHQ4R&f0g?dpBWt_IcYW0HZ+;@X(~rUC{+~ydvMS zztbGeT>|x0LRaP=?2q@#u+^q|!R%~n_uCwcj}W5JX-mmFikM9|Av-&Jl#b@&k(H64 zu%6G2AmXTURq;S+mTa>5;v~lofxJatEyn+)9olgmR17AD+nw5sm8YRt7Ws#$j(XBN zU-sLbD6zqu+6B~A1y3vSuh$ZLRy;Sjx-xTwQF&FXOVKbm)O)>ea?Q1F-N#aU&|wiU z^dulX0Hl-Q(o=dKp-QLR=eol!CnX-|N04dHwkw%RkTOkb)5$sunYP!6Biu<|@ad97BWJ$kCRLZ83S3ueA{qiT> z&=tcT+Ug+p-#@xpHOnMq48~Ur}tfO(=u5PP9i*Ii)7owGf zdAx41^`(ysYxCf4U6Kur55*dYiJ=P}imu7lWtOd0(j)B}BEmov%%KZAZ&%5kdVHE4 zrCY<>+%F4tM==-W?JK-(4~T(O4IqJ7_5yaOU{@ts{4GsnpJEL__hSILfmkvjqypgW z`HXqsdfJ(r0Ii7(Fhy^OlGTi;+QNLHmY}3@H z_zm6N)1+NM8e5+IeEEX<*_i`C{3#|bVdf4=b2tjJgrO#_rssO?yJ*t?%psE#nFHIA zNr*wcj-(I!)f!eAqNV(}RQ2SyOV|4z-N@p4I9SSt-)RBD?{b|$ion~dn4-5MR2Zj` z?wO9HrW=#>3W&mS;Y!&XdZn6pUqmtWBd5ZpYPxO}`A*@zTYjk?%)BB1YU5g~?o0|l zASi~NYR4UEF#S1=0(vo-Y^R-HIi$w`HU=KDEBl0CMa|z1X8$=Ba$SqB*|NBqIJ%3y z!9Ec)1zF4RylKkz@krkdHJ*dcwG6^;fb<-uF4&6zRRJ+UxvlOSFE8n)7cMF|o;Yp6f0#bqN|#|5EN zV&Kb*)#(ZH(Bqi0ve>NPW!P{*o_)VTwTJ|WZ8QY)Aob5z;zyGgk0$+7&w$7gWBw5> zG}vNK004tWMH+5#CgsflIOy2wX#RLm&f?Qm8%?2QA)@AZ5VTuax-W;R&7}{+U3+xX zxd=~ypKS2v0571Ji-La%)eLB^C}4@~+i10obaRpEKudL#;y9#$NptNR>E1YXbdues z?IpaRc)SB|G)ix(_O!KO30qihU}Fh%r!BMIs!Tlb>wz8%S`6cr=_-qa5vgm^!cHrp z_MonzGQB4v2fkvXG`kZcUR@I!cducWJkUzB#yRWh7m~C%7fSo?b^<*vR^qDE;S=gQ zte*WeLmhH=d;8X19oTYgCw>h8@iA2%$(TqlP?Evpna{|;f>{@*PSq6 zKPR#`fDV2Bhe9^iRa*Z04)55{SUevCI#Vj?7T^@iG;VYk>@gcdUH%rBr?NLQe~u=3 zl-%X_uECqkc7hM}B2u3^EpP3JLxfLl>qB}XJ@mYgPPsiX`{V&X9_{w=Rjpx=vTmQ- z21#8;e@>!9N2^-O&xfg}HQQrC>pMY*FKLUr?NV4gg|JiqaSs1G4#Qt>4II$i0~@E8 zJ{?)&ePOEBHhQ^uzek(Ng4ZinO+&$B_kzGKN!#aU8p9e6!2WBhiYSc{xWRz#RC1Vl z@F}woVz$7Ucg~4$?!t;Q|Z z1b7FcjykTX&Z9tu8NZ<|w(^ZccLz!*=_k`-G9@Np)oSYjAj4YPj-foMQ(32VYC8nH zTcwlQRx?O%Ub%weI@!x2p39pxraSXce~Y(my@J|grNU<0br*HX16G^AiUCYD4v~E; zu!yvl;%gv2we54vZLIRjidC1_5xVHHyuHTg+}#9G z4&p7mraM?ue%%mM2u}cycCTrC+r_jpN@De>#oKn+y z$Iuwyv2W>jLP4ih5{T_hxOh%p-RU5ousZHRU%rZu!c^gO$!zPcP)Yx#+k36qkr|~n zntr(!1=>4Y6^BJpE~n#-d#wAl+l5wEh^4!1uBx)V`cHG05BNca*y3otemV8=G}F&O zqpyt=js-lw-P_1Ow*87i)$&`rqjdKv-)9LvL7%38Z-Bs{>3d3)3&r>2y%s>SkYc69ouu zkrf(c%66u<(9z+60lZ?_8{f#n_z{4WR|eQKc?B#}K2Sy8Z!U5A)kq&z3W;0&py0re z1biJ8A4qX0$V2^%aXwBy)McA1qVR`m-jHq?N7$|%SNPh~ID7B4w|Vq9m#R>c10An{ z%K3Gu<(xj}ua9ChGSWZ(d3638So;sVhUbJ8cEvMc(Oz!*z)re5N&!^;qaoEkI_aA9-3eb@~>!Z_#nUxumhGa670#HXP6abtc(hSWS^LCWpE_{Ovmb z)j%0nv z<$dbdtiY~uCc?+jhPFMd@`j5GO7)M7t_A7~#lL4Uk61e1P%$2%>0hC`fCy_fP_N4*DUhiFl>(O*zJbY~E$ev#A4O6=mD^5Q>U_b>iZ#Ss!D zBzVx_FaS85#r5Gm=b=BcWi_|t zMUv(4x*U`n?C_EY4;*#O2DjjLRhU|7=Vnn)ej_F>9G|?oZ5B|55x*cA&kY|dFmw#A z%)cy%wO89VmCUlGXjiTclwGJKXWY&bo}7s)gjV0fR$(Bwsy^wMELwF>wvyhC?vv)Z zDu<`|I4_p_q7+}6yH^vYMj98~Zf##YloIc&wQpnf4j$t39@+JuO)yqHa$n{{6+gif z6#4#P^e14=G1Xe_%%n?!2NUn*51Z_XC;Pze@P(#U;kDLM;i%B0%={Qr^&#hc54+Oo z5FP)3yn4fDb4JT|{jT|)$upV{J>m1**VhWYk=HAEExj$JtUci_+p+!pF2YR})h6l; z|Hpi!g4QUum^ld7MKeFKUE1un1`c<`J43>E48?Yo?b+>?-qA@_kt{r!6!ZXdLpn z4YpLXdLYiyz9(dn{()20en@n|R?^Ohf)=*`>dKL1WJHc)@z{29O_swQ2cZUP;3=-PbF8T-`v#7kAPHaF9B@x=wOUSx zL;aN181tE1qm=-1T@gGUyjGMqp%ne?m2KM@RqgmqZeU0b#;QWr!p=Cg@V@8`kq~Fk-dlLDwY-;d zHAdgqJWR#1xM#X8Upq_N-3cb2@a-G;%?VySL{memOxTRC@r$RiwWypaBj{kg{|4+9 z{o)DHLtG`LfNCLP`o67SuG@pCu*zz;m;+rif<(tY3{^+6MV!xM_i~k3cJDXKpP1mt z=;s0@8?9cc>Z^!=5sWArk$dC8{nw-}l2Lgj&0s1&zHFx2RrpJ9U6;&$<}RcW9p)JV z@hRJ(|Cslwl1iz6KGj*Pbn5(yWm#!|Y0((i1VMqnG5hpUuOq)AyHX<2$0D*{PQ-tQ z2mb3@UztbexLy{52c3dQ$%6oY7Cq5tr1n2wWiZwf61vtfL()EEcN98g!$>dLmSU1$ zc}`Qj?|<_gF_fN8@zVM?k2yERfi_C(9iCn3`wapelru6^oCC9qj|?13g97t^nEC(% z)115AXOx$W^=0j^6?SxhjVJGa%z>wnrR;Va8IhIqv2(t}l6=U&J?vE&;IS~Usa&L$ ztz}mre3@8&Wxn+|%Kxd9T-EsGo5}B(oY$YjDDY2Zb6~V|hWeAc<5G&{EuDNQmPEr) zDV7NLX*Ym%!idMMd~xp2$)s=3{IGbI`}y0jh&5g@88CJDkPY09Yp><#muK)qmxR z|Mc%0AvDuK;XOuw^@o%(zh-JDYnJ?|7M@J6cT?C+e~71eDeI?K|LZqdoRvFB0_0of zr$TM9Whzyl!tWeFmJbanr)G>q8VIeLl>3%wkxUw#*R81t!}HB85W=%sGTwzOYA}sCS?iaMJeXbe75si+Z@`hzNyYU-b`kfBr{*n!AHLjdRv0wD_y1m^ywfP z_F7t@k3q&}QJ`~)kRLQ{w1O{`bT&frsc!N+YbhhCGZ;j|H`b4HtIv7PpCcyS#Daampy=^~FwsQJ z;gDrpttu4d&!-O`Lte^5_J8m?CH$J+MN=S}p~i7?|2o5DnJcEqcU1Uc+q_Us!~x#O zxMS?3xF0{C$RcY*6#<`*L*~!bqs%DVzr^eWqe7zHO+QA3t7jW;_f;49zbe1^io)sE z_ELkzb-ug5H@J+2G&QoQ`Y|sX0GRa}(-s*fiOoJw&YidW$>tblCQ%&3@?!ZDr2LCp zBWspDZ{b@-YUOVHs%~FYcr+Dw?dd%}!C&;yBokjk;{Nse>lIOh1Q}Cv_g0D+wTCrm zO?-@NpY~D^QINPNf!SOks_e4$C5rbeFsx4&#VxIlGr~5a93|}m) zkDwFxE^!-T)QjC#itYZcE9u-o6Tej6k0p`6=^Xt6zP;0=rp9HWl-LLkqYfw&(@T2? ztC6aBtvmS&i1(;pk^-}^Mny5ha_Yj+x=RMGKIRw1VOXX)!iwQ9Qw1`}g04QyaKeA8 z^o2mgwBN8dUr!H5VSmaKa(2M1l$HFXMN?Sb^krpmSrHbgsb(JS=>sc-G6(s78!(Y- zO!+kLL;N8m70rk~*~8Yr*i+rz;0kH$xH)xkSmpuzy9MJXjGfAOPDoKZ;;-2aCGClq zZi#K=BK<5|2`dnVjq%`ANE1t>b8oJ+?rSBb4J^*|y&2WlBkxlC|c z{9iTEnH;z13nLvfJFNfX@H*koDktY27JTYO#40og!$SYH?2oQM#zUq+O^WNGVRnYU z-v7B{*!4cse!@>~^dz?Fpou8!Hzy_oP*+S5Y-PMY$Z#RxTP@puK-X8e{)sM52^$(F zl#Ka+YuRK>Y8=5o(Mf@N8f@B}%jT$;MHL8%Q)@k_qQmZulRf?!^8Cpv+1k%g3d^@Z zM`b*3V;cSmkIhylFW6-=-r2SD(?+oS_^YRF;Ve3@7s}dabNvjLsGPsSfZq&nHDG$s26!4oP`y?}hK~Z}8SN>uS9! zS=r)Gq!RNSWQ=>;g+R%Moj*pWKD<8Urx@Zfid;{DhIk$<^w| zYAU{@C}9L5T$syxTBt!Gu~XHTXBf>1~4MAH8O?4>epZCP{k)013}*7Vs9_h7VlZmu=Yege;;1?nNh?c zxsh@poLND?)8-}Ua^gH<%!G6ABS7K+>Ln(TYQb5fj<#Zf7^C9b7QShUH%?0+R;5R8pqp~ z*udu2U$W@2*lyP50B4JK-HmW5XX>pzV ziJOWJ8%y|^gE33U>i6Zxn5g?bkbH=v-VIjQ3*zA8BwP8AHgy`pfimTsDMZUxbmxFA z0ID#|BOzP9_O&_aepNas+sRY_urp%{lXumD!NUX2E|#Pe2hKNT5wtz6e2P?24W2zo z!lIf1$nF&3-J(yqb>fyw%^7*TK;`d7M!(f{U?FfETSH02C_vv6ygJS$q5=D|q(O6v zQGn?e#6#akoM`CeGz;Q_&E95)_}*R$qjP0H~5NP~~t=uub*&zthE$k)rHiN$HFY9Rd6sewyOQ?@s8 z)#RF=JJp5p6hbO7`KDB8hH5)P?T7=+q>3?kxBW)XTblfHfWBDjjYj8I8u5)@=~x0< zPbitw$$jr9pga@bJ$;9AY&%Xr-ykKWl`CxX=Z~HJzj<|Xny*1;LZvI@m5$uYwbGuV zCXabvNgW+0DI0G{J&swMnY07~T)O@dz00^69|MCP{7b5=}go+pw$T&m?qy}gg^{`iRdhUWweGlposiq@_gNbG` z3yAYk4)B)y7QWgibjaH??6qa7a@;lY4PnbF!99LjyG=G5bv-HkO&+YpY+JVFhwL@H z&eZ_}U0s{*ZXxmJ_`&YObzu*Fid`Cvw1q(0;KK@7j?_Z}p0cFk0|F-EL5FpU9vT}w zEJpG}qGfR!WtQkJ`VWlVQ!an@lhxFxYIA0r*1rOpV5j~zK9r?&d;ZYzho^(P5>oP@ zBmw?)(zn~C*|cO62noYRSusF>?tAro73?h)5L;&m|)z%uS zpAtg!C`PHvjwgdVk?O`o_pwd9K1e=MLSv#IiSwEl)N&2uw-E~T{hn|W)i=T}@P!94I>e0ArXRJ}ZL~*upV0@mAFPF%tx~_BX@YXJO$f7ag0 z7(L&@?lDJh?_&v^!h-~jxbZ!RpDhg z0TKbn_Y68M=_hB;BA7;?uRtl7=aF-nQQ=IkKaE|4FxGx48p2%mmb%===Ro}m#nDn5 zgY60{iW2oHi)1+E9KpFD1uD)wZM3Cl&nCvrEdZvP($wOohcVY&6*0+ zk`LptFe}PB=HDiO|Ngh=NdP`dEDVKkqS5S-4-QmldCNpLP~T2!;Vy@2@ti#bI7p?JR<32PFOGn z*{MBY+$KJwC=Tm3yWi1&nN*g~L_IEhc4a<@vvoEVRhm)PRQwqtGoF40S*ffO3Y@(; z{lWv|FVYf0rhO#1cjINFAHh3MR9BgKQ6bXI5>j^ITV*itz9$^djfm~BSwdoOidUsI z$H9v!naX?5rz~ZkmujvBWphoHo1B-lJ)(AL#>#Q|#R^uVRR~){>^=GxoQ8+r#>IjX z-75WLsXR35SY@TOXk$+_Zm=Y+(Tb*MZ!-9CU~kohJPtU;dj%Lm$wrafdH#em_w*5N zBcyEUOpB$Bwg_wPZm-5t_#NZCU-bS%H0U3FcpLI)X;Ir*@Z^C2=p^=816ON>s3m&k z!+J@v)ESDp>QCIW&UJ>4>~dP^0Mq*`Xs5!YQcUmMJ}`?@2-6m+3*DJk-?o{YnltE9 z3{%;Eq^sLa@9=%&Evchq5hR}~-6#d+JpZ&c%tcQR_6#7GmKcHQvT8RhckJwA$MOvw zu~#NukC&Tx^~XS@v_DW5q5aSanf+Y&u~ykmmUwvHu(%pPhKy_`k$tru1%NMr4OqLUx6uBFhmw&BF|Mi8hY0AA@8zRixBDF3tC4;x*`@b%HD}8>tRdMz5dc~p-@al8gcnJ_MFt%GpqLlT=zdT5S3<^#K z)_x~INfy?Dq46&I1WX`#j;Ojy+7mU9=9j6cQBF9jtXgR792$ z!*2wil?~Yc2#eXV*j|fKtxygTOO6adD^SZNAuBcS9g2SaO(MXsEs98_5Ut+Bq#8(C z(2%?d&uuLuMIz40OdM@pgziHp@$aOpTRh`0KCq7xclC#*0VhF)jN$E}3+&7c+#m&Z z$71-6j4wuLjU;)(0S=&AjyOyy3j5j%m!B4ks_%iX1U3nTy4>69)XSyOu&@~4@C6kXmxk(ViFU1dcB)MPO+^Z-5rPW5C)c!(JRq7ahhgQnJ z4@47-$|Ff+?^TplNCnLkxhe_o=f}v2?tE$}Tq6O5DFbzy`Z|&@e#tx^aW8k9;5~i| z%%+VSifS?S+FkK9n*PDTPpqJQX^+6V9Y8vA(j@@>Mo~3gwf4SqLRDBH6=U4!()7wV zMH3PI?0#+AA|JKiYVA^)V4Hal)p)0UK_^+yQQJCtV}?Fa6_s}i^}LqB0Y!BNP3@uR z)+RdOo}nV+J@3oruzQ5`W}@5oo>>5nX$hZajJ|Fhla(1-?2Gf3MgJJ;KKI zt|D~r%pv||EJ(byT|vTsa#4BW#6t0acq5=OFE6j+^Ric;q)PAm|1@F8DWjcNt5IH8 zPnvQMG)-4zPg@}BA1hSLbE_?p#<<@bAl;jUc7;jS=5*;cROiqQe96YL+u7`eP+4@6 z&OP5GQ#g)69#A&?G!wG%pbkxe-D(c)5;G^AI%JPqm4WTbMc){AbBsW~Cajti3UBv^ zlvC>1g%M$B;dXynS9fjRt*mR(_AeXT!`r zq2A-cCz>2Y@%%SWIR!U)KS^dv4BaBQ_$GSaxTYgUg-zouG;*jE$?loff7p&#Tj!Z_ z(tl1O5|9&kd?CP!{oufS6F6ie8Iat$`=IuIOUx2Ov})LUMgOyxVK77Y#$2)C;>lg- z4OQ#d!-PzH=`vUQ!l60Ete^vCva@Uy}fBF*1jd@ z(0i=aE&nGKlw4g$4y|$WsZ{_C{Y6OZ*!4B;A-zuzV4Vi@`4J$@jbhbyIxCBeDf=5- z?q5WHU(=9#w+cYm4^`_LrF}C8dR3&6K{t|Xs6bNc_)+@&{4bH;9fTVs}I%I6&; zaWnJmvx63oT9kLjuT00y$&9FP_oM!Vej?{Uyx%R=tjTi5<85Iv!kWh!aOOXR9Tl30 zLd;q^!flBcaiJXtnJ7sGQ<))i&(wawdW4QR@(WAw+M)Eg<0&7G(9~02f^TZhhIJPK z9ttnMhq|AzEThAe%v`^J$Jm;UD3n~yA2psO6(Sf6PPCJfiuvPcT84idymio3A)7zY2e^LFkk%+H)oUP3@yczhg_P;>v9{H>iIWD0!whh=7{(|# z-aU!L(B;UF>@mu+C!rUgDoAreqfmy5&VFI-A&yHJo-DLQ5Yx0hw=-{w{=z^)$;`ih z><0}Bi=h?Ks#^!=ZpqjnppMno2+UHn0&GIqnAsBf_#wmstjrJo&`ayi;3Dn<*LcIG z47}_AF^8}Z?f$LKYal1zb>kGl4j4j-8Uu&qx-DJjG4mSbhN&>gg0`OZD5UgPxu4_SL{w5C*?{~YRt4ye~n)fB+4 zxulF%*SH@)vhYG__eKL6+}>?xglvOsNG11Dps4|w>>nv|;1R{sdC$br-B0BlR*!)Sxj)>{oIdd} zcIF;|Bqdk0T%(`^{ zJ~|VnCy(TLD3H@(1P<2Pn>H;RKqryJG0)mpm4?pUny?~7A~B0mSM>+Apm0v0q1eVJ z93Y2FZ}N*XOHR`{pBTKO@mOmR!sH7dk?U8nD}3i6Ho1MYQJe(V;6)yPZ}@B0BZrgX^ zTNDgRK)S?2r5Qq61VKp=>F(}sX^>LsE&=Hp7`hvVaA1HL7#f6OsA1^XKc8pq|9aQE z*52Fu+k9ayX0Gcx<2cUqID$z^?98g zhPpGP_ar@K^$rWulxI9CX7%IYH(&PnKF?&0MyZ?l@ywTWO%hzy1Vzdk!fYWA@6!R3 z8wELEEQt8C*$!yg0((0j=nd^og&`;74d%_bxGe(Ucj(>%tmoc1LO+ml8mtU*ODE3vza)-D6 z_Ii^_RXdb=Wc<7NbG%34hqN1t)F_%?iDhH){O#jda-AeVmWmjEXZ$U6erG zLeF7Zz1tr*aZejPS4Te|#!p{RKJwQN zo%Guy!{-nGL*zj)lXT;ci0IkUFci9D-8_Ln{|E1x_+G~Kz0>g|aWm_QtdHpvs%odB zFqU+&Tw8(r0_Zm+L80s(+n8?{B@FEi=O~F& z-TjHNEbOOHPyWV6!T5b?iZf?%iMvR3jJB#G7U%Z&%g%W)X>1LsxskUJH7CR*)Mm={gJDZTJVV{QoWNps5a|EnG;#@np zs-|W!Oy6D=Z=rGaW?fohi#WA5(!RRyo&axIJhS8jeId^Y9bhr}-S_Oc7T9in+v-aJMUz@KWOAZu|9>8OX`(>EEKh zpeLUNQ=nO5tcr??iFben{-VPopPd&?oJrz=#oi{2FiAGNvnPdqjvxQCD$kN8Jf1Eo zrtaFDnkFKZdP9+X9bH+33yU2$s+?`?fYR8CN~I@1yI-5cdPUff{lC6d|f_nuVM&s*H&Dl{$i>Vcvut`N$0=F@ZFL_RK7{x7KhCMu(W~+qWisBM2uw|pV|Ec1 z{jt9|#4)-wisnqGlIyZ_Qr~rjP!k|}gbHEo`=?^T#xBnqJv(xiGU%FIN>134*Q-BD?s?yO)%X?gi(=De~{LZap8yatBE5J9u%Sh=wsp$~Vd*I$aF z2akT|@H#lG(r~2{hfFjD)zQ=|JHI%l|2dp~wm3t#I~o4ak#OR1I&BY$Q5}&F8f+*I z-ARt|xhFJoa+TB~m1ag>3g)$$Qk|MMcyT+jcgy8aI~EU;zjx3Z?-z8Lk%<#L5E z$ER}jkfvv)c)frNh00$@L0F-Mq2hVLzPlziw&AW;u*qsW+tNH#R5_ys-9m0I| z@D?Y%g(TmH-Q?i8lR2|LY{&@AMr2z{oc(KYBZG#fONQ>MEkoE^S$NG&RNCc$Am`TLiY#8@6FDU<3RTtEk8Cru*y?YDUOA?EPlM z>7ahVzP*XTN%?~d_j}hZdgk#O#(zDG6ZX%U|6UUB1@iYJ9~)YfEdUzfS zu^rpQz2#pXq9v{l6;;CH3QLfLWBy_1d@S*Xl0qWU9X&q+$Es(-&%S^O`Sd(Z6g334 zK<(o;FtX7%362%Ag_Z(=^Cod$cWw%v%ye?&qb z{S(@>Tw!8wsyl_QjS?eG4(V?GNij{Y@;E*vMp(z&p;b>%$;CtU(a>i;R%R~VN^6;! z6+ZTP3rCvjd=feF9N^~)i^lsJ%D5KhRwaF7ojerW=fdLqRqN|!{JvGFU8srXkhZ73 z_mSdLg;(*+nL&gYJz$*qoA1}tw+Cf8Y(_VzB@{?D!N+pxb5#IcVuFlR*3zBW0@bpL zy-^3H9T8~wKI7gd`?FZ>=EG6#id)rR?hw(C!L~&P9l_{MLvqzIEK6~tXT#aDp9X$y|pu847VRxL~u5`1I(5UK=ms5 zd9^6SX}z0@15$=p%j`P~6#UkG+|e+K;7wF-mEIr`LpJ}EsbAU1DU54FK2fE)CRK8F zB9`_D-jC;elO+hK?f_(e+EmnNLOj^2JX)@6R^OFsGQlM5GIBY7icJzG1Ik3br%|>-#d&g7%ao^}6?1$!k-yAI~`8diG z-5x_x=Ep*G?KBn*W$6=`S4%0cNhPS3)1Uy1GZ>HW@n0tKiR{j6>PAGPYuwa5j^G9w zyA2Y5@m{4#GAd9J*9r;MAG2%)jRP<2Esn=qUN^#k!j2Ru>_k_JC80b@_P`Z+6fWL= z>*c?nf3_BYYh{NhN@MYkhL;23VRHF({qKr^M30}w?Pxm4|1vckYyC8OteS$t$tvG6 zZ?7-5!gkWkKb~*0cWa7wGRpJ~A9%}1PwG3&r=a&sq1d=3eB}rw%t3Z5y-K{F;8+wI z!kma2ipK5lsB-b%9ssg`W;ZZYA~0|kwpG4Us(5(TL~g^g``+x96mPk3aqZ_vOE$8V z&9tqNCExXvg^uN-2D3^_t|Fk^pyvZHwm5kux0Kt?Hz9*h2#ea4k0?Q3*}wSxun%TW z_>K?3*|N&E!zlJlQdnlSIDaRCYqTlYpTGMo#X#9!PeOXI_3q)%IMuQ5OA`qM5?gPr zsNpXxPe%KX-{0yr^7ri1*&$N?K$=-WOy)9S~Dv}z;fV!&@X zba7OL{5631vjFtSE4b-w=(OM?INFeoTewzhSXi_}HPLjy&a-`)xXKBzqD9#;}GReH+$m7gzn@%1)YjjF~G7tEyoSl=_HOf|vVYA=jL zz}fXF{T(qE9h>h2Z&p8Y*D#q&`;|rCD)p|-!ZKAr%51aTA^nrn_W$IG5E{12gRINN z%Z%7^-w!`UI}^WHRS>CZ|GKOmX0leIzon?fYkY%v^DdsO6S{n?4;_wW(&>NF)3{MPlI2kx*f5O6{q__@J z@<2M_NnOdLNk02YJ6b+cUtordrp#XDZqbanqzPLe z8hLs}hwZ@k_V;*C;s}!!zdG5KgpUJWyNy=j`2xKF$X13-I@Q=2ua~bkP?DRK;e)j54T@iU z62(*RMa)y(ViVK8WDUItX9tawv(~gf9W8$9sqprk5HIfz?@-IJI9l6A?-+EA+PDmK zi#_)~Lha(p+!l_Trq9I399A}JlaHf_e`QTZEWKa6`To!?I-M0AZ=$#`%KbG$sA4V_ z%bSYqrXP*V+H`e*WqMcY23*7W-tz9+fO{ub1X4 z&z}ymwr7nL$_fWpx7j5jQnJuM)uHi8qb~%Yg<3l#9^bnjFU=2Ox!LZ|kKKDsb=9y0 zK27bV!QL+VdQ7Ehj#jE$k?yXhjAfOT`dk||{UyreFeA-RRz7FuG z-LM0*P1%1gMw#w89OdXu*^l!r#V{sSZe9>blJ0WQQ5C#&*4{F{(v|jkQ=M!eq=cOE zwM>&VxAc?Lvxk87940Za%$xKCNSrjdu&s@8kZ%P{k1?ew<4HLs<=0r}RqC!SbHkz0 z$V_j)RMrU1$fD|WqlG*Jg9RB9C+MUwheJusbMq5I#7_yq$@nYl>5aj84p3z+eHhoH zZlzh;(Qq;2kd;Hq2fOOnmQz)wr`c}>HqOZg`g^V=N*s%WAuxl{Iy8Y8%gJtRUvwGBtm!&g;Ene^wLQ28~ao zgRZgEZREAK0TU&6|Jr5V9P5c<}v_hjH04du!8=KuQHpg4i9w=^Yd;|u|#0KsjN6Y-!)0p zdojGV*wcD(BeTROHyhvlqsL*SkEL_;$CdcGJD-n!&`Fe)?NZyhG)Z(dO+ad&B!__> zhx$wyIIi{+S!yWye+yfa6M-x(WJiJ344;|vRz9TSEy0Df(s6oe+lCn^(fe1&9=&v1 zKZisZfMUz?1Ri*XXE*d`Z_GRsTn;-*GE^RW&HPsp<$uz86+_@3>=RhPCO(d*3qIP6 z*X4m!n{Xh6L}je|`?OC=n}m$R1A52qOesiSHT`xg{$-sFm7xc5T=$U4D}dIk z1~Jzq1IAlOTX4yGVG=$Gt~E@YEc8@bMxMy{Uqk}&;1R32Mn^UOce#XG7^}l4|rU>ewG(x8kGcCl6o0&JQ|sr z<5-ssY!mPDd?pY|R~;^J`B?b*xUttO-N~cCv09AQ7knwdCzYTnqTEP4-3TpE2tNAR_a*0*5+MiyJX2yS zrpOH27|wq;0IeC;q0RL8Phj7;$G>5P!`xYr@QYx5>_tI9Fflc*;|-QaQd)hr@57B$V;tZ?IVb4QzGeyW_N5}|@C z`^5e!qI_~?`rNcrqHBV@3;AnBu5Pu9vW&R@VFq%LAGn@ys{Nw50G9&+mJOXEL!DaHb_%y2~@+RCx?$Pm5>1Oa23w<^x zYOeA?g?M`0I~v)iAs*H}p_8J?bq_AQtKcSq8Q%|+RI+FV_wz%tlhOi|iUq#clv)%) z;Ch&pOf^|f&8TN|nyBqCP5s@58l!Qk8-#_YTc>GO;2+6Gm0A9N^LRBR(pYY-+vrW3 zQt`@W)sCu%O2;$ZMom6+4phjn!3wx1I}W)3zemavCbZHkb8 z+BSwoUoY1<`m;Zg3sY>{&kz)XBDBR_t6d&7J%fo%#aY4ZCOGg)b47 zS_+gPAT(tNe*DUKm<6XYU%cBoOo`Z@YRt}eF%n@0x$5jGX19!W*H76w?_ayD0<%(D z&8}_6JeLhZ$$`Sj76-S)YLG`{SH4VO*(ns0{M^R*D~!x3Mfdg91k)7lh4$TiO}&2? zZMdU45S#H^d455P51^6Kw9_JwxBWlb_av*qfOJUiIW@6SqVDkMaS2Sqd3LcufLDq zwzZ4WDt);i)-KC}<1@@+^IC*;Zz@P6G*63E*|Q!&cproQH4< zzI8*)Rb??3H1=Pn!4fBY36>uGHT@PK5DjkojQRul4`2)-pZwp2krYKkki*xiP0LqU zwkbOo#g|kFT?zUZlrERaHf3)=^&K@KYNv<5AK2L|IJ^krgZa^} zuO0@jyT0oQYT_?|TF&viv+EchZw=!)yXc^Ya~rIX5m^F+yds7C{s^_kk?vVv1e+yW z%NX;_xA)Pw9T5AIqZ;J}7eiRPrWnnNv=N86zUJ^~CR!B1!T7+GM|31&oj2A*yZIqP z-b(P+qk5@6_05}%J@!}QJI*VjBZs<$lh((y@oBS@P6&=x#*6z;DKZLHhul<U_)PR|imCF6sedfgnkBab8U6X9 zj7a(3DcIO}Nr+PXOcT5*!cZ2+nm6eaUxdXB=-l+}c2dCiM=2*I!2bKNV!k#_p1Tk!O3-s|YgGAWxF*T^O z2T`E~0ZzK^ExU8)!mD!=l^DaE=7#qs86hO#g72%%og zL_8HZ*hC(B@VV^IUHa&4es(8(!g^+un8XcW5U5nm_n&uo))PY<7OEXJ>J66uZ);N(kOOe+>by5P*( zUOB&s{#mI4mzBV1bJf>N)Y&3HQ-wHA^Avk{?`^qeYX_#}=H*R-O%=xS>E&5OA*zau zK<81K0SCQKFJM13>n3X1iN4DTr!1N^JjS=%QVb}vuN35UmcXdfJR7P4_a}&cUH)__ zC6V>sM;!CPSrSIOK9Mz#X9QP1d3|#eg5y*_~tahi{jwH}>8-1xT=CN@#~&Am?v~XftGe z6dsF>ZnqWrN=*FNz{*Vd53#G1{rGNCHyDXOQ6Z-(zqdkO{O=%#ktbF4La8Kr43@ax zHqy(HGDfpS9!lUThFL@EOH#0uhCRcGOq6>=(>F-A^e(>dH~npXYm2La-u`BHJ$>|u z6^r5txYV;hp**X2p5nL&X&|XEs-5@u`tIsu~Q!m~v)c_NG3t5X&oG=7O$nFh~AFY}u z_-UeK)rBTuNDk;^Y4%YA{GGsDq^NZ~7wAs<6yL@DyZQ&K3;C);L9dj2R=HlsjWANb zXk33p2uU%>-WYQ4CjB<+EGv#pn4MM1JRU2t>GCNCZ`k;ex4r)qhpfmx0-MJMw}1Y< zYnAqIL%O^n2ffUU<3HNC+$%J(^D2h(~a=R(KC5ZWQm`(8Dl?QiwBH_r8bs(|w*x&`t z*7arMcs+j`=adOcERrEN**$-Cwrp|eMU3WZe=xc*0snM*^Q``80{$8PK&jbU#DnV# z$unM^#&Rx0I`f8rPby|$GXcJ32ZF2P*ts)-OQ{&we;d|^?`x)u$-*hZ1PF9>y>$eKHWrbPG5{*^j=ahi9Xf9yCdS<$$HAOt!wA`*k;{a_=2#SKSF1eS;HCn7FeMZ zU}RHYekIOC#>PRFB0)BL5HXO7WH58DH`(2&r9@E_ij@xt7te5{O?U5Dk9JUCodBad z*pq)*D#m}#9Jh#}fN%49Kg#Ck=xNlNlDC2SRk&Ox=^^jQJId~?k2+6mOz6&%;v0Nx@FE3+O>sY9MT-KPc1YejrtSnpY zc56!xc#=YSYD%86i{0)fw3%hM%rkUerTBpn?us*7fBCVy_tdCPLhGR)SYusAUyAs_ z6zLNxIz7x7rBNE5QX~9|*%rsgl-5&i2fWcoK0_6sI!i+NXM=6Wr6Cu+skHjvA`~ zb9<1jemSURr^l{x^hNrxOPv_uGX^Gjv$Y#16I&|?)j?Hz`5$%Ew>z9;28Hgz=UQ{i~Nzm0BYPjXwn2e0cImhrEgN>!%`99J$ zn4dp@k?3uK-k8J_eHTn6MCZYqv>T1tFZA*6SJU{n7h(z&%|6ycW7ei?pK(dr}5D9YOp7Li330gNWc1Y6AeH4F`aKw zU?%M+2~3jlh@gYhXS*v+_%Aqb*`OJlHBi%I$I04k9@p!+0abgZfAm>a>D2Rq{I@%e z^p`i^k_!}_SwS9{kg+EmrL6NtglASEmk`)FX8Cj+Se2(pEY96>uiIjT7DARQrf*kT ztQ8pZE9+Bw@H@8*cX>N@0r>*4!bYO+cR34G;wz8bz(xErX+RA6@=f4r1yoN^s}WO= zY&imKI(_5Ka=QK=1Xh>*d<`E7@X^;xxIR{&z3Z3ix*NihW!X;=X^CCUd+`)6D@7Wa z&Rs>_#Gs2I@F|Qj=UKQ3Wmxw>KFgED^9hA->cS_QsO_!wHp_8qug91slUIVdiKeGV zMCOy8qtlC2c872*$vtL6Bjgs9Ocqh51Xlx9#ejy+yO>cuPdr-CPgVp^{)9J23Twt# zt=ebhjlG|J^nLL?TX)?@Y(Hq2Bc3oMjw=#ZzPWa|Az=x&nrh@Py^8dUO-VRh< z+gky29e-P_yXxyt^<|8u+x(mG`MuOlWv1%ZDfo)&wRnVMPg9M#y%smf?Wy2Z4lL`_ z%G#W59h)7fi>bt6k`8#Kg4-s8c!SCR3=lRxjJIax3N!fOyWpGEf8bcJC>{IKB#tI) zW8eyBE*ikG*5R*b&t>2La^t#Lm9S%v%N#))TFu7{-=myDlX? z5$90`QEI^0XHSYD|fjlq3Z~#iZrd>*1)=eGzZg7S?>kq0h~5#S|ceh}!Zc%+!}f zZ8d@~z^sXw&2uJo}HGA-24m# z)Lq!N2&?8WchIWS0#dP*R=ce2?7MF`4)v=33#X^lv9Jm`CZ=Az3HLfulvu0L#GlXksC9&JrCYQuGU!Ne^F;Rkiw=)kWodyr!mb_ZTf7W z+97wl`N99z0%)NQLmqbj+O=Y-^_?h*am8qxy2!Nn%~NU;Ryf79XLlCk7;Kv=UFx!V zoT*#+laRc8U$`|@IkQs)(7LEE9{pPK)=zv%dW zYtI4Nu;(zA{;RG&Ych$|AE(T)g$(JY0Mbm+f78tU+9Qb^yB8v2*4Gao1j*l@a??s&B8j7nTzI1fHeKGVMwr-0ND`)2=v8NL0I z{%JmJXbVj6wamZph<9KEBDm1Ss;^>K!ez6C#WX~B z=MOMkrF@a|!(3?X+Ti|`8C^{T2k?Xm#w24@qR7F%Mj4f&Xa%bvhnEr7H@6rgw zt0Er1=QUhj;Zs)CbO?PV#NhfzCb4{V=G0dKbh*Seh3~6Mm1p*}!Ze873uGW^(jR7k zRJFU{Kg3tP<*ij3qL{%btdcPpe~>M{oZ|wohrcfNT5Z5eHylmOsQJ%d7`jV0P31 zb}vSQ$`?&X2%BNEWWRRbZIg|J+EMR-#*^>zX-#&=Ke?t-8tj<$?`qD5nithWn>t4- zC&9)Q#OyUD`;)BdwRiD5M`Yp$zkKnk9x0kw<)x1{g3qeKrzUM~IO4WUj3Pp9vdoRE zpJ?Q^9oAL=O>|L?xt2u}Et%aLyYYSwDn4<S;9z4yiOht}@bcEqUSdvj8KT>%%ro2qQdZN1m~T|X_x&LqfQGywcTK08lM zX(Y34Pl`%2u!9y7vVFMnUs3KY29v&opxkYQNQ(~jyo z?yW2x6AY?fPH@j^+Xq%#5DQkNs+fNrE4pR~cOR*Qoex`)g45rZC)1kim2rvmSl`I> ze`#DLmiAN9*Rm-4F18>~Y#iv2e!{jKx23<>&Tq1TqPV60hwWvYA#dH@Y}<@8I}ElgDIyXWo*mKx+Cu-N1CXDXzOH7bsUN56F+F$uJv zeS}yUIxcBb)_Qg6+g>He8K$E?7|%NXmiydP5cSf4CTnqHpO-u{FOj@BM!1M}H<_%Jmf)GFD4T2D^UhqeAs_Xkw$?mLs|KP^ zK_&<_BtBnhZO+ffs%37e$v9%P-4?AKkbQc(HsimvF1M!a-%7)KwuLpM;+ixDFwK>8 z{t~KqF%88_vM8fx1|#b8>~~&tVWywN*S=UlWU2h}S50Yb_#kf{L3B}jW4=Y3vAJXFx<{*S{&CyVv6m2DLuDi3@W4y0YXo)B}Lq1Pd#6kE}d{_&Gq{sLiYdFuWrbDn{A1@=wD$`1Ja;QYO zeo5YF8wsk-Dg5mDz=||nYeB)xFSYWz%#|?Wn|@{wY}%;73#WWAh-czcTCB0RoE;#~ z9K|L<^+p2ofe+oQH(eNzqt0zEuml50mdDZbe#oTWAF;gO;}EYfPEQ5RUpH^vk_gNE zGXc`)<&M2)%#trG8t5<(ha7=vyGjSjwwp?Nhh^qgmz7&}W@ThEFPc#4E@h`xMuR#7AvYED5v2R?X5~0~C zQT#q^j?xJHH9-?tYK_Wq!n1$wuWUtxC{lLro$HIOi&*E$;nB9+rl2-A66Lf`n^JDB zv|Ja#O~wxs`mdd??RAqLFJ*clssX2&xR+d>o!H^K%D%>pXnmix8vR2`bX|0-f91VU zY5WQm>b$q}dcEdz#l;dIe_nB?dx?oaod#RboM4Sl$k~1!x6XQrCHoidq3wStcLO>Y z_wa^sTfbcT6;CK>@~+B@kT_Hc(U6zD><(Fv$0)RxWCXWZ-sFpj$c*ec{MoE$z=?HK z=-q%{*c6Ub6_HWY8qYhIVsG#_yKO-Ketx3#;8g zNoX#gb|;QJ3DXe8mxI;Z^$@`{+Oi{UTNP)4CF9{8 z4^*pdEv8;5Qv^oj(}YUtSM!5DPfDST5Vp<)DCVu=DgWQaIssXPz*RlEq>x2we znxhzMM21`Qj?E{pn3hE?ngX4NUiiKtS{>6TEN|ws1e}9`eR~U{WxD5&dmY)FmDW!h z;PDr{j}N}s(E;Py8d?vP0TGqQ_^abNRVvrY%hD3-Aw+pRoI86z5bokE>69z^L&wls zhZBC$reSI<5$Ap+qm>80vsIs;kKZS}R|KaA!(7MLBr5@*?b?Rd*ZQaRAn%#tbaQ{p z{PkJp*jD#a;TzOO#h?B;QXSNTcI)KIE^UFV7{L*!O^!)b=oft|-Ny(gz!J8o0Ak_e z5>A}E`E1>&MreH1)H%x!x|4minVpD)S8^F#{Yv&5lsgsx?XgW;vn(mz%wG>PD`2?{$sXcBs5IR|u+JcW=^;#sll;@J- z@`?+~RodV3v`=^Tm}r;hukB1uA5SZyi9tVt-K`aUheqARi4JBaDq=JJ;TFN-q}3ov zxFY?KQQUM5nQ$`4q(aDD4)w9-1mLil%)%Mri6Zk>f=T2ym-uz>ivg*|o#JVcrs!cC z79x@714-voCG8HCBR7Sn?AS$tB0V?z=*P2cVPN!3yh)k9HgUM-x~)Tu&O6$ z9YVtRn5O|y!H~0IFVC-ek_s|Cz314~5PbR#savjlz~iYsVEZle>(&K0U)#Tn7Ibnn z5oY{jX@2Ig8PWd}<9}`imQMF_lv!S4uGYZoZvQN5SQzWrL~zT#?R5R%ayOuT8*r$- z!ZnL%*PbZ~qBQMWmcnZM{rDD1sRsXg&G^xt>U%>hbowmUR>z?>W;(obws+7s-5JFE zdgiX*gd4ZtBfVH3kQCp!;Zlx9?!o|f74#diW!=(<4sTiYBbV26K)fv$UAn9M+-Ik; zDAUtjQNWb1oMDcBiCRx*HYA+!v}zQr5lE+i+?|a~jeBhzhrMUPl!t$s#Dx*Wp!r&T@~ zs3nP+z^D40+Z-nGVI}g#Tz0QjwB4@@=(m3jrQfe@dQ-PCkbEJ`P&mno}a@8X06+TocZf>(~?eT2T*-8=EM zZ^nNf9~McJw_xl7CibyHP_@cRD)Kl2#dkB!PB8OKJ&eTIXTuvc|G-t8O#7x5YGEU5 zBR?>9yrpiuCbqxm3e)Mj8*9b55!LdLilI&dzqx1Ua@SS9XG0HE&%2Et6OgYudp=&; z6BM{)H1lKXgiq)@r4qaMSryfMr6MJD05DY;%DL^>B@w9>1HEH9lvz9AkSM251@(f( zzVXTM{k~+;=_hhIl7h8VesR>*TlH8#mk9FV@u$qV@rDzV`&4#uwiQ-uKCeppqQrt% zH|j&vKR)YoLZ}T!hW^U>_yg5uIrc%JQ@}s9$&TQXG5snwZ|fx8NbY@8XWuSDWVgeVM5r!KmD_6~tBaFy(qSVmIc0HoeY(Fw(~9Q_x-9v;x>n*K zyJ4ug$NEmaiAR*7&1aV@%*PE%Qq0c9tcW%2fw{s+R+ScWc0lI3h_w6{u1fa@Gn3FD zRf{RBP6W(~oWgF}vpY>MEmH(H%KjOrW!Y{isA5voIcS}_M+X;F|0g)jTU41lMtip^ zD@EoS&#a3`zWK$&8clet+EE(c50&00w-0`oVwZeO&{h^R`X^^h_cwl;+mj^Dn@YZV zVff|&14jLhNautn{;np^hP3bkit4m!CJf2H75`Nxc_9ygRIx8B=fDUt|2cEH!HIqw z`*#i{pS}DKj0dbYoJ0CCzpQPH^}4xGZGEG(8A27OZL@~au$_JMp5$ojz7@UJqxeLA z=a|&C*UW@>7X!ZPd95X0UDwPIu;OO#f^`trH%%~zI()^WroZnv{k`ujrX%c|F#_jD z^*R^G_YN)lGJb#+-%2^a4oPWcy*7n%F(T7wmUYY8Y8aooKJlLpUB9dQSZ;bs!$4L1 zGIcD$!5^E>U!8P~JjT8MOvLvjtOTG!0VkU4lz%?g)>6 z3bHA57Q*#VWRs&YShvamJ+Do9{f|K6Xs!Xavyz*)8)Z*XW(&tNsF4j~_N3HJbN8Bs z?5j#aZId2>HEi~^?#?|)N^<4Y zy&=!uC#KC4D|WQBcCr%3b=)>Bc6kR%eT}G0<_b79xH0J8I~va59Ct8ha8*#VD}H|B z(zp~xKTPVs7krSs>!o~Jqu$K~DHR@Q==SuCX|TLHuTi|3rt922ruOzn74vH{ri z>p6NEII`CNh$~ASjx=~sMvVr(O@Bha#Ff+9sLx#Ewjry`5?8D|XCt^}C3E*>_T{z( z=wY@^8pl4Fe^unr_HBg7QABotbmKXT2V}#8HOfczG?&K*jYR2-V`+QrwmeAG4QgA| zKKD9H92qWy5*kvrPMlXiSCy(7Y|}sdqW1zj`K*@vCE+&m@Hk<2?7^SeLZY!#l}Wj5 z#m^w}NyxYoxM8svh$FoQTqppvWxR!0)>xvqJ`7doMdQ@-#W|GZbOqz!Y zMH!Yc0Rd`G-1qkw{0>!69d{Q1>u0nr48ZOHqVAyTAinb366| zQmkN`5pm2|*WtS4Qea&LkwvBCWbl&4#m;Vmtk~AKa;@G4LB6BQK^q_doDRASJ6u2( zM)q~7Bl&GC&k5G`Kc-WhJTm1=H>&hpNrKy+eBonPLg4V%qeOKyIPWNWr|{^+XpD^Y zzeQ&3^xv)^OTVfBROk=@Kl@a9G+)mxi1}JS^`rgpexE(%q@pN=zE_5>joVN8R$nqT2D);-Ua@oz%;`}2JPrl|WOQoV!wtc!J(4RtIf(RMS0DdT z1*9UI8KHl}O?XM!@azGxC5=ljxE>=_zHhzK^4MV2sJbtpQHF@VoX6xm#vlBsEsT`4 z+zkf@OYu;x=mGf?_1&dJW}6tk*Oyk+PWwV%daQoCb?4_z7y9Pn{!6BN*tD~}t0as_ zs#qSY1U3~;K@NRtaQ2Z8*?P%^N(Ge*VSeUs`OR_5P5Uhd-gZqpbzGjagOpds@70A_ zWbB_g4|Ik?YgkDPvRzJ@=O zkp#FPvQBwzTy#tHr6|tYH`@)<>tCNKfta%>k7R;hR7#Nu{b)Ix3fR`E6*un`I_&Pd zECsCbgrUBM9-9Tp+EPnyx*uaj4~+1MNC?4d7EgYs&T#OX5Zj(rCqi*{ z2d6NB7&DGFUeatK!C~6Me4^VHoaorcp^*|aoir665TzPB>-%}HUCan>LNiOV-Q{_x zI(c0YhY{Q2m2Gi{{q6#cf@GudR>(uH4{=|O8s>-Ojh$;l-18gIFiC}fIqh6U6bL1_P4t#j z%VqHc0;OwyY|D!Vc4Q_;Mc$~UWgk5_uDT>0ePewNvPsXxnsCi9-Ao%)VxuzAKmL-k zx$^MfAW9BoyFdXE;@TddZR4SD+p_T6jQa4c5#Y~Z?&s1F4m{mCvZ2D(W0{45v8Xafh@LDqUi8JSo^c&i5)=fGoP3Y9r^B?l)B)H+w?s;28|) zf)h+Q9v>{6>RE)e#`*M&C2O=SA8$3?7W*C8HkyynCN+?)Rt-}W18~mM=XAFWu0+~Z znJyN?lPIzdR}c0~m{t6*kFUdV&)!Onv+3_Qo0W1vdS1ry$ck}qSY(!YctJxzO79Lp z!AB*DOW*jqDhy5Hjyz{hYd-=c^+8Z*-Rd-ClN6_C+-A4Trtx8{gkMP{A@Z#PDP1J8 z>U2)5JmpswwR^*2KexDgC0YJ#*bzphEC%=OF}cFnuP+4{9B~{_!5=x^C*)5#^=&5h z%w7D`g?&2iA#aA3hV)1Y|*f82IOE#}Yoc){lV6 z^Nu1E?&Ps_1G`$il*5o5z&2;?vQal`cxQL)UfEsPChc{Pusxytp454SqL|5u&~#m1 zpiAfq@b9%?v}hoXQ7GF-rn$D}Vzz>e$q_p@)ueJ;nl}7)jy|{&o_>9kJ-`U8ooGWUfNBfO|Q8 zWdk^2;SPEe;aj!+-i-|hqwvg=%|M68997K%1B^|}S_BwgJJjbeWxw6&vLef2q1dIf zSq_~cBg1g-HIsSkpSD6OjwcCX6mu^~{ema0L&i{+U{+9!B6vH3Jco9!?qJR)q-V>u zk(69@W=+n0sc}#wrEg1VMr)Hh23E>J0RQ%FyhdpQeH~){idI$$avjK4vxC zKfzQt836H{KK4F^@Kj)R-r6l-lyZMAKi?gveeFFfkdxB1&Xfoc0Y zt+#4doCLJ>h!alfz3yYo1i*U47HVmj2o);jWU%_SMca|ECt<73X9cfZ+i~)GwEObD z)r07Uq3PX@lpUit6XpW^Dw|GTrlB`wn&|tkb!@;6awkt|aTV)0ZC}XF(4Mx;t$ACP z+M@*ENqadHhhJq09ouoet>lC(;Qrz_G(8q{!$)uS>*Pq>9GqoOJCa!_!uBLgn++!? z3ZMSNg~q%)Yi)E0Cp!OwLJ26dnuRZ~UiFqH|2=Zw*(T{#RL(t@kv>jG*}jM0J;%-h zVIx6m_(gVjKCQ8Haj6iaR;G}pGblOlnAikyUwzFTjR&8{B3lTb$!Iz|m?C!<*hBOQ zMh5(*wwh`9mr|>y-t*rNi0*diY%#JJdu&B&G-p=Qah@t#V!Mn4{?-w(^fB3w*srUx)T|qC1N-Ucf#nH>u^qVq$t&g=@ngF&uZ!z z+J57{EXU3&WTPP)UER1_#2(D_e#52T^LCO%5aDlGof3o|{6MwWLIckQmMD;Y_k#of z95BDQj{4N@dO)`c`)RHwn|4!nlJlQ$E|c+^!T2TCH-`(gsoSXbKy2O@$jKa|FOBA+ z#BE4ZH{o9HAey$;b1*!D#jd82dcA2HZc3TNYH_AbcZ4p1+q$EMQgx=bG1bw#1o49! z!S9zNULI&>YDW@YY@X2C(SQGCRny5qQtKDckep%dE&ywwRB$B#YxsIv{yms1(Z@Nk7skWP}^Oz3%B7NqXl7Su=rj!|I zM1ces>ZVl4SPg}aC!7+!Xr$KOCC0!D=7H*J+f?E?G&b2aObF*1%#Vp7qmdp!+yA+% z(m|S7Ya1~J471cv57M^%(6Yr1%l?9op`HZ2YY7K#K-PVgj;t&G)fjC>6x56K^+>G6 zO_SsNKypzTDxH}&)eF*#j2EG>>=}MF2I@NmOj?py{ZyG@?HITS1t``8jItC=4;nYb zr{7OHE(nc-xezBrPVek$E9Fuyp70E0y0c;NT zAS`n3Yp9NjxeZeCuGh1!pu4oC(lzBm762=D<%64pzA8L5AHCi>xwGYf)ob~)M@1)= zu`+`CGT1Q(aRlIKFXjJ9wg2OPnk)IgTD0c3m#j(8GNki6H9IcKlXZNPtFd4IVLhEa zt*A$`$lUl+Hk+B;bx%un62S7ka0-0H+*&G*eZXvb=SXSXwaHFo8VF?8>WcUA)U2J+ zn{F*urjGZS4>Fpj8v>k=&>q49?pmT+7c)jt5!2#vw7NTa zlss;;9{@xW#bL6G?Kx324d)w4ZzSS%v_}nMbK1+MQqBstW-I5zq^ef4#djJ=ef#+4 z<-srtUg7$)Bf=@K{a{Vi;ZkDk4Z`TLm%_KBRc8UGNs@r4eS%LYl&%uYpYl>_`apNC zr*riP;myBMM&nb1ehRc`-2}sP51$6^B>S&o1GYvBEWTqk_;Xf!b5>K)xc z45_#@aA6wD_`S8vza1s=o|xguJa-Eq28P=|V-GGb*q*KV~%QO)mbRPv3NcUZ>I8MMqOMY!n9*1zTR!Fh) z%VyBelOiHaBzFenx?wn|*8i4&p`K{sHoW&aKqMqEpEZKydDtD6i6zNU;*&H78q2g7&4d!21y7__BP3vI(DjxCl^zdCrmq6{`E6uT>8w9)(G zlFqZgs`Xd&L#O45VYYo&7+oTih7{z_yO`BVReMNjjrTHe(Za=`Wq*5iVoVj)_Fd)d zE9*(RXJ++0aY>p5hGa4|wl13iQhUT`Ak*cUS{*c&V3~7t7d45Zyj9U{cbW;|q00dl zPxq;dXGT*oG;*HrIkkWNX70hS9BEJ7u=U8M=bT~GYAb*qOCR6KM}lMA=5r=_IJ^M8 zAp`tjuk$~82TCskruNrlR0Fpc6E3kd4Q;&fd?CcWl-?n@zES`>tqKj#Vyi!jxnoaf zZLc=iksFhW%Vs!^}vPVG-0qyW^FGdkJZxOYP(a~ z546#pqxVPesP@Y5gHIY=)`2Z#n{uhxq7+8L71(qi0Xg*Ry6cXy_1Yx-o@uK0o&!h1 zE!lH_!GnZmT9>o&RAe5AbnjdczNNHy!#qh%MRJ$1+m~Z|z;Qth9o2N0xIf|@p*9@O zSI>C5d4ybX$9rc{meq@!eBi2J$gQ1d3m)yg$8}r<-T3kX`cI* z&)7J>KR$0>zt#W~MC32b5t5^=h*y=N6)8YC9L1`?w1dkRu^W-YdBYV$0%UC$68-s# zf?6iFr!LDlei^S?;mG$~eOl5H`-dZ?ii5K>M+|eH{2%-BC$Z01B?HEJ*+l&sFU$Vv zwtGMSpjtxx+6^W)oG$B0179$cQ5&r7MaQ@IOhbNW9>L&=NsXkQYIO2G4<(1!yYVUJ zO8aCN%rTOQkjI_;fqnmAzB?Hpj?P%arUT3xRk6Rlq`wH<+7de(td{&!;Dj*5m|NdL zjbH-IUh7ac+TDhSkGy|E;@xe}Nz!g&W`O)Y>Y6_Hy~A8zy}XlXuJe29jO%wNy*$ zcQJaW2AeKA>?Q++rub%mM(9;wE~6eMcN57tTu-(ZtKo!)XFb(`o_jk;kyT6PpoIqO zyf*e}pt>a;yj~@%wPZ4nNPGh74N*%xOA&U^W1QWtO>CkIfI;0S?OLa=_2YOhv?vxA zvq*lHi}F)-)Q$ehxZhz$*2DKe+@S86<}+ImiMR|(E??mof$JjFYxSZQX_r@f7eWL+ z)7LV~%EpI#>KvTC_VzkohT6QX^7l?zw>h-bsuXG}9V?C+$%UrgvtmXl(u;0Ri#2i~ zSVCzN)Bfk{$o~d{F?WHhJl&OS^w-jbgqA0v2~-rIQyCT`CJ9!H1dDo!RjaZ*n`d$) zoL2w2l_WmNsUaR(f?R)}a`KBiIvIw|v#DIvTwFE@%kTAq_M0`bl*iMQjoI9)cik_R znfPSjZJ-Z%xiUO>EhJke{C8b}^0~sX)fhL19$2dAb)jWoVGr5o2cN`y3xWtqPG{*! z$G?5H73vIN<5_EfAZ)R9LtmTat<~Ln_rYLzWy5y#IO|wG4dnPJ#9SJw0^V0o&EIum zrUbl-kzL1Udr$(W_2^-FEHY%MtGaNdU#G0`>DPg(?{F;^#P;S}pZQUrUbMrlyDBTk zC~<*J;YU_S0p>ksywfnQ<7$#f1j*1mqMXNt+R)g7n}5o&&#}tP7HqA{W8aEU(I@sCpYYA><7M3CYXV{tuPRg^xjJ`nm@yXthXtv zW^c_`5WS`%0!GF>&YHE)WoD|VqRAzN=if+)V)K7^{uP|LWrOPNtO56@yl6i?=}D0F zC+U-rg_zz}%S1_cC-eCFJ zHbNyH3lR~_-&Gw>IC=GjIdMh(-=@k-bih=Z#Rh(kkf<(NF*2=Gk00QPAlb_vhx4!Y z^d=3O8jc-Z~vc=Kcp0pyM+xw5yaSL=ND7FsqNM4J87=!5$0HF_@b zCU{3W8~Vk|LCr+-V1kXRv>IRbRoJI56P(Y)5`E}aS=Nhk%$eL+*u6_TwozH)X4~&1 zE3@{3oaL|NMRG&BdduO+vcJ#6*MO}w5e-Pw7V+@)i!es9=d{PJhG#fae6s6aUg`9{ zxOv^Q%nQBe_Al5H)}?b;(Wh-3@VD-ra_su%XGLPChpcO6^TYxo`bt3hD6XPz<}38@ zgXn4UR)9#?QX*-j$HQiuY1i5^*vFJ;E_19yGgp6L$a4Ci73y=0W48vDBq!FcM*8qW znr>jy$t*dp-`~3fIa>^tVdTh-fcufWh)Yf97$sir)HM^P}M-qZIjXT# zQeJ$1Ng|XYxOwfT-FE(@LxeJt??Z4=e(K(}RVBT71UTT3Aowc|&&U7J? z>ySYpt)rIQ zGzR^6>vEm6M~|w6+>;bh(W0`4XzNSMrkk7z*~45jw}qTvKf`HZgT7@4DJa#pCzMY? zmAz~1UvMNG+23e1i@jH{bYnlm<0pHoERgLwyeOFkby`fKJHYN{%yRAp9jSsBKLl*6 zuiMqFaP=34M$r8rQ)&0uuRkw8u}OL2+D@z3ZeJ8!A$Pt|SyHCH(WoPHwiWIIb`sVqWIq&F46P*`N&Z=mOmTkU{#lFyK1Y|zBR*v>2duH?yUva`AlzxQw{os| zT=yw<>4Zu{>*c<)nt3;!G~i>K&g&~q2vA@KSr!gQoa{o*H4gjy8KWm*laO_o*(o`$4Am_wdiz-Rku;Utq#UmlQ7A;iSx64LBblZkHc)i_srTS)7LQbnS0N1;-8brM54LZM(k50_O4MY zS<5t!P0j6aSoqzLi9-yS-BS*5U_4vOd3dP3L<@UC(iye2#NCH58ci&aPUcyE zL(~3xL;hQYiAjhdEL@|-_&%I9+)DfKZj=8*If-QJ@w)Km|Ygofz|;07B^{e zbgioG5X?}aM;6vdjGU?dqM3}yG!!sNMyT5s1y<7JmWVyCP{(Dby0pjuJI&J85|MuC zp^?!sHZcX3V=Bl&tRv8U#n`SDSX57W5P+owcsOBj&Du$CbTJmPu55Cr2@PIf_t9;G zA9I{vV6A3{agtEqt&SuzBCpYg8FyE*F~kzrWLHYj#Mm&S<>>-5FQdMT z(y*;ZJ9!?7s5~-HK5Q%pb}HI^Qc-wmyrfLY=@4epj!? zQ{Oe5gD8enYWprdO-&p!iD%k74iRt6YdEQfn1y>Q*A6AacrEnXQ}_H&{;C@6b)@~i zh3^$QAAWqqQBfif-;PYxrv~p#$*cg<1kaY#GxEl!bIQZ$PKMjEI<%Ho$%p-iY^ecd zu0>AyUBcJz_Hh8?vp3aPF9j64Z+qm4y~a_^#ICI6&Vp0+a#Z1wbl@i*zPZ_VOuaPv zs8n;bD6Ni2!8zp>fbC5~Mxp*JZSC3k*$ISC#HGl23-wIfui0B29;WbrvD{L&uWtP3VGh`>KVDt4~8CYMN&0GZP z?$|5ysM^iHHnPJ_M33mQ4}6Ly*+b6L*e=0FFnjCaW3SLAZdRqOsMp>;`>q^2W`*L& zE!ES73ZPyRG&`&knr1w-CAGW`&N>wxSe(+wc!`bhb*EI4kXMpLuStz@)pSfEv^Fbg^A}zBe$)A>JwnFe&m^U+ zTb0FRmqa|?O zLeo{DDuvW{9`q-g?y_^QAlIrPhBARA*viMRJEEVz2b>s71Ke!RrD;&_NB4_&+ST; zabOK8GGCXAn~&q5otJU$0;-{^_!9l+WfZTS*opZm_GSyWNY?2xVIO8U9_!o667xZ8 zxM}KL{#B5n{IA(`%Mulwey6#mi-7jXl1a?5^&Fdu+B46yc4?>Mi4UcBDpoi&1h$A? z3cQzz3iH$~EB`Oa#Q%RB^25s*K*{_Z-u#}Bdk^aTtRh1E{lRYy*ezO{V|qMD*)oOC z^qBPHS8ZOyPF9nSiY#$_F=GQ>-LN!L!q0KEskkJ-mWs}dlt=)eXxPivx808fr7NX3 z+?&=Qa>w~vr)ut`#Ob-SEsy%$bR%CJpPt}QT^j;ZT~=60w=Q#bKp#W4hSXDXuA53ux7`Qiazku%@xe-N+5^jq>?0LKomdet&jq4dIoDFS`XD z3C71Mc8$!c+&i6ZoP5bIh11$#cUh3@1}+J$Ml;Wp^O17{P$6VvHV$XyT+xe(@}-ga z#p>34(e#*D%?ml&j_oFAoQZ1LWBK$=dE5|cjgRj(^Vj==7REi1(iAcsYASa$@5?~G zLHZuL7zV*x-qvRIBnV(#e+k2QIER!xqmLjx;Tk;}n!gVbc;0hQbQ5D@^vT9uMS!6( zU;vx!Rj*mj2#)*yk8g(NgHlXA;t9F(qnh`~_5y#D}E)Qq;c@c2T2mJlg|^?Yaiol|e}q{r07W6gO) zL-sL8X(WerMrSj_ymjPhtx%@Q#mSYehTcGM`Deg!5Ca9)MT>;JoW-iyLi3lll?F(U zHl{KY32B{h%G6oNkf)JlriS>Q{`=pY<=;v~Z0U8YmDm@Ai}*T+%0{^*O6?s9xE-3? z{R1yXh`sjpSt&9mqammD1se5y1< zb98P2_}x}8_CRRm0R!?wX*G?7fY#CB^Rxku1QDAzquJBG%X0tr%ma--aK!?AKiQ-b%+|kDmKM~-YfhluoMhb@(*xRS#hud1i;HdJ zKQ^ADD2Y8ct7rn)c8#$EcKF_5hDVWjX>8_qX@}kqCA^xV-9N-J^$L76lq?kYHp7T$GcsqEdgSBP)eGFt&+e$b!2A@))2fJ1G}+_S{)i7-p{lryI9U}1fps#XrK zXL>#Xpu?i~na`$Ms;$QxMTq(FEzQ|JFNH>f?+hmO-RGo~Aa<=NS@RVUysc^CEbS-6 zYGy^2TsuRjED0YDB!ksd|!ER;IMaEtTI1G}3w?t>kTG4JUy9gaq;W zh0wQLP`Y!E@y-8SZ~5PLA0W-f1rGUxjt1rJ+W+K{1^(%$Tbmme4vtVv`zwqk2GA5l z6_nJ~>3b3@fldteSaDpd4yct?96D)_?w4{WNR%q-nWSxr+&LXdX>=d(W!J_O>5aba ze5%bDy(=#~Cj9IHHLeV**!i^YX^nb)7~FsplrVoY*ofg#^_Qc%Z$P>tM2BO3pm=xT znTeu;cfFZ(fgx3b|DkgNAX2ZF4XRc(4vzXGs{`%nLU*9Yqxxt0enC{hYW#FXAOZ`2 zGhH90(f$>z=V$3J#SS!tU{g9crhAhgr(f9zpLDVXNMY^Plit+oFq!5VOEG5~rIJTp zQL3q<19mAcF^k+edp1Y?WLjTKxp1Z4?GHD*9{>F|Ky5>)Q z8N)uBW~9Sak|b&@4j3>cZ4YK&%eN&dmh$5tS5zGSuJB0MWDoON;&p8PQ!L#0j~Ca{ zE$!d{YUmO{Ow^5xDdB6wRtq!F+woUIMW9KTf)bf?JmK%NqYoS3?{1;w`0!T}N*)S3 zXJSk^{9D;M&iXUP0P;-HRYYC=4d=mUt##SXMvdM)AAtU|$^>b!jiWf zUwk~>VO+%bQzLK5)l2LRD3nQI{7~gk|DDJLsRQR>TB-E$8}S+}@L)AUk;|bdDG>9* z*u!LxIJ-kl8KCr264!2C8Rasl%BrLK0A;%LDZ^w}C&UO@R#jaXVDyDG=Z3shZd*yC zt;(;?rw4jDRsWj>kV7wNG*$DH5`d9)7&mQaV-2dIUugu}QC{psdgrWbC*I$*7b+0K z%9k>d>wczPcGRiN*wIXy`6DfkH88BY5WHEIJ41e=$!r&hm$uWg{bj^>n!;eSFQC~M zRNc?1T>SE_eOT~@^~>B7TZyHtKd?$5(PS7sWHvV&C<3|smv`_VQK_A535S36 zN6~`kgeKkEi)mKtW5Y~g?8QqL1k9G%K7g#VVJue|=kkjlk5SjUIVG}S{ER)%mK9~c zY5?kyjhb!A_d1a4x*>eI2BWS54Y?C8CCILDXw5yeq!merk%NzTb@xbG4L3NPGfv#G zrfnY_X6UYQwNkEun#-#XN%oi`L?Ufw%fOr!`9Rc`puk;@5ZjNQMN5|(U-1)4b}@dE z(n__`S~$`JcY%!&T!~M_wWGYdp2Sh+!n4#Wi_%;I4E0& zU?r$Bd;x;lzQuQwZIiLugxULS*{zo>>s9DQ*SWR6&Rq54-I}lB&0oAVzYqnY(kT*f zJ2%_vnfP%xVb8vU8&ON;GiukruKFI@p zE>2?&r{Eu(4G$1S6uso_tidd@qxNmRCw7ZHquXd?8`d1~Qq>Kzhd3nxB*N=Z2_hg{ zbF!^VL&$)wiclL>uw#@x^?kOZ3rpo>xG^HdRa2=@^;E?Llci0+BmLuN1yrpkpGv%F zIgN1n=HVErB$R0~JS~2=TxFG5P#r5v2f)IcBehL0^7(arT~D*Wu4L=K{}`xR&o`E; zbDx>@V{>edv@$~`@f>F(FF!pPO5Fso${f~uMFJ4;xfHr-!$SOf#D4`(9Z>LSCMID1 zNhV`se7PY#+?MG)tCHsFX_jAKTs>u;EyKin;sdBJWgVPewr zuKtE!p_A#N=DFl| zwtb+dyk;1Wv@?6%JvOx`(}@^gbL~2d>4>f|PMlM2R<)CP<6ZVG?*5YKgF-z`^l!w5 zgzf!VM8jF^vcO5=TvO0=pVjg_?>+ke^Gp5z{*$=ZANh~$PjKXk@T=^S!-HECPeFZZ z%?g8QqF^IDiMvAvIZhHYaZ>Cv zxyD;F?${T zk&rFiQjNMs?I6Z_48n)zOG?49dDp{BVmqXw>l z{k5sEZnNhnE16(L+C=>W8BHnoA{!j;6ZuEzBe{xK-~PvVl>hV+0DckU`Sb}> zuS^Y>^NoZoFSm#zQK~j~OHW1rN!9!t*O|-t0>po6bNWA0HM5GEEg#Hal!5j2zsk{o zJS`WPW>MGSj&}JVHFu+R5p-KLaN&==DO+JqNnt;4IWoqswELt+mJnCaOA5WBzAJWS z_r;oFm~mHkO&_(wR?n1OpS7jXq4)WTGFOTafx}{0L^8SUusI<&f@g|P`qg8q++ATg z!OrYkN~)4;xN$C)BFQVBVnY_HJcR8Fd(Z1%ODM!ticBTw`cxZYknbvhNte~f7M+i$ z?iSa=Qp2OybPFck#P6_{kxlzHDxW_KWz@tFEfR-LIloUn>2$!dxsZ{pKHb^Nu?BJ< z$vnSuwDoD&bsr**Pwp!|2-kNgDzvz^biF4#6n*JDU(9uC?9Cmivc-r72EYpbATY!N zZ}RbA#QKBkwGV%bYtN_utV6hB1CnG6y;;L0M#*E5*1Yj3w8dh0Gfzg6XffTaOY#V5 zRCv5;%#xqT2|I{A3i)B^TO!9+!-Y`KQLQ-a)r8dn%>YQWMMGrcine#>NpE9dQ`0yt;H>h|&=n40*yH^kVH z%SZu-!V2L`fKC5vzV=Gwbs1l$okpfxNH1F~3AzhLjA1xiQObNPm_2#|jt(RKVj&LBqO?l()nv zZ`@dOez)EJB;^Azz*ZDV0UdGNw0>`U!81+AM65njl@1Dn4*cdJJra*Q2<}V(sy363k?#QJ=_LA7$-glU`OO}Geh1_`M5wRUtj!)o0ySYR8 zZkbr_3ezRNk1yJk`G&vy|2_9lIn`1S3Z@q;4b7IxbxH+dtenQG zE0h!HP6Ax+1;UaMoFhs7mwHy_|4Y4a{|ezlg)3Iy#K`JZ%)DxI&Bi@sqQ!_kTotuUykLoZw5>a!0Fy@A4OrPsz;D^{{8Git?k4iHr;({au z0oTgsqP=%Td~PB1o)(VgNCjrGT-N)hDm$$bpnQ?iJ^By?u{^pcauUkPIZF6YMt=FG;uZ5TMEYe7Fs*{4Ow#o zo!;kbim>@4qao{)pSX4K&HBV3k=!W>reU+BH8t=TjWxmLY;&X-6|Z``$KLCrgzZSz z+SLa{q32g;nuGU<@AW1O`!_9QNZc)7g|7MrUo&X#4@7=;7rb6g2+W!udSUjv1lt&B zzUCS#yKVunuv~!1q$P03yUy_)cni!cP&<_2haKtYEq&mf8kjfUGsN6hd(?pom;% zepUy^$ZAP>vH;s}o5{f|A9@oDdFzlixuh*tEF6WkOj9a28Ui44w z8P>IgxqNCYG$}I!S58F(p#bBn#*vu=9{1U#@CubG5Wu-tA+ny~PFtIux_i#CHzmE= zRPdP8@EXqZ`ikF!U(fIMyuNw)#pO#6g0A1c!c!a|@a)aa+wZKu!IT~qzP~I_jxgn^ zL?F}x-e08rD*Wim6^2MQ1U;+nGr!wEMK23KNto)NI+h$l?jIwkIpm6TclEcY@as-{ z(%l+?=$o%u8u)1TPt|jd z@KU>wDqowWHfqDO5M0Wo--1mSa85Hw0JmBFxE99UZp+J~6i>f8FKr~4e6k;I6t2SC zq^)|)6Fm(?#+;qnF1~`RwAqd9(R%u%Z|%-Z;aIr^|M6GO=Apff!%Gf%&q2eHq_nj3 zOXo$FZ?WLh%}Nys~g;F)ue0~aJHY~y6t zZ-daWw@qsPfI}SdJih$nprvn|SC%Zz!I_g7{JQewm^k6r{ZDnh!;=mb-PHkgmDw#f zD`u;4o(vu0TQsa|(R)Ub~@df!pSaRTZdl^HUc0@t-??)zM zh3Kcxm_|nBjcTbLxbj|uvLuePLf##C#E~nz_O7khJS9d@BF~%jfHnX^L zC_zl&$iD1CkB!7kPVK{4v2u0kLmoqf1bh@*8A8^cQ043sk5Qy0^vlVaeHgnOhWHS8WS};|Kdj zb*7;hb(Cj4wW9Gs>s*l_!LgO0gGyI0EfKb#&R#%P8+F96)+2qQ4ZRMUcA_3`t+B~r zSBF1esnS1}kujC|8?RAC{W*(ema1<_9={R1Nc-%)&btLhU$-y^M;6<#{^5h&*`fb^ z_RRtEMeo;%au%ZLL++zNfx6c4iK@p#GgqB^!ji%?o7T9Ggtjs@;Lt5c&8DUz*54(K zFd2;ukAIxg^8;;8fB!q(bzURc-zbWwh{TuHZ+T+T2UC7O$ci<3uZo&9^N%EEdFh0i ze-;Q~(((je+(r{L>%is3P!a*9+ma*fI_MKxMZiAfCO}?RRG7`47*%c&f--M#h!Fhv{?TS5<;nT|A=Vpx0(x8~6SBhdF3DE6uR# zrjsrWcr|=1I`C`3%Ag{9rfq4%ldvH>XVsR4PMWlUitn8jR~5soyND91FoIPJsg=&H zqq4`ELsc|UD2$i*A%I5q`dsfgx%ot#L^Qdr8XS6s+y~(5aCF{@*~|AReA}M_?p2U% zb-?P0{+a7qu;oGL#=iiWR#VC-KA9Be1O{q?w zH7bTOL*7{{T1m<@l$14E;q%ke${U7Rq)e&87t3up-aTvh&X-m&>R5|S@c(hEaZb#j zP@Kd@Al;2)S=Fy-`oq1sg@kG`{1kK7(&qm$0Z@50DjC_6NRqC{emlO>>vQRkywC^d!`z#*iJcpQjrZRXYBg~8 zR=NIx8VcMpiC0=6{! z9!WA}5LhZ)oMA)<_ih)wRj2LtnPa!-L(8Y~%j!$~rM!sP{8{C5a6uQ>3gcDW+(RkCGcK9Q zVR9U%eOp0f%X!~)^Ywmwc75!-_x8Ni2=j0agznY{qIMNJ%n$4uE?q&}VI1Xv4K?no z&U2|K)z(B06**e99sq$UX7ytz%v}NWsU%uhf6F%q|8B_=s@2ZtkkLHG8etAQzyLod z>;MTL2&%}a4Ivo@PtS04Q)9GsM*&jPhczZfoRV6c-{>UuBcqnMvumBohs zWE3X-f>{Xg!V%%`%M5f9a11#1I`?YHOM?F>%PdW9_K@SCVKwH%@^;a!xxJ6WE$Q9n zzSC=yWU}B}Q(qFkV5y_s?eL2hBM|zjEE}m%pUm5z8A&AmKfZx84m*U1)7X`St|JAU zNpmmVXOw!Si7{fxJMpe+(|b$csdB zTSQ7^%l1jrM-$~R^fsb*xh+DqqW6VFdzXDM)&@`7TvQDJp2ol&bf4JB(g9q)u)J7s zAV4HCW0oZmn*^0vE=)_pOJELY?7XOVBUl4yh`yq7!aKP^i(C4>s%)9aRK4~)Cxr?e zIwL(OhCoOqm{+x(o3k4;)l4&(FgGFHj)K)x@q$f~*Z=XojQ;OKzk|(%e`WD<`2I8a z(OI{8wA<=?C`ptn)dj+_rJi7H>(>+KPW|4E^F(4@4{ssuDX{Bs`sjsw-+GiwX^NT- zCAzIDq`|P{61ixVd~aRurm1)4{lJ9x(i%7spah%p#;@+YNT~r?<#nH`X%+I%GZlmk z+1++33vn3=P}kc4Nj2065aQK-JE&eyL{xzlTSY>RdQ4)grh;hOdfft4_6tQ~s`ZQ; z$M!(eDtR>V_eWKI-*Oo)Whtc6qXG~iXgTHr0hg@?h0yF7kJSoCPT1#~ z7eW!{yQUHf$=09Vp>#Mzeoa22D%Frt@iY^DleuNup>=`U)ZC}eqtbADIeJ}E*WtD} zW|VijSqKY4UCI2R1J8LWOR+-7>_*(hsQ zT|6cNsRzTPy%og&$I#mUhM8ju%`8V<-(HPV&LUZ}oLVm(*4#*Y#DlJPIXlOJwC@z_~8>6DrwdVn@un=f5 z7L8vUNZJKY@;3~HiN8Z3jmS5kwT+GG{u?5Md10ymuugw&t#>>PG|YJGhY&GiMXJK2 z0n&T)-d0(ZsFAoagr;?RTT{0GRuI#BG-s_C<{d!t(3$?JJ9W~b)B&Y7w)>NPA;1Wk z*}J7#J0VhGD}}4LAhYnt_!m<7cc6oG95il%!pjuyFhPMVeOugXll9T@6FI`5=%av? z?(Td0c~=dJgXR|so-DGCyw@%_8WiUwzkyr4a0-tYwGeT*l!lZ)YcR}Smw69r{Xj@W7<|8b4BN83qvRA}^N z@e`wBDSqB{@gbSWMY>fh?<|v^*zx1?Iwh2I1^6hphz)XE)5t)SbT2QYTvyO* zZO$yyvnOoGOpz;7IP*R9(5`oyt{WNfVi|R5u!nISC-$Cgm19+x$FKY8!{R%L;ciN$ z>ct~P_JS%#o3fvBS7q&IPcmZuMhu|tHjy=IV-rU%NchwjS)zI zypr0|#8PRc*VpWLEEsFwK20pJR80Q+PFtJBr7# zP_NHdW7cD=%Dpu3eSot4S-jh&ej z>rfn|RC3Cy?z!~Z_sIb3Q!nWl3=keLtA6^G4*jvisXu&Po5@;h*y>w+QVudd=KB2@ z;Qzwv+a$d4eC@>afDZgB69gd=EJ}FI9Yg<-5dyje9Cmw|4@tGdk4|^ieRv#4*p+X;#U&m$9`CCBWOXx}qr|D2ZFjwx#uMWaf06EuXI5k7em9RPQ(G@$ zJ%mwD1!1C)1>kNIN>$C@dNCrbhYvEAU|}N9;U5s@Pn9Mpzw5<^CBHeiD}#x<(z(zUjp28Np=f!Kuz#iY<(XcfsHwWm41`PKa^v-_GBgYnfl zhXYC*SSxGe>zbmxtzh>6B^(74{Db09&(Qktje0iiyR~7{jE>I~7SN@7(faO}3<46j zg7ZxT_Z_YgKq>DeVVV{-sd6U%YB!588rqlOzjmZ;Oy{Aqsv`pt_86zC!{&A6I z!!>imd%bu4ComJZmN30GSF1$e9^QpFULm01lvsIU3(J}p9ii!YB7<>N%*zY`hNe8S?N#@U4>1!j(1^&R!KhrO0bRL6gz%2tB~jt zbs08_e)>DBvH!}C0!d_=9M{yn0FUE3k3@3q%#fz(!oY3`WbO&`dnM%YYKRBwQcVMf zX}8BVY=3wACBp6AF_k@E{I&m@)>5t0EDx_?U+{K^y=EC4K{}>!L z_G)G<6h0_>(R@c|Cc%n7 zuT<|v;}h#X;#9ATCzMG)UIOprMp)-DS_7TYyXvaPNT0L_H!6h3 zVd@m6V$8!#6H#`p?#xnaW>V7>ddD<#+md2!Q4Vg+f%AV`szs}C^_qn~5h>TlKpbx} z{im|~ZVXXX=u(&3XdiPXimzL+aWkp^9)a5Acn0AE`$8;OJPduUSpQwYZ>?gh!f(3b z3^gdHFB}=Zkr2i7$y?dgA`i3{QvUf1XjWZrvwUGub*D0TkmFf-@aA?N-s45C%xb$t{%Jsiyx#X0fEp>%(g z(V^ysSfZa0J)?*|tv(+~$UV{j&5nwr<;PEkWL7J#CS*rJl zhw{5}G4dzmFs0l+jC9;ORdZ+k-9y!sXN)at>pqmDoX0n7Z8c5~q5b@HFD0bek*LJS zQQACI5+4p}-fD^qm>&=m{Do8gv6uwi+6-uvki6PUZxQ~iJIHb+s`TPU!<`Y=jNvd)Cf#0y$v!Y zqYcWj1R}x2;Db#)sq5*rBxCa>-%!?*H_8P9{k>ijUIQO|>vFfwY^w4KN^qAxI`AbT zWigf6wcea^0di-J;tkzy0==fDm9jHM#`ssXu5hE`!pQj`om-WGeZ|?7Nve8LX71}u z5LY&Ht^zD$>FQFV5cJN}Te0EMo>335XW|M~=c3qPYx?b5wW9Ow^R&nI^qKg90Qs=e z>PHs`rWsAzT7SDj%6|KwAy`bac`qCw-N?_7?eGP(sh&%fL3Y1Gf`$&y*3c9xeByhC zGnJtsC-H-0hb*blm+>zGzq;(5!kh&0;pApZh>=CfUjly5e+2v#?){jPBpX$D^Lf{k;0rn6(pAe{5%(mmfTN7#iQ?XKq!eO(mZ zqpW>>-32?b-7d-!T<3s}o_`w`|3|>?@Y$@}{RKvmLUPJ;TaJYT4)k)MU+vO@g?qUOED*3vEpmhKns- zKImF_Jc~OKn7yY!7PZ{l31eLmCnw%%RVT7h2Ub5S`XAi**TG;4qTrR@OQ<5?6#-F1kPcDeo{IgHJ3|via;1ia+#UC6Y{D z%o*biW9+%9*sC(}0TaH3T5q-|nBC!Is^Oh+Z98330IvZ~j+*y@|-3}xN_UbGnrGv%gT z8*Nom&0I z#ura0cJ+jX&WLLcILK#xm_T*Nn{vr2?KW{r6lw|@?QPi#Onpqj)%QVVI z_W9E9kY`MkZN+$AUCMfo(x*wffYStMsJWF27q}k19jHsPZ#+3JO)$RQmK%_I@*%JZ zs6=j@IQnRWl0h}w)L1n1PC2|8?BCno*&})sffl+>H_9CXpMA^_aY6Pum{%@lMOT!i zRifH22+qEkXv% zKPDoCa5ZK=F|J0M!!hl(-Z@G$ljyUdPrS@Ts~$IXt=^8SW*WskaAWQ%@OqVMNb zNx4xsI*oZT9Z+J@U*xKuC4Xt0J=~rGvyXHylqq&I?)z4!YyS-Q@lMt8ac%WXtHgfbg)Az zg+-;)!tZVBpyj+x@T5yhDqzN~LnG}~>D79%Ac z5{(Cce*4>-HTGwPE1aJdZx|bN%Y=i8-hPf}tyZz@;RPJ~zA))Ge*1K4Yt5@x1Q}zd zzZeb9^EXWcd2iWt@-UR$D2}yrnz=+&QgmEg1B)g|dG~FwmJuCZTA3OlH%vqGvvGS( zxndb!-lR9au-ymG6>j0UD*~{oJ*#Pr94_96>1oT{HckHRFKcdCGvB{iya2p)tiSvR z*wmH&FZ~p^srmi=oU*sT0BhKJ=OFvn_nY(d-OEh_LD=GS(0}NTaH!3WgGbZIoA(rV zw#XY{dph)EYs%w>>+3HAKx=44bU=HzAtKj6%QS@kx7jPAY8!x1>cL{PUpk052#3AR zrFIxzE{1YBk4*;s<5~9cFP~`J|HifZ*|@F(#x;Wr<%S0HSi(Il9H?_QRDtocl!6!g zouA(Slks!*2lk@QKWY*{BvsE-t~_T6Jv*NGfJ15P3-9BA@4);XP2HAV>KjNTO_8k8 z>-ehpQg+fF$pR8-`od)?NWcqUDnl#S)6w{Wi%p+fP2+Idd(4>D-3RbfR6!Nq*YVe= zKa?}OIc=cgmT;Si7JtuFN1wxav_nQ*S5_(Wyq1@pqGujb&*|`#nIk7tiK2+<;b7U=x$z;z^FSnCmJfbN(Iqz%>9<;-Dn_d^Z}c@ z1c$(QmcnnoB_ECJ5w9D)=+odNj7vHao0^+j@X_PV$f_j}hff{W4 zLU*_Lbd%>-)e+S^%^SW}0>7VE;76h`O3>ip-|?)}*Z*gGFTL|e=ShtwVa~O^kFROL z%BW6iu;NoZHmZFZB(nGp{L14(AM0kaJodYe4=rt(k@>JQm3=61-KiPDL8&vzk&WY} zPHI&T_Z;E9IGC0ws$+S_#)j5pJeQt_;wm+N#FAe{v z_&9`A`o{{HjDC9F6w0w~W3}y-*Y??RxQ8sO^vpwcnD1EaZE8|uFPqS_@#4ss@bw+k zxf3%;kXzr*gL@BSOmX`>a^)v#HMf37y?MUVGsV);RjkKcUop$>oyODZG%~RlUiU+a zN+HDDgrgxHG}iE2$3|8%#}ZX1mJ0bIFJN(kZm_0VrlD3g=e~5Xiz?4BABkOR7~3_{ zU~>p&wCciskdH6Gwxu>Xe_Wu91knn)l?YN{(nf=3V~j1WF*Vm?Yhij z3rUX~4MnRYo@am~%2!zsUlQYgZ%`i3zG1HvFR(H$R(B}uiM$$vk7JU+x4Mfk@T^Lb zmQ~maxVp*p@4VdxX7fzQppq?n&i$|)A7kVxI+aLWHd-} ze)eEwlyi8n(h|F#UWArsety~RQroj@38aKQF@+C;j3tCRc<{b#Gehy68Hkg)^JsAW zrtn)@<;R_H49tY(jG~=%6&mLx)I5$?_bO0_ai-~wQx3PKO8==_3ao*JlG~={`@v69 zt0o7pKnA%+3?QzuB%UCu%B5?cHad7+o_lQf932v9H6ukAt4u#piLXkvYW<~XRU%|F z9MxAmD=Vq8QI&UI=)Wq&iHWa6Sx&e3xt64BS!#)VbemHXN?;|*tr&3w1z~KTKJ@XQ zGDzFyLCJQV5>=yYg27rGQj3*#DAERM@BK^G`Joj#Dc!(;t0K_Iw-4>%tDZ{30z>AZ zDmDvc*6%R)ywfwSD*GL;2CCtsgCJfMhIP%oin~p>!1i`<=kgEw{3`$TYRGRv47ZNt@i0B?=5G!Xwbeja!Rkwxz}^wT^Su-g)!l* z{KuL4dY|9+YrEFf72EmHIkIBN)Kb$dug}@2uhJ?Zi$#vB)Sbut^!_r7RLE5zF1=m2 zHHl}cZtGr0Zo^BzsZ9KhG!>av!UxX%iCt^*Vice9m&W{~_HAW2LjSg0#ciy5TF_?i z#mKq&{=-Y{*K4E>P2;v*e9PCI;82zG$B;574&h?>U4A}7hWh~pjK_{B! zs{gCvDOeT4t?8Nx1HLJuC8I*NVcrb!0V2Y9{Hzq%#zo z+@3PxxXEc^uuccBcsJkgK-ioci}5!yhYQX&chCe`D8rSTV~kV)tkRiajtoTaHZzFq?{3*BrG=06F?Q4zlQ+TICt0jVxt-j`Q5h!q)H1Dy;8#x zFfLz6!mG*Tn=>U!@l_{3dPOzG3B97J)*lu;&Gnnw#~t)w^6QkxPLu>1=?_9N4h)%G zJ!^qj?%u41_`M&MWxl*&9E{ek#R<{*-d_ID<@L=^TeD_si?WPd&heU(2uO)?&^q{d zWN${479&8r3`A%2-ZuBW>PC8M2Ko{q#5B2O-IB+F?@M3B1Q$l;3p}NwHbYK%@WPMT z@2z%h9S-=nZ{V9f*G{+c`jKJWF>uL3k<8m0Wz?H96M)tY<2{uEkJw}+;O$&A|QOk1|2 zZ-Bpvas>FPwg1?&v|ec%SnEB%5e*(RLdq%AG8WUKCD+fJaI&sNUlWf>UI5G<<;ZI; z<<=*Y340o)B#n1auX*j^gpRDeVHPj!XA_P6{xS@wi=^(s4*Z;DB;D)vSbu{lxlB#S z2w?SC|5o|#g^0v%=qT-MHDm>zNxIm6(3mH@C|YG?zHHn)##tEM@zVg-qjlWlRdw>J z?}D{)aonX9O8-_{owio#-mIxP>wB(FyJ|V5mkUuzY4H&NR|Hk~)mSm0!MqgUPURh) zk%-iG>9w$hZ&{C*c3+rkUbJPP0vL*y^%N1@V*AJH8_7-aPlYT>*8M(VY?t=Y?Dlr! zrAPA3z4SD>(G0HxrCvdw|D_;6_TA5ltvF)THAAKttMlx4UHc^eb9n@V*%Lp-AR0Ze zpYDv3Pfd7}{nVf7o@cH#dYRon;X56e@bOBP>dtx6EPHh^rl60(ua)70N+!L8gzk4d z_&TqFIvrq^eiymlJ+&7rkhG^0$6j7Gd?}c+ZBynD#rPxs&;)}k94eSw5|hViwsx%S zkINxDdL;hHkY-UH@wh64s&&)oO20PJHg7Xl@5rh?(!pszq>slu!+1IM-x8tpfN}f! zmE0Dv$*YYgC6BF5*MV+&X>X1%UgUZ<30P0XHDWcx^ERh3zrrglxOur?aVP7*=2l3v*xg)aY>SBj<{|>p1W~<3Xl)$ydQI?|LNZe z;%9GPn4*EonqI*(fwAiGRMGPX_n!4`aDH8+v09+f@Bn!iEjZ-83=Ob&@2wZ`liPmT z@VR70-?|m+s5VH_JKlMP+A!(YFQN5?E_>2r#8$C)qn&H=V2PE- zbDb!giS%Xp5@8b>_^Ief_#lA}P&P8$mL<+aRRe{?EWYYL)tdRKdDoX&dW&&IJsp2wa?u6JmsMTh0n^2GVQSFTGd63X2otoALHcdaq0G3 z=!?G;z&r&6Fgvl|ocvXKsM5JEPhn0)rLBZy2Gy-EaR@pFT;dSE>l`07GRa#iuW~ld z*{H_85*vThljfT@)VD|KZSE><(sN6f=k}2N4I|SWHq2^sj7AuXmJJ8&d8wOUGz9AP zMQNKTHNRk4Cy@`V-nU4%Vr_j3xVmcg?^NA6tx#f!UuuZmv|Pa7Wz@mw2$2i|rVr9$ zSgyJ&tYfk+G+PPV@o^TIR*QV4t3sK96}NK$Ad=e&&LVkzRNV3Ed%^^t_|VX@Z?Vbd zd5UWshx-Fd=Zrn+`{&98NJPs66Io8j#03#i+C1qrv{~TGoW(y(f?L+9d9UoEIO>F` z0xd%Fka0W>OqXuX2m{K-`^u7e4N?CKj}Ly9r5(@VP-2a=GsG4Hgy=(}WhGtj!IR1D zCotai4{WY6#Q<`(UxhQluUE9K`Hr(a|C?g^|0Jdx3OVqY&}n)TKnCOIX{1;ogkCs$ zD9Ga+X){}ml=zkPdW5e$MJ68b^EtG|yJ7A7Qf00ShvVza3njR^hn$eeGoWLXwFX}q z{{~{t1B_-Rc$@pxfE;1mxwL-K%J|PJ<_x;*-zrgoP|o}Y)hN2BNW@x6GypZS=#bBb{|pt_W!0l4Dlv;dA*?#{pK-|bubn0G}D7tGyNSJ3@K<3^jsFi=N`WE zccpJMu^YZ!69eK})P2TW?1b8^!ae*0~JmNrIzMT$Au3TIn^_dIQCwT9;>0 zrXy%8wkGfis}o*y{U|px#=R_>nK$b;H(TJp&VpC}t#j^1FH?Z(qO+CmV7Z0L(tn80O>3I)RJ+9r27V*engoboD$rvM z=q%1Krh&Ac4{=v+SU-n&mDHW6Oq- zA#Ze)LoxM zQultaH_yVFHEl%&N2p{Lz}~S{*XsmX0b2%qN0B~)NO>fD#+urUZ(eMy_&MG}P;K#< zbRb@A_S_k3E!QmA&c7_t-qy>vloE8609J!i>`;rh^bV9=-({qQ?4VIZEbnU7Ry=&WXp= z4#l4X<1u9f3F*xZzto$_bIHTXQ7<%Gs;h!d48{mlgbThYHLk8APSWRcx)jb(@_iB4 zehfp5e^5KR{*>D_5ABl70MBzZ;jok3m^90aYv?TNA3U-8B73Ox!CCblYkb_3631C`j1 zH5M(!QXMLi)Q@K^l$j@|io51C7PN{HgF2=~;J^fHXrAeMZ053b2bhn8wv(mmIebic z*gD!05;&qSfoETfQ|0J?_A*efKB^(OgCuLJ4{xcw%Z5~m0v+*BF3>77vc!stAE~e<(Z9rG# z#;s>6h4sq!`*F-9_9Q@kAzTLRzNK*$tR<$7QIo`$7PjxW2JPsvkJE?MUoX~MjvH6X zh_{*4ge`?-E?3@ui_81u^*B`ewUftV;;@A#vcjhn=KZ5|+j-;i84Ba*9A8!DXsuUf z`aIhSs9bnRvwUVt$9L$o0uZ@3OZH^Vt%6Kj zEWbQUb7QNe9$xOV%NMoh`PQK3hYX7wB<*yL>~fNm7JQxr=*5}KMT@k?N}DTmIIxg@ z2z}qCnmZ_b&;k$qid3BwUvRconl6kQ`|B^kwN3YC<>e1T^xm=S^bX%)cQl8>L%{0m zG>|zJ+-7Tv+n%{S-5KB$11dF?|}s@D`@? z#zp9!5Z?KFRW`+9(MC&Q{uj=$^fMLAdn&aSwUEV5LbUe~Aa>OJ{w(6sZ}0ZoWqB{N{zTa-Mk+t- zqnjUS*A(Wqn^o6=c`fYAxO?4e{Hs8b_dm~Hj6ayr`NLEp(C_zVC_lRmcAp(2FDj_w zsZ)=Rc9x!vyFO}Q^&vT>2Hj{py_Sq=h7S8Y1Ii|vR(6t5rf%&_7#5{dKgb^sPVa?( zpXW#e^2QQ7{ZVTFEkH73ST|6c+9;ifl(L4Ha7ZCzl=14$Ydf|mwAl|B$xo>*baJ?OYK;N3HPV%=FY6g#j&e&w3{bIkFJT8*PS_vYEK`}vohBzmC{#F1#PtP}4 zHu0hP^3xXJ6jpge@j5Ct?-&FNcVg3~IJ?04Dxr9T-I%4 z;rzb^8k|Po>78cgXLd7OFm7)zIA&jcrCf)vHN~%QKdP_$+ZX4JE#(HpsC~zEC4wfy z#1(%@SNxE_m9gyac#o2Dg^ri-)8-7NOgD5K?_O{e#i1ZmI@5ox2qhsdfMosNAE+Y3 zQl@Ie(=sUBqlIixxTooyB;WL&@-z*qYVz^myqQ-b;)S4;s}ru|Zg75IvSCweR-c=XbD1gBmU^ zPH|RTXy(Z|eACP7tczqTK$Zx$*$Dyb$r6DSE%0HrYlPBx8Z}?3Oni zC>(N4AsJ3VskpK3uDOgjuNOl3ki<2y3ZA_;gPcMTNH&+Mm5362EsLCMW{jt?gZ8Zx zm!wxQo&w(HD`LeYTW_Or6d8Sps#QvS*7TN{G)$<1!y7BUmMH~%%IuS`D)Ytdc^O~L zQvbp6CEtmyfPpUfLlHWY$t1 z`^1GII6I-!Y?gfL3;(C1S$ePEHBVeD9wYoz=li+E_h5B7PMu;Gt)7ZoxC5It@ASXa zE6RrdyrJyV&CWOO%8VDBu&||PM>x4GuBcbQ&iAp@@7c@E3F%(T1D)*RLDPr*s|=@G z33vNPL7)c)BYfD)kHEK8r#pCpk39DgQ#If}F+}*d_Y0hU>Q#3V-_2_(Rq;|nBtBMb z32uh!*W2E-%CZb|7ul*;(@!MFP$A{g8KN7X-31mak1sYGwv!E?wLi^|H zB8?|Wv45SGTVSCCv*V?VHHu=8Cb`raHJ?(hvspyF*jEzH(B=LVUs{lPiD53q%(o*Z zwRlsw`dBCTLrC8C4}iV18Wjb>)ebnocz2m_GqAuzwUs%2I*$bTH?8-JNS8)V8^Gh@`+=m=`WYZ+MBYW zk&2M+a;B4}d{?!xM|l%G0M@KFar+N#Nkhb*f0)HLAVX~Y*n06DLIh1Vk-%`ONJJur z?i|1D4ChylNEb=Z_-Opl+5WY81uv8I$8kqpXKjigbBWkg36 z5)8Ds&fXp^+t;GlHtv#u+PjI+#zHg5@L2E|8z68I?Z-q`1`*wx`)hM-{SZ#9`!j+t z^U?RATVjC6NO~KPw}||p-<)G2?y7y{f_MX;tnn+`0cZPy&Ci`K{|V&2IKl=8=*N}f zIc`?b>eLGXdelM1BX8{#e7VogoenErA%yI;*CxhESx1fbYSuV*hoM^4cmy-(E~j<$ zh#N)dUh|WeK7R?4J^p#R=;ACJW59roovr0jeakyRtkCVDabA7GQQ_J*5(V8Wsp`*A z+HV*bLy9tG-U1DCqBTGXqr$O@cSX?!t0rJs5K#6cr{`s0cg=#qB&>g}=a8K*>qn;L zqqXxU4w}?Se#X2*Ky)=2;{^}+FaT6xA0O>5*BzxL)RBUgbY^?xD^VET=IPz+VA5-a zI%P^#o%VqLUez(1nJ!R!n1uoYW&7|^%13h;Yo7h7lUU=7>zCny%F}n4Nwr>|!p3A8 zacdmeZs^^kmE&KYy%ilgkW)A$J7_IUITNCYD&Ko6wZTE)4zEe*Wcor>80x2X;%u$gQ6vqohADgh1zObu(muPUIUEf4G}J8tc<9=i{0!bF!MP zlYP);a}vAE-diR7uy#*?$-N3T<=J>bf)iTpGQE=5XKM?TeDmn-o;!^Wvw00n)%Q;I zy?-E(?p1->K{?+TZFe@Evh!jO(BRSsJR_V0$*U^N-rI^e>s!^iX}&F*prlJiIkc(jCei;9!1LZ`#Y0DP9C3FIvjYu2c;dV@03`Sv7TpXem3S5FY-fZ6YWso?}XSE zh~bYXckh1FJQNMgn3>C+_o3R{bYQ3!DoK!;D~{{(R@&HMa8RKYHPj8zp0aDk{dN}= z8WE>=D*DT6f@}9&+XgasPH3u)-day+ESXJrzT-H{i@2Kp{pc!k_xCA;+-8%a&2PRU zkBR2bO7$?8YuNp*RhqNGn07<%G3^!cw{Xp_Lfx6Q{tzZbEaMS3F;z1~Xxnu;&CZ`{ zz5w3%aBo-RE-oNpk3JjOblbs*j-s{)N^#{lT;cw%k4fa*_kZh|~_$?jkexUApTJY=l9$aMw(eCI=#^O3?cniN9I|8ivBZ+CTrhDuii z8q^9F|2-!W5Wxee>UY+4zH-p6UA4G_Uv zos!@MnU;Vt%jf^cQFn1g&o41jXlF$#0_G#|%^bs{r~7QDJ?8l46ph#D^BXG`ub@Cl zrn0FYa9q&4xQ0>vKKUdMj-jPcrwOw|6Pb)FEp7;EdfDLm*N^gOsKzuh zGoPo>`UzvGm9|<|t$7e{<>$hal!Mo~7;9%VY=W7O_oXaMgW8ucuU=z|e2i|^u9g{P z%FSxKF3bHXna;?L=+c($R}7)xP^1>jC*F?3!TTvD@@IubCr70WL0h})_J6?agX1cH z-Z=$oQQg@Sluc7Me}FGtOPjzw3m)}I%WQlP=G1&i2b~O23UrHc)JYR9=wN+6GV*HU z;P?Ex25Z?f(^AG8_%|L2MzHv{9~^iyyG!NQU(+U&;;`B{KGI{QQ4pM=;R~RgIAfV# zs3;6ysGTs`JXN|Kg_`d3W@g11XOvkKyG8VL7F9{e1p7?WM}~}tm}tNjB&32`B>et2 z4QHcDQHY$v>BI6Q{z%1k@9KYI*_D&~G6Agr>6N1c=>Fxf>{>4zzJP9=I_h+Ob%^u} zW&Y$HIn@m(T37rf&nEj0Fd(-3>Dqg#?Eh-qjO_`!DnDfQ3Z{~%*PnMD|Dgw-D%^bJ z4jxoNJgpwyeY&5zVlX|Zx}f#-$?7cFfPdZCKzh~>inc5|Psm|_+W))2l0}(Z)eK&o zp=9$a9q(caI0F0V^AiFW=TkL_(WZgH9dDY=9F+UwcFLBwAxTh%JfM=Je%=sro0iZ%hFLk_6Htx zD3;yy)P_7T`tuOzH6IzfdALcQm!bBWlliBR^XmyW6oi`yLl&YF6vG!+Y9ov>$V;DT&kyF`ebu}ZvZwbT`CZK4 z3WmS@cecqhH03zimm5P$jP2{y5+4Utz${;R++E^kF%g|w)mhPzK^*qs9^kSkR4aZ+ z>#kkx~07h(FLNDskL=dXO;szJ)xVERGeMzMtatMfloA1OVJcd(FMZ8+z~5 z!145+RG{E$?jv>ld_i;JjQNzAQy9_>zp5L2IZ6%Y zKhV(1_4Eh_opLUCja+*bzXEixRwc6P{uynt4V#Hl@}#UT!F?P0!nEJs;;&7c8m6gL zg-5z0+^khmfDB^z$60x2J`nD#B=u1-(|0}^Ln`yZ?n)>h_tNk`Q98PjkZ}U^14#uw z&9uz24TAd~5_}nLI2LQ`kbU9Vw3}`|F+Qa)c&&ng`jyI~DkV&TBHjUW+cZUc* zww^gXBo3ra@8-+s>IUsJLn^*pFw7R&BZtwa=lpydgGR3okevp{Fp(kaDvIb+=^(R? z_7(Uk>6On2wiuRapM>s80oFi~8hz zrVFUfw6{yWnRV&O-w7}*ctd!B{fqA+VsMd(;Y<0dM~%-vUz6I<+dLZ@d1~#W{`?Wz zUuilodP{!EDGiTfLT34mmgZ|J?cBh0@n>_wf+Gk%D9o7dX`ha@nwoj3$mc&!@G&$p z1n|%qq)beINm=M2F>|*4b}-(_<0f(47`QwGd^G__z@TDDjzk4a6SFXw?CqEM&z)T_ zsdnqP+Vg<+^!;``Q9a&Uc;6v`b?y&JZ2`JX zc^^z)E;M7^)Ca8{i;wH+8KB0Nc@x`KH3Oo=iAkYs@jU0I;@@zYLE{{RuRguNVpiS! zpr##9zR4XXYUpa`5vaPqMRX9cz)`D}SsTU&yy=uwF0`U>>v3?e`zj1A(={t$pC9N? zk1W?0Pcb|5)Xj+R^aTEG09nMl(=OADu88D_%=Es%`w!9|xRyHVJa6*5x+x~QwmOC| zb67?!e%30I0!_y-orX;>sLWg0_4ZDAN96Z%!$guFV_w`a z<38Gd3K>aLHSR#B@eK@`gB;}#1Ru2WWC5jjFCgKq(cb34n++Jm%(08psMK#aNZG!B zui*=_eq12IecH6q7O+Nb$6<(B0PQdzbBYVMMFmW)a}*RDA0%jN#vky1>A{yK@0;+> zcjaL@cim==6}_ANfg3yPmCk8vmq+m4Xx&7)SL-*PFW!YBL<^uEJRcvSm^+mJYT&2s z-6;EISU$DlpB9WYH!;)ZkXVWaUSQwbQ7|bizjQ1pVv0cYyf_Y zg_E<#+jEP{8Xd`9+5XGBkups!>9^o}==R{#MSfhij1nAtpeF51^+3nGErPF^r!J9f zMoAy@%Y3k?$`CXNbo?9@Qcl}+6`cKv#?#`^WuUkmxlqUKWoruV4u`TJhRO`BZ1WUB zZh%fBhVQ}RO^8L+PJ};mZI(BxlWqnz_={haPMTJ=be28vSJ4hT{#87h_J#x(W&h6q zt)Nc&6gWHz*wx+NUIx%#_>(*!PQDa-D>XVT_R?NN`Mb%zCv+e_I0VuC3Ayfx&81oJ4e<5Bsv0tX(XM!en4J3V_ zm&zcGGtdGEbSn&5lz{;tBnL+F`-bQ(6)P53oo&0sOu?3VJ z&*!+^oemIg>=e6$2AfeDS3f2A)(RU-#XXO3ncbZH{3;IJH{H_%Pj>E^8@7(0sN8+JC_cSCkXq25HoBXAqeuj$Y;O8o^ z&4sSM%x>zXl_MJ1VY7!6i`#sECkEL!{!!dR2`a1|b!rM{W$k|B$p|9sn~6dD#sams ziJX;Xpy|1c->irGr&|mdFc9!4a5K~Fu$#7^s=sN(Gs>es?PNDD*s)+Anv2ZytDJiT%oxzj;Z896h{yW8E1X9&z`!dboI!gApJo7X-Tm5{&uTbeP@F9 zNM;T0JDiVa-)AQ-9`o75R0_gP z7iLObytH`GjReXx zVW0Dth(raeY{Vw~lst!Vb|Kb?MNkZV`VSt$dPdZH9+j*w2kf|6B_B$9)tCb56i~73@m%gYU1cb{CgDSdeL+=sVKg zFgq#Iy+da{zMHXf6lmRHoe3xTLu=#te{a|M$7tNNK2F0LUZ=$s0`|`%tyZ&bjccO- z-H&WfYo3jN?UJa_Rr8AZGfCb=q2qu#XiG5Y#03Tfv?o&34P`WN686ij%PH&0gz93I zowI3CwuKA2kokQ!I%<@0)i&DhmvKjHCO>&;zMb&~GyviJawkTn&EUn3oZ;DlMIq-#r;rKCRMS7?=uLuTy-m?A!)@(ZG$Mm<@7r;zwBq#+qA5#{+BghcB}m0|Bhc zo1JT?UFwfIOHN2!3X84AXsabpODVi6P1vJ^5!dGNL!^#Gi$zBtvTob$M{$9T6$wqm zUqhS0L>U4pky=sHXJEvL0Gl~lo)4hlX8JwU1T*qG*PS60A}i0jBqfjMI5o3m->=b% zV?P2#fCd{cZ|RtyHjX_L@oga%5I5bYJ!7R_%TpV#f(@!mX@fH9JxXRWKIi|F?^eeX zFC*RIQxyEtFj2X>7|rbgTc9w3c>`_DYQY;<7Ni;=6&`rNca63$y!eS#6JH*4mxTw= z`BFdd^S`KDdrM#Tvz^ncl{s#YoN5{Hm-#!cMC|pf1#MrtUsM%hJWmmNy@#jLg#@v+?|DCj!jwt_{`QhXHJ}=Sj-fb%n1*Y7;MGNnUf^rz}jBYNY zCT!y?3<{s%8SE+i&>;;$6E_AVX)Mb*?xy$JWXjf~)`;vy$v>Hdzyg3CgyZnliyg|R zdGK{ne)r^9TP4GX#0vkH3`JOc)2D9D8{rrhc-s_#yY9gt!i)OtB-D(|vVM zl5*5DG=Fwrrua#`52~tMgg?iIuY7yu8$9@UoDo+|Qd*H4NDErj3~ICH0&55QG-Adm z3@1%M(WtqCsqb8IehScmhp|&88i`;lQtQT6Qny;2AS{XnMx{u93OSh%fxM6Y=EX`!%OYX1A?8Q)fB=- zr5ASx^7Kza{Th<3N%wip}`uh~2&51Hxj>A8O1 z`(VX723!Kj)sUGTAqNjzV$UJgXIqdqE9>}+y&qhS&A7WmgESLz?=hr z8gHTl;b8aNZob6JdW_N&>(yTn zYPLJRrSe%;PDNY)Arc3s|LTC(F6Gv;4G5-Y#D`|TK5tkr{lMfZ#QfXerp@s_2aH13 z7>pM)ukekk+_2M`NR@gr7%!b{-|#CC?4iZOgJ2tc3k>R^=Oj0ZN9CB};o>S<2Bmip zbct|KRX_+nr9eCUb4|_7R~g0NZTemYude}twmlyd;cju@XLSvIW85aBywaidOCr7@ z6*c3&kiJ#$c%L)m!3V#CIcTU?KnshP>Cq=_Q>0Ie8@VwvU~+HWrDN{-rgooE$@Y;w zMTI@1N{Tb8N~+OZzqIF&d9XB=(4Vsn|4@UuEEQFDmz(cy=@Qw(F_hyT#jeb zTEoc@t3h6^F5hoo`?ym1Sw#8z|D;T5ck4fIc7eM!UWchl zEdIN;`9+Qk&|m4s_EmSbYTyCKyIs0L?v1Epwqbk7hvXm9vHaUMjX604Q^HA1A!DDA zx1Xv0moKDntYCUZcfDdg*BU9Vw&MbG^-%A6z_{A!YtS~{&`EJlw^V6?Ke#(P#RX`P zZ}EgfnhJEMX40Fp5+YH(2t}IBZ;3kYqnoM3T@Yo%*e6HGqgm-dm*?R^L5BO)r?KNk zy2D&v(|gj+bj96!78CccB-_zFP>%8Dmb1k77xxzMjMC9g=JW7dmtW^UWC+~K?p_0W z>yxE4nV(PZi($9`&SIW2lyIUo?7+(syg0v_Tvs14Fx7q%NCcY^u`hVm!{>)v;pB&) z2@#QRhU@s7H8Wv7`7>nv%r;NG@_{Ntde+Vto^1$~*k-^CMF$?Z6hSk>S&5pXDkUvP z^)#BcT#G(*5BM6_gl%Kl_)T(8Fv^(bzPf+4@_NdwUewsZmq#)z zoO8$*J3BcxXX<)3#UJ@KC0o(9O{oRP?GGBZvmsb>;h>X{@}?&WX3odA{VQ^t zQvoP*=pQv;&H-mTg;>{tP(-L}s&nNd&(O%K5^nI%iB~gBugxqAvL>>h)zGrt5frK8 z?aN1TJ~(rFXRla<*t6`HAh4L-k5LNY#yZVA#m#GdmNq{@`Mn^Lm-o#{#pzx2YUd|j z#`H~>peg`rJpD-x<*qTasd=|l1BW_O8scT5Ek))V^ZTZLrt_zi2?#e&9x2+BpP z_yZC-5n%UkWqRh8mSwN)=+jJ@YK?DsW7p{RTidwR^5F{HBQw#%*;aO#!wXiYi*w9| z!^7OZzVDMSMo(`uS)8!0P+CtrPB$sjYX)`y;o+;0(>=mn{US{IcI*fhx9cfu9fijb zh^tuXF+15=4W;ehZ=hC~J&z$YZ7^ZZ@X8o&(92Vd$f*@j7P`nPR+gnxn|Kqz9rt0I zZ|OsnPpoxe!p-wLW$$Rsz2-bmDZxa~%?6)cR=X@efiYCSA5_e|1Nw=u0gLJicnN2) z6f27Z@;M9%L;uuOWe|_WqpikR*!y94)b$|h$xnMhea=K24z(MOpq_-*7r9TnQ)TcF0FWtC6Q|#4nCKJSZ4EjE%e>B`Dr@{;tDN2#Y&E) zN7vJYd={&;(=zW5L4%Wx=?T%lrwd{q{8gja^^nqw8?v%ss0uOEl*CzL15*W1E zAUs819>@z!DRacm5Z5q6E}hxVzqv1gdo4x21ZrUj&P^Iy;NCY3 zPS|QqX8`aerHK5B6-B~I!9qN!Y}jYbp+E-^4mBI6|7H#QzzXpv!t8Z)1Ai?PNc7jc zRUEhM{mc$_*3De-Eok_$2w6Yqn={>NTsIx)@fTBs%dGu+`m96YQ46<7JRT!ZR&PZ{ zG*bf1ujz>Ro)F_+W_&c{HCI#wpmo^UBHB2U^x91B3@}i;X=|>CJZ?ro$tl6n%2P3{ z%|}|NZjEEeO$Vp#VlR>>nWU2qVCl*dnSRS@s4STQdavBli9?4VyWED#K57^ z3^or(|G`kEQSVq{7!pJ@R-jvU6#|P35_`$thp#})>Z{P1b7w7Kh-1Bgez4qF(X4abNVC}qG(G9y|4K@K_D7g7iBn5+>>soN=aPuWF+~r#?%&sA7Vq$#O z-HfMs8E0NMVtwYtk2H81Y8~7^qZw`?_MI0HJKJ}?Fn|u2wohg!loPk>nT{)5{u`pf zG!sk9>nr7T(=GrBzTN3oBknPxz$k@h$kGLCJd=GQf2UHW;{;m`#*7GOx5^Tfy)WGS zsPM-0*8OvIFRqziyB1db`B&4~NTs?^w*30vwtAPHTuc&yg^3y><1%%WhfqCLUU~}hosK*%3HSM4DfR3IUdArr&>Bj`NhpC5S(jyu3BtiEZJa}+)8w@G zBx)JTl8&!e?0D`8xq8ydH)&_OjmFnWVrQB_g#6`N6>|45<&4?l*ek;&hfd)qO^ z;u!ZtqI234fDeB?m$TP*0~*7ZkyqQ?=eN{$KhBo}^3(S#X`WVx41hJr5xR__O@Eaz z>a(`sJ-xX_IF|8U>+0K^Gd`ZntlpsF$n^=Y?#58Rg4gWN&$&SMwj!;L#t3255Q#@6 z9muKAO09>(*qx>e0_NM90LExb^BqasC!CpI1E!KgC=#B#H>A%}yE=-U_wpV~94Y-^ zN7Q|JpJM79`N^WTnmkKh^tx5}wvEd78J?CqDML^~B}WWTZ^tU+5fw`WuI)OBQ6qQ3 zxc6!n3=Ol-L{WxdvRH@F)1|U9NYZX7P8wI{930IWn5oN_-s+v#R09cT>y8UR;J7y) z%dE+A@lkJn)RX4}5s@Y_5=5!g`1`g+neEC$VXML_s)~>BZaJ=v3M)iUzP8ya{H~ZS zPuMA)kQ~p=(Rp_(FlMup5(JAf*g`ylO0Dv|tbWTpng-QY*}+KQZ-zema|xRV%ei~d z&^8K_;vqH4zACR#$Jo2L+GZ_hH=smzA2i^ky<<3N>g$$`WQ66Tj$iHb$j##35Svco zgeI;9(stMrypBcOwwR5pNi86gPN9DvSU4OJZ25;k-qtWS`T)fTi8~wz*Uq-I0ZhrB zAU$%5s*8ki&^ zkG3^V+Bdg3kH7bH1(r_i4@+tIj?Ly|=QzQ)WJsSij<)BPpxb_J|Ik?hjoKFjo$|J$w7R1GWDUhu-m)I9Au0$ao?7Hn5{{V9^Hl zA!+)p@*lP{wR#icV3SQ{^jm#GAEgwg#!LY|M-Q-e)@- z+NgCG2fsOX6e_t6K8o0uv&2|BthH1EtI{5%7CHZ97lIYYhRY}uJJ2q^7RG(ck4@VC zo7}W{sEDu81G-*LAfVty;v-xRb7QeaOXRW$g$~&wE07MKB9cvgW~KVM2$QH}uI|9o zarJQuQ)AWZF2?U3R;}l99o;$%JKqi-^F*SR*!1wjnO<2GR+VP)=Qo$qr_DYuPd&( zK~G#-+^UFB-Qz`!aZ%OZ@Z9b9O!IKLrN*J7f=?2SAcXe#GkhXLraq$4$4C%E8s0u9 z;K{iqyK^=XRA7R<(`qnUC33IOf)IuGE^Lkr*0}Bm*OJ@VWRmlIKaa976^jhKb#2%I3$FvK zLT2GjMn*Q$Akd}Z+$IDrQLgpvSThmGiiaL0!d` z_k)HD#00M>=zxMd5e*is-3Qg`a)f$v5kV7q#dEZ%LqvdBXAt5TdpwNA{qoK^iUbAf zdcjP`YMp7A-E3cY>q}jm$x|h^*)~sKfD;ed549SPY)a4&cV6aLBj*uMtJv;_bHpR@VN!jd}UA7 zrvz#PhMi&vJ8cECO;=O5^*a?4wpjafY6?8e80rG+IE5|707UtSGT4|^&roSNyh6X)*63J#ey;V?Qn$ z%*>*M0>Q52Ds#?Q$R_C0))C-L56cwx6ZTs8J+7`w$)w&Ge^y}C&xkn`s#`&&lW zVyNo^nFha8UYGlOy+EllZqxsY{~oP1=#%{Euba5q^A{(oZOkfi3He_&?;f%13&RV zQACmK*h9Iazd)G6J2mL0F>gGF-VgI;9VGi#h zMb3h;C3QE{M{!>zy9=es&$&8(3o(5;8HReHPRb2){Is$5U7{ToZ4Yrzw_Y43s-Aa5?a!B`8PxSK3y2impafe~2 z6|0B>?+u;#z@W};>Y8%`2)6B(v^(J!w5h(MiBG+#;2z8Rk+JZa7SO@eKBxwLxh?Gf zcmYf=M~YDDMcy9&%{79-Vxj+>>d7JX};qzW!HoF9Bj%6$jG(Z|0MqL(y z;PaK;;Qc{*jplTXz;fcG7KtF+wrC&4=oXz}Iih#PjNCN7$Sa(hP+WV)W+U$o>+oyf zU-GW**=>$Z;fPlSWWGa*Wq$V89oC}QS6S%!GG&h`9qteOPN^;K-dLRI!h;!B`>O-V z6(h#^XY*xr;Crj~bMFyTrDdRu>LIX4px`U6) zz9BRZKk?jmHKVH-e<@RheS29W@^ATyoP?}toY*ayBb5%m0W*(wb;&f|Pvf`a2dAt? z)3Q4pYU1wX51Ff`jU-8>=Kd{}k#*U>C^Z~jphf&O)H06z@pekdUeafp31Z_hFYaqr zj+b9s8qEbZp$@kybVl|92jA_k4(P)TYv%M5DkvklN1h9rRhk_t8~1y_w919oa4cGN zUAcXCW(!{Dp$;-epu)TV ze65~2(+@|3BT)~83{l*cIV)`@@0KNNfehA4PLnkna$D}Ir0hI%)Gt^}Mu>%&I(oKf zj@Q}xZTS(~X8G7_B0k}kRn@CZaa1{DEz$&hG}1FR-y6+f!#tR^ACTvKnfUsE z%LA7R2lU%W0=b=F1eu3%R3i5yy_cN(-{=UH)*h`MNl1{Y>y8`OjF0Awg(i=ofc_A2j4HZ1U1-f?`WrMI2#*r=;%U&v%X=LiV06*ZCX6 zsHlh;Bj;m2J9DTZId{JW3c7inRIWNEn{?Y(njjgg*D97HB5P(-+CcCMn@QJ$8C&>b zx{r$Tn-Dm-D=|I*&E56M@9o1m%@eJ#SDe*034Z_)qw964w5r;8r#fn*m5mXfNRzq*!=)GMnW*A5r}8iMh`^gm!#+4W+fxv(+xQdN(VhSmQLn zYwE-b_$3yA$x=Pjx~z3i(t}EU)LKd^!2!?Ix>f>w^*;GpRamm$vKXszr!wU`@}!MN z*Am&+-#U5^W)Cp;9jt*?-VTNwvkH4pW`O@pDGgsYdbtiSOzes{aNhE|L+83KtK~3n zCU}LhHW1nKbHDLHDpe{fFzXiQAkGFdamDa+ZlL-uXedsOQ4Uw~?pY~*631^C6Kt}n z5R^EzHVX@vJU;r&Q}eATD*`VrWubRftmc|U4yjCRzQRakb~YfA*I|bCdE2=?mZ`sL z7A$e*NY}Y_5@qM@+9HeiCQUo-7-4-=psx$>b^laFGNe2u$2wFsST}I!#^=fLQzl;r zHaHvVeKXE-Y*DCmtYB=jQ(p?yH}oM;Z$tTUsbm)Fh#S^^!&2`E7u2X3fk8xD*LE@C ztL~gf-!QcA5c)!gmD`C7;TvXgD#n__CMFJi5u-+vjyth9 zEu=!5^FfE+H^Bc&QCgi|%$eH8mi#orlcr!wE{lbpD!o3Z*ch6n%aK2~yKTpfX=d`# zL6&v=Q0-x3+k5^x)?-HS@JRtWlaoh8*s997rQZWgsTe}*ipARcK_J~`=YyT-TE7ud zYNT)jSG$Cl1LBVACAo9_!EolfIbPR?kU$i;pG?ZV9g4+o{2;`iu#EFSY`+;;2K_i{ z6+vP6OP`-|!_gUVhO_fri72$$spEy0y<8w`lo zQZdcD)9zQ)`+1~T|04a+@I(1;j&BsMI>{Z8qxl?ebK7rrH@A^( zU6PW5o!R>UO-(8A(XJ<_>z$irCN+u{M(b7Y>Ut};U+!KRoTzoEjksI7zbQxcoMkWz zp$)=svRTz-eL?W&fg6{WHfKcCvwRNSE&il|>1Ms%?5m;1>b{5XM|~gvs+++Q54R2W z&(85zud`s5+$XyD@N!qdWo%6Nn^{Q60MG{m!4Ha$T~Y5*Y5y_@*$6{G=Ahz{x$2A_ zzj)KTP#Go{AAKD*Uf{YTw`WSmbuz!I_+y+d%P5;KeADb9PMVrUUB`JELk9o}>(SYE z;khl`xs+2+p(tbe6pI{NyPUp||#E2sId?uF3mf8eKUVP|-T zAf{_;8|PYYb@1g}veKj>uEA=DsazA36UR=8KHQf4+bTj!!#LF(=hYv)2zh&*h9wP1 zZJ9J_e*D@j5{}`e|A^5S-WzO`P?$s|ZZGV|FlX!?vQwUz3OZ$5c=+&({m#41(U>$n zh@5l(+WRLDIc9`%8gFF|Y3e6)!os8%&hDX(7u&6RdE2&rrm9e!J4$Gd{v}(p zAN_rdDS&P@BMdX81H5GO3-%jzz?RrVRHCLOyVV$fntUeYbUsrioc}Pw2yn*EHu25R z6>B{=lycn4BYRVxy)495_>bvZ^$xUjFJ9+w1Go2+U6%NpG<}TbT&zV0l31AiaCgDS z%Ogc{ZTMult4|%DuxUVjcmh}!&f)B^-wS?y&8smLB`)4Be3SBL!Z;oP2yJtt$4-{d z@h+;~aXah4=O0rbw3S22#*L~>ZROQQmEJ4QUZ$Vfedy5k2`QhV{Tbff9+>2ewD>@L z>vsrh)xfb)BW7dnAFYDFfpNVdyCC1~@_}?o{NM$b0||6L&d=P%3#WBbNj7&5{Q<$S zz|7(V*021SCSAUI_7S0_x!VEzK`~-f8}}*8J@#L@*L=NL zOX93wX40&XA8yx`X4>S*|n3@ zmk8oR5FAbEusN6@9eztnPOch_FL_ihFaH|iab9vDda$+Y~^=Nm=J%W?L0>S6ZHRFCj z5*L&EItbyic+Oz@JT~#xz@ZEy9>A?-^nI2msYBAxJ`H2>Y@g(r0{Qxxv;)*-T-ocA zHn?Q{@qL2r^U9&fIZ(rj7de;LtNoKMKe0kE&b)nzx$$T%RfzUTE$rBxci=){m)aa? z@vdxo_oTW--E5uvOyt`T+jAN4?O5_;6K@ugp#v*D>bokTf~+hW6Fi(TG-V!=LWZT0 z>O1SPVzzDD$ukmr-~NY)u`WvZ@aRxSeZ>p{j}xh~zqK1KT`GPgHit0Kf%Sb_wr>TK zpI#jcnQD1gCcn1(x+7?&RwLo;TK0;A<81M(V>!={5oy7?#itw=Ll}TzaY6pdke?B? zfuB++mFF$9q{i~RV24YSsM(GiLpP3Y#I^=Jg7(EoGIQ~Q1P55TA7l?A7hxOX2Y?Ou z3McRq?63rSjNpvPC1?lxq1pLB%v?29Nm8@?;Nl++4-jI`4 zU*TlC!Sycg=@Q)H=U&s25pRus_XId8|K+iP_(U>0y#Q15QssTyI`VKIST?Atkl%u0 zVjt=#7~G~()e|2e8)8|O8cg%SX7~PCM76#wS(9!CB#kQ$<-Ilw(ZOY?0v1Q@dt%gE z>YZT$yViSuwkc)tc$64khgJ0Lu8IwxwIsEUz_|AXlPzWvj}jDy@_xyA%1#sfXPeI3 zUV2OE!g`u?-&;ImoOJK#!;O!2X%XO(IcnTK2M-AS#I6HY)kR*zqJl>v+38%Zo8E%2 z20-`1BfdpMVsepypS=~EitqWxGC>g^V%Wn3G4K3~@DKTKWF^<&MR~Wuy&d7VWPl zD{?9o#W+&Btr%4%w+Hu&?T-p>a2nU_GD$4EYfl`;gQhkO^(Oz|=c?B|Yu!Q?j?k6n z907;&LGfM7w-IW%V4naCT^9J1iEUloft5DyChM04fP$7FDZTrZ@ zUq4+bDfPx-)_T+Vqb$i%|1iRkVg0Je+ps7_hd;=6){RAifQV0n@^ct}MbSK-_?m#W zrN*N283&Ef{e>FZKenW|KGb%*4VpX?^x*wHxs4}=U($zuY`XRlOPryf( zbWI9qZyAjunlOa<`Z`RmzhA>Up|D;efXzp2O)){6l4m0pK@`7?Cb7Cueg=G;{#X=d z$Vw|kWV7<8!{mvMx#=(1s8rmUC;wDCAP3!Zy_IlX9fF`HZ{(W+!_K3Gy}Mh>S9-|l zOPnDax7a8TERa7&ERAb3;=Xc~XonES1?Qz7%-pT*2kmbzgb=H`VeO>!mKzZ?NeNRl z<(1OiFm;zWQhL5F_S6OLQ6rOG^S61|LE<(#o)xHd*N7e`DTzMaBx^T*q31?nX_$#9 zY1(AvnO9cA=4|VA^}EmVw4o1T-ndf-biMmnmhMfWmIx8Qx=Ih)bicv&CjvN7%s(R4#c!&Ii-UA^6Qlu>15Ik>%oiP3 zNxqwKKz~B#Q+;-(MYBPS{Cvi}Kp~-3Hh*<6Lf!Eu9J(-RXQ*bP6DdBCtLc@KmguZ# zHb7rDm`u#NSIC2De?uOA1D)`tmhU9J zc>fgqr3RAJ(3XCaouaPS3YP}tItnnI;&7>;X7U^oozj}VYFvICg_El3rZ>nVzC+7C z4m!4);R^Ns^f_LMx*)Xj4X-DPiteZ~R(+@ymcI=Ru>=g&#^PPg^0@)MCj zw0M9koeL00(KP(B4j1%0q2?Dq#M0Qw(o0M@##kG1<=wHM2Gi&bcmcnyao4Q5J%v#0 zsi@k>yiN%(+asd+U9X0xV8rm4`|CSEoQ);}q@d?oH^NWycnzkg|#EJ zwapHKE;~GAzu6I<$xPe^YmO>nUr#VkxZz&1)m3bXrRM`$o|P(e4DbGXTa!{BXo&Dr z{hoodp4n>YE5j}g9_`zXIxaKo=a}k$wfVAz3RZdu9w9aVSS-A6Yg67n!|WzfQ-hJI zdA0B(F!q{0VHp+BLhC`}Gy6!rvfo8F`h25warl&ypQ%s`$?VpG$deWU-)!S|KAkOX z=!Jh;hRiKBh0G|T0G*Hg)1ldB12L`9}a-;1bbXbykQ*VgGwpaT?$@fqGy{Zk;0$)-y-Fs%H zFHJUy2*{g#=uMbd?WHe#kibXVdEh>&bcGkc9ZSEm=;jtjO_l8Na~i4IN}%G5mDj5p ziJYd1BAoU8$)eFuPAqX2gn_n6d}DsF{K%%A6x@$tB{{&qqxrHn=`&~f>KoSWofN6V z2OC_a)j>SN0}o)o-j`avd6o2tRr<|-Rk@Ww0AhkMl{5UyX*+o29}nNiZ(!IESb}#- zWiIyXuC4vVzDF6<-<$twWq_>R@uHdCz5?1h^-Gar9I@#(<8;z=9}(iB|7_p9;z8aH z_hr~eM9KaJt5n!AQjs)jUn>54k~xi2Le@hqxmK+6q3(&;c)=UI^|$9j6C3@9#l{_6OcB2~-PPUSyz z`<(2>xP{o6Dq6FVXFra3I^;l|Noa1+Viv>P%dvhxgEH6q%d=i_K&Ag)n$iE-{jToJ z!UJJjV{JO!k~)yXkdxE_j1_3zO=4wEg0UJZbkekgPnIxG#Z&#Gm0pcLHD-IpxeYu7 z0?v1AasqRx(6WnJ$}C8dbDFVR1rMz6;I$Ok!f(pYtiNptgHLWhtwmDl_h-dX^RPDT z)X=v{$Aj(v!f$iH)9uz8uT#bC675096vx8R0`UYpZH_~CUx%(OQKb*dPvpUJc~!Z{ z9_IA{2{wx;-gC_~C2TsJCKHQadtQ2ie15iIa6o;#-+{>_kVlP zF58*3{G_cX4#PuJ6w>(TQPYj}xTp*v1+AAk%dFH6Rl!2nJ0HJL&D^eoF*BhbyjZll zGb2r>{%%#|)qdHW2_`75L78!e*t~RH@_y8~ZkoG?Nm5+|FPin&zppEHRmDM z4R=Px?r~fBEn?O~^+8hD=x2hIN-f*uc9TQDhFrSj8d5KZl_(fz8xE$P@hJH!A%SCq zhmXpehIYcBR7;*GlJjI!ZqBvBcOG+0IDjZ5(u<-sZLCo)abp)#IT!-USF=>Wg2|0@ zv>LN#hz(=Sb}0&G8LiU9*PBmWu-GY_J(binOro`3rqlg*vtOo%$v3afF|pOx@;X|K z#6H2e68k>%kQE;Xw~%Qn&_gV+;PEGRaB z!aO567e6IUdS|s z-ILh@Edy_qBL;N#-*8AVVXiWrmaAp@xaEF$Ekbw1XeA|k@&Gi=;$}vjQwNg2 zh%2e~Om!#UGLBSYCPA6v&Ae&Zf{R*yI7ipuF+?a!EjFcV&ZUs91k6T&#pduTN#oXiEV1->lv%Ro) z8JGLl(aB*=TMe3%HjnyA<*=#@z+ff1`GW)p7(n_|%)08 z@Ej+>T02|cufgX|KGe!p{^F!lN1`F+*@7BW7kVXfcxC-(N^3FOOtvk~u_9K_uAmHw zmwu;-0_=$Zm9ESJuhKv-;+0`%nGWj|XrP{u`q5pw=gd(|aib(zj8huap;Z}1EqBM+ za*jXYyh|lfP-2Tj=S!yhbdT4LHH7E@Jv%Elw|5pJ|6Afm!jM`7bqhM+f7^Tn(B`Ev zqt|5%%$m7gyn0YLrQQ;HD{JNwG<7^v!o7QPF|w*>wGMpe$AT$Z_Dy>CZMqe0?R%#Z zh^_%qb)CtGOan@VR@;C9=eoz^7hmY6PA1NaHL~G3*3&PJJKk2*zXTE}>BHnphu_;W+^qvY@*g=96IUf>navBnDD|EJCSG(D4ity+sQ`swbqW5W}cZo{JXALkEV$-=n%>a?xBi5m+?@GCvf<_3&Y??_(JGv0z1X!zI zSx)1|=RdSok5KfB*MXR+IU1-imcJa4fapGNerx}|0qnxyn;y1|Ab7ajT%7Xr{}%|J zj_zcIE7;;n0fbWQNB2J7QrtM>JW$4A@SnukYGyC*8X>717{S&iTG|XQRrm6po_)HS z1f6R<6tr#z?>DK`8a3(r#U3Iu=QI{OX>yN-I{q-F)&Z^gq79@?**&hxptG8Pc;G@K z#epEwq>R-52%$m5?ey{yzxGVpddv$&r6Tm7?>vHz{ww8C%jVVpQ_AsVy-AH10d}IV zOYm80_~-9gh(;QsUE_JhlXaLk9|}pYwUUeK-~;;Jj8q0SFZKhff8>zYkFM;^Sk{@M8v3?A&SE2qVLIvbr>dBRAwjq&f5P7Iide!>^K#~LhAsSig&T$Uv0xFWBg!p^#O+fSG$4x;4Ih)Y z0!aZWWBwB~m0g8XOfa~QLh!RIY(N_qdRAvdpJgJa371yX2?M`+Tb*hhO**i$EteZ_ zG!~0e3dV{F`!rm3o?(?#;>8+06UPG+z73_Dw-{cQynZ&ee|2evO2rp2r-y~~!qLeP zoM^G@3)^-;^p)|af=<`t%N<4oyn7H`;yNWi9I_?Bm5 z>zVOhd3iv!hXb`fBl!7(LwdgsYkmOrW63h5t;2!f}&AqJs=&BDz zRS=6Ab*)r75wmST#Qz?fujMRbNn@LLdRHTEzfTQ;RkeuNxxgFfC1ftFv^t>59aDDC z{BhWqw69}6By~s=)#dXrW?!iMrt5C+lg^qNNB|%uIxMA&8K!e(=3y*gbU^vxrhV?4rjr~^)+Kc!W!8X)VJwl?L;7O!;d{97BBZd6E5w^zhx9Cilr5@qZHabR4m9)%?Z7r8$Eg?P;4H8IbsttusTV19-6Nb(Le8d{lZet10(-x*OSDrA;dQyihDr-6oPvghs}?iosg+d>eLDVFv~+uaf>I|a zhSz^zt2V;dPM9LR7sgJCPLxq&tn6oavQv^z@?OD0_EZ`SN`quMxUgbITlaB10WFy2 z3U@!w-jz3-a|dOh-RC(LAB?TbHiM%RKpyOGZr33geB<2h^;zy z7+A=|621p`21Wg2QK%A5dHXc=`rN`%^-D$A6Ps%`K=*D>x-jeR7oWYQ^HA5L`RnqR z0dPsvV;m5zLLjNW#>;y>=lt%i6xejO_(Do=>)&GPA2V&Z$|1|H8-D+nz=_x82<+ix z63wY`HeC5_!(8|cWycjyXOanS9E$uJP&)ayUxkchSW8)_lo^ErhH>3E|7yt+wtymvS@bp1-fmd zwm5P2RfueThV!pGFRYD$0kj2<0w^uwAgS~ZQK@kIL8rUE4PaW&LUiDULihmoP^9m3 z@RE8zOKp$p-!;m4Xdop7&^+UqYzuv@>nlaMdFM@$N^@IEI;x@hr*!7ty&=7hwi#fb zUblbDa4x4sAb6%)-TKm3f4pSx+`$(fto?_fjEN5cJY4W!c?W9Un;&CRZOi4oZTV^a z%D!cG&xqh(#DUsMhTcGAjHpX$Os+qC<(@)+z!H8u_Hlm=w9!*KXRfEy#==SjxE7qA zftRHA;0_AB^QBg;b|N1(>>iu_U=OC4h*~Nf?4GpFBDafht5d;Ljm1I;secj+x-}Y8 zoLKq(y1)JTUQ;YY%hMQ9y8145d;hf~mVaPoL_6*}y?HxPoYLfu29C;auIzhP1#flT z5^ft#v8dAC{6h63&>>`Xw&9&(l{(X50D`me?6VOg7L5QG?#>mD_?zG=q%p(cS!v2S zvOn*`D89f|K4?fjKQXkZrQ!9)V-PtcxR30RO5?#QazcohJZ9}{xjJLvzX#p(b2*&oew3;U@>?kAds9EMj@NOidCP*{$=bZ|)o7y5lf zSxM~_b8xrZM_Q|yhe=tnxesBgoGz=q%H~*Q3YtzYezM0z*|-lPL~zd9)}eMeqZS0P z;?Pf~?GpWPNBRurB@w(b6h8yl((n1RM%BFGnA`eKYVPHv3tLUjy@78DSJwZE_Vnu$ z%T^lFnA0uGR*#*$Jz*R6gP1avmEM?QBJ4Kzu2Y-MLgs&z&WBVH=6}R+NGe0al3g0! z>`7tAD`a?`haSH->3k$UVMQr|D+9CFErx1@OH}*aDPQ8*IHjcL<~iEKNzRUI zwgR06_TO{uLO?`^i8PkGg9&bNXaWn=IgTGI+c{V!R^;$US+`ClZ~-mn5(?h>-aA~h z8Jw1b(`*y8yl`5Vj(>|<#i>kbuJ>cMog99vdGs2k)s&%1*@Y$)0(j`)Rr$L&w4`3O zhp+M`8nyFtDtpg=GS^0ih)I`e9QchW9FU-cBmWWMQ9fNpR41s?o%DXe+N`#UYN;z6 zU(3C<97Mb|F^3&0?y;Jmj$-%Q`z;a>Z?tjOaT&^#{pq2vV+>EKb(|}~soAL+NQGdq+Z$y6NvCho6zW4F0a7d(dz~N@TBlE(umyNS!NjNgK`u{`c?qT@Qnq2WlGw515!{YRcOhhokOVU z4*j~@l}(u`hF14d)-%486QD8$a#cnVrI<&xgf^u6sa`;}vYLvsn=e7*_S!js z_6zn_uB(|`VBs9I4E@JvXg?&HZsmK&D(`zR_c&KQC**2Ef$eLeDDmYc5MdvQ)#o68 z#Hay>BtyD+EDO?x=l~hWedlSj5j3-+YH81q-U16?&DONZ66k4psP`VZ#tgsjBQ--R zzEYPVmQC_q(a@F~_v>MjakqcbOAwQ915p-7!>J37Nj@PyZg_wElpD@eDnagC=6K;p z%*nweMUr@Vpg!qx=l5u67g87y9|R>1SSUTc zvE}O$h99eFyZ{VwLH|S^O7wcV(2obgCoFc-rsHd*S4Q5qoo*Z-G8VJlga10OGsk3QFhp9KoZ;g#ElOC8 zwYBSh;@7qSGKNev>euX%lSS@3^tq>_c0#WblcMjyu13zqxi%T1L#1xT>g@GOCEa5j zN*7ruLc59KY19fL9Jek7-zy1RUWDmqi%KQRln{^qZt@MmQlrUn`y!HwWAVpJUb#Q0 z1_#B*Mbq4DVPQBA7+xB`AJ;V{=A&Au^YJRvpmNa>ODV56=!*PaW*%uMh*sQaf6kr9Fr^J~c`~di3S#;9nDvAgJk(7? zZ(gO9Ir&UbRA)^=Lz)wTSI*{|J$g<1_>-inwaj?KH8zx%Ca<0@Kf$ z+kZ>g!;#rG0v;s%CMgCu%l%U)>E28H@2JQHFn<4$dVK-GKn>FY3`vjN!{gg4sC^t@ zTy3y21tyN58)A>PQa8z#*q>T!H+9&wA@Gt`ao2qMzlx{Xlvgt}NJtZNIUP#bQV<*l#888&7 zU2~vmGbZ(`H=Wt>R>$?xmn*t938sbla$q&>+=3^jk^;mGOKu;O_Z8OBzwS)>FC&OA zK%DCOdrc)B%vK(HSuMWNC0|?kUzD;P&4P-u1^oMbKUr{}oEVogPW^Nr837GvUi!ADY1ItNqe^ zP>uq0bq+W^$Su{yQ?9YF95h zoH^O!`EqAodbh~?+JvYXl}ydJXrL5>l%7Jl98UAHaES7|DF&{~xi zR9Y&%?>r18Uh|XSD{W?--yhmPgf4V{T%s=`*<5if3|wDd3KY;#65&$VB^=X!CEfy<}kkUh~9 z3h?iXsvdY50<&iTjiqWs8J|bKAWrK&SCLI7bKrvjv-1Y;PKj4C&bNXNs)j$I?|>@S z(iCDfikw$^?B@k8%v>=5cJ437Od|Kib}Wqak!{is1(O!e@oVSPnfn>qh=PdW#;JE` zaEYt?cG#x3j6?Vx^t}>Tw|L4M)H21)QsjNX??Tu&hK1=e2oaHyl#Se(?OF-;J=IjAx zAMNEqacJaE2F|9}I2=3?43D3s6?j8SZoceVeR)$ongKEjIecPJo!2H z*>t?zYmk%g=*WKY`|D}Y7t>2C4U(_}#llO#_2N=8?(I#P-E@%zZ})~5uy3SC9Sv5; z?N7-s)QppBS*;L`H6!%Qhu-tMbvCbW=x!M3p$;Q&DFKEIV3(G<~j;#|1rg3YJEP?2*d$w-Wh|6{J)+zB}Rk(iSLkaH$_ylO>?L{0gs34qH#0^(zP3|U6LBk6oOI33*n4WZFQ^1}lxBhPeo7--6p*{i||F?hF4Ng+*u`fpDZ+`7Sy#5jy%M5ciy1;lu0f7;_ZC5LAQ~d7vSPSn&%H= zq;f$kN)xz_-0kBJiY~=Xqosxwz_@JA7q5G}t*{AJl}f{Pj8scjshME%t&{KX!-WId ztg0RbW!g)7cZAXTCH(0$lWVe|&Gdbt0rl{;tQjC`I`70HE*3gi8|#w1y3)8i91I4U z-p4ecaSZ;IYc**;y6y#Ozj`i~4o(9Q{6=$U5%|w1p$U%@4qu2w72+4CBD~bqc}$P%zTnB^76oZ0EXV3HK|WF@Vaxb8n7#&vU*k_;1%_M zFlHxI?5kZ$`^{dpd4u--m(H`mQOW;Y`k3q~K}8T2w`nKAo#5MyrLyEZ;xUIM;YjBM z|AqJt#%Jbvz6p2wpG2P4^x~(l;$+$N>PxFl?n&K!CLreoQtAk+ui_68WfS8O$d^02 z)DPatcyN6!4v$KjyHLK+T9lttT(Hk>H4|g2{*zkp#ZC-TKg8-&46bJSWMg4@GkMF7 z_CJMw7nI^^BPa<2FeeJu2hoMnFl&VQlwnAzdLh;`!Lm;{#nFesF)P?xs2gwhj8f3Q z6)hNyx5X#igfXP;@7zf*d(lU^P!#Y{i;~omW0UCX4@xEGXUk3xHMw$6c5=FDeza4~qX)ubg1bx@MV+a-L zN)W4qFrDAX4`n>*DoK1Oyd5Uol|t86gQk7+G7Y~BY))7YOfD!sZml^G3R5ijx)B@! z`*EjHVYp zw)FYaR$tp+7n9iP3%u*ue%N}IXGz)-Ownfn;W|HLi5neXHi2bevCClz7UWLT5X}dd z%Kpo_@}5i;51RnZ=AVj?iBZf4{3q2%53&QyD5&6do%`LMHPODMic+02p%b1dU$1!+ z=IK8>T%9p5EafPhlA%D0@ZHs3e@lKuW?S|iL>a|<(h8iII|gQ_XJx3}r8DRFIA0li zO8wQnDEcv2ulVGouYUT9@o~vsku%+8w#OH=b3wTVxo{z}k+Eh)!CX>;fEVsg$eoJ^ zKxM-Bp9o%+U;W(z5s|XI_G8G_s0IeSpdG1aOw9_&0V`^6-rZiP^WnVHRypnFu_<-iJ=9Z$ zFZG&K04X!cDEq36TDi&%jgiBZd(;N|A=Y$Z$-A#}WzpteL9rUSPm962cvYOn*3I54 zxb$wW`+NEgiog{*QR?J+J4E8M2{(JtYNSY6v=^}^!xpzXmZV>{6on^-Kdq)1VgRNu7gFb8|JlW5DqCb1d=UIB@!?+gF9$>p?To-nupcPr` zpA}B(01Spzda+=b{o+QX#!8s<_p|?>jCsJgC@5Q&H9-mJKb(sr`Dxyla5?dRE|jp4 zSZ<`mM$G14H-yH9!d{^!W$jwgo-OA(HKUH&*OZE*LFbzu z6!MkS|Fq9@hvk61jjtdKZJ5t?*!u#%JSrq#_Or-Aj-36?Y2vvsfA%T| z91C$icxXF>yRUj=aquFA)eh`Q>f=ztW&O1fi25mq$cIC>twz^+5o1ATa5ku8*yGnd zmD5EGg36dJ6&_?Lxq~Wq+7U3+sO+-*<*=rPuqA zW=hp(eKTt&JNRx+_4u~H6a7`q%{}LMKy!qrSA#RcEL!`^nx%ejf0ntk8?T+!acR&TEK@lZh3R&Kdk!UPq;d*K&XyvaQF;aV&VtEZ0LnB(L=j`7f=GefI{nEZus@|tpi;=8z(4>w*agfOj@vC`} zufJMK>ho*T*7v3=i2&xu2i&LwnN{*c?VAh}<^GvFfmyCj>4AQ@%M&~LyJ zOYy-l?4on-rWN$d=hV^>U1a%noJh4a-9_tJvPo!=0rlqtrSG-R9jnwf9fol}qUy%E zPWF|;?gqa9>JC9oV`bjj#q0PqBi0B=&bY`y}!0chuH|v5H>`^oDqwA z4z-@hEgV)u-zgZpU^C4-5Head1*6jbhTxSA1%0(;jW@Mn0(pr zY6kcbFgB0>k{kK_1Yj?b9odQ*d&SAe9FJ%Kp&?K2I>mqO;#tqi>c|_RuW)6Yi`v5~ z?fDu|uXa6$OP8k~&)wi_0)N{Vq#<7RFMMi>v!AUEiF%;tziG8!6z&|P+4lmPiPp4y zOfdszILf@ECTkr0Lf&)^^_}?S4;%jPX5G0f$Fr0>mQTv{Mgz6qwW%g28@u}W+>l3Nc!gB zNlJp|cp_=4J!{`M^Qk>BDR%|3i^L^4NxRW5dz@E=y~I0?ONu_<^CN*M9`qN? zPA7h)=-rcakpK;>CMQ^@qw?F;kdMkoOP15=HMo4FiO9IOOK7HZMP;MZ(kj^r3%Ek$ zk&mLt%5}I@pE-C|1XuXpMp|^1{!+nAPfs`TjbBrnat7syU)ryj zlg&Wup?*1`DN#S=5e%Htz2rhNqjrzA0P(wij*p#5B&ducW(X`JNXIdUiWpxBhd5!DkC7)qs-S73XelRo5LQ zY&f@VqXlKepr|0{sFV_6t3U?$Wck!1aoZczX|@2I9Ef2i12NL@H3lQ4 z8NuO$wp*!e6r0^t9w++JFuBkAV!$zA#WG6hm%sCgtWc&rzC2c;ycB2p zG*;*O_#X{5zbuKF*jeI~4hq^bl>qk*AcB$MJdp_QdshZC zU+v$yk+jijv47;H)K2;xBBcg=%Wp5aEbnBY{lRpvdb@5_U$k%0Xx{I2Rja2S0B4nI z_-g4!O!PqdB~260c8Atfm8*9<#~$e5l>0l@Voc)@Z3@YR-8TdWxt&iUDnJO_I0GPQ zIo0#mAlS)WW23fR!&N7-t@&~=uNn-V=8o3Rv(BeMe2i7?HG0kRFrT^!TN)J)JxFRK zvqiM8*Va#tjjKzntC2l0A;A0B7t+(+uP>`N#p$j026x7zVlT+7esqmvoF85^^OE|w zEz_}7J9jcmHXq~sN1KrAc|ni&T#qj zQ4SM6-uUz|aeVU!`FqM_y@?l!vJ{6qjJsI;^5Yq13evd6TqdXIr^lSY_3m4Q>Gp%+2 zTp;v;nk%QnZ{XjONzYrYd{6#_Eg8p4h1W+9iT92STx$P`%-z%(=p*_Hjho-(<*`;c zm;;qp=)N0~FHqUfzenk=2U^)mzZmpg1VlZ9ta?JOr1b#rBe_8A@2U5DDF+_T&sq$1 zNPd7JuBL5YA7t&lyu4YVKiNV7;?U}4tbS9I*7%bZj`{eGZT#6(RoJpyhowFg8FLu; z0%xjgk4^#1J6nLP3g@MB92p-{Q~|0xsCMVI)>iY{8Uzf0zEA`iZb`#3KRE&jB2QK{ zqH82uHO(d!&1IjT7T#7=6NvBnVQ!5zeY(IX-I@5~XA%(3NJ7illaVFhlTPH9x6#X_A|B8KNKD0kY!ec%el&p z$+t-s>T#?t{VC6v*%=&L6f>82Taw6*3H(p=sbTVxXdz@HO3{;@zR;9BF9`NGvlng4 z)YqEltAfhJcQsUH&E`WFDx*8CIqB z0Whi(xY}T6M$B#iIyw212sam+H*%|%E+fRF;jId?F|+x$^f7DFQ_J&^;Ii9T!n$5ZZ zgQAWpO2oDvC~59aqHk8~8^-)@UW?=&xUu}iv!YZXhl6x2Z4)J9f+PLw>JTdj#^b3iqI%} z4Z3kiftMva30_jxkk`ht+NqmeV^uCuKaNWp)*1*bj9{?A1kCdxi9Yy>9l4=tMl=Mw z!=mlJET{o+IJ8Z!KUe8@F5PTfgiz}JL)5z02NsCkZ&XAu$?}U*ii%mC+jW;67&R~N zfxaa~QiAT~XwDXTX3&kM=JA_Jzf>`35oC-s-;uz&Sf6Xxc%lPHlH+~M$bQ3-Vb^)b zRb2VqVUyzj4V!`*58Eo(AI}T+6Ncub>>++aXbd>UoQW5P{A`>FUrA}4-s+~t0~bG| z+p6g)ha%ZLmOcisQ^XuMXcc%>W^GIJ&%ltt`WdcFCG$r`kX!h%(A?}nw}+UyAn^`i z@0ZA455Wr<2TxDdV?yqhPoz)T(_i%=6=7?C%;HV>7*)v8HO=NwGd4y%s0nkg=@r~2| zD-3cLyQwpBs~zGOkjpx9rd+9gtIJ&Qf!YOTv{4huM5`$jYv*cTMe`8q^YS@x1jGXUd_|J-Ls)qE z>h$T3_>GI8E4FbD$*D^9*#_s0`WB!TG4k+B@%zGpCeMe^{hDyr&)_(bc9C?zm*o5Y zHyK2_F~Iy6UHkA;*q>(q$h=dH`1nq|sig(8J`AKoPF&sYPz#RNy3SvMntRxCeLUJ4 zLbYgo5GyaRoc3Ct`x(!t?Vdud1Js_hUvag2A(*J^s_Tj}HBC0uPhgE{&BG1YK^t6n z<#K5a{V$w~XK{iZ1j&X1Ve}V`pMPovIc^K0<#|r<%83-^Qq&eW(WG*VA9bSY@o72G--D z)FdnJuonbQ`W0#}gbzd#*~$a}X3NyX=oLMdcE8i2=QwNN;>@u^Zds|u!Cq?4HVd{O z){YyE*af$LMY1#z*Gc}6pI6v!cM;?DR2xF@C?g5XIX2d?({})+$oScVxD=U#TWTeI zuMl_UGR4s{>@mXbpU#^n{-!Qw z^sB?G&}x&u(O>e~GHgaV0=WO@CkNA~gN7I+EMFh^d2ruT_lO03XXKkA=b*bHlOgq) zTDNC<5p|AR->lRCuvl{@O&G2(uOI7E>4r-wV6|VWF^G!-1B8#qYUjVqnATdN7(L6P6=x9<%b&NTCR%`|6a* zqQ0pNSpClcly74@AXx6YaK3_r*P%;ZYB6X<<@3xVO(~@p@A}KvJhymwV1IcODq^kr zfdt~7!c?M2$lVdmxpH&&kFa+ksHLE~^8Dw1lfrJ{dXDRlAK#1B42qT?>PcMEGe-c? z7hKbWcL%;m4k*uW=S~0tw7;|>Ubuhs-S5{6l#I9TGrwd9;ndeskWSH|P?EArhgI4* zFzw4;&mNOHIR5P;f%;pZ;XOyjZvNC3m|XD)dX@b-zio8y5$A$v#dkyfR~L4feP7<{ zp&qY!HhrZnneWC^C4s2jloYUEFSJ0b=yNJf6d9U$qzgDk&&eOLMU)?`6MudXxr=pK->QclB3n{1qncatxNvtZ!H znI!ObsL6KT^y(DH;3eRiK?M!}A#V*DXk}NjO~H?4asTk6qj%S7j*U%QDiFGDcav#v za9cjU^f69kWORP#6qtl!*3Ca=L+JK7^N&6h10V~|>W4)b%MCuzqoZphn1={lIYk6+ z2DKN0N+`XVLv;qtJ44B*u$w7t(Nz9MG4J`3wG`%bV|%&5Fw*I%wG|&{bkBL*Oov=G z`MkH>eq9eAfOjXCLsLvnVT@{=Quvf@o1<_j_!dplud(Cd}m&r6KsJFCU8R+HJFkv$!jkjt z^p4(*5D^LR)kJApd&N-1M@q+LZo0Q^)-E1f(X>ic1F!qhc*?Y0L7<&#W9x}k^K^_a zP$rbv2pDR+P#B3smSgz{Ujb=vE*F;C8Zi_=Kc?l_doU6)J`mJUIuK>M>4GN+v^nK8v#iOr9n(y>b z#Q|tRQ+Np5jNJ4KEFfquVm`N755$VuU}lvBRA?L=(GShjpK`C~%;_sH2QDaH z7UOyebM)sng;1s=Gtu0RCbfr!*SHxmL7YH@!J50dT}e5=DQ=tj&5`*)_j=Q@cwz_# z6f%fCgh$YR6-HFWkmbA-!cH_{Ln|c<`yc61xsu#i-0pT9*a$!7;6L)es+qJm#E3lt z+`SAwXhR6URoXaBb5?&w%3_@$*G%$-K%KhNwR4DN3#6})^TguY8q5?yI{5g}Vzy?8QpC z0Auh&#{t9myv7M27iHQ~&30~kK*SZNvj4XSd8d8k3@z&VH|NsK#CO%;v=bqAPcq?z zP}6t9$|o;=3_5@D=3dQ*EsoBs`=u35;~cLh*xzLUga1$ElQ&kUiT^ks+%NIZwUcj- zm3_*7y7$=82XFU&xdZRezy-}O!%O+%3G8V?Wglm)9GBr7tCvNy#rg@3qw6V6XR02& z>==LiIu~=6e@q?Cm++M8F)P|5;&rq+ykV2TrH@aS4WZf9JDm+4qDy4Kp~mE9HtJq| z#}xabou{utoQY8XF>G_TY~U)L+G;9m(`U%GC(9%tk^CzE#$3pk96VgNtW(Bw^<41^ zK3p?nRkK7V4UVWM{+KfHL_Sbwx2t76lHmq4Qce`*<|A@e97%}q4Vo3U^T-h=J_@hc{9CV1A zs#5Gd`c^CZy!m7xnNgJoYDRe}OCN^-4QF*NlNX>ND{Y8nBRv-V07~q@@B*BrY<~U5 zhc#`_^B}=M95OY+>2OMt@NP2=28PA)KMi(H)U0%Gt&YpmXIedS3QDVip?}jwFeA!R;~+sAO|n`}`hG%1H$N*M4eAu94dU8F2ve_avOwjQ11MEkkS#m!?ezw;NBSYW=G)#1{$K5Md<^(k{wqdw##w{QUsI2gvfS za_t~mJI{1@iTx9IX$SvkFU)Jk4^hx7673dgKu3*vDp~B zr0?WAqg^|@sSg$mx0zcdzd3BRJXsd66J(?Ir*iP61_@_z&}dnIY7WThVM6g+(AatY zi}G6j@om|-3xBmI=`H3YlV}YdFowYVBG4PR;#njJxc^x=dJSkY11ipyb{GZFDhNh# z7f9AQwv7RPS5WYh>6|NVW)sicMot~FYOCE*me6BB+HU&vaSvN|m?@=*eZdwWkExdy zmNZ;u-9YNa)n^7YIOL_$F6&Qi4Bl0X0Umas1;c?yKHOEM&(|rHHhoy)zpPPQXSc=5 z8HGzf(~)%+HAhZZ2=^i+9X8XUy;{U!7l2tUH+m^R>SVjM?cCUuv^cL9kuR?o8cQ7Tfc3UJ&%f9SY!)w~4BtAlR|I9IwiBa0k#7)yMt1vU@$Z%HmHC`2FW4{@GPDMa zg1cOI$DxY4QWsfhfaE*c~V+sch;QCtDKp z$rD+bPOY$Bs1B0ez9lKqu&^yBi8sJd{3bnae0^Bq5<7NNqFmtiycw5q^B|wxbzNE0 z&1lk`|Ng+jQt5b_rMHaM+^CSFZ0*H|a)Nu~dv|7!bC!GJ*~vY-o1VkZH1zIcotxiV z(*u~7Bll2Eu@)Cxfa6x4h7JtL~Qaga3!2^J1?;m9bh~DZ(fMu;x(~N@dY{d7_!M} zO&qP;FqF|Io|C(kcDd}jMug3>-&Ga)HTjl3HBoWP2!oaRj|(M-yf6O&|8W;z*Emg8 zHHrnoIjJ807~Ht7bcqii!kchFoKTj|_JKt&>CU|mEgtYyly9}71F-d7GrcXPyauC1 z#PU#n$XkXZpM;jSvW^4W5TtfSQUeM!pb*@kr!{hj#lT4y5gW zNK`0VVzjFTe_r@;+i!!ORHpsY!{?2>G(UeqhP>mdxBb(&d)y7Z#?)W0GlmiM$xfn9 z>9E%0m_eY(FdD|jvOkN#|7*9mi`C>GyU;K8;5)!`QQ&u_I_ z9Sxb+KyT$@WIl#VVm3k&BMjzF8DYsNUQ*lyaXc$<8kV(EU=DAH0ej?4HJAJx*0=w~ zuEj4H?e3Ld$T~oI^xmp<&>#W%MQkYK8?mZ^zbmE&v};Ep*HYa#04@ zBw^b5ETFw4>li_B+@#;!uZHapM@WoDB zZ+QBNWvg>Jkxbx4*y=HRqFZnKisP*tABG3Ek4hv5H(%&!ZKNFU)$Cl9>{udH2tGwOs$eMI zf#*ZGd1Bx2M$A-#^*+|l*hfpZJ9?X1r7EV#9kS=~EXb`lQ_HS)DF8MYqs4Gh19eIZ z6{m_xvMLV5ywaytS=2Wok?JLq&D&wq{W_yP5wPVq{6;KNJ$&cNYA@u1{PuTj|JFHe zgxSRsERr5IX~eE4#DrspIRK6Hi#D9Uvj9>f1kYFEwLaoG8Ymx=U!yBafL%}Ia7B!M z?xBv1ZbUQ}3@I{NJG{I|kKCN?S^}cR&|^HmGOhiyU#Q*U4E~n28Z~@$`_Y)xEY+9tUsAEMnU+ zuZ!L1>Mwq>vK6AX$Tj0j8b5CBpERPXq3!#>yggv{#T>=3=svrBhidJJ@#ikN?DEm} z0zNtJ8(}OoUSVj}S@9U-%IsT(?o_v(OQXD~@r zldD)d8B4iaM3h*vv9%t4W|ih6Y{ZIQXg(Jud6L87Cevh|GH;P9w8xI;ft(8eRQ@qi z`O*)U&bfThVkZz<<3)Aoy&dc`H%Qs1_?A_~46l`c0P z{9RI*@}B|M!EIU#ciX=w%J&|v5uOsOrtiV*{%Yb2>$+hO;NOlh2rzJ0v<_A z%MIKM2Y8;zGe3v~07XoG=W29t5?4k6pn7-hK+{$^8{#DVu$awh9Kgy3|TE-yW8vbqseqU~4Hw z5$O2Jq8Yw$IWliO(B^?f!HD3S)d^49lDZt+gR*+@(OWz#?iRK6MDyp4kXGDmeyJea zL~i$)+?lh<8G>0!tS9XV230>0T1MHWSXk1O_=Zg*HKdw(Vv@+%QgqX&rANGP)7(je zibSwr*^0VG3v$!@Sx<0!-t%P|&(OSm&j`4EFG5gw(rMKN`YSZI%B}4qGW^-S8r`5? z4deo)ExtEhq1<#T)_&B}Be$r2MQ7Lcy&qv-;~PnAC%;-yIe90}PP-Z5@VfulCNy+y+hG-N)SK z_i|%C8h^jP7-jjvJIAK+)a#giWzA8>8eW=u)*3f)R^&8!)yB<=ipb3D+7U}TmbT4Q z^YU`x&QaaX#}9}}qly0w4Fq`s5Z89W=!zRipJ2Y)O8oq$Yq5RicDi_d7We!|l(VxW zxILqup0Ikfh0lUNRS5+f+KH?RgKu&d1W$7QO%r`nJfT+ibH{aZw)xuGHC27e4IKN83FLcdOZO?c`1Jrm14P8)6=Q@>zst8d43^yRnbAZq;{XrGvG8^K2u@ zYM61|FP-^ZvinW%?1{Zm>C>CJy#l~*QVx6tt}{vQP|Z+h(;gzbzJxt;kfl3?CQy6n zC2=hm$2|TPi9TNY z^&LC+PFHMyv6urn{nY!v9S)6eU+U0~c~jFfs%13sB-^RXivS4!2QX>=9=v6TSVBHl zoFN&v%LI%7Xb+q1Z?9 z*V!14JeI=|GuvWZT)&5qYTKJkA$}Qt^K(~DTwFR&*C<#LZ3Y>e0*~)=T$B+Vz2g8L@USXQ2q zVAf8#reA4jJ*1zA4O#Q}hFx@JPX($iWU?zOoLY-Lq_R$_E}zatc;$Haz=!+ieRASr zu1;?_7hW07Uh~zKU3B|czrBB=cEa5kQjXpt0`9}@R(VU-xErkk_@5>`=_YLslh;5-Y|3pda+DcYGI)4jp)T46Cl5Mmsyd zc0HrgIW%E~Sun3K1LIB`VBSd&(d|gpMJoTe{1b)i3ajhi2n56`s;169$=e|SXuSh_ z;7N+8tJM8WgPH%t@%;5bFu1HdGmEnk0h$cic+x@MZ4v7h0d1E~&qdrs9=gk)J3<=g z8p%UHdR1;DT7`Z2q>i#y*Ym#j)aWw(Mm?8ssa9jfSA~36YWwJqKbPX{7{*~a2*qvs zv*ruwOHBo(Dn6Nk1LfLduU}=z$}5_dD5$x9AHBhP)%L zT3>9~p*p!=x2nfP9FF+(GhZpGm|wh3Gdh%Z zZ-+eiK9B33Oa3G1wZy!r_C`*4!=(-iM|&pSv%*(Yk032$7}H*(;y3dJ^JAP~2%}%ic`5s>19^r5y zn)|%8!nF}-R)i^Tz}Te%*KUm8S}Tknh-N?F+0M0!?Y>uw6JOm4_!`%%O&Z2vh-rV) zvv|3asovaCLu!!n`5)oF>T)D_<&(w_2TS9sZPp*YY)qCDZ;87;jyMiZn2h$rc=78; z!i}Q5!gkll{7m#9dk(vU{}CwE_}R%PB{NX9G?;n~P%sfDux^ViThvw|m~>ErG%|Zc zsCgkP;2tkHo9wx zS7X^Kd&hOX<8f-Gl`m}}KNQl4Y;f*tO;GJ2}N{>5v+vHcv ztkvdnWGp9!4wU{I{tG*r_o<;w(~wP5qj^tXB2n*ioKv|J{`wLBncnMrN7&){mNz%` zN0YZNN3Cc*$b30?o8@1&`vRQMgoeNf@W~uRr!@EQv};TPAH!c8LQV>;g*Fc6H4kIL z8wR2tTBZl8#5ZmIeZ}6%XiK}T{=l0LLI>Py=qKW1rT$6h6rVIdrq?eUCcfGKGBC7P zTZz~>&4tEj89g-^)CrK$?>Yijo3xi`sdC??hDJ#4OmatMxiRvy4g{vYQW}fRXe7nMy{dqF7d0!S7!eLHI07> zP}y7I`n!kE?SJ{%CJh0tCYmplyWV*V+iQ4bto-Nt+4=$U%y+Qn%_?P{X`1*4sM^ZR z)k6rc^#~)xe<|N{jj~wb37l91hBGyx165(a?UB{9u#`GVRM{!By&}nf!F2uEan%%k zc6nRkhfBF>u#{=sJDs+=2XN(4-KR!&Inwe@&B}7b-k6u$7oVW2*Vf^ymiMo4=Eef% z{2E8Cer6$AHlc=Pe>FmBm3>?Q{WPANo>ZE_9f|(l2iw{ldrI63XPNi8KCY+7P=+!6 zGQ447ji?`(Shu#(GjELrEh938>gpJtcc3yMWcoE`f8JRPU|EPh7)^oJ5|belR(i~a zb`|e<0&@cTTI<7yt@(8FrJ$3hDwEzT}eF`)b+vMxHH)Q~pO_bPJ-Lj7SQzD<$e&2IuA zjpre?=$N&mZ40|2%x;Pt&pNJd4an+HRB+^w$idBXuUQv|L7Nt(gr}Gl(<8THM(PGx z_J<;>Z|_g9DEg1N=|n&HARnwE56}HWHQh@?hB8#_G8948mOUVk_8r)DP}b=S8C4ox zd5896Kttv0d#mRjt5hd|__t-68ip@hoBUqDhU-6Lo#v{Q;bH1gxC_yZ)g^yp(eC9T zni;*dMVxs%lGWV0e=Va8iGIMEUQnlA6AS)#+!cV%NcSGA3r^mmtT=-ZZShp9T8Im* z_&EGU2p62MVcCU`O3B!}1i7U;H;Mx*dzaB-8F(Wu_&FqnvVSKQ|II?zX`2uWP z`lq=0PSr|Dl%38)n+qK%M#3oisFw-}f^`5IQa2AL6mxaKpm4R3hM}5_*NGUW*h6n~ zfY-Rh)Lrtz^0TDi6B#RAZg0loWMTgykqkPOygL2^vZ)>BbkOYI5<<6+$B?mybFnXC zWJ9%abr$sROK094H~Ytf)hpdO@>}Q89U^Jlv$j@7oGxc3CXq+p-J`dv|M~4QMYGXL zcJm#>O$=40lkap$>#1pNboCJg@@0>+H1m?vRAiAHaq-4EF~Yc}*}l&zNZ~M#dgQ0_ zj5wzr903^SgpOj+c_W(DIt2<|fz3D0jYJpx~^ zU$9Le?xW_&^Q}4g$adA$3wa3j`}25{%GZ5|iHm`tP0o@{jg6grjVMU@g-wa%!?!Dr zNUVOkTM~&SsYb8Eo5WBXLM|FS?ufu21Rv#rmTptO3uRgS z8vPEmC0~>0jXl)b(IcQN$Jb&5{|0S+!U>55d5@1u8v=e2nPj|bW1Ig?uYQ~Ec1e=8 zV<5I;%5Pfu5t#f`RCA*~%dZbc1?@5=v-X(z{z7mUUGt9O?&M3dz6*(+4{Wsao1OH< zr4ZFee+B^+b3;@xc{4YpjK_LWM@$ZNq(eRCc|(l-m8Np^&u_0ie5=Ka0^d;4e!!aa zGnZ$&r^l6*VLQ|GeLLT1N^Ocw&Ls(k4O$zM9n~Vwh7fmAwIOS&t{XfqfffR;=a)1N z_XbSE78rt%U_z(9lb-P{&QEL;)&RE4$G6H0d^}e9QMo>3)|*=A?vN{bgIU#rH1qG3H}QOmpRWVo}9L{HoM5EBgHQ9-N?gAt4o^?51tm* z9-W_6{?oVEcRzjWRsu6iX)t)_J1uvHk>uqaf2`foXZ6jC#EG4Lb2)#^O2-}7=QczA z&#umHDtZ-d{kie_I#)8rO81{}I~zy1r&Tf_9;8>E@!-N2dYJ zFvEV6Yw!pX8Dp^S%S!~zb#m1<5uCt=skQFnn&v0t&xXwKc>;D8ozqLP&vkpxG73_;O zWYtYFmP}#^V47x33LR30=!pJ{ zBsNZdmEEGpC8;5o?o#Ixu-4u%e0qwh5hH%<%#AaECcc}3wDqt4{^-|yaP{bS)29sv z8++Jlc3!X{D2JMo!ro`3RELuFw{nONoNb+Av_%XN zYal%~0(4}HbmkiWI`cqPy#oKXhpk;)s{nb63@~ZiuE^e-mA2j=xil|t5UW-rR3Z*A zX-m#x{gbRl9r>>h@3(&5r4;H)Z@oVjFo{d}mU#ZXOy_U*68HXGSfhd!nC72b#7KW&PXdYtRX9aYz(S~_Qy2l$%A|;v{&CZ~> zB%S*_*8s~g)U=aRdiLkU_yV{8Hw!>f|KgPf&n61#O@M+^6{l?RT(O6Hh~_EvJJ^Y) z=QxQ-i>I9{0MPSm#aUK&^v%?y*~*b$AcgCuZDXx z0w2Z!@b;frNXRF5PqLy>fxU10G4)AOX!#gktx}S70ck!73Gp~=Flj#Bdf^pdgfiqu z(5n{EAt=~Zp;&=O0Zor!_#N|z-AbL;!Pe`9e|}v$)z-0PDvx}r$6a*(rn;=Zvms{Z zOv-7dALs?M`-IEkNUj|9`EK`&s*>BvZJ86m?f|b_D|f+W6zHWi=ISFdSrO>+mCYfn zLl(WqZTxYQQ&k?|0|B;onu=thoh_JyX+B(86qg9xXsL{G0-^@?;N0KOu}JO`>JB;C z&V>0>4!$~bx3r0I5t2LyS*oZDlCf>Hg<9Q{t&(_Sw;I#`)5khwo}4V}97&XzrITadBkXeFJNQ*kQSRYukZ zndmiJMt$3v)!r;L%M=Qc13?QV{#GV_C-|bsRTw`jnt~z= z^u0i$KuOw_Rgh48c7{!Y zkj&ylK)P4Wg~rvU1mxExVEBRY57q-dwUGv(VDRdnEULL z&d5&-pASvkRjvOb>lqWHnBntu)K%j`=UpxK!?drm^cmO$nmA3 z;C9E`oHWk08mf|7fpb&-lX;u&kAWV^p_tzH(&K2*^!>q|G_A{W8F*e6 z&LEUqi}lL8Cg+IR<HK#SVB$R7Tw_*l^NRmOnoF*X6aut<2MgweB|i-v&#+ zULuMR>Pj5C)j9Dbd%RaEQ+zvG;^Ea(=5xTrWqj^v2i;eIZTA;N2jQhb3ZBG(y>rS+ zznA?GwXcZe6hZoI@p%e+H0IE#dy7d}eE{7u$_-sd6Ym~E3#y=i0BAS8jSD%yyYpHs z@j!8b2ys3g;wa#jW`X4ZA&q00Mk}eCt&I{t9HPixs#@4~Hb;K;Yb}O21k{+6uaGXh1m4FV48Y$% zBr}q`DHkvXO8zz2VZGZ(s>sXYKC#p()2T7(by!_-uN|LH#__TlE+ryqj`2p>oo{N=SV}ZzfO+fG?5(c~-ajd%)Jo4xnXvR8ti`g5KH8U_9YmVq*wMzo?RFGab@!8Zz*L{%W0Z{c^VwUh@8xf{a}zGhM`V4-)^Tamhrl z*wWu1+%h;sd2_*Lz4JNOqY5!&IOTulvJ_p%5g@FC#>?P;Js-q?dn_=d)?Hv zG>^3KA5q0K-Z?R&NijOpV+%(-LP{$=3X5wPLmXAi+*8Q^!`WMhHTk!H<0>VBAflku zP!v>J8et$vC;}=wU&=DpXX=c-@~12_3va zkG*cUfw|t_a0E=jK@MgV5VM~&mJddd&@RUHx}V%io>%S~P5z9(t#yur@AsZ2z;5p- zeIvOe5k*vX!q36$PeiWHAM{BdHMk(o`$HnR-L)>mWYTv;nvG;Oh52j{8a+1?c3JN8 zohgUwjz3G9dF=UKc36*)R`D7u)3VJeHdWSeC{kQSPhq6j3tmSvD4s_)P8e+KuA^4c zXSBPv6n9b0;8?-_|M!=s8pu7Cl=^$AA0H3PC8WC+g38I zhxrJq8Ge-W9b}>{D44)jKL%Cg7a@$KO1}1 z4$Q!R`R)EtF+M;3ZEuCnExb4Vh5q7Oh4vt7rLW{{e4?;wylm3GuO1$&1|Cxnm9H~! zY*MKOCU8B`v5&DX7blG0qkYft9#6(-%QQN!G{|>|K98k6Ob3avXj|=msGli~ooF^Y z9Hs@7E7Ko)6O&Mk;oo>^eBV|ZpuYH2dfvzdK)f_LG3# zG<6;V?lZn+ZCBmK+~UrOEA{iS#MdGRPLrlnj$>7ZINZ(8L%cXwet;>*r`r9b(_(W;Ms}jY};RX+`>hWQ5NG|6nEVAN*`t*AljpBzUEL z!8K^7!k)q(D1^>(WA^BaM*43g%*!}kwjk@bc?JGSblY>kZB$Y7sJME(bc z^Ox&#E}DOdcP-Ir&m_MO-Xa%vcC)W&8|A8Ff?U554s~p{?uZskR=~3#N}VidbRngW z)iE9u_K)hftMt5D{v0Q{w1#nwYuOoo*aFbz?||BowTs&l;bkFlIEu&MP#5k;#p|?t zcWjSW)+#L`H3L`)UL0Q{u}T@&4uS|{4ovj3KXwLCD_TinW2DR89AMbUl&_Dw*V5MM zWEny^gzXmT?&ZS`!Unf~w9G|KSpw|(lj8C|FvbydSI-bosgARa}Q=M1v{D>O_X{!Y1a}@-40LzioRPUS@WqlS&X^!_! zgI`cWcQrY@GlW`kamb4WE|1nFku8U+F^ffmZK%@8Z*?DCpW_TroC*MLY?QRojHG%q zdk4RjHZ}SaET-FV63L$JilIL=y^JI;yyIFae`Y*|wUK#iyy* zWM*&gco#;Sgs{*?m)&$pYZ9H{wOda4^u!Uc9(P@La0&=o-SIw)umqQ%t%S(vUVPSG z`M#(os?Nr;rYROy+Gc6P93}K=X8G6@^W~0$ZzS9wS2Gz@{vD{?Rj;4_sjKK_T@(~j zS}h*9Kpanf#1u9(m-kAB2mLMmBzI-qV|0LtSQKvC0lv14G{%SO2!FIMJz@AKn8s+# zwoe*^IIOI%Zdl}PETiJ9NlkVee7yL>Eb1}PD92+I7%w`B>P1OqIGz+p!e`(du{I@U z@+s9f$HdP)0zOiqt<31EiH@Zw%_ByRu#-_V_}$L!4x_Wd_^ud0Xzv4?3mSXANIU4R z6kyO--3lD%pFi=_hUU=cjN^)5Lk6(Z3oYiB` zNX)Y29=- zz7M2VV$o$k-ow9^-8T1*b?&-ozq>li#|)~?wPB+W?$MX6-=}Yw#W^<+(_*jtv+ejg zwXv(;(znPk>7RWNU3ox7x4DhpdoK9w+@l4G-O;yisDm{n9NM*6n`&F>{B}3*9V_|(zaOor_cJs=_8pI-KVbkHw=X_pI;@izZ&SKn0uiKM;Sbh?CoK& zrpCSM#V?rR5+6{(nPUTdt@3jWx!m^q#4%$fcOjzf9pY*E^rZj_b3M=J2C(zsdQTL! zWyXVZufroQ@`T5M_5JF41irzsOcUR)#fL|=!_m0FVFNn!`q4gAL&;KUtNqF;>VvR` ztP+1bZ|NTqNG;~(xrV;Dnja#n0e;nP?qgzK9*KOk=loQ~H(W%l>Nob)_t@B>8e=RzjaS{CTi~D?)g7Y|O`J z-e7#(EynUf#OHfkw$w&YKJo785kIj5j~mz9?(epW51 z5MKjWs@y=v^NOK$ou8jS4`0nig}5qt-&<9x8nO;BkcnRwk5|_z=n!#;d3Mka-3VMc zOwyz}Tc`F5v8>d=z$C(iK?F(5aco}ca(M##JN;?>AGrB#Ferwon zpSb7Oc^KIgfju}gz2_<8zx^~R8hxw)?E`vkG(`~|5^qqyK(<23VT2N&Lr)(k&!f@8 zIF|``0;nBcQgrD^yQLyhpux90Formz6VA94AE_kzw@F;kE9*&$8CG}iIws3MBWIHI z^x`H-vBo?U;ysexXDnJXb39XsS3*PHutuxhW-i}r@S|3JK9*ad8vryPH#O@EM4LG6 z)ea84BCDKoaTJZ#fs%4EoxHeEaPed(nh?wfZbT8rwN8{-3w#q&+Wn<@tKI2&s*OU;vwW(!%aNhwoYUShHbW$KoVQZsS*%^f`xJsJSjtTOy)`;2JKn2=jU zr|c`D;@*O6c(Tpe7-!n+-tD*$Wc)k>4y`SM$4BQ7rK8Sw74${8{tn@QU0ENX4-Q`j z>Np};M^D->T7;*xhteMSH{Kb2SR?dO?pkJjFG)H2N|chlX|Uz&@=%)zhk_3-ud8k(xB zXMEC^y}s<0ZCm!wLk-rf(U)EJD_kT+Jra?iCVlhk3w%zhHPUCz2C+{Xl2^kPorv=K z%*xh2TB@VcumXK5cxQ94Cfb=;Ubx%VMeHk*fX#feiNtPef7-~nw$N;vw$NpCi8#zD zlbr(iw(vUFf(AZ?KiA*qseOvz+Txu@+cSNsJ_!Y!*V1PHwmDrFO>0Sk$-mY)#szGvvZkhm9R~I$&s<)sKjmTt3YufvW!>F zsCGVeb$+z6TD{ho#&cjnliA5MbD#Iz1}529b9B7qLF9WUx}O&SA;Rm#*-#&p8*{JJ zP4;!oc|SK1r10&AXlu3&!pEpVE6bkfbRg)ga9vsT;z9b3q7i{3$I|F0V}kC(RJMBP zCiQv?!R+_Xw<%Sf=n&E1%@fb@ilrgvjb}UM9+}~*FV``O9J0i_JN zPI|vZ@!J>erw(G0)I~>)u7f z!R&numCFt+AnjWwg6_${AM$+*%962gy&I8}vNN$d?hIyANg^Cz?`N|Dbo5S}WqZWw zuYN=^%GyTLI0F!XcCc%tXAg0A6zTOGu&b*m=8MN+HHO4X0O_`uDSDzLW?UWJmr#;!ya^mr17(5e~~1fKG=>U;`sfz2O_nrvce z;eEx9d40&Rhd(hwtFlI#gAqqh60@r57Um+Kr3;1bKM)+P865FH^%0A}*of!UM)(Xf z)~)@vVaWk&*6GVOyb1%dH;>cWe8{~rM>a)_?ZWyN@eDuTz8o4I30g|5+Me=~o=W>v3SLVtt1ZXf05!gfU&-fx$+upV zjiQ{u(nIJwm0Q?)t>@EZO!A6PHa9i3k)WW1YzdYT&aoGZ&h&LWqsaW*lYvStku$vF z(~iu{1DoE_5uZHWu$6Uw^7{;5!S2AFu^&n37PZg#COPA62!qXO zd@kJcB$9l3VcDRwTNNNbB|)X;n<|ve)h3ZbTk!i8%mBl6gDdl%BvM(OHpE(Db7HJ4 zPJJPRPi3~g3c7S=uu=E3DW9>&Y*!DARK!fA_TMst|1N)wS~D zmLqjM((vvdWtC(nkm;s@j#%RNE##ZK!_0vGWaOZqH>*fSBQ`N zLy}k?MdfK6oG8u)Ce&WLg@9zZw0puU4q$~3LB~2Cyw+hzEPZzTL-&#kXItB+y|yo= zcBaNf?LqaeM#iwbkeCqOFmvq>$k^o{bEoOV(vP=A(Zi*pOW*=^O_|^{vCd~G3Blz3 zRgUcJ--WZMy4n|>Z#tKLBxvi|Zw>6x1>|ZYUPAJ17-qgdGu4?^AOFR=$}@sJ;u%@; z%zQbM>@Z$HhYjs3F=r^fYRPhLWA?;U_XyRg*k%#6<_cB7v?hdHWZK`3dNnS$qMF11xZIji8VQegchG$KRB`fZf?VUr2T=lHz8 zmG`TrBKmPMD^^aQHEG&w--w4j?loMSfGE;Oe=&W0FrYf8#OBTmk%NXOE8%aeOD5XZ z#!WnmUgW9lp>)i%edo9_xT1!v(`EyEDzflI+@X(=usO zM;%deU!-zQTdetepRG6>Z4_6`F#RT^ukcigR|huj5uLeuTGqMfgz01+2B-D3ZgzEX zA~W3I(tovpB}{-yC4C1UKzvB|>^`+;@Dz7ka;6r)>1 z3#=g2ws7g2U+F7f`1R!%mA46Y%~CQO>BymxU2YHH7gf_T3(0M?&j=?FY2uB`e`C_| zyM49b2z+b(#T~~-^2~}A5$zHR(`BCzsX&g0VY{7u&x9>2_=)rkmB(?SeTrWi?KX6` zw*+i`&-kHHNs%;h&d-!U9}Wo4QeX6T!kEVY(US(tc~@oN_J+(qI8sB3U+vEViq{Ek zi$3&H9!ZbgoRZqwsvf-8nHUQvdzzYqwr$mq${=rA31O79k5JWPQ)n`8)SAB|fE~au|DvMY(fJshB)}uk71u zO5Zf-q3=2>yoirP-EoBC)`>rQo@De1bHHgir$6aU+?s;c`@#c zq4?!R9IkVC|5fZjsqp%{U*EH?^kPFE7Q>B$3&$Wu*#&NS!9{w?S11e*e7S7HC)N|d ze{`Z>+J&-1dFWpmMr0t*CKY~Gfymm~dcpI@>wHG& zC3SAYbu73EaKcik5euu_C$ZRV6#1o=4ydXC`pDB?3Z+C5ya42Jv`@t z{Y?1n*&8nOTicQC>Rc2t?ZMf{D+b`1Jqk$1WH8COV&_J^U+)v1SP$3`!#7i@v;LtK zyVFR-4@anxZM`f-nTU@AYv;04QXI8ia3u54x|S}Hs<30}OcpdanylV-|5Kl-sy9n% zEzgtHQ!tYt!U4DyRMH!+6!(z4CFQGrbO~HQ3zU03qEx}6Wt299WGQDGxoCMCFt~52 zj(xOzOIIxp`5IJLLj{m5app`Dm}*-)9+epu;;@Uvhza828bj^)y3~iv{oOT=90LPn z^3#wWNYQPca$?;LczyGNLo7o+FDFB^-Zhr;+DY6gTMSJbW>BqHhzygC6uq4g!t2k7 zW@^I3;7k3vl?tpw<7yEXnUO60gLKq?8|hRaYkWTBrzCYbAL09*#F_7X@>n2@2v&c{ zgqU4!nO>juPTx&)Po;y%Lc>{#9b}%oHJL_^39Ihhhn8t4vX7geyVhPCe~=uH!kzA#IP+_cI`GuwlCh*KtSFjR5*( zo=1ZsqR96VxaE|Wt75dFbLAU#(^PuuaFyrWr;o+E1h12Rg|2x3NlYw{c?gnZlW6f1 z09K_f*lq2qlLj94UApyWW;b!oPc>dwKeZHCMsI%JCY1r)bdUT0$r^E>xZ>h5Ev~*} z_KKK~SU?m04u8Ba5D&<2UK|kL+KKDFU>LKzUOG)%VVfG0@re+!qOLtOtEIcdQprGX zuB3x!NbkDbZEI6!bx-uk=p($VrdnC=?Kp3}D=M8rEY-@WXXx@j zghAXV2gvWn}#c@S(QVLl`JptZ*#IXPnZYZQ16x z6CrSDQP37!szI;VWUF=KYoGKX+uG)8>9vwi6=WfigAhphw4x=AaFFYm+%s`M{%B8I zaW{8>(zm~I7sI?IR{u;3Y>wNt@s9veSzrIMVVC$%!=C=<5-w07 zfMLnFbx?gh;D^nb_TZtQt?yGxJN&Y)x}&XyHf`ens^NyrZi&%N8ls$yK2044Dzs%m zNQqev0rb>h@kkC<9*R@{G%4_-{2(8Ynp<|5@0Fwp2^-^!ka0QSf{rI^>!&D&{R=MF zTBKg^E=x_%D;KvFT-f3D^<^6(y{L_g2?{T3bk+aXEfyVbIE0zGa)h@W<=3|x1i!@z z+zbc0JisS~bXY`!u-R1jL%|a2Ps~KR*g2A!s_5>j@4TQT4X!6x! zn)|M;0dfJ>t7ZCzA9Z`Zqj)B(F}l*Cowd|sF##8H%xS7p=M~!P>rrkS=Uv5G-Cc8oi1j}quQaLx=C_*e!TJ<_WEd_PeN8)TOh?lGCEvbNoxa+PeS=B3+Q)K%`m({F zLW)VtFPm&B=5+4(WPEk)ilQocD9r-%&HWSxF1~EdH6MIM&Un7WeE*EvRxK4{?)7o< zR!A29aSeO`-$uVmOwNW`lo6fQXYgNi&61OeU^Kn;yHNH|+5_`(Ftk+j$j| z;wuzbZjKhMhYb)$e3z%)Nu5B=&+*`!84H#fZ7KT~$GEz+`nu zJp%9z>D-~xcktdjB@+2_WyGlJM2$w*0B^a;%NR6hfeX6Xg?65q` z78I+J?Q|0E}K3&V3?zbt>jOACwMJ$SURMwQXw_h@J3$n1vD^gs35>T6!~ ztlwJ1*3}mzmzF)vC?=Xkb@p1nGUEY3Yi*fFecztz`@ihYm;R~gX=2y3nEtKk9f@kQ zc!#RtWb*pl8_#sPUyANKN91MOxytFSy=uW65WI%Y`wRVkzYHg*V_foxLItfR%B2Sa zIZHzyKvoeNzU4eun{^yI3xZeq7*i`EK*md~22jqAmwn(48kEYEn$xvz#Q z31;J7DPR%nC4G;XvlgMZoBi|RFKj$mqn+|GORLC*SX$wqWr^`Jvoy$&fWFLku z^CS}nke0tAFYTOm#{E(T^?2Peni4&ON>f?Z{%zY5+pIYK>9g?x$82JW)vs2T*V;sD z*bN{|T4fw;u^G)3Hi`m09A%oxwuP05sQC_c4qAM<2sBr{cSDl*hHsAD>pHfAw5ZNb zT|4yTk2Vo|m}JHc90AKJc0T)Y^1<)VlG6nFoDU-dDl*(2DOE7t_WPJ03Ne)r7VJ*9 zDwnW1bCSdiQP&Zkf8;u89tCMeyrQMGKM?t19>sbVX#maCv$Ig~pw8i&^V?k9hL@zz znydw_T6^AQfyiN zE#fQ)i}t0by&MI+p%<^JlCIpTX{pfmXDhgJ^BQ!%M&GMifE4hwr;ce zLFA02i$c*1gpC7AN4j78QA9Y`eIRAr--uScPH8?jo6`2OcowzlQ;Pv@at|w}%j;2n z&MFcKRYwhLbPn!PjwM`0h!h{xUAE4LCwm9^FIk7myMfFh4FX@kme{N00_5!hWXTX( zScHe-N%mtT@tAbwQvvTG#m6yd@

b91bi?L_8p8){4UUpY}zYu=IWCaRKFG?joMy z=!ZGah%X=z-JoTX()LjyqkgrT$Ucb{ez+J*`Vi{k$!Bc74qvfSv$NMNR0Mhfs#KD; za-I(KdTXNvyyAP8JK1N#KT~(NWNo`bjW@}hP=|u%fO%KyAM>v66^VZONxI<1`h7qr z@3T-*7xc5?(N~mSZ*fl%fwW1D(&fe9Vddn0gpG1znJ>kqh>+|w9%k9Hpmyfo25Amm z#c`i<p+xtkA!DuK;Uju&t`v!5UFFw7l}T{6we-!E@)|XH0~i8P6#4rTqF9W(n+S7c z6a^zP3{_UpmO}z1zY>UN>(&6!Isqq2-2=HUWg}1o?bBJn$ezcIM87dod|GrZVz($f zhxJ+HI2@%|y!iYk!)O@*pfhhD1Ab>ueE<8~mG0auQei<@(N%s^hj|GNBUEmN`x~2o~X^cgzxN ztIF;_qIs=*&E{BPMO?-uu|n3AvcFr*!dJ^@LDa_btd(c+N3zZ212NUm&wsZFK|7MFUr z>Gc6Yi-GB@<&$MC4v#q}E{U*5#h*$`Lmf2W5L+4`RR4td*O-p`2oR%@#2@XIi3aPGP?G7|a_oCs8pE zKRPf2%Jm9*r#4xMgdQ4on(%sSxkmkd=5A@{pX0AnA7;n_AZLWJ5)ctq#z+dY8_zCZ zilma)rxu3vpp7D`?ZppQ0~{uZcEW@uUH;1%%0lKaNlQFy4!hczcit^{duY0}Z_3L^l>xsd5mcHt`sr8;u83v)1@^ zaBk(eW0@RJP@Jt$)_1e7geE$l`0(i%h|O7)9OCiv%x(Q4XVyJ=c<|(r2Fakw@D*mA z-2_|m5tn72!us5Y=+)@)M?=~7A+IcjqIeiE?kH+7T5#%^4vvyI$hYU+udv-It^DJZ z1V^r#vPBt)fTfS`7{p$`*8>4k?+z0&{9m$4=#o~AZ>%$&WvshGhZL>KQOjnk+~(gu zn$^hiE}`vT2)MK}_|--{TX~5hZ~r`!3DUuz*O<&kV8qq!pY}TZyjO z5ODNU(<{VLhBOtP#O!&N+!MH-7x9s0ON;7VS@{+K^rI8V6B1kWC@{(GBjxxstSV!t zRNN8N=alSCMsv{S0ti+v4=<^zGpg4xuViffl!y+Qn!?@uf zX>QK?oW90MWWNF|GV;Tao@-`_Fp6S{sY$Oz(i_BK83j=EDzn&=vxa`DG8A|yT6;eFxK78Cfax6*A3y{>R z8Zt7P^+d$75cOBMq936VtmjZ^$ST@s<qCpaBIu6VGm7>_tKaNk2ba~WwFb_O#nqJU;wO;qNk%bo(ZJXjvWUnnqz@)L zP6`UFyo~ju2(yUwOpV-J$%jZsuFn0VIcf}50KK)Ke@j?wzlp>s*{f(78Q~{Jv?p;& z)X9hv(T(^ZoYFUWYe?K%+Kg2#jCpBP8{I#6dTr%PoJj^N60hCes<`pZdZw%?VqAPW zcWd=vm?2X2?A3&G&n_dK^VRg3(I~^D?c*X>Hyv1C9&%e6roD#lC6O7dYHNJ4=D=gq zy62qKx(2-N24dHKF%um&&A!vNNz9ZLc)oTrYM};bQ|q^N2FbL=KhvJs+;jdivEi)j zxOh)dc=?2Wx0UD8^JC*Q4Ufk%3oXMCzx2DKb$YsWN%y7VZugEqJS8*eR4-{``uUrtatV^R(0qv61`Srq-o88^VCOp09{18rk@ED9ARg z@<(#9 z#Ak@YMb}qzI+%=>Ma7+|4JSXHIJ0n@Z3c>{3dRC0XQgUP+P0bYU+zOFkY!h2DHjSp z`}IIi!g*(4_EI5>Rd3vvpjfc_hMDsUVkaYVNk>@Yp4j-~e`GKduUGb%Zj93ZqTjq4 zc#(-peB`l6`M%(CBOBYh!YSjv0|Vr#Ah;-gZb4SYZi-5bq*3CHyT`d7DuOxlw<IR}jie^uU8)Oq z5|d@S*}D%)fn3yEXt^97(~U0c@h@B!!0+E`|H%|#V1d||hUn})yb>DVpGbcOsVlhh zUDsXho6UC%Qp81?6k|Z4jZ#Yg} zRoBHYTietf*!QD33ZG%1T$*HLO-nDDoJ|(AXSh&ztbskeR{z?HtpBwY8U0LwrGxP1 ze=mXoYP{;5MsS3h%olf^2(ce&svNq?^ON@-$x6v%?tpIjNdsJH0zjGWNylX4^`dMW z*E!HJLS4I#e=29!&^6anUp_)FuVCCrU@S_iDO9x+|5B&q{mxmND{Up}*{CQa4VAO) zK#}7lfEDT=-=-*avvW`{aAU??kr>3v8)(2WN`;GGvPItr`u$2FLK_xc8yF-tj3_`N zKNdYtDUXE-yTAL3MPoDj=9qd{l^NMk4W242_s=~z)NfGe^c+~uoI>K|TFXbUZLP8*ZO z9Z^8S!dX^ARI}(I`6bEQL|f^YXz#st9wH#u9g|&&OWKmS9++EW+OyntgwZi|jZz=a zEg4Aix#RoLImu18YHOpM@B#((!AtTA#|swV#jq?6W5=prs;39v&~m5Cl)#7hXlPr_ z#)C6T6uHieSg)qusD|?p2==XrJ}8y! zB4-DehjzY)ki={@drP!e0Ee0JxJL%0v_jwGELEn8~JzkQE;coc{Q9 z$@_bc7V{#_KRoF(%Lr9h1wwxFk6*jJ`|VF7Ce$mHhjuwS%T1(k{r4pl>%oeGY`CXM zCU|nfNgVt_&bCy-$i1Z+1ai<@2%ag^#uDViiz9c2!W9IozYr7%ZJ%t)oahH#Wo(Wf zvdR$HMbT{$EA679tMvq)k%fb1Q*|SH%$z978zys9lB=zy6|H!rrJ=-1`+Nx!#39PP zXTOnQX{HmEB(zh@vM!+ROBSBI>5h0Zc;ZQj!4?&%t0lBqNaL=-bzlZp4-6y$fLE0J z%WTn&_x{fRu%!*11IQToDg}dH6%MPu{?KHauOBE+KJgrQQ!=e6ZS3gBX7be|UijM0 zzgB8QYqQ8N6w*1f(2;xT4+Jjy>AFi&c=ir_H=iF?-@zxmf6JVh_mASyLT8Ptg~!ZK z)m&JJ@PX~NvE48F+=hJ8=gm{4qMxN-GZw6`pOQ3kSnFDwEuVE0ZFPqGzIgk%rW_fhf-+)j8^n z8%IgjG}U%zio4auMAD{yjpz-Gf0)VVkhxlVb8EtmAWk4xg1CDeB~s%zmBr+>tFdNyTcdwZFIINR4Rn|!~4 zmj7Q0{f@Ef?Wv0|F&D{JlsZGQVs@k2@5m4Bj1IW$l0!dIxgbz_%=IJnQUcex&f%LL zC8MN?pSz8rh5_tt13vyi&S_+syW*0jcZIE8uk`SEq-8fy#?}iHU6?xM&h@zRE17YO zBLo7BK1$zelag67H^sX(u%`Krl$0#eUkvRYn)LYRXw zCM@Tj9#7gy)`2)OS95;qKAHucG`+R?no~9gmJ&uPp>>Cu=pA5>-|)5d(=TWRC9W^s3y_mcgD#k z?Ijq}8PQD@TC-Mf3*u`hLsJB)j*-PxpDfB)!Orqe4ZYzBH(jiZ1+LRHto%_MVW`I8 z4(X9~ps6OzSvkAuY^}4qn*BEJ~=3l-y z5K}rNdfoj$39mls<`!u^7GVB5Jx^+d+DfUJ%-gu+eg;1cVxn*Z=0L?=w^>;}C7^WI zxv_nug1YphBU4ym`DZt6P1xr=%T~}@vNCR(>S%*KzpkE`cyec3c<4jpkXT#U1#~-c zIo@AFrX-IG&5alm+SD>(u>SsYT0yddyezPHnGe`Fu5_ zHvAas5T~*aBHGfy{mtSUxgsDq78z_9^QqJ_NmFEXXWcRTbuklrSYXL0NPY7ltU_0dp*Ht-dKR_@H%5=AiJ&)i#js8kLL- zd(yIhsK#%&LNSAnT3VDbL6)Tc^jLRACIf((m- zu=Tm)lKcUr&yVa1N|}&9GKbUlV=nr*+YujP{`|oVlPbSq)T>e|YOKd62j>q8Jo<9q zxG#bK+M={F@@J@wsm+(D;G&Vcn0BEYlG3%{6CWj(+C1jp1nPwaAa?zpY0c9{PV?Lh zrp@#?gGjaT(%AVdl3Jc;tES`EixrZOTDS0lZF*WnamKKfCD-!L6`ov# zEy9x{R*?-m@6nvBiGSYC9Pcu`Upu+^G&g9Gc~`%oi;E&G+$_j=_Rsa7_t!H^il%*@ zAYKY))mb5=KMK($<9Q3_g^I1aqieG7QQyCyUm8M0*Crd)?CH}VMHGi7NE}g$&{MIi zOTB3jboqH70Uf*i%$Q>1GiwQnM>EanfAhm^K8f#B!Csbmx|aY|W+hCcoFCVD@=j;A z-P^B8swEoJadY%_kVr}1JpC&p!f8=?ME`Gx)IodiWSfFK`VNUUhuh_>XnIc6 z8thSyVx8Z$M~0At`|fgcy~UE{#_@T?d0jQh;OP%DcaQ`)V&pWHpP@BT@Y!3)+PO0N znFTtLk9B*LyFB2}3H{mNNom(gXx;FRg5%oVIxQIbz@<$6{j(j9tfv+qvgqus2c`%|{Lb*-@uf@A?}Zm)}TPIf|-$ zeO$@I&-T1CXVJs(+tt^du~DO^kCZQde_p5+-QxOF(M?&|&`E(LouX2fmhW#}v?cTM z&wg@$#5YCZjZY6g(X!&dKGXj>`sO4OUzaxdjVE4X+UeIVI5uG%2KM%$Y&9Ko<5XYf zh@oEh2Y)d(b>yD#e{xTiQtsAZ7JCGH9nr%(|0BGR|ELBY^c}ta!SbQ;k%sA&S_NyPxelXH=u+iFU7es|#RF*J_m@N@T)6_AnfYFnZ^b7QVG zL-V4%;>1GRd$4>Tiu`b+O4j2|!O3mgL((Z{KnZ>w^u!=eJKOEWO_aD>6+3fpXP!6R z*Ik{^!Hlb9e5(aMIn1{A5uQ#c3)<9#=MpEOu?XTDMwq_qAnSFZNOLV1vDdP3_;@$y zmCShChbp_8wRl=1LGFAAZ!5dePQFa+Y%)(;D`QJIQtTqHTWiRrE9W~}Z*`%*d;1Z# ziTLyA-N{?N84Z_jk3x;s^~1!RNq5iNv!09aeNW}DfeM_QZ8JWmzke9hdCTA8rNzKd{#9MX@I_q|xv(1(7{Yta4J zu2Rgv=tA=PBkYBJNrwGgTWd!4M)F&gwD`&H5M_6A{+HWtiBBIFT0+Qd;6DxC)(s^b zb13fKY_52I8zIn?dsZiC?-rOd;yv*A@?eU-^%D;8PYbhSO8*e9v*)s?FB#MM;I;X2 zT8Ih)rLlT)8%+sa>3pE~pS?{Tsh5R}O`qChHwp)F@f~`hf)Y#HvZofkNgC~q@w9`IO<%7 zL@MmbA#3=gNQPQ=!|>B&oS=hbY`)^mp&G?xeR9e zt2q+yt|kX3zp6LRA`w4~%Kff$B3v^cU9%Ed%ZR8{(uc}Xeu;9GTx<8dv8$+xtvMz! zo*qH^1Z<|75gMw2d7ym8 z6_KbxSy18>5h+ufEv~rdMYvAw90`hHy6>vgOX&IU%J%KizWMVUl-M8?ZVC4$00d z1_USk4Z<{9!*MlC0qt#D(o^QOsc@IG_+zsxu2E0jU5V`!?j^5vd2ywK zG2$MIJu=)E8$Z0S(x!#b+6^d*(LC`NOfiQ*w9GRE&+n@AGhQZ`n)+#bdm$I(8FjJh zNAwo?^%o4Ob2D$S1n)Oz9U)@KL;ABi==emFhiyWY``j?q%<3W4YjD=@wx$&BZU5cN z{YNz^UoqlivX?!tH!ZwRfm~|yDtuzs+(}kw)j>w;WD>v=5j#=w@oI>Z!o7uTz~*)8@suH}aR=;r4kYm#<)T(D3!x}l|y znKB>GlVnfW8+4aT>4z`B@2Gg1>ZRJSSN5`QDA3bPDs?Hy@+=%R1?KHIR&XSfPU-#`<=x)(q zU-AG~XPo)@y4bfLV!YL^uM#_BWvISKpP$>cy6W2m`!>Fg!)?dW|19Y2a4ml%x%tKJ zlsn!?BrNIUs>+9k{b;G5&ueKn`MQxn+nv6scILYX zXzpN~A)q{7evR*W%klql_TJxcwr$&R5-lQ#I(i902&4BF!X!kC&M-j`C3+o3?_JcW z(R+{R1fv8I(TOOdw=fLGXy4?z@8?>|{3&8CeJ*d=r)JN~iTNYTzO-K# zbQz(&y7h+oAs?%hK7%VdJZV?L!gF0`LrCv@M>y?HB++lw5fKEYZ8|zOLVsVaJiP;; z4~{77{8u#mKbR7XGV-1B%L%_3@4ckmp(ZATPOW?!>~L}(=fhOLaNIA8U%Uq(w1E2u8wrDnCQ*coNU|Ckv^%0 z*7jFAuJ6bbQ!Tl5Z0n}v6uSUM)FmO9$vkur`GW=;K$oWO2mY>4=OLf%%MiZ~t1rgI zaa3x4n5mYiE=56cZmtOZ#aG6|NbC_Frb5pNf$;2U;q{Y;x>*5 zB)EAG6q$X`BG~ZV>j?P5ZhqXV!$(M{}G8(x#pLK6?3|VFa1xxaJQUwk0b+5eFa9L8r`!pQlMuJ7Ph- z!>MRopGKrMvedo6szamytHi>A$pJH3Fzd7Z!~|oqB5Ct9iJ@DZW3L@_a*Wi}tg~x; zK;#ijs^r@Ksb!(#X4H4CD|^qQVCmt{qkHCCsn=r3azl1kP%l(ThP>iPG<~QVIEW-@ zy+rnwGa}ZX`BD7xQrd8pABOl+(o_CwT>#t45 zlLR62CxM?x>Gi?G1@w@=0Q{XV%ns^bVnIxOpXMp**v`nm^-|GnpC@lh=Z*B&wLSg1 zpP4+9y?8tHm%)Sr=S5oBkajs~K3rrx=v6W1_YdMHI(89)NS6+20bLN| z=Aqd+1s6_-lT8JS^1B^V0405&dHlY*5Al+SYpRARwVUGTz63OR+I1!E_EooSiqBOW zGpO?&dgmw;c(h90*5b7VF`%9FWXVJ13f%vA;4HkDBmUZK>i~gCX_vnNtoB{l!`=Y3jZ93p1>ct_TV?11fi*2;!n^0U>4U{Z<6%i@- z3n*!9KxJ~S#C!q@SK!L$GfRG)-7^_|SScq#T}35lAqs7+Fp4eE0LQ0ySR2V|GcV#6 z7dVbP#mecwfgMUSqw* z*S)6^BhjXK!a)$jd)ADG&R%{VQ5Yvb+wC{z?@{0 zY=X1z3znyAIFF395ZqUjc(wY?Lf~(vx;s#Auy0PSg*ecfNT5DvHryiImIwEh)4NiN zT1jxAG=O_%(B^}4cO<9o&h79rDZ$v@M|IzblWXT;hE4V}7OlCRh*a+1_LijlIa zxy2O=c>0?c&!h+)t{N7(UQLLDMUG*c6|}k&NS>PJ#h(unrYIfTg-5@*i|fCSE}@ua zm*=c3%1P&VTCk#&ut$R_Isj_jneUwe=v^;du+oDh&XH*besA>ioR2}A<6q-FCo>~S zkh7c^%S)FYFuTBh$Oq43_dh~qe*pEL zPqk2|6%tv;Q3#7r7)pJo>-_oe@1cK~`SKyqL(wUBC{F7m;^%eJ-ObcQ&dMs5S-!*Mnfg~qs8Mq9%=`7VBqmJZ@4Ze5W{IQhIt&de@Wh zV}g9LE4q%A(QAIW-!baY@AuM3ChQ*RU*2cnrPgQ$jS&Kq3&SC!3F0RHlXsjP@E4@zBpgAt@ywh|#+Gan<_S_}%Em%~eF zxHu649cVMorTfFo9yoIIv9EYg3NCKFZ#oA>y;|Rt2FI=$>8cMu*4VENar_JT#`5)r zPYv-<8FAAHjkKRFZf-bJi3rdLVHyRxTwQm&Ndi3` zDLV#=$#pIEbNKV0MHg!Ea$Q(W28rd$Hai@gzNT+EgMUaQ@5yvJ0#uCb?+PAJd{!aw|i z&#rlT$$>E1V~%UGIyoE>{Gb59dlq3Yl5Y$JNC?$! z5>wZfmm}u^FEP;J_j@0-`P%R7y&HEQV55Td#u#>?_~Wh}QD#)5xAXgh3aR?gL(z-D z??t#54M>X!WRAG)8JE$yT(Bt{IQrQLgWjCiZYIK@LhmwWZh5;?H@eYF#{9q9i=Z@X z6ss(&TOeu7CgNo;FW>Z?_b?^PnL^m-C~m&a*OM#+`J>BNTsM;rV$_$^k}MJYFj}95 zQ!NLsaN(g&;1$+;_3YTjY3=tMASYIt<{0rEuR?jCj}uOl#@OnaGf^>MYK732_>BBg zvfg|@b%S|w%GE4oTU;=q0KFX5RbbVie({P2;#D>2j3fjGA#?M-HH6cArTB1^ zXibhBWJmItYTO!5O8g_puvs}*(HhbtWib&iS_*1nhSs()0WJ{uRP#ZA@RwlGJr#Hq0>9;kiTF_Zlg zWmlfv58VQ^9C^aZ3WquNeR5t?7gV`U4G|P-@pCuFysjDGPu(eO!dYT#FJPb>`z%a!&rb zXJDF+Do+Dq_s;;bbqGf6CgghPu8DQsFK$l}`uCU1e&-Bh*4HU| zOA~*EljD3|2;lXDqt$gbLOwmh7vbw<^@>dkzlA3rDGm3!)l z=U-46&j5PN(VM*V5EHTmN7fhv=iepE>LhDQ;s}b^PYc{fAr~>KnOKPm^o+FqURm&j zQ0?K}^zGtZQDc|soU;7U z&Uy=<1~|PJIA!L=ISa8Fy~Pf!!Qrs&mw`{xt?DPy4&K9#tpd*Qlj?V6Ho(cT6XkU`yq zFvCO1kvJb{)d$EKSA}|8RJx85Q%NulMvL978M76V zPNj8KuQ^_eguM}_2BcBt9zJ}o;BeSWz{Z?bKNooL7iYlUEisgHFG0L`ly@V6IcP5u zq01%P^B)Q?bAVTSar^PCJ@WPde#7(l%kH{&98JE``KY2OhhRIlf7GzxkGQ#Rv1p@5 zhRLugTEfRMTrgoS1Y-7{kX!ZXi4pQ+$CIc!(Lp5$zT2JLBY1fAP(_f5)v6LQNJXP+ z4l8+)z zvCU|i9iR8|$o~IaVV7>^34J*LnPKY_6nd@Q|Nicp%ZTO_sw1>$J54~}u44|?XZ4mQ z#k~z=fBN>2A?mK8e9WVK(Hw7(f@|MWVv>5(6A9(Mcmtdrj!Y(uN8BQtGI8j5n)CfM zg^}2b`UWfKJ_={hB6Q!Ek@qv_RE9~V_le7ZMJcv9u&Qx1`7|ylVxYdEGrNEX?o@}L zuqUO5k+Huj;53b=kzmMm3mnM3uMuG$p@H2LX(SHV9*o`X5t8nY#-<*uYJOCg=a(xm zxl%&VV_J7cF}3z1>pNWG>(K@5XhuQere^WYAl-&lHlAF3P^@-JTtVbs*c=C!0+n@3 zvx(Q#Z{*sCFyCZGzsHN)bX~xt`HK6`zYo{*fb64=Tg-1uOkeIW+kvL_pQ-6scKVjh z^_J{BOnM00G%SdElf?4U=SxPhbfIcBipra4^-~L$7gffNJ9g9#eh*QzwBs$Izs)=Xk1mt@-=E;_d!N} zT8eVuFS^bmmFj&`RZO^1)`@1(Uc19o7jH!RiVpPTDQRODJ8S({gP#$xsa;B8<#s>9 z1Wn}9p-X}9zq5KX zix+r9)KU?0!Sj$U!6#^tjX+xOF&(-y&>0WVd6qbm3J2vGg$A zraADO;xy@@qhg%Ui{QH0ptjm3v2R@?84(h^N$qs6TBhcEQ* zR&DHPL@aJ#g{|%W;)diL&pu%3$`CbsKT9Y)XoSN53nyNZzesX z%@A=z)e}`tbh&h@(Fs%P=+xQ!3x~8*;tMfsA-{($)|}jS>PeCv9cBZTI?2Z+VRV z>Y&}d>a&f&ywN^S|2#`n8dIOKBS!>Q#jPvRU)dNh!BZXZ>Z*|4rYv66CAF>CW3+v| z@eW$J8#2x*2gOuZczcXN&qj?7l15o0w)3^zR$@wy70(RL4QuGCeFG2u(jk};;qt`1bXI^L!Qxk>DxeeI&>HFqJdAuCFoi+tf(~{wNNxgrltb0K1&iP)f1c`#; ze>8POnKv%N+`;N4)<9eI2Z$|Ul*5j)ZKvx^{+-#)1-6Eu~<1@Y7Nk+TZ29-{v;2AW%CsaZ{Ytc&&G4K{9 zfJcE~@11^`RUUJzQJL3oX@zP7yreJc|9t?1l;ki(7Hf@Wl6m!O)-FpvjQmOC#Gv&q zRQ_Hyv3o!&Lh|;z!gcK&iWF;M%MT)>^UWt(&yg{dPi_Kc-*PZ6X;~IEP2Ww3qfp6J z51_!>mbM`8Cw;q0%$_G--q;5bf>FPvGx{$U_QzkvR3wt<$pc*!x3xDB+(K^F-DE&M zm{E<}^Y8SzH?&5$q9&YtFzAg;Rg@`eia-)U4o1HK(kaE?4%}-qG8LZ~ zN6H4O#p1h|ih&tL;=eX?KWV>jXJiF367_ht-A465No9ucCN|ge)THWLt6((}Ma8CX010dw{QH`JThaKKnA8O2wH9AFh#*-5pfpNq-qs~aY zwt+O#*BAV2H8F3y%Ds-i$(?&C@b)5q^9r9vMrcOwicJ#wNr<)b-N0l2g8l9MVShr* zV#;vh8;ho1c*}=)=^<*!ja!7xY|wb!Jh3zkmvH-x{wl(HKmt| zIvoDQZ#6kH^3e7y+PXbMW_N2tsLE+m_w{3(SFNu+acj5Bu=HwtIArjmJ}*u!*76yF zdDVG&XNwOp5>UN;mJVSUE~P$EYUe*G?pzQcxcUl!-76?UYk%%Ax3X|HF)jgOPR|w_ z&RJjtPZ-C9P|C~%w_na2f;z_2AQHkJ;Ve%*b5>+{z1M6hs7e^!lmz{fURPrJA!#0sTg7gw(qH}r`6N_P41!qXEmhr zCtGa(y;Jc&2wvz#weze&dXsQl;xJ5?L(KTKiha!TBw#YEVc~a@v0d#n#f%ZS7*j2Z zeGF(N2<>5UO4MjzD@5cHs`}KX%%@|@P>d^wt3yz^eWC(A>Z7*(DnP3E z;YGlt*t>RP(OD(p6sZD9EsMUByv}8%e{{tLimD9Gut44LCP@(n@A;>qC3a})W7SLz zqv%h~+{?N!fhF>mCSdK@A4-R>bMX@vO-0R*;1wkGn zNPE_DWz+wJx{i2$rhD-g%rq9HYWp6(7@HUWpeLJmS^35xLsto23wq!STBrXD=YJ~D zKOudSZCzU(ULE<5UVd}0M!|lpXCsQur50*t>qg~@UJ3=V@SR*yNkkr_PysEtK33C2 z5I3_}lN!`x^&CuX3(cJ@E0fESNO<#qPuQubn zafQCucoJosx=Wm%v;6OQ;v>Rlf8Ys$B?~rsf@|+3OeC#JtVSY6%8GchtAv^^YFfV8 z#YVc4Lsxo__jW#7=eos-M=7hN%6!DlBUpLUkcfp-c$W%U#oY}j4Sss#7UMemhK5#<%Xg5_YdKp3_qeZnp5Tb%HHfe>$qg= z#NhXf5P8PUSxDzLC;XMLD4#V}l9X|D|Diodp1q0Va3pU{`iQIi$lxIZNGFqOkczn! zr$JC|oF}2eX3Eo^5r)#L3S4jKForAhY@?%$qAf{V3#|vDJHJC+r)0HM)W9gETOxIH z>-YyJ8ym@a5NR#dU%R|GDg)xTc~{3XHwucP^nYY@{4C@+KGq`7CoqZ9UMiHrnxmS( z&5hxLvcRy{$at?GCEHr}(#lCk)H76bB`G2N_ZV^c_oW#ojyUaqb@@Z=ysuzIuRB^31~5XxshACFcx3N(#$(eiMCw>jtngn21R%b9op*Bm zi3c3*dxn&^vM1;uyOgLz{vrmDiBp$XqfQxhMR{WmfQKx&)g5xtF*xtbtq9i5toSJ! zI^2irB@E*~rGAyP@RZd>xiWT_Ew$c=e!}IU08vK^=c0ka5{T%=()AV$`x*iL!9m?&w_-yIa1^*|AgWGS#&}?x?fKh~O=5Xrd88F@-|Opa%%~ zCuL`opW*de&8zf4Yaj4s#P}4{+N6%0zC!6CK_=Ru!s*8gm_)9#b4trok@9*(>=X$a z0cvzRxqa~Z6m-e79_@D#NveZWN~hl~vv@a|KQCmz9anH9^wnX`qib42p7~TQM5s`q zBYFC(6;;zStn(=pCt0bpzEe~8?K_Q50jDoAzSkaoOdw>uZ2cE^N*5MUlv%Kf{fFg5 zWp;1lW&}S;LUos7js=wmrcZ}cKvSF%>iI~hM& zmHu?o<=bTk`JPk3E)AWb75*oz*JR;~Pd-k6FIDHh`DiyKgUe+SG&oS(L$Q&T0=exw zD=D=zavir#R}By?FP6PzUmeh`#><6JQ0&bC6z`??rrYB!>D!fMb zykzcL!4l^rsX*~X;qgQoc!~!j71XxoqiinC^+)H&9d4*MsMy_rXxZWv*&U@4DGkO- z6=rZ`}HjtLcnOYw8`= zfZq@CBJO&lOC=hUFBEU>!ZLI}XJwog8A|XK_1LtiZ3HeMR^hrh!j{#@XJGgG9Xn%v z9MaxvghI}|N`UA~MxUz@k_AhT1_zqaq!Ag%(y2o(F=C)^&3b&f<;pSj)1;;4S!s7# zhI+970Qcmt6%X8knsFD+)DEPPq?WqZK?W{4K-0lgekQ;IxdtT!rt_b~OKe7@*57!c zJO3bg=Fv+|dj)xRF}B0Xyfw+AyLl0ZxvNzmzJ4zffhVKg&ub_?yN&)JG^Dq5Luq~6 zB-Aa9{6#GmA@dNN-(QDRk?hP*eOP{jHKbq9G`WiMx_`-UOR9!mo8SfIX2;YCP)iIZWMMEmFmJw9oLs&bSztPCB>Rwo*Fj zW5D+1-6_yj*^Vw_n5}Sv$K=9e-)rgSaX%iJxu?`hL&X+{8C`RlckVor>3$FRyx3g> zt@F5SAw#JFZR58M?@O;DV#mK4HhKhXMNNqXoj>i@7KKJnMw@d1ypsYl7Gr;3zK|nQ zUmtAgACuTiVqVhh`B?+~9#!Kvng2Gx`^a)Lip|C?HA#<;`GeNsprQO*vm3(wtVhjo8%3Fnhj+8@`abK4Ukrxxc9R~$J5(6pQ$u@bMtRQNu9a}!JP(o89lwXxA663P}CMFoUju* zD(b6%4#B9;B-P{aDnPdrwlOV2JZRn`84K1&{>og4(mbG+oKU9my%LVv6K`MtEm3 z8=ptZwLv;))#jm12GuM}?AQZ)h1u%Vjx3&KRV<=N!YjHQUO7l{6L!{V+p_W}G(ZSe zUrv($d@pEMY(Zn0;-IU4sH<}SZ)7m3L(*5r;6mS_ve^&;NVlWHh~_0;T`u1Lqj#F} zFihPUdj_5xv_1%YQJRV=rxw34mVkb>e{ITHx#Ba%9vdY#t+=fi-+u2xCTP{)-0jgb z7wHCl^Nre}ehGr@57{DvTDZve#oF=Tw_!+bO1amklr8@&rO!ubM9?kctV&EIh`2eA z!zD2NcCXe=>*tm~MWKVVf*A~2`Y0a3XyRWFq^Kv4mc1;7p!8@*=rCVBM#IumG^}$b z2E@I$2g?N>Ek;yI@LdO_4_iKB{=#Ou5-cb4Ztd3-p%iN-RqOK<3kR@_X^e~xL&4V@ z^7SM=GRI01Y^0t38DAzhrDNqrFb}b=ygC?ZT$i?Q^Gr3pSKGz)l!Rg;hHBIR5u=-$fzt4kJ{zoVOi%t zlfO8gWpk^zDnD_G)j|*Ig@2ij@EJIP%b|h zvjzEXPu)}>c$yw)`Ar@StPJn;+O^|0<#I!sZ!j|FqKI-z;^Nyo$y~Xp{Jwaa>$(vg zb<5Bv3~RC0Ik@lp*pWWT{#P=@d3(>70Mq?NE?xOU*Wa_Z(yq{dAwbrUz{5HvUvQmj zt;w|+lOYLPRD&*fAH;ApyW-G@1c}9twI<&GDd18u7?TlL^)RB#ROLKkD^fpinnii9 zT&$jIAnS#u155O+Q01<`or{V|V zZa@24kca?YQJgx^#CP}%Qw zFdqm3Owo-m({x*;);7l^=ZisCm@1J@BJ3XCb02%=wSl-J5G;a%%thfAoN`AMuT<>*+a1H)5UnFl!s~b@@TrizUC^O22H6@LNkV@_&%4EFaclGX2fxkMR?~egB zUoOECtdS9NUKFbfCn9ZinPD=jh{MYacqg8`rh=X8K4x6-e&V9R+AyJSBGXK}79;}jLW zWS&Z+h#(lr(QKa{-DqgKOMJyLWw*90=e%|(XFeMFqe6C4nSlbpUd1&$?bXkGU}#%7 zNmpRN;pV$u29)d(zvhh6FCkl{5O6iHT+O1-);TSd`&p3!vMaEYwecmYp}hKEV2>XS zKw7`1WCK2XcSx8>B+H*8L~IC<$-0oZe$QxkY{YNg#L${hg~S%PE=f{kSzWX?NO*|( zjaY^yVt`r1tZlw@(i5g$qNdSGze8uD7y-GO3S&5_6r_}nlb?nxJPq`a^g0sktOq@0 zQkP{e0bsV@;N2c7e-O2HHf5?>-cjhx5cY=-AKrC02P0|iGWyFx#nv`IjU&B zW0o`y>8-iVwCwX+r$n|>-i;KPDy8-diH9V_Q!J|JGkX6A*{dRdvE5}9z{jT5yK(t2 z9!#M}FxljvsY@De^zG!Txrp%^K}F9UT4V|*5n+)cbdmpLdJo$))gZ#l2VA>;iutvh z$d`w57PNg!XZJ=;I>&8it?u_>(ju3^LGE@ix3rmLbHnf*$(uI@yV;8 zzKA0w$W|neUpM;Jmg9o@U}!N`Y=4264x&uRJ>yzJ$wZ2!Vsq>IrF!g|SrIJN5CQAI zv6TKGx~%=lkg5j!?uJ~iG3|nN;OjN>CR~9WqDJP>6!Y)F=;y<{4_oT)|KzWhZu^og z#f?8j@uzn>Uf_!~W{55R9qB1$8;!~L-*d?y8>5Ke1$wqBx9`7FE!%Ya11Vdq)zgi~ zM(-X2aBrmFjP|bGeF^p8gXui*p4SY|;DjZaFrVm!Ps#bb4n9LhSsf$W?#~vB6u(nin^t+K!+3eqobF z@dBNgg68{gueUVZ>SG{RwoeJVk2JiAx{w-{Sl3y{FN4;TcJj8&^RYuAP!22^0tn$S z_#JRl<*yilt5(XKZb%pQHz_X=fw>~{=f^QsWV7T?tJ&gQqM!YKKez@~$fUYg2e9vi zQz@%~L2$kY9Bf)yQo>)bz1exE)SrH@;@z?z3@;R7 zq5ciTsAFHM(Ihsz-#SxobYI44BKFP~KeMTo{vr+F3*W7;CEX2PuG(>7mhjd}bnf&M`rcDrqHSoT>$1nB-v!d#a}@E*g|10C=s6GupazzeK&R^s=* zkA7ILGFElnuWzM*JI~;98xj$96E-V6ET}D^8CbwGJsA)JP=}3Fh}@m_|1|h68%4b)i^5g{Yjwk@kqXp(e081H5u|T*$Fny zeSH$l3179bzcL>PW=@n;p^!ufqv8q7r+2)jHn?dv597*WUHRiAoMC+<(^r;yz*pXL zTt1so^cqHzfR4BP?oV2OC?{K;C`{h!>Qy0F%OaYlW3;xc#{zm#3^4tUGWOb|TkxNZ zBQFGw<2oOb5q2q{HX*m7lXI@iJu_6#ShN0!@8+6Z`+@$8ujDR0JMzaauP#zzm7L-r zxYOcxm3KslD?WyyH4HdJm|Z2hoYuGLf73$9gj|2eX^o`)`yREQ6N~y*bW$jSi`D*F z53S;CasnrDBjXVRtYn2gg>rE-g6J24s*)Z@ERucUL+f$ocW<8Aww4@9;VzI z@4H10eRc4`t}G7_tB=Af(%|flY+~AOeLb!3eR7E9GlPH^V3e|S%U+L9m;>@zRUdjW z04qZlY2ZgzjEr^c>^gUVL;}^MlbC)RL6<8!bpa>Oela#ut`e9){iReO9i0MTC1d?# z%F8t_F9v$)CiVifX%V#5{bajL&DVe?_(flu|ZN z{o{nS;I0Bs4fxK(v~xs}MboBG+V%d~ijqH}RR3_iJ?CP!7vbWN;^9fKIvWYnIuCMb zJQVJ~hHYh3edzB4ut)xkzq4NO$3{gDfxLNL70%0%-Ff6QHR%n$P5<7t*2jVi#D2eL zBcZu}PJzA7nh*cbpH<9c!3myrB~iC&X3teY%&c|SSl)$gPNtr4vDPL(gRa}|`D141 ztzkl<_yo6mt|dbe(Kto%YJD5jNFat}$ExV;dyOPdp6T0NyBtf}lEvj%WPqA_Vzj?3 zITr~SC9;XCRXotXWI9k%`(fbHQto&f6o{1zo5Z*0PxgJcsvO=B7)8iopSGSyd^BnM z{*y2szaRQSQhX#M!2O6OsKmbBt<>3*%OT@%)E*aO6wm|rhn&w)Gg|%<-+MX}V_@}i zxW3ddNSKc#`FhZNv4>4qEw|(y@-lKb7eCq1TaVTmsr;m;f(h;@5CrsVJe2A--sG3J z@sHgxWsdV&p^!)Xp83v@`qKURAer1b6=C}1>QGyExY!c&1KSsJV}CQ(Zhr*!o92>vjF@V=p-@C`!V62-&25jXX1G=mOU;}5F z72qM&v-9&>uHi2y$+eM^_;kAX5 zAY8`)MJT{k?q#Hr?&o2<55U=Pd2x%L_$Q2oKIbxPGoGi8w4^wLs~!r~Ay2`aBR^=; zSn%KnNVLh<8BCz&T#fjpUhmY!#*$&eMwJ)xVmWv6@7>bp>l2LMO}J=2@a+wMIU&Oa z6kAf_iC->9Z4#<1Q*E-m!XKcyY3sJ1K;eUB&fCvPOeFN3^`c)7Ncc`y6jj{cvd#ua3vFcPW8(nhY>b@t zj8n^@4J*3LxK1YuBe%O0)oV^A2)v1E=E=UHX?}UD)32`09hP$YJsXLl`=>e7{1Sy5 z^OLN^=E+4Mwq|rcZO~FL&dB-1OW?DfbIhX~)t6=_@6fL*Y}?7y;IpATab__~PJNs@ zboGXxoi>Ns{?A<_slS&~fa+FJz2UWFgx11l+IL1D_IwUm!x8C0?~}a{p(U;)pgXy3 zM$=P7F^1iWktaIfIT;CKi2eCi=ba2k{NgQ7@e| zn(69c{;5(Q_9@*_F+W!Ae2(ZaoeMj=&kUz%q{J>#p1=G2`)weG+c6o-R$Lo5##2_J zb4->-wGYY(8g);jj3hXYa)0&B6TsMVh*ccxZH(}AV9WE}O%#{;G$nl(J>NIkBWjF$ zo6_Z8oHrJXY=!VLxw{Cfbz7+IqApgRtHMB&XJukXd@M73Kd)n%za-zJabcB~YuTb> z>tyDWi^I~JB)NJiVTbFjnW{Y>P{#o@{3nnfYnWn7)hiGTq(%vQ)Y`R>W~DyvS{lF{ z*WIiQ>GuKKFNf-T|CmebyZ-YvJ~wMWrBputMNn~xA%YlI*GS~^7(r)Ev@cEGyz~$W z*^5gTzwuUbptic>|tnP9XVP4lvl0ej(7!?a2!c5DvmblBiDeUG?0 z2YL9QY`}AK|_);Ka#b0X!I(WLhwr3SE?$j+VJ*B#-ZVtRHj%P zZK`)tTkl6pWyTdFnui$N7VjmJzGc);ZELW}jAKf?Cgw0W&lOs>NAs9Ori zfl+5a{3e$ok#~Pwya@j8PXTpFQ1tR=%aMaXkSe%c^LnQSh#e>hW`Rpp$gm@}fhU{dziO{~&hG3(#&t6$q1S%+p9DJFaa)tu z?4|0|^MnLzc=2n?*VCh9$Cm#->IlSIsl=4tOs{0k-iznxsSn+k5wR*SZhv@c{ZX1M z-irmu{sGY~WEo>Ya$`Xj^POS+VcM{-;-g##L-Uv@<~n@bxl7#=#8x9_ldaV;N9BDQ z=U5*y5`wa7>m@+4t{zV)Srb*{^MD*5KVJQ+JuxP6oX0spu(@D>C#m`F&`2`S!mCo9 z&%ov^z|Wg1O3r+38m+`U1g8lPEbU<37;#>k{YE@9i>=yI+jVxHXSC$GESPC2McU5&=8D0pca`jG+- zyi?-!f3sBwTmGi^2q3sV1m}qx-Sv6w)bl`;hke6P9c#zXtaz(P9z_gL_PtxtrObAg zmX9z1ui}1U81n{6m47+Gm7|Q5E2s*!IHsH_bv{ZDAg0;7Aub~LhA6-O-h2<6AV{9l z=JgyCK`GyPxgOpA2ktqrVDGx#TJhhyQS{=_?sj;+QIZD_ZFewVpLT9k7*o6B%V@b= zO-YnOA4Fh=0UFI&I!|1keYNBo1lbuUw3FJ2EnE~N{C#+Z4|!)(Z8rKEdTlkBYg*WG z46ZstnX(NYC^F#A#G`ZfgHs#`AKb)Xz0wG*S9(4%%y`*~;d)y1PAXCT`b9IEtQV-W zx8C=QT4k8rl z@maX;&hsgp8N6JxKwM6oa0-l>q zemw(qBtG!Ek!=v!o)gf&SYcA-op}n7`}}+lHAKOweE;VDqx!=>Gm`U=8RA6UPbadw zQro(|KNRZS26F_#$Z=K}uM_>K*FOaQ2M?^pZBBbhD6nYihQ3%zvvyn3xyS~bMI+|- z5$Aj{!Ppszl-)Lc^Q>g@Lse;vpWl*~nzba4m4uqVe0%Vm7<~>|SI@D34$8j<47)=kvakM}FGM6OhEla9EIzGEEM5VMy#o1WgdPp`wT z3OXqHVf^H8{$iCHh~WA)y^_6L#6IyXev+|j$nkXY3A`h{n=Q`#;iJ|0gv{U#Cp;IC z!p#sy-K{eUw6GAMW6A0BPLg^)N}i}%?R$!T&~ia1wnNtl{w@83B$+-2w=z)8G_dPk zZPM?uz1GXvMU{kVh0|L;lwIuuSeK}-sz;lRi`pNXw>^eU3vUkytNAOQ)WpFd0{03$ z*1vxC1WR31P@r9GFp54wHM-WalKI)=C*@)QiDG?HbkNwKfs$|E@2yi<4&D=td7{5X z1C{$^#`#aeDN-c$$FPctA5J8`YiSf`=!?Lv$3x+|XNQ{)(&RnJ+~Gnp{@KOL81H4l zcbg}Ds?RsR)?`Wh&Yvgw4bl*l5FcdefAe?rR2m9Nk6m19Ou^AFG`G4=?V~_%G=%5j+>L2bSyfp0beJGk_+@h zi9mda*g`Ss)%dd~BCocbHTyF4U$3T}MIzBj&gH7uUQq!GCqL2XvE2wmFqS@#6V)8b ze3UZ{Ma0vzh%B~#Staci$`?h4j8}+nyv}kB#Pq)SD#6&)%)OAV)hE)bEHWScRum8` z(ILJOotBdga!_x3`Xm}jm^fT6Hi*3sn5(hO5mtD-v0QXLEm9Gc#TuM K=DK*U+P zO$y*yyVit(dS`p8Nvcv+MoxM*ub(r6U0;zki-Gx{N}1;y+Hb06mBY(Sv|12%kiIkkQ50_X(0X znv~OD(ln?cd#stp>BRbMcZj1B<ER%Q!zUX1&6m##6MJ^iHjdN5J2R$i6v6P+B>q$|#4ba+kP<0(< zl$+^31Ty|0JK2jcDvECXT5xOQvnlefJ~R%%+%(nADzk?`*Y(}_yQ=x}7eG@kW8@4S4{5gmQ8%<#fe;gPLEuWg zPxkLqNKZ&EyFJ1eJ_qbGw4AI^*MO)kSzq>_1kF&4xF}Rt^HrDjz#c;O8cM^Mwdi*y zGsQ(67Ir3nlcbU|+a5pMTs_rd76Y*|W)_O?6MyK>IV$^IBgvL0X0Fs#7g*@7gk8w< zzO}J?9Up>vk*109kR5v7g!*M+w}GFYeoTg~iN5U+Yc;>^c1Ow`yNhTWz~lF2+E__a z?UJ}CI@@=OR%usi8TDsbqyPIOo-e|sa9!jdDP2hQKx;y{{a8zczBet!Zef-5PJi@! z8LbbxUu!U9!xf9~n|70`YqluRD8?x}I_5jPlcvoLx#zGgca*2r()ZC5lgE6E267MP zlu?gNhqr1f#3qkcab?}b3Eymq#i=!9E*IxzX8ZKz?PrNsVJ$6pEbHvd|I|W3 zSOYZqf7db&jc60u)s3VS>?Wzltc-ir_sXQ2@F8)^ODJjVJ}vI}Z%%%=!cuf&e!JHa zQ+i8)IHSSUs~8bq(zLHsTiE()@#2=#kH@Cj+RSunabTS`MPZ55(UJ|C7`shcM(lUv zS#JBiK5U#~i;*WnEMG5X-D&5cepYYW;$CCgGY7D-H7I9p$p6Ds^aym-J2E1*jC9z&b z#JRJI)L~0=lAXn?GM8I%tD{W+-Nk4Fu{|NGNs+?t<51F^G;g7=w4npdKf$hI z1gm~TfCbacg?}mTBRQ{nvh75tafAOokjP3NhHu{O(^8mK4WtOIrM+F^%A1AU#%&&i zf5sbmH>vg9kTq)UGd{JFkYx2%0Je2>e=})RLNf2(4fY**%rCR}I!m#7>=yt)z+eDC zLmE13Fnz#tM9su@&Q#*U&Bg$H^zg3U$5q6cmtU7I-^$Skoo4Lj5&GiJ@d>QIf1+TS ziz;KoR)KPd+~%L^|15Uy0Cs31@z_2bNLdN-`Q?=hnqA{|+xGTN&r3I-dp*&g7Nyj8=4(T1rE&ZivOt$zJa=;W9%-ILtkWwS1~z0M2j z|3A{+Gak;Zdmle35+s5|7o-VMg6KUYYV_VGh!PCZ`-t9xgy_+G9evc9=-sHJ8zFib zox$+GbIy6b@BW`Bd4BKa1vB@(_gd?^*0t7NTM}F4*iKnImtPPyn(XhUbnWN#-yOR$ zKEISio`}DPyHI3*Ja3f2W)r_|+?`L0!v|#57bW^z(SFSn_ohTK6(aH z7zJG320uypoXiQxDup*3qHeqQg?^tv`B%3g6OtblzH|*XzeA~J@BP{;ZLd94_0{EO zsoSQ@Hhn1RfC6`VOtHm#YIhXnjMoI?###9$8O81RFE#SF` z(0AP{uv;k(g$03m27A|lQ32wHWBlUJ6})~7J>xhCD-sMnAo>a)O%bY-Mj(erRTo1?gLRX>0d7e^42S z4`#p?w3{YL7e~|H6n>(aty|#kiDJTOgLc$8&lppg#rN{?n#5>!UU&iESR^b+C{0|u z7sw4>VTe=3(&@6;sy%}QcXju>39?+E(JupTZ-{Rc zN17%MDmR5)H*b*nD#jRsSlg%=&S3-^oUX+aIrC%KZ_{F&s}zl-0RDxqoCaz4BV{v{XgM+#*zm(qjYSM+|+P!4uwyHXCLBvPhB;JYa! z)_d0<8>RS=mt`xv%yu|0%#|KP>(1w`G9*O6u@U0)ZfNEL%mYMHGcc%X;5)MO;OJyu zlAhnV8uB9ydXmhEWw{pprhn&F(*u@E+shEgwxwO9Gx4l>M(TI$H$gu%Lx^-I9=8doHh%V(r54G19q{mh^gUHtWMgIi z3H78h@}BSmd1U+vFmx49nt1ZyjzPALx(Ru)mM)XYA~y(YRh^(msIX56sggL+u^!7CQqh^v6O-I5@4G3`BOr z#heC5JTnxbP8)beZa1=(nGm6_9%DX>vp2*CyDmZsU9SEuw)c(9+;6>;9UTNyc>z_)B2YXjbk)33DgrFcq)s z2EiFWWNxVC{34q5B693B7vu+#a*p12%1jdy!S3Eix&}8WrN_))c&D3z>^+Qm9?sRb6d?|p;!fvM!AcOCBCP%G2-(~&ZTUgQ5661}4J<;znDa0G>tPx#I-`Ow}z=79WwsGZ5y0 z3mi|L0Lr-639mMCj(XB&1{@1oi&-`cHduV116fxLkHRonzdwa`&8bS>cs9svOc+9Z z>F{nx!+BvX|9le>XL6TS+r3?z;Y)z@;`&dkMm*WBd*%fH%lP6kU`Sfymub>6@HKsg zWq@^)OVU>GNH&Tt{>ixpawx@)QS)WfV1v-fVZCpBK*i)MC zK0jMg6Wy%8$NS=&zSqYCGWhQeJC7Q4&iI>zGjzVqkCnC zmu=k|4yR!-+k3xbP*UeqK(L(H(4vv(!k&Q1P>4VNnCgb% zoCTRMzDiO@XQ)?l>FNXYJ}`AL>{n@&d)e|Nqazjq1&K8-97#4b#$o-&^l8*MN=;7h z?9kqfKe4!dx#|eCZM6UczWtuqTl*4<-1_Qs`nC;dXNkpyox&5K|L=`kaFJR3dj|m} zozQfB7e_AgPqDl4~+K-dOlRratTWk83k&4^BM%Q=$kq2Y|zD&!*aOj^D*?4-X*{+ zGzYHg-YL2+Wydb0s6XtlGER`=I+Axh(7jq35WCr& zH;`8)-#Imzz==kO05b;;$FJr;PW7t@4&SCS0NTD7pIkQ=e6lEXQl$tCkowlMp}KSr z)}W=WBVvE@ zZh{$nZK|wsV}fDCNFZ{sh=z@arvK#DuO@(unYq1B2Ek43e0NH`+h|B+Kk(u-?V!&@ z|2BR8cV_;hGO4?sO;eGNW*0*B!rX=?TV5!h5^|i9K{MkWJijqySD2`rKmIlTqOjU< zw{Z`+jy9RzBb=VY{yOOZws82p;7poTlwHa}s7n}n{gVk935KI5wTf z-;*!l{1npcc_qa~{Jv&oIo;t6H7E^{w$b&jNMmF!lU4w%1QYS*W#12x-CaMmNvMcL zdxI{bYBpHg2=a3;1H5m+%AucD?!np&^q`}MBZ$RLyT|Oqly|~?>TtQ1Iwk{~>e`(Hb_Z1gmB}}II0InUP8o=v#w2iVKDw41${=*oKA%OTamZ-NOG_G71`Nr>zzoz zJUUS%U)`IIejO?$NtZGB^>l#fAd`{e^L7JK6Y;$pEXygg6oo|^}(Emfo#i`;(WNzed%Za%YnOQ-xDU+@~zv` zlvP(ErumWPN)@y)^RVR_8Kdwhh>8>DPQlYgxO- zaJ(SmnX%?n_ueCOV93(02g%oYpf}Xth@IK99V(P1Zd(@qNk{$EQl+ikLe!FdD@JMe z`+CFpf95o@{hHHQJYi;aWj7NiNR%?{8Z{csTQ?%_!36yEMfRNVjF7-;G~9P`_mYWe zr&^csObWD)3%C z-)!`rzuU&QaE(;C552JJy%YxGJbz`*@$1$XJCd=YbE3k#l_mz~v~y=gWFn- zZ)v}`yi;8Zd3E0SUV7m8f2ayks~U5Sc41JiiR@ zB_|nt{oy5C@o*sZ+EUBjW9HY`>$bCkFb_VLR$ zS`LQqwIXba`;MQo#zs6l8aUIH((e$`r`?a~e=!NE>iGOZzfwH*OqmU-^&C`mTkEMC zFJ#KDG-bKR+-9N!4|P^ERN*16EeoEibt!qW#ab1Q@jQdRi;VstEHvU_zJ(D)e8n%$Si2idbV`{-W#uGLXg{4Qm!Ij2@THa%ZAmfAt zB2x;l>fL9cr^;}(s%2yb?{mIzY_~c0*ol^r$rvBo^U7tWWcIl;ltNZl!HT|nL4VL2 zTtBk-Gyu}vAy}ed)MsJc?S=k&{R;lezpj#e{OkIIzy8a|q(_4^3;0+S$zj=mbS*W; z1WaWj?N0(L);dX1+AJzFQOS^O0WD?@;0el&x5H?ccWf86NMp(F7F5jVdWGh$ZxtEU zq2i;LwF<2(3ArbOcwJVtw)EX&i6VF-wnhm1lu;Hu=0|VAK36_-@FPw{roYFROy?HO zT1@HKL~nIIn$~PSxBOkD5%|8nKxG^O+iZrA?bJ4IK^{)2D4eWA{D2wK|h_OgsM>6uB6QKd_*2gEpG<^x~xBu_ypVlis|)173r-e1N>f5w8=QWq~xxPJ#l7uzYt3 z+_Ux^uB5zU!g}lP>uh@ly=zTMEAALz`r9x3t8tV5dy_)CWl+&Us)p0 z4s&(D?V4JSnn7}B_&IvTRGwm$kT1IPHGYDKEZFNWcR4{KFdmE;WmDOeh`r(Dq`yA)Ls5%EruR!<| zM6KTz&()}H>DO(6AV2jc)3J)WXn`7JF*cDGzDuQ^k@}9Wjs=`yZq29Rz89OgK;rf4 zHy!7}U%t|SIUQh)jA}l2lRa7a{55+DwkNM>`6YB#(xN~0{loRi2X|O_!s$%DF*$P_ zk9@zYnJ+i?VjcT5e`I(RdCq(p8l6~+?ztd@Z*klv>BOI`?W-!bnVdti^u2>Ld29A8 zUSG~zo0`qDOBeL3=)!bP3rMr^BWlrnJCpF?t2U2yC8j`ZFnq5XyL~VNx%C+Nt-Ym)hD2k271C$h40^5L%r)YG*|zmi#YGjxuOb zsj{agV&TRX^wnmz@$`>XegmpGFA!CaV=HVW*i84Vs-uSA{QUMuY&YtM#SBe#2W%I3 zzb_srzL3D*2xtGsy9iRtFW=wj;S(?(Kut_bQLw!U88pj#e%+WGV4WB{{c?w&7JLFM zg(u}Km`>3^G2_^3IEwCg77lidf=o%iK$P~gwA^q!tH5bammzB*5(JkoXmLOhGxay&(5p*F({g(?scE$(^x!l{S0KVL0Nf;N0DMRk!jGE zO0Kbi^BZ7P@r?TgB==P49D6kxnt~hN>bB;cT%sF<457R)KPN3rG~fz9X`nmI&qA;_bp z5)=t^k%)C%yZc5(Y*GPRW23vYfRskj;xuG&|KJrK8)Rq4pdVTtxIQ>@G+s+|3p(k; z2A;p7cdRzehf>zZXmu@rfhqBIRD)83}?`j2T~HcL(pwf%JB}^ zvYORkkoV82WQJmf$D1%B{h7~p%;efNyAI6;_C8Yd#!LO))eXpEiCtD&yns<|eu*kZ4w(UO~^SWz^Z;r=uT zz$_8)kE4W2F2{D`NDp`}`&0cdu}Nu@E=Stc4>4BeX_Bs@W3|z5aXPA1K;3fFCSzAn z+bdSznTlh@dbL=;p(d=By%{cT?kLGnF490p4(j0>@RA_i_mFEB6_cv zGjmbo&0a1>Ts|~F&&;nM(iknmI382i8*=g)X$UuZ-i zpWa%kL26i@brV+L0tCIkY$3lVfF`v!?OIWle1;_UfjG+#mjoR7$kB3ppP&LSA7d)o z=Zas6K-CP>+M?EHz4R72x_q`xIL)3Sddn1V@?+LJ_SXW@MaBgh!Fl>Kc4o^ewr3>` zzQs+{8@6Ya4*QjXp^YIZooUb_Z5O=))pL`bNy6$A^L7vvxUZ$Qs(9we`Yb`6_U0jS zS}VFg8q0fD+L={9L!TdE*J{D1sI8fLO>I85&5{O*ajv=aq=wx`L}+hn3@Edgq`XdT zJ_a4y=y;UQojX|55>!J}_Ipe0$HJF!O@DB#@eaSL7UO#w|;|B};s49qfq#aV8Y?962 zE>}1ja3V)R)7_(Jm?7w8wKlb&N4d7Fr>}2%dCVW&s8ZkdUXPzJY`^YSH zRW|@$tg>)Dr!Pq#$P*s=r4i=%4PN#ofy(VSQMTc=wm=qh{8cIW=u0w}cYRb1&xrRz z*7Gm_ZpI-#b5c>;{A|6etEdOtdcE@o{lM1(2JcmKh2+$=O$GDRNjDMqI#6{Qox4!0 zSH)uQK+|flfB$%m@hdM~qG1MfrtA2@=#K2;SxSMqB+D%OZ6A-sPkR3010{ZT@x3M3iVMpMl~#!b^$_4i?I6LzO~1 z(+H{M%D6FjZ0Asg9a{4XR-uo7$)9+pDk_&EY5w1gFzMj~d-T_1v@5rG>Y4{fO#_+)0)YG#vxwhyD7NX2<5 zS>*G}Sl#^?&Aeidf#Q@%NCKzQ64~hBlRtP0W?zc-=Sf?bX)uz7@5{wlHJoL1#U{k! zE4HL$)^Av1eDiK1bg1){@ZaBQ`Ss%fMGBYNm@{UsH4O~U8-N|z*ia}5c$@V*@DCpF8IKv$)KLd@OT3|mcURM7~&~(jaMtH zChNGv?YAj_*D1j}($lIT68(H4T78{2y0L8-%YNvD$`(}YAd@hSOmHnmx67Zx+^0j*Xv+Wi=Wjg6OZ8vTRJZLR zLniY%Yk4(SsEJ(8%z2omQi1iGPXqj>rw6$dGN%9R^vlZYo5kP<6@sj(x-mCi=@(CFeut<>p{WmSJ%cR+M zFF^=1_QHqKXQ_0!FOl1S>DE6A3MUkQLU%+{dwU>qXs`aHmHGY~^Tpktfo{5W*hHcT z+|@;{+?EIEaEoLX|FlYpVeKts5#5XDzwN_mT7Ofr@n>%RuRdx0EO8=eKA!9&ioRK0 za%gd;2BL5Cx-0UI{e^v6hg!ki@h#~)|KzCO8y~;5P>d&ej!aXT^fm9)$f|MpHu-FM z{C=e1{&eNOZPcgR|3&=yzcu@w7xOaQN~xz!Jgo3M$R=s|Ivl;l5g zRuNwmNwX}@$vfSTNG_1XW{CJoq{Cq|lK+^_^g2RsBl$lDmZJPU{B*C}%=!D+$)s=Y zulCDPwOHp|rB(c!k zVo*bhjhU8NY*b40zG-V8!Ef78i$Z#Jc$5)Y^dpjItWuI?Qa-kiPTC1hg8o@?rx#bG zR*UZ2K=uI26Cu4*L^+APIvkWTiJk18ekb&gRsC1z{p-3I-E}>S;2p2TXeis}=c7b` z_gC93QN%FofCL)S9ZsD7GNt_649ZAIf%lSY%&ROc9ZSqP6+#U(S&qrB&wMWd&%657;z?2Y=y6vD@S6PinJWw&}hBozs{E6c{L0;%xfvM z@O9J83Z>=b$rpWNpW)sy9#daB$Df!?5@0eE&buZ7RGJ*j_g>gbeljPMzD*k9WzXl; z-eHhqR);<)T>Y2CuHs*PNLa$qb*Ge#w#|zM9bY65QRm~2Jk{+{Qg!?f6a9@vPJec_ z#L(;D5o747T6RXdEGH=T;@;Og0SATqBrGFb;wnAL9+IiO-`Tn&y zE$Y#w^M!dL>F+7efPfa5@^WL7q={L5Q#T>wMhWk&M>mvP&fns+8(mzDW!g^vX6SD- z80V1!DRR2^r}&E3P?ZUlK(zBXioW*zQNew;IpUk3fsUtt=n9wStS1en|el^5KGC6{Pc8;@f=eEln-G8#yFx%6x9_v~Mchqzj~gYDw#VLQnk5 z?kl-5tf2>urjTUR@iQRI>DoyWdWbug{dSOhnJ)MDW@dhVvV2QEz-q(#mHQA%dZ#kP z8#Uu4_uwA__LndA<%4hb5@9P$QCj6@TiMZyq~|Sr4iJ=0>7&#BV0LcC-v+Z=9KNW@ zhaRfA6ESWQ1ro_gX4K(*@jW9i?REZ>Z>7k8PqP<_S-{%`>!9-o2hRJZ?4R1FO(mv% zE5wJXa!wQoo4xoAL;YvX#qh4{d9gjp`%8K#$PP0;RUC+RC@!ilf2}b3=xJr**)zV` z23JRYoASD8muc`!7;9;QOa1v?Zv*;#S$q593}bJR=55Y`3F-SHL;qvD-a3F*>|7c) zBu(qw_L+`P8Z*~4qxR2l62lIL-{hHXHtyTnF0^%|BHBIzsSf*L$$-~R^G)03zQnQi6GyrEZYG%< zT+pCIK5){sO(pw^!|QtfSM!bg5UPtfoit#Pt&S_xa5DxrG1pJon-o^L)@EI&whBT# z?`}9}k7awueKJ`lxc9V+@efwTg`kRsCQXgfkdmrm$aQ&KhxaIrWy#-mo1FrA1P|~_ zN!xC~r1GpWrFkvfAf6Mz(j{WCNT2nfJ9JaapNmTCtui2;bgru;66i?bZ5=A@N77OR z-^9G7GrS;zM@Ez9>|zw}ves&*ZJoEI4r5gIv!ZhAIvIRs3<2%jcBa;XmM+!B8DB%Z zQmCIfRpz=vfKBVZ$fq`gsSh2RbUKmYjY& zQ=aFRO*gBdd@kECk7(-m?z0;-f9w`uoc&R)F8}<@DSFnbsKkozsDsw7-skeHTLW^5 zBhGGop$)=K`-$fb9FC(&QsWPOuuJijR9tB#?~SHP4I6}{_NHwcGPXNtFIVd>I@WsB z06bDrdO6O_N|@!n4flNQ-m0ws-lbzLeMEQsGx@cYaFm$KEhatYV^Cpl;gT6-$cpMu zAS?)gu)AwMjE~ZgHxZVMM$8o2k9OJ}_E~F&vl1EE?}N1s?4`!1rjjU%Sl>D?ZGC;l zko&?+N%XKmVjebWo?I_}{zHgCbvslN_f1GWSHb>lyCLoDbR4lf=dl4k?gbg~=DqS} zIR#gAci6Ut_|(t3Ot&hg2py`IGx1&VjeIgVJRDuBfvTNt&@Lswbh%U1mU{)j?}XPf z;iZZ1NWRvewiNj5Fh>Jy`s@!&bzy8z?EP#=fRO?@W-5gf2}OsjjOCqq7|)$~BA`2j z-_{@^L7B*D2^!#a>g43HmUCH)fgFE|q<8V9#VjY=*&{`dy>zsZsiL#reOYT2`DaJj zVFs5idd^!rvDz0cboOnkfe!caU(RzYJP4TFKZBWeTL2TImk7gM`|NtmUs-({M4tC~ zyz=`E&h#&oDc-Z(TF9b&78vrX$HN|UyImVuSUyD#)+asp>cxBdtZ?qi&CN6vw{c7F zc1AEg;n0!G)O#6N?{ndXc1loR1l?J2!$xVtOup)+5;&In#k&xF`*vR?(jR*T+R(Y} zd4FO;DJcB3u(HU7f8wn->}bk5FBdS+E!*L2xo((36usyS@ao$&6DHiS9vNih|%`+74lOsGs*WM?T!Sm7 zMF#-VH$IhQV`>}BZ%*}LfGY;N%4!>K*hS3wPTO6|=yTx%(@6jJP4SbAy6!pm6>98%OhYbueRFM!dcaJD&f6UTAp_LX>|BpR>iX5lpnk_#)n`a zKmmSRwElFvto6>}xQUN&>>D!o&2sc@$RwJOfPka!=cDl=ZRlv{i+fKMc1)VC`Kus% z_KrHmFBo9^1G^YWxEHEecbgJXJ6zJZ*JI??U{QFAzQmO@Y*wT(f)WL>ijWmyv_mih zM927>l|>C@8Mv%jI?#kb`tqcc*6%}=$`?V8n^9t?8%hWm9@nA1M`BsA90sn=h%Oq+ zLaH`x38uy+Rv-y0Nzd4*FC*7x|0KVY#;-b=cx5C@VM2l@pcu+6a0Z<5IWc7S=Y;PscXnJtEEq5Z;^^^a<4gk!+|S5L&1~^gb`1*oGJisDAG5L z0B#TL{QOYAKAZzyR+^yf&tAWpc_B29uJb;cY~ZYU1T^DAecr40<=r{kI>tM0K;vo# zVcaRnw)O4MeY?PC?=owig-UpRLCdF?$GkHhsf$WdilTo{(8>H0?mZp%(yd#~S){@2%- zN;L`p2(a^znDxl^Wqf7Q!W!CDLaz>gRJ~Q! zdK6f=lIl5U=!0XJ1zdMo?BZlmgJ~%0Q6F#8lfu(>4v5iXvQcNm*!WNR#zTLGZ-yim zDUegwTky=xri)YB?VR|F#ji*vg1#rx$)GhmpEFNmt1S!c66=QQJ5i~ZeN3X_QWTym zDXx3%4>L2a$6dw@Y_87M2XIF>^zCZkEGV;64%)IkKOC&kejB)d1;< zn*PwLI0FQZhR2a74jBmN+Fu+)nijlXGi9YO-g#wh%CZQ+D>^p)@pTV$35nzr5>o$9vGorB~+zqf_Nv<9QeF8H<@FlFbTA+zcu=;EfM zDWTktcZA1Sk5`wx}0z4Xlex*MydR@ctdq zgAe@n3vE>$055&`TImg*SQaywE@dy1JECdAr0JG=H&A2kr`2dKNcvojQJCb37k0gs;N@#YcsO4 zOqUtoq-guaRObM`5cnQqc1Q5Z0EoHozSK+%e&2AuYSzr-C=nCevamL{qe*dDGmgd` zKY)UsMML}Mn^m**nEM2?WW*N-1Qr#3@v>mGlKpi5I|ZRA{&!uURm3@tSd8x00NfX( z#v@74x2!#UIG}BWeZ%j4`l&1cNP&CkoJX}=(DM2**S`a~Z&=-ru*IJzeP;1Ekxdy- z^=N_pgOO=CssRY*o?F!xI`Q6XbP1fsesw=)Mdv?qP#iU;8-#zONJIv3_fz&oM9ks} zaur0zocc7qQsVc*wfg1$K#!sZY8_#zQ6fLhEq(-NtKdV1Q@$^*pe}t z@B69rdn|MRaMk;f8GyEfZ7Y7I9os*G8RWE^mD0r6$ClcCSiZ^@fDn+2k#T^{!ItZ_ z44VYSV^HzRF6^r=(?tE0XR?;u-d~&Lc`78$1}5M7ANupd*!bt%7F#L@9RaJDo>Ab^ z??+w_ePVkcF^MaPBl(!0G_D!_^IMOWN_ax!bhpUc(Frt13C#AAfl-0vEh*zA;Ia8cI@GqSDN3-c0ZnVeKUSIAiT7c6R}dZv)h^Wp&sH~ zkP|2W_+WdsSEhZM*GuCB$o=XO=SzI9{k(`{(w^LG7qD4j`&&$-dL4abecE-s!|2Sr zsa|`bwk6f5y`gKAMdLQ`_~X@~Rymcg$`q;}Ce7meDTT2ssrsxvEIfMy!*4n*UclIH z-np+srS~XbdU>3@=uqv@xzmc@8dWUmD79OpG?J?beO|c1DzpM9Ve%Wmj&=K`D`SF( z8z-z2Im?|?Q&gCZi?4q-TdP|M^Mgn5O%39H5RbcmS&9o>4kOX!SW5xF8O($1pYj(l zhmS2xI1XSTO^lR1+B(L8l1~5>ICt9o-jkwXEa;MM#-vHIThQ{4`tEX=*<73k`;#&l zn{OP6SvM=mJKSZMCeLFm9&O{q)34g+#W`sp+>`eq&K0*DqN6 z&sSo0eN&L<)}iF&i(WQ5uh5x2IqiqzZ?M*g-YKUJJD~Bv#0g&EJj$xh(}MS+-M^1P z>c>mg>VF}CFYXrv$kMYB{yqc%b&yB)QbUHJnqSoX`FML@EO$zrJb#>?4+5REaE>D` zE4FFTCmtku>Q^mIHuSX*Q> z`Jt{XN*=Znx0GzBRQ1Du46_AjX`qb0Z;bH(2Vg0~PgGbucprYt^J{WB@}m z@;0B#COhQ)oM{TH@f?-s@~kD6lQh%1 z2sxZs;Yiwrlc}@n&OWB-LaY&xCUUlxJu?9JW(ynNvf?F2_s~|rRV}qUDUfo!dS&gK z`?$KYzkXXgmnW!tni1Z1bC_XN2Sm{mt|jzcW0U(X%d@8-5)n(POJEA-!)lqASE~R# z|2Aqf4TjkRf^NC(V7f$sf_5*9Jo*+#(cP{)I$G2x2C{Z>8g+--S zlP+Lu>mo#$`+IGdCHv}hOem9d(C!{4lkf@6SZs~i5b@31R4T4S`wRTknMlq4eCM^( zWv_rP2Ha|APRl@H>8;WY{v`24Cx^r|8<+GzYgZh)MX*Bp`>{-)1?TTqTzK99#UgIw zRLXgGE)dCr8DH34uWO;_PsWNWo{o)B$#ZS1TI%ljw`vnz33WO>#xUr*hXAR!=G}oA zS2XT9WZUHpn`&K+rb*$^b?+=`-1J(Z8o}qUPX+`xiZOMLNKx^VBj;f`rdkdkEVJX^ z*-NC@skQB51i!pl&kP_q@LtXKKE`=v^q+q?nlN=`klPXFRR=kbLDeSv`O#`5%q)fJ zk4hAicm%6er6s!`N1dxNZw%+O&jPg8w{xbVcpGX_*G`e#0HjmdoIWty*%@jJFMiR= zp{z7}pYz2uLa@-Z;PH&(44|EVo0IE@vL*l&lPYl+D4-C%(H}f2T=k>yRemHS>e;jy zr%?mwTFKL&0mTYk3sA?rK`q3h71ta{G3e8dJFa(ODiNs2|Ga2JiJ=-m~a+ayAa>ZAb!CJTL@##tI<_aX3N#}wv2LT`(pB;xEIUg^CFTQGc_^QS!-ssd6wwf893wbOPsjvX8GcLHo z=r(Ot^zi*AYiaFF3PAUPN*DvaSuZ>68<1Q=65CW+Hm6}2FUo^oWiF!$xA2CeDe+pS zRJWEb;8(Z9K_Y`Pj(r!FC(bM{ER3GO9&8-~*2Ub|8E@!P04O2wd#HwAdhD&|0#HR# zLpK3U(A_c|7Ri6(>1oPsKyjRQMQ46jmXyS4vHg--OJGJz$C+Khzho#k_(+~Iv8jek zVinw6c!3`au-@qp&Fg|;-O7+X^*rmCJf#$xo%iF#lVxYs`J*?S1zHzE*tWuqqX z{_om`Z(#JtsKN2L?-^FgR)wSK)#l~*&|}x1q@Mwg_BG78X}jx7R3NJ;xh51Kns~dT z*>W*{FWH?fA3ILH&ub9gt`(K?QdgH69nNEu`}~+Rc^Gtg$`8XGO$Ro@;|yJNeGb?0 z`N2~>OcDkbd4?{Nbs5h4{rd(Tnerov0iCGJ`IXXc&dcmY%BH& z1(2wH4FiOs8(-Woc0LX42IDNCFZXXQ{e^C8-x6)0be4%kS~Il=PN(pHobmtmB)P;TxYlne2hj5 zL=7O=r3l-c{b_7dySnZ35{4(@ktzOMkJ4DUGm2;mhR+AkT-?81MlU0|XZeNm)fE_7 zA`}%gte}y5$|4@H8E$5hZosGZ@-FW4Qc=M75K>p6hNO`~XU4qiPH)(&H9AC5vhQ4g zMJzYp(v!j$J{-l=>sFdqPrK~>?B4$T>du?3s?wD-A2DoPcQ|&c;b{ESDX!^k+jEBA zbCW!iSPNMo>t(_up)MxZrOm#4wwe_+1NcpX9YtnI|Fbtl+4<&Y+roXJj$&)N)3Ie* z&yB~rnS6R>6gz@%g2F-?6RJsE8iIEVdx7xWACxZQUY6^ChT%@ zV3(&EuC!s>BM+@C)&x`{F2ZI_{Vkt^Qjr_8eKJCQ)v((ku3w3VT%RG7QLjGCi;cA&`*Gi9rVv`+32`}X=UNIB8vB!e zxqH|3BtMGb-5W;q1W$-cTvq74p}*0& zYKvl)7UF@Lh-0&v^NUh16HFubNe7i&>+e+B+%`nJj~lu+Y}HIZG$bt=D(ZZ;!Ad#^ zIorZWN6{M!)wF4c^}t4y8py7{yGuz#>yq98$aU7&9g>buH!fEPgfT5WPrXZ%Ob<`Z z`&m{DsGc}3oM~y@>#fo*G0be&x5I@`JCD!4B5Sm2HiG<0fmuQd*9n%Y=6>ZK{7$QP z9!i?Pp?i)!!ySn)%;eoD^kgP0)e_f_W*iw9h<52WC^q{N!H8E@Jl0yf-t4Bvqy*rd zMD7hls~)oXCd0Zd0>{9+F*X5McT38L7CAnR=7EhSil^4CL&7g?CN8#@;z0$I{t%@2 z+2qnT#s|^FDS3zy0TmqY?WduUzm$TUMY#zr%+w?x?6&~Y;&IC%63Z2<{jM7*O0)nl zX&qR2t|tUwUo!{doY1wKQJm0mnTget33vr)kY&mkCgL#W`z|e7z}7eP>HCes>K|`M z7@pB73l@1Dm{pjvO?Uw35%g$Vw1Ye%5X1(!7EZWv^~73Ji)MG z`D?Q>42q7Ir{k^0k?@g6h;$ zC7bivZ?th!o^V8)2U28TL84d?fz?3TVU~cXvjSw}M8`njAHx?dI!i#LZ)$o@yo-sL z-RmX(0F+eyXt~W56x*crD<{dd4TgX^4g2zG6N0)ei)GMlqXbq;%lUFq6w?vKfZlfF zQ@On8tsm0{iH0};d7<3p9f+kS(RAdg;?ef3u)!5}3HwBRjawBfh$*WgY>i=S!)YJ4 zDGlT%&78(f{!Q4y3*$C9Ow$H9#lL9CL3pqwj1*uaWovIxYYI zi?u)>{@=|W78?%VsmzoK;WcE0TfjU7bfq>%#Wx-LjW~zo<99!qban}}A52e6L-7H@ z>6|xHiWRCusm==Bv(h%D;}X_`seIxmw&?fUr{&UtBSD6eI-(4Q$lg=Q*Kn5-h6#Q! z>mv{uPv24h6S61&%DT(iRT)BEkr zgTnS|No?}9roWKkSU=llpTH3ByT@1qHf`glAzj6%LGR#o-Fp7Te_i{h`EXU^>W`QE z+*9rvoqFZf+-Q9>#$oFomv#EY+rN$6%D1jCWN_F@afN?lA*uU~un@DUKj`dX~SFWjV?J9TyNS2qdO8fX0a?fUcr5bxOiKvd!d*cD^{BxYVq_3MaFT}hh0n4a%h(VDE!SB8?zp+-oMJk_wxty#4O>(7EE8U-9gvb>3#Jw@eZs}T6ey?l@3I0y(+XQTCQ$QEqSes3M|>D1r)zNJt}~NF#%YNVhZ$C?(wtH6S1%Aq|p4 zch^uuh;--BBb~$0FywjJd;iY=T<1FH+UzfU8l8FHwbm2&bKm!hr6_w`-8UgFoapP$ zCoJc_W@pdJdL5gtVVH3x}9L3-3(_f7{DDsiNYR*J$ zUCX(e+Zi@D_Tho9c?{)uTieCegrJuH!dLXYeRLZN>JF8E9Lw>IQb{DB$~f$>+qX5- zT!M!{{o|7hiRS;C94!YB`J7i1 z(~aDEv`9F(ifxC2hhyL(3ydvZzuoCo^_f&A)jN6repkt5_$%Fm3F94f6*@EU9n*Mj zHGM;G2@ZPUy?G6?4a2@N4m;`YRm5#DQhl%W_pg5I_h8F7 zmeQQZNcJ{@x@Wgyag_E@0|6+7zyC2F`t%=;W7_3$r25XG{Z^gb;N^AEa+T)XKqXh6 z%Kyg#o{}49#mhd03RZ1ImO0uPp`YgCU;7gA`9FNkjmzhGK@2M#ARK=Y8HVK^4asH5 z3~e_*%X6hrzbX4qQrPwSDm?!pJc&}9yIyRJVE5$UCW^{=oFAD~VK*?*6NrAvaOGVI zv%Fk3IoR@UtYwoHRrTd59F?5PdhC#Y%<})WXdg-5aj^Eun8uu{f1ZvjNkk|wU0Knh zH_Q0v`Cf~x0R!IZu2_IcdSt%XTG`_zXLq)d-2U{X%)8@WHcLD$#&8i>%!MxBlG|?R@gJzW&#(No zTPBSCrZv7YMS7Oy8tEz7LlGo)#3w%LA7ZT*quxs7v}Gkyo&2>%o;TyZQW~i6B-pyo zDlK9!#?^9E9EdQ6J!@E1%l|x=dHj_F_tlONeT#B#MN9ZGAhGUc4%a37!ST=YWs%%g zYbOmUl1Vi7ahH5-${{rl6$xFS2b?kT>ssNr-9JIxKPb1~g8lOk{{JhT|D!1A=krt@ zqWtFXD$>e3>0$ifh*P-pgwDE{j^^9pu2?Q-!-OX9KYH3^68vtt6n)kR!0b7-PTlBS zTLZ<95>E7sGU>ST;Q5*-z#Ubk-PI^h{SqJ0xLo`5<;(7$yY$xoBZ@2$cv`oMLS|=vzm}Ny=(wM5{foN--x0`J_+HchB6kG-m_}6m=(~-KRC{YI zaiWQsFo%U25K)b2OfA&QOq@8c5VrqW=VTF_SMOj}Pic2<#(ITx$7qo7d^}No#&!Qw zs?0SS!f#3y!5RO{dIGUug+n)FSh}^DKe7kx4pRrVBlCMQ!+vrEW&J0KMEF~2Qj_h6 zjS{ge6ao2DYOUroQfq3!e4uQCA*Otb8#9pRXJ%r;{6hQ9CH~74uVoAl;)k213Ih?< z^Je_pH8ZbO1T}50zI}4oH`PVKTQb@y-JuH!hm*58oN2 zD6Ky~#G2WQ(g7W_nFI8DRJ@g=`%R|sM!7loxVthik}~rZZ?;g=vfw^!@vdKq2Ai57 zD=N%Z4gB3v%%&MZ)z~iz>T;oC) zzjik>wmGT+^r&ici+F7F0}4=EpNJ=@dM9r%m<=uaXny| z<0yzJwUd3=Gd;bT(iLx2x9Wbr3#$dD4amDC06V%`=wK=>^NsFH{nonx{DP^zwdv6) zbo9qt&K(g+g}Jai5rzO16QtSN5B?=G_=&Q+)l~+ zC;w5Xcf?P5`i7b{HGga_8TZjcenE@J3wrXjbE>uu#)Q9mt69$0Pe&sDz`uN z9tVfhz$_5+A^6D%4f4D<@D)KI_*w#`<5)^@0B|1o-wT)@Xb%0NCh#l+NMt@{z7@mI z0(+t9%|3cviKV~wLj*?)>W|k<3XR)@)&ZW;Dns3yCbsQr`UF~wwZx&QapDU~kJIhV zNz`%W&`71B$=vVnH*GB8o737b5LEl({7m`1oLKCex%TH%cW$Uz^Aa}XnE!O_de~x> zS5PU1KDS0wO%2HlC%SRU65saI7RYup7K~-7d@~33N0Uxy{YF^#6#l3&uR1V~V9nsa zavexyUBJ-ZMX<%f>6ZZR;~lQ32@o>inbBW~BAf*^YqItHINN%9dONb6`%$<-WNVCt{&s3O)l$zL>{wSc}KAFHYBO&W=y>t zad$tWJ|G}G`VSE&nB)t7Q-IqE(Qk<`zw{;63YL%17T^4f05L<=2S40SZZb*ojn+b} zkZI!d#G1%L9dBxJHA8lQjcOC3Vx~&5Kh!n|;ByI`GVS^fhP&!IGg40F0E44;e^j^V zrDJ{YA_b)~`eCej7mb#$+51P({DJh!0PW0r*8Jjk@oG^#0!Gi#bW>%Kq+1q<{ZZAa zLi7xxR?DJd z?%MPHqh+sJYi26L%6C{;vy37b<=OqQN&$x9M@FIL4y15Qds_}{Qpm}_y12hNw&c$*nhr@m2f-P^>2?E z&vv~1%K!8(y{eeh2v0OS5h~`ik6xtsG92^k#JKJ-Gu8q`|IFe_jn~H26qZ#fMC4}h zX^34drrtGWdKq-c4;g47%_x1{0LhH!GEv&%0GPMbxXKS3lpE|!P4#0xo!qx0&Ql3Q z(-A*CU!L9cy!EU&v!jwXv(Qp#txLR`dsO}Teo1#Ev+~r|Z1c2!2*^n6ChG%~+K+Q7 z|BtHKTR&(!Unz3`&kNuN7#MHdEKzcZuioGNg#gAp&4ij}p%i@9$q_FtS2JQ9tq}XF z)68_~f*V`SUdhb2JlBVfr1+3 zMK*GtAnqSdd+0i`k0c&ULv%04MSgRr(_`L36d*DHW)riyKE@pNTd5}ipBTOO^hF}% z+?m@Bx}D4+0FAsP8CS2LTPJeESOv2%(Eaot&I!X9ohcw;ko#6IE@@5qKX{(&XTPj# zT_5pBX|-Hg-i``zAxH_H@m7`(Y@iY9V=byGRnT2pxLF%96WGvE>d10(2psFZjhb?M z8>+es5rh#sdOddrV6=9hZB0?((ZFV|vT$jCX#_OD(VAXrU?_Dqg6=vBB7b2?z@fsm6RtPMm5?Jw-K)sQU@xc9)@i- zay(OiUaU-oxKE6xwElCQTXaPhUfz)z&xe1S+v1k1>rkOGJ&qEtB`PT}NAN_OyY6Ev zgO}o=nBDna{4|e{W5|=wi4I6f=dL{rO87hWW9FBr5feZTA|WO(yl>wLk0KW|GS3Bn z`g2Eaw>*k&je^@Y(skB{bi#DhG7%S16NenE6oprq>*Qs-5I>&WjsCI?P-6=w!H-U; ziW^Qk)#{a=FDWOsj=Kf+Ojj=_YCR`YJu~KLdEM=eZ>;%TRdyGhN)`C=nfv||_VU2y z+?P=Vw$>om^6^(!PH1-G$=vVRcYb-lORqOY^*x~7@A>g6FkLzO2o$c%q~?^WuB^Xo z8N8bgPaS7wKAsZ2FSO9wzz2HorTmSj76fVdbmGGV4TyuF5QjcIYj)iwufn5KF=v}` zs2ryBjtB;=%EBl;6F@I_e?Q>VasHxqK$7OA$-_??7tl(LJ3 zj_33MQjdQ4O2GsW*=*)8!tR8%+52p@#+xVL$`X?WdzjR@o|Z5P465V@Fd0jFWh$n9 zs0NISTi7c0lxS+=emfFZP`V$@ZYJ3EmSj>IK_;BDxJGXrwzYrLgr$Z^CX{zD#8*)i zHqcab7?(Sil%`8KrJW0PGPA^YB2jv0zgs3gYU#+kt)%#6&MhZF*Sf&B*f;8rW_I7Fc zEgf{8JupAvBT2jbOiKRqhBzq3Vw2x+4=8KD9V*hcJyHvDEq`UWZ@w$3xC~Io>)pb% z%+M9#!nVWhkyfnFKP4Wq?!ersvS2nfC+iny-0$o2e_R_I<+D@Df~X_8S;wsqGknAo zQtIY&Gx!&=f83oHIo7%FFS_^w)FK^IJ7glH8YtUd)}^_q0US;wHOmO<2BOSR@qzMk z-}?{75vc5UOBIHqhJ}gPjwde&=ah|J#MAC9X5yp&OI;vK^ra&7oen3r7oD>d%}%KK zmH}W9*w;zFL@=K3gB4kbAuRnG3uvt-6CpFsvr;N-XzVf!0_aY%hxXHn$5x&{2!C%0 zWYl}G)5n>z@k00EKSReF{xp0 z?!n!0{k{OQZ7TRhGq8OvOl}6$R1PaiR|8D%*SCq4#n{u%p1Mwzp zu~m-IzBm8)Tx>hSDfgLoUQxZkdzZ57Eql`tlq`}P5R3Ts;zH;0%2$oz8AM>6anLOD z!Vea&F^JX#tq&Y;F1)l{6Dz#iWd@$nr&dIU)Mu5ds1^p}n56QZeaLj@8>y)@a|kX> zDwwfCf5Jcy?opw2&7Qn=l&QL>_G{vY3>vT9!pvjrWXG|hGs2c|&-O^2{K<(hGNJ?dA;YNaGT}Q_pYOE4E zr_LfirlxI33H@I<%FZ}!0o_?!ZUesN{p=Fj^n{`_zNz^Iodoq(PrEqH+=)OXv|B~#VECV z*dNE?3VrY81HykAr)K*{JC51h>SCzv%zdGBW6oUwj(J8UYz%IeMTyEGiq|el>t6 z;He3< z_;Z|5a)l+ocikTZO6R#~_0%H}6Rm-3M`4y~Z7fw^z6txME&MhZkvoz!!9zs$%($Qt zCb6v-cuUnWQzgckMFWvvYG);EmOjpLs@Us+TX`HRlzKd(Y+)~U7$#1+ig%Z+Up1!B zN#{*-sW+!)uKawz<)Uimt_5~NotG|7`iYo19{?C4^I_9 zlc;w;8`S$x1A-5q96$I4_2r-J4iLye1A$uslF3XZC+QH*;Ao&!UI`R=FK^eYs1Vp18+R(|B1gyVRK)srL)#!{9AWF!cG#HYdO6I;*JrlU^IQ?w zf~4pl!gT$9`^wxwhzV zBho5y?y}?JHB-f^G!iGtCGZWfmB|EIGF?vx#YtoSq=meBQdnqdwOP9FCeUU77@G*- z#+ByT53h48<(4jKR%2&aw0PXeeE$p5jtd~|dCr7V5)7!^?K0mS5Vqv~=LYr2ikHIv zCvobEjNFOJvy)To@@kD>rzW3GX>m7Z{}}VSBq3J;F^(befhl)L59ZxBfxIGP*TdY~ ze;DMGw2L&RZSno@32pTMsz5kUK&*XmU7S59v7`y8rMsej_tAuIB>U-4SAW_2o9a%9lM@@ zDbF*Sy_p7nXA-v;mUgnt+WjHDZx1L>tUaptISfVJGCS!y<=R5eVzWy`!eiz?yX%jp zZ+67df_Q2FF~z#l%;UD_XtLne9NrMs#{~k=PSQ6b_lG7_sZK0QpPe&WHP!#5YBq#r zxH(Qp3?I%@osC_}MlHM8;CBapse%m`?J3O;H>UxP=Q%fI@sV0hWufPzS7M80A0K=6 zuC0xG-veb+FGX0dMaAgaVCqhOoLG1I$vpsS04SW=Etj`7AzC^aDWh3=Q7ZSDk%XNk z6_#4S+yOe=u*+zc>{i398Hh=g?Ex5U)p8Omm8iwT3hUOk*9l1|V`c~3Gyo8JbNl$W zEOG@TbZo--Aa77VMCft;#N9~`_4f5Rl$x$Hw^$7Yx9LYF%nAnrL)@0=I#VqolXW}n zSjT;DK-})l2!L=z9J8$HA=3RliFsI7k1-S%_Gu?`BD#0$$xIU5-ghd5L79(dMlM_( zh>|VKw?BC1xZeO&v`$}W!cdo42Jo-+wtj^=EQ`Kx9P@)!dYkMuhw*OkNAvnbcUjH# zq%y#fx2$7c0bC0Eqfpy>WhkY#6t`$y&HiyC<9U@w@5KsFoE_ z3Og0|leSg=&;ywN9Q!-V8BXQj zoWJkn4IhVwOgBGjIA%ND_7$$g#)oFh?Ml7KEeGm9e*Ci~I?0cDd3kKBchD{-b6O+> zD#VzA+L;=WKY4e=#!296y3mS#cFaN%i7K|y^Tzb`ThEASDLXH9kHWiN_0~qKpeg$r zX0yxfkM1zKbL0ee`Cf}1w>EJS!u@Z;UTOB*iW>|fUh;#C+3aJcx{E2CNI81!PF>M; zNzbp}%#T;r2G+Pt7nm-K;q*CxR|i^LH>6u}1~6WweV`|m#kzfX*PtvfIHF@cdvh~^ zDv9Kqhi3EVK(@zmfK^1=$L_4oOMaK|N52L7?y~fDbI6aXp=pOKQr>7cptOXk1AJl^ zHU!r>eb-;+5zG^M4#drAKLm1X_^|RqXCFK7KYPQsnD=_R#=#CagxW_;UXyiFk3U&} zgM}IA9UrE}oRh#}3Vo)nw|qY_bI3bYQ&&<5x!5xy1sP{y;k3A#bhQfojYv(if=4q^ zG@`y$7L^6>yII$BQJz36E}Zp%jJp@8WJ7x5U4z<*hj(6`ceH5caZwkU{p__jk?dOHc+nUHF#FsvyFZHf;IRYm(L z9_g-$6$4GL^D>MSbP3JT5UcMeoxB)ed~_+NWJakj0Z53%NV6{?E8^KKnA;HOIHXjElm-r&T)j0%U0w64gk;MD_?4(xoo)BHIG5L2Ic>ydP zr1h}(Hmsm>ZOq@t`BIzc;Py1D#YwscJG~u|c?2D840%oG(B%BdZI~ zGfrU&t*L|qTyK+nU7dZ_qWwFAfZYuE17^=q81Z7CByYanSvzGi);N*;+*jMJqs4Nl zhlg#rL&G3UOj{Zmt-zjAc;@&q88SXYL$d4Z3!CHcAYQ!Bf~i2Cw9a}ses$(_*0n4s zN_BJI5pK~Qe{$s#c^B~B*<+~rpioL;Ld@b=d5HEBiBdDo)lzlSGT;fX2_?R+!<@VR z`Vn_8?b2#o&wzYew!ykpas4FV9-@3wr@-+j+F zmy_&>74~&Xt*Tm;2NqvUyL1&qJCJ~r{ycmoyNwq|ghg~}` zUZBVDgV!69`%-VYXN5^7C>7rop(|1Bj2tdDV4dfrUY^C>b6;*Icu)9&Y>*Au?uXDe9lxvq0z%}}+8UQ8E z^NVE_=9n6O{bo@st12tWrBetwSD~hBN8GuJKy6%< zK~UR{z}=l~NH*MXBB>|%^zUvHy?>cphr^#;HJ&DVz1>g*QK-k4AE_ecO zu>|QCkv~~salpp&os|z2nEj5ffzZ1u+UE9Y7fPp<`%KIG{jRCt)$+~5zQ1-Im+0-k z{)r=98J2nHUia-!M_9~kzIMoS7q<}m(a3SS5*?$(m!21O8^ZhCam3f?M8w3OIj5hi zH$)Nl(_dHUd3O1;rj3OUH3*F&^s-}L8?VV@UGUGPUnl86M@BYDU`OB9S2p_hC87nf zC8C^Iq0_BqO8|ix9mec96uIgoq>bwptQR$a@b(Z#UrEibrRK~2fSoQdT29-oPt6v+ z(S|iM#B6*iGwvJx!_-l%hH=tsy0MuhjLi|;Mli00GAn0&#N+HdV?RC?lk+;p+X>Zc zfj6MhHfZ8TdSSpgAihv~ll#-JZ)EB82tkR@WS-~>_Vzzo}DW3x}Q3o$w?69o<@c|VpXjI zl*Og}3H7Zf05rtB7d#cPp+bYp;qf6)EyjeY*4$n-B;%sK{hU!N`9Mo3zHrGA8_X~I zuS@vXDnGenuQ?|aEZ%=jNO&ej!_CVbo1gtDYYSq#7o$o`nWZ|H*$QM z1gAcCQ?E%+1sWdK{Ug_g`1JXBbMEn+!}$#5xiESBvr9njq+8g%6}loyHAu~mpDukL z-!}ZN3vss!Xu&ymDbl7iy69{OxffM(>zR|@-ScpehBvO9&be-k*%GfwnW&cwd(|Ht zXo2x@jl!yKjeX9^c8L21-Rsz!dr`3Qq@u8j=`JY(rSM~_qLVak-WT+ICL_5jPZH>j zULPiE+}^9%SyrpbE3A{cQOF=0m#!bfruEoETq|UvX7+TB4fUzR(&)OeqvxCX1b(}z zzM`XQErd%2w^^)9`m&Em{b%S>)Ik?(D4^hc2bqcwu{+r)lb?kc&jWB9uOQlPi8r=! z^Z}!^oXg3~;RsW;PrR^4y*n%&uuIsKuAQsKEuA=&Egi{N5AcrT3+oOt_Lwz4tUqk% zqvTs}Bzvh*|Is~*RM*YMFtdHL@c6>F{mmTn_2`|mx@}(y?yu!xHUhdXU~t4RNA(dg zw4%_k>=YQa3if0(qDY+!;q~Z(CvL1ogmU*a`p|Gxp$BFWqxGa8a;O8ziV6N>H=TT1 zZ;T4tydX1b4hl9<(EP8*F2+70s;bi+{xjw zGB~(~Gq!s2BiiBPRuknWa;3LG*x?Av>9X})Ukgr)QZRu+c=s3LQxyk^twrAYZ9>A8 zaJADU=hj%2=Fjn`a+xx*a}yJjQ=N}kr#quq^-+2-iQ>7R1NvMyQVhz#n871fJPu>1U?z>b6>JVERM!4 zHXK4R!TOJ1s4EQVTK1#9Um)(b4eYzc;C+h5Aa>aW+ZdcFcdepuRPY51?s6L(+WR z5M>*$D?TA}|7zNUy{!_(l)FCMjD}>?O>Va8a-tQ$P)MS~{_=(7zuH$Q;4)u80 zia)jaCU>56Sl5Qwi7K-903R8{ojN`y)By zc&gr{yXM&a^OZ|%-LX>_e<^|)st2XA9P29Q9~E5zAIO1GkJiS!7R}a1XQIV^Pjabd z!WW)iDUT6-`9R&(zw8%1N5%ybxv}R4&=Z-H#~J3E(4HK3+Eri%)9&ElDz; zdTHwB1lo~5T~eJuy+ce{?&p^yq*HfKFUG~sl-j;o@{c5gbZxJ4E`c3YaNB_Vn9f`A zad0R-TWJtf;~mI&KYubVf^$!O3B)QoQLh^PTOBu!G!*IUz8a`&TjbnhHnk4E5V+KC zU+7d=<=Cx{7T5uZXJqYZ13R)58_Sy*hDM_;hqD!Hk_9ni;W#BciKr$C^^Qnpnyxfl zIJ=wmtb|i~W|GK3YTWOV1Nm5CY!w&x`r>SF|4I0s^0puWOA(|z)(6~hjgB3rL6I2dw%+7iT>1FOP~&NR|lG8 ztXxx^mL?kWyoh}1ZE_LLj!^j5`pwPFdbyHuZC;xlxth_DJk_O+{q&Z~g2zekUvFZ! z3!(*sV95}T@-K=65Phb94S$yh*SrHq!xuy~Pc3rqygeY`^6d(-&OcIN4qXU;u?>^! zy@ex6y|p(aFNh_VyyfZkd=<{`)>mri9&-92o&1XhWcPg0g(Jl!+NQ`d7TA;Js`pS< zae~jU5PiQkF0u4KyRrFVi=CAoBob1-*;j$cjr_iMQ5RVfJ`i%_ubu5V`{1^#(pa*A zu<6H`M@DC#ZsZkcxhi$$+vG`S#u(kZN)<=+Hu;g~3sIQi%bge_$)Fedy49BaKTNy& zKgXWr2a!~kvb56v^@Cqt!zm?|#L*CPW6la*`;_o)Wn9eGbboD-^Ux<7gwWr1NsPRI z#czao%Jr};ct4^W55*HWGRy6HhD!2fQy1b`*BL+IB=h_$>@+qKe2E^TyC?6BO;4g+ ztf^RLK71k5$9~7zxY?2^ZP%qr7TmWyclU~iT<-Fai*A=1ypN8^uDr|UTsu;xluEl$ zo@;K&7WD3~T1oHi%}(-T`<-Ho#luxQyn3QvNFbOP*QUs?EKhbFwqsh!ue5Wh71S=j z?L<`j-Sprb$=dzh*kiYsu!EEP9f}Xv27mqYfc*q3_l8gKmTqj>&*$o{Z8EIGg$h1u zjvVVlS75P%f4}#C*)5Grtf7W0yE)%ph$^P+-H$dTU$eq%=!x-<`fHz=7vhxq>>m-n zi2Nj-7capxi7`iYNq_GxlM5?$vC0Tq{P#NluOcyy^fHOLxq#S3cGi8ia9M|nZ^CTk z#SN}MkbEop#p>Z$|EU+*-x;y-E&ht-5}Xl#F2aH}dYmwSX2rddV}dO2P<6sd>WW)L z<8o8pAM6UhuW>JRg0p-9jg6g>0T<=r2jzAesWtQc{r}*7q@Ij7=&iEwQK)mG=#q)Y z%{8Wo14klcW?+8n`OmsGqUt}nP|aBu9R>6L!M*BUN!FPsG06YT+^(1vd4#)~r)8RT zH%ufYvV;Z+>+Qbv_a+eKP$;wMARZ*_StIN$PQiBldZxxy)@2}N5<~0Oj{nc6{;k^T zuY2p-u5Lgc)R_Te>iUvSewwbe7L~yz^2rjC^eYE>Y2G8jZjNhyZ|TUgnC=>g0vwQAgp@fsHBIczY(t7igdBWgP6^P@K5O8Y!O8d@u# zbRby~D+nn(nSnGQ2lt!#$K12duu$!zeFAPW%Z_mRO=;cJL2Hm4Y!ljLxtpignDw+S;Ez09t>J$>|H(M+MBl0;P*u6f%xghMDDPPjsV&AZo6;C z-Ig$7dK%d$Y+(+BirezKCydCMnL9Y7NIK$bs?MlV2hIcRBtqv$P^Go4dp}%E9tzHI?M#f4N$5T!V#fvw_7r+&nHLx4%^={QhE@c9X zTX*WtD6Jr*(0ST3=UD<>^)j*!;%Z0q#2CnUGr@_Sk$B;7Kd`2W*+W8c&8K{ZG! zSW4p57>-P5r>pUBJ_sw-hC8mxwb476$#-pVGV@&lqyRqRsfsJmtk;pr=y`XMlgk7z z6=b|s7AaBiBF{tLwdSnMASHl!WiLRj?$@;S8KJB!OKjf@0@uC0r#?|DfSNS(m!X?93p-nhX(x1-ER}?`l zhOR@4oY7{!kP>gVL%3&(c_6}ybK}D zkstIHr5EE5*02(JG13(BSM7FK`^i%ux_wD9{L@vqhabFGOzjJV?{9VD#5Y#fCnAH( zYd$D))h0BNUqT#!DMoo*zR_YWAW@jM0C1PZC0~b*C0>WMkMK*@ewLaL`kC|51Gvq6 zt1mJ=QE;Q!d(t^3ar$7=3iHh4)aG!3ME+Q>^Nj)>r4~lJw6-UKf2csSqVp0lBGk>e zEYeK0#8rnHD`2bz78jOA*y(WO{4BT40YUPC~oXW zf#~^S0ft-Z?2&o{0ZXfaG(`BID$nKIqH?^|!O^j%K-_{di&D@izYH~G=K*Dplg0yK z!!T`SeW1Mg#S>nmZZhP+z=NU~yV`nSmSe4J#&K~z-!k5DS^om|5o-)GKmUvtYODip zYLalk({-n~20-+jnl?GCS=I7~gS;qs%(Dd@lLa)-w4SzO>ZY{nU++xqUk^l1h~%f?Tx-N3+4}tBg3LhNj}9fT|^t~q&_wy4g|-$kaGVc_xyP22UjT!^tv9l zgR9rQA3kY&{W}QSxiJ6a1vtf8FRBpDFidZ&pwF9Tp}2AN&Vohlw5+a?L(Z z0aMHpVFV8k10%8jVOWU!`x`eSjD(_+3#C0Ab1q#WI(16eo4heljO#Q&;`P41PxG)vPH7HPNfFsg`^~&l*50)MV$_;k!6)L#d8rRc zB0^ann8+B~A>E$?k2={0_O?OU+kb6XZfPek{&A5wt28+TsG0FKPGf*$V zg-}t`BrW$W!28~(7J7i@M%FK~S=ki1@8?zMBw5X+f8PY`GQJlzRuDWp-WA;h`1Fn* z*e>1t4xOzQf&|?CjJ8@irX+9L$UUH-;&zD06p{W;scVF(z!dNvA2j7WafbMZ%pxF4mJf8YH? z6e^VK(j4x1@m%X$bfxDAvqNZ5-*Le+X;hY<%u-1H?MI+1ZIo-COSluwFR2EoMF@8k znM5PFOtlmCOd2>!caJlus4v#9#k#J9M6s&1{>cG&&_xW^EIMJhEoemF%miJNcyMW0 zN7Zhxa1rNEd4|v+6JjD`5%4N>K^rFzwA~>;jJqodbCP^HCG5ULH7yO^AvVcg)72yyw%^iGib@-qoY=*~Ul9OizouRj1{)8=pQeatIqGOi zIdb9))={~gol29MD z9)VgtL0!1RFV0VpGWr@U8S@#p8ipmm!VCsksa$)91oW;Xv}l8JcguiS62(` z$h~jRej+G$OVa4q>pp=p;Ne<34%dK&5<>h|4FoVTHhLTWxFIU7VdlvOa*?PoTAHIK6%dTq5v0`8VHp;jj|h?nFUkPwZ>)8$^e$v+kQCMa~r!x_;?`1 zUYnKb7Nvb?J$8(JHLaDiH6e*4rEUf({*sE?A$QMSUWF9RJRM|5!7oeevrS1I@clQg2j)GwRVM_F z5Dviw!zb;GA|A%j;}?(v(%w;we^AtX6)zR3w=_N30l-9X*om73-1>$n4|bZT2y~C$ zQ65Ia>szMnhh$CD3C~Vf`cR);*6ZDt7i(Xjgaj8*UVy3DkR(HE>`Cu1s`gZ;9YxT# zg}(w`fHOi*T)hWXzs%<+#hlOm`s6T)HtqUl&GK)p(BG}@TN0eaCy9(y#NCX3zyC;v zMWsX|3#uz$RJN}>&QI}lyo^L%Y`Yw`^42Tfhz9Sk9bbn=^UL5QTUMR>)?9~%TL2!A z_{Vg_L5D2__3BPO`M5TK^FMPOTHY)DV8WH-u+i(*T*Sqh@F}!=hQU*wm<;G&GR|z# z01sgkbm7xy=E!04W^E;H?-AU_YhfVRUN*SBq!6h%b@ zQ}CMhPwXsq%^N~c4sauic;L#MO36^oC;f*Ik3-0-8*>1YW~u%_UN=xg%Wk~IX&g>1 zC|Hl}v8n;+BmKE@Uhn9wrM>DGAjh-!J;oAUH>*n;+;+UFP8+|+P!d1H0x_h`^{LYz z&sWJ9fTuS4iFoVFb?BfYU{p80NGRkzxXKYzANDu8^{=t&izIcra)ci4ck$4)4kgZm)iLwB z5&hVn3h?EN_>q)B&n88YrIqvXzc|?LV!PfNl0zTS##Tz z@%i>^A3YGo^Vpt^&<%S>3B8ayOSOCWZZ*K2Bl<64!C^a>NItF+ZpWs@)iKMm1UQD!aZQ@NHf=)1?wWBqLrdxuyL_?a%v&%VsaYqA{^YM9Wk!h*lcS;k~IXMjtn z0^xsApc`A&Umn@}5_sG4QD576|S);+MT4Zrn3K!=!zYcfF- zd$u@;{9qEY{g>Nl_%RJ9+${QsL2{)mdV~E6Kx~kYK7<- z-R5+CRKz9mauDdhTI%=SmqMYNWw4>IO@J-`q>0)a`Lg+z)(r!6T!jmR896{UudYQN zd)*{pX?wFjtXu*G3je_6*T%g;%YmdEg%m`wcq3?jq5HQ3Ne^cYj-L(9s{j|vn7!eE zaji*v6D&`?&T`8crB{#z)3EyC7E3x-sL~e4Z8rD1eccEhYPR4|X6xSr5NDRb=K(Qo)WQ_J!-i=MEjyZ;XT2d*!XTq% ztxEe?lK5Ov9F6sTmEbIkKR4|IcP<{UfnuOicP5H4BODHP(ybao(e?66_zukJV3u3w zHa{Qy>mj%-(?3+b&0?SlM-oV7rld#GiS8V~wKzbhBoXe4Rv;9X*obMvbYg?IT3$Z8 zByebzeD;awvq=Rmg!YY)f$rog@mB&j(EQY~#Fj1s<#imtL17H#4kvUZJ3-pFv{&u| zPoHorJ4wXr>xR?mHqld~eN}1aOcy`H@CbK8%^cohIakD2_SZws5z8{KM?1{4F7{F9 z6}{cgfb-=y86Rh9RPUhkV>Zo?kZ|#5?&+4OpRb(z=d*f`K2F;lxTug{DgezCjGV30 zP%&!d<*`mr!il3%dZ`2?}=iFrr35ocA{`{p_XdfV<76fcsZOgkl=Q@r(0&S_Vykh5xvt-Y%PY0eJ z&{=uL1m{`Cvh^KXRFsxQ-8YF?-MH;AxxX`b%zVX?*65}iZrt5{AW_96nudw7s`q=f zShcv2QF=ewX)Jk}Dw|5XH(c1xPL??b{LDl=vJN!Rheb@VqrU#Yb4p^^I+5 z$J^xiX1_(>C~N&ePGKDOr|JA@_$$leAF9jIjfH!~$wlP_ZtO*?l>VY%{TF@)jb?kf z3xM1fiAY4StKxB$Ig<05?9efr{z%$vIzbFinSXsUXdcLEID{9$(DJpu7E?0`h0H^y zCjnXuVM0ZQWbq&19;jSldEvA22qabtuhUcD_!zEU?~#YX<|t>jGSf{OrHOJLWoW#h z2+pwjbCauasxqa<@ODQa1bL=_r{!7_8M3dtE_iHn{qHByVcJf`9IQpspHms~SURQ($&ubG{jomY%kI&%M zBSXuYwT=bSx;EPG(TZBZwiG;;))b>wOpyH?c8weK)UxhH;b)cr0Xb?{=I6_lQk^G@ z5UZl5v!aVr4&?NZ4!2k?Rt@7 zoa#oYor8TzhJ3jlW5(!l9AL6DIyF~{=k5f7z~iAO<~$5$C6D2iwuxr2t;Vl!O5;+1RdI zGw2*{z3!oc?B}t@DZK^EHCQ7x>XM2g*InAur`JXdD|Jn?08p)z?7t2coGyaeAT1)b!_BO0Wh9odZ=u5tLiZZ+4?ezcvW=C<#*api(w)mnFVI)K6rY#FfcLqOWP z>wUlX29LhJBW=;+=!&ioqjlE%WXUx*nGPIkRCSGC6tRNKjDlz6N>wjud=6G@C@tsn zM8^r{A7RNtSZJsGxL7IG`6j%&a#l&+kO9yne4K1LlLhJ9ig#qzTFXiNQ zMtqb^;{qoqCo;?Pbq=1z4INpQ5)RUnf6TQjJ+TzN>z{Rac}#jI9pa@Y^bz}uwl}YY zS(?w{plRm8(a{nt;gw9$vmdq6b!yh52V)OTf+RF!2zY`;IXi^5k4S3BIzo+O%jj6+ zZ*uKd4yxqsm>a1S4MwU31J1}ZQA6fq#Ui?Wtce!SmPufz-|887C|_Jx$x3huxTH98 z6Mb0?&oDV;aAqgp>{bCoU6(YBM{ylHeuW5b@_6sWTSFDmbe?zTfNMuQG3ee;$xMN?-S7gsIP7I zuAfj5^~DQGmPrEFgE4XhYA-K+tGH2#3&7#-X_W;;b_6dHBa!ddLCZZ!ob5w>fu z!qc|e;90l}pG9V5(EEMguAul%8}tQu9kde`@-W&CU4eYO7R<5}H*GSMxf*(jAx%$J z+f4%;PIM(DyZ~rq&n~;gUms#>fxA}(pOEo5Zm9Pd9JX*k2c`uvV7Oir4llHCbyJMP zMe(kC_=fN0-BT33@Em*hbuHB3a=2cpWCR1hbD{I@(kiPpz23T^UtPDPBk2F4?5(4s z?4S4XM?@3>K@bp-ZfO)yy1TnOq@|@p0qJH5DW#;Au4M_4T)G=+SUQ%D?~Ok1&pE$8 ze&@k+_V|~Fd-s0LYv!73u9@NSaX_$aRT|_Vo6G@H)Ez)@JnAmbyDxfj0BX|Rot+!o zF(-ZlLmYc70rJA1SI1mUF1M2?`W%2>dq{B9hlyT@Te=R!y!cxG3C|WQZA+pfFVHk= zH(74x!LLYq+wk>88flG6P_|L$;IUDifqk%-1{K{v`JwkYslc|KVx|87%>u~qhUk<# zhd=<4mM3K9s-NYiqszGWrPok^y#j? zu#56Do+@lMTA8^{7ZCgxU`A?uX#1uFVhg=VLYP*GJ3nLa^&*x*mQiRb1wSLn%SyiWV<+A>SLkC5rP8 z6a)fISG)7Bq`=BMmmoHi_7ShOHuJujx93p!l5K5K#;vvj%OLBBNIm}oDsx`E!;qz~ z182`xiA))yxDj?EL4D_P*V6f0f7dQms++)NVT6p-yX@A=BaLV9Mj688o9q!4;)xk! z6c1H}8piVD+Ku*9<0W7zC29XKj`x#!!yJSZ>rma=m%_=8q46)$O~_PNK+V<_o7Y^z zJ-kweEE>5uxhQ1-CjWUy1qJbt1dD8F!8*FhHjO z%FX)j+uG)S{n1@J%QKmAyYgtU&2`Cd)JD1v@NG zp=qX8MR3sO=9PYqLZrdvB0k|e+Li>h;8}z7Atxe+e!7-i>{5*?lw^$nGysk7PEnV| zkK_5C$r!l8Kuq8|_0?F{WS-tFTKrvLMX*EU@33nwe|}M;X{Oj{4_8E_ffzpl6S_}k z4XzJB2RU|w-@;~q7V_O8jr$tCN>1b$_g`Wib4{-i#v8RBOefiyE_iND7wr(4isWC$ ztX8s&Jv@?1x|>|38ri>^z_a%#>rqM^o%@_4-v+#OW1YZ9j~C!_7ufC*MGfkz zNQqR6;879%E_#CAW!wgU_1_+TQ9S2F*DkZ#0!+W!bdpl%K|Qvn@hfPuj_Ywe;Cb4= z0s}z+O>re}j%hfNfKNjzt3yCs<^Z5A*FdqU;&q6_cXoEIW&76g4yCiodOWE4D-F2H z=-@IfE$tR2dv_nuSts#YmYaW#7gR%KPpC`bTdslucxMaYwwKEV?ILzLQsUnBy*w2- zLO_9-##_<^BxGmW#k+5OB)A-Yh+d@&0L%Fj{IiPtx=tI>WWO}T={J~<4r71Ck6Lx* zs{1jt*OjAgUktDu`yTURVR)8ZcU4oQ3gQ7;KCLeSdPWEunJ!6Ff9w^{0K*mRXY?R#^D_@R(?{hj{-X|<0=$pkhsW2Su-=KAoKI~#w0#_OrlZX%#+ zPOjZF8s`|ik5efwXb|v&{!Vb`^|SSOR^AAScMM`XT2RIFI@3}wfLZZYo37Ytc#95_ zxh-D%$2J2Z$9FJ5-HN)(FsVrV9DrM97hf{U6+y*4H3-#sj}rja1}ZaLw;p#rC$PWx zj*)p+bw1ACJ#Rk30IWqUFRXxe@{z>E0m(c>3z~XOY2Z|O$3yAL$*tbvAf-oSrDCWy zO|8f0w*hPy4>7~LHGtYVM@5u~yxny@W`NyYrahW$|vgz`vO-7H-oz)xI>+z}{=jSa{hl)|ilvFNVZ=PX4mrA50{e`tT$vR)K-N?dH z(JW|dX~l&8e=;~{w*#WMZ6`U<$oXlIM z(N^!%KbOdG9r=ekF27ma(5vapZWn7Xy&3en`@Mq;{kWvB_LEr?N7_GM?mr06=j2Ff z-At+c)k;*07!oA89ETPpS585!8bo7g4-lwZA zkHDb`lf2LF<~ju9faCjOhHa(Dxjyt(`YN_e0sEQd0zRqTshtK zwwhDcL>k)Np#|_UeWmg<)W>%V7L|0-5011}vrx=FGD9uCH_5@TC17~?ZSVgaI*Krv zjhwBP53~W@$--s2)H&W(*OLBQ;om+)Q9vXkmu(1BAjg!Z+q^`j-BeVoiJCWbn~6Dm z;m_+h(jc<|^l)cC8niqC?4U6+V&*($hsch%J~G$pTBUt+>!ber+6{aa%rhm9MHeS8 z66$-68MA2_*ZFAxhaJbv#hN9-R=b}$hC(*y)#=Os2^g8NT-m1A;PF1KLk`#9^uMDi z0JVMTX_ktPiYvDN9qE5Qxc4#O=V6M=EHPxrX9kpn2lZ8XIaEOJ4}XNoo|ELP!Pimc zjlzF_0(za_mQ=aWWaHTQ5T4z*4j&6b-d)YDHM{$6ft76FlVEyQKl@`2#;b7bsx<)* zSZ7|VO|9+^wq+zhgJ^f#BruQI9ESk44D>U?T5=#>vwlG$d^fj??v+DZ>dnrn5m-LW z{QTiv+Z&EvMq8{8XC)fte`Wm1a4Ma(!@@i&g3?q39XDe&WJSJ}wz!QbNoAcw6a4qAIr#_=GZSiH@vN;d4Ie9N>vcyr zch`@~^X!wWaN$UyT!;w~9H| z9}iy3Lj%J-yOrjeZG2xB0^3fNb`|p~(eCO=SCJ3Uy}9QcG1TIrZA|g!!0E2yu|Y*@MmAHMWX5YBoTwVZVW+B=*%&E&eS2k^tn}>UL$V}!|sit)JVnfUl%fKT&a^beW<#`v9 z5!WHXd3iIWyS&us>>s{D{9_J-??pPE-$z;~wGu7vr1JD{!2(|S*<_e|&_QP)=lrk< zK?q^uB$cve(6<&%myd5PdXg68uYP{#Uc9;9y_xyqxmtVDxC^yAS|8kh>3+3^3o=*$ z)Pyv)zWpJ)4gjqjdgVxQ&sRg=JqOraM1;0&x$;?qcwz3eoeOWZ`udg_zS?^zP=t=o zyA=NFHLF5<`f=CrjAdTNs_U$a24qCf1;AnT0=oE{x2h+eo!$=10VA6u+HzpDLj9oL z*&)O5>W6d`CjJ|*^kSALzqQ@Z7m$n$;`C$}_u=u0E&Wl04(cZfiv7_k`J0l{v=uPA z{|My&qDg=A2Y@-m>Pk}JUy^5ek>e zA1d;~{@HokKVV~tRIVn~4)yXqyt&ratA2g9RvW?|_9%R*cd(?!Lm!@Y_|oD|VZ#ql zT(}1{CMihk-V zd8cvBuEu7Az2@fL1q9gmt5~rSLGY?Q4VaL)6L84#8GIdqZ$=xdRNC;SL(UG@tapLl>6N*|^pl@5BwoLS+< z`u0u<-k&(6@K8rQD^z(2C)Tz2A}obIRkPC&<7|ba$+-y-Yb+iCH7i$O0H+W7L|l)H z!NnT5j+Vq%xMK#$J$C@{fFrOG&_53S12!^U&V!#_b*5JpONlym4xsBT<-+kC4+xwEyp;_9hxxg^#W;+wuDG?PU`-*Sf~aW|l)z5PNb!}MwVmbYu?tImoE@_vU- z^59yWdC#w$Qk*Ton3BnyRgZBC|iQs)7oecVO{^`iG6JrAv| z3Y@y@TfK!EhlxQ^ynG2TVQuRwI);Dik5t5}H(K!k(LE=)fvuRi*26{l?1@}~voKYwK< z*{}QOR8BFb&$_!EXQ!wSqazEMsr_U6l<2CYn4c#um5D{E&ADxq=agOfKP3IUwgL1m z$QV~u4AZjrL;_OAe)-v%w@wI`x-#;&TD9+udf>OUA1>FeiEJ(b=tT+SP}-3OJW|yf za131agA_xaTa6OWXgQ>iXKc8~yDSC=fTM<=&^{G2Y}p?ZoIq*;iok%uW%4L?-%D-n(TfAMTNU$76qnsFa%cXiC*BUC6~)A(I^~lY=fMm&}1_3GB~H(ci5xx(e!M zLm>SEbdAApu45!fL)O%26~G=-z;;n72(V&n_jZh3iV+auiY()T0KFbtH7Vc_b`TPc z{A0s7?i^s^SLQwMn}E%4MeuZA{@?d6?EV{}-%AmL0p24z8f%2GyY3x?RpT zh#-ACuG+VqeKYT_Dg84bU~N3W&L)!(`z|Nt>8QOMD-2QRyomzn)t|wdjW+JQU~a7{ zD>WMuE<0Ub`_=3(g9=C|1wKP{Lu7)MyKs2u?1sC|@@-SlZQv-3MfY+XVQFmyA!Mrg zpcD+nBrsNx`Er~Cx4Rg9>s`AI@NS{RHASzcDwxrNtQWMGw;4N#l51-=_q@2VRx{RWVCd6n*%eXAy1;k23gmB_+^@|;<}VFD;7 zyLik(4|j?^`G^6h-Ykjx=t4U&WNgKgpee3Jy2I{v9HNdVKdhTkoKHRs&Rt$6IMe>dlc|2G``1}%u8a$iu zO%cSzjJ{b_`RD@?sreGloxUX2dWN6xN{J~&Hw95;4}2=VQU@wOnTVc1Z8=-hc6?pz z6j$f5(@^KY^pM0kvk`@hlZy6MA+Qx^<9X|QhNdqpJu-l8kfTsTpttpQH}P1;;5UhJ zVu@S)TS^V2kzKBJMMp#`Zx}|4`6ip4MU_E(6}2r=v#{=@)40(Z(f8?hlg*w}D|Qax z5A9Co^$c+a5He)&Z;unSD@b>W(OZ?d&?YtsOq`Gc7z`CV)Khz-Hlqw>w6_==S)rm?HE zA#awQD4hWI{?GsE|86sh`_uyj<(Ox0kV!vdEn#171=b=LuQ55wMWHZIX=noECYo92 zBkp<#WR|PxOwJ8x*E%(owUsYlO9T9bJUg84>S)+*mH*XjkGDnpme=pLV|c-sf#>w- z=t|@N$|7pJrL9k#hEI}qcA&e!23(UU2r#9i_O{arKnLO%K=1Op9Wbjj;3$MPeSNE{ z378qv06`?`q=hftx{T^){-rWz$*1KQQUT{b#-8yP>(?CJjBWDXCbsEPH;Icdr#qz| z&CQRUrLV~&<_-^~JJVliOIL_8Q@QkZ=4~G=@KAkVVGt3_R2B9lBzsOM(YN*^5N$Tf z_tL}-KtdZLaw)uB(Bmp_v3oNxAp{t(KPA9}inImW2Q;TM3cd#_Zi}7@BQQX3=hGeB z;|r()3sA?VfqK`HA}aq29@ipZ6ore;@8f&EfmF|MhS7EW3Ztu{e#bz+88kH?HS_}E zqn>p~4p{ry9(bmg9W$_#*VnyMX+#@^Um)0g6}G#x)N#}q+F%mhKlH2ah!<)*m7ZS1 zz8X2bJFsBy4%3+d>ZQ^8@CxGN+FQ)UIv0dN^w?YZyIX&Xf8zoWc@LXnNKODv?Bs3F zP9V8s#%(z=!(jigTM$ZQ-@t}K$PYB&B$zzLQU2}qll-=X_!5o!Gw|V!*zidaE~W7p z$CwvovK04Q!=>^fm+xA+md>W#< z0(oPF9M7u~TkNAVjFa+wSCcKiT%sQjf-d$#XIrj|Sp@(z-;ES2%Cel6peD@(*71~^ z6crap8~4@xjuX7G%{le+uGxAhKrDEDAjxtH!}aX zUE{gOy~zU8*4Rv_&C<(}s#$wYJ}ox`nYu6%SE53dJ6)51keD8Q0wNt!L_b5ky9_yH z2J)_yp{N-_{bk-EYUID+^0~S{mH{m!Y0Jq)8rDgxlNw$~hamr5);xv{5TA4uN#7BP zy=E9-CVzq*iY5Iv&f{H-)8=5DG6Z3*)sQ`aTe9*eocL$q((M>mL#i~b2z8R_r`L-} zWZY@yHA*nIzd3T<4JF+}N=pHES`fka=|iYCqCYXb)>x%nk@m&_>uRw$%|B{heEK_! z#-FG=B?6~XNydZYK=NR z4IJXKk`-09+Dji>X*FPM@zSCX3H3@csI4AVVQf`Q$Po(3OQQPRhtE z|96E3KpfF%pRRh3>xuwU--lz${x*BENyc^AjuCSFIRu>Li<7p$Im?|xtPS6)99eRq z$BwU+jyb7hf71R*yhLcQs%c<&(_RF4NfG0(fv)5FoN)Pz3Xh~u|JDlrD~r#x1R7X0 zmMhSuz64Ma#r_Ij?H=kB&gB;n$(lRzc>X8qHT$8ytDZRZ(VLt#%|J^&XKYI!-Au$K zxOC2lFP2|L8@9?(9Ea@R)jC-QzMlnCarTpHDe0ZdqiGK~9FPln_QrGb{42abFZQDu zMI%aRDznqnmfq7Zx)3_MUY#yx*3soGsu{|ya1gnOpTW4(iHU~_=4C&V{y`Y~KA7<^ z+E;nICft+r2OI;owHWiY&FME;Y@?23dKnjZ#Z0uukd@BoD5mFW8vUZI zvbklT=igWUUo^o$ks!pBE_UFfVt4XLVK=KdznSctSY-tm!t|Z%gMS5JBGg!}InEhz zJT>~57y7PgxmR(?6@2~hGW3&Zg}b$%-_D|t?-g0Dc#JqbLDqI8e;ZSa{9UG2*oB^j z(FS(Gq>@pksR#Q#-sHCtpollq&L0vbdvz-51UI?xSvPZ}bDPf?x4 z|7DHQfxkw-NYE_!X1QPeqJfi9+e zB7ohk$mr<>WwNgc7fr}%O8Q?x3NQMKu|Yw@juCgV{|8Wc2jZP2!DTstN6}7R#Re>A z?(RvJv%r+zPS6TPEQ2s>hA5+| z`ErG8QzRqZ*9}}YtbhG9b~IBy%~JY~vD)?|vjuP!t304Kmh1}3@Pn7|u@dUL>axNB znd*=sLHKK(j1d=X`jsAO%N|c>N%fjzVS=Dlxdo*Eg?4s-xE{monkhZgn9FeGl@c@N z8pldBA2rvX;_h#2{Qv*QKZas}e)2fUx8iZML#MjSg`=n9F;ur`MjXGERf8zY{o00$e%}LRAK5y5_gG(v& z>%#o$+TOuXj=K%-*+Z+8@k{@-8mQctt*;iuc0h0PV=$A^%}hh__an$yRgsJs%Dwws zSqixff)M6Q9NQT^x&=Cr1QA5^%)`3{fp7pcFdS$Fd3be`XJpff^1S1Ni7uzcnq#aK zmdLyp8B*z-;WBRcfOQLe{Cg$Iwyev!a)L)iCYMf1-m3!@g5NL`BI2RZch`zDGB-z4 zbfdsPMnX9}p&;V$z>+uPCjX_U&V#EzK?FSjC_6a=xMZA#`W?&hMc7tV{gj={sPu)ca9EPTx;Q1ZGwI;LNO_Zgg$C?@ZBMPuUi1L4crU#7p} zGWpXC_?PKGSqXQ?2gX5-j3O~+FJq(m-og_Qp4}Rs-2bNvpnFi@Mu{qgIp~%(5BFxI z#sKtuU9DZ&mfm!vNuK2YSr5JCXUv(f0Cvg~nff1cnYSZLFwWu&P6O?RfHwM(L~N2l zyrt)%1ecuFlz36M*+*&ehrLi(d)D;RFq9%&7 z)2$ae8>QN|luU2xJmv~}R|C_28NA?LceglWGl#SttC26K@_ZxNH^swjJ>-h82PAeR zMfPcw0oF?tGWur}Q96K>;W70AIIyDU8ne{>r06;cS}n@2Qw`Yee9UC(@5 z3iu~%I#LsvMY(1Z&}CI_vuW6?vz%KM3Wth8FK2<%U9o2+1%N#Rsge|gkEl=-B8x^$ zMJ)ArOlmODa&(!6ytK`oOc7hJ~YMjb+f=+L3L2uRJ)$PB->A?39)7r)c%d-@W%0+!U9K_XNOn6_shV4WITPoU|%5^mG#cHSDPIwv+Da95Oo$CLzGk*4m*p;QX%L!ZS((C(nh+<;LDQ$aMvWw!{I0&Fh|%73(dj zMkgcha&dQKFmZ$#A7Y%vH)DvjJ=oed@<`uDaieow3BImUCHL*y(7gH%-8`z6S&i5F zV7k}Jp-bnp*sk74R$chPHd;;wbx-uf%AquOcw0*r(5l1Rx6E^SDQq(WAwSYEyT9>I0IcIPq1Db zD16$sFXw){oQl^MdTU8nRP5}$1}@)mE`&JcH@*G@pZ|1VOpl+jA4y?-{KO5=;ahkf z6qGBa9zNzw>Oq@9aFw0<#?){xkrlqmlbGFgR^rwV)@Y)S6-ch-gT;&n?D*c{V4~r0 z^**3-eSdX0>*HqW^o{4oPVC8(>*O}(M7M9o(7{Ih##F?K*gOkYjM4RggA`xozggyg z@{zA;0i)uO<;&iGtQABdVE@Q|y*R!!i1(w46O159DK`1fXgpvlpq8_?0SmZR9%;Q^ zH+Zws<~yzl$~URF58b^mBG9bt^tO8;tTZ*y5Xu^{9jpc5&n-@^Sv#S-g{Mca8E(m5 zm2EBfS7ogNyxlsaj1|XNOIV|R;va&CN4`gRG;h%JKyW#wzA7OvdorhTx{Ws zyO@Gnx_7 zwR$&@$Rtc=zP`CXh>Gn>PX3}dfs>ucKITQj%79knlm}7Gjut70aWJDwy5zW7govuu zPl+^74tSxH)J@7^X38bk3@m((87eJ~c~L=Br}6D#15_NvRgk7} zO|wagIM0Ua8(dAE&!|+1o2-ws7cd{&a=P^f*m|}36#&!A1r#xIIJzC3ExYPtRUp<& zzUig`Z({VYQ&27^%MsH}OJ}o$*Zb4wg^9z7ue((`n+AQo?ew@0Gt(bJOPeO=#lZw8 zmn=-sk`DI0vs)?NEjRUqK_uetNJ2P>AJs9ME~WwfaAeH(8Y?-rBX2^hu5$mQjbzs<{@1m3cVE<~ZgYMr<<2x;BZtta0*$HDpu- zxZyv<9Fw=@P9>%6KT@QOoj5n$DQf9QhmE-*n-w81}raa$| zfHJ2QnQyxaM@uKwbftol4aZV!h zQol?eS}Q$FH`P7s%j!>U`=v-=G*8d4;#$>jtOd8Z=DhKI1fD4Vfhv>O5BFTX`shvL zFL&*~WIN>%yVjFh)s)BNy<@7|z|9jfe#Z8gWjt_y!;STc40wFMk=7?_*mFwof?0DG z!v!T7RQHVVBwmc9ooymz&7tYXS zwg4en?Z4sc9E%HwnX^3OEXEiXcyN)nE{RH7Id`diR^#!JD8;XFPa(zNV+jNOXvNp` zs^Iz5BE5!76;sT@ZFL1^76tpI!@SkIbw^;W>jCa3&X6KvxN8ZYaVD#a9isS=%WL`L zgSToAR1l3N{1NYV*Vl(#pn9eXW7BWWFUZMS*pc|iI{f5blNA!2N})Wn{skJ(BdD04 zEajb&ylFhzz-Q0L#~5oGRSSD^k>XXh{3r)`C9uMHcFI~>AS68AJ~Z)GOa!XCQYr~n zzw6ke+y{>d&V_?mNz0>i2!~`v`9G1fv^L;fD>EN{E}BZu)fkELA5C5_povFxDWu@S zrfj^XKrxyc%2uV4%Ja_@5H;jVv>rd>l;tGOsC$T1U!nb&kw7H;J#_fHS`Wj2hqmBRtpwTV%gX(FF^VUGrU(2$zavA>GP|V6^_mK zS36x5lY;Zwr~J~MLmDno`qQS{$2PH7Y&R!G5?g4)Yu+1`f#jAQ|9s)Pv3I$#PoyGd zl1;pJZF{-plxvPyh54mKfKs2(7%oWV-wBB{OJc8w`{QEkQrvsw(tT~ZN90jjAQ@_W zD*kqgBBGd}7LmIt+5d3o$>^&tX!i*WexB*5e;l3MJua!^s)|w5=vJ{pPIVtV$)h=bE&bjoUN{VJuv{d`*8o*3Gzv&(G_ z8uGCzY5dSx6;XobG>&pO$#R;6O-uD&O8Mn$b<7;It%|&Ak6CuuubM8SQnEXF)rsW?+@7z!W009nA3X%( z%Qty~SHxylfkutSLJmMaP4vv1kB$>}xmU?IB0dRzy^SG9i8_74 zxqd5!SmuFpxvuyWnUYc;9f_%Twr3Ot0g*!t2QeOT!c{fWqcaGw)c9)uuz|J;PR_W6 zo77sqlSy5{X~R%#pBZJ5ocOeRn$#vI%;nhRW2jq=Iz7>Y%s{dd=Oe@PlNI;Wy7qR> z?+SV+LPNl)HlYM!PTw;(jrm5$lp>(Or%PzAKzLbOP1EQZu`?)b@NHLWly{{H_ogAV zKW0p}%&N~>SMA2ICeRxO7M>-FKR=-@Ovs~8@QJ+~U%e=vGpzTzG!!5|yc_2N*vg0@ zON2tH#^>`6wEf3wMi?us!3`xbq_=r!*i-V;Oo?ycjORUG} z=b2m39Y+|55T6(%<}9LN>4kaT%Y45|d7nnM{^*l?`rIEWQETj&$@8bN-f_($|AZA^ z#&|y^SHi}fwI&a^r?)tYu}AXu(MQeF7dq!#Fv~tXKn)#$5ymr>SpE~_Hr^9su@q;> z=I;HqSXX@)lfLIiMm7F7KH;YDLkS)1+PsQvlek7!?kiaoniFY>BUch%18&x$*>pKy z%;Ps>>m8#sQnKFVzv?(GtziM$KVD8vRdflf2_Q(g*}c{eX|Eio^!IHxWOJjr6La@u zEU`vFyow)sj@*Zmf9!H2r*uC)PYf+ZOil7e3(+#wC47Na&%K2nDm`- z)m^5AA+y^y)Tmy@j4-jvr^?jG6}B+h(_g3NR6N-T<_9xMr03XKVruJ+nQk4%1#Wbk zxf1!Rq*_XnCZ^tz_+c5C{H8=m{gr7PN!dcpV zI@q+SFW{Bj{ml_IemU1Y6Ei1*NFRqXbFXJ&tRG5df(+8GiJmo8u6RDV0M#^*!9S8= zU7N>YNHt-qD|9o8g7udT$W1abMvl2`YdqM~5STwG+3v>Igc|~^Ic2s3(={c%PJbt@ z5;nWPoQVs-3O#4OccqLu-do3l^a#B|5Xf+jbG_)*G0hGMPRql+v``vrVOp~aw6B1X zCo)cdS~31BWh+K?wh|1u**gm=r~A}U87>OQmEi6`r>#@A#Y#QG?xoqI>QcYRDK%Vu zAp%HY2W;Zk(}zz6Ly9`aOc!r5pj>E)%e8&46;^v8qoLZ04>C(t?**p)^B7qWX&@Tw zk+RLxc(M=*Y9*@CuSGcon=w=Exp@{g=R*C%<|#YDmQ@iEBgS#@qFOSlHMK~(_ppBo zBasOi&vSiMoUp39h<&>zKtlV2lAXeShR=SKR4tig#|Kch_ERo3Ub^yrpGJaWE`0C> z4;TX_E!g%UTM(TEZEw|sOww0w2 zsd21X6?wR<{$R+xCaB>_7+q!D#Ieq&DS<>&$pI`A5 z1La#{^~*u@ua9!g>yprYu0%&F?Ou*NGQ%UtCMpwb+r9r}o9W43))WbqRaRDaPcKMA zJ3c0i>sThtnHyQMqw{0Z_yRRZi+|9!hcgBi*>D{20Y6$v{ z&uvH}^#P$Bt}f-|jm~B?4D?`aeUCxjT%buv13O~NB!p?!GEMgg;duN**%G10alk36SWmrD1QH$)ZGuy z51I3Yf8q*pz(0@RpYo5;y|CEG!bnA*jzw_yK&0&*xb!9Jt~KPn%6`6|3C@yE#0B?V zfYyB$jQ(jFFykatdodwwa^B!OS~sTWOMLC(&D7E7>j&F!DWiHHidD*3xgkS!`MCn! z&*K0H6M zYuVCM`y@XgaJm>&z&L96K~ss~#Kml&)p5Ac(#=QJgjb%sw^?|*qAK_PaO%u++wByV zs-nh?)8x(&DdwNq#gw0MAw%*@E%zEG1C`7uU!gUHnJ^PCMC_2bGzH`A_P=H1^sq48 zsw!uX%+oWDKJf!~26dC>On>I2Irxn4p2Kdi!p4(t(P9A9BLztG*UevDQT zdZuq~eh5##c&v*+h}Y~iL^^GRuZU2ao8}%i*_}Uc=us=VbDaZ@1jX=kRX5dW(6POP zV6Sx<6UGkBt)DQ{*6J*7?NIhT7?m^77MNjlTDRFV!55gw;4u$cx)*DJUhLR=jMVU|=TgKUk(z zL=;U(hhcW1Xf@t=OB+yBKe;++^O*ICn2Qv@d|b|My0=-P1Ccl0`MR*<^U=^a>91b4 zw{WJJ`zP6&Oas1dU2%R4{y2_jW|;bJVfM%S?2FyXhmubxd2jA>#UR!_wCd8zE-P8~SLHl&3~7mcD&kEzGYPP}{g zaB9WDGbHlEoMCPGJainp{{gJ09>?sljb<~obyzTHM&uow|5bkr>#@NL?OD(nLnP|q z&kCv;2*zZ&F!G`WmrpKahUI#2!*Q?)qwJK!WAz`}bBvIthlyp;`r)APH<1nmWlZk* zDCuE*8eI)|sZbK>%fO%ZzGY^s8Gq}sg9Tyb_}|U$FJcY9oYYYCPxc|VJh?8x{y3^T z-OH;gC%Ay%_CHF)7#ndDVk7%))Ba*l2i)pVaj!6yXNPFnJiQhkQ~&f{00N{dOY3u= zxVyV7;C~8wBNfX(Ea&))UHM6qC2_ItYwz^12fI*~e!ks1p)X)+tql~0fKJm%q5D6| zb(yU9%3Je3R+0VM4Ue-esnWz;(?ml$re(gm$bB^h(`y=PvhI4NTcmNNCko-_aMBS} zWvSN-d*JxwFK#25e_W^_>;OGEU8qS~Mi0D!TkvXcveXc->z*ElIXr|TaBQ#gW0G2) zgx3bH#-it|&r#Lrl)^_{gfsjqj*>|*9%p6_j?E(a(FjpFie6ngT0p&UnZ=PzDmPdx z={jOp+FldYIcCgMc9EpOIk0nJt{p~XJYCDTXhc)Tjc&5kBlX6d>wBtJOVUArcw5W<)DnI~2vy_k;LoZ3!41UW4&_Q5@u2A59MUJxLUo>NU8=2Mhq z@-w7}A=c~Eg3i8wZG0!X&)E~>Py_))W1)w|ZnMwZcBy!|EctjvwZx&nU7d@S-H6(I z&`1?Fd=qNbr|>sWp;QUAl5EpYQ6z^dq%*7jQ$D$-2SH+572rxs^>)!>#vpj*;p0Qo zcu27mQ>z`(CE`&9X>D@*;%OsG?WO}f{s zYYLR~tl3Qj?EE68t(oUtBY?jy7ix}Te9iO-7yP^(%cKa+;$aN5=~ zuAkpYGrP z1I;5apn;sA1Z9=xrLAm+SKWGFqNQ-8?6^Nx9F2~MHkY`jT362f#q^^&7xF7we8j(IAI+ z%$uL5@jUI(@pw?}8c)wMJw)GF>a$ zvpY6%&A{kB941;g6<qapTcD%(A(I=*bZnsPcOT z#S9&0I-6wS)^4lcwivZ9?lAATTsrynGDv%#qkKiEH`v7pLwibJ)Wsgm9H!VnBHcf; zWR$HQxpN0}r*5 z9mqevCqywP`S>$OIm3&p&mImX#(YF74GgiNSNOJtaBdn$oc`^vz2z~3(WM15%^yT} zlNOEk^B28s#;sY%uzHQuCA5mP7$fql-e_ETtb(nFjIpQ>%^Wtu%NQ`pEPh20)r5mo zbnRwp)EUAv=raWHfpr2OanYI61=0)Ni1pdwF4FaB)aY}SOq8tiTr+jJwwt7l6JEDl z{v-)bIA8H!h0p0LPel>6YpP|9G<{oTwsJiYQ!o0<5XyqY6!$HeU#Q9B_Tn8qw$hON zpc>D$42L4E&+|7=yc<6-exjA*aYnbRL%a~$x3ZWt!$}tO=E-xWlh7+%?>27+HjTlX zE)@ez?lueXQOt(O&(Az~EeNB}4A{y7TfwL)OTjn-8>cOU^*7#!ZebP^g?bcdhKroc z8psrBe{*iAUzCxxX=(>pdRgK_UdUelLKLAVZ;TB6#CmQt6qt{`Wm7xnF{vQx#2ra; zPuK=$`dC{;52DY1;O$^&*np&wkoutjHwlG#3fBiqSnWBkNYUFTPm4^*RcC6R%|lo9 zR1IFgH4ZHZ40UZ6VzG+7ezl`5ZMUG*@SwF;n}doF`pb4d8Fodp)P;9c$@_7p;ep1! zlg>Ik)e3y-$yc*qyU6W{DDL{(IjqEDA33w&?CpTU+iE%!UZ&mTH9$^Zr%}*7x z;h`k-TJ`H|br4qLiV0c2L7Xd8T}ORp+tV07zi))>EhLyBgF~=*b_5bl8~Rw|aQz+x zQcJ#^c_8z5F)Lpt^TC2%t@N`extT-9mCnPW1Pdl{?8U%{<5um2Hgu)^24c(h(RKat zXY}n~r>QWF%%?unvWjJg@ft2YW4};?Y^oNUvAt^NFOB@bbaoM)TsG}C9!k{aWjSkt zH;!!_US_ehbox|E<8`uSF@)md2gNe5XBu1C2dZ6-biqp^IVkwF0_4HJV&CoSdrxLV z{|L40$o@+cp|p%`rI=_=(;0LY@LH?t^GMv50XinI`tVVclucm&E#7i(tHxgYuX64cs6%XItIw zL^Fq}e{Tr{el|9#RnB z|FuYlOn&*$ZY&#``HqSwy8o1r%;(F7DUQvTT+2~GqR$8w=p5PV1n*zr73Vk#Gkv$- zU~e1936r@@Qra3J+`}cxj-cjp***{dd9Fi zqAT`{%36Zzqcny$L_400x8+7JniQJ&LIo!Vzh5sM*Ts5FxY<^Ex5cfXz{}S3HG0>Z zE(hjcwb#B%sfIbt zgFbx7JKjya7zz~)Vt5ZpbSf6C4Rb9!MYssW;l{1%Uf^U_zdI?oe&U4G_*i3XX6c0R zrlGZeo_2kO)!VAKQ~VV2ZJZT9>FnGlQ^Nxz{M;Bt=}>#7y~vBd5*HNdkz5?56;^H{ zt(ewTQ&D;J%QOCZV3K0tCzqg18YM70x)HB%`NdydJzBI|bl6l$!mr zANH5mPpFywC`TBXigu_a(Gt}y-SJU`pGHnEK98 za$hm7ux&&=uxX&fUM7F<>pEpb`gPtBEJyFD(QM!=U~SZ9eMMa1$p2wxQ2(q#f0GQh zDpJiWusDJAgl(FJ*5zW>SSi89piJQxLeZn0-`BCce!Ai>QxOm3ujt+h(kO^{I%3(X zELY29*&#K|?Y+*;Wm-QZa~r*C726N$22@^9epfWWP&R*^Kx&b};%Sv>eB!C8;oJAKe6 zGd1DI)?8)clPIdL@dPJkI$&Hw1rGzWROE2h(QpA9lL62y))TP_b0XLnjVHp`Es_U*g8XMr+;>y(q>mjH0MQ*!?haZob>qXV6 zeSM!TgRO~2Xz#4+`cfj+u^53%XEg+0p$|(OBTLX|{pXSMEExCYb2hEj)K9l{>*1-t z7@FYoRK$~0vjuGAK@JOq4nrl8*7-1_qXdpOb&ap`VSWan%$W&N{@5`s4a7 zHHEyki!bLbt>c;=y{?aG%qR^TzK^6O7LR1;%!X{xnZY9OT6dEh|N7w}22^ zluRY#q!RmPD}Szww#|aH7Uq9#Oa5`lJZbv4pN2%8nE>k1TY?k%Z5ae+_!Pc8{ocZP z+D{_)75WF)6x23T6HZW>mzw#pBO%c=8~_TMVmX^-h{0xb>UV$JPb>aGHZ+0zX(r|FN2heCkuFr* zmi%1vDYrw5FXlSHQYkg3*cgKr`0Kld=ALxPda7c?Oo!o`j%RbY^Q0Oq!H3OQI$e?o z%G{r{lbowb>1{oGzf1~B9=2?0J)<^w1@9u~YNnLv7j>EX+#3kyVqDjF#{Wu6KJ{P!Sh~vdY)28y zIBTT7tCmm2#R9{SloI;n$ASL^hX8yQ*B(%_YEVT_>3WurVR@M5(ItExS1M~^x&6#Yy%jJZ z)p)}U?7w3s1rEnTsZ%^fHUQu*byt@At3(`fD{EHZ2L^(jSgCIEQScvYoW?hthroNj zZyMz#ie=M^=pI>p$G>-|8pK!L$DkJd=~+1}Bjb~VsDnfCV6NTUe1t|9c{Ld8#FwcQ zCrz0|npxI?m5?!-`&<&Do{OX5;qQ*L3XG`9SXvTgF#LhwZ{{mNRJ$TMJ}*6I0$Dm| zm`-D)I+EP`ff|SJkz3;wQNdJ%5IhOEJ$8)e$6>nnTvhdBOgN61ug3%7`?chC2N#T~nk4E=FKR(FXnEIXNy5BJ>96<}J?0`ypZ_4A-U~^U z&qgq1wsKOP9b=2LGqfHz03eihEx>>E=97Oy@$b7yX;A+{3d_TPx z3H0;kA?ZPH0Wljp|NX;=X2P=T+1O>8As{lHDsc~WK3Wm+FA3IPPjz&?wSKJd!732y z>dNsr9Hqt$_t+(DGxIcp81nFBg!XUb3v+oL@q0W?^I@8ez(?pAvueh53(?%x z?^yk@&_SJgTzcwE7*NhTTk_x;5*1t6jbeo2*lCXyf9k#1{NQ^^bI64BtZT-EQ0TEgblg;P3im@k2}6bhv`M0e02w)bJ_Gm4=|Hv4g(T zw(u7H$pqxE7Qr5k7?1o<){A*#Rz7;Zno=sc59a~ z>!vxC8#bg1+_+?(xm%4B#QasAiF!8XmUNS_*4&q0SF38^h;lzF=F~_jr-&)Y?p(wo zU)7~`chJT-z1(1&Y{5W)vH}U_!A9#I11y+SyV4FT`Mq=Y-afVOuN5j3Sl*$kptiVd zfvRPluUf0iQa|03{w`$2lAI?-1jS&!NhvGGgr<~}_8?ck{5@uqGL#83La8p-i$`VbojP2Xil~qC{o1x%wdnMIxYTO27RgV*+g%lTi zz2C;|1!ky7H&3A~+d1?GD;e!_^^6m(qPERR`XL6qtetx;%LYJ6?hn=v z8G@^xSL;f>ka^8Q0Tbhj%$1VaZ4(;a&YN^dkP7g7K=f8eOB*snq6%9EAR5LNG-bln z>LS2M*CzJddw3J@(|HiuPv7ErIQj(rf8jlU$e#b-124MsNBmlikCq%L=w4k;I8tJY zsE<)MIzBqs7CMU{u~g&u7>%=h~O?z%Ez#r>@E&lRSt|7tsCVZsDy2TU#^E#rsmor z*jv@VwZ5JObowp2ti`-ZRu&|NQ4j3sS%R0+ri9a8L(&Aze?Jzj5wemV!L$#V!!#)j zO|@?nLSY7oq?!WPxlD#t=1=1Y*IGr;v}<+6B{!IM_(|?AYrp37{h^PnBA)qT$`1}TRMBghI%GY}gC>Gy7csn_XLzi`_H*Z_q z4p5-W4wr#OhObA`jn0tsRPIa)rJ{ywic)HY6NUZlKk2w0-NRS*#g^@9Ml@fRm8eR2 z9+P_zpZm zT;4|%=-n@)_C|S08>Sh>lmFWRf!5+ig$9RFV55YiwFE9yV6VI6p?udJvQX|f;$b~J zJD(09eO{2c90#`lG+vS$Jb6kp&m(2CI<~EGwbecNgQ8bp0f!MEyRIX;ur2!0+sBg$47pKMfUYw-w1F<%NP~ndt0nYgS-eDU^WaUj znk!k|upfjbl8(dsdl%2^hzqOa07y5nKbcWfEI#g)7~RXTsv_DSUcrkPE_Y`nve+pD z?*d@$Ak9U?G4r|!&@`5RHP_^MIg1ZZcqSVZS(EfFr_6-JpGz9a(5}m9l)eNur<{Z4 zJuL+iNy>T?>1%0cn#xc#=l{e8E=c@vuKeDhedNIv#767rvY=BYZ~|KHchBIz0;d~e zfM`0RP&ww>L8J=%cxobbi8nfxul!&}^2C+`K-UR402&B|&;cDLx1$)`$-IT*3&Pxd zsMFebM;>~J<6x;_u37GlWKMV5=;T3}_ya#uVsuF)@QVwlD?n3w!oh)_8K-%NCqdfa zm(bYI!9bhGhTlB2G&3voJ8+FWETy9|tTcb|hx;6Wx;@v7ROtz4DVdplwC4X*28vUA zuUNV;uh5-X+|4yBi_T-#&m)Ww?V+@r{-f|s^{zQs(X9@L_X{CSUZ@x=K>O!GZFs(> zeQ813EGFiun?L~?J=Wr8*Qgta=i-tpaP>{XBs|_9?fDh}sm(a!g2iz9+ar7m-~YY>1J$=yvKvN6N;{_9e-oicmuno$WgnECqBFNcEAA~>=J^I z47*Z%)wmWbMYZlgdB6`}Pqhz6diq%mGnOv9Nn!VG{y9+~A_p2L!>HjvZN9ZMh{ymR z-qNpTc8-~K1#&54k2-ry$tODOM>UX;p!buWl!rm=R9T1Kf4u%FD6P!h{fF6kSTUcg z_e^j!)!V3K^e5A1eyC2pHvK1=9C+;}7D6FEira(EjRr%5B9WlV;dAf0J54k(;sMLd zJ2O%4aWy5biOif6Fp!`i^VeCffZhmF5LmW!PW{+KZ*&ZK?}@Oy zsz(<4<=zbC1ZiiPQj+&*!twc>Xw2R7gN0oe^F#GA zCn$&+DUiwgKXN=59&P;AFG9k9P>#buz93UzZ1?l(Z9yzECGEjXyc(F1E%wL6xLHI3 z0lrB~ZFBYl37EMi6E|ao@Ck@wep#sP?P-KoQf4$HGUN8dWUEWl&zt01mLW6IQ|76u zQDrvlgaX^YGfb`uiSwz%G%UxJo)9KY%52^vUx~~V^%ER78ga4Ke>Wej|KrVJ0EOmN zT^|mti3M&ioXc9SJFU$QhbvuFchbPPOl`Wt?!TNl=-$L`C9~0dzKW369K+-LN@bS* zbWSz8kfO^u>9$fo^qVWcJ~);;Ncngi{>^P1naA8^Vw-(`pOrW(QD$^1NbXP37gnO) z4?(>@aO^Y-%cc4k`ts`^IC{xq-I!JHv6N*0X_Bv8JwDhvXa;V}5>Cy8d)y&r4cM8g zQs}GIS9h=?Bj_&uwo;I&B+&wR8F*;DCUi{E)tn`kgN`cKfGzuOb1L>Zt9&;#;Evs~ zU+J`W|D0W3JTl>b628-I-}*j={a8-W7(KoqG3k9$yMPOIG;K54x@WB)^ZZ@MHB0%n z@NcMIprq(rhi(=;M-zq;cEfMdbMYoz`w$4V$QRKBGC%uD;9sLq;!vH0F12SSp6OXh z4G%Qs;pvJx0zv9&Ro5XNZs?xNH!^p^$x`zuR*Y}70Z#4`0 zidKQs`kyWhtEvr2gTjATfwK(wmY1X!J!i&DsmF%Nk7YE(xDT~lW#x}Ke3~YztYdX$ zu&G6t8T3r3G8nR(igV2-Ty?2|G|i_pIKz|AkDMT9E(VLg2u`PLg1_5ce$|YTxO^H9 z0XazH#kh+P=}RuvquxveZ_wu8~LDGea)7Se@|xqXA*`|R3{{JNV`h9s@V&! zyE?)vr9mudlOTx_gw&FZC$3sB!UE^1C!gm-5tbH$jv`BB>b-#?!W$<>j(;-bf!O&3 zbXwBxI;K+p2iFu()zYHIDfNAQGDVa=A0EK=92n@1;(A-$xA*A1#g@ zPM}HJXbeRa1sCK?Y8y<)_iL{9wCB6*VJ_cmp5z@pDd`xbSz#$m+dYeRP1LG$C z9T?M0H-Mq#E8plK!N+pfJQ>K4F~AM@LcMd08E0H31>o76*`+eGcuq4NJ81A|3-mu6 zG7)LB9RasH?IK`544F*B+N!YUVQqoyF}X3|7^x z9v2h@nY)Jpbl%o*t6X3zvJC{;bEJ+8bPFB)P6^WHPbeR1#d z1UO0;B%!Xw(0TtTo2YhyA=bOdp~sNNU-ngHVW_MA31ji&uWpeA*M13i(n}072-ka1 zIUajduga;=d!FWHZBg@E4YGBCQUdqVdAl0fdQNoBQUZj^6(iO}2e7Z+^{FC8 z{3h%Rjs4G~nD2W|_7-C*UqlwLx5HbcfCg8xU%G#ePNbyK+{uz)WzY<$3R{d-MbFb2 zC%A!{N=Q4yOg4&P!CIe%n*snULcBPSH;<<8(hm|UWN4R86X(>yY|PxbPRV%`EG#Tk zPrkuu-Q2i0Ip|6Av|6)3r%kdRe~i=&@2-10=)(7*Eat47=H!GH4bd`e1tG{aVI)95jkxMASPN8O(6&o7FJ3YK}TksolB*4N-`% z9p}>2@c@h6FH%GejC(;?@JR^f%vu&7S9&wK-8T%9bcMr%opUZt(Td+G-u^mId+_;& z3G;&}ijR@e)IF1Azg&Wc0(er}F2QDc(j}ZEU~N2aki*p)kY1_a4N4C6M2=J2&8{vQ zY|XCeiGp+g^Si!|?SHI#d8l=^3Z4l`61Q(U`_#BTzb2Tz;)gp}g=FUBUy~qi+!V8J z#?OTnpzGlyC2PQ~#L887tfkw*G>IYjQC4gQ$WMQtPP;(LwPrJ7LqsErzFoP_WPKNW z+;Lq17}T`xs4s=nqT}RcrVFa%{z}?%BVsp5nWV6Gv3gLX^|6O9IObyS9j$ z%x$ox>#8UJx#CZkt0*k((5&8YuB&pET?5j`WTOH?%X-#7kt>z>V4In8lS$3+&fX`!1Wq3DQOu>U2Ewr1hLQ*OzJ69c0&gTWroftJ1*#cXqDhX{C(y0 z29t4;;iKD;>G9-0R?YhSQLD^LC9j0Qwk|xuyE$d{^OiGie0=;5DadSQ+fOUy=z~cX z^{)5ot>zflo|kc1lFMEDov*jv@q>flx(E(J|35D=78^o6$S~tci4c;|qqVi#>)jd*-{hS9a;zWg%Wyg3s>$$7 zn)0Cz>NlqE6gs!ut!Wb#h?<-8Al(?r^gD|ZMZP?i21otw(}9*LtJ>@gglQ37+Oh|+ zVV&lpULGI~)o&N)p|cLznkwT-%#!{7X+6Fm5AALseAs0x zS4i_d+#+ld6}4Y>>5@#=HJOqwPXxS$pr?(^1f*F{LYcb%hXLp`AVe`}honM_^2V8Y zeaDNs<>~G={#cV1sfA+!zNb2Q>UOffV6*$jpo%5KoK#>{$lJ8!7Nk014RWMt>7#6f z92CdtwFR;yYL!H)OkXqo%^ODr8?^!2r(IfrJ>hLdK{!QbBVFa1Rf1-1qSOJg{;7_; zN9)!veh6oO`qtyp*(e6Z_II-KD|F_~&0smfrVx0#jeB zEsPI<4f@#vU0t=sJTjalqC$w1c+Q$cAg9aJ^Sa*cL;_w~9S^gh0fQ*MLIXl5C!aQS zGoR{9uB`;QjgZ-hIth>5s=nTXc9c4A-Q7N4^j=O$0fu#7dUcPa2XLBxzy}#5a#dNR z@&o_!HzpV<^+q>zLdXoYr0Y_U`lp<;E2zEnA6$IOur;qi-TOH6IZRbN}%McvawNO#P7gW}dgRXXU)Nvxu~%fw3)?m~^}_7!glqQ(FPjZydk`iGYhYgvvtCM!kcdc0r|$~O z$7|Q%TfhF(Zfo*t?q>;4GO+7)4-4WsvnNdS{3&?LbYgf1>9k(dq*>h0mt1ZK7I-zo zaI4-zVwpW-Am4EV#ooe6CX(PZyqJrJ%V?y6@yl7NFCKi2bSqmseSi9k6k>fB|FxvX zD!l4E_Sh{bsV*I)ue+A?^H)va^%%8-H-_6`J27o4UI7gM!WP!0ZjP#bvYvQYA72h} z(q0uZ2LzP~cW+`Ui~I^Zh3;k!I#Rw9i?j#p&|P-7H};>k(KpnyZky3?+U3XfEq``hr5W#4!ouET~10Oz#a zV3pK-&ovEp?Rs5~6|DOFJ3fB}Mg987H}30D@b)YK1mFuyOo9SXP`)OE3G zL%p@-vsPEX+BA+XQ$|~iCYBPc1s?ZYS$5J!ywl9BUZx$HmoM{IuuEx&S|&MknrP=d zG2ZGmmdM_P2})lRV*AkC^1w{&??ver?6JB8hG!D_p$9lg2)n$pT3o zK)VuBz6~S^;3?^Dd5^t!y3{V^bh=cLauNui0)e*Rot_XZC(F~FJO6uI1ybgt)Ai1E z=3}e%j#ZB@ETol_lL}ntZC5)RU4HC{JvQUKS9NPa`%e91#CFg{^QrX89<{YBmq%qm zDhC|2EVVQTQV?q=pm-G6YOrurQ#qJ}%p~15(P(A4#W8JUbaXhmkDZUtfQf|fp@BT` zj|~tw*W-tUr9{QfYqR08*y0G?A^N31l62a!)69a%l+ryCQ5Uq>%!NPU(pda#wk#J{ zk?Lu4+)z=YzDUgDCLKw_N24^Y#QlQAE`Kf(KB(_dR*kp``)kyvux~Av&mA%VG@_+Z zTPf!^DJ(Mb&|iUzzIfbAv;MXod5R?(b#Xc#^f)Xa>QV`QKYhYA5jxwwuz_fWti5@Q zS6)+8Y#2|nf0Fe2^`907AW%BI*JY)noK+`fm^p5$!LYS_{1@r{Mbi*M-!a{>?hX4% znXEo&Ml8Ogm!BbmrSk@RG?@h^UIQHXwmZlT%M^a}y+6570mfIPUNE~rG$JX}T=ue<2aHErjKnpK9aXRWXN_gAm`0;vlVnPrm12%Drm!K%8Rl9kO6 z4X)#n+W2{6Gt|2Lf@6=z)5aYzb!If_p%(hnfyA$%1I*)o_%nKKfg$?5wA~Z?u^4Bq z7qsTRREwPKE)u{h7da+G43obKqs>mH{rw+3H!b>T7 ze6MZ{yK!IJF#zU46Un-agc5=dA`8hE8+9mr`G*$;u#;!E8fTYuvcrPZ>4eB) zIf;cuM&;GhnYIwc4@@=wh#KgH*IVnTy&dGKY!Y63K64&ETWw`)T}>zPE=$>+!MTA# zXoX6zeI6qRQ?-uE1kga6ao;~JPFdXkgKh+SJtF2Qp@Sd``KX4~wjTjDH1GT`&^+(5 z`Lnk;iKbi49O5(@DoBM}8rR&WBO8d7ZHfA{+!j?XH__K=aCKaALQpoHU0jr@ST)Ha z$9geaicUFYSZ*`SayvU;o=kS#o!5*~UM|AP!^jv6ul>9`ZK62Io#=F+k#ZR;5R1kX zmx)XiY_OgcEUXK<;|Q)LH13_CS!(|QnwV5B+$P~iXoS%DPlTdn&UPD`mC`tfeeM!u z^!LP+)ZZHmD^3GVW3Gc`oL2;mh?7jU)D&#}3bEeFBz+RZKL-Dsyn-?uA^4>J~TJZ<& z&*y8J$s`E10ht=~6<<>Paa-R_8cBC#>A0{$$~QRi!M>*U`aIO6B>D7>CUtD5!+s-L zj8RlpP4ZTP$Xu1HDqWcrRlTW`lXT)Z^Gx3`tv1w*VF7g_61i&sBr=cG^pE=!t5RA{gTn+C_TS-`j%mrr#4A(wcH_7 zGB8Fy$_GWGk|M3G6$tYq&5&Ial9I~x80rz__Qy10ym%hWp%3Pip)E4i$Hm1Z;-lww z;Pctx2=gJ$MyH@l+~}i4{R{9YHW-7B#E*l1e@B}7q({(W#u7XcZ^tb%~X@ zhz8RJ1~c(w;@Ee(-Bq>aNX(=L%fkn{T$9l~-RQnLHeXJtB-&y~Tz)Ad+3Uq@+f@I@ zlFjQt(gQDgATff0q~ra3!@WI(toj01D^hr8yCB!~N zTYiA&;y>fJjPW$-Gfo~8;})=(6DIHEI6F=hEWVtgliMlaq1Z zVq<#uVTL;Uh>)$%)%Vwtr=oBzjGnK`4VCJx)2Z}G1&Zz&TE>|WVtTARMj}AFAvE0Mak%8LWq-b?It>HI(-*Yn|f%|8A z<=L@yGPHd<#wRZ#NZ+oeY=X_T(Qa|! zq;IB4m7-e|eG9h`gu#cBF#eKvA8Fu~V?X)QY6%fw!>Or5*MCS6`rBe$EpBXdEpzCb zeVwz!Z>O4)jP;C>#TZdvtzEt+p?T!Oo^p)#0abLDbMZYmc*PBYv|iwRKKX02d=cr- zpG;-u(CgnO9)gp>Q8A2u_}P6^30bN7*y~jMO1}CMT{0#rkJMgr#oF)ai;rzHS{5zc zPNtC6i!RYVN77&a^cXp+z9*5VW9TFh+!>9lfQ7#FiLBW251^DrhlMG*6pE67q7o-QvnK$d!5^BKjouVrW3R!9w(U&zw= z;79~!lB@={`_&Jf|J(Y*9>?xtQP#9;!$Eb6{bl#nxS3PC+5I)C#}b^K)o6?J+RL-u zS@V8sGDgR9XcQTQJxQ5-dIM45P6!(*)1+H?Bn-v%^_28AZN+sz!|5|)%{kv?ZPuW3 zr+v{AH0icO>$cJ&oK!Sd^&qBq`C4s#n>sS>_zGQ%Y(LApqdIf`g=v)GF6H$S9~)t< z%rbJByBZxs;%we!9hy;EY-6h^Fimx|T(tO*>2+jAnAID~!@KxFLva<7aD}Mh3=n0Y4W$%As#oobf|-qpOyC~8ZMW_zkWiG#`30-g-JHTA zbIEG@#0KN{slYkPeebRIHy-CG^F3a^FZCrb0z}@(@8iC!#0cf0?7We6kPP4Zzij28S?RA!emDvhHjIxI^(8U@F|=(dhP&8x;DK z8u1-p-bZ&@)CPlCA3|2p_1vAb)MHD}`&*2TmxVN4h|ZYwD&2c;+dzXnUIfy7?)A8Q z`EU$Ej%*MsY%{}#tUf=t`YoKapC?S;a4th}?(aC6yflZbgb!Zj58i^c`{c019^})+ z%!?U#JeW0%rKmMK8Jtea0jYjekbj&+)!}lS`l`D@i3OOph)#I0nB=047ZE7l60_%% zjZrB!*5YEpO*Z9Mjh)XjDe0*b2Ika`nOMHtmf&hUa;us9=!8kpJocaalP&E2sb^Ot zqslG~p$Ene48f0k30=;eSK9ae051jj$Oq}-WDws(V#(l#ZTrVl-6YS)u_^;Ea_N;e zvsxq8r_CrY(`tUmUEU?N_Y?JlbOyuzVQu@5-f#?#|G3!LB6}c9Ez1LMY`x@KUwHN#T({W86mErrWCvm!FU-*Mn6tEmq5k zQ?7mjIDZf&KyV3H=VmDGWvzUpt<4D}O3h=%P|K%@VyX{EFRzl)E;FoosdQh5U}>UwiycK^bMUgmP))%>tzzq5y~^({%aS*Zc_Ft`~X+gj#0 zStvs(3i(%JN);gL-S9_MjCX&rub6BsH zJN=_tgZ0+pbi%>s3S>LCpYsyGHNoH;=lLym-aFD zDo+*vL{od~1fkY4_Y{F@>$O%Vhy zRBziYnJv%WmM>WsZ7=lZ5VK{T9Rd1CX4Ndb953P@PF<|UaE=?D#-!hJ zy;f}^)%pGwQb7%=>XMol_?+6#BS41_j1c@IbjPd`r!rBc2Pn_}neIc015a1hB5x2% zq;$p1%UxVBbR6hZhG#B&*7j(2|1j@O6Qt`?YyqO8^813$^Iizw&~Y@H3pJI2kF?>t zJ#(&aNszY(^bWfmw%g6|w3{AH8thFvQxRGy4((W*D)^0XLb)U5hKNC9XEBau9@s$c zx>Yj2o3`$vcGmvNWwrKwTPaOBJ#hTbhj-*IEP^HMG|`p^)veB6`(mzp_Z$vmVLMr? z9?d6yaLB zH3<bk zZAYJPA}Ie@*!c7HxUw$DCVr;{5Mgy^xaT6ZzN;c<=P*DN*G@` zx9}E`W<3d%*v;CaOi>@ro^ME_W{9olQvUE$H26L2@}!ixKf)M2sOj7M&$Eh!*tZQE zzgCgG&sUsAF2xzZtYIeFHK(6Do1&PnRZh4tPWrxjJ@)zck7Wb~H+qV*vYDugo+Ya< z(fz>UVp#!L*yWvBioDDF@m0$8$2BRM@TqO7n}JoIF4y`LMJdBQ z({!c}t7az?D3-*{uZUQeJ6N}akKTvO&AWa{LwiVr!ZmvhUo zcDLGchfF1M1NH!E$yV3GvE{^=QMVI-!>=y2Q#PGZG`va-p0gNw8x`-?|pT4@;>EJFBn((%TLdQbiz9~g0bI}%A~Eo5`zr-wbM_V%#4C9sgY`%aYG z;zv+bT!av%9;{BgV>P zbH+KMp;S@h{D{ZDi72cPpMwTAmS91WU5;tP)pdx04#QmSARV4HCg&uJdHuNPhYw^h zJ?R5&h|0es=)5j0`U#Ko`_#7oLD!85OIQ7sz#*gC+@W3gMxYwP!(t-!_IU|gI-uou}EiWJ>fBRuVA8x}x3&##hsvx_r3RmkCst-mX zb>pZCS~Akm;sB$A=+?CLh$fccb3#7$)U{UlHeqek^Q|?IXFZRv$3LEV%D}5~t~p6+ zq)tjZDx^N6=zqoLH!I{Qj`2nMs84xqkp<+A)X7K|ZsZI3w>L(pS7VuW# zzd<}tIORc5`R1tAe*i9mJ!-A~p~J^Z>;1ggx&xMo8dTuxaIW-BC28l$C!ofz97P>? zDi7`7W0OiX&SAmK8S|rT8W@iR^xhW|l$Dkl>U(H-UH>g3*b09-qh6;hvQpig{nH0$ zi`!>>M3c9nyEjd zaIL0pxc|>c;_@i-!AO`ZgX|{dF38%j$nV`WpsFu`X~Wv!n*8Gz0mBzR`p7sjoHpD0 zZrm5yNFrD5=#ukr7Rc{>ehGO~b9M>7FLzKGoa&(!+@~82#pgO+Pa9FYYwl+%IqS$R z^FmD@6w;r=AXW%4LKVxYv(#|@A}!*6V^K9dX)g2-4l!dzGieS;A4G#sh z5k+0x@~m9S|J6dRDqnE5J*rncu0}5-hXHXJJkCc7y%c)wF~OKAh;r$idcMMhpiX#q zlAM`ot`p{YAv!z)8|9ilP`YIVPSkA`-KT*=y#%B3jL{ox#L8d9;~fuZa`KL5;y5BM z4K;3`)TYuK_K!5cz3T4Dx)qL-fVZd*e}DWS8=Xjk($SxqT3d?hh00{ce@F_;r6XkP z(?rSY4vcOIinczV0?Y8wQf^*`O*$EFpAUjRK8h!Fe#}^+DYhuPkQAev_*T!uQYw(5 zNS?5FWKmot7vMfMnP;Vfjg%1=lBY4S#Ze^One@7kdGdMa%9 z)APwJopbPeea?*49;*Qt=SeZ#;mqk<^H-hw<<5Ie*XJ7!5lbXc75sp25Hi%TNSBc^ zmuIW;Cz$)QZeAV*bBmd1WR}fh0)d6#fw-1Sv8CDF6tYE7^7w+OC8x&ibk<8GI*ot+}u>l1dwsiW)Zg@v7HE%Mn~vy|611t}A`uHfN&_lb>sr9i~Ry|k1} znG^Epkub*5Kf1ece^@QmU0*foj;OXvx2L7_>eIJNDvAGmYMq0+`tqCQ!O zsNB=2-s?q!@R@IH#tHpPt%6w{$KdL^x2BH!Gul1WDuTo1c@E@ym`i`^&GJ?vxd-PP zUoBS}FnP(=drWhS@4C53Geq85p_?K!HGf!au~%!zC_E;VCr=K&qUu|^oI5sfTRNA; z$6unsimPpL%1~i>bVNYdJ-7>Bu|FT*eY(m@x_#X`OzlGL2MHG==;;rzBEm-^FF8y( zc1B~4`#TZj^<%?1aDMt#Qv3~Ni)CTcH+eL`@tY^g!B)DKOGDg_B<7()=e_vD`*a~^IA1wU_X4|58XX2` zmV}%OkeQtDi8KIL&Gos62HktHRR{hh36zg-Wh9QGSC5t5p_6u!A+Vxx;|>}0N2wRK zb#)10Z8($wV+>^hw z^2niu*K>6A>92hyOOrAyeLd6s*-hwF_$Kw?c`4|O=HN{mOg27~M;jloB*6F!QhhvT zz|HCcX`a}HGHTZwA>_I_05t<#Yh+&b>~*6L2Txl}=y?k3N){L3x;bRxI5>Gr^jq-n z3(&PGUjIEZBv$Y^)RBbIp3+ZcuIBgWzeq!69zE9+CZbtnp-iZD+NCSOvhO%kIcYYy z)6@2J@nT|l2k4~eylQP6Qhhl@w0rdg4UWtlGV_L__@o+DDDq8;7=Rx z`oiuHRFJ-?aJh8hr#i}rX~PO3g&W-LLdce{M&1`$! z9L)N3(No<$2EDo^wOvhs1}|ih;8a`!Cvw`l3JQ+u6TQ1i_>PC|cXN3FevM>*{gTIf zOi0|BRaz3^3(*XoT~-D@2&*dKKg1-Aivj=mJ>Ch^BRy#K<)a=AeU&|%8a5;ob;4-c zOkSBsBb_s_HQ7y2)tNKd1LDsZ#9KG-K3}GhJ{KF|^>}bDLCQT%)Dzpm;18Z?4svWF zI-EKjoMKdbb>#LWa4rKAh%uyl-5Sv`HsgoxJ7AxFN1zlqSv1dLmS@C%8n9NL+o=tq z3y+F8tbI%-n!BSaqT1y05P);9RVM4z9VJ#TnunMkSbG-L-y0|v*PSV=a`|F3dlJ89g zT@Svt{u}R2y8;9SKK+NO+J(iaC{(DwatCUq=*p)A(2`vyK5NkaXfn#t$5v~)?dN7B zGE2pRp$yrv%%1${Y;5qQ=8U9Kt=K=?G@C28QZ{Ma1H!=NrgaRf!J&{&lCtzmZ)K(2 za+Mi?2mlUJ^WQ+(oC*)y1s090Vpj%<_wr%!Uo#hZpyw;F84~I|czfpg>t!=cAU;o` zv24IBEwqXZ%6v0RRhKXj8k`3ILEl{>kFPNFM@3k$|E-uJn4>eL2^F4e%w zmSU-Lj2sYnh4upURlEAoYvr#CF6sel17kraCRU5CebHJMF;Y9Q9NOgGFQlD?{ScD* z7vd%K_c@`JOZLpXb?UN20yOIneR-GQC>`ordx`v%UJ(D-Lxte$%{dhAeil0V*_CxOAXuE(Q|hWh%#0fC?e)@8ZreN|HNk+3|c z{=Ue;>udix==HPQw_Tc4S;_)P((wwZw4Z?Uyt+zN|MW$~GZ6d;gL@KXv;=F?%E;i3 z<}hEU^4O+nA*6*b9>9d`Eul%!dPI<1D@Edji@W5mxjhCyy_++Ujgsiz%haX%Bun?e zu!Qrd+Flv`2UWkLspsm?@N&D3I@L*>9z4rwT>y?$ny>Dgysuy7(*#plW3JVqqw*``P@^JA3whadUA~NNKcBT?z*BmOeK7b0;#}QHu>^A-y-){@t3+!BH zuuPeElt?t0?{##~&e%rmF)dcxi@t22TTebBLcIzd6)^OM@=Ev#555RMpqC_x_eoXT zGbB8{L8bQ>4R=|~oF?6l#6fCHzaNv2N-!rC!CGojC$?0{Hl*V}16VPg$0 z5^?{YuhiZ{hoaBy;;#Q}dtwd-si(F>HIF&zb5XiYSyR$(109HZo5O(iZ-BN7UzCzR zHvN!OnjNCVForhC%9cwSd>$s_esHR{_QcEc>I`l`j~g^Om5B-1-AQKGdoJva z`0$iX3e*0d%f|`(LuARFHPGu+8 zh>vLj%`p3I#1@{ig0~euh}xvb7ltN|%NlhCVUx|tQ%P3az9w1kr(~^dSrXq^KS9v? z0ev%Md=~j?BYBM>R_meNi%}R<^+`9LRoMy#&L!HTcrO3Ao2k@GNOWf^+7(+^Mp}9> zPOdE{m)cO3kXt|8@}f6AVo(5+ugmFH(Oz0*!)MUb**v0h@jb`u(h=+@_vC{eZJGqbx|#$%L8 z-~PmA4c|0;CpQ0n+%Iymyfts8b*S8?4vRVKwBe2Dq%LNCJ@NB_(FUx88Y{0Zi7(lK z$8LOKm5y-7Y0&#pQrA0Qq`<@5y-wA^N3Vg`nW5en6S{k!^hvgH_ACK(%XUjply}c} z2@z2~2l!>aEcQg__tvloPth&Nw$X2#AUuYp4ioL*t1Q^KWzt{5eZ|b)zYy-f-p+S1 z$BwgUMX@Hy-{d8(wPYDnL5w3p!EF=#p}9@x0nN! z{uqtw%cAVq3awE72I-Dh%X;;$k+zl5eo2|1Rz%(}RMv|1mK#U{78+1qDzzajRTe-p@+PLufb*mi=F0r3ya##4Vh z8%~K^#Lg=pdHA1~&-pLD_8v!ZF^rU0vRh1b^-tahS0z+_&Be|5^V^zd%W%%!cX*3) zOxC$SuZd!(VfsU3>Bx_?M$4j;UV}Rx3zr4GZpaLwI{)>@w8Rvm~h$>bY+sUF~BNj=>IiOJN#PsWW^&p|wH=f>sQ&t~o*f73IAp2{!4PEV&v+1c0ArsQon*NT^ zt$=dDS>T+8mPUUP{N(ZFMYn<=XAbAX*+4Au+JlUX5LO#ZC99E4-fl>yL(<+ti@utg z+7o`@_3cT4!Vm6rPbH+Z>1T9GV{L0IdzDt(2)$C`^Y4Qj0p`;_JG}+##YWhoIrmxE zD;+2@6egfw*C*t^rJRVO#Lg8x;K}*9KCoraPne zELT{@*Z2J+FimMh-~XKL_V0_|D$vg}wHp!_%aF;c~o&}90by6g#VEVC$0DTPLW>W7{3{6+MurOOO9#8O1DUo?>e!5n=EbW zIKs7g2FijgG11}V@(sQ-7t`_Np3~hGB&x?4IK#dxHSP57> z?#Yf{ZhiTSn+m=~)i7UdUFhieLe-q0XfU|kLM=>#J8Hq*>-lB;(kHZ%HSR;X?UZEGMWo@u`COTrOJu#(LNoL$V7}8t4uYkz zKggH+n`?kd?~);{*E>?9~<0K1rJv06))9 zHEUvRArs~lWQIoCyq(AZ%&{9jId`I^xWO*owy;hYbG%(&n|{L1bKN?B-gAmXyk4aj z#bXNz?|CFy@I+lrZE*2;7?HVxfb|2hqll44`S3ob&jjqTQ4N8f4_*FNs%vTue-cN0 zk>irI4QN=?6=Iwcl`Y=&+E(Krgj{<6U@e?Acj6|)CBYMCwiw=)DipysXQU+lNjwYV z#C4@)(=#AW!mQVC1s`qFHz#A9j|eU5~!U2{mp@V&sK?6Ba7vM)ucGip;~j& zvp^;^_ZV>*m%65K9S*Z55;yZ@dUbzr0G>ild&mA)66MX&2XC{T!U$sM%h%A8&NOlv zYY8u+O7`tvFRfh<%jri}J?b2oVn^d*SYZ*$ZgCM>cm4Tx5{9@83RstmcTujQOj)FK z{X#}BCYcDOKHndbuG-RjH&?UeLszEAOmsLsesXdU^Qdr?~iBq6yubFq>o~|FdpCLjoQW za32#;Y}@-I2l(`)#ZQg-;X!8CubNmVA7md^mT} zAt`Adq&WWgS;ICv$&ngc?eUHAc94|o>L=1E9*g2&iMwH|08078cJ4jwxx{MUO!!{y zto<>G7c&V=>oWQ6*OUCtnbYRn!iCQydDz;9q zsCv4;s|ucTwf561E(?C$EPzNsXP-1=sBh2t{=5wgaaDxfv()+mSGHfwIW{-`dh2kr z0Yj}qJ!T8!PhaX+xkpFhZ42cbM@L6bGdVQdE8JcVE82|L%FQ3F1aUl`7c$FxHD4eSr5xD-W z(N_U?OSi3uzV5TM{*|ImsPg=OzLtX6V%4|!$!IgJdqT*Cg|=BTKk)nrY-`dDH(w_U z8keesIJVdTf+j$}iL^iF)9j#G$~%K!m)cmgtvh`GqgcBxO`DWthF#qVgP6@pS$($f zX1Cp`!Xp`cD6}0$&!-Yotei=w@^pb*nU`x+5EZI?Wh>ob!0jX*4vZ;jM#}6-4h1$^4GH^I9(W z_7(%jE@2jjCk=vosHm_Oo>kb+<=T&xZBo`{6y|;cO>9SKCHY{0P5kPVzGSI*QR-HY;ZN zz}-}jY4xedc4ErerEEnE_wCv+K$~i%J&^rEAFYwtu*e9|e$re?mGt zwcelAf6rnUQs2vA<1T!dO=wZ(n||}FuKiU?49O;qu1;|5x2t+RB#DY?I|L#@2xbX& zb|Xn6VgpIrw|CR?Qc_)euu1jR7d-h{=br_a~=; zE=u1w#X)Z%hxPJxL=`NZV(sePw!XQG6hP^3H^GHjg-~t6X=(C6X4p$r>;S!7hs@j( zF(s+%TrM)+{qP>X`kAeSxowJ@5ZAo~jBFNXrx`KZ(JP%OS@jCm2e1K_;4J~J^Y|f7 z^85EYtcQcQdSq8v_{Vr0X`H({ytvuMWzq(zc1?#!oP|e;?k4Bdw;aR~qI4ZJjREc8ShU@+fstT|A*Qv*b&!W;oSjJSAo#ei!pMeVlIL z+2MU;F70=nOHK)WK2^s_aVR^p)UZt3?A2zH?ck=8k_&M*Go!I#sls9?pZ}@vZF={d z@d0dg-K`6kl07Oibr%)?addd7Eh8zeR}_hvXh(mEU!hu#@cqy^7H_!iMLsc|F;en& zN00CO)epV*R?z3yE!icBsn4Kko5`Dl+#MGsX+Qh@#Z9G#XIC@Ek~2{;njaG6_Xz4ai2>C2m%2uaA=i2*d6fIQ4Su0+R!hzcQcEe=FO^hmFPw z&o*9~THQRfJbv5L0nRF}D3zoAW6qVEb7=&1q+`eU7m`#WS)=<{Q6*frlCH zQJ4=Mk~C3(9%wwt8e!!k7c<{YcShufm!yj=1u9SW{_&w9u-_{^`uBJ3_tbb)fdBmp zj3FV+qq+O>=R3Z&36W0u^4;tV4od^WjOjlwV6Ts3WE*3pEeGl!sU1dSB)*Q4u7AkF z^FAewv92abFf`MFI=7qMnrtOcPol$4P7HI(pK6C*;3d(z8o|#>W5;Kbcl%zzzL%=z zDo1yuct|!EfqXex?!(xc?A1?iSr9*rg@Z znLJ;=;mTk3UiDGSOe~9}Gk(RXcS(#_KKn{)SK}`I@RkGIPvv@bzU1_$-)xi5n4$Nw z-KUfw&!@CsG^R%4zv?$wk8tfyU(?g(1~}&R@xmbFJynf~1FH*96`<62-3tcIXEfzE zsS@Wt(6M!y#v&7q7?C}Avi{qa6rAP>>+ig4$IhLFehkszDf~@-GAJc+M)V;|-t1=H z#Ngw+A}c&een=yu3(dR7|1E$7@;_godP4fO`}d%QMql;Rp6yPTen?OGqToL4EN(FH zExWSo`%8t&E{0*=&o;m4A3@vd+;q#zKNJHLhaF3c)j4<7ux#0@rPY)QDdibAX3q%S zU)%ZO$DOlHrFPYS1-Z$f@Z}95kr2PruaI@m!5xm-CPY||ufxna98-iVf>ho&cZv@d zyRqLX$ypq@e>X@6fQ`;!r5Y(j@9uP)eq-qv%+tC)u)~Z(#dGX_oSwo$j>;${Q0|wq z30?lC;-8s1!%d#ogO~!W%DdCO&g6W~TL|cp4mJCJsX+#Y0<#lxUn7$yQ4#z}1Vpd^ za&5e-oTQA>l>xOs6U}1%f9I*?eh(#}yaA+H6?&SOq#2Oc_u3g+nDMU7JSR=m11jK+s^FMII!HgMd? zUjk{zyN{koVe+wzeXY6YPF2-;|9C>NP;cF1k9gY0nW8u~#sM>@8V>px=1i9)zBZQe z*64+~NrSS#V9!27W8cgRo_E<0zWh&g{i;K9Tl+sN`jG-PGW#G0plvY3J`I_B#^!94 zF_BNqR=Zn?zFpGLhi4;M{Vt^SYopG(-clX{H;NU@KZJjBVB|xT?JLe+j=uD{#xS9N zBtfSuRtZSbC9HG+N7L`gSDM*VQ)Iv0aN8MYE~;t9=+R{#On4Kq^|hboUp(zt?e=j|d2MaA3v%H`E|o$r(rhVBfkv`;dU}RpMt#wV)-vZ^8O>W4&8>Xin)ZNq-L)^ zX0)9)p5k1_X#3h=hC{oeD$OMLV$6 zmZkRtSRL*WdQ^*%CvgFU9mcN0)%N;|!}j19boFLBxYym+lLnmlSyxx+YRP(D8v2%! z17CA?*su1l{FEO6ZeZat4-Ph{*caK|U){+sFaOFUCuIt>m9rjJsOwztG)-cWmJT@% zg#^@RBaI!53m0)lI@`mM`x{O7+yER(fT>@_mZb8s2JCUa#yZvhoM-q~Z^ZGeL@L3( zQj%RJ+itFX(_HY~tTOJ1|7;q$@cCE0-pf1TrtjV>!RxP`?y+(6HfE_}NNZPt#bsSdO3F zKwj&zDZ_e7;W3#lwzqmRkf{+PRBI&PgcP^G27u|No;IkT;@%vku6WK{7`Ny(5{_M4xMc$AmNK7GaLgV)RZ69?<{ z6I7j0ZWwX43J-Z4bPAU=y4SSaB_=N1u;}fRzx)yl%%IOKobTYye+JPB6k;7Qm?qJGSsSBajM z*pRK%k34QU5(j5Y{NWYdaCt<`d0s%sKfjp!3^EBYrw(VysFs)fAQE@+b2xR}%jotf z6kN3GGcexSn12sdMokuN;Ag=EKKOX6{8s$kCXfvGMp3TRCnsUj=ignVy19dU{18WS z8;dk!#cPF6Cc2$dy-aTQ1a+$-|L5ueS4X5F2?1A8K@WU`IP%O{U3pa%gsOU+T-G9=^d5n(i! ztY_HLs%B{RG&y$+6$oAV0i_P5(NKekVZKy)BYPd4*P~q|KFZ07>H$=jjx~1Yl1Iwo zBmNzNpS{LzE;DY+<~`8n;!ho^mD)`q=^k_YaBvOQ;}+#G)kh1UJ)=-AcWv`-Yye!{ zXJ5GwyAHK-u=uT^*eoGc(~-}eG_|%S0wGDtvb$%SMR}v$+;jXll;6)XpJMu`vl}&h zb5dMueJVNWiEmRf%mFDn_{x+2hKccm6XQJ^{Hni_-%>Z~xP60H-lWO&RGVnT)twdh zo|n>39wbH*G3jY$aZsKA3Zf;qdlitaBzh3HUNQHX_033327OB8S>ML0s78x+-ak}k zxc`1YEr9e%wKD!{BfV^;?0d^onqJR3>zIARVcF^mX8DReBFke%I}~-Mm7v;g+mHH5 zoU^2{w)+VC6+yR%0|67@JJr8HPIBes|n4EkmPb$0QFW?7;*rBdKEC}{rl84X7JLvS;(5$`KfvpI@Sts+jP zR{$1R4i|3^_Ix()Y-2uZlH#ac!wa#3M}N;Zo@r=lVHyhjPrhMr%gu^`y(Z_LDQ)K+ z-R5B4k=1l(5G3)l^7u=YezWiWk2F@Vw)X7}ZK9itQ@eqS-*_{U79Vq&IFADRaOqth zo#t1FHrmE&AZD;d8eN2AP)^;sxl7tK!?76#aJ7n22=4{8p_ z2m@XrJUP?EkzHAgQiDdieu14z_WcRvpc}5d^R8?U#{y{Gwbf>N{>WQJP!yttS9p50(_zTJvqP5kt5xq z_V=&p$RJBCKTOZMZo$1~-f45)9mArlG$#@4#0}a*{tcDNN=Xgcf`sRWIeQ3MWXOLh z{&+fz#xBge_Yd0a<DBf4?be~I zQym({Gn9;p=_(*2kc%@MCjwWl_b1Ip&=&8_*p$^WIe@<4*Z@Dt z$+gWyza;4700>q{4T&y-r+Dih`mWnP@$gt}1cCm}%1xP{FCZq%8tg++vp#d;h^B6L zu;<*_zLZHjx7JMDYL2)V`7%e@D$5qSw#FuDc0#wbl7CV_(G32>eLlLlw8@gN+m6{i zc!>`**l!c8!;_{Uka3yQIz1oxCe3}<^n(6tv{D&VVF9%wL|S*TEvmgG zmf`e;^@{46Z+Nx=xPCbJIxRBegU!e36fv8}q9h9EMZl#a zF1fh5=7#!y@S|{Xuxj)EM6V9`1LJyBFy-~|f#gua*l)m+#|WZ9(%^XD65QrRR`B4g z(%C}rwjpX=R)Mxo?Bl;wq)XY4{=EI5n71TNEL%BO%p3HgpT|>pxXL1v?DQ+Ejo_;? zmnV$2fZs9IK_ek0MHvzI>`4+Lli6bX8=J}rf9L>62M402#vZr0ce6yIhGae}yNa5s zQ)qE!sN`0Bz2C}4azbxsOVyzf8P;gm+4qtJ+Er3OLMqfhZGL z^nV<;-L7N|@lBXq^rxm8_BPmhAG}3L1pY~aM}PE2DS>v#UTv|Qa-V$xaTD!ec0;Jh zR0oMFaBA5}Z}CB$>Kav*>ep?wi5uePhgQh?C-y>{&a7$AoWJhr{mv4S)i0$kiw>1j z`ZrAww*cDTYRPg5yqoUss;OcAR2iPI-u(K<4}4Cdqegww zPYT%W;i+F93-?Cn-kr2HgeLD_960%0{j}U$PcrNqX2t#v#=#*yDHX2E=W)h50HW-K z#J{@6|5hF|J?v+ZDsJc8%9>+vvZl|y$y(;Hzj#>?VVFnm+%MpPT2MN{ViRNa`MF#tJm2`sl z(18HTl}7_+&j8z{E!D%5B?fyginZZRG+jJixx#%_bm=cM0;1uT+&zctls8g^tgAy%+!bqsdnT)|x?>yK1huVM9N^ z9;|+aR7IhA($MeH+~;ACu-Z4%MSD<{G+rKOPLuYM#I`Pj3uRoroKvu{z&Xdz5XAWb zAoFl%)eiz+sj1-BjQONMll(=2d=yY%XX`rtP{5E7PcNq&ifj;(2GMbdxhq<|3}obT zyG;}{h_G_*28DFF9Yo9s?y;ykfq<|C^A0um-=xk+I_2_j$E(DBY+MGUTuJqw(LV$M zot2*8CvQAgu0CbJ9@Ly{KALQG8SpMEr3-pDGz^JU&A)}ikUADp&7Epm*f8x18 zp?5pE#FPfk&Tb>rG!Dn29A+_ShuWKcc_{UZtmO_~IHugM8=;CP@vt^`F?EzTX=VOf8%CM=p ztirKNVh-N=KM5ZkBV2ed5Xo#7j=$PLUR$pwf_GU8{SKTyH}G^>4{Mi>$KUCc3hALa ze!KFF33&OrKg)gEymphb?Zd!WcCpn`Q*pM zeK7D{p(6kY4Q{98RV)W*pEzoEJnKr zR6_M0a5WH+osHGkCgx+8INMkV9cc1dwEG4z%mVrGzP#8P-y2mbB)$>cU%3s)&OW(}}M}{{AI4R2>)yNDa)NG?&}JeE@4syXau(4arY;Z{P%`-G>%lbekMWa5tt>DzkDyVZfQ zyNl)i#|}3ft2$Nxv3BiHI4B3seR_@tV9^0EH(|n`{#TZ_Q~w!9G1r^&;XQt6Np&0u zrl3YDHnJ?yh)Zw=c%%MpQwDOSB&UB-*XJVJzg{9=Ti5g8c=?Cg_kSzVGL`XJ`=jxx zNW*!YdL}q2nX4LqS ziRx6^(NqgO0jrj{{Yri(Yfup3`BE@teK|TBX;g=sN)ib(a_ne>#6w;wr0^kj`NZ6BQG?r_C7pcALcR;8QtF*Jl_RQO=+! z;^vA8#8dBe>~lsD;xq@$&*_etnq^w7ltDK>&{bW$V-JQ~oBo!>42XE;dklT4!1Qkh;qeDw?P=Un_I z-Msy1QAptr&CB? kLcUkD#`nXeDLag#>ph5wsGQmvfXeV60?O!%ixsq8^^JPpZDZnp5sb#TmDA9R^s#X6+0|PFgD?4wYEO5O7~c{gFr!++(7!z$ zv+m+o^W^*s1EG^q_i2U4oL?$-!vBVUw){&l4!zM*@9zGGLh*a8*RcgA6>-JXgbu`@ z;67*o=`DlG*9_BATYx5_2m3RgJ_B4_?M zyQVD_A$aZ8WOLCO4h#vR?mLwA9(7;Vo6ESp<{fDIi+TH0-9MZSWH$a>jbx2yQ5mGz z?0d=Abh)9Q#tB}k>1h6#g!yxFlQ`&pu;h25zY#~DaXp#IiQJ{C>3Wrc76Hj8=AfkOnD!uM4&Ar)R>{?5feWIlxh3hmK%* z{z1h%Q7?ECWHH-3NyVrv=G&l7r;4;qsjI!miN%-9`@cW`OJDJv@EyLKA_hO}Rh04f zb#khx=Jaextls*lXLQ_(Nx`Szvg~g`!n^Mh=syc>yc|BMf!KuUkw*0->~K3|!c!j{+hoZHi3O7+~n z83gh;-7Zny{<+Dx#V9lymjZQ13~TnCF@3s-9g{{}Q_;X;sL^CU|G}NEEG`dl(94~E zVijOOfE8pcQ6{{=(YoqC9h6EeDyh^zuJsC&2(rOG=cM9wYv zpyi-3FDlXs>Q%GWhH+?5dIe!}ig!KT{J(8#-BEe0UXDyEo-}7pT3&evj4De^tnx9C zFm>=JElTod8l3MI?(Ge;U-)xgH{;{CFcNyMo}JA)T!ps~8FQwS`$5a<)3A-GKY>_) zM2zumK4`qV*#B}{4M_UfEBg4(*&69nIOWQqHVIx`Gomw$9pGBQ6Y`VBQsm{pCjEwA z04j~@qEbQcOVX&q4b^HA!;izwQN-Nd_le<@Vbo9W|9y)8-<{71@IVdygl@Ru;zpmc zE-7>NLTfmVS~tZ0Y!iHv9D0YAqaZeZS+Gpzt`3S~{f6!v(=W+Zf)(PTEviKxdp>Bi zz@`x^;Rle63iu)y|3z6CM;!q%k725-HtSu3=Acsw(4jZ>6xk%X&#iEEuPkSNKW^n? zsor{9i_d;Tw|uyjum9;U#8ENG;i4n@KcT`qqz)*5qm0>Vr(~J525DnX9ei2hP-S%( z_O2YZ7~MY$kt9CNf@fYT6{e!{hTDCGjuPxUa}s{Xsb}A`eA^bl=LS9xMz46{Bbk&G zrynTzw*6N%!K!dTCN_@db3-3M9HIZwYKHgP^N3!0EZPHpDkJ!2u6&u1?s22?l>5E_ z?9Y4%N${}z@oQ)qk}{AHwvU}b`V+V;n(5csDy|{U=L&F1yDHW!`_-=Kv&f8FW*789 zPL&^a;_P(sI?N#Qg@5zS*}4&y)F$Ue*?y4BhQiGu6p-b}RR3mL<>9D(+3~PdAdS&k z;NSn0jY)lnQ-~+JxvDqR&582oam0!?D36&FaK(6Nd?IV;-!Hd0(Ny*LDBJP)KQpK> z;(A@kpc)z6;}a*-ecZR;wmaFN5L_Se)2F}qhu4SW<6(tO9hJpLYpKzmRpNdMzx&(U zbpXp*_46{sQW+GWXAG@vSz7~#vo`YambVJqV-%hiL$QzSL^L7 z2cj8JOS(b&AnDT%Ia@9Z=P$i&Z?xUxNq=6q=PR|XSh6!`9wnD_oQ)KGbt!x@FgUio zCoXKF_Z*OxH^O&orqqy7PvmaxJ@%2K&yX_2Eb^g{()$)SR&$)6z$lEwL1HJkEK#=~ zj-AvO4EpZ?BU_-?K<^Znh5fPbx$8!Atic&ED;e??bGBb&>G&A6=y&de8?jO#cHAFl zV+`D<*8$NQOemm&-(07OPCfj*#bco++Mxv%w}fMKN-u`+P^^-Q+s&9oy;qL|c7w}N z1au8?M>qsglvhE^4R#PcyQ~~8SG2?d(tq8m|At23-QHQhWk!u@cg&?cRGI!<#CN*Z zu2{gRV!%EmGghf?-Pl=<<5oj4_PpORz2+C-_)@GLPzOF}{Rp90JS_HS=!9;DY9Clb zM0#I%(Ek{zdN5Q)lbbLZJ=^z^kwLlKAw%7%%?45wM0Nk zO1opebzh^3ZV+cb4Y3HdX|W0(DR*zh$vY)U$cx)=^jH2&s?g1rb17r zU7zs%s1(k9nB-W3|^B}S}WJ^_|8_Rm&uW~;S!V109H=Gm^tQELWfRk$JrG7MhVV8 zXCx_AV)+WJC=5hLcaD^N8oZusVu!;uxT+xJ1JT#8PA5-VoZC}5v2GVKn_rqH{PrM8@TO@yKXtE623`jSEX4w~CE0~3xfA^3`cA8o+IiB~Muv$oZIyBm zeeJ>FofWZ$e<|hvT&iVue|T~-6KV`FtnRV-`S!_+XFN~t6@~IlSpCRwcs>+`c+3J3ImUSHuG1;YYGtFv*;a4ADp{vf6nB!?~ zE9)WXnrxStSfa~Ue*qeubzl^wbFt&8V5fO5!g_)fTIjJy&)FM2Gm_0OyTc3vw=8$< z9-Ic}KjbJcvsbZg*W;PV-hv`~G?mBI_-V4-lvUifMidcxi9wf7Naz4*iFoNdy1ltW+k(9;V=jp75=CAP*eW3YMLuo2X&P3Z??fM?6}8|=%Z`XonJfL}36^*1+ubY&H?0sLNG=1)7lo4v&&08)v-O1(zg z-_cMOM<7qisvgem4 z#G86}ke~667jyD0yws1{3SR3j4EUP;JT~qDuX7Z<%Uz8=Z6~EN?{(soF8qiVSDdHH zr7W#N6=E(aq;9vjd7(U?GRiph*mCySS28qA{c(E|asVINx>6mQm#L`zaVt(1J7bt6 z?5YRR@NmE7sE*6;b&3I-Jh3(ko9FoI5^07}!+k%0UR#PJ>TlT97YP2FrWH&5eCqd` zk=0jmd%xT&Kz+j1Ul}F}3ocqy`MspG7WAngZ3Q1u$0g8Ik>TaiFx4!&*@jIz^OY>< zJ=hQ-pE7A14?rL8{J2cpU^g2!Sf8JWYF7K9R3<%xIG;z9^Ztdq9b3|%l^dUqZ=mivq+Ww&ES%%-~>3PH31Q&Ho^DBl}TUWDj91PXX2M5lTQ(FF@ zYiN#E94Qb5;$J&EgKEPsVvdTLRQw7x`}U}EiwsemjD1^c*o~f5*R;@xQOuHhF?(mTLAYR}-{S+amyxvxPMGO*16M~abP#V_ z_VY+>6whH+VRSC9-l}DL*eT>mUB_J;++g9T*aAukti!=brq^{r`?@psx5iCmSB*_d zkK_y;WJp@+|MHZXn!8FxoN#q<<7$gvwX5xv^WvN9Hn<9DWFBo3*9f*lbR%) zoM6a%$?e*&{Y6cA@sD4lTyR3cf7^qO@_aF~i?xGjhc3Utsc#S3;U3A8s@`+D zYJKh5Rs0cNznm&QMu;W}8muTGJQlzb%F2+i7Wzsd@V2nZon{seI26^(ol#Ce+~x+4 z8c-JoK0vnd|8QtJ71xLRHnbeHxwv2Se8FM&PKu*@BaxS^-KU)f0GfA%y**K817f^x zN_Q-Co!_*fKWH=bE3S1fs)+2fZKgY>Jbf}ObNCLd`hWJX|5XtTAk2K8oqLy$knUTq zRBEKNRsP#=6QxI$3}>e|qIu&X&z*m8H>AJImJB^xAzpv;WJ{kY@7}E<#afjo%L0!O zU+$}g@r~f)!@o~DYdI9w*Tqsdo*=c~cW*fpK(ZwWwdYqJM*j+R0&p}rB>o= zy=mM!oI#4cS;~rsWmciaHj4{jcWRC*byjePU~o^g_A$L2RCjp68&i6g*9|v2pZ7-? zb-u=%Ei;f||C9QMwnbv9NX#avkj$o_a8DaDelrTZtpK0e7#$b-`<(4nv|PM>>v2nP zK3hrKkBu-$)O{{_)~f{`lMgR+&@FAEW`f$-IAQliJ4|R$+B^@-=FGn47wqFWh{g>hEOZUrXhXjKJzEY3UVf;eY5WynY)5i! zuZkg65zXa^UlGgqK_iAg&$<59C>Ps;dw>5kKuLF8BOPSVF6-@BD)1Rc!UKJz@uh|{xKaamcD^Tk^L2WoyTTbYytha#|{l)qq8@#MFa z$i|@ND%$Ow4X^~kXVc+8#rG}4U-rteTipsr?%u60BAX49Y*0=c#-v@%@ku^MxcS~> z*wb{owD8R>Twc9~sSL5;^|s_*y&qS6-gXTO{!`#1&<5^kNH!8ExX9PF~Vrs8>e+Che+5vAX-KjJh9}^H6(H| zlEj;P52s@sS-D9pI!FGWC>PBnvD}FK`k#t|%knt{KXv@p5-s1%m5Bex12B({;Gbk) zStP=2NFcsCtnht|Sl}VL?%=i$DRi7$@ZQx3mlqK+`7h!6pXM)*-PUS)8ij0o_vVG- z{Gi1A9)7h4)n`GHld%VQ-|{2Z``onue2=^gO6d*N5G?8s`9(u6!XoG0fhz=w=qe72 zKC5Lm-QEzFAaf2{9AxCLNLHE|Rie4~aQw^K#p}Vv>QpCkd%CjG`8p5E?2BI=A3BTK zt()oKlY8?X3#zV-h9r~)^9m7wRa%7nGBXq>IL_jN{X6*W1jH03{)tnT^2ZEy(_|H2 zUWoY|c5WJE_U^`dJTE*Sl1X)xLzkY_z`zrRUhBH7254`RJ>0MIhNhnnJk!F+$CAO; zTQ>KbP*oY1PbQ~LG3S)CVoYTfyJaon=P_+BYg?|5_-k!8HF1INfR>g+0e!DtQk9*i z3E1R(ty}SI^HCrFuilq?n_OwoI`*e0g;7oqoQu7GCfrFLlvzn<>h?_c@)NjFuS)RM z+#FZ@w^OH&Fw>&f%s}vc&%$TA{ygU3mbv8Nd=DP2-|@<>t&fbm=31%kuU&_DX%F(y zqttFZrPP+C`SH;fEJXw}0_y5~;{2WNrN2h~ey2y6)Ut!@e6Vgv_Mlld6^mxB^IRjb zCb#~Fvqv|W+PnAyhKqf0Q&UsHAXBqOIwN1Il`?t#XowHu@YIH_p3DTcy!_y7rWiKU zkJB<6*{|E{mBT5ftA=F>6p`Nzd{Ay@p+bJ6ok7ihrzB-x^QLxxX)sZJ69TPY$#3Ls z;fUm{l}%K<2MMq#RfY2EEF5d+?`QQh^?RUFqD}gJd%Q)O+A4a5zos&?6ksU_0 z@Quft2BCV$9_p(&Kv!?3Ir!56eCkbic-T~9J1wFDZ|dgc(0u-c0k`Vb0H=LWAy@Z3 zhSZ_V6?EzTc@c;x>okx!I4{fPaivr5n&A8?`_ zPq3`?p?Fp4+56g`!?dmFl`fEhoH@rufZd<;AI0+(TOD zc6$eMpM*B7ETE;Wb=evGOJfZwY<#+F} zPW%`Btz|V4S4&%+sEY!4Y%Q_VjW*cbPo_^T-%Q8msbevo!`<>gl%t{HDW+}_la8oL z6S>&N?Sj-L1WJ281s>yI=d-vyb9RKtdpgygYX{nhltkn`U`Mmh`F>4105cjh+h#CK za|eFd#RTX@bx+hq%D!U18_-;tIEv+=FgsC-xV=!{A;zVeVP$!-!s(Y=LdUYpPa0&& z?k}q5w%}d^?+2akQ4}w}u;nm^@%y&(40RWWReYF&GJt+J&BkE&=s9@ot8D;Z9Z1{c z3@hG@E}o%)O1YBTahHu$a8wKu8=MVqax(t3E2;b+Qjl_FMA2WN!BIZ z;?-4|rw)4ZDLa`wd|w|}&e^*|S!t+~#G_ru2DxQRpSiARjCt5+1nvD$s%EQ9O-VcI zarzb)hGa|G#h;ZfOUR3by`YKF?!a}Yan14ARql^ha7Uv!o_HBYVSxI^O*LU0T2?(Xiv-QBfuYqSaE>$O(S z{hqzg+4qF|hld~CJ?E&Z_bnMUYP{C4U)RZ}?qPwFyl1hTublP`YYvMQ<{laL*%5@U zqC;7pk?fy-_OCLU63&Iqy25K~n8P6J<`oUaR&crK81f2wsSc(Y6!uo*QH(!$Qd+zG z3WL~x+dP~oX(!rLaSq_*P0{V!Ocu9IgLqCokVS<2Dxnd>@_XhWEQ{H!LgCN?eC%L| z4d!i?a7tiPdfWXCThFdVCfNs~*wtIrdHZh1o;~G#d)P&PV=~~tpuvUsnmHM*5#ySD zkgmHqLHm(yh3T>|@Ec8F;>E1Di0O#3BS!`(j7Uh(F+e!)8v+_-4N4SWB0NR%_0Vd8 zoDe?i?V%3-?9W@*fpILt$*P z>*eLE4cb+txiGZ>2Ylbss4i-|lw36#ttVXF=6)C{-+!wc#L87`xxU zz>e?th;|@#Q|1qM8%graxP=L-!%odup?vlK1guiBhZ7o&!VH3I+qqvXK%GfPI}bHA z?(&`Shwrlmoy|3?$xbQ`b1*$aVGBs)>p>?-dtC*6UH1LRv194SC*9X{*e92lsP!K$ zF=zK}Xd{ic3G)pf!Lr>J2AE>mKkdn~yV7l@4<%;JiC=+Adgp7xFZ zNzSzz9dP?IoZ^sqKXcJvJ%}{#EYRGFA~E^o0&kZ4$+lVptX$i|8r^xKx-`0j0WIuY zq|wz%uF-gm6uf=ku3 zd>oxgTgtFskN(kWWXs?!I(+-udn!pP2*vn-*CM++T97JY&EVvt&td3_OyWp} z;p%=k&*zv7lzh^^kE18(i;7(n{uGh&t>1H<)2Mdrw#Pv=Hqw#gXJb1u*SAi?wTI#~ zG2=D)H(VShKOqHX6}l9I`YhhvyNI4|Ix(mDc~J@Tu$9R?E-+i5{E#Dy4niREIl$L4 zj*O;JL4?9z_?iY?OBqf19Z&OPjQTmGi>>uS{coALE+Op_EYET=Z~RNXFmk-2t#AF#gk>J?=wSi*R@d(!xqWGj^KgBopYZ=3C~$Mr%aM< zQ`kKTNZsZpgRX`NchM=!lSiv!rX)$DZRkIrv799P`@3NeeajDo0h((IkHUsQ<1w0C zQ$bwQ8B|flT#ab5`CLk8Zu;rrz1w4H*b~McW-8D!RBr=M<208cy&-pdV|+M_{4A5mT11Me!42Vu;;SYo;r#`?rIbgN5#vaF zg6?0ZZw$>rZOj#mjEm++h^Wy3JP9>(Q&8>Jz4Vyz!E$j4ufbs_M45-YB2YwQXg*S) z_qnl846s>vkmfzgx^`8K?+L;k_J*3AB&phb_YXN6nky#FP~%oD0`cro%A?ba_^btD zCqZ!(nZx}#;cA6F*?HG_-st8BYxA9vK{}MxWOZ?# zHuVLt#Q~un82q)>kkZ17 z5FJuo15Ld`I_YM!4Bp%|Ht;xwU3`SXn3igi$HMdz&9b28+!iRkuwWw1@$QQ@5<%3~ z7B1ac?0u;9POGXU~kzlpO+G|*gX`NH2pvBbN9Y{hD zi|wKC&LyG)X=ti(E%0r=)^2p#E!xZ3gM_J?`SJaBx!pIjQw=P5n>D<6-EnmW;p{LB zcdh1~0=%0Bh{7-jd+e^7{B*WGx9!T6=FUcrfgsNf7G9j$$9CkCD~RseS0H7hDt1Q3 z`DA;O30e=G`vr*Wq`e$f5Vyx8n&-jQ@<}h#IjI?suyWf5kj%AQYZ(;H=zOM2 zCXS1Q2SukaE2(^pjyB8>#@9fU5O$|w2Ojy3P-8WYn_#cp!n=1R%&EzYA15VQkTJ^i z;(21%)QFbjnPIW$TwtIw&IJpOd{Ooo^9y%eWRq_(cLSwWmo7YsePWB}o@Zs_2Le}w z{a|Z>ZIvdk!c#wNlX#!v+3N88GFd;7yg5MRQ=k7;TP_&?%FBF?CU(@?=3M7d>`0GJ zO?Gj+r9zrb6C2U=0Y;DpEhMa4inHG}rudK?gob7<1<;RW*AtiVQr&t>)!TYnp`iqa zg{XCl>zz%OcKTDfd3hymWhD1s>xak5$TZMn%CQkBA2eJ(K*8Fl?I`5_j%U;4g+^D@ zq8<6vuU|GcjEQ?or99)6O(utojlvzhkgz*?n}ijb8vI#GSYRXp6mX>=dyS6|8wnJF z`jW9q#J} ziZxvMyYs@lxerPI*192Q9Y9NLx!J?BhGm}wA#?B0AqXbmP<$!Q0SUqi)SCv*y+XJ_gOvSxIEQ_fhj}D{jQv_; zFE;rR6jgRl##i-&+*O8C0*Na3*Ywo%2)_BDKbMo0gEjh*%w4?#&ATOC2?f?8nzJP( zCVWWqJke#d<0F|!2p+-}l^$-35czU;bs=ytHKoUnE?}m7pHV_UGAV0nI;Q&>cPX5Tv|V@!Xk214)f z9~IPAh{|B#!sQm(9+(U>Upn&%()Gf^%|*83=*3#%vLK(k-bCy5GG1{Wo&bie74Qwl zo)$jl4V2A*D4Qz60qcuN&{x6Q#&jl77F=m0@DpCH5XxeaaE`vrvGBBCI7(-W6X$4g zBXtN;tU)TiB^hFt+i~XmMiwhEN<87@j#3>&r(HG#PCfsbdGPQK51l$1Z<2th4tw z8v>Q-#ilv!Ic>+%cvh0o(xW4WYQcp+kzM#YvbkoF3EwVOm+!L+rB-O0{Lee#)tv|l zvGk_kvkJnYTg%qgUUis3Wea|@NPt?=<@y_)a)a+Yv=d4QF}idFhqtN?Mw8o0ON_^&W?4%` zDpJ=)YFY1DY`Jcc3T8wt@D?|;tb!H$gFd^&?GL`3*<($b@}_*|Gwk3{zYxda2<>Xf zETP<-j4=Kspl#tSub6|`rbU3qSMKJXW>0#!#0@AgLo*1AQHCZLl+07ggF{Dh9fy0w z7c0D~1T(?}vfkUOz;^2_*fhHXm?;^0ZL7A2Eoyg9w3YAX-847|ekrx#+9%sjgCi$T zeUDG2r^sHl0W1t@C3b=_ZqC;$T51~H6Ja~Vj|Dv}OV3*Aazu-1HtfL>+nopMgw6pf zbKtmvvkI<=JjfsQx7Y?G-pT|oU?O`oze-nZQNf&0CEu-iac!LbWc^+cB`>*0rG5MT^)2#q7i@`{xGRs=un2|h-sX6^ zsb0>RJj<$Ky!)~%Ny}{eZXRxg)hJfk8+;QMrzkU$qssz@*1QyDl1W#&_?n8w4P;F` z&KxWi51B<=&`gy%>Oqj#!AK(c+*17!!}+Nj&Z`c7vKu3Rs(5*_o0J+3bN$DN!y6I< zlZHJF60xE@&LHDgJ+b%{B ztgy>LYpIQ?a8G{{dpo+)Zdk=ZZkjmSnr)aD=jiG7FDV~$!uc(nJr*o*$T52nX3mDG zdk6^a!yE2)w*oLu5I<2tx%PYh1lv1%e6IOuDT_NvZF>m<${2~YmP0Yny8H1Z z7e?lByDp;$|5#vv5~rcYB@VJ+?!8s$hwl1a2l~d=%9oHr$5js1U=JwLz`kHEA9@Tkyl3hBdGoG9Kv zHIL`rJ8X|>e$^WmrHEi+ty?^@*JsclZ{g{|dB?y!++8vMexh)*@T*>4f6m4xi3FG4 z_!20FZc{pUJ9|V4J8dAPy;LN4t;_d*p%b6XxrIc#x zN;2X|Ka~OlClyt*C`C5L28NnAWOYDV(E@sF+IW0ggH&9?jgds&lKoXbigQ^A($xf7 zM($a{)jA*Q`s6q1_^+d`J_)A)iVM9g&0$N?CKKvLc!IqPS%S?kO1;drCB}rS#r6xa zH*>`Y2&!@ATaFVse7>U>!kxF_7mK5vfppMbyS`1K;5N64rTDbHOEba8fi(dZuQ2U1 zohJ)pV{3@64U)e$I?6~6wD|E6j5(Yl`H`)mFV9DP&xExUHyUJ5&>pW+$+q}}3b|?J zebONKEa;ocxkgRgzCKVPKF6GO%2;loM8~`w@QHpU=;4?)IDy=yVfSlYHm3`NqbYSZ z8y7pHv)F(wX!D3MeW5I!i*1rxj&A4Wy%~Brf}%D{=`NNHBzqffWZ%KX_#(l+b%+GH zq!PQ8ZGI`$2{H+IJVdYtFDjU|nkyveyZJ+q87}yy@)-R%1=R-y zxutoi!{U>?$~7-zI2R=g%J%qrI0>uEAM|Rb-Ejzx>TTpM3rbNAB(FAynt~u}ckOK~ zhJ3IYhB$-Bbep%x+x4+S?zSO6*elfk_XayGXiM&Y%>wurSXRqE2_lX|`uqe3anGOg z6HxfL%zitgDEy;euM>7nQ|a(i%5VCNf#K*^Q-3j^}!AExjwP&#nC(M{(=_gSdCo#~899B^n=Nrmt+ zt)5bz`pR_I6osm3)-hD$h1#dNhMLRDFAovo+8kA+UF)aqydJA|p`3>Ri8kgi{W<-hjbD(#8rl zjm@V^luxwODr(qa8{H$u8WnlN!Z^dQwDfHWnSFnq*D^UO&{(Sa{tn`WuE-PcJXYr?)?r}kidodF}~QQ6yqb=1;SZ83dWjI zRr6MJuv+@}fQ7u~!$kOq&d(hVE}S3L`jhm}DbKWQTLGb9ojZpn1}XyD@NS zDHZ&7U7={jlmwb`RaDDi{VKE7f$)w&WdoaJ zZ~Z8~t&)K03y&}W6K(X&CPOB&snt7lipP1RMgy_|Sa4i#LSYsuKypgaX#LYJ!F?F+r?8W8jYF)#yhy6!YKkS=uJCPjAN0J_ zmzDK){z?VA#yuu(rc#T-0tpBm^5eJzVs2*ZDl5uO>)1H!lw>IQbz2?e4~ z&lRm@E;Y(csgrSMmfVE-W`J3)KF1YL70(E>`#?*tH2tLN4A*GqJktVfuTbYS_=&zJ z5KuJ#C}@pX!%2Q?9T3ihl8&>MNMn!@;YQQY6giIxILw>mVs@r7^14G!D6pruuU2giRMndu+ zd6xO3!9=htxl6;O!TNdbU){SJZZQ$+eB0Lf@V)YOB8-FD^)NQ8>{`WC9l(^YT__%9 z{AiecWEYCD3OMHM5Y8*1}aAH=`-t?VN=c zVJAO+TuI=pcvY)IwA6uYZ+7iSw^Q*dMi-%A?0~w576}?)3|xVwq;&Op7w|@h!FWd_ zWn53?u_=|@+rY72YO#co3^5(nbu)yJ0N54OgzsK$BYNgU(0=*Qh0E~{jiT&jKq9g* ztq1NKU^B3ee#=xqn$2l~H`Nb8n&=JPnRH5~$mIs@vKI5)lp=BxtfyW~6>nx?c8*Qo zkjHCO2WX&}L=#_=N?~c*%{Y>Hm2%foopvb4W~(@VDkm`X)Ns>a2Z+U$WM3e2>=Pw4 zKKFGixoFYnyJgUZ67kfDE{ST;psR)3jo#^vH`7TP4V;gQ=xH!=2et`)?cqtCO8!kZLGA|zBohbrWZv7ztE>|gTw0-cyHSy}-WwR@gM zQ*hXW;Ia-qhq^$o?Lxi0&+cj%!_{U?v%M?Z_yZpLfgT24GaO+VtyI}RDbyUIU+{H^ z6N^=tu`*Dd^cRh))ABVc$!-8*%o|(x$Cv@%`g&}K;cIfZm+ZR{>63wFG187#A>nh7Zu;M)|lBgtpi&#G~^u6 znU~X5<2mefHCvOH6&k~k`A1SstJ;YM$#P`%Rr z+Va-9Zl&0tONH39?IL9v(<^J2f+VGS+i^X|jKZ>%A~?`o5_V{v=KH#qY%!&3zqwT= zT|yBru>`L?|0;sI8r96XKoR&}q>J$;rfyp{2Cq-o_W4FFu08hE!R3a)%hFgn%0*f` zfokP578MHIh2$c?noh&7^g`Hk!>@0@UAuqPUq6=4XX5q?NL3}F<+L-XYRkUE|FzVG zab_NW6==DAB2%0~2TqWgQPlow|8arMemuOP7_g{J(&^?X9D7T1q|hzH`~1GyO)c(= zX?0pymgLB|McLqFgo36iXWSxd`ID55)xce8f0vLoJb`|4h>_bwA>kd}Be$JENEh|g zF3Jk^_!0)lb3hpr6L{56LxsohRyNRd|DEPGMf16RRx>jKJ}v$63LU z>=VE-Zp4kg6CV9(1SMcJy;3Yyf_Y#;Bw;2-bWMx$d#XaK^f!CPlUR2w?-8U^ry_pZ zUo8WLnqqV2O@g%Ww_u-1BNrF7M|S7v{neVs(x{-`H>ELwt@*u4FXON76SNolaSa}d z;UC{N?bKunoy{a@9GKf|o{pUNn2T)QXxI^*G?a%jMh1>_H{)l|ahj*vgk(_LYj&HN zHwRtO=PadALMA(V%)cc$XniUC5&lgbSoe0?F!Q$3{B!l*10dIOCeOEFpl>8dP`>IQ z9^ACUlLuzR=3_Cwp36uGudtkHwk9vdPC1J7vg>VzZs)r5X zk&mCtthEK->Jvi`XddHt-@+YX?VjDZqw^{dPNh42A;P0HbYVZZzxfzNr=>8@F3-2` z@c>^q2DUDkjA#X?pecD_>_$KNwU)eTdS#u_N&{ZG`YgYZ>zHU9OhX3s)$Ib2U#Gay zZ$&&tAeQ1F5fEA9RtuLWMyey@jka6Y8=HpqYgH~7Qsz9z-9#g%52X;@~QtN zo5=X3@U;sQ#@$Wf2t>6howKwAc9Uv%icu%s@*-Vrd{IjWYRgxf!fs+_8I3`9-S<0u zr8(qyrkxE#7+^mMe~C6RV(X#Mq}gW8;68WeH_$l9MjX3_>Z67O{#80_k7;6I)g3}v z79l+54ak2s0FgN#V<#iAh}qAg*tW+C_yRsIAU?v%e`;45lHJE_ZE0L+=Bn#KKW9G39nGG6*;M^aHQpcS4#L@Q^umRh7xvM4L z)Gt`ng-;98ze6KHn{MND6v{`A8L?Pl-)5d5J0zaJ@8r*H59{?Mm|>U5nXT*V%sAzE zZhtt0O%4&OQs?3Hmvaqz%&ggf51R0<{EQ?Vc<9>jDIy%!C0+q+H{5u3YoQ3a&Gf1w zPcp#`V(GUHhVR-Se74%dvuf@5{^bK7 zl3=eJtB~6eFcF-~Ln|<*1WTGSRDe&}M6MOW^rmvT_CY;JHck44&nIZN=qh@Bqw>a~ zjLE9qG1*OT4)j~wn-TA2rFSEn8 zOZqr|vHTk)WV+w=vcLM7bUUIm4zv@X$hhzjDAL4{zxE|HK9)?=$f^ILb_ABYPZ(-}&(6oIwI~x`uH3GCpZ(vycwrTh(?fB68qDWnV#lwfyCS z>&K5K=;DZ`)#AXFpW#_`GtD*ZkXZ4zA@4%izeXfkJq^8HnXGQe)o~|hwF85|hsrxs zC5vgzb)dt(kdUF9WDmIqOgc{Zw@;oTes}_h{^iNP|7$^|hvbp)hCPO-MgGa&i9Wq! zRHG{AV6u#aThv0A(%?{7jxChb1|M;bO^3utRg7DopBx#wujj}7n5NTDa zX=I`02T4yNnoT07kZa?<~}{C|I5y9S(uj%ME~3cjizJB#w^^NDD8kL>G%jRee` zRY&~G`x^bUR*Q;6yi zG`$2|uEe($Bu+;V^UWx*N>Pb{-I%+4Sh!nTt67U^WaMtmm1LEm^!{#LQfKJly?;iC zKNf4W!7pLodm+IhphqX_0?(}5uLR3O_pbE3l^#x=$*So4x`CgZ=KW_vm-9?fPDhND z@~kEtS;Lm*T&*Wge8lQy*5~V_oTX}3MF|;;S8Rl+JbaKsU&^)y^2L@Samsc2K1qaD zJI|7mF0P8nszmc60Ug|L|INJrUBACSu*Qm2K9nXiH_vFa_>1OHe7593EcaN+gZ(c% zlKevA_s)CinRnvLLh#6gQkjyQ$({1*TMoeSA*R(E^<2rZ|BR=9e_%V~-^Qzo$y-|} zrGp?d9izl0Ul^MsEYcG4Lu9}p;DIcsx7?6R}J@s{7Y25MxQ_PlWdDiz~_8Zw7;ZNH(U@kdPrGxf+}2L zIdpV9gxi8o1fy8E*93c{Apcy7YV7wo+n_>W!K!yfh9d*TD#uciVW+m*{PvkKtQswG zRc!n#DgsuMbNH4WgP&`>!5+XUlayMsBq&=(rBLjoo#xTSA)m6TX_AkUPSPjYYp-0* zhKmsm!KAP1=5d0CWiN!%LW$Au8NB3@h!cEv@GV;JcbGKzQ8<-aQ4e+U&~*s?^*w1YZeSa*9Q9=6&A``nq|d>uCAR=R^`s#(*d>r!ydnXz?pMUOXe8 zPuIPM*MYrF+G4)W=v8j0`JoH2$smetb~A*nPD87Lsb5R|aH#aSX54>rQ**LOx+QK8 z6X`$s;{PtT8O(T?t_mk^SP0xISy3;&5E^>vFvdwZT4X)j2!pBsLWVg?hpjqe|<;BO{hdk1gkD=5!-Ci=W- z&Z|XDxsWbYu+O@DT+Im*Z;R1D*Wf-cl!a!+wx>U)9v$FpW$2hj)qy(OXC~i7A;Lk& zxu`Kv(eyOfo5%3l-t?Y_aBDLZ6i+8A;hGnd=?Gjcb)> z%gsBs+d^3+JTWktG07S&NdaGTu6!EJ<*(h$L)*vXMz1u8NvF3=H@=oMg38=%iw+@s zHc(>zPeI&&H=MtgRZPL0KL%hElIoF={rP&Ybb$h5sdRl9aR|sWmMdN!P+u?t^(4y| z;etwsO_P_AWvPdcy4ubq&mr+IVGW$zJF)y zXJ*_m26ONx<2a+CoWzG&tGg96=RgQO?7ktq@1{vy1Ty5;( z9lt)IgXE+_BL0Uk^nYH#2R#OFawD&NXGOKG#pwF)asu8$akWOind|Xt2g>!gM z`HIh*HNML}eZQ)rraDXn>~7IE8j*Me_0_=md$bTaCQ__7^)j7SWWY6kz@ad^?KYO2 zQh<&5(&Zpe$(mWvsB7dRTJVZlAT?Ehz6%qb8vw`O4-Rrl8;O%T-L~E@t{xHc+82YS zBYc)TT-PzqwR_>#Fp92@@~1lU*7RwQm<9*$i%IQ6e#U(F=x${zTyt7)UH}|vEcmu% zU6rrK=)X6y2urG1DO{qlBu~sW(vg^CJ7m|j0+h1kTt`5t%7&)1fzrpi3FJ9MhUx`2 z#H2BIApLh(Gf$H|1hi!gH&<*z@T`aLDguAS8t@rywm4hsx3atN#Dc`-OD<};HAI%V zdXk2ECSxyUbrQRK(8An$HZw9-?4sIMjJ>#$NlP3_((Wb%HJOfD+$xaMI$Iy`Bj1Pa zS=aY&uJrZvq-E?F9Ue6|+~;^DWpZ90a_AP1s~N~O5Wj4N#71xT*qiTEpT+-5)TrNd z?rdH4>+wITzh!pi?Eg^9+3Quc;1bKLmTX2fU1Sxcbf>|%pj)MLV0*)ZD&c1^Oh#TM zIP#jiRndv1aw&Y@;=GPEPDbGUkCYt!0Z9-bHO3a9O$+T&1j~J{A)M-+@$QwpM?UK$ zGwXHke)rvnIM!sH%bKJPG&uBnE%=^(_c-(Gx)Cb~*hyRTcCcjxTB+HMZ>$&%F|8SD zw@e*r-@7R8GTuBEywu4>dH3&0)_<^WSO)Y-I$dp-KxM0H-u391-J28(Pk4vSDsH+s zJ74v_Ach~a!~Sm;^G@>lLL_ymMa!pAly@tP&}u8zTH$HmHOlzMp=iAfe6es^jh!N9 zT67KTvm@mzXwz$g1D;KHqaCvlz}d31evk83@g?VR&T{qr(LJ48*rC z3yI%!^-kikR5_Ax($IBF^72_|U5rwpZL%C9_{_Yd1);oL=7^C+YSiXnZiw~h z)52(ciW{IQ{7gTo$B>W9lel82B7!37Wv*y~^ESGn0N8`wAv4%3YQ zu5^3U9ZH&A+fKYFx*T6gn_6{V`8s+d@S5NRK=MEtGf)-bdq{A0HU+6zRO~6rvyV(= zd%AadFFs`U$1JA>gj35H#eBuzU?CSfCRHhp!O>=zJ}PtV?#I4BmE%KDyU4(xoWM=WvMrVoUIuH*|`qdAmUyQAzJ)Ds-avSC}emM`8=0n3t2a7v-MB%s4 zQZ#$Gqqwu&Uvdm5Ec!f>Pc~OaW+Vn1TdZBePKK=zK^8X0uF1BwA;J|$TefxCMek9r zZg<{jE8=mnO#sZGv#jT;_5ay^|64(UN)HE0FVKO7E459gO!k>{+YYYtO9qwYH>Q&^ z=tJb2Fb0&(w{#5C)tw!T*7)66-&x;y=v7Ng>3OY&M?K@+BbMj2HqA3Wl0S$amA=1M z*UMb(@XerT^zf1+^yz35v`bB3CQJElJNqy0mv{5wB| zD$aI5X3J2SFsmHdA*Iy~Yi?^R%X_txI#YQv&8!c3QNREqDuvFSm=`eJr)YDvuW=R?I+ZdV9L}4J^i|paCJ9cYfrdKbq3YBg;(`qdz~X@mUtLSo@qY^4GBz$ zf8>7Exfl)Edz!{yyr+Ct98$7ffh1yOA0IH)taD+$TkI<`J>rMV7Ug)nUinUq_mzSd9Ke3;n@Ik8@cQF#RH_c+$QZbisMaXld4qWcB9P2-`Iu z$nmgk99pts&Xz`FYm?{%q90t znnrFP`l*QPTy>o^UUvHOzv_YVSMyF$R#sn6uQ_macB|c)MFqlUzt@j^9xUQ==|?4h zYRniA{I#)CYI!LZa3wZ$^lVB#+9{*qH6MMeqnr5iri#=q zl+{ilRcwTQfKl{ej>M-{f9y@awBy2jk^HnT+4g7J!9!M^1JszLDeVQL{^3}Gnk}2?3A)F^}0x>w7uUMo0x?COoPua&?TB@D)LLKUTe?oVxKKfx4-nZBy8v2no zSg2$ma=}LEq_X+`wBopDJ!QG(0MJYuRl9>k6shE%W@#75TWVsMH{%)*IDj75`>q*fr@%D{m3) zH;WvfJ6pbMjRKxnNwmI@bN%IbpO9qmOR2OXM%H?^*dmG5ats6XfO1GM4K`YGw04^+ za@N$XV5q`}PfE)Wzf1_djIY__z2k{Fu{dPD8ei;w<9cOPl{VAqbI@7N$pD%$xOJzR zCCbqs^T%w&(TME6O&Aw{ZFDn88rZ>CD7rK z4u)34Sv^H0A*gQE*4Sy$vaaOQ-Mc%1{$w1@1day5MQJMdw>E4TeHIn6ZW;zvrVq#c zy-Cd}vvaV^2b!qToZU~#=2LpIR`S9_~WW^w@EH+H2O_ zKc|TS!$&l!{#QMOth%{g_m!E4E-m$#+u^Q|re( z%DMkeBM!sAq$z_;Lc<#(*8z9RX;F%{Wry=&gWgul8lAeAhn2H~FX11NaLE3JCD2ze z1ake3;pGhLHYO->i3nqh9fGO)95N#Wr(Xe+x#-3eGcR{&TJ3j1P0T zfVw8#Mi*=IpI3*Tz!f185*1-8N;;mt6I8{a#ktL`yqU%}7jtIG^45uVAdh+eyB5Lq z^nKo8@*u=SGAz7filRy{?WARVTa(92+HSR?lK79+6qnW>G0SickI)1ef^W*UI@_yh zTG9S1mVV+-S&;KGlZQ&QQo5GeM*+q@XWp=olDj%0I2WCTpW@NFb{ID zi~n)u{t4UxBB9YbnHNb$Aui2}jvVbbE*2*={H6$Pj+!0F|9AtNTKJ7m1b{@6#E6Dothdpr%r%h8-YV|6>yDgUjJWEyY&vLB`@-_Ei$yv#jdP7@VBn*4yfTtYvr?MX*v3BUwI_Z|dGxK#mLyWDw_cpM zD}taC`hCGQ5(?}{PJFvU?{@HSMAv_SsVwFh&1g>40A{ZcgDC+~0m)4h$dPkL(%IX) ziv7u`T!5dWmvGg#dF!HDXVtG1FInluMX`ej-lYAQl>N`JG)J!Syp zBaZQ=yS=G@9EoOa%oN)*f$+Ae*^eo{6bNHJlZhp*s{!hNIov-8KHfg@9+X+@i$dcc z?O-Ix25eP*jQP0+RE;&o61ZbxBfdiW`_1DLKBNLLM0nZ~gWOlr8bhW*(Jx+fVz)k% zHf*kMc=`W4ulXZ2% zW-i2Nn2wysJ9!>w^yBr+iYWzJe$@BalVh~)D$9Ks-#03-F8aTRkh8N(2}-#a6RabMD;L1VYDaU%ycXNA>u zN6x|UR}ZgcS_WQ{FHIlYnKh zUtpsChyQF%7YJ8WapPXRh(PyR+dC|Lz;mr4tNZs~`_D}qdN|%N4#b|mR4I{%CQk({ z9={E)Qzhs?{Ov?$VCq3`%jllZPDRl6PY;hdo5C|X+ui|57Faz3NORupiVP~*@ZXB% z-n}RQnEJe#bwf7Z%0>3HllV=the=;Z03Z{~sERWExEEQDJ+^t~il7L=z~7egN0uhP z)`xp!4^BT=`ifgzyI#Jdt30SanR%Hjtqo<@Ok(#^(jgPx{J#iU;X3k_U|k5)Z`S5 z^)do~sjA4yhx8xWti41coWrQmQmj=u931eFR+3wYbpV=%y^uCAIuu!OfUs`!!sD2aqANrho@68>jlE5^=7B{ok8)s>pZq2}<%cCHkC@^YMmz{qjm>kPj+k7z!M`Q(C)BQnm5&3he5*J@h(lN@ zics}E;v8Qqmzb6A>Nedmhq#PKrtCKdwLc){-{`mzCz$Hb+KT zvI1}Gc534@D>e}EFqhgS-3p0%^!SQ3-I4t3x<3OW*){tDp8uf`Q-(P-L-|KtH z-p?qF^PSzbss?tiZC%qz>s=%4PgB!T?P8;@;MJ$=si7+lxFy zSy@@U{-f!cua}w+mQRjT@0P%5(4K+LR{~Q4hF*B%8?*eQd3IX288|eaE>@webCyLc z$A4viP~|vCPqD4}{UEqc%tlZ4kGY2Ng|||MylN2H?S}>=Ga3=P1|**@1ZCjm?r4yQ zvi#neem3U$%1thp@7xH8x2qQ<(1 zg|db_c`xYXGG5!MFGOQM_G0l|`OB{p*sYbzuu27>*R_|($-(P9&r9Rz{bl&CIgdSQ z-9l)IYgE4rO|NZjpi8BCr8!vObj=4ZcFfqNf`GP9j_$gV;@;`0L>Y}U`cUl8vSyKfS39gFn4TDu%*Hr<`H zwcYu{F5f(cUDrx*g#WEw5HWv&@W=sP=WGA~O1nEW2JpG$%)eStUSs>DY$>lQa~UUl zZ65jmarTyRP552d_|L>fK}14OLK+mLlu+rM#OP39AT3=R{0zFJrBz~d_h6`W4j3?r zF<^9$F$Noh|GaPS=ktH}=<^O(wKW1Lu6kbfc1i7WKv<Gh=6yXC7nHt;U? zpk^{Llzodj8-m?iQji5Zf$%pV{$Ok=2$;KUx$-2iN5gUwZ3jG(+c69pD|Gl3FdL@N zT97AETZuzFWT91h^MZe`P+ccimN)5{5a_jcCYSK1 z;HboYNltPEgt_@=zTt|ko)R1oI8R@wy?}!6*KY0XRFI=FM_TLwo9h-R%2X?5>h7Vd zsQni#b)3^iqGo|22k`7s2i5pncK@gK<#D9TKu|vLqJHqV?4t!9bOJz5THIu1xJg}A zroxD=)+^{3pN%KYo-+UhZy{x9Npdn+Cd5kC@gCGio;q;*$k-v_Ro78WOw3V?Z4&Z- zUI0&WQ9w(W_duvCHF|AHBm8102CSZ#!~J@SaiZl!k$H=MZD7|P#4j1x5AKJH$&*(B z#k7(#i;G_6L6B16`ko{>5msm3x~+l3PzUfGqbY?Q!ZXiS^x&Y_)h}|prB=skto4N4>XTh5KdBe`%|45UJE6#Au_akX!bSdgIJPM^ z=m?7z2|Db!~HzQUMKF_G-mJJE1{RWL6$+S&wahB8;X7EPbB| z)4MWkaZ+C2;vC-(9ZqRp;6`t^o=^w@tYY4{g)JoU^1?RiAo1mO%JhIe zeB1e`9K0y-gnQRk6yqyIkqBEf6U}x4Qg&Kei2+$9Qdt2rBwbOAUpZ_%=uOs>?1e9T zWTtz4yM?)d%*KP6wd8iH0On6H+^=IF_Ul*|DJJ)Rc2JDpmmJb)^_l$HY*zMfE+6Aq z)&$pJq1DgH{gs?pZ_-pAU!1m@cxqw}L4R{Q)F2uFY_=d(r8Mfln+upB&uj%9FIryX z&nWc&iO)U(Tk0|pj&VVha_yx01w(6B!Lk0tk9*XS9o`l4hbNmp%{eZH>w)X(n2oZD zb^k>?u-re1M^W~mQ<5a`7)XiqUZ;~9z<*Y3u9qk;G*IexovhBaF>3K9zNKN`YuBHk zkjhW|iT5-DGada0%F~MGdb(&gyin?zNJpzKEkq5Sy*#lI;f0|L`W!Vvh9fOTTgsYA z20*+G^8QjZ#A&4U75OB|u=z)Vm8JE?0RKBB<1CU8NrJgfz{vh#sVk(|k^abpj10t> zT8i)ii8WN9MK(V%KLFwVT_E*@No#SS($NTG>q_fY^(%qF9fT_h>IcB89h&2{@*{C{ z=?T86bt2*LrcYq6g0yUTT0(h$5zm}Hs#?$eIY~(fp ztv>OLV|%=I@XYP+go1u3YJE-3lGFO60}hrSUB>IBd`%X8^qUU*6JG75_*(_;$GlU| z+_BktGVQ)`g|3N3?{d!xm(`YM19hkUYNuRUTLNOZ%L>fvi+rikCdjTizcT2^n!UJ3 z%iq~P{f%!5w<-wchE<+1D748xSw@^Rlkq1cOGnY{^GOd9!au0jIV2pqSMirX4mB*@ zfftR4$qts%G0k2VGWPvm&}C;mq!g+zG^|eO#}}k!8Rps!UpEs9GqO!yWsok4Pc{1HyFPaRuTM9JNbyI*{ zgVrKM)4VFDqCqIiYmllJDZf?(l!dCn4+Hf&)XN7)i{)Hfu`$w;@8Qc+)c*p~MMp|D zG38#L7zj++SZ&QXJ4p7s9TZ#j75yn0e#X(#wDeN4hgOe6kvh~H#yyag-xF(LU+jHC zA(GeMn+6eQ0$ib7rnRm{?&uL8Bdi?`l9KI&5hkn4g3=!pD!yvj_bpo$@9bG^Zk=+Z z?oc)fZ66d+6=dn|FKoX!?3YCIO1k5y0twmQ=A}HD_t#)Cr-)L;*gQU-lmtkgODc$EzJVV-M zGlB}$&;k~?OMrQp`(i|^gMK;7n4=1TUl*v2bX4uqDwiABzf~QCOvhxbJ?*uV;O2tZ zE1avUQLvCZZAXxiLBd5uz{8PEj4~&OnMEr6U$hZJQeRxdUy#wJRXxXfisI1%7Y&jG zX=!PZNA0`R@jIH7t(K+Q^3CJJ?Bha`e>C@yEwyfuPp_}8qReFNk!K!{`+&=88I(JY zPmV=SK!g3{U2>^Irux~L#E%UtHhtg9dcdaBn;;{*w88TKC^H)SoQmlN(YI9M6jkZmwQafAu20TT?%5PG>3Gi*4$PR$7Ae^63Sv*7Iz- z#KB_pus&_T9%JjzhJKMW+>^9RVD+`bZ!~hV;b0MeTx2mV_iMgkKv2;S0+EV~KhFc# z6%s@%p^rZ``b{FU<&YYv(x|-n2kMc+EXa3t0xzP#_2P!OOqJ)DGqiG_O!24{xtcj(lRu&Q zSYkroZrL|S%;lr&vcLX{-fknisep}B<4(m_yhygt>14+NMz%_1m zXx+{3mil=OSmNlm=DGSp-iOWYd|6@eCaGV3*-pP zzP-ncWNf9P8GPyEH2&PhVjp1PhWU1&4>685sG$#)xaO5U!FD*k+{At~OH-(wOZRSX zZBT`g|DD$TA-C0ELCbe1+Le_H51F#S9_6r8y6NZ2oCSg<^FKZkNOZm zk_f@vms+S#LKX!qS1tB;Q&7F{r;6}=BIt*!7gmYaEm_`aZQBG$TL-$Z5^FODXmfSn?7v5&sm`SxJ zpTR8d%%8;jUu^3)yoi@AAq|l$pcEAsrT# z#q#3Z`>S3})bLZjUhYpQc6@G0c0gLnkX9O741O{$xg+VNHt{=j8e9YWxL8QZuL)qO z4oSc8|2hQ(JKRlykG3odx#BQqf%o*ETN-eVx+(=OOLTaRV~BaR`f+0EbZ)KGk{9ZK zPgf0`PItH@k;e~FUxO7;yMs3Uay`_SM~pg;y-U9F@Hl9QD*sL2=h)e6Kws5?Jhb6z zrh>V(i-paaT$jLI`{`o_PR56AsD`je3+Tjsu9i*7z#M~llSxE1mH7ym=(AY5_-|2S z{U#xO7kU2(?TSy5kwWb~*5_`p>EjO=0YU&lCLYsp>+taGieAV>jj{x{kZph)zG!Ac zqwtaiwJ5AV87PhO?(Wl?eS~|grP^-6zJ8W!&F004OGEg!twF%v8LyQ_`Gfkh^xg>Js z8YUDKGSB`hVR#&UTd8f8tm52wK6~}e{VCV&;{(8P`^oVF;G`yC5}CC`*<8G)vER4f zwp81szKh<=GN~TE3a;pR{=t2|HO737VkvwH`&b+UmiE)*Vmw5XU9t{?-$i zAqH72xLs|ClS9QHPAW=rZ-S|Xn1SmN`| z)dO9PuX^W%#JP7@f$)he@NSQGxY1-f-SG^5hUgt@W@!HHj~{8 zALL)-7C5FNsmT^1F%Z#3t@9;45tWw$F{JVO<|Y)HIE^j8Il%Ru3S_)3otF%u)6+Fn zwojl{*RsC3Mom_MmXdwqv9>(-B>5A`DqyoLtBpvlAJHkBwFnG(%Lf*)nHpF~kcSpN zXsk&|Z?Ob!{~FhPKoljCs6n-We256jS~KuV+a?<3wpHuK5c!LyvGn6H}@J zPsTna^qW{Vp+q|BkS{3>jYhX4p)x81gR}6G9RIXk9goQjL@ZLx5IUAytf#5G}{6>Ay zbcAzXG>gXiw3>Os*m!Tn(qFx?NbRjD6^Z7ag&Xt+?bKZ1Od^0mP1C1^^bxfdXbB2AVH&$B0 zLXup+*_w%(Sw2ck1*eIU>wCN@(kGTDB-9gbo}xmBMM*d=I=s(&2B%54K_x%VV8k%X z-eM7y9QH$1=!X_>i^&DoHmDq-aN}{(Xfez+DY-Q<9VE}})56BOhJUQA36m(?> zYyU0S`M+bJZ!;HIo0n=`D+E6j7>|}e9w*27LuEo9O>t~DtP5xFzu$(`Yqzej0KXxr zgH#zB3?OPfp7M2uSpLf8k~9lr(jHX41xDGQLT~59$~{gmsISRdTJ>r~IRVsvrfMu0 zX9RTJL8I&HS`w-Q`s1W(Vw>yffgpLLO+!+$nxS_8riuhCMNWcs$dN<%0$7-Fr= zwax0GZPXo~nF;fH)VuZid-U`u(x>VG6bysTRN=^`yU|*IFWlcn#BSK<#3OszC2$|f zt}dqwLYs~>NRHk>n^Z~0#> z7p(6oh3~t5?lmDjLF99#H#+z^qDBQ|gKWx2WYzTYzOxVL-!XeR4lSF zob)~orNCV+?+H>L`5EMvi@;?Bs$0>H0<9OKHWyy)wCi`H2kd;s;!$~)p2U1;`e1`p ztAUz_sN9k$=L51Hd$%{|w8EdfzyD{K-!hzyDfuU*_6(Vk4_xMtcwHBwacrTgXO^AP zmArU;>91-6neRwf_2dwU%Lm4SAO?wfDS ze~#*5?zVPLZ(f--X8+T~{#HX}wi|zNt%UTEoBC4GcHUkh3uS22b4rjQR?z!uQR9Zd zT_v9XKI1l|UgW(22$EFbm@#&XxCF_;_GHk;2p~I?NV{D9$D?*2w$E_;Cu%e#W2JZO zfBd4Bb?I!(*O8CFdsVq|-294p@Wi;LAtH39?-F0WO7aK0^OM{l@%i)r{f{c-Pg|I| zy30+F0_B1?1P+oSz=5~cq)ZF#&b4|@t&k%Vlm37c|8H<_V7S1lbnhOJM>nwT#r`P= z&uLpxt_^Wm*05wUws7UYOypbH>tUB5-WJh_ytu5S1AnG;4|GOUKacmOHx1GdB!oPzJ`!c)M4oZtH-`T3? zv+fs{CjF&6;mu0kp?)eL+<)IN&#ZrSqWo2~h-&m}LBXSt|A~sq&mL)3Ghk&*;wgUO zGW8OOqM6;xFx&1I{{SVl=sZ*6S046r}58e(+jMAR`0oS zO7J!#+dvBgk;#Pt8CI2uHbs}T&fCBB7a13PD`gJH??IPF25W}>yjYo5Bv_Y!K24*S zB(6$i`Fm_6*>lICuPlcA)))NWEE9%cwr?fvYp@#ZY&c6kkqBi8d91v3WR!YFaBK?-6&?5Usn zu%ae-m3#I;gkMt;gRH>8{{qIJEa)#WrVf{=A_E6EUMZ`sf?sFfb>BgZFlp|0yKjJ= z>9=+))GiCH}|j*KlE9= zZCcQ5m-A4|u=Z=Lz)s#wdhlOqC^@N0KwX=$kj}A)+^K9LLQN?5Sh?4LWYqiN|0hzK zn)FZ$*r|5ZQLdewDXWixS)>e9)&JGqAE%RAQwM!{e}9%|h;hhK;5f#RvJ zcLWYf(O12H9~d#NH!n2yQjyeKkQYxm;uXYp?a!EHdbRkituHc#{44Os_do0T*_ari zgf9TIup&kE`AEf(FB^@oJ*P>dG=M9KG#U{*iD79%53}C?SNnQhis!WV{z?=+xhuI( zCfg}@h59piew(Z);YAg+%PYx3Xgbp>jict=--W!0(-3S#fOX5Qt@S$s7r!pZe|XeE zU^2G7W6?N*ZU}54e!ufO$VOdUDbc}y@Ol!Ti1aDC1a^C|57RWa%bJXj()qixybb<1 zZa^nK>v&^cDS89myOOmwQEpt79Vh8B{SoNn>A4X9J8jN3Usy2qK+|qk zI`zCckDXoXC;aDyXtkw3|FLT2pSO1|uqsb*6n8@}DKz=!eX&3sf6VKR<5Q5$FDyS6 z--?Ol{Ib3OWb5ZE$4|dCB;Gt9?FI-es0~fsjtO@OAysN{HjH~be8ihr_MNI0({D1K z>@g->=lq*n#Qdvo#&L}yF6nS7&rph=`(PKYZdy8%9=*oW=(0T@Dsb8y=HgR3->n^Mq z-Y!#pG#=mGd2J&<3s5Gx3>?;KKLip!acT^hi=aRKjfPljRyEu^?hW*2aDhY(SGBE9 z46UJ#Y>ui|SRgVs&#skw&wR|$Cwn6%#)a4(nKKnbmHm-k`(XW>VQK~%KS(Zp_X9Ux7S~Qcu%PQ$enDgaI$XrajVR`b?P|()eayLOR_%cdMQi1xBfdXs z{F@Syddc`w5ye;U@WP&rg_@-D`A=X1gqI+pRks%e@>LApuMd|mTqyODO(2y`-zvwn z;DyWc_j0*kn!&uI7vNdEKL3fd4-}rNfmKvg(3?KfI`oH$Hqc%$K<+S?U8xPq{(NpC7$vq%b#BdSAbWCNS2{j%2?61L52=i+4=voiGy8la8LsSWR87( zD4hh=2BeMrhvdPW$7Ze(e%dT*(aJ^HhAa5tq3R%uExL1c|IH(R@^^h+k7;(wQnl%6 z;h@z`ZVwK(7`c;ti7pRz$xr_~pq$j=z1g!xs#VZfds5@f>Kz&y`bw@WP(Sm{e?tbq z{4waIBmN(h*F5)sIYQ)69U-^`b$*zYCN(;6iRLDc$nb@i*NujbjEFX|7`lE+ zG8mNDeyC#J3tpHZY_O}*ilNi`KSak(=mvJZ^r?(Bw_W=2{(`rjdt*itNxe~a#+NGY z|0geZA>lIuR6^q`l(BhbUc-=2tc;2~I2$SWO>DPsXI1Pv>wJ$?@&Yeg(5yR4^~il* zT?aXG%b9;WeZ zmh@qO`e;KLZ_E|Mezt2yV}cnsfkSL&dgAUsQ-@EtfkcTr+9E8Vp*Wh&XU<$IYreh( zT?vbFN382!5ag)*$6Ek4pP6jjq1<0sX;5u1sm=aTLIgXrI7BrI2X}XuM&0{#a?~70 zEr(^#^3Fy`cK~lHPksa2hyYu(mxnRb5pbqOQ^e73R}rn`^75H2wUm9Zw^LZG`*XA= z|5p-*Ih=ui_o^!2u|YbiF9q!3Zux*V)q*;cKIpP{PdDt}#M#_6-g{wcklwp;agCYX zgjKN9G-C`mBqmqNZCFTj)1n`;GR%|5GPkq9N9+W|;M3k~kehfMD1%QRRY#^VntOuh zQz}iY4|Dc-*rU%((xhh57?3fCz+1LlL3+`wLQjV==hxnw@}G`wE00{^c#r~Vz6B-F zdg5oGPY5pVLYrp3G^HD@E+uQPKH-8Toxkh>=C78o!h54c7zs2Z%G7OYlfr%CnAh6L(n9bM z;y?YTb<8iPj5jOcSDSdhzk09#<2|iNPwHwKvPlaKndnwbp(Tj)8p#OG%Nc|*fy9YA zjKc7ut$c4L&G44o!rW~g+p6>g7yaqiW+!Hy85RJ{TDaO4((a}#8U4e~1Ys0Xntlra z@~SU2cX=UE1yWCIN|k`xYmCrX8@jQ$`RT*W%859oE2V5~HLAEVRYDE5r)?w@OP3E( zS-UK{|8farcJVb^s3+Q>WiJ34;%_c-jDT&Ft&PvQaOJe3B4Z!JOB@HSBDo()PZ}6s zxtUU{2Cl{_gZ(cYVV;K2`gvH!gT$!)R<#wi(+;ooWXUw{qJ^G`zBMYYO19t$_NL7j z*kj9-(Z0bv^2?Q~B$RYv?W144fL^ZIq>@p&F$4A3;tg|wgGZZ|lEQ6Z2Clhi}!^On7 zpWA9sF?jN$6G0I{wIzkhYow ziMm`yVA!&nu!xm)DxYO^OfpX~R}>9-{>k8GUE zBs}0;E0sdrQsJUIcseNuPM=KJ(32b^_r1ZO<*zLYuj%xZX?7oX97I$iVELI|dr@oRa=`{m}F5!H@=c%xf;5FYd zyk8wo2se@V8kn5E``xyq{%AURaYzf7#xil2@OCoo_*u-nX_U{3FluBl*k?$cmGb^E zyQLfu(maLBv18~kQd?0X^2En2QbL~YKW)zb zB-(vbDvLm6)GrmL>1Ag%_1$Fy)aDZe)?EV5$&2XOi1u~k+H)t(dFqI+eCfy+`bIrwMR`DnwIe6Cl{KNL20QBh455^+z0cD42 zP?K3h=UTs0Egw1hVrO2s~KT#Okd@gQ5MalzzC~{-C4-rvOMs zVbWBypow+mgcp8fR^58Fo4z}7@g{8@xnC+dPec#h-&s@W;h53!k`-fAjyn$vLoOxz z%1jiui?d`;T%}*x^ zEjH95k6i~1?f^Kkf(YybcvXJ*v~4F;xOSAxJ1>k)>z)qMtiPJxlD|j0pe#$*FIwr8 z*`G)9t;LPNl=c}We>@Rb5jZU6HE0a8-Y^G&- zwZSOUq{aNeHwq9s%gSP;V+Ln^qh?@?5<+Uc_tojSrY??@5jIDqrr-k-jRZ%pZ*gq9 z&SO$TjzT**v}>z(S>Gp(^lt9}oHN%sup!Z+4U*A;oV-?vbn6W4>jKuB4S4v{xt1il zY1?!rJ(*#9dh&A81c_OWay9NW=sV#0m+rz}WStGw*&#f;rw+XReBsdrc8hp1q&Uu>t=FE^8SskUpHli<1Cp#^nbV)niff zqsvV+1V+o~y>qsE8>o!QA4w}#~maE$YqfuvP zdPmTNTP*-$&`Bp7A>{u6W!pO=TE=Y;`&hc&(k&t9cTqNX-w2zCFh~(Wnco!JnmUHt zEeV^wj(ZJ?j`0)<$wa}TB~yf#bPc;!9S@`S<6ADfOK4X|Uj^7ix1q(|)at*l zxR7cY8Xa@Ns@Vx0njA}-HpV&oFgw(I8LAXXR`_50?4QWSU^l2vW5$=%E?)Gu94)a) z5fzx$;^*`uy)U|{^jslRZnCRkmMVoPEio4O8l1(D;0`EEF;50^9zJ)peH@(ZWu8*E zc>b0RHR05M*8%5E74~OYNk!N>H>b}dFHw9ARQr7Ux}Sq@q)6{LPcAQd7n=G^1S&sF z8m1={EZEvq-gY(4!8B|?Qxo5vMSJHgd<92*l_yv%U8(PrO6caz!tIO7nU0tmJYCNT zgGD(~p^)cC5^ve`pwT{#fKzPl^A{fLa+IZnSo=Oh9PGZ=g3uYd{Up+&m)JUSnqH94 zbxbEOH&LGhvuuzIS)2#C!EOrhQ<5eMFW10nKe7~A71q?(B z_s|XVevIG=_3&Q<(YReZl|#fj zTvc-}l?yNalu{c>o*(3KFwM)G=~m0IPh-)N&9yBmjkonI5#&k%=?=^K0koMRA6u;` zXJnzYHo5sL2{ARdeWWT1zR_1`jvDkj7`V(AIzYSrC9cp{tBI-w;7jI;re0L#hyCL>YgPISJG(!UE zZh~BR1C()5SgI!^#2~F4yjd12>E;)dgXn;)eRvjYUsFwm2j51E1@GSX-=l5mpw9<9 z1xzaTb}isNt4WP0T7LO0R<`vC`FPxFpE+c=|9R=gBW!_xRQ}^cs?NPPdREow1#Xo+QFoF2Cc+2f*4Jx5llb=(Vo4~| zgyGYXH1+SQ#`%ZB9O9gvRJJ6=q%G{!~i22@M+ z&kQ^lN({wa?GjMs!Kzv8R$RB-V_Z&~^VX7a&uXg{y<(MOqUv%BX{RMJ@TrG#Bk8 z?u`UW^i}DGO`oVshnN4;-H;42rY1zKT#G!k@AG6P-=o4%Gsf-froxL`_uZ0Xj_#_s zOV7{&+~mAXQT+{7obun!t>XNSoSXlH+9U-$P8u!N1VHSrQn$Or$3jnyM}RNml;(2} zg^?pppNVY~=x*O1B+TY;%q^_o)8u}ShND4(ZRPOXVearqtMxxF7ULr{QWQv5Cu4Ea zaa1{}JJXitZyYo@-`u`B~efdkhX}ohl|a6o0u-AoE=RnOGN5c zBig1B5nUQbxfxrm>83M{^6etEw`}%0P4|P=?k!`lLYWXR_S3_UEnlKo78C7mnA2LTRhgS!Px^!T_oTt)MPLT+vB&6 zAyT2_y;_=jG%tu7_KIb_ZTM@RPST<>8OYMZtg=dr_U1(&gUjQAhV{f`oP`gIB}ZrR z*5!1xx^e%l_U_32ygD6a!B@A4;%r)mGHD{l;96a41zD@%M5`?>DR@LsWpVE**@NGw8$>VXRV$mX|eBH|2`R!dbNb;S|(ErMHXOSL#pHXWFhWl5KOR+nTu!Rae5OI77dY_JE33^8M?c1a4?sh!fs|}r_X>dH(I=siwYKT+p(7P*~lNl}7 z>IRNnVzQHs6+I3U!D^;vt42$n!7Yz1U8~fW4MoG8A%`-|oyK*cf58${4TwPZmG2As z%Dv|iR2=Dg(0Z@vh7w8ZNft0dqSP@8Sl)MN{9dHuBhN zXLG_a*Nc1PzYpWA*NhBLRGZSZ6u({>o_rv)aR^lsE{wzS(fq~@#FN-Ga{^e-eg-5Heu_!QY7niXi$$uiY*JS1UO z8(NoVL0$W&D(=_I4-1hFN5f2r+UVr7joAA-!tjE+AiO!Y3MYQivyqU{1>=URHCKK` zR6UGsvl<&@Q0Yt(#cqP$)`-HR1Qz#w$$)RpDrBE=<^oCw_O%K4BX^k_*t#Vg2Fa@Z zAZJTt@SU97nBgV!6m1|&z2sqYa%HUSpHk;(t+cnXk;fL>@(3fJ5*3j@_cgd%5%W#Q zMu#```NWkt4y=1gN-oW!S%H>~X6!R_z48&;*YWXOwhQhZIaV%u5EIVLanlBY%W66T zWXpIaR~Jv`bMQC9#JU${d4r>jxn0XFV>A8J8_Zr20{v;nmqeB8+8Ny#dFVjpN~5Jj z|7k74Nb7afqphA!jpnz-u^jYO)OQPur7(?HNo=L;)xC}FMXs5V8>5R4v3Gin^tNh4 z4*Qb**`G!+qUqyD#+R20 z6@Dm~YRHB$%5Jw`TCxaOMP~cgGp&I$KtY7}tZNCr>&vF|e1l@WiH)|=l21f)oSrQ$ zuilt2aiqIYYYQbv<{Wqf%CvA!datFPg>=zV`Va1+}kIWk#IZ1A`6oE=6`h#;P0!1Xx2iq5yJe6_G2M4A8us4W$6$_=XnCYa%}jirczkxNW@U zz_;9x{b4cDc;C_>x$EbTcY zG9|3cFx#bCl<3)PzuQxCDiOX&qcqPmjFq~?BKj~t%zS;JdqVFK7pgB{bDzK2@#&YX;G zhYcZ=j&Q{Z+Z#wk`Q9GZjWIhUSqu$}P+Fsxo@hYm(M8+t>)7PMHvlau((}}IvUJ>Q zk=;a+zV^J(9q}w?*Y*U;uMBh5@}4lIGbbolz^}KsHz^P`@OI=a_+-kaGeKi%^4AU- zFFJ&sfdeW5?wHXycO;|7-W%?BuaHNLb}7Cj z``au{*EsXal2w?U)W#An@;b&M6|oLN{f!7H?c4AJz3)p&iXq*uVQUKNwk#{QH*FPC zi*4uC*X}uo#D8|spi1D=9I8dp3k^}d%3xy@Xp|T*Vz_EaZ`qkNBI9=%GW(NMYhZGV zs%r0en{R?-YtEC?U&czXNTQUC4Fy2$ru~tzb1q`Tf)AUl>-*2vuomjxpAnt;YI|}^ z`c4d6>*QhsSM8x5bdau`2y=mG1qB|*BYnl-pj0;kF4-z9%g#mPRy$yT;Yc ztav|(M%nh+96W1;3%?bnU)Ifs4Ox4zlvTET;;Ni3=-FuWdwfeE`}JP@1hon{OB9M>n=cKMvSd7cFmEgw50iiC6p- zGCOiCJEB+CJT^5ca9^t4?WaV4Q2n~&(hH$4&N!7Hp=%l?+}vcY=a}}R;q`R)86?wv z7@pG-*SUZU9Jj$CJG-~q%&czQUq3Y%vWN&Y-WEnyaiB>wc+nuXSg<@Gj_Q< zpmQbvGE|&4_;$(Yl)%eB`R1((!)@)AK7$JqYD(7cv^%6vKffXT4hE^8OTvje)!2z7HW^8=yY zr2#r7VX<4OP9(h6dU3aKb6Yt+ z#>R~gjF2>31A`F0T6b@)1TWnZ+;5KsGs@}Q9%nm|`||5O^2mSYdbSY>&D$APwTAKZ?C;MFI@kOC;FbC)ogu zka2bwK=*&X*{(>&K5D<$`~Z25b}~FnYNGp8kb*5A?NLr<<&{#V#g5Dn5)jkrfy=lh$-wc%yhe1x|A~HH4f9+J2q^ew)fspZ0D)dO_oE0t!gVXos2$4>c z{>c2+?CT3}g=;AtHB8xCQ$)=P>lZx2hv`BmQ46vDH$q*%ZWOU%rMqk98NVkCG@3P0 ztyNyO0~sD^x)S@~ilbe{FZRz@-=~W-)?u8VhjLC=T#jSe|2J&l)jiRNS9F*HKpvjA zTWcCeK7nGaUfnK}vXZf!+_7%zq_NoP%E*xW{DVeOGdR2A$3HD+O{7DQdz9~+6`IGY z|37Vz;we@K!YClDh>y~pg89XYW7fi@`9b?S#7@F^PyBzl!6~HqUUMm@rb$I z^>%p4z3I8-H`8_{_QuY@1bdRz?VH)V5~jyY%k)R?SNq#18@xZ|7zuM2tymurcn((2 zHkjm#A=b8bG-My&xbvVEn^Y9ryxiSs*!$?XR=KBGbl5ECitk5sTf6J~dFY3lC)vqn zk%B(~zLC-y$)_@xYfFn*FcuXO^K`>99pVC6-Z#U&@0R#Qf6*Ar59;c(s-6X#`G(gY ztgeVn5Dy5R{zVMiyHWo%D^7RMo`KIZ9QP#4>$)O^`yxXRykMuNE@yZz3#9g1dL{;T zFvrAp^{X^{e>zGu1H0}ZpT8}biw$^Z33oe`cp6)kLRlkEh%X?Uo`LFDFKuTh?kuGH z1UsuVwBBffoJ!4)2F&TSZEfo$S^rgB`p@n7rf^9{R#r&?Gn#rGU-V^eG80M*g58+p zw0**3?aXB?;-%irE|Jz;bC-HtOvn8{YDKX?ft|&k6MXcioQ*ZrpBxT?4Fa9h#xJxd z9joVlF!Y^I!ZSsvXsl1Q{E13W`)O3WaY_ZAA>(A^dRLDyU$3H+f33vI#v{<6`#tqHig$;G zQ`Ls)%4`1)C9yZ9x#yhOZ*GSIQ0apXY^^{vUKtdvIdX8d`GHyBu9a^T7Ivwr^MVoe zqlF+#U3)oZr8eV-E6#HYr4N0ufN_YK#KR>UB%A&UImB#_bNQTna?zXIm~41#z4Ks; zUpoKv?iyIYm`%dYJ}1ZNs~N|e$r-L!Pw6l zjY$?6-~E3`6J0mIy#-BfB;V91D>@&y^~Yge># zy0l+N+t>r}um(F;S*zFaTwP664$Huf9VAvy0DoGY7;4YzwJgB8>8(GHf<_Y-5+DQ1 z{_+BRpZDUO>@)#HBJ>kmaPU>s#Wu-9WEQi#6}T!c-`h8GQiSh0Z2Zz}n&g|H=PVH& zdye|^7|+w$5gZus`}(8q$h?YM;v)H>=NxwEIshyJ0bRx9B;i9S196e?c?pP87 z#wg%~Sb$HS=dHzQLH{4pLPPO4NsP=LR}5U%LPoYFYIeoyDQBDEU1piv@U}?LPi;Gw z+b?v6fp0q<0=k`?EkJhHLY5rt4F{J}WamT~zO&N)(}}nx;H}96&tR;tp^p>P8>~AD z7dkzGZK_(dd=dOD+OGz$Q+A{0a!kb3Zo3o`cPsXeO5jec#QlfK$C@J>JBuUrl?;Zs zj9gRgB(G~@2j~49%%Z$z9=v26`L}p#KBesTMVi)6T-Ju<8LApAmIhEhF>IwGv z#PEGJ;4IVhyz#SYZR1G}hLqqciKWzy`BMg0*nPjp{Jg?`UCmz#dN2P6z-aE@{&Tst zZE|UVD#!Tme~gd*4~&w$`K@&la&lbWMeTWvfl9j0u(Hb^gTaTp+|W@q)yGVQoXj_^ zDzw$f6z!ch=E_m`-6_xKx=}u+GyuH904)T2CA5s;>t2gr3ZooDy z>#eWot$ERXZOm`PzN%sh^qQY~!;!JCbI~4UatgR~%WK}W>Y0%oT7mlrn>|Z&Bh+!C zb^3vmS^Lw+E_a=rO0+9j_61IVajr4DDy3=2{K_SC!FKR=Q-#Y@Ww8n zdl4J5eK|1W!~Ob*KDo?}vT0|MO>DH`M40#mX(b8y@gIb{brt@vy=}uEt={Y8JQ3Rb z*GWQ26>IEB^939vaKjm=Q(Hwes;+#>y~QR6^0WM2fBz9RX7dfJdcx z$;=|R2Zc+b*PoTVc0kx?WH@GTyk$HwUw>(d(}pL#sQM5tPVg=>8g@4GR=|yf^tu?u z@jRhKi)d|l8@vhc)*(+EcD7$V72_cpNADyUw>Ww_|N}+fBoMtmp^`d zUN1l2-aS}e&%|}1;ldB!ttaYFPu$G%+kQjZ7eANDEN6G5-*3<1i~m-;AScFaa@bvQ zyGN=b``s#+V)NlxA6pv~X^cKXR`8Jpaq=@Ed-MSYPfxtY6vX@qGELg@$^8 z7Rgmb;sV=Uaw@|v#aW2&yuYCNn}li7*K0Bw4*yl}+cJJ+c8{?-xOVf7XX^9bvh15< z_eOux(esD$w=Qqn+HUan<2L$AN8#qHuZ&%Tp&X0D-5gpUXO@geCx;UHI$( literal 0 HcmV?d00001 diff --git a/docs/images/platform/pki/ca-install-intermediate-opt.png b/docs/images/platform/pki/ca-install-intermediate-opt.png new file mode 100644 index 0000000000000000000000000000000000000000..2bdcbf306936abf17f9c7d4fbb46d8e8e99856ba GIT binary patch literal 632376 zcmbTd1y~%*+BHf-a1R8x;O-1A!2>}82`<5Pa0pHa8r&fa5+q1)7%aHE``|D*g9exU z!`}OR=lth>_jzvaF!M}P-PP4yUGvs@*IM;OO+_9HofI7b0Rii^f{Z!>0@^VG0T3YS3v^2Gvvx9}TojC%6!k45J6g7=q!cV`w9lWxUXsGFbF(@#8 zO2pMgK-#5dd5MOr7{-h`m(=}2AA^QQThsN0OuHPO2q7C=c(X&StfT=E2H@Q?Qbc-~Q`0U+I-cWu1jLX9g-Hk0@bE2o5b6YS(CF~DpZ`7*LwM!xFp4B{urHD`Kj1U0s|60|8PAzRtca_uiX;7+Z$Ia z@fq}4g~rh=^ajt#zvzNFcl<0=3gcy&t2-FA`=}zQHe5X&hn}6~9dw~>x!g-9Syo#F zD?9$+ip?FO-H=hOkR-+BZ;ww`FfV95>w1}L@;#g%mBg&KSRdy`na-Vso z#G5O{Xga6ZDnnUxU__063MwHhOc&F;N%0IO-_+6Za;d|-zYh|#{mMrpCdV7KC+!?x9w+%U?k)15+msu#Bp>GI zHc|J35TSg7mX?;0!S|&Af?zr(LXp#ir4SK9jW_~F7POzfVMBaq2Zu2B6U*2$;WmU+ z1f>rcV5&swMvf<8IoVm)sYZA09pCR1pWsvs^wkp1?|4gvIveh$q&kkk>E{K@bt zogfNFfbA-BJtE~3q#Y#AcIqpHke8?(((l5McO^q&Nz4$1q~7$Ap?~W5roi+>F=T=o zk1mu@y7=4kLV_Pb?yqXbjCTZGv41{wdxi7O-U`7B!#4mg^{H*gO@)vsg+&LOAVGA< zc8B%x(|QDspxO2pj{H6d_Mb=FXIDikp8BETyhM0O>)M4{DVvH)h9>_!?w!nMHrenv z=RDFPdEGd7C}EDI;ma&;K}@X9wmB0~?)Fq-Oq^X)si<7Erd0PH3!1F{o2+XUDJ_9u!tg++RRr8*JjphH%J{V zoeb(J7jY?LX4@B5n~&E#I1EELI~=;H+OpbLx-Qox@cN!ff2MsI8>@her}=yU?G~*7 zO#sa|$T){|JaXq1CgbUs>#p-Iu`bPZHxo{$)I60cYR|Zw*Ccr_^3c`Ac4>CGcPYNU z0WdTsSSAERH=*dKFHg;#1+IBz15K2THR73^2ZRU22XqDy2SiwsY*fy_GpL(SxlQTr zdG2ZKF}_F(&p?+CF0Xp?UGe+t&HMq|_c=elvM9M_+634%?7f}d|4}{_X0v5u$6p3f zuVJa#u(_NHnX=x)-do$7-?N>*EH-+3G}~sIYWvLUm>-?r-8Ox8C;KHIJ}Iatw=@Tq zZIE|vv(CrPCzM8#MxTblFT#&f!v{{UF{wEP{{X94Gw+}-rH^D=j?YfUj2%t1z8TNz zNTW%uvQWHF1Zjxds7_x@6Iv133Rta-Kjd_dp^f!V%@a1jbYw0P4ki$g_raV^3AIoll#(}?Qv$V= ziwO%JD;q1}N!Lp2j9qEo9Fj@4CA$cn#(8-cj5EQr>8;_ddqM~ydBoEQ;fUVkcS=-) zNXgU5b)}A)Z;Ia(!!!j-jBSbbUH4h`_W>1A#ZhAxjmoop2Yi>-Io8vYhx6)oI<*b8 zZnaD9u8mxcN$$h$N$ov?0_j-7WKv zC5>6PJeLWFSz`KPW|Z=x55K_YL%$Y}<|R5!LO%3ll871h80wcB7@|9be5|@0T}G#( zr7Bac8Ra#?H)=UDToF%x!5ZlH=^Qe;thzqCa~TI~H|!AKkGVp*Cc6EIZ1t?`**j!W zEI#Zv7$q3wn9gXr1g-#LGIG);?kh_9tj>)oXJqL`spKGi)bBxZ!I~lB7}eMbK{X>m zmLWrnd}k+Y)jByk!)w&(_$|zLuY+W}K8N8~J5|$KXbt;O?&3BGR*8iZ@=MtGPlZ~w z?wpUun6Q~bxq+2GDqmODR8no+Z76OKoJ?+{bQvj)DdRGL>DKX0@h=&$htX22Jyjgy zmDJx(EHx0ioNXC?EfC?fT`s!*an^7a!(f`Q5r4_(zZv3E+#t=Io(N2&E$)y`R+gm*6~X)C$22PfyV0rf1ZN*r~L zPQPvPvnsIiXx;ss@H5{XxGY}RtRdVZ;@~{Eez_C+lO~Dg^?37iX7R^|un`?Gu_fN$@l|oS8Ekvao{Ioh0bzi}rJd@^{CCaZZ(z&G zA!TLr$g1_KOVGAMi~6B{iwlNzgik~cO-YV<@$L+kUaMxl)^gElvCUk59dNidX5o6l z;qZ9rZL5aAW&a4L1crZ0E31{3MvbT2wf*AZ;?n44*P-?A;AujRX1e_JI=U#a*rZcO1 z?rPHoQtPO0Wi<`I$qz1G)j9Op-}gQGPHHtrXL|76880&Ugmv5$_or?q^Cp7}e4Vksqz?hNVtX5y+i{O!nY$8r0^d{GqjA_5Es@cs1EzvUa)`2F7&+xgf zMyQhfMma|-!2PE?z~E!!vUBIXob7C6*`$E4eP-jP|NaDU1ZMluVrlm$nakxvbDnqj z?cMD?P8DU7XX>rv)%a=eTyMAPRA!>Yw72d(Xxae_U8}pu{`X-pB_03#Xi@!T&56(qPToZ|B z<3+|uqwi71N*$Igrr3S#z44Xl31fyTf7aKmh1M?LT{6R~7r$%PLDO|JN7*Y>F=jE5 zVGYj@=U6^{LodjGdhAYxF!c<x19JD1$5#L3m67(*GtRIY`qm`N7W zD(;W1!6$0xNFQAJ!!M935)#xI-B&Apecw6mq$oAZ>!=R|7EIc-OPKql{8n1|4VL_R z?r>pL$BOkv&o_V!j$o6`wO?B(Dj1NITf&cd${t5c_^j}A#9e+do*EX^t zd>_Iq4e8gf;olmj&gSO!E>;e%CxteTwa^?DbX*V+2TTi-U_s9G#k)TGZLhLRei!?w{)L|HNplTwNW7IXORm{K)ZJM-u?M@o3+>-0`PX@5%w0^KtsPyh9qg$e&ueVr;N~hu zL-W|s|GfUbPIC|If45}s^3QF-Z;M{YTZun-EqvcX6WD_mi~7Q?fE^kF>u^;X_Rv zU6k{GhOIcd9L;So0)iyMYnfN?Jf0jhd)@)H-flHJ9L6pVy+o5Hcq-8D_w~J6NRRzZ z;I}a>@G}`%-|u=Sz+gU}FzJsGlD4+~kSEWcAu@%ByvBX2_Jk}w6*DJZ5}*3j6MmQa zuc5ay8t+GSZB@4qTn?2L4lEN6EVW8&Y~K5hinrcrlvHone{Adxu$P~8LpfMs|MjV~ zlc)6{;39dAVbZGORuE=B@J0}Hkv#BJZ1E*aYEhg749$FoJja(QsgjmLE3}$kOV;?Vt=@Adzrh(8M8baJ%aR#sThp#9{n%Ae>k#t@ng= ztG9zib(vLMhYBKzKG#&Agg_67J+>$h2ReeME(_!?Hu%0zdaa4fZR(``=(wj64m}vl z_c|~*&D_-SaG(6aJC&|tu#tl+XbVlBY%iL^4z+*Ny4u{@bT}kUp;K1|84F-8V&AB# zqc-FI$=wQ!GTmW4`ok^zgZX@Nt)y3EWUk)b)+N$jXEP9J120oq`Ko%G9VU$k z4AfwQ8*3OACQaEE^9{e(NqQYEt|DcbZ7W0b2PTpa&CXK40^!=$~h=>(VecY@U zeFLfo_4UbZ1DgD{-CeA@OwDM3=Dwo7eAN3>x@xVtWK^O()peNb3Yt}_DZikGefooU$;*m}D4c2t zU+f!!usQ4>YmV*u>`_xev#i(c%*u>RY92Hg`?i zs13cywC1nK3k;?%rF79gjO0_%UnSvy>(to#!GjmwwUx{D3wEg+!jShu>sUtkc!GzJ zV^bRFyXmSniC|9H6!h~JUzR{cE;>T>iJY7}whP20s*s*s**+NT*}d>i3|u#}bvr1> z>0CmpZ3S)D%#mQYg_dJHC(Ql@myI;GLTE zTChHB#iX;X=Id#YIEP+$+=8;r;Sl}=Iy<4@wTTB^S^5lApe}t)i=}AJ9U7YP)}?02 zv`o#J9P*23>G)QuWiiBku((C`%41_#zWUu&FKNR&|53wEhiKOOkryS7{7oSMAz%rj zA78&^rI%D+99`!tzdOIOb;17GtCx(ug1MQrbr}=!AhEK_ zCL>E@*Q`@btVO$6$;&ByTKY1Z+tzMULY=LLzi7)$BRpo(J`o8EgA$S|Z`fjNDzH{> zSL9X5;0w_Rf1bn4DQ8U;8BgYAj2r6CJ@caKr9{@@ZZ$8%rOc5M!Gwmr#A1lwsAuYh zqKKyB(zn&+0fkWB+au-`EoYFXZAFz#rL)S(7cXo!E3<_PBdqdliZ2)S+(WvYqW&35u_bNj*Gq@eEHXAt zLUN3)`mt6`UUJ3GX)Tx2<}|hKo~PHD*jMk_dgecS=cd6n{4iRPHpQonO}9@q#-ajjrJKL2OqueCj2XNY zQOMagp#>qyb{PlEM8~fY{ctP(Ra*d5xpZknTi~_o>6Dv9%Qzm()C9BCNLmpo8{&;S zf6o|f5<+jlvJ3g1IA8%044v3(qZPZSU zl7Ga!dg0y1E|Gs7L%Thi@vZmh^|GPMG=6pIoP=+2CH%XZ^)8 z!zd;hlb)GmL{o^kKHFDFoX&bbprmI?-=BPFiEZ~td;SOW5q$E}mTvQt`lyVEMCPoi zQr*5R2zy5bep4dC*kR1W0XF*PX7){AMFK{0P92u80gf;!o{wOsek%nH%E!79cnqU% z@Gv@M7JS2>>*|fw9z4k{qY^PabM^D}X4nxIFRjN#Js;jU`ph;(<)XvgDME>k`KxsK zMk~qU;K|I%kSt3n?*QQ_i_C?Dce8f&Kj@!NT=I)MC|Z#Dzv> zpYO`Vth)BP60n>d_4Z{Upi6hA=k)~`N0W9dTQGZ+tddPXPs=l?6~bNs3FGBoCP=>v z`+64wxHrX8@v9^ABP7&n;(t$DcMjO*?sPUW3M%ciK5KRrthKW1B{N{segdt1XF3TV zo*~L8aBx%S&cR1?9y-to`QGK2NIJ{5Hs1l9DDxjao7QD_2-#P*M4X zWIxE{08!^@r)i77F|}oMXguvbxHr58!20_(PTi;%Q%RzZWTE&vt}8vBv9~jNQLU3e z0=inhNi!_fq*+o7_!t-dC$oN78_Uziv7%Kmlo`fXQF76h@P2DRB%`zf$=xDB7;-jE zYlc02qnMWM*PN_~WYzQ|rWh*wJGM7M@-c46MDDGMzN}`8d4Hx7;&_j7NVGj!w)aJ| znqZ(raCw^$CYiKQ5;egt>=ls@whMhlOm@oZgF?P^l);1NZc}g93oIb8o|pB@WU#xG z+V}#H-zjL8!9#R-rQg4herS|;aiN{#)*_)Jctf_}zRs8?a@9mRigdSCKM_N5zdrlP zokhsWu%@$mgh6Yhc#YQti(EP?O8&^RGmIpR8>&URl+N0c(GHBGeCij+_dJR`!hlj6 zmjW!^Z{8r6&Lh#8P0(s#cZ?BsjXY_wj@5cKMCb@sp5<@i7Tu0I=<~Ami?f~Cs=T4@ z`*J3zd*B+oVpC)F5Za@Oa}`WAazpg_`|Cdg03V{;%Dm{*Rg90?^9MFJgNhu@isNhe zWK27I!a2~O@xFNUqPKL(R$GKl+S-D-ODLmj1oH76=Phmu$q*3oZrpPNDMkZ_r>@@s?+Y&_xx3^bo1kBx1;PB zx;P17{G6EAr$;M&nXB^lN=ZdsK7?k5qJ){hG#V6H{$!@7ep-w+r@B+MW+pfPX~U^R zDBxn~7pi4ovlFC9-0DfG4(&eymeb^0;O5TBu_wl~wEWfSoH(_n_c(S`a%|tQ2*BL^ zq90i6Ssf|vHlL3zUc2DE@v$vd{tZ~f{a)f?+L7P-HZKqkQ|mtRw+fXVZeLD6y|7yd z!}`$jQoy}N&on_}{E37!=zUieM$r|&DUo5IXM@d9HD-yIWQ7kNL!yrk7c3_k>~hL< zAv9K70Ts~HTZ&9Mf*s$c0WQK>UCp++u7N*Dnoc>f#TEW=kb1)dZD=h4*l399C+q2{ zCwO;RlLTLxSlJX+7f4eOyq7_V*FHNwQW1E3z^haGRWGmRXPb^a)Ve91tT+#j15^tg zR<5isr?47<+SJ$2+ptduR=X*WHvleaRC;+D&eC3m&u85S@NZ~B%rowYvDffCO@|}* zzWCO><)C%$u~GH|FmH`h9`B#L8VNkfq=*y6I*q79En5|w>JxJLgp1o+ei$e++`6eWn^lRqBnO~`@!S;*R*$kg8U_)CF9NohmagORX&6WnIoe1T1(G6Y=HPLTpPRW z$Yg7^zKJ1~Qu{`|pN0=E!fSXMWB^N67NsN?Amk}vgQK7b=T@fF$y!Z|QE`08qD62{ z*UR!KAhq@SGscL0zs1;8gH%_HV^(dQ-;(`FXL5jvst7+-{95l>R?9BE?YIHOE`-tg zJ@5HyVCtE^b)#-z620aBtzo$7`J{&Oxujj}Z~ z4Z53Qrgbtz8w$0c9n$HISq#5n>~YHnYvhuSRgVVyw^cCiue`IBOqLs^VJEM8fG7KL z4CU(uFdG5?m^WVTSCz<%qE7y*fwN;5p8e(PXny;o3w=pvRz&pl$ob9M%@u|1vvw9J zMDNJ=!(sWJD0dzC{v{_g>?(%%e>8F*I2kL7DSZ>^#$*C)vkzCtjVlK_viD!=TGVRU zJ2*X(0gZD#w{H|_QOP8|2BfO;?Rr+R?X*ZBzea6KR=+r+?k}hm<{FdIn!kLe;QiIY zHWfy3Cat5q36EU-o#rk$F1!@S8!AdkqP#i5osG|p>olBc{2`SZe48F-3+6>UjRWPU zJE1zG_}&Z@-jNo}bH75jBG(JV$|+|;TznY_2wH3d7WG)r zOEDl8AT+y_41s8JBBMsdIvzoK;KS>IRpW) z*vEX0#9$BMlXd~5cp{@zc(?y}%XytN%T-4PfhtM>Z>7vk@X8^-$~9XG=m-I&tMV!f zyEcAMz)Xoe&7VbHTU2twQtZ@VIW&F5^Np}oB{+6!urQmH$WGl~D_QE0#+eS;&C-sp zY4A}89g81kvti$N%h@&F0CXkS(Z4r;mwVZOLHCh0ym?5VYBx)5=p3qUO%xRy)^8oQ zzL19v905&f>&{N9bdwrwlX_2}ux9e6kdWcg^hh>`Fg%6j)G}*EAHdaI?h(&aans3| zhKF*_ftuYxuGlvo-z|ccFN#xo!hc4)zZb1Zv{Gem_|Q_$oNi@VvR=?Em7vij%~MaJI=hWSQrY6Dl4UP^$T7;xx34xTv?;>N z)%_9h(A7iU=N6@0mM(8dIWjZJP!Q$TR-S4r7{8*eqekE}#&|&@0qrV`#;+AxG(t{3 zDOu4PF*4ZE%|t7a=|^!+*Kpntgxy?nT)p?!$@Wowjj8N6ms?_A-{5ZwO0w|#<8UJp3~;#ufbj`J}2hKpu?m zJk{A5e%sJ?GQ$?2scMjUeRg#18I6suHK5~Z?v&L)r{gA3LUGg!D8D)s5=|K`sC~ zPpn6Z2Au1tS=+`61N&~wxiHu9j3!i*8F@ow@tO?#_{-EF5&S7BOyG!IEC-d}9jT+e z)&c`v*M?~@(Sj+DX=Fi={6fbte;c;T(FEIb4V@px!UC)Cp z5gyB5?X<84d|)8RL423pe!l*D}a9`e4np!?c>4yYVpRob7S zFMok45n}LTv1dDF@gSSM@1E_$*J#x_rOaA#JX}B4nwrY8QIssJLEF;d%cz?15iX_c z^DT2^1;@jn`aZmm?*eS)u6?6k1K78R-!Q6%Yh99Y<`LBA!_&5uVA1`{>E|+0 zSF87FGc}@rg9oJTHU^34$uj?=)S2}TyH~yvuS@s{Zg%+om9OEBZckF$Y;ofKS-0{( z!;X+c8IsCmK$f|8YRW;JTl^J~|g%!*B^m4p^FSc$y>7EtT5oAoS2)ndu!>?D-X zywM%%{ZP4URNfM~pVLMfdQsAoS=nH|`WiD4NyVDu(yb-b0js<>4L!7h^}Z5ZR*(^1 z)3VHeH3kpHw~ITy1KJ|Fn$nR_L6}Yr9qxGG2vhwBA4L~Wl7eQn2KM|EzQvsdaZY`4 zU6=>y!mmrKIl}3l$ZU$0>|?JW9s7m}2G6b+iuP8?Rs9zZg$so}zPkm!T;VnKxF3f% z8y3h_O5HsGweXIU_m->V-a>vZu$aHXj|^0at_xp`V+px?3A|C}-kMb(-ZiIyy*5|F zp1`I@Vc@o$q~dQIIM>lXXCw3Aj}n>4e7_Nz^j#6M<@!75#*es*UtKPIjlo%E>k1rQKXUv? zhCYVjY7i53s9dn}4bJ@+UugW@*Lr4gWK9M+Tk+LWA!%QE&EKepFQ9X~4O9&5ck3)0*a1s5SOql%2$eg{WP8#NB#zhfCImaHFG&U!@)$Q8g1(~l=e~5o)@aBS%Ngl#!bScNK*W7dM4!-%1gk;^* zv^bg40=zi#UjPYUg0L~|;FD>4^I;m%P^H1t$Il3f8p=})+hoE3zwv= zrPqp@ij`Z7ml%MTdV#U@n%nIpE0M>lb8N1P-bVFrd>gtmn=#H*SwR!!?a3yC=*8G|3LRMcEUMb-GZ(a+oNHRyHa$7pqr!0xx*j z)B8kH#;MYC0CavI+BofQis(uHe{i*XadJX9%J}uQQ{!K}JiD}O*>tpB0xEJ%&s6fC@1yqaQgrJAvM8>_OJv*UJ`+~?W!M_BtPnJXtaVW4&QlC5f zI;-T@?g?vNi)^Z@x1njMu*!m4Tg+lIOM|nxXJx)k zW3LO2Fb2>yu7+s1H0em^nL!7qhnAn%!j)$(C|FvtjRc2b%L;g-#fo7{4#}PqDQkff zRS8BqNjUI}Rz@e?xD$q5sPX#$ zu_*RIBD*pFRfh-#aWDlASQ+kyt==vWn?a4~uOIUZct{LzCb5GPQ4Oq&gWDqO~aI(y{!aNHgrs6wyFGxG~-AOq!_+6VKvLdhTSw2%<1q0ib@vZ_$ zPeUSvS`EoG_J*Vx_t8f>si{QGLkxgACMVzi5wEhh%jt|fH-3BY~tZ=4?^3~Uj(!tAe z59Gmq%LW>vgC^bCv!O`9-9y>-&zAOB{UWF~YzT`V`|3nY_Xl*~8pT)2XpK_nkocI@ z!bfypB4oVj0ps%}r}+Nyq+#jZEzc75HodkWbWho;FS`|n?w!bGL^s>_B8EHWLfe$& zI;rqlGTJ3=tvO^-5Rrp}&gEbfrwk9BpS%kHmRS7{i85Q%D>NS~l2<69#cm!~{d$Mo z5@a?dNA36b51}ujs0hF5jELr^m^wIQ%_)+I#B*b`Ln1En(y9sVime3Fd~#kRz4}b# zMj-(gLNG_Kfy|SmeP~*nf?(Qx;pI9+9c!cNc48cQRX+LlmAbWOI5%))`8ksy@}`wZ{<8{m5K`&8s2S_eCj zeQt@VCLV#7)#gOqE)}cR_8n$QN5y!PR^98?VNze?t9C7W?gof&CV7q1#&*=_TAb@j zCr6dpmaMnS;UcU{Dh(_F1S-EalG^x7CoVV_{NoPpj>k-~N59j%G9=6`%C>Hp0;h|sYYdAHL$*d3kzg4pK zlUsT5L4Lvay5L(yaoeO7t*3bg0%39B*|SL1!igNQa=Iu7DL#;KbtKp7w!zzBu7Y9a z2Ir>Cir%W6iYr2z1am;cX;6JQ=Zqz>%7Wx;4w|ZyC{e3Nd=SHzBiEU}ZSe>Yy3@{w z2^9R;QZKX<{97F8S%4<#<6mJwJ;DyvAo%5JJzvOw{6+XKf1h|03ph*qL;b<#sozs0 zK1-QmL^29OR=8?*p)vP2FRPm~Q-b$sK5&+DN8EJ2u^uf%d6iC1H9u$5Z9aI1PG7*p z>?|{he7|4Qdy9J(0l6XJoy;M>NDsuo=)x6Z*DTL`k2Ou}byXh)1b>#b_l=J1I(g0S z=ZP>=Qbj$IYvB4z3U@4WV%QB##FYQ3*eKr~#9dza6F5k|03|rH$;%%06fS_h|RP zI5z#B!~xj#H_`*?H$=M|36Wxj*+qi1^neS_=_`7Cp`BFYvB@N*%4N@F7Pddwh{|AA z?;7P|_Fnf%ru^Ahv{PzRU5#+Z1m}J$GH&j%5W@La)}>6kllg&5G`P7YXOITng?-Hh zl%264ON%;dZjV>6g)HF7z5U49kxH!e*t_g42yB48_d=EwU%AF^gX38-^8b<g{pwJqC(bP~@@@p}-2%SIAzb)qQyP~1bv{l07#U38)=>6%TDW^w2 z&``&}i_FhoPo=%aSebfUfOB8ROF;aCqTW!bRL0)Gv8wCc5 zjdJztattRPKw|R2?>Nf7!uxPy%2(o>N+Z9gmHYNP`|U zxfvnjnuW@zo(VQ9!b;>0fFvrP%KiwXi4eGu1*})#d%4*gy0~C#7aIETP)AVX;-lLS zPXdWb18AEw4I1KR6-wKZ9m-Ei*R~&eF48JzSNWIc?AMgVtEsUsfX?%}a4*4Gu_dVe z(nczS3}ee%F;fj=FUpQE_3j5SoBgh0JZf#HK&<%dMN8OtzH-FfEIsRP=0(^{-eOVjSIIus4o$zs5co7vw&JVdA@L=3)CkA|#H)pno)H(cqnPa`b zilaEt4jQs^iaRbMfk0mfNq%~&oOg2-f@<$ifK_Nb*~dKiD8^vTWeK944dZfqo>sl< zFbI1?(r?KRxG#3=`WQl0r}Kj?mN74h6!|VqO1n*wzC0ZqmUULU0ETn0OqG(X)XObA zCVE~$(*u{o_~2_W?;HH(&hbpGgRhAPaiSZg0TMkfJ$?DDOs(aVF9IF~hOZ-+aSLN* ziYk>sj3e1!!|!IS%ObC#o7Xz(V1Ya0t>soBIM&tdXT46szqNoP{-&x5R0Y2~jLJvz zVN2D&*NPdFRu#CScxMQ1qu5itz)M&v*w{u`*)Rr9B@OrSt-bCCzD0|F8%X=+ff~ zjlF+a22Qb-X}?K5YWI~tJ} zgbg#l>nml#y>f5JgnI;Xc84tAoOV*LF{3AUMKiY>Yw`M_WLNV@d zCup=FvSKGD<}WQKTXp-toW+rG+(an*s{%DoBRr?0nSMt6nd!skX#yO&#tZW9CW{!y zG=3wa(Uq)KKYCV)iDdIXvv1WR>#+aBn;PQ=Qmd#rLDVh&o{h zIm(5PaqWjEvrqy5r|F^0`a&@ar!v**h@gNb8xMJ;>nR}#&n>!rcHL2jXxl4VnxeI! z>N(JZ&1CDBGLf~og<;#{lg6b!-XC%d+>}Cay1Q3#sG)@_|4nc2rnHbsBa2YCXeMsx zR=!8$jBOd)+4cNS|Ks~j@0xe4Y*wb+vwjX|wguPzumr^n(_>;$P zS{qa5!lFH6-|^B6p#zhhu7!aez3!DR^D`O>Mj@PMvD7`g<$!xK79s9OS!q%iboPdO zHsQ^8vF!AaX>DH1Nr|GrSy}#;k^f?4H6B^n9FpwHuZ88utM0bbTPl!WbvFFwpY@6y z25}dYFY^9T$LO)N;4a6H-yd)=I)9{9hG$)%D~o3aI@k!@CHRTuRhjPNt3eRo=-i5eciYeFgee0}K@ZSv(YFBZd>V2NI4ZY!6Ehk#T0NjF z7;piO#|WI{*n8d4;ng_F5$+4OS^a2%Boo!tXk#z@&ZZby{rqyy{kvT$W!@KQy+1@| zN~mu#+laPFyT2+rwGiG=TO2r>soTqgQ1F2zRzFs0(rpL;e!reSM7>xdA>^Qe-29I? z20~$Xzv}<;7b6>-RN}SQCB$f(;A3c~VMA)?;3s$bJ_??Q^(T--9+3DgS`<}DX2$lU zv5e+d@Pvg<`<+xk33{H&D^a$Wu zpM#>y$3G>v=pSRRuErFp=v+boAt@hu0}u?9&vlF$W|w@Dw36;0#J4$ku|{m6QeEHCI_G0GRa?pC7!z^vs)*fw zmRB@wyEsjp!Fd5rGOtMI3hkcSo*LKX||~cwRd*7q^V$Kbd?|r!-Q}FvqTbK z=X|nk07rc5dZ;fGsmgK3-Kd_4`x?B4PKQ8t9Ed^0)A61^vj;wjCdGZWz@Kw(Q*>}2 z!b*XY={cGT2BEFa*3x8tc5^(JHsbp|ajYC87`ELRP!q+q*dS}p8BDFMN%tC1t2~34 z$elK#J$Bp5WXSB8ir?~>1#919(B; zKH??e|KwrZGTbGIu?}a%t+d*!pw%i-S`H#`9l<}y&D2UH*FyAQbz`*N^D@3X$oRK& z(`eiS-U^8yX5+gCAm1f5cVqGk0vBH%qW7Cb)$!zyB4o^&qmJgxy*&VVtkl-;Zt9y=Fr9$$K^S5)&f3D zud?x9L91wCaGTB9q~VoQELrD!!@}u@ehU`o1vpqftM&jVsJ4YSYj@a~8{@^^^_hlK zIcJ_fDrIkhhMlALizBX9-iLoJYp_-H!=5xC$1xb>^-OvXo{Y2bWgqNX?K~Oyiq?De zv(=wYn!eXW^|&)L+KJWtiL~F>a+yCf-OS($vXPQ;vFZYKMP_mWp3X+*oINqEPO}{p zgvoJlt+Auvq|}nYy)`-`gXa1z3V6i^+u3X!_uV~)?$?VsP#Fo>=H4rI8)$5!Y(U&I zx$q2hSq2W9k)l4dSmcou zUs(&FV?U@et@MV4nvqIG@TT0tZRsZL99`u4(psC(@rx;V1!@x_1SSGLn9^z{8s0-? zS{IBzxI3m-uhk7AX-xK1tzU*(gU;kgCmFAu3T^B)$-xEFwp9()Y2DyEANLc}+*Kmd z${g3L;aX7f=>9@sO=K@kmQt(y=#-0KPvyRpgvnLXnYH2{vbbnZBm!_OQQ5_f%P6A~ zQ3N;9WJJTP^oH#`rKl39GN?mGFcv&3sSJpd@l_9VEK=e2m?C}>#O|kJQ9alaLZ{DI z;gUqJgt58U37ckZtwRi{Gv&WlIkaPBIm+!Y3puB|k3WX#IGz_%6(L5@Fr-4lSsQl7 zi%oDcnSKOp5sfj=X;fR)TS?ik%c#Rr5W<>7q9X;}-n_88BrYA(m0p3P<`_{u-YDaK z7b_xRO@({+&k``tDE&P_AY4R)8*xUauddDcIX2~^ZQ)7y?s*Pbpe9GQLbPQV8I~@=FLmct) zF)~+i70p4vXeHdl1}K&^DIUk*{eBpE z+|t{AS{%&JiMpQqp+z!Np?WDu*^u^Jn=qV;6*g5E|4|T+eAX+9Z%?!iR;v$#Rd((9 zG%26-2d&79rerT|5aQXHf?|X{r#BNO8|;#3f{b|YZdRnGC|S1>_2FQSNg!RVUNIq) zB&;%eCDyXCzhOEgD`lSyl8=)6s{FLTfS`S!A1d{zq9uN|ExbOVvj;(qFyH)|ci%wC zfXt0FZX!LD0zsaEWVzZyMIi#cc57mFiy>$A25<9%BX)zP7puqCvzy=a^FN97z`8yM z>M8q~`~RtkCK}L>e`O*J;TjtZ@OBx`_m-x}s7PU?GarnHePM{OdZLrJeBFL$M*%~{ z9~LtV3ysQ*Oafr6`#`eCGe6(oz`Ly`#bHd77Q@Hi9 zPa>OA6;3^3cHh85^wy8H<1q$RcwQ1E&@@)n71#MguB`9-NG=SrVfi|_O=o}_FpKqQzCj#<))?xj`A~-*1c|Lz9ruk_=6k6ux|ddQA?Jye`uw)w4@jDRR3H?i z;p?$}FC(?ul(P?Eta}d-VM&xnhz;0yJ9;D1uW0uw@=E+E%6K`J-bSR1smvP4&;N}i z8w{8`OCL5ELkk!QMQbGLiF^%ruHj)PICak}jB^A5C$@gU^)AwLeVV2tb^FCy!S(E; zM@5bODt1BL+#}0B>{=E$^AXSm+F3yQG|8hav#IqiKTFPtl zQPB1$&_Yxd^&>`=sZv&ZQ5GTFWv$(jf(gtMaY-uD0|?*_ylG!>_D+{&b-V93rO7C> z8;CRGUpv1&kM$esG5$=_kG5O4QTc{LDY^OA6QtyKAUh2v@N%B)$B!ne78hYV$v^iblTf3PSGzI^QibHLU! z@mk|99mR3NAi~gdfWR3b8V;?!tW9xeLv&RSB0_M%5b8dQ0U(g#CmUO+LN0^^;3dpO zyuda#jl{k-yD;LR3`Zvt_Vo;QH@83Qad8yO*hCMw%N24@rAOno!D{^}@R%G5n=Y>1 zDp(~-en0LgH3C{lqN0&Mi;)litkb7x4yff=Xsq$OfAD1{Ed2_*};yO#W~ z#{1y8{5dGxpLPYLRHP(r&hcz!(Xh}?-;FDgvA9l4i zmW&@cf*cc7rKDGCW(_9|yodRhux5?6TVAeYQ!G{XIVIL#&)fzUJ8Yg6T*c`X>%aU% zD$ng%8vfPX4=%O+9Z6p78>+2DUtIXlE>TB29d_doiw|MX=TGC^6NLSEgYfo1k@?XK zycO(7345W7o?(Tm0~gLMrV~cMqP>oMF+!$nshtd>Q%c^vSn5z!KWULW!fV_!y&p=`b?X z{nkXOsXab}tesibtP5z&yvNH(RiSl7Gjk+y0YHS9<)N_G7StF27$L@qxA*mKHCIEY zw2asU6Yp|v3Q6{NscdC9A253hS3@wqd%f{*4XMSt@h0&R!r>mz6DY8Ph@2MYR^#EE z)U`UQue>G1_-*Kb<)dX()7rSTS4{NG?E3<+nCDKwXE? zd_-r_hF{fBY{kh<53ddLSu8NC?l^zo0*J_BC>)S%%y&RbU$Wi@B7>f1F0hRc4NsEt z8OeB~Gsuj9{|{yF9?$gu|BY8lNk~F+s)S0YoR6y%N=Pc?R5>S`^JunpBsr&2PIHJQ z=a9o}b3QZYIc>w751aGMPS@U_>-zqF|NL&h>+|-X8-K7p_I%u*_tQ%}f4%YU`!s73 zMgmE&)>?Ud^ruVEo0(Iq3L>eAvW+T_KzlcOM$*Okf36-?EONVBl!_DCe!NcptE8c} zhLG=e2s7j#eT=V#M}>Tjm4C0G=HM4Gj9jCw2Is0ub5+=9Mw6FBW^$c&n+V>#FSL9uJRyQv^g%l0HV z$9U)9KhkcO>Rh5Y`dPmiVIf&wTf} z5y5ihREFXg*?$a-@`_@&AQlO_Man15>Y7z&UI@*U-?Q3g@_90IyNnf7EuTsNKyPmq z{diiD{dz=%Y2YU-f`to+o?VG_~{z9W#2lICAH;b6ng9=XN!46aNFtR3nR#XHTHi z)Tz emKKa<9_##^u0o$oT`r^%hY71@Y=R-Hqpz^5xcs#i+ntw(_i2YtUh?z4H10 zXFh{h1p@acPiYFqyiT~~dDNy(awiL>GZeL%%XXR~sJyB4FMtceV z)*^w>8d?*c>Zt8M@*KvGPgYwMZR6YgcJW$sGu~#g}3dguM$G5TZtqB1?Eco zXp%kxU40k3ypx8hL^blEP||uLxgJ&Y)jIRTHD;=)Ohy+SA2`pP6(w-k*-Hh+BNvDmg{$(V~1&lx8k-~e;i?`8h4{r?a!^g?Un z>Dm+Dg*GMW(GBBs+f@nV*Rqmo^Xk8O3>Z?$G~7kGq_Y%rAK;bj4@ScPE)Us1^N3k) z%|HA`8WtdkHN9Ll6}l^I64;9HJ?wo{|7GqcdtyvWy@;i59*X(L4CP(y#Zj;jbLUgu zB+IpGv=&DP$TYTGBmB#IrTiOduwIbtxZ23Ks}GEyIv-s%%3cV5I^*;8$H-o8eG59` zTJ0fMZHg&s$eN0&WTYcW6_70#i|KOvhn%%Ead0toXucqUI;PO5nH}WtgQ$#)(^G!* zxSn1vls0Voa&n9bbq%gGfOWmJFASXfmEou%c})D0oS$R&Dnb_fWPD2`xuNb2+-~mW z9`b8`c73nq+p>=`74&_fHyz5P#fyd)2cu{o(U8JWYSVL)n2ZW`<@3vF?|t`9%IMp% z)&DtiN9KMeQfE%7)UGv*9}t}VS4nqYNrjRD*v8r+7IS3ny6WnOG4G5r3*IsQq$I)W zU_)!KhQ1+-vZ?mjWoC49C^rGF_HooQWLg@<+3tsck?Djly(N{6-I;{#(Jyp{VJTF?!=ELKuD`{?UkN{M9gk2^ls{Wgev;Hse0 zU$riBUm25Ntr5#bVn}05&}d;BwJke#2U=V;{iz0<{x9+B+t;l3McXkYrS*)UvCWL$ zk2fKiuS!PR8~elGc)PgGo2k%9ty^s}$2{O?7oKMzvFE7U4M!S* z#P~`WfUf})77D{!EjQU~a09d+MG#VhPur#m%o}2N4e%YH+s_P&QpHmxFdK4}-4z>~ z;6~iLgZg_~+zOC(&g)U9Lc(8b%?3Y%(0=FD)P!p8N$cO{+0Cd-SNwhV$*-&Q+e2%u zAw9O4h3DaaokwcvrJ1g~+^!nY`D z+}&So{7r9ojo)@M^-;_hs&K1U1hAphAB5>{5xS_`@(|bDFklJ!h1ywJM|5|00R!G5 zw$L-VQ3a9I@MKBseSYVY8}g+k5^~L|W$$g7|;Lxr0K0!ww0~VI!mQ|`3boC-ZSQD3>W9E$e zms~724cpRyk>c(_4N?Z@U&RlNGxUHVWZD-2yK=?t;2sbm;yQ*K7U5o&W4M8aTCV`I z&zE*{_%rQ2w+CWPt6p*2@AXnARwot>CR4*w9;jPVhyfws?MLgCYr}U`v=?8gL z{|giS8@S-X;EB~iC~R)9${_nM58=;;qOl*+DoS4jG}3=|XG5<%v%6B6@3}5~desPdSYlDL=O1UQ zm#^V!sI=CpKc(><*z<`y0JZ;oSnjt`FRnJfU^0K|kH-sy>+8hn>g#|CyJr;HY`=x? z9bD7iX~^x6uI2Ho1}yhpm5xQ*2){AO3(qT- z^&h?ufR_pn6k(tl|D3Dangg{F%wE&oaw^K(b*X*K$D%ajzw# zq5AmUu7!7^IJ#ZW$j9SXd6%gB}b3*6c)51Bq zZoz8JCi&8qE-CEEfd>ty45t<&pj+@_?wVvo^1$A9S;`0`q7Z7M^aBd!JUAHD8U<`CiX z@!XS|fn2yz%%T{N(2nYAp{SjkcHChRO;(IK=aRuT#UwZm)^*1gno=Xf8c9ThO8)SgR#NG#VgU$SD@Ya0`fR&Wj!*E9xW!jKp(Y z(09!Zqu=?mQ+2tk`7urXtfx)0b-!|d&afwWsy12R+xX; zA#tFM`?uYuu;jV!?Tx1nWA@%_2Tyrsw=EV!7hUfS`XlfVu}zzJVgJgKDw9N4bAta92EMuBf<#t{waf zTRXB<{6GbZM^lH=!ZzAr-}^#k0mZ0=>8ND4wo(Bz$d6Y(7{fWp6|S=^SgP&e#8hkF zy$kUJUJ>kNkp9&c;5(X${zele$iuO_Ddm`VX2>VmZxh$8UZJ?-7)tS#tPF)km)p`C zLNr*kIMuE-txPU0^m%I6(LyH&wV0by1826vXFldXx>mCI!zTJQ$bpXOSI5SU`#7y~ z{l-InV~^&zFe(Luq3CzK4-dDPCW^4(tf zf10s;R?@aX1x^pk(u1wU!~{3aiF3nQjefBDHXm)u3oXv`5#mlr6A?{FH;72;0;&qN zNmM%r1Tkn=_~lLVF>T>%aSmp?9h zM!;5i;>zBI>FQmjs}Wu><`ZPaiFZ@5rJ2`Xmm@xQhmI28AvfXibr zWo%R$(secX9KMerFYes$2<_HrL1CqnksY&Mz3KSFfZb(O5_%;EvtmFE1<{!E98cbg zODj`IRwm8+ZS-Hye$;QnKq(NT&O*?ibI zAY>EbpK_J7+j-;D;ez8c@8@!JPFK6V-;e!!VZc>VuNUcANUDuTl@B-W14G?Hhv{En_05O{2KVSK->j#>ii3GV(?z6 zj7=@KE8=HCqu{19m=bHa_p9r-@o7v%x#E!1@tx!64!o@9o&#J(daNI7QP=;U?P>R54@AGO^h|oE;nkbc;w$swieXJg8 zEdhKE>zSIb-^iP`5wkWCu4%JXJ~e;QR=^16scUp#$P!|l$d4DbFmf^)Z@3x}qn>nC z%KXC3x01zUy`nN>_DUSKoi-<|>X~J?=SoA4Z;anw0)J70Is914Bbn#0 z!o5xkVI9*kNsAB)svuml2&>{Sqj%wytc1#jk|v8^BWpqB-{pAo`J}>gPo!SH)f@=7 z09+oiS9&Yg@V=!TLfctbU7ZNPE#qhhB@R!$s6FDXv$rPpDaKp7c&Kpzx9YwnsJPP7 z^{%FcE#R+xVX8CsehyNazc*WeX`;&C))ri3!srp3kjU1V#B$Du-52z=b3{QEye|= zK>nB$0nnGM0*|y&78A!Q9-T8#_=re_)$_CMX=+@p7lWP`vlP)>cqUn_K!r-Gjrmm` zX5L3}U3*-?%hRU9Ak~I)&=rVN8Xn7abHc@Dg-Hc4$F4(PsL9%W?UeBX70%4~DIZ-e z)X=^n*svFHi3@?64}iMjItaP4D$(OXO$iaXb~;(mPzt0leDZ_kNrVZ4q^qYr6!hzP zEGY?jbM;^0S6_%+NvEa6ZxatY_F9HZW2^)>5pT16IiM0(5?a0-sG`*2TWEo(#Rtu& zgMr}Ew9DZ}vDc#bV#*S@ysOvtlgq?{xyZYQZt5`~{B%}(rS%e;>mA{{3^<8@t(t!a zJRi23MS0^4_s3!Lrm6*W_gh`+c}Bhsv4+<1$n;7>R!WbN_qLF5XBrP+x9hErVAY?t z?GL4)<@2J|gGz=2M@~~yu*VHEOG|%Yj=Q}=Nw*#@hGf1u4p>8^Pa%&I0|(3rAkL0G zRD8}_Bi*yr{rg?ZNBWP515^*0gL8`p^Ex;RW>XK_NNZl5O94^XGnVY15FCV4g{p(; z(v&dMN;RO}@Cb0+tHJD*Tk3%8Wst4x)leLT5&>JN{(CMs&@J<_)F;~hROX8ncRM|_ zfY!1{)x-BMRL35Xyn4(u{-Lp$89iq|0Hu&A7ksedkJtS z3i@PR>&m?5=~19>tHO3N`6lN{w{LU@Kq7Olo3`+=F-c=h8oJd-fQO8M@dw5ASsO~Y zr6MeQkMdq5mWs&_kzYmT1pwmPCaVkbL<*nF)!zM9wJ`E3T zU^gcikNTHYyT5zze-axl^(7e(d<~DWq(}~=upJNMC>X;WVX(k!D757D>a6?YqQ0;P zs|}EFgw}1lQ%eH~Haa^MOIel~TrEdn(Db_QW7KYIR^*Iku~cMGo3PD<&@M_?u4=$I zPT2ir(Zb(6y)!f|G+p_lD=_XmIknQ5OQ&6GlE%Piv~n00<9LJZJQ7984>j}ItVYpb z@giZ?ys?kO>?Q?MU*Tm(+99edJ%$V|6qG@k+T?W0$@CelWC|^^r&SH(m$MayAAcd? zQ$;nBuc|@0ooSs`dE8YyQV=^3EWM^A5E1l_xHUyfc33polqq^5v)cVd*!Pt^M3n1H z5e2;K)ROY+lM)L)c@I*08u0T}eoDAeKo$I~$%f0OGVE3Gd{3IsVi^vyv$7bgGxvRT zJ#T-DVHj?z%sWnxGD1=M2T+lqR5B@s6v7%MuvrXbL-$@VWx}nyC<3fSe2wU9c1G{X zywy9c9`R2_){|5J7IJ@oEj#rgUC?3RiJoEaQr&QTb4PgUF*Q;x7#P8e@suiUHw1kB zVOM7M4+&lFTq2O&=ODH!F^4qBHs1}ob-$^b{)}*qrW(dxqFA!QsS4W!&U$_gKY)=# zfl^t|X~SAhy)3-AK?zqNax+&e8x2)%eB19nWi(qtUq2!U`!Ve|AKO@S*se^bND^3E z%4mxK^cxH&w+63{4H@i^4F5t}shI47&23H4UF=di5==vpSOqO|H35cuHUvcg{f?d= zMFFu~&l1zQ(jcSfMcE}=u6;~$@b>}_m}`wOr3pN;yBY*2B>+K54d_|yF`$VM_Q$=m zP_PI2cQ{%sV%YW0_*G)XxJ4NR1kNkmCaPF=0e4&Ho-yC+*@l&=R&RZ#;RbmUf%RF)ohap+`30 zIOqzwW_jh|wUCnXp=D52CS)TK(a$1M(P-3W8Z}y;!0){KmLe&;ZLTQH$a$AJj}n3{ z7!hWZ94TS3hD!?+E;ppEqIFu<FE^~ehW zi-p`@7Jo1K6r$fMUu#4P`ha@sc2biYJF2o{=-u0@e~fF%-`^|2Zf=Uh*K-Ks*b%nA!g&6)8ob_;SxLDXM|VeXro}ll zLBK4(WcRz;qSCpHc>^k)fZ))b18LPHD2hWb1Gtz2!PCAp7r>63^jvD_Tv<&Vb5@6~ znHegir%$WquD5M_#7cnkUO)F=B7SsB*Fvug$oIU%P|gzaaj$Z;&d9hU1^?n@(F}vX zt#S6*vMHP~arZhM64qeY6+GsJ{CWkjE~2_nggu)~i?{8J)3o4cX3D;@pxI-$Upa&O z?iu5XoQJdDP}C6heDQkB_Z3N) zEpb$Y{!D#NLcECI28jz?Cn$J03xDa|VS_4EAMC}cAwMJkf?#Izg-7;hXCxka;=B(Q zlexWWB+>@@vZOmuP1AB=Q#Y;5hOA?3H$Em)>K}dOg9yFAMnPu1BPxC_SRi~?Owp1o z4xd-n=oHpAP#hR0RzSd%DyOy00nWVjJWU~Miej~>!(m#gzNl%`XPQrL*9*Z$WU;d( z00u=vQ{7_nP$*>Ba$*ghy|k?DmO%MKeZsVBis(Pt)nMc4OV(`hd+XdZC-rar%?iG! zPM_#4f1}9@BEDYrZiq{GK0x}dyde?us{9SK7{US&>*mc;#zW^v+adGmDJd?N=dC$8 zjzeN{!98!@8x(&Z?^zx#?egA=_g?+@b$o2)9jb@DZ3%hJ)eEv9z3(h3nDrFQpMznW zk}ZHjd)_3&5UZ~q%IaY=Hvy}U_6DiDv40rF?6G1noSqPH*Qm#9N3BFVM(@H$4+*`Mq z(*{4mNOmWlQcXczPhT_aoEYstM$jSG?8tgV5WHQOedC8cR3;&v>!lXVu={>$} zFz)|zb*$3ITbA_1%6=pBoLJE?P}0?9s}tPX9)@5{kU|e2Q~i^;FwFPd{04tT#@|V9 zY;OMPyX~qruV0;N{rCRO`SpgA!Z*_QOn>UKpc6MK;3DvJk*1>P{qjjBtp<Acv9-Ol5l zx#iLXzgFrZdsSq55DmsIZxU{E9>QPv=R?0QL}v{jXgW4_yEL!6UVS1~XU|jbB2e}+ zXS7p@*?f3{gM{ySP>eS5v@jevi7rDl&VbNl`p^_StU`Sv(@Fq2gI@cfO5uX27?{7* zTm6-1LLX*s6EnAN%KCB`<6M?`0?plVOR%k0wi#^?&&lQdRBh?CrTuY!l}FvqQH8c! z#4=(iCa{^-6{G=a#rw+P7=2vWoLYfA_re#g+(!}0owyP zc}L26*TNH5m^Y6(Nc6Y}t`yUk4)30vP^nqS`rbgF+dK|rSmWH)M24qbuXUXo_8+t| z33ZY4XP2;M)|H&;zqxbD8luRur(~g&IL>a|7;X-xd~-L5O`ivQq-`ftZmY8MC|vOH z8vkmgv^7|JHZF;}AE*qN(e~nUgc~tIVrjLR+)f@V6*nn=KP;El;F?L5O*o|b3&Y>G z>mxK@C?pl0+|4S_nla^m>S_W!45s?+U_U@0SSKjyn9Od4vvqoseumf}aU-=tIU`_$ zE}S+oy!hEc-Q?dnbZeF5gdC>p&3KyW4;J?2y-*fN)MOQ=2TtEfRHW`_O;|2He>t!` z9i_U|!`clc+|FI+NoYHulQLbN^RD+Z|BXIw<+JlI5M=X^n*z)*2~S3Z&?q$6d;k#B zxaCEnscM&3TZmHBFQ2UMO}8HQ+B2|Zz_Ztzzh%>7r*N;fy=zPWy0G(`e3l_$w0`GT zp?tC+GdwFvmQyNd{pqP;Z1W{GVDz$34Jni{j?%(Rty}|f*!eZBfGPWpFE!ExS!TT~_nl(9(bPC(B(#Tn zHd)$xJ(`p~KZa^>KI+v1teR?}R z{_5@H$G@LeG!BI>StCA~0C8_xjE}&=WI4O7CHfG4rdXGAR6pkjq?-7Tii>TIqkP0GyV|Y z`&YPX48Kp~^T6XzE~D2nije}~$rwN2%8SYt1!Pvc8@Dy?A-C1io}u9~|L0EZ>SChA zZ09AsLqH*?R>fkqmMm>aydXX}eR+emNvqng_NQG5e6}^H#_B=xW!GKShn z3~+ON8&8-(bG>Wx0kpK>mtYculzA|;Nsjs;9mn3@6e@aCEG6>wYOxH)`^vj=hcde6d6~kY$+kf0g8;&#=ICiK?wSa$K4R$ro6yfrsR*l(TQ!}NK;LFbi`&K_LE~5AdKT#xtA#fulf%w>m1N^wYBP8c3ZbO zmNhA4*l5=jk6TNXWvj|QR)DfM5i}9ucBNQZ9{eT>!E6`*I(Dkj@+!aF^IIc-w5rp0 z9wEU zDh^t5ko%4=kpqNmjM&myo!^a|+(POK!-50Y(Gd!mwu?vI8_#kw2Dmj$AEcgZoF4Dz zCTkMOvC_e|%RVbLyVGX6%=eV5tx{+!_g^_MLA%KsaToX6wLiz0EOVHo{Ll8XgS~4| zID^WY%))lC!&k~UMHA~Yi72JjheN7iQ~ZPv;;-j_MPKf#DbUq7 z!}{DSX{>ee8WsbzcH1Lt+~8FdjY1eQn9V~5fkIeF)TSY_1;eL)e zNa1>|^3WJIk;=hn(9jv`fM<$-Hb2t+uIUbe@3m~D(Yri?RYTj&rq5%#^4w)~Vv}hv z*XiAn5vhnyAN66YjPGT!&d~wsd930h@0G1GUd@;5=Sa_g&nY6n9p~t@~8iKsP27zk^%-)K>92( z8H_m)EHFYuEXm2n85%^RfU%W~YUkZ%O7_dQPBpfhf}i$Tq!=vQz(P-wzn~^^AP9{a z5(6W&z+ObCoQ}ciq;D6fp*)y%@FfewYPKt5&>?k3Z>WwY4&TA}pHRU|2ah}>(Ace< z-v6+9G!7hKTKQiWfB{7guGr>iWBEpJp@g^@i>`o)xcEO`)jnB20LFB}Z{kmPoD=92 zXdY3Pe_@n7MZB(NY=<8?Y&Bxv!+vSUDrR>(t|$_L3oHiLNA;kEwDV23Qaj18;9`|; zN2r`6<9sExGFRWpGro$PMj0V2#)2>J?T}cGf?&>)q)htqTRdN@ENPX99&g3EA{FbG z?JX8aY#*PuM)AQ;qjfTv-4Ci`zQ!*GwR$2M#bdI<$$kY38fzJzv6YffJxKZ$5{xwy z!)fnVWHB;A6KACst-%p-IYM)ef%BT|kbTa8W z=Zl!qp-*3*A9^xD$f*)fQmFs@l+W+Tt#&x+2Q-clz$JlT&ZZXv8o(sAGVT`^LOqO2 ze1=ovI*cUb<1(~MkC}&)TVg!!I@T*D40L6MjCnQl#fa0bX`k^^5wetT8^{-L&|)S* z)2$&JHEUV?L${`?E?u~2`s*kDPAS$;FBb{9w{ak#e2a8L7UVc0N5xRLvadDpxvCw;YaEoA>X$NQGnAh5ly&6Os0)oS;a!ZG zA%?LYRd#FIYYf&#tWM2nbwM^FO$hOEhfzM2ggKLvWlqcqRejDxL(C+J0msfvH>}U> zvv6qgm>jf*Iah|N>Zpcd=Vh=(UPQB4>PCKA_8jXci4yZ#_{ss}x+ACd%RN09{r~@s zTHKFBAq9tB9=nu+{GMu`Nv#EZ6v?eSB{g=FZ?C{%=mBUoDk)92!nzJzeDxkqarcz&m=(~0SR zM(1>QTezRkSVM%8>zZ@PcX6dY&mU3A4dQ0g4>Y4g!qz71{g<5nTosCIoxKxQlM5m) zqaW^-R>P{b6~2U@2m@9xc^!$G_JTAIo>yGqa|r1JKB4p99bSLw74Xc8^SPuw5urDh z5FRtg?LD5JWv$a}Pl#*09~#-h|3Wa(AmY|xqn>N{mzYzAzeVD@fHMtwjty@S<6YrA zD%2r8fA5Eqd5cIX)Y?t{YDGj?m+}b?Qaew%Gr-^S_#v z|2XrAzL!}jIAAFPr@-27R49-_q*50<+>XVecD{R=r?MC8{ zn*tv`-1F&ue^yz`{P)Z6oeVUu{VT07fwR!x^~QUUez%`Hk8mNA=~bb{PM2FuVp12< zp-cQp`d^DX^dlo9w!-=53nx{UkN? zKHWFI6%L;Xmcy5O4V*yOZxrOtm_7Gw>muV#4FIzvK}<4=TE%*dFLl{AnbmCYu6Se< z^p4Gl)mzITJ!yQ*J8@e)oeHO_{#b9B>obv^CpN-UhN{OZ6FEXZ)qlHuFgeTFnIu)Q zJAZN{OVz#VC-pbG9Iu=}>4BG|B!iR8_L0)8Em_!!tJ>=%fmUhw^QkI<|K=3>-;>pQ z>P@hxeLN+`6dLtby>vGr!&CUi{h~cy-ksVu?bVPPt`$A4326=;7*Jf#6m#&rydE03 z{WI&EehS-vHhfg@Yc8ng)@QW_jT;+Et%T(KF4 zOS$IuiLsXgnwV)%oGtyRt&<-E;%&TRdq8J1beRMQeG)hP6U1xCx2UAscW+{fM`X2C zk2QS$9Z=m#B_W*5lxj8l-nH#gJW(%O8bg;)`Ua7>8@)Uee=i_Aa-|4G_2c19J!9@4 zGBfF(!fG(s>TUddfZP_3R4V@CzvTBC?*xWksE13cN%mhlpNJD1q)v^_rw5GtR2B}F z6JG(qNQ9rUde@Z&3%%9jT84MR>&|Q*8Vb5!qGFVy8*-n0Crrq2En_?^syjyzbKa5| zMdIr|IeJej*y7FeBNHx@OY4ZqU+04q?^Sy1mP{poHna_YsKQea}a#dDdv?^Xu4(Je%_T z#q;dXc@qkXJ>=s3+&a96gO*oz*BS-=;QHHN2B}{p-t5O(7T0X}YfYu_QKn2}(uB>J z7Xm1?o3X&1*k+O!6P0n7htzZ@Q3}@KFCeX3ppwm^jaLHieSK{MRbz%r0`H&Ro3Xb1 z8atj5z>S5K+Ix3bS?PAV>cD?zX{@>BefRml?ZE$8mC1@{OpxylB@OPhX|aAeTKO^W zZ)BN+Z%XP$s?MY?Dz0QE8NF%hVEKc}l@<=aYpK?9mX%NNW`#YgB;7C*@7Ze>i$X!mv>1WFd?{oVU+TE9=n0|~Aq%sxMLax{>4)${~j*AIx z8puJqZ4W&T&=wU`{JZ*hxp)FwgtlNhhpp!<6VWN^FIWC9t5EhNforgPEjhZhiOnie z8;2W?^~G}0X2+(6;l$5!+Rx&u&-bVF+sgm$lqbu7h`TPqJ?few#WlB09}9e|xF#F# zdV*+OdNa4)EV;85k_@_ZTH7;zxw0H41LH6fC)99;O6H2+TeLN^&&m^%u&J#1`|$yj zdM{>vl?dJXsk+@O%bhyH**)>)M+wZCOpaqoB2NYyMp-m8F4fVQl0lX!t6FJ4k^HN*VYW8^B)NYPfoA@?eV-`qj6Vr@s9^+u1Xf zl>{ULHs|iGl>%4yUnQ4ug4=T_A4$>*oU-dq4MG5B8&}S64K5A@eX zi19is#0Wo17!H48Z!gt5`TDVxrtZU`aEs}ven!K6$r`_FpOX8;eu}^7C`Bj2tj0vY zE>?%x-b*w#u1GV{l7x=Y~d``r7Go|G_fJ`L>8*~15YrgI@dJg?zyobJ*Q+EPBpk0Y&p zW&7gZJhrHZ*^I&YdXqZs1ct zr4Ps(6PEa53jianG6A(H8W9y1U?mx0eUyr#0V~NCsNLM!gucM{SzZ6Q3#Q7d8kZJ=neY(pD+Es`E1M zAj^ed(}5Sy?$_7-Y){-G1NJ*nJy8}2&boT1z4#AQT&X-qbe%P2LP$%=}5 zq(?3-u|ccj72p7zK~joKtj?S0XRL9!OpJ8MfkAoAN*$x4y?VUmf4{M%rC6`s(@Ls?Uz{w$f78JBT!R& z-rh3Z%-OXmpc1LcE9t)n|He-r%k^5k`gTn~uATRUy3(yiHg6pM5vpb>*Qgd`@nYe; z;pOoB>!CLhyl0OQPChyNCD=_sa(I@>Jh=~XH7&jKalh9-AO)UAnq4707eNV&Ay=IYV?_|a#&B80|sG1w>T;$VFsiQ&`g{&W- zSY|7rD40PljyrKM%0xEw{%L6hjJueo^NS}AY^qKUJ3*8ybK&LEDVIv)AS}5UQrNO` zVNhEwRY_}9%(7t9&M&wqHx~C|sVBVk>2iB`zqT|aJ z_6&uSV(Rxq6z=(gu$x7Y#T=WNvhOi@9&)Yf+(hEOLV8xbhX%KdRId0{5c5kb70rkp zq!zup>=e5F2+ZVDtmf>RWV;vN7Po7X4qF2;7eNquIHtO+Q6rdp%ufJ{YP(p^%apxa zy85mi@Qk(x6A&mLcy)#Mcy6Jj9H8jQQ zpVmIpB52K4{16Zw#yY)%RRPR>vJP@bce-dZOnS-U$twxYLK`M+V)6}nqEj{6*T|6F z5=6DbTJ4Xtk|ZMj@Mn*`M_QHVIfluJC$ITt>db~qg1)3m;Rf2-SHbUi1%jcBorKWC zQYBcuRc^)7my6Z}AePujfZ!a9xIYr?KG~^?O=X%s4XNg^4->xG17!+kAdfrklHZ)G z#3rz^E}@^^U6=j_Z7THV5&CoR{!?QBar+Bl@Au(qMNZkx9Z^QB$f5l zTvO|#pEK&chaSNd0H4+8XTRBl0z7u-Of_rPA)Rw-7JZijCN;uPW8b8@Kn% zq%5m`E=H~&Ju4>?ajZW(hp$;KCW#m>TRo&=73#5OFGRg>EW&g}+3KyJ{&@_{cay@; zc+bWYMou#~QGdb%t-?waEtp(bZBs!q7=6C}t8)PNQI?h}jWl@PWb<|U6zP{m>TV%Z z#tdh+DOdUXt_Am@UC>wi%MQF5UG z5rM+9ed72@)4+Fbw+is%Xa;Z%k3GOUzSsT3A zKP3Jx3?r5xcHz&il$Fewtq}XYvR{zTY-4D4>%AMfckzw1*0|MiATs^y+!@bS$5*#Y z;|!$cKc*hidLYTKeBb}+56yCfe2WZXoQ;XYF{ANCMujb8trMW!GOO+C6<|m~I z5GjbPIop4&AMfsPXs_XP$A> zb2=jU_Sa))1vX5(&pM6`XN1&dN$(VIGL=?yAJMPG4Ssa^<>++!;fknz0{!)zDj|7~ zn-{tLi5DZw(CE|J&o^F|=#bZOv0k$38nY=Edkel&@C3yM62AFH$oTu_l+yrf8TO!e zF=i>W&yl?oA9jBW*mE6}Uj8)%oa=!NRN>EXVL9V3(PQ!dVtr1wT4tD6QqX@|g@#5& z8~XZsKVHj0v|60=%Oik(z>1u)Zl`99W0@TWtige=-|pmim;C;X`gpXnT8Ber5q^6I zc1Zl77uh&T&Btmlr0q#bUieDYMfL)X#nM(i~ zuJwErIyQjY*Ub0PyQnmIc_=@rF*~9)Mv`jCTr;9=bQV|PSaRUyf%eo>Tm(LPEGB%A zYrR8#wQ=gRA+s5-3B4Pn`cMGvi+{^I9ui`Md`#S-nduG*# zP%7u`B92L1$^|#`lRVzdgpb^9@); zKhW4OdGaWm^bF0|3icF);yI8N0+;qKM|ZYE(~Id5tv(ISuwYac#4$`lfh0!MM?KR49z@~(Z{A(|<34`84j9u3io zXfdZ-&^Zb}w7nki{5UPt%t_t%Eo8=@s}eaPEjBy$5W5_!10*>nZJ0(b{bQlDTHGgd2g=SzzPcSFt#&uLpx-Z2 z;2SIIio!H)P}Imdk6c@t4+G5umY4x;la}HF74g{+z0%7hs|@4jiKyNPtrv z|CxyDinFvid!StR6Hi@TPVsz=Bdns#d;GEB!`QiKNv)os<;*zw*6bxv%~=>z=dGCi z%hC&)R9^G3QRAkI*10u9!?yYEfcf-Ik4m~bw#`fqlgM(3rB;!PJef@*u>p`3jJ<2N zjqfpw9ss5J0c{S;;a z-KracMTG9yfqQi3tHqtdBF!pI`!eV$q!lUvg8ju9ZSim&DX}CFXcNmS=#`_iMdUVH zueTcR81R)bihCUU!l75oThVeNhWm6O1a!x)p?}=F7*(GZIy|buK6hBgi`5EX*B6#g zAI0eC8%}9S0=U!EoBKdms@~%3i z4`|@d^-D`|ay-;@+y_$~D=FeYpBMJu$Sr+E=aPxrZ?8YI=is8ivMm zwOnMkKcnx$W`7heH%(_)Rdc)_z1!cZBNtQsJGCJqsKn{3_t!^{gT?702N^Uxr#+)X zswIQIvaZNp-5I6ri?Hte?I4F?7Lb{IR7CZhd|H zq|boflzq{;|2vn^1e^`%`<_(nVO)6Kgq zPg5omRAjHDj!WVdKSl&|cz_%pL4VJV%Qc3lwlK^6ZuMDH9k5hp)$C(zfn*$SPokyF zq?nUwO4_o8>A^`TCxU}GX2E7%D zrTu?BDUsLhx5g%2Dor(=iE|&REyRe=3#aZqv_-ZoEzzk^fZPUR7SG zbEODSo`2C@e%{M`Ee{dA`Kf_qMhXZPrYHp6+zy#~k5;4)m9_EzW@E(`{j1O^pFEa?#ugHYn`9-TvnP`n^1%U+GX3Rf*_ZD z-{B11?*ZOL_k#mLJI5(qr>u4wBTyaIv?rMN=+0RiP&d!3Paaq)Pma-SS3`KLO|D6Z z+|~)>>Vw$of9Guo6ZmFNv}4^Bx!u?0$SBwj%>D(WmUa72Un>UPdIAp5lq4yZlgt;L z%u6f(S*fZ-^{VE>dFd~v6hUxVn{Ppu0 z`dFKG&l|+>w-b1{5A*x|>$c%<@yiF!FsgJtW)uzlOBfMvY$JL4UO`7uw-qeo>0F!A zwwKN7{nT9J3f9Jra>j!0e-uD|UDev12BtmR*9Bkx&AbM%xV z)HhHG1^3%NbG$X)4R%Rg2q6*d;@z{^r%Z9HO2+e*Xj=1)auc~)LaDhFxs`T&WiBH| zRfDta{gxvzGiBtj%&KCe>`8{S4uQC#;dQG_tzCe0Br>k_6W42Kk=y0M^kk3U{$Fv| z+Zl9F9l^)F?l!5GX)k;vW77Sf472D!#kx_qhkRIFYfuZ0KXYajy*vb;&OOr@41fUm z&Cn>i8#A*OT=8_$nT3S2ezy-IA5F>FdY&%x?US9eHaztz?=HX_)B2j$KC3?JIDBhm zkylH!7sCREjDBG<99#sL!B|4_7UT{Nva`#uQyXx zN6aUS^%^Ykcf zkSy_F%#Bko~!Bwq*z0>(vsm~5qT_) zHjG3(CWb`fjQ5_L9`&heS=gy!i8s|m_$wL4L7xHuHA!hg>z)l!hwD^{4zki#0bQ7~ zdnit~`?+u4L%JjnY8Tl^^5g4%YWra&FdX`Ly1n?cSmVQjQmF;0{3yTy8gf_ciJ^Rh zh(LwO&PJCLjFZ|hYXGgrh&6O7Lh21XfQv`=M7d$TYcwJ9SYS&g?agXN*Qre{rynvfarg5}9X{3qRKOARO zAAB7KCmKAGc`NTrcT}Q zSs&$It(;yi-CY8@W6_pG@Kt`mE0&~_GnFt6+vLC)4lTz|xbnf}iyt00J1`iUyfHkR<_W8~z z9~&NJ!GWGNWe1qj16k$<7>(wDS+xn<%BBlV;Pg?ZTT#_^oXyp=Hi-4gim*%yY%}^7 zlbW3y8V^D(lf0u(=iu(ff-V1)DlHpcqeQSM4HO~qEngg$6W3{g_xqUKB8xitoC<7{ z!Bq}7XD4(FDg2K5O0(1KnY*Pjrzg1_$CU*Z9Znn8uCcmKqvFIxI#VFKW-Z?AgdYJ> zbafeNdo;QHtdhiGnX9GYpw>p>Pjzz9hcDObagL9TI8l8^LPC4}5R3nFm|>fTscYic-r z&3YSrq50K&t=Cy-k&femYkw=&90blc6usR3G5}5{y0XX@@*`M zm$YIP`&si7^C3&5ciRrK?|B*+Vxe0GQjMPM5F{d+a=5XIF$~U3QHQ+hS6j+I#Ho!i z5S~D+Tq$}H8|e5MWZI!!L-c{~o@fyJRXB-zQphrjFG)3dE7xjwvlus&eY2xx_O!iZ zYfFV}-lhJC-r6-xW-m{LUdDUQ{gka|e^@ziqsgLK!b3rtN4Z>ST~7c0HmyBuE>b|o zE55h$Y+L2wIQDYE?LoGfqe)0!s^FS6N3^4j@%t3=RQvK`)~*41&(#;Bp*^}^b0|{m zc4^B$T2^2+#d?r|G3@M54inq6_7&u!9pag_9?SI^W-0+7&x(zXmixQ7W&7e#a=}Re z2HMOk3%FMr2j<$JuM^o1JeNNDNA#B|3KVX@XpDCL5{|mKeMMf1S0^5AY_7Mb(J>QB`-p(bpQ# z^%UysAD(s<8a1{uwNVNJ?7PKfqwg=T@E@Qx^H6`#qppg`3c9@>o^tr2d`K|N!m|iW z(cyA)Kr^8oMSQrcu4AjTIxLXte!}?w4B@fJUSoP~X2t2gJG5CFsN+8khR^9a&qr|@ zvHo*K9P%N_cHXVivtP#o3qAbJ?)LGk~c!|7NwR8r6VR#`Jqt-P5MZ zBvshL+Y|#YXw5%vezG?E`lylPP+ zd)+kZR~mWGjvC7xbo)faQD@psvf!2U$dSbe;n(&%s zS`B3H_ll%#53D6F3fQJ%)2^!eiyIoyD8IYJe)%@`1Aoq;n?g^!A86Zlc^1B%CT8== zBOpP8>tdzQ{k4aP--21@|LM3y(60IX9sj{A;eMU4J6$F^nPQd6e|W|@1PK$m(d1gl zlysg-_dw${KU(UEYa+Q{&jH8-@`{5Vk>!r4xka`nq4IuPeb_etRE z$v_6a`i(NL^)*$WPsF|B#Z->n1AyoKm2M6=>7}a{ItxG(EY*1!ld5pACb1WGl&`^RB+XTv!YnF7`lZUu93?WZv{ z$A?xl%KCHOxehA3h4UPseTeY8c_HCdM>t;Z-fK->3xU&3c?8m8vg@5|~-8u^Ao zNcm@$qZ?!Od%Sde0_GZSxPdPzwOdHqvid;fB3GaqcLY~omoPzF!87m0H06yib4ooJtr6{nb`Vr1{pz<5IzNx!02C#3RHQPzHZ z`_-$+ZS<^{Zzf6}^OSbXzay{#0E(jhJpAVSDArT&gN?9(ZE9sVRUWcMa-JTYy4Lg? zca zMJ+7H2%FTk^^L(ux_nPeKVVZjntd;*ggkV2FNU2aq4dS(3qk<}zu}x`ns1`fUnh)iS0_7`QPG(17+vUlE#~S9jkpON8meLBX(`=tx78N54OMeuH7EiIFAJ%++If^ z`-;7>L@G;Nu}}3~j%jPUDcs_+!pltKiY9Tic$HHA;|eG){bZw}2O%Y;*3fbaY1pJ6>42!?)IZ#vA=LaR0AII;PZwNo5bQotp0GdX*!G2Qn)PL{YxMY5( zAkR4-LisiBv{YPd=|V{{0y&$$Xed7rPbX||Wq!^M0*bG|mIsMi-FrGyH+tz}k5WcU znVWu_LA>sM6D=GqB;lXLn=dn^j-n#hLwBcrhWBWm+c|{Xg>&}4+gd}Frr5b}>~qMO zc|T+CLu}bEt;w88kRmD3l+k3zd@2Di8ppA}x^%Nkea)8uElDt$W3^b5B78|p#a1h6 zVm{Te6shS?l(>Dc_WF|wAmOBG^P1%JZz zm;IxmYKN9KH~lfX=kTu1-&DrQnn38)#u0n{i<}S~n8@gVM7JJ7`%H;k&X?4ei7U12SR=*RYk%yR3=;Y)XYpjleUEzS)5b%tsh<9Mk~>7Bh<&r4 zZoAf_G)F#Vr+VJjKVvzXlAdVAp}y(+x$JdR7rP|oa;U&f z?VkcJ3NL{5Q0OEk;hlFc5Zu_J3G&lxf!)nj3=13Z*`oaO&^-8q;2D=#2xj{7lMrn4 zA3rDu-7M8L{&bim(D!x_l<+y#MhXtE~xt_DF<>@Q_IwWvF(B*tuCocU$3J%ltgBIR| zilwo(;Eof_+{^D90hOHtB7+1L(2-Y44R-ayy!arvP`nUf+^+3UIT>A`C>7{n0U9(u zzlsTUgE1(*M~z8Da-6}3G>8uVIM|MBw9gBr2sG4fBnlEB+j{^$uePK+1e3u-F1>KC zg>7Zgb4{~&EogD=b3V`I+CCY~y`SV<1-J>)N?4yJ|KMiUl_Ya;u^=%ItluqmlQxd@ zmb_7EIQl$MZ8J+ZKPsGM2?8CkD7wC7BMaRRY(Wd!-MNz#Z(AQG``kP_Z{WO!cF#TJ5Gc$%$ z096=AoaLwrNPgo#hD$)W4A=6VvyqkF<)0Sc{n=K;7$Y<{6G+T@+x!84+qD4n_fInO zK3$v<%)GbNoR*eNYic-?1r*N3Pgchs3dicx!+o|--KkxRXHm}cDZW_3$x=vOFqgRQ zvpBC2rmcw-?cEkDPwPc6P(o2Yn@cxpk+4Aolr zAZcrj%t$F%qkX=$8K!G=KCzVc>uUr#@`(?Z%y;6}ts36yZ9BiDXy&?gd4qDO(XX1D zq7I3(jQL7n=OY~54$&N2>oo+*WjP8G`N}QC9h%(3R^H29(6i6>jzz;uuZLfDm5+3r z?z($tNO-vMQT`)Kp%QRCd3!lHwL1St>gL5U(oaC)?_q$@=y*=Gz)paGN$PDVX6+!l7y0-f^4}%{v><3U2X-Zpfc4Or`GNVdbmb1s=_m)twMb@ep zZD$Jw%LScw2mo3s`g-&!x^vxk|~+uz((sxYChkj}oj&VUqt(AQ)(^{feaP!PrUR$8}wU`^()a@|wW-pts0F=5y=p4@er}IWd z@1cuB6q`dFa9sa%)LnpOCcWpnS(*nHZw@%5qzZIBQhQkhcCyO=wo4H@VE+aBg)a9x zs`aU@LvZBF3OOOK^!xGp?;67t!dat5`g6e)hjVq+=}dKWq;5MY46(r_ki~&a*+uu$ zBBnf+>?cnFFpM?ie%PucE_4$UXxY55z??UqI6)M>K~c9vJBSIVZA7O{S?31l_nG?Z z%|xr>HaI=M>%;_X;|Q)zd{3SzJaHoRP`iED^3YsKGyt++IX-w)=Kv`PK(z1C)+*(= zmi`@Gg1vZ}fPXd8xK#2cf8kfyP~=A;b&a1tGsK@&=h_{836tq7mc!4&gpc~BThT|~ z@xa8oEHXR9;-j^#GkH2T3s_0R;GqOj>o0jL#qVSq4JpMN#I*SN$NcE79NJ%5X=@2T z8O2H@utqm*93R?L@2Kd)CJ>>zGx|#e)^7`ZVfh?(j2fLYt^FT{6k{DnDD)3QzX5l3 zeO-!Ap9HlIaeKjy1ssL-JE8qW`>!|Pb)r*Im4slK4?Htq8d~O$1GHy>>^3N{s=}LU! z*3R?|4|qc{@#a3k^)G#(PP!+>+@=QGC_PZ8(XcV<+%0-s7IDo~9gegPiU6xm)9s*u z7Q6qFnGF=rW0Rk>rEnn%ryzYcnoMtnTC63wGVo_jp+V7rHgn{!>8;c>nmgl>l-fFJ0{eH1GYR|;=c4ngf*-=B@-uERhw0^&@R{#a{ZUs7j zu3;NA$m*-3?VvR2+`b+bx1!8GuV8i-NF;lOzYgPV>ITxv4!^zns4>}qqz4u{uKl+l6&L$ zG>u10%#(1-Zlo~B1G_U{-1m6T;O&^%7%H$2&0)1tv_G;0Q;txxA;S+9#L_-&+#Vty zmt9`E90)+M;nB-pqw3=LG*fL9=EV7%zE_H&3dGij1TA#*A1Ij0X}-fo|>EHR@>)*i(%^lJdd_v#Z*r zQAVwx+Y0f&mjrq^w3Q2Ds*Nbyp%>0r=k+5Ud8MvaRUJ;%t{_mWs8jg^l55%B*moVF zqeolvm(8+}VM)@qvoFM=Ed&3Y>GTY#m|=E)h~oO)|Ef+ml!cqFYht6TC#9OnRW3nj zW_i=DOWrpN-bEEHX23u!7D=cu;dwX<0~v>hJo|@4fC>Mt*_Y2 zouYVf70)z>=#}ZKH^*WHbcuD>No`(fc z_l_0Olp(BDYmuB;>V-+xOQN_y>x2W$AGoib6==kloj-+9%&&jlOo4ubmn0t?-8Ebw zcIP`iZyS>Lrap@VasTU)5PycqNO>YmruwYU;|R{GF1DMy(8+U`71&v3lx}(8k_`P+ z_asdc{w6IH9vTfd(W?A<#f(*ALLVFDBIV0PrC>r+(=rCt9cKAv-)vvADl*z|Q2npRok<;w9XFa$F1v^e z=Hco~M^xOvAVRbA)?R6%e2OVVLC2Z1VFY% zZo+=renij9J00K*YuF9dnOAv$4HQ)jA;5hb!q&M7-J&@kxGdhSC@>G`8(>i$K<913 zhzbp=nP_wCAQ`ayhV*Z`|(^}mW#=7B%Jm!B2%l_yRk?IRTtl(U-RU2Q^| zr648rO`&&wuUM2AHBZeG`6vN>xP~as-!dZg-bc=}4z+7k2w@RgY7+8&hd8PSkJg}T z6le(iCfX%rczn`dys&%${R7h+dpicSEaI%PQ!X>U(>poy$r)d+@uQ)qFUc4*Pw8F~ z8ni>FYlgg+*}T$89rG-A*Z%jkbGXzjHkqz_Ux9<5UXd89=G`x4VOj4f-P9U1ag%~& zW?*cugJ9+wsXxyqD*YE7&K>;fv&@o^5 z_&ZN2Q85_`ggtgrB!O_gdES?Q?}G@+fZZ&V>_y!atqK{J4TwO z>oL1s16x1pfU8`BEh5Q4B)^Vk1DXEf+ulgofigb5TphKcs6#9#XFgD z-WbZqOA4y%WlmgF%pJ zI_T<(Z{xruN%y+vWsJZbtS8##9pd)hT!J0bG2&A+G@V-W9$i{c-E&hEm{O?h5Qjco zxdPK(Yq1uC#29E{y#z4*Dxy}e#^*9clYbpYiTJoIf1{+9D%X-Li*Dt&6rHxJ2r(kt zkA3`fa3V}A)HG}Qjn)``VAJ1xz=+f%T!@HFr7M^ymC8g$)#V?8lQlFS=%44vT3KMWP%`+9 zXm7Wmn#%UAM$YZ94s~W`h-rK?`-JoRj804lN(d9!PPwVX2depFyMP&rzhLVrlltca zCT^-%7ra>M|Eck>ep&#FpDT@v*8NFGbk+W7s|cl*KbG?1qoE7G|I7SKr_pS)*7>cn zH_wokP3ndFIxxxCtizS#o45O5rR+)4t=pVREIl@J@9}$|d}R|76GQn50_c)XuBiH> z)`(Wzfh%K@=S-BL-9mM^%~SwEa~-MKAyW-H#h8(M>IKXe+aBe)ETK@r1M^2aP;?g; zhf5zLJ>WM$5XyfvHatn>vxwvZWd!7J32aQ`2l^#mfC1B++;CMuk?5DcXhx^STL7@( z=k;DJctl44MouP6E`4Lvxa+FB7Pj0KO1|3_OtLExLP49;zwA@jbTK!dUS@5kPYF9y z0)su)+6sYkh39JaX#lA8xYmDFzpGv6_ihL3W&w}noe#?Fg0)##ob52A<06Y!=Mpvs&DzMYPu6atp2he*83$L!NVPYqy3t>&}Pc24hrF zTS<_}gZBfOq#}4bjA`o{Q=GHrs~)A3m-KnUtujRNz_|Ro;HPwMo;#9t)F6Vo^_PGZ zb1Ymz@4POYIxv%bJV;l&S?qg*W^crQ=H2<%9T$|ZxssNpXQpMAe6tzfNeZ&6-f>rt zXOqx6OkTj1VF*G3Dh5f`5+gV7`)D~&>9YO}(ybnq$yj1+hE@fj1F3!rV^?@a#agry zo!Df+s&-e|`=KwbbGDScT>R90GZ*I8e?74ZD&4yM-BM~on;;3&34I!aZF91+3G^6- zG;3;^PpsB*$hlS&C+O(AfHB51anR|dMUwmWa1B2x?})e-5;O7YneiVHnKlJmb1eTf z=pT~*azC=ECD6p=?BkfMpd-(JV(ju9*_0nk6nj3H&NUo1PZ^o%*wp#zxTO0^pT43% zejL1dyV$|oP3Aa$wf(_y$Oj$YJniSEX^UdkT<&}^Mo4r-W#%`*dkXWD8Nsu*qlJA4SW1>3?T zw*>B?A#YTjCecvORE0xHo48J&15;` z1+u5vL)hxp@DwEoM*oI=Fu$Py;Ztd zbZcRBmW^D;Sr`)04^q}#Q&^{RK7T=WjoTxIDkUTv^`3gG>e{ANL@I*21Mr;<7i56v zR7db7cP#gjO$z`JRZYz+at@P$VNYES`$?}xMkcnZ0CBor6y~P5TuBZ^#sHjmd@x(- zUt}==t@xI`c6sd7=#p%eNZVU|ceqM9Y$bL8U!;B_MGN*uinBg140$zHO9?sJuUT}s z;=c>7Fqr|Y1V@Lc*V6NJNi;W{>vICP%pj`lu<5pg+jI zCk^l1w=XR)P(13`$he}_z>Hagek1?gVL9VW(MDVI;Z!vmgd=gnnnMdLK7Y-0?gGn=8=`!pAJ6TiCi%9CD zB~k30J)umElGKAsdh8xh{@$!hCgwaIP^j~Y9I_{Qqhc|o)LiPj#fHuvcu9_@#xQ-cFUqcB1U2s!Y(Gx017E%Z2iv6O{f)tC5{HvaZZ*!nY!T$mY)VWiUY+>it=}&dV=vL z+ExKDs86EurB-saIYadGuLM-MZ|p`w$FXVX+Y;5Zp2BIv_IOy~i`y=afqytEXqkN3 zu`vb_XS}&0x;(F=$qd^R8dSNtI%G_YQuh{S&xmJ#y=VyJwr}sXKcUZD>p#{NY*&y^ zz;IQJMRW!x0|zj}3;!8Ag!}iab)hVL<=%2q+*{E9P&F#?P=+u_M#|b#gZAo0zU<|U zNMoRY)fMHCdfoI!@YO@#aiyGRh%|1!XF`gxap<0~dC2}|IB|Brusa?whVc0OOQWc) zjNV#&rL_IaZc!86i)6QhYxIJv3!p>#_VwX(KBSDZYn-IyXy81u2J?7-A$_(S` z8MA`u{d9jy#*lV&Uz^!#mXKbo=JPJkmn{kgFcB`oQ2evLW=~NOR?h*psQ(#2A5a1n zR7`Z^SoK`2EdRBPB&8l9+N9{+{`5T1`a6$u#0nWrld3VZ6@6xgwWcnIk833cp_aQf zm%L#5>!@$vA<7VM0hSB@_kO%tJyhU(+IoL%RIX!DLG=?W<=)m3>i$vI@lweDz8r3n ze)R>OHts@$*Kc7@gSM|cF~TQeY+O8momlO(=%VJS&91UZl)ES+go5#`LDAzChs0_n z{!aI|(chJ)T(aIipFqmv>KRPsk0uf4$B6BZoy6w)aaRHfO_#?Bbmj zJ-2-ZWf>kX%GGlS)3oME9|HDnH)A+EEdZ}BWMrh3D7VV1tz!PT^e7hqLF0_ejLn^Sy1<&lq9m*0xaS-pT5&7kE4E*%yUr>w95Cy*$UmuK7+%o5z0{J8iS0A%U7b9&RO5S|(GonXp3hOp_#a!}Ma_~KpaBM;i z6Z2R=E3Z|}svRGyQUDwi`G$-Q2q7yK&Ba@&6Rk!9acxg^xIZ+Cltaw*#Kpogq)<>^ zeobD-^1K4S8Yj<)hOUFEXbz2~9B8duNYeURp4|ig0CrtGdS0VGvO0{_V2n&dA;I|S z-mqSCNz%ZAvh9-J@iO{-Ocurlr69O@7&MC7z9+rKF;gN${yH%Dk<#)IIHPes2N&A| zB&nzEYYL4zAYu#37qQ#uI1F|1F>Tt-3=@G~&Z*4lo&&6NO!nVi%VF?kCE!Er9;*dN zoMB;?2jMJszUMeOPlkf6_G%rn0B-4ESf=}d7>&|xFQ9(*X4lozfsea*D-n1P%^8OY zZ4qg?EN9>xgYUk%-%ya*wcN>D2*I%D9cBl!*v+lo4pVr6Ae(o}q#CA2O_z&on4-eK z%TUeY6>0?9V4x{+b2~Bee6AdaMDXO-V%=((U^W*J09qmyvWnY$KG`zDi<1#ivf#8u zg%;=c`^nj@KuB2@`oG>`OZ0MYfQ_GN@850`Z?}qm-wE%=$D(*iYUE8RNwDoDYRaU= zJwy-h!3kS?oenmH8)QSq@HTuX5oMO?iIXLa{oKFjTHfI@bqn7)sZF)XGP0N5l7i|Y zR~O{nzR=O&@!S!r<|}kW=r!+ z8TOt*l{}{QZve%f)IC>Tn+o66ySg1Ke9y;2wt4AOw1aKi=HVqR_M)9^uSkMc9QY|8 zP^bzS+yZRoE2ia6@bBYwj%cd-b@p;f6%OZw`FUSXLTIqGq{jH4pgo-NDqY-FyyUB2bzp^n-6?hbS<0Fy7e z-SYOby^2edb{uP=^z0CR*i$*UyIg?KG#&!HWE_4SBzvm%NaWD-i^C})9hqmFl+*6+ zA*J)pv84ALNzOxWx?vD;;tdbN9L0IIi1#|`#@6wiLe%Ys9F#qQ(>H zEWxhJrJl?%xz5Hrc~=z5pS;swJTB)r6$FI(_+6LBn^f)(-(K$Yv;7eX>y4Ko1e0jK2rpL^1C2m2{cRQ!O1kgD75YwoiyZoEu zsT-Fk%q3=`Do_9kncIDE?X{`z?P3IDjvtM;P&)1wR`BT634EI_)otPbXRMd-sZG7} zA-A5q#3#>ZSl~VeQeyiXoI9g#y7{b~_H`ptL{VnKPZ?&z=d^v8wgUzD;A_VxHCq`$edxc<>5852APwZe zCl*m-8|eDylf>#}4`_66ep{jJzuIceFj5a8SEfSM&_32^{GQjPJ}EDeRq=*npnav5 zP1U5;B>;jV@)_>q0u<=c7U9^dl`;g5Q4ZWZ%7n--VjF(P)7dQ!>z3Lonp(VD{^ii# zF2w{Nv_Zt2`RBa4C{W0?A)!1V%k+gmr8dpmAyq<$i5kxhem#;*JL#1)2UZj46Tnios=gT?^f(yC`Q&K*5 zd6BQbO8ONTxH`h-lu5_dq^3=|#2QQkXMX3o5ir|#q(GslQ5Wk858fDNWl^gK?`r!HUK{YpDMKT zU__^g-$t*A#ARElYWW?Y^P7}>1l}@mQb?(68l!4HKQkitgC&kBsvHvyY?L}?2YvmzAjb*P$n4)!}9YqSh?A$c@!Ok8WzynF>QbRJl>yQeO{x5$0 zWnvYLY91dcEPHMYm|(wZg#~tHaSvjbmDfCtF=td?9jiXz+>me3MM00kdkVl@8M6;R zypg?5i*aIALn8)AV{QQUY4eM;sXMR6%5kW=@Qs4=ESPX!UK1NsLU;U5^c)9U$P#<^ z@@Y#4s|9P>nvvzu-@d6p;WSxPHYsobj0^h*zwO%8G}J5>KQPSC^`g@^tAq*Pi?zY$ z_8(FpmX7$2W+4>9+Vb56C%;ybx3h{%nn|}O^}jZaEz-8|Z-x6MLS%>sUcpWWd2MI+ zp?xlcT>mQHhTxhr`@gu3`+Nr=L85%JpS!5nEyRQ@epTmR`f*17q^@z{;JM=uB-2zi zbIBrSbZ=$Lp`hZqvQ)zeyQ>T$EKAgXlw2C86D6E~m0RwGqclVulXWJq@!6Eb6Ff*w zw+*VRADP?|6(lW_3UFM~y;P=c ztl0!+3&DEISvQXn9!T;>t)-gZw>gD4UEh3urKbB#ewFG! zzwSiF{H1*iv=1$hK3d=GG6RASa6A-6Yq7Ph{OcnB zgF~#PB97pG83#v_vA^f>I_K8h5p|@Nzq-r|`k+WnV$x+ zHI=^fMp-|8SJI+IGJf>L=fo>>`M)fH$?>}&10tzeyp$t&=y+Ha5%?WV9Y>({e!jwg zm@)v(+$@SR5L|n-H38u6V)ElwTo1rJ?;!S|Ci&3@1xnF=9fscntLiV&$&xCtk3dC* z-kwuniamV$1YDE5H*5_VZYu$vHHhrdztydNN%goi%}j#<8$+=?>J;CO(hq>kf>AH0 zZ>goYX`$)%z)kHFbEgnMrP-cyPgzWKX_jhRr8rqp>?X6k2$R>h38^BN-?19RkZWcx zJmd6VB!-ea`8N-TS1gWs&}oqUm0|>SU9c~oW~oEo80(0AIc}yY`@o+Tl9-=WOeqIb zL>1_mpnwfy1BS3iy;rX@**q1}TCnyiv5K9BpJE2aPL2*V@=OJ4r6f6^=$D;@Hq)Eo z)OdljYc3)C{_OrRpP>045dNVk+6YwFb%oQwx5t!nOmDr@Rx$Gkh?t^`vJ{Et;!)+N z8?57@inZ*M;XBdq70h0u$k8?oSK*RC39bAL-0>15%xoZk(xB3uNSs~bGpcLAH+>vk zloaW33@^?VsTjg!;yG~WE#FbHwC6UzMO;fNkJ$zo*~YVR2ku*)N;i}nB~9aH_sNxR z$7LL^u+4w>nApP65Xoa5R@5bsY!LHxHcAGR>R==e-6dg6GM_@}mmou!NtBm`-qXXT zhi0ApVGhVA3ep_y)iy>0PvM8BfD^;>@@ChLD+MpCe*R0Q+Yqyh6|(<>?u?Tcx^KFBhTv;&2sc%V=9b+Bc~yf*ydj)T=KMO4dm$`_F|4{28L} zT7pmb1>?`Yyie~t^Nefd5L9Ftjx?S8k~>*}2?2dWf!11L>KO1g;XCepD~s=x%t2lG z%dHm@A%olT{tgIC2H=G*#Uw|6-yGWWvH6P~YL~eVQOsex|P| zrhZy0RfbpSSPuP+GMaqdxBi-#BakE}0?aKtN|K!8)*X44WB!Yh#!EURlDOM~*h;gX zJ|+f2;CT0&cp^GP&!y&miEge&j8=*od!I~ApkBz&SjWm@8Y`^=z*L?RvTCZ0^aM?Y zS3134kqphqCCQ@JxBV&Cq7mGyrY7pb6$UNlU_`Shh(rluDBqqE{`>N@eS_LFBxK+| z%%@-sn3x*rLY{?K8&nUh^V!&TSK>Y4T1|%Rr0HI!HqBoM9_&2^O|9!$RHH860Re^1 z^GZM%E|Gp^(k)=r;eOvBbasW0dX+5GBL(A|DB0NX7vLJM}t0Nb?2ma#Wx@A}0#j}8Fl&*` zxt4lgBCWO*z9kc0>*>;b(^_{f_MSoFqm%u@|D7Ibh69PxxMI)=4VHjGimpAIf z9qW>bFmxvPz_-XmOaaU%dYj8Vg`U=OvvM)oR$r?ZACC14aPble zEA!d03^Z-6$jlkZoDmELF`h091}tJu<0o3~ru>Q@^u@nC0IK&XyM*=m)|R6Cl%Wmw z*?$wd{=P6luiRe9jI$H|i~C9c_m)IBJSY+>H1Iy(hm$#n*xylG8Xw*X2m_1pejZ{` z=Dc}DWy{YF#{Du$S3&Ah*!z>J8$%k!9ZCqf9qfTHH4U|cz~jm!jiI%g;EQh$Hdd>P z_tR!#c|$9YGAZOT81QlMN4(tM=}X9XFn*Mzq?BonT-!H8TMqwcZhrVaQh0wVle$0! zV~sPWk2QU&Ml@V*J`9*E%3dSZ>p#R5a~J|0Ro_qac=@>1m!l_%K=X z>9EkLbwTsx>5yQ_EbP|i?t7DN*unffFMhKFKE3=mpfxIY+sVtBk8AfIF1@3}ud$h( zEUMZdwXIu^b&|QqFR*e(OHN}b;rP`%G)Iw%GhZxE{gcH{ql z3Ij0i)BTYO9Bz)%cCV0E{CzO|<<;&S1xe6LQl>yPBmPkCHri8j`26o`i*~>8QfZR{ z%CE_W-XVF^5w3IgnsiaADQ|%xh7^fNXf;!vgE+!>$JLO|SvaNIIS?%A`wG=zf`N0p z)XLubTDLB^g!{-Ck>7_|9pK`NplL9pnfs6zsqx~(PI4)s9h3P>9VF!1g3QJPZPcEC zgX?!8>qa-%S{%SIsi_h!VDHf$!T*mOZ&4QwacXW^>ozs-mX@z?`_}SgJlb}esiu9P zROV=7{WA9YK2k?5#PvFv7THslFF`oD{0M{&$CUOX0W@5~Xu!9G*dXH)qmpVSlZ)%&UdO}03@kPON2b~?h3 zAAm3T`!Lh#q~g?A@h!W``7M?PPU*+``Ha@+J0y7^H_SFsDn0v>>{tbiw8RPfoFk#C zj@>W>t#-x7HSqw|xdKdd-youyvrQ(ItB)i(Hn&W&Ka`qVZ!NM4;O|g~Q#K7OBm>Khz!$mI zO#9J4Wq#pjk>}aU0{i|V{$jU72&aP!M&GlX0Kf)o+sDT?e}zevQTvxU!T#s=Js&w( zt$&A{|BsIg{y_M2|4fWJ*~&-amu42{6P`po`}_#3DK)?T z6_|bu{tZ`CYLTkriS9QO zzK-r8Fm*`Xik?7Pb52ezo*YlK5V65^?koCnn@iR}FD9(fsATyxCyiP)e|0UsYCEj5 z^^naKLV_rpJQ2k-&t_6CqNPxnak?^f1!~}|v_@pZoBk2H96#=MHV(L*s87;dU<@Tr z-iRkG1_R7zO6GX|9hMuQ^_<=s;32qv3$6U6P6Dm+?YkHCbN&}(<`06rQ$7Lye07;} z612Z3(Ow(yuh7x|ci+bj&XwoIg3zz(J*Gp!yPLd*3Cr_0Rbp1=Rc~>=V7@@7LQPuY zU^H6s`tbboO#TmVD)#7py6_GZ2VV%g>dadld)zEB)hE`Uo|&%V2>wv|@HyfMXWx&J zIZL@BTdAV-tW<-^n#r3B`=Oc5WH$q#zCFxcyc?>ySgef3&guATa!%9hzV7RFE$=toz}I+Z$TSx^1;?D%qzuCIX}?!lMtr6(Wpuq> zsYEx8)xXt+#+NiKlw$t$OHVoJHrtyAGTWt>rTox~T2l70|9er9YUQCha;PO~>8`eN z`K$SYNH$DfOLGZEEx<%tpej!dhj$d(GlS33XFTm5YmahLCvkMn?C|Fv{3WW66i>In z`0IO8Iv4%=L;g%eBFk6!|3tn$8UFwNr%53&68x;vuPIkPu9YeRE;+|?-973E%S}v# z#Mk$@*1XL;d-?++i1y)v#yxA4vVC+w!gq^ctK_G%Hu3nYggD$d{l2zXacGDAz zjzf@f!rRHMeq(F(74(TRSxx0Zg7Nxq`%7O&{+f2TiNBZ~JI7j}T*zA989P>Ru=~%y zYRu#b>3@wi`t#yiP_5lF=c$WARrUi?5&9gk!OPxV1?Nfh5?PjqcY3<+PUO4V;AzEW z9dq$#6Jfd63o>q`N^2|Y>I6aL(d(m*_)1%3NP_;ii!z%`cY=eM_C4sD-aL2124_`& z9=|KSLgh^SfYpZU*w9lY@9lMg2q$^iwe21yd={TF|9#bIVOv%HBFP^1FX&nTsWD$Fn?DZ#1Wb>1RLz5&FE z;pjqv7{7!KcIOamurbru4@r2PB1qrmxCFT5n0)6)V}@Re5G(gKJv+%n<6pK`A0rWku(A~G+A)I znI&U%k)>z^Ay`_lXFCC`$$97pnDo=mr6ML;Ee>mV@&$p{@-vybvSL$!)|b|vc1W^$ zG@dm(cEXzMro8&9l)Y2_#96m%r_*$|ydV(Y2~rje-=N+-{!eVOU7no}cLR4qq* z+8`#$Or9bkM~WDa^lmn(n!4ZkfeP9e%Hu|{AMC3fz2<(NMRM+3ODH3=?=I+p z9qNAdm^{n}myFc<@;1}xZjl58|NJk@qu-}*O=P15=_))jnDcSE3@V7^yonw@oec@u|9%__DLy%L2j9||2u5{&Nt_#CT<(39mq>>>YLTHqPkX$H^wO=Z8ur4ZN3 z(zwtiaiY|F)yd37Us<$6Jf(Lx)I$+Ku)kWjFGq2AErgOFj#Uq84h9UjFS(!B5Mj0j z3q8G!J$els97noY{S9puJAgNT2#Y$dA(R4j?DTegbBzO24yC{cIMr^nQw-`@rtFHmZFPA8ijDN%8hJJ3@53{W^Ua&zi%0oKk;z zINolY-Uxkr^VI0Mpf^22Zyz5C-VCFv!hfH8;`RRj{lx`*vg!O0?%mPAtgg>k_PJm8 z+weX?>{mbl_9|3W&4T-NQ{i?xLHSpyN6)cN3p7=1(`0(O_?TBTIikQ;e&xN z84#_%l)IN@%6)$Lvv}GNJ!?xa>|x#R+u(*zRDf<=ju~Jda*7o2&#%*1Tu}?SCuQ3_ zVIB3eA9eEwCh$i^0<9z=mADCG*x7iLI0n-t(f5?!ab=S&@om3SQJ&J8BP0g5Ym|fk~|8s57NG`kaIsb{RY*K(!vbwI=%~M|a2gQ!d z?ov~_7d0Na>jtf%Z+0b~L5en?eOg;n2F||?HP*vyht??w_`RTiR1cgAMdgPzdzE7x z73=lHp06l_Bp~xp_ygWy4n$$rCrPsyN~FFfUfo-sPm+}KxeG)RUm$aO-POuO>&tDz ztb+*;&xIIYUqfi&T+|dK0VwVi^Dr6eOk8yDIFp7OVK8SiB3hNRrJTy~b^1c2 zwLaEwURfyS%~%s{?VX5cU#ZpVE>Z*B1STV*Dx6DbF|@nZKWB;l;xfEfMz+UG0Ci2- zL$QR=xxEpMm|%wbQ`de5MF#BmxF?J(jw@UG?B%6|1OJ`$+=34-I5!d=MoV`N!Y$R{ zTi7JBs_@#K(d-uxeTN$pWZc5N3J6^=26;NbwD7^f?r45<(yVPe8LU*1D^=V}mHB4J zG&J?Z`S9;H34-}5b-P!(muMlR!{>VQ!}9J5Vod1bH{K8{vSid;!ck(5n06Q=Ps&-E z5{fjGsBLvR*`%n}UzmTC+2Qi}Rqw5sFtIdZX*#a6S}QB%QZ;{l1wQDs?Kj zG@H!n0w-!uRzU7`{CVM0#CZ##Afny3F!85H^oYMcj-sL}9SaTJR50d|8k0ybBa>)J zCDvHD3FOslwsQe*(JHb^Gqu%|tg79$wYSW+A2^!XM4zWj=-bWJCw!2b?AS7+JR^0& z#T=uzx8l0gVI5`ldhC9c`}&;j?lALO4(OOW4%Yj=o-4ikNxe_f3rvm(N9+Kq)YCCr zd8@MrZVIgi#8CrM?Cia|x73Bmgo_*lLPl=lz8f;MFpgJw2co-;t;cQwSOJ&0paWjN z)OuKn#OBwmI2Hd+E`2+BF6`zx@IoCV;Ug!1_Kfvpi1KrLmZZnNuAUE`z}_T=new#2 zl0M7+qm+l69v27{uW>GlrPtZ3d{Q}44VomTGe2y8o*$VH!14Dp~FI%zU*`Toltdj4^T<*kXUtA){X0w^{l;f;Zf=guS`g4kRurbEfhiW3ip z*_#60h~GO$04TCTkX7o|DclZ~q(mdzg)=ck-hPwl?p zTG%$k(W?`LA3m=n@O@v@KiKfboU46n!vfCgbK=*ycMirs#ZxSa4Kx1`Tsrd0r7wJ> zug>!MO2$r?S(x=qSUP7CjG;bu&XMvOG%ikcVW(e56hmqjl|06h1?pOw@uxp2>vsm4 zE{3HmrUIXons5Kqj}k4ik{OPI;7j?QEcr4F%E(^j&F`gZYuC1=Vv;M~d>qz~B7k>w zznpw2j;BSBn>eRGZY-=jlMs?!(D%IY&zlkxy^%iScJn8ZNUhGmi;Jap<)Nu03!h$T zEo~|G_R(ItWb%~PPtz#IxYkCqo#1Xn0&Ca;ZkV7uJix8Cz1c|XwQ84Mb@Vh=!hgwg z@vn%sUP-t2&y{NMD6|~Xw7@KkB%6K6M1SUH=U&?74YZkTbrL*&X*H+eSsbjuYqNOv z3HitQ{}9>#(%Jw2pMmB_xbe{s$Y-zDtAqnk86N2u=Nd{D>;?hwxudC zOzA3E4ndNyUyBhk(C(JIos6u?Z3R$Pei$F618*KsvG@aG#9c()q>3d?GJiIG4X_6} z))hPmiSMNvLalYXjmB^dJ!Vd{x#b(DQ#B(wehkCk$%N5pn?)%Ck{HX`n zdjFA!v%uopcmYrs?p_~)qYIxYH|V8ITw*tW>B^tnELiGTxAZzg19!LMe0QvvV>9RC zS#b@Q4@k|)7ro4{>{scW;uzI4c&bf@Iu{z*YcH}7y#WG@=;fUWAskFj0=5R!FO8JX~M_9fv^pBY;E_collHb`|Q5{vX4WZXL?A} zc)rgwBQSQw`72Y`#NDx#edy!mWj%TeNRt0YWFO{v6JG4`Entu2GdW9*{1a>^bN5e~D_uh7w@bHt^2KTJe zit)3s2iL%iz?ULUvOKn9%widV)NQpH6n!3t)gdRz6p%^i}9?@_M#|NL&;g;2qtF`Nzb~-ce9)l}{@z(V!;nh5go*4Ns z9b=saKTtcnm#Xp>aLi}(xan}Ax|N&oYs%=$G5)>7zci5kQ(P=F%V7Za`sB7X**3cR zvij7|f`JB!w1xjL7jpe0{SvwpnF)||v8n~>xN2yMt@Xub@|bMd@6#quhaPRt$%L#P z>??i|*>pV9zBxA~?*rSkD5fQ>e}_+#B$SinDLwD7Ze@JN-qn+~B5KbzBu9*Sn7*aj zlZBAp`QRYlU7Hp{@+fNs@1BatTv5>BT!dIaJjRFoJi7R0|JG^i+HH9CeO&8@W4O~f z+X?9N20`?^=Ihzr-4Mo6hcsmFXr;MM&fjZRled27v42{V_pm6N>Eiru;dH_|4*5C0 zHL{5%;=_{dx@vU?Tod7Ed6Bw^#~UMR1;RNDEcCngNb+uE^eyfnGJ=8%6}0JYq*#rxTYPk1+^MS$I5yDm$5%h3Y069 z+LG^*qp4jWEQ4~D%f{RdY-Kp^6)Nq9XpaeQBSCO^p)Dj`$urU>`Pi|szm zSgF;@CvX~OF)$^^M*x*sv4qLD9r~@mHOg|}BxuwCfP9g$kqVq7Sh7wXg1+&z4K(0U zh*18huY}L&BK5F-6IhVeN}L+_9m{EmiSc>SA^k%gg7L((NLwT|8sj3`>iz@D(fGecx=}ft7pTkO?@r~HjlgGc`fyf zG|OqfLvy?zHYS92dvn^3x5H+SU?DlYLscp)DP$_r zUEJL~D?#orezf?1#9j0ky<<@6qa3zv>~eXBB5isFl|97%PVo0B}cXe zs|PN!a2APvL<6cniM`D`EOE# z+T;Vio|)LzjTtZ|9{%zHE7#)1QYWsuPz~jsb0VCO@hHH&_!5Z6A zV%z7J9(E?<+1DwXv1 z2gqT*+EmKTZ}ZBNi_g4sB_nzyNG*UFpxNp#?gakr$(WQz-mB2K#olg24`zQwwO{PK zF+VGvB4A7qU&^!EI^X+;cZ;xDu^ulhi}k@vaU-=n`LK0otlAcI`c0mV3=~~SC3&)G z)1!P)A9y`$lEmWAQH>z@>|ao>sbOn#UNHWxL`wOk%I@w|9zAWp^2rNE3ll& zAqA(Q+~{ywMqUMr3Ed*5W%X%uZuHOC=9XA~b3N&=R$0>p_LGq<0QC=Z(y=kh0`PdE zv!2_Mn>wtNC!gK(u11HE_iz~V=lIcB<5+%^P<{hvRqfIhQPG2a<d%YHIY2hRudz@&f z<K?Ea)uD+RDOLd#?cG#@<}^ll)BA&O&PE;YLcs>8_B9#@e=g`-dyWGRevTuEl?BDaUvk0?SyNA zhC1aFe`Us!%z9TeGeUo~Y_mO5I}llWk6uAO$ht+uj_uL_ zPR36sS({To9*vn4ujgzFFa&O>{fOD@Ai{i(_+cnoL`vDOC(mz1qMb7LKIDbfK6T(N zvNU8J4wYa-V)ecGsK-z+ zf4f_fqIgn${hk-nA02bk(Mgg~0^|Okn>XO!lf|0`rs{s=p-4YBA!KJ>iD?M7&+m+8 z%6^|EQ5O*SQL1Ro9ro|877t^@lK!)idw7-OUT3B{>=q3=Cr(}8VGo-a2)n`pejq_+ zu8^t0fz?4wA6@qXO&mboEoj3UvcJ?LUBC2wI2bw~3!DYe`Gxh$A$|E#U7TT=&K6Y> zf|ME-y@rKF$HPkm# z>VDxsa;Aq8tFrNSJv^|Rv?ki9AW1iPOlzP3Bg>jG!fA0@DFAi;n}fXD?JP)LCfX4) zR?ujfC;w=+1{?#NVB{< zXbkbc=X}SGk^A`-;B&GUf7yT^RdX~exafWU`SV9euj9t$fT<*{Vbt`nq1g@)1dL;k zNS*T9#+u0gg40+o>T}h57A?e>$6kEx!_Sf2Z%pj^KvInHenls8e{1RUm}wMWf9i2F zou3PeXU!JvMAhdi8{03w%6<605^iWwU{Du7@@SliB(W@XR6&fTkx^LGIsY%u_9gEn zfw!O9jGEPvH+3IR7W{$~N#0FO2Jex8ZTGvhq>Hl?0U z7xNaa4Mro9LU}IXyspXpW1TDjp}1^&W1(3mQ0kD{NNuk^IybgEUNB92xa?5a=ea}1 z^NWJVaKF;9-*%c!d&frZH5S)#@Chp$1c_y5f4b5iGayN8o0hDzV|0x<9p1XuIMYdg znqSDb#*CUSwhZ(1x}Z0shZHW4q(=!!Z1WF46&8v+xqgU0AcqzPXusF7U|m%FM7cw8 zkE=Fw_m?r&B}Sp)}|Ak!PvJKh62 zYGtC&9^{wqML|C{!A$rwMqXN}SOyX0_=~`7r#`q;s3&M|gsUw@L=7QrjYN%NzA-P1 z>dvZPdgmqBsHRZ(=?>ziufso}t)WG2Jw`KSB>lAvz>Gbv={X~xXTg6U41>)eRa;_C z!S|0fu??NGX2cU=$!yr5^V}G3nSt3gYcoI`!wp3!$Q_ySJgvQ{Od|44^ZaAL)mN0a zxOi>=vU@3%C=61veLo*@5Nn93_@rs7DQs$~Gfs@z_Iv|5o>#H)@`3mSzzP&1@LXV% z3Yv;CUQhSk`lB_k7SeAOB51>%a5Pf#dBbek;q8U)_wi-quWO*oLb8t=Q58XM@5ClR z%FA!7qzq8Vc7VfmzO=%9Ehcme-<=)PB8F&&Crr1Orcu#>!015br`up zq0!SZ1o@HCZ{=d&KVoBYq6bl7-LlDMb>(P1w~T4%^ydV(2ev)OMJlpC`wL$NUBd#f zWiCHa3sN35_?irA4fVnA#*c4Iu*E<3zd?`MezLNiTn1N-5$^dmS=jgIgtLwFogA#2 z?#+You8DsSJ{bAd1{D45>xS!XSCzKKV&tp*_dA)yZ<&G`5B}0dPd$PW?BM6}Vn%{5 zm_&EaYaCVV77r`pePtASqEnc%#eZ6)ken{YO-XY~gu3dn-g2y^jD>ZE3;a5|4s6<~jL3Q}Z~1T@zvM?b&mDr+IFGTC7TjPAI*S z2Wwk?`=YcNaniR+j2Lcxvzq)b>`;;S1hQSAZka4Bh3d`p>y7Lo^EOVOui>l7q)Tp# z50;kV``Dm*Py9X!z3YA*BQ*3Taty(IOn%#@769iHP?$d2Xi1r)eqWacoa67qF^bNM zeD^1>A@69+n;JSBZC6m^6U4BKe#BRvm-?z_54Y7NfX)W{t!?vj;XQ7r<(FIdhvFlxO}2)1SrM;LCi%nRQL^*fC16vIRqS7La&=Cr-HYrvzB8UN=|luFEnOaQ-Zn=GGi z>3H>8BZX)Fji*j|l(F(0Ht*AccCss9wf+G>uo%Ssd>0P98FUOXm=H0*gY4U?&WWkv zBAzXtB*%?gR1qO=`g4&dQrOf2xwe9@n%+7l@D=yt4Ay9zUM(UtuQF8|vtE%VFEMzA zz1W9eNU3p7S{tY;{48J3piWZ9G>JX;^kkb3A&6YULmI}y$~zX$l{lSil9@91GtnP7 zw&N#CD1qc79w^2~`jj8DUR|6x5}v+tlU$!qdiZ{D$pZ5)W;HpWvEruV91U{Lb$47I;ap-~ z0fgXQsReA31v>Zdy(=HE!&AIA95vwm7Xy79e8ySsVfL{HmUp+MR`gbUsxHbtT#L9= zPNh+%zot%B9oZ*6sp67Mjm|7p#7+OpH z&-K;PVueFaIazizdZ5V8_SNlvt2^a{+aqHh9=r~T*)^I%3Oj_=GXr5pt^}`ygw$(W zUbKgMqU(_-b|Q{Ke{}jtFHe;FV2ov?Ij3k|EI&(EYHtW-_f49}!TBV!<$*VGifaLL z);$v~TKDxbBR=o7nZ4-Gd0z%Tq8#rQ6K_NjV>f8Uk^1D0$LSk_+5*yg+0}mFe1cwN zzL*>Nd88|)V!!HcD)$~ujIYt?q9FI~Sl4vvC(k|FFvr>a=34>S=Jzm=p-<$xA+kbL=$PyvaQ%TGLQia59&Y3pv*-e%JTLj;is@c^L-rHc z_*i?eku^B7c>)bS(=2@cN%T<;a9(gQhk;;txEyUPj(x&WdF)=JfuMiKYgqyL3Z`Zc zLqd&^YbhIaV`CXR<@2jrmA}t>(Hj#82~CGsD=xt>_9@vD&Q8NAY*kNdWzrUSm6J(^g%n{9WW zQiVZCv7>>^AgheU=gUSD)F*C-W99fsQ%)|J)~fa8YdMX2HUtc?;+_gO?UZb_5Y}DZ z?n*vxlYHx-^7#w5nbyPHf?rP(?_iuRhH<#}d>gI50VOdmv$7V>{mv$R#GS6cP>OAZ zw$AsB5HF)NE$Dqu! zLn>cX3%=}70#XiYwHQ8OLQT=HHuyCuxAf@S_OU{BoZmy26rStk@co%ttb(&-D`yN- z(|6M2zDRjIWDQ#m01}6tC2*;tGpptkxU?yljeiy5VKc509ptQL zL3#xdPmSC^?s^^j6hv9atkE=*h zaZ`y!eNJq?R336i|4h#KjDoSNKJb3ivkivThJ8=#rNfHyyW|#Z)t{t7jB5{bR!6G_?nYZ?z8*#c4zlz*v* z&KoJ~(eAr}5)j+WnnANP^B`qOF-Ovxw1F9PJ(W%p)wvr(*Wd{eLJ%!eb_RixznMH@)3Fp=12KmB{|3yY}R_#=j2d2wZ% zx_ogPcU(1_qk$soEHJ0JZ?)F;bUTPRBuX7{G`15CR1|GAwXlhkK zA@=@iQX`R%KS`#yXOQl`4CI9a@H~*bK`S=FFPYisU}ol^PP{%Z!}+B*1k=yZ)Lit- z%;>)s9!d4WKS0-`Y|8h^YIU+UX(tknyE)n|R8L#*iTzbzl+-%i=tJG8dx1vX$Xt*% zem~&$$|J&G6!T`Yr?~S3%4KJ~CN$rXMBd+b&~3Bjgv;)I7cLow$*)JB&Oi z_tNVFX8WMP99z~Wd`6Q_vhdOcg(v&AB5YWp>|vZ=N5A}eolP!*n$6qzE_1H++)w8~ zz-<#&0!w8*3S-gM6`#6|KSYCKy8_WbQo^zxfzp*n#9 zdf{ma*^U$1hI@if0^i_6-rd=Swa*pU)DSuwr9KnnwxYO|$XnfVRI<0WrB^4r%#8cc z!~7J5sciwIpCt?M9)q91q9mVHCXH;zj2PTb96?h$si#-qXKyhPt}rvA6H}L?NxjEqQZ@-a#LfG@OFTb-^bHL>$I14 zV)4p6K(5nfK%tR_L&$CWsbZDQqOFwIY|r-&r=FLLO`Tf~4KuCO^8jiEs^3F{ zy~}1m__$%bUTucbnk@`j4Ew1IC=>LHr%eSkYh}~U5s^FU)R~Wg!74bdlz$bwO`ue^>#385+eOhmRTJeVhGsy z2rP3a_&V##<7&pLW9m;ZH_>N3h!Bdkg0F|7sXdd9F%Ux};(aoAu@sFhAZo{PO>x)& z6*94U^M7SvuRp{zW|t%5%(*o)piRJFa4U54$t2+qj>?BwB$)1oC4M_Rj&e#<&F|_= z(1r2>7vytS)qnV-^fjj~3@g=Uy|@{s@zy2=eNlkyEMoHcki|9lMe?A72tu3sp|CO&Cm$JwmAu$19vc(0= z$`J{ME+bo*)PB0$OmC^euIU6Y8KD^AIkl+4c?LaQ{ghYc-p4%BsN$fKb*+if0}h%}#~{`F`N3)cP-cuG$>&ACZfHWoTT8@E<~<`1(0DKh_Z9c7G7hXg3b zqip`{+hmT##2lB}r7@E)w^y%dYda?az|1PvT@BdF^auu$r|rA0UBv8lPwjd7k6Ylg z|2!nyV1HG<(&rAB!nmTp0C8jJd_Kx84&>Q(wi`}JSTd=-fi4D%6U1CL4il;K$5)jD zb|Aq|{PT`5Eb^-rv>SE*lTLFzC%o7xR%1@&&a@U;zfzOmm0T{3+@1C|;%h7q?joV8 zM?67feoUv>cF#UiqzDgOb8~sSLXXkv$kerd`JI&dzn;dt9mN0Ih!W4(CHZ#ma2yhf zcz?Yy1b2wso9w`=!#wC5|LbOmy31O@ZnaoPVMRTxxXJ}2TH*TsE5n?RQon+p8>uCpCBA)b)V6MW z!!uqIanliN_}`S8i?r8!7nU-bYE0ebE1m#fGuX$h*SvuAWo46@E(n3+r~hgpYyY4h z-m(L9{pooOoVDk5RMquwf8}@KRX=+($fP@T4?&OD_488+Ge9^3{__nUt>^K=pTMh; zj1-v19)Ef;{$_IFtK9l!9*s*zL+o+u1wqAr&*wz008!kMKd;$sB*leF*(Q?ldY7Ed zQi~(y{u0G7l#T=!4h^NVVxX7siuz2RS6p;# zWozr7FO3AGpf&hE%=LJ@sfWO!_Da0x6oCj_ZRI}w{!QGqnwfeIApQ_<8aUu2wc&&3 zogSW<9h%*op~?}`m>-hCq{qmpSpRL-o9nZz>PXnR<;vER zG?@5hAWt1I|9uPoLKtrb?f(VkiSZV-+WEk(*gU)NaP{u6C{OoFCD6x+4pV|ZvJd_P zMwGB$$r^f*+k%~|a4s}+ec}(mrN_^_SI4;%3{O?9Cv(8F3J65F5CYk!D%%n|-!;43 zgKPUZ5zM?TbR$9*o<2x)xbJ922GbvV+Wa9nFnur`q`v10u_#eizxgnM#3ny}9S4T7*JYU~kare&-o4WWs*V*EK zsui%n!h=K(fy8nH23vL;cdRKkvY**z`2fzXCUY2rY^L-4>u=* z=KsE44zy+YUOYY0H*(^)_QY=~p{nI|^)Jrf_kC%ta;Bu#l`lnv)^CIP^(oY9&>!Nf z`XKK?lPR$Mzx^)XVUCvdqav0AbX6G&{y*glAZ7D^l`nLL%R1PN)lTdj%i4oqEy|^A zEgXM#4d`BcNb!$xa*r%J*-*Z7+43LULi^985@lIxW7xS8NM<$zW+UWh6hN(bT%NiA zsxjA%wj~eGD)Cnp%8?ZG|IfA2^n4eR6= zcB4+TKOTqikt;T7&;te@QvZ2yEQUT!*5<-Mu@L4Tjut&zM^9F$Li!%Xmy*GhKoz6P z;_B2!c=v!Qaa0jB1FBny6;1WqHl0h*p!MwO4E4*o8OcX&-(|yIm3{oj;TyiLCDtM4 zW)0rI66EB<<2}PYqEarKwPY5F(>Sg2(;eL9rWkt(t@jh$(NgTZ5dMZ;6B0nZD~zMx z&;Jqn_*f+ymn%Ms-}o0z)h7E6{P}NuTH56B5D<3Y5z}~ve5;B?%ipYsb|Enp6s9@b zT4HXb%<(xz#Z715;UFcq)z7L|NEH3F{=6<*)&6Du?j@+($4Lx3pDa^h4J2}GU8&tO zIFRe?*nS6)iX5~ye$OpL)?A8J*N!@zV=ojbq$%4$>K78#6og$p3z9>EUvpP!tzdRT zWfwC-(B|~dMmYzYSa+^}3E=GF=JO}{-+d6%xzz^xoz8IuqWe_)0o_AelI5z8wY9v` zRLDD3yLhkSK2uD$SZt*wWBgE&P(LG7N!xNQpx0)hs#z54Xd!#1K7_q4DmhvWQNgoy zetM2;;+GE}%GJ-8)t6tW7KlDIP$IWJBYvaA>R^IEDMwlPVo3U(6|*`C{7}{9VT}OI z&YE>?i(eSI)!C@?ce2X~NlT{mx_{Y8GiU%{#s%v`WIn_GB;rgGc>++!9tt^dcW=Ql za_?HLKCgshu6sfMl{cBkLnVjz=-l;R2wmH$yP*vPbJ%%<2VI~o9;lw=4x3+ZmQPe8 zxz(7jwk0tG%kFWt(Su&?z5pUnc`VODfqJYGD&d-2mkoG5c*UhvPnC%|XxUh6CP+xP z+2ItwnG{sF=T0saDz`ArdD zj`L;j3&**+vJ_jZXK7e+dLLB~B>4=znCCs6dLH}BB@q!TqlM((vgf3Bd^e=D%!dzH z#;B(Z>7a^va~mP;e?JQ-G4@YHI7m%VS+7D(z;Nw%)?f9U-ohrw5lgVxZafk{Oro2| zcuw8-Wc+ZK(pUsE!dJ4N);Mns`=Q*&2A{^C!5h{M*Yt%QOdno8SG$0E(o!&%5mp=H z_F2qLoD$4NE-&?&KCgZ2#a+N|_|3hhU1AC>NQ2qb?$YGS{PB}TE23hZ4#emuW+{j& zpxh*)d=uTyn$`72+$Pt#<1ZN!U87rXf9AV7KwN;RgUxvS6~*hYOlZ>apH+{fbL#2L zU&(IsHvhumHsb@FhE=lq^^_h|_fQArRedh|^r7O}XopARdEv%5I$GTYx;8__x}@@D z0#rfWEi*EGeathooqI#tdV=)tT}U0L zs!G(xIQ|+gI^g%oQ5!CIdb^G#L$M$1s)t<+i%^w7etI)}hTYVM-%YYBOW!oUlvpz0 zBB(S_CJM3w!U(1UkjDZW=6I?N5XFFb%#v?1aury_91V^6UfLMExxF>^F|2`l<-kxlkYnsl!|xwIH*l`EVT{4tDjm`ni)g;X|cnLC3-=j!Zw zsFjLq=E>EgmvUqoGSPRo>z|ssGRgv(zTYi#W!|P4a9Kd$0NK}gZ<$dZsEe#s5y_RE zy z8kuEsyW%-AzH=i)>-a}H4Cn0?zReqxde-Zn>5-~iaqLH)SyS-MP4Nk=|Kx-;R$T1? z`Iq)3_jtEgEv9G9V52u<;t278X?wN9)NPddEB-{-#;wuL@FHb=+Ca42)ZITX0#^N} z{R(&18gr@&*^x7=i}^yk4>Mz%ZbWR}2>=cu)U27L49Y%Rh0PFwqsB9#WOA%VR5vMI zj2_yIRo){Huv*d*7UxBj9DeLEG74h@m{W_YMp&T+@>Y>|<5JA!)S2`4R++}0P4nYe zC0F16MCBfD--X;T3EWB>*c|bFV?Aj@@Ub+U`dgJU@&q6=t z%|5&1T*<$*PS};;&Vxu)Lw`z3L<*qd4T0s8i9W!^>7fHzMgGBp`u)NZce1~Hs&_#W z?ixVdEIt}O$Z?3JEX~`xygC=w<33b$%m1|{p2ljvy=!-$JB$ZZE24v0WSV{@vHI(VCw z2`2gUkr1;q?#91PZ$=vTd$+Wdw{R9Rf8Zp)2_mEs&!}}mWuRAWr*HpZMA@@Z5%g@o z!T`p={^;4ZhA#%qo!?7teZlSMTT<)`1NL!y^4eMGr8T6V>3$w=CumU;xiOMb@dd>H zm|4EYjA>88Lgq^ro%Z?z6cF?Fd+*zMj(Sg$V-~SU8gU?)eeUf`e^tp7jlq7>?6eKk zE^(2x->z(*j_!O5vH@=u^POBwMK= zfYlfXX5#VpfY1lz6%aor5RW7NQiW?gzYE3*M+1+lc7JFND&GAvn-rPdw)sm< zj+QzKENXK5cDa&{^~{;vPs0CoJ@<8DTBn%>;9A7aN=?=6;)B6n*@fD3D4t3V7BJ$i zFstqkhnsKEl}XHEskLhwX?9&O)&Yq*?0F|ktp-(E{=?UIzDgOvz%_166p8FSUluQt z%w0tVFuv4`G2Aj-{pO4O*wKC$|L&y}L0lN1{h{eUkoqul*IF`W5w!QWMmuM#U-BlR zGQQt?_9d%$hs%$f=QWy0Z-jqdAMl)5B*!*RIZZ3nhZWRJF@7yh>@BTjy8c+4A5~QL zmNUzGVd%r&;H&EFlbdp~;zE&fVMP=~tnq?I*291xUwK<3p^XtfkW)km9@5jFGWCef zEEA7fTGVrsMMl_7TV##|`JWt5UL5wPCFp0sr}V{pHsZ@Lc-J1A>vLJxb1oDKy_(Ge z^eq>5&~snR7N=AGLxaC+l1g|HN8$x|X>5b`CV_BV!>u=goG9Z-P$(cyZ~5eGwNGz}})^Bv82J1fIOz9%lZUNZmFs4%i~MsThsCl8$AJcm59YUIoYrY7j!m0U{7q{X1~aJ zdTYwt@Az^+LDe0XwK9I;*ECA_iP|xK zdNIkf1VNI!AH0xpDVTB~5Iv#W?k->xb9V zB2egVlQJ`Vac@W2>a5?Wwz1g}e)ik^e~sQ6-(jK3hc6tTE1>EHLRhK2Hj*3mk^j@;kU7DAI$ZO4w=Y^FBuWjtO1 zf2K3J>)m}@*LGv}^_wL3XZN8$qdZ(|7vB#|GtVl{q>kWrmvNeINc@@~6l1o_X7C0( zHP6P0Q?K#b-M04iJ4+3;8qa@x4h%6YCvazz2a>SCAE*iB7vt0<|2)zY=ihuYD&_nY z5{R&)U4L&jcI8|4u3-550Veyev8E;^_+3H?|D=bH8^?jqr88>fuKe?a=K}%zZOF`F ztbzm0ZZW^j&DB`Q@tsncxo|BhhZw(4R!1=6FJA!bLg%CM z(37ReVm9zvKl(NMg6aK9deDB_jAjgkXXC?q>*`w9>$h#+$ulL15!JW#qu-!DJ-X-h z5m_8Z8o-C&5#J=St3Hkg9uD3&pW})TQ;Fym*4yTJL?TByXWFd&bWjFFdku9ShB+|% z5aR{mbqxJaKle6Oq<@qdQ9d}(>bD*laVcckU`!gNu#`mG(N;#);(-Jc}>mx10QZ%{5$D_1oV0bW2J!5VT~vS z#*x~#HUnE)IW&>fOE;w#vrEJ z#%78%`CI45(h{3BT@fn^A`RqDj^;wX^D!Q)YfCaosw5>{Z4V}l!MmVyVI#21?&!N7;;4z3=^AU3xu2kX@19(#Y^z{n>ix;Bw5i zjZQjurP3Nuq*l0X4$ybG?$jJ~1BQLQ-sKIVXon?d?ha%C*RMt&?FQT2wf0-|`1h?p<8$}$rsT`(XnLwJZUdTM!%}eaD2(Xx5y&8aA z6HArwOu1cI=Qn-nFbDzc@a_7**I!PmhTM_Y)N%-81O(#EPw9o@dm4##>A60QE7=}B zwchjI{Q~ElWzPf`n(kaIKAwn-f7dT!MK^RDjfOA!OeDc-W3lX$x z({<_E$vK;wRVNNUHk`z@?_7heZN=azxuW5#j6Xhw=PTdepcBINAtGh1_f`%QhDLwW zADNr5_Rozu3eC=Cn*>Qy@%a=DmB=-8RA4*hPotr|qOC-A*|@G6^7jw!7e_8j^+P&6 zHbcW*IY#UH^WJteewd{!nfcV_JV!crXW<^a+%sCQk{iw;-~W4{mESpb((hzeNH)2Z zAKHV`=`5L(WUI^Z6{DJM{@JnXIm|Zks;Ats@1SueQeK5KJ6=-C+GxNBVCj>4=E+I( zpN_eD9+Sb3MiwymVzK`!X$bY`9@?hCfag~Iu(Pj5Hfv{3{-2tMpq{iJsXWEAle7?M#5TOy!11c}Qi%C-}Y8H!Pl ziwTca8ELYB6}sjs5*mA6_mQ9oF7)S0?jaOI$Cg_ev{NUy;S~>)EAAQ2_%1tX7oH=a zOJGD$v5l(7NPvm6=i(mpgccalqX>LFDv#P{@@On!0^?XPe?2*7Kn08uT>Bf7bBJlH ztPQ)#iS@)6hw39vqSP&O#<9aH8FL?*SapusDEdCZ0Dm_#b#2AkR-G=# z`?PezyQ|Yy`;_rAB0gW&lYYT1T$C1HEVbFLY(s*0MF=-^>?RTMj@iVrPk zUTh(hmeusQvF7B@m#ED~#Lwk3n@>KCWL%Oz>}cs17bX|$;z?c*l`~u|Gdiq451HbB z49NK~`g8WN;3Hn11N*xh1+Pr6c_BH|I)CRD9C$k{xcUUG50L}9`Q)!Go|G<2B$zAz zO~%-=FjE^mxPL8=(_FOBF6;d5n`pKd{k6M3k=P^mVC_Y(fs^ZUYz7h9SPJuq_ z1o$MYS4>Js%UyA>P0CUzv8TjzY0q6Tp_OY!&S;g%%A0v{Zq<>*dMZyHuU`u!UUo|^ zdHC<%k?Ixte!dTZ>()h*$#2UdR^F1ue~C#Ze>_3`R@lKd=d7KT8Xa4iOH9wrkPAV` z2DOp(2*g=I&bz=;#4X5~ZdPTxh*?Z$Alh$5Qv!es*}QuD4L02p+!<@vN4n0^2pdbl zN&0veiVfipI2TTL1Ew?2S(gV$(8Y`QkmBlipuBS=Rpxf8S&j&lSm6nF^z31r zW`_!im|A&rNM%82!-YSzA=I_UEwgr(+!gMVq>}j;B;Da`lZkMq&FDOUmbUY=xaxKb zcMuVWXFqF17ujC}edKl7$M@L{p?`Q#2R;;N5)vR5CB{Ki3az^1Z*^+&6TQYgC<})_IFV;YT=#x&F%cfA$~kPuu%WYND+R?8 zZOMA$5llpDSxMvfM!dwXh2OYA zmR#r|J6nBFd6D-68t0DolzL8QMDTry(6#vUd{UXh=J<%Op?)U^C^tnV(?zI|s(CJ+ zF=P1Gt!x!d<5UxMZ;05|q1T)}p~+jiTZ1}P?@DV_^pYoi1`S3hX9xSR9r<*m%+nMrQQ5Xn8=Luz`t6b$u@-T{P=Mg(1~ zWiE{eZqV%cw1uzfsMZf{&~bYX%IGdSgFc9|iEag23|E?Y?iTxX-sg=x95{h^M3U+S zlG@X-%@mwe2=ft8TwDtTqKs~bfkFevghu5Tf$XjUUHJ_{v02MyzyQ-6{G zkoT;)2y#3Q)TSf>Yg zNuH2_>Jr3X$@ToB(h3su1k*w2BN$_`=&ianOyI0p3mF1mzM%!fNyFBv_)bczvMyhw zBSI}DF0wHpD&EoT;;PNv8$Y}FTKtTENpv4w)yeTGp;GZ&mnS5|ze-~b3T$3}vD$W2 z@4%6;NZV8LS@vwBm88dNSYki4&2y2IU{vneNj%}k#y*u-metmaievell#WNXu24j* z+ZL7q*2OoU;c@3vZ!FEt(BY6AxOiXqEc1A?fT+n)52N~H^GQB@3ZyS0{aD71bN!pV z9v)~*U-MK2KOQs;1J9_0+Ayzt(~*?}A_9l;R@bFR_s{UjSt?dyIXfdocS(e7V|E*s zzd4kM+qt=J91@jft#3$X;9Ef~6AZ97NeI^SHOaoNtDO?}u(&44OAfJaSg}8#?66VX z)4#0`hT`2ahu>E3WiHml3x-_bGr>kMt7JGGT##4ad%$NU8S}5b?Vetkc8e^l4j#&u z9nUMFSuO2e)bI5MKOn9$*)Oi-m$EG@$Uv+>M~K4|_w9fSosoDCVwJ4PsgkWJg2&zo0XEEVtEiF5V%sL6`=RP4Gb` za*E!46woB6EpIC(9C=1WLdh$H`hrb8}~YN)Kbj_xC~2Y z6MwcLhI9M|-K60z;tw>7@iHP9T#G$Xib@53j5Nr~AJ)fBTos0I*5#lW*QE&KfOlIBx zi^=S#>DvVY+G0j=@ZrS`a+>tY#g3{N3Nj+VZ*Q?Ic|T@s^)z3Dy%6h;35m|=lDv4JB*wIAw?hp>zGx=H1iPu4B7y9d19C>k&_0fj<&4#~$wZ5ffBbnKyIh|$+;9G{amY9xu%jIGR3;Bug=#5!Yn z2y=tu_(uMlmb{~n5+p|2U{|=>YMMQS!XfvhM-O%e!&=*p1w)}Q zyFFP<@W$a3Ng|frj{@*}Jp7e)ifQp6gd;Cx&0=HwC0NCpvhS|Sn%*R7-rwwRGXu7z z_dx|ZRAtYMu4=Xx5BS3kr#M2nnU-Y;RBk~*wD#g+T4tRGsJ#z#O`Oc#ZqZgMDOBXL z{49`PHzd217OLKz!I^G~>h0IxPaxdSgu8Pnrf8AZ`uxGXxXTOD0$c;9g z{Zo@BAafE0H^%4E6QbNMH4vF@rv1U1p2seEz)m8b5p5QYPMPMbmVUzvNeP!2HZ`zl zWh*czrjUH6Ggr`T6#tQ(T$1orzL=zFaSTFQCrOY^&2a-bs>nX*8ft;JSV8Xc7dDqm0{ppPR_^QWWzhrU-sj#XAv^=Lu_JK6;lP`60uBJuScQ^1Gip zz>ve7eSlh9dj~?ZLbD_&s6F^OiK(m$B5a!To&I#_j|L(XJ4x`*RWp9PvfQXtp zzehur@7M1SWkz|@#XB+JV%oZE*rBoVw0%OOg24zoQYST@R^p^HM`Vyi3eieG!C%w^U#UOvjSWfnE zuhakQ9-AiY@YBUlWMxA=b0jr#uLUMX{7n;r^u_eZExROKmRb)+jdX_o1)TkgV27BG zV-K7qEuVT%1|7z}aequxXf{*?q5DWd?{t1~C%2-qzmq$-VUq2b?#t3@OV!J*e*W%s}3o=a0>nkdQy zni=)T%sE@-0>s14BT(VT-Ozwmbj4`T&hG_g1rX(&XUb%ELy)6fk|+(axjOF;RveE% zYwkAQthz10ij$)IoNZ+&nA?f(*C(UNDB&qy2;>#X}cy8nxi{-7V+i~J9Dgj6L35DLiSbaA2`uF_eW@W|{_9+-9!gLp-36M}-#531)no*xJGDUK zsX}Oz?L@?gUh`6m6JkF-z77v#aA)sQ!Pdf)#cvb&G)$NsMJ;8x167$o{Z~KKQ%bZl z+g0TzHqYPxqn+ujGz7o>9eh+gHgd4Is5*I0gI(te%@`fI+y>~2R95;IlVxK1;YgVvc8SDZezCn&1DMC;K{IW+ILJJEZ zZ#FknmmzMZ4vJQ|;993!hi2g>&q%}9P@U%x9lh95!LdNU$)6jJTI>yTyO(+bvHf8J zD=Km9v5Y>JJ^j%q;Av?Z&$8$;Ynn6-o#zS)&pWR08vdC4T7|QGv%{I{C})-zRg~%Y zieI>h7zO>s2>c{=tgOTT_R2ke<6CzrNAM1V0~r=W3#3bWoNzy-gAo~Z_L@MPoC7wr z(m_+X!KHt{tdP&>$c1hJCIf3eVixRsoWWBnt~XRgdF-;!B_CQm&hJmx_sk* z_!#DWh3d%zr5O$(4t2ADW>trnW{Fv$xYvkH!~ON&tiJnEol{Ht^bE=YXeSGFipYR9 z@MPEe^VbjQt_`#;nJ;Hvv}_fMl(#p{#%CSQ(*l(n)P2*`KUfNzFXv_$cE_xoSZ7uG zOVmyk#tWEONIA7^4JL~?ed!o14lcRLhaIxMZK$^0d|No$!cW3JYiPF9)0!gPx)zvZ z_vMj9?RS4}M4td(z5~7_7xPV)vS25n@&EGufO0`ceGmD@)MWv*%$nNz~v7u)ydHmS@Zxa3Ng~EAH+*Yiai?VIpc(kP#2>P) zylPPe4$C#N9h})M^ww|L(z$L~mA2J!OP}G(mH%=5|DP{xJ^KCqGA*Na-agk|uUr0- zQ99h!K$l>-{Y2eIcC<$C2EH45J--)~{QJIy;g7Q20u~J$5s}~#S$Xrhk6QVipT>wS zYlXfhZ>G;f8v)H0okh`w-ov0$6`rIfTHaE6b(gW&WHpPX`Z8AWodI__n6;lv{n$94 z(0KSO%IQSU-+2UcwOOfotH`tmqPUm7oy(77>%>c2#{fs|h!Xd!M^GWWwSK%v`}g1D zmJjEZeKYF~`~(f?c~aj8lf8YR>a_I&I%gZM+=}0_HI~$qreBsw& zd0lRci%*q)oDSuZ(mYe9kv%qAD~eL6e`G*E$4&Vo+Sqwt&t0dPtB6>xZ(+Md-al;+ zKo?oJiTh#6&M0yVo0AGc3!_?l<7LZvNzEpEOe^^qIlk()5QgG9y z#MWBHK-^#HQ4(JBXXbJPFXmh}n_rvM-WgA#B5R?qercp$;7?=e-?$^!e{AJU!*n=0 z4Yd__O*8vh7?W1h(>1Mr!#;tFT`6eIug*xd#Tvzs_N`g$Sqs|)Ptd&P7iYw#Ru!9= z`1d*AYo!1E_uAjO&cV%_%IT(hYFB9gdsNsU&B^zqNbTZ%;>K;4E2HOPI+M6TfgfkY zvb20`QcABk?Yv2Op9ahjKd|K-PudY1hNcsmP0lS_QRS;#F1=*lYre31=(IgQqW9UG z_a4hd^OS|&<2|W+r9*(G@nk6w9_h2D4;zcc_Xzd4w?jH+%e;JBca%j(ut^+*g=4Aj z?o>mSqvHZcq1ZDl41E5ucLr(&J@eIHD>m*gz>fKkCn2Q~@qqv7(EmS+{(<%Zn4 zZ9dmyZKdd>(pgU`hauF&=KNo__d5fUJZa=@(|vcb)}M0w)gh^>@r(`(GXPPjR50iLbw{Ma<{qY&NZGGcY~pfj$V^9e|+jw9Gu z!xgdBRvh;^(VYhL6qY8GH&Zbjn>>>Ap;@_scRN{id;9Pa!`z#eEkE^a(Svs z8D8AN8b974n)EdZmndd69x)fxY^P3+=k%%v{pP1meC)LK){5>Dz4%UXoy*XrAN@z2%30PKyv^_TfCBJJO5R?g*i$8fSj27bvuap?|6t$Cba%VsU_4JlhHj8j z$T;bPcL@{rDzC)+_boq-en9G`N*&^PkZE|$w(qrOGn>-+?I!w14Y$|U*djvgi3af# z?T{BV5zGq;4441^W&S@!VmQUq^{cPUTi=thzgPIEfA&5;@`q;0`Xc8N!yDX4K&o07 zF9%mXBd-o_!6bl<@X%%;;X6};^|cQpPo|or0Nc4U3Y(U-mtnu)v0c0FcGF9`%(j{+ zYXb;?(5H8n9LY59_Dd7uY-qY++qqyOQ7Te5k{8RX(hzJc?LEK@AyB$a*wp{-AQ1mMRY?K?_}f-`&t zOni0x45+k>7wc4_LgN6{t#;UHn9P z#JUpeRObwQynG4&%>vMvpEZD(MJ$cUzZr9?B}Jp9Hlb(PTbA(qKRX~@FtAcHL9P9@ z+*|Fd3d|is#`*-CqMqFkWIP!fE2}?2K#)Ql`*?J zGnPtlW06+e7;5yPN zDCYo71lsIdq*Bju@@}h7u<^qyf0qIGZiUrNn2(zKqvQwAPtj(RF=drANYz|wmKl`` zyHu0zEbv0pda=BefK5EL{sW<0il;}iPfV#XUbpYM{!{!8O9gx#ROdUQXec{aFU>(B?yRn4}e0cg=Y4kGF3 zps6n%8_!9o$g&dXg{u*t>Y0=B*(AH@-1D=RDT(Yx){;+sFpnS$;=R%_D%2x=!Bnvz zQxIH0pao|>q$vbC3(USj5oS;4I9ZvELc(&>#od|{0-TR`rVVAs=R~nN+x{N%X z$)mYxU3y|TrRhHy~NnzHr z7HDBWziO>ndU|2Y`AtmjR$i*BJK1aAg6x#`Dn^_;AyCqH;ff=H#|2-fEet&*NRT%a>+fKV;| zXq9Re0uW*HW{;{Nst`3K)AmN4wi3PEs%6rplS`R&VO!o>iyMnm)^>p`^=c!>N9X5i zO1#Y-%*CeWHo$dCF3Pc}*0H5B_;00q-_L9-O#YK}G5sg$ib7hgm35Y~HrPod29@Pi z9;>4!6Q@LjsX#$FLGxaB4R!hdT1%Tu(Mz(6%PoZ$yQA(scF|8<5aQY!r7yNu$hx+O zCwId4WiWTsq9(qNP9ziL`b^PQXL4n-d@k6V?a7(yFrXa$y|7A)mZ=9>yW-yqk_Pj} zJ6@%WbcO79rP=>{Pa*u(&AOsO>R`8i`-$*($APJ;^^)S8%KJq&J#qGB9pSNLZ&ig- zlTB*u)5{=D6XOyyo{BZQ&D)KHXNC(Q2VnE;_^wY1v-PC@3-~-qYVR$PQgndDZ|wFu z1l-hX?zLvHewdpz?YzkBz1MME{u}9Gb6nLCg}>B>VGewYpOnAI+1K#UZj)wgTR3PoQ-5T3gge%H3BY@H{D$^w~4M? zq&hwM`6#;7p&)ZAc$~wIEvG82gi0D{NS`!dN553CrDIxCtL9U67+Xz#;Zc~}28w@f zxLIk?+)`JTI*fjIc7O2mh{Rc+WnIqND%zc9LWM{>52;Y4N7l;b&&sN0@+}AyN4B|N za^n3xe~SmGl_po2J7q@-ZZnzeg@AdmHB|@l3CH1)?oo5$Y!Z<>CFc{%JTWsZ?vtBt z%V_pG5&9%|sIS5xB!7Ol6J=0vkV=HhKZnO8UjrzJ44|QtIpQ@_a_h5Z9(Lk$udmh& z&A4Q0iZ4vL!shGOe=Aapo4Hph4YbxR8ciKCa4bG%(XSne<}n0X9tKuD2_O34(du7!mY$}WvC^|#S)cU z4|U5M-orO_1XZq2TB0Xge@t?8cx8IDnb{h?7zBh4TX?t(tuVhoqKCK4-ZRBOV z7W3JBIIsWs2y!L*n$158R1auX?G_K}zqCJkT&-)u}m1;CQMabtNT5_Gp za$lU(=MXtgh9X@WK3wPaJLvEbgCXmCpTzoSNBC47LK3JK)_(ZSQ!KM;ktM@Y%_Si~*+O8S}M+@kuKtybDiZ0LIe3 zhsFP6f73B?vaXrWd}Z0pQE8#hS}`XUlkmg`yV_?z*C=6L1P6)t>Qz1;uO3!r${1$1 z65e+E;k9lta(s8(Ic=h#VDS(6ee7(P>?PPD7#NLHl5yDJ&C6uNruHNc>C zK|57F8{4$oL4xbsSJpch>lSP%DmB6Msg}(?OT4C7pn2o#n14!VF5i&65-WG9OPQmw z{Z2~#;5F@4KfjvTN(&KcwSjl9RNP9a7t3=CkH$5P=iz`>LxST(PRx^c|R9c|0T1 z31mIsTlnh!RMkN5Y;L{6A_IHoyj35+ZNy#IHK@Iu5Q@QKzHLPv+DOe~eHsGcGo3;~ zB}}>`kt^7-uiHQ{shY#+h0@Wpg2o#F^saANvc_~_gjF<2_Z-9ZopP|R`5jT#m|2I7 zcL3h~whb#BsgQFD7;*2@$HqVFXZpw40ozIm-2}E2z58jYmaB@TrTBZKjrYz%|w!k zFF580%9am_xy?Kcu-lDc5Yg zuKr^*3?kEIIC<>YaW7WxhO_0QJ^hOI>TaHJ$Yw0rOUF$uOXnLeKL&ns-n1-rSk~NO z+?e{#Y2r-luVa?xMyQ(xHGgZgLYAJE32?T?#B=@-lS}e-7Dy!Ob-tRjxql1jw&V`0}*;r6jSb zUngNi5Z+LVXtSNfGA9>&py0&`l%kejD>FBmboT1HP~*>FzsGmYFYFA8k$T^yg7 z$~Ggz10!@-PRlTbv(0GT5b(P*?X+(WJH;A4$ILKBNKIR}4zHku{ap~e3WPF} zYG5EFvK9Pr3BCPOxhBj5TTvca=8hzg&aRIv-4Et#Y9UQC27;;eN%u-3a0q!(r{Dg9 zDY-KSkYted8oiYw%aFuD)1@2yHdhZOECR9zULj~0oRwo4*B02^KHv0{-u(eZ4d+LS z)_EWoT-_kk(Cx~W@xm^6y11vuPNP@h_Vz@bi!0N`kaSfJr1f;SC5VpjMnOR&kHzbk zb$WJA=up$$4&d?wBRI7w*yaHH(OS4>W=IaaA}(3`z4z|8nTPC@>UCIO5=@9) zCGM%j#l}5Rx0%C70X56fp@XGmm0L4%XN!uW&WDah7Za&wU!cb`o%U8)HbcbDpyRDg zcYBg~NZh5O&d@%~tpQ(;@3v1*#tw`ke)+jsL%h-V-yKF!v)H%QnjAiE^vm|EhS7`w zK;-rF{!Aq^H{Y)eNMlYg-KH*;PQlYLpLM%q7+e;B7+E7h!spjLN0U~FL-cG<3<&M# za{*=(q75+sBm~vZY?;}A9c1Kv-V`rKXk-u%2~=8F>#MIHHw?F!sPjLT(9ob^N-p09 zh>rQEXoiZ{U9sx8zMwbDPcG=*tCPj6lXJ3M*QETE<2%^>bcAM_5 zxBD_+M!Z%GJ)>ctqMT;YbxpeV;ZJKX(9)DNseu+2q}9%N4?4 zT9fuS@ADu=h420(4U|PMjz54pRaI7g9B{}go91K24^I_G;M%^>G@iP*G(BMH+9P}s zUUy;|)6-uChws>iC!}KLrNxmxm{4)i`5qmB(c?{z=^WWuveMquqctO|^mutf@2gBp z<}Z(@4^u6Joh06qRXY01Q@k{>{;;Nb>W?0j7XPSKz3NvzX)P{ZF9zIc17>0I4;5V} z6xiMhcUgLs9jN|}AY)cf7qN@p7QD=D(R||av|-jiQxakxNr0C@NTqEs9$smpPR{hU za58`B$2P?OL*-5b5Vu>Dlx;LY*#8yfCFuTxm+hxQHH-RdyB2@+KmmZOiSMnQ0REBr z`zo?H*XF+NDtu)NrV5EP(V~w~dagiPYF>NV39`qv&&_|ntTxcB?%<-;ui;Kj(mMNw zpZ5UMH5|_!C=O^zW9}X0!L6RO^)h<}Ci-Dc=(NgjoFpyQWxBTx@i**L-&G_b-q(!G z?LgR3QNEeo<`qMF89pkuY0N@A;IyP^D_R4Md)TLdN4o_GfiJeZ?9p{K9YB0X9N}D8 zc+UyzKxcE{RGe%51iIsW5D&W;C)G>Ohb{FJ+JDUB=6b|pLqqk?WP=7QFSks}of`Q{ zos;)uAkWr~o_rTZa-X&xR`U%oIGoEMR}VXBq<@(Qb_DI8X89)~zc9JC_T6w1p#6BX zBMSI#$}L|DQ@c9Rd!0udH+@G-`;E*&Ozsy^P;j$LN+?A9wcEjZH^c6q=ipt zB5b)(0>R>_{J^_AK^s<%LwF(^?-}(JSl(y4@FM2e4p_1H?nQ3U);=ecK8X`_3t92$ z0xQwbMt6aE->8+X05WTs1#R5dF7;2LZ4BrKyYq)2yHu{={bz!3(XU@pfQXx&k8d54 zioDlabqs$^YF(3uH`VnOnKhS0FRUPQj$C}OY8S;CJjnqIK@C!8y_lx@;Dr^Nxbrrm z#YtU1JcCW!_-yZ2(n;H+bUn0qNo^w3Eik=DZ1Z(g+ z?SMCPo!jui>Ni#o$TRFmMz3le=`v8a2U4#ix)Kk(S$AW;mEPKX9X>NM*`sy7OvyeS z3y&u2mGKBqJDvtYHXlvbU@wQzzCW(;aC0Kyw&{r@DU()gHaS7Z)2|}roiJ{q0qDj~ z>fs~gq=m=vluf`W2icKYXZduEc|=u*|5?biZ<1yn>I1#i)5LUjxWBjpK$KkFU$jqX zYWz9|ojnujZ|*mKF5Y4SF8(Xt%mX?&K3Q)vFk$BLxeRQ7bt1a*R?63UH&_1}R`EbV ztH-46dg(7@-rHvs6SJ;0nuE>{YfRf`nfj;_hkzF6Rc*x_C>M=PlXVs9h`j1AZ)(B14Mw5%Qx6olZ4lk zMZw3EqYa3^gnQNA8I3Bvd%|{tfgXdmxlEQu(6liDb5$xW?TEZZ{v!+cb#2QaJcn?* zI$FSh^)UPDAlr~^v2Red2gM%KQ^&8!p0=5gpY--VrRM`fUyu5XllC z;8W(5YlJA8cp1qO?CG0;w8^sl#SKU!Fy@cSsDPrj#g5f z`aB(&G-#u&?3PxZKqDUrMx8zZmCYhkH*!Kp><#9=I$v+j&Bp7cRp|Cu-q)?(weSSl z{Vu3fGB)>`=1{JdmP?Y>BZV9@`o>J^#&HmDm&49ByM;E_^APoG6#tZ{eb;O+YU#D- z=G79jC5JbaxL*JpskV~NlniIK={VlLiHg(ss0;L$`7crWAWR{WnnjZw$QnvKGO~Ae zvad)C7hv|xNC(g;jOW*qe`WRqC9lGf_#Z40{11MNsPoyCccRC^N*#7i#Ryl=RI+`6 z@jff16H?$S&a|+oRN1i!PlLnXUM`!x^h12Nxm|>;_cq0FMxopL2&yv z^Ps}JgWbo$`cyloeJFWx4;Zn&X_vr6*^~Gx+4Qm5Y9KJB!WNYE)G4tEZts!gV!w8p z3UbHI;sD|Ap7t8_^!7_*TKnybcXkGVJ2|#2$z|?6aYvK7$N(e}@BV?{KkH_5j=wlh zbxPvXh?J2Zvm9-yr!*hk@$sfA-La^=k~&fh$bGe!Q-1M*UggW=&Ug!xN9#9}PRo2= zq%e;+w4AI#z33Ni0gRjrML>t17#)|!+r}nus~5In;bmIzp4Jd?uix*Y$!aTpyudQ? zOy4UsCrwPPr@>B0vRd6b;}c+sxt)w)|6D6QW2=PINb!2tZT6iDWk*aUYW(%nzErMs zHr$j8veCAQ^LV;A_amnEsj5P?4BHZP>H2mLzkgyZ)+zI$=ZaIkvMj|IoGh3q|~Kjca`4ww<9piLVHwds!WTbcLHq?zznPoe1>3Oq_lQ=u{GDTBm4 z6>Qzhn|92nny>4{=Jd6MOlCKv57yszg`|Vn2^Z%$SU=gE`no(`tI{c#bl>r=wP7{v zvhHKLGTV#RJpec^wB(;{JlffBsTM~SS{{h)RlbM_gU`A7M8>h~fERys0Pp;#2ig9U z^EINX@R^@~hvAchw3jnZ2{o=-y9)i;k)&0PP#e#`xnaw!gwV{sDrH5%KN^}oaN(HndTq^d|3 zgq@7M!rMo0PyVj&xM?0>;gA-;zk(E|ea*cV%G9V=5#lB~jhb_rF1vpeZGjS8Q7w`1 zRIc9WGx&vCl%>#SASLs=(X%OTUkl;{r}5%dlk@PpeADaH%wJG^&ovX9)Q-8Hr_ML~ z`&Eh{BADD?vj(5sF4j=~JAt21McEsg4wHwfc4`R1T-OJVttJFvuS8&jgEgqRCOys@ zuX46E1fjM?v)k{1g2>rkgTiV#p3JGm5+$CufJ&wbT};4B;-^(HBdeu%KDB7v#`*Bs zek-NEpNX&)tFX*vPClmf1L& zt<7eLG^qW$TwiYT;dnusxpxzE83&iNm%ZEfwfJ)IGMH4f4(w=DB0x4fn^HrR0PX;s_Eoo{w}F(C0nm!Bw*uwqIFzdPf6k8uk@qt|{#VX^&? zmn|+g*$xQP1wC4mU~htxPRh2AM=Q#{_+mS;e?SlfDq4A5{`hT~>Gf_&RXSduQ_DHu z1MomqPxdW`WS7@gLHG|Ra}&lku~VEWE|tx57D1KWExXM<%>KW0N}u7E_Z|wD<=85u zY=lmDAo@-UQdC%j#&%l3UTU@O?LT!dw8_J+r+ERe2$tnjqCEC|(tH3Yzt()9HC+eEjYQzpUaK|nN!_7{E|GYxdAhoW zg@!&zo9T&RaoKI%enQX9Wi+z@>d6+C)Cv(d1`}Vsjy%@rk7UD>ToD}4U9emoZn!TQB&q>D#cYaEKJys zmZi}+-{}NmpqPnLhJrD*#!c2XifPe}t<4WJN>Q1#os3KgKNrNRbwjg#CuP50NSM|wHnTJosKS%1I``Bq8F@_4}_H2U)T&j(>} z6tcbsAtgcA%B85$zFl|GCO7mb{f=0Ek*%&Kc@?Q5iUpaPxMUx_N^_T;M>dCxYm5Hl za=H}u>_#t()WqOxGtOVv{<9E&e5K&8)8`tUnsAun9sIr_ zvZn@;&DBF(L~ePWM~P)6IiXth{Lw96aSf6~4XcT2mvYTvQVn)><3^tpRo5Ge-MaHb zf)1;CmXESWI6GYJlq$DEd+e)RP#jS5zB}9&Q#LOQjTL}2<7;~&vN4~le7N%@pP|2n(5mPu<-Q1g9YX&Er#3t5wr+vkHrhfnACGB`U zdnJ0Svxb<;=vKw~W8%NH%h%W!dBUbQ5v?Kv-Ljwf|xB;imMOml5x`& z^YFW)SJhrGe%Hy*cOq5w@kb$R9g&HzK9RJO3QP-TA)SX6cor3nsSHVrgzddJq+<=g zPVL=Hw&AQ@cR%j@95;{@e}P~QT3t#Hc;sL7&o)1Wq#IAw{bku&xfmi{f4|#eaLRn) zV;P;<;y-vz=&6%?)_)l_DI?y>=BNI+Y-JUiZp+6fJN5H9*Yx4z2N3<4tJ-mGfig3H zsVuz<$~v$~U4RDnSaa-gh8DWI{-E0c)XMD4j)4XHLQ_i)NU16#`Aq*lh}c?)SdziuEp;!rg3C2QpO@5P=}LDkYbc5doo^oFFJ8$#mA*vE>66e$E%o?;px zL4K>;f6VvxRGFuXh@VOgxAMtioo?w~oUdIjKH?9kGcX!#WC_?ARz7!5xoc?r?f2TK zr=7304W-C2YLu%c!@4ul;V?MmPeCWO_?9^EO#C&V4JdcNbzxzg`1fl=AC7{voEXJ| zYg^u##scK#*ySPG_7YjT#+ z)A!+;^Yau%F4AOvJ}QZ#?!QURrP_#u?6ypEVliJpBt1vMrz=ZXOkCq%hm9T68RLU2 zp5~WoKk)0H%n&=9+-bevPg{31NcTL0COQvlVz)K^s#<((~7#OR~v zk-cBubU}x^yR8Vf?TpGsm$gpVsOAC*$!O_yV$#19G)%psSbrn>XZ~eJFC#1 z5+rth8AXXt9rgK(Pq$o3QBm4KVw_n!@@@xn8mTI3yIl`u7&k+r6JtlbVM%O9We+X- z!o zrLP{#Im=U~RUKP(y9hD$Z~ne;6^)a1=`p?~ccRK$RQ zPzGCHW#A}VXFhMB!3QL=i)uSg{;MhM<*1MR8efp_k*h|o*NdqlIH?+gX?k7)$g^=s#94*{@C~{6 z5sLukVg!pA33MTR4qFx7jN7U_0RAxJ$58>Wf24d*cMM2bdxZ^cMLdccRy(OidTly6 zoOW(fF{8O8*;(8LXVSY`QCLaZefhj^fVN^fMR@TS#@_)JpQq8r*Eo98@zOG$0OSE$ ziZSC<9LDOp_Z7+83%$Wtf8lPt)UQbJvqDo=6O{mBHt1-bO)(=^75H1f{YxJB5Q zYQrYNxalWz^nJY5|) zIuklk%ml`T^@{a&W))0mjT>48h-$LXn+UMb>dERQUHxHbz;2%U&7i8M;t>t|WKwtH z&6dB|P{WOL!qD;sdEa|b3!#1Ebvl9*04NoPY#B+LUiZ<`b;Zl99B9??A&Hh$^(^i+$`fry3mzh!_Hr&#uJ|WHiGXU}cps2Ql3I z&gz5~Ph#_2C>pX1DP6_CiYDPWGJ+Vd@-;E%PJuF(zF7l`tdrq4P zi>+~{;DbQJvw^piaWXE}u{obQPvq+xq%*|hOz9dHL=<-QkP^w!lf&sLTs4VYmRw~=<)BAwcql=Pf!=3v*Y#p`Tw^i#OvFhGihwY?TEP{j%-!8(8tkTnve8{rMfvk&L98K(rE9QAfLBA~653(57yus3py=|!DTx8!&_|)b zI*`Dr9>|t;H!haWg~-OLN14Ved_`AFN5pLdbM}kkhs#mwFVL7q-4qNsPiyY;6KB(y zfWFqVItlgMKsMscGFn}p2$4^a9_qMo#}Qxeop!&VuR1EeJi@=4%jV@rTRQJ`?~u#+ zA<$L53DYXE-$}~}TTQfsg>cDJqi@s+fg*V8@9#FSSb^IQFLs^nbb2Fzfuu|h#?3@x zznli7&-{_)N0k9&&S}MPE;W$-$6tx!y=E*11vQuKi<%L& zAjo8pWY5tv9Uu`506XlW&HAxs{Vhaf_(b0v|Cp=}dgWRy+M8TTr|3QHY8{#fIfxoe zO}JMd8*K3xAIBZ{ePe>6WkwZF4=q)^i{%d;8?KXhu6XZ-bU0$RR%!4I-9eWcl?AY_-Ek4>wUY|KL>cuaz0=QBgEC0Jiq z64J7PHD$JXEw5PR7%Uv0mlWFfbi6>l!T0Q8b&u81CYT^05@0(1Fs>VskFgOFs0K=k z;7Q%e#*QGBC~I>sZTfD#sm-CxAYpaloWrzb>$u1Cs^`jBXN(nn06nFgC3K+cYP&wp zU~nbZ@T7o9OX{@G?Y@I1bHe#wIGE=V#C?OCRTPrNdJ4MbEdBS+MuZc;xJk+MBu? z_wMK7pPB~)TqS`*8$ZD3hx)qq!D4a0{3mmz-v{_JR z*jmp`g~Q9nli2gvn;18Wq5;9t#*k@+DoV|kpOxCV8C&v{@5p{-V)ctE70aYif;z#K zF9Z*O*lXF~(W#(q{?4zC^!2XY7IY6}#tM7cjoMBmp-nZ5bKfVBTLfY2K(VW9#2G45 zC8ENpVHiTv3&8VZ{zS*cY$E{VkhxWQXi9Mv2ifPxi#?fh?rOg{?H-bht}wp0YnV&U zXKy!cp%8xQfgaIHyKbCjq%9X$|3697;-r20bl{^TV8Wx0|( z(l1?q>LeG2x@;{M5xubivnBi8$e3jFXpi!9cRU_rul(At#-T$xsB4o{Mg=* zB-B{V{ujR;O3scD>{J+Qi7>mt|n*Y1ykxZw5_jUO3{FbTM)jZ1%d z_1aA6Kqiflv5OS1xh-Q#tL@ZV)x0M_SfpA(F56{UESay}zc`u{blaV3ddK?UP{xLk z3dU5l1)22*i|-sBP!~imJJPPg0wQ{;^Gj2dy^+<*%*JMQVWM!F?Not)z-b`ksB0IU zgcmmj5W5_O#9W?fN9{{Qk5C<84DmzfVvS(GU<@t?*_nhFfO9OUJvZz|9Ba{yo^)++ zHhDA&St;q`vD$5YfrOeCr2&vb^Zo1Jydf~Dt#Vi>670^&g$GTA=>6&xx|8Nc86D#O-d!kdW)0(NtAwkO8v+P9=x}7o4)Zk% z*dpz0_)yR~*lnjB6!6lr6pBP6doOE9<7yTg*6Km%0hY4gfBd9<_SMbnXE>$r8r zmPp5TJL_AnbJY`dY)d8<2NmItCmT9Tl3j(G@QQI=G1^;yxhGapynBHz;MzxaPky$+ zDa1J9f;bqtU}b96(`DwEB|5d?rj9i{k0081{>yM`TuM5G#;InjJkw##{bJ$b4L-}z zZmO;G*|I|Sr#T)0xs$Eyy|%*{=34H>LLU0TT`%?^f)g*cJrY;Ug2~{&Ppf4qH46HV z@x4>5@jcUI3cWEtz#B%-Ll~>!`P^vvzkk;~QjoW=@Jo#L5YQ~3m#&|z+Se9YF~IN0 zPpanFfk6nSDG@}=TPH=}hEq*D?Lk%WAyeCSmG>IND077xe`F1$rYaT}=NJAs01yCF z?XM?f_x5&bb{Rr_3{8Ezqv%2vMT;+Ownv#wpanJ^Z_e6DZ@Q2TJJ`RebKCC*u*@;h z2R?s1b_f)jVvcO02PMA>liic_P;CtqXC!D1%)Z6tLHM0%!i*%qBIFdM8DMbi?J05S z(Z#!>>A*9i`>}YC}|xUy56X;Z)2rG2}&Hrb`E0>Xfr1iI@kg zxfUq7_KMSs@BKPx!8Ns0s;DrQ_L3F71Gus+9=mCVxB>==N^D8}5oc17!j8uw3vxO@FOoD&Z) zR#zsLR%NfowHgZKC~s^!((&uWs#aoM+bGaZ*^eF(_mf{tEhsD3@Gf71o?i92Ui+P0 z++65wQAbRa9LGy^AJ^g;aF^&lYoG^NH7p)*1k)YNOlX(Tc3bsfzjdD5t==Rm0a*DN zHC5HuyGSO{ip8iVl3gh$r)`;6!||?7iBz-cM;tPnT#@tb&Tx)?p?B(^LK>&kuQyn9 z_eQ7WnM8Fv%*<*$YNXkF|)7L=PbYD{!I?{{{SbyAezW4Rk>c$zYdjsL)CKq zY&5-wrt+p;g@FzAcX@{w2Td&Yw8%pEB-U|$giZ1U+Qr_tkN(C(DWOYgX~uDa#?sOm zhV1g}Sru3c+5wzd%{;#QBC(YwYWpeKCD^Et#7uq^3I2xMFEq-7#wi*FBt^4ZwK7i{ zUny2@yalqYl8LTSFjuu*&<)G<|DbQ@9V^S1zagR;muOsf-X+M(p80Miv<)04fE zn$*q@HQ4XSgfc#HD`pM91r2Vw(@_(qlcm`!F?vv|G1rU&eweq1wj6iu~n?d-AjFGHdPmMyj!AcoVlHYdMvu$07=<<+>VRzqa4`S z8*94aWi?t9I+Px59X5obIXS zUk}zN&H4p`EA5l6FhlaJ4mjQ-%!NjjvKhhj)JL3_&O`)0p^b~)f1|J&W){Y~$p=5F zso>%vhivpGH^&{-g*c;Z>PMa3EvwDEX+#kn?{qdhb;RV4=cQySbAV^uB(9hA=y?2hv! zT0=KcmK8@;<<6nqECwd!q>NMErK3C8VLU+MBQ? z=O;s0-~{2S*4_x!co|col(Y;~wkNd4V5;IAUCLk44x6Hn^Kgj&e!%~#+xzlTAgNoS zk^_Ha4c!0h5QK}15an*hEg^wgfA%0M`L130e$U;#mIhTic*)2qO(>q5Nr)=j*&ZL$ zIlceQcu~T3zr@dQEDHB`s<+Q}l+TgeOl}mp>(d{7wnsL;m)O7yC~8`MRoy`k4-FYz zIqF~GI{o$s;>1GSITcCJ#J^>zXQszTNdtV_?IHGeg(7#Fire6XOXrT-k+yn(lAhM} zLm|n}IZ%5x3>?BhFz{mrx#SOZXM>VtHJW4KeN-M1Xv5PA_F1x*j|-bW$Lz|e3Fq%h zaQ_b9y0^seYJp3j{EtD~C^T$bnRLBdfAQxK9+Zk8PGC5u;~)QU&tyBElwET<+*grp zlkfNj^!MNK`GxNuj8j{ahe5-itTR3mw$jJO_o;|PLk<{VC zqGyjavj0A~|62k|qk;%_D+ss}6nT9W`V}fkyJS7}A>D4}&-nWtA5?nKM=;W-0$o7I z;d#&^$%|5=r+H8B`1<$UJq45a7}s?y(b5^W*=ls3QiY+LZFm1cfb>xjAk}9`bVtY4 zP_Nh!`QyB&JvQZSnL@eC+92GIcz3tA48UIxgKlwaV^VcjMlt0ohx@%{Eyw%|Xv&Xp z)9nD5UHI@HO?VK`Lq=EQa(Svef;*1^MY2&Xc@u<2E|W`?)&&D+w2K|>K$&Ye_ zx>h3rZIikSLx&6lWjuc$)BXee0`e@RQ^Tc~gTwD*EhTLLXgBlO@Av9Ic<__SQPV&| zA+<~g&>GO0Sf4lmclrJ;l>P5^*Uv_N;opc^`34KdfeR=Sq&OR`TY)W z$Vl{JE;n_gYE7?3pd5tT`+8TZxkAb^T$HM$#Q*-RzwcN{!a@w7&>cjN@suqH)+{wf zOkvMx{8Q@a4}Eazkw@bJout-g#am>^a@;vJ7Us~Qz4PON=LOIm2CD^aj#9;VlD&8( z)IqcK^{J&}Y2OXz^;S1X4DhD0Tm$MiaBPs~k8ipsnWVq#;8@5dU)3%`LP_45!c!LX10X2B6IzizZ7SqFCoWXjkp(G`W(yG^IN!7Ed=##k6HFWZ|a| zzy&%NPvElfxOJ%jlb1JTl-#lpWjj5M$bJ;sm#2_Cbto0s_57Y0wbf%I?!Jn4x4YZJ z36TydQC&CRAEF6*kx+Qg;{>=&h+=45KPr~`FWUNKS#C)$lxu3*anpniyP&@BxXM%I z-R<0eHb$$gwBc&^)lu}S)5l)b+{%w=!KEVb{%`U8|F%?8HZtQUi%|YI9pq^rTBhHR zYNX<*pmO_2OVynB@SOd`k;KKS2N;Dv@73djbfX2Y0dY{`KVk&DUT!>lj2R;QeN|tw z@z0Jp#f~~d3jfU+{*RCDuMz3o=m`TU$JSPC=8DKZs1Ib(PM2q6US7aQmE&{(0?uTa znOS`_=Y&}Fp1Z?*)BT>){asnrD``<$o$@pIC~(=;bq3H+lu@^R1JK*!g1E28b??>A zIPEpvkGal-T81iGc91U~R}GGr=t&+PCMNv4q!2$JzC2Wq(mww!Zq#^5J`by>4eT1S z=cHa{3YVr~#z`!vtln**{EZgeCA4JmH=^#H#q)id#DG}6*Y*$zShFg^ICJw>0+lA& zqLp6&bY-n->-A8@kx)?@O~>O69q_n@Gw91t(Uk*g7*pr~z51wrjwS$22;-% zM2~GFWW^j)r4fEaLKw1a+W9u|f7|@O4oJTT*rV!nCBYwG31tV*#@k_!;?hr!UkQ!Y zIPIyq{MyWCX^;O>vXbC>?HQASfP@+yCUM^2pD#4wRMO+GJyNp@h4{r%8<*(y!3s5R zeO&(}T3-FRq3+3yt;qqn)t^w|WLGcjzNB4nYA?#B&p;wX7_}}B27id(+i__T1NDNs zJv#W876AJ{n16vr)#Nyv_RR6F_0V#mlxMQK92K9p!^0%IRkS!Xe;^+Y5A{V4q^g59 zr;_S!OFODI)C6mD1&I^p9+=&GcxvA-CM>+SwN$AjxsSsg7WOH7kRduS?H!JVy=F13 z)V8XjK#rgH!U3+x7}F$%)03xf#&$(w4tiKtQh2T=MjB2JL@Cd1hg|sP@##QzCX*2d zV6=E;-!!~|2izCUc(|bLmc-t`C zyPf2L)s4K@Ay=uCc4IR(lazzcZXJEL;78xn0sb%-{#K^DjabrpY^#&Gma#k>KzXQ8 z_nb{OfqJ#tmgH^xX-pB|{kli?ynsyy0HQlmitnqZY<^XRu%5)1*ovg-E*&N;%Usz! z`h&Cm*M;_PW6F}a-8nDcr%QvjbC>x~X^tc8mq zer}F+CvQr<=$G0%FJ{7r+qsSCy9zVmOGigd5UVY=?6LLUlVcFVofn%QG6F$kl=kEy znh%qQRPc)csaMK<*B3|YICxV4Ap_PG;3ccGo*osbL{KwF#8n+9$sMy~Oze6YvTlTQ zl2&Ro)_dCkumY??@NJKh7dC-ueJO(5Z+fNB119G0l3!17h2UI@DI9y2tE$~etJ}f? zx7+07IagN|-`~TY|1s&}uYh#OiLtJ<8!IUr-l;uWLv9EVfwfg4kw5E4*6Gt^=ap|5 zGPv#DI-!Q^5qcBb^hfQQ%T&2}3)fgcIYM`1ID2J8K`?g8w4vGQd_9w#^o!T+Dz|@} z#q!H$iO485E&JI-b%2gM5(%jzz;m(wuMq!D|sAf{_yY@MWo1$8CMAg@o~% zlhD3z#OS=b0B9F8su1d~Xf~^isxzL7;j$FK>2WWfG~FkTR=+$L%K(JNbT{+M8Ie%) zOdU^lOvvmd{j}F^-AH$PNNTr&N^b6F04!|$B9TOcGxy`cY?z>C5Yt)djmSH-qG5kW z38e;qQ|upXwvX&MCm#d9ZG#_kOG^UgN?~q1I}&~SuYpK;HnLw4XAO$r{N2J$I(}4$ z;KZ#LjQOGPM(Ftmz_(|-%?Zxe3wt6|F)S@wh0+(xJjJ>HGt8>&w2%8@dfH-D)xsYk zx4^Xiq>fZPicU2?KRLNcXAuJQ#HM0DyFEepakx7@n)~r^)~c_G(7x)B&hFYkpiUaU zw}sUg8s>N5p?h=ZxgHh=wtv<12bhPbknDh59^GK_M|o>~3oksuT5a1|1HlRyATAQe z=Ybj|;yGDeII6%C4&YzH_R|sImjssa*S8P5i5dZQDzxLFR^;`l@EdY7n zz+pxW(_vjFDsIT-l9V|H%H{aev3@Z5Lue8GoY$?_)%Zj~!si4y>exDIyR9EHy8G@? z%3)AfL-`rep7vGA0kRK?j`Y37Mp5Z_tJ@`Z4~F^Yl?gbNqlhJbTS3h2rtVWW3iW?A zf;)de<7!yL=izeMqD0i9pIdy%Y`F?6LCiw&UyAB;(mN;1 zZoD>s?T1%nrrfVWHu!prq+b(C5At(==JIjN;_moidUd{8&_f=jrhBUiP@_%oMe|1D zVn6#Y=i!0P&2-y)plCaxlb||AH8v*!&^fXT>e&ZJIIP#^kJRcMV;ZiGzW`^A`&fLt zvvuNHsiL}TlR7FL3sH2pg!e9Xa&XKIP^=#Uc6jsI6+ogMgbn}o{u@j#lrb z)C4Mg%PwT3Cew>l6dKrUrP%2H$(~mO#;6_&YHuS1&L;w-;T?{8O6@N6^{hXp0pfm) zob}fDKwfcYCpdT3GG@N+WG+#|wCcFre-}6>orvM`pp7eAwA5#q&DF;M-1E+hu?9Mz zuDV>cnpnZ-Hk7LR^>nhr%nWpW>;tCyYwZ-eJ*Y&Ye`XRjP?DJ(A0~Zd-MwiTHD_aD zMR@ve0rG!+WPVUtYC*RjY(o>teHg4uk`vCX`--jqp$_v3~|`4D?uW0*9Ph!c6i^% zbk^x~7btOh#)}rakJg2~Y7Ipr-8eep$Mig(bsymm_1rqxrH-&%n~qXuCZ=eYtMeFJ zu-{zGZk^sOg;b2=c2^)g=;lELdf~QU)iz^mB7?QXNU(NT*Pu&IruHq^ZE|_K|CUonI~W4dGWZ_1IuOh0Ld^n4u8u2b zC6A>I`h=_aDitiF6QATE%CoL$f1T_9b5Z_B9`$eWYy|D8_WaPx_dZ7-zKMN^Ef>-` z-Z%I&gi=n#i6w_uhtL<>ma2fN=CSNBlXK3hPS+F-_1C*h&@B?0l>X#Rdt;O+uWZqQ zm}82sJjU;DcgK|^aShLgq4#YX_6gZ^cKPG{Ue5pHnEiWLZ^-9CdlO6VL)C@CHgv48 z3}CM!mR?Y$3nTrtB}yM6I?kSnK|0O=Io;uzDv#o=Qd!D>mdESOmvnfLx%R(|`luh6 z>(`P?UTtH${ci}|!hV(g^3=s^j8&xHMt@8Nxmkm%k=fe{+d z7b`1yc>h_KF)Vp7#NdyEFO|BrK=)r3C>oX-Fzu9+>+8a;Hi-O#F8;4T@W_qVkMu7i z^M&&0O9;IV?;&SuEA#O#QKp=O6}N2rp!^v|&XfK_x|jO4G ziRYBf|7e%}_2_23QFI@#ynL|&Fv%bL0lOe+6d`k4jwRHtb5o9E=)r$`yZ?7vhU>g>~c%pVZaD;CaJC{iYLgGLBuDjSugf zD(NF2zaUfZe|eECJsLi;`c2G^xyB7*vryBO_FUPevHf>Hc_&$d4p!lb1P{2vK?O zQX#A0i6e-77a-h-n*66x`hTydd&oIB<_J!)pe(VCNA;?8U*(4IvT^>P@%_?hYcc79 zifS9xBQVEg+00rR>(+l@45|lALf0h1IhoR&DqQ1olG>qKLYGG`-Wz28F`N=3f}L(h z4CVdka1ubAGPi4*WMBfj=O3YRNqh&W!tY;43^t8;s4@+7E#(0edg?z=ynCdC#!7e0 zPVmr2r(bSXt4Yc=JbRaXZvs54D>m1&Bz$HE-xhM;J@h;TY+^Am-2jlsG&7!u z)_}*b=qba)m+a9U->vOuVyRUG0Eas0p$r#!v%?#g>!)Pj``lNM?wli3KVb4zz+eHI zs+1n7etG7b-Zuzz_rvN)Oa=g@nr;>_&Kwg#_ZZAM)nID$nz)@yHfS0axq}sdGYz7 zAmBApHaWt+`EDEw?+=oo;`1M~2_T+jID>}3HSPCzqXN_VANa~z<*RHaZ666VLk>(o~NvV=krF&_hD= z;}b0bgaXu_J!>4Z0JNk&(az-QK0hn~WMf%UgM^Qtyp<98l+9xZq(RRH?M?*aMn%)> z9n!Iw?zB+<3Onu??gBpU<_NZQg+B}>l$5`JkQzD8F)lZa4Ut@Al*JxI*{u?ue#9N! zCqF`zZf48(l7FXYg1$Rn*$WN5M|6glV8(4zz7j#TGR*hYgsUl!MT54Gm zD1+jO#ktTBK)YRhI;mc-`t>roQOGlXE}GBY1>`m!Ca>vP;uBhf@@iwLmK}`<`Q)>z zF{t4gqL|-?uJ=3IcecS#xa`*ieADaA%16#}p^KT#qYGJ=(@>ot_eAM8VJ`WanANzM z)gkdMaUQUh7sa7wR)CBmw`Lf{fR03Hj5k-OR1(KA$3;U1m#LH8 zKz(?kN1z%k`FeHf_?=9#dLLyf<;-F8NSQ0k7mx#)rp$quc6FZYt+J-b`jSXi)=t{h z13oEJ^RxE-?Ed49ti+AiGmzxN^dok!kzZ74Fg5k3BQ~+&;j}(+xCMF+Z!@dY^JcKJ zuAyNg398&b{1=$8Pss`PF5`FblF&PZ{!$dj*N|N^EC@Cwtrl;fJXzm%v0M)~e@2^s zvFv4=`*fq%v_Z#K6ULRAtLlH<1mRg-Uy-hHU1)+e2%2&o18UUig8@1`myEK0(z=nM zLh8B0BWkJ}LQpkBjf7YD<4WN&2i#Pd(grM{M`7w!Nq%DcUC56*)R>;_#bPr7{lceV!wS*!IHW@Y+vI~NS@eC)f2h>y7QP&FW~ z-~Yp>3fPm9;1TAzPr-EdlC4kaAL|UVTb5yf5kYd+n~aFpNZWLk`|E2(2@OtbuD z>NB~OVYO3rHIA=iirM^VUDTz)5Nq2fu6m4oN?)XiRmC<@=Yqb>8}od5oO#m=DTq}S zEwS@HjGzQP-0*?!z-oRxfZvt0T*+7pTUrUp=g6E zpbi(FIaii9Tyepy09(^DsZ^iJ9<<~?!FeKy;%Rb`G z)!KRP;2HM}_Fc=hzY_pP8alX=Ar4O*b3Q3-Wfd2Z#9WR1#4jnnnh}ycljxrdTv+gK zfR1P(75-5HVv=1q!x|zQUG*Lt1l%?tr`>|OJ#K2xqGcF{##50oPf_1nqGrIMcPWQ0 zJ*iR?23&LCv$Cm4OJ40i-_|Z%qhN+6ef(xSZLs9M0>r(v-ldpC4iA4?6`}+PgzG$K z0I43oatcbjz1c=7Hgtnuy2{>hw0WoF`08e>4z1Kg@l!_4PEQzNjJD)pJ1LIPPu#~S ziTXavQjd!GWIwtizTz9mluLh*m8Jhm$mT0Mkw}nlq+1<137906m$r-Ho9r8uJmh_} zuS^rc&h@9H3yD@eBU@!~?p58{+Ew-7i@C>u`t*0R0_QLW(?Z*UZsy|kL@D$A8?W<3 zH27#l52nev-KVW4&v*}`wbyuF1G9=@qFWUTll&goS4&U6=ds`H@@fr44oVUjMxjRz z3Vhzbh%<<@APq1t@HAUx#*V}8_kHl)?H~LwA;T}v-a9dU`sCO25)rDctpw#8F0q>U zu@Lh?i{q+&U4d#lq+FA;^jpL-YqoCs3>ATXA}`AXFH#2h#LtGrLqxNrBmyC*mAnD??NlDTN?%S9eA=4L$vdJw1 z6OHAQPQRp*t`VF&Kjh>QUsf4@#K2=Jkx`i@;rhCc{^v{)Ocu)3KV+LuKOA)I`!17X^6hUW2j%i z^nl94w0GhXPOP3dNW>GAx_y7@ZH>NcS5Sz&&k5fz!=6`r2cA*$aVxyk>bAdwlFx~4f`jF?XOd^#g9-h=!&4M%obed;g?_J6E zGl}@i&6lzQb%GEDH&94BHc&S-zMB}GAJc4^sVT-Jc3%H5s47VgCn7SP%4&n7K}Ls? zG>Lci1@iLbI$NJhaxk?z_kS@O;*nnTY`;7*Mx`*Zs^%H2WGJ-|AsUj=J&-#bg38ZI z=DFDpEIreabrGwPpCC!pmp5E}*I)SQ#s!774S zgW8$!=l2j%sKr?0v(5UoSNXs?cTqYjsbL z%dM1CmpWMwzOYX&m6wGo9B{mcc+Jf(3P+b${XFdT`*#208`s54e@YSSylfY6kg68HUTv@Q(IxJ*R07Lh;B`6YWFSy`qORdshf zoMh8)@-==zzM{AgBf@~IRYJVtzm=_9nc!lYDD!h6R({DpIpFh2Hxc2rAxjttnm@*} zt>4&pXg?|b0z_eQp4)1Ry!gUAsb?=){N}48Z6skcFMQ6Cxiucr9W*^kRprR(aAvW1 z(Soj>jB?Y7Dr#p;6Ooa>n2*i>%L$}!mR?l0N28NLoNeJb2a01ZSo&;dzWVJ2Pw&f+ z%&EwFDu2VV_su-TbzoWJO&82?iZO!%sc-)FaX~H$lVQGeb_7YJlA>`@`&;{mHk0!0 zFL^MMljqrv`8i(g(7p78Iod|IBz9p;sc}KX1+7FDr)py6p3GIE^HHO&iCr2RAALqd z$emnjy$G}&K%lpziMUgAY2ha`dG81f->^k3OT0D-gjpVT2Rs3<8pd50_4a z^#He!&W^#duu6Je>g!nK>XWYnyobld^gf05#r~&mF}}&Nn~$ zruzIkdf5CzRw+W(zC!F`5L-p$`04@3)=d zpkaKwZxdgf!y{Ms>WwX=113nEw8ySX$To-iQexK?3S6t>{qWuFuo#sP(&5@(i!3k~K;Gq^l**Hx9m$v*QKK+9nX2f2m~UY&@atD% z;lx_F<$Mp0?)s$~Os>@5Z(s8nLG}e6;CcgV%SU24K#U9yLty@$S3H(+ayLKsGSx59 z2G?jC3*am#u(2f1VD)MKkqpE4X>LYo37Ph+S}g+N$sP z7Z*(3>;~HpD5jRzG+hf$1hC9z-9(`@3Gv_2SIi^7a#R1pv7Q!I%>^0n0#x!R6O0@B zz3$h~6JzW5$`j)*@p->|d;|n_8E;Ge|;^S{#lRw~k+|6%iIs8ECY_0-d0u zPKtsDcB0x%&pxeH{$Q*veIkR~We|bS<|+UYWf4|K(!K`WpzIuM{i%`*7fNxK| z>7UDi-5*9LTcrJfo6HjLD6IMOoNroih-G8S$eBaUdAo&xuh79ZGV)@x#2h((Y zT=Bb|j5=wy#-%AcV>gf2vXO(Lf@7UI6l@GvQZW#g89n~C=tPh46b9R7+R~HMZvLJ8 zy2S2gf;7EdN)u(0e619kunvQQvE`@Hj$2qGwd&Jz4sSslCh^lG6}6| z?yr5m$xnYVPY}j)JSP8p+-rU2gKwGLeR%?hoBJq95%5de9wxHQ{3Wmlw9i1dqHe(>X>5ZU-?lAgF z$Cg?0{7iFD!!;#!tbRX_|MrR1R)5I zf#O;<>T|Aa8V^6f{!>OXO_V7nFTWGG6fZ5K5V-=^ek3Nt#0j5! zVu$toV2&5~|DDJfF0Z4@oz0sOnv=OMesWVQAvtYRdfznJWOB@Oc%Q)P;ITWt zz;(Zv!Q_aqN$&Pzo`p7jy;V{pBgxg{eR{o~c)i}w^=KsxAZ6|wyKu0yw!rB)a2@!P4@nv4Cl1}5ooYtPE1m8CEL2= zSc~<2t{k%%UH&74r&Hz9UKzp@L&*qc5er&%3Dj(A<5k3!8B#0gLNb48AEyAFUF07- ze;+vnTFuWg_9pj7o!mli=4&eJRB3j9-@xH8?-G9hWfc3&_;xRAbM93o>PUPu;jX>l zg{$b+#Et0tW=PwzNnXlbIOHwV?{(10^6X9$4}LIK5%A z&dZT<|0g-Q;G7{n3veoNwhF?NP%%?5%YkTt_tdF6RxKiI=Eq;^N^?T*>$MCXgkEQiJtAbY2^SY|ik zWIR1Ah(ED75eD7Q?+WF z8E@%(V+@1VW?t~!Imy!qymu{emUbv{(4f^i$LtC?>jZSJUzdUmiEhcBQvQ5L+iQ5- zDn`sH_zi_!loY|7iz?e!{$2!|pB`_g?38mCn$o|;Ff$J7NX5rf+>aIXXR;i%q5qk> zpj!4Al+YsCwd_QU0_myG9FNh`9tt9*@g`Qj&`mAMKL_Rg@)%#(O;2x#f*QoxZzWvZ zr-pK9<%r+FJBLzMIIH&XCvh;7Q^w=7b&bK$w@6A26L~XMo(+k%_T71^AH;;BxVsu4n zS7s5nuin}U(ytBNfKng$9rp`E8iS^Dl#tpzSZh5iw=){(U0jFGA8(GuuM}&G-Mi`g zUee3ng?H;JE!;To>KgzT(ofphpbS`JaW@{jD*{MvWWK#i2o54yNd4|Rs^j&E0b^iF z+)ncBGA##z#U$R{DD4+~sh$YjY&lZSKNHjP!=R$`dI8O_&KK{+-ZDkJbD`PfX4$Z* z+1^j4216v}$pJlMM1e_@8!MHJs{sPFv!84(NghYb!UihD)C46D6G*qExYhkAdnb+* zbgGw3*P~ssmPC2Br4B5+Li^P+mlSsB?>CxK@np=XePT8OwUEwTP8JB@au=DM30qn@ zE#kZ_9Z#}oq{Q)1l9g7FU(55j zFaM}?sw)i30fS8;F8(zrk@ddmQbk%-$;92RAjcH3AddkpF0f+9kq^Higk!Z*4B3x-Zyxd&E>>3kH#w%?k!I|FJ3 z337X2tqyGv+F&@pNTWAHi+A<=ooiG zOdJVJM(!;zH~(s@s{2`T5nt@Np`VF;ON0{i9ZM;xujcTR-esp!`JNY^U(%5Eq$V0A zB*(i-q>#Lh&E*%~rE{gyR4!>Gu4j3AYvuQBr{9#T!|Srxq;T4lussms#OBN@v3fOR zP(EELD!UmHyry@#F4Y@3Wp3*S0tsY2%9!47KfN^@l{1Wge#_QbyKj%QqO4Pkvwm3D z%xUdD7H)mQ0h*(jFo8i`mnt*$51e0&L#CYfUW{>mqBrz06T%2c&MfUf7hjN?q~^i3OsKh8ImLA7okViEa7}@- zD5F1C8q?0B-Fh^9SaqB zs*aap@f;@5vkD%@^CL7RSQK*AihI1HB1ynNE>46pb@Ki!=)R8ex!4!80nX;y$Iv*` zPtB?=@DC2JLsu>odmdgshv4fQi#Fhs#!VGrZTYCJC=f^>%AWSk#3F;s%6@@URA^e1H~brF0xMD1NT5=A z`5`y;g??X_Ra16gt9pu8J)xf`FH3{& zBZ3BuJD({K9)Et_*kH6W$3@>VH#&BR=4AgdM4WyvA38WZxUTngzF+5SInRrhe_)kmTWxymmmj)0 zFBP9f_fXPpUGiIKe5up~L2B4^ltWyP?_-f?+O*f=c0US*u23by&Jc}@pxlq`J!eiC ziIX~`oqex&*^v9Oqn;NgfX#m4u2At_76GqPMdXIt@AskH;JnHnkt?uI9qV1z+Posm zISSq%(w$ufBA=_X4z}*4T?x|5?2a+W>K0koZ#+%%n(tE-LKcbN+A4MrT@#90_ zmI#HHE=%snHw$!pPj(*BqO989H;bGYRNvn?t9JMqMu1gYh>XQ3ciUFd9b!+z{p{{3 zGPszxRcQajDTT+4DN^l9h7rA{gRwBNiC$V4PjtH3DdeI7FffaZ3Hdtkx6ST@^X~uk zjJFdOK^4~Ydz6Zcr5fct^u-v(B@+=ASseC=&HdQ^%sHh;Ea6T~^p8y*WlNuB=#3BJ zZ8!>lr})A3YF3wF^};;^G0GqhQ|2eHnqE=8W6ylw7GA)P$ZN{7uT|*dnaXFMHoDyJ z)}CqeiR@F`;O3x$9IBH}v{&`-WY0X#ga#aWytKnb zk`Uj(zwSs`6&8-2s6+aHr-X^;%9w|9*FH&aC-Q;dQ%1iz&w!WPIyJoc)$0Xl>yoEe z^BeReI2Tg5iWbk_bU;P=i}guW@Ei{{Zeg)r+tRb13t1LlJO0J%0Kn3pBfp)rR8?-f ze93qGOejO>o}dz{ZGK9X)d6LdpTs9@dfW=s&S(qnk)4_nRUO@!c=5ClghL{21>{qj z-Pe=_Ono@_3ML2|NB|D!!d9O7(M^ufm zt=x^+ABzd?w$)ej4t10O2qNuSNL(E0km~AIlf74Vc9#u$nG2k78DT5NiQKPFC1=S) zrpqyMzbAmZxPb`Vqia_*UvB*UJy3UL4lT8}o$1l-tdEq~JKtz`wvEO;_qUT08b3CB z{H;IyqXCC{(&3p9h@wt_09M&P+}Z%kYfmr1)5mI2bAd~wF1nA&f*$>PU zzFm9Q9ST}ti>7qaGmtVA=}V7>;iJkJY@Jf+5xnpe$wi4#Bk#td%JSIE?0xSzYA_{I zZe47dnYN7LZe0Os8nGZ#QR>=NI$1Sdh)|cpMSAE?v+N(MOZ=eQmIIjI?ekYHDZe?_ z<=;y`vEk_gB`J@%TMk0%_|@A&`rlYNL06 zK>t?$j}{9%1bFCtfN7uTvbe^qTGKL zS{sk8gmf2h!17 z=84RzH$FUz$b7R9ma)mUHoa9)u4AggAyI45Z3PjmE&C8Rv-5N9i+fSoL&clX3bcUg zp|`|%T&53^UaZdG{3G;H0zzL8vFMtWWBu2cdB*U`bhk|*uMWfW{)LvmyYiY=lhDSq zF!@mTF){Gy@0MDDXuTTvCjzpUak<{sr=WMbN~1fG*wu@$pHqp6yg#Sihd1Z1>9#kT zGLekB+4%h?Ns|QHtt9>t`p_{Y{g{(7la;J@NauQ^zppBP=nRv%W-dwwv-Pj}m?(h@ z9zHJzLlMQ(kqnol+2xdZMc3xQf^`pxLG&`nFqu!0L07$A`zzi`?yY}}E+%{G*0OIi zgxG$iC^xKn@?xSng^e6zPw;_3KVm;pQle7wteX76brawBKDwPmyz=R7+o@=2Aed!a=$2)4R3eG42|JO!vCpmVbB^4c~4>S7Qq5^S2>1aZe2H+G`V& zbh8>~C->WGhxpmUK*lwhSgN<0DaB1iLQYpK-<>}Caq^_jrk)+OU(NPdJ`Rqx9NB5i@2^3`?KMY zycE6=Ql+x?^e$jx4&)Tyy$bOX1!<#=n*y{0S z*3oG0@Pr3;z?Oa&Kr^2QvmK7ehRdw5D+0%JX?|DJ629ToKHikr|IA8B>S;Dr2te^A z8l=QPM)l{J(a*ox)sDopZN6`YPaXu+NNFPvE_s(mPj?03ZKR<5Vot2afAEa9%k3ud zdgi4mL3Tm9hQDQE|3laYMxV!v!snE3L@#q0N10L?JIpAym24V+`M7iT@{89x9DMwu z6d2TMe!r-GUxk=|i&!$Nh3EP!%+qM+1j1wyY_Psj+u{s+!1XM4FikzjSL8|&)>&ppDhBZ`>6Yn z>KTxN*KW@B_&KDN8a)hJ`0_Azy46^M*1kjP*9Y#Jj)P9@_52G!JV4clv?zQc80Wr0Uuf^gf81*&Fn4-&ypXeGzCZqe zru7Zf6am&!7LTdg2r%Ajc&xTG7c5zl!Ph+ZNJN4(4|y2;IOpg4K;yi5M$dGB|;hIhwg!Q68SRsQAUqy`S@mn)ha3bd9lglbSh-k@~%VNR`7 zF>#G#>wG;28d}p^ACNSPH~8K?c%|`N%rzi;QYs2lAVW=jq?)x=8IpC2W#U_^M3|Nt zr)hqrjxZ4#`tZI|!jD!i0Ii`bgj?Ib3KIcDu$5Q6-3bc;){u!AV4 zssfO?@jnb5KXOel0kOS40a<5Gz-rMsRLr*B0n{H#&iZjq=Lbj$hhXypnzdRr^?GBR zeU#k&8ob@H^xD~-@_k(^8%b?|A$T(7B-3SK+3#l64ri6yL1p{Tu?qgn(s1FN&zETa z*sJqAA<8ylEP5p-1LohJ{b?Ol-_Jlk_T%+n-;<%~OD9*j$5*FvmNY!m6L{nlpMQ81 ziM?QsSf{KXWK-PYD;oxnuihr-Q05Ui@CugPtn#K2?rYN2#`b#@7P<#Pu5?Q^fiT~W zRPHOgQ~ETrp?pT>BtB*}z)XZ|8*r&-bs$`un)?RBSBS^|$4?aVkI5qJA2$(FlBHlA zlrWt8p+gulsbr6*e;0|*U;Hiq&!I+pXSTE$58JZlWrHPublTb?j1$o4Z}(~VAjd0q z$GG4}>AF_HQ7Baw8iSyKI(uiCs!{hJWKl4wS{cOXRWyD95N?g02`hdAM8Qjqg7ynx zS5uf|8m?;+2*6Xfb&6R3x7DHdJlFzLwlt_~hc&QMQJRm06Nht2)J3I>RWLYvMxV4A10^8(gFU@4 zO2uaZq;EG4)ZZ+w*e>v#iF0NsO6Ys(n(<36ZAm&ogSc}4O3)GZ`=SMvj3ZL!Egod9 z)Yv_5m0!kiY&|G2&_nH5+7ExxDfx2@BtfrvlN*JbZpS|@Urr=ozOji6)WpG1Ne=4W zksB43?_=1>w3Rc-D-tXyk?=h}g$HF?L+&P}AzsV^nRrCLO z{sY?r8-Kq+2DLtxdpXNKB4!aW8TVA&P4&Yo7 z@l7#}p1)@Yx5+cKR(TkQnlZYOw7_O{X=RsR{;sJpkA?B@OT2aWGW$n8mkh|4pO{LK zgpqC6k#`i=H#REDV{03k$ssC5G<;FVgUXiVqd;ZZs-{vQ^E9Ybb&rQ@j_sjrH5a%V zYoX4m_NNj%O!g+xe&%^tQNMhI`y$ILQmoBxIFD323U2H&eS;#eq=<8d_U*WP6iGjw z_8S}M(>wk&Ku1vQ1szmYG4PET94uRG7Jt~agm!+Xt+dfj0g z6_IA;#(*`hNN#6p{v2G#lH;@es>y{v{)VJ(bE|xZ&)*$V*}a7B>QySSFsIv0RKzkh zsd+lzsTFg08?U{qBvLbemnX=qF5W;s%Obs^|5=l5DW=*H#$-S?Poq`l0F^V$USZ!i zIXM%7_k5wV#8kPEI-zs3iPz#zN8)eawjffU7~DEDDs8B~Jd7f>|IE#Sx2LGPb93{J zB~_jlZ9<(l`F7c?9Yjvda?VSTpyJN{mDT(&v;MwM2L3YaOEcHITRk~JhZnOlcf*ww ziKZ>Rd-rfOg6w-;Uew^TVdvj1c1VplNkr+j<|PZ!Xflf37cVdp9f+!7qJ3Pzo9;KH z=3|sIYGCXTfQj$HmRdiuNs*WPUX)D|@_s;+*`@M5(=W`C%;ubll4*@cSN64UDMDVAEofp*QcBr1KFK9LOg zOM%+DV6d1Ktz;=SWmc{(m&i1LD>;}{?59wA)u@=$u9A+yNELzn1Wq@qDgT&lI zTa&O+s#m6&4KZWmWVY4jbn3JN%keUGpGOO*h>rQ}hH^HM(=$RDdwJ2BJye#;gTe;N zzC1DMEZUoPPH%at4P}sU*18?m-%G;K7wx0$|AJ%&EG{}qCiD_64bLv6wUn-%_b_|j za@|_mMzzr{NOYMy#MSGSSY9CZO@Bo%b$7Wbojv_s(;O#ZS9UD_Xlo8Et_*Gv3$=Hx zYWgOPdOc7AE3(6<9E>-rQsC|o&CroOSVhC-9I@r8hZ*#xsFR9rUIcu3iC9*3W&+ef z{J=K?un)}j=AEOADjV7)~@*nYVyniNYJa) z63GHGKgLQb7CefkEeo_yBZhviYvYEoL7iIHiVfhYESnR{K??P|Aj05SfB{Zt8bZY&!Sdw`hxs zRdoI?Z4kWt4lA{O!<&{K+d^)k_YLPp^a&ifaAwT0Au;yG-9q(==%IJh-%`tQ2z6e- z1$i^ZT}+4n{pe6Ad#LnBW)1>(wdTsm2zbP*ac3_zt*lMy^lR1~@mFFlg*%_9w>!;H zX61_3sA>dTGoQ*5vx5}^y?PnCSfix@l=af#{~+14#QFt?%J?rI9jzez28uM{=lWM& zdEnwNpB9hTbgBX1VH>avTiCNZ7>jt-#2}r9xwWCNawb=h|^I z&^^zv7arb=e0d{uz^UC(Q|bpdYM*&#m#A7y*Ex`@@Ctru!@1L3hDNFwm_)enAB|8B zdasS>7=!+_Qm8Ojeag4#m9rE=@@y)?OgMpz{!j}3$Ym%0*o7hdU`_SxWbUJXODOc8 zk1;zrqr~mkenrW)Ga#sz{9)d{w2jke&bY+Y>*fy+mRr51P!}YAw(Tp1zVsM@o_rTv z_vZK88bNz>WX}I50QT9>UK~^l`i?0!BWB4nJli7|zPkX8YM_y^yg&P@RSymEdEPBpFx6oJ%|w0fx7nS)@8a#~XJkZUR6j|!-o#5Bx~n(j z&ECRhNO>iaD=Z}y%_C<&aG#LJSEyXywk67xhS~xr;%BKE{9mDmTO|M~3Hx|$u%J~U zU9{+opk!uO2cKNO^(DehD*x42c`ZXq{T+pV(U#Kfd*9|%B#U1|C|#|5US47kah2un zZ*N>qU`pg0I)ci%W}OwD*l`AbuScVYVqUp&6D9LIheHExRTWxQ;@chCWDb3gWZ`3W zGCd`!mu?{FMi@6JEtID86~%zfS*SmROlUEH zjSrJSZGY_B?2C*e_4h?=M}dYo*Y}YzB}5VTsk0Dq7<`!%WJNm{AMsFV@U2SmOMo!@ z+Kw2Y@Lp5k#Co--9F?NefNz*S<;_9kCmwQzZIiQs`NYo1MMT+YR>q<4l!RUzg@GD6 zk!mv8+z#;D;GdnQ1F^upbDzeF6JCOp!C2Z~LnW>|LD{A*Q@RStiE0n5A(!+hn2jn3 zxmC4IP2a*8DcK$Dj``dIVIn>h8xCJud5?yKQ$>{lJ^VoVdD^goQ5z&Jv!|{B;^l9~ zLNBLMMa1gA3pw&ON6=eJUU%lQp8C;rswQA8x^2w~hH{jr`qso;KK|o71|lC#xvB|Z%+NpXd533zZ1JuH z5$@VXpY1yM`pLv8Nr#})bc)&XJ6&1VFFT(hr8L*o&WuLf0m*z3&#z){yJYaLEHk5* z#>O%W=w56Qd$MY6+e;O)p%H` z+NsX7`}nbpe!>|2rXPmVw1FbU!AMvB^hS=K0Y7`BndoCGVG<*-Iiiy2IL3J3xye>( zGtkr)Vl)SM<+(z*S|=ife|6QJ?1U+LUaZsZ{hMlWBcP>073QKr_!QQThJ^#+v1Xjg z9PKGtX-3t^^T=7Y%cCX4!_6cNvpq}jq^y^>244BRGeHoYGkjG*|d6 zy#3y_=Yj_nwxnAN&t21~LU7s6JrXUJ<$964u^@>p4SH`JwGVyn)ot!|pIoG7^jqDh z;cD>SG8q$wg&FU6L|7&`?B?1>R4;`)+uEZLn>iUa^V+^7E^B-}-L}#n;g0gEPsdy` zec?jT#&e~85zuPo6J>~eg~l)Aqfq?iCr^pzWoKz~`;Mhbbz&W_U7Od1y7ojF=W-i0S=QO*ZsM|DOgWN6C2G&!3&W z;Ww?Ljq>0f$gwqZzw%4L;<(VdW9$575R|5OJ%9D@jx?QgV3_|xMqU1CS3^%czPNTd z4{&!lt~=CVmbdcQkCL6k(&BzG2kHkk568y-`peeZyA^{pa;mI&xWal=Ie=GJG#Lk z{y(zQFe{Yw1*rSK2a`J9i$=hz-`!cvjW(Y{8wrBZ|4~L}_YY6>d*K~VsyDsWbA0NR zfkcVXrxXM3NjLfg`IIF0v8A(0qZQVlgayS)+o(tp{jt`nOJo({I@{OX{@kU@X7n|2 z6J=Gjag0r{3TeTd=yF_}3WshRo~;i9cIE&oaiKQJi@*9iWa<@!h4Dto<6hg2AvfGPWOd{TBobKTzqcJYZ zs~yaK1yLzuea%jH+~kybM0W!;65?)Iswgyr+QuE7;{|-xS$@yZK+KQ zmz|c&y6EoFC;%e+VGlwI*ul0zdQDu*ao1PKbsCvnm05B8wG;f+mQSWuM5D+Eh)+g` zaJuN6SOuSKN;zm6lv)q+bCD^pb-Z&Z*00BF+z~%hUsie}fGAM>o)k*p4(njqe?A*BTK1kJv^ zjjtjjlP0Ua_t%G;vl7Det`jR+nmTB|!8X#~KqeRbf+47y33k)Ba^17ulcc%$z1HYY zIVLjQCn+_9yOiPPb{XzmnlREb%3P=CLl`uvg)hDI*Xq^r?{PF!n=6b5Ut&QurYm^8 zqa*0`#-F>?%NMkuFQgYM?5ODdE13bPL#fbt-;2)vIC7WxJfH$4$(t_k1>hVG-$)^r z%SyB;eve;thX+)_4U|wIgp`@+A-N34i+9FOUr((6jBZgd6}kGE9rz&ru{;HK{>Sp< zGac&QmP`oyJF<_CA+XNSSMGGmprR1dptRrea||VamJVt5ksjF0qH$ zZChW@#5B^1u_}(x5UxMJkjD_ z>IyfKc%4RJ0dHfkroQ<}W$TIjBnUWd>_E~eg{Sgdo?rlYRLwO8}I)9*qWj9fi7BhN|bVk5~#uNJ%HZ(654^szipF1P&F z-x@S!82-mmNzyFJ_$5XH+kkQnG|lB1$n<|c#nM2uv6H>yKB*siHh8jN%(N^ zvOWWV#bwFW^angWCvy*t-5phinle7?`x1nHGHtO|X-MkN<3RS>`}964{f#%f0wr-H z$bHD&>O*MkYVKFyC44aB$3E+C>~?(C9q#N9&-|m+-@2LP#)Y|yU1#rtd~sgXO&FsDdjNSM6$)qfyal|e z9`cDq!-V2J|B;xd9rSDt?vHh&?6x&$;ftUmynV%^Qdjj}=|I|2T=vurJ1Ax~;v8RX zB9|{-$t!j5V#4bA{#<73CHQEj?$N zY~C`Z>YFsKfC7ow$>95(v-~wAI2~vWMoa!uISUJFPF6TP=XedW^J}dGzr9FDb@si$ zxoW?2hg|rh2S2wokJ&tpzz_-YECbhov+`18ecNS|(}Eq!K&gnXC?!av zs|h03tW?nyfnIl~ed4_s>({Wb+vnnIn}+I5eYyDHeldcsXy!QXdPVdtYcl=7MM086 z+DVa=%h&HUR6nuOamq10fkLR> zvQ}9=K?SP%yf|uayxywbQ^Jb>B&*?-f>ItXRi5Ehh$}O%ph%#vJgjJFRwJ&%^&1fA zfY_F}WO_zwDRAGdq6Xbg#AkPa{rQb182YFXWO;AY98CB`b2Bf}Wa7%dL0lV zys7c3v468G(`KM?hB~%d=XYWR2Xxp$Ej0I*#|!VrGDbOI#gtfl{qosKX4=O>aqrC1 zGBjdK-y;hOOFDVftz@Gzt=!p*ca=ykv~+<1j`7_sB)esb?cy!4;uiM{iMFO%4^RHu)W(oTL|b>0I>c&?pXMWbaM#vEmF=tYSUyL2eDbbjkc z{;;u(^CjK|g(3 zM7R`!!EeoPSP%p6)4hEm&>=YoXUqN8-^mr7aKSP+VbnkfqLy8UXC@E5vp|r&1K%rB zbzkj#=~z{e?w*487OGtMGUDNF%Y)IW(6tIR@5Q0Q+{0vy-IJxrRoT``)Z^8ByDi*uq^WB>-D zL5=LYWqMdKwh;az0Bs7*hb$V!=Fj3q1DYdU*~Bs*z^%i(b$|lv{x%H87u?ZxexRBE zvPtdi=*k zsLREVG1+zjbjU>g!q@B!i&EncG)NCV9R6|W*X{CDKU<<@yii`E+-;%7sH&T9c&(eq zqQ)w0Jkf%k;qc4+^Vwy$)4P>*9hZx6Cj%qH#@J^@rHBPTzYE~mS=R_gat{$cxfUZ# zOt_VOERCA(K73*OnGe@|DWo@yyR@5Tk!4pfD0qMg-BVMp4cJnYtfAN)a=W67F5KB5 z9O7WrE@G2<_3sWm&G{IvBL8?Fmg6_Ex16#Whdhpx$idi4zA~TU=|L`ltUuaD)$Hxm%-!L_Q|e)OMYoY;6Ewm{>-_!U{~m}~XA)@{N;NiCg7E2iRmk z5y@sz&}&$Y^lBtojbHFRT`#SuZ+XWLzuUu>sX2{d9M`dDV?Sqh77pu0nXd3%Q=g?G zEn2~~7MMABC`Rb*!38V%Ggb-aX;W7?0lkvcLzb)=boXoJ+J=kEhqz3#sJezQPB{Dm zcy+$)evN*%{n3ILhN{wfomw!M$Qb>%>y09Z74VW97>bbr8(hawSZO=RQ~uSy9X4m}rLU+s#M_WwW}Ck_ z(A#7=wwCVk{=4S)|3#Hc9?bDmGKyxryv9xm3f;f5d~&7wXkT%&U-Dzbq|m5zA~U#P z3*TDu1&WN$J_9%ThS@q;F;zfmLI`0z67^Q0)qo}I=5=i#K3R`}|5Wm^@mP!0wLHG( zoH=Ur+(7F!iT}z5hL5|t|Er;!nVcDMEfj>uPvB-xpZS-@p^634poM0BmeI=VP-Hoq zWziC#@=^MvuHE=}U_{ETT!W2XEFxOxn?Xb@5?+sg;5OnZezO_XAYqffPIp_)M@xv3 zwf8dh3$7}}h}b&)s? zH3Q3D_pm|3rl)u(__H6>2F-!bqxuzJ?frB4nAo6vpKP-Lx+%lj|6q z+INJ%r-B8Hle{z)acmQX+$(<)^BHTuR4j;my>YNT#g-!>=gu$OGCPnYKBS2*2)R(gxjq4~5-0^r*tRM(pO6 zdv)D=KA3NrpYe|0#xEeWP(Um~A7i&v{P#PjXQi4P$0ILtTnPk1xIc+l^hxyA>TrB& z)S%aZYu!ZC32pTDV{s!~M6x@f4oyx?nms7?cpvM#SS{IT7;T>6Kk=&q@<01y=H@Pu zrYz`pzj2=o0nf;Q6|j~&Xq;m<@Qi>FF2D|!_4lVSrpyK`^h~le{)EQP{MEDPPV|^4 zcorgOU(@&Yz#|m7|cUIH6}W?hOIq6eW8E3+I+Ifa&zjt+a#erdhi?$vEHyh zZq3~Ou4$L{5AWV8^tBY2NT#KT5Jh-}L1B*_LLG}Vd@-5t5>(BVhetT7$DlV>moP1d zQZG**Pl|phsTrL+2R2r|TaTf=cEQuzA%C|<7v*};lil!Y;bpydP}NVHgh~^X_<{j2 z2c^1??K>3trdwiOUfhNSq<&^UFmZGsyD;@_SKRb&VTxb#O8g zzUJUhL=7gn0)qqIJ3{x;>XPdhb7y>J_hzSR7~f-@V|_NiS0dEqiin|(hsRrQ;Kzx> zY#iV{36WK<{jVY^25pSB!u6t*h72XDC*8kYxLnVHag2joTduIdU00d!#L`&5LL#b( zT(>o%3iIt71Se6YJ9l7z?G4B|y8WKnhT^(BvSrj|mlB3|xV+nL>;X%4rwoC0^+cNk zofWjUGxFa5ZUE?H2yF0Vd7kk}W*)f6V$O1xuQ^f*o1LK;hKlvk^oj15?b|7C^Gm@x zt`1KoOewGPC5S?1>0w44A1`Jr_gu~~rpA>lQGN`hHPsP0HYnH>+$bUsfUZ!7x6=pZ zo7`HXX&X%z8aQYe7~D_FKdSE^T+kAv9!&M)zg!s#?(hLzr94v5N!^%yK#qp+m#sK6 z_PpS-*r=FTlZ0?-9*JS~EP_}f?lQBxQISysp%%3i)>aEFht=9H^HAh_CqeCdb+D30 zLcifX@ZFLSqg0E`i!nlzDw*FN^k1Y7|8H3(zWncvEK(yfw0vG~UAp3k|!}<9c zink)3Es*!8>&AYi3icbTW{E8OK9g;YJ*P+9rwc_hO{WBOHLlw=@{*(ZSxeyUy>0jS zg~;F|H|>hmVa#+f-TUnmC^yQe*N|T9Xif|l$$e~!@Pn$-Ct_BcBDVD zdLd-u8RYK1hM*DKoa3@96ST?d5*^(b&Oj zxirZ5%l8kJ_t$<)2U8dsup;-Rkqedrd`G6MG*q9BE7!QK&Y2isUN;{;bJodR<5De; zU#`;d-s7>Dk%@~u%P#!(bwhpax^E=(1 z6GlGvgbT(y%~NHwrzZpt!mo)2Q8vNo0&Bm!3Onp@){# z0qfhye8oh|Im=?)>vl{f7RHTQ=Fa5P|DUgs|2tucjyf>sUZjS z1f)(wKhnvkpFja1q+9NG0C{(yMK+;VZ-S$UtegakG@+_vYi&+Knu3XOaQ_b>AAzX0 zf$wfA7RJtIw>y1~tF^ALGQDHlxp+FhPFtRy6r0?=pk=$vkE>AXW*om;JpS@=-pH1K z%ejEglz}OXrD;@-LQx#uk-6X7G`U!jwV6EskXw8sor>8r``u$Mu3XrxkB^G8e)TIok0p>S$UZ|hKp@1>DgA1@`v#JL|@dRNSXtMqq@Su z=+?J*bsL=^VqX4d&Ov*>AoAPYJZeaVyixI=cf5E!y`ngHLa&hiDmFgzl*H`DGS6;Q zM>;B1JHdFB{qM=Lxsod-d^?!#r~MRB&$stG?@mj^a?KkbU+cd{W7!eNc_-8L8egp* z9jTCSAlr~y66gX=CBxjckgh&UV=((1 z{s|9@1F4bx1nG;fOfx_(mJiz`fx!oVuz}$ywWaHr;|XI&WW5ALrI|k(?7NS3j44zbFRtagOfjj>Ehh`O>{z2mUo{+t|i^)uuw9 z!#3_Ml5pK-*%st7Of(6zdS05yUblOXVR0Nv?G4Hu*PDPEFoB~B$g2J3Dhc{u$s@~6`vm!KBKXPS(<%OB&KJ8I`jUQ%#_QgZQXR0?=SEKX(shFTa_+Qk7>$d>G#`CRzsot2nyBt$U z^Ok^_z8ob-AC~#|>DpAILXx>-$G2YIR##2kul;W|tB!gwI{DF!pDwz8N8!bPs(J2* z>)63YXu?LXPWSL&95>%u&hAwIY+H@v44EhdMBXqIE3{9?T>lv8z7tTT-2V*DSpS~} zXDt8!Iyj@wW?5L?dQcFboqj065k|0cW4I6k!$Yt6IN#iEeIxtCq|$tE+}%ZhXvO?Q z7Z0n@FrUn-V6W7v&L8awtt&)q35=82Y<}@}Qk^AjE-+^99Cn*I)Z;p~P>tB|8Hr3> zQ2!3s2eCfF4{dT8El#1HIN7PFSbKVt-m8Rsd;3DXt*g3x!KQ-;vFW~i`?ik3Vahma zX3M?v)`8hTj*9G|ffBrK>zIzhyYu+b;9NvYPf-2NVy)|d?8*(zEy0OD-M&7_(v$mm zC@jjR!^6@OXbuQzq)SVt)AlnR9?S$}9-p@Zil?#KqhZ7F&y*WiRMF1`4Z=fzuoidY zU^DQq>gsw8x5@_ZVckh7&cjcbIW?ED;bs4OtuRS#{>^xJ>ytlOFY|U1(VF;}BGW#2 zjZ!hfO3Pj%lzrzmPq1ZiV@B`waet$$RbuzaGHvkJ$aXbS_{(raj=Sgtvfq4oeJ*m-&b+5{*MUS{s;JIrjs@>DTrLZ z7=-OMb6iuG&E=$P^E-@2A4bnm8y~us%kJC;%b(r3Nq=;i`_omErj*zx+EO4*F>tM$P%x=KvBB$&_-x}yc1r|`K&m>O6 zHZza{n@GK_Z)$;p8^3Z?lb$MHnp7(8tu12E7I+{(@JY9WGaq z#Z5JmvD>RgJ0D=BgNJ3&*8a!&Ff_p6B}<9{4FSv@cs_$$io|ko9TCHQk_8~lE!~0U zhP{s}zB#9_w;-h7<#oiF?Z*CDkNSnO-M7Oq@)T@#0>-U+losSexmB01ctA{-h7R~1 zDv&z;Nu68mBGB$dLP>I-SLC+zNndlr2O=EC77eP7JBajkz33{Y)8dGrM+c9`_vh@i!nb=zb+SE5l7vGY3f(&aXuZ z*Bn=4w{orzE)278+D*{2hfLkdv;D-A80^S}{60jqZ>=rjXE#O4${~)#d)85DUIFi6 z%-EOP?GwOUHo?O~%5LXcVA8F41wbHy6z9f7o)>}6ZJt3RU?&w@`b`HKIS&~eI+_s|nA6dI#AdZ5 z11Ftum%^9Ou)PvBfaN<*AFLgmkM9aS0vIT8In9pH(l#uFu)4G);;-wm?c=}hR4~c1 z+@`tLc(TDgt3bjSTlyNI6o^xU0vno+nY#&&)q|Ms^0v&$ptI^UkLO|Aq=9@lG>#KJ zW(Yl6;+<*OdJm5-yz()yLopU}gFPN|$r0|m)LXYV2!<6ai}?ogHJb+D02(Z0t6`f= z+!BjDlEzoG38vMM*)+kh$QFcl({bhasmCE11zrGtJKlb_(FaYO&DlOrxd5WwnORf! zu&cqnpvg0x+`lm;A${74-d>a}~=R6nX)$YsRRt#Gn+m z_|PTbkGF(&GyCxT2)Hi>1)grm>_87vc6P)F*d^E$o1(43-*|Dg-S-af@wTl4d|)jY z5FOkX;aGD&EJT;|HhzTy{}DHb*+5hhE?pa>O5rE`iF>*DGh`l?wDG!JDuCe$^@OmF zSx#9Dh#Y&>UH$){j*M~wU76H};ArhBV(~?dTDy9QpFL>*AH4y_X&j>6mXrq5x62UQ z9Ey$3yk`0e$f0J|C#sV5_XZiBF56X3tX${F6_IRT*cPpE_XuvCO?#sI&K@;cmiv3x z)myGBtt)nidztv#+j)iIcxm%KpZZ<1{8^(!^ZI1Z(bgV!NY3})9G@>nVuA|HVMZjj z9Sim+cdyl@UfgrJV-u(oJaamOVBc(s&(U`ll?;cQ+Ebv%G?(SFf}Zrv&jOR8qsp(| zTFq7raK}b$Ryj@yiyeMIkbA2 z63=-meVQS=LnNWS?p=Cx)(4N=jGU%qyg9V3g zkz?s71J@bNTr~@>7CQ!8qE|;sS6ea6_4s?af6!M@LKE;icJaWTuajQ65G+u&W>;ce zPwR!A#20_Uw^K+#rfmD4U1CcGBbrGAP)cKEnreuqc1Vz3REjr+?c;g80D`RaHn>W5hu{0E(*Di<0csV5EJ zlX*tguHJv)DxBS@FHn@rcXx8D}WyeVbhQzZE$$hbq(Vl&w1bNOQf1Eh^GAwD5raE5-m}Z~4EY zRquG1<;k5rzCml9l~z;kyUhjv%)4lLEME6%+~=vF(d#&~t0^_@lQD5?ho%-1)haC4)4B0w9YawZA$yRh3QF+IW}5MZe9hS_?1(qyce6ybEh(Sy_y z;TB2q0_((0oLJX-bhE0q%f``Teb-*Q#q2Z_T{^4R<{|Ykx}!!(_HxW|9L`~JbW=TW z#8Gh3)(n$MkwF@~e44v2dl%H$u+p6*fT;b46xf8*j=e^lBW~(FmF|5-_b2DFajVes z*tRPeO(8q2PNprpPOo{&NiVSZ)li9_fRQEil|IG%XW+2%^6tU0pwAX7$0z%nGG=#? z!1(A}3*p?vQkixIhB1p<=Aw=9b&lCOnx(0$CfJsW*46a{wEhopici(F7g>CsS8N9*vGq0v@8KwapE|i*@OeWY4_+Z&cnjJ8ecvmPMp^qxamQK-IXJyUlem zny*KLGYCTC3ZC%~TlqmZc@k&fX#)FVC`))LR9Pue=SRE%j5N1PdAKF&FvOrAn^grj z`QlUY%<0>Zv29T1wDRZew*zB1GC@#FRe9ZY=+i7?`pCSg^SV=k%yo(V?L2U|=%2>l zS<6nh`sT*C5K!)ail$)7!{$T0I;bp}iSy<^#Zp5zG!M44X?U5TxY0d2v3QLl;u;(? z0`_qYzOrTx^1qmn#Q}_??nOm_ps?EnFH}ASr2lmBG#B-ixdfO$%-aNp z0)POH9R@Xf!ldf~eyh#O<13lwt?m`dAQjY~A%Xo_-k^wwnmvrBdM4gFC_D-ZZ6I8@ z5-M8yvhoNRS|7TH`dha-Clux0OS#yU((g_f>SF=X8|JtbP#1CYJ5meCx&%jy$!0f`Kj z1RW>JW-ZHuR;4O=OJs}*B`=ToMxIEst!pr{tuONN-!;@o&RoV^h9?rj5!8i{fCrik zfh~fApGC{!b}0tAH${W6$DD}cKGyVYg0zI&%FCHbGx!aZFU9Ce!?fWX`@}I{8d+c; z8S@LZ#9UM7TAii6vdW+EKEH*{G$Y-F_1yf;2xK7Bm-y?J?R3wGE{+@Z2cBlLGzWnw3 zMnP<0y$_t1wGD>9%QV=V-7EIKi%iR%eu(99V0m}qR}JBsrnadqRUrB!Lw(Oi6lS4d zV)0(bb;s}clutQLSNdH)?dZ#*fPQ^#-b{AdPtFum2DJUhUrZm)n7@equ6FN2kuPQT z#|mlUJGTcKJcWO)9Ui5}4pk?psNL(L_B|`$$m{1ub1O=|C4RaUmb=(@T3e9) zn&$m&5el_5*(N2^&M^7L2M`~%=8tUdV~*GPe$aHvW%YW+w@au*%E&)*-Q?0td_oT6 zQB$z!W{N54IxQsG-c)-nJQqr;9p`W+vQbGd{NT{ygQ*)Ely8_?h#Etaf8RA(lTH4R zCu!)LJ2^q-aWK6BE%}pfMkDR58`N}uch2<&CTS@f2cj+?1(ZWH?vbW2=f$?<`mPN` zr?L2i@-V_=3874znM(#hK5ogatCqa4s^~UD0}#T3H$t(S-)fpp7?7~SbW=n{GvY-b zhn(nDAkMq)%{D86?&q-c?#rVki`eqwI_i($KS7pXii=KVV;3hZ@ zK|ybJC*3UQjr|vx|9<&CAdB-sD)f1M6kGNy7D$9#pg3~yQAZ@r+1qahcgR98AptcL z8qH0StU=F3!kIaSeD25*?XpEO={6APw;4KxhxoLA`>%%6iYUE-gW))rFtTab>}tOr zlNk;;*tTa>+U+1|wnd4d!;*poA3bAtYtb%Tk9$LjnCuCRd5c1(0c)aox*Ngh!WSRn zYTNlO*>leNwyhT>F)7_Q*quz(eNxfm+@QZtEG^D?}DqkOo$!iJg$M;*%EqwoM9n8<>PQn84WM zV1DPe|GH2BkxzAa*!jQQo_{xsgOxbw;!CiDklhNSuv02)%Wn!9^tegD`5hFLkl^Fm zg3n;Y;q_;1E9@5oamC1!rC}(%b=sspig%L&o`fg7x-Np0}z2qhz>f` zh*4fMy)9z(5+)nA9O*6bwU7VzC@H_5&qxNWDc$T+^b)r>L(XpWd)DCHca9VV7Ip9FwR5;TnaL zm6q$fRWs&hQJ|)ZIrCDai}Fb9G6y^J>Pd#)(iH9;hiE<4&QnG8z1rhus` zRMt7>wFa9LOC#TT^xx30tegJIGSZ;W-YcR_c@B-N8`=+lYOMBN}y*~5dOhrTo@IN@Vwf*EG3RT$11>#|>7{}~l$ zcH_--iF@;5&=>pVt^?aVh(L1+Zg9yHmUGKA-Pj|V?i%Q#^?ce$tM^uJ{GTo9zlVQ@ z5aUcK?F~!J){H!h0oW*<+}D z5rSIMo)x-}T`yUH$y}+a_Ez;nF8^v7$}BGhp0bdF7n~`;s3ou+yVbJ$b`IF<>JYWv z()1{i88q$Ov`Z6i8~EEuE+v%WUFD{57MY z&jd+DbJEBT3?)zhictGpc8{cs|4()1|F1zGPApdrCcaEW{U(7^NcP4vA~j@pxg`!- zXz$s#oON=N%hoTVi$Loe#Y+_d{CjmvL9ZkS3LQHx`hL)fY%!wthT8JW9cMIL#(He< z9TU*w`I)6EC8;eL0(L=7APF9H>Ip`gARF?xWsuWwH`DsQHloD?Pqmz?vIjC4v?F+{ zbl{Y@8L{-jh{%lET)U*LTKrMJU=Vd7|8?9Qbd*13fyc{1?oWwexq#?QrS~F%{q0PO zB4@fajuz#2+3kL7r|jQ5bNG9u#-;S$J0_Cy#n-;3M`fB0GJ{cUa*%sFk}6wNyuqpc zze{5toC8VpI5f=$CHo$CF{Njd(>n>0bC+nDui@6O`J+KyR?nz&&8tuIRk}wAFAE$a z8XYoxhVQ5LJx@;m?eXfO?rvp@w!Y4zb9+*kw$V?rCHWJEMheJ5O35?FPkT>fHh=r5 zOP-`ge+-xFR*`?f73GtntsFE-z7_IOnAGLjIqK$}!Z?N!4({ejYlS|PMjrCuJR#V?O8BS(mo3G}*<5tVTaMpao7n0Wpe-i)d zA_x8PkPsEc7`t`+?)*8cK(5px&Is%mgXH^FX224igMfWwT=POP&-jvClN-<_mow zr6cP7_&>jir+dl1U`{5%UMzJHbfV+r`I0keS zKCIr*_vZfb({{+ujeDAZ5K(LA^L(AR@Lp?-Fa zCn#5{Ca&>{xhvB8)FT(_E5$di)#+Ot7_aS1`X4Ws19H ztU@<7s#5y7*aTLlysb|Pg`SdIpG?X)bX(2j@MLD~8GKDlZ-JU7ZddBaG+IU3J-hqt z2mnVZHbTIV{M0?p_n3)10bPb0>Mwz)yz(wnijGpez@L82Mc&F5!`;Zc2c6=Li3Ya( zh#yhJc_3s79=E=DX>Y$K;eY=%a;+%KMPN!h8q7MJJfS8+rW50Y6vj3`aU|q7Wgk@_x7A&2@f;RB(coIYxMcX@(6`5vS zUk-STM;$EJf-qwr&tE@>fT8Qt2C{RMk2Gd`9uBzDQ|)`-=2{h@Se9`f-VtYZ60S1F$o5mSHa*#&C~jHB-)XvLIv z>c3^lpg&KM3;8*H>koD;&ZSn%@=enNfvxOTQktOo`aHkX?c{Kd)5-dH6`~RH<32hzJSTvq`&eFivzny&z;I}S_TNs{>8MZrsbgOH{mCFrDpygp3S}OH-+66hFu#MT>M28 zGdvOYiy7M$8(W#2S8%kRu{C-9a3!r5$OW9vvUx8u*z_`H!EL?mOZQlH)koIV9wXPl ztpu3^XvSYn)<55kTzck2nnJ# z!CF_x@5c4)lP2xrK}7ZV2U?f6Tv4#=NZC!5hj`&YZJ@8$ zUd?G1<2R{(tqH`mSBgwC!jC)G z&2bcZS`SX?8WpPH3dSM8;#IO!g>}7Zt&7%=%v&;-I|Vish}s!bUeTkDQZr}}d0)S7 z{Ldw&vV&k{h!WBvdOa2%w7{zLd%q%}zY3<;=(lB$m7p8@wNPnhRu7m-8>CT-OReZN zRm4}z1nL9=O75Md<9~V#TaC2O70XibX4_;|Ah5Bz-qjbmJbUA`)x$EWjKW^j_4qvr z`SZj2mQ?!{MxSMpCQDXQaolELQy82G)w=CweCSx2;Lhkgua`Ayajmgks6qnZ#{#xW zDK??yYwy2SxP;uY^&$#-QEg86v|ny55^ zV~W7I?Y!mkKbP6$*cuUmX7py<0=I4XTf60gSFl`@#pFIR57)NiMseh;;B{|TQKyyW z^Q|ARs21_N?N67?gZ<>?@Y~C%Ge8!uy}Qm6Zh51 z-NY0ki(#vWm=mlPoN1u)GFi~z5xeEs!{IhcF_j0l*Zue&_TRhl?gz8=E90#$vD8z0 zEpo1JUFik9Z=WhlzB+kxgDd^}5v~97lh48U_i1iAvo$YIIy_fZC#PD7YxsU6Vr}g4pL@84 zxv#P(x+L1j%6V-Xho8%4C%xNA9^LKQuZmcztiRDH3|HR za%1HAI$^MgLwRN_o{O2;H8duxI~#gA=&B{dW^Zl_1w2Lz{B3AW&L?V-=xIrs+SG6h zZ7*I83lQ#XqPY#S&40c(VVm#{lKMaiD$uy`Ks%7?eY!x8jf&{e6#etp^-gMHQya&@ zTSGqnd}a02CYJ%H3$9RaM(3JR5CQ9XE?s$Q+HR8{PUA&u?3OEff!Ig1qS|!RB#i!7 zYV#lDbPzf^iOp-!E8LB@tb_~d&b26INnWazHzQ0K6RcVhnfG0gvRF~^ITPPk9^L!x z)&b49VAQvO-Ehqv#4?MhV@q#O0RbpYjb(S6@26D;~CmOCxvGc#I> zHt3U7MEA#_i<4O@exnNaTd zdb+8_-F6A{n{rL z`J0pxc?4V;8ZW)Gx^G3=(NM=yP`nA39Cyjc*Y z5Ff`3(#2C8(7JToqW!w!J#?exJPqz5EsHvzF>989^W_yBicY8<7G*l{Ncf-Ke&1*V z>Qm@i>;b|_`x{qc5;F<^AZXJP7+%dh6Q{X7(qlp=Lj2|T(VVU2M*qSA>NN_n#2n-n z%ovY7Zmfae&bO3M<38_tf1(&AC9amc3FI%e?ePJg-BI^5K96++I2t;(HOUOdmS16D z5^mLhg;jft)Y`!#0MWcwH)jJvolR(_XM7#`57cN}NF9BHo==Y|g(!H6-tKI{PK40R zBU+||3pzO>V&!)Jway?2J$qw+%Ca3|m$cv$yRZaxF`U^1M>lWwN{GbU*+b97GVj=C z+gsQF{kClH-L{jb5lCc(MZUctI|cu$NGri+(iG(y+<_ zacrz;yfAhVkOYcpn(1cnF22!LW_;;}ef_k*=RSF)BT1-iT(D{wD+7fy9T7F?s0z|y znam+7{o!UeV}S+rrG2LDSiN#dGsWWxU-~dpi-I>?{QDA=)1OSWiXqj+?~b-&)QiNZ z;fT)-RRVk5O7d@+e@XDt>H$8cq-gQOPOya-%4vhZ1a9y*8NRJ zrb9O=`kehpP3!E1AnVjWwIl7{r3eoI)sjjQzgAZ3P9nEz`{=#M)7hbO8$Z}@i!b|5#EpEKrfYWzuzRbT_(yTzEUR48UliFLfUEOh-Q50Jr;xBtZG(lEyCzq4BCNhQ~~8o}sgHyc8fUP?^?B8V~I zu3$5E{-1NNjsUZ$vFFp^=A;3Es_r$!Y9vk^Gr3vymqHxbmW87L`9WE~#BnGdL}ai$ zzfoTRl^C16L_za@$?ChN>gf9Lme+g-yi-9OeUg7o=Nn=;I{52m|1zM*CHgA;HT`eey6lXLc-jg>X{EETkuWJPt4$*lR5 zCH5cG*dMD$EuJTU)P1(X1beM%TbUTqqaPb4Tx8uPjIWvwmQg7q>+5L&SR`i?82K0) z`6dA-jrwJ~G(}JoADp!)!@I;b`CBZaZ$h0Dbm{z zFR&bdiv8=g#L>m#k%D+2yPtZ@Pvz3ah8aRXmjRbrW67iJrmcureU7>`;!e+9u>qg| zpo_9v=t`=HSex$8Vjh){Q4ha04mBzwgt`of&c7HR)Aktc^D*Ce6y|XqS3|4~5>%>w zen>?!)}8G^WAM`FcH{Vsn6po{NkhK&#Fv)HtLYtj(le%**5W8@$x{WvDq_mVmr4fD(B;LKCQ!*2P68ah?= z2%paO+*J<}Y(u|ObbSpW?v10@wp-aBFN_se&^a`Y+$k%s`+0TfTAygvH)^g|DMv2( zm%sU7Wg~!?${e_!jfk^}p+vpjir`r>XN$OGcBKd;bac#!%*B@T6HeHv^G1wd{ zfO^ygwD+Da}orDR@gJzMfxVhZwyiF;47 zMH&RyN_ezC$z*~_i8UsIl)sq!N49S2WiIhQ?ZYD4x>^yzi5Rhw=NNnNpaF09Y`lOX zlwh5$NG@F{R9Qfru-$qY^W*r4HtQm`?@FLK@B;j}e$XYb88PJ!(^Z=K;NE6N+_c5` zeDF$g)`seBTn+!@Z@oz^V}A<|*$(dCrR!;7a)>`I6tR{ay@Pl-x&S1C3uTo z%Gi1X>s2OfIiBco_p_jemJ1_*ea0i0ZUo-ba$^hK?jL2opN8(0mU45Cty$v8h%mM~PmSV4A!75(sxrU?8*u}e? z+4|zCW2)|RwgTHq&$;U2;~QK- zc4U33f~_rQ0oVJe%{&II5n&Xc3lb+*HDqxQBZ*hAzQ7MV{mH6^h(ad*K{3K%0Be_g zH3O|E{Y8d6s$0PGh`|R|(Tn+Vk)6Hz2C~0`V!!K+3>kV~ShVChu#`1lney&e0H~{Q zIKV6zm(zS`6CB99hT9cXwaG*^^!_Y^l{Wva5<*Z*dZd#Do(et-1MM6YPM!e|7tf_8 zYJ!otuLV%2h~%q{@pPsYI^p2u3!m&xfskgT$fLoQmlI0@0Rn42SBI@X{kL{0B&QxW zs?Vj7OW;t5!nH^b8S%XHn zsQ}hFh@Sf7Prc=n)b0ciNt)%nCscQnjyBWP2iTapB;+DC$?bn}!}2O0RF}RkaM#jo zo0ON~TCYpWn@);%JrmsK_wKXOG0A88htDjO8Wr#lf~s^sC|ad=W`9N`hFfKSrqCG(J}r;H2~g5GUm-caolTS=4>?_mno`nw#VEa6wCNV7wt zsGSGv*xx@Ymt&kb&yeHhl8FEa969qhwGad1V7s~;#IL6Fq0Vwu?{WT*P1ncfjE5&q( zt%ow3*_|1F2*LA99FwT1&$qO@x5oheKnnxXU#Cwn}C~^K3h>P`rL7r;Kgpr_$8yDeXA9v z6z}cYifLrTEYtcwIZ&U0zM|@>gtDY3@85w*rHZaYu&a8A)zwYEpvwUXA*Rd|8Qhtp zq+cNhNeu`Nj%QbAU;H_J6e2ljB?j+zFg>^Mt?I!c!Y9jX5sSb}+X%2+`jQyDl9p7E z;H=h2>NUmw>qk%>e~P)MKRPzyBeqBBX+)F*!szk)FUbJ<`^J4IUP7m2nC?hnLXkZA zb@U6@v}8z9lI3UpJLKUUnI9f@DWrt)H#x3QQS!4{|Jke6KzF=8;NnD(QYEhrCY@hJ zH92G$6a~Q%U$)3lH#{USOJppe8WA6@3=5(ZY%;?EDd_s28z(CC%59>_DT|Moy58qk za=&R-i7-vm${iQiX_=b(A~>%^FZOD*yK7CWsO{zeElCj*T3d_c2wPa}?W|QS#2Vqz z{W8Mpdx4}s$vmcKMMXWd;f7#Pifo=;TS3laYX!fdCu8!Ok{#&pRgWHgPS1z6xN#fM z-g&x#wro%#ow`rSBhAIRQyC+C9-k}~Aa4DX_+I+_->94N6j?Sv?>m2YFt1zisa)Qg z<{=k*q^@6qw1>0(k9#!G{xDBZ7v%XXbj{N>~gfTob0mtfWs$T>0#H|nE=65b&)TqQmtN#PJz*`0*WVIioVyE^L^Fs z9sP3-TH_C#P1yF4K-?87oul$}bGdc*@_c{$ceTNs*4HC|Y(Ew2_Jp-2Q52qxfRH;h zroOM{F#B+FP}u6%2_Wj`G03N^P>{W{d#OsnBocsZ1@DvlQAizqW0dqr z0bXj~z`OadPIWayZheMK!nk<&J5Y*SMSsW~(wJe35$Vvy*PdMhb{Kb{DcIH_ z+f<-6`Ek~udq6JXFj*4Omfc-d0r+*C@(pN){eYsB0c3=RCeIqTb9tR(dIUo2m;Jvq zuP1<(0F9Zq*;L>_*TkDzVpw#b4rg3;A9x59_%aJcZrf)$*YSMn90@DI08o5Pah={a zd%(H%Jk1c?q5m*181GkP-|*MQVwYnY)d%pbhX8v1)Y1$QDP3=rxjGD#W=pfI z_q_Ge!K3>XsRix-W_tiW_w0?x$90!uAo}+cJT)YN7F#f=EJz$Z%y}U!4oPuTx(_O6 z(l!#8Q9i^*V%W+3YySTF7I40K(0d0CkuYT-C^kA;(Kg;jKqMv}>btpUhxCe*AK3Jn zT$Ge`N+<@>fJuJ+2??4u_+lAQm4^3kLi468vZ-t*?UR)fx8+JV1LE``zG4%2{X^(w zuP(;v_H=WrL8_(`+Mqz<*suH9D^v@V;r%N`HV>crD(Xtli+*ox&?4_QQx;da8=B1f zs0m|`aS{F0CZ(EAWblcx;me|`A9lHAoMvV`=9?jRBLg|Tlv*_wU;KI-T(|rwo#XQD zw{1;_p@)32z9^a`@M9V#ksgIrKdx0xzXDVAsYe5UibAP>;D?m{N!#RGrMfa)>Fj<# zm^Y)SvB%;%Z0VbUkEqW|>gXP1heLT7-h#7hT_@y2Y028 z-J&dwgrgiHoQ9CqRWL6KW-oz9$n zdbS4K8i9Bhqx6y5?@p;#x)$}8u@P0kjIgDA^XIZ}Pl0crt(QJ{b#U7J4u{Im{t9RP zXZm1r4v3>(1LUkpqGD7`X)k0v^3_Z+sf%PM6IR0~bvI5h6AJ_r7t{^~&+z9o^e`oQ~qpc-5xPhgh?& zIz3q%!)Y^0DJyk)0Dr|7cRxt?*P`Lb*(xN(l^~)Cwe$H{%zV(i9oZgf6E*6aw5K%6 za<@`3fXM&pjhN)Y>$P`pW_K8jg)t0RkLs#(o*LADL-9tIQu61yMgIzqG8IB{2+8To z=9Fo2;6(RHw=76o2_=fP9bOGl!hzOS*2*%$HG7{@_blxpeqaN31I4rgrX>34+(6}< zWNS-2XiC`}ShyqQa^+1<`kK>s=eEx%3@p@-8lY~U#`$Mf*(pO$Z zKH5xsn?2Qb1L77mE}VP{Gf7p05QodU$m@l-jAa)yX;r5Ot`UVW3GpO3jA&PcJmWrM z*8PdP$oH?ad@MJ3_XNY^{B0szn|Er3qOYMd9{bc|)KTqkfI)mMN3!=ulEo2wO}u&P zj-~;nDyDvlm#VG*T_+>P;jT8)wJ0Qkgm+L$B|$2ACh7S(zWftOw#sPPdf>BII4T9w zb0JwO^pV{Hu;OgH@maRz7fcyfdCs?8;oHWY0iHD31Si0|#P)NXTP(yT?>39?qr%;< zst5SUtq!bKE;AKmP0SBL*kJK|Dl(R3jrq2?!IbWy0tA;$yQ~#z)sPMOfw0pD^fL< zI#2+QjnYn$gPL)tO|^y&*ev@kmJBhC=hg=4u2w^IH}mx>t>ivA62u-)v`C!tNiRk) zq9!aYwsUO_CDO5RY3$wrDO&XBZLN2!Rb)%LDO&z;`w)}^I@>99#E_%yk2lJM`+Cy) z=a>Ah7HS#Lxk>9T1nkvqF{>GuoTa;*f?3C^$Tqz?mke@PI}s|;tL)cuvD3Vl_BEm$ zoS^cLo*PRPcIwv$H6foQ4~QP$+lb&22N?O66b$U_Wy^gkXMke7`eB=`f08$*;zq2u z%EPMjtxf%35~a7xy6W#G7Xa5^cU&wG|@^tlh3IZi_auXUBVYV`iu z#l#&HceafDc>NY|lp3nO94zD#+sn&TZo`3p$$!c_*;uzDOQANu(d-}}cP3@6P&YzqXfygS}LTR{E!)1e{f*VotPB8~)M}bpLjA604x%ykjY!KxQ9e+2-xWF+ zU0MW)`l++q>V8a#q^v!v^*a_K&B04G6$@7sv5h)2Unhp4E2JKmTC}K++hz(`K7w0c zE%$a}*hBU=?q)TC=rv>^;Ngte?0_v#L{5Dc0dWIFal#S^;4znwa2u;Tk?TnWPuC07 zHRz&EklsZ#Mi*DWD&W$DKaX?jOzC-Pi?fcvhJL61-Pu4 zt1ajWXLk+Llx3xK?BEY~pbs@aUn`@3WnH9DojE?V-iy6s1a0YyI~a!CQm!s#vXBRrzr&Vj z4p_)7d$p-4x&-MYrWn0EDRY0z6-=2vb3ggr_rAh(>30?JC3jaDz6or1ImX{IkW;>3 z;OvU1-wvdY(cYri{CMZ*eWO=Z!)PsCE4Bw>?Ama;)d%;;9A8ccJA9W=q(c_#nrGzd89W%o<}Y&axE_(=Q>apytSY#)&E#iQK6g+k_!aX#f;a=PDnq?ce}6qu*2T*3MSTbHe)?XA zH;4%4F{f`|nEIUo#1lH9#Ns!pBi-lggU%Y ziT^QH_up}c*Yq#H%%wpMA4PO%cm_+axnrc|F~|>YPKWnzOJ_=^`Q)7M=NWf}Z|#WG zW>pf-9x^Aml%s1CyIg|p9GU^M$>P z9Q@Q<5ITM^ww+Nd<0S~)0I$amx*cyZ<~33!@U~?O|Mx5aOkVS4Uge8}1ic>fWr`CU zBb%(93&N6HWZ=(UF}>EUanJ$IVj{@HpGrLYcs;=gzE-$4CGl(hLe_3zJdcPRlW}!U zPNHzN;1V${f5ZHR&!_IMA6N`%&v{gd)fb<`zc)5jwM82V>XjPYAsJ*RnRF9#_goNNieZ;Wt6ju7Stx6n;O$JM-}Snw`7a zOr5atvU-8hy$T(+fq@%aIbhRr%d?V8LKilYFAx}&;peU6LX5-7amkvJoIfqqi zQ(N`O{LndK$tcUv|7?dX-U->DRqz=qsUtB$VO@XJNzxonV>o(#xS)qu)X{TRkr!EJ zPn247b8;yIoQ#;ocd9tG1j)mE)HW~+*4h5wj7e|g^3t%REvux8&kIS5x-a5f@pQ*c zyp9%XeXmSZ`KlVSg7FyUWkJ#M)++?)gstk3iMsowg= z8Kt;rRe{F$g7tvr-B5V@V!HP?z*vspkX00mNg}!Ki89$vbRjv&k!CmQnO3Fr9boeO zOz&2;C0@K=M+|KebUcJ;C}2qpT0qwPUf4&)D$vu`1L0{VDv;D3xwM0Qq>Wgd9EESU z33&KUYj1KTXKq~!e)&E1NeJ`K#r&pBOw0_tEq7mJTU0C31nV=0&*jSV?ih4g`9KKJ z<>`PCJ1$Z>c51bD377!?E%1Zw^~5%h|Bth`jEZaP(uGe13ogOk-8Hzo2X_sG;K41p zQ@FdkTcN?-g1fs_aOdv4U*G=vj@y0D=^mrTfFJd1*V=Q=XU#`^7LMQC-uXP2X#Qbn zw%*KL>vHidHJ)*wFoC%7;YWS3TTl6aR)CSbZ5PzMk=fSTUzV_4Hldh4u|w<)VftjN z^i@F!g*M0Xwk{Kbk1=8J^z8nvPpJ*uYGD>~E6(A(Te_+H#ZPY--LG$`xDaupSMrF6 z5$DTpzqOpiLt1YYydH0m31EM@5qC0oN4kdbDo@U z3CxcnIYU^;F z{hMXc|F3!WMT0K)tqO?8rDgXxtzTU|yPOE8>dQ8&_{PP3FvZPjb$(*s?1Xm*v3e#$ z_GX`s2udEQ;tozL&``X+iX$>jh5Ca8S}z_NwiO%~8qTwyiK1qW2qQiD3l>kcETvk{ zGhMdvnJ$1G_PCDC(8(d2g=?Bo(3#C(wc5d6HQT0b6PT?B8T9MG-*Dg#KgWhhYzT96##KoppcS;C6z=jzWj&&4Q*#(VlHKBP)G&oG{jr_x+R}l zM{)w^X;5}%&=|MI`ig}^gK~}4J&Mn=?dHHS(Fy^TdS0^OisNfYE<&UOO0o&>V7JxI0N zICWVVe;^4iZ^++^2}k_L2j~CO%%`$cLrB@cviUg3@^<&ib8Ud$sZMHpfi`fjz0H;k zr*nx90x4K2wHn14tHyMm#dANqOxfc2$jY0HyB!Ftew_uPwpsPbM#h*~V$FP#GtR+-$aT&s6?Bi4H^ zR^|K}{f$w~&sVFfP)X&9oBrNrw|~idQDxM40_xA3rlHEf!0`uTIVn(-#xys_6}PPvnqBPgA+kSb-0}usMM8Q^CMIvttc*9`3nzHbgN_%=7Tt+ zt?Jz2OuqBXR!bSy*6m5tFXE?1N|s39*ZquJP|G#d(1$Nzr0=r%>XeL}yB37tBtX;HxvD!lL|FeVr-=e=UoMewo%T=>i?P&tH z6`|muj#^(bM-Z>27T49US>4zBA||$>gH!^N-2Y48*+W z72B9N(PNfNhb>^X34=xJMzhzpv|*1Ewx0w}PuZioS^_?Ims>WS?~>@tUsF#^lL!~= zkrAEgD)}U}397mfoqLvFvnllU$5)go73N!#-H$5IY>OE8?c$l7(dqFlYI~J?fIilt zrY~hNM-P^X|MAk zMey6Hryo&M5pJX^t0;Y*q)2lbzUARKrSylNllQL~QpFTM)tZv3Z_nqww~_OLj(HN1PVMHWhm#SS zbLAR)X>(r853;wR_@Uw03#e6JH=37Y&ZC^Nylx`Xq#e?&GA(uID>KSQm*;!{F{;hX zV9nXHvVn}i>Pot!;xRzeyK`Dnup{MNLTy1$*@%T?Jlvdukb)*@C?bh1q_T5#XAaM$ zQoi6$7N2XHzLS6|+m&zaN>K(>0#0&(|diM>PBvZL*EE zs{%ZJ$+aU=JVZ-Hu(jOpB2U#ypLgL+fkO$M%<0x4b)#PqJ%MHoL9LPgr!|+77ux$9 zqG#J1iya++W{-ggaNdNltD!s2Us(>0ng-$mr^^4DJiT~oNP2ckF4X!^mw}d1@9UR= z>=(~Q%`(ftj<7ezqZei|{lmkLbod9RQlNLLd9TH|Ws52jgYv@m2P=$dr@(t{0#L_a z@@`MAbDMNh^Sfi*2EO#fJ83gS@DQvV#<^9D!?lv!Gg^TQ_uYZ{!Y8Pd?}3m6#Kig$ z!*Vso06{^%SiwpuFj}DCgyTk5Ew!3~UyHtsB9FfS4P303VCu)={cz_OFJq2ax_bm8 zoDQ5=!G>_~ka(0}3!H$L%+e9Ger|sFPV=g(V|6iQVA8b%e#O2JN!$>pWKU6z1J@N1g+)X z{}ZEINaL(|UPcfaEL`^f=?(`~p77IKm8ikPjSQ~+?;*bGXuXW$*3>cg2&FuaO031^ zf0Sq+O!dAI<>JRUL2<(FQuozb${be~%ceKzhh`){2B?{1_d>2_B<-h^>%8amu!i7I z$&lM7TPXaslWF4v>o(fbJrv@jai3V^^yuk{4$6b_m2`cv1nofWD=22HY>GU@Jvm?m z=lHy6rg9}Af0z)a2+DMK!_PNXES>`N*YYgAzgE1YW|ho^Ga2OU3wgTzGN!gf zn~P?KiE?Zf^o^Q?foF%^m@FyLWyPc$_b(RQ`J}2Q6{O#v`X0Qt%9}WY-g>Eb>l7MF za}B^)mVp-WhW3Sq;&G`pav_1REQrIopS|E{IcWHI9U@}Pw8=QdE`}opvG_K#62#HF zxkNFgc!z5qRUI#_4pcbI&WiWF$gM7l7DX!elou^NWkL4WTf{1RzN{!KqR028^8K;# z$oxv$d!>FMjdchq1MJeEFovr2 z3@joX2H69Dkny(PU8$Q;Bt@fzgx{JEc}T(c_oJb1ml18}9UiS+{?NeH8cZOumJs^- zP*FPVm}iff-}R1iVYP*dP<#wtYWa8V7G+k}>m0_V5|-{z^e1X`wWMFFjFRQ2=wyXx zh+QUI;)_%fv!>NH;9lbd8`hFbant9Jpto$b+-55u9LyFXvOWm3b&4q=QJ3$q zPyovVC+$gfPDE4ziqK4DpDsGE{^5rmPj7!Q>_m0Kf!_A%yynH`$YgKHu+}e99pZ1 zT#&q_xKBft^Z`(ZQ3Uz%oJ;qAp=ST<`m_IAf^=IfoTB&7I=F<`DMc%s9}FzAMN5a9 z20wB!9+5F^-sj=7pr}NbAUnk<(p&!R+U7rXp7L!$_#U|oWxt#qA|Uq2dliWJ!8%(= z5(<~5RB7&FZ;GC5MHy6{TjfGi^s+dW_=%l8FTINWfJ@7 z15`DDs6X6TN=1?r2aE-R*kh|mYqOQooOvh$V!nJ&Ygl&wvvYpig2TokO4>qPV|OMEy^MOZPjh@#y4=Yf$nQfVvx6@m#Wl zT~IpAp-tE~B9-;tn0t7q!VJMvyd@PPxmFqzXb~g=Wd>4<4C-3?w@K!|`Ny~L5BKS{ zmwq{MQq%l1yY$a0?qb9cO5_Nct7!xYHYSkE<4G%s^Bjr}>ZG3QiNtbT)I$1w>xEHu z7bwyb2+1lv8FZ1Uw<=oC*EFjXpi~&ejBYMV^UQ9AZhSMPqDon&Z(Ne19YV0%n_)z{ z*In}}5pylu91$@if=Q8V8<(par5)aXc^OY;%tEl~=Rgz2I-ntJ-d~@GKyCmu)=JdG z%@2bo(%8E{EQO>y;3lkS6j4ZTQLqLFklMwEnvST7##1k zsYJfs(-NY~VsTyoot2r@`=eHJCn{#3cdhboJaPVuAFJ3r`#8V0hfte%K{2KuFz#`l z6;;*GvtKO08jujc2Z#T>qOlp=(dbXb&T%UG(Ged~RG9fp zaQ{$Ih|~kyBGl;aXQf962D`ZFF5Qfwy4-YPeHujn!|OFU<|L%U}WK&snhAd+mZd}WoQrK`&t}cw0i%{(G`}PV2 zQ6kS@u*>Bqc=$5|t;e46sG>m+`OyP=NBN%dT<5!Ol4c z#*aCJ4Djt@qSXBI#vKk;^@>MTl~AWtG!1d^GX0z-%IQw6X*K=PbCZV0bSFa;jWpj3 zQ!^;V5AB7$NEf?TF1RATkHLrFAh*T7)T%mIfmAP%E|6Z>WO zQL`WKBxhjK%21}T1FlrkF5EI88Y<-h!F`|n{qB4F1oKb_oClXd$70kEZGoBq3lTQ~ z3vREoCk7#aI6TDa)j!;hpQKn=#hyCJusb|U&NNGQ#9@QtK{+Z!Wmhp;xe3^ojb|^E z>IPAxmvoCU`RS^ZmHf|+J+(=;V{M+!f|iU6U-z7<{u}{lr$wOq<4rBTQVz}oe-7}A zlw@(P1(r{>xyUTIO?=t&g5a=TWBc9ZImQ8a=y_E@AXZV%QFWbF>$`Nj0EsQMm$G?# zn76hg&9K0iURWb`sw^KVY4bK+A`aMRPrpIZVy6NW-AWz<^mZ)>y061>NVzd?heU6z zPa7f1jytxotBcv2n(W!+Hqaq4qYLrm%2AE5 zNUFK<@8c0qPjc626Ork)7ozQ>tK%LH5p65k5GhyfPjtq`=L8AFwCka36}E$#{9A|L z&;a*ba)H_D#FgC{D*3u$DykQffI|uK*EzvAG*kyB#q^xU^hp&Yo|{G3uC#v^=!5*n zB4Bw0zTW2eWr>NTwcwxroi^Qh>Sjd$)wub8-%9+)Z?b>Mu3P7jYC=Y{>SRN0#JFhX zm=#?eqrNjlCuM>W`#j1aR*t}X4;!+23q69|56q#5sLkF>1Af87B%J9qWpRTRTmDSY zsc&GA35&r8Ut5yz{@T2OOwF4n1mlJ)o|oGciHjx)ej2b(#Y&VYeqH0nl#HvgoJkP3P zRnk`iFz$ERxNkT}RqzhbuUNJlC?j3v_yF3vChs8gd_!7Jav-~CC7^51?G?gqh(jJG zq$yI8Z*bS_slcU>x`45QqRF27D?DA!izdukLQxBKC;*@}%-;+dXF6*Igx}u6qBhP* zraZju)_jEnB>7-8bWeBSx2d(ekUXJj3Z)h^dG9j}_rL+rWXDiDv4t}kNk+~fEx+$?@^ z;dj5X1MVkMJhmgbR)B1V-5{htP8WCE(G^1Ff|wgjv2SsQGd{8WHpJWs2>!Mzf1M-L z**23%qxoysp&=$v%DWk(L!|J7C(;wSjcDS8UpcRRfen@!TpDs#l2g~oMTuXs`gZpq z5nJ{jqd-6me*feY<|*xc{lS=|fLj3ak#g4=!Y|kDnBp$g@ka^HvtC>fqbX$aXQomY z^l@?{_Zj@_iK6yv_cSKuZ11rbN2tJXw}!b=;iuqcuhI|h!*H=wwp{ujdI;XwIq< zQ2nPNw3Ld{5EvlkPGxwEqcj0oae(u}V+%l;lwp&i;#&PaZ7I4AIQAR@c4zBnUu0hp z*1F2z9>jW#rR3OTNxJi|<5dU!ddFLP2yH^;_-CZKfyw`EVdCY;U35z$Bi)6HEYmJ$ zti%8!=K`^bf1lIXM%>^Gmt;Qfv!@YhPy+mcb)4HU4Lt^V4g1iK^!bIB`Yfyz^AKoX z2U%xxrax-8N0-l@+D;%RP#Q~wUo99M5@Op4Eh*f0lIO}0*0XJ?k8zDtnZo+8|A%0* zTWG#n52Xol*vLCLkDI_x&E^}%{?yoCWj_vVgrbA6)1mC%+gugupvmVxw5QR=z=b16 zP4(5Zd_uwSzZ5PU%t)h_yi}50VW|)qpQAh8u^1dF%5X2m1K6_ia6|ylBIEHO545vy z!UY(4wP=~Ai0=b8e`f#->icaIx}t-|%Vic?p=KvC+Ew3M?p0iOtDNw_$<>juyW;fu zeIXlBSXpvGx0DByC;=JQ6lpvMo8}jHN;1Anh0qU4$~W#8yHxf%VNWG^*WE;bz<`l4 zF1;vS_~Q;4CI*HwWtA4Wt>+JF$?^@5k(JRX;$co0GcKlBYyTj@Lp(lQ+6jIVq|XdD z_wK>XXMj|eJ{nn~4EwIk!Q?Io+d03&^2oZhFmdn)c$M?Y)Qna24h(=Gj3@asgw6L-GJBOzK z6zvPKLAMx7k~T(ff{^8hkWT?z{OOFV+qgeE zJO=si87t>Et2)lxt>a!i&gGoqB!NPT-$zDD?6O%@JEcDPrA~hg@jyw6sg56+VhVyl zx(AIEMioZ#F-4l<%WJSB-QUBvC7@kGtP| zuWL~b(Bev9jNN4kw7xjKz=R1r_}*WiR6KXhvXrF6D0O1IAa`){SAcx7lXe*3n?F4? z;l(&!N)u-}OH}Svgek5YCg0Uy&R)Xn#N*&t?Pazuv0@cR(ogb!zEI)K#QC4RI6vb@ zg}$sBAtTzgaKzM$1spF?pLET&<`j?)B2L|EAH-J25k>I1Gh7RBQe-a;5O?XAfya+U znJeHkyDBxQ(0*TkHmcD#-4^8(&3}W30Lob5T>f_Y@xtvHk*k>uNl@hr4`>MR(O$L& z@2cC3CM%M(RO+?1aHt!sGNqOVJI#tK`j-cUQ##G3N;;6FFNp@Ma0Y!D4o=|S>c?c@<xKCocEuUXQ}t2P|vRn))zxioND-^q}J0mfirCR`Qm2%fH4bYdo$FHYI?x za((xEGnb{3qSlx^iMH>KN}ipG|2=p)=s*7US`7_+>T2Wp($g zeP3UXNMTLhdE{tiF~e&v#dvv||8B#MYbV`tHL-K08&J>TRsuwnGk}5SR94kd*tGB9 zXI0gnIN{j%Ig?2`vnb6Zbp>iai!4>a-IK9!($jG>uqSsmMv~xE-*rrX4fw8{?djM!Vd;I(!Ph{Lok1gt5W7JZiXzHT zm>Tmd2DHp&iQp$px0!v^!vokSmGMBc=0fTk6jB`mv+=u+BlNOv(&9UwegcWZ-9%iu zWg-{dZo{ZU$nXWafji-s@mATjF}12-I3EjU*%KwFg&HQ}l)?^~!b}&DUEHTlYz=ay zP+yqwM~?_a)5sXnFhE+3^-Nlj^#a6e9m4Fwi5kRQ=xskow(Yp?TuNqIVD0`?6bbL_ zj{WaUo4z!WZ=TlL9rt%!d{nic)vNx{aW*_GDVs_uSKV7ETj>LtRM;Dg-p}aOv{6VIeeWYQoTjXDFn?jqrb$tG@~nxxtsG^(>4$Q? zmSae$Za$*$(fl|;Gv|r*>EXC4CF6LxsS5A+609vHcw@mZzxQFh(=fSJ$QwIK*RjJf zsq(CpuFB5q;VP8Ho&}g?z<~MAVI|<6=aj&^Y3p-)33jhpP?jV(oYQuUjCe(0lVcjV z9Y3DavDLes6h&_J^0@^>PA1QKE#IC0P@^8Qr|bYH@js+1>VCiO;n<yj?-~e{D!nV*qw$bC`&@#5PJUV|)p7TiauoI&))gU1 z*Bq)^VAor<{0_Yx<1ls`HLKQ`=YQ&ve`6$6POh%1J&FQL>`=azd zLlR1T0}9nDVGg_Mi577-cK)N!$xOrIFHbsBUXE9E`OcrQ-N`c)_|Vl!~W$ zAl%pIJ~M3z0XGs^0oa_Mr4l`waeDuqorNmwJ0fpLUNd;DRV3c*nvM` zTdCE@W|L}PXDZ*=*u z0KWF=Qw_Al&;w>AnmRTOPK~c(AByKe-Hkb>Oq4`|8ea_km7=y+N0>UdfIX`-qWu90 zOe^5AJsydFpSiPzBYupK%pfk!olKMIF}|2m*nFPPatfqT#X)x*atPoqa;|$iPI+y< zoR6}(^>{wijz;mG0ZzV;ciW1(fD_URK$)#@2B>}CfkDcl>34tHS7{5%?TUadMNEC} zX=X0x6V1ilGhT{$Hukj)$MNVTx6I!@u|*NK9rtrykS-W^{t@~*>Mj3Ie63ZH*f~5o z)dt_1a~?pLTMNDjD2qe}lQgbc|A5OOF5Nxql9T$0**TVIq;oCW_C z4M(E`2ift(O+~;z^Ab@RaFcuM^ecFt!_(-6)wS@-yC6b<&*$6DFtJUW4^&^ZjcYEe)9+6~C{L`FI0G83fSB z=^jBf%fvSETwD6-xEtw{YBVf*;o|yzL8D{6BF6O zBmErHE{CzRu7CkrnY_!j3GMZVY$t~F==x*@Oq?lzGErDu4)x{hCi%DlTP!+f zn^}TfJLljKx_*2a-u56F-X1mG%iz6LzpZ`dXw1Jj6FB25R_cflpbBFpC5y0M4o~f3 z=h>UK{_{!0cPP_${e%y+Y<=#12E4S6SzZsPrUq3XEfC}?5#)HiG!6?6PsaJKIk>(L z;t5)$w7X9f9xK9idYt1oDTwAlOVAAKPUacORH-F8qc#u0T;q!GW@|vKxxZp1LTtXC znuNSO61FTG6!%b(-0zq&1$`=Dpd<@dQfG?SKSvda9zo&g{Jp2+@a>evJLywQjqKV7 zI{Nc*{#$&@u+|AgJZE3R>!k`07ct-Ph-&9(kLy&5>GY;;1>V+HKy%nwNKn-HM>hXw z$X|WFeU)sl>Cd`-%~SlqLJoeX(mD&c<}>_SajnI>JS;jwj?=LL_vryX8Al+Hp7Sct z1?sO5M?l3_&U>4Fxw63Ib(v|-KvXvv<#M>!M&KL|==60!)#4Eoo!G}ng7j(oFFr4E zL7=BTwI?X!OBh^TldE&VtgWVX@8c-m7jEmd9{N24_d^P6J5NCBwNt!SwhBo2ah}lh zIgl`CQ+D*rIo=|gDOV!0E z4!zsY!@nQ8JT#d?;y7NiMBr0K)@ewCeS+HK%dVy*v(4oRQ(VS&4SR`KrpqlfT@X4| z7UXBj{r&p>O5$sg`>^FVl_L4SF)jT+uv;A7JD0Uj+Oi_s$e@k%m9O>g5xzqiZ`xX2 zgIVqr6wf#mX|J7TPtT(f8@sGR(vh6?){quAKV8 z;))54qe}rz_$RfVH2ngaIMm0FF;a1~Z*xigh$TvynSUa%J zo9i#v&DDT^tk#%)PEAcsb;D{broo?d)E-5qmvzV#$djIr{V_-EJ9}imyBxC#SP2%|kt4$l@19mOi5S7}$HK*h1=|mbHc208gCifUjZy}$ zrQ!8)ifkmBnxqUmOpEkmDi{3M4Q9xMYpNVb+gWrr$+%S@u?}sXDQHY89Ta0XOAqTFC@V=5adL%@mPkHQYn0>1)i(x{w*GCv0bI z$qP{%DU_!0$RdBUQ6702w%m}*r1%F za8f;Ow6*qx-)d2nH~(Tk?QS{|+%2`kA^$PYh}4$&J9Vz+4mLs!kFoqsKQ41yO^<_+ zqiB{lLg9$p41DMwG`=)xF_9C$)}Ht1Hb{ZhBa*)2Xc{J=2Zjs649Q#4 zYIc<5hHiGBQ$|gQ=}#-Ifh`K9C0{1S(Tw#;cwc{B3^V@J_AlK7?Up$Q=?5!D6L<`x zRln>|@tCoB0||eDP;a@ytO+oq;8@9y5Vd5}zh0Oi$%op+FNmll)=c-DB(xk|FV1lD z%eG9vh$vxNF?|R9ObcwZ)*2*Qm`}vuik$`9fAH=hlY&Xth;H+=A@~v*H z8%7Y~{pt>sFd(XyZQ?<W6cq zVwaJ@0isi1zU?whk}cQKl9K7Qc$$GHuP}GDSh}Pf{lU8kQyFzwpgOQL;rl}5w5=1) z=gnzbbFN6-yXb=Gt_CBYBoZ*kkUI=wCJthudR_H+kKD*|q0XsP9nk(sWgx9iNBtS4 z_xiB89%K^rTvmNSYfr_*@tffbmhZ40EnK!6s7k9XsNr#K%Lli}-5+{RJWryizJ~pb zmv9j*ThC^gdMsUty?AC`&yTT<9X`E+JHVV7Wf3XBj5y81G@RN*r4kl<%}z&o#BnFX z!C%VYWQ>D%HTxCKF_&NFD4HABoxN#}$L9ro)2GAD#`XDl9cAsl(k0mKau3XvdJe2{ zY{eYC_C`}^hAoT(wdhoc-ZXHq+#uFERZTjxtUA`4f(jUUfFE*;MmkRYzMHL_l}^ej{Q z-T^OxYkH%G6vT`hOgIArdg&vr{^$^CF0tQcvE|2CRtffBS+d+?leaH*`#CKAF(*_R z2|khbVsjjFFu%q8*?g##TA`+h%1`}th-FfLggJc*xn|0W-=oy|@D9}kA(2MJ4BVx< z9brs(EwWWE7wVoyUL-Zf$I9g(R|6zi{*}VrxBq5{*hb6UZ_1{~i@U30dICmvdqziY zM+EC=J26x?-4--cC$r)Op)I zg;IY}YSL(r$|a%o;#zEsnmqa*veau8Kjz_jy2Vj$@*AD{^k-6s(H=q0k-J=lSqBu9YxVW%3t-W)%D`BApJ9sXDpSknti}b#a^vBJCb1c1i5M40c(3%F z4+|ReRy4YWVcMrOfStl>k4DD>hoalf$)XV;2>t%}Mc{JLt|yYqT*2nVHTm)&kCU~} z)MXUWTMb+bqFPz^%&H zU8bJv&gQj5TYbTTq8=B|@2iB={7T6D4=hvhZuxQpm9n4W5k^_{a7@-Yl0)-~gfW8*HcQe=%o}R` z-%5j8;76b|)RatTnr#Q}hVE@@H;;mDC?_a8?~d}@X||06+jHYIWWwi_4WwC2)9aRR|zv@D0^Ow_O-_>G9s62Is?u{P_D1J?K54TSMMtx}AWRe7#KcmL1os zD-0SS)Ir%3==gbdaBHf`OqA7n2pl<0wD*(sT%4Q~qsct823dn|n#TIZJ-)8#piM~W zI?{7Zx{(Draa5D^JYs}Fe`;j7ilK+$NBg~Oq z1;+CB%sVaNv5Jp4A8EON1V?BK?|mG2lv11~)Lk+WFY?N+*C?O}ONpm%tDM%4+1YJq zxFl=pK;vM>|B$Oc=sGuJStTP8@*M@tIWA}Lj=(q_P2VDv;LbE!M3>iZ4;lsF}C+) zIbq_44(NAXZZ5&VjG@;wrq``FJ+shmuH}k_SK!1*zUs14clm;*x=Car?mHJ|YMWqA zPjF`CF4MJdjO~mc-MTRDas7_>VpsZVT=>_wBg@)(sP*LPP*;5^M|K_6B7&Y8{iLar zGA^gfiilu4z>_23v~hK=Q~!QgBM87J3}%EWMiQfZ!_UavKS_JH0eijQD;t;X=U!QR zkR~Qq;YKo-2vr3J=2J6!|}WO@odo=*Ua&m5I>dT=w%q@(21Fa@4+OnTOsyh2Yi zzu<|J;zeo9)l?cT>mk#1!Nd@Mk;_8Wzu3YG^5H*2-_)A$G;ef#dN5c+`IA*C2Ql%# z<_fvAMg=LwX6hklc(W)^EXa#*(Pu{&m+-Ak#t^K;5d|ERNsTg0Tq?nC-we{Joi+^o z_I7?x^AaxXWnSy(Nq!jGSDfi87Y_%bL@&Y*c8@hpkBQJQ)ku7!{T(?|p*+@<*aCss6k(nEKm9fcNcaPJxZx6(+z&}*)oC!~G zCNSDkg6@x)Sh(LZiao|5ee3RJ*RLGwvg)MKe7ok+qit2Oi%44Jc~iFuX=-QSyW0>o z(WsDKUeNoIe{#M}oNoN37 z`$6Dl!5p^Bol$U5Qu{ZbDxYyO$L>E~_kVD+2Vqg>MN0Lpz+(UpXo10bdd_-5;<8y0 zA4^@!?Bm47IPaMhUS)xwsy<^|e=h~1|MLBM+3x*eTo0-wJ`T^XiJjnbH;@~l^PN%V zmo?#WOxL?j$!;Jz_e_@m^}aO_-p3&(Yx|8Xk^4cHbJ?c-L*I6Ct_6e*Gv2ACI*HpAE#b!E($}Q)uIi z5F=}wLTcu7)c3);|H=z$e*4|ENTWmTs6~}j8|BXdq>EABQwkd=FAHA<5{avyP6Q;4_tr+OcyoGAn9(Ck9G%l0P+x3=sD(o0Y!>ah^%W zYZawz&kWE_(;`SV$oH37Fbg^yQ^-~s+!jS?@7wK){%Al#CTu0+k8Yk0Sc< z*4Kmo5CN0DVTajlY`OadU>pE3Pm&wzq!rlUp6fHi9EqACB(AEQXtPT&41FznpL%zZ z8sVE=KaWda+#XmJ}@(Q)Y+ICKQ%<`?4ZPS8&ZalOIJ?xvJvW4R1qBg7C zUWDcklWN04pY6_9UVP_+976kW22SL4-q$u@W0Mq|=Hun)dNnoBeY0$h<-B4KV|!t; z^R5x?Km>1fl;x(`-xy?=QOmX~$Qw0nYk z(cS7wE0NQ8UMy%--6-Qv0(qU}ZGI7KeLu2z=0}7C8g(O2_qy>3Yx6IFdiK zGDMLSy|_jRmW_#H8(22mZjqhW(Cv39$SjOoXC8WMuQPol?B$8p)U+qpTM%VtNTe4l zn>x`u&4!&;!dEMPPJ+&~1MPERqUlg}T+c-@7eOZ}-A;R`JQ=!O|Hbl&7RD*nDwYo} z!<}SN3R{C3ch7=|k!RX0(%=X}a9un8()JQoyM@CONk2pA@;M;<4*J{;DKx7@q_yE$N8gMd zMw4){#nBS`h5mMFvipQ1dyf(AlSQE%irY1(d9-q>l^I9=-#d<3yu5st%by9&dAD+M zOh;`TTOZFRZkgtQ7#Sc)ock_XlnhfAdyJdA^0DuF6Ucrvyz8YB*n4O>uEe`pwiSGJ z5Ix+?4QKoy*nU^U;xyXy8GuvhYmk1fz}J`ldA?w+I`crlWMr&UM%9{k8ETV^=-D;- zdD1`gUFzV4VrTK1Q^mA zAYmG9-Iwoy@p)<5%e!{}Z1d@|lgM031)=Vz#!O{9w*&hl?+pif>P@L1)izl|p^>v;y@XwY`6bW7O!$sV)lJ<6?{zjwFX2qA?k_Ny#5x$*no& zVTK)K_OfQ;MRHm*JQzQEGjAuh2!P_aN3L@T73uqe4fUqh)QflvHZ`&0u{rmCm2>T> z&&apa@WXiAJuSXkB6`}wFKC^IQf2-CJ7f!=0ShHqgV%@op7qxrov|<8CHkKUOP=q# z;d?sqA9L)0?ViS-s@qPCWcOp#eGz0W4;1Q1>sc58#I{%34Uz;0F27E$v|#dVICt8* zjdX3cU3OT>CUW=gg5@GXtr9-vUpuf~?gkR~YeX;jDDj`yZo!=z7Rba=m%QiAY;9*w zFzy0w%DjvBVBSaWwsF4gQHXu(?zzFsh2bJa7O;|D#)T6!L<9|_Fo;XYhbYBjTTKIl zYCzb_lmeh7Y|tgXrnly1$m#(rcpx7h5+nS&c;)*ne_JZM{rvrXiK_}xlW8uEO(ck+ zU*ut^mufuR>Cvs04FBro7r*R__%#q39hFj2Dnh9+Wdj24UM;B3TNHTFdNfsw+G#d* zMnz+lU2wuL?C43W1E-tZt06sUosmxXXq0h>oG$wj#dpBkkBbGaVHJ0NxlS={euzjAgcnr^%K@ zUWW0|)SSq-OWidtd++C2Jb0X1AxEr|3yeNkH`_^`OYo)ke8;2a@xlND>-m8FMQeS4 zH85+JvU^`<@JuUTHOpqW3ve2lzcrn58X>lxo&p?7)JpK)5@aC{RCt!MxjCop!O-b- zURqXxd-kxcx4Cp&34d8(Kj~ZlyC(X%j;{NgMT1T2Y9j!vllM6`rv?Z|Mi90ex5DTG zGMtxafI-N=|ImD$q&gX$ZOL^Tu?L_fpw9so<#yBZT#Jl9=H1YDCL`#0JrfxJVr0(r zvlmX-XHiEUvix4q!5mwYtgdE|Jjj4b$7fv-iZIbjrNqh~l)q-+e1iWaFmE%$<1ZxW zuGyrg>j62;1agi3TY^V4sta7b*vj9GdOqGx4qbsUa*gEkx*i1cK!W>CtkeA`fIkVP--lT*f6ycM*?M4t#ps)I5ZDr+@2?1X4xPPN7RA$CL70 zg1n_YOWX`8YnT%p7vU|8q{>4Bxd+iFm&u#D_R|lA!U|@m$~YC6$rho}at-?~}TsbI`fD``F-= zp$1pCX&2crcLO)lBS_jZSnOLB9&z&TUFUEA@q(pSMD#S7mEhqt#6aW4Ou@t(uqa$p z?O!yzvT*+yL!R0w6MP=~KEoMln*Y9kbAi=YbF`jxGamO%mZ_+rWre2TTy2$#*O|(% zY35bhSSLF{hNBGD*(tRw7|FM1^U6tx>PPuD*8-tbqeU9s?Mxjo|#Aa=IY08yOSpS(c@KymY14O~*4yX!7ObO;*mh>5Y&oB63?TyRQDJ>o_MqS7UC-3Uw3`KXE4Q9BWwoV zMPX*#l1~fI%q{B1TSs z)!JY3O^ni&_>y&GQFpM?UhG4#o}CxjA+ni$Z|#el6ddev!7(t`Ejtgfe|wVuk1sGs z{G3?`QF0LVhmOkp>0JFBGFE<-Rm~H zcwWE2r@(i(6ZOejL9UrZOOloxoMS_-U0Rj9jDjh?aFAG#CVR63jk?cns!g`cUu*Td zd~)pI#`|FXI^w<-3I-Fq=;O_f`gTGQo1A!JH`_O-6&2x?#;SMvzkXqr5+xJ_q(Mr$a|jjbQjl(GX^;Vi5)qJAx)EvVknS2n zLRwF-&-$#Gx@d+WWxi+1i0^H-PgsYie`>te$`@AP9noPxBiii1JV1S!0xBezmQ z9jo28xJ{WR=?c{cm;@y=n{@6$G&?Ygpi#1jE%`=4VsWIP-vqKZqOujDL#hZujlc!Q zD+;V8m8^iDbsm_30vDX~I?hO_n|}4_x8r>4SC+B~ zF~sSk{thdoSzUQ#u`;a8v{(TnXKyd^enZ#Slk(36pPI>DnhMjptBsiH-=38uIYQsN z1@2rX@NC#px33PEc}}C#pK{C*Y#ESQyn?Hd9R1c^xJ$Ev)?6k}V!Vs;MSW#p`!)k_ zlvvJ;A{f3+WE&vR(OO8CL5y19JW4DZI`$mH2`Ya|>!>(Ei^0sr@x$Cg&(JZb@HEd^ z_^TqE)oZ#y{q?|-_5KpcjCOSCSxf@wi=XAzcXuY<>)f{B`j9lqsCoJlaCSkPoD#<) z;&6rJU55B&_F?mA2z~G88~HVg%LzNlZ$8^$!AS?VIbE#%S4NmVf1};}03pOBb6R~n z856pi@2>PJ1c_-Owg-~FAO+$RKU;L8c(Ctzx-yw;Lb&F_ech#xd!~Dzrkj@))?m67>zx?{`AS8kqQ{Bh@NyfJ!%BIE6pX z%RXH;SLWsmkZr0_#)1miN#4vZ^Q?pObR{w!-+3^wpP{D9%cfpNAGZ7|}^ z?7(N_Lxp7ZZ1OznC~a93H~W71k%CxF{mV+=%SoG|io??g)^0TU8}))1E5kf$6>FW! zFVamd;dME;1${f3TjEGdK4dm6Sd0@a$T>(`M9e>c3p%U_8bqf`QO1K;NChQAf1?!e z-_fnr=~fqkH_XG-5KnLuw3S(xIg!y;9Vl6mgl)M9oN4P%&1->Ca$D8Sar$%JZ6$J+ zt>g-awQfFuVFlj*9SfzQBP3%|0?)ZBdhykg< zNUi%*>?5!9Xfmz2Nj~MS%O=&Qx34;Hr0!UZp&e63o5^y7R}}LQs;@%Z!z^C6;qe=7<}CQXtMF$rC@&#glQqJ}Wo$M`R+CWJmp(}H z@-P*;8MFI>TYzQoR**tx+x?UAJbv-*F^~nGR&f^Um@A+sF&)FF}pWfJRUT{ z>(72kYfKjo5pi#g-R)(OJgv(Mq-E3)`|DeFD*9&UML_76bv5#Q%Iush=v;DOkDhuz zY?(5Vmx?*c7(#rKsau0On&@~t3oa6j8YU+ga@OvC?1b`crta zJbKGJ_4)9WK;{=G#8d4^~w~{skx3Vq`61&nxQb3r1m*Al<5>%=rsl6Q?a+;5o2~*RmqbK`eCWs{! zw9Vcd1xj800+Z1$YK=QpbU}F>@hpP2%Ac^)jch>6-?s4x#$dI)4^F8BB_QJW#17=V z=+st%0;131V%sX4qXSgS*-rSv;)Xk)XYd=R^yw3uW=V%_yiZ4( z@^{xD(I4@f7#Ht0eFD?WEs*%kyrt!gsDU@DQ}};L&n~8pN>*)9qU`7El7~FVC(G1l zoHMK#jKym2w$Wui4pQ~fc=W8QyV4=emm~=;Pwt8DtJ)A;85~4287{(WG_sg-C{jEa zxcG<=9iK-ysWxk~6aE2z~OUN94d6-8# z3wk@fh%lC99Z;!$fc=O`{6+5VxK$jr2>#G(mQN)g6Wl)9U;*jM#{y^7s@9;TBhGtB z*gMtNEMoB*0~E>F&1n|wYJIdb;Vi=c8np?_GT2>6CM13>AiK5=n(M~XL`mw4o({{(U z%crWFUiV3#AC;O(YSLZiO>>u#%Ba%(J+bb zhvdRoBQkrsjpf_5wv*Lk5)!!Nqn+u4EQcN)OMOcA^sF;t2;a5S! zA*AjNN4`)KP2`18@rY-q)8)rkN*-b&?|gnmK^p9K^KU&4vXOJ5;@WPzTZE{pk=J^{ zGe)m;-gpbnX)5BAcxaGB6GuudT^(-We+~RS>~->nRX9AoAWt&!jT{|~67To$v1g8E zJoy;~iDx1eVM=o#mlKh+#`eAg+n!`e?)hpQ4KS+;2Z>O7p{k&8={pvSpW?_26ppdf z_gD=)^#t3JGYVEQGW&2)&$=sfRlPK2**rKb>3k<_z$tsV4n&e2=q~5eq^he>PbTUk zBB|r7NI|((S-%JTBW<_jk{PZ31p4z|jcwH_U#6%h*;*iduAtfru^0IUBVHU8L+P!5 z5PmhKhmnJ&G|F~Cma2u9b&)lZ@KmBV)z8aErm6f!eI*avraH;&wMyDiH6+Q&_GVmn zv}MzGh)YwTgawT#4^V%Q$mo5+IB0{h8rz6PI`_?uR2(v`;m?a-n5kY?{IWyX!0IV) z%WdNIpGF3>Slr=nrz4E1)YR^}@z+xmis-$aE{w*i8>h*yQQFU@MR9=8dp7WBgZSmZ z!S{)@DBox*ek5?{tL>nHOx<&StDtHlNlaV1f?C5BDwW#bqaroUmDaUaqzD&J#D=Q19XzA5(OL26ik<$iX|z-JBs-0Quw#_ zGWF{TgGLo5cqb#j5pYffYNb`F`{@>PGa21AvwhG%-{d#}*(h4$ph^HEg^r6JgUFBzsw=TCZ@H4zjI5f?tpCdao_^3@Pn z*?i-^#Iq*Tl9Ge^!XBFQbD{QXyb}_!@Emnb*?_D!5UdPq*jD=wZc&mQILJ z8RuyFt_X06Mov1e#d>tDmo3OOeW&}=L|gXDNb5TOV^5r{F`=hT(i83?eGWGCLdI{E zs;wC}@k!PsUg+&sfHYOJc8Kh$osgeI7h_E)?1>_iRpShq#zyVfAUOP6LWpal?z;p-7et;McL&f6Tud9KY83Z=d(#BXh=8OeAXtSWgEee3ItISIFT)KEc&wr)+ZZIT1gtjA6iI0R-evTHO`ZdkJa@cWsE@I0paL4t8g552mgg24@)20Me*;o7>-|lKy!7lY z%d}Y7fq&h`MSid16)vy9+?&xd(sr37gi9g*SkC&KfSfR;`DoHvj@Z4KZ6*nlcUlxh zizA4xWSjBCM0Oj9?OgNG4H}xV7@P^N;2ap2h9$mHQpV%}kodZm?DZwReV}Y~Sh&G? z{xG*xSxrtk?E4M6lch$N2dW}r+pnCg*X2~xh~)3(NuQeFA#KC^N*{l~ieof>@-d2m z^wnn{QOlNxtOw8Ksba-};u~Q!uf(8oql%js_ci#YhdxWPA_Jbvc#p}*?TG|>6=D4( z(M896L2f_qU!ux>c-6hS#7)H5*gj8?OH4ZJ$Cv8~l(*B^jneiMkxXParAl!LSJLps zP20wp{_v2P0=VD~s`~p|Js_g*h%997Iwu7Tv9Q?W6_7^A+|>3uu_}pI`7QUWWF@|x zrr6nmbU4puA$THqYwPiBR`Q`;3BqP|tio(m*D<;%io7B-TfWR1^XXPHwF*R&ALXza zGQ*Jpg=Ce#%mA5kj0-9Yfu|03D2p@;8%kAaSX&-&x#lC>BvsM^JCl2&u)2>jzM8<( zM$nq*lqHA)1kNe8t=Y>mRZJQVX<*d8m6>j_6rAeBGn-$r&?A4_(ikSV{&~*?2YS}q z*kP0$;)Dm1R8S3<_DQW+M@?o}tt>?ywNfwla2ly#0U1RLM{uKWZ;YB!f+`67n8T>p z15)7LpQ!Y=89P(&;nH&S#vSw&4o0QQ#!I6=>-+U0@P8po*83l^S4#e&*%bL!2*L!knB^qkdEE{(%Wx|wn{$uz{AU)7PZA7AtCi=e>d za|=;6Oax=11E`I)MH?i2x$GS>rucR;8agFom9+D2Rx|(R_uSeeJ{EA@Ts#V~ZBC+Q zqvv7DI~;s#H?pXEeay-8)=rwMaFlJFW-V5Npc~q8iHo9c3Wddq{_iZPu^1(k7}c-S zUHcN2pUk6GA_QHLiB8;`B}`W%Hp=|6RQLD>KjQJ^6m+O(MZ4`UdT7=pCF$?K!?iUB zp&W4MMVJ)fT)q843(L^2Sf?^GYlw>826FSpUx(j zh+}_?v-w{KLw|bAZl1`w$l>lMxReBwbpe2cL;-lC@>bE%qe&7(n3qV`MfMBfB9Z8( z%E1jym#E5-L#mt-mI_a3Rs9a`Yjp^AGVbKve1NfC;&GXb>e`?NParTk?!xQ79MvPJ z>JMK-n-fi0g2l+-A#%#lH~AYuUmrKN2Z{vuw*|(R#%M)$vrmui1LW9e-FNc}MvdaK zNaULv)4w&=pL{k;V3dm_J2mkwS9~?L1EoG~wDhuuW3jB;5oYzir%f-IN?g6KuG-}h zYViF4wSha`80x_PW)ujMJy`67@w_z~o5az6FkV550nYAB#TqW%tsi9C)^LDJxFW2a zD__m%$)Cb3WhCdrR5#KxRqn{sqS_onR?JK7j;0A#On)uY zDC0x80s+zE%rJdNkRo?ih(YLj1SBp&rIk?}kKOxr%hQh4-NR)UT{#Ny@Q%$>cZ8Ed zln2T)Tb!5|sG)SBbbs0>`f^pKZ(ZlcLqweCCgEz{Rb*n@UHol#vl&m`AH0hn_b~q! zDPExdh%pk#se2p~%^6R-HgZU6Kb8Jk(Oj2vNE^v`>OIMBbibz!)zw;>uV(d!$(opd zd7~L|4F$!c2Jqu&{kW02&ug%Y!E5*=C~Oj-3asGxu&6=*xvYI(?WDTh{6~AL9`^NN zUE{;Pg520jP_Rv2I-de3NJzpmmI-0nT{5#`xy0L*>?01^>KY>omc1$JT#p}{nr``P zwH;HmSj(~L(i9RQM=)e@+LM}^=27_ofA1tpP1l>ln5+zM9RD2v=Oi4C^L)%w>V8RS z^;F=6W5S6Td?^vlYiFF)-t{)|&fV;tio!2okS7tQ`&h?l`|fgdyi%&1s)7~$a_ns8 zr_tWhl2I6&2GHE2Vkxr3VD3!1t=Y7-No;%Bb-XU3N6V}|T_9}Ux2eE>L-g~b>G+?4fBY|pgW+rFwGPnnkXh7txX20dk#n4CKo?8XLn~k(+vGBatge%m)||r8~M`MwULiBHY?{= zla_JPvhE{X{qoGwNYn6|jj9C3xrJ@hnE!=eFKblwG;CcnvdYXdb%wq;UL?A^z+F-4 z*8Kw!RCHB&t#$O+jCnHlXCi8a?&)v+_yi5wF{assgGPmhd8(xk%xAm?EG zZ;IG|ge?BOzy~+H?S2Yz=IT2lA*zyf>hKX#*)&LU$6h|c%#*%}$E9{&4>M2N%osta z(5eMVfP)NkT6Zc82Yj|q%su9Dncj2CXe><&a8^=ce%`5$m2?G{i_;vlcKKU?CGIm& ze|}O~kF7}hX@7g~gUk?x&{BUiDvz_D!i{jbeXo;&3yR2E=%D_2y6@6rz`peA?xNfM z(n}8?yk#%xV2OyxIdX3j`fBu=EuzRRCGIjb>BJ=NBz5Mzv)0Q zZii>mW2x|q3`^gqe5IT>N6GbdXTVT!j&ftf;Q8igu)l@VuvD=f=}_w=IJiFYyEEfr z-LrxEDAJCSuNEvNV{Epl&eKr}5SbSd=EF#{Y%)n-l##9Dx5?loVMdI zu2aqrZqFwvQQ*K{b&bR&m%q+SXFSQo#Rp2M?ax_*cMA<(G(Ksp^|){rv(VN7Sl#}8 zU^sO&mJGycpUq3bBl>PBw1~wh!0oKWEabFMKw&>K4N|z(7DaWYsHNry4-B^gK!CPr zZ+=JYNA7S=BIe!04)Y{R&sEuHF5jQcma4>~0dj8hCjf^@8ex$77HEDmQ05Q)Gl0Hv zAZuj_cjU)3T%eB*y%!&H6;cy>LM0rFOajyl^%evo97viT=GHMTrz<;4J^oN&F{R7$ ztvst=B9fvxQD;%MiB0!ONdh^6&ErKLS61+>S%X@o-?u7TJNZpMbHRD&~_=rWAP^SgjnAUmxDuWp!l!a zix?oT0$MO9jg2E$f@eROOcFTrdWqLty|pB;5M4qf7?8(9q;pBirA@u#juLo}SJaGt zB%O+6kh*Y{Kzo9L3|Y|EyX8@avr;J;chnLHySD5z55CfW*F=7&fYSQnmPRn-3w=iv zV*z38T1t1hH0|JBn>GVAqVmiHM(@J?bl|oI-+vVYN6*2R0B4|H=k|#}+eRPK0iLR=ORzZ}VJ$eZA3V|&8 zTIaSinU|~Djee^1?uf7=0y;I9`$J~8kPL2d|$#&wO?R5g-`De=-+0i@Y2klVFn!) z$r_E^sWqw#J;vJD?i2jJmb@53(v%y%w}Zc*e^GvuvYV=eF$U#q!u}B%20eZ>O4L%% znDDV@4Sgj+#JyUi@h4fH|7uF>!#*gDoVBQR8~|WcX*@t>5`E^h+*hjfvh#Q~z=+fd zCcy1{6IcBrxqC6x2yfIN+F32{HEoVwZkpRyF;M;N@&?gtW~nZjI_IQ#A6&V$HkNSE4^;dmCUL`R>RZW76m_FDGT!@^Ya8phH4Ar%e3J%6OON2- zM&)uUcaH!?bSX}*OcOBNcpIq9`7n991lJj0R73jjsLGD^vUisieh}xxdn5>srhF4M z^eVUOR`CsSjq;cM40#5XRtiN?m4OaxzcLfYR8L z&-&8L!nl93y1*$=7RaF=mn*PWo13SB9m~pg0z<3HU{0p^JeG2f9gi=_ltZuM@=pL? z{%#21%e6Z+s8=UBMx|XH>Nyqc5MJejCrJo-8&b$OsFhinmhr^sbJ}Wv9nEU) ziw&6AOUG2>pJAI@rM;#nA6&@cNpgyLMGS(H87jC(tIqK4XsRhA83`rK1BSF0?ly$! zwW6=Ct0er$$BBy`PlxSiqkj><8kxaV{HWsL9DDjqfll6;-ZLq)_eaKk(jRT6fdq@| z9qE$BFKkpMjAIN+XyUP>G${yTz(%N-skz~l*Sid}a zA@3Cj%<@eGi$FWGGQ7H}bne{^K14S3+?P|}R$*^|1`fCl*Fr-V7jP!`pEiBkD=HY3 z)Nu*?k>YP>kqU8TAmYJ_H$Cs+RKj@iqr<%}TRI+HmsZbBH7QV&_}VzczD4(+M7~*1%A{NzS;HA*-uGFlqnR*#80ot4;OC7F4(Ao<*?y*zc~AO%l{SWfL1 zo^~<+cP`!9^rKfM2Cz2;5A1BlJ;qK1+(@I}?C0ixeFAi+je&AV!as`Q!!6%}5^R5# zzlmXIIN2D!)%%(J#ZX1SHIakkp32LUe6kG;DkMu?0F9YCln+lTnFHPBIR*vFwIFPDDA&d%Pw{;0l6#dd45CD z9%2u_jxWssF`1EIMQHeUon<+)Y=s}Fy`Tl0|S zk0)`Kd5^7KpU}!huPsA>!|D6IqLlX-s)5!UHi-_p-MYWh-bC}p$olXy@XvT~wW_i~ z)PDv>w|6e;`3OA>E_4HruMhSR#N2txA>b}wbe}kvgXGiK)%VF_h>rG;(h}qAVM4hx zU!sJWJUv8QLrvdAkBX=^v+t%9Auo(lQnKX3y8Gh;u;MU4sUb&X=CIS9f{S7!Tz$fs)lndSfQj5ca)& zLYudLqzbYFA~^i(g6<`k{>i2r&wr29WRk?NK$-gEBW3EBB*&duXvcDtMD>sHIswuZ zeD6B$HnztorcU3$#(WT|HN9uHVLcHYn(pxgOqQQ7qQs}gBQ<$Sw#o)_1)JuK(FiI?WpvP7~cQ>pm zKT2aCa)6lv^BX`o)k{Ktf8ii49f#4k;?cq@E%f}I} zywGbBpK$;WQ3bbJ5u4}5=YDifm&^u5OVMQQXYIW3#X}JV+y&a4N-dqXt9DFQ$xE~u zn04vV=x?8;`nhh-${v?PX;4GmR)gV`>B=cWfGok`%kA!(4;f%b09l*h+Lqp$>Lk?{ zz!o0V)&F!-S#y&`!+xfVd?H8G-i~8I+J*X`V?~(=?t%~Q)vm{Dn7HF$vK7&Q4=g(l zR>lUA3oy}MHt8B{zn9>cTcw~Xb_)$%zr$X#aYfhV#tSr}$8gCp{ho{haIdiF8~$pPOjiKKI9AYy93GJpCvlzbHe}W z5AbJ_xq(zd2V*x|PM?h|9}z~$(fE2Sfv1!l!}czFUzNGiAFmmx$Jx$3#oU#{vV(b@ z??H<*UEAo~BSL;B{{*gSZrIVp*dfaWpO7Q_r*f z*?dG>$C*hG8D|PN_-oUcsNVxdhp-ivSW>QZ9T&q!VDslvei@aO(KOprZ%fM<#NSfK z#N2R530qSYM5+v~%jy2+19AA?nnGh{WG+>{^3MHc)_ZRkTXKhXj43HOs%C3AIPJK5 zE51(bA3~xDA5rU08GC7CXkO6F`qD$T?Tf*ygJTI0`({;*0%1w8f{e*pk#04^a@D(; zwKwZc3aGKiR> zHmjJV8{nlBAs>$IXzi`k$ywc@<8j+x&ZS+E$KBJD=9XpRYeD+!gNeMON>I|_f8XIZ zcx~S>(YkDs`dwB&-Y&0*A8f}-Qdqyay*==|<8<~dMH4g4P6iI*0 zI2Qmn1DM?pKvIP;P<}6HKz%D>s*;6qkO4Si#jaoo$&5`&xY)AFvT+?@AuJT z)gfWX-Vw#WzrkI(8%W*i<8&OGgtA;`uZ)8$+1R@YnU-pd{^jMogu?DSvmtneI{)~A z|A;n}DHAPN6`mKlC2_bAk*;RgxvC{=g;3iL7X?#)jLuF^Ibk+6RaE#Vkiao_wQo%c z5=MAlPGW3~ccjdFFp({I!=q!~w^og{)|j-ND}0WM{;%$z|L}u?W|ixDoCA>ffSx*{gexk!9<+c{QSrO97^@(lpgfS?KVAKDc*a zT%(bpcN1j)=g<7_|LRcSZd6WmofVyMzD0nLyjar(a=#pkPvwdKzQVs(;Ra}T@gZCJ zf!*oQMS+=>-jq`PSrWNAbcLSB?b{W<)jngk^6&D6O<3u^4C#>}W5((+GLVf{o>fW? zDzEI+t2{I&-u&~8czkbp;xt!{8|4kAS&gdKUX;*2@CFt2@8#tt5i8S4SrJodFaGuo zb(#OVVI>0JdzSmL;uh_LhWiFk0%>c##|kZJT&S*;QmudAHSp2B`PE!B0fagYZb-eQ z0^)C*VV+mEiTUH=j2?JlS?igNCCvHpFU095ECG&x>cTN0Phig6Eg3mm=%Y#fuVzt$ z6D`76+sHu4q&HezziXv`nQ=@^>#OW8m4L@MdDBC-PIwXjkbqjF>EBVKo$%tOY=kb> zVPloyyy?nf?R;y|1-`Xu>;8%75_j(t&B|9-y@u( zoWcHdXkBBd;^XGsjiofdJ zo0}lK@oW(HT5ty;h*5kd`KT|#YxTi!r#sM{j3amuSFrJSqVNv0EQ}`kXt*pLf?m1@ zJ3j@Nxt}=S|HHb)#?vo=gHQp)?3|#PT))gdhd4d$fSFD-PL9_?1$i!0`PB}vB?b3C zhyE>MaszjT`WW4;h1bb1u)g?Ecb{57bu#O>iTr=1PIwG2=KQ%mv#@UBSd7KbGJpZ0 znUhumFYP#oq%gx1r@tmd19=K!-^_tV;`vG{JW?N2#KgJOcZ4h z_M7S0Uzc&Kz}l%Ud1Nqunj{>Ye2$mw}V+?-mz7>$4#U8J^@t3DD6ESBFSR6^On0_OE$ z5NnIcCKtSL#NXjc#}_x-o!5(-{SqUB<>G>KnoVq5Vs&3hEAEfpF@XmJ-@Ie#!^waQa{&wnr{rhG4x5G~yyrxtLYdQr(^l!HZQLYfggt4)9 z`cw<~(t?Sm1lx%}Of^9YzSlz9t@rVjK~co;P5KA8uNul5hbX)M2m5yOc4@ z3Mc&1e6$jU?DcAo>Wx46U9I3Y{j#h28MIid=FOqpWt+R|alTi#czK2-Y^gt4+l?#r zl@LGQ?cg+`->N)T>Oc^B7e}RCWEkHjJKvQn_T?E&73EJoELiUNR#>tmNhpbaA#%Pg zhd!}Pv8Rx{{7HCrl9OOabGgi)hpwXmzC}H*iM9mQassbVa{{`}5hwQN9}`0qP4FTh zutx1@hX8V+`IN_Crr~1+0nRUrj`wL+v6};J>N~i+V=j*B0BKN79k1>0X=|hDM^!Q- zt;fQCP1-u9fh6sK!mR{r%0sfnoUz*x-A$+o{h{p{#~OPx?@y+qDnhu3lFC84gm=s> zK*uY6>0a&rjvk}?A5GeAWes(z8 z1ZGq+Bqb120Fn_*O|dqRM%L^FJNYHq*Q>xnlaX@FgY1lvr1k~(GG%@ERC@d4lZYoU z&nTpoO{1%vMDrXf?mH^`j~@5q6EeW#cQ8wf)SFWoHbymWZ$B>zWo``#7rrmb+C8GS z;NH?8INujPZj#WEmT{KqH2l=@Hf3HKDpG8pda-)Okx+QniD3@XOGtY*WQr)R?rXM6 zN1Zrb9ye#Wr2%0jJPPn#QJ_6koR9k!rLkTz)1NTq%BYAELzBx9_k>87cBH4xtwkG& zUhRLl2MB1$U6A%TN}$V}*3I;#hgEOIn^M`ehT2J^{MK!Bq|yX6Q~gaGg# zlXFa9e_sv;8(J?nz+P-3<8~D<$825BlWcPTBwV!a%hK(%1{(%CG5-2aY+MCx3R}XI z;CgfGZ0lmA3@Pb##wSO6aLFSiL~3*zO%`kj_H~%D&cg3#I);(?I$xmvQbKUJxInUR zZXF&{cVq@r8I%_TLJ5npL*CQ&YT|p(MV9j2HM%Ade6Y9PGQtm_XCA@U@7=u<^XzTkr&CLkg8M{iiYxjX}#kpcKI1WQ} zTyONqOF!gZo$>id0tQ&#dvU&*PTa3%J&?0zmQVZ$ZMFy~9^D}`@_1Rhv@TUz^io^P z_=44Fc}>krPsc1`yb0G05MEmhWiP=qKHnEz%nYXarl!kr`X1|UJ8p&;YpTpW_*^c9ei;#$8u)8+d&&RIwZo55CghfbVP0ifEUcn1vVFje!&WZg{2O+P;q#V z{*XK=ecJZ#c*V0ehJ)E=+nk{LQq+vpeNl2P@1 z^J0@6?J~X#)r|MSz=6Ru9r;j-Mjr-P67UMU85vUiMKv%;+-Kl=R=fIMW?1a;Hqu-8 z9BQRn5H9`8HEIrH{}*~MqFw)Tao}cz^{QD;oR*7Q@OI6Rs9kv%>0+5QVM$Sqo{nHq z!=Ttrl@G=h%#D>-2X|L_PR=tTMW+uI2R~EkSj1^Io&f3##-uR!A2{uTlSciSU2KlE zd$Nu2(;`g-U1jI#0~HPtCyYJ2Y&AO94GhB*C%N?z@cA@>6)7 z>@-dKg;Vw3O12ucu}!XY%sfMs_)>)DZkrgl-!EU&!Bn}9bxA*=Jk6DGa(=b}FW2=! zl;`oBpI;YYpRMu1Hv{5x8lS`RGWfT`l^M~N%ht(292&He$nng4!4H{$1!LrQtFEA# zNl75qRTIxsG%wS-T%e(nR4|A<3S1qh5cZ<2B*5-Qd!%(oSc@g4UM zPCKr=hNOauYhZl?*12b$&Q~;Cb%*LL%vwOi+>NZEr74r9A^=qX-7k;ZGp^39Ci@BP z^g4E&S-jyZPJT+uG#AcF3joe=Qta(_+@L=fKC_hWy@Xr$d6xvtKJS7tAFuCl-{=6Y z&HKFeXd2NT!g3{73pmu-ptMWXi>*8#$;1WHPC!CP_Q=?PWypJte_!42-0TM@6ILxS&VJ)QMIUs}y|(Ja6-xY^w3jf_uCORv#waKahRjNrX!D8BHlPF)vVOaF=_ zST=g3&@yWW4JhEUvu{G=YCi?)?WGUhCh%u^9+q~tV<=DqD zygz89mnBMy-h0{B*twsX((x5VLHgw+S+kDdTkGRFcfZ;TLO<(pNk9~2QO)mE15n$= zKPPRl<}v4A2q2Vvpn7>|bzaEJOTGhyJaHgvrCd9Z@p(^;=k5h7F-0acGXm<*Y|T{3 z4_Yp^kzlTiC9#;R8WdTBkSyNMIpj8n3_~e&of6ES*4*? zxHZ*(bL*bh)MD^URBZ+b;aY;MU5;D~{GPkNWz7P3Uwn6%vlaRR=|}5OzsWq=zZ@`l z3^d2@YU`6UVESFy8WZ}-h*!C~_jW0)>QpDWeOl^{b0u9~g#;+pY`w??q z*A&tvK(k&$O^fY!xqsNkv(O&q2DDGxmKqA7#N-I9(mb`ejYa<_7;(t(E@K-E$fE6z z0bTEY!i|9I4`NC8X!k2=SdIh%QPO~Tr}1D=u`J}gZs*sKCwR(rNP>ND&vkV(FU_dj zzWHR$^a|ssbn281m^ENjd!j8I3`oTa+gbSC8(cm+3Pu6qSPbK#-iS6w{KDeuprN*RNOiO0542>@9QKY&DOn7Qk^zTgR#8{7o0bl5`y}LdUCL?y+oh^ zFK1agAn?tw)%OBcfnaF<;>2^KFTcLsCs?M_Pk}*{P`Xbv6fQU zgvlz@!Yc=xKU5g3Z7NsXLb7kOX{*_{onyI;%Aaba6ZxT`+1i(L?B}*RH@tZwX>adF z9qrNhl?x+F%yd+yHg~?4db&MfnEU!>1ko39RGljkxk#o&d$IxT7(XJ6F~u=*m!m;N zElNXuhf@S!4E3_4-!r=E7Cy6en(~eSJm4YAy?H>^eWw@gFj>c73=!UA^9K)dM$gFj@q(1AzVOb)}4o8oK`8EM}MUPX5vl!7LBPWAiY*?aNn5o7WOr4p$XjmxHP`xP6^P;r`UFZvTK~ z|1aP{nd;_wIAoU|=L{*=|8lRA!?&b!(iM>Hdx9}*k<*Z%yfWn0fNb_!UDsam&#>C_ zhtxSc#c68WpyOO=-ZoEv+jHMTWyJmZGATsnw;^fP9WGu4s4rKzeN z8P7bl@nv_iGjL4KTct31?H*DOY!^Kw{5#V3>=a4989tN;h)mAc>RmNIr&YZ4B|7Z_ zyO-VNs(mMIx)z?q;A2d6D8Y?09&(#w6|>An_2hU7ErF_=7ptkv#P{obaRjy6MK53O z?=`MVlrDAf3S?gFzNb|$?m0zNB9R@4dE&m(nWrt2&~8k04Y4GmmG;=!_tz?Lq!}t* z5s)u{rhgm)0VkGsPW_IKHUhK^QQs%@3ftcTQg3^Qq^OqT(+Sa!aoyKu$azcS=ci!5 z)R$kyrPRQ1dm+9$LZR1B=?0G_UTtKhtu)W zXD5hc+fw}bt2V5~TE8=Mk4;JLy9v`$@XZrA$!yAE>TL@4Y7) zJq_~*JF*8x`a*zcz1kDkzUQ=4+k~D~)D3vGW-2LHOI0e^;IK-gV&G6b%=nJFsV^f? zB}Is{aifd-jmTGC>tJed{*>QQWriljd-ec~Sc#)qhAkkjVu%X>0F~3p>iAGdIWL}X z%e!e(|fdTZIUL4upgdF8&+;qiXY@_^sf znnIUs@3k#INqaZ1{~!fBQzEmp2uD}_)YT3r(JHT0Lrp@$0Km+Y*y3`0=Yp-Is3zoV zIwcN@hJuat`E@fe{C-u|Mga<^^JP$)hINadMeYR`T|hiEBJp)Q7&uC}y;lvH2O(!7 z)|$m_ZmBxdt-4P%?(PIe9%7u?-WEE&I2rOI$PmBOSll>nhA!`z&Y+q*eS4m1d;v;^ z{vq_kfO5VMRAQ$rA%1|(eHsx>9FzN%!wPfv>5WUaV(%Zm*42)@EhC}qfhxi?0w(MF zG*h^Qek5SzyE)HIkkJWxIVyPmocR*P>01}vg2{yx52N)cXIKE{cZtE6^wt-(sL=hL zC0X8KbUdERPaTU^x;)YS&u5Rw@b`M+a4r?^)o`KP$(k2(jn9|J{QX|aWuPVuxr-VV zf2Mx){-k{ZOa$=i`!@JLIas9cTl+DBIYtnS=l_) zsV1~=n_qnvI~Au{%?Q1Gm%YWRaQ>9C1$6e4(65sfKV-)45*QJ6$85Cw+>4hYtsf`Z zrKD+RdN;4(@|Do~K{e8!suM}$_OZ1>^+qYJcYLJO$MwA*RucRMz&xN=l?IMYC?h}u&9<)8m-Nr(8`f3=SvD}|xt-j_W|{KrgQdK4_xiM(Mvzw@HNZ({i74~)2sI~QwtIL7>im>;=9eK&1Nv|6RfuC8GFzozV~%X z(9P+RByG4<>b;k4Ea`jFZye<4bD;0vg4xN9M*tapdW1|>shH8K4&YuJND<~v^)qrs zTs9s50xf7^iaX7`?!2C+@xP?2W!AUt8lBJQ1hS01%jc5I5Ba$zZ+8!6pLg)h#$mY* z;|af%nv_^hngdNPSjlhQ@B`2RNT{`zD3CDl&v8iY|BPCpGPOJC9VC8R!L!Bu7%T7^ zU6H>`VT~Iy+;@cMJTx{&H$<*YMJvn>SRVj?FPM6A+mXnSh)JzmC8+Go=)$^k z+$Y}Mr#t-haXMcZtsy$5Xr~TJ101N{x43v`Y!e*6Cp%ZUr2n#0nU9JPntsgfoP1&S zWqWG0e*L7Ms!yn;_s!X`oMgNsM);bkO8kfM7v3PZN_~0B+&$kti(e|~mgonEzL|ub~FsDH+&tg**q;Q_J(IMmQtS^8`AGcg(v%<;zy##NHTRAjl zo>-jQ>r;{}4uZD1PipR72?3g#-Dis)LzM0jruaALI&i=TJ zH!3sV9Y=z;MJSbQRsJ8!z5=SvZQHs~TA&mwEiT0=?k;U{htd`gUP^Hd30?{mFYZvB z3hwUi?(PyS1PS(kJ#ycF-?{IObH-pWGD7&0e0%S;=UQ{^Ie+oa#EMN4)oq?Hm8rwixP+s`iq}&r#bE?wVE?Do%Mmou{3*QD0-Rx2CRI zS3cjbIQRFuj5~3f#Xh8~)fBr)Kh|P#omyD1(oS4#(DVNm;_Na0Ml<{NX6wavXe{l_ z;>^V6pw~j`_U_{O#uQ`+sGbt5e%*`jOo1b_t{YBbr6~zHVz;(RJ6Xkon#wSe;iZlv zfZP0=jU@zWrM*W^{V52r8`=i+lNHRTcaNxU&pWx_X;T48+(;nYO0>plJNENk>-qrZ z4~9b*6Vv9|!5j@! zlbbl;bK_Z{gqHyLp?yRSX-lM9yOiQQM*(KZV^pTKiyROClaaXkvMDvzQX^QYn3G}L zDByTl7m_g0{4U9Mf_MSUqU5epIf-@lAtaxLk=(1r!K1LWp&|@m$Or^4&CPRjMc1F1 zO|wBdd1he0T0d9~-{gA`#37K`@7CQD?EFo~rs7F|*1;Mc0D~Gt*ycwwKp5ditKc+65Z7^ebT4Hmid+oU`ue!4^KylM)t?H(s<=+FIY(YeU@k>JQeqi2^SdP^cu5WtKYJ(`+!2-`(SI#H1EF~$sD8lHvB7kW6iq;PBxJJ%1 z@=w|Mu9P;E5(Qr=Y&PB9D?5v(NL^_R-_>A0cLuBTEKFK8PHLwGtYofVn5`pcgb97t zm6uLNRc#+1rhmqk1_Kp4Te0ZVd|NNX4+FlJZE#Ejn!HM$LDA9i(gEQg>P=@|vSJP@ zPY#zCZD1A1ogcYmHdX1?pd2JHezi`$Y?Zv89Q9Z09I8~Vx9G9kH4f~*z|kl*ClwjS za-3({C!XKJ{bt8%LIq2xj)c#_^l8~a`AXd{$wsdCN!E#rtXIV_)3X~~&ncIp?HfFD z4y%Kk!Lyv}#p_i6wDoUa1rOHUZY5iU4w%WCB+x+DiIW$Vv~lKoy&v+g7ZGXe?n~9k zo4fDAuSx4TjpBX%hbCc0IEcCu3?k%{IB%1}W z)a3$Xbdn-8lUP~whLqEwdV}Gr_Jd=s%7zXF4VLlo#>B~MnOCoXB=_Hb zmOwA>fHf};1H_Y6#1O9=M->cam?~xgghpD6K!j3!=v3iD_@BjHhzr}y>e}MY@1>U_ zEA7MxDF+!uI-UX)8D}Mi`}MBD0X7Esf*2{SHAlUsf8ZJC!G6Af;xEw9y#Em~;D zzxvU@ndp%3z5>3Fn~)D#K_m6AJj+IH364p2P}cajlZeH^ z!E4AW{P=QiQ`}-TRA6IBJMNsd@fsoy762_Y8wHFYH#yGh?t#%>{c4%>seWnL1Dowzx8&^&oq3Hvga~-=>zrcJ}QmdhNB9nXct36?Wt0^}%TMDej#H`{C5P9%o_( zL%=0GHn$EKu9QC9-fY}%QG6sqR@Nb4Aa^9wB|~%TUWIR!HKh%9pVu8R%eZ;r&CEM? zo#vuHN^K*L7;}?_SF4>DR|g;-IC1jKdE$0+-C@0(V48W_(xb;OwaF z?dL}QxH6;ML})7x8`EPc%L5!9ubZor&$6N|;Nil-1la1dvA`_E(gPSR8`P=kf?XRb z*FjkAV#?Kp-aN~`%lNpOsCyS9?h!?P4brIgVk7CYW<*(Facnjh2mjoX&aT44|N4X? z4fJXir*RgbHHw$-R6?y66QRQy8!*SCgD7;-B@{EtppkvI#Y;jDx7ym-Ck7PxC`@-_ zS5X!!H_adDodTA;o68O{=M?9DgI?6vtCly#KQH4uMRWE(X@v;?>N4`trdg^SLKq~1 z^6>6G&_`gvkZ4Gj8N#yO^{@dktN?mn1Px!qP}^oIibIsH}Ny8p*SfY%beP3W~} z=KnPrC4p@`?gt!-(93G;n)NbV+s^JP+)4(PjNPmx%p3tvac|?lpiB>$d^947&rMx~^<+aje0?sQl=!e3w{XOz8q?U7d$Zo7jO zU|4KcbKJu+N^1G@g$8mo?Izl$?x-W9Q1ne`fc=r!)#N)8ZkX>ch6eOmlcQkXzLR2f zSe9yjd-t~f;lU(u5Z{2497Ml%YF|2^@qF*>J^XE-z+V#()Gt!2y zE^GL*&~yryMw407C}mec6YbkWmpp=>!HvzAF5y%=n;S`qA{xuB7pq}nHm1V+(Hb00 z&3A74#gg`9P-B4JJVO=0R8jBz+kr8VgvF__bO75n!_nInSE{2DMGpAcb1f6Q7ik;AN>^~hD`IQG6zQye8v~fFMDpjSafi~{CYW2YS z)}65Q=4>>7FIX;tRGL61Rq)iPyzMeoT_}PQq&zNV2t~7Lgt>5dN}`Z^7WK~GC$r*Q zG41C|^incr@u)ZjF4^ie?>uQ%sW=yOCa>!Gs?}xQpuln~>T%l}j)hj&D-rzN`W-6J z8&4O=06Vs(Wnrm{WaC~*FDX*#vAf#Gk1fzvbdK}GjCs7p8A}0^CN`|Ge;bhB_Re={ zcf{w`7u&vsdtI%11Rz{Ye=%~cZ8R1B_K6R~AE(*0E;hsF9ddT>t`;^RcRI>|8bFsV znVvv~nq48${u=@MJ-ya5w0BYZv`oJ!MXwk%z>PwQgW=_iVeL~P_J*<_0QTZ^M0Hge zCvzbv5O{o1e(S**#X;7zskAx1svT)^<+dGD2sK-M+juz1uC}LRqV2WdMbYbM{;uL{+# zaoNW|q&Ov{;x`!e2F0-APqwP{~NG;M@+{mby9fnd>}%qG4_gK}Z2uu?-s zEW3a|O#QHfFZXS#0$~ITHhmy&|XoKq=&Fu|co735=5&|l3QRu8}t|CV@FRZ8) zClnX-#r6`{Zos!KiO@AOqwsp=${_mY!0X_0JI&yBFf@J8s~LX%7Ojhd>iyGLWF;vV zapk}`Ss1p}Uoem11csi|k#uPJQG2nM*Jxud)%BL__F3a)J<*w%O>JlPDXf1$XfwH^ zZkzcWRsT})1J%t?K<~bbv)B2ZnuZ$_s!J`7ci+Mj_K&u6)AlRx7Yw>JgE-{65J0LS zZ@J*r|4Dag{;Z*2cXwhDH=fM}5%2t4!@WM*p*Wpq8iH@`C4sch2O2wD8oLQ?^K5gm zOYQn+w^ws%0!X#4#RdCwz-Y;3(-GakxNtE843u6EITquD!xJ~<2M2>a9o2!Y`c^NA z>*CPD>#WRaHor1^e7{l$@W2Qi{pA+6J88b+adFD_arasjM3@F15}-G3wr=0;n-b7< zm@}sZ>;;``u8w=nS$OkVfHu)&jB_?8lQ`xQRW+ZW^(`YI`1jnH<|KXHLtxRB zW#DyRRajFc?_i?)FSfKPNY?Oh0D79JWqV%nMIiCg)FTqe#Gd*9SqlTKV%Eltx1f?y zbQ$wTBP9Rs+^f&9ImbbSK-&%#!&122<3a?C!CQAI)oq~KiHqh4{gl#epUb$AtY}@r zCd~(z@KEMX8sitYyKun>(Wiv&c?Gk} zTOKI+;(otuusa1Jd6{}s!2B^DZ9^9Ss0-jHl1-o@NG%4lP_?Yms=uI=A+`tA1O zb<4h^e&rXoyKt17J2$|}U*K0&ylthr`Eqlnal7ky*o=8)bZvjM8e6GYVdgtI%RY-C#W@UH;0H?)Ze_ttm@R$V(ybSVq=v_<#9ZNwEj zQEQB`skgY}z1}r?XtShD&@*8iEp}Hu`xR=1DC2X|WP+&Wl?rry~HQ%~;cV3!E zKl(QWwCI-%2SUu;;?t>JKete;aIeu&fouTcad@27F0LQa9NG46mlfC&r832Q5Tu!MBsfqqX4WC$;5TdAzO7i9@hHba1_sHN_|6D){{ja+MR6? zkh{O+rMXgJkMM7l=cwH)acUC?k3Ss%!y0$(F7@`rHEhk3?Pc_>$yaSR7WFS`%K(z# z$tAy6ZT};p!)6kfugKoC+sM?CR*ex~%9F1hY>r2MLXY?L-G|$^FBfk;H^W4_thGy6 zFn524AZ1?R*qAxH9%c6MnblcjRkh@TF1dh#2N0C0y=zyNY(!xkEvs-JsN{=jVEfV% z$SxhA^qSpv91vn02ivzcf`@W0uK@eA$QNS>`^Kol10wfSA7zX~A=HK`iKq%*iG#dO zQ20H+C|L^U*Q>pcJxq4t{*;v-;|TkQvo{9~=1!CCr^MU9G-na_fnW*DTS3zjCme2$ z5@xGU_j2{sO4(Cd&B`xRUFLO#H)TP;txswC!(7Y4;zxD#vqpoPnOhiqZmv)Ay8#k! za9GdtVx5IKgFeg+V6W_{CP9vfN0&N}(0>#b=cqQqDsq9Z?{j9aubTI757FK~iNa_IjmJ)g2XYBw8}Kj~>SA z+RFcOrws`@MPBv(Rwntkg<9l}@e`o`Er4bqC4mLIOs{lnVJZjqG>o`@W>*QrYxIIN zn_5K0r^Ze5k^TI=cP$Ez|AJU=AEK6CKstk7$f*Z4jnEevHh>w*Js0qv6ww^~! zoROUQ4=%{MEVWWK7yrO}K#(Z1KfXgy2U`AUupoNOR&G(UPf_r)7R39<31%%+R9cZu z2!i6n;UTktOohu7%VJoNg?d{hn!Uw$j518aPSL%bN;>RXf+cf)(jXl3%;m)rAb_Xb z_H`h2H2%F-@@wL3<2Bjr5M6I%WUpG?JN|ffx1esNhd$_hp~oiht3}D5_4B4=2F|23 zaGwR|0~Iu>r9%Iv$ABRB?8d~JF~{JKJ@Na@9a@?02*p9wxp@ZY$)6s6Eca3BVvA34 z@K?*jrQMxVPSYPbj{oca{H+Iu7(N$FpeFX0lJv>QDN)>-KdZPu0d~pnVWHU(UJ0lU zT?Db+^CZakfEhhvnck%iTGj!YOmUdu)HsfL6?N6=*Pw@My}ukS*V; z&?Z;&@zHWcGSi-<<)Hz@(~cQ)mSw@!(Gnvm0<2OIxwQvUhszdmV#(I=Zu8Fa$LMcDbi zVHPjT@|qj`r-)M11IeeLi|=;dI1<)a-mPoO{`LR=+cQJ5hT{AWTYilMxqVc6$)#Ev zc=`__%#i(25fS%(+vf7P(~LR8#RDOtsJBZ0?P`Dd4vwKs(FadH&2DC3N6#627CC7* z{nIt0X^zo*vIuhOopP#{wdr6VI~E{U_bvl8NHMWCC;JuSj}P%*Z~woBWdpS_lfi%a*#G%E zaz-?{KVC_fD^zW{iyT6lp6vWNTi)WKy1)40H_PA7LJPXgFwgs0J(m9GGW-8}o&MVW z^si?^=nX{CmUeJ@a5=Oy()$}1H$*$EywA}3F%egkuV z9!dWF)Y*Ug?SqMy<1U*H9Y$sN>S`;@EwlUQhu`4!nX;d-!M3d&Y~Nk{To%;ep8}0l z!f8J^G&9b^`(i@(kA_0Z@Da+a&)|%x+upQ2?ytfWCKJ#*09Z(?z&8ugIR15HITv$@ zuNRzJ&ScJS%8FpwF09Z zbmhKUH?t3!ix@P{!e?1VR_axw-%mQFZ0La$7vWKFQz+h3uW6I}XK;(6sz?o_} z&95U1K5ha&v$nN-^Uj_6D9xZTck}v+vIStY;@WoK-QcRM@|D#WQbGSiJ>XvpbZ)T6u3)Tq@H@vW?m{-Hgcge#g>F6|Hm2h|N1unvnG5zQ8lKx@)kDI z<#74O=)eBh0*r2hkXy@u!K)&8!C6)Z@*$>dWK6;0<|<~V;P-48hy=aKcR+Fb0BzwE z2de>JQdG8EJ6h0Ogl9kh&$#zCg)Ebf2f|JpC5m0+U}~W=r{3sIzg-hR%dGv4bzF>GI;yE2DDCa zFJjEmgRZp2@x8f-*69Z^>PutDon@Suvhoi9Kwnr_fIJyHe^9I%U z&l3hoYApIp-oritlCkWv1c>Zs+ah#gqY57W4zU+p!Re9O4x)(VNB2fg-G<5Aw)4YU z7786@Bnu3GNjuSDQ`tUn8In{_oh1{7QH(&M+!Rlb$Vk6-{Ix;(zubbkT}-8P3{yQH z{Y-BghI`IT3#+7~k;#PcQX&o=dx7Ek^ioq=MUJAPX_IWBAGo|=0lGa+^n^$C@D3ib-)uSIRN5b2250umu>f`?dQac>eeqHY60p@vgChs=7_T#sV?0yS&HNgE{y#fEyqKDO75D{`DpxlF45x-Vx@yfh@ccJmpb&RICB^?g?LT< z`A&6Gr?w0#z8>3PvX+av30K`Pl`#CwQzMV4+oD15aLaCVGu0-Enmx>6{{rUJ^_q@9M?&OskcjU^~hZ{tX=e zg<{4jTXn?upG0tPjE7G-`3mcO@q!o)CFfE3>4Aga%7GbJRQ}8Sh3O{3^C#UUo_pS} zVN3k-0s)8JM(I#i8xE+{mjG=qo{Xu8erV^0#lSHyRjh{z*G|mjRPDEd&Om5CT%< zl7MvMl@fUChw%u&wg0(i|D6XRjGXJWl;xdYF;LmCID+g_PIG?xx2q4&%l9jvE=%iG z+&6ptaEA49DFj7^UK?+#;6496%XneAxA;|YqF9|mBayagshh1j)1 zRby;HHEW9V?`BC4SFG(Cw8-EuW9#M~s0!KjWNi3mTz=1A76atm<}WhdqxVBNsdZan zS}Zx(k;(fw^X8Lf?{3yOUyp$0lSO4**CX}-9mO{-_|yd1$zSYNYl=UyfbCI+`qjGE z1si$_5AqZ+WS0o7nI@lVy50@E?3OAOc`SQjBpFbw$H^ZIRpw5oF0pUsy|9NaM;1!% z)RzoBjmhcL)?O1Twvg-Vnx0kP2pub(r$?v&CK2~Qp_!oW0&^wHdj_+e&WE&>2?}lg z6C9ZVR}Avdm8wIKt`AnRZ;d=TGy+74Llt$d%*Q0b|fk zoBf6L0jTD|ww6}sM`4anMG)-y341q12S{ODv(EdwW^MsZ+-!BxD{*_yug^X{Fdzxm z@g}5B=FM`JemSk;AqDHgT_=kN$!p}B)uV-|b87g{OiZV^&CYM|VW>t5rBh=H5;Alk zqjp5!LdxM;l*JXtFjenX^zIJUL0x3hROGWA-v1?aUHhfF5I~d8cDx?s`u3Y zGO1-j^!#L#GcRcv=K6eh$ih}3RlaiOF2Y9MhFrG3i_&wh`lqUc_Nk^YfwB8ofc!CA z9S;X|HO!4^z_)W-(V+)Ua;`*QD1d8s0@$=Ja|^yH%M+l#P>PQ7Lb*3nw`7`X?=Lru zwXvrZ5=9qk{_^p*QSn}SJBMeu<~;cXV|UE;IF6grk8ZZq(9iF`*7tMF{VQYm4>;^U zWjas*-fE)-J>7XE4H>GNa1{PZ z-MNdZE>XssB#1H2+oNafv%(B#o8v)Fbd6gFWHB&GV#05`E_2^#8_CsU3uYw?t#EAD z$*PUm=c;k#`idvmeAUMdLW43Dz>H#`pfe0n4jV_=le$;M8in#F7bQ>7C;KT!0lh;` z%ImStu0*#Q>pn+KyUC-d`Il|vZYO-QPBV;(U>S*subV3@AzP4j<6Kab2j&PU4wA@d z5f2npTuBFg?4mN%!^+Vp4rW_hObacYuFb^L-)~&&93EvYLk* zZI?#ixD6fsgkMh0l|ee0I|@2_C=nBezowvV-yMq|#+6GdThG8FVbD!fjDDqB;M~0? z7>10L>w{TPYUGCt$IAXVDN+ju{h4_F%{bF!imEZU%x;?(eMa(KS?UPQDS2wVVQPpuI>WhgHI5(s|sY*j@ z=!M!e2-RjYm}^48OT!E`--d^$@rau-8qT-K<({Dju(advr+If;%?9YMLKvF%x4Vh0 ztKu?6Akyk4_=r>DK6Bbkv9fN}bVkhzjc@wJj)cVB% zk$Bi^(`?=0L^uc<9*LTi2va7dFExt9!|xd4+yff=#AJ)&F<%|jJr#}M&R9>kpaMj- zr`1XHu7)Z7_XTBB>qx(acUg#gRhv+$5+NL%wNbT7w=PJ0TB?e|dp>_F(Ev}cXgbaj zPna`uh&&Tdg{t`lx+jfv?*1b=mFH;p@#2s5!x*ro@X=+49VxZLcgr#{9jq#yGkO?MT>@W`Y{l@7vxycKl;u82@fl%5um@^<(Mv^TSbEDR2PLs<)0n#*lhh|t5 z;lp_xfqh@<`G>?t#bO$oEEo$bQXy|J(Ha#h$!QLYBW>KwLhs>_ErYkno9)MHO+QW6 zi9_@WEqvYea?8xq@8RG^*HH#Hgj@`J6!u*)eNn7eFEk|&-2rlu>f>pp`mP@J<*nVM z`hn0onJoGVVp)pF#;<+pM8p#(&@kb@t4Q~IO5`JsssXCgc+jnNM?;?D>kov$gPlH> z541~}2FM5F$U{GVHHQE(=(Ew5;6m7b5M@O45l9V%O;)a+dfIwb%UhjlU|)sAjWa!- z?d>y`01)cHX+{!HS*!}5uxw2~BivG9W3oQ;E2Q_LjGk*~L1D4)4XCe>jpT zyHsA%l=W>tOR?cFVdIYQ%e_;cWv2+*&U7u@{C?Y_g_ZV67VvlUf0oh`|H9rBYSHL{ zE1zrjYq7?W!C}P{?gMwWech+@E>A%|&fPg-hZXEOyE4vcnhH5Z`h2&1C3M z)NzgLTVH0mEYy%V`I2_%XHtH4zyp!kZ<}P|Er4$IB*b-qCucHF%4--#+`k#pW%wEa z4&O=AKTbb;>zUm+1y?|zaSH5m{gka7;KoL$h1zR`?rPy!K9*SSaGsgx+l#l%{}z56 zWM8Hld$I#BdJjqmoC#3>qUXaL;1^1P&in=GSai54l z6hiVk)C=jtKFZ7O=ttJcML-+-8u}9ohv|7ZPFsnH+YS!<+MOzC?Ii{xe-GDdEjBw* zbe;c!8U1gVu!#;;14iN7gCm_BX#8N0dyH1ybXnY?ahIQnkMJ(PREd4@-A8dOBG2v3 zGchBNMiog?DG1$$X-kaFK_T%_Kp7?NUFjSEMY7`(L+X=_C7xA1V?j@QWLH5{k4BE3 zzdvVLrE{?sQyoQWrUEFDqMKhlEI&?9h$LoCxj4Lfbr7f2q-o~)&T31jk(5$}j3vSA zVM}%*ya$EnwwW9L*^V`rFfI1-V}!d5Jpl{mrdsR3F3tNkgb(G6Y}QfmO;8$OFTv>X z!YLzE?l@?_gnsTl4TQThfP8tTHGIxrfqjr-L{ykT>oIu<-CDhe3!ol{{zl|9fvhGi zHH7DN9%r-r{mh|Wu??->E}N9eB=q<2yiE(fGfGZ`XJ9!Gwg}x|Rghu$ji|9yZhhAb zT!4J@LRr8}5WKO@ZMl=r4}bcSV9rNT zJPuoRW>Aq3pC`Wy6I-tM%FmhQfO}Mbw{A)OWZn32i?!<&-s;8VDMY{XO=1a+n zeqEsM?p-bQ+`+a8blEAZG^P9Tx8<>aA0j|Uz6Xr=eY|!ItIu6Plw+v~MH`BupTAU~ zu4ZnTA(OFeBPDB_53x_$CNS$u*bZ|GVRd=^Lwc%*Ab4&<~#9W`N>j@rSVMRk{Q1K|@y)!URiOeeO;6&0%GGmT#iZ=&} z0vLsY8RB6tTN)`DOjV5?v(|GoXOC-hc^+CB(D^bDQ>RHhJh1PzO4Uu3UZd1wAzffP z?|cuw5p6NH*(nQG09$T|HkgxE1N*u{*s1WZBzx30U9k_bf^9i$jWLP zK*n2+V3Vq^iyiAmqmg`P;)D8rwK-v5e#YGVyhxl5TNpBD>ZW%4R<-tK+Q2mIy;LrR z&$J#cvm)S@(#lEZh;*6}F;mLl&=`E==$_iUBt=#xXmgxN!DC_*UY4A}c&5R@?UuKV z|2}nd0G7^fZI!Fyrmv$S)I=h0Kqx*`Wko(R7RluccbMRhIThR);X*yF3E5QBnwMOT zmQ5Tsf9#f~Qrq3fxM8FYeg(K?(TEthV$!*P9aepx5)Odz0I2SS|CZW6B3=yMAWLl}gGeWrs7iLrO$n_*M&6dK#ghzk4`T>@iI1j3I6fd-CSZ1yuo+{q->RVH5D_qI9kR=} zEo~KVxtj5mvrsu@=Xs!6XQj-iSo3fdw@fm6p=zCW7+_8h;_vBHFO*LUtF{}B)GBG6 z0~%%_8G_-^!jr0E7jY)xyo8TCiHTCfAjv`ew--i~GE;(sqcIgp8R3dwE^1rt1Z-S4 z?o2q_jMZjuu3+jb=9n}7~DvH8N61b0m6c%I7cd|C5z-bE6Fokm&aHE~9-ipFs) zn6KV9#ed)XnY7sE*#?43hA?qEhASqdt)8Iy>vOJc!11D#B}1fZ3UN|S@dK^qr860~ z#@(1xxr#=X)9s{L^=oEf+V6azUXr;K9db+^7jp2o)4PL@Zz;T&7yJRo9FVr-X78)P zNBHS)xWi*_yedY^ezK1zj-6!Q=QP>ylL;5ka=ePw=oh6v)V6dYMe3=d%+JI9lG!PT z#H!#m1&W6J>8Dfy=w+bpHsg5uWOT5i1Kph+>C?l^+4M-&r;lI6@Uv1gj64G@Cp-Yl z2`33Ld6i^U5C2F2st7`_vDY<2CHXH-Xgm9O3P`6iCBlh^EjS_@?dDki04mkL=5~nr z^K>&GS_Y0}GA5H>RhGi*%S2#)Yac!M97Bm2wP+|0T4Vf&YG?!)N)YW&PozJElu&R4 z6$LWcd`uC}KHz>`dP)4yw||C?Boj(m|NL${!J%;^G(6;E%fz8VKghu|r+PA3)4)@_ z%Uvzj{rJT&SI3MiMg33D<*l$Qnvzs^IE`82MV}2t@U!$&Ih;YrrJ+;|Z0y-`udevl z1vaD5CbdKj)Lwk$F^bkBa0gdTU)mmN=V56xr%G^X&$hkES;H@D2}L zF6=!hppIRHK9vCCnzlyZcRdz-vW5S({i7YQ4R|P7lOs?bNy@lxKB;!+adXH-yBBLh z^J*t%O^$Fz{UDmp^8(HJuq^M$YgtLGx9?tMFT$Q}KC~$Y_L#Ot`HWvbA@_}^#pfq@ z{JQPIyv#Oh?Zy%V5y@m|6Lq&bj7B5X}urC&Xp+G+K0__SvOMMM(6JKGrVoAlqX2t__q zDXg*9igtYcLv1kfB9v}upjHG$WiYc}@h9*1QIPaU_au=aX9hexIPb>p@cH3ear#A1 zH`9@x#s~59qfuNl>_i)Jx#smNBWs+)sRTK?3aPghDsGY+Q&*4Oo)Gx*X`kF_+V#_9 zM}RDd?!0SJPCFU@a6Lvg^2Ch^(@b)>yZl*qxGKi)6aPg?oB!b#GaIF;H#516)sktg zJQAyd4%I3aj;)mD-_?vihGMnII&`>pGwQiaxyX7{wawtOpfddbNPXDg`F`Vi&O=6n zQ;kCS%ZHi5)nPq$fG(f#h4kw>C3Hmxv*%9=y|uR26g>6R{$Y6UAc$wK-3}!Spus3( zt&8t>o=GY>?}PX7f?qjCd3^nRU;G&(5ypm=apL4hL+ogkhY?y8(>nOE?xh}5gQe5T zX(YTr?HWF|=T_!uV`MPfRps!}cwZM>X+d))Rx zcu-AbxgxbQA}y^M$1|D#br@^7-cT1`*$l0!;E@JZNBCS2+9TFU+HL_P7lw~^YgRl- zBqq-xFmU=fRfaP*d1nfr%<@kHdU%zfOVWdZh8ThNx-|ssfBo2}BsRjU-lNW$~8ngMjlZDq`lFT+Y)|d@p@uJ~Ayv>!&V|a010dd$F2LyMs6h9E(nC z2m5-ZtT6mD%hRorJ~D70TKUW)i*EGQDdy*CN2tVG*-aobKKR&t$#W zcvwWJ6OoRji~r_8jG#>Dhk$-6>AJG4{SftVvPCsZG%=ET8~Rf0Z8s#b_}k|8^uV?U zckc8k_Tpy=_t>UBQkM-8H5pVARfC(2AIo9LJi2hZsg)(J8RtO@AY@~Xm=xdJVnkPc zD!uMg{i8gH0HUlpk}#;-b44Q{Ge>Jta0HL<3uAX6VYOBT+CdDQXmDf zZH{#a=)vBkOu3Dc22yJ4^Fi;`8s5D8ndZQea?wGlGR{2SBX~TEk;H1Au?Fif-Uu`X z@9X!7oFq{6nAb5!h*hl|LPuRo8M0TQX=P5UThXGG)Z~hE(-*Ko1nK7FU)Gf04CTh*L5^E6Q-(F` zj1v-5Z%ltd6mkJ>%NX;lI4Er@JlpCz8md=NjrNLuGANW8wcE}0+Xwf0gw|Jy%o zj3HJ9<}#T?Rwj`&9zdW`>SKpbgM9C166J?RAYL{biR{H7A52{Ent~b_h^dvw0yd`Q zx+a1?L^ly+(|_)QQ9zJ(x*1*2p06Im`r$$+gQtDL!Ps^WzIf+J^Hme z1xio5_%@Zlsz+d>Ch3DtmET}8-sLxYQ zoa0V8eKh6k1eSGVJnN^759e3ffN}zwZfyVe+BN&M5Hm3@vXM0zP!xUZAl#>`&K`u> z7WabjQTfD>#laV}QF`;kPt>Y4a85j&3pYC|&s=usdvj2VGXcciWn05tH!eC-obN5k@vd*a zs0{GmD=ces2Pwa`+>!f-IVRBTPT}iNAA*bch|S|_=BpiK$bD^uu+r@l!Lg-g-^Jkv z7ukklbd7c&yVCj?^XcO6zZzGfQ$3PV$zzv=P&fE!5~yfXlAo`(^_vFNW0a?G5X7gi z@!C+xc)YraLh6bJUGAXqyW*KhZfLEvY$jmR1`)SD3LisPtOaor@M(FBXnsd%*ve_{ zrPIl^o=ZW*juMpXyZXXy%;`uT5M=E?k||4&-_H{Wql%+oaYPGFc#7!oTcT7LT*K<@ zPz6dVb6WDk8#vPM-rs1Ac86=4q^Y})*I>))%df|Z}x3Mj#DJ!?nl7(9kotNFU9V@h}@e?(Q zk-3dD>x$X(Lq6|Db4NZTD6&Yw9G~mwtnt@nmoxwZ@piXQvM{X$qt<9#8yi9Vi;sG- z>;RjSRk&{#+vXS=$MFjI1MJ*;y7o0)YZebc#=Rk))RYrI1~u`hudbtvoh+k-)R=SY z`6J1{CMr zG-tEmw1F0pzD4ljB;$TxfL47uo$)RUaFp=Ow)WD9-2L1sE@uCtIw&%h`a;HLA8WPv zOF6#S&uR(xNtu9pr5=#pnc)(bNWN(ddPiq(MDFFxg#-Qr08nWZV)+LdqI~yfAsK-YlgE=OE`;sqrXb03Pr@vHP$($2Zqv z%XV3$$?Lym_v)HRMSsxcR8HeGnpvvC>a&2bSAqU9IFKmkng-+^|eDM^GDOXCe5di86aWWF4gTwmDaL0U|Eoipac#`r=;SDZW-2I z!&a4&H20=bY)1pEK!6#{T+8GmZ`}O_bgC(PTesR6_6eCIN>cZ!0bkH4J{K4FK?VAb zwn`t*;HusC0-i=n%ta zEKAKFT!V+Z*Qt%TSe3-&qxa=iaKj_Ew@yC$T&PCU*2Ul9Nf(!!dAe^e-;Fja3}e$~ z8{L>(lL1H3%{!7$BYK%p$=k8jxS&rppLW6ZUJXWS*^6kLXmC8Zn@uincoO2+-a|r; zE|G@w1lzJA=WM$yyz6l6p@^OUbZ79>)}fUpt*o=w_u0C43!jB%85P}PwVUF#v(lOs z(ypX}-(Q{|IrY7!K`-+p5nB_GA0g;`(kZ%S&?WnLfxn`Eg`&+i2@flihRPxLf|nZjxhIWJX2eIv3OyKqFcP`}rl@ z5Avmq#}oSPz#EO~$|oEM;F|7MwzY@NouV6^7~cf4luyy(8J&5OJYIPYQ$;|ANk0~A z+sF>5{;(!_N40jH9=E)=!Mh_A&QuaK5()h@e=)O`N+9)c&%jEWm9kP9Q@-9{V+fE> zTa`l{j_QY9%_8d@nq^R7bphKE!D$4kYT+#o84IledPp-K{N!7p@et9?4X?nu!=ose zQw53=Ix)^&U<+p4wQ=1a>yE8BrV2&w&hv9LMLAUiL6fQ zE9`fy10DHpGLa_rMO?k)7EbEi4b^_TFZSk`gdHC%CoC>XaKp|@>-^h^yOg71#uR>z zCy9BU{v838K}xaQrT+I;*}vG&5-!RvSNVeEfDBnc=X2&-T>cNUw*PA>{O{*Ey_?(t zQSczjAgT42k^zambR}7UAaMk~7)QtqL76EI#yQolL1#T{+!@>#3zy z6F@M~5xK4Y@bir^Zo89!%uixfw|M=+^hpB=>~40c}z zdsr~U^Bk?ws#lIZ0tze%3F~syANoGxUbW*Q7zExoY&?}$wM#TV?I90UK6>JguSr7# z9?x7Qca`uBXjx?iysG!9Ykdx8s70N&fW{Ts`bfd=qr0OPxW*6}j!NPuTr*0yjk51l z_J@hOS7T8cRpe~;JiD}G2P#0q|1>s>sS8MT%hA@{ic zf*n%5=$sTR{P3rGoRd7sb;zd))@p*+x?vB4FA%a1kK(P^>ovJ)R#Z&pMJA@VWEwV# zQZbUv<^$d^_w$i(+2wL}y@!u%N}NrXP0U!T+ZYSSdH1C4r3{a3vg1A!r<0)S@L ziR~@2&;n4$k~`D2E-xEVV95s5YQ%ntuBZ^{*}XtEp^L}g9LMcCpekjla&w((;CAnR zWK2eyY9IOL-cStvB}jSbmU@U8Ne)5r8?f3--el}jfN$i|hF|3rCo7nz zLS$yVZo#rj5J+l;I!UrZAEcAFfYWiC@(0D`2lp_cR<2=7B!ZiN5H)BHPYt(H4`iaUl-6OBRyMtMYW#CO_ux-4P7|c%F*NGRdzN z={}xb(N6^Z#SbV0Y z*^2&*axqTlFY#{HdK8f6ilN9o`L4Ndea~IOW+JJrEYjfTt98W`^YVP4BOrl@z#_}` zL2y=l+HP6pF``b61Jwo_7d(Cvd8ad!PL6rmCMyZ@wgf`)+DrrJTY=d9KhEAVD$2HP z`xgOG8Yv|Oq$CDJqz9E0kPwt+XauBT$N}kYq#G$|kQ`Dvq`SLwh=Cd6e|o*^|K)ww z^RD~4Kh0VLi?xP1kK@?)ZQqXHMsxmMJzXvXHO{aT9qEF_#AXkqC7T1dxZ@03=rqI4 zabWik03dYeIJ64qE7S5(2#b08%W2y3ng;)z_i#H;eY2nzwr@1rMQs%aAgfCqfrygR zuL-HP`u!SYE@6}7Df2y+mBrT$X6}i#qaJ2~pKdp8ZdpDXo7pfz_!_22fvo%Vq z7Pd5K@&cmf%qU!|AG-8@XrM%oUc)2q)UAsOLzdG?0vdsgQs)!raaU>5dQXzHC7#u7?2ELvd5_n|fJ zI$FQJz>{l5u}-q8*S&G*$e`|ikuW5z2|Yb{twv&?HAtG{j>uUE?BWT#V6Je}oGr;C zigVRC`Z6Emlwwt5jW5x*BCmIy-T0;BkOP(d{g9U-NXDuUOwPJTBEOrv_N z3f%Je?n;nC(ti4*c;kCz_sC2|P+7oWW5G_dOTyXP87@?cn?gVIuN{9SG0=0D%e99g z;|tkQng>E@6nIF|)34+5^UU_Ii_b1uMcJFynL!^~t~bhf#^zpY+r%zjT+}uwIcFS* zUQ`zg7!x)D$7TFVe1-brg3a^Y`YT)lF&r!sUpVt--5gZ^HpvbA- zNsUO}1Q2IwCfHSuV%FmdXF7VXeQfmFQ)`?qZ9BLkJZ|j3bog|l)6B8Fb5rXE8D|9Xew{cRXmO8)shtBXddC#+%-eB7?u|9)&;ciLeNkTvU9{9z5|RrqTc^(rqEU&i^Gz2VQ+1wGr20?qlXvOd;9 zo0dU84;oS)BMF<0nFO!7L0Z&H!o3Jme%h;;gvRFprgB(!83jAS!1-b0g%+X93f%C{ za|9@w3Lvj5j?t7QMBcCNLpb_!Yrhh}M9P4Zt($i?ci#=IIrxA}-E1Qdsb7QL4efJ* zEk7JG2Alk|eUV%|*XJL2>YPwF-5xi4DT&IYHWS*m?=?Il6r^wNshL? z#U5bTDAvrEY+@H;EX~`*cYZV281ehd*l!~ETnvqQzFu$L@Ao8)#O;p8zLueoYr0zf zB5bO5)*08E4NkGwdEEa}XqR}X;6y%d#~AWhd5ULrR+>yI^IZ1uV~3~WQH<9e5~PSe zs4b&B@&|ZFE!Cxzh8hfk@5@NM`S6~YUQRo=z&vnTMrI6z&d0}i8bw+R|Bzg)cY2@# z0>$J$lv}vuq~~5qj}W`5B;U_)Z(7EFa(KW*e7|;zF~viP(y}_UX%8W-H0CE&Tr)%(6_*54Nw2vT>Ju3 z9*i3H5&dH_x9C>KD;rQ~wdL4C)((;9vG3UF#XO%FLM2jxXwhZO5y&uMC3}0j44mg6 zAZ5D&O(#j|O7y+V<*I*Pj4nbHp}kX(qudx6UtfLPbOfW9oddhg{pw{Qs<9k{D*n3P zDnWRaA=I;koGb>2*=}e zfZcOeC_(rhz=J+ZbK5Q4Sp$F=Zlk0biO|Z^o7%bSl7&9!7XUS-j1>CldQ+e!=}^-n zvW%daL#ZT{Q0#1M(>Z+!JVhwl)lP&KC2YFc@@f{iK~1$>tO1cM*0TUg_4?AO%pC^6 zQVGTY!ru4toDG2Y+;TPngagt#4!;#@SZ;_&L&J(~FM#^SPZtNNwLEPU`61)( zx4{mb2}pb0_-VIakki`OVX_9lmuq2*FP=caPKZr^+OX-#4iZxw#V&DE3M-QSJXNT~7fHtw2;8)m$<-C3(D=LWu?+qO`1vu7qR%j;7btnw z@So?oFx?f8Dk|o+{_AC5*h~BW&dAR$^UuOwMyPUeGTi` zHYDr`m#Av09gU*lJ+jSF5G$m%J2h7VnXYwIRVgu zTvpMO-kr1~7j3u6s`QQaX7s{Qp0l?1CohSUg}$9V2wH9yNW~EjTuJrVRn3sg5IZ}) z5}oB4VtqUfpo2yeTCSNnu(azPZqu9>lWxx;cU(7TVSK`S&QRBjsZ$<#%9B<`1yb?oueYb*2wrpfHZyy-<_25q)l8lDvavwDr!1yW1n+*5{SU z*PG?PXgIj2nL3Ab2hE`6`*h_DL6B8_C&f;=&O8(VgyzyhU9{MPI4H{vEaC2(gChCP zO_p9r`>TzX4?|wf4Opo}ao; z>Uk0h(K6V`-I?iXEXumuD4T{mdLKn93YKo`;@G&2rIffF%S`fvVEfCyjT%I2i}iQ# z(c2>rnYBhbhk=Tn5i@w}TE}=$ z(S7>UvvwA6*ZmobUhfeaH{%wHT~Vq14MKww=4b4`r!k3`?4kBNe4^WxdyR$CQT9;- z$?|}6S19_y`AQ6*?jVV$Wf}UO(v>}jaC2?Vhu1S5sx22(?xjP9+OTkb*g3#BbfU-^ z9{s;%f&WclD_>u9{rol{&<14nRiqcTMh$VGhJJD19ZT0k?8$8ds5(bCzXQ*%0G}qH$^n^& z^G~wXZb~gVH=m}RWgH1*j!R*TS$tl0I&+SYLjt>*&;nE$&aq(IPOt+2p}p86e1~c^ zS0*dEX(3%J`aq?oc<0c=N{y`(hSz0F}C>A!;L4E6@?>s;bISFHRAcwTy4)PHijJ zxJGNE1mAz$X$M67d~{oDX(^6MvFmgNFwvcN)XIPaJ}tof>V!@dEHvo4j**N*=3g z8}m7L0JI2sIjO@J@`Zh1gkRZ3V>{Vk5UqGU>mcc-1oGX;s+}kU#?d*kl*t}dEK%8EeJz@=^-1uAp@?+EVXJHO9N0RnX=iI^S$~C_HU23NgS%+pF@7;_e<(w?_&ZJb{D)Kd5CWS};76>JUQ z`$l@K=fqE?S^F#vO_zFVP>L+l+I7^9&WPiAo^E1adBm!0-OC>rnEe76hnCQbNL%6J zPd9cq2|WAIlttY^FKwKM$4l-<3GLCfzQwYK$L-Be6pQapBE39N$ARM8u3*$is1wqYZV3aEe!t%I%09!IV&NAPEbHd)7L-w{FlHegieS z{7UaUK-6;7$m?ZRwK2Bs5LJ**l`OuBYC8-@AJ#$|>QX7SN4l&ld%HgOI4cVwS?|`@ z&+-IrWY~x2UDgN=X0IUd+{0NtSyV0v#(Pk)b$SDB&|s_k9C|fd&Xk2QN{X-p^UzBt!D~ep*{e(;_tL< zGtgKJ4v5CBgB_?SP&hA@uQr9sr)#XIp^q{EN}4E$4G1M1nknd^h7s{YzZ~DR5qS*b zb{`(s_n-w@u0FV-MHY8ly~aY&rHu&O6rUeF^wy}2zYIgqlW#7DT48~aqGEF-(eR>P z(VA(>xr0C>0ny8AZ*p}y(@yu}_2v(^>v5{1=#poVRzNZE9;pp;Lhe*_k-)9GdojnN zWoRA|HDBsFFMVJ9THDsi(Wc98( z7#_|oq9*MRRn}{lJn!NU%MIVI`vn3JS2+$XkM9f3mvqRwl>q9z1?WO2U)vLUb#1&c zQCi7x&jRkk$Y^l&q|yQ`vFREoLvt@$WBjf^#!W&iW6#&PSTh_H%-a^=Cm+TPm^ifr zQ12oQO2^X4>w?>l{Zk79-K*+)-HVGP0`aKTZq&!jGlDx(uYI4n;JF{u z4Dt5|q}OLIbt?}&uAe;k4&2P|(D}EH9$Ee7BOoj|uUz$GydbyuW=|xJT(S0Rb)TVz zL#>h}N3yM~OlzHXYu6wGf=HU=RtCyO$V|#iT;M)_W=^<92!=k6JpG#eU&Jn0K z!On7Un8}u|b}!zz-kb~kn3}ncoVoTTx=mcjyP!I14+3(CsWUEv`J7-YY4e;-}=qg$p9g7yY6RZFT;|u78L^I-3nPM62U~d%Jlv&Xi>TfU|efUVp z!;lHW#+v3BL!NP9E<)%zY~6(Jj=uekgCQwMH?~`}6v>b)4v=uuNxNdYji0)r1y9ck zWWbgCwtw?3w4*oR^OT~7_!}xqw~D9@kkQBC0IPyvW-|P(iUbPw$Lw@0u5i#ZmRi2jv*R2x$@)M~adw;rXGx)-nu+qN8WDfcI z=tq4&#@2LY`hjia?aHW3mrI5mFgNKVV*xI6T&9^O|*BeRJh5M9POry`xcD zFxgytWJGiBJ!-aY-W(u;*r+Vp#wxR&;c8O-_j4>VTx(^YZv;Wgao=bIUWfrcccj^l z$dk7Eokgve+D(bwft_qfm8sf(_{xU$oYc{>y`}an%9y>ceU@#U=Mi-Xve5)B19r>Y zTB~^yUxRc)vKy(qaoIJ`&mFV!6jPd~n{e<3{bH0bc~_sXE16`rW!KD@n$J32qB;Xc zUJZ2`46Ze_=p>ZZt@iyo>7u?;G#gs5nsW48csXIz$GWc)>4B9`9Xhr@y()mT`^<5L zGv|GD3K9IeE-JqLwgOF;O5?E4%e(-6CoZy;>X+dL(D%>#2*0xBxyO)?NEIO@u!4XR z(Hf*me_kMi5(=d4^aG*Llx}^9SnmIy1waqIFM4&Sh?u+c+~9yz>z;A1o)Ojy>OyBW z%&Y#;?K+4fmgryKR61U+Koq)Z9KJS$`+GxMQp_ zm1*Qfu20BQLG`~HZjK*#T04BZaw}}qZ#W+rlze7+upX;4_;!>I;Z0OLcmt#+#d$h! z93hGas$XAg%fLjMfVexvEr2zic38Eq&ZW9|98d7As75bCJv{TfXi?I^lI^%iuH6Z| zXZ8%-OFHDaE49fdkUh2-zb+;6*Baet&e!QwbuMol&XJ)b<8*O+o~4xE#DH_GoeH{# zC_0mUR?2uxBv#qRlr3%f{^u{%jKVM}VS2zIM*g&yf^5|W4m9j$N z{)Z;Pv)}a8{K}Jf5B5ZkvRsI2+oZy=CyV7vJ2eX6oN&%+x2m)&JHmndnNnE(%pvT2 z;jX6k_lx~a8PNA)8Nlsds7R zcA-ZpJK;@_j@XrN#A|P!ih+MZr0*?1dBvs8GK$66RE1I;@d)7uPnI2#o_5qZk->&GrbO@nru%QU}Uj6WoS$<^m!w+Jk+2+&B zHwi29@$$ySX`3RJ}!9Y_*vK=iY=~o`DHVHF(tVZg4pj z!qOW9X}mlZUx!$I98!NC6K#TR+4YTAAO8vFzkC@t%H+b`RgU|N$NTw;iDO&CH|U%4 zJMY(-ElXTPB3o%BA;`?FI>uF1X1P~#S{9;wKT)%;X$>#U&y>G?wp z0TlO7PxvA^t!oczl8*1{j=JStozb9axzZZS_3gZWAz_k+tU>}I_kO#cH;$@3qbzU z3X8&}=o&6IHIT#=>-k(L!F!ov-`F%+^czY}+GTYJs_Z zhxkaU6Sv#L z_jjk4i*?8xu2Qc3Ygsj%r=;xzWWQf8=ttMcN1B{bJ=`?iDk`=(lG&1Vo?Lp~jh}NI zi+Ul+%R+T1po?*+7AyMWJe|^s1B!r@BMUTh&)7BR3t?PjtSAV!1)-q|DSuS?<7>6v zpE5jc5b3<;*M=b(M1YkEbWZ|jljML{%Jd<8+QtfDCxwrKR&x0@wqksA0-GCpr-@3Ks zM-aWL_+f-JgucA!qi;|)?&Uj82`W1eZfa{UOEGu%3)|KZ%=w(io{_4C&p~xrqMZh_q9lci2Gc;4?)g=<9p9i}j`r6IPjZz{ zMb6U(?gDOSGZyzC5YMacDFEE|leFD>%Tc||w{*72IAc6_pS6H4ND zWT$e>QT0*c{e)^7?m9oGzpi!!A4Z~Y*w+(y)di?BMfDfa^gR()+i%~HHg3-Do#)F$ zrd!{fPdeS8%a&0Wy3Y?wr<&ZI1yK7V*4x7eF|IG2t}m75x#5Q|JO(C@=>RizPEAg$I8hu$M-kowNesHw>=Q^3^53%JwHk##;z|!=r#sjz>DhT*op?3 zNYOo>IgLB+o*#~bPn^G@RDnbz9GMxE#*K`F8 zn^)lbv)zoofG4(aGg-IX-HJE^q8%K5*sN_c&m6DwJI!;p&@Q2sHqh$mVi6tr613u5 zaaC|15_8jXh^iI2K5nmeA@=_Uhz1jP5{G=H4$uzK`KvYHb!{MHw^C=tl{ zL`fF)JE7(qyWI(Md{7Or>T)+bHdenm^7y0fZ*~cR8begVzLHrJFS3m=_ETS}b~rH2 zH$T<9uLgVc(l$ah;z_CT+dOdOdSsG{^*w|8x4$0!zxOWUz_U6C(aFP#= zQ^kwT$1)+l3&i``O;|*8=1so~d+icuXC?IGiFDBb)#TQVGDXM773h2O63hSY(c;In zQYp?Q$9ZF}7atRzIn+0vugucUa*IWOoY#Qsp%C%M%EDKP4AH5Jlw8yfY4~+dnP==B z81n&sPk|*a1JNTLBP1K2n&R-57Kiv#Rfm(cd?_*&wD~-c)yQB0U;d4^KR=HfFL7}*@kiO+}pGX)V51Ap4D$ax06=ci}7 zg|J#vcBvZzqwDDKIHRa+*4+9c+yPpAipW`%@8c$6b0#TQ@j6vSp+7LLz4G(77^z`K z-A(7l`OTye;)7i9eS6_45I088<>|*Dmy^x}+vF6$AN8rM;tFfzQyPSDYN=nmpWE-w z^)gxz8PrbXu&|lT5z&tCU{2&JHPcH1e^9CG(aY?3bnDuk_Hk*GBShJ6+BsUv(OP40 zuD2tC*3=FNYG=@`YgxLE5hcQ-V++75kpr8GhtV%Hfv`x7p>ns1p%Q|3*jXh8$cfn=CIuRFjl0y9bTU2_OLfJ zY6XQ_bjbGP1$pNSD%QW{-1y}B{*uWioYD0Yx-~QprzI{Wc$cB>WN?4vzdIUd@%?Bo zW72%i(iGJ<42XaxC%Zp7GgYGbW18)-in#-ww>-z%MpJ zFMd0cUG6CQ7C| zQ+l2Dr$=;M+FY&Cv`_^l=PKvq1t1Hf)J=hVQ~c(PuYnr{NL2N}Q0}wT6j$|ljP+I; z)Sgn;qr$#aP7@pcyQCRq@nZGi_>`WPSe`48O4nCWGq*hr9B-@8dGk8=tBnNXcr&UX z-F-r#b^V1A>z?J3g=X|2E4KaJ2p(_}s&^UL14*YJoF^ux3eq1rey2S!O?Ndt2QrKx zo*O3Nuqj%3AD! z(3_vyl6c73I)}lh2a~!sn88S#lUPYVCZD-lo3hj9t4-=5mGu#Lj%xU44+mjh^2B5y z$`!TCAprEd+tWXbiuVuek&6Rlc1e~R&x`!AZmk=xj;!-(0}F2+3UysBx*s{)^zyF@ z+UCMQDthR9^_9IJWh%*ap_qx>{9vdNI-$#AJ_s znlWy1$4))+=cQr_PNNI_dWJ)``Pa+nMllbvC7>ViTJz|<*15vLAKhR57eyb2Q6?Dk zpbn43;>9p-kl}+D2ASB@*ZPd>bwL)*8iR7;R>kRa`bVBEx?^4?Q(dA$3iWa zK|0L1Ai)^t@d96(kjHa!oYN+UVSI{Xx?6gW2g}j(e*-{UodXGJSB0m!Y^Ql3Zwlpf zp0kHg@ftcKBfaK-bdwLgp8I+Tab8?0t>2_VZl>7O3vKPM0!a$;Q#m+LR>y|9)#DYo zEXaLnI}`i{G~$lSmpK3G7ojw9Zs=a^#P#Xkaz!`Y8l9UgE_*Jm-MUIr8sVoxqEt}g z+QIedkaIs5yjYLP)^DxECSDga!xP26Qk1sOQdglfw2@P!swB1$4nuSKWmT|sjSvgP zk1LD%^%d5+_35 zM7B?St9*GbFJlTs;PG$<-L6#u}4K2hG}6t zvuUz%#1_EiLaBIsmeufHJ+DmeX^p*he4TGscYoqDU849#d@KA2l}};cHU*4`S^afu zWg|Jh>-U^CyWi0|kDyO)aq4gmy`Cw~y@@CgTMcTr3_$+r2(D~j96UU~Yf{lTm^O-l z?iE)-|6BnYUi{qKkg?_~Q^PL8PHnHI6*mDOl+NVLbp?IYl0b`sLdzNvA^2CKB2K&O zw--~?G$FGV)u5K^(F0(7c=)GwF-%|`I1r%ifk!%)$q|3Gk;BV1rDJI2SJhqj_&D8b zAYoUBYq_X)cq_werDn+!2f0{hmz(F%&)X=_r|8M{pxDBN8%2v-F-Cuc&d3e2lScNm z69JcS7G1lonmaQG1h3}phvO?%mpv_F% z&L(y((LbX~CNiQM~c0k#O>yHaZ}HvKX+D256G zJ(E;Su>zOdLgGcK*3M+PHcT09h@GZ7sPihmJ^fOoKUQU$MFRqDU za%`0qQc5k!Yz!XE=N2i_ia@`r>MHPEh`F5&>vVaYt&sgOpPVtBI%oaR*R1|wB=f7? zzwC$e3?IzaW=Q3r5uro*U*dEd{^af{5iK?4LzgA0gX8r5XumhE%fD1B%VB=WA^F?o z;GOWvPi)#pueErBm~4@B^_1#`p^^Ty$U(tVP8;gShMtbfW|-{ko%%j>+V+9XK#4~j zinOIUu&Q0;Hn?g^^{B`1tFc#S#0py&o78gn@WE&})B6zcm4>-4o(zec7tDxVOiP5U zn40_y(bx(XSagIRRV1Jh{h;3uw3^Af%WkSf)`#0^BGea*W5e+}b=eyKCJk*onU^>> z9o{}B{({nssG)rUUrBTM{itD$Dx_hQV2WB~?ZB%Q!#bPdj`_+Hyy76B95NUoa-mT> zZ{OeL9(_uJ_PRs+%sG@r9|C`lw3?GlLfeJ_Li9+1p20?E3J% zL%4}zA{LQB|4Y3st;=h#yS+(mFH9UgftWNb*A6Ssw9t*|70V5_^(T5E^oX;SKza*| zHC`EdcKE@$0(=+@J(q~4hAN$npkx*)d;R>xTND^sUpMEk#lU5@7GYarwdczWhu5cr zPPz?_!J9WGTkUf;cdUissITwd{^44B&bxn4$T-Dno}D!#TSRg*!?Mm4c;?cmVHfqg zxJ2^?+)nSuD@-|v93e!#9L}<#iscj9WW(mk1GK0{qWV9o*KMkmv8hNMh$#cjK~)*( zB)G$GH>)}QrEqYNy{&d+?P}eY4E=_;2MYdx7i~umQ^^AxuKW(T(i9j;y|#PW_lV+3 zLV+{Y66?mWjp*tlE;C!-pGMC0Q1y=C|E~CS!~b<6ay-FJokcpXlUcfw@D&qPwtTVZ zZoH#XAKu};<~S6`*eoL#v1SZSQ=dWvp!+F?2}6K%K-xzuJg`au@vxh!wiFN;Q{Zb**Mm(oUH%UJ)IT*oCQwFi5~)*>H2v<{ zi9GsbB5*UgtXY-?&@M8?j?fMV1eQRPHVE zPw7m!eC6lFA$q#2JfPmf+xCsz)#Q}COz1Q$6<<}Cbgz4w3~#etD2}82)zU7OMoZ43 z%T>`I`BPKl5?^xHcX(m%_!-5kORa8AjheuGIX^neghVAjW zwcCCEUw?jT%+IaJeny!Cc@L172KZ}&~Lpr(=FhiM# zXK=B3hh({5%{QTnmylWi8Ftpf>vzVUyqg?(i8OfZ?4%~j-Pl++6D8jM9-Tx~9+?|F zAz7p*HfemwTmf63QJSOTN86+i(@(F|>tln6$p-QMFkBrI#_pv@3wgpXMCSEW(^Z8pIX?d&0lRp->+ z>Y}FS`G#l?2BVB@Vb49S#`WIZ3UyF2;UaP(#SV|hAb3}(J(5ODW0{sZJc#Y&7th{V zJCpEdo7&Nkg2d48e6PkNB^n#;GG9TB- zFX>ySymWl7eXw!BglI1&?~l`;F-hMd_%KvVjURsb(D7Ppq2qmG`iF1!?N1(G&@oTp zW2}nrHMgo;yFOJiGFF2eTF5xY?-Zb_mw8RW3n`P)+)hyqZKd_MQQw~>Miz7Am!>C}jyHlX>6vsjmiZWf-FKZC|W^kk}=5%@Z$P2A24Sx39e8_A&LJJsp5& z(Wt^UZZpe85-!9!iDu0l$t-v{#Id+??kOPFAf$W z#c#I(*+M?}4#T;(lad|u$?})g+@!9@&PJ(~=V^4zqa`^yIN?&EafjMJpZOOjrj^_I zA!$E3m3;|0f#FjX;R@RbY@SD^xLBRsO!*74;^T0(=94Z|&FNalwui>TQ=A#|#RDoR9|Cy#d2EqjTa%Zy$aCddWyQ-hih3cugqS9;miE@g) zG>1iO!sef|K+(H*F%Ogcvs#UT`PngtP*~&U)0OLS8_s-iH@!N)P9c560raDe;PVKj z#N#AtVPo4k?VnXc&FK2-Db4)Rg&*%@=k?qV4;SeLO2_le%JdHR9R@jQ`#DsWDto1= z*C$x0F~>wP59Wrlg*>l1w^UzEaW8C+p63T1E#44%6y6tw=x-sP8NJ2A^J0{9@~6Jm+|p*%MUjZ4dvP_NIT>Z}7Kh@ypS>X)P4B^1W@!t$DA!dN zxp1+Bdr~a2^|(nX^xaH}ra3gqm=WrX32%5AY`7hq8ag<(%d82)HaD(#L5w;%ZME4r zgj>X5*tKK^h$SB}s>xib^sHEUU`om8zG0p$)SJ zy}z&q#T6r|;I`CgaS@22=z;luk3T+;C%5+88zrnC-?B88bKX*O5?a8o~ zWc?Y&iNQ=g{+6vT*@eZ{Ccmoz>%oXUK$h+!c&32s5lEgnW!IM*#CdvzqnUI)8e#9V zs*&Q=93%dTA>jCx(lE~FxWXaED}*y;V_#j(H?qR~c^&-4od`x^?&t{qf6@8f!{@A9 z_Bk9M8w$gADClk-bO$8O>J(t{E&$c=56P_K5{bZw!{2y)c>RjvYsCsDi-1qB2-_mf zn6+6kO}H@fYBOc1jj+?w#A-Q{Yk{yG8YU665qq+>pbqgm*aRjy8v1p+KU>ChuOftY zd%kFw@ol9#^p$#YL5dR~&eIVhW+BM(Q##!9@|+c&7)&Z$W|<6F>6~5Q!8|3zBiebz z4Y^C}lo+XtUo=Z3?g8O9cKhe^X~lU%t?IbGyy;`>dLutv*1zf}ic)bMzt8a0gjpg^ zD*6T4k2KH|{LPn&PvINYYAbX`Ku+oi_yOCy`@A>$aYIFH-5ukPLN5CdhMshtuM|{I z%P9;qQ(ex(@=a{$&hYDAVz5w{ZaiK-lRQv=_nuI;@b|m>7JA9wwq8Gv>Q(xa1XJsWeG%IRxj9d#8@v3J9Par)ZRD2_nH}8V)mcy9KeRkBgV(G+iF}Z zLgOUju|>P^Bbbzl*?qr0VNSn2Ty4>K?1MZWV48Q}nksVs=m@Vk5 zK`(^zhQxjs&~nEAA|zDzUw++> zZ@2SQ*6n{ysab%Z3w+zE1&;ZM0hVJfX>$>T|0>&d)yueLZ?`^n<9Ffun*k&(aTT_8 zZy7;CNvQi4w!B{h=%bmy=){MlKZEi6K`Mjvt{gJ16mqS*IB~sRdWuoOTX@R_L(i^8 zzx7=)MTRpP$_w;8LeX6n1xhvVh`IbQ(qriJ*|vzL%PUYwZ%n@)$;tYUb;s7T{x`s} zwIF&rScIjYU#lBV;;d#yqxZGeS&W;a@gn)cjwxDkhCg> zKkqqLVhvo{CQ7j?g_aLd9s|PmPivreA3pg<2jsH{9puxOUiXt*2Qw!)-k`YhcKIhY z#ufmCx_RvAt(Ilknj2D2xqJB^+j9}w=>fm}(YEt^9r9(TyT&z;p$!eBbt@NH>4@cz zCr2TjtNy&!2CB)!Q|4~smYWNW>S~;SHkrIvn05dVE<4i>Cs#5L9I6*1!!@m+B@Huv zn?~_Y_N|t5fXG$bY-_hMCHNWjd0a|F3~j0`o-#ea!^+ViHSvxLN@ix9U_T3!e=6G} z60C3WzKd^IrA%?=<6nc4KMcb&4rtuGO{XCF$5^W(G?6KRP-?`T5zyz`YKSKySc}zu{Y064Ybc|(?}E9ACRNZs&J{$scmzGGlA`aDr7anSiy)hM}vY{hZV{Y0lO{M0c=TS3uFx)*=h0#h6;smvC-BpXzko z9+u?id7|MRUs$2>q_yJ#r~GU9VNM%{nd_T$>ypR|JJ_Y`kXc)SeOczq8p zSdQn*L@l8^$GHki;0iE?C9BAzi2fqUOBBxhozi48zd5nyp#hYoOoQ;Fz!I^h?5j6n zE$IV|jkI*J98sagjN&ZH3O!>?;E56)fwsg1wi^o}g#j2L&%2`50>U&lv}V2elk=T|A9yH%|t9 zsXOj9d&s#ww+S~4I0A|ioTTu?XzBIxu0vP-cTX5W1V+o*yPDa}Yrdt#%=D^I7T1Ae zwa%*JKtsNDU4Mn3wKyiX(U=Z)b%PM`4}SKT4@r;vTwjC^3;NJD8vdABLBB)D-H*)0 zb}UTVW$4UUoLo&5WqxR)r6iPz>ZnVY&~SLHsZGcp;Ob{;q|y0rd|9%5$0IWI^(ofZ z;-AFO1AIGK3SN0hrXdJm!bFYUE@tRnscZsx4TpjBo|%bn$Hf|tm+l&J_Sg&X!I;B!xna8+q z?&QC?0k)0<>ke!9-la_fq*=LDK*kJ0{K&VqJEG*w2y=`Qa~k%TK!$J1vcyE&MwdFH z=INJ&{pElcWbB2*s{#kc#^NC{q5Anb%|Vz8#-jMdzuw47Q%h2eXLa4LFg6}31PAKi z@^151{d`EWfhZgh5Deao!`o&Gx_SwcmKO3|?O-Ky$pn(D;p=PsVgc>xJFRlo1`rp>nC(ype@F;boC({{Tk3 z`n(^aAQ~H0`kb%)^?}&Oh$ojhbEXDiAB45YrLl=CGWm(>CFt|pn@p$F@JYUqXxZj@ z+Fy^aRq-q?->Ao`SNf*j_X;BTvm_>U#`)Z>5BuxtX~H$d<)ntK>rGnv{HM60k?y!K z)z1SbQ^y<1(EYamSQ^%MGX>_9i_X(e%k;F(H$G+eo>uzmG;lSYy;Sj7zI8WhDLx$( zvFX0wY+_v70K{4)!Sn=*Xaq#`JIQlUJ5*BkJX#*X%rp_#Qs`Us5iNAdvZQ8JjzeZj z@I~!s_k#)bHQPu!F~f|s2wJZkT`~!vo1FlrK+mS!+ZG8?C-h$XbY9oI&T}QTUrKPd zo+!fcGoRS>L}j^oysB#4+$~z*SBJdkHME@R!Y=01&piZl4`ax$pCO{#`6H;-HinLscAlSYs?W^zu_o+}fyUbaU zWygBx&j&y@6nUObg?6y)1m%(|X)VCA=gI@m5uRZ$T@ByGF~t;bo=`5R z9m^j{nx-Ta4uR#{lIaWIA^Pn4NJzVPABkF!cF-W=q`Ur==Wg6kKglG)0fxT#6ie@Q zJtBrU_IkNlH3W8#118Z6)1bYu4+ks)DP(K>v%=8*Z4{Dz8Jdt|Ti?In_lR`<2DzZV zb3cWb*5f$K?mD$<$bQK)WkHOGu;xv^<&^bEe>Xjh25piiu;jt?(=2`FXjTS$HQlc3 z>8Gz#rD^cX(f-_GEQlJaru9Bvok@cBAinn`2VBqt)k+Jx~1&^!QGukf=lD>PVf+dyGwA_V8PvkL(t&v?i$?P-QE73 z_k8x>opZ$)J!rV;y?U;yr)qj#TB9L81_hQ}(H*4XQskwJz%bRQDmIZ$$s+Win8yjs z-St^d4PW`I51%KZmx;1$}qQSmYi8 z%=A7Lu*J5$eA=F6&BJ^ieWhk|n5N~53W1?VmLmDX>^76mzh12G@WLV90Yf8*X60v#WJnWUQu|+X*?*7r&4z*McpS6+4R;n} zZomEhI_3?;g_I@Dl2C|q`On(ytMumFw|(Ekk5IlOs8y_9G!WiCXkk_76GpuWJY*|d zsOAV6HV6>8oQQc|M{=#Kx~{5L7Jtc>K2v-KDRGo~c$MAnzuq|mpSX>47QZ%q_cRiWCz@*d31sHp2#%cFb?(mCEQ@>c0`h{D(HZyP*a^S=e ziGS;hqUFOkH3yY4aPpEU?Hh7D&~#-d^0X%pcCCovA&XM#*Ml>aFiTUzvfRHKPze<< zMjfceJ_dy-2PVu72phGNspH8Y{$+mBNH3&^22-l#vaj>*MTnOuJ2embBwFh-aD7gF zwqYVGkZ)OGo`tCT*`d2OUXgCpstf6tTY{LB#bkBBiaiLY;`IPMh?qwqgzeyc??c(^ zFM0FDYqTWX>k@yF;RaWGe(Euy%6#ZlHJl)(nS z63LQho5+iZv=j7vj6>D@+4&Yld7~<`qZ~Mnj@I&4d{tX1JwP;%^!m~X9#=bAW!i`# z3>X)ppHX_)t?=?Fj{heKf=HIX_20F)p3)t4o;6G-;TJB?!bZUKa*|~DT5a8RC*zJo z{Noeb4Aq=m;#+uO>t~IxocCSN=PIh5XR9qO$XrX(w?z%yTNi+G;%^_C8&0IP+;Zye2$pZeIKq~BT5eQRZcL86PL{94&j%; z1+&edRp7Ue=YTPG7kVYj`|Q!?Af}A11@R8V+&KoAYm|SeO3vF~#}OVdcng-+Fk~52 z**LN81%yoHFg6%z|NssbQC_+8<`lM;iVnPQQW>uI%ZsJ5c8sfou5FlW5 zIb>-LVT2*+$7GA>N0ef#kdsG5NIKeyRqH;_hS}c?+qug5B~5^l`WSdjso`deY)A)@ zA=N~_j-?~m<4=5E%3L~YEJ!Y%vY*3}>NN5~B*b$cD|w|N4#RM1p`IXc)xHt-Z-n{6 zHK`LLQT&AQ)%1(UFiFkJqb2`sFE${jd_vbX<%9>$A>~ie+;i-l$l(sxF|AW(D^-ds zlit&RJwJtO2I7>XmCMoKC+_A3-8csk3?B5BkN?N~z%CDV8Y=9t%D&(3$|Y6N>qRrl z*atIZm7^u)r0d5DUCq%vVIRQq*9_(Iyb-h`IT`#!Jo>$IQ_^N9v!&%9 z_P4PYLJ^&G_3<5g?RH*gU+{4!-d~=vZ~seaNOO$GX<-&d+RbIFPX32V-82K3jz9W7 z8S}cHv&f4cBU6VJ?N?zv6Tne)62<$3H-;_|rG-TFiLXirdtWY{yUOMTliJkvOGJDb zn<~o%fJn*k10~DVol||Dx7O3wX@+T;X0L~7elG3$_jwt3V&F#$Rl~cI=JY3w1D();*A#pMrHu#K~s)q?n!@R!VMg zHHbt*pL8L`6`8yD!_JLD89f&Mi%1j8+n|#JU2${G?;Uit-P3LW5A}!{qs(RcBSQLm_9dJlJ7k} z&xdQ#JV0`67KIP1dW@d$!<^M1Y+0;me`|$VrqA%}>t0#{YD8IkKS3&FyMQYwHp}p; zA^`&HV6)I#t<|c$oi|?9YS9#j#h}?VyX>2!tbsUAegZ1?G%!_s?1QU+%F4Z`R0(M3 z^!HxK<@i~9K71{shi!ESI@+WI^u795$54qf1AKo^b&||%rcR7 zA5__@9eI&hpH~{f5c@%s4NbYPVC44>xBh==692u4r<1L6`OLE!TTPR8%KoXiurXQB zgLe3Fd|r<-$W6fWZWPsQr)mEe-|(TkvPNEj&WCr8p4+nxC@G0Q0EF_{NzaL?L(nbWL+?vy1)PwzFv6wt8thM@a7%L-bB-&{(`~KHh zIA0)3#iw;N&B5eHW|rYdLr!Io44k^KF;-C^T%KH;A*&o)E@*t0I>0AUyWOyq6e`1&_QZ@^tmF)x8Zd zB`uR5wVSo+GQrb@y!N-{ppEpSDm zruy83fX=JQ7Ng-PxN8aU5HP2=$~p|qph)_w&j2Jn zDzq~YM@(MvVH z4WY!Etz|{~Ovc5jz%#=uflnigK&EePFaNL|qIZq*-qYh|5E;Li`sbyENOBUl4l-`H z-$W~M9Y{iklHTa(iP6YsZe9!;McvE+Y?wRO*b0+0&n9$*v^<8oJM-&@u^ciVSRPsD z`~QLo_F};xZ9k!_Z^CsA|C5UpaIB0sA2;L&WG-}Rg9q()EHx0cQvfomR zeIBu&1}FT%EL}d_a4Q z*#+he5ehuKn<;i`usIv+ZOSO3vcL0B=b@L{PHQLGCJdve(d0)6i9(4l@VVyTGVtE< zKJ}yN==GW5n-d{avPnvZhulyIdzNb*(wTu?)Gt{;aTAxD!{JT9-W7qu4Tz8fvSwFd zfrkogGta%x1@7^aupoETT-0R9?;pD;2)~qUl^F=oNI!0N(=bibcLy2-c6q?hZGvU8 zs|bIN?5=*PFd(b83y{Fy{QQS{x_jMw5kCcy#GAfDNIqt-L93an*Qwoc~B8~gY{TIQ7){3#%c2M81g>~5ZR&d zZAY$nW=Z$yyf;tlxE%H=m(RLi2H_G#`Sp#vE?}d!|8sk~6B57aF4ozu>)uxSUiRU# zasoKC65@JxI$ZgfFvx^&5mrNyF2kPtZs2JA2KRkVci&6hUijxfzXG83 zr=wrX?f^ET4XAhdM86{m+ehGBk7%i}wf*wiyz`0MZ#R-dB} zf}+1=I(>eNr1Bk5o>jZEuK#5Dbda1(lv3$R&uW;I^)oiqj>IIo6}45Rv1}vKW0Ssy z-$c2j{bM2_QZ9B(=)YE89k&OfqXls^i=z4TXGE08amx%g5|i~@USW}x z(uAz*n>^2&%vNhA_%Zjh1G-z{6$Kbc;-CM~L~458luPN(dxt1Ow@Zu-t2vJf{|i_V zxc)f+=70BcJ-MVV5^$OH+=+c}41T}P;s#x2dApyz7-<*E7e1$Hej6~p9MRNl&bZ-dF zcKuwJRCp)}d6;2UpT&O2)JjVU-9@iHPB|lQ*fw_m(F*4)laJa#4#IoMGNiu5@h|3* z=~s^cXQUrVj#-plsLWM6(nt|GdtG=J~^p^$IY|n%ks=$Gu+q-wef?;@z#M9kuo(W4xZcCRIvct+_ zR1~lCuO1!yUDZjHr+GbJd4y+O`+s>|EvHF|Syb1{o(BnB-HkV&Yxx7t;<|4TAb;-X zm1~`eOaUYQg`A7W{eh73WG&0$d~HCS2{nR^I03&pFkeAqUBLO?d0#hIYBp~i5^1&SsUSX#5`ODhPZ#NgKo@u&m z&)GloZhzsJOCQRWV#O*D4(=8~2Nc`u38(yGiXA@b)d^kk7)o%D3VoDL!KL_}F2aI5 z{Z+oyvG7yj2y4Q;G>K%d2AhQ|{=O8T5-w9s7<-_an2W$Ho- z3-cJOKD1ZIOaAw8T)poQsyM1RyPcvDBZ~Nz&z%*og5Oq0d@acC$K884OhM%m#1YDj=lB#gqRuORlXvo6d~}Zz!IU8XjZCy6fPIGEw3upkxb&@!6&%IRx+t77B4+*JIGUzjP~G0 zbf6e)JqUL2w+qJWAs~b3h=^W|o-PkbAv}Gp96pM3pnPgF&=`tvKw#l2D`Ys3>TV3P z#J?qI8U2pXt+gabg?Xbq{t0jIQ>YtABCVF=+=6EyRHK{D=w!H&#lXWRbWt5xd>Q&Uh_C+ydUtsvvIl9T{=`0I&848m^Hqy zs@WLlJ3TmSxhHwltT=d|Rur_CBJwdexg>#n0Q|hwL4kX__vUMb`&l(TY{TvcAYNqI z=Lu~pX8@p0WkbRvK=~T3%&LfD_Z(vjO)`b<*QOfWx309X0lnYela|n-n_*M$yw7MzT z&1Dl(Vjr2snZz_=Ccj9yJH)hqPTE#NXu?nh$j%OC--u>q<8QTvD_#s|Xln1+QECMr z3mpKdDNkD0LXoG7+;@ei0$~UYJh}9jW>N>dW_%ZyOqu*IW41oq|6<6`r&l97~?#)J_Fn@$LBM)>Ku)hljbxni~Piy zyWg0KcEH<25Ba?|8~Qp$%5B#rbnYLUWknRER=3{&q7+Zo18=A&U826o2H0lSz+$D zN9M7P3+!9pKkk>+U<-zwzcsFBv2Prgx6Hj>M=cv&;A%UC9G4 z_rH-d8oI6Z$N(6dGpeEM>-ni94Hq8Q8EAYX=# z4{eLD&u1-k+XEZ|PYc^RT8~_Bo&YR>B53|K|GS6&pEB4MWX=U8RiGa4m*-vTlGO0; zea`&%XCdo7AbskXakYBC-n1%pa&$3&DsRzp+Fp3P-qE38G5l<#GFMbBf30Q8W#^3s%nW8!8kLJOsy4iDa>7M0xqQ_u(u5zYf4WNpVua4XyVT$jXbZ0s8<&A zCM;*XepU8#$iF@La`hQ?-Yt9&B;>m*vmob^H9RuXKXsn77Ynv2^lJl4^%8Siz86ys zN(zoBaCB*s{v-Nk+4Qrn3!h|-Aqb#Uu%Wm=yKYM0*aL2Q1tFJBx+ky;<;K-p9=Tel z#l;3F(69p%Xp_0^b5F1OfIKrpa!c8^OQTH`{5+eicX*HXfRbN~?8VeJT3sISk~0OY zztO3It1fOITf=*(W7X%oc)e09&!`}c?~YL?BO_+)ye@)vcGvJx4$b(fj;2gQ9}8BQ z$>9Is97#~bX}RaA+)re2Yiz4}Sp-c`3`aZPTS;Rc+ow|Ft$P)c!jI^0_#2p+WZO{4 zTVteu_{({duwaiJUxtJ%(7+n&3g&7<_64>!jm{p%1?!K>CahVZxNDKtwzxDHC*N`&(ZmQZ;lLs@tZL@;eOccN~e^+q2GZpNelNucmVZYL0mJBOJE zwCTx`NHAGxa6JA?#l*JKt?$UYso)x*nV$tNiecA2l1luV`YQOd2R&o<{0kEE-tC=tRTygBc<^z1#tfL-Now zvjmM{XC1Yg)eIniX$u~v?T0bcv3-St33Ct zw;ZC#KMa^PZ-S;X_*~~e)``&_MSN!|d8^b{xF%(b9=At~Ak^i?MLuUsw^X0-TSuMd zCyIQ&iNz+TwdxVZeP9$HeCPv3Dsj)}Nh!W+Se-hrU?=PCT~OLtae6_#77BrsLZGb- zlfk{$g|Db~6fWyM#Oy~u^j<(0jdxaMZ7%#I27shg1=)_%N=CJ>t8Jbmc&TfvAl+F1 z@Mm()^1=T#FkXRabrWTR;{+}^3%CVJyjkArx-Jz{k4Txfqu0xQ<^B~=0qc#U%dOHG ztjAjY3bYd;KzscuYxe+pYzbb>(jPd_y5N?`waAdwERv3*wF4YO}M7K>2I^^7r$9*dTOEYp!C}&ST)#pE6qlt_a0V_a%`KGs>30U$Fesb?HrbzWxyL1FWjmvgvF?@>u%RgSy_*a!&W&6XcO) zqQxh9Z3}$;P2)gKFYSB1FzEyBD1XCmE__L*gg$51m#3H*A<1dLRI04`X8G#+Qc+{P zh!|PDzL_{|SvoQKL_Y$dennq`3>8yY!OP&7x&NroDRD@(vxWlVo#(-i684=BefF9- zTC-9KQ%L`r)Np+(v5a2|rJIOk#R9%)A}xmRR+nyS2@i8j?)zh-xt;qGj-v> z{Zl}hcM2x*Q2&$9?Ka41Gvfz4pk9gQ$|o)t0qt?}({1mdCV#=gB&0*VCwYSbt1I^* zyfZO>V|ZzYjk)Qb+yz1eLidfjEe-c9=Y`wkWMf9NOr?-##YF8TAJ}&>kI`DNQ5S?f zQ3q&l(;0SKLtkIXA69B6j(9f?&bijL)g6HX7z*5LaVRH2u@ZP(+=C>5C2G)}#qfBmbkk1LukUz>4!u7)1; z9K*)KUV#9Mquy|Nsd*zTutKKa^s!3jUjXd_)|w_)wxR2){Z6)42*mt(J?(C7KRR(_ z_L)J8XY#*lMv8hmYcF_w7b-Kh_Fvk=@BYMBArt3Qn?!v^&gQ>f)1?kwk}9APWY?SgV!E;8#~Skp3>Fa~1QT4z(Wqbf zzaHfAI^~{R%Y4tz7i0y}EV+Bf$)8;|hKJ<>0g%&BqxS2YJ3iUBYl!mc?F4~1*mrBc zeYtLl)SlYBQX14>aD~d{ejMcY6X6^5pQJMhBvYesPTTNyNs}PIK!U9ks1Z#ZJbau` zDFbo#DsbA!&|nf6&Y^A`q}#)Uke8*(liU~i_9^6Aq0a?}g*&Xb{2X8;XcASy6O!;> z2LeVBPj8i;2x*7w;I0Epp8fQF zmnC~xg|s7d9(^tyKI8(4wtO_`5N=M_O!vJ|ce!Hq;koZSw`hE}Ie17?Sw_ihtt5uQ1OKIxso_?3 zo-J%gyDrqrjk5y>BIr!Zdaf37T~F2~ zo{+lyeWMJXYw99 zCjo~v`#$j?Uis9(08k>51aI+qhDM^P9pWmu<9U2E;g2fkaj$`JjczC$2VqqfRM|W( zy5p7`6KHSpQ(*K)u=}3LQCdU@)|vNUSOTHsSdtH9VHcRchl|8H@`rn>3v>dhlPPj9 z(I*kUVRR035VV|kH}HMKU}*UX&gvsiF4FN;yx&D4L!L&$;0zb?bnAiKPBsJ=1c&fa zeDuGNAK#q;paCS!;=ccFms>gLGY;$-bvClj(9k#o$E8m#!oi zxRH@rxaC@6pga??|2EhmAjIO(eFxsss$bXGk(6Az#YRCkxdBHWWaP0**w=DAVqxDvFOlIM|(W zQ7OgM&eE&{Rp_Dfd&4Pb>b5`?i3@hur5l9{{u$M0ZSw`>^CF|DX&)=0QNiaEO`;#p zmCuMSu;N;7n-Wgcg4icH8c1@C_l7n86>RWQ{#$VJ>|R4YbE$d5wE!k)XCkFv=}=%P|-6YEd=4RN)z*BJt@E(&t2*r>%C^=Xp8hXfv4j3(Z>32AiVLuFLxO z`3D|sKC?~dZeShMhc~o=u=|2BE5178K8iVX)aV^azYBzF&*PaXOYfu%O~YDlV6f6( z(%1KRO&9vEEilsk|6tL6Pe`@#>qVPd=w1|G!X9#aaVZ~w7TKnUpCq1W2C(E{*aRLr z*tRE02KBs;0pGk2D;vImOdRl{wi9Hl$SZz5=F*8_UXVGO)rn`EIOUtN=v9FC@X3vy zu>J)GkPHX8K1xzTQL?T_F!ZM1X(^BSLRv zwnko;*V7yCz3~e6Yz?;OnLbA{!B$nk8ub=cwbu+SyPTjK#M%Ln=gO+bh|tY~(df}s ze)!VM9nj}~cJ1t{=k*rkxjU=&PbDZBV%#g(7MmpZVG&SpVfQ%5fptb+sC7!yJnKsu zM|`Va@;E-Y%W_>&)-*;({_Plbau-V6QW=j`{<^1yG}S#@i~Q86z=sMtt7OyN=iwdE z@+Q1bB+9w(#f)wNYVG>HX(jsQEskv~bN*!korZ^~Gd3!(X$%+iT$;p>XNu#=4S5}J zc$Nlw*55n={>8uZB2WyM?e{aBsX11}+;kNmPT1~$EOfP(bbgR>y^Hlvx6ZfVopl1+Z%Hy6a)!@Pm?yuk|} zcSavTS!Amckrpb{b$_G`CWam%$jk$zko~<(Gn-)k_IKT@6lRg~O`+Q+r9`RJ3Q1>q zZ-HLi*A#b!Nm3n&2GLc+>DYHSHWA}Ybu~tp>bkx-y`GdINv^z>)hg7({zLF`saJ^ zCx(;yWgk!X(@eeSa9C8JL#FCqVDX6LZNissKOgoRuvCMweqgfrbhiy^z{=39d<5Jw zV*oqs)l>fC&!FcpP}qqZtYpmn4k_@}M+G5bg8Q|W`&-4dW`(CZ?!-D}(oM^!?boYL zsJ9cQ#sdsw_?C}~sK`Y6u2Sr+?Sii}Dv1``(d3zN6DWv7`_SyINr|UZi|O+%H_tFG z?Z1@YNR3u+=Nv~yqO@0ACa9$nqFpDV@weX|C-^>}w+v@%nUlV1Mo%ctYkMd5u&h43 zuy=UbyZ{2>%C`U*oNqnH6oO`e%dhI{(QAJXYJG3-xjd#BWVCv`2cML*M78=F%pdXW z2oRhXE6R#c3jUd0Zkjvi77%xB>-PkoIr95n4v06bdW1g%&>*z2S`egetlJkbJlIPvr0MeDrA%7f{N@v=GT-r@>8^5K2e zUsWi6!s&sZ%PU!jBSb{Y=8(kqWb!AZ<#1b||F()kVn)#}N5zrjfreRn!FyEq*5Ujo zpQP_+W`02QCo!W{NcV*9guPo2Q@c!td;k&|M2q!Yrm14Wb&uu~n z|McizYEb2sa9!pq(rJojy>68Xt>18XGTR~)VRKu)Nz4cg&kUgTTW#()eI$7 z&jNDm(~fG8kSumoKe6c5u5gN^H?bUL%uolp-kuI_s&A{GqkC{5o%?3vl~^++?yz5S z`g5~a@iJN(b-7Efvpd!s>x&9b{*kOwvf?4F8FRn-J`5Z`i~SY8$rX0G+9g2l$BZ1f zMaVnM&@t1*FltVtRe;m|7L`#xH%c`O;gL_0v!9EQbSX?f+*H(rAjy-%drcuf4v)+v z=idK58w3Fq%V%Ac2|bV@DbtSv64CqZC%jeFD>~Cm*LS3g-Lg!fEA=3Qf>B)0tG+(k z`4%KHIVhv-VkCz8g)Mu8FbM(+nj+CnM8S@mli5GaCRyJ1jyf&Qj0ba16fdV{x-f>H40u5tRD=a)&JTHczi=v_aAOHR3;)~Veh9s{usg;}WlhmBel z1%))}&1vD}wHzuobuuE43z5V=i9Z!plIhN`b@NA)&aywrA-xP{q#;1-|STOiYRnIce;NG@uv2dr! z@4SR>cEr+yC)J}I@Q{BxOka`9Ct{GCRQ(NGZ+|?4ILs1e*ggZm@&eCr)Hpkunu~XJ z__yW4(% zv6ZubnhX?TzLJpbAbhB>FF+$@p8@PwPNJceGA*uE z^jlu{a>M;`Ct0CF-ceRr59w!OlMKv!(sHwj%pjJXs*!Svn+JRT^&@OUETS1@_Wj$7 zK3v_uqPkwRQMs8uuQ>Fpl$QdJasQ${&NL?yd^Z;qD=}pa3EjQt$Kt9){VW|?1z{@T zI6RSFHa*HWG{65?E{wtQY~0#kYV0I^YT#uo}BT zXUR;s&a{l$-RZ#fBkFzzR}U-PXv!yTd4MVH$rC%&48>iZ(aO!{9nc_I#c1pXE-PV) zy^3%yPXx&ql^Km_AQ60-8ZWj+uOT=u{3xpJPtOw|XC}=uV^f<;vFK!$UK%ND;-q)b{pd^~4iq)O+)c8#aN8=S&)m^~}^<)H4C% zTwXbC-9||~Cw?e(IdjLwa{1hQx%Ds_YN&VcE@Nl_HInNv?^#I?wHabl4}p5C%PW$r+b+fCjf^y+J+9l_Ybd^EpipB;<$ ztMUqQ5Z_aiCN0Ip^k;w!FCZ9FJW=)!a1X2g#ww8Z<7jg_jVlme(94N(x{7m!1J${D zRPo^pS(v@{qx5L2Zh~CIAl!cAH z6iV}uuI4NtZEN5U+liqe!q2oAc-4A{nb@Q-_^R48SyRH?6L?|>P6NsiPQ)LEa1ZlZ zIMivt9qw1objIK|m7JkZ85|D3FSWul(a|R1*Bg#6`BDw@m8ETbx9e-IjbQv-Tl()qmrO*|5kZTUAwLz zpIFFtmI;C5e+3Xa1bQ#4zU$s+K$2G`_$vJ7G9OGJh`Q!99SJDe86fq+e*c6USkb(5QFbO6KgJQMgzw8t^B+5=Q9zH_uXOPR|z6+ z^AR`SZWKPsO`a}Kk{}H?0o&nZjDak-xZ}kdGi@m19X~In!H???Q`;-o;Dqiy$b}3kw#2$lP@=-46iy|lzUh)@kNmb!_+NEEU9g8m~%Zh zMky^t7aTD%$~CdY{?E$yUe^<#bK9dwZQskF_b;lrTHDUxHX4^!lkMxLvzE7AJH_np zwDazkOdD3k6I6{{b~^To8TNbTTn-fipM^SN{?J($&$r}7^DwpJY_~r@?q?a2Q5*6D z9_|X@{m0~vG?a*1sCqwLW8!psN<3YYWSWJbpDSCtP4uIWxhZa$mHk^EP?7dv^t1Zs z<1--d1~Y@^;jcCHBb>*R$+cQtf6otm#8Szm$R9HnU+YPf;j#iKK zf4F$_yI+{s^;UJo8gTRiC<+4#o>qR?-3V%X?XEwnW<(^*?B#~(I{`q*zaK)Wjg}WeHUe6>WXo2QBns>` zZ}gRWO~Q-ddM!?BWcllKnB-e4sqQZO2IIryB_vohaT~cTu#jJ|$30uLH5Odh8|$${ zQPvq9TpZ@05oP9up|p0nVgG8MnI)p(03qNbK{DiCIm0_<=Wmk5UXawQS(C69A~?Z? z9V&5UfWI}(AB1}GTky8sLp}rThOH^NA5lS{;(W~P$j>&SP)M{h@_{4QCsr=2yeQqR zSSg(}iY9!BTvX^t(|IpR~@5|YfkSj zAujx2LAjw8^E!OJ$leQF3iFLA_Z|k9Gvh&_x;7x)Z=k6mEqEw-r73_kwEyluJf$ zAuI)XnW5k<2Lq8#nwiWV5UHL2Ih>gT+{yRP0}y8yVyK%p3e#1a+6*w0Q4^=5Uu1$$ zNgi9B>&fgtz*|{Q2s~Stm*9imwjn4m9+mKKfS%iYj}ffpzc!a#dhU)F*lHFIsN+Jz zUjk}IS;GN?I&X_7>hvLs=V>tIAhbl3I^8X9Aw@DC2I!`eYj~~q{#?QKlHS>G5uh+@ zCD#0HX<#23)$E?A(o?RqkARvoRPOk*swmadZ^w}*>4)Q4`ej|XL=JoTow>~-D(9o@ zY4$G2Aus7Olig%i&$2;YM*(XWVtwZWGT6iVm6QNR?2$N5g2m?w{#u(`K1dmgTLL<* zO%VYSrcE;Sw$GLezv51}5WzFYn2!m%j<>3sItZ*^_h@A|#J)f@;Jn=}+kXCoTfoV; z^gey$8>O=D^IWzd1#48KFyyicy+4xFG#}?24z3F1yT}&1d4`x(as^dNjV0ATk2vGc z!?AmDkvRPItLAvFnS{YuN!h8t<@6?MhkEe-c`TqSeYF3r`+nWEg6}eLd;7(d@3j3a z|9FdF;FDUq;=(w=sfP@~qV;vh;Vo<;{-3x@6)mHZ^>R(rrzk^YnydTiI|<2q`R=Ld3G2!I5CrX`MnUVt;X(fV zLH3^?!m#Ku82GH16W8R4Q7?HBFC6NhFHynLF@NE6_aBXUM~7z272N9buau_Y>L(#1 z-#;j>MVBC}T6G3*B8V!Qi$CyQVsDT4NvZd;X{yrscnT_A`I-6&%W9JThECf0d=&XN zLT}Nr35wRzsZlxrRrN?)1LYHnOwzZnA&NIM_h=uY`3mE^f7S~lGR#5-$#Z`r%t|(L z3Ek#RbI3Tm_4<%_@nB)dW|riY%?sy!|8KKSc{7wrDyHHGX3AE&N3wU48^}vZ<3KM=EIJN1Sj-ovUE17UY;uVKJ(gB} zLW|yM{}crIZ*kWZ2n}*fRvYg>)R2)sC@BcPEcVq2Z(2!OJ}}GG{hZONaTUw9_!zU$ zdzbUI&_b;TC&dTAoVi7n~Q465zc?WE`Yb zA=l5UBUwRSIY7&b=P7Nnn(j=x=W|)Ziv0iyF{b=Cb^H9OkAe(HZBEDRH|MR}F2Ucu zCNDPJD+FN8orN!?7ep{H=;SsHc$a`8th^z@;lbq}0&MRwcp58`$XYb02kUAerfss9 zI9aCrA+J8zjoNuSV#4vh+=}k@P z%k(%JA|N#J;C6kI-7N-Mb+}OSw$@0Xp7{7rByxMsjrmqhmzkUP#(3seP-eGm+IEwE z(a~{7Ngpgb)r`&V0L034{m1rkUDUM5OQH9-hEGo`#WF@I0ly=GMHT(tjH)nc-y4QG z?cM5HR=uVpSr*+!%IcZQe%AwU9Vk)G8gkkG2iE5kN<;QJBZLk}H-7BzvlOuSa`G4U z=eMP!(GMgi_lqtq=3A+SSyA3jm5gkJaaL110)tszTkxy?gjsCt))e78+EhuokN||p zSYhNQ<{Ii`><6u=@m(;EVfiO#b>3s|z_|Z6O`2DS~kUQYiaD@UBbQ zeu?WmV&zSebdImHweB5H$CsYm zc%7_zzCG~h$ko^Mzv3+O#+gTztxwv4xUzkP%Hjs>H(DmvJex*f^fu>{#b2wB@o!~f zFGijfSF8$#JpXpNLSRhBDm@HRpbi8|L^$8A)z!>%Jm`Nv5!P?J<%)<}vG;UY|9Nx@ zb+;fp!SbSHq*?qi5@d|6Wj2wY+xE@fD>(Ov%7Bhti}_fw|9qs#c|7)`(@(? z^14vtc+M32n_#!=%y`S$-qClR@g_-R2(gWMzs?7ztpAU%uMDcHZU0q35RjJcF6pj~ zfOL0*G)Q-CN~F7y?(XhxrMtVOYtv`>KL2>m%$f6P&+q~E%wk>lb^r49nA;F5;GaSG z&paF@CBcLMTD@#?ABY9L!b@(xd_(jdGf^S-=(~(BaUw+@NQp>##Ns~s)EV*;@o|bz z_cPO;%TA?0xOHW+Cq2a4&0@@Su9Lx$q1mCnD&-y;1*8nH(`gsQ2 zdyBeMgQ>Yk;t7>tnW^Zm69$RLP+&izNVuKK5qN*xqopfTWFz9L=ma2e77`U%GLYXIN?djq-}P`$8pwG-99ykj3u|NGgaL_AEw@Jx}i9 zdi=9Got=CT;Q0i7J5C*-h_;VFG{97~@trP3p6H8__JT`2ix*=9edNrTahyp4sp8L~ zTBPNs4EKS*;OzQMP3!mS5I;TE6uVa~B&FRM!QCRCmQHn(P;0t6TySBS# z38cwO2oE4iK1sYM1TW@u+!39$t!;Y0vBbnL=`)blTu~q6R=ySanWM+XPnR`ki6PG~ zxyyW-S<+$444)8mQ8I7$8UzDkf1=5u3%O6!9*GmLmgUB<-ak%X#qJ?OUs{Y#3nTXY zh#y-P(-dXhT`g+wA*eM&`I@eyykL5^rrUTZTH~{%;8k1Zyth_QIA712DZ}}I*0rwQ z?r}2}U>~JkX8!b@A}1$>3D0}Q_i@JX_;<5P-K?T_vPzN;AVPQc$n|`?Qd+ZVYrv@^ z0?hFdA;tQu(9#OUNvm2@K?P~&GFxDM+Gd1u$rL;#;=5V_cC8O@MY{fe_(hTd6gT!HcULIw0%TV+Rdq`brCnXQbGM7V=N4NO5P;9sy3TJ#F0cRWphuVVe zf`w5@S7t4gf0u)XnK4HMG{ww@oje5g6@HS+SFxHIINtxph-5XPn61HDBMSP2J9sF3 zo_hJILn-K)jFszXcjgDYB!~sXi)YR#7aqggJ z5~VzWcK%P@`j5X!n?LQ6Pt#P9q3%HIjeL7UH14D^KP2~&H!+vv7aVg=8kq9tZ6LE~ z7(eCgM{<4?HmN(P)0{kyd=*f{77e@P^FG%m{Cj9Jlo6EVfyDDQ7Tzg5ByM}$WGQWi zGs^hKqH2oWn_^eS>G8RdbLF4Oew4BfzyFyqU5!es-;v-ox21cb=eHwyv>MYygh%O0 zEA~7j$)MuyeMO=&1nMv0V?he#xwmq)m=zdg8ooQE86Z9jKpjGnvar&6hJC?Lp)f1qIDgqvC0X4C5Wt=cd zfcT)uOl?-Hdv%+ZLca&U-))^%PLsUbzTpR5WXMQ581>*jI9AEG?is6)S%lH*OK=U@OL8E_04Egfv`HWY$Vjm3Nr+qp*%F z;oG(m^*1HvGstcbJ#;-EDpW)vl(=y$pNnAV(Ax|8jt{8L>l|k!5qs&luA(*vdA3}7 z#Ccb`?)+y`m>RLSSBQRvZszK`V_8ad0NIC`RCv@|$^U`@f#AiSQ8_UU6&^!W%3 z7?7h?#En6!!}d2mPd{!hG&Qv7nAADE8b~!{({=nyon&qP4hbTtLs#veciX*Q-kK{^ zZ2vPS{w^TEcCc~f^C9js%1DJ;_?H`s&;)X>1oAMKnt7;_>;`H%!iXR%Peq%|+?QZe zn&coD)Sh`p{9+J2u~6(5_&^0xBHQ5U~@d3oe`qYJH5HVG_E`_ZJ>qW^aYhrYg`O#aIRmGi46*tX#?h24;Qv9=abFO!{eA>TfR z48ee|kR-0uP4U`Mr4-fYgH$I32wI~lE&ahHg?lok9$}8J+^Xen-vn;jA?-NV<_y_= z&;9(T$UYSM?rt^uqx+&BW6E#v0_za>f~L02Gpkm~uNOwXljvH1hQq18V8Bt>ZID`9mmgw}C|!@gGQXu4ha?GSRrG%D=WQJS z4{Pz%uixQwf6fTU+l$&P2RL*4pP>2f;j;?GQp=*ZeC~r8$h=PkXPT?5{#!x+ro?%}!jU3rq8K*;lY4&EJAcI$WD#fG3s`Yd~(=(AS|06t( z%toqW!={z%amg`JV|ifb0#-9b_XAHQ!+~wf;`&PSep4tr8Y0I*UB$0)|l7 zkZa6Z<&*Ig`KgFJk8||0^?bVH^s;k1{{7)l+G_m${r*FUYq5yd)H-w z&?yAb6djoY@_qDumqc%p**HObo+(+rRi~S?cP~FXu_Ze7?R90(@JqnLHLNA)oQ_dS zCcQfVw!&;f%G|NCAEhnc-^TH;_dd(u~cniL-zR6!H5*5)=%9q1&RKV2hOU$fL*Vm zlEH?etNJE=qteRxLLw(-8R;8dEbd*Mvi%bYZt&`eY-Z7cWV2L0O42+y&OsF`j{kH= z5?4P4K$WXGw+vQr$}uwWWCz-NdG+^WDlNreo!b&wy=|E{dOrWyE5N+ha&&)Yt`Pnr z338L?(Nrq?S+CW`?;X!o(5JqS#-vFyXfz39N*qjQ63OOE7U4H>1w|<>a49^=kYYK6 zy-G%0glY{U(DftB-eHsChktXgLV{15@5W!ft-?|l;@jTun7Bpmb?YUzrbPC)sT zNUkr7Mp*$v%lk6Y)yEt8(S5{`y<2{FXH%N{^&2fLi=LdkP3B!^pTZ8l+Mj z78otj4WPI_T-jq>(C3e9ga3%E47=q37M=5~WjVjX)94S)fEEwVUjtQyczT^la8E$M zWvmr6cRJ|zmw+S}%JT>aWV`A51Do;kp_oBBa_p!3E;g@&A=-A&JD1uqUi!rX^9zGt z9>=!Psg3=K+Pe@kf1}!^Oto=U+CG1$2KL3M8W!2Y^P-N@PfQr9+5sbH|j`9 zU%o@3L(cJ*@ft$;luM>YnMK^uxxnJ@u+%Ifd_)>aqsMem_*(cIzUq1hVAdJpR_Fsb zcH6Q`>cc!w8OP(F+D5R~$z-jWGCWw~i}1U&zwmb_pSq3(=4rbyR*XB6Z@)u{9PWrM+V zLjsd@z(3_)CbMBV*eaCqkmzhT?d~()13#HkRcILcx7YK zyxPMJ<9Kr`?1Je6M-ahZy=o+w%UStXy74eSzH;YV2HNkMkP*Rm%ZNz5;?mp)s)s@e_;h43NsqpO}R(;&A*rI-a@yJmFIW#~E3IxAjXe9?> z_@dhBFhXZ_hm3WxqJ+TFj3e4oY|~a|e^1(?a!iQD9=NJkneQdhLNX!oPHy6mwmdKE ziUK~}zgPF@TFk<3*NYuQCy>VC6T=z}}~}pGA?q`632sV6kUhxsQI> z;BNsBnBN1Sy!($``T4Kci%2J+pa7{!QJRuNr3C-s)_Z8ObRl#mZ|u9G|^t+TQwQX&@YQQHmP8Ct96ZXZiF2PSZvQV z6_+Xc0LsE~%JckLDpL!V?5atv6CCjy%mzh=7f$VG`@Z0Ted3dbFqhqCjq7T{%w@PB z5Ne!UqOOg*B-KS`_Li1thk7N?N_P-J$rjK+JW1&Khh<6Mvb-KZFCc$D#2sTb5O@Jy zf0XWLjq-3_;K-%)Rb{Mj4|#Yk!{8J`JHJ znlFb{tUm#4Zre-sxW($!^`x8Kj_Ph(W; z`Ihv}<2%(jJW4SGP($#yy+;<^<7L}g>my}%O`jo-`KFHNhhtQt268{!1XZ<&edH1y zlHtllmy>AA6*2r*)y{QnZ7ciqhMrLRf$?E!rVfo1o%u4a1JdsOxC$;qXR8smg3Oj^Lo z@28IfKn1VIJc(E#{}E=#@qbGklfZ z!@0ICw~^w)A`vUkRZvP1L93KusTm4#Af%gZ3Fb2vsR!t zqwP}23Ne*DcEe5_8avKNeMtH>5VnlVhj>3nz3|NRo{Pc-W!#z1-`P-EnWt*HoN8bw z;vp>Gt$2u;N1ftF$U5$KhbZIemA-UY zxAowpm2ZwLlGkI}#v~S09%KVGDf{W8jf?TC&0viQUgF-gYXM)i4ptp+YQfm#QWS56 z)$l!g*qhj-HJ?`j$+c8n;tZq(qw!>J<#E{9HfA{MJgZSe>xi~3ASQkRx4A8m-B zAUj)D)>gMi*5`2R+6#vE^Q%DU zOcPP(&0MOpE^xy7@U*p*tO7MBHiPLdb6-5bom(DlArzO@2FL4acw_Z{8;EZXCPg~2 zv32aSS2%qmI^?xA>1UsT*4x$g*OtM*)TBz=rWk%Jkgh3(VO$jSh|Ec)8N)PH$7`4J zCkk{XvZtTr4Yh7n>l$S`eO5^G$GC8HUZAP=VxYr=>_K9!?I@Ifg28%uNNu7G*_vv0 zKa&5cN~xWN^3R`k_@@D^$X~xWE6p2MT}oT`Ph0EtZ*DWd<5w#w-VcYlOUWH;qT&N~ zW(bnE#tF<6Qzv!3xB2svxD?&ZrAtMMxifGSSfk{_3rwBy;QK~w5bg-TI)a# zy2|yS8-O0-c%tGEpIr?SU5{e?11A21DYg*#!E-Dk9uEo5nbRvgkt3tiT&gHNsOZVD zU=7Z)E4^v|PC!C@i@!|%urm|Ns6$<7R$gP~qR;mHGSpt>Qo&y@>l_2D zOUKJgq;vJfIxCEYUB10s3p7++)$nU`r&_ zu#%ZgnHLE^n9V-QhZDZJ%Iv5Zlpd=TDXP+rKg&1QmO4Sv?nC~QkCp%|OSai-hViydJ>&neFG zR=I()@sRa%@!NNonhB&j@c$P;#-ckteD&RyznI!BTnL|9O!Bv?31DmwqD4M zno&NRz-dS`>h+&#HCd*lD*s4ZvPd$F2Ed)AV&@V&MkeeOYS{=Xs(i0KVJjT-dS{Hy ze=g|~8h&jO)ANwtm#)oexRErj-trx|q@Fk!Tk&EqV`7|;{6xS6FGPP#qmoz1m=eX- z{>{)Pq1L`LLSN%(03;lRmF#D_>isDsq;Nj3Em^NT{EB^Z@i~5HXd&jGMEe_EtFpS=Cg+P$VAcD00Wn~_;jNNOX zdZu-wEzT@i*e7)7s!`r$;KiSeVv)s;&Qk|a{L%NY|1t z6~R3dJfBPYwm@i=rgVn6=#+FK#NY#id>^ijwc7yfjHq85ct7U;5pLut&*754|MY1d zNhMOW_ihKb5T(TPM7A+o-}bpo$^&2{4bPjzyW360myzam@e8re-u(>^bRA0KpeYeNU> zW2MPi`wK)BJzPx75jceH4UCil=;oC7DzoQQNDlcKDg!{Y4RMs{rQ*bGlOqwMceqQoinDh&4~3Wjlv!i}78Ljs*38hapb z(+`}t=0ZiSA2bK^zSS<~qu01U%wU4rMSPM{O0*CmH8G9x&z0>jxZLaG+u}T?56ze= zhL_}iu~8~mK>>Im4Yh5YLZTUZw~_2pru2_{u$s)!Th?=h-NH8a56aKsRz&yVIY~L9 z9pUKMQ5oi6(t^#ZfNkV>!Z+?AE3AhxjSMN-R~#|V6Y8vuOtj~?)nPaFs@3DVB z8yk>g`#i3zUbUWYfiQ-lNps))V1LD4Y*X;N2 zEUPZ~YY(Uk)wL(25KIRW@gF8qj0Ook*;}pi%go>9a_RW!iY!a`8W`16UIN-4xK^9e z@<#is(IiT8yEiCSK=2P$#AEAZ+lf+&o5z7cP*Mh>M8%)ZMgw5P;kGUABvArqOiKhf4^eLH&heYm)eUg$VvqZ20AlOS6#gfX|Agy zh?l=3GW6NxEwFmdcRZ5`^76T^#iVa*TQw)70==o0iR;GGqlTC?Pu6N`hk2$`=2+mX zoB0;9NX!b${=lOz(v0;gifP;8^Earfhku(GgK5*6u4BU-JL-A}z!Ps7Y{QmApVge1 znjtyd?^GQY0zr0ytqhZ%rycZEQ=}|@!%4a^Z!&lT$9*0MYjP-j3-+;M@fFbCBY_Cr zud9(m-t-6dIok+E^xa&yxW9Vc^&18K2opgTXyeu`#U=7sKvR6#@_E6y$g=CBUYt7s z@=K`u8KzzI?&g3<2)8oeDa0&Dwd;BACL|FyS`Iu*Jm^NccO|c@LOw)}zsDxr^%vGO$Yv&8sB{cDb*VX3vwa0IlM6r-Df!7`-Z7TM^_Yh*J z?J2L9{Y)P$l&;DfaYmNU$N#GX^Cg{tg=y(85oT9Ywx)T%L#$p002|fFH&GL;C06YE z?8oAw#FFS$v|kd)<=r#3h+mvWvkKc}BBm`0LZ^H@#5zbZ{i`H#_@(Kc&AV%1FD%gE z=iX1Nq<{JfMX;0L(O0WF1Sb`ANP3S)H!vX#&QlzX3SFp-FOC^khTVv&lo=!V1RK4L zo5@&sfwhH(0)CQJf<=8g>w0_5X4Lh8BDngs=wU_(59)T0k_rkn5q>XqfXN0M@$O^M zK@)HIiBmHc%np6=MxiOXBfE4-V1PxRXFI=l%eb}oyNbN{ef+mYoAl@8fOH`va{-pK z!SFM0*To)9!&L!QK`%cfQrRajc#G*n^xHZq_YMmyI~l#BtU~s6{+r38);2WxoXQu@SMG6hO=_K4JGgOrhkU*%_Q0}(i zL6>L}0s>N&46$^VjIf9~ywzNW)%&Ol#L8b|0#Ti{F(k21Xg^mzMLQ%XQUGUg1=~36+%RGC7ZWkTiK{AHNWwx2j`r>5 z)1qaj*G-1s@k!^|+G$T1(<}pfVX`5DYcsfU-L3aVYtebhq5!ysw(6Co1&u!f%?aJb zQa41#uU@P0)EQ;B7n*!me;f(v$h;_*AueZ=B5{?Pvhb=4c9qIjuZiRI9s7y`?9KK73W;|N`42xOJWR9 z8k_Nc{_(F5rIjnDscP!|5phzyT}5;;p(JuUjmG4sKw#A)Ax5g~$%QfdX{eiarN`ky!D&YKy242JT$;dacL(`#gHw_Ghj*t(e-FSC(kc{Qe4G$e;;7*rYogO@SDN##sRL)85 z*~{f!raT@0eIADP%j2WPJ>R>#-xjUl^L$$TM+o1E@AKVs=PD}p3suWOtn^Lo_fFU7 z_mP&&rOSp}z!8GEuRREeN4%fkhtuEPyGqXL>QqitEf29@at#!ni8mitw$C-dz20ON zU}gU=faLVX&jv&;Q$xy*mYujoY;1{v|Lv0B!JYV8q^uYaVe~JV`xP;bC}$L&OKNA? zYXO)VE{^|xRX$jFm&qf+{~OpT-Y|WXJz_w`tN1bTYN8V9S(pHqIQ*~buKYP0pPf+G#b-n-JzdxsU1)iz$3Rsc*9E zg2z$!hbsA-p(N!_ZndsYbpRd2W* zK9nDp^h(lAF9B>uV{m1mVSrXfE_M@KhbtJMym|+rJ%j%0%OkZ?Bo0zSdDmWEr9bB4?TfI+*L$)s98x9MRg^*F9@#P4HKW}oXEM)K(sp5J+bWj zFYW9Ul?bJPtn_`uesm+1a0=xO&)?O9gD`v)2$SA9N|Ku8 z;!hLJXKSmXWYMz_$-&0}|Eeg@ee`%w9Q`@XrZMedS&BG>(2X?2-pbsclJ=s@A33rj zOKCMJHhON-B_C{?2M;FC&%sBZX=&NSA-%9GOn05kw-fZU4h2ADq+NTtn^kA*;w48v zJ@RM;f2qWNSUwUMnN3h1fB``wJ-I0`b8i03vZX+-r{#@0 zXOSzao7C99{mtTD#(-4qfjrL+k$L`{C(lGUng(F1>Dpa0bmgRK{>>JTUg?1?6p z5n(l9jBOL7EJTCOT9SIYKp@$5!obwQQs$9MUKAY|z!$;?QQ?K~U!CLdl+W7lD)=^k z{CTMnBSp(vT1c_1EFVro-M;cwuiji@HQ%5Wtv>$UZpl|+$$|XyYaNL%49bdh&Su6n z-~^cS&gG&AI&ZbSnSCX|fG`8y<>-6spWqLh3V-M~4eEH{z6u09CaAsIv;eX7+v}-S z5l0nIlb8_0-gQV3q+|UB?f^CR_J!gCc#;w%gI@6*e~~F4R2=ows|zDP;8fQ^zblyZ z@AWypKlBmQgj$CInj-nooL~#ejaUcLHT54Dn(_LoVZj4B6hGV?RE) zE>sw?wvBh~UYP5ePvV)q+Ap$g$TitRosF+s^afqJ?)PJpGtu6W5AKaXCyf){W$>hD z_8A_VNBm=#wEF_GALU1B*k+~6-I>&&4q|HJ;^117w!#r*J>lk00GO4FBpn*dxJuDq zrjp4mgurtjscb8bF8Nm|A|S# zy2^k;_tG*6d)l3i5?|~T@~27!#f6%{r%VL1t|aheyCP113h+&0ImZ!3r#0Lp`ncM* zU5Kp^6`5n8Y!s;{w!uA13fJ?hz)CefeOmg~N9?_jt<`*T(zwp3+AkQnW#HDi>T*)E zBk(CrExn0qajkKt_>0>%(xO^x5m_>)irwe$16N9K5$r$WH+*Km!$mZ$mzU zM~{KL#XWbI(#MAW@~tN=wQ6a!S17D1rb6{(X-xgMkL$0XP(ZsoJK$JWyKiW(`&5#K zG;D1I*v0qGQf-f_W?9kANAN(6`{|yMhB^(h6i@30K$zLIynw0)^5#{D(E_IZ%csl} zvC&MCR&FbC4Hslmzr7{W`6eJfz>_|1<6#yMfT+&5m}R&xWtS+lbMjUO6{WQ3W|psN znq}yX=O+$C3Op1wy|a+U;LCdI%&ZwVUUdGjyu8I1d{QILWXdJ(^U{2A9|GTn2sCr3 zmG(R6i5~#2iBESJ`hCT%w7;2b!l+8MC5%}9Pv<(w zM#aG^i?xc-VRTk&GPb57=P&8DLcOB)AQ0Kf7YI7{U3MQNlzJ|^v^W#EoA5;W&BWOk z*h%fOWWZN`sY`J7=Rd3tSx(KgrA0^h;oH_f zbs}vI)8{>5oN{>ujIP7>eFrwqa8}T0m!Ry=;SU@Me26?l*(U@qYv>!ieX?li`0u>?&%S_n;&k1n!H|a<70j4G0h}}!pQrFeEfcgU}%MHqcj^`>8 zU606Tiq5)RgU5ml0ncysEd1B*;^-(xs^aE@DY?I3nMLwD4hvHCN}&Wump?}!?PF|< z*ORFT_F<*FZ9Gm%GpSJ}*o^^F$I@9+`}L076rb#--a7Jq!ys&YXp9(Ce>(03rK>o! z%!7s??(tM>38`+i@vE^%xMxa%h6m|JF{?Q_^~3yqZaQ$z6pr_eAR~v$h6ovBMdjJZ zb6;)j`O1MKFK*Iw_%e%V;r?$cTZI9;&E=y5Pol?%Fuk9m0mRN8x=$s6tuV@R? zdY;dpQBE-z9olE5{1!~zZ5C7TwI_UTcGW!yZRPz7C^X?CGrwvUaDjcKjjIV*Af=*Ifl;fwLN~CIB9$G z?}(9oqhB9C>3Vb5#hp?6>lqRi`xHs+<8;dw{0M7Bx+-#79-|T9308Y+J+Oc6NeF*m zzV;slSa@au+b#J7@Q;7xIX=Ja^*jo^>+1TWlsVy%2i3CYD~{vjuZ+y~HsTS)NvhA> zW=;?zO8`9SY6|$w*MY+4nHl8?^{4Ia15iH2^@Q)bBD?^|zEZ^BWDfo<(sXS|cAi_T z!vmc*>nHj^w;zx3tpW`A;slP18Ne%d9##lI8p)q@ZzBGDy_#FL1v1M)bgl9$3lo8~ z|AA;GK0pCd`H&K?XVpPhDhtzeG2ZF%jWF(Tl<_s{gGFg{$bj)Q43eoBM}Z8EO46=a z6gUw}DHXQoyw9WbUL6GW1P{iZHxw;Wu zvC<6X+Uthtd_ehdI_LRJh2GSksDSq?m*dMf#J(}cHP0?y1HveylpVo0g5+tCjKS^g#0TH^U^Z0=u!=D$_>)hK=d zr_hhYfAZm3(K^9ZUDsW7byeT{t`&F1!Yr*=(6pk)j~M!-_AVp$8BR#`CHb$Ye?S-J zlb`K1aVz|;KGJiEpK%-Z1~E2=8N~qrSxM3>wmXDYk0g~<7|AMeBaUB-W|GA32{2A% z`8PT7Z$9TShc(29ewy$Aio*_u>1Tfph8l#!AqaNQ=jY^Z9~od_|LCEe)Ej|wuZnor z-lEl$<1OY_;9Y7RZe&9lfE#Ycj-4rYx2>60RW>bUK7q77@uNcNgo1yUHh^iZq;QQz zS7sL;CAIrPYNV-H9F%J(`>D4=>2mgCi$bAy9=GP&(5|$oe`nH3;>tXr;HUs`aWxY(p(9APh4d+UW(E6L#&uri}{>@pZf#a#1 z_}ndpQ^8BZyiokT!22CGI-6e_4D#*_0TlySH17FtxloZl<Tc=- ziV)Br=Wu;cKRZi3dEf)O^S}r}KkdB0&u`zh5@Ef;4O`G_-?K}7Jvp1q4P)w{xh-dV zAz{8@pEj>L>v)WOqV?+xEyMjEW9xtUTmOE9GriwfXCCK1P6JdTorvO*1cz&$XS%DD z0o+zCi+eUfgsxPnxe{;q@1771FNv(c7ybLEe@)~I%|S>BH{(2a;F`a#vA-UV0aBQj z!-gii1;IOXJYK&`KOD@VT)db}u@WoOfm$1=r&bDUkwBlKA173_9bo2k)0AutSlNBd zE!qL~9b96s$mw>;P>dr1!{Eccm?I%&`_K#2rn`Ct!hXsX( zf$hTWXB7t2@q9nU@Zcd!oRbb{ui`qGh33)&Fsa{wlZf9_C((4q{-+FVjPlso>oHH(J0#GT$&9 z%tKjm?F-I(D+u`^=2$+Z1c?S)4yOBvW$_(lT%5XA7ZckjILz$+0ED)x zIlw9N^_qkkP%VW4$_pBxp~W^lL)1E<8o{qWNrUyl@z*FY>Sh>NV^>5bvzYRHW8-Y7bUnipA z>yzWEsPT;Jx~Q?sYI)`3FFZ@S&RgDNV1?wNkF1_I?e=L(Tf8Pox#dg2NXI$ zQ|Q7QDH2%~s}4DT<4|>Olbq&}RZx|?9!i=DZNia{`9?rW6)^@E-H+|gy|GQFv@kSy zViZ;ZBW~$7g2-O=HWQXcG*?L8{ZL(j3Cl-SK*1n~AZ-2|L=-TL6699PZ7{a{p=Dz? zAhD3BR3;$B zTUw=bsgNzxxaZUP>8^Vy?vV&)LUIkR2KTNB)xE@~1RcQSjp#V%ga=x96NIy$*(s~2 zVm#*^uU=yvCttH2Wy3^3(Zx`M2*$5i*|xCQNxpLdN}v?sdHIX@Hl-~}k%`H2YMSQWsmtG5H0fKSbZ_CV_9ON`%Zd{Q}O9XD?0KzrXVx5IQ-!Ex&R)sY2GQGfMZxl9pgMvgY|K;24UB_qIutR{@LjDum2FI z>9K-*u48l{q)3QQJ6zsLH4_}1i(^~LPk+r4odOa0ns90NrkxL6I}$sywoByAhdfO!!3ooI z<&~zijimh$OEFPZ+}YC3wu5>s68mts{qvH6s9!3I89oH#kifU*O`r$VCaEWWwF5*c zrI7LMqzha?{>7293HK|dEm2UoCSL1P;akD8sDoX|Qm+U&rBDN(Xr^#Yys{YMI|#t6 zVMW&D27-wC-=(PTUD3~6YVHbb%?HCucF}oY^pe}J z3m{uJ&TCBHho8M)xUu`g3tf=rfUpW{78^osuP?Q==JWDw>k33vGy`TUAETt)y-{h`+KfPZxG73wJSbc9-Gqvv`xoayK3F# zNNEcYG|W#JDTw|BeWSFpEf$~L5zzSzNO`w=j>}go{xg33>|y+DETC{>rIm<=(Lq9E z)PW@K46@0;&eE1>Cz zXaYU=Z^snye8y4T?p9rah|*JL;LO;>`+uGFzuOQ?7p;bR}cYeQAOD z3dC)IMi#rHpnM*e*IU+~_PA`eB&mvvx8T|}&8}J#vR(l>0L{v-~dLS( z))vpEch(k#=ry8U5G+jqB>PBpSm0G%JP=_oD5qYYK4u7~jNo4ys+i4Wx1eJM?Xn_h z#Ik z^ECtBH5NR(H-6jatDU>dVj}l^bbr_hv{0VE$N&GlZvShW{eS&%KpQ3y<#p(- z`m3?^+(>U1{RkV%8`lC?B`)}_{E@gKpE{+j`h@r;3d#?EP)g zH$u9!R=!NRcG}ML7F}|6ZF&W|I|ii#DJUdyag}-9Vg%Hg3gL%ak}Dgcr-hX4KLdFT zv~*LF)de_CM)%zp60rsaj;-N%#GFSXm53GUu%Ko%oJ}Id5vYy(@iH7f7_|X=TegaS zLkd#ekaA`GL-8W`($6q*jQ(8j^rE+Qo_61WlrXBTFLtyG%C9mn2U^-b4J>T(n+c2N zo)xda4+c&<2UPIna3gzonS|uAoaZ9**&xfw_*$I-rP4Zgjzu0gCIq|Ai}W!$M(P|KUh7rVsB9oK?&T zK^n#=3ZC)pxF0A@+vHq-Iy+UA-0;UuX(cQEJ$T~8GZrG6ae1rc@sVabr*OwH-fu`P zfeem-=O#SAiP74YU(_-H5}LuxIFeus^2M5MmWsp@uwhy!c}b%l_RC9qTcXS=*TH6r zOOiy+6mLpPwk{{NO!>=^COci{r(1D<#UPV?TQOs9F6;g6}=IgO#ZiBv|Kt2uPn_p%zKK&02nqudbuPJhO2~o8(>lAY;i=CVmj|-S4r`cElBQEFO|c`*c>kO)mj;R{X@=ln7XwQsF7cK@ zR(R=g-s3hE*IHqEDjsb6qPsFq<$w^bIp{TiVyC7>GCE1206PY) zz2l$8eFRVPma`|yG$kJtY=?u381OFCU}Gay&}YQ$C_xErZ)XQO{~jKpElK2Hyix*x zBk6JD9A@&(h&)aT)BoY@tD~BJ_ z*H`~jy!^LOuk*>vMPKR~RKE!SGqfjQH5}6gi9cHkCfNOLZ~~Fh@J(NL26z1^KYu$WD%Nq@<9dOc^vW7 z?M>O%6Gjb(4BrOdJZY<_F$3@n(Q2NScNh)dAE(d%%>IiOmI^T>{`ld^mggAYArYUQ z+Un|UN<261M-0*%lnZT6b}5KlTl%5M_+4eQlViD_i$`hY#Yx@Lo!HwZBeE${ny=5^ zl3IGdKZ^DsKBkb~T}V66dmu7*OM|pt6Pg&F4XiQ_@4PP~Qf?~)1_EbU<^f~d5S{%Z zAtJ6rEnXmYJv?{<(1hNOPCs+qI=fQxW%){5L5{JzVBPKfgf!B(f0@SF4T;{gx&*Yn(zTw=^#@iz+^i z2W+W3f5%E6FPFnXHCOSt(G8X2zXr0@%CA`C>Q4KF=c|C`a=?>-KmF*?gD6g~T^Vko zh{6ARa1o+?Lt$cYwm>05Q@ZVG*{z^ko;k07e;kcIs0%S4WlJl@hWuEzV= zrO=s$b?BH|WZcZ_J}7J|a8&J8)mwX)*W3xQ3s4vDK4{*sNZYv1;K_3uUAOf*lt<%M z&6{Vf1EB&1%xVaRXZOp3N?8!W_RJ2vk^#IF(ZgonyC9uLqIwFG9+J7 z_r>+hDB6HwJ_oIgBJubT_Z3v;?{JdnuN;sF00=4p^5K`yX^sB;eX&tf4NOF_QTM0u zyZQ?@%12q-uHEW$EUSEFbf5Nnf{SBMBNdb+GdA25#98%a0ySSNJ`-pUuhJO)PSasP z?X{1S^-(k3&+6ZD{ZKqvg`WI}m-#9w!_HcYi(brf!pJ3VcUki6+q+PP>*|VvF=Bt& z-xK?bfB~gVnb$N1L01ikFwI#5UTqX&4-IiTWr5EU-$&t>uK%BEh5Cl0Puz2Q-;wKT zorWBr?!R?nDZ7<78upUDo65MZ|CSmuHW3gx4%>Z{JA#DiSB^x=e`1^e@!63|a*?cv zGmHcAkbe9t=`=d^m95I0oU~5)!MS-~yDTIABn_jYau+5%>quRBww9FJ^u|ZY;q+o# z?_0QQNKCg%fAoRj|yPx ziyScHg6>}hn2z<~Z{V&&pp5?}<^C%HzxHnIuiaUTJzHkXSc#5Oa{MdSwGx~Hz@?_~ zCzVKzg8-^0fUn<4*DclStAG8WSEj4TxNBO0iB%r}Pq+Fqi+I6aT;+H0uYYR9;AQjv z;~PFH8R_r8Zz#UY$&`Fk6u*#$5|m|m78wx!j%niGS^!;ND~_MHb?&LLR3N_v38RX$ zgs_}khus=TbMFN;`IpR=`)YoX0pLE~W`$+vR^xj>1;its+&p?PvHsQ_RQ8kM#{g6O_S9m%jJxv_w0*Ob_fehEQ0%nt*yd15r}FEM?^e z3mFFtXp;dq*o$HK$y{=GoW6~yy$ztfnJdEh-BW<02hcUW9S`W5vU)K5e15`taKO98 zL{ylrapkpAoj|wmI^W}8S9xowC)B)Eyol(|lvERv`?KAiCTvovc6^h5z8D(zX@~^7 zSxmBUkl}uRm5&}+*H6jKu;_mfyyM6IWkrIO^414Gmv;4{k8^TvF+JHz^nDm$N8#!& z0sg?n_nL$vk0$MoRyP|;?ReqgW6tbA(T$dmQ=O(GrxtF2o>tMqP;`vhbKQ~i|NahH zmbjK=Rg<6%fIV0!X!IR_)t=7%q`Q-O*6&TmeUI2>-YHuW5$64y-+twR)TD?;Y(5+!Gw({uV> z@xc4*w+>d9Mu|&>i-`Gq!Cl&l2EQvncO~5@E4;R%5?K#B%H$T#Rhoao!hjmtdNNG#7LgqdOO1>O6L4xAb20 z>{0gs$JM8BVe0Hf$MIh;fpl@Hz!uaiI)vrfmMZ8w-c6Mb1x4tU;Nt%_u zNl(j>G5MhStn2;Maz%|i&yVYpxpMv^KZB|c4~yd$RP=r!R3=}vYJ~6{x{Vvs??ku# zV2^fik2tk|FI7QyU6s94aE>XwBSw7j&TO(fvm`C1#cQlJ_($fOn}x5R(7lQ{og#KB z@N(tbT5jRwLCDjBiyz-y(aQb01~@u9RnB;nMzf}NhGM_HdzhVyWzvOPk;pS&vSb3v zoJqg8qJ+aw3%V};#L`f+p=(Zg!vVr3i?X;zYK!vD&yI8|D9JOvm?%V=;8nxBU(&w) zkkyRpZGL$cYgT+)>{Yl&+RIRxXpe!OZj(C*D-zRKm8M|PxK?#HtXdu&ao zAklv*M+mwGhuCMX$g`*Kyt}4*aDx@gKDW|FwUqfGJX73vut%Mdd``Nk@O77cvd5E0 z1+@Qh{P!Qb*@s9fEyFHWUF2o0>>ZU4=ybAyaF6AidzY}(uP8ySi1u=TzC*q|1d#VEdZozSp@qeH+j{i|;6No}j1g{$lXW?O%1m>RIy z#Oy~j>%0wL+rrNtI%&W9ZQ zY3JwZz1UIbv=t6^!w~+j0{b`HWjy<=#nM2Ijmd=?M`z6bkvp0J=<=0h4#49IG)=bk3UMF!tmWv{mH>PFaD!&;dc6|=R6>z`d?0sfV~m@RV#DIKC}Os zshW3Nu|ar^S9a>Kz>9DYgEL1oZGKTj;$N?E`Sp`+P-EZAmfLn#8-t{V|7X}>1iCis zAjyJPhs533kHIa?Un`0gRa256%TvFr-`FvC{wPAu)!5*V$2ETdM0<1A zDyK2M9yMRv^^fYPyLgpK!COg&r3#L?LJqb|>$b0P0a`F!>WhIzc_*cn< zUG&a!#vJ+Gt{%fwh?QVx4{<)?s;prizpbhR zxIM2@h>hTG0WK^a@?Ca>Hbws3GH)mS@md$K@NU`uB3s+e9%RosPWROW9-R&UrpJ&y zuOQ+j28f-^K8;cUEFc}@#g=3jsAw6%xM-<^wa6!vAL|Jb=W`NZ@uH_M+8EYQRXmOjb0!L|ordN9ju2 zhqC+^tyCQ^x{XElQVLJ|zhhpqE9r@aYf>TQ7=8wLi6}{`EUlB3yt$$C+u-iph6p>6 zh2IwG4d=mDZU9iYPtzBP_-(;a#pdb6|0`NWseyKDcB%J!WpOkItG?VSCshZ(1mH`w z@VgHH1xDQk(0%PV$Vb!+7nbh1+XS&^sfa;#OA*tqQHnDF z>U>S|d_zijJ=vkUn)QS27dO2=zZaepO5=(DUUd1q7FP8Bj%4=FjP<+vv@%yO)#5mP z#u3C&X3^)yFtHg5Z`(144H*YCh%zUuku?3ru zri zkjU+_ewfnO$A7A0$9??9T$!4f?5flD2_2Ac^Jjbc2a=VB=)3^{6+q?Cm5%CC5Yw_~n1+(BF97jjxEZq~TKXLl>M z`)z=SRH3hm{TW;*oIbK=5VW3Lx|;PZESVzSJS(9cKq_3RL@9~Y9FNU6dNONZ%DS#< zn_ZoC#b;}ZP-$PQ7y_GK^4hhl%-yqNSF z<65Gn(zt1o^-Mc#w$=0E;Km2%$k%P8$->lfZ(W20lE44pgS0lNlrkW_@Mb#-4 zoMv@3^rI)oBKv?klttqOc%{euJ#jElf-CO($Wje_RjP#i0F%4cc&(I91YO;_(vg(W z8Z6XhM4Jc>y_@|K9_A8Fa#07Pg$j({sGPD34{qq8JHVKddz>uK;eaCXy_*Ef_mv}) z^jCJPd@KB01CHqdyAF%gcW)+TLQB5>`mX=k`CLUHN*fHuP+!)N@6c z^G|2GQ`75`L;){KX}yX`cX^ksT%Q?$a+Bpy>w;z;KtZCXssS|s`y=@n1+#zc>&KYW zv^U0%Z@H0~OI;&+wE9;8OYnn&qj-$@V0ay(<2p1qGtOR~r~G&AQc%-gP!G?MrLRk` zmqtpG_7vj&r(T_t+YWxAwJs2JUTw%C*M5L8S&&;n)bPIP7n>v&EUTjqv{oj znL8f%V@L8b}M^GGBqFYK;3>m zL*oH`wmrb=Y9!BD>((v+YtQ*Ghg<655tK~jc;DNC0G5?tWEBw6^GT>%Kj@?a?9K0F z>%O^6FCr^n(`Y-E=p3dZE`^6Z&y4*hTd9?I{)*%$eSERowz=_?^x=mXg*iaiM-r#N zanpWvu6{jAt($GzV~NHlD8rt^X-5{y)lzjoa5U8gTu)PsN630h3_0sx=3K z2M2G!de0M?5Zk|y09G_>mDc#*kMy#;d6jF`Z%O8T*z?Q+kJcQE7c9g-o(~-Lecafd zMz=1`>w7UYR=4R+0=N%LJnRs){q6^@{1k&y6p|{H-+!>&U89g(Q91o?1rA=R_`sIX zx?6vms`ds%L2jd7grC$|MCK;4rsuV>yv&WG9qpx|7q z+}hk{Xy#vB)lPNQ!hNarzm ze~;sXkS|aD?-$G!w@6HKeEqlF0ZqNURtc}|(n4h>alrav_7(?c_@)h*UGQSThtgbs z-j!+e%d`G{d$m~`=fZ&a^BOc1u-yf1`A(W7jRH@K=$E30qx;-QkK$?Dj8I}_SE~N? zua7=BH||Ut>3xu)he=xQ- zGr2!dml-`?{w~mc#o;5Zn^BK^3M%HFoA5cDum)K5` zt>}|JNRHEoPLeb3!6z%Nnfbr{D?m=1Ng-ZZZ&y_>_feC-Z3)BnKhepUfQgKWusJ`;HTBIp^k ztqv-yhK=LMo#S-eb8#og`P_aW-~lLG!Znxe!b+LP&i7szjNHHVL-KIrC7`AwG0PTN z=l}eoDtsN_Q*@8jQr4(u$W%A^@Wg#lp@C4-aPasF@55Vn3VMZ5Py6 zObxCcbCr5-HG1uxZ-YaYv6j;24UcGo!+$U+)3@kddbpH3EBmPiP6={-%PzoqcZhq=0 z3aCQSwm%%{&Se}iE7$HZDhlTvd?fkxN;PLPK5jqS#n({Dl`4)!xw`#%O?llZE8T$W zMwb05>w|xAANsx4WZv)Q;Hkx-kpq#ZHMhQ&TK>K18qH+V=s2j11)}+a?uPM7@;aClk~) zp;jUKeqQa!y|Xy6rTrFxCbAEP4QEptpQW3g$A)PIgq`=VC4m|4CD(4QY0vZ^>eAiY zT*H3`*}BZx`EUK*-Aa8gF(y{_DAY|AQ z{fzl~ig68MXw~!NDlm&9-2>)^k-nYQ8ZIs5<1WH;zPBL5H;Nn$mJ==g8i|~IT)iYO z0Jg%c(|A*WHne)xm~27#2|)h!FOi(KTBQ)hyaYd~Gvb)nX_G#lg$rwut%qkDd=6z! z91n_q#SQ+gMW*n#APQ#VJF`z5lWe)Q@?>-%N?*I9i_}5m{$c=IN0;S?+Pao*yB{*q z*dHHg^;q_?*FC7~0<;|jTDmeK4h)EkKKc)fedb+QWd($Ki7o=Pxuov_c2m~A8K>)j zb=TeyAw|P;{j81g=XGy;wx+wU16jQ7*>Cb~F<#Gc{#?wTaknv{$hUyQt7)fe&U$?~t!8hmlS?cS87D>u z@!)cbOnvwI`ad`pn7mM=vb-WT3j5@@C#t?0O(>{ZIZUjP&8zq;KHNkLPZ-cq2&uJV zPFCvk5ztG=a_iqxQ})cHMQ><*W+Zn`JFCALWiTPw^bWq^9R4^R>Gi&qb~B!BQ-(-S z!Us&IP15*I0u}iTvWJ!WVuHW2BXi6fE{_k`^fqnovkj%dF3(WAHZHXx&nVvs;+--$ zu_Kt>`O5`9`(;y**kWtV)OT{;PHMQM}|Bc^e);S}e$d6g2owrN1=nKRH* zcsZ$O!Y*~NAU&a_=yGK`VUxiHDLYw=O&IVnIUghitsLx#MY-3^SCB(y8c&b)36&n? zh;#u-MR*wqg3IKA<}SapK|_$%6Fu9_Wa!V($9FEWEQ=Bvnv_;sj_c=f5~wGPZj+cG z7*6}d)Kx!$?eqWu_?R&wJ_m6PpgY8$RQ3xQ4JjchzfcG%Kolc-crGRH^T#gQLq@Zn z7@v9WT7|7VB8xblH;eE(sgdD6Y+2*~t*dS?DkYiWt{CeBostHMr^5X-;aatm9F*D8 zZ2vvW3&SV$XX%!gE@>BZ&HRG{okLlStR2Q2Q|Q4*m0OiB4wMfQ%!QOdUajM89;&{Ka@5fjxkrBp&(l&YWQXpceS)VMY-CAT zpu{g=@XD^wWGbx6y|Qm5~kHySdJi@h&-VG1)jGHhnIx@)nP zh7O1B7*Su+b8DTE$Ok(yh>`~GuiHdqton*iT%1Wy1I~kzTybtqNBS=%_DaGN_M9tg z-EPb+hhJpCHbBDAz4lGY`AdK2YYPYkv`4nJ-@Cwu{F}d2!FWmcq)R8`S0nW1YNSFd7xt)$h zdfqqo;-_e($dn-~i>3HCS?f7@9GNL`BpqrHfJpNdbalS5gNwANuOUpNsgr(!cZE)L?GfFYVa5%i zQYX3%d!m~sN&@Ddh_=i)-7ooNZ+f-sMJm)20vCHBedTtCdbAx^y#Ijad&ed)kfwNn z6IuHAK8yDSEA{Ea&D__&XlZd3+*jSNRWyB}XmX3Lq{PrHjPGG}HzcJd3Kwr0Zb&_E zx_i9_m5t2uh4m{DIfi_?Y8lv6+<^VT6RjoAG{*Bnv2wRv(bPNx4x}WP^W!+AN6oqf zI$@~(Ys(B!9Er>xgt>%_^ix##7VxAi9kTe@wHlM&UODw_B6dl$JdegFd^vyOiRm-m zpKc=e5UIXH{-j7KHFtx@(tSkhZHh^Y{ws$gj3*3z69w`dQ&tRj>ov-no;#_?EIJwx zgSn4nFsy{xJ1t>k8sHDW+CLDl>v#%}wv{ zbyyE}XpWGU2zlGmH3-|YGm$`zJ-Witc^wj^UB()!vAV|My;)W~brX{TlZ)B)vb;pA z?d9Q&Lg+JbO`Ju+;Fw9v;whDUID+G{w&_56wh0`?Grj1dAQqFXLR)0vZ`$)rvt9bZ ztn@$17GD{?&ftTqd!gxP-~05cNLFt;ii_q>(WXwnk*l%At%Z6dbJy=sp>o%aeZdpO z>nT&<hk)y}MPGn_ZmG`QC6={g%uhiyAJchjApb;?S9Nk{HB zQKmw7M-U0t`ouVE%;hPe{cf=T6nNd4Ks$Z=9-c{icbf)!NmJ7YLA#+L*}@Hrh z3eL@IDK0vPEXNi9N!jrFy7QfQ@WOQBN9VU%OhOt0bfxwkF=y6H_>v}yX=^JY-?Qq) zJ;iYybIk)bl&<~0efyUch4|N+30BzCv@Is?q2m_ceWDv59n7<@R6DSdG~1f z5PW=v-bxMyXJaDCfBNUdlQ^d49(=-NQ66w|Q**xLxqic&h(aW<;1-{t3zq^f6F2?AeTOl@K?)BbYGlOsHVHK$>PKfxL^b1OK!pOjc1 znnR>T5j?eqMB|$#L)}LUE+H*-%3ivYS-hDe#}9`+!E0 zt2jt%i3E#)b7X7%c`f}ilhF3rit#aZqg4Q#*AHuLAu9&L?_J}Qbw~I~83)xpyFx>V z>{L<3*ays`>0*CIorZo5O(o@0MsW}yAp|^sw{T~E>|{I5-G?@IfB`v3d2!;y@b-x( zBphl9r_cA4wN7mz@nk1y>R(q~lst8=?6J#lT3)&oBkU3SKcg@kvif>a?)JeS@QJAG zY*P?!5_Re^Fkb>nf+P)hpfBgpia_UFx?Z*4OqNYp^M_5Ww+dh^rJQje#E5|=WNBc^ z{!K{R%e~_~XqaYw%i|^GiMemEqSI3tVSf7el=3%GL5V%PaE`9dqEHT>ll^j+i<$+h zA7A1%SKOvW&cPQmiYPeY42~PLwsA<>WW4Yp2pQI!B_$m(D-$}DdDx4}sju-qXi+t% zwYs1`4Pd_gW07JmVl8A4NjCeNfyYRV-AO zH*&UDP&CGFO3W!D|0wrwA@E9he~|SW3)4S1#BL-nvr!qR!O0%@-)Xxky}#^RNE8%x zBrcmB+qG-l_7Ga+x)k-Kau)Fibuf2IsE4>uBI-xr2Fs*^ymO<5%IR7QTk8^xOXC`v zpY?EVXFZpF7(SdE0XJs^Yd%#&qr{|Vt5l3EgyL;5bb?LcUxE|~X$5e*GARjbmyG#x z+F!f!iHt%;_h8P`a0`6E(prt!+(8)1+6FS6GwH+YZgTE|JQ73EH0%?@-4GC60SWZh zdd>W}*}2n`k;h;dzeTZKujg^T{_>F>E)b3_+5Dg>Zug3CF%9W; zTTc;|SY=mEg<{#2*?B!)y7FgeNncPV{7> zFZv1B!t4#Mcjdsbt!&*BKxgpz;E6xa7Q@F+h}aGe{j)s2{S46g6O<>~fe}4AzMnpT zZEuj@gTcaEX7ta-k>KxD2Pr%Fl*F4Lumvioh4`;AFjvB^sr0*u{KO>iI~v(rNX8 zXNKWQBSC@je9#}LUC)QY{pQuz9_@9xp7VFdNh_X!(3@JJS#qgX!%q)~_0)VDVP)w! zo%W-5ud15E^Iqy*lu_m=Teq9jl=Bi85FJVcT9e|a#k~Z(rkEJ z+R&;<)n|Nfd0NPRF`U)z?PnGT&-%YHGGZIy3Rvpu90K7Sq;H%&w*>1yUI$7JkKwo-Oda8p z4gLy$7_2Xl;?OTjU4`7L)EBKk>jS6GVX`cT@r=m<0%wFSpW@%6a7G-I#$ zC5}E59BVex$+E#`vET!zeYW5OAN9k2iPITAbg=$Kddi$8!QElE(icl~VY-9XmqFHF z4vEe2dY-y?W+RS}gfWh+apdJO%2MxWY7^+Pr!hIQ5*F^*7REIrsrI$n)GW>VEkb+) z0S8}T2Flje3ab5n)H?Y50uvc`nY3vQhCoIJ**4DctFU8)mCuY+7MO4Xb}&JjBq{5k zO(PO72QNc*H>Z^Ah)Xb%58uRCHz%al0JPcoJz?N`!^R!ESmUCJp}>y=sgSS(QiYP<4a$#L zXfkqkY=matPu#OW(@N;x9u`-T%I+iDP=GB;U;C8t;1q|Bl32ymCz@L`kQs}Xg{#~5 z+UyQ2*c>@La@PK2zbLY+b#r>ke&u@iRzbx|hro*P6lOqBS6RB9)tP z%dyV+2ua189rlvZ%VqhI>aB|dOX<&Sr}ITi7q!pYU~#<+`b1K{|50>gDSnf-m;Qxp zrTuysira#6;#*UwxzD*@?WA8|&HN%zCmAJ$?t!zHbT^aQV}&LFB$O6oweDMk<$=Ye zcM^KZ;pAo_Zj>-dnxPBznui^J5<0u$E?DxRYP#zug9Cp;MHG6-{YFD<=|T!}V@u1q z>T3V=4fBw0cIfD2__<&@%W&5lm%f0ABWMZ^H%i*S>{gx=V7}l*!zb4-r9*Rpuag(3KNMz~))VclVMT65i{>vfsEKC1F~enLC|OpE7r{V@fE4?~Jt{&?YVYy(Y<**|5Xg4t=i!r%jUlZ2mSX2&gh}sHgFj)51BV2B0cYqdg z*_1GB%Od@rNZ>&S?1JqTSb+^S2>b%A3`qK<>}D==CwD0omV(^2gAHW3yA?3mb5=*G zn3Ze=uv?FIE&Xi*$M!KRkK3kiXk;fXDvz(<$zVoP|G5`5`Q$Vlx+0rRXH(T6FHN*f zSOZ_KVZP-b9Kn${!M$S59wTbI`~KPI=7<*-{UJqVbZt6l38y{^5ZTeK*_a>hVOrf} zE_4!Q%lvdqhGzlUp4X(6IG5da*5sQVLA%S*IxnaBwT4U8M}9QNXW#4gR?eDqF;8^1 zSoLIBFLsYP;o8WSXH&a zk&h7ve}}#ms1qx72Bq;%+!? zL*eF58#cMXp4*N9(CiCEgL0PT4s)Mqc7FoHg*9br8tejox$Fpxk;iRI&a5xwYNp|^ zIZPuMKeoB&Qj2p;nw~RpAE=#|s6VQ4dE6IFUp*5$x2dFW3Twc6q40YU_~wA*VZ>%A z*dr?CEtWQ^T|qX7km|7N1bqxIG){Ds3_tO{E9O6Dbsny|W-?hO72egUK+dB)HenhS zOKeX&rB5Q^mLUEiT>tTI9{nPW&5UPD^9(2UU^4~nE(~{XAs41kT0-FK01=Q02o@^~ zI@H)*^%jE`B48-R6SSl5f1hNMt`}31j%S08jYtSGxte{yP0G~B!LK&BCgGFSXu!dK9K_}}XN3gz5k@`f`^5KC@o+#|wBX{8 zxF;puF@re>EC&+)Er2>IL6ap>qNI?dWUZ!N zy+v6YNDR5Vcs?Cnkhepb`NeleBsk>VL+cAs%`A`{muBy_TLj8x^|YPA%yg>$!h$}p zd)z8K`vN`IoCOki5(Ga{Sf=T8kXcHe&t^w;3dS9Ql7dyvgH1xQ{M9*y^R{!-5p_U$ z?Ivwk@zcx5dJpvvr!f@NzNz|XiZ6aMMS8z&g0eXNoFwukDs-1+Kl{ti z>0HU1%WXnLG~Ri=JM<=6L-B33Kw@xXE z%L)Qu1j;S=XJY zv?1ja3chY*#repbW`xAkqsWWQr|N}&|C&G;YA&~-g0*-2POjbhpV4LI`lPytN)Y7T zfTOk3#U8i>a>MIB;`yvqd<8p0mvN>0ZlCy6?lWlH`U1zGv0UvI_VKXZ$K^Q49H;ue z!}M_BristWpRDJj2#>USDXMEl$$QR;T45(O>GBtJ>G+_f`G+%F9T7uWNR%HOXPyyz zfluKe;cX}wBHk0)(=;pDTyrhq*J1ew?J@8mlipal>4EnPoLMif)4%Dn+eRI^!Q(9A zYDlMCmJ!#Jc8h3um8MW^!o2XElt1Ji<5S5KD=wokzh(8gr00amOft*lwIo%7V2MS@ zOCn>U`3y$98LqTqei1f&0tiYF9J9q{&E5BX7{&kMX0JByA>8^b@yd1W!V&k+aHVgA zx!g=q`sH*dwkMVPTuHjL1JGHc9+b^_uPu$?7xmOZnkKEx$Z)}yESP%f;`0uRy(?Pn zlK5uQzV;lef=>^X7sGco_Ax?uenGu}|NVf`i~uHWMG1WBw}lh<(&z!uV zTe;~_VDrn1K2fk@WBsOQuPj|s|Ifu0Ic`z-kEA8Vwr2tZR+BEzk-|K-INbDFprE!z z8N~RVhc5oM@t-Uajyhpcaf+hVTcwP=2*59#8Bcz(5kQo6v;4 zvz`v&@Bmcat8{iNMqkop{8?l@Mzan(kSmFO;eWg?JZT!f(t35uH1qYhn`e3f2R&^A zB`4&?-=(>94vErr1swXU&PhY1T|1a+IwYcnBuX|*WPYj-c`*uYGOOp{Pd*zI_RWv) zKM{GvaWd>eL(4g~MAhFzon$A}t+OI8c0bonBQzTbwtr;)>Dpo8rI*8$!93fLO>85R zvOqd=VsRnRJ;Y(!&%N9s>g515_Flu`vV3Y{>S-NKS!SW+vhr%|@L}M|)^C%At$aAh zpp?nt$Wp2vTCi-_ga2xkJFrhmr*N8TJ!D<}Fudok)X#oI^f2CxzZ;(%JrvO@v*D7d zi~BlL$J1luU^vB&E3F<#1m+7}D5r5<)9h`}v6K1MwOGIo$?ZHCi4EQaUHH2wY3d!9 zZPHjD>Fw5@_&G*?;0Bug=EwhL{OX=B|ED+tRMa=Q%>uQ z*{mmp$$U9=nH65fUHl+3{i0_7O6l{%qd`eE>%{vXq5B)oFLv=;5fRM{rE=r%H+6ZY z;wRf{Q|g+*E>lFZ=UtGp%}QeNj+rc2Q9$95%D0K4uA9r3QgnIp|8x%^;xvz&g_Dx) z-l)9u&ZzVn4~V&o9z!!tUoo_3rMywQmB&#%tYBxK3T{XW^<6e6U1Kq{Y%rxg52XGz z2*wCoU@ZBg{QWhe_I$Rsp_4Wqsyg4DwO{JlTB5$qmr)a`_xVfoxUHv(c>;c97p1hH zj_i~`N(m9A=ID%r0 zWeyMJqXGHMNhb9^K@3&I^z-3AoRw78cOO1fh9H;fdPSzeipwAo4qCABJfrB$S&_?8 z2ha$36(Q~10RlT@fRV5v+mKhUZ`*-5J_grpI_QtSDy#Z$cjgyP%(i>g>u$O5%MpF3 zhJ3^JEP8R9pok^Z<46Gghd}83jrsN}uOF9)oO3^NE5{OzdL~F?;QO}u>4snZZzYlq z%3Sh(c+&C+HM5#!7hy(EEghz96UA_=-CA%qf#+T8AOvDKo)aO>2J6pbpx3J0rdMm!?K3k1toLPviaAxQ6t`wD66OljLkOu_i*5 zn`oy8Yf(v?h1S&rD}JxH;$S{Z9KCNXj255cPdrB(rb!YT#OcAp6>?m8;K9I9#d7@~ z|7v5Sr`8ThjFT5Z<_QuYQo4ZAyg%u#xcCH5l}Y^)2^?ogOT7)ov`KfqA{N%6Cq4h# zV_xW`kZt3h>o?OQ+mY{O9l6RCXT&!Ssu4Bv^c}jppXkEA3dzlyxdt<$b~Ly^t^bnm9D&J*-W_G@5Jo1NlOnJ-kHLvw8%Gs85jxf zIn*-ApuhR$#)*t`Zd{vflI*k~|Ig_^Q{zU&<8Ed7vF$e(esb@N-D4mt9W*wEY(ILk zQkfZpD9rwckEPHJEJ?!*o7%}6+c2D6i-rKBiL;230V=NJ)cNMXyV3srpMMk*D`=X9 zl%qqx30b!6Db18xO;~xA7ZV#PR>y`@9^2JnA54FWtTr$E1h;z(wf)@7BDvB);_x-<2l!k3_9FFpx6ln6{~P5x z4GMYdGFP>X-k>ZUmVj+JLu7_|{L3Qu{p;X85CgdXH_*v`GO+&FYDK>rj!L4V5N;sL-;# z6E#t#&wRqlTj*#-`2}Nvc{mXgyL(K z<7W6c+$KXeOSU4>rcJ35JQxptS!&f_XI9ihw`I6ZY>_i9RrT06CQ|~_B01(brk`ar zRxLveh-+!l?kat*>az#!CUkLzwkK$n=#t>$V(?vr0`9K^=YFW7M-0!bD-+Gj9E@!y ze??wQ!UsE`hn}Ckp6Bj@d&1Nl^fqe+8W*G3vvGS_w*v8ug)KPl%_Av>-L*Ehv@h}v z`vn5NGuZTTt8-I}i{wgRn5}8iZtj05%(oRdYtY#myxb#Kw2FI#M6Spxv5jXv5b7M( z5rrnt-DSfplHYq}HE3~Uzy1Ee_FLTE#bwowj!*FXt{xuh8FKWg_)E7dM$jkvkuicdwVCVw0XmZO7g2IChH*?`ZbZDt{aXv*Gp^i2C=Ok3eIqlvVdqz=(U-@{V)-1G zY1hG;X62@M6Tcm{TSisKZEw{}GD)g+>yh#ElZvnw%rFx^(^e>TwGo*OQ_2sT>gJ2} zbADbus0`82e0k1NRT3d+>_eZOLS8cs3G?fCIaMoo#+xcKNn&kgoA<<02;X65`{&dk ziWlz8tF@6BNz-A@1`>{_EYDC8a#cyF$XWlxe)h(#Z%upr;iAYB*`&))R4r&*4X)1R z2cyvK0u_R_g7G3IZvMK^N~7WGA=#Ql$LTmlNAsiyp18;R(?x2J4H2lO#2#{tjCuc< zN_%Q;@SkGs{)U-zJjLx3JbBgM5!0TY^6!b4ZIUX}mZK zY{MFDIS9M=V?LS}y~bt^gDwg}Ji6&CB=O z?XkPYymREyPF1}2-&**A_=4Kgu*YE4k|b_lq+4Duj%ewo#>7Vo4I8cvCEmxvop$H% z$eyqxg@aFm%+@U@d%zOh*j7#7`~Qoyua1i9{r^-!QE8EoAyib9MqmIb0Rg2$I)?5B zX$BDqfgz+@x_ju7mX0BYp*v(~h8SY6pU>}icF&&ObH47L`|q5YGxt9C{k)%7y*>0Y zg_b?q<{<|wui<9WZ`AlK_Xq<7c;xp!g&x(%e(=6JU6zG}zt%YY}Un3<7dL3#~bGGS)3Mi48P&A#;3x=1e3K_!rGhW%pEP5OPT!ZAd-6gmPT`?A_uGNoHZ*L*m zyPQtNEj(q}QWo{9x=YlOt)lnaN9r8Ev3W~KR9^MEaSv05@i*&?-_tYw&8SI>4x>L+W6K4e9NW@0*%LLRTzyPuI)?1vC4%& z>qsZfI+|q)^lCnTrx~}*a7l2k{sU>x4?Q6dElRD{s*RhwzP}I&W1zgh=Ht`oRyiA9 zvRCw%?TX6-V2yW?1sM{H2_*!%wD9^ezCY7i)z9`?==tDx(D5b}{;olGs7)&AaxaS! z)ogLgN?)b(i(!<1Y2>o)wDETNPwMGjX~)j=G>;7JF2d!?E2=JME?98w*1@+=VAOHL zTu@*!vG%pY9koIwKHr2I*3g5K}L}8GB6B8qc8xW zH~I3@#$|;7BBTf!vZUAvL%4>*m%qzV-bX>4;p+e_&*?xNE!uD;cm^1R; z-7m0FJ=JCZ1QU1En)CG+aGyhhWCAdB;7xg{=G2QHvA(=4yO_$SV zE*3ItTXW`lo#TxpjM`^VcSIH1oh8b_B|0xcF+2X;L`5(wiQgYSkalnO-M>Fl7G4S* zNkXd7-QbX9FTcn4!wWHey^f!~&z`Pj>P9>C^;)NIvyVIKN0CtPHAj+xFKw~*-cMM# z+j>1MXM8hd#dqEa>9-OA%}4%+}pO9+f?w&ukcJiLO>*flMtr9-*`UX%uPYcD z>63UAg_t2ypxs5wGLZgan%QPI$|7hZw! zCYxho-ibD$oFbDyad@MTHK$Lg?QT?Zu!DD}a4L&1->4dDH7xIiD}lmdtfno2%j z;s#LWpQ)Hq)9DLuSjAmYYy&Ss3q}8;u9m`BpZ&Js!F|4_-G+myO?tQJBOOzfDUI0G zhM$Vsr#%+%O~_|qAzmLx4_6bhGnwD3(;hr(`lnP&&fnr}fs`q?o zd&1}XGp+@|)h~IW%9X9z4*RQn^-Mm+KvqX`rvQ*IDop6R*#)MRe)$n+7WaJ2;&(P9v>K#rzO85)c*O=PcZ zmkg8L-O6Y1wqu9`M8K?RNzl*$?<`62=i1;6V3J(wjBO}0IM~-m)Qr%S<}!X+M6+^z z1M%dy)_H=6n3W*LjSy z>^Xi-ayaMp{*V5IW?ABIRYX>%=6$GmYOXCol~fb5-Q;K2$5n^c3jaCFpn z4{Yh~J#TON<7at1J~x=CzEAe&w3sVg7&9JqrhYH_1);$t{w&d4CMc>)fl_Q#T0cc6 z#C};e=uiwWdOiX7`l3}F!I&q}x|YT}%(K$|souY`g(1e<^s?%DRB@7>vzYnAI$W^L z8rGg8;*P8E+hL)dY&4N_Za)#r5T(9OV-eWZLd$`g29ENl?up6e&W7}p2et2iZ%PR) zc|f%pF_H8wrwL8}0NVTqU->Z)eQYV!5E_qWFi~*|R%I$1Pjupk0^x}ciHOz7EyKmLXix7Sk-&-oc!;K3G1z9 z-ywwuV$Z;kw_d!`1$AZaPcDS1z?aPi?YGp9IzYFKUbPra<>fiB37O75uSN2Embt%% zpn1Q0z&j122ucQX=<7IAw=T;S>z!@It;-esaiXmuuZ2HM`5HGdJVVk3Vf zfIMPY*IJZ10e#}K@$M6cWJ56RPz&*ab$WAEYn0U`QVVB#9NQ-7mf`!vOSY!)`qxGw zU7Nq94NVo?!h+q(xbuFzzm;Mlpo*`WUW6>rn9;mAz6hQ@ICz8EpI-T0XQ^&c0ZJ@U zqTO*A5eBV_d9im^XI)9!8bHG)`-q_(O*t#w06GAoaC?^W2}T-5pXeKpJfcdlaJB5p zKtr*tm15qFm79T1tDc!@F!8fphG+z;`Ey;E(h&J32mLElh|9QJ;`EVI)JL zl4`t&VBDico_ua1M@s-JbuTMZw1tUr+o3&h`~m1L@zLZ_fPAfcX>A~M>z?%pFZS@c zjq<%A+}nr(*Z^I#W1gKNC-#Syxjc}3&dXm+q^*&xsj8ly()-1X(0G+bADLTN0y-_>0n!o!fQ`hn*&K(EBi)!j;Qe7i#^=;vO zMX%}{8&NC|t5D%~Oowd_l_AU6hx7CdoJru(HXp}TyvRe%)AHV3!cI+zn&`{NDfl37<^`ueBJi#vD5k~N!R8IKk6v0Tv8F|6)-QhPLg$8VY+I$`)T%H zax?M(HxqKh+VCfjrJMTB%-K%^lmz-_5{s8nyN+whu$hxk%IuHSKHMZ3t)#1?SibO9 z?*1yPu{|{rw1f$Ls>$3Ca=n@Cyh5b!8wyDoNs|J2vW% zNlsCv4T$1gD%Jm(v#c?^mDaMEqwVnN+C4UwanGRrt4%~1%%uT5_6Xlvckhy@wu%y+ zai%CQy=9ZCANUV{Ir{xYf2cIhezWMW3>PMal|zE;`5gKcc-m+hUf00owqMM!o)U%^ zf2h&wQq@QMo4f0=CTPz-FYCm0u_bLKnDmUt15d1>;> zI<%TOxi$<@3Gk@yX14(cmesyv1Mw5Vc7j2jiIn+y(UL5qzDct4Hcj*bB_s+KL)WI@ znZtN-+4(|vDBi*%uC$L@l(4fpx6D(*|8Lz?#J+;Q#M7i@Q?JHr81?(`(eGD*nb}!S zJG!4u@9Q_v>gyx?>^45z5FI*+|G?v}wxc?NkswcpWz7;L(ffNbpRkERGi6OXFTyYx z;LFoAh|Ttf!1?yM4fTP2w6O>b`vW$5Zk1=9+2Y0-`y@AJ>WX9~Qse@z!di1;k$GiW zf9F)s$LDb;>q4cp5aQx6sY)8KX}{Z`Z!F zqD|wa-|j^Sk2{N;F1U3sR$Ga_W3-vzi=u{6(iwj}H%}46!b5ZWkE_=(rrwTPj zN_7JMtEhkdmQ{1-md{yFOD#`yI`w~Qa$8VSSO8Q<4dauiY1+P*_q=A_8|WJ1->Ugg zW>Mo{RXTM~>QTg%6Zl!H4u)Y;Uk(gi^~|sVW-wdS;_n>v;b01V?w z_kD9pIXxxGRiI0+vf#kydIZ`A8Q|bmC6`TR8KIV=lQrnj3^DVd2CC8RRrTf57a5D% zz;6}}&EHEkN=Psy%OYOoLl?{_YMd?NcdK>s4E%bnM`@y@{Fl2aqdif;5>2+6(JhQ6 zeA2weXw{vd?GA|!^H%QFlV{!S)xr8$k=l_#X#=c2G6?q2={Vb=5}&iSnmfai1}!0x z0{F;IVycX8rv;qvFHqM7i#TDKs7@A@GS$-j9Qwg2$SK2;E&YJLF zXpJ};rmS{JBv~kiU@!HCz)Z_5&$_3&^=R?*m9z96(`1tw@T1E46vF7e_Z7o-By5a1F;K+N74oEU;rz)t zez`xjkP*GHkro9C%OevmI88`8$yUsWv9YJBa|Zjc7v-+_r7mX6c`;7@>L8b#9pW)ZRvUt-^Q2k$_J z>1tPdcfz*YVl@!pVjC$EGL*oMikdLhpYub`k;J)(xzdgMO|)u`CN$^*mX`-vs)3ty z(Ts-x=-Zfdt*1qDI!@io8nI_o~J>M326-4TN5E^BtCQe}b z)YUNQmDM`%9u|etq4JY1*93_f9SZX+5iQ8lff|kGlj@r*`m<+`J__X6phWR_JVc#L zd}wytG^lb%N`hH=el_LI+4YJ^ebYxE_w~d5r(-bG}cN4U8ye6bBm?Ry*s^&ZiY-(gaV-Q>}s>ex008Z0IIKjtuaU@8*SO*ua*~{ zJJ8ln%m{i!ZPs3VKsiXJrP^)oqB1%vFVTz1(B(<}6^4|X%P@nh9IUTaTt z%B?>hc3;LQ!d|j^6&VI8H8DuBhT^4S%z46e z3G(*vF>*^80NA3Wg@W>Y!cJ3@cC0qvYvR_!y*;+C-O_a?-D;1lG2QoPtBtFEYFKp& zuYGNL$-^HFo%-1mjc|%R9ulkT9o|J=#|rJe+^p-TW9^*svkS|>iSM(^5wO@*!&yj6 z1BfCr-etJJr*_+H(KkfAeAraU)ShsQ6U&@$jvDttS?K$WCEn5{q3ho~+*oCOqD^m` z0VYwfW09?wkIv4I??fK`yTn3EOOsM`02p6zKw0*}*ihYZ^>@0EO6lzuy8VDHbtzBX z%<4CKRxoAf|CH4KFThG1cd+%b0zm<_O4+ycCdmd`<{<)rqd?yMVx=guN-VxfJk8{b zzFv?NVE&p?_ajJGg}8lyEv-^qsP+P!~aI4I*$|mU{kv@}=WXy-@dxJS*?%i^ ziX_fBK>lz^J<6SZ+2u8rV~1P|w}62W9E`cNV=tPz-M8M)Pyez}e?-jXm`k78yjD(4 z=w6*Cq@L-M^Rf+?1n81U6=M7c^UD<#LQZ zL{6xr`1%82Z-{8lYxxExP)Mh;1-pg3pRq6F=thqjRuCvxPt`a0K=0tuT1hl~@}9a3 z>a@AD=8gx6UYre!X|a%MmcPUYS#RZDE<8;({5pV_gZ%ngC8CV~X6~v#8cS9%Utu_Z zYfa3(4t;Mxg`2+j!-u8;vNJwkmxR=B1+<0aN&aO)+kThU7W0sK$_f2*wYq2kv{eny z=#%COyNscsk(Wv&ho~vaQycjdg}UUj%v98+Vfu|@B@f^66yB&>unJ=SR5dRgijd|D zObBo((K!d%U^?#yLO1jfM)Dg*^Ci}ge;4moagz{FQDWyl$`57ssbT5eLtPGnR?#Vh zUT&{Z)M*kvo8xo$6g^}5zhp+C*+mIkbFd?MSR_~T{$V_Y*Fqk2To1vT*cM)e7SemijS3L&B;wh-Q9zAffmwy zeKPu8sV@2B-!Y}tcayt>@6WG{n_Dk^o|f|7^(S6eakCLjE_ZDsm@ixc@mWW81k=qu zrs6N}yj7R4ac9yzaB_zwDD1zBca;v3+pn)Xsd;7|+01WTHss-_ubV)w@kBfu9&(;V z%^Tpv=VXL`zg~MRJl-e6Mu|;twC6kpoC{$~_jHy}J>~Ar`JH802^&Xku)Y@-q3H|wJy9m`syk0WW9)lHrFf+a~(Mh12vaE-{ z63qYRV(nHw)f{P5((FrQwQ~B6cdVS4?Y(F21eBpwEv@`4NGae`HamvQvd+6()}pco zP*qUFczxwGHOQ&ew=C1Vsd8iNiPrH8H8T}4A52=aA!@$}-%QcZek8&=R{#2@Fk{rJ zX~&;lh_qhe6H+~g>?B>5T7s!AwrM{RE@R8;Io#kAynaMyw0o3^m;&k++p~m}Rn3TQ zo<10OV%_!Qu`w)?!8bykMf)t~^=l#il2>Pr$u3iun)nzn1-0hU;kzc9qk*=;=Suoc zsnb$ctAV^R+S@Fi$LsfX97G3Jib$7K+_N+8up)_$bxE zB9Lav?uBmBEL(3U>2GMBKnN}1dMGtBU(f(@mqlO#dZnud*4fCsO{;E|EXix14| z6&B1;2(A&oyr*jAE#jK#?}oPL400&bXnVo_?bpR!tSpmRCwwT0N)V*bohT{Uk+p9a zt6*+4lK1prSZ~}vfCCZo-h|-@fk`&uPg;(uZDdC1lgo>guRTa;lj)1u=0E)zMvoHW z?RvtrR+4v2!tl>eG0ALk3D$v>NUiNHF5w{+Zp6VFX@N5?*`DE!j|QhxsY!XlTvP?0 z6RM*^5|c@GAB~31vmW+u_rsp_YmBaR>>s4KNB!;kHULWd3H3qh_}o z`>P7}y;QS`n}V6>GMa4G6dGWbW)KSvD1x<=gi7~*`-F#uuUx_nvG8Mqq=1_6y#ggm zHNM{=S3w6oZdpmai-HBrvlJBmVZC2uTCB}8Z~j^I?}gG!F@9CkS4607UhSncbyFWk z_2&2+ZDd&K7G^<7;m*MTKgJefyW#np3X%-XHZWPe6hDAkw)JX-tB(V4c>q14zKenG#i=Kq;_sNpVw3RQQnmYVm*4xzqvH~N{|tM zb_#N@=4mZ>D}CPTw{562?Uort)#-qPm7=e?e*@S`9e--ESc~!oc=tGH>65vcS)$ z*q7_=xi0*S-O%Cm1t(L-fjs2}s%zf$t$PU-KF|}mQ+-k@$7of%-ahggka=6)Su=S~ z4m-2G*l<4)rhqsF}4x+C}b_An@#*N%rImB53m4=KsX;gd5&#FsJJ0y0B?dHR%H;GPk*$YHc|1;QfMN=}%ADv3{lZ`TCBbV zoR^1bW*VYgp;|_Wt7gvcV4K~t(eRa$Kz13i#W4%(a#un&t`%0W*CfmJ~5s`$iF zi?#-QSm58DT*lt1huR#FNH+W)nkZr1j$9f}Q~mm2{j%bxCJtxBPWk-Ei=2Mb({o|w z@RTcSj@TMhLqKsiIonEQUN)cSo}7|>$NiPpfb?RFx~pILj*U~j$Y?z$O5@Xtx;1@= zTTgOplU!=iXO|IjsBDA!)Q|2s)V9Gw&72}m+j`)@zv7qglS-ENjDT^9$u7(-yc4nl zh#dfNQB+l~=+^H0=D{_m$)GUSo+IeBDU+Dh=jO8Rz4hX6IsZY?8-MzC#2QAe-rvFc z=qDf&EhFs!eDxM?YfJfVfQ&P!hQ9Qk)^^Y_i?AO0JA*)x3mdJnjCMJqi6yVS^dky5 zJ+{I}@s`ltxmDDnN(>kL-RjKMa-T%L2+7$63OMR}wGS@B^7@x!VMiIU(K zT2>o<$HQY|#-J`hJaiRxWyqVnA^t4Y!GCnFG#P!ES^m8k%2@ZbJ7lewv(65e{0xqh zh>)Q{(^@1zbHFvsfi4AcUoTvIAD|UcLLyzA0GO+|tjwkF3s>iHbR(@z4^nDHg=h~G z0AVbyOmX6FniH@&Os)NydDXIoEnRVPfbT|I; z&QIgYW8L5LfeDg`Wy{n16<}8AsUGoWNP05gR~qp2_OPuctZw^=<=>az|$>5r&eD^Rwd%jZGVBS2qEO9^{ znYAkgjL+OGbHoni>eC7rb`1qs`tLu4rv9RAxs0!F9S6p4zw)c*pKbZkOn1j&AUeUY z7Fg0Wkcme_{}l77#|rUApYRD+hKtH2L=-lRgi)1bD-?W&{_Zq&&wMCS?Os>6pUEaQ ziJvvO`%cf#gB6OVlrv|U8J2!;nYrD9@&Q=-b9VV$-5AEhNFpB`L)E`csS5dNVLiVm zrwBX9dUI|>hF9I?<~)Z0Q-Zlpo#*tOAVGE;9NocPcivcME=t}t=bBBG0`)Cqh!m~S znW*7SbX8?M7wooRFX+@q5HKA{bK+rwy8_-5pL`K2N{r0}Oo@_J5sTDJ;>tRO)a}h0 zWE3u#n=OGOC713ku}N=sc^P@BkjQ3eIR)R>itnnd=t?_wujhi;x3<@cAc2<0PzSHH zV^34@5s3Ue)L;PL_*%~(t;DNkyFnhGXxs;Bx*X~n-@G6!TnPa*=Qd2RD$DG$o^blp zU*Q&E<6aFho(_Ay^tgqY-ti#!fw3G0@qL8+bBML@A-QEc7=Lg@e0D({WF<^uS6t4@ ziU_r^C@omG?9E8o;+f`(4Ps9HLMKR*z%01%Q2hWL1qFH-OGr4m-mb>JQ37PpGBv zBZM#Y$HyGAosqTg$GC3}AOGUDN45h&fb;oE=ejdBq?@%Qh)O8EKNqw1zl4zy#A&*w zTElru8sgm|&L?M>j;8MT%>-9bKTkZd>De|s^=K(qMn}1ndbh;ZQpE2*3K_VZX<1&J z+Z_&<3${>Y4bc^ESu7$P|6*jED0&@#%0eoQTKMJlAZy!(o@AQ`Kyoxp_@yyZmUFHY~`~v^w zz0n;&%;L54-&qqWL zeDYos&k2_J3@5myrhJho2_d$RL}~JOMGo^A3ijz^bqb$lGQ>?Qr4DJ989h97(a9SE z3Oh43k7iN0wuvG(-?C>$Ucwd$drIM=>KVrIE~cKfsHVMWImAU?D}?Do!i+kG+NgY@ z+KkvQKm_+v3qETa{OqpXL(WIS2m-%%Y~e@bF{g;ALl*mdmkANdh#~qr`}Z`cTg+J0XP}(3eP>5o${4 zePrqulA;K6sC*P)&0(JQ-pDdVL4dqYFwLsy1AUR(pq84oaS)B42Qj#!p!%h0tOF`x zgtFW1n89TvK&0IZIA4gQn|9gOwZAfyOp$6}O4X8v$3^Qb&8JW(@jb!W?pM8lgKh^t z0Nik2B>&cG51dh<8Km;`6@+)84@trF3u74{ttDSF5+<}%_I-Fa;GC1b)+1@!#Unua z>dzB#|3Zs!Yl_WBCB$y3ygL5c+{}&v3{l<2+b3^*bbdYL=}epSuiVX~k>fq;xiVdR zZ!oErCa78Tk*~3(yrqoQq1lc&*COOoHP+9~>vlXCDK1i_kQ7=N8psdkrVndFPA0PP z>RTB@tWd}6mqeGLmo`&}cQQuMl#|`0#Nlk9Z62beE9-cR{1q0HhL zol7>WRo2AMoWIruEO0A4Iw08=`{^%735!L9jzX-ryMBrwxylQ`pXDAjN45hw`sX=S z6JeXp`#0;jW(z!Q80$>_2zIMgY19WZ(U#4~thg9c`d_P8U6S*c0Y5wRry{Ki6~fGT z@UjXyC`7p}HOK5dNnIHBxz3)3!0smjDroO{&N*-!X6nau^-Rw>?fL%H+|)8Yym z(>lvmI-PTEG;i!a->%36)o3)_=GrK8Tjcf5>SxzcC_Oxmr^3*m+?ILgE+f4>091mW zedYl{55)M3XR`nhW-EW&^i{nTobxWkx;aD*PefIKB8}9Sw$K z{jIDapKm8CvNkqF0R9>ERTWV7U+Z1$scn;~z7|vdP6V;BP-v6&N)jMB?29dlRz64_ zchv16N)QNoO?AYYy)CkgzuCb^yDohYYYs*ZocG3}imCEgz`F*=d6lUgHP)3P{Xb)< z_&l|zD0>jXdDV*G6@&4th7mq?ra9pp6Z#z8mTY^>H`{Hdt2yID1LTYnGB)*xuN%3{ zrB*&Ndczy(EmwI!W!Acwe7r77B}1U?5iAvA(p=ok+kNQYbufXz;P0GrvkPBZXL0K= zb&6wki}rtCbg^6KC`>2sbQ4Z~k@G1%Go1YfLYq7n`Bwx}Y9Uw0(p@+Z0H~q8rJF^& z3*@2wlA!BUiLNMS{?-4@WAxEtWGBW8eEhYgWm<5VFmh?}T7HSy=-K>_zl0Ns$oTNu z%QqJyBp+DI{i}2_;sAeM0NA{Aq(0>`%trVmi8+0WWZ^G-)KmTsZmleC9*6-kB=J_N@UU)pLj8NeIU?+=<>3VRdLW2_c3w0Td zjSA3`vo1HjVUfB1@|yMw3Gbh1q}HJI!TnE34%3$Tf=TPJu8fyO+?5Q~K&^jcb=SSD z;|t*AXDG6XzwetcQqq28MuMj)!p_p@CEr>)RZ-So%FZ#QeCTzW z#j&T`{GWXX@N5GOoo)>dx2=8sWRt^1$U~%TNhB{VwT~cTWt>?3APtwPrJTyD{A54A zU)JZnVYY1t&z#@xw%o9m(c)N5EOSo}&<3pQFZ-drp4m3Gjcb-{M{$gKXVX%N()GW2 z=O^8s&YN?ET9{83iPk2^$CATb!0=q(lGYN4w)4pP_CHY>(1??5FRB62b{ z;oX)xKxfi@l%FYdeFLe831H|;WWFlCA$9tXlZgI?DczfU196p)yGDpi#BF&9bA;@E z-4TppuG{wnOxtIXh#qpQ)p4HTH~amyQJbs|Vvq~Z6fb54c2__8y5g%BqwbB(zhzc+VI`r@v9fkYE-eJSa=}Z`V;@F@D!>56YV7mWQIPq_+tbPp8i3{%O z>XbYRl%uo_Jns=REwu{3(uB09-c6zg(3I>|ATAhXLjtdbwgZM?eetik+T(x$)O#Zr zGkx;G$D@hDnAL@CWJ(Uw>|RzY>AOv0vEa>gbv?# zAMzh~Pe56Tzq4>JEYi$P*)@L3Dum1^XRi(%5k7QXC=y5o3x)$*lRFhNq7xAX06l%C) zQcB?WQdRr7Yz~pX?~UhprUG8N>DPC~()Z)J+V$I$=m|hPt9Z+|jR#F@S-MT)9#$bc zS0nGMkGo|I0Lc>95r%`IHNYWC2K~ES%&Jkuy=u|U8j_E?xOxL*_5S{(f4k+oXE}lv zq9S7w`s?jqf>3rW-5#jcuC&nOXxfG zl$r|2%myGZNK$Te@Uz*2*xtx_u}oekQaZk_)VDPP9_5GIAjUCaS{-2(}DLvke|1_0`&n zLsy&(XU{GjrX-$|d*RfbjlALk*L6;QLrQ|V|^D*^EFOS4?p4LqK+@%*#VFsOz0<=q<4rSLTRsNu+)0i5FwU;o8j z4xhKWB(1VFJ8jm~EAw{&#;yrX+MA`ReKJd0tPBb-BT) z(VZ+x8Uue2^Y4GkY3SKfm0isMJ%ZXM=gEuQl=qz7K911x$mx=Hm(>8icWLi?d=Je_ zEsG)_$AY?a*q_E=zMH(!C)0uS|U}}yNNq%EmH0%HlGJjPC=C^M|`Val$a^xfu z!lH`5M6vyyBnbK8r~E=6Lr~fJ4JlHC!<+J~iBpT+Yh`@Cd8z@+I?SgQffW@0+CcxP z#FH2&_Or4rx#T+jq4B4r&aHg556dK5yhSuZEP&YQ2kU?^Wu-nemm}31unOjQ-_AX~ z(s+WFpZeUy-l$L%X(3pY=*&xP_w-K(;`?zz1fjXO^U{DO^%&$ILx!mMZdl2#Ry+H) znM!+jqJZ&e0DGSW1O=09ZsP(H#u3f>Zx$-};ft4Hmv&P<46!wO=4M){L6Tk#+*XGG z`3Ya6OpIx$p6_|8uuOh+j$Nw$Us!%d>xg-BpC|WAW%agw>Ekq29FO;vLA~N}wPAk} zSNMyzR(hNTm3BH3$;ZjCOLFI?RaY=hN6j1vC`>zv?z3++}F^a z=2Hy252Q)>S=d>E=_l&$$=cT`f7zG-Jm=b`C|!^oS#4QQ8&4K$Fp>pG0QUXgdT9 z0z|b8prZ7&5jO9&e)wjXedD-BPt0XPP32~{F-7$cPuk$eT=15*~3 z_|O^un1V7sYh*&HW*w7-bB-%mK$o2uo~O_0CNF5dm6nEwR&4c4OeY^TjJj0KgPDOi zZFQ4H()CCsR*>Pcgc3uE_eC$<*J@wtwSxNN5wqZ6dlL zsf~4-CN)gj5kLG4+bi8N>#1Y+*+AB*A3!{Autr~1rsdcN(2l7HzG2A-#ltScSFd^u zR01irMx7GmOpMeNxcjAb|D`~yU+Y2@Vv{zdj{O%pcvQe7?W^YC<^@9CwQdt2jPp;v zR^I_`t#X4MleYC&LYj|`1COt-B=s080VqXEKy4{@7&Cw4ET;%Jt^7w($w8su`JPRx z2E%+HU=Q-*+3R+b?6*E&-?A7;ImB{5rz!0V1o%`{$6&tX_d$v0*TRG7|0hTV7hGNdzT8RVy2;o+I>^(1--nhK-9Kk`C_$2NXih0n z3$sCmit{bChgoQQN%Q@yaWQyx-D460d$7G_jS#0*04K~ zlW-X(WW~|FDOGfBJRr>Lbyceml=}oC{-peuFJl*Lt%|unp!bS=J@-L)-T8h0Y;LolcpVE`0`}+=9lF3xn!4ls?qc)6U^lR?#}q?OVJWn^ zMp2S?LH_ofeA~lf)?*tZZpp9df;@lc7^e$6K4-$&2X$kF&|=fxz_eO zn#-?et9fbWpY8~;AKKT=CSIls;)x1G>(o9)t5)rHAflZu099$^1dMh1TTH-Ag?k`~ zq5D8+zy1C5(wCVB0KC!*7c^kAtin#EBI7P9rnOf(gd2UuV1#PntgCj0X=^8x$5Vo+ zx*LdH_2zHaX-&*GYx6yp0^#gh&$3TnK46uWc=CWX_Py~d&8IRI@A8Zx(=3|bm3!&@ zDbQFk^UE4L_~UH2mD2UuK%LW0-N`Jr`2@&S9LgQsYvOkrOy=iuI`Lc^9BB^`Io87& zaBi63jEwd0TNTVE&$2A_Q4BSR>-TycIxHM3q>KAzTX5n3?HWKaJ^Sx0fPcOrVg{$v z+2u+2JyG%-xSAZ8i1bfQafLx*Z@yAsIOLA=#5lgTeta8&i|2^zuq)j3aaT{hqAZ44 z-GPIy>+Q)FPeD>O^~Y+_Tj#YUakip27CJse@jN+~VN6%)Krz|edWUQNJ>3r}DE9$X>>&ls8rg{^canL*O?mJlC!!_PRGA)?v81rJd?}FxS{ETD3zTStTUj(~iD5Me z5EQ@dx#8zmh(=);-BKwo0VNVG=BY6g{1_NuZF5&i$Nr1xhcH}z{l}D-U%TGw)$o-o zr+wC>`1buu4Aiei#U*x!G|pDxc4gvGdpr~eKE~JypNz=Zc%?x=j8LZkxx`-0it<_N z{>W)f;=u9VoL=Sw6|D=M{r|@mbn;fI!~XH_B;dXc&jgpn|TX#UVs-x)I(jf6wz={KFnsFQHWu$HULq8`{7>Gh_ud#p}MY=zZ|CO>nbc z%3H7q@6f#95Ir9JY*ab?$Cer56#!&9%mxCO*fYFRl+A+8$Uf&Iqlv= zmpQGVe-)Jtqj9dRm5LYiy}yUD-H37;vm`x20ei271<`ImEwt?-j?k~~w4y|{32NPk z?^)nzikG~;6Gfob*7g#GzQ@gz89wHhvdLXWzX$9V2@{XWmh;tbpW_=< zz);}lXca0D@heqn9$Uv|luga-{Y(#e#`T-)zO>snUBi&Apr3@h|GajJL4sx7sh$Og zNnlkxT4%*4qrLe{|Cd)f0z&svxx~w#Hi<2W>zUFKj>SmBP|S-yz3J+>hyjU@rFueS zUoa6VcB3oWqyeI{&dsG;6-8{U`5^L@$$*vO4Crm!B4js1yZq>loAe(z6Nn_fu?svp zuc*V88OFX%7h-X_y?uebMU&BXu;CA{m<(VqQm|*tV8o)-WQLy|3xvR zMNbwxv{+%%S1~Yed*u;`YTku*x?k8#L#NX{jNhCJW4ANk=uSwac=f)zzX}XHRJECJ z*1bGk4&N$dZ~0ic(f17O=rJDjh-|Y8j zKXureb)EmV9ncemuMPhg!$g}YO|O@D%Mr6?HIyR<8keGn=FxfVi5~BF(@S6mTueqX zBvcRawey^Y1QgIM*EcOsW?k2xK(T1v;{o2Jac_Le0<$#l7t`%IET!tZ&0ASf@`hKG zdTx5N?%n;-*f(7>LJ^zI$YM`ok1IablbeQo^?Gxfmsi+b&f=*;HkF*vHV4hCUkvYIdUl((9^}hZ9?-8Vtccym*-9cUv3|cXEM`q7IT@-XD~PW$?;whiBVWQ>J4M0{^;&TK=rCTqf#9L(NGQDs*u{tEw%XvK^B z$UEaqCc;*oEdL*0Pel?sq*1t#dwd$S zKh53mqs>dD0}|6q_WmYHaYaAMGZMd7+->*ymOoc;$ldzlOIE)Bp2nOMNfL2;FXF`) znKfzJFPJiJ+lNIu$Cf{+ADtTW>v2E!gG^VW$9iL!tAyGHZi2Yo2x4!%F=f>C$KXgB z&PdYgf7i36XzCnXIjvm|R~bm;QB`G9SIU;AZ6oUzxxT18Pu7!dJjP60Vzxa`C6X8= zvb6Z}G$W}RzF@?ZiZjaa%v%x)+`}VHLoiz=p23o0ApcJ21L?;D<=b=bA7qdP`rV1p zuMX@o^!rM*1U%e=H!j=nV(8xT93ATS#oCQql{U$f9S?oqz3yf@$Ar*_8r08HJw#mz zC&i{d)y4f?5$sg^4Bq8%6;yn3ksinh61!@(zxz2w(EY*hsY)|q)j&OrN79p9Ax}^& z5OrPltM4A^Mx1BFLa-PymFJUE`gD(ApK)2fJ6ArRGK$5RCognUUH6zulZW_f+yUPe zGYfENj!cbU<_-|`KG(QdI;QNrXY?%jB>VYu7Az>*4>w(ib4i4h*;#O6B6z^io62g| z?H!%w2Cg-2iJ>pTenX2eq>V=l;)Ezhvuw?}Aw)ph6F{|enNz)YJXb}r;{QL!FR4vR2 zAfUB<@%-yOU#GkBKj$@%L3vZI^PN#4qp9>%WPo;+F8&98msl+O#;DKFx8s1CX$vKa zGoG6U1xV|T-i~UKLa4X@2lcm^U2-}%AVoE!cE9?X-Nuy2`S=J+KGiD3dH=PQixAx?L_=rn$?e0 z(9^Dpyt8h89>0ru$(%(pWHnVQj6algSN)jHMvph0^vf^ctAET}pjWuN)l+&y*w`!D z>Y?-7Jxqo_e%n^ZC|?Q5HtYI|b4hr)7{Z({It(;&P37SlL2uu7PnEpu?02cic$7j1 zp4D16^4cYVf3dXe6i)PNBka(_aaNh5Bq#}76+(K5Mrb-CnQTFyc$#I3v2TswT z1G_CX__xcxlma`mQw zznuIBUGp9o0!R(N2hUZW!=u999 zS=&eXgQ<*OlZKBFq!Mb&$E*%TO(%2Ox^I1x?#>mx zk5W@E?L6}mE+#}|45tbZCU~mc$u%8F+@}vGTTJVMfmDhEge>y!oZhV7*HDVrs1v%C z8FfueKxd}M!MxNr608Y5M!B;LvA6lXXb`qZtdA0930pOH$Qu>^sRd^oR;KsWe6}sx zLh{1E*GH^dznJWJ?|;zsmO*hxO&Tu@u7kT1EV#P`cMZYaU4py21%kV~2X}XO2pZgd z@H_8r-Ktx=d+U6fum76Ur~7$+-Mt=)YG@r@R4f!QgvO{wUyic)TGnI}QHU2m{8?~nWrbcO^Q+#Pypd?fF+(s8HZ{lkkGK9jemW!iqPCmAyd9=m;~ zwX>gEHyj!-c%LebQU$q55=vTY8lP`i|2!W*q3&YE9|BhAru5|An~->%$E={n%Ck^beX02t6ev9PBb6zP?v z1MOIqtyP;t!2Kav{uS-*kkH|p=X$Q8SPpYo;H(O^#Qv{Eu1ZPM#L{ytVMXQZ1Lp(3 zoY7nXjE{X_H+&~kOrQ7Iba>Ajh5#vvG`_l2JaKBBzl0r-$O1lusVd;io^Q6`KqAn^ zna|f9XR8tpRaLO|T!NlT_fKP4=fYX~_EAI}G4sA%)P?p*+BpBB!LzS##dms-_@9q! zeh?3+oSgx%QjW*x-bb)OPmTt+;7p;Cxf`Ur>%$ZvBDG0RB!lk-&bhI;fU8fFv>P*K zvk!}El}BeTdvW(8)`*I4k!++;j&Dr9J0Ha5afBP5z5nOQgAfqG2fl4jH2ZYyz6g#{T1O!BkxkX;s-mc2VumDF{vKy%;9p4lP^uq8WT%u-E41GWTMz z2*ftI2Tsif=Sg1qbMWwU--a8!qo_>zke0$x@D$ddvPNxjlbC6{jUX+7kRA)SXCE4A~G7v`jDS1D$%pJv$HH>k!7z2KQq5+GX4 z3wN0r*W-ELFNwZ}fQHaf5T>Ei(m{ zkSyXs$ZsRY>ySZvf*D`iNQ496wNHar*<pErSL9tvG!?BUjbyL8)qW z_QX#pTN4_DMa$^XiADOK}_hopRH3R z(&gF=$C1uVh)%GKs-RnU7sXpF|dl{uf+W7RFB3gu*wF+4}X8MveP zio3v*e!{1rh_&4wC}5{NzrWqhqz^mq@e`6kpidlC(&Xb*{N|x!3%Lj62a9OmJ-*De}X#SpkMXi&U_<|H>l^ zPW48_NLZ@KSgbWCu`^pzkLAHY@=WQZ$^$EB?T?*e$@6+hy?r^;oe*l@p z!^lg47sikU+jjEg?wh1AWmkXy3fPQuB%$>H?uaEJSv_D8I+8lSA<#IwnLno?%tV5A z&MrI5*Q)q^@ki`4H5i|v;GwsSYkC9k0{+j_+p__c9H`VYiH_`oUW8jxtZ(ub#0+o5 zw|c5#L=7DP(f`n%0(F(Z3-r(RyUnlAe^);o5@UF=lz(BXexMG@XiXeyw!$1AGK{G}8M|DtD`Ek>vhYY;k>;Hkak9(TWMJ-ppTDtwtA^yP)MMgw@K&(@=U%8?R_R zicqUl$_L1dds8RNaDn&|*(sbr&P?QKyv}2iP&+pgfY0W{2-(qOcI9-L3-$YwSq#kO_b;=v{eXC-#=zY52()#>pR9Xj zddH@Cb|fCg5(4``;g>XDN0myhP9PibrqLECM{Motd#EV~p7Y)i{wIHsf&;768Nm2} zj@P*<2=G3iN9CF!6O<3(AraE*ib&WEd1R>!`hc#}UYOH#fwv&SK|sU%McdS;9kwgB zvWYCa=AR(Z%ceHK)_ITglZrw_Dr%8v-Fru=NCopYD!*7_eTX@uBxl%x1g?T5tQ?mw zWQ`157A17UC8U=*VG2v1Js;)l2axi609DbO*!<4%IPE7b*NN*>>GeMvm{J6`Wp>_5 zrg)B_PAL+Oqb~mf`n=1wA2%GVH&^Fm8(i{H-y0C%Cp)Ic&z~Mj6i(;eaN&ZUSV)52 z>d&=XCOXQtrI{fbc4P54!zP~J)jB<#a()i;j0yyv2Lwc6#~;S?r#TAad*;=hN8{7w z%F!?&cnzYPr6CoPt$4gwrwVRwe#+?+!N zpnz{XYO4Dosl22dnz2y><fA>K4t;jfdl{ zB>^SFG25(}|2%i*z#XA~u`32YOr+uw1sa!Xd?k%E_?6msO}KG8Q)zJ9r>CL*ufrb; zM+-%&5MihYebj9vO@C`s#RN<#2*Zk~; z-&~rw$KN!CN`O(uUx&x$1|tjYMjPS;R(Z?eZ<*G$WTT7TT}4~cb5W6cL0#q!@IMjp zd%rA2i|RMlK~Bt4$jRND=YgyBk35Yk5BaY9J^Ir?xJ#2B%81%&e2X%gT(79tvo1Zk zoe$$$^wU_1;2~qHYd$aMw;11bhaaJXswE667}>vtv$K23`87yuhN1z=;mm!ikZXMrngY{ya~mX=dEy@Iqz6{;1z45W9p@;F!<`K znW7Ptj8?SL@k0rfDCVrgYC+QVA}`Rozi4doS5i{pIQZGT>f@=_e#M-#S*|Ma{^iT7 zM){apGR36)#Hfu|>YPUcNt5b&S@4y_mtz7H90V!+{15ZtFtfH2E|s}-fn)krNaO=V zXs_CFRUhtUcR>(p7YHO`5q0~gB6WjNRXgwdECyscGK-&U6pzH1bh#ZXEt?Nd)e!!; zE_~S;0P-ZU2C*dtR+9$de1i6Ye*!N94Sa53NGP?oj8PsMY!|FXm#gO%6A7(gTjfkxb7#x-8eqvv#S{;QQUt zjGAz9I{ww>9f30r_GtG_m=j{URQ>?OxHEzXmovoAjGt%fO#2o$zR``(Q&v%1xAFX3b3^ZDS0OOuQGrMpgVS#n7ij+~?P$50>KwtYnII4<6 z*8{bMNL$6{lEC4cr^|C|nY)JX3#g)mui_g_XmKREDTpXL`bUrKOfz|1d^vE-Ux~cX z5Nijo>)$WA@8x20bgMTQqP(Zjg+z)6|N^aK=hxU?>jb2DBN3-g@L3=DwnL zx-3j3`zFP;w3;}u`7VapNa4ltRRmdY*HaSrguA#IW+8QhZjtnFfqghCh8yuFrKuWx-JC`<>t5oTIo;{75}b3@1@n5`I^&+OkaWUfiaYdn4n^MOa;l{#pA#F))n%RsA1BSS#GN zcdqXub29d8b<4J@`*f$CzlfzE=3aOI|6h_L^5Kz}HckBxA(giS`uw{`k{4e@@Jk3d z==_8WY_sf#ciR!VXOjVF`n-S@=%4dNIw(E&h5E?wo8D#zvT7HR3VEU1!^d!IVEbll zsmn6x@pm&lXSBS=u%StO{mR)Pis8B_CJ?S(3y-!s@4^S^xrCKVK;{KjOUHr7^!u&7*+^+oWy36r8Ot-KEAY)#vu6OH6 zj18Z(D5!Z~)|YCx-C}bl=_fQ7+?=fl%N_jtcP%GodfS^&7afS0hG(tYc1mAlrTV9|40CbT1N;JT+1bfnY|8;EQq+>*Jc6tgxY7w*^?Z zC4K(@EyP=|-G(nxHEm+J5ZbEy2=0 zjiE+lRZ+Chv%9BcEPTRvwoF-n82}DDpe=U$Uhc=_IYCH7V|`~gm#2AuQg-Nh7tUzy zNj&p(d^?6pr?v$ah=kLB#~v4P+6jDJ;M$sgUBgro$_Fng(a$Mjc|~}@^w)E_;H+>y zFj?f@_LJk%l@Nu-{+>jwz|(Ok3P&s*7<{%wUt6XA#HcTiS)*gd6YL3hyENNQ^&Ywc z(f!%q1mYx^Fu!{-vBd~@$J6{oyI6v=QV&uCg*4YCe!)oExrP*PYT=Ff<^;Cy46C!t zvIB-h?7CRRk!7RCWSddD$il7C6qD;!kEP|kQRpV$Hkq2@8D#_{Rr&h;yD8e-fnRH$ z^9jjfT&rJQNu+0>zFVs5LG)3SL(~KwaoP^9i1DMzygZ(4C=u(j`LT(CpdCQgP;fW! z*#>wMi-^gS62c4?9x^(gCU7UIC_dmziqDFKI~hL(VV+iYJtswaD}F4qRN>?r9j#ri zV}D!on}m{WVl`dq{KM(sthR%TtF`Ph-6F#t>1gICGIzgg%u1fA7^62l58t%AzYDCu zoLA@rgB1 z0TpIZdokSL33@Sp_#Ssd;(sY1Q|y5{$$=B)WYlg_rwjw`+d8SdvscqIycSgZbH(XE zTaDfZj;{0AeHAn*hCn);0oyP@!|C<=IYc(4br!=NPOMEg$$q~OU&uA&%&hI?;P$;B zS6eOB8m-C{gs-9^WB^bct=jS;0%;wwPtdC&e*m*R={Gct>G*2xmR*Jn@E-LwoUsFK ztmJl}f(8lL@Tu?(kE@^}Ug0|b^Ry*z>}fOy*@vpvt~-sd9EvN)w%-PeuYx;UPw<%Q zD}Ny|gJ`sxIgGCa>BP&+yGxB)(%xyqt?x%PqSKs;HvP{Bbjg3^NX8uGgT|oR=KOn< zA<{r4VfJa;zZ7j1snze8WvTf=0xJz<5tQBb-7tMSx@u=}6XcW>R(y;ujSHvK;x}`| zoJG3P)Ta5D^DK@>1NB9y#M#V#q){NQR*-gd4c0dE7HbF5bJak0k^vnbEm){}qlxu( zF<$t?FnX-j_R50C{i&-Wm#@+>@^aR$n8l=%uF%X8UuB~)K!F7ULFV)h z&pUG=?tRT6U-^aruEfSdN3Kh9C;NWVY0=fv9U%1WP+uMS$_VFN^Y~l4sloQmw9Vpi zz4?Zrh^{;O;0CzvasA5~jA&-)US*;ymVW~wXyQSGzyF zZ5d=eRy3(c= zAJ2mtizGZ7F6)1sk603(=VVpe<&33FXHMoG4;SK9*0)MQw8X%868ICUc<8JfInpRc zkzU@L@m# z_9B4G0OhV`VM|huUXw;c{Aeqa++}uKgS0TzQ6>syCYo@lw9c*W4S}$Zt8S@XrGRG- z`RX~QWb#X)aVDo#qi{qd6ZwkY^r?l@e3d!vpC7MF3fzDDVe6g;jW*b=|G_WiiTYmB z2oIf9-mq~bE?;-LEPWlPo=XJ)K1vQYzU=F(c&VuVW^;pRcKD3$NfUlKj+)PYkANH! z^q8vyb%z!m8HK^Y=*&=6(XjCy3j)^+;!1Eyjp|0|6mEsy5&$6E;GHk=s2esD^R{?M z=R&YE8B3K45ZkO+J|!*Seoe?}V>C0MzT1Cvl~azFdGED`1M7P{=FDH0k`GHJw)1Wz zJ7%0W-_oQj{TItr3Tcn87zoxe0Wb(GMynY?i6j}$ z<&gG8)D*{&>Fl)=fs8k?Ttgy^E0pni)02lx8ttz8%|=c@HE0@aCKe5yUsw-Paf8oC zd2~Z#%z1>&7j*JFC4+9_9F^ z2t&Z1C2coB&+hwOf$KFTPaf0TUm{!x()Ik5gg=T+9D5S@$R-@rH5lc8?h^n(kquc! zZE6rfl5X3+?jM#AeQzpjs%eRSXdz%)Wk9tzZE~m!7Xs73eT!4awY7;D?w@1vgId0^ zgv;NN)mH!C-J`1Z)dK`gvtI-5^h)srAu-(U7ox!3{Q{!DN0)y43fW0O3wl~oXhb|pFT?IcM!L`sN<^Pw{TZIz`=k34R6vBwgvctuabNh zXT-uh`qT>}^2GeQ1esQteR5#w;n8LF{@s0hOc}Pt(lc>QxG((Nn}^yoSIQ7)`e-)~ zkCLo_#qAB{D-8|JEP&q-2tX$%#H?7b@5lyZz9UBmqT*wu=K$4E>PQr3((Z5=jNgq0 z&=B`J{H|TCY`i%X+$bZMiFs}YlYYTo3%<>Yo$kr4*N?hP3vydQ7;Ho{vu@yN;nyd7 z;-RI1gv>Mr4)KVOS8fZItzVjsZKJ{Jb;XI0|D~?lv<76K2RsRcq3}zjkm3dyW|-=Z zZZ@Kn{ED#C=PDZ4SY`q|!hl{|hsX_?L21<|=aGsF-;Wd4kHvQnKJ`7oc3Tm_$2SWl z-QUr^yJ*>l_7K53JVS4wpqyQX<&EFTfPGC+pi>*YCkhnd@-ek^Py^uwG6%TR;;n?e zbut}|Jd7<9za|D``RDrVIcY!dVbpX-#EtY5^`=&POA`gR`VR_mCkmNgN{r|)`j&vc zqFS`igdW5aaSms>U*8OZ4RAXEZ~p%1oQZmE&W}OAWAv0G%Ol7eh%F<;w`Rt)3x1uI zQu!wX)5ebHl*q$%SV5=DAwkN^Pzca5rB(nV`@wC}<)1B_@Us-t`&2Ih8j2nK5$elW zsd#)E1yuh34-@p?bkLiPV1Qv~&0i&DjAS@53weLBzg!nn(3yA9+(u+SZgTHMRG^7= zcIQT3j4;#$%HZ-Cc@NFwh{DWUVvs#b+qL=Vu=vs#3#paQAtR(cj__OWfrSHv{(>Aw+@?2c$ z80d8G@_NAzmexE(!&C18X+-vO1)--~U744`_WG2LN7JcP&{sx)m~w0%}06w9bnL0>(izNljVR1O}=;ab)s zPag_n9enj)SNc{ck?Q*?G1s3OFy?lNA1!Dn-!Y3b9sEfaiXx3Zz?GSMVu;PdfHSpw zH#Dbu^{O^;W98_v#fJAv=rU;hcjV~K65btLaF)P<2@VUd&WA&tlB^W~b?mbc+^Z9! ze;NZbyayPwQFx@)U4RARj|Xysop}`9{aZEM^ul{SG}P z`I1AIH72K|3cF4Oi_w-;!e*LWI}#mWGOLlW`MJmb%F~wj57!IlbZgID7$W4AyQoWn zNN9cNi9c7fkVDYDZb3DgfQx>l3}=I66}SLl^sMW((%gy^#taunl{@nzdhf_$)ne4| zpvGOpadEq|mfPQ{bP?AW%e8CIv7RU5Ys}~YoX6|;P=4n({RjPZ%wewM!%jBasX{U% zI{Le1gu$I$yTS-8ecjZq zy_%9l0b_IMg_4=RL~<*}pRh`V~zS~{~mS!}fHAKh<>VZ`a2ItGjVNgI+6=W~Ar zbjZ?_*eudfJ!$_P_@tfIT`$$;`=yj(Dpd^2VVABOfc%P&7$Sj8go@l;DM_r$f=cE4V4P`)~a^z$$4>Q^7%iA!Dr)~_eS19^` zeIH_kw5GaH68Wf`F@t;GMkKALPCx$o%^L2?ZuR;%*u2W+jlaKI`QiII1qR0xT@+TE zO@Hc7qrcal4s5t$SId*L{CZ>9&<6aSP1#;KurGP?&)Fq|#-mOC5+~>J=)L-BfA8|%mV}m>AYh0PaxEN6R znjX*QSi{$&b-FTH=OgvWEg0Zpb+h-{c+={)y5?q+t1<$83C@H56G*r72c*)x6?F|p z;t3~KxHn5FGTDS0AV=Zk@U7QNz~&qCakverwZ8DVJ;s6sESvw& z^XUc*34StkSh@WEy@iDDB+<^Fuan&(8xtN;o_d93;P+<-$u;|RB=FiEyIvGlEs!Jv z(@HNswSF`zge=^{)-~116faVYZI%AZYkbYjCnk>voe!=J)N(0hS0qr zO1mdo?~^B^SIc6*{}!hH2vgMvKFaade^-z-=3T5jIdB>XL(x+2a7!&Ko=BOSh>exJ zX{006#zox0OzSZuXB_cLeMtvE7;U#TFe@sM?yC zO=rJSb~&78PwHn#MaJVZWnu0>B=Dkm1)RzBg=tbBT6;y(cv0-woy;FtgUJAE!mjgK z0~j2Y_!^J29+Htq%hfUjncJ3tEgAv7G1yzqWu^d!&-`SavX&xN-@|m*Jf;Cz?JaCU z4g++*{J=a32z|VV)4x*HT8+!2C-ZIWjJ3t@>tIYPl&UDl>y+-WCy|YOuhwYb&hncL z{EFbqvB^0m_4U5p&lo25WWWwjNBe?8y?>JXkD7SX99Y_zI7#_~BL+aHJ{f-4Dw$hphv@x}dDuzSv4N zk%~^lO=WrVGnRXkDgB!%WWd1HU!C_kiERu)S^Yuc|Ax?<%Fd^1a;8ze_?@FK;G*^O zV`wSzyOO%iveyR~CN;5;H1X8vnuVN%ewRMw&aY;?kb%W~w+g0WH%Lo)QD?s&t4q}U zi9Qfw9wRGauF3Ye_VLSTzCQ={GXnD4(Vp;)4g)H2u4HFR4+3%g9|KUTU)?5?$R_}a zc(9-R;v0=2FP={z!!`k#NOZ1i@qa5LZpsT`Unbs)X}&w{NVWSS29d5@i9)?pX41&B zt-+0}?Tjx$!Oq=!LY=hth#LL!1b;rU1P{O7T`3}?LHh?b-}ERf#GcRY*qWACamCi1 z90najI1L6}mYIkl)zZ>zKfZ-Ov^@WoWm*quzLAb+FeH7`9!x}Ghb5aGF}@g?KW^Qrn~#U`+{q~vxDCrh2QjN7sQ6+GzDN7)|^zz zaq`;eB}Y4Kz|{V;vPPBtDr@K|m1jH0ce<_f3Nb!*rA9A_Y`{L1?UC3NvoSawjW*&y z`e;(8*MwMp;-mzT{v^v?Jv0h&Z4XT4_K956n;P;nY59;cwymc~Xw*7s_p_Ch$6+5% zoISHJFvs~F`G2Z`WoA6H-DOeT_ZNfeEsuTI2TU`3d2Dd;CmPygJ8)|z=lN_p+STM6 zK8mbYs!?miCh04+QW7szFnPrqK&G5k%5oALAP3^fYMVxl0^4F6cSx6=Ce(t$!p4J? zhCU2tqCFPV0)F-bF1RW6lmB#`%xbqJFRS>kl%JTjY%Pf>*=kI)&sJ~P5G%YUuUBEN z-Am82-5|pL+NUDzKhS3VZgjZP52Om-_P-KbiqCOLywIqbXjW+ZjdV(s_}_uuw#VpM z%To&8e_{k3Bn_nn@8awX(l2mIqPFJk0@BAM{3kc|_6QH53WXdkSSoWe`4|XK8pVh@ zdzrXbq(Na%4FuciTKbc12il;8#jco$0bge`Lx=9g zKUHyR^QT5n-RGVYNMR^a!L;4om`@m%P<`?Fb`pEBTupg}P3yWtiQ*buZIhTGlwRnJ z<#s1hd+@L2nF?G!#G{lzV4-sl-Xz~{xJV`Kvdtfru?!u}v|@crMlohlcI$i1J7;uJ z1x}kBMXgiw*@0V^)60%a^=fUsBDX?jjeNp*Bcny5HFgBA0Wb`o>aM0Fd{?!uXx8-k za^}#PwG_QI!5hQ6bNVs7G;24T7g$B$hqlR?2te|GIf1hSz6-sq?sI6}ChVT9KR8z- zS?9&Wn2f}!xzBz{pEfUa4GZu0a=V=WopRz8mUU7JnWussDY!Hn>}hLzLVq!RoN;zvw%bgZLN$CmoOu6!$qsrd z`~56bdXNkz?}yGOMkAbs%w~4o;QwHgIbW==EV>56RbFuH0!f;f^K7wa1ny!~cJDJv zow}OB>opRrwNw}>YvRINKq1q3-qdqtj@Tb(`6yxfWlBM9l}k(<6FWKW{(x8^eQ)I9 z9Z)J(V~{q^9aXUw0%QDhNZhdD9GeNt_eQV!wCtlb2#w?N`pc1Jm{U*bn!edhv6ejJJ>o$ck zy&UYugf(T}7AGZzL@Npg>Zn3OFHqd!vFUDs728oJ!m5L%{kZ4RxHk2}2cNWPkO(^< z#4J(+1UJ(c3Q3ZOtoN%NI59>^Z-i%>uD8gn_af5D8|dfyJNKfh_;;TwUgdnaEC7Cd z8rbU;xHCwr+4b^W&DYxXJ+ZJ{IzJ%B>sKg_sJq*B&R^m{@n2THq~k&Oa0YXnUw-d& z^?M2O1vdyH$fpa?p>@(cfN04V?DUk6;CWmAt+?`TtkB#r)BE?v$)Qb&v&P8~vfnPizNR7!fpO)zs)PI}2TLejwJO;lu`udKWehxKOK?un=20s;%c+3V= z+OZWnQ?Gb+I;6%FANx;{dHo=U9F2>cTt)q#(rXsn#}rt6#qzJA9iMIu=%U?HKf4t( zuQ1{7?!SN>@0Ak4EQSx;srq(5TVfS^gBH#p0q+tqqTxQFKl+G4p%oeHF$k}{GLh=i zPu8>&?b?ebWQP*rRWDW{_E=Rw^^-=S`}@Q2U{YECA<>Y(v9 zWxT+*K6#rZ(2WUJH{WkBdF!1@t+$7K=GI*Q515>P31&{Nuyqs_b{kw?x-WX&Z=w&7 zFdp^D&ADH-ZYYwMOtD~&stxr$mBWX@%`PVT-C~ckMgwbtUX_I%)89j>roqsvlGdY} zil#MfpW?63b9%W{#v|4@HwFDo4T~6vKgeEw*N_uv%(CW>>%nT564+)}b!zOhsyCrAY0X@9aCSO2&y)!WyXz3E?|$$LX!18gRV$Ta|0`{4ipH9b?6_GUu`Vy_3NRZds`(Sbl=EJI4vCs?+yj{kB ztErW44{Plvw9)BY7yh|_&GCNeQ!F1JQI!DrE2k8{1sqQ4;MJ>4BMa91M*ZDcHzpL)~z5P)f5GPvm57Qh}t+E zt%{T)!)HBFA!)U~;%Y!xkNp}mP!D?z3PS;a$|_;aLSusMHkzG=^*}hUoNT~QNYe6R zfK&JS+zREZ39@(OUY$bi{8!l2CL7Y4>4@n^-U71!q8GlU$RVT+BSN}CFlI%^^!;sr z+ClaK&7z66!z+Ha4A|V~pv(Oo5XSvuJr(E;N8}j5N=O>jWc^n%TjFU)(|N0Vn@wJW ze8Kk;+>oH98YICh+-k-b?B|rc2TUjN(d-$(@xSh{Cl}}hbxQER9;<~hf^BmYGz5j*C(Hq?(pPnQc{dmxVy}wU+wW18avOiXyPhtpNX^P|dFH{^ zs2w3sPp>@gxt+Rb144?`wkv2rnC3lixAY2Fi(DTG`7rx1LfuVCshJ5Xm|D{Upyc^O zC}m*XjqoDw#NJCUfu^pk?|{LR*8{nCrH0_v&-dRc>wLj%6L=E4)c7$`%{dHV1X^F= zkwV1L&|0J$!;AGy!!xun^tG4E(1op#OG@d~cJgd$@_*544>D*mTzGW^0Y=?Q@+1+J zMM|>1ZrwVSF7f;ZfP@wh35Q&nKSF=0GrPIyrBMezuDJ_q8$Wuuf*Gj_M5*t}G`YG{ z@N^n6Y+Tl?khXYbz1=&cBym>z%<*$J8pW0c68f~eL({2QkkA{@9|;PjCuUf^bdWyb zq;XV;p-M$gxDWl{Ofjg*CV1(!NjC?AIy=^2?yq|fiTWFE_}bU|!fAod;~gXN(3#ot zNZk7Rw6HK~mCPvQj1-)5?DdiLp2(&}IF@InpprIy%hTxx^i>emG{jAG6OvtBHUIDY z3Y2f90ewM6c<}5B;sRm6-84&Pg>YtUx;!D1+eDa2q_VT#c6E&?ikPNF{-?fQWbEn z`3%EvY=FG+D|Y`eyjthGjKlMCCv-xnYo*irNyUK#uFC9^%3(Llq*_8#7jTWVLHr~j zkB_Jpo?__c_m5Qq%sRxj$NH>k9v)Q3tX!!HRZ7f60k{%MO3ba!9N+>mW;zlslcvZ7 zWXo<%Hq)8>1Wz{}{vvittZ$vzh~n;P(Y@*TORDT+npWfGKL{as{-lPg4M?90{-10c zP+D?oYr}PzYq01H!Sdx&b9V&(&{DS-lLGOxY$?w$Jt|?ZJR-d!`a20?vgw!L2uqhc zP^r9A>$^?)t@*P{FG|MAsEb5qSQk2;O6Tx>K}mSm#+7=+-7lB&+{M~YFZJ&1<;z60 z$x-0vz>|Dgstv?=^@eVheJ(5U&^MU1*6_UGLbCsN7C;Oeyqw3jGo}#icSJ}K4;;Bk zekbnWT|czfkM+B#ofwJc$2P`o`$*O3vk%3a)p+b3f{!HpEkFl7z88-5foYOO*CS*apA)K0ltC``K>(udJ$?L?nRZqo84L zD(yqE_xx=S1$i&xv*|yOs{|Dpi)er`S{hdxB9SBY!#A5MsADvdT{wB^ypVX_?!JiM z`8*`wh96miKpJznWAr~f4J?dp1H#|o-1V4$O2@Fuoc=+>pmdXg5j?kfEnwXk`LE=v z508QiJ)8r6jnZum5C6JEu_N}ArEjrF#$+j|A&uBIIj3q6sma@XyO@C6%DOwDu_vz! zw8w?$-v&vY6P@VONh^G>{CV)I+R!?Od;i)e z{+|7I=w!m{*ObTFY4|B<(~ERA=ZXE^Q->lFvU|9@s&zh#*JY`?MKRxeh6%XwNM;he z7B?yL!Tv~(DEm4KeQjhVGTQGCyL%^{NQwXQcIvOLhj?zg{h{j0p>S$qAPuWsC4?d2 zo|zjy5`V-*M4DKk?AzwdJ6LA4Kdg|UR4}AG<=iB?ZM!v@j+al`U9hY_z|u~9o_7Co zH`DWzJ6?=!dd=V<7&kZ)#Ik(xR_SW!moGRVFfR-#?d#0&n%TGYQB+Nq9r8Fh`b@=r z{<`rL&YIx*`{lk4q%?_5kcseXe#BWn^`pC|PQr2PNn3TmS)d`PC~=k?+#0g^ra8Fr zxhhvTH>)c~U|r=p=#T&&Zb9kpH^XsEbjtLR>?PLddpYtS*LjtB>Y_McKIzwJ?4$yQ zWy)%X=78uzX-(^wmJQ)QhRzh znkgNmNLm>X3h)RNe!F&bRV5((u?k5(#bimcGjeM_2Jun8y<=-;K{p6p9YB0eR zbe6N5g!=>r5QbO#!t?Cv_5lG@0tRd8WG-iF$`_hZ-UMdFNxc)-t+T}G98_}jJ~@n| z6VEJa#D|;wnL>R0V&s@O(*`EPfAg5m(%uBZ>;Hr4K0b4n>b4~VKxjKb2PyReq&3-K zcj)_!;44FBL_=@3`((0l4QPypq%?0uV{)b8J3Xh{J#F(3wlzb33Xq{iNY~>QKjojN zLff!Vlm;ikU*1LP07|DWr6&P(w4(@H5P6GTCK!T=v9bsl^t`>T`TMIv^=XnF$qd2( zOui%$D8{zZbUx**y@gLU*{$nO9#Lh{UrdI;)XyB0RNAz2H9(J zRUj8acVA3X94$S7X0HM|J(K>gxO9Z?&q%i=QqN0Yz#}i{9qn3>Y$RZ z%q8Dif?!0^RO2Jzyo}`lX^L)$+5_H3V}U8*vL+h#D*s6H~UDS$}IKTtNH-(z9jJeQ`^{` zftfr2Ayg7&Mhywa7(rD+R5jf!u@{NAvvb3S8GP??w2h0i^9u0bJ!A)(M`dsK3ZG59Sm%+Fd4AR#|b z1h8&Ykyh`DmeIW3Y%w6It-aEa`s9tgcM&m4@TG1>NV6i|RGB}+H(L;uBQN9QoTa?p zL~3E4+QLZ(1eXLcdQE0v*UzjSlS1WOL~7k8!R;-siJd5FV5K9+_aP!T1!@q45`#6_ z129*iB|tdfOGN;BXIU5Z77CI_h$bu$?*3_V&hx5MHAqx)u)3}+d%TA{*13Jvn&9yB zKsr;jL|$kJj-U)tgfXFv_)9J<+Z7Qzv`2Nq+|`b=GHctf5$lF77%P#P~f19sk=$k~J7=0)OZf%Oh`yc3hE1J?L-= zn6S_TqXv(4JNCsK@AGoM;$Bo!r^a3Wj7?eT^3d{ zJ?IPvlI0*jhQblKvgGhv=R?69JUsOEn%0wSDZX;r9rr+nPnK3@yA*%AxJ2!-z4+|jC!eyg`w`B{>OxkCFM?;h$ZAkfWF#Y z)si`4^yv*UV{Wm3&v{N^@~2$^%BQi)2|o(?9p}$Y?2Rk8(){**+Dw5@7J`X{1Cn6C zZw(A`r09CT|5@R&*{DsHLD{glO)l5^LC<_72JNO%p&og49)^PdO>20ixN7@PFl?EY z`}RPfyk-h(O8_DKM@mCisk3j>Z_oj*KfXhUP=(KSfyC*!eped;eivHrkJ>FQ^X;{| z-O3_4&TunhEn(B@zK3@0KS^!R$S-7a)Q{WVPkMfbz^4uT>;0duDTd(uv3G9`qzGxO@!)~}~b0H&G#TgZNPF9(F$YN*4-8`nGI-M) zGH27f_Nr)sR1aeJ8xJ~e{WqZeV1+QBL}0wyswk=9=l)Uq%S;BMVi=Z)1!6#*7H$3H zuKzkb1@8=jXN%aL<5&4Z`1=_I*D>JS^_um^t1*X_W&C0v1zMtE?kfJ^+@tni8Fdj| z0OO+vfyYauk_xt*jo-F@zM%ZES;iNgI>UVHl}n78s_z{s+R~WFv&Y~rf383swNiyA zHsl1REjJ|N)BX?I0v2@W*q--C!W1yt8qcpdmD|HItk?x(Svz}S3{;a856Nz4%sW~< zIVJX*%O$!G15X;!ehDAG{pJbK(}bBJv7_NUvq#X}40Q9BBacAugK=vibm)|cCE^Vl zsqp&t-4$6uzDo)-nV{)i`29ZV=2eC!M|vXypae;=+5ew`CmYA^`;u92GGSJ!K_h#d z5na7t{uLSe$}S%v=_tovzw7o^_JNDh;`*<98qa%pYVIBa`6DjSkIc=d z!g)5TSzhZgrmH~Y#A7y|S8xtzTsJG>PG_#4cZLkT^siH(t&V z5K>=L?8Pen6)f&H`;&779ug1Z((kzp>?w`GkE}-o7G#u*liMnDFn(ZvyiL@VN+rw= z_oDWM=?hgpH=#%0lkPH|Yis^`6=C&;pF6lY{%tUm!<6hg3A;gXJy9o>f4)0VU!~^J0E&-F9VHhQ{zEGg`y-}$Qt6VGjDm(-`H?j%>Z@N9wj!q z!HLO?@DowC)Qd|3n$TsLuOu;QM%_r{SNHS9F$1>^Sr2Cdm{!D2u<~Plo;LT5Am)IQ z9YK~Az((sMdZYlE^se;v8(umJjNkJCE*%bmZhpZ(d3B!;sRTK^TXr<=q`TdZS5iX& z{|!;>x$6l;jZTX~Zb{8?x$wV%XHesekiyr!lhRyO&;+x``5blycyb1jbo?3p^hh;r zf)a$>X9?8m3V3Eptuxr7YWH}%p@B|$oV@VLnAU`uvJocT%P^Qdy0%@TxJ^ zxfJpt{n2czXv=bTb8koT~p+e(M>xHw*;^#^C=nE7+0dX zl6~zLBX$#g_$%0IpAu#XC-#?Xd|@-MM=62jG`SuW<-7*7?`hE2ziCzauW<&2EMQ$= zjsh9H@>q0py9?v@4|u^SaZmfWw*gTD=FA7EwL1^;iUc|ecRM#1e~)dHM6Io%?*E7{ z*R@X~e2{L>L$9^&4eTuCa8VQ@P|O>=%E7EKA`1lUQ*(IYgp;=DO*Kj{mEqT^ zlT?QUOO;}+uu5>M6u-=g%jqKiC>-x^49PQSoX=gfGZ!@?1K}(M8){XVnpTK{$=1Rv zXozaf|9Zl`Pc0f?ORkr@hO2Egr}TW4m>6f}fA&_w;mGgox*@f_A^;}1#Q9VX`5B)SYm#C zK`G28uoW}X5QW`Httdk+`PlxtD!u!)M;}-ij(Q_9-R^oO&qy7l#kB-6K`Kj2>b_YY zhASGUTFa}TmZv{)_tTtCRHy{-Q9y#g(R%Kc&ln>lkQN>q*RRh_hC?W}v1cn(v!eI@ z@y#1gKq$A_;8f(K;VPAu0HY}ejXLvZ><@6JqOTOa9Od<{N&CK<=0Ryy-omAwX~o7A&~CySuxyZ$3HS+1fp|`)jJ8YG!KQ?tc2|yZh=`!}H1V z@6V1Tvg?rdOnR35fc zoe8mUNw}RoU=aB9Q|cEq6Cd1OVUP>yFo6BCMA=9(rVS~$Ee?|aZ|{~5VxAkGBI09D z84=fK3jhtUtl56$#C{jGRGpLtmK@zx+k{b%(KnC~L?#199booTdg4JR-{ijsqxmMkI7GZzFt=GXlCFmBK?BTd4v9veF(Y(#8)H!9?vw2jzh?5Xux;?e% zsJYg(!$4y35(*8=R%J+`En1~iQ|Xh?C#=VrN3_2vJ+}~NMa->Wb5DS;?{MY?nM?7Kggl^5QL{n*@QzxYv0qTD7;n+ndMX!QCURWA?!J6qd?bKJf@5_QGS%;7+UZo04`$Z7j zb!#XxWmSRE!NMVXw^kgq8HaSJBUt5iL4Q;v5eX^D$BLsIN{TeSAOF{R_ke5BIYH4u z6+U{H;Y+(0;ZKp(vw1x^o3hR=TPcW9_?d>X-)X=d$B(Us%V}fI?_c*wXxd*8`gTm(OsYTjafxr}Bx>nW3!xXHY}9ByUJDN7fN zz)&(>HxpdC&(Wd9PsPm7j;PLcOMspsew$tuHBYLCNv*v1*037qdbhaNAj2@Z=~hG@ z0JdFSDUG}?k}mO{kNSXC7{DS6p4xdhQzJC50DOhM+1FI=)2*~48yVl-3AYn)t9k%*$>5m&6_ZQ&Q`4jcSP~q5 z3~x8Dx!O~`(4zrc1NQDMITqsA3^d@!AM9+=oHWdgxO1ewz5o*^OR$5-8=hr7Hd zJm+iIsq-Ai2t*Mnwy!(x>(?Y+6adWzG#_v4hRHJ2@aD?zAR__TU6wFO37WYv!SIsX z`6leD(a%4uWXq)Ns~arzon#{p(@m9&i%DoiBDOuUVkP(ba|X>~dwo}WVHX7mXjfrL z%@(>OC4C=+?`LVg?iiy9Jjl&&E%hnAO3Z8y6?NzB!*HEFzdEnSg&2D4FA`M*?UM&9 z`v-A8__k6>K==C{xqsOvsOak3sW+}ncTd^WxO5g8FF8A z$K=X%L9B1~aG$V6?EcUgB=l}z*B9R|SZybwEuGyb@@|X~V2DOOlZ_)UFMxh;q`5yT z807S9C=|efT7a=1MZl%3(Jk{d4ja0N{eKGH|NP66oGz)diS;MNIUq%G$=|rz~+NBQ>fhp+dx3rX{ft&2JFlg)FU6di{B5~O!jiojK z;`+G3MpgTg=jcS!Usam z3u`}cot7J8>#0KcQmrcC@~~of8_uYpdjigqD&S5_G+SY#HCwOa+;FaiF!lrx3}z>9 zLYPUWidAw-3Ak;`{eJwg+4K~hq>!5B1wP2#@bw2biw>2Wl}%c#e_{6N4+7q=J%aLH z1{{_Flg?L#5rq~GR@``A*-Bp7utL9Ge}F=nS>FPx0sW$v(ObQ4@9-$iBKsDGyhokU zmOD-hj)K(*wdC8B$Q;Vk(y`4V3pRtMWI@Z_l32a%sk2_FAxS|%&v9j2D9zG^xOo>7 z&-Ad`(!FeQ_@dqY>P!zjk2C2D0Q%ECsuFoO^AGptw!7hYHDoz}a<+)KtNwG5dA(&j~ioOP&n)4XjebMse&8}6=MEyu$OMku*yuq8@nVmTF$e4ohrb6rd`X1-k` z-Yxq(oNFO5SyaIn!d#-BZ-u(PFFS9BLU*-FM($4Q>rZx77EV)s6j?TV)Cu)idApK5 zQ)Lp}BhQX&>5W&^6QqxwZwHTbrnV8?tP=oVM$|y?3ou0g*c#C(s29sN8Ch<1-tkVN zB1$GcaCKryFT@Zzxq3W5WmsrtXSMLhhN=NGE;KgHi!hR@5yV zEVMBnyTAj(_Zs!hKRfU~5D$rGxCUN_y?VblvvY@cR~K^NHt6(QIFDmus?UM1yMMyD zP~5lffw{Wulbh{*rxOy3P_4w~`9XCeP|1C?MdDMQC@iDHH^x97mDCcnlE8{s%qt>@&Ro_~oSghu=&#*I`@E6NN4Mcb+vZDs}+EZ;ai6=ux2u%B< z)Fr~AH+&%j5xPTTccNTLeIL-bC1?xWLlCfMv*)Jt2RdD_eJ{+q>&6A`f`p!K+T;O@ zRI*oKa_(BY?{EIcokY6oa_NnQ#^*iv$2D(rjXMi}(i}lhx)*>ym|b@0P#O+A6(>dJ z${h*v+lxzUTrWBSQC#bGeBAB0J`)gB`?ihsCz%(^{iSYTe zAfDQl6oSL*qQv-7?`k#UvS$pLMcZkipkh zItRFhGxL|9UDm&D(`XFz@ohOG(DL24hL%Ir3Xy*4474U>di8$a>NSVoX?-Hcey;WO zwVr8;z`y!goXxpw7NTX~m&PudGs-xc(WvTHR9*+c!>W2pWsnFzR|0keKX=BF@oe?UIHJz0!|JpYEnR9ZS+>ph$zB#J2l7v%Ga z_;YEYwLE6V-Oe==W}Mh~V;KPanX#aQJut>_==~OEMPXjy1voJ+g96=bes73iV6gB4 zs(p^wqDK$2!|&W^u_NTU*=4JIyy3wWZr^khp|Zs6;S_5jLmdFn>J@H{Gj+YEON}Sc zrb<$Kh@D>UFeok)OCXoH%;N0H3$lOQoi{Y$!E>;$kk>YKcph3i+dj6Uu-XiITsaPa zM9IZ%s+fI&_DbvSkRvk~8E^H4S$019$$8je6!^K`GX5z$nS`&_$8)y9j*tWW{q=r* z+U>~hMH5QRfb+_xs$)zC|3Vx}%u4}>rEvG6-K=B8usWRgEsx5VR0}9j5*!CIVn-8X z7iSmZ&Mdz_WgOX*EF~?1v1r?Fw4sZv#YEyZTy0S~64gdLm?c{AIrX4RIobcV3*|p7 zOr$N?fVVvtOn3R*;=*_Mp1$bLJh9FxNR!|` z))E!c$eh9sfGPJ3R`;_1{52`KlI~eUcerCk<$!E%X7J{|1t%CJtGAr1R4#&uYoqkIvYa&2Bo&oAJ1rW9po!P|oG*Q|F7-?jP1eIt0-&?ZSkI5qm zgC63HG5n21C;AWKySrzPSf4zkHtJMFzMIJNW;~n7L*lSv1}Sc?*KFIf_7fzpCvWqX zqXc2cRS=~q*m`U}?jL5~VXR3ngvEiT$Liq?PQn)aEQ=x6&$7=!ic@2)&NvncJ+GYX z>{6f(01S;Ubj~>J?#qt9K{E6dDq0Lsv$Ni-Kd`;oisoiOJ#2Y0B0>8K2cy7|HKgdG z94FDYC1jspgxRu$fbXfQZfzWg;e8VR;XDi|vPK6kh}VZL#;_N5d5Xq_Jhrl0ih)-w zhV4X_Q_3s9tt?c$z^cikbYb^Wc+_c&H^ZTpTF~@TbsQCZ^rr1(_rGmg#q(Jw-Zv%i`q7{8gRztx~6_1 zi#GPlMOns@ajUJ(_tu}OX~k1rKj3p4$mu)}eXr_FRJ60qA2eIyNN5x9G*E%zvU+Cv zyr9uTqRWZ#x;Wh_f=UR!&qgrI}%K&*;3AIvs30nbxJEUXCByPQD1Sxx;HREc_EJ6V-ff+6J zzOZ$z<0RfEdDc@?t`cD=n_v=x6OeHgpq&!7qy8Mf5At5liMQLcbwMR}hdk>(44+ko z(54u~$M-~e)ttyCdp?8TKM^>V5}DI@Z*_u`zh zsTdqpT10X<<#D6esqMly4277JrAAOJ&9D7oOM%n*Vuh|aQ*jXqHlC&G2P5sRM;8=} z--x3Ed$fm37i;iV|K#ZwjSF}#>bvLbZ?|Ln+NVx{uf zxzm>%oW1@7vxkVEZ?(Qg==1~P?Tv-y7s*NWSo8W~(a6n>U6FPFgVAoYAXlx9jtP?F z&3a3rqM5)ckV*<3LDwH(I+fZ!qPGRrr|>bjf%T=UONdCOVC}f?g`4TN*$7{H#{&bh zn+7+}`vK5$+2n1@{+3I(aDA1?P-^9#<*I3hXP#>pVg3^Q@?g8~F7-wkFFi-vEQre5p2Up_#RoG1whscZv0rJcfI_?*vew;5-?R70nXup&uCHP9g zDed2;g&8V4T?WQqj0#7gu74aOQPnrLOLk%N-gotxHL522h18be`e_=B{T3d1h?koK z*TTF?c-B2A)kUDp$q&;{p2^qLX19={_7jo3((vF4kD= zF?x{TB{@vYe2MceFfmXDY!Fy1xklB`(Fn24q-31~6_VD{EI-NNm`qCLXmE5eM`o^k zF{n~eqV3KDtEGNd#Lv?RRLbB^e*d6-LLlFn=Z2`UVyxEQ;=IPN;-PpJg zyp7&}&UC}3%IkqDxVW@$CJ3nZ2upus8fUJ*$eXtC(NkDdivHo-Qv3SDt2?oxUR-;+ z#dJ{fqy7 zolTqwu%>OU?Q%GDzgQo}EjScj~JCO?sxKVzJz*po(LUp8Rm zUBTBgP7R=U&jiAf^b89vj^ep9fLy$feiqLt@f?qMy8YJgyK2(5$5ki^0XHOzDFO** z`#q&~y49anI@yA_Tn6GqJ4ts$!4q>k5|g1au@|ZcC$*B==u8LSZm>P@ zfazrbMYHjT2no-=?hrgl2nrt#9S=5Oylj3V4Mh}}>9eF#>KDZGX#hA4PRL_lSpMCY z?*Mx-s+!ShwZ%dm(FLc&ibx0r^gGv_5&NOGQI8Y?hQ&6}Xfijojkc~UnrBT`q39Eb zFgXg0VjOdBz*jnr;zPeFQ9P4uzaz(?t0q#|psohV)1;;E?RQD9hd^T)8S!W7E3xc= z0d#(XNb)Iqmr!lDRHWZwuS4}E$?0NU#1T?VR#^PbjQg&OW$YkmmQSRxVtD#N z^=+^N4vS|%8QRD2jTBq3TBsBTt(dxKV+a=^=v!lxhjp+EeD+&n$$fggI;|?dU#cf6 zTe@aGqIVKLBLPPIPy#y*D~CZ+k$j2hXBp|7{3?>5D2_#34iZ~f7s);fGor43{&m~8 z(3I(Jzij#q60Ai@`cM3!9DL*#QwB~fpZFeoEzY-_Xx?t7Rj_K6PZa|gec*a}A8(yo zay-65WIGF-DW;uyNICvS>`$Ob@b;=LnE)Dj8qSCZbpeM(YvE43?-j^!GzL?!eRVj^zipREkZ zt`ZOVW=j|pp*0PQ>IlBA7HVdi6Pa-QH|-gM6nJ_H-XAul*D9Jd8@hPJ88_ODnup$v zbmVqej|?_$u66&LULQSX9iVuVA)_WSWfX)?TVsQn(f0Qzqqva(oiY#pckPfH zmHC$5iLHm^!Rb)qaPWD!hq;_;SZLq^^xO@h zDnh5r^d<$Utt2;lNW73^0UR4ht)zH(tVX$^k7LXFB58#*S9)HHn@8qq9>Ad1$w#f% zl=*C<+96m?31fr|oX+r|Ct3%3nKA?S)nE1Ml9Q{RSBR>bc-n?!9us1)pb9oIB z?n)#s*F4unI#`7bgOhSTgl|>hu)m?9)a^>gAZ6G!q!G2%YB#+aVs=qp4H`})TPFBr zjR+>|+85eRcSvi?BS6pyzxy=l#;EkNgq?C@^;InIZnxl3+~a|G^7=Q^zJUzFG8^(0U59q6->WMu4)*Oj{(qd{Cs&&sO>bqp z`rof5J@jMj=wxOU-Y)90iS$ExR4&cIzUh{o3|*7e886m2X1x#apAw@=#O{G6a>0!& ze$6FQJ|<7{6ab^#H5U^S4@vx|pUE&a-TMreafSPJjrkCnwlkcd+4)h_&g2Rm5L2>$ z{#cRniG4K1Ii;v86xzM3sR^ilxemb1_8R)moAaRSbO_??mD)^!GZ<#~0yj)UPua(X zBy_0#N#cw6&a>tr(X{crKU(!;<#Ry5YX04#cU1_lI_fBXsz1`hefML( zor=fX%6z@Kkn4zJAzz~_i z5vCGbgfw5|4%Ovl0@m7YRn8J+k$C$Sqq2r8mZASE7oYjPropL4#7#_Ivk?xs*L5n( zZBnAn2^y4P60!HiKqI3eBGSk_rlFH~}Ktg{K`JteQ9g|ZarhaC+SSV2ysG~F@pwbtfMdp`Lyd%kp;YiV(8 zw>FcYhVlnGs+XBWmBGpnDvoI|eghhzik-<>cV{k-J8pLoE>kvafAoc7z4$oyR%(+# z6Md95*tId8a7@NHfroTjl%61{B+R)BT$aQOE1O2~t9cs|$Y?g2w5Kuh_BCF}NA*zM z1A*8d5PZ~qQ2ddt>u8yhAKTv#+I{P7Z}Iu0-v%J!c_ej;g!3-6ER%jRlRthqOybxf zHoQ0r0*qrs24+sjB5UV0*8jox$lGGl80@#k)qS79S?BrJwah@NMDTaNrVE4n8q@v| z7GKXstc_SdmrqCD{eTtXFvEln#>`ue3*DE$wK;Eo8!K>x0W3FnAFuPA`sH;8HbsvB zMdSqS@r#e67P61%4khWYX`AXR;-~xj?8rYte2`oRnKQ(r^3rLW7Q+^dC_A1-ZR*kYZslbD8mviGQ`c~T-HlRq$hi4R_u zWTJ%<(axM^XDel5!6N^uGlJR6LBKI5u3(vuoPJE*&8dKAA;SkF{lj_~JO#wISC2s< z$xwtr*i25Bp+hI)nD6DuZr09*M>{F6jiJze5$M6EBvfYhq}V{%7-9=w((!~yD~w=I z%R}+V8ph_IW;;#kL~xt5Ea?jLB%Z^v0gMcc8n?Lt!}<93q;rzJaVMi5E?L(Yk!ZOa zJPH=Of)Tor0wOih4Bzi1KL&2K+fnH(EZ+tU%RMn;YlAL+);5i!iBmT!s+x8agripk zWBn{%f$4&3wZ{CY19gPRehV#`e3w;?a(k>Q=#=Rc+R`Gp`;d>owiq%*o`3b%?-9QR z&hEe&a-Oh8sZe|C-ry~KDTvmX>Udvu&{!83>&)*9@E6g0sC?iOd6UDdT`+0U;4AQ! zjxp=6nf_O3Gy3@>8G)FXm|$Vuz8SQMI6>+357U9g_n^Oj@+{1ZaUT6O9|G_^LM^gA z`CV=f;kNr@Q30h^mO(jNkniPnu7he(;9t-Gl;dJ#TIIN=nR0jM7r;oVe2uU_{P&s4 z3mHiS+2-1haIzJg6-JStW0u4vS}CR2T|$n>d7Q7n#Vq2JJMnPY*70 z&@ip~5C-dZG0itZ(~%EtTho8(L&BZ8`-z5I(wKAbbPosrRqhHXDx&CdfUxrC_}~nW z%r^Y^g_`uVnb(lij-syMby6Y~+$<$t`A2dML&SGfN>N)`ONNk8|#^ZJHuh+vtDlj(}RyvQbF2v6*=MQvV6-ZkxJp^AC$|d4R zAqZMnh~i(Ihat{Kv)V3T7|YSY9L-l5A|UnSWqDmi$lb*NafeY4DN5I~6($&U>}~VD zL$@jD+7gHyo%jdFF!mj0rd@No{=ByBy*MFTZNQo)&Xcxz zEpJ{3_x-;Qxii1Fvs|aH)x%-3Whc7=c>8~3QxjA$UKN~fFF~u!aAkQIK}zm37|^$J zI3ZY47vTn6;aBFh*ca3pX20!nV<}zF+TqgXVCEU^Uzuhm+>e47qj^i#^TJoE*`&3jZin0W#!y+J z(|$MPt*cnKFwx5ub2weh1X1q&?caehfTOyamDTI!;LAu&e@GxCOlV`_m-9SWQY0+{ zN1aq5@4GIH{Qk}V_{x|lo}kAU-iNsEu5_CUY@Ecbub0N3T1D9Gmg-p#cT>8RcwV_) z_MQv{G=R^j4!~P*sY49~fP7+F-Ex?)#MOqMJ$teHgC$T!#CLNH?i0Vawa2%S=3B0yK)U*As`!jSdfIeCvrK(f0@dV@SdDahh>V(N0cq7$fJ{!r$b`S>jXbz1Q4(TquYQ zj$~weEh=-}{2UfzNI-*_c++V^ht?7DJy9$N+Pv|`HQ5nb z8mpUh>l=j8PaiVG-Cc+9MfXs=ODnxFGInBa2`5qd4=G501;pcgku8Q{S~n5qS1Ot# zmzcU#7apQQvc91+R2<7lOWpl$rofs$%!?VLov6iT=$OniE?Meqxnf>s#=tY40?xsf zh>1MgO-H&n8!!@!Ub?~=*cFmNvu|j`dTZc4Tmq0Z3Y&gdC+ z8k#5L@C=RZx8$Y}y2D>*`N9?;u8U(`!Psl}d{XCN+&Gda5f%z8 zzSeY~dRbKQC#ZbAoCPLu?Fz^$R}N6Uh%&NR4!)iZ6vV*m+W*3C`H4)xDQl-D3iL+Z zhfOOB@ojj^wfkCLk7|??My!&D5i>hP92qXn+8#cDdz`#A_odsE+Q;}T9PVf+BOW_c zi#dgKZDDHy%Yc_W_b+}4-NVre3f#AzhsDIim~nVqpfQ;|PlR!!!jgK3dfY8qOlh}I z&*~kR7H7G`Kc76`ij&|$q7vFx=i#7DHAFoM!Xnp;hqoes`#CQ7oXKiFlG^(D8DNqj zKKs4;cbyq7O7L}#o!JuFHW}k-U%{r$-%4#ZwAS6oG_GC(j{(@>T@#1r0iPw*5Ws0%C@+53V- zs_+CfCk`K97y}h!rMT9S2(N!>YtXVyRPHXDXny{%^po+GfYWuPF3ur2b`RFwq}*T= zg-I`;C>VD!c)@s~);PTmOQO`zCy37wY1vLp(xg_IPAF_e!{+lj@JscIq@$K= zRKcje0~$v%`cd?UbQZF2E#W(2nw?9o_i{zC49?j~@;*AbZ0K-!G&!H}R>3VRo#mZo z*$3B(%&!${L&5x~7PS27b=N!^YA8%X7w2+!l12l%Y3EI%D55pS@}d^=(do2|GhxC5 z-4K{~vMR1=8TxiJemCHAozU`B57Z^44C3}DW|CVPLHtfMD^MySaNO_g`lkn~VI%F)kpJn~Q!h&>u}HJV7K}ikO17X5sT>{g5x}>K zzIf@0c+9)_!E!#Q+Il}GaE>*nsIXjV{0b)vaCGe+r81( zUklY=H$rd?F~%O(JU_RF>D6%P3tKD@`ENyJs&}64)ppak%}})Xpi_9r{NW(Dc_#g0 zlviDiCW^Ru!!d46yVlLsdutp+JM#M>K>;zl8WG+03i+@C%)lW8(YPi>Xp@yYH z<7H}?5fj*hv=Wf7^4A6b<-OG#_y-#-L@y_hY#~9`Ftj#mFgq!jk4)m|9YjX36iHm2 z?qWslJ25tg?7LtagcUIO9nkO`b;X2dp-F?2Sz^7R`n^7>TEw6Iln%rWt_G%YQ@DMV z44AH?;eQ;C6ocFCGQRtK$d8_{;4_CW;geD>F1L(wCZ*5)RiXkeM`( zKrO~z;Y|1H$8g_*Nmo=o2BwNh`Ad@81G{fu&d}AzuohMOOeb(t&PAR8idff(1eF+? z_WbJ)DG!vft^?1?{Tj9jrYnwPwY^}q(l)5g5;>#sC6qatW5m1s(QHAs{ldQ!9@-sh zenq@^&45wS3{kxuG{kfS2}=hM4d$#$g^zeJm@?(Oc+Ea+@LrJw3UZU35@-EQ-u`j+ z{Le3eBxYa&6L}sd)eedBPkF!A5Q z3qQ9>&p<%`FiS@vdv;3(qFaAAiia(*El`~Ie8u^;$>cy&*Z20z&Ez@)tcca{I`Fe_*X%QdVZaa`aXLMR<~9@)paxThOcNZT$(WV5h(uqea&eMUn$ z8Q93@00&9~B_pr%y(;cvd~JL`&iO~OYv6s#^{cn0bDeK{WTM00-g{#>BF3B-?1FciW%4)B~Mw3c}EvK@mIxm`H1772Y zIrHGOorImHbz@vv=ks|m*^rqu*xY2Ofs7J`vm7_x2^;6?TTR1IBX7))C{l?bbgm@L z$8Qx&R>5p6BVk0>CEY_lp!_4kn(N0d?5jGkz$ENXcH3!DB}~E6Q4Nkn$<ExxO3I<*{3InZBTKQed=iK=D?vabrF<3Yf3Z%-#;fZ6 zn+32ZMf!=|=dc5*E_?KAVkYdUKImv!^g+>&vxFjyP3Kpj71GMy%)pld;bGdNrp&*A zFI1I0!=M&3C!I@8fA1#AM$MxC;{wl2>ZU%xBPLaQs)`5RK&s=;$SN z>GT7_B4X>~-p-c;a@fW7Ln#C4nCVk%fsM|uQ!@-zO@c35`y$gpe6%%p$o@~JO$S|w z38O#(gXwmd_#~-ue9fDSX>B``WBfsxe(mcSki^3CtX`2@T(DiM5CkZ^+%_iEIt@+OcVBwqpG%IBSfZ4LEH5+b3yg@S}-aO1H| zz9aYTXr4*&c4elmzW-R;gdL2RDGh~BEx8aaO}&cn2LT;*J4y{{}e&$3v25Hg@O)6*Pn6fAuD;zO~!tbMENJ~qSJ%x^C zzOH^&dbT5s7Gb;v?erp&U-?4WtH^8$nXc;jE&`hO230}GaMpy;;L&y7}!Sg@cRshFDH`2zy^55#k zpJRaVfNkJ6=$0cfxtO59yl6BnA4t3ggG^9p&eHZ^()2dpQJNVqTVT?_m}I>2gz79U$;0KCJVI8wA{;%?U{9l?1OD_ zv)^A?U5`F~g9j?5w-wH#rx%&i`Iq^jvp$ziSx!Y=#sXnnrVJbZ`)l zNr3Ow^b_gxVc&mj$8(D2nlG()2JPc(E4sz$IamBj7nY7C0oKn8cmMN1*yxA}L^y{q(t=PDp1fR zC@Lc}1I3-4s~I!xapOVZfDUt0Lbr$Z2N24*o6qp;&>d{G3n*Bke~23n#MaB2-IU^8 z*Oo=TYiht*DVKy=p8X&VZeIZTQeVHvV!WcFPB z=i4U8)`e>?SEej(E?%+wQfnBBBJwg1yhz#dE5W$7!kC)L#`!Ej#24=f54liYr#CZQ ze@bq)Rip;@F-Nw+dZbX%mwK9e+|j^{kC(^#aby!0QLl)myhTtW(Kw@Vh9#ZihKqfM z6QL;d)7v{gliYJhap+c7#qIr&u5GIl+G-;Yp4@bRYc9cOD zS{=nL_Fbw(raIu<$J1?VoNv~G^5s!xxK^=^DQ2Jg1th)Z{P*7XKcBt-{GV4;AkEu# z&Syhj4A&i};X_`uUcW3WLc3N+_8fA7F}o$R{zjmJ5EcjtJEWW5)^)Mj-3?TAru5vX z6`Q`U7KKwZm2&&GV8ff70P;;aJKc%)JkY#uHjUZL7|#&&(l27K&_0|6@2&{<`?Os~ zXO#+HZ_CmEi!z3^LtfkF^jBie8{|{5-|ws+DF*zf?P21BO58QuZe@F>S`rPjRH5Ey zZ#+`{_N>+O28M{seka>XLW(It3*&x!8cKFP6aO}-oIsS-PjXlF7=*dE2_sK1PGWp{ zF7yb)+Nr%k{0!U1n^1_%LrygfkZhJ}@N>%Gy(n`ZebLiUX;hV`?KJn8hoG2H^4O9- zlYRI`F!SQ{h>LK zwOX-GfIc=HF`m50^Ot9-ngqmPX7^>#?4A}vE59KW1uAk$cwyl7^-d^bx|%&^8dyqR zCKVZ_V>Of62EPI`6{y=K%M{{tuu$KLUVkIu`SaR<)*UpFGrh0ab^FG*Bwf>1y{;Ss zRL@cg5H*kTVw}&<56ZNSVLOSEsUx=RKrVJ2UXGVx6d_VMgVBl)8NJXR3QC=QunBuk)C7ZI6Mm|~O^*gwU47L1v=QeIbdGN<{elgE4R#C&>cA#?F` z@drFtmO-0WaeVf`4~O;kBh>!=u~at7M`m|`@GR#^sI!K<>Fo#lO3m)3uwu2Z53mQ% z(WIk@7O6;;R>IU6%Hu+7G=I;#tTcU}7Cd)}4Sey{IsS=wuUx@G`mZF@W1W2>(2(|X zLoNJnaE*i^RXqhtQd6paIt>21+D)7){{uOdaD5YEdp=S<1Rn#^9~SXbtP!@3CZt}k zBr3#;Bvg}W95zQ;K4ndY$r{-TGL2Zi=9d|FWqTTtJt?yjP?{IjG6w6XD1k#dnkWv_ zrAu~cXT49lKQVe?t0?1d1zOLN0<{wyX$Z_b8MAJv(j1*LotW5JsMQA)pm5}V8f;nQ zq9b}*`}M^h(M>Bsv!l2C$edWQ>Vg)Q_vBdbW2e)@RIHM|>T(>yX9uGq(~ya;$JhKY z&=am$&M2YM?lPFU5~|x`(}^d1`@@!&o`UM4Q!}aTk<#JTGRZOXOwFu_!I2LEsUAi5 zqPROf;8Nz=t;Tp!R(eXKQc5A*>N1q=jx~ZZ8V=cWsCt0ZvrPK2G*Pq$XR_VTnLWZt zJSp%6VtU1?7P?QAKkR5Y=l>&mWCq^jLVkroJyY+Lz%^`DxZc|@%pM4V_N-f`WtF@% z^Mmblb0Q=Yz%zLHO8U2~(J)1Hyj8N*yT#Uf_n6^Is3i89Lj&{+Ed21>lxjy0SgR=A7 zjD(jFo|>0H7TNh3z{WkQ7MY)0jqO1S)Z7VGAG$~C1wm@1Yb&J_@^jUeRS;eB+2jKS zw23N5ggXR)d+YDiTIZNZ@FF$Ygy(CI1?vudLG(>g+go~}Fx>fRxAPjhu@Ud&vdruc z{Tq*P#nnwlXqdh)KY-CW+Hm}1N}LZpAA7VDzB5VN@xNpOk;t>%Js%?m45bWo0QXu-qaL)g%JN9R((yn>$9To#y z^OWNXY|c?s1TS+g&VHYV{#6ODSz1dLuax?!mAv?(w^M-;3SqjzQU0pdEBQKO(qkw{ zRN)KJ&hGz8i6*`UqAWMlCY#D)i>qQDe*db~JpGge-82G*6o^ zOG}KUV@WPcS-YWpjrMyeNWd|Eg*-JC^;<@6v7(t@8WQF8Buc5{D(1D3WKxESUMsW6 z<@fPePxLey>i!MRM@C=Df>*)q8}*_PSv-%>@1Ew}$>9&-_A`1=*gr~($uwBxIe0#b z>E*-0c@0U<8(`u}iJE8cW=Vx)nS}WOXG9TEu(>gC*%S zjZ_)F`~YqR8K$2Yg_*{W!i9Pf4@&{2w;zaywv=zN7udzF)WhID>7J3F$QYpa z)GSl^_-*xYR>fjbw&zq?$@lzQiW}?nrvucsFrLTWZdG}#!dQsrU|RnGy-02ubE)4H zK|CW&`QP}2K;2z+N+F4sSOVdg6~Q5bF4`wokDcuwZ2V>@OL^@*yI0st#F5F(gB%mF zYvYv4ledX4e_T9Zy znUxuJmdAu#<>8}q?xH#S$^vg+g260bTbh+^b;KFQQ1xvA@rMN$nAyy0#yDHyUFLkH zx|KAC#tC(XOAry+CA&xkXj|dbWNwb-3J(4$xmCW)9RHM#M=W|NJi$Kd19>u*zL%;! z>S%ONzCAu>%HZG@3Vc^Nwl(eGm`{m!mVC2KxM-dK7fbc|NuL8B7?R0$YQ8nz0decpEdfBcp)7-_>{$@lrrF8pLK zGw<;_q02P z>-K7*Gn*`E8Aq%mXxbMwv?av5=yi-rWBAmrkU$_H5ym{1+r#YV&|%l#xRqYj_y&W_ z{n5uG!>()X`Ghdp(9g4!=s$HIBXIT!!j5n*-vJUCeuKz`9{Ar@pD3MbCIvr-mZn79 zl^OK} z)k=U_XUZIwwWI6qM}&ZwMzo+ri-Z$DRap~`o7J#g!}Ns5fKNs^F`1llQu2o=wn1ys zbz2|_l3(X%JB2n#7byDL^yncnNRxD{`YM9|>@GsLvo9*nlo*-ykG4z)%EcG4Paiba zq3b(GEskv1^A!RMa#EO#OE^Q_)J8TrMhh|}m8N)9N$u7<{kg;VSj;@(0G7V6q+Y!aGkK{T?YM6Ts;hP{$ zW*{E-+I}2&l!B*yrnv@+6|QXl|Io_+U&%fW1x%3~8}70+p~HxM*H4Y&P>UQ-X%G>y z_a#+IC^&Y1zdazRZaU|@i!V4=wRO9Syn2GzjGUfGT)ik#j;lI^r8)owA(U9S#x!B^ zaVo_f5wMcH1-i_uF#+rKD#MOyV8<}`$g1^mMR#9@?NshK1GS1DWdxuQ7$5Bm0BV)L z@|GM;4u+-y-|}NDqyp2gkGuyP65Y%>Pc9FeAg$oi=dTU_EpV~=;~iL*%*kLwHjtD` z;m4_%TTX_MArMu2qkkjWC?nHYA0eI_;u-pT+pxy^ZQG(~<@Qu9g)?2%y@2G`GV>XWrs)_6 zt{3T(DA`4%rJKQf@juh$nVA=`+cJR6lOhM8PM(I$h$|IyAI7eGiN6~aX0pa~dkK*)6VdD>eN_a7<+1e|KV~Y$Estf& z^}&H#do)KmagaO9XPWpniBK(qk$HF*DlPo;E^y5=h0Ni4aZGcIf4SZAY~Xs?#W03Y za?D*7+ckDZ}^NPAX%@rJu)lAvb}@vx&TV8bax;;PtmJodjB z`>VJpyZwJ077>sJ=@yWZ1}TSK8bn&UK|s2@JBRM>hM{BVhX2LA_kHjE z`#$^NIpoCw!(3~v>+{ZqJSTLSbcDD+;Rl|G@b_o*w08g$VktsyOSP+Gz@l+`*ub;! zP~zz)=>GosugfV-YxkuyPfVMkc*?c^B-!9+2 z3+$t8+PMdFk_wpabzvlFdot;Nq!;jurE!l8i#CLhG)s+WXag~I#q3FXEkLMELBZ+hdMv^cD`j0 zEB^@$QomGC(wskiN=RcGM7C{vy9z9vFjMtqF z8BlRNd12&1&(hmJ!Pz3)mC0N4+<`3zke&v-13wji7{t6YdyelSAG{l%BJ~yjG{0XV z1S^R)<;TvaMcS^`PvyX3WIYEe@$5(ae2lC->R-}My&g1N`pR^i%KP$^9!Di^T)9}n zj9EDPT~=#{x_Y)Y9G52(zUC&2DQ(}+Kep%`*wP~laZao6LX=|D7HBsYDlFRi@AAKV zjv^S7uM6T$xvqGT@ImYs-@`lWQA4Sqq0}CL8B0$vnf9_3gZtLlzu%SmMc`Ms{&h3J z%3S^avA+GmFtny@*A9-Sk0YK$0Xg>*=}A|*YzOJLGSNEJ0EV3cd7qz5h9Mkkdg`=Y zfYKFaGQI7!4*Z4qSJ$6s|Nlc5zCK>d_lGt0L8QNGOCd|yiSCNjqS&)?wr(uM;Ntnm z#AUQN9S`5bLLNo%3WS#&dhr|AGud%nB@r@4Fc4fDJj$Gm z4m0C)F}(fJkVQ8}6TpLE#baxA5BIl7{M9oCGVUAhsin3fsUPy&UE864h8}bZf0%q- zWwu8&EJ})aO)ru@w<2|7`%@6J#3Y|fu+${s@3w_jzo!&TBRrkY`IDsTy!@ZVgOBys z;FI@*K0TTxm7ZmHQ~@(u2(TKR(kKriDL&#EZy+_LiA1Lk_u{4(^U{Cp2>jw5>tE>e z{Z2JgE95uD!9$+~Ywu~XqvPMu$o;5r>!QnUZ3a*r_{Z60t1Ip+9j~NRNVp_4K z5T(DD?}O^p*K3tp!skhVY>fzXKu5sWop+^Jq(PQc`{TB2uD`D~4~Jq0m>Cy; zB*!-XCDo4*A?mmscftlAXL%ZrCBXY{H$C<4EhPndN}6vz^6rOw12J+z__DOYKLVgT z4Y1SgE_nme*_LV|ySqe=)^K?8R$oy=UE}$bras_tdE6{d^_|HwLs`~b2Pi7c2oh)x08n%HFnr_+AP_0d8PPlDx(SZoW55^L zKY`Du^}Q31Yin93?*Rh&No7=)7PR+iJV!xOQ3h<0EQ%q(RM>EcG`;8VFuHk=^$N%q;^SZlrdo%;mtotZI$S6r*a7npO z$Yr-V0L$Kgch-UPh)kesuP?0Md7D=ROslICR0TxN7D3TR8-Na{lZ=!+y|@9${}2#;;T)U7p!PVstI>ME!Z*GhF)sYxOCsTh zDUutfG?7MLStGuLi9=xs(xLGM<8uhRZG~ZLcJM+_ID+hHb!pt6?!I0d<$;QETiFr* zk5;}uG?}m5i=a%^`98mo{SwgE+f#PdjnkMuPOc*tiDWki$Vye6h}9AI(jCy#6|RQG zJ;e@KX!IAH6;C7=K1`By=(^NUT7l8670$ zp9@McFFLJ~9RCGk z{#kBUtoo?{bGaH^F;u+ZOoo6l(}od->0x$i(?7`LZ#T@Rxg6(IGEM<_<>v4(C5Z*k zC!)|Pzcn0mM_RT1fYT6$)8yVzWm$r_zOplx%xSqlz~`EGijp%Y?+Vf6J16jy2az(N zeRn|v9x_&C?cVZZa{&#Wb;~^%7`Z^2b4?UzfD9d4k*upV05GR_>l8H(K@xY3PTOrr znm5Aicix!%sbR5QR{sU|QG>mfuJl7Sf_-RvD&FF;1Adu7d}FfrNH6E#Cb*FKCRcGt zIB-RWV6$ofB%wsV3>DLcG@k_d=__gni)#%J*zdR?nfc$}p-gWGr8AZ?f#>|3Lue=) zSR6u}md2wBbt*sW{tkRIa_RonecKPu) zVhRtbe!_LiX39J1aI1{2GryzR4eqI|!&A4Mn7?8es0VFQlK|-L#2b$*o|Z6&2GsYB zYN5LWSA`{CFM^XjXrNfhk9PP=vaCBfrw-NnhEfKM&NS5(4KU;}u7q(9l3TY7gNe4u zsb}|ZH=x4UME)taf+Tg80{EsU{iNt$oj!+wJNeGH;19 z#CvL)zofh%hO&1dv?A>8cEg#H7Yrq6xl)hkGz|@HVrk%k23@A!!MG`;K}Ttd8y)Lm zs3~_H7y4m~j^op9rPudI9;hSW?t@1I$Fx>3uNwXH^Vk35lc@C&N`YXr&8jmg0U!eP z%!OI{&X8S%C#y?o5caS4FOE0gx}`V5vE~Af@4*H3A3kN{uL1CMs24ZDV8Z%|9pJ&pIT3&7H=`Y-GU-BfIG%C@*qr3*z_T=laXo=ZNcwVj;Z1XohaKD{IX$ z=(I|2Iz9Sa29(_?)n`lhDu4iyJ@!PUPTYe7xeR(5nh@X24u|20F{rWqi@?uT?!j2_ zD|8G&{&1bcn9p&QbIE{-UH{{+jm}`sKYbhr#EMtS9{-QSkMeDgDOV)Vl0r0&1VEU| z^Z<>&#^Us&^?r-XX{;yY)bZUf7*v$@%INH^KKa#mq{`Be`#w@6dX1; z38sj+$7Mj!QSxdPlLaG+RxbT*Fd2x2)Mn*_{@vSxT&uyVDHJ3!H>s-!=VcjgREw>I zoRld;JIPQ|qCY@T-H&Zr)AK&F0lJy^+_AflLiM^p_krrJMQEAu{d)jUJ^Med!+!&} z#z&%Uy*Bk`{w!k+Hi?2x-XCkITtRBF8Qwohuq(T$((D!AJdxjO^e=H63RL6GZFB=I-fy@e#s7805h;s^xJk!Mu@Up&^z( z?Z&LQG(Awmq`drtLtB&OvE1@nV|xI!p4B7Ct+V0p@+y2I`%dbO@3BPlSh9K)+jWNa zhvJnmt2uFMRvn2h6dL685A6dl1z>tbd|?{}aK`mFd2LCq>WC6A2kO6PBg^t4488dM zx;ZuxEeBd_iT9O_ohf*_S4jbNPRR<1J;&>)miE`FeIrBPA~nA;cn+szV#`RIA&N2Z zt9Q#s4;+FeAgAJW-6{MKl6YO^ckA%Kp08Rd+SBetXDnpXAn06fW95Bpgl&;nTfTfQ zIZkd1^LjEMq0JwadWU*`4$W@bAEQ9r*QhDw*{4!dY4ooJ-PmWsj+$=|Cs-YqG{hXC ztfwpGfBOJNaL~{qdD0}#{@_SlB;dsEakTE|I3fU^b_rD$FLz~ zc$f25V9-N&naBQ~0Yb3Av%z=bVjmm*N;VP1+Q{ds<0MD#q;K+ac=!-6yZn!#U}@yM z*Ki|G=0bY&hoA{t1n?w+!zG{^L=)XScIB=ZG2pWi>JBxd(^@-RqSVg>aC?aHlX48+K zZYD@MV62Cl*%omLxp$oaf|NdWQM6Qgrv#@4eRoWPDLe zT`EV`oJ5~9*!-^YPwHas`e-YVYCkiI6Y%U`e`$8mvLxAAt@XcwpY>IUlG z+aF;h)18v+g)sCibcd*=FMk#N`s}`!E*YzO#eu`ZU)^79}f$Bp|P4eVRSBbCmS~X zfX`m{aW}4BURz5$kl_dwB)(sDx#Y5d!<#Ii$s1E;-E?jZ*YM`^_unZ;?*D-z|JeEP zRS=s?_lg`zo#%{#?KS_!HudUS5XS`7Y842)UhtK%gkSI}J8+}no?3W0HE-?TP2tIOcUnE) ze!v{M)M+u_bU8~`_zrBTW*bNY9X4)ik9J%_c3k44ygSR8_I2z~ZFcbUzH7X*fYHQ7 zJ7mhaTtlBqpOLf@?;?7yotGT{K050Ag*}~5%`0&ail!XFg!8OE&@2t>*=G0lSMDzU zog3__jz_P3aX);$zT#GNj61vjYr1b#AR;Wa=@2lQc^(LlM`Z`S|A-5di@TIw{=-Qp z`-h9Jk>5@}p4SlUWN?!NTdBnQlQ0RA_5O}oT?Z{mNLWFo+68TQ@~4f(@(~ zoVFWa%qK53KJnf)U2y#KnV!!s;HinA_~YOUW}=@!Hc(}%4RQ_&+Q2xZv5KM2xAu8; z%0O*7IwuZ9Mj2G8rYs{s#i_>K#PWLXa&t(_l2YVxF<@D<5C)tY8My^Bf>5r+vyV>uW1{4?*`e}k^6}yP9zeM-y5=6N5KJVi( zmXnP^sOQR##_E=N!Dch3R1DD)sb_*l0@8S3R;k!TS4m`gA>*%na%YM!>99`X4<|Vs z24SeN5xT;F;Zo{PJU#Ti*!HzV9l8&4>?mz+`O66cqg~X1!u4S<;=)=l4otp>tMh`! z0AC){l_tGs*7#^d9Ae9CGwTJeh;9J{bSl7kAgLQVeQ(l)k^D>;_eF@L4(#rWcpOlMSKRyFGO=5+d61_r_fbe z^M?;)Hi0y;FZT*7io3!@I$V$H=!8g5_SWTmw&>)Uf-_nH9Do_FO9u;Kvgp|>U@XeC zp4l(Eje|NOy2a5~7k7!VQY?Zs`KotD`l`Bn=5&EGV%76vG3R2C^5(n!-%Ij8Q=y)c z;WJ+gZzRmoO4EUOO5bk;mEvu~9yd`oGpmyM2l$#+vx=?LnoDji`zMSL7&bM^L+KQN zw4o4d&0VA(mIy%=V7=-qJxDmDkb@l`Oth=%=+G z6dEVb@X0@&rP_*|(#!$dVmdsN%`aO} zoi|LG-nUg)EH+L1OCA613v>20jdulRs!;@|>=R-GJp0$-cp96gfnq$R-Djj!Iz0%L zGaLfOL8R4YlV;6qU)O0EU!+Ez(z`zinnG7TWNUH(!mp=O^S?E|P2rU@REgW9?Nuk= zP75p7z2~VX&qY)#}!jE=?maQSU~l2jmkN9lA0vP%;Rg$f>!>UasuoD}CTgn*@pQWketE;e~hZN`rW zg{668?5CVM?|J1>=9&Ph@;is!XrrGg1vwtKAdP{z=rZr;?We4@xr&WBpvk6$qOfG7 z6$%h?^?WJLYp~SFGQ80%TW4+X8#m4^f|PBcwVn(TEiex)F4<<#<>m?wU%RP?>Q8_R z_6IBr^k_Xz(&JbGjQ`m*|8N0nFNgp|q#?8L2#_&$s?0x4*;_U5WS6dE%7Y_t^fB|MhrMRaa%c z5zZhh42hyvNNA$+@n6vi|LME&>|So{GQeARvpUvak{XZ2p9%{rDPU*Q-fW^hUUgt0 z?vfXTzFWLj#5ES=?rqA^lOt>#+ya1P13^a(e;I#)|5`E3fv0pmXHPvA6o5qTx$oH_cbdBA(! zS07uAxd2c}cZZA}oGqGTb&s1vtyVc{Tfg@S`}pa9GggnT+qpKUX>#w(B74d8<%+Ax z**rQ=)s*&+JYnjKy~O zgf@n`b0K<-?QHFOS+WAbR6?@xwskR(THki^*;@tsBS77XY>G*HzO=Mlq+^_r$^1xDj9pFdpI{be9tWuc*41eLS^BuhAx7Or$ z+My}mat@+hAzNXOm;N@hSwgbi2f^y*SvH}h(mp)TU?v?Dk5@qW%Us|3ys&@xu4_ z?$K7a+(B9Q!Kj#gXQiL-e5Xy91#SmmC7ut;xR?mPdj+tb~*Fhk{$KH6Rn!<31GIY$oIYW2CDr)HqiCix5^1b)W)p z0}(7syP}pb<)7@@2n#$sRIbk9b_j)ngrCQfqqc=KW`2~~7yqF62>fqq_fZ=ybxn@} zxRtB3G?dLlv88mk)qE8*%G9?Z+rgSgkguMsxFWk7ds9V&h;p4P7Xe7k`BHt7qKwBI zQtw4wm^~}Eys>oH`F`M22H}%`H}cZtjhTp zXXSf45@yUG($lw;r;zVGea3K|333*JrCJsXJvpX2QC z;L!MPTZZ6W-4+LP1cB_DQo3z}A|qy+vIFqxS|mCv|ri7%{b3T>EzT$Vffp0&G!v z^xmk`sHrnmN-UQ__4gB{*t`;P4>S+qn6lDvx9ZTj+-V->nuG(pZc zXFIDv{HU1h@hO(f>rtJ*2y_?eLyrqyxXnFawmiDm-bkwA4Z!lQpCHqx?Ms?T>+&6w zDg-wt_!ZCQW`(zr5FdXE7kW1!7}TyLNs)1?s%@+yE_hIR%A!AO9H)Zaa7bo5;^j+i zyn5P0je#lDeDQv95z`tiSVP~}FT-|+HHl&){s4aC+^-mJUbS+z z`)MuQn%lrm<}^ZSPA9VeQE`*pf(*F6YqgxQI64K|^nB^f^-OmSDi9dS5ea7bA4+~{ zE=Q@;VZ3@H%YhZ-aF1ySvRn&Pa+ksYg+$t_Y@9@=VNGooDA*FyEpRt%xra#8k)~Ll zB%72}oPv)WJRjjPK2oLzgd>1IFWL4F>Mvrty|%n93oH0~x!4kka;4*J{OM|(;*r&| z3_x#@XJPkWzF*!v8BEqUwzWv5gR8rU!MLR;$xiJSHst2P+Iub6Atgwpi31nA1tmW4 z7q=3%Cz8`XfO1c@BBi}w`v}k~nSuY=I^6Iw}m*}Y|Tu*3LdIlG@(?a_=Set)oxphPQ0lJ7L2%g=nY|-Sk1+E{?=`3VE@oyGHF!GS*Uj zV$D|}%SA6tadi3)DSDNc&gwyo9dy6w&rESW6~#MH^}b;j<-%8I4-fR)-g?o>)Cw0P zXL(bh7HWHa(IYsG_#S09zAB$h>-bi4gPz4p$DQXxl^2m^W|c@q-#$Hw0r=1W5b6e0 zv$rdmgwDk^j7A#qPdUD@O;Zh>OwLME_$#-XBzIJwa+Tl*4zg%T5t+0aiv@FQNn}Yz zb8C4UWUeD;fRse670z?Ht01s%&R7RG#(=_VhWr}Ed_c3F*oLgD^_zNv1RoX7D|gpB z+-v#<#(uubeX6Tq$*3{TPrby>X?%dZ=e9Zg$_No~3tx@Ws?jOy26EJ;=8!76_v0LK z>?sv+X3#K?g`~MG#l-}aAjcPE+0zGUPHsK7pvk!ncSNuz?Q;m=8ma$5tdrCS{WTlK zL#5X0*jz5_&fT8kUs))2;(N6|&3gSgMhKu<^?o2&Ik1c!>2M)VYrB3Mlo}DK9^X*D z8=MPbZ4CEIy#GL+GS-dF1N9?24dvf8WBfwGSI!pP&c)pr@k3}Jj^yD-7!S%9U3c{B zsdqe$7jqWIQ6GuAukCwKQTVy%oD3I{S*@LJTONpD^fiZFmAhZTNtng`qmpFm;F1#{ z|vvZyd7{}R+AkD$}4Djmc49~;}hr#?MwBR!bjdgENjk8Xmvi^theR!T)u+jp=F8>W_LEi@BP%YK;R3 zQ{caasX1dk28N~E?N%cFxXxSO@3tG1C>$r>sv8a8nO`Kqt_tf`^Jd-KJL>KsnRV_E zk~C`Bok`F@^xRLr8w_oa*vr5EJvA}HmD@}A<#jjH?sFujs@CT_)ItvznvM%rdTEW=?nV*c3uH@ksB-m+WKO1GMy$ z@kZ2l2vOgZ|3uw2{18;TBG7h@gA@$cJo=SwzHDfpgHN8*%w9&|G^kufEReOg|HLvh z)|#C{Or$1+@D!V*s-U-kT^BX{ntkD&z}syBh{20$>eymS?9ZDFqVMI3<8*ZUB4T9= zd&Uph7~{MWnO-G)aV6_FiJl(}qXD7Mylcr0+(zgFZ(9uXt68R*KL70oTr5RD3Te~? zUSO;;Q`Vqi&!WCv`xi z?QH=g^r_*4Yf4K-*P^6y?4$mH!;~D@jX4ST8(3mfaGS@d$DnE&v75YN^$72ukK#4N z_9OWc$ez#Y-?x9fzs+*|u>$Yu?5QG%=J6QJxB5r@zFpJ~$tO;9nXN!?GGTII>hB~` zARMl>!nouSEFX7GfL4g^rZ2XTI=-xKP#FpVd^wr<4Job1|b zF>kI68MO2BsUi8;O)c}ubVPFVBH~gBsmE}pl;$~@Fc<`b_A4k7>7!?%C5V0Vjg&w( z^#75LS{X27A=Bye_LrD|@rPW(fOPsdM2s6|V(w+kIQBxUWt?^GazjN$vCN`;X}&RH zo1-kYE;J}~;NW5jtsa^4l|o8gWQ3u)ff8ZeSn>49B>mSCJ$ov#c?yAQ{<}ux(*YUj z)h}^7Ygv|=h6z9N+2|bJ=%c6cGebL{_4mAZh5w3PF0QZ^PrXCLW3Az}Me`$T(9YS!T{)hNzdU;27SY(Xdo&w8?*Tl+1b05byKNJ zcV_9C;1RD&e4{wvqRG4}UCk`sprNZ`v@GKP;j!24et1T!7$Hee|L`X2VL;gA4oNVTaGU`>amF zL~Y{h?jJMKSPd`M;%ti(C@!1-7mj%gZ{2IbeJBxz$?s6}!+K^7@+xK~gtdiQmzdrG z23NUMZYNTKIT4f1^x5D6VjjkSViRXL|5TAP?EY}7{}gE2+hYM0#K(IIxGfyheO7yy zA3NwySo(c}>))VYNI1gF>r-P*9ckii-mkSLqLZcJjByj6mPRhlg&V6QSmAyvk80n$ zf0>+~Kvof9D?a&U?>YsUU3;were7G^0l^oF8Qrk?POWIg;KO+yOCDDVr}Klj_D9zm zYT5C2lwf>KYv&TIqv?yN=`_Gzf(BURhK^cIyJka0m8$!YzbJlACEP$6sMITFl8M(4 zjtIBP&9PK_NkWuP6HHc^c0+Z7ZnhcGJG$`Nj==c233WA=3WJ1fA8vEl;p3n=jj1qWbv}{43!)d|#mfS$#$PtlhyPlp-VapbLhs z4fS`sX+Ji?u;2A?-9^-ZBarjmf62Y4c{-;9N^0EtqF29E9K4OBq3!vrRPUWBvY%}u zll?M7a2aLWbv1;%N0gD$x$1)_7!h9w5hfiPl+_br9UM(9u1^N0Qv(KL`*FjqT+pgP6@3d$-@@v|5H@d;l3~b=1$!FzXuk+TA`zlm>KrI@*1S){6^J z5$db95|4Zd5BAG{dKUkC(APt2eCXQKcYCugN-@_s4l0jx?nr#CZ9XIIu{)8copAGK zn247iYn`oN(0*7OG6pZkz4{N&jOdROYOtp?CKB^nf_N7ilM-NqNa0(&l+k4nY)WyPC{|L z`ioan$hmned5we#$GR`pAg6twCTc3SbrU%m7X+J14(~KB1Xa23;sd*biEMoiC)mtN zabac1&?(x#y8xaQsp%Xd z*SlM7rw|`Z^$W-gkK#@hw~91#SlL>=U+A6Kz!>e|S6p}@0Nm@+V?>w`238E&`xB2u zoxXs(zUFWp$lA|pFi?=B`+qV)_<_z0T2f`}4g)7jp(FzxlJ*&u(Wi|4=-2qChB{(h z=*wo(++}aPl~KcUopV)0S4K7Et&zos({o5q3&7Og@0S9&$-K>G9awvky1oPbU&YKA z*A9lw4s{cQj)WmQJp|5K3xbil&_uVLlf|uJTSK6>k1H^hDS*YkF` zgHe%2iVt$)E>-u+SE%_5Wy;&2hWC~UubuNmee#*X^fg{=a3x8_wzy@aP#3Y->vGvX zqLT-X1{Z~|aqD6Fyzk*rso}fH97WQcjsUj-#*>`2V0XE=8c6p*-QC(u(iKWZFw_D| zzkVf%G6M^Ygo8&k^U}U)D)avWVL_K9|E{*pm}1jb442qz_~c&zjQi2WKX_0sZswL& zMlS-FlqyepX}2%}~qB|1l$|t)M-1_GM*!7OK3) zUmc^+8T*3fbnnt0NSDV9P6nL@k5>s9_kr?8_9a!diJp=w)px60$G25b$6noURg<9P zu27Iixnd)a^NG=H?}P5@vg0BVx%-(C!%||Q;NzvE=l0Z)n;SZY>GJ!V-0HOsB=rB7 zCyI#T2_(+{kX2L6F%}A@>aMPc;2zztC!4S4L~Z%qnqHt+XoBoe{~m2pW8rYUmT5bk zty|bZ14%s0ZZ>6Jc>$Q3PK8{#o-sls6{IF+Ao1Z{JO3)UER- zTO5lOKjfAfh@g<$`r2!-sm50Qpkj>gSttuHRSRgV!qX3qWdoP`?FP++TUW~bJCQt} z7Ce6j_bR=a$~G5b~vSc zGUJzK$zq2ircvxoPBip2A?*67q6REjuOEUAaf-5x?ObSa?F`S=WTP9|zxP$qyR{jj zc$d?w=z8^`BaRY>|FPuV;v=?eBqnhxS`BNg3X%;64Vc@@vLSE3dy|>r;Bq)Z5Mtjg zTYo@27t=S>>r(rPemqz;TVUfp8?L(fQRCG7Zo7g%LZKlDD`D~63oAe6L@n-%Qhc;~_&&c3*;&2@N6xnSLrV+X9Or_G#-Z=$tuE+M+z#uu>eq+1 z{t00OdOe&7j^V>^`Gp{zqr%%A%?`wa6dad;rsgJ2&|625kMfP{e=A&-z0ZEN9ox~! z{vo?L|4q&fpwEYwqk321(tryS5JmQHyI)B{XI(OC< zrJx~rK|#c9eVYy3DNgQhFldI0Y1E9gSh%cehr<2YV`W= z^a-0tvXj;c*%YH~Y{#3psJxO7KI?--YVkx*rGkDuqSZzw-!=J`0IRXhr(?)7>CwR< zZ%n~(em%OzdT`-B?p2Vkc1hUx^{&YT8i6ITnWvl-`|^A4!m5io>0u1;!tIWOP#U2h zCdHqd#X$4={pYRPFR>t7Eu|JGnul)dB)2q^0+$QPH&1q@|BJfxluVy_`q#;TT?|3M z@@)qi3+2jQO)u+t!@SO?6b!GY-FTMorZblf`k9qm7TV-@{K-6wu3+5r_7Sl(Rp3Y%ouk0nF=e0>d_60{{e@@z}eg7 zIDnCezJn7RfulELGqFlNZn9lgcj$~a;tj$u%l^%{hIVH;htv`k>K+Z29-dy8gr=2$OeWa1Or$QTho4iB$z~T6G616eGfY9bWqf7DOu||T zK|7EvjLNeXR)2SjW#=oo%e?xLs2S*m_Vt+*>m~$JtO9ovFs5BgqM*-DRY-*q%>9<) zIWB$LqP)E(R8#bhM1zu>{{~}b#Oj2#r{pa(2k`KJ47yb8aNL2a z#`=S3T26Kudp!VbrR@0u0AUq5f80LBL6%DZw{0Pt-b!ox$q0q({;@u6h4SY2Ezq_p zwGOZjO&2<*i(Tn_xDN-8tzNy&`QsQ!*VB-v))D6YO|i)BwiV0? zN%IFHhU+MQ4+*b_g@tCr^)tLq+rQp}L>^cnQ6_^Jp6;$DwRRHz6p4v+1GoRibOK$^ zz-y3UqPxbnVKVMJehtykvCiQfI2X6qlKExu*00mwz%`&vrdvw;Xa}xfnkhJ|SIzv9 zQuP|1VGqD5Mbse0W9omuaEGj{Xx`>mwIQBU|5LCxd-~3vpN?lEF_DEOo-V?9l2Sy( za7mimfkjt2x;sOii;aR-s*d3oBhzz@7cuxa8FTRpNNT?#eoGqt;U!lwoXpwggx92| ziyN>k4z8Hx{ez870u3OxVKIp5{Nhi7!(m4>@jXzL4NCJ-C5}Bobt@+di=5U}SR=Ri z!&T)~po;2iMA9bJjRHoV&4QqlF4^%a^f^-)_?m3d8 zdvM%MjykP%p8<;zXwH{O{b9{Gdwi7gSj#LMZD_|Gxz;wA^)l=Lm^tw_hXy@$e5u6& zEz^Ts@N{SvKa5-HaMw&P&JKg zQCOEmU z&2Cecull^wW=%S0+k$c5)?=(UXSaCk(fLm37toLmG-a2(Lfk|dUvj@(wApU!Z0BeU zRhK-NX!>frGqTSgEB+R4obeW|K@YREhS%q$AUx9YWz&A0YQ561qi zB!Xq@^7??oNwLOBXnl@CH!8Lk@He+3l33=RwE2?~SI=%zuO4}}a1A7I(plE7`km;v z$iWv&S4?3bT?sEL6yJYuMLHh2STfahUc6IkVgarQQ6mI_p{1uR4Vf0f=d2B9{)4gS z?El({UgCeeob~OG`1FgsnjobMN=Fq?(?tPg6Ccgx1G4NJ65gOY?X?$weVJ@RM6FNT zP+i;OkcqQUVLRZciiPqBrgtW(iEMUm=Fw-p_4W8gw1%{j zFNY#aDgXx&aOD=bUSQ!(bi3KhZ75UoY^o2i)^R#q6e5Ul{61mcG{rL_a*mE zQ$qpV_2I|edyqzr4BvqrsM{_yI-VCR_EYoV$-pZ`J5A#85I;*bC$`NBm2#<(#O@y? zCn55DbGNO%93`(Af*mgVB3ZmL!m zA7+tL`E47$qM&nI1**o1KmVj*V>lPG@udu-;CgvG1%I{;ebA@#I%r=xM>Gi!pYtmv z(|6)0-7o3sg5730UNJ&z(O6X(jea(b1%>#va=8T&Eq+-y2`v%Q5D_Kn7hZNAxbilQ z4UbH@7%>=s>C}?bc>Ov)* z50>vQYTz*ccb8uX+JeJY@@fDC6Fn#8`Vm zHyYR=Y7NVr zyd6YleDu5+LKqp(+kKoL_|5}i+s=;YuMJr+pnZ#it;7)by+zqp`fb|hH*fTR(Ko)j zA#kStn1AVzXA*sTf6`T}>!$?K>xzH8DXwa{t$XwsK1$*)4pys`u%K(Liz2HtP$YA3@L!nZon5KH}O}zB(IY)LeUwcbx z0qx$&t6K@ynD6Me@9dPm$`0(fm0`^AE=wD*-2QSflj;}WGCDOe=Q2Zqt;c15W!F=w zVj559EvdIEhNdHi5YpJ@ZW}1O7WsfSIrAL0@l9B_H%++ov_DKIbKxJ9u4rWGY}n78 zelpzss%aXi9$LC#-?5)vVI_ldKJ#0as;V*B#Z|puvZhSKK?XI43(sM{C`L?LfUfMz zqjHQ1wm)x4)eOr`g8jrx8Pq^EXCW;fPdrrbg6rRzOB#LUweACyyOpBi@1^PJ=JK{O z{YG|;wFwy7Djr{(Or&>g-lRmzyB6W*Jy_*otn9!ahy<7E(d+34sVM6AU_q9JxygxGk+nj}irme$O;0o}(!4n{tkE|Q> z*!`dv7Nu|_e|0day7zdcyM$W8SN~AI*KUeA16;*~`K`N?;GXGDubpUB_XH`a{ut0p zdnv4e8bgOu_+Dfo96`^Kt>^N0<0;Nr=r)lZSuJbE42`GPb!fU&efNzb+v@ zIv!UL!V`2|d3f;r*$+9l_}9nIrDOv!QPF`4OI!C#gOhAKyjo5dZu^35<_kncE-xEw zVr2gQ|L*C2Ec0A7c`pl1dFhocRSWB?>9<{}4pB9y_ZQs?)H*+IdSH9%_n9#}~ zcEb8I{E9#%Ny8`G-(;3j>oOQ|ntH0urCz##XDVvfT9u*GpA9|?+vud5@=Xg_-8cP?zYxr8V-YrOVj+1$6JIx; zRUFikjpxsDn;Ia#Q##5?>c5M3(Cp3MR%m*RWV~J!Z%VNx-;%Ui+z7~$$nOVww;Jjm z=7++FxjtGXo>;nj&n&!ko3Xj2=+Skra)+N;==-KKi}a{)ciCip50mG^TTya0v2M7p z{zJUEDMlvhhc-G*(WLn&F=1>2+)Y-qM}dP#OhSiPSUJ}BWQak3DtxL1Y9i_%BD`EN z-qAH?n@y^y#!SBoo4}!dI1YOppFZPg{^v`5I#vF?g3J`2q1*6wTBZ5oqYMk&YB|B$ zke=&A%=JJ zhdjSOu)!{_JSDAkqW-lX&=9>4-fZj044^fHX)&RZynplU*x$36bSQ}f#6PjhRe#!K z>Kg-P4jkJ}55c*&sFeXV6A{D+VzZkGLr)Bjvte z7jGlcwBoIA_*p;YEPoY9?9P3--Hw$0rX3l~Qh+b!h@bm@QL~Rv^K0Bqyjj$~0vwd2 z_or>G8L=MtH<#h}dD`TQp-7_9AQvGh>82`uJOem<;5W;}R;H0*-mjS$ zDcx*G&HhI22CcFgik@!g8oxiUL;j`vuSedhMOoTO#R++!CO~7{@?c$Lzn`=jvg2$& zFX4XF*&W{$$PCEl##8zVBG7pC+uk9p0$h|5Bah5(Z;=~Ce=nFeJXW!U{03`JDv+j0 zjpAO-6W{M#LoT5yH<31FZiPyRnTBK+H)`X{2)2B4sj1Gde9?nKe}qrg;f1W70SMx4 z^nB)^9OtRd;9P=Cv6`P$NV|A3O15Kv*et?6#8+16NIT|b=|q&J8?n~2%bIHp6qZy3 zBUCY@+CXqo`{O1|hl{8Df1RAio~udcc~q1a|DlQN#~z#IK`nl7xBXt1UTuxtE!tSX zDh`%UZWn~0Y}kb$ZB^*yk`aw0eBCD*HGyt>I)Tbz5`iZrnz!=FYoq&T9v#tjgfc)y z=zC45v=Y3TY3`5?1mM z>NoLNhE~wM815{5?|DX+cb~;UJ<3>6+DzvJF7+}jbgL=8hCaj7=Rp2nfR_Ub#h`X4xp>gR;Wetu(lvc~25u8STEVGyDI_n*ZUk{Pm(W z4IPIO1#&x$sb86Y_Ih!9saIQzI}gdl_OD0719$V_y)1I;wXE3Dc&{!+eR4{XE~EY- zMKub}BKN1MWdCQ&yh;zmJ*s{D7X~6e^rPLsAazyp2Xw;rNMaGE85xPB$=rTPWkCuY zKLf6^=0Cs2K9n@|iyEwn>cY6(+wagu(wY09-3f`NkJ4dUT&2p87jj?Ut zN|^5)TLU)|c$%#podD&|*ZJng)=oO>Mi-=s)au|naHDpUL{z&vGEqUHGncPXsYa^D z5X$Eixq*i*S$A~bTbw+2L&~ag(3_iV=u|=8Lab(lr7caFdd0ek6l^-VUSXQML?0hk z9H_2xy|In`@AA?A6hGddboFk}hdzn?(t5`3bt2P*;_bNm(^~G{s>V{TUuP1@khiR55bk z3Kzs>#NA_D`I+*IViQhF`~BiUvfR!9!+>8jm|Zh!^RAy4!cxJTKP_F!>0S}WU5dh( zH?p@&g^c2(NtKSHM7bY`o7u-;qw;dzKrWifG*r1j%Se;(!GW5Eqj!$Cv5pPi^^0Tu z4i;1udp_9i$VrXX-)N$gUDiHo1|BU-38oqg?kN3QOIfsk*_NYiN5>c`nQRlrOG9eU zZwYUwhqW=0=8R^;M~eMMYGT}EOmoxd-t<_@jy#yn@79r#SvltQpo=+3zvt`iwuy?? z)K0?(4y?7jVO;fmlL-FG_nNa53|P0>kymT$>QicA%|t4-(VeAMQ$Z@_O%uA#5#^;#X@U9}$7s6Dh`YLG|w4NOPQH=as%K0m5{((aO?F9}5?tFmQ zbpw{sF2=SIDpI;fT>aWu<)2`+73mG{KX14D9eh@u*5g7Dd2*|X?5i_e&-&A>3}Z9B zF$nta=)sQylJz@NUvg0}Ewl0>yAa-BWuaixGymhpYrS(h!@b-f@^+qx7pX;PID@38 zgMLuR*aZs|^0Eb--}{BeR4C}Y>B&nW3I?Jg|(QD zSL%%7*@T*Gcj&^Lln4AON0}K6`)%&-v|0q6K@P@mL)?yQDh4td^GKZyUp@>C0;9$a z(&+{f#J+>h(t-2oWa_J5*CLF46DfEzR)XNK4s(SOJPm*MX~@8FkLE%0!Up7GyD;)^+ju=kwz7XWw?#H8@Q5BYS{z-eNr)WfeNwNOc}BE5AC47>IM>vv%VVa5M;{TEvgvXIb~cj$6HG*`FRXod031XT)PC zsb|l7m`qvE9CDORd^#+ap4hr1A1lcaYa2#Zc5gB%mH*d zNA)>r7cyD=@D`lOC8>Tz@&MyUFy*T0$i<7Fx_gEwEt)@MV1GB=ki2VM4ykA%Mj59f zn)=ssX?^yp>Q*2cw6ZQKA{*g)B1*nDg+!{p=N5)+#f_0@n1*6h{+z*rxpFGn9G>v7 z-qtMBrL7<$2zv%TlcEx1$5OD6si8+_n}cSXkgopfNgs(bCpASp5bM_V zvtHW$!H6gryz85DvXB!j)7R(Ys{aGra(Bt0G|*#jjlP7es!=F0+EinmbWq zLexfiC)`s#d&#!DhhYGSey~{^FV!R;MIVf^HkvUASp`~t1I~7oQ9sI_B3pgjJbj0fIVfB-Z2VK$s(YslJq@rJ^gasPw;>Li-RuF3-Eu7t2y zGKkNZW!Xj&HAn;y`bnPPzf9^(qIyqx$%`8+tcwyG?Ko$V%`h~j7>aJ;pe4!Gc-oPB z3)}Y(OO-?bU>HptgFun}+OJkrBVZ+08pDNElrCGX_gEhh~!;*U~eOZ3g z%}W@?JOkvS6OpmH(IH zIv?oRUIW*4=1M^^K<>^}S1+KtGN``mM|{4NAhsC1UV|;BcE4;Py62w$SGQnTu$|N1 z%lu!E3ssU^^k=T5*qfk~aO@7}NXQaQ&cKWtlc4%h@=RZ1?^U4xLktb{psh8zedISz zee%XR)lx$UIDojrXNleAIF8 zNa9d1M0t-TgU>nF`T1PbIC3eAwU2>;Gp9QH(W68`Sra8F_-msi`}-4R zQ{TzvD;TAQC{1#gKEw+V=G8`(gA3&Z$D)3wI|Zc6TJq$}y1o?Pm9|$nM)7Kh_K4aa zG5&>nCfM~RSRhFe`ppPt7V@&|PCvOwq)46XGO1{Rgo+lu+`hniOx9%SB6I13;_WHf zu6h-HV0cE7)|7#-ntOL{n)Kj!MONjRbf-}d3<@FkzB zw;ztJlK2AWjK{>`u10%Lj#%*XdP!hxDH3qfpcwX;w z?{W6AYCVyne9)8%Q?(apzxH+se@_aR1WQaslIz?g>WKBdudLnW)O0LwH;@U$S33l3 z+a6=|VFZE)qY`D~+^qC&uVtvDO2Ll67NPlKa5dLPT7 z;qA1d3GMK9G`h+YdF;$N3koMX`vC_r1*X$XZKl3p+%Iw!Uc??h zKVC;r?|ja@C~@4L?wmZ>5PgIl4wr9+G&M*)J_~q>-6B*uKLL1>ld3G7%cum#$*5o5 z(C<}I&tCnG{jSCPzXI9+93^SUUV{5|5jj3H@rEdBrsClUZ_JcG?2Ip@Iqi;>aiUBp zg$Iv*ecsru5P&uVOE`eh06Ul~f9#7A&lm3bDSl4KrKahqWA9HS6&s1{V{%djUZ&S) zsg_P68S`cY;n6rmC%+@XOO)9_cT3C9%KVwipvYCANfpUC#2XlK%~q%aryI3rpy%&1 z2I}s#l+^UO%Sd(vE^FkMMgy;pGE}P&Xd-!;%1I8%pZGgIh){nPjdw`QR*&#EyZo}1 zQiQ{~NXSTn_ILn@HR8Yxus_nx2WRsY^@BrPgrUUf(zMH1`gAkMydPHhe(dL&M6hke zx{g~bz}@`kZ~Wiqg#S8+e?*3JpGDH0x{&7yXG-Djj0|8k8_Tz6x-fS*B7Wzm*)cnV z!s%k4aIN3&Cw0D(C3zcpL*~alq8wK-xMw6#Zf%8wevFWh5?+5-EL@=|B3aJRnP6GR zcNG-x7+phE-}Ux=@)d=vi0oW|>I~bQ#Xh}kkE#nJOdv7l!_^C;#xJ1}NN4F8+Q1f? zf96_BjsYR?etL{Brj%#O8Xs2?-iiC>ew8bz%}#dghN!7{Qp)W}udZ>?Ys7$KPJO8k zK11djv+H9HHWZ_SC~(&z77faE1(`Sla?6m#S9A63R&in!)cnU~xrDGX66iC4P>5V+ zf<;=c^psgq@|^wTnfkgVZfynp*}zG2Zo9qID!v%g@{d@fg&Sy5QE8f{`c$~h(9Sgp z@jvwg*}v)s4u8+Tp9=n(Go-!rYM#Tm%3^36Zp<+J9U$3ll=|Y5Vk|kF7#10XJq}@U zT0rPKzhI+!(KJ<4>!oU0&?>b@rG|J2>j{bO7B*YzXuZ^-2EjgbO?H7N>yO}NDRAVo z$mb%G&#Bya)8+Kj0ub89?#5v_s#QIjhFZrcKR$GdIe9ATake$6GG9^{Jc}VzvJZ9i zXBaPQ*oeGT+7BLH`7RKLGg$$;77Kt@Fb`(Qck?>fsO1LYXLoMN8_Jt&6_wIw6J6yQ zUCtA|i7c%Rb1AW&3qah>?&)gZY{%TMJ+`ZxSW-iO_TXr<$m~I(?bsk={8Gc1J}M$U z=F*f}4lB;567k2tTz|ilOd=#R1qsWPqP0!T#Ck(1{3F@(I>LmZub~mEL#TiZRx1+m z<|o_$r#;7tE_g*$09}zW;F>LcjUiRQkOR}dprcJOHmxzBI{o!7f-%y^b#ikzypxsh zQsxX4mkMUJQ{p_ukR$%DPx^nVvj0PXlQ=B z9~Q=AWgDg>U!nI!gRY8&!DoC68W2gP)IJ99X3z*SSePm26_5u_4xr7vYjl!W3G#L= z1NB!iPLgBEO0Y@=8|h1&8#A$wUgoAVviyqwa!hMLI2P*Y5Zi^H09v4%R4P)u`ZWLx zF7qc(#Nu+xsL-kivNalVd-e7(A2eea>h%_P3bYduugme3oC6!xN z$!z{^Q|jM6E>m$`|0~5-Y?OC6reVF30t_ITV02`o;FJPPN(kHH6j?#{_o~^feUJLk zI4_s?;%ZF82~MY7*a(pFaJ2f>EP=W7`Lrx^uzPX@%aobcS}E&9v34Pv{26bChG8YP z!w1&!ru_E;3HzVxiS`JyH$##YwN7H0v|?gs-h)9Ef^+2v=M7j9It{%JS|Mn-V@X+R zX4{ry{j*g_D*HJVR8}FEFav=Ca&1}ny_Cwt#LuyD-x}n_oL^~7D5=W~W&0`7@a}I~ z!|;s;-}vatO3qc7V*7w2G<_Z8a+kbCi|%<*j86VbIjUiTRWq?g=8GD~Eo}aI)jbJLzB?;{f_o(?nXORU< z_zaX1a;###yJe>6vI-E#W{~>pS^moybdLEYDkVP@Z?joSSxPgyx?%Gkg*jw)7)S?Y z;zzqQYeXw)`}SKJG&*Q1L6}L zux?TzpO(#X-Gu<^^Xt{rCkP85Z$>m5ypDny-;!#)HL<9TcegY08}C>=5Wjb`I)eHl z+x8S`;D|3p^!Km@r9s=(eQyK$cWWUub0XUutnAO6GcK=#rPXqwWIm~jh#GAeJGNoT za~4_FL6Skg*abNQ@4Ww5#-_q&I&Q#=FZLb1)kY*(k4AXK86m}{AlSA0|8QjQ`;|!Vz6{>?QBqb@>R2&Igjtw7eS#(BvpYx4lyb+B7Q-@SE;)Coyi$A~PX3*$&umyxg@#!DRmYcO5_? zNxzSklxoX@Cg=_$wVJ1gyZnKft*p`r!IsM4C3ajgt?V#GQyAxazJ^AEf}_}D_x}+p zrjltkY19W@AS5Rln8dE7KZ;3yn~a8bR`@5rp$ZulU|ubQyE0k#ZQY!_NoY=G;FuBx zd(a1pEm^_hJyxYBVr(V{E(cjn8HgkoaX4FeeLASpEE(XfnX@kyAQ=a|Qyf%H(|y_j zrvP)#3OdQDbm1;G*&d1fk}S4LoSG!H*t;T-8a^`ZMdh=|nZV0v&_{y|vdK^+z>Axb zi0Ol=i9nU&NVqsvxg&LCQK|cLHQ{e)uPuYApw{E}(w7w>kNt6?o1##cPSxxqYfWyQ z1~2~dpgM3Y{TK9@f!T3-Bdp&PLf#8Ma`}l>15yg9@=gCt0~OxiO1u;k8DEFjrj64K zr(sP?G2G~3eu$o}$zw&uDxy7v_IahIVb@Ee#-Q>5nAHMU zoXWdwT8U?3Z#w%WQ;L4h3^3Ft4fSoa^bkasY;Seh9Y+wnzU&5PeJW;~%66e(X~M#M zpYAG3M>nZbJY68^*t6zPtQosGnl92YXHiTDl}TfkE#W(MU8t15XAIz>@j;P%^Cx zU5PU>g{lYqBq!>d$ilU)by39R$$TdboPvwAjYk{`8?!Xp@l>|+V;3AI9CVB-nB@ed zjN{hz@T0i>Q+;U|w(Xad?HVZzIAG=C9+-}2`?(ZMvmad*r`utw-pMcRQ@~L&Nzd}Q zBoBPTkrk&_+ikV7eWV`okoPm8c@`VoBB2=@_NsI~u|yKN?+ghYVdx!Elo*-GK;7T@ zDW6L+DvTJWAyKD`Pe`VO?Q``5>Rw=!gze0=q#^TfV_~n9R|ie!H-B8%ZTl#N z&;V1l+!8JOA&!olQ$C-@qXs%n$SI{jm%Yh9>wFiBw>uLhXdAzl;Da18!f;(O@a4$N zW4_e~98^mCb(VEu4M3K&3iUetvKuPF4Dm(Udz5{5agCg>kQ!qujwYdiC^2VxsZE|( z66@wIv)zUQ_#wcmmVy1mtWjduBl=iJ&BVQF+01oNNB}{y7LJV%Iix}<8J+$Z6djjW z$i6nqI6GW7KE3lx2F)@Sj=Na8jMjG`V-B?2SrunGuBM~){7t_lds|)>xbQL#|4@qp z!&r4s?Rm`S(uQJmB3v_OS;tr&_T7FzXAz(os3*NTVgE6ynsqB@0b6wF;>v zy!fh89RsW@?+Pz}e)|BJtZ%ArOc#GV%hp+Y?@bNu3?)dU;Ms%p%bFjwhdP%?p8XW` zmEm3K`{<&1MQ;>bJa98R5xYC)opQ-4Xv1oD4wJrr4GFV1YgQAF>CLLF(i~F6zUko? zX-$|qd>mqvbS3+Dkn6t>vpiDWVDP#l!n8P{W0iKQZF_CxA&^(3g55bt7dBpislJQU ziUAVA*3iqTxoW@~!TjdLk87->UK_ldZ3~cUe10E$k^r~Z*-a_NQix^Nk&j(k7uM?ru#_#EZ;g4~XGb?fkj~GZ|(tVpz^ENHs z#jzt3ARz|GWiNS0Mj#_zjGA%$Nl0xA1OF{-0#74xwo30aD+Z4!=!kEBkhr(d2^$s2 znQu%Ub`Hw=sPO%)1e+aIU5(sc9>elS2GB-Ze2J6Yo#J>5#289SiEg9I=FAIyXcSYB z{X9>l0b8;qjH?-g>+jR3p{n`;%vN(%w#$H0>TxO<>~d9aVzJM!pkI^{SUzi<=xbFo zOI5^U9Q+*v0qtq+-6~)*^PJ)~G+fJZa)HXe)uzaY!lWu`AkwI80nd%dP+Gx+-V0n{drvgM)H<0si3Lo;*Jv0VL%~!ROQ+tliW#B! zjlwrOSi~rW#SIAyE!mVug{wSzSCRH3$exdEYsQy!h%_V`DRdw8^9kLUPq8XmMVt#Y zLI`w^Qz@`u8RV}ElC!xhnWeB)r_7in1%+h)OpXj)?lk0+1uK7idl|y1e)i%=9fL#IA}->dceYUS7e_nYsbag=R7XmmvY^R3nPOu^;x4CX*#* zWAyuZwXtU~iFVal3dPkIU&4EFJ6v|FaPRGjNWOcjwH_1vz0@5yjZ{>>75C{Ew)RkUDopcbw_|8WuHa?gkHd7oM<)K$&dAk_K#v>(=XtB?vSp9o z*bvQcaG*42ICuVVhGb?6SqP3~=;AA-Mb7oU&pCa$PN0o!oVRSV`Qq_dzJOR-%Rkzd z(CYM0B{Ewv+xG@SlEdSVc0je7?}bKbOhE4|KN=JCY1AB=4X%2QaG4;G{1`b+nK4K^ zTS3r#bHZ#6Yjhl$*6|d$Uq$nLjoPVj6MZGfrPJ{$LNLG|rEs$QjLkhh?-?u`5O8dH5&mL#fM z#_sF0y7dt0;G_ja*+6L~0oJ6OWQ=z5P#M&9=OxPhg_zIB9@lmWi1*GjdTwSHjohoc zZ*)I#-KbkYRb(e}9_X4#uiHL+bQcQ2 z9jwm9&xtFuaV35(E!%jk&j6CjR`KVr=i>aunvYZOptg&S(|%0uvmUr)btRRZ6&x^@ zfU(R$(9F7>+gefI8@H>xefvRnLw6WH@y;2%_81>_=XPc_FtK3CSPS@ON~`E*-B?lb z^H1%qw~kHhAaBYfb+*BONr8WJx-AvC;gmFTA=S<@=Hz52JNeneNMHo0zWahg1+3zU zj{PmO!+9l)$vuGC##i^p-dt$sQg2#i6#;P5i#`onPxYgvnL3?ry>k&ss2OYZTMm7E zx_3Q4@;*NJ7wPqXLQ`LnRvhcsdqQn2j|wc7L==e;5`T~4aOUb1@;R95-2LVOnYdLV zB&^mff$0QvccK)Vxx~jm!Y`xSnZD}=cKjmsGq`kts$34tgw0*Hx8jW!BlLc5nV=ra zjiK?N;`ueMtnKpsR&D#D^YYMcJyj_8THsu+Ex@<*OSEptFJl5tudAA6N4w;sC!Gzs zDdvJETk0RSxLU>pQKpccY^GGr^Rvl*rw#dy2tC~=M*lkAe}N#Q>(BXv*fi%V|=`7}LlODFEBH>x{$^$C^zZ+Hg2)=|$*I@4OjYcxRay-y?L)J#2Fj6@!C)4c{vUUq~uZ5O-o zJwK!gkNcJnklFh&R^(_0hadPeve5D##&tLCZecmf1GEC8lOFy{RCJ4TkN1S>c+Je2 z7VD6liKWI3>lnp_+1F9|6~pbOxhav+KRQ(wEetigUF$ZHvz8+1eLr?;O00XkTz!W2 zq9h#Q8maZ{S*C=)We0Qi#|6`my}}cHKOiB(v9nPiSc9EmMy4qa&F-vF^_Q9qq;lEN z93(%_Op(-#-Zg#u6i5APFd`L-BjS5Q13B+RIi>g;b2=~4XG3l{VfRvzDA=ZZ9dwSf z3q3d}M>b~Xb>9p+8um+oS=|o&xg{a6=&=zdq7d4H%p?;nlJNM}<1|pG7ytG#>5dLd z+hx`E{+;O$PlsLNA0PCYBfiG z(6Dbk*K;~5g60EQh~c?st^us~`1`G^F23d4;j$(0zPYlQ0JtA>*Er-lm?xargU5ZlGqOEu zJ16URC{*zA)T&+E?NHd+jP~A(pc-7hB>wg45ryl`vcPTUcVCevp$Cf|0>Y3;@Y@aG zzqsBUn4pa^9&g6DIk)C}xNJ9s_#62X$nqHna|}|YZub{joNDUHaIe2{FJ>$m)4eWU z4~bp3c*4OaH1R7IyehXnDA(z6aC!ROv&+l(4R!zYnTZJbIK5p5%5rI>i$~}~H&;7H z%Wvou3jch6;mu-18WwVD_vOCldH5cb&4n(y;!JaB}y8lV8YZ< zs^ja)64bqy1^eeD8l7b{5N}Y6jB!0K$sSdo9|!wxmC3j=EP2$g_ZDMYRLNv6Kau_{ zf*fgxhb}D>RPw@*w=mp|0AOnzM>NGDTzW|rYjdCSP>g72FNTW-zkDquTGP!r~#OSM(EV)Q$qC)*A6jn_55Ip>v9`6QS$*AT29%+E&dp8Z| z+GT8S)1CR$O=z}zd9 zE7!`4Se+E25Z=9=xx-kkDbNSek&a-lCDqeg04}JO*SGyyyTRC@WABw@6B7>oLqqGO zn3t7tS|nP;y%pA?U~)|0O<-gO>U8U@tvabgRqsE%!B2bK7l7wkmL!)?00wozaCZg7 z-9H=N!l)D{hitdobuU<9?Y&q&(UejQUDLLJULR#FESuZ?sAk?q1;I4pc9Ek6t+98k z0LSg9+N5#a{*EsCL<7eD{e^V-PHh?D??Y zX?ug+g30l2gZ%7-i6G%%S|V7eaffUynEj|%C+qZ>!u9$d(Dcjp0F-KbI?QtAUQKNL zY{F$T>3vsu-75qO8dJBuIG8m_#ZZ~IdWw4_JD8{r6)+ACYYN5IwDoGjb9Ocp)l@s< zBfCG$X~~9_trQe`(v{*Zk*>TDWcO@3w6Z~#6S$0Gnf9Oci@_9{(sC2H>^bnBb7dTI zn}x?KsXOa0>!+pjtIj4p^?cg)?AWgy)zxPxs0;1dRx{RbkD@Otnh0@s?B!i}JvC2% z$VZ=OGd@&O-HTvZnz8gDI*>juTHlaVHsZZ)3NMB0=4-}Ac^d`}6Io{N6g1riE@R z)$_S~G@~}t-{gv)!+A+F-rj!4zu7V-^OAp{XNuY(UcH_i1!eB zzet>WG#O0%cp~Gfbv$mTumHYuYJIP)N(wk}J{vGX*s;@I6?sI-i=-CX#v<*s)e$ACb9*Ar@;RWDc&Ftw`#B}Irvq5H!y1)QBZ8hVlsYaV4Whug z-+M)XFh42A1!Y-OeoD69J?$i$*qGp@wNrTGAAbO}h>O{j8(JBwNMjAdF4T%^zlL%;q-j@L7^F?5PEaP8 zHi&BPELz!mBsH@nr~w?F7Z0g*DD4XkwXQp;!b-fSrkD*zY84nQ$6OcCm+0tXC!dd zp|`I{?>DH0*B4jZV!qvEk$og>b1FYBI!>{p zbq?0k?~c)>)k$7?m#ZNy7K~Q3s8WdEroLY;+*dq6-z` zq0(nnQZV^ug_Nnz+TgOq4Z*2>EM*1kh$+bTvbRI$t0GvqFlQb`1x8yxNP4u)Wy#p5 zAjAUUhFhuzPn>XLJOnnkHX_M1mR<#^1E8}CwxLocbHd8lxLKQ=d}>AY1fP2AYCn?5;@Pl>~$ zUwu!*Lm?EF)sxCETjU^X7zLSL^vkWar``C7Nw$6}ur0)dkK^BCq$YBO)I}ukcdPI=lMBLa(MpDjooCC5!8pcCp>H_ER zXyEwZ%zld72KKwN&JVq_t9SdOb;bs_o8oHLy)8IY3pd*>JL((;+A$=Y8x(p234cUn zO3qoBJ!6w1{MtsN*1P*G%+^1aRO;7qSy2uB23u9J4X9hJ#(u7nCOlZ_L2{K2X>}Vi z0$nA0J_-tGp%sowdhBM$winsQ7!;{s&WTHNJy8plTivwl>Ac#0+~|4Ug2{uW=JIaw zeRB<;iA-&rX&B_=Q`?KmI+bZ{H(9{{jOqo9&(OcxMQ>Q2SwY$?AZL>0Td^d$onT*G zq;G6!1beM1c6Nq6&y-#Y7!94}e4jnaN6~HkouZh0sGAs{F^4jmg7^6HYnUmXA2_qq z{FHqg+y}RBs9Cb_h=z=4Ut1P@{-&)ePdwl&hgNiVAg8I5)`kS1^4uH(4aba35rk(svCBcTH)?F<%<>dqlOr;`iMviplV(h#VGLy0N2_)zBq!bYmF+>e zrDlw#Yv-$fqk8A|;tG70a0udFoxkf6Yxde;)kbY;!`3IeTEI*Fy&yc-nb|h-kNOjT~f-jsv#)1(z^DPz47^RI_ zCtB4^mfD>Y&6K&KS&pi5Szyn4(>>0sWe7ow6P&kfS}7#$i`ob%r!vxq7OdH7@AqrlWc4RGjaOtIFo?OOxycVv z3>qCIMPKgp52*2%VSRI$qeDi0yvi+yn$&FaysJHU97&R0^w_i%CeF8rXUIMcvv4d+ zses)XhNAVASKR98b00YrK{mfZF+C*=N(pP0Ni`n}pOk59oXbMuES zih81r9jPm|7d(Cwf{Ae!=SI@hjJZ9qv}SKMxiE9#)-Hc8AZyoo#`DGILw@ru#c+05 zxb80=1oUrPl;VcqN}k|vax^A(>8JvCOk{7lsrTWxi&_0Rr> z^#I0}!qNFcfIF_x=1Aw~HIN!#(hxg8$!Sg}H)Kh_Z84?gi2u-cKNk{~EAY9uck5Qy zkT(@E_WZTi^o9=6H;2Z@6mX{8qtV+^#_PWq5cSf!fI+Eu&8luUBXw{$Ytm~!?*Q%) zAU&4>@XgGC7&O(m>Wk0)o^$C&1RT88knDs$4TPNkW<^9sWb@-K z){pwN7YOm+lUn_{5pgj`PnS(qB%#9XJ@+ySDgjtQ+&ZIXwTp)nHJqMVodliOrJaO) zPVko)wI8gWJ0vx!ST9YeYSh z6OL#nU1^j4?Eu~&sit;?8{wZi;PI;oR+~cA9S24rDQX~nlc`@ zfvojyG_L%x`+<($_O?&u;?u*9IG4Bl;k^4^B=au!G5;+hVrP592Nm^iT_^arl-1Dt zH6l{#>+*nbi<1Gg#T5ee+7CskP7;Qh>6!PFn=PoniBD!vb}~ctcu~r_pX^s!;n7~T zJUtv=5bG92Ko;?axJgWl#07YFE(WBh3i~9Jev}Zr6|B^7*{O1l4M1FrYb;UWyA(5X z%XUm4r%e;+{wiHXt_(XYD8grhm|Ly!y~Pb2)0*ITwi|mGKAYbI<#=ECQc!hVzTZKH zYm2~fE?s{=OJfj6Ie&)#kc>k#807X@UslsE=`{5N$2DH^m3lss8bNYy33_5C$-Ky? zT)0EEA%}CiJ=KI-k!l=cU|GIp&(gNX?jt+4h>k*+q?zjZ&wM~+%k)=<>gn|%>Tu3;Mg*^d1!S?bV z50Qj2P}syp$oKrqoBM4vRMWS7$4%!z%kkAStU;sV>RKg~#zTEW=1dIIwSJ33rX^j2_R`^=YfcGRr#@j3 zN)j@huA)qKnw8zo(EgyXW}qvpo#Bdx0>0tB81-H+%E>1#>+pl8J~lf~LC_nGkdg0{ z%%S&`DijV<)9UYXn94aNv`E#D^M)+^JD^=Zv_ z!BLNW|7yrVt+JnXmTz<{E7zkp_0+*JOl7nri!*M2uj4cq=VsGShe}yRli>5!@oGGBMs<@#$B1L0O~>{s5yAVD4Q8YMbKVx1g7nKK1NSk&myFzA zPt^U6-@kM#%}(&v=uyOq_b1xf)BN%y(Qq6yDPS_Vq?d^XVYY1Q6K{X|?b*^=g=*M& zrz*l3D=irm*Ya>R-)^#z)j7mDPX;-L9S?kK#;E?CZ1Jbtc>=#1R~w0K0Il&B8x^2m z#nGe}*ei6waJ|T23r0uFGSLHvv52XQFH(@14}QpZj?sK)@#zI@j^te+q#zpFJ# zjt%Ei52u#@`-#4%ep?4j`#R*s2?fNZjbwW3Ie?dO)SF)AG38^q~xtENulw+ewzU#*KyqD=#0XI@{**uE}oa zR{j_X?M}AbUe+!;H8vaL)Qn|{Z|7d%xvisoKkr{D{2o4{X7Z31fdx`rupfc8=L$W< z16}21(7CrG6JkFXqO#B+P`7YvZo-LEs1}9D!(1|8n#ke9$#;%L$FxNHN z-lanFN%+QeT9sLpkI_+7OO6j6-pITgV?NzZhPHb*S8jBZF!6fDKknA!R|P6@kgAT_ z)D)ugtyG<1@!r|m-Mm)jMs@yi{spme`)9Q4$g6D4Q>G85Fq{Aik?HuP)Y%olw}J!7FQ(EMe=YwC~41 zfnS(}#f7?tKLh0^Kb{Tfk(#9u@jB!|80cGCjI%sXKjh*fac*M zWxaN&^GJ_t!#BJ88^R7IkJ|x<0afA+fI=q1aaS0`*iD4%b&nBtzn~u!VKPw{@e`)M{nYbX<>|)#TZ&7Z>(3`pd@}P zznua%E!RL{ag9%P*t^@$YY%DFB#Ic^y%QHb)Jd*00F<#OAXh7%I8uhLNAphBKKP1i z@qqqgb;-*Ja<;r36hNq;cmvJ<7M-cDRFedGUwG{|njZJr0!}lRnX^BpN##E_Db8ci zqmX5LDLQInm5V+45nUtTC~NI`Y|vXJArqV1XFre`FtJp1g#`l8o~UWq?F~?aFa9PX z!Fe%i={M~^yz3RmJ!@l~+PM#?y(x( zq;uP^(muc>XG4fdJ)R5+C!YB*>p=tPcQ^5Db5be)j(?5IM8`4jNSy#@x0U)QoiD&E(uH_feyFYya&cUZ`} zl0vSdBHMw!gQ3NmH_vid`ae3?>Ln;q_25~9Y+SQspUv!TjjcGB;2@WA?cU1n;?ACw z?7>hlbkOC)OKD~2Al{({X;*cs${$w1Q772m_0wfxyOZ~$U|JN)-Hx$W)5uS!XVWea zrP>7apV(lCWC24Scmp9U{0YMsA*Q5N9ja@JQ+d*P`C>T#z7a{Egx{D+&&z^YD| z{+vvUH@n3OVOE?KGUvuJ1Ad%rSo_etKlbjRA-aD1qIqV6q?jF zTaAG0Hhjr9-Hw;onr{KoDbalwC^snSM&)*5g*4$ez)Bc%q)9*;5&SKlaIB=F#XwD^ zjsAH2^vG1)D2%FgcUkJ0e9?gHrl_|#*ks^#F(!Wbh#LEUD0}aqrq?xESVcgkgMf4t z1(n`=69G|*f^-Q@Y6v}{gd!p!A|N2W_uhLip-3-*gx+gHsD@r{+-IMe^Ud6Q&i-cd z7X%o7dEck3XFY3)J~|R0SOHu~9$*6U&s(r}erJc73)T0g4MlxP$foZ1z?o-BK9o># z`XxG^9pG&G?CVoeQiDmstYEUtau2d7ekFFgs>f0O#rcR(6XB(SB$=6{ve;52eb+#**e8_PSZc3qJOxPHl zq#l$bAI4dFp%%xUJ7Ix!VUJ3^`VBGlFK757d%2~tM7{NG0SDW{?r|3VU}T0~I7th? zH6Ir$%ko_P4EIu%Ij{HcD7`)x@J{BY$5D!A7W#M#Ltro*(TFY9;Q2OdDXq_O<3cfX z$u;ZpNOt7NqFE)-asSD+Mgmp1ipSD2^1#+$Pnq;Vxwf*zu`wx5{O$8a2S79NH%=-p z8V8k@lDQil#t9?tFsQgJzve8l4mo)yFGMQyR?dDT?97M#c;gQ{YG|3dllB7XaX?0d z48l1osfIOQI^s|pYYs=E*5wa=V2=&E8LVgC z46QNrG0YfLkn5<4Hz+mBy~xlHG9@ZT&+( z5)tlwpp-cLh`dlfu|JOCWA-O8eFqNRlERd{o{cf7GNwn>v8(ryU4Dq0G&sx?>b)>20CIbU%kYFOmp$VAA{kg%BKNBqjYH$O-M~ zJaojR-NAC*jToTPc5O%7!XR(M=A%mkv*0Hk;u}fDrIAe1^bRFJQ5s_}CvPL3rqb4{ zz`eO$pV|t?$+E8JHR2X+Dt;O=r&)}M-|Et3)^Igh$}1d%BOHiZ8cFWZ9J~I+?{UEP z+}PJ!Cyt$vnuH+`?^|FHj)C}ve>yZ#ufOb0QHt(kJXRJ7zXW7Pp9 zSca@l554Pq#Y7pT!r0xx$O$C;5A7-Dbzyz^5wW#3|c}PODZJ_#Q;1%%4I%kIlw#3&a{4#vR=aC zQL3j^b*&C?xriV3VsAQb1{T0=3yW#?w3!#77quQz0%jYiikB95KSRoZmvgg^l^zmf zpMoi8UXhwrSPG7I+4sMW>=)N)mS69fdGfhWPD{HdAf>EiX_DU5y1pt7LG;)%h+5Aqh8C z%kOO7AYa^6IDh@GQXJPDdeXCy>ir_SxFo^GJtuVlc^4X zSnwXMVTD8g;PhLEd}YvHSxQ0=qGjisL6&Phv#W^<$kJpv-#fo31fBH#RXIjFqXOR3 zE(~cJFfOuOIwrS_T-}i7&|0o}Jk%rok+S6hz1AvS?lo%>PL8r{`CH*;u#HIJOnj=3 zQgYNNjl#SBk3||H{DwapI1U2Bt_!jNyh~9Rj}uVB&f|G*=w6pe^0`)Bqf5gNw%>le zFn^g0>1(|bK2L9H777_Hp*`47xL91+fzJfxrVhkuhVA8JYT(kuAw{t^>w}6DXXRS6nyWY~II5#5x7Kl+ zA@EPJXS;Ew-qIJ;r9+Bg5)|3%B$fKtN42d^@l7emetRfj=@vaAHddEtci3m=a2h8B z*F_|Ry!@RjOM-J!=5^6p^e)gI-<)qs;5=xUzzejZu7ER z74bu^KVsb1m8DhG#4NL3$XLITpbTt&YT7rG&+!bdhgW;`dhS-gaG298k-N6Y%cwgA zoP>{r`MXUsG7LLZn|uYF{eK;DqD_9J@@|SyZ-ABJrzlbJRh$Dja@s%I9&o&+eapH^ zfo&n_f%UvXlSj1&neg&Rl3TBzJP}vfr#LASTEibV*|vD!f1O`e3DI z#$E$Of$N-%2fwk)5uaqxk(%S?N2BawAI!sXuHzDn;Bnn_Qq;-$!ZnY>OeNsn1?cb# zRSP$Xjq#YJ)M_w$$FA4LmpxpaGI(|LY%0kquo)Z~j2j`IPFM1~ZjLw}^m6pxe4B_b zRB!rcg1hwIW91PkgdVq91=_v2;u@)y+mZ)g{BGHCF+(F+j2>pB7uc;^AvO92zuW#1 z$M4ki{-YRbm2#>8n)kn%%V$Qs3RnjHwEH~^MjBO#G-bq_+wZLbc#_-X?!H%Fgu#kK zsjRmnSp*8+G`^TqQLwJ(gG!0NuIN28l+04%h|o(7MBSkTy&DT!a90Tj(#bzD>m=P9wVr#-u-ki<2@NVQR;M*Z|9Oh8(}kFmUA{30Qr>}c9r1O zM~kND^}y2LhdQKQtU^pz$Jk)(3=WT&*1eZ}Y;0k?yYYgnKOdS<$aXync?$Nvh!Y0t zi2cS{b9{D=T)=goVz>o8fh7v@F)U7tH+JR2b+lVFI?nI*oZTV!8<)6sucW?wF;WPQ z*Nt!+DXm{ma8^a_?M(v(JEYwfm~drO@Pipj1acq)&|KPei&S!Zujq%fw}nv#&ZL*y zG)hf|Qt4NrtLW5;zvp}OTm?=Nb)I_u$8^N9zN~~KyQ*ohL&Fq}P~3Mc`5((1M)jCX zPhEYBiLwgUe%_kNj6XDTuFwE6Me-pfMk_b@(r5!K96 z(zH7382!EuTwS9>v^?#lsOFZ$LR$r&WhB!QjemUd?56Gr@PuF0P=AWK+JyXv zO}z$+du8B>cg+2 zxWQb``q9>3cP?8y_B5Y|1(Pi$9jUiosvAjw5to+U2VcZB{uA-hzu4G(?zg+c7i?1O z=M~n(+zB173~^8u7M!1(#g30!)E{tzY(}fr6xC-~&V_TlmGdln3rOdc|$8XqTS!H#jYQ2UC!t#d2qBU~$d#>y^XKHr$(R z<%~N`zMF@g8l3Eh58t((RM_poktYoD385PdLg!H4(av67x=b6&T&p(D<=)I5tq1msSkP@v00E;$v_ zFcIq#OMWLd2DxcAmhMv&Bp@3MEZ2xX@T&V=(Jy8$aOOg1X8Jb4G9Px9kn}M~7q%|g zFX|~WVRd8|Zs;OGIXEHo8tEl1G@f;5{S{l zB#i}@zOJW(0*``Ho_KU#XrAa<>kr>7qZeR(H|(qcs$653<~j;qZ<0tp`qnA^b9PK5 zBQGT?!4o&^c_$EQ@Z6PGyb~gm_a8C<(xD= zUpe$jHQZCyqJN`QTI0P%eY&I2;Z$04C9`g~FwZ~03;)t}krVXuYmuRi7-bdaB@tSm z2<7!!a+Ica*q$su5JjEd8-#9Bh~dx`7+biMrrx*O_4Ig>K@YKFGJlS}rL!uyIvjq9 zvrt%}k80-LY?rHKOhDjz%`YNE9j$QpOR)Hj{L~f01qpSAyKYk!wBqD8TQBaf9_+!$ zg0$36Q(6dW`RJlsemx$nsYN2ceJLcuApfWc@P@fdW9`T$JA6LgAw6b9u9tG zxOJ-M99+{ll3b(6-eA(H=lAf|wHlT@y3+f&=67ZFcXKrOA-a9$k?$WYMBge|`;OQT zXfR&Bqvt~nnodBbQfQ>8oH|09AkiV6TsH|PAvaLlaW8Z9FcLlT15Mf>lGKYg9LPOk zadRlJ{P@^%k6mx+>S6hofOIv4H____qIhx7c<1<;{<@u^J{-Di+pPDeDK*5r=R8O zQS!+rkkjS)m)JP&N>p!n{*eYLU*-!xmz31co9TQyuqQZ_gRb!6(&kL=QLINac*^6` z5_GM{VCHp>vM&l_ak<+}@g{Wq$3@VK?rV+6lOVJ2&xU0VQ{UGhQU8E=GN65{5@yN< zAcOLn4;sy$HCg2bz;lk?C0nfxNrsbIFT)sq?>+yJl!GjOxEuMVLU-4U`?ok&V!r<7 zz0$fa6)!gBFk;-Y2g&iQi-w%>i&}oWNj^}Y=XQBdhwSy~@VE1V!jk7CA9f?y+j^I9 zdv8GMO3II<4-T->xHz|ji$SPo&jG>%NAlZDYFpyw|gewl=K(HN>4 zUx$eD&4ZD1OSs7by1~MCckSYExD@(_Q;8ciq?XKCm7OB&QQgQt;bS5S>kC$7lQRgGod(6#zk>g zj}VR1!n`e?tS@-2T3e=K#WbtN5cshsn@fZkvKzD{^5a+fX=g*6X}&$8M{Hb6+UXIz zxUC{Z0Hn=98O?h)W9NN;!?edEJ@zgx9PiH4ods?l^Tf6=BW1usnmtfQZ6@=vzA@-# z#bd<8V~>sx>oF4n@1Jw@m8-u-6ix;Es?$bE-^TkPl^z}-$*`j>)Z}Hq1&iy-s417S!s$=a$sSEN}1cmtOswJh?){kBg~^#4|`5k9aLvg zwmhmE9xset5gXwYrm&lkk#k-_pE^OWyZonBQ3L7%!BSCAh)RPaHJ~;V(^~%IIfDOJ zweO_q0hzYl)ZbPqCJWixgIqHC^VJq<%9N}n0B z9Qu49we3KfgyQ%Y)@3h{-QIslVSgCvlE{zSyUm?80doK%sY$OyTjxe9oVH7NDC5s* zzCdC~DyJTJ?&c);V$ZU>)WgrK|fM#<(4;ap#{^H?!3hH^i6~u5pkAZ3Rm&BV$uu}^k z_dR1+J_Hp%-tg98AdR(p-prfgO*UZqFo0F~?RdnBJe6jLmsRlWqAqW5z~OjQrx_DY z!A-H!{&P4_ljaf_zeg41z!_(M8KWANmZvJ5I|CY}*235WL}sOM{q8k7^Kd50c?lHd2`(>^ZY+t8il z{)0aEuMPc8UcbyR34_>mhLfG9%KG5q*7FmIzt^}A|CGTi!9c0{?-IBoD@KRdfZ?8k zpql!MG)lrudhOgMD&~1frKf_sURbm@QgVR~kRl_^vr=?Y z&TRRzS>Dz=ArF*c@2p~{ZPPj0Y1v=r_A}d4PdEM32l-wm5jtvVOG-n? z=ZN^?%FC{j%4h|v&kFClG(@jDyC_{g9$L%x?8myn-$-e?+ryP|R##snW>~kmXkL)w zEHm!i@D5weR6*JA?`v{A=#$WTjXyS0-}akP*y;PlgPP*+OWU^2v7b zTD%Lb<0f923ii{}`v2jt7MKDakYeXgNkk5h6L~;(ulLHbeh5FU}%9dT9nGiGr-9TSju_ zyB+iuX^C_6BO^Ix#Vl9>ZX_Srx;vDK;dyCwu?u5f=q1}D4z-47s!3w}2rFzEPu~mg zj&@fBtRWxS@0TN$hTWGbPw{*v`82jjW-h8W9!{d^z2+ZIfo+edXNZHW4yo30J&6jm z2)JV50YXYi1j{5CC=2JF>2hr7e_|gUzSU={Kf-tq`LIc+9dpL90rHu<_wlHxStYkw zHnQAK$zC)xJpf??Q)8m8lc_H>eSPTTgaJX@7Q9qP|?aX|0srJD-T#C4G z{QWYFYV2!iv}$#qqD1*HWYNX+2j+D1m)6OYSJQtA6W~NXHZ@sO*<_ZeoBt9MTrIeI zCR+b=pRKkAC#}Q(82kmajO-(IO#mE4-Eb?o(EQ*G{OL6>Bp>`rIuO*)d#Ioj5%$57 z<7m`gGx_2lYX1M{sw(%L-{s|*DhSa5eKvfC=OYzAs!#RaXd@t_kBG#~AJg$ZZ=fp* z#@iXMZz}4ECSL{vZ-O64=ad@S3MIn$lm*QzEtS4Mu#9 zo~?^W&3JS^r)B%^!ilAJv*3N>U? zPU|}TCK6lj{naxvndp_hPU_?CoM+tkHOimpaXx{p+uxmWVT1{dPrYwlW5qYCDoO>{ zMsvkoO{Ey{q~ zD7uS0j_eN)JVw=<)ejh60tj^6xuymQsMDpj$-xzBi0%< zDJOQvo}T&#Kv0UoQr>?>hAUa9!>y7j?da3p0x0kv_2Y+MzVP3UxMNC;>%H%!k>AaH zv^dT>`HeW-rMB|3m`u$V`E#3c8;)B7zgU-LpWl0WckpSZ31Nn+>FXDPuM1E*m&ith z=W%@Nu2*dVW%;~03OZ~6-K|ERCA*-Yd_?|l9A-(Iuiw=WjH*nbVJ3i|tPcAsxF zGSYAxdER2t_!#0+Fp}}fGLt_Pl(1iQI^(PfN}G6#0CiS$-vzST(BoG|bi7cmYniKp zbnYC{ZPf@dO;YJ<5MtL)SXGNkmf&`zvl%c36Fcme3Yp>ABZK<%uu~V=X~F7z(OX=F zRGqlEB>GOb7GN0JFV<`>3UjR$n$L45BF~9k`k4G~c-56O6WYTr{LaQL8h_j~KAl#` z=thvYq%Vn{##=jN03(42`tZh)e4~n(l1{bYe2jr_EkI@?I|0A@NQZ$a%yDp7VY;*C zEwC7}VgzvPBwdBqZn5O;cl0$#gIpSXUzRfvh^sed+M57EiD6f+po2_b6OBFd$@)H! zcq$~-c=hXQ1ZPQC9~IV&hgtcc$^w9~6n2xDeElF|YWWr5P4sRehjs7BP*2-lqVD@( zgT~kPzv1@dv0DnaU&{Tj*Ww+j$ueJB2@@#J?Nz_hciOLc^k7Tp?;o?j^DnCg3{h*Y zNK-^61~cz~Nw7@czlqFRzkyFeb>i^ad_=|t&=UqBDN?NC4}H(~4U}geHo0WHCHTUV zq=gi`m@uNAEHk*y<~tDds3(j>P*5Wq10-kTw6S}9!}mkKP;O`lW-9mvG+l{AZ$tc{ z!+;yu%DgA*7xhYgw_7n}{4=?@^hP#QMX#se<~ZsoXO_`rjtp#74GZ;zEtC)5aSO{0 z6&L=_oknlfDPKH>E7x=P znH*omHIeU$lATBEjMGat7fpwE&d6_4{LhzI$L*sj+2L*3kxS783_`3NuHi1$k;vKf z_bvH-XYrWKhpf8P`v`ikwUovP?JrLdKhBu88f+pJY;9nkYbgbK{8cZ?77w=~Ovm=E zTcGo0F~{xBCFSlRA@6(bLA%ay4k>vs5EPh3B^`qP})!rYTvUF zJ8r5DgI^yb7StA(;TH1>s%%;U}{|B z-vVH#ZD-h}!H$qOYgGAI0oW6K$I04CHPY!|mwl-XU{=DR{wFJ|eQQyC$1|?AyWaeC zvdqmJGb?h;Q3?3U5;1}|KTZPN&5Y8xifEGZ15b}xPq&G$Qb%PbX@}(<*?0L5 zcota?01z`{pcR?OqF8(Q?D}(}PGlQ`sCFX9R~YwezpF5q()kF7awvWi9S`;^|jtt5Op=?$3N8UJ_0`EL=bje?`B=jzgKxE;?z8BN?W2l+i(Zb%jb6#4BSs(jIi zXQcISEr6TWcz=Daex(2M1vmmHU#3j^o1f5pK-;~y9+#jV`5i?A`?)}g6UACXvqq;qQz+tvmOGPt7k_YtcxW6 zGM#s`+UDR z?w3r`hfAW=8u_;XdF5g*u3Hluh5UR5a^Rk_!L61b>qEEU8Z#5<&}K;pr>cX8D^=)s zbLL4i(N=?+dOFLO`^3{LRXx%8qP`3!!X@t$yk{+=Ze~sl*2^7;|a)b^{)Y$`DLzQ+2oH_@?EF*oHlv zP9J=ADC5j*xhGv@I~0~$Q+WAP-%Mt{d@G1bR-U`j*cy*(Y$W%;Ws$!>!8Qsu$82wn z9c>1}zClC+@2Ipr2w2~R2t5c0U81FAE`NDn@9*IDy^Xtu`DstJ568`WJ{sO28$1?I z3PO#fPrKUW5^^!q{0(+IsvB1{Q{sB9|P zlUomg)J33SE#EbuITa-XwH_tapXzMx=~9JgF-?P$y_ z77>ZrZ#7R&;bVWY4)wOFZC%yi6xl*;InaJalV&w@Jy*J9wU_n_Wa6$5v7|0eyLjoP zbO-S~&bA4df8gC8B#gZpTzlp7i)6T^e9pXNBqy*$&9{Y#@_$D#az8fJMb7g#^WubZ_BjcbfOQ)a=x3*`*-nyI-+)lZAP4?n|(sSzRh*^L6Sk2HkI^un1M9;{i7)M>bsJ2D;=H>0*+pU&QkE9KodbP-VzG4E4rSzkW}R_ z*u%bv?m$H@&F``Bgwxd)Yj|qu(^@HKq=fLICiMx|b7Zr$SvnFb&nRv~-tfo32~hAo z)7YL*4Z_)UGnQRVU6q9I9*tVkPDg$FXh*hSnODwrX*p8Tx26~FG|l)#N=y<64D~Fc{`t<^=zdJ2oO5kK9H_-l?fR=(Nf1tQbjV5d@H~RA1;Z$-unMWa zO*xYl$kZeyeGK1m{<2ojtyL&&x$ZTsZH{!;ja#HN@?*)c%BUO%e(Uh^K|`#=1H-5X zCFVWY|7o6)sr3b(W(e<9mqr!E@BYMOPx?0eT{|oiuzgyP{L8TEPZh9tZaZ2HAiKX@ zl#drsAnWkdBa2ppJpnQKX$36#Tap!#HGShqjw>s9ou6Ifty3ftws1Fn9;*d(8N)9J}u4pVD+w>b@5fDmE z^2?}FRieJuZiWQ6HBW!fY;__oBiTs#c^=TC%`B@9okWI3(fL;;b9HR|P5S%eJzy!* zkY#)|+7Y^=t!B?6(p60~L%HB#T#qMg$}<%{dcWI(2uu{tQ`p~wHtx<1vuckBoIu<( z*-|?BR*6kJ+~}gb%bL&ilYs;%Z|rXNt#<;Eaw zTnuXPT?^MGT^dz4@iom*3`Ek^?ndh`3YV8ta#oo&-@!@+^Iw;*NW)j0l4K6CA6NV5qM+%`NyuNbOYutyp64=37kWQENYa2SuPduL*m7*mnY zKkc4w6Ium0dsx*_R1@@! z=S$m!t|u-FE3%~?FcW^-7Dwd z%ajgW{L^*0#j=6@$x)_=jH+gLKc+IcZ?;_3UBg(a;?D6!A6L>92Uc41h0xG$&y{l% zR()iR>UC`P6u{*4JVKj#dxKCIL?xGvcfD`uto(;nh;g&jgz*I|?DXx-U%y`1kLi|JeH zRULZzH`(}!sipUas==+RJ1a^Hkmch2GP>Sk$j8RxJ4|cPE@ErlLE6VP9>2C|}3YH~*{sk-Hss-!B}{n*E_-SFXMqySs1fpg!LM7?QFq zZn|y=J$RPf;g&VRS@PF~m7}a{PCongCmh0vm?%=4>>W-wv4g>0jA*nYfle*&G}X62 z!B)*V5oA_IRL6RE@7we^^z{ZkkRrO=dnXQKL?^;45I4@qOv|%wjTpV%e|KV`I#a!$ zeC1>~8e(ZLV;ucW+`Oi=TFQ&~n;vMU7~wvBza&$-fUZ(0T{=C&U-4*P$EXaWQD^u~ zZOP#o8YBccu8s?(i=X99VeB2Y1O^soLN)Lx{aIu?zc!C%G=-GtF(W+`^nrVfDg=t_SC2 z+jgN>Q_($UDUErr(Y52`M~QhmZRC?g%US3AvRKDhJinYk)r=Vv6Gx9_q5Vs{swvdmY$+k@Ip z2`7zq23J>c{Nxzlf6P}4ve*7yM`o9#wW{uQ_ThNdMo;gJY~&qa1VoFZzjh5%WtMrQ z_~W;(B$Koxs)~5&_c-`u?{(WeDd4A~Wx-`@MpDVx3L$BKj zcNONM><7}DBQ0MA?r@rUNFf*DC)T_hH2j{2MM}r2wwC50<^Xf3PRds@r5F&DK=vh& zdSm^$NDWNbSX>anG?)rK-oYLqYeA9;{CSZ76+8VHKDB|5img~CC-tu^7L+#7&JOjU zW~uF*nf}`CN#lgWANHTVR0aHX2ix8$+-No4gA%kl>_LNQTXJ_YkpSbX-4t&8*4!8) z7=a8ktB}^^7mP}W>q787H}6;p0M9XDR$mcmq7$AhMOtJ2C5s5V_Qr`&-@BHCU4 zrg8o&#ZHW@!p83+!I;|GPWNgIb8IP{HJ@#FkCj?+37G%vWil8b=~T2er6uK+LIQzV z?cDJfgE?OA5ySV*i+OX|*-ji!^_~~iw3crfzl#@J8A}--_!U(a&Tk?Api>M}z|}{) zk+c^YU>-M>u%u>o9>(M)#r>yl^rxQUepmR+a#dA%+`|uy8b#u$v{Pp@Bl0^~?r8r8~&`rCAmX%F{bd=)%0+Z~?Z>2t$?1LVa#P%QU z6rQKkEhoBRo@&%hdDfpFU0O^szRN}ZyXe(O7V_h6xecET`FXGlw*{GQ}M>4Nm{eFX=o8F23a@gCQWw9UkLuW*O<; zL4>EueQbIkrJQAc2=ziiD8lq;pAsEnK+Kr82g}2p7!_fFo_=jE?vjV+`FFCG_z7qd z8@7wvq>#F+{{;lzs(lYo1-`vOm70CxVSbw{Efln9Y_y`HZNSCnOPQfI!e;op{@Z}# z)WwrsmfA#}?fCFHdr2wp)y>PvN~>_%R?zuTMNJJrL}Zy091eI?@ZoH2Zb@S8g z^UY4G^@9_}JPVM@>IxtbXTmz!kUeX4Jmh>Se_k8Xe;n&u!!CPS*cIVL`HlP5Bi38W zgg1p|(>-?cdqCJfA1(|y?1#6uTv*DxJ6l=3ZF6kl*zvUlCki^~YvZ)wU#*^Y_o?Jl z2@;p}-ANkjqKL5bN7`TN<#{1Kj#|^&m~J!!a{uf(soB=k+J<+i;`om=^J$+qL;=RN zegVUR=oJAXZKo+|bjExc_DI0gXy6A#IhSb91`hi^Jqj~)C`}nsf7~P|swKzC7zJ_EJQcf7TdduspgY3{^ zi`47FW0KfZ2<2ZH@MKtFksWexRT2& zh}cXFA^19(8K&UXtlF)SR%t!IsZebKkc0DWE}g@Y5TovysJphRKjKH3^LEMi924;o zHY+d@?pMdr8fgeggH(Ks^i%cB>ooB6qiBP0{r>G&!W-PYpWw>T{pRGusdrt@+%LVE zqiSgF$_4C5hC%DrYNSpF?b+e8CvrB!I(Ums81vWOoc5C0!pbx+as65HYD}B^i-))q z94JavZmDOuwdtED=jG1|_Jd(R+8`!=kyeTWGM^CHrU!2C)`iDHBB;HT%sqZHuMM8Yx{6Z%#RF-EUC}IjSaUk3zNF`&7ctB?cxbGIz+MWQYQwz zHl7SzLjW1pCb`f1u?QolLBC>r4)(2o-4${_{#!GH!QIV4jFs=0q4450Lx-BeS*MMo z3X)4_k97TAEhL7!wEp7kpcYvYTL>k5?==5&nbYHPJPqQ{!~s*K2(qe+`F zkSots6~*y}jj^!1iJzpM=TCycqYr)&$ZrpnnfEmtv8l-ghhSAVUA^m*OmoH=J|uWH za7?rhd-e#^-=ReYX(lx2KcIRI&5*GQ%?BII^1U|dcEkfgjzmNM;2uoXtn~wPbX4La z_8Hv_LRIkL+ljXx(O+s41~;0EF-lIH3BGG`0jJZ%jNdasPZ@Lh zKr5Favt}Y7DVh^qq`LsN8fPlKI&Ex|C^^Z~0>OcZ92)f-lq?oX;cpEsSQBK+-iP5X1I)+3?6;m*hEaA{DUdMxZbdd*HtM4Av zdZNG8?wGZKe9!p#In&68QK27G%~Q!#8(isOAgbxmPu6pj<9DIfDb~hSg*b0SHQGAO z`rJYi52go4;x_PI5(Yrrgy{JG*`t`1@;L7Ls~Q%IMjDmgz|cq zF<-@Als}H~wgsh(&L!Z4kWsQT#30NI%v?QsnaM;7euK z-ZHC6V;a|lvMLVYejv&YY30A~uS2Z{W#$CyITSgdFsi#jKuQd)nF#v$D>uWla8;JI z_SA!CSOYKrdmY87+?mW7a**!1-UVLLN>Y$wytw#S;2AVxrWS*6=1D9r3T(4>NsJMY zZ0P823@H-L|J7Wba zL|W4Gg2PR+{#*9^E4M0tZ;LIa*exxY(kzj7^!C^uB>maQT$#CD;Xt|^upTnAGpS>5 z?z>a#l!k*>TAZg^LY?d9j6uFf)3WDwi>W@Y|B641+P4u!_$G~)Qy|fv;^OE(I5h`o z!SV=^W0axzG2B~lE~qrLbkO@e1*;~!`*1c!YxhJ=bh|X!#~1HU{tR{fHRQ=ww3L(L zr_C^sF%dxWc~oWzUP<9kLYK~MFM3hz_A32H9*0CuQ&~|IHqf&f;M-r54Hk!Sy=7>) zSqiYMp8w_B1b8zXJLU3w!*DQeXer*)J;Xx#`)lZnW&nHN#%pL^(#~kChMTGkQpV1+ zC+B+PC(cb0qlU7)_t8|VZ(K}$=BNIc;`!U3OecH{ zG$E8&OpV?)CUJ1;kCGmVZFSe@Smcq!E(0WwVwIU2tCOms%Jtd8ra~aE7KjV){Rw1jEdZR>bbW@c=pnn2z?32AgsEF`xO&5+v7k4tY)VByVl`z_TeZZq z?$qx=BADbI_Y=#{h$)ymJ0r2Nkbh0B}VG*g8(b8KQOqURNnA zou)lVhDe%5rWCj|upZ%IGlmLc8wDx{x1LM7^u*Zbd_p+${tQk`U7DS!Ami^R9Y#Qs zF@^?quQ|7sQn5Q!}AYMs~^-{4R^42heC2WmiD!C z(Z2JNmXfBmZ_R6=x}aw)Q;mQlrez0eS-(;nDYVFVapam1$>-1;nkN2k&-_tbpt`*)|6bX6;T}UZk-tkYVKXtNE|Y^|HaRO9g(?%!q^ zwBD37Q6@(JgGaV@J0`Ua8RiE+*{K3$di9t1ul+UxuBl7b&LAI^%;-K@X6gR>%71MW z@@qyI?*%lU_j8oa7|JwRWnL^u8}@M=7c-6JLostTNuCAX0ruy|qhmgI5*JBaX}S@i zsdBL#dsAP;;&~X#?Cy3PN)TT@Bo;Q-XVG=XBfQ5S#L;>7qK9E!kG8rx$<&~)*#3So z7K}!T5U`2B)T`D|^6gH=ikvvOC&oDuV~BH4Dvn-3Ap6RJhW$g_hW%#j=7674mrc52g@X|!8VIvtqDTZ=@K#o(aV>Wi6f9R}H^)`u6jTNtPh z$A<1EI)3HYDQ}^>6iV`39shHo4cuy5?Aelq?@W8GH)p5tO&Zw8Bb*vbO%1QubO-cS z0R+|aieQo8bJv8nFBVlCE@%DFlrv`iUkrBnQjRU=3 zpshwotPt|H#f^a8eSdFsw;2o~UQ0!!KoUfY=ryYIa_PIM zPdH+aCL4f(Dp+X{20n2W3~RlUvoS|fxUpAGvx@Yr_<4b$R zrifGisQNyXc0t#e7vea~7(lc-L@9F^|z{@o98Qk5|~ z|IXeoG|Ar{7MPJ3lB8{ra8$D;P0J^N=hfeU*88UIl$gRQu>BHGnjUtV<#Y#wCt)yQ?7+5x6$HqFoF8#N{!n|CU?Kp@Rj~=?Dg$5&q%2*lYa7by*OYpS~q!7+1@1@-#*{>At~kXmyI)X37@OFTg=mw1XmN)Oa8z1ucZ!OS%NXM z?U3O8cWdW?tK@zVd%?uiQsh5jz5GX8#>G(mikRZ1X;@E%(BC3!1`HQz^J1LT zN{<^9FT)->>Pyd8)yOpmbE3mG(B#dnU2~yZ{O4FKX0rLRmv}2v8la(dr^h8ZQJ$H3 zmEe_iMS+AS$AYnQ8VP0`Su2gQPSgm(I|>87U>p68c*RvIJVz@4I)h@TGEAE(;4q>7 zM_ihHgq=>)+MsX7#b;Z#+@)~A5B*B&V1`3D=@XVS8;$3mPoqVvj40r$;rwSLRmp zj8;rGqTn?to?TA#8(Fk9Y6pS*9wduO_Um1Sdd~)l9H!8up*-)2=2O(8`mGxYPAy|`=iDPI#pYUElszEB%><CvOV^p?`)k?5o&m{g{a%Rt~8>sv|S7_ zDO?7d`<|;73Osd;^gBhBTBQNC^5M6-)T%Kwjk%%ajLdl&uppxr%d~oB ztY{@}T1R0{{)7^Ef$Q?j$DO9RyW$*X#s@ph^jC&$l3JcA5?`CMV3}nej38L1Ln9a1 zqZ#dJ7s8IR)`!4JILZo5yTEDHmIF}h>+qUD9fd!R2a`W|krG}cS@)?W{c1y=8Q4JKM?f3)E&zk)IFD&E~&rN+x+m5;(sN*{}08{ zFZ(uvA1{|6y*OiZ)5&or{ON%T#XvZ7LQNvotl1+_imFiY+@9$ahr|Y-COYEB_!){!CQMl`IN6j7;~Id3oh zRXVuP{yv>Xs$MMJ5vl}x6eMV0TsR$}va)LtGYoP{R+E=W&cVk_?u3gLc~cr@MP31< z2VFw-Pam9$1;L6M)vdg#{)F+syBq#xpT0`B!92xOaeOO4VD6mMkGzlCk~(y$_8r*O zI#}!eB@sCV*vc>(E)!g(xM22-wOICten+dlDu47sJ>4JOl=#bxT30kR`(U(@qvpI%0d`n_! z#+UyOW$zi)tSG_BAR{Dt>`#v!*u*8gY zQqS-VtLf)I15dbamrUB#cm}b_8nX~MiQg1>Cr=B^MA+BFWXsmdeV#5OhPLBEA1n@YCvcfl<)Oao&Uw$h~*CRI*nZ1y(lUoKVSF zxwrCHc>4DB|0{<7zYu=I;|5$Wa>u}d&t)FzK<}Dm zTx0$7F<5b>Dw%g6U1Q$(}gjZA(?SDDd^RO9>YR&vvBI5*5~$wQeG-p?%7SX_`` z=QJLWTLO73dBrVYn*+MFL>d^MzvaeRGLWG9g3v089Psfx;=Oz6ZvJl~(f}Awa4ZF9 zQ|SeRzlyU*9Q#EzWD;n0H?DHgJW zRFfTkZ-#UE6kO)CP(Xu_Q`u=$*e}Pb%PjX-okA1;{hsnKcV&3}lcP<{b+$SwK@p}j z&U9uK=a|Le!L1%p)wN|8NHL};UD2}A&dZ_ELq#q{`IcXM*W#sZ*^H-wTgR z*q};bKs!}+)2z^3kB7DQG@jZsb{yn-;{`Q7#mI=i7-rhRx7(+7sUsw^)9Nt_2FzaQuepRu<}H61s#2ssq;^I9YC$ z)Rn?zd`qfKv{NH^g1%F9^>tc^*}>MgRF+O5Z2CY?Aws0DuTOAUhxR4!#>q5sA&0;0 z2o0-tcd1{-qx2A9^QjrGNKb>NlwE<1%UPW_6gRfRk|(B*mQ0%YHFbN-fI>5c`o2vJ z?p7PjhLdkeXY5aZ5QkhDjnD(M$}!h{ylO57+#GceT4 z9O4#Au-hsVwA%T%xZD5uKvDQ>#kKX98P{$9BA3*&6eN$PO>(g^`!X+~pFeFXk-h9I z==;e3Sac`qu|mHlKUjgyEbj!NqNzLoL$G3ey#Z%Czg$%nHa8E+>M%50{NrSz0+ZTx zpEF(Ws~2{tX6%0Hp~@279)0Z{Mah<&K6-mB+h?`!=YIF#KBN6+zz*IK=d117cK?XF zYrt?qiYsKeY-ADgI6XuL zTVk4|K-11ZTWPCf*v~T+5+_!mkLr$}QOI@Nm0n(oa7s#DT$5@Zyy&KcNN$y>MI^m1 zO6~K%9M8pC%Kg{Jl9sbTf3>%q*Je~gEn=*oFzVv}k?{S)3-ygHaL7od2=q)p?_}TQ z7(XEy-F0eLGHuWC9*+OdSI@WX=kKkAnkIZBkDx*X4kgWU=9Spobm}O+_5o|G&%4o4 zm+;LwQQybkeV59h-h6YHbC~%7$HNwB_r4{u**^9|FeJxf)k$5!(Z_{aEJ_mWQ`+8! zu+Hg$R17yh5JC4S)wbCtp(dk+PFV>Wv?9n%>`eJsfp!ydgT_dAR!H{G{TB%sP z&pMOnY2*F1W-r53?+@=YeV4YVZzJ~|Wjn%uo(cVKDc=Zfco6TSCyvqx6ao~L+~vl- zZgD3s{;<40;}k6M@{#Egoa4PVyrR=c{@Y5I@_;6c=5)@8!X!7o>{)Z0Qz zP4f_v^smm34L^bAp-l%dkRm2~a!9D_XmU@sjLS3Rz@tdYH?23OnVnztx=UZY{PodM z6p{L8Q)?h-Ny4+^+aP+P!}#)lcGO3nV8hzt6b`_@`Z(grt0jx?uKD2 zam9XV#Hw~+roy(?Yg?bM@!z4)Ww(cLgDlB5+caWvs&%zFpF3a5(1%pT;^aXAQPS2! zA3ouy>0MK*X1O^k=WNrTay=&5hFX1K5=lUL9a=7W^0N2#R-Jw)2nT_R$ag zI2OurP-uECi~$Sk>~sqNzWjo(*UK$sTtluF>g9arA_ahMNxUpLji{ILaJiKTvA3EF zJ>FXy7I{AVpLs3*)`M6HgGpWJS!6^ z=8N{xbGDl#3~Pf;v-UfAhAm=zc(O2WFWUvChedc4ORjE$LtRJy#7Vm}+vI-^e?Rc? znBUTfL8Tsk{YS9^xBWQlZ+rTtqlY%GRUP*3umBwUFX$?_;Ov3E{mcae%QuKfM z+3xHb=dOp-nbGT+rJUDK3q%-3-MUrOr_sjQ=r7Y-+Iq9oe{>;gQplsXz)A72iclni zxy0I%t*P2EthK9nW$pD3GZS4r)qlg(`-NqP^Ku%h!Sr0&YFqU}Qg-Ba06f3?aB3e8 zwq|KRIGId&5`BDr5T}d-^OW?y^HE^(;A8cw;mxf1zOGdUw!(Lq)`x_qnq*&K4cl}m z2!iLuwu^b}>M!sQUg(A{bRWeWXYg6ixtXnG{-uxpZtgE<8a)DUGGVxMvhXdMNMcwl zDoAekYDL-`Wi-@(J+0$D&zlS81ndt-0%=RSw^t-_z{VZ(xpm5KAvILx0qt`D`ig z-UE9BJmmqmmSa<>!{6qEU@tGP?u4H9)?M(&6tj>Po!z=!9TeJ+FD?$qW)~`U&1N`x zkCe{NaQYMz9nO^Azm?3x2M{FfGJGqxgLo_iLV5!|q0a$A-8`WkvCF1XHb@w5((1Mt zLp&}aX)aSo`*l+)0>4^8o@JH1Mk#DJ52Y*kX6X;EY@6wF5F{@W?fHKx?<>$;nVfZZ za`_A7^UXmdRIWtQ=KFVar=44&6KOQz=UiH@wtUi@cc^V2rTjT>p0Z2oys<*&CQUV9PEnR!;^pcM15QR{Ao&oN%MMlG|k zAV;{WBU0JYJ>=zXomW%9Wplkeb79iApX!Cpw?ovPB)Z+o&o=)%{fG2u-R= zGe~fjl#pqkZw+W2$efd*9IJ9n^>INPp@Rl>RN_x^07Sr3*3ewzGl`0;4_qAj(C_V! zjC1~R87O+)6+C^*TgjnQV>lOz4=e93GgU{Pw7>2$xI833Bm~5#fj%<%Q3WyvgT@6b;wn?hrox#r^1^J&w=k7JCFE zQ;u0g4DB>BV$t0zKX^F>_qx>qN5OOmFMZ;g^IMU_y^B?PRO3YaEM%c3SSah%XaSjZ z@^jS2oMoLU%_6n5HdV`HTp+FFFAd0=3Hz==^Q)g{2!%N3ij5ZVH(4t>)tQ8j=+QmO zS8k=Q8>n#4nuweEt7?qN>?Wm1ooaK87F_+Pd{&fn*CDC2SakXEsF1j9gFk^XyIX`G zGIGtUOf83dy8GngY2|~8uFk6_v{LSCa{+uJ7L{x>3Q}45-}2Wwl;tY6drlxR%S)qG z_Ec%UO@*94jh280o{d?7CK6GFdU|8!M{?~*TIjV~nJ!dq`KE#GQp4ibp{iEYRzt*o zhi#))NO-Sd;g<_s$;&TvK!4V{W5><%d?)LfdX{4u9DI3!@eO)>pcFaod|jFrnu znhE29rNVdpnOE0H&%Xeo>uvT-a|sI#>yH6n6=Z#k(lLv2@86d@!>OiHD^CYobR9YR z-%c%Ec$(Fc&8{s7fa{jF7#in7xb-7J@aj8@xwM`zixl+R9IEpX&%X0TU(>rkPHnK1 zPyL=P>PIsTz2Z?Xqr-bP!RxsY?#KfH-RNcBSWaQNm4{{A^-ZOX(h>v5Qj0rcpc2iJ z=Jx|F+6wEyn8v*zYj+E_iXSpA^C4A18pXkgPZKf#U{m!=n4`%}|8E&)98=zpbm80h zpUmZfIv=L?+XMc+c;SC8QBlAW<3$DJVnz}}=Z91;T<+W`0s|EF*b{-pmg;VkGqO9gVTajJ9=4Y*Z1 zPr69oQR({L2=r#hP4V1XcFPLctCjtlKewQmWa?6C_59G%89=a4$yfG1dN|N826zYj zy694!uRa(&OvxJE@{8YAN-`s#5Dm@cxAmXvj&cBBBk}8YS2io=Cm_yqRe!6?o&b(| zG%@KgZlDOT4d!tAY@=$Y+$!v@)KuNt)mbLC^&%_6%dV4w3gZP1wz;2H2J`*O4?##gR8u{l1wCf+K(f*`LJQRv9w4Y9W zR_BhIT%(Dg_xRGLIpsHEj{mdgx=87$UkzcreSFooT8iEirfv}o1M-P~>_9jaD=;gr z_>*F3kBJQW4npl)uE5`+Y#DoqW874=Q{Bd(_i)K0lQ zl1vEOjE(+X@8&UmH!nfPz1i1KKQCyfJYi>94##wfpvG&eeZ|3Mp!~f<0x(9qFOT=@ zsSFJ6Do~Et!X4b42wNout*u`zRKBVYZ}bU0o9jLbC>c~I*t$0OWiwvF?KIOZZ3Uz4 z?5qx6St>0{7rz*z2(s|DxQLD!>t~_M^M85}`xC6k?JNzQyx{>$_rI3?)zR{9xZn~e zUiD|^UxxT0`~1%a^`C5${n>%5JK1!I6MDaWFHKGHfM>nRy9PDR8Yy~XUkcS!omsSkqgB+GN$Hd||PyiXY{X>pBnc@HLY z!0<;(KtWi(C)q7M9t?eC^YslmzOeSQz@nD=A1|QDiP{RHW`K+igNfxI>WwuSZrVU5Hdha0!8PLptxWZBG@K5RNnMG)i;rgyt|NM7Sdxm5 zERUCytkz0^(5S$>rW4Ntm@SROP`Y9nraqT@P0DK#H;8g_9Gc^5>A(iF1umL-71QUo z6xD36Xp5?COV$-`ehdZc&k!Rd`&Y^=>i6nz^P-#jb2X`oYl3ZBbx6bk#7Q3<@H@6$2SWYLWE$_)%DY2p zmD8;T8cg7;fDFlK2sWb_WP@P@R70CZgsf1TY4gL_cbgOUMfQQFxHxm-Mgmj!>N*l( zu{R5$$8P{7tuL(|#n3RXD!k?DlX+EYFY;y~P^X=n&wuvJn~X%@I&4wWcW}KU`v7cC zyF?V|{h49Y!gW6@#5wJkU5ra}1hY(O?0u3B1ifEtpE$3!qf|$Z-u7JAB;Vw=gn2%7 z-(LTg_1Jq-YC12gFps1ERw3aQt{Pq%-L`WXP~O?NTgb}W5ABs|mpw~VB$q80SDT{e z?@2u9q!*!Vmz-6EF&znm$&ucsem=FvOM}+8DJ)r1jhls8>*ZDfsA*)5N0B*Vrwlm%Ky@zXOZW zUwU>nqo>?UZk>GJ;#zPbgR8#T-eI2QnhhmEdf7$O&39nWdQj%FeGs*S$o9Bi{^@+* zMvbfR<^WL$EaCf)(i2{vkPs<)v}vWn#lPo4C7@{|2b`0m(p=+MGMp?9B=K90RC(J& z>yNEsOW%-Bg8g5x`!z6e@2YvJZ1)@Di*dv)(#DpW+?*OvuTba%-_A`;+`*7Bv$+u3 z4@Gg5XDe@){ZN7BER&SK26V6l^-LWIbsXBGr3S^$Rn4nEVu!&W{M4MhcJ*-nG~M0P z4=Vit{h4KxJXkQZte!cZ=6&G}Rbi)AdMj@qwa5-58p~wM3YsDn%PzH9!H@U%^T*5i z{9bi@6&1pXCa%2*?0TxuFWn(9YiB^720Z5R+XFlns2Dl(!iO*WcLRC5esEeWBbiKz z9Os);EmP9fTHenOKe~OR&DJNt|NR&F^liOsq*TbA+DBzXYqbaLdUl5GM`5tXf3cbx zD5YyhZ!bH@+|%b2$UK03j!N|5G#)RQpWl7F*>DLpz7cYl4*O(&_z1L0-JY|N&TtQ0 zk_4@I+Fnw3YH&b`L;t>p|AeJ^NRRy(^>}&ZcnPSCH<~`MRg_+2Pta2S(_aCYyzJ`` zo6t`jsL-4L&U5fLd~Blo++b4(o3IVEffTVo+YM2wyH1vDMc0=f$gNwx>eZaR!~qSL zpA;lT`zHcbehwN7B9m=iiI%>mKqpS!^kzZT+~|fZXtN~4nVzBI?ipzwm!-DiDBlU9 z&w#EM25sl&cBTsNeYB6)R^Rw&3y0@Vl032G{W|o$W0(orDoLHZdCN{L{neAIy-s&4 zC_C4$OGhtz^q=8TdxIRnLBXY>uV#ZzI)BtKG*D0|+qum+NQ?t2b^KpsG?BFWtQdbl zaX+_SVA7I+lGQq`;PeWV3GRK_`0zogZf~efdCN-^EN~w2c zOrOxe)oo2o`ESlHYRXaX+oUPE)aAY$9a3k9Nzl-iiHDx&uf_al`Nw5rsmHZQos%MX zm@=t|Wu$n~9zM`DE@9mby|KO}CB&?ArIjkJa?Ta&Sf)Nv{OrM%WfEL)MU<_nte;tB zrqnRwM(V^`ID0_%_#BkyW;fqb_c5AI9N}4~lY9a!!nxdAt@_brYz%hR23F=_Qpwa^S9*VrT`nE8YhR4G23yZIC0^YjN zu^A!rRgW;0xU#bCjY0;sZ376n&w$OzqH{bwf(vui$hF!vW?#AA;Al;6+%0mRcvfp!3WJqZTCp_x)oOh2xukt zk%BMcPo>a2_$EAYf{G&x{)K_#K<`cypPYHnjvwek#cWL->EW!c)V>-JQUpu|y*kgg zj@ONv*a=?i9sK=ldIRe4ss5cEtA$P}YBE$*9o@y$0&b|;9Vh!TmN|TNb$_sz@-ydK zABXO5kDamW=^uC1w!WE!v*VRO*e(F+R+ne&LPS7*s-I>Kr z$?(j}R}y&#LiQErhU49w(uFeM0t$c9aMZ)v2S`OVNlhb ztMuXQPwG*rsaq}Ap~ro5qkXx?SRoMpX^R33OFK(ybzIguYu%oS1CU7}vgBYEG%BbU zM2s68Z_rZR$ljn`4sRC^Hm<=T1+wA?}Z+XY8PUkg8TuIqg-yi9w z4z&m&4%UgE6`n-Ybg7V4jkm;Vr`X-|`aHZQfQRo&1!y}5%)z%?vlX|l)b;a{FiNnNjpHDtq*h{*D7B8?%H;lSenOMe)R6~l)om3 zyts!@hb#B>@O--;y3@%pdkCXNDyVmJ;W&xcp+0aA>Bp&ig!Kg5nEhW9&c-Y+O@ zUqL~kmUrze(%)Zcy_pj~Vvo*et~(;B1PCuhiY{E$Hf#zp3x12N=$DQj7Gh;T4e-{= zl_AmC>?z@FFeThaz}t?Y;hO}?DYpL>0(Rj{sWHOSeo2ddpR<@a7RgV@YG_3)`n8Oe zV}VU@V6$5(IFOaN4m~xOnu8KiUvBTHiGah4dXrR3ZBn>X1zci=l==fF_N`{8I8?G? zYj_0#HrV$p^Nbol)W%Y~Q_(3f)D)7}pxcq3Qmo4D7kI^G+MBBUYyt+li|n^0_$)0A z|5A8zm-4{XAxv0=C-rF|_Yu|K*)LoJ(-h)-0?xq+r1mn@OIb8&k}}L12fK|dcb3>$ z0qi5kG*4S;+*o0X;GrY#ZKt^`e~5FD(Z3Q3yL@v+I=zX5Bsy>EIyN|8=3h0Tt{T0B z{<$b@FwuBm6EOxudPb+YNX$o%qMqmNc#f8oa?J(a|J2F)_DuLgMt!+;R4;NdI+|c& zPII(L`Db?*kI3s#RRuyBt~X7QB3}t?kc+eLqz(o)08Myt(7V-P)#kevayx=uq()Y$ zEe{pHRf(Ni`!tWC7%Y6>7vytVU9PKmszA+tnI0v(I_^lU0ZMT2i9iYGuAiFuT0M*U z=Yt9crO#&(r%oyU=|{GzAOm^e&p>V;j@3mZ3@Od4##Iy??xz?iM=Q{>*3~tf@rH12)%2Rz|DMG7&>aVZ!Ec zfPj%poS{*bAbv!doINNFCUhEYNSP)THStxwkS z+aZ1qHY<}(qPWL{4FS~A9K2D8;GReh5W1ve%I)06^I(QiJ3Tua?e33ZK-Yr1C?;zv z{Hsi5pvpO?j;=kOrIOAU0XIlW>j`3JRtN*)Rx9=zXxk7pki$vATTwr4yyaHK9(?gh z4y-eAN1TydehS1^biy5f5GbC&%3e@AC1qtybl7JscOUpwme7Zf8NEd9Wz9Cgyr`I) zHR#8KD*3}a-QIV{$A73~LKRG6@uFopB6AA9hQcpOX>MlscfkGf&)g@vs~7Fl-BL9I z`yx7GkDb%%Dz(ow?)GU@hKDam8v=$+okkIf$IXw<%q+dT&-GEa3vF;Q^CG~;6uD#H zdJ#;t)jtLp@jC`M#B>{8;fxOrSgkv|oE`XVd%B^1NF*n!>F#NbkK&EgcSV)F#X#(z zuG@jN_8oY{zmSOkzbcaY4}aAi^;-^@6_?`iPV57NFx1{(IA%52!0PY-3Zzi?gX~in z2zULlA43i|{4*+DMU!ch*aET6jWDQ+k$=^7y5K#qr!lUd*fn0DUcYN} zIzE2em8uev5w_;H4g@dJe|CAMmHvt5@kqjAaA?}1u-{!qm>jbYkRNA@$>zkCHj2h% z3qxv#PdZ1f(H8vbyf<}b7r_X#J(hixANJt(wHlokGYfBdJH<`MFqzn`7aWKn%keVr zMB(`e)2wv6@ku3)?Ju0DM8Aksq`{Xglg)9=st*{wQI2HhqYSBoz4jopnSL_FnNvO`YrnsA)K{`~+#*#th!| z=N2U@AUm(ny>FuT+Fz!_@6d(>*CVKFa-4;m4p~1hioX&J#k=_0ULt0svG*DaaXp~TLNt-hLX(( z3X-fs_LaMib+0HZL{a>QPdB<{@Ws+uId7$Uj@H>N%&lE+`E91wcMJWGkFLI*-S|qH zXIgzl`#VEm=E9y4)(bMs+RFdQGG`UIQZ{=CfzbGAg6)>%Q8`YTt_nDzVoy>Zx1WUw z;2vk)HpgxQE(&T2EpVe@V+KU$oCO-Ob2mNTPL!Z&%Nt^djV$$fPh=o$Zys@40kNsb z9dJ*0kVsqgQ)GbltHV_PG!y`L<+Fw%3h|Gq;yUME-9~(2r7#2^Ns16JSOd99>{fmk zbZ91F$Z#ol#e8JYRt8+ssRrl)IiOdQ3d9qwsP40IhHj8mPvlfvXev>c6~N}|Zk~)n z)pN7^I_TbUZhUN-gKUjkcoE(vZ9#+H)9^mO`o-50wq9fD-htH3f9C%39zsk}ITyhF z0bzsZTi*6)s5Sq{pPsVCi5Ka!jPE5Yits+gc*`2!tJVH8CXv~Z=QW&u@Ol<^_F5G`{lnx1FN349fWZPZtvxYeixPja>kMOs5ctHxLc`sfgZHUJqYT+@ubc=Hcz`hD*Q#R^_` zz_?b&CG1eD5=T0;W!Y}gcd%H_B}sQEAciNAW`Xs>!Cv?8YfclG!`0I?-{CK0otixh zF2$HP(A2M2a~B=AWK&y7yJOFJ=2-rPeqhn7OheEk@yYh-rZlb=sn87gmGkT&QUSe@ zYNbQ=e%Fp9Iv1jDKk1O!jI9VA%^6C0&?xkLeV9gdn5pUC7aVkW1YI&jTUgOI7=nR; zZ#-L=+mjW;qTF4P)y1}NO@C!2 zbM>|5ewXk+`WKWMTW((xCETRD_`K%xP};3TO48@29^tuDgB42dPdi7}`}A#h*N>5I zU7zq@`uv#*boSuQdI%1Zlv4z75OPUeD?hT!>m>7Q))YnXt{oS->yQKG4PE~DR{DPj z_5CY-`oDkv4E{V3H6$EH1OAPk9hgtNL4+aK&5zBp^N~FSfx&+9`rpIO1bt=V)Zk{W&sm%Ku5|VJ ze0Q2ND47HDB@nwmUNPw$3iO9+44!(8u#h0)CKYwm>wv?>EdIsAwRfr zI<3o(Zd29i>SnldcpPoh4>3Y0fj~5J9S5#&0n0-{?fBy`u8%S4oq-p04lr{V$yM_g zn^Je1o8>d5lo?mm6{u5!=M-de6kcOpFb2(L61wp2a@QJP(u>)TS6?cZn(mMP^_Qyy{PEQLq;y|G!qL+Fo`rb1Hp^Kj~O(z6`B^+Sb2Bg|n+?7_bp z>~J>*r?}E0N&HcPc9f@qK2}iMAW64wj_H?^I&huMKbw5Usc|R0%|OgA8jMLld}}?| zjcn4y4aG>B_iHjUaoOy+m_w>EKe_mIj9HQObX^5_rpVQ+r#iXFST>y!^0N+z@(fyZ zILCprNX660EX(7EtPWFaIaiip(Itmd=>hfk5cvacwfn3w!*9qMe`87<;?8`32da@; zW%x~B@&)nxMyCZ^rV1oC)T92(9YlrM4M|-)*VSt@#d^RJ%YE;6tBv)pUJg@~kEPWg zIrF``V&+j^-<#MjRW9*=q(OWmbVM#LIz48{Z8G8^3Ek!xz9?+)DIy!f0B7NkgrYb zV=AN+YeqWTSI2Ac8A96+AfBD_Lva8YprancTt^^Md{;s9Y2Fr|pNLlzEv9$y>Hu&k z)qj1bs+%{gzaCe(qggM!Uo4#OxvvOJ9fGxI*B^rqNVs?)l4fmNFk|;vIeR)yM9sYXP{TfFr8LdjE^#(I9uK({(`cyX1UJl6!6;To7+Wy?={* z0XG$S87W zAG;&N(4jR6?>*SdpP;%T`}+B<$$r@VL54q1{ zcME_vx((t^UAMl3D%QG77qiaPz5QHiJ0>dua_|na_7Q~WbjGJnY>A37oTXrI1la>q zz2;SL>t#u6;@A!R>;!`*tG=V>9^k!RIMF#DYIn06WBga>;>No@jR_goLXB_k>MJ*A z!-95M@Ye^wBSnG=F}~oc<)8R=^uZ!Jp<;vqeml3P1&?<9=u)!n>O9K}T02Go=?hH* zE$Md6egjxaS)n+>QJbhfwT`?FkOQ1Bf<0(nY1Y{|sB_bO$Pb`kZXEu_MHY1WXyL${ZQZW@ zpAM*_S0Wyk`{=2-KqV z$o1hgMXqDsJ(ELj8#C4S23T)a0$bo3d1@ZDpS@AwXZh4EX!CZ|39+qwFH1*;UC_Zg zF1`>pD?U3Ev@*nX6GL5cR-V}%9U;?*WX}l^q4l*x?u@DiE~!~-WW{sPCuM0pSBlhE zN>%oE50_c}G|g5`ZVcW`7)4^?9iP3q?t_g4(vFHV4!Rk8`{nZidjO;ti9QJ1%R&V> zH5e~+VNkoxVhNx!b*4kZuD0--+i$w*Z=+jTIGsO-ZN znvo*1Mx$(p6b}1{+`S4NpIE)&IeYu)&q4jzEYG zNlieCAN_BNZx)yxAWAz1NUsUmpvlGAJt_Y$6Z>I`Y^D-@yG!FWHT$B9O09_GB8{H( zgk#Gr>T5w|?^jP}r9C0KLPW;CKW%rX&$$m9{N!+<6sx>y$OsgScEWCmcax)v)fX_U z&~84)s-Fs`7C@aTnF;&AOC*$mIU_yNvqNSCAvaQn>RLk^L}em4N4~00h>%*MD6_uK ze5@Ob3dIoNm3g3FiV53K;7+*;VBVbVg^W>Fd=?1q2tepq0&;p=X&c%a!RbPDhHNec zT#=ed3!+-CApFP6(rBMqOg3j%%|u=xR-BDZ-)Bvqf7}_4oGUHLy;QnguOqwub z7sq;<){x_eg#8i0uefo;*%vf+H$jZe_{#`tA9{mX9k#uKJ-~|@nMDfJQ3ndCQ_A*e zxNp@!zS}H`G3QPnydXC0dC&%?7f{{zb_2$%0F9f4GmAL9>-4qiGKM*$Nys;5$4xgM zu@Q^5NadBnZ1wq=?eo(9fay>78o5(qX-ijXpe^F`ik-mEej4mBSD9+=HyL37*El8h z6#Ju@J!SL&M1EB7if@%Xpg<~YS_B-Z4-s-7zC?#apSOgsZlWwvJ7e=>+09aQ3*)n2 zBc&(;9~A?iqy$K+Q8CuR(fme5#?grDrkvo(kKTc{TF(E@C&VFq<8A zNWXNeVRs^x(GYmd$AUsl|K&yQ`QA(wW>>5JZNi`&<@NpqR+cpCT(}K!F|Tm*X=#IY z+J38V5b!A!ctvRaoM^F;;{|k>4nQoD-jcI{WF0)50=zLAk-_F#581P-_)}$JmyG3_ zrhHY1s?9Iqy>Y%h`j-yA=x-88%JVt8nU9p#zSiLVJN-_qsh*&PAL{nSWJuKyjzpL3@I`=866P@csCBe?0@8h2^$BXwG7YJdm~=aw+^mM4LUvI0|s4U4pr8W&mRP@t-o z3Fcvi1Am3egpstwK3C1WjF6wVPWM@T?tp!L?kA$rQNsPYPa$6jfA{QzQJc4?8s2fQ z+gM-9q&Bd+0f!siK{K<+#O{P zO7g2L1R(2lVr^Kf0;+BYK(jL~dHC%aNt8`e6y1^+S8pjo1b($&&oT8#uOhMzF=8T7Y%g@tA0B)v~YExA53x zL9A_TL}Ga+RCjCV)e0w_eW2}-z!CVWH+rL4tW|O2%lssop3^oHCEK-@1EDR=GO>R! z1P}s`wF^lo*hX9V(0o>AJ7B9{L&wz{^ z?-Lbco^HplkIR*h`;z1vtr(Rrq7b{Z=F9EpL46TJ{4L@dEuh!Vb0Um|P~v^tMy zNbT_0a`xU{a$>$*kw@n3K4{ojL8=$l&Ipq8WIcY4Re-3{vji+nRRvBiE4w+!%~y71 zI>}H(PLW1!bgK0!br%$bmFihl;irm+FbGMmwDCNg9RilWa$0Lo$4VB zzMFB-J!)Ce1;D`ws4-}6d88!kV7Z$H1NiK2$~Lm3u%qQ;L**L7`8BuKntggi-v!Sp z#N&fTDf$cGBV9Ma{?mTLjHKPcjkgf^mwjnE9($l;i;G$DwO6W_HpW;@3>c5h)%lk2 z;U%?NzhE3S733}Y=M;XvL(i1R+x&suU*kF4IFFUROgVA3-G%VK&K^sD>WbIjx%c9ng&F*6v`%d>R)|u@9lnP>4aWH*B zY%<-WQIdITpB=uC<8b=-_1S!PxU+rd_e85vUNW0L4;k7Wc#4n7^NW>gBKn{Wy;XQe z%Wapr5mMs5z5fof3l+xIZgwN2n+t&>?1*iu;HeN2nL&3gFcdzdn@K&xCHcYCfZcc( ztaDL+5+57xf7t-SZ6vIHR^HG7{Db}T5fNM!_fY^>&}rA?wj66#e(Ps%+9w32-@8$n zZLJ5hBl`3sUpg-pW4BA{JX@sLOY=UjYT1xgMt9J{z(y;?Cq{&?9TN^ubLli^P#NMA zu9jPs^hkLWW*$S<97-gtpN#ceE!gfM3?&WFV1pbC51#|9&duwL!#brM%V+U4G>eeH z*qy+^ z%Fub+5s&IIm5Fuz5^le4>dc(@tKtff@#;Cpu@dRwUr&DTC<=geEO!I?P0)t2^14Kd z60>wnuh)~^-LYO8#a#_Gwd&eR8KA3e_{S)?DFdetf`p=_&A$Q%E*Zj!hx3b%RB53Z zeNM5<^AgM0+FvR+cIrRPoCNQ#tTqW3&%c}HqD^ymFQC>!CYAu;fcP|Kx#eZyC7F&{eP^6j59o+!MjAUdp(|!cr@pZ#$Ol+HR?t>{(#_J(t?h zGg?792^V3+?;TR51`ScR{`K80rULi2PkM^O%nkE1(1THsZ}(~5zVC(cVj!XC#(O=# zYu)of;&K$eark?bwmsR)JmwkAIf3&FR8d(R$XttZ4oxJYepmo?bHM_SNnN8=unXKg=FGq zzqJOIK+9cU%#`9Xdn{&79_M@bhCNyUs&l1w++j1R?X>>RED&vRwRW>>lk+4%Q=Cpu z`I-cNt@MF&N(6NG ze;8w`<<`c>VxZ$biIz2F%L6slqOZuRkH<-qxJ_NbW5VA4);C|RIzfEDokI!pF443)bu!))#r#9!r+Ma>brZjS& zQalDK%cyxj&+xJ~^`j*Wx-7)|sinDuD)Wx~PIS&juO>d(YI z+Sw7^lk=8jsKaJ6^29c7bG*EhMSwTo zPJQh`>ew&$=oM#?urHdNymoozbQc!eo{B4|FoNE09r?K`>{R3r=48o9UU8j*G;QoK zFCfWvc2(D!0o}OGI_{*JFtvjeKl=sgdS;^fD%St4i{MqXqUny*c6Yn(wxCC+G24vz>-941ZYY+2d_jvJ z>*ZI8Jj^``Qa$lhYz=A{x)>oE#_LQw!yTA-H)e-+){u6E9+sn+0G$ag`aMfpW=fC~0YmogUhQ7Jb-kuk3#RL8zT$dQ#@MPXY zfMjAUZ2!*jBmYpnmloUb2V|IWt4z4!X;}x)ILShA(1zhU=-Oj#sGIsYdj4=w{9W%? zk~-e++#;8j@QZcAn%td^XQp(>VlCjax2`-UU(Y(Q=WTijBm3{0*TjP9$klFI=qafh~m>UlIxP0&HMI&v5Ac%h5OyV0MR0K5B90i(# zhw1!s-~EH%pLPh;q0VU^L59QMc?zPyEm_&4&u4@o2Y*j zb|Z1_&gM9PUaYU4P=M=Fc0T+m>Y@I~J4FALeu-*rD#$>du z0*8&=#8dzHRc6J?FX?wG0{xb9(2I4?f!=CveH`JH+TuenQLgrTF{i%2ahPx#mp_dJ z!4mu?;5FUD70c;>2C)RX3Xr?qF?#H^3!1oByNB7kYYZ?TFUDzADe1_mqdEhlpnXgN za^{mxE=m_pTY`BqJKz6mBlX;KA1|~oD(h8hI33}Wpj32WknpasXSU_kZHtkqi(F9$ zY>$mcZ#%hWEBa;-6*{Gc4RRO0&G|T!&f~ftPgV^+#gXVcHCVVB2{cl4vJqw1mf$_v zEuY}o)nhe3I&^cD*B&Ol%CFYH-HU{m20rJ8ERr6331!KCB$YnTO`It*0Gj{a2rcoM zPk1IZl8bS>+u@krkP9;^)w$*wmkYt^8#$G>Q!QG%AoVS4{p~_U(HRV7w4`~0@rL6Y zbN_`4Y?5^JG0qx+z0rQ;7Z(v|5Q+wensr9%q`U zs@E*B?(!?PaMmA-ylV*BE)Jl+4t9<-5?lW0{Mn|E|Mt<@9`qbuaZtOsF$gyM4XE>g zZbbrh9zq!dTA;p-kjkrg87e2m1oD!&5&21q3*2v`K%M;aqr#;vvVXz7Z-cvob$M@F zb-Gw$Bjb+gKT|ns{FT)<#ljBLiH0TZ0F*)Peh{j<;%?*Blnvm`$PZ)~Ve{9|tyE%K zxGg+1c5=YB$Og(2hxo(iQukao&_#SwGk^9`>mt~UqUZ5}9wj)Zx|EF@tr#60Di1?n8BH%5Y=5%2zqZ$7O8m?!)cWX!fU60sI1iX3Z(jd?by zU4C_z)7N@aM~kX__Uf?!dwW~{+qatw@Dh3JAWBKrUUB_U9i^;YRc_OAhHq#=Xggcm zmm{FZ{S^|?=_mJb{vVEqSFTrwK2|0!mCz zeZ^i)m3Vt}V4Ew)^W&2-O$nzT#-GfwZ^gwVf{eZP(tO^ChRBVaWS%DuKT7;Zr-sX$`l63W{AuL{(V$2}>aBwRih!ELA?x))Ag3P4S$5kK!?vM8 zrDgXcFATELlA;#5+-taHE_m$?49DsRfD#$?d9p?0`(^!Cc3-`dBH;Uv^6qfJi?b9l}0nGSY~eNdlo z`C$=eq3+fTdmc@iD(R-nB#!vugn6o$Ih8W1PBcwTOea)a^X_giK9%*_yUsHPj-}P9 z`;yFsM*(q?`_8_=&AXH2iix1BVMqcCv1oW^8W_s=9su;h1eRcfRI90(Sm9QI#cu#a zz~hSj)tdckajW%+aUH9Jud78h2QU2S72U|O9Hg?NI3^}zNE5E35Yg##K18#!+}WmV z%4X^;kJm+{-(@S(s}T z5`I6wPqnRhc!~QomF3Bb(La0y!s?3*-2JiX7G@%U3u4!rz|XVLy&;*$EF9Goro3;a zZY^lrpGvtVafF}e_s=6eEP2WA)Ca#_m}}+)FU2U$U7dR;T&_P;W~n7CmcC10ZI0F7 zSkC@`D0}mGDBJ#TyhtiZMP$iTLb7MyMv^33sO)>T#*lrRv1BVkl6@Jnyp67Y}zTfA$dcFK{+Bwd1KF9HSZy)-^)i0qrYpdrV+4isR zxzxKTB3B{s-q7mHmE8~QiZ+4TU6Q_39jQ`($vmB;+Iwu>gdo*W)}8T_+rMgq878|^ z&}JXbHX{AJ2gW)5)@G1!t7x~WC?|Kqy{Z=*!w&fYjo%NZ{G6YBm?+?N5AR7m?h*+v zC|9^!f2Vn;>$Li0tIN=%jTf+`(vyw_37@HEjt#=COOH!0^B(o4d-@vs1hY?Mmc&y1 z*q!R1JhqkMck7kkMfN$wiZyya_M#>``I(@=bJH6@2X5T2nqDgXbIUccB96TC_OqGu z3;P3l$OYKsDt=lq$-l&JssiZs5VM+d7|t5eLKy9Ccmg#d zwb=^gv{b#43Eo}O9=#hQwtDb+led;0`uraa-}>Lc4g;QP^Q>{HgtBI2wFY6gFIS|Y z&pil&A@RKlK2MD0Pgq|vbMK0z`0sGZ-X+~4Rp8D(Q_y@ zer;4BBZyh(C ztTy4$D=$i-`79!^Yw<|F^=cFvdU$2cV?q2<9RzYcZ~idDZzCR3(el`Nsd^ObSO{+j zm`tK&t}UoQm3cMLT*uGA5XU*Zq(&(~W?N6qAfHJF&@T6!d$L7GJqDA2Kq#^XeiA3q zyX|vAVaJb5p6sJ`%jyBK{v`X!iRL6ku<2wG8vi?uP=AXB$xxtgEvj9k0b5~4S4y3Ppe zqoL!w%C^-bvAwd`738}WO2rt7Xm*#vjr~ymj~q{bJE2M+eT#vw_M#u6sEjyYWAA(z zL{yelg1#tPQ^fCo$Z~0kGCZck|4QG{d9UpnS$h&QZUD)SrDk@MG6MA&x`1}cs6$*A)Qax6e0F782ze5@wQ$qarXCdllp=-#ZU&;CE^#G-WOhCGQU?Eeq-59^wOnY z6g&_%W`9*~A!*U8exnY;XM=zrET3$H@FppJNx{rAQ@c|Kee3?aIx%a-@O8*Fyt5+% zEPZwBxeSIswa@^is9ktwpWpoGX|(5LFJ&UDVECcr%LVJlBwKmT-qBVSJ++YKWr5M% z9=Q@SF<*Ocbei~yrD;UE?fkn|0b&1b(aCGYZ)gw)K-DPx-HouMj%)FbcE;MJUo&ru zC$wK^T=Cam&)8j4T)!keeagHy=1Z@WnblFiDk`IIvM1#h!jD)1 zhkVczb_F`B;kkhg^d<%G-(+Zh|53)Z3Yo%cGnKVStB(#iD>jUj!G&_QSf0gHz5Myz zMNjGgQ(xiW@oVhY9={Lv6K0jTg)*(`J;Xs@S*>@xR;=m^LdcO9lB8zz-YqKCrRh65 zUh&%k6dUP28L1};jsi9pg!_m64ikQ)_Dq98?mwCA_rDdFkte`56F#SUb5ve2@GjtxA3wtu*C*Z<7quYZwIzOd z-Hd1_u3!@=m@j zVWRJr!$YU8Gmxig6{TTh`MsfDcR+mXg)|AcCn~7w7SHdqS7<&+Sp%3bfYIxQ9?SUX zMHB&FuD!8URa)cZJ{?tuYFaK(H zk@U^AD9E7^-r9UOWg`wjdUcR-(15B>kcb1Ux~SFts>k2@+hCP4&8yW0z);jF*9n(N zfMak*xGc)y3&!mb==$AW#U{T!Nc6fE_~=z6!$S5E#?3Z#Sq${aNd^1vwBJ0s)~7l*b%0OYUh+LcoVZx)DFU<_p91T4q@cA3he{_ zgC>N8u-Q1HsXc`AMg7APHq}`GJP3x1=<||+=jqmf= z^!B#N!ZjH%VL4!F+jwd=VG@7b&7Zcr*tA9Cd{+L@j$wODWCkdAP6t5@u$$7ld848k z7OIom<8=2v2pbD`fMKaYW-(mvAXPTpwI5Uy=h<0!JF@bUP(7}G#*3!}yqpGegk7Rz z1VeN37FbdyYPcvi{Ta$cMm5%@hXLY{AS{SY^0+3YPk!- zPU;znLv^H+?~SKHu10nQwOA_{rM@J@H%{mAU5n7Dv9#F|cwpbf4#(vJhpWT<-6Z+~RUNEq>Z2jXsF8^iW4t0T%$v27RMtqt%w(rrcmVir6^Q zPu979=NT>Xptv;nHAYw1b&oz)qoOrse#78-Q-5QE#Dbf=WAaBS-mzupp15+BU|bE`+B z@kGmdD2v$~{X4Fo9qal=yR1sryIsRM$|p|M<-={(N9_VwwZF*qHWu#(HSK3^Xgb4` zQR7baKG_popreiv+pY5o)7!~<>)*i_p7{01EV?(5zL{^HoY0r>)BD-`a!76l0oHPc z%97wY*)aFVssjet*;1w;f`*} zWVonrSgN5=IW$W85FXqWE z1PA!FdRANLrM}E$hJ#X(T9lk(W{fgJ)PgYXQ?8ai?o!^R6^9~(yB)-P*7UGCuBd+B zqj;Y8o04S8@CiOZ2D~t8kWBk?2nPqeUORf@Kkn2Y z4J0-W-8d>$bq5S)KCN&1)f@nHkhY#yaqiaSZ`*KpaIkIpFwjB=93vI^tfhbUM7V+^ zE(#x%`*&@-RD}PEA$uZ9AA=<;Ea_7&iQ+v*==VMpMbS$c`hXzFvxuf_xz#SQsPA~Wyvh7 zwNj*8_g-6AvPKfUH?B{GMcHIsnZF3bTSdjl*qCj(;;rVw?phJ`jqO{0&@1&*)Uh{Bmk4GJ4e-cIR)kciLcT@2r;vTM!O_buX$u(PA5B-Lg zYxR1HyT3g0({|KS!_#+P6DvtAsM?;;-in(2cV1e2Kbhfo5(1Cfrty3_&0E(SFw;a{RN0C1EpT=erPQE~^}MPIO@Cq= zRwp<5;oT|6W5ch)(<~vzvdZ;LbL8Y_ z1*@yB@Jgp zMtw0(Ux-4-V-xd}9mC11G=TeA&;;dk5Fj3*lS{EOe4iyL#Y_E#>}F69TBfpC^#-EQd{Z;m>26$b};=Qn&? zo=9;Nd%t?YNU(@Gcr{j+&#sMy=&9{k!h05-t+mKo*^ za|AU*d#mC% zT;NAJWKK27)fVa)rp@wB!-jj~n`rR~1qowckVmCu6u$azZr1-_D*yLKEErF33Rq=N z7#VZF62l<7PqT^Fj)tPcm=D4^eOHy-!Wm)|zvz958N|PmVK=sQYb#<<2Kar5`be9*0zRl-N18^tRvyNeIfI~`-YNQ0qHlk(`VW%A%e9V zcN=t-w>v!`%-!WCr`w3J%-coAuCu6Mv@2*QOmCAzX}XKmH>L z`rqAH5chA!CN3N|mYehQP!}KK_3(Q{cC@df*Ykss*GC7fO7ClYDa2N%V<3I}3s5LC z)gsdMqoU4=SI!XWd8az8jv}gB0tVtuI50LZRf*F+iD zcLxA?57-fyyk>2lSRXTq|4ZA>>vt&50Wn`O+mAes*IACpk6ujj)|H~O1Ah0@Eq*A$ z)ySyyqC#b`6n4O3?}77b{nSYDnoNq5%wOWfcF6(Da#Nm<{sN1;c6As~ek3%thL%gg z8D2m3{xY~C<>E&c0ukjPY~!!v_)?zy_L*^SFBd(pka=b2*DgQ{;Wkc-FR!s?s=^6t zkU0ksm6#ZX;9@qm`!@swf-ol^EWj=ozL>9-de$FAp)8Xhzx;pA<@@`E@~;cY%Of<4 zw`R_i$wXFNACK7UJbsr8*H$GUya&iKyR^2-==h~5BR${j$~kl{(md1*NMwhP0Wts6=JZT?QPoDhsZo{GJ z7wzP7K4L08;N%EQ1F|2J+eKE?F>1>f$Q^HyJ)HyE<)GBq<+g8Qn)Bmdi0!`Fk}>U- zUxWv*f&BbdDh*h#IS<}8e8r$1kSduF>RBR4BhqLCd6Ctid&%VR0|N{rH9q~>#*mXF zp@=Dq+mx__RwTtHoP6`G;y+GORWh?YS5;;9Jw)Z}sbfCO3F`8iH4ES6t9Z;a~J{p|A+f{y-X8d+HcdZuC98SLHO|Jyg zc({ZjN`J08XlL#+?wdF-nR(1+%r8hLJ_lhZs&m0F9|dIRp7Jx3jOleKvMEZ_{#9P4 zJm4L@o%VzAP1A6kD&}Xaz|dN8{f0XlUv;)oDT&Clo?8gKlxhi?_g8jr3upyII@Hi7 znm=7msxF^Xxkel|yg+ayjaMdyS|n6Iyji$#m6VugvvD^(nKidblT5v!dTqSQ?XQyZ z-o}ib%0aDhr`JV{f7gNk`NBZ?+le3JNow~Ad2_R(7rfdfQ7EqZpXb{D>p5>~bMYP< z^K=T06#hwjSl!skgKOO$&py{oYKZsw&?dAEix27GBmCL4&}&Gk1_N#}(o<@qoz zh^c1R!q0UJYc{;L_uQ^9$6rJ5xgkBqhD;U)lbMrBk)VajAD8m{(oS-%*%f~FFvh>2 z5vKc^C%lw4vVOmBTzCA-Ndg0n@0bne`i>fc`|3G(1v23lDe?P#{d&_?H#4YkXAiYm zhWoVnr%Hi0>8E-!Dg}ari74lz1D1eI6rxkiahFp6W9s!ZK`j3NT{nZUp93ie9LFqK zlmk2-r9+Lkd1~DG@8?R0i>m&n^KrZ_!v5u5Fae8W>4rc0;s5yr*z#~xkpYX27sJk` z5`N{V959z#3JP9$Zt@abg)T&YDA6OKrUPT+ZXs%X9h&m~PvCvJ1 zJxkbS>_%%B0xSw*T#(H*C86^%!WZy~ zgx2DVEbKZM86#C0BgvW9_#xcq?y?O36&KJE5AleoB%i0^iA`>;kj!uWo}$7ogH8}c z-Wx4QtnWuu8M200Xj)qvV!DCzK%(Uh%(8Ry?cq1+`4R4%!eH027v#Bk8OI?vX!HHT z5<1I9^?5OHxuK3macJh%?|g55EbQEmIf+c!9{}6emJL5T9iPlv8oMrf9@n$S& z`a5Iv%ds2w31#ej6*#6=br^1vs5Atc8RFl9tQ6m|BCoWReMk)o-v79sJeH zz;Goa^&mMR+h%0U$^KefXXNOTHT$cHI>7nW+tNL&rc#k?(gYp52@X7leF`L8tA~h zzB*4uXYkU|GEaA;K?JLdgkOHYOQ}4XSRhKg?NZ_PJaU!)`L#_dwpxSp4!s zct-CmG1gb48LiZkq2tMS^m<|Nx#|~B(4LilV)D!bB z<^<6RlM*||W@kvBIGeG7pxUCUP(VL#?$~nu=!2Bx&<f=8=4_p~}-)x^Iwn{H$ZyfP5`2{ZK)y|zVhLn460Ik+H+oZ>-bfx+2s<>8esP{f= zIwLz$^PHtq;aS;8{YD#A^|SW?;>(OPX6Jgu#MX6fg+|^Mq8k;Ztmld0K*%`aW|F`A zyHTXBMNtVT#(RlCbbyakwD`NS`fEldXp(TBFbIcz35JR`H zg>&qZq})lx4uY052>qC&2g!)#!G!e`X_sh01d6+IJhBMOe|x+0fa@lqify;G>#CIh z#&~<$-T*BDkdA~Ne&xYBj{@^pcvqvv>+ z_G})>%zc-pK*!=Y&9PzzOL~8{>IuK|Otsk_mQWSX`VC{sL4~$p)P$5JUElM$C`MeE zmE@SNq=E75cusdY*V0>&*ZLO(NJdRd-OH9g>}>f?=Au~cUst=Kli3#O%&3{aYCHhZ zOU4z=pG&=}N4rh6Mooe8&Yt3(pEGpxr`D(Zsc8;nmX%E9rw`yi`pRayj3mCK+w_#1wqiyF-%ivpL$x00vF8mgv`BAWaByufKxCLrka<%CL_Ba~ z-yTt?3n%?F&L=oEYJP5eHW$|Jy|S%vC1X3081GKea#^HTmaH4V>=y0aJP;5XlIL&+ zx;mNh)hJi&&Kp0CwwR~BXib|!_k9|&d)@a(c<9GXuVpXKNr9yJfz5nF=K6ufH)pmR z2*n63xL5)(-|F7!ghJs;9}yjD?WEOw9sE=5Tds5pIOa^{TilT-)|(iwbn4{M=qF81 zo%o`BghMJZvH?a$b|Y@pw;w)WkIcKjrT~f3|FB5Na#o7bHo*H|2EZY&HS0*K&cvG+ zN;J%l!$7Fy3K)aT6#3bEh+hJbKy|4QNT9mG$#CC!)K+EtAkMB-e*3`CcJ4!WLQ{++ zcKAgj?H-U8_cts14=&ixuRY?*kTSMlOObpdfm^)!Vc`sD$^!b17v$r1Chu{;_Z*wx zOy}3#ti)l7bNjizmTn*&CqscySgJ{cVo1K^q znp^X89?cn1hR~+Q#GO3(X%E;e15%*J?Num0jXsBFsqn7*HkC-X5g-yq+>=Z)69I4y zA$h`+ z8|a^A94a1b@94%ZEWSaB^DpzP_>$!m2Of_9^f4i^T~$`>*(|YD7j(K`crbEmBsV5s z+f<;1-OLg9l)YEV=;g=MvX4se7{3koavc}BO z_KF>&&4yE2<~C%;eQ7jqQgJhW8`ik}SwnfZVNtrf{iq>wy5ard7TUg6le7uqPD-2iU75?e2{R@m2#f*MDWN9n6vM7vMAm5 zH5M}8OCw1pUr)$Frn$s~p_J;ns-S(|R*LT}9gA)F(6E(-nVk@w9@yH$CEr_Das|7yyGX1zp!z{fryW>{OF){Gp}lZ+-`DBmiZ zi(A^u17lQuY5fS2HiMEvz&X2OUV5+Fp!CLaH(NyD)WPz^sM#}8EZRSM`{jWz=|G16 z`|bLVt-_=#>|_L|Bp=2d_BiXxCLAL*cDb+NV?y~;>z*8h%S-9$D}a5_X;)rTZTRqm zl;=mVQ|$NR7O{zB?X}b3Tc;6om8RGz7$vu>;g0u@yN1OtwIF4V}#P)uvYRj-2 zaJ^HVl%f_5>s^3h$gbtCI?N;0g2w9|jqWm#adRO-ICzm1Nahv8b7;wgq}1CEQ>o^0p|) z?vEXV_`hTzj&3Q}UalJM6o$#FTNOe~xDfI4(f`^^V~AJi2BRFGe>V*{)Lts2xvc$| zUNxKdJ)xV*#|Zr10WImVptQa1c5Jn3MOE)FOWBir-Fw9Job$;C5>Jikhl)>KW5+GJ zzp9~wH}wY=tBVv*#R-FHa+o)%RztH21Z=-AruBL|CueXh#}vht5l6B{r`}35#VRsC zy5-av?|g=06$e6%*3kN{|!QVb)?Ht1$ z>ZJZDJV77S$#~dcce=2@FtD(!f5^g8-0N`b+gOp5(nZI84e$SBUvwd~&`RaE;ZU({Z$%P`=!HR_a39fsC_U0(-Vkuh&k@1jiL-S-Z|i0x=FzFZ6nk zPC3gdx!Ryt;%?*#l3wZawa)F%j)t~#_|~a~$M^qev%FpU_M28ED6_xA?^;8^Ti&Zh zsGs1DP)P2&wnZcjmm*`9kMO`iUH$AgK1kV?)?dg@Ii!H<*k4&a`ws>mPcHuE;`#a(6UWx_W>lRZ zf+<$vpO(3b3MY%Xxi91d78x}<7mr3{A!0(8jnyChsXF7)H?~8h4Sn~ynt`3UtSU+7 zlH-Yqn5z=ri(&J-{_pM6w=uGi{UpblinLhfb$&^N|Jd!zac^|qjM=2u3TPa?s=Jz0 z*PIi?i63|GGF)*}Q4!wD)il*mSFm^5Nil*KAw0@YxaGJDV=N`^b<+7k`&jCr#lnPL zN8*tlhlRT7(D2yhsI-DR^n@tv7Bcs9so7mR&T%y~!J&~AR43X1It z?_Mvr+v+fG(lYz)4=3qwS;Iy@m6Wh=6~Y{4BNgfL197_3X@YNe!cHEJd8W=97d#Q& z5p%+nd?bjm-dArz&8eLt@(TJ(eH;;MBQG}QrdGhSl3vlN&n(BW1I=6+1_-imdR43O z=P2~@BB)z3+Mp>|f-e)q&jy;#F1pP=|8ng0FUQ6$+iMpE4k_oIL|x|W-hwrIu$ujG zI{Obk_?Pj0e8?_Wl<3eAX-l83A*8*2Zud_cPGx05E=AX+b5IN z3;xw|Y1}B!uo`(s%8}T$d?%)gR73YJShI|d^l-T0ra4&AvA*rRr84`|iZ6y}(MVYb ztox-!I@!V!pQ|oZH*6Q<3@?AP#P=jXk3zuAT9=qC&Z94o(1FjY2Y}&HW#?p8rJ_$> zr@poJ^Yc9O(E*E~-IJuTt3bE$<(%u$eSlEd{2}9yy z&mu$Qz*p-js}g^+z90}Fr_n7b`GM~4D}t^(5HWjF&%Pw;yvD^k@RQ2bhp%!kKSZ~Q zmm|jwf3W1S59_c_&)sT?>>Xt~R0$X`>I;1(YM^Xc$%G@(tG-=Eoo_a&Hf6uP78m$5 zP->!VZ+M#vWfk-dh20|#Ugb|Yf`!pl&=`coyu1srJSRvMPLp7kv$c8wsbMF`J(J+_ zrTp#|KI|8v?*Q0>DA#$Z*b4`oeop@*w*TK!02UeFmd=2kYb>+h9cX7p@fykD#$L6nOV-X;7a&ezQgNFP6`^26rUl(n3^HnFg^odr0_Kp5f@8=} zKO(_OJuhFpb&T}&WsU9@MfV4%H6l@9ugeUIIgfU~sF2>uz~gVEm+Jc~LC}X$Zs-{ zM9P@0@UF4GYi1NRJIZjHmTH%noqKdbBsUGa-T^&S1cQ3*f{aq}syl>>|IB^#ch6*S zTf~P7t4m;1Sp#0k+S7F%5oFtp&aE2-~=@ggRfy`8Srj&I@5OP>ii*?7a%jrO1f4lqb&h zU9Prced9|N&DZmK(lYAceY*RbZp`5-p1FKd066s}i?+!ySEM9sU#6rSW-)Sob@{+S z(6J|{*W0?_8%}fAvMxazlj?3m{=hJ>iz_TiKQ}X&Krgg*Ug*OhK95_t*L!(4a<(84 zC*?--E-=R2b`gf*EfOrAB@X&Jk>8;@?e2dTv&un;uJ2Ni$ZhLh?)%x74`>rMK?HP+ zTD9#qP4gX-%9(438Jug%9~L6VnlK; zNerJr;dQJF-2yf63|DorE~E)6GWXM#^V z>Yk$WQb!|gy3fPo>WXw@^d8{wiul`ioqUz(zz91ntocZWdbg!$2CxkjCZBRm-B~=1 zGOc8?+M@})J9I-ne!7KL6JX*Mwe<#KSEbsj{A3kFcb*gsuz9^jcr9Ne|IQFr}~1hayOf3Auc zyAaCLuS`lo985@BNxx>9&yMMP+4497;6}23hWc6m`lCfYo6}dWN;vT4iZ3Z= z$RIM|sO(*LFj-}juF4kX9?jC{H1Rt@xdJ6LV(Rj=UrXL6+SKwizLdzg>{_E(s*K)- zl_gT1`ETBD=(ig0)_*aBEH-nt-L)xbeRwPNq@l6QOrRRk?57Em;cel_sEieWxDPJv zzPR4u&FVx+(`))zeUJZ#G#qup0Uu0K#p_BrMD)7rC6KrX0zCQyZdBx3QY3(h*m_Yg zD&^??M!t1MH%V|ynnIuO@O%hZz~|_MIzU-AFS#NkV!l6lOZ3e7{?D`}2dwyL?&_U< z!A~QhiVKwY-ZRWw(r@?35<8udyGy)^Ue>f&nQ8~^yb|Nlo9-);x>pNCBei`suoauSJrc}cSGg=Ff%j~?JCkJ&k+kTIbGlCd65 z+p|n<`#$40O!IK5IjPeATv-s4(Q<|NyfIbfD~&u$-;0-oN&oInM|{vS3K}|{m8?CC zWdcS-93byYAi)uIJ|v9)GCt2dH0+F5cdEAveQE4tYjaYBh4(?7`1pt@D&p zMbov(&8yB#8FlS;?p3|9BqQSl7IYb-D&V_$3K;tY0t`i-VIa_8+I%&~Cj5dG9N?69_#5I_DzXfjllwlP z6x6k9GeVt*ft)L<_D%B{<uIOQ{RsYwR}&ul{U*x&XO8Gj1>(KFnsLdbwWL!U#c_Niu---Zu!V@~m3EExWrM zdJ(h40+FJI52>;HT5DI9hiH);G{f^NfXc7zHrQvEM)Fl$*{wC;bShg00x|gM^7;rB z_{pGaNG&>)TgCx<&L0jZzl3234n)!xl20z>go9u8S zQD&ycKufrn(PJc3rRLw#tuCiLYjNVVQ~^`MH9^uX3(J)Ce&=A?B!8oquUvNC>9Tl_ z$ZC)0jDG}sw%o3l7H&A|P0M&;rTyl@`NKP?s_I!d-)`jX)d)j}GLHSRU}_r6cP1~# zUx^;{3k)m%I1{=+XChXu*euA?7vq*(DnQ`ER%&pZ zd}>^}SuQbUV7-?j80Cih_~J-%0JZr%i3CkqujmSzN}JYno_tjqfsQzuY5`DbskGVukirM60t_Ag^}RBs64v?88}>i3aLB#wy`hfVfG_HA>_SO zA0>svhx(5#_~@|geSoV+6t*$y(6wu+dm06DFVjUSumvDd{npnqE4^3qp`XWAgsG$( zB(U=*i_{3AJ4k}4T*+0(BR0+=#ZF-eod_Iy4wz23l-7ILF-9gdtXubx_JdtW@gD8q zh?{5Gnxh`L5+aqGM&{Zp$IAsmsg~cah5w_n z^1raK+yB96)ceUng=O|TY?%JxEFJ@3?3>0bqhRV;_eR3<*+?|M$1 z&Qh_=h3zd@B{g)?t?JqJ|0E@6K2=2<^l%ina|}cK&%?pvvxB}|!yJ;172EfE`T0$^ z0B9!Qm0d%5N4#%?kMpz`xN;jN2>O(C6ERhP(YaEmd#mEFuS4C7Qq{GRiSa-ETcz$j z{mwg8X;oyglCzFqEX#a~_x1)NvRt+kvT?eWrqTrVaA;q^>15kX-T+a4ctXXFsk39M z_l`nO<+-yNFB0VC2?7i&4D)j$cAen_t^h8OYu1h3do72whFnPv(j_~*hoap^0KAJI zoe7>$50qk>*p0m6I{Ag>s-u+k5nEW>9VS~A=C&WDDyQhoEdjJ$OO>KgKlVkS{>Sl~ z$PWUrIkCo0+5F}o8iN1!rv3vCQ@0~#^A^wmO%5yzt;K2%#APwz27=jW$)j=HpCT~cE+|5CJ` zHpx0&lPxd1k(kZZ<0`g6FR}$mClZb>|tIPqh#>?A&+S8RS?`aYlQ>=#l@#FJpj?4m@#5NindL7NZqZ1vf%u6kzOt}>4TAeRHj}h3@ zyim#w&pKVSEnLkqu)4pNq!lnV_8hUkYVhWab`rCzUolpsH8EDYdrzH*+dH6!M!n z`o$+xsONcm$Xc2vge7=`&y=M0EJpqC0dWr4j2$xN*yu| z8R2~STz+x}@`;4B8v2k|lyzgZ>xZsIiocP9{OkkMvL3JUz7Od`^&;tVM#ImGP`DS; zBe+ICBOydZQY2)|is95^jh(0PELsspr4qmd%qnWw5nG=2@x8Kisc>KbWW4i^{!_SM z^!!|_dz7MwryQ6^C=sd=3x2T(@)jwlDTy36H!MF_Rk9p#xKMJ5@J{n|g} zmAcP(CNTC(Gniglt2D42wP1z{&_%f?)Hr)JOD>Rgw5w(ITdFM7(LVRDQ>63xTpy=A z8ERMXQv+qdzZ_X*YXNg-8_F;%62@$cPnB{_=Y0p?jT) z79M&z26c)=PIp1U9wIbb;<3O0f#Bhr)ZW=5J~&+v;t}_^1W9Ql1aH^gAcka;IDFZc zKj3EOfccqgw_M`t3IaO!dG`h1BoRK#TNw|&JbGNs!rA)@dt$59dhq?Ik|WCeyBj$c z0ON1u2<~_sev^Qpc;0QYnx}0g`)7b;dJG%AI5sJxEy}|UrPo0X0q3^9H=3+<`^{A< zjPJI_wcyRw{F}?E{;+8s(XilUt9;C&%nucp$eib5evW%Mm7{Ms?lP^)8_|YrZ2=DN zpJ$>ZaUzxpQH;B|!FX{l1@)l2a-S?VI(i?J-y<2}RYqMmnX;;?3ffcab%%4nsrph~ zDy>iQ_(?_qYG(bd?+sDI)4mWm6c)m@>pkJB!?IpJrSYxZQOLEbZfSAtzE%?o`SA+L zfn{$&77?A#E|*L~t&k^daA+;A3~Y} zAHMB9xchT_?I`~GX}jMsxqt9hn($3aysfO?@<%ZwGZJ@Ma>T{$fYQMondw6{{Ps8C z{+@`|GSAr7_^(I$v1;2{2%}JLn9}owZmyArr7rfhne8#a#L-X=yfbe}A`T^PFMTZk zImK7yxEj_>pCq98nyosoMlm~*cclt2OE?*3oSyssbKJ-xEfe#!OK8a*zV43gMOw2v zKd+3kGBa0WO7Q1PYmB)>R{~I};tKcP<$-=hl_gWF!;wih-Vj>Iv>^(vFge~em4eQ! zB>)OH6zYAkFI)O%qdZeF)N#SO_C8dt7m6Fv<=B~{{&5{o4K^SZ7MXW-lZi0k|^2m5$kWl)wDo=xFrQ!oF4k zKKA*F5>u!Nb$yPoU7~ndjkapQfbT6yT|gC%<=d;Q9 z9tS}2uC^*1X3ZZ=QIi9}t>jb&qK}YO*$63AssGV!3$67048AjU;nhh<`Vd5q z|1^4YP>(ic{2s!E4&w?Q*056=o&_ZjYMk+__qi^U6^s>;b606NU@dV3>a~Ja0O9_> znEc#88BR$~Y`)KDd^nFFA(+?@MT&KweceiI{e+hk^f_w8q=P?cH<;a;I9upKawz!g zT9-E@mTvf_=Bo7tfHV|XZ(q)rAh68$F{~y7IRfi`z`w~Ryl+C1hTC`28)F{=1|ET< zXLl(wkpnJOl3z$n|Fe4bZv@&662vXy(#_ga$R^<%=kJ~AXN~x$#1(o{l+uZA)cbNP?TfE~ ze7>BLr6?p?ixia`ea={E2-Sn553VY{kUF2=TlCQRf>~cDtumUMHqq{;sg{&_kmYcC zpIs-cu1J#8%qY)A9%%HHIJzGeJ3o7$C|x+HO53Y&d_TRF3thnPq3c`*%a|(_$P9Q^ zJ?yEql#TKXy-ITtv#g)+!b#_*4C6VUEavCB$H#C>5;t~ua4~*t4O72#+bhJHcgMK= zaLlRrn=fg;r0g_rm+=i$t*ByX%Bi)GCcNvb=CRU$Hc;m8MK@5&1P8^?^<@V_a-;Ij zYQ)g6uV?<6v2u62c)XNU3P-!$UUP3X5!WrvvT|Il{8+vnQBLdoFR?}Rp2|L03onq6 z!@2pwvi0YOBBGJokCd}@BSntNDAZ8%xqVF4fa_6C6^DJwwtLrkgv(m&$!F7S=PlVe z_J#2)g)*8pLv4Uz$68@e%p}ikL@?v^a}kF!?;K(E*K`a5xf|t<{=NxJq!Dl>5_Ppt z17+fvvQr5Rv01)#bBdr5%)uy&-m3LZ2=|C~R#NmRsbcCnf)xW=;nIXH_q2wy32)E8 z^*3tdy@WXC-z^``5@-F9hFS(65yWLAHA)q zS!T)8R1U!Le7&y~fZ3sGc7AFCfodfJA)$XS-2ZqHL_7c?ytuY1 zTxM#;0X{6%*EAm{i|eH2IrdMQ35t>up7PCc zxR>^m)z>!PO*%$swc>Hsked2w6=8mNrCloNwee9NW3WpMseI}Lo*M`?65=Q2d+7Z_ zY6dm;W?Z9L-0dNLN70WfvVQJ52;96$F@zj{yoKGi)jt4wO4$^^k@cg_8bn9c8FlT$ zF{}SqdX_<9!wYlrq+Gu;ii*MV?j!V9%=3?nfxR5hWsn+}_a#kVV#Kgvr{Wg1Cby^p@tPuGYA$r; zZe^J@{8nzvAVYm_?~sy$S@3E_(0Su!e%}IN=*sQKD-YcmtFyHu)BJNag%_-RKlF@o zWJq?LztPCnD@ch-7(9~4u5?|Mefkm`%4Q5lBXV;uJFc@(#?pUw+Q`65|9WmE+QoJl zCp+#?&69ZK?lw`yQnka1vd~~yz2w;~PIM3*28c^VXsp;uei6}o0MP8lymeDfRRyJX z3soqAK*lQvA=I2@O0LuQ)$hmIT2IjGm@NRpTgR8+GSz@s{U_geYoXXriO}iQ<$4hY ztv6jQe3?~DEz(e+^zzF!q2;I zGlp9X-qa4MVr%$NIrk{*-+vV!nDEaaughm7)5}rc?f-he$s<*(b}*C=hB_?I9y-;p z<9_FqCZ&0u94&eQ5!3qhdRj8Men7w;KHX~y#j^;N@;<_vHL){Yox=V|wjW>)AGqP#acgp;-n?MkW7xC~n2wN1CJi@D0Xf3;vT0vy_I*cM zqt||q96cmv$AIg|K&*JVXTbt6FX{N)m61-yzL7^kJm5`4<~eb$AqrFcCWSkA`>*CM z=ErhaTfqH#o2A$=m0Em?BW(FfX2z@-ry<#gSRf4F?0j$!!}kWGwL0&*k_SpKK9Vfp z!iwKwO)BGps|38dkxQ_3=nvN2f9Uv_g;31kH`nl6#gL&PS3cCNxh!nNM9Yz7uQe=f zrhl2Yd=wca3(YpcIK<-_#NmOwNWUY7?TCK7823%@p#}pw&=hvtEpdWj| z^rL1`855$lG2ME_!$MnJ4ce(2sBZ_*EmSam?TGr&!|4ByvhxgTx@)`rttf~Hh$y|N zfT&dIEks2?L_kF85PFdkdJBPDK|txf6Oks;drhcI%mfB zvjgKy!rs?jYhCNN`Wbhs50>Viyv;V1B60bpyk!Hkv3bPpH&=pDx0U>Ezq(kvv)~76 zbG~)*7DA;$fL-6$TY9%h*v*i&8{k|cAk%P;>KgjmtPhA2mfp`fwT9Lpb_O-O+1CZG z_srcmIZe>WEh~Kbcec9UAtk^C5d_w+x1{wRF6uN)j@Glz9d=waf*`g4{ttZSf=t#` zH%0mVBeVp0u$Oa;^Bl!xGZj5sng(q-6Sq?5POLofgZ-@Gkc5wIG!3p7T-ai~jFZs% zl}>;;#Z})%+obWIt+?ZMUip>+*WGPqDVFl`V zRKK!C=8}tL>i%=?Gpw*A8X-QL{M_!6*r|nY{WBT|9{a+7SMVWPv`ctvfddv}po)<7 zx`TZVdN0nhwyjC;r7l&iyg__|{AQ)`Mrt)b{Me^rQ7KUp`Ambpeif#e~`n8EvNm&z>0tU9dpuZz*kHsr{MYRfN;2YgO(uOYC40!-)1 z2>~?k+ayT(oT((mX9{RD0u{4N6xWhDvWMYQ%8H>jKf#p)uDiG!M#dRmT@T|d48BN* zAL0F3OvH;T-3;a~7Ghmx0JkB&|C*JIj>$h#4pU=Q7Rko0SIBFmxo!uL2~9_LR~PXx zubTRtJOTd3KRuxgP<_sLcvMQIOKf#&kPuihW_aAqSa^sE*4gxg%WbW@DmB8B{zRX_ zd*1zBSm+I1v#qzye7#sPP+q^3sFb1^ae)y7Dq+bzX56iTEpDJ+rg2rg9!Z>?IvYNZ z0GeYO96V34O_i{bEWe5i^oFGVdD~4X{D6UHP2-9{1C>zY`tf9Qa7SaXJU;Vki%t`% zY6}2LTYy`3SkSdfo&^RoKO0)_6b~5fe%0B`IO?(XxWGX*i1tZk^+2IC@`u){`y3s9 zq&)w6pl?eDJ=zz4(Pa;OGx89`5zjv_gj$<9C8xh3dG*2C6ZW%wNl~m9D>T5;?h&2` zJKR`ZtICPIqbqZH z6>K+uJ>B?*8Y?#);H%MZEg_in>-iQU?hHaI^Lf{LF)W?fSAV{^vbrB!mJ0tgy&cTV zp_>tskWkM+cncXH#NVO;0b^}d$@gK<|Lp=0(D?WAV_BhZL)NK=_C~7Xe14%i3w6 zGyM3Q`@i(^OR-}C2W5Ao*dE3Cm5H7tc@*)WIalZjR>s$!RwI%bzig+1BU^x!&EGAu zo4lSMH%I%!H@pazoJRmObsV{PXQ^a(#{c}Z0RUO7Z@DBk7^tB50cusDA&bZnz6vvt&S2?DXkgRc_ z=#+F;Sar$m(ux%8z#G-d)7QGG*kM+C;!TW65o0GGI}i8%5{%R(l^H znMuk8_UBhWgLNJAe}p>ljs&khuvb7NkbF2}eLyIyfbG~d`No#d@$+?R*q=*v6KV2V zA5-=m#E}?D5)4(wX&@6yY{=s968)wbpQ5yH- zcRa02;S8KAp~G|EM$YaFspmD##+2-%;*LH`Xv>*1S9jGCazWR`f-fqraGboSl~yN< z1`H%-LV6Fz;XkXqhci#j`fqL{juVP&oP3&u#1^^c?7oC$)Dj%@?g;(u#XmsbOzEr4 z=G>*R00Sx-rr_YzOJLx`b=UCQ+jhG+0t$0Xm5KXc|KqLgv#srV(SErK#zaph<=Dyo zlOByJo&BxRbUzYiMuj(h1dh+*WbZYiABPiXa9G&(j1hogAZT3z? zFLtl_OEWkq@Ed{FyQ1JhZsJ8P8Zi$jJ0wPUHkwP#Y&*Z@RKL>*G~`XDyN@N}?0^dH zi$OtYKjE^5&k%h&)hclEpkU?RwC4T?*8a1Z6SR4|Mk|kXFvXrotou0ua{f7U<2g>U zelT3_0H}JYmECD3lXZGS2KlTKaqVRMCNNRVjlWpneP~G*SnxvhxtsoLeTldu!|lYU z28xy1MddjL+{rH67bC?11z2#iYJ%jH%$QMRFrXuuVA;lYfLCIb7^w0=g4>B3Q(iv4 z(^C!`zxN#8l3Vd3bOsIZT62{v8P3m{C97;Uk}B+P;tAD^r;7H~|1`9tv1SA-Bl8(u zGPbgaJ3>?S<=;KC)TbUMI_s|x+iuX>%YE^}N@6~9<6BMzry!w@W(3^{)UE%xdjIwQ!(_{KB zh3cF8x0ElJ@3=dkc(*0%zU1tMg+ONxPJBUBlA-D4D|E>?UMoCp%k#e@XU%tp{KL|l zK_~=c0Deba{ZHW9NJQRqct}TW+wa|1QBdNC1W-<6GgxEdraZB3xE|;jXP&vBIWNS7 z6Nvx?r6Cx6Vw&UmPweh!xy`2&@cG(Y{RPKq2IxUG>UZvxogHMI4x-!!>h>F8V|v!_ zsePqXc7)Cr`;pF2sq@mdt!Z}elgCjh&ptN|dDjLcxvJvVpWH^R2+tbqoGwXm^=fHt+0rE0<` zX7L_uqr%j&-mm*onLgk=U^N2B>#4O&i*VEop5J`N+5N~^^>v^4IN7;lWp$fL#_AC2CHxF20SGjO zNsbwou)g={!!vX0ZH9k?*DKC!sZag3HJ2|bW_`j5DJ|w&yQ_9+t4Y}*p`W_6^zin6 zu;0d0IVHQ)y0YJ$WlTDj(KmNT0+JQxw$|L0ijyL|b?aMJ$55=R@8utd6xq_XAPt(B zffe_nHT-B9&DDj7-H-i;4^(F!^;CHaEb2%=A6feFWj)1s(k(0p7H?ty#b(+{!V1~-Dw$h5lf&>B?{Kgf7()okluPOe0~C4 zcO}Ef`Kzg^Q$dta_W}d$Uf2b%+4Eq+ddfeg;#|U-QN0iLN6W8<|LCGt@j=V2QdTkQ z#WkQ~mL;gDYs)*woA&6<+R++f+x1}FJaP-8ajpP8JVfS;k&eAhrob}{cM{LNdJ$Oc)e~&AL=}EVRXaaBP?y?BUxJD@QvpM*{q;a$MTYsu> zp==7EcJBVESsaxAblqzBEhE)8AeUpJVHlo{P91Iw6Sk7lV5*otn@@09H-Eb^^DUA! z`SYiuj9O**?KjI6fr?X6kR1BYleErw!8S5h=$j_0)5;u^A2oJkCBbWi4)x^T+`$qY z!YERcuIfpFzj;mha;+v%a(uDmoVQM)eN-U5F8Qk157c%-qX401y=Oi;~>$T;WZF5 z03>;vZ^@>zO=s$R*EU_G*9&5KBC;?{ZD!ui%Kw~r-mH;%40Lf1gI1qJ3P8{eKnvXj zDbWLHTZRU&)}_wk??PQ<7Xs-wu~3cm2$>D%8Pj0))$o8w;Nw-o0O(c!yoNsa;-%fC zNbs!s;<4)X)o1_k?y$R$XrhEt4mnQOJHy6mF0DR4QQ#yw$u?U015d1tVgQMATu*E| zCv)tVS_<2;gB+*$4LOiP+PvVS zD#TXhf<*)ai20$Py8X$3?VbA({xd`Ue*{(whTlS*Ld2PfRi!7-iW}!F;6o-Hrz)w^ z=8XJbL96y77OuXtPZ@oWzw9)dX|+=%_`vM6f(*=yjZjwI9;We(A=%PG*E4ptC?0ot zo05~FIzI6@7He?ohOJaa_u2}>RknVyMC!{jRjkDFv)q?3Lx*>9y zQTGXH`UKtOL3FknPsj{=>(i0u(DwRQh2@wNvAjS;3kgC2)6;OL z{{o}mEG{>)VR}VyrZ2r=(to3&_F}AlH)ckS5+RmF!tJFew&jV^zFI#AnNrT27A$0a z(;e_U?UkO5OX&yi8@Aon^wIU&!B#Cf*bh1lACfP~aEZsbSvKc(vOhy;fY82jHnZ&) zIkyzp%sM?!&Qr`vck?4B{Bpw~rH#k<;J{*3(c+Z1W-ZZQTla3)L^Kz?BX9HEavRi) z`}wo#ocY$Pr#@G%Mn8=bRQ&wU*I6pv;yZ=c%*gm|HvT$j`XTnL$&Tx;B0po@zb{L_ zeP5^e`jGoJmEtqaYj-uTa0g}to^;A~_^v&Ml^}`ID)Ym~>MjSm<~;xlcBy7ex^qps ztS)e*0x^Tr2mPH=WUt$KFwtG3SRi#xvH3Tn{|Dpy`0oA7KdTjSsIl?6idYL@EPt5dODuegI>pYW}vhyvhZhUEo6Z?zYtlo!7{ ztaaXSh1&o4vAf%bQvf6Zm4hMU@z~orU`Ee~n6*&Z`EW~kxEf8mx2dyxx0d9j7X73j z9%!(HA~^=p%a%E)>aG06wxI37_h_I11qWMx;ad8$_{l`{%iC#+W4#QkIZ?(oJI`7V z`putLyK7`gK=4kzSpGzm&p4gfYN`wlbW7aq*FRsx3EmruKHsJJ7#ASd1wJ>=^54{Q z2X81&RzjO@57j)xb_GuX_A)o)d4`QMOGj0YET>IN9?AFyvX4TrIE#b&FGOzO9Yw+O zug+3+r(nZtPx_Pv)G2O%YPcBUz4Bgg@Lvgg`v#oE)+e2*a??`O>PHHWO7v`>>u?aO z;~NBvS2+DY6JB0@((hdj;e($U&%XUgg`&Lcw(5UK9_@-Z8lker0iuSdXDZm=uO3%D z^(RKJ!YUpMCl;lgeAQ$GlwALsD-T9xzsMGZWQA{Za(}i9PPe|h!WErj&9!io%U|tY z>k57N0RE}0nHBr3Bk!dvY=zOEWX4)&AwIPtb9y@HD=y9Jao(4Ch3gCw9M~`Il#EbV zcQaAn`{l@39E>MT)^A_pFGMG%jzLnq?YY*%r+sfkPjuUT1iL2|_7~PFaEPMm-BWcC zBwtAVT9Of=3WxHTSLSMq@$^JW>)yWYUYb#Dfuv@>`i>A}+-Yj+q(G)2uD1UaSQ64n z-FXkUC^*SYRg>U+lS1JhyDz*>0kJYEMC%Vb7Xrd?!n2uYd^Y{ zAIu$m==jXS%iQfZjce_c#e1iA6VtdJuOu3IbY0k-X=lXiuYUK=QNP_>mRy*n#ZVc>TClYSAzO4Vf#K7?s^_tY88_fCjP?+bQ28 z374q@?424Hf>?)!ff-&YqNR~F-?lX;#mligo16GhSHFiE$-3ZYHS z#9WdStWUDB=QUEH9L4tCrJsCk_>mr?=y&-y`a6dIHoSk_E6%K;EjOd9Z8`L#CQqIr z>h#gim8~}kgP?6THSIHYb5W$rjjLjgx={n^+5OXW_kkMA zS&9L9s*L+%q2cx~gKumU( z!b>pn!Q`CgS^_0Zhq7G4UHvK*#liLb%GQ~zm#L}OjhcU#r@4-fRVXB{ebRMcA+uBf zUrJO8RvNQ~sz}`QaT%L_HiIpDDyRn;%(^X>de=~;`_B5&ebv<&0lMt#^!g?0Fa@)M zFzIaOLYn?A+=zk?Tpltk5NKO1hc>|5*U0$FcYDAc*ilU5-8ueBg?>I6f=v0u_>eCr zdUpvl!1qA;G6R2!w&cdw4TssZC~3y)N5HF^F&k*rYN*|=U5Z%o8UF<+f{`qTLC=O7ubrgdOlqee@G7RW z6kE}~v;JXy&U+BeL9JtxQ*LXZgR#jo3DDDuxl=viotSPk^Q%6@x<5H~wWscW?vpQr zF+B+S5k2Lao&~wV+5-*XX8g<;Lp%s#5$eHZjReQ3)=p|WLPzO)9lV7OeJTui^f+-N z1;WnnG1s2U#NQ}@S8p)qDkJMSx{ETo3}*`j>lj`3(0}UhS&#pWbk{6L-3sU~&#dVi zuN&9n6wR8Adf9_Ik)OKCuy%R6=&fyWmsjf|rlY*vH4szS|H&-wDEE(Wk*#P2ss%U? zZsgb0pqhsr`r|7%X!)=#MysqXD=Q(ATOvtqZ;Xpr4O?BOGGmBSd(Ofm3VU@SU0(9j zy=fGxLEV0 z>W}FU1Ko~sHF*>qUZp+ZYl{g6jtAtZ_u6_qGhR#E9rWL~Q}{|6%g1+F=DGzN3fGsA zPm4UKos}n@+Ng&a4D2%wrd=c51{E1SgD$vQ!}Zu=?7r*T?AsILollHjTAVl55a;P` zTXky*b);Xs^3G}7;trEyP;%epXyuLJdWMTrgS+%HOX*J`yJ4Gk8;#%lT(5+iSIM_vqi%j(Nt} z4#7tppiKqrK4~Fd^|!mO)QQ4PUyoOtIMjp?{&(GYG~$?$nBjkbsXHjrWPi&f2zu{3 zz5}{vgpK-5#nl;O1<))n|nAsMP}Muo|_PzBe0LBc&YKI6&3-i559|L(U_!Ap;|q6e>t*BN1>8x zcc|(4C0`EVzIPq=sIXjO2Q7(%9jD!w^Lm)gw5}80aE}0fqIjkWI1lZP64RNB(9*STHj~1z<6{iK&eFt zjtRxYX{oDUAnjT9&uZi<=EW=I1fpnY!6#0O1^$4CDEUC_T6Jf)@jaJ>x{J8-tpV&5zeKHGP%Z*=}G#_g?LPxdO9zuY8E# zpaaf0+#BAUf@szEC3VY1!75&@6kOZ{M-?b>`$s{+EXt$(x3g{{Hunu@%?qPz2&%wr z`SSLZa>3f#h$IPm^h~3$MiYmv%Hf|&L!KqQT0%oqUCec*w3A;WZks?~C2e>BN2=IZ zvqR%hO|wg+f-#+_4m8u2GxfzANSW9Wy*b;14?f&I?VS%=R2BYe>^!5Pv@dNTx1DmR zA(Q~(eS~Cx=I$020`AmkS5UE$13ES%#eOPOFhlYiP7kJF`%}58jvMke*|M9Z%(L|6 z2a|Sr7y52^)oC1H77AaOP4eyo&nR*M|FAbFnTB`m!gN-{7S&`RUPxO0iDkVvenPS2 zf702M7cMdR8;%jP8{=;>G!GXa>f%MjWt?tW|C*!d{ffq-me?tB-s>2NgZ7jAUsEyg z&zFDP`&m%@O2?26n$$kW5(zq3I(uwd`XZxYvpf`e{cs#V80nY2Dek&T$@74PQgXtA z9=$8G_$+VZbeR{d63QUpF~`_+sK^r}2(0R!`BA=Z#k`>36t5F3y7N8Lx`El;?In2O zx13UZyW)A972B)WCK007@x9MF>x;MLX%07Q&M%E~%YeUDQi)Qkq}B%EMr)XFz+LBu{slT?n`e(P)Uo1|MN8fh$cwV8Jl* zH7^t2xSmd;8)t0`xEzd2u{w?47_y>;%S$yKbzA7ZOvN!iO{N!O%D3+N^g-?>`?LG6RjU&cw}a_$bW?4K-K47r zg|r*@_|%srALuQuVSjLWEtsRJXW~#k)yLdpHExqrx5|XeWfP8mV1%C-Mpo8!$PxI} z4o#%hW^_{W4QQ6XY*Sx3xaRR}rnL?kX>kvD7I7byzS#hY9E|4uRjfr{9 z=d8CismA}9hzfV$Bn`)(&w7~K zMt)v)yte)$08vsx5Gq7SIh*MPceGrbYKon|`u)#b?VOG!!5^UjFHZHamCtdGQ0&<- zhi>w7)b~Fn42K%yzl&M^iF0eGQyxd$+Lcr}ZmqGUp1~LpQK&z0McON`PbTS#-=oou{0$s5(kGQ*A{2y+@8JeNDDv@zE)SVUUeSZv zh}YPg;9p6IKBb4W_jznk+qU>lZY55D;_GGej$c(rYKy$>W+sd%!o1?Q#Zw+h&y0!M z%IV#m%Vvx(4IH&>m3(7?vCiz0O9#+;39U4#UZ404ftn|H=kf4A^bam| zzYVkftF4k|@a0Pesd?^QcY^SPx|Q z_=^TxqSGIa4j+%}#_%+!)-RNPFdX4I6ko9BJqIUF*m@&gqK!O_;9W1#%IxlLldk=s zp^F~eUU!1x@1xaJs5*i)l9z4`cZ>v`O}rO-cm|}b3N;AG3~{U+biR$-xC^$|m4_$9 zYF>FUza7vVsFvptp&iO=|LsvEFRnMu+f3%nOZNWl-aB=dEJ%I3J~J!H^M1$dQ3Jng z43&zr+H;Mwjpi8>PQPvO?vk+yJnZdIUd&AQdAX$+Hj)@`X!`liP`5E@2!A{`7w1^J z8>FqvkkHHSE{+w4K&%K}NJVN%b)lXG*&Wg;*(8f zmSYS-7`CCP{u0)-5sz_z!uUWew~iMQ+h;uIVg-*d8pAax0xmEDTP_EA?_=(bAgk7e z_)j#=>Vp{0Qs8EzGOF`k- zKqMP$3v#;;PpWD0=%1FrA&CV;5>xi68GCVr;XiyOX=xbV!#PKNp0(ou1^-T_0a4P}JKQ;u zG87_M@#QJUjZ*rQW%xAAmSN6{>@FS2ja#BJtH_31^Zl}rcOlv*taHtpPTVQdQLLWX z@`kIpaLzUlmARX-OrV&n?QRI@VPlA&+602HCjT&c>PPuvZ(uSxVOPbacQk>X(Bb;+?K@rcmux6?Osxaf%;MCNGFB{mKhigS0PAVkFb_hzepEmMS1sXvfptb<<{> zE*qDBr5^-!U3>dEGh+Dg@Ve2Ymkg(y*o1c$JFiiB+5NCWuJ1J)g|$$dfzbJR-{#c!rj*72vKeF2*Rc{kqtd*T!G0=%>{-$b)Pv?(V=JCUY_;4!MdxsgkR(3j2xH)5Rr4YZmjewnN!NjTHN;#(Obt)#5v*Ui?ig_=V(mG~-li zCS;a0#v8o^r(_(Proxs5Zx0A(tD#E8DEMmbGy};hkJcJZt?56A@kD*2@xB-c18963 zazZ>1AHD%q><-ljCFn*ggxFH4zZwt?5bC{D&?x?p8w)5Z3I~D(4H{MFlFbnSsx-^^ zWC@XdMC^l(bl2y~gHHJMNzT3f>86z<9{#iYPAlf20@Y4>C5%D2G`X6zJXkwyrDQf5 zGc~SUXDaZznoB}p{Dc1GbVFzdBv2)jwoDL4hc*{XVK=rQ!3=lPUU$?I6B`winJ6 z5=e`-ivcs)mbghxq-4@wOA~&mF#LBjjvHO=!6bI`3aVId;(x5qvl_aj_Ks{Rit9!6 zgSa=`^(-!Afo;1%P7RBVn@T1BNbtUpOVrYwh znP$^ON{#uZS^MVgnF^n^qhVRSA=K{Gl@YYZF8unHQUdywQ9mVnGHoNs&=5J?ZCPnt zv)izm|HE+06~FjnMn2tF1|r7ppHlVa}NrwOH&f_p`Cnty~1!x@_9vxeRgIb-0D12_0~bA3`XxZ6

mn9U?oSj@%79k>3lOhR*ZlTkI&b2*<i|mP0liA|jB->0I5?QQv}fK{mAwto+*;Rp`_lDuaB=hYb?2;qUHfPtRu%fTDrv;p!3bvdIyI@|i*AhHo6!&ew zHuIcHmYJ|B8&3|OFvzj_@&Cuze+D(Ze(|HI9T6g;6zM8kP^z@h6BPxOCZP1*L+>pV z5dj4QBE3dLh)9Rfdv8L7P(nhlf+X}3Lb+e|@BGiqy>rjm&hP>lhBr^1XRY;V>v72? zX#wq_uwEynJ1*|W7bACs@tMlfBUN3mS5?AC4(%Mo_6;RcN~mI1_eJs#gI9ZfW>gK4>?u$6?uqxNL6uq#D(Ai5nx+2LG#K%9ra-qSHM#91W92bp{G|on5&@w18 z9;auhj?ok*v1{|Hg{#rC^;#|gZ%t+`zC4kV+fiH)NqyOY_M*7{=0XZ#S9O_zI>kgmDBh;3~A!#SydrKjPX;w8O=K-**5m=K0@El&?1&O zrR^(P2Rg#UJTs5SWkk+lfrp~t>OS$PO`eJQMWBOi1eaaf4x4b?O(}t>3hD92Pu%3{ z(kEYfmxM_ym)`O!TrJHgKAF2R8oISqtDLwRl#!|Y--r8Ty5=93mgC<(Yca|bV(Ny= zkkz&s(&QX(O(**VG3x5EwvQ1Q_4Vn)3nSN?Oq%KDxCq7Y@yQ9VeV4svr8$%fhA=ff z6>x06H&V7#TbWjkJL*qXm@p7#C-uiQW*4bKS>7~?%sKZdMR5|>E0+L0r;8{_(SvjV zxpbaJFqL8afml3%eC*{{G(8}ALsa;g=K3SP>S-lgizIin_PJn>+XrylsbVdJ*q?z~iBzP3}(VyCz(`!UkVTN^E_N{fljc9X=thmW#(Z+ZH`n zHs-eSO;eX0ZWGpwQ2gCK>zFmK2qivmw>gg`-hozXDCcmj47o48$KgJW{!;7?Twue~ zFx=J+!%nE(=>3(U<1sds^SqX?+STGF@i}p0%N76KDhzo-TM|8Y(X~L4*+&A(CLsu( zU`N##Eb^%+xxbjh)~0Y(3l2^$jn2Wc5_e04z`h&O-;BiBZWqPypk`4=*Va?b{a*Ta zMsw|HV~|kqm-^bs|3<1@6zH3t!_{&1LjgZO^iGtilf2aHmy?hki9t>cnSQUufPX=t zZ|a!rC_dWSP8Ig#@;xxz>(FAZJ@L0j!71&nfu&Pk$+cI5>`!kek^Io{cVypS zMRtqiD;!|ymZ+{o8W0xerLcfX_4%mcdvOLY zzdL-{?!7YVaBrqq$3kN0#-SbbUcuDVuiffZWIzgb&bGCwJd?BM*g`aC3GpJkUbk%K zUaQ|fZ&VBt>=SQKQd=pMxA-szx>?Ktu(^+!wO&Sr^aM1sf%B3pA}-myDp5K_8dAVr zC>}6Vp3FL4h@=Ly~F48Lw;OX3)l? zGy~_A47bC_-fOw;6T%ReOiI0btpReRvr%Hp8Kd=Q@_mERs@8i)nro8Uws&s6BNtM^ zo0+Z{im1pAyIEkbDa!XtJ~Qon_tZW72`wd%L4B}HUch~CJmkTAAy$vN^2UHr#J9lg zt19YYu6s5U4~l6z#ShXodWmM7u#NglZhrSYY$e$q7kfF^=vfd9>BID2=%*^elNFhM zM*FCT?d)Ibc2)f$ZQn}Y*702n;ai%(%a*@Jo-C`ARtxt((Zm5DE}qIc`~AXpaQKTrlJhjme(l~z~>s5)puTZZLjrD z`Pm**(sJG@Z3(Qph0V~Ri0jXIrg^;vM4gHWjbQn^fw~s z3U_C@*o8*R#16mokVu7CLP0T>16y0DPt62kH$dj%GwiAu!@7%hI8K`VavL#XzI6-(rfTg z@&cRi_mP_omf?%Pc8iaFpCu{E4ohyGjZ^hX#@@8P8IN^OsLm=bQ4M11ud-J7&}Zjh zPzDli)!=WTI?}zUTRUa*3bHC$NsnMN-M_<;-qgw6jhoW$sWp?J^PwG#-lz4A?-Tgl z(L5x3o>|)UDNtDJ-U?%5_=zRv97yrpx@Jx*S9BsQVDb*cK}d%zLe#vgl;N{Dthzq; zLOGt7WL4<}AK98K#lBF}2tN4BH6umVTDho9&uBr%7mXd=YSVw-Ir-Vf0~GYp zrVZ${@-s%pr5jbXT1pao!`;#VCT8$C{o%_SRf5C1nU-BGrGJ{264?{&78tMPae!i` za(eC*9Z>ssN1Ldew#Cu}l0r0>lY~lRW{yJYvG!KS64ADSj(X)CHz1o>)5%edlOF)DPQX`P_A+^+ z@H`C@PKgwL0VcL!q!|i6X~%Z#)Ual_$HgT#UXN+u23PM_S|1aAW2;BqR}0q+iiHhq zSIvLhS1g8N@OE|G*s_h!ba^Q8t1gI{M<=uT!@*|q*SJS; z%}2omagDRYAI;tl*eTm+q~MZZjMnh9XvH#@?YZ^7SX-A17a)cZ-FJ%}tlf5;`0B?H zPSRcBuwRqu!u zY2XiVLlwaN-SmgC`eb)*XGF%PB1S)P-s++6?o~)|v^+zhn5HKj9 zJDWaptx0i$$`RWdl6ci~tpSa#C%;X{dDr|QO#%hGZ9{CL%t>Zk{%BrAw%WPU-`n)Y zbbW=$etW~fn!_Fq9VdR}Tf_M`m9PP@Vh0#;Ji;{fXogL|!692;$id6>W?v@pSc-7J z)sYpTB^1O~a(T@`j>=*D6R*^YNV+fwtO@_4(iv*cReLo!MZNUo5w!JqWX$1K4cks9 zB$1yI`A%*ode7IQFDzs!iFtR($1yVAJ8a7~e3N|Z^8Z?80p~D+yytbA)%O-Wl>#gP zZ>_HVpp-38f&(k`8r*eb2&XlMs60GtW>F~DES#R<)a5KDOL~>rerc>J2k$?f-}4za zIhT=BZ#aNZ?<1oP`Ys#XIYcYf%q%gd9>`hbWE*(`BW^za0W*tq(YZ}u`+bn_RY$k% zp#8%E9u&f}sVK?5SS0)v#W$)9aA8B%BRt6eUZ ztXRYJ*DCjLd)R@Dk#_&fm%Cl7OG^L->|Lq3TQ-QeF?YVX*m2n2%2%Anfi^Q67e|$M zs=a9IplCaM37$bLn78KyJ?@TtXv+(gtUs6@_geo-6o|Sms4&u_gzk{j_)px(=-~uv2=XKNq#U;=1 zpWkLB0875`-g&V1!B4$T;SLs?74LlfVUBB1w24JlShIU2PO*T^s6NbblAZZr)Go(D z8~vVth&HHU+QqrtY~}jd{{}0r1qY~|VROm|Ts7ZYuH@K2juB7pE#@jG)}FYnIP7Wd znXCpbjTa(+m177RzCce*Cvw(d{YZ>}+nc0vXk8<3O+-4?jt2~N&rLk1R2v!kw5$6B z)sUyWmmlvL*p%PLHUF$zHFth0ZT?;f#8@ukpr(sPUL=5DNL7S?OOHsa8nI(re13p6 z$Bk>~S`z^VZKjva7M$V&jj-7`raHn!3^)(x%N?$Y{V51YymYhSnQx2nbDaZcN`c|X zep&Ohjl4LBz<1vNkK^PAeY3`rfvpG4MKiF&mVUxxLK>-)rjQyaS!18z#L!*zXYM&$ z=Jc7R)Ne1faya-Bvm5aa?{@}_bLQDR@>k~D9nd99msuor+O7Rt56?0Gnz^9#e@{PAE z%zGVkRSV_F5~azBa@>NgO!o3-!lIwqe193|1G1=#s&mR2i!MR+8X9x@sfhR}vLfGK zNf<^i2J_<7tsy4~>7=!BkNj43%gq++hAIDPmA$MzBhsYD@iXt3^O~oJpLFXDa{dTY zp|^H^tr3^r=#~TT7v$~9f%sSYCk1rMog8M9iiC_eL2qu{pBFt>+o0YI7JIn$Ju`!c zo9kmA9p^}mg-}k>Hsu9NXdm5qg5)dH@KADf*4K9fCa9-L?bfW7eV5%8Su$3dzq7=; zfY3?g92~v;4E^v0{8|ekaq7?C~as9$Qx(jw~5?LPZX}jm1cD?s5L{DR_`M<)QFi%1=2E=G3 ze}Nn!-Uy-Ta8;OY*x`@#z@oErX7FMi%Llm#Xozn< z{Lh%!1Q06l8|7_78W2)fTXA;WC}3-7Zt+sff7KhIN=KW=Ga=s&rhA96m2Rfi@M4tx znb~JX63t96>*EM5z=Bxca|mi3`JIRb^zHPvNJE@%u@->@%V-J(;&vZ%mepNi15h(Y zyIw1RL`7H&PS&j1ea(U}pY@$I-Z}J<-W5eP=sTx*WeMbpKcVtfZG z4b;UJd8U}{oTa7$6AR`l-NyGbpPXW~W1z1{udIBfzq>z_q^5c$Ax{jXnlRzH{Vex7 z6iE)Z=_g}WXDuPP|4ong&-&Zcb%S?~hK`tP2woUZ^;&Y($*R!eTWnO(sy#W({h#Cu8jViviX+c59e=R zx)F?M8%F!vs@}?wkDMNFNzH#eS5(z#gPqb@6T8y4J~;KOA7!$a5m z+ZCNiy-@fvp^ylh_T#GIm zVMi$dxt|f)KV9*x=p59Ie?>LZg%Vyr zu!NWCwzBW@u+2sW+A0Y$%}dHz-2HFZ=2TatPR(8kWq@q8#glS(#gcX$8VZ4_Fmj^E zf7*XfcFAi;td_DpnJYk#Tf5+*$qP)8(gww z^BRj}6OSX)e^FtL{af2*%3nHIo9arOLN>l}E?ccF@vJnd(rE4ov!Ux905O=(zr@6u z$`s0E6_o$WF*WTdU&{gC`dK1vw@wiz4YB*e&|i$${Pvh6a zLsn=bemM|c#nj0jwm={KW@8vOs(sRwn?hAy0+*%V&DFcpjaO7-snQ3V5AY zFWPW)eT$X*wsF>Cd{3Ah-bY8M*;9c4+%fBmYHsd9n4F;UOQ`Q^e)Z+F%s<8Sk){0@h-}yIA@L<60cV5RlRa_f^x1+s5ug+!$;REBa%hD6$?gX&eMF8&tnStXqC2m zrCe9o{Dr&z$JS#0E5_eA@sVrwJ7k1>vdkUp-@5nXuigmVYQzVLAN`K>g{swlWkK)C5$E`DHfI%Z1s90qQbtRj)3mh+5>;D%R(o&-ETb3 zeCJ-~^b-N0Jqnwoe0XE8YX?HS^)K%gl3H#Dw?J~{fa>>8KP(9H1kh^&O4!qRlqdDb z|Ie$`%Z8E{){Wk-G5A-mw}?pZ;l1e^LOc-ExDKU^s&^CAJ3qfqj%kqgj6iZfzJCXi z#n~M#oj>sn(yG?LS#2!arC%g5c|HMI+Zai1QU?a}OBYXlnfNosUd5NuxB6a)cYov3 z#<9>yU86?W@HkG}cyezN%MaG7uLd!Pl-a!*3GMos#X)-C3QbfhrsT|N} z`yszcFP+5i>5`yD}e#A z<;iEKx^qx>!-|B;OPFT zmuu7QX}%?-bHTzAP`YL2Wt@RL?CQHn^}>mrYs^?BA#?#I{Hp&wiZ0eJ?4CWsvGt?7 zAoy@Mx9n|Rki(X5q?C%Um;E>C`u#}6^`GlYU2R9h zlV2W&{vB$e@M79^*S*%8YhpPn;Rd*dG?d*tVSq7One^T0QqYfNx^b4is)V`@tF{dP zQ%y5bMwDGlXqBB5Xn?PCyj%MU9r*C2@BAmIs)Ou5{;fTAn@{dc(X>2J4y~sdHyPlo za5b&7%cm_eI%IBnW`W~{8{+Od_~BZzKI;L6#itb{qvKH4QFFX_;CXUzsdQlZlC-=M zh^yNjpK{E+QDT@}@oh;|8O;zb=ZnO4F5SvV*sZ?lmWl>Fbosf|_c4>G-2A~_&0?ry z>>39e<+)pZXVgC<$txFJr+0-dizqYt3mw!3KMNJA)htN3$%{gdbtUxN;F3;11R6k# ze;pw^ZB=h>s?$x13B~Q|FHpHyvvPWK^|%7E!KhDoM*A}ojD*Qh`J$4?K)+Tqv!~~5 zhMZh~EKDZ%dDT^XVdmU4L}_Hz7tYwwv`OUs!)P|2SeBpOW5vh-(I?&zK80GsyT0w+`Gb)Rw40;!N&DRpo%;P~<0(o${zao)eAULosQf7EpC z#VL`>G%4-PN#A*wy{d^V{4bsNZK)g%rcFX&pXA`SrdtfqHtQ-(2i#Cu;w!nvI)OQC zo@L2y%|?7&yD=PeTNZ#PHm2`U|kh%NSi-(ldER)cF7T(%UL zL&NPXN^JRv_xoU<1U$GAlX$=|67hcwBToUtNH7CTr_WH{I0J4e)-Nvols%#(eq-tt zzA!Jf{X51e7lMn-lFyuPxs5llce}R*V}45BMWWMN->Ej{wX5N`_ZS`LI(8Y{Q4R-6 ztTXXqj=;n77x><)*11!K1Hqe4a=3n}C7Wc#>_??9o+bJ(4Ff;7@6_zAa?;{`ts&B* z{KD$HhW$GvBx5Ld*le2s)UL}q$-MG>G#{Ux0&d$B4A%GIs}xIXjb*iwZLfautTpKN zH^0&@$D)#oJOks;jcj4SZg0HC_k!yeqvDPhe75al%aES>>g#NKp_&H)YWP*jKcFOQ zOD+TZ#kmiGSq)_+<$+7BZu|Z|7Nq$Pus>1~bJ;rcFt)qGh0oyH2oo0s%f7TtB{6iR zSFo6+bF;N05)Q%GDy>k~Q!T#TX5>Ns zb$s<1tgwzptjDULZ->_T{{im*W3(4U|23BIIM^Bd&@kwTWvr?#^}gee(FbtSzwdJ&{s;z!%3;$5bXq@1MW3m+amRR>Bn-Z=!_t zrUQ1}lTL_khwMB7|Dpg@tQXcN-mWDbhpv4w*ons~&8~R|SiG%o54_O8)Sg4vs0m|U zaOvj^bC+^ARlew^&gbT4^F)JgsUc2L-ak-E()bB)317rb1}XFy^AUfmH4}0#%D%}cH9LTzHl@u% z{_KnNrHRUSW_{3SBHn+RH+@ZKK@!a(nY-w4h}KHxOdY(YRC`k(O~%f)J*1VYjV5X- z8k_45Tjqj^n>h0mzfL}dS^WC+w0-~j(|@YheFZ8&;JMfedDW3KB=%us9su?zGOu%Y zW=EtP^$-+m?dsSF+eO-L2-L8)`JIML`AnDKB9oi|r+FPP)8{-1lB*Vet`p>@EZx^( zcnYU~Ki$jk~V40HRIL{;eVjCLTt;O|UvheL~4U1LEK`w~RFL;eC?)~%*X{P4~*!fdS3P##G zEceE|zckHem2L+jvrkH=As_aMo!ZnA^FMWXfuun;c+?g^v7m6#K+2>i9*&HeCs>EmkR<5Nff2w!nXM3}FFJYvqh?F!q`v zKJ)U2t2Q>O2jy(|AT8D&iz$^Xn-q0@7|Y;gDWRVq|w z`yH%WfBXRw_j7$`Xdx_oP>s{7uH1r0Y2TSood>N~I{pGqZ?=#gFcBJ8(DH5P_3{(u!u0AJuvL3R&?190M)hWm+%;yg`3l!er~ia zQjGtuR8P_4O0axkR2E}r117QqbaJl%m~<6A(98lA`iN%g(Z0~&@b%&w2j{K~yt?>E zH*@reI?xx*tgfAktuSd3y^3qsaD9+}FFYVDyfgW=Yamn02%$v3V<8|Ilb8)UKN{xu zUMaQRLDtjGCCC?PJ zuWd^n*`G-+@#Pm2{?|QQ@JtrFJqXvwZ?XCx4jXrg)hI^XjAs4UKJ|NdVegX ziWX2vFlhPQ;i!t4lIcsPS2q?r1lM!Sw|k(w9WCw_&36W=$6ywFmiVuK=4!kRp81`I z;Ck^ffA??@98MuDl+t|oyFv^-cX(s*I8TKU_`tJYICpS0rJ=XBfxfw;_{7wIAT>hu zR+Y6xSn@}+Q$tJsJHdNh!K#nBQv+3^%ycBfD=b1MQ!v&Am#8^#PcWe9A{5eT1+#IN)m&I#aUpZbt#*HOxu<8QbY>^CCH!AS) zbkdAg3kqk}W0^Jgh>Xig*4pxk*^B36cjGQdI{yrZtvz>i3ksZ}UXqwz@~J~G7wV;GN2F?-Tw_+V+@G z{)S08OE2Yef%Bv-wI=%Ho02CN`6r=g(O5%Q)(Qo27zG<06%sf()sQ4rbQz3p{eXRV^jt5lns=KfcRA%V0B0Bg9F5&HZsQy9u z^D5iXw^*(g$PzlEI1#(~yJWn@5{qvb#XJ1MZuman_FcCW!~cm#=tXe~OUgOAu;I(( z5IXBoELyxBR?GCA3pVkRcpE)UJoZK4g~tFa6}i9%%`y5B&rd@a=;?m#DD}RtRpl{R z;nJ!!UakAX{{>8CvzK(!CN_TUG{}~$X@VuaP!+ozObS)*;L+Xy;X-li@>CC=kxxK2X%avDN zK52de&yTs92-$RkmBBifbfLKvPQIN*ut(t4(o_ufnIZJZk5 ze~fajI%;E z@L|PE@K?a%TvC}lZ{dy>o}jj|LT1}pEB6E^_y4q=)h`jPNNZ!o>hsxMsVHY9XbvfM z9QjI73<~wgUryH5#M{=N%E$~jgTg)2W_{O390UHif{?e1O8VGRk7O>^(FHkFp4$zT zBl{);$;ZMjt^wGp?T7}3xLe%a47(E2^ za18~UzFPzhvdDyHphV#~wRPGnphu;--AdJtN=`ivR^5A8(v2}%Mi~Jv8igUWorRJ1 zbqTut0!kqFsPw{?k`TfERdh~Z_xFoF#OhjCm5Fzxc<@`+ZP^S z0c^+XX&j#L>Wm>#8Yvu9hl zyuD3H!D2R3<1rqvKc_u`9|UZm9a!)<>5G;TR?f$Wb#2 zVdxp@=F|Bt(ZZi@>Zbviptyo8pySwUnNpF!zflZ!YRDv z!|ppG&X1zQHg^miKLv)3NEB!zb?jeDWuXdz!8xFeo2Ob;ZKf07T!te56Fc?du5f;c zFZ$oYqu2Ggym*-T^W2rYjezVxS6X(-MyA6`e~N9)fQRQVa|N#6Je&429J$fvxe}~A zF(#G>{Gy!y+$h~y2a@bgaO6ZgO?Yi=CHpRhbhOs^CH8=`!$4R4_ZEn;o`V6c^W$}t zDyaTQ5H>iWT5aI{UAgh z(PDMHp0CS2P_gN*I$Ug++TTBF6MR>#$?I62&>iIfsqRjf^iw3WZ;&&M#JN7{cGzX5 z_wHNYXEQ_@X7GL~srh|n^aCd_=~YMh+Izh|l=EZD&}|u#m9VVrRJfT%0rGrnQA&Yw|h+cI~xxooER!hShTT zVhlnc;eTeP1{Go|q8+`0DelQl>`2rz-AjnHa=5ywb`-mO3lgPMWM+wNG?r)CVi2l6 z=<1J;M0%+!f%JsbB{QWFbC>@}K7n&PYTdGcS_v#nehDAnK~9J2n234WcK+-dkKV%2 zTC<+VJQz&U0wN+j=ng;Kr7`(t3>Tl?sIRnui+cY2zIEzof~exPUI=Y)*wNoO)GthC z%d{OweFOAHM1J2fhWrJcD>=?qOK4GK#eJ>8*VXS(c>3y+^t!_-oeEZIZIBvTR;927Ni|7Et)QB?znU)nI+R+ z^tqUt%gnxI?zbosvOB_B@YMNPq?(r5Ho)Soct{CLk>&QVPUPmtwA#A46-i3@FN;b~ zfpg|G#%df*K)d4o^~x(cQ|h(fK^9kADqfp>{Yl5UZMBz>a@@yIP6^V4Ie)XQ_}NK7 z8x2UV3QADIZcz=kDcfVAxoNXo@?R6*dcCfriO59rN>HNK6jRGPcz8RiiT<;YFU7YT ziOsp%8; z6DLMWathf$Qn{I%jmb<0RS|5SoDW&fetBTSW`H|Mq9Hxk>lnmdy$eVtF)LyIUAgzz z(j29nF>jFG(-_r|#&1?No;|A$A-i#xDp{Yyg;_B%o)*vL${L@jlk^A=DTh024)r#_ zbM~5i+~s9i->)~HZ(Rtl{BWFOm{6~2acOCo^>pI!xjJWu)Pf-A!3C#gBoTKt8ewpo zV&vjxajNjGEu~<%R*t$=r3bcd0toAZ&h4+xiuoVztA%5>_k#9h3r}(i%dW0a2Wb1G>BhaN9l*KMqu6gp zd3mH$#QeD~$rZ>$Vn3A0Ir-$r5Oi;qiF>7?87`XE;lG29FFVH{k)^Dy#$Q1*7<1)> z_&M-1{SZgN$|Z@iCx#5Rg-P)j;Y8Bh{$s?0?Z`WXhRRY6y>Aiz=*p4lx1$hLCSsB@ zSAd9NSBmD8E?!pJxQQ%YcJ?gmxFf&WSvTocZLQZ(-bb`jz2|m|qZ1ZB;uP?l2LB`m zeN1Klj`27{^`wJU`sFLRkl`pQ*at+?N3jokX01doKH|bkOoF+w$RJ9z;`y)H&vf#D z=+?CKm%Tpx)$%+j%@srxouuVIDxS zl6FW+dC}s#1_h~wpL_+p#@XqCTu*rA{NAVL`rgs-l6Dz|g=~ns%V|exWffbPn_8%@ zezT1;+s5`kD0EQrB8!)C+Y^{6#L!NI3v(~52<=fCDd*c+OSZUkI(wcm9ou!P#oU)= zewbl<%MQp&U3U{_=@jgm)0`+S;f&TbYigf8z;>a&aed2fOoU9{p%${!T`2dArD=sZ z7a4Z>I=49&0i0`ga}U-&<+*xPnO$s*+rh5;H!t~*>=1ACl7w3f7hPeh7N?+(RpD94 zWx(r)HmR*&+t{MV(+t73XUF^F+z*Rq@;fsB_-y9RSNB`9*SZoi8l|0vo%7}zyKTNv zzY9DUfyygX3|dIEu)R83!CJ;^GN*N=)OBDoRWY|8-n>-l!m`efSpcx~*9GNs90?wv z`{Tb&e#UHN|CQ>)<;-O{az<)>ZzMB0y!-qwv_3;H+ov@Ugo%v~rih|S)vArF#_!8-_lCmu;#bdaN;N{nSXnse|Nb$kQqd;ic^Iw+(UXt#`oJ1@ZwSa+pu67ew!Agds4AHzrqnmKU?zm0z~ zf#albpEnLk%>IcE*>1;dl$6pZJe7^ZT-5niZ(OE47p{VnlR$x2f$S=d7sgI{>_n>< zQ5WdFhTiIITHyN_UzdTkrtV%!J$96Enj|8B+7r~Z(0A2Gb6gVRXe`;F8o zbJrKHr^9B9p4wgCB4gSajdXS_q2xPu+_iaw|($)N8p;(>_M;(uj&9_P|<^-igJ_Qwrsj9I@Uy=98 zF>{*_c}Vbl%LNFbc3XY$ug5OSqxlk)Xbcx`rFe4eFM^eDp(!zG{H_x7gA8 z_{=1A04|^@{aVGvR!QAgvR?0#RfEdTwt}6Kh~ZsUDb_gA$}uyGR3-HQ(OXS4|2kO8 z->K6X=)QXJN?ZFNeHHWhDy!+uBOQku%GhYVKdbj7=0+r&)`wZM!lEyV`PZD>j@E;_ zC@A|0l|3n|I1{@k8Q{<9a{?3Ao?EITTB!x(p2{%FGH~_pRO+-PpE>!zv}IO3B@D>^ zzH-WDA!sALKVCI^H}*f*4qso0VLn1v4oP69?quk(U77#j7Ox#Zm9`4RY{1}du8wZDY4SZOBPeifdlL%a$@Dtvnc15RCt(Hi{Mu7xt z?iLJVmtP)dLb%Dc3d;$(H3HvA1X9E_xzYWo^a$ztI1Nn}nm`{!mG-|(vFi`9PvS(q z@|*wvm}375Ojf-iw_8|L*`p^&%_$zLDCXLAmd%fb9~CeSUM8_Oj^6K7**6JyhkhxM zNE{uC%mgw8QKCq&-^Jt%#LX&&BZ(@hv~>#M@@7>BkkF=kmy%vuNG&DQWPfks)TQnTT|Zw$1U9o2=HUtD{XwrIUyIUL1z%oWUG*sPUl{dj+~hwg zp$wZGEs$Op9dtN(d++`5^eNafDSsUQ?7u|-yJv&_9-Cya$Iph-W;WPa?48U1<@VJG z-;fuq#K>q>l`d{o%Q@}TlK0$OeeNSlO1(RWY?;~=VH?dL;x*jTssf)Tg<6^DJvwm^ z_$M+@Fg{$5X?6BtX%bkIi-d4?e`}(mesxvMfM4#~J9`7fSpAKo9O+M;`8?70EV_Do zQfI_FF-Lj^E>3Lo?#&%A%#RI)FwIMj?lnP=1IQVG7S##Y8wUE!%|E*ps{c}>q|7wO z1m*B+PA(BuW_3pl2wjqEj=m41S^Lh8cj))lCoAH^NY`2}k;5CK(Prpo7)!{5}LGmA%_so3|%` z)mal0K_>wd$fGerZDl>taRS)rUexMTXxuFvu&i7od^{VZaUF8BtiBd_ycCoJC%K;l zdIPIAXSo`DHzJ{Vlr)U5>)w7Rv_aNw{(XS)Y^xu6bAe`Xm+fJPEQSkl; z5J`1?D7b-pb0c-=68I?TXA6%%SaeS4%cXdwt{6n*{w9zV5=EIbRcUZl^tAxV{qPX+@sfyup=^}f%j{pTbD7531mfTSYwJ6^fwony+{+VOt$ z6u$m&;bi`H!GfKz*H)jTr}wyP=RIO<#&%oGnxZSaydQe(XJ5gUC z5)%(iDk-QO=~EEi3=-_MI+=e^Brtx(!wC)KWbhAWyq;Tvy{I|OQ=s+~zu6|C3BKOi z5Lsw+n^&Z87#3xi1Ds;^iwxX9uZ8LafxsG=w3%@1prU@xluCEV7O%+3l5|u z8@+`J^V_YH?{;SE`|7DF>kw^|4#C5kGps-cT#^6e9d7aljURQRh)qBESU&I`W6r3# z40>6(y!82U!#{68Rz-n3lHOdD5-tmrD>1)-p6$fNj`5h>H|4LeCw#Jym@k*?^PTw(+GYJ*G9gN+@xEj2p@AaF*?^0 zD@b}6znpX@a%C;_AnW8s<+jW%7YeZwqwTvl!G&I;_!ewon2P?QU#(K3ZleyUessG6 zVTye0)L3FfQ{sGE+)Kn%jEcC5_m*s1q}nt6Y;+&UHI7J5LqHjFxa{}2u2KQsCvf9_Bvr665~esjG%TvQ=cG`Tns;%y)!yiDV&YL|ZO$Dg!u{Cb^$s$%6C%6uqQ!9ElT+~_= zJ7&6lfo&syAO~4UF@q74!*&yoy-E0*?IFV1f3AzF6PvL+6MNjSHQP?pJ}w@VT!opM zepfcNk1%0#d_!sGI?NYz#@qB^Ft z_NwgUiYM1~pTXD++|i)$5z@eU(L%X1ii6m&Mro+5UCMy}u5n^uV|C>-JK;*Jt5`YM z6h7%89g??HFRStSx3YDx9b_B~(WT4ntgnuhP4JtLJtuhmTech&W;zKSMZ&^laJLDM z5tVZkhwKOk#J|c6M9NbWBw!o^!j9TDf6(w6lM??ZS_BDJH>|uq;ZgfW6xZ-NLmz{9Z+%X zyMIn^+qzC1S>hd;-uCR-{ut>{E&$A{57FnYx)v-d8gpMfr~J~1m-s3t`uzWgv9Ank zvJLxx6afJN!Jt7v3F&SoQc8-5NK1E(hQUMxM7kwMNJt8Z#OUtPJw}fl9V5p7_W2+0 z*Y|lp@r7gTxVf+EJb!Wi&d$XFsfgFq7EAA}XaSR^M=PF?n!Mk8JSCoRPc6Q5M@4ek z$GEIp-M(}bKEwLEed&?S6}y}jZQDR@d&2_?bgZ6go&1DxOZnsX1&X)EMBg8CCFdH6 zEJQk97(DCtmW=h`A5y4z9%>|Trzs$Xg%IjVWosj5N2&?@vFdK}G~5Nq)!u5n@~2gu zrR;8w0|$L!;$GHoDtiq+y>qrIl~by~y^FHFjrWem?Ly}*c;x3Gph_!yEq8>?5O{id z!I`c{re@ZEH={CS{e49-O4R3LAb*3iGu%SA7awGaBm-rzaF~Rt3D~~Lbl6>y#jLPh zqp%q$HLAFp!HgDkv(9U z9gf27qW%p20rZVV+)4S~eoBM>6o5Xex8D69QYEL!?|AlazSJW)x>kfjiMm~Crru&zSyrmKQ?%n$5m3eMU z$+K#j(|z&qzCVrLuk91B_4J!+GlW5Syj;6) z>DQ|xx9CGMycF`INuXVtCUA3A|f+T_9d(>1om5dw#2FGY#i)7Dx`s z>X`T4E=3juY!$ehT;!STu$LwVLW1HijIn*tiKQ=fbk~v|TdkN-=(&ge+*J%Yb}pA1 z;u&z&4TY@kNhPiCAx17kqgwh+aMZh7cFU$0_rX+7f zxD3Po4_7@i+piTm^Iwg(=%jaGMeoDresbIcl)JgV4#4>Uxhq)a?wGmwx|LeJA&WG7 z;;mUVQOmS)?kLyU4U({rq4kb@RkL4|VP89sIR{-{@wAp2QsTNaJl9E~Qj!sjGg{t* zDt_-PYD<^;BSiA^Q1@mPB^ZtbH2m-s%W%?~k2dE`99Dl9SNC$dO&6kPU!+W+70sJe z%*Q~ZB^;mUl->|sIk>2}`G(~-KH(XQeyDni9@999<9DL686nF)!qa@^|#$K?Xe}g5uES1DmX~wkOR0b9sHW*ZaaYC2-1KAz_ zlLY`$itBsT8@}?p*b37Yf7)Qi+ZVRy!o5&6qWJJ(z^tFvKxc4+eOVvp?P7*_u|M&u zDavq;zRH^)k+ki=w{D;XcxIUH> z0c$st4(sy#qGyd550F{fh4C~1GEr(n(1jz}-hj3GlYc?vIRgwj%Cu_tx?VV) zN|f%@@Jz==(`~HShRUR0^Gub@OO>%xuM4h(02A-ziLABMvd9}rSxaf3JD%IFEd|`V z&Mxg-&ho8Bn)~4wEYy4E__BP!glH@+-vD?27+?WrAJ^@AQWh(yeeX=rn!mfC+GXWP z?B7d-Zk5Qc#3?6`o>oM36HOE_pbXFC7ei2RMXdBZLsz(H&;OjRT@!LVz5UnWTL#5V z9^Kc*rwdW0Sbh?g%8$T2xI&!syO4hW+3Daa!i3QTTTWkNU!`fjS4OkTG#HP~7P??KQ~ zyJ!wjuLk2~BoKJ+Sw)@Mj<^~?>@=-NHMxlrYFxAv1tI|b@uDjh2#HRf29nJ$tXg4L zy|69gqtq#Ppx5LxZx<`~?(BzCHEsk)0y~(Y(6c(&B?z0}R*p?A$7EjbSc}nlHeJu% zoMCJ=FZVH=nm(0?cB@}Y!HfY*R5(qp-uGMA z?fEsK;SQ{CujsckycT9UT3ZNmOmWal=jOW0H51&UXrp9k0zbpqyqo43;s#6Q$#kN{ zvZ9U*=V78kkua%?dX(HPXuFxQq{rckHXW(vf9(?n8 z{T1wTKDzqgCeLsA0c?8Sz`3^aN)miBZsnEnGXkz{{GffBNkxVxSOuJ5XYe`+#te``vJLp&*G=F|Ukcr&8!R_tB zuVi2o_N`6L)R|#?mz8|GnYiO<8_|_zJwLS6&8XdFAQ^}ce%xjy2+0RskAVh7BV^4I z9-N)3JNvqwZRtYOkSjGMYL}&`3m#jIDF1G?sHzb+x!oRrITvF5yV>5E+yuGH@W_aV7iuhx38?h@!zDbbNI z5K{md>ZHue19b%WpRedoM}?gauw7mRnUAEQ*XegV5CtnJLeynrc{Pj~mtj?Q@4ra{ zZ;rb=%j6Q%`U2H_=7#^|Tu|-4>tCBHSvMpP=b@yC)}8&C#41{SCx^8!$Yf}>EIyxpHKZQZE|1k)exb7=Qw<^MenGg+c}Dz z%hzvB`Wye2Z=_-}aRfA+6}qS000*+r1K6)$&g>_|!T9b=^xE1F8m1%0wZA2qX&Xn3 zF2vuKTMwpOsa{5Z$c6AWyd_CK72rb@PeoKpWY&d4KUT>_>852CdF%SrAZ%xF)^ZVU zdAoKnC9aZ-rHGg9AX7~luez7mw%*K*g?PcKPfW-{2Hk(Rc9;MQywuGMZVCC1ne*O7 z!~m^E5lR3;(#2qxU^3nGtMUA^-@A2{0AaMqxl1|oT6}~2P^!$2W@vX4&tkB4ylv+gc=ljyk zr7S;ZOK1J;C!Uw8_r7@f((KObj&m4#{&L<6in{b~HhC_t3q>7ex*;Ua($W4XzBMoK z9w%6OS0sICQH9ID-?XOoxJ951kKovA%Fs0zsg3bIm$ED-PL-E} z?&AFiQ*2xP=8Jy5X2Y?JzQY4Taz=W(i_}id@?iUMaPKoJcwUmeAn1{$@R_M@qhk%S z%du+E>kF*8_JO7}=TNc{z5DPjFjI(*D71}`G{YvQ1JO#zv`Qwuf9W*vT|i)-Qk8oo zhKo98U`!6mqSA&)sdZjP}z@LRf?it^F;Y;&X67iMHndu zSFU)DeDyty*=X)~$@rZPZ0s9m>Fs}c5XDszWL;pdi%P!-4}RRosJsAdO%-^r z+zd+Xj3x;tX)vcUxl;D;K6Fbk4IA(z}tSgVac?&f^LBy^9{Lx4KUB~NbjLG^#En4w+Om7-=oW7dn z9tCh3n!losW*jF-a+MV;_LUq_u}sO9Wo5@+Vih#D;uJf&;fYxqe*SOSE5D>|H2OX3 z6BZ)f@Xwm?Rk<(gDyvJrZ9}EUe$81E*^_XL$9YL9SUH=w-oMsj`-_!)I3L^B|C=j| zdsznWtwy$$5sNlV@o`q-Rs#E{3vQJU6|vEu5?K3$*Bf>Q-{m(E=L=%#{EAc@1he--Zql!@YoYAr?j@jm%o?g zM4#toLeQ35)sGK&`rgQyC`{*{Bs{_cG26bfGoX3~?pn}gdRJef|LR;+VEsbm&Jc< z;~Hcz`ICLVkq%QvUKwr2W15%9fA)YP(MF$o(p1u2|M(k)A|mss4-RoHwZ@BtdNUOh zG*J!z2wOM0cKg}KU!dH+2vle`_(bXVw4aYhcJw9(baxLr5g)0#q%gJBra~sN{fsic zJ#hb@a{xd&)PA08OAG(X=rJB!jbRSDMvrF_w?y}JN!{P2%>mn4@hq__+(q2Aro{$z%;9^Li#7CE`&Db`CTrG{^+Y@R z%|2J`Pfc@vb1nBETFE}1Y_CY%zRt}jy_usB&2j{bbfYuA3Qri}POr!y#59?#zI8jGKCNE<2SvauuQN> z+a%okN6D)u3t~}8$#2YR5z2Zo**{11-|boJ1F!N3A8U9LSOM|iq%Zs?MzdG$CRzSK z$DfA9E9LYk`+1MxyK<`MMUlqA*esFnMAXyXE0HQy)PSPE=wTqKmz^%@Q6#*vo86te z{Pi7frv`NkKN@wl{uD`5&aWjO$guV+?OjG7TT2nc{MI=%#bNqs7(u2dK@_9R=8p#? zWzh3>8mE>|IDCHw{M3BjhF=%8Ymx$oq9okIb4%Z~g;}a4f3<%=u2)G`RKWFVP*a90 z(Mb#fIl#v#RUQ zR6&tQDFa*Dl1J_YblIDKcD&J6{mbwr-Db&!L=oMa9c$$cjnF}}ghAG16z+7ql5>m( zuj`Y*$9vTO^@CrYdZTSOq;~twiIx0@#v)F&_ONo#_&%Sz$dgy{3HMvo2RTL~D|1Y^ z^q%$J)5VD!*DZR!QYT&%mgeVR*Sc0IDgIPa{QDoG?@zb1`+CK#bdS1b?KJAx1Whlr zHHc$U_-BZV9-Q~E85V*be)vf)HeSFgVrdZuBSj^Yv%n%rP6&Ni9PnXn$!M8SVdFTYDa`Oquo zWZMzrCdl-@ZwnjDqMw22$?2`rE{kq@Q~4%Xwk8J8O>5+`xab|3kZ`}Ln=w~ZC8_hB z^QYwshlSt}K0RqxRVN8tYVT^Ir+A2NKbfZ1BWR*;04g^B^FY|?zT4~R@?DZ=Cfw=Z zXT&D2dj0y3=vHGQTh-cH+DP~eQ;DMH9Ib_=CMg6)?&wSm2j#b*VbBGclW`$3<%xi! zG!!=yh@@Z*V3E>6Zn9~lPlHpZ74IwOmPHH7W2>FHRf$&h493B^437cl-j&T6i5%)bHS2-I3b!D%iC&Q;sE#RPS1M0W4q(==0y}tN>|v3x4G;^V^CtmlrnPiTF;tpCM3%=sULtREbJ;W7`%;Ji+iyubH}NHQ7D8c|5YzI$I)NbWRS&}M7Y2G1)H z!EgSS8kzuEaA5!D5v=D39{E(F8T^@Mu4OzOG(E=NHO{zU5lUi?}#CN_EhiB_2c3`m&#_{#8D z{~wZ{!TZB(f<~tKePgU)?N!9uvD5;gEL;1K%{Cv2_!zZ6Pud^m(q7-g z+J{6az^T7e8TRn0x+$tDHYwV47_4gF)q)eR3fh#k!&F!KShw2(zj&M5_Zep0W+l(Y zJx{r~%_2sl#bi-ljYtU$1bWZdDJbq}{GKYglwx8em9e*0RKOsnAv7b;sR>IEx?(Vf zM`{GZ9grgt&;WORBcI4K^f#_Du-JlkuK5^qDpVFo=lp$C03w~Ts&RjEj`=;tYpbI= z1;X}HjNnSDhGM#EJaQsPgsDBB%9?#d*O7|N|C1an;CpOSgY=ZLd%(($PAv`<-ZorL zG6WM9Jsdd>>dJ=Uj$b7fr}|@>E*a0-nQ-DOBuhobynK!qGmxXf`8srF0pgK;=TI1M z0(6K8tZnSJ_N*h^%rPSB#?Bnm|QC#yk5pJZW z!28bmq49iKH6^!z39`TE1c>B4(@S4J(0g42eY4fE(AyR%Bn2jI&2u@d*;Ci#I@u=V zGJM5N%RXQgCN*$#n7p#}kUotlsB38A{iUZ8p=nPH^F>6~%FbIGyMMTnu0v z!LF7wJ3aHgc5={i2&oi*{pWrX-rC^|-z{gAw2Hqc$_w~CML+m|bku?6WO%5HbrJo0 zv=_Y86&Nbx>5edMBlqpDt^t6Nzno7Db@v_XxttURyC$r8?2wv*4R`RGbG*~i+fb*XK84564=^HvX& zF||Sz2UpR%!^ggKR5|n_j6y(~(3lIB&>t&38U^kk#{GV+GFkGHw;!uum7^8|mU-ID z{T(7eYbm_VY_|O>^E2pyGZnVM_H!pX`f6Mm5f8PCF|Sh#C=%fB;-ja0H51BHD~29J zF$;$?*GO(qz24#ET0gfxy-sRYUroFq+iRgZ*VtguGHwSI7gFK#uk8gQ||-ipcBv(SN-kT ziQ&zqKqHQSDTtrh$r>$P^o#XFQ%d>3S%1zPu##z2W~Coy5lIWMGJYvmvI7D8t)Z3S zGZ-Myb&qque)$_$$3N2}dnZ#S(Sp4D4hbShrkGE7WJy-pey%ArmQn|n_w0!MFnUc# zv*l2KaCQngb4BDz1swE`Q2Ry07@UNm!j#rvV4^c355c?RzS0E1GUEe4%YdA_@IBTjo3L@qlV=NbV< zHIXDHMSF>%1_;}O$S#`Tdrk0a0l__Shv@(eP~($ysa83)^J{l&P(Sx05DqBPIma4x z({7oEL0t_HA*N$-K?c&Y_E3{|=f*8k9U)Bss;68J4rCjz3^d|Fr>oKPeMZU+Q=X>FM5?Av9{eWXbDASdYQF3~>;w%n4 zs+#SV*5LJlX&s`y#>)z+vw>BgAfuYHDt&pAN2Vrj*Cn$(%uj9PKVPwY z(3*WX4Eq#aNT~Ik@JIT~b8oTVX@x!tBJH8~226$JofYA1ld1fl38WPN1uPASFJJ|o z0`I%oK|UoUl@~wOb0eq)#|u7X=32;B{0mr$IJEX2koSIdmLn6$$pjM%6!f!sRK3|t z+6dD7z&0LNE2KuCy+k7_#Z;uQb44y(Z}q)6$##lf%O~Q24-prYg>%}zibSvu{##hr z;yQ`?IRIEnt96dc?#0SCD-~)iYm?beC9s;L-2EV~P@?c7=(CNoMDVKe?nlPE9PNt) z+EC3;Z~6)Y?cyp`joyFRe;mfJcE>f*s!An)L5M<{g>RKTn)#1-u`&%ornn~V%1b;> zn?1U4lszu-r!(P_wt#TKIQ?1_bA#3$mHjE5yF%4>KRidDvpN%*F*hff2yvP7Zk@FC zpGq9@4_BcZ@_HLil0e{U_e#9JqL7l6s7swSCtI6~y45&}V4aG7`lv6CqE5iQ{Zhz8 z2*x*e1$f}}QUy~}UFfZ6UW|=;Od;QVR{=d}554JiY{I@zfnA>=M7#6wK6Xnm8l+CH ze4iVl7B7jxxtzaPp{ujg+VJLDiVOq{z}mq?5+_m z0gK)%Z04OL}H&^<-AMt@Inq zw{Q*Bht&m!_Z#&Dc`8k~A_aL^H_Y3Z+d2G-uZA?z$*SUf%Q9o+=Cyc|wR{>Wc@kjV zEHWj8k6I$Z{>OFbZSqIY#J*Xn$Al49)#6hjdo?4Em@aQ%QmFZQ-H>|_L;Fn!q}EaAibOb{GS@&tV$h5VaoRmv-@jI ze}*EHA(9+Q&y@~(`S1d`yb719@aTm3Johq@X3d%~+3$AtPoi6c2&o_@K5L1iUE@GA zxzrZh)98oTdu-q!AZ9i2{bf2|{B31PF7$O#g*O*RB@F&FWZcb3*Hye}%C z+>=dx=6Adym&lTtXoa^&i0Mx@Z1QU1r%6LfXB{w$#=FdKNJ752|l;%G+0dq zJ{knU>ETinGN(Ov&d^JIou6;8XJW{o%>knf9s@NwL%g%ri?hYbTSI=EckRokbiJ0h z=bSYh8~m2)yyjuN0VC?E;_8E+LYa=qy+&YDj`ar1kx;q}GKO-d2IurS_i&4#PvWLj zCiVpNi^7cBRKUaA+X6Zhw>RgYRK@1mln%5PQ6s0p5@NM zpMggVk^V6q(cov5WsBmDe)aSbIjHq3 z+t`ENDC?gjHVlcaX1!vxp4G$8C9=6bnR26ZZisE?HLmk9X?OwYdo%eDbK_fLOO@KUZzq`zJTZ@ zXv$2S`z=rCnmFpKOq{g=jo9oskc2?Q3;iLKsVoiCiEO$1ZRN+v_^Bl|5{@u_^&qlp zSNiPk@8Opuo#qiR-z`ot_l@C~5SQ8xO4ZtS@@|Bw)5Y=T=(yM$feL zzjFR3g}(6w&uihd9)2`AWtI>Se(ZwAxjNSD=gi!6HBZ)))FDsxM|W$`jlRcR^ksF+ zk7`c-Tw8z3wKKnE(iT2ta@}%$Q46&c1YLfvp5L-lWulgYzQrnsdQD;J`0M^pW|etn|I{XNUhjN?VBhC;dh zId=NjgAT|oJ4Q2BD&alT-i~xIeq|*4YU1Pm*QDIy z4+{rnzN-ejQ&<>bm?cL^ipDmo=X6VVEN4R0Gdy=@zzl znGa!|m%b7W<&A~?(b`r&kLN0FjsV>}X1}tuSR&!{bzXv1a=bI?H2;A5xc>2`?$Zd&jhE5^(eu=hd@I)4fn0s7p~b_ll^%)l)p z7;>pL%j`vZBlUyRb)0JtE|ALx|2Za`*z7G+aN*1XM-0k%O+^qoz;KACUNc`Uy5)8} zy)K+_4|d6JdMm+ZZ(Ubzt$Lp^m?OWB#3NVFK%UoxLn{P4ve5=!K>=h}zlF*gcGe>1 zn1&3hh6j{`Fi2~+W=Tt(v)N)MI{>8A%%9t}hcrn!snUwJ?rK6Sa-=ZmXxkpB^nU(A z`2vYMnlhy8)All*)XSjH_v3a|_x&icClpUcJBIIiQ2xl#Qy9TJkyEYUB-ncw^F3@s zIQ~urn-mud+gRRu&N#39&bGg6vLu&H{$9{m;KHZkQ($3|2^X!#`++pu$ z&g7hZD&NJYaV0Nk>b`UfN2`-O<>O8lr1-gYmny;jiQ4@n%yUADB~D$|BDEUZw;C}G z6%-L*&N#loY(}Wf)|esJu zz9+lzH$R(H!g9@Y4PArF{k6v(svf0rjSTBrFZLiS1-j`?BB6DBb3~OT3-8@G_Xag( zu^oVve2Q5PzbV}F$vC?$s>)OS1HKv;{$u2f5CgE#4wgPuBL92Oa?3pHF&@RuU?UksjB@hy70*S^r z?G%x8*c<*OR5781H%4g}qYuuIG8&zUp}dO$0Xr(A;$mLDlE$pjLYmO$jPi8stGC_Q z8E(Evt(_IuMT#1UYnTo;8)8)wd}5vUrB(^$e`H4s4f!ATTEFdY$1K1ro6qFABeXRj zqt~m2kLaVGXF7^rE!QrbACDoBCs2k*kz&){rZq{z0;06Y`oS$vq#Kdf0OE>MdOB}U zWM<7dcE0Regll_suFt0E3`8qbWO_I>48G@WbQGoJc~EVgMS`-yy$ytkj65`mfn(81J z-wSOgA3_itBY50AGzI=KK_1KL<~*T*V7Pku%7?pB?Aysymy7&$B^Ut~6Q|1jE&Af| z6Po2Xq($}{Stkl4h$DF~3ASKoFUz@Xw1;`hLe|^j1hOF9x{fe$la&Eo za5Alqfkb**5SNDE1Wzci_zJfc$@zM3*5%gpSihi0$T zwO*#=!4M1rOZ{`tD*3)%O(-2cI$wdA)Xm+;+Lxh^R`KFMkLQV_`{4V@ssa{v`-+15 z8@X%B`n*lvep1H_fPxChYqwJ3{<;zXEk*lXsQE{~)18!*(0u?WkkmKa?*0e3?{DzK z+@fVp#rc~5^cdYeiUj#zp6>Fqqto5qw_C}U$arkMyG{|b{B}jMtL)VKEO}$U-tv|) z6zPn}gk7GmL?i9X6A>eSl%pk(^lk%73juyCI%P9M;1PbWgT}qxXDG`h^2~Wdsbzqg zLX*j!$9NhF$yN>N&*ur4^FJVAg7E7_^$Z5^xo=MnE)ky9jPx+osLlzPr!t+W&ZW>4 zFF3Ex@Ay4HaHgsqq0(}dqlXeA@|$GNt};c7F*PVzr{dB-?nej^v@2h&#cN2<`nq-Z z&s-)Z#X6HyNFd`svsfPBMfb6O-cd|oq1hV#;~F)qH)yy(7Jt{7F4DmyrY zqPQH_SETQgy7}$6CtuE$rqx~Xf@@HR`uPGpyU9&T+Di?Mldi=jv+Si#-ZK3qy#Ncx zwS!9Ex5!T6V_K|XznNb?k!@gU!S1WZ{u@f% z5uzyi>y}}q>NbKj{Ms<;N0uS|k6ZWy8ADVl&wg84jOJ2kFI^GKT27|a#z*`1w9&91 zwuHYm?xFJO?H_NKut;Kma-F`Rzrd?EM5R{a8EYsI$pI|+d4<2`dlg&rbvf!TzQo3B zuGA5Cd>%FW#V^s2Y_)XXzQnKM)S1lK^t;umWWax*`x4WgVb69A1nzS}NR~t50WROVlJ$#qY z$dE*fJHroc2vlCA3}>_i9B6sMIE4Ct@u=v8V)IzO`D!Gmgvtiv<=h4 zVz#4Cr^-#5BS>lA|3P|QMhtzKq;7G7*nCipuI%bPhE#3;6$uk{jemX&xrv6XM2gi3 zA*AQjzrT^L#2$1rjVP6THYa?Ps}#u_>2fq!Q)?bA)8y`?!~y6H{TifF?inAx(pDH) z`7ZX%58)OR;__0g7{k=L1%K9Ko<=9_DU8mFq> zJ=3@q&l~RrH_WVkT%?fatYyrc%b4Q)CpkAbRi^*c^=r>(kR8*T%k=OesIeEGA$Zfr zd|rvlx#>X5s@`dAX$O3aAx3Rw9Pm7Ff=gigvEoi%c{*2QVKxgE@=TuR?HZAIgd#YZ z*LsjKe-WCEwhXah)Smr1@##IJ~X`?TEjt+)M<$)j>(%}j`rZ;7op?*5F} z>z|fADW{P!GtaJ`K`h#Z(PKwHV25(D{u4bjhhnl=^~+Y_eep_%kj_LG;Iy z)qfVYau7U9Pkb^9=Py+mx6Rs;$&-6lt7R_u1P?3!H8c`MX?0a^uBP2CcIY;3`6?D;&?zg6Gq zr1~*;hxA^F^$N!SFRdkY6X#)w3g}&@w&67>L;;)DLZyE+{pAVf%=cb9^?;9lUY*Wq zBiRhNw{Xv-qiJMjGCXklP6yB84I zKV4}h+>@0WhiJuz08A9G)UoFPdcsK9FiSgw3Y%w!pD=japk)j)bb>muX4D&Tn=e}S z#$KZ2eV~MMPPf0srV@^Spu9b3G<+F-M~6_rP=V%;AZ`D5^_#Y6@QXVW`6=mYjb}-4 zHGi^{+H4r*a+LJ*{z%D_kayB)Aoq!ezclYSL79 z@HhR+**WPwqOmx97X&JOIX|mdyFRLBk$SVdnQmLaolG+Y(0-Gj^GN?N97p@tyI@ukQ zmYAx2{mJB94sNTs+%?Uq{&j+n>qd5HtvtC*y4kIfWA_dU&`1WJM3~VgpzWQhyXE@B zzpm>ElP!JdOYxB2ZwYb=W%vfCH}+ogajF{p!>vvyk^wm^CyD%oM{sXEq^XDj}H6_^NVg8!+RQn(As%rnT z6@QfvPNO5$9eq7f-o|4D;5g9WOY7U%-vNj;XFXhI|EJYWH^+03JGo<^3A-l1pH=4azq++^LmWK6OzJ+{l6jhDXejO2EA zur(#*GHNxV0@~*RBJk;r+_Ot2hb?+UT9oC~e;CI0JB5ZzB+9wvg>Q+{emAkTVXCPV zj`8U7=9*A@@8#9>eiCUj7Oa|vmBpP4d7&L~wYnXbn+V+j;Um|`6VZ(V_;7_5=8;5B zGB9<;H!{ZHf2Cq4>3?BeW?u;pgKTkOMY*54` z@0OLWplF~bOeNNLD}`U^hhd9LzkCM%k@&8z#sG(PERCgCp?PD<7a>x%63t}oBSRVN zMQU$}&?;O)NPD`GpAcSxbm5{p}Y{#H>gNFSGg8G*1d2#AgE@G=Odl^1Uj62=ys)80WcKrBe~Ut z63{b8EuXhV8GW5E(^II=5ztKVUmn{OExr16{ilIb-3SA?X9*Kb^-W#S=BXq)y~x^pTQYh0pZa-A0zpeIY=(2fq#bjh>tT47%_ygXv z)I0rMqH~b$>oqeEae+kqNJ+B1X1^^cPixt)pMErh4Y4o zL%XWAHDx*(ATECb8iD}jGce8n^g@dDPrHA6o1{2)HD0qGP_=pnC9Dr?NGT}Q?URiq z=l_bX!H@o+0;Fm#wu-5a-xzw%tmR$Ml%{K;nEuMAo0tAT{Dk<9@5M%L^kWtIBlP|f z75u6!X4)s3)L)tYKzpiY?77IxCgg%MA|8Y$D=n%QHo_tetP<4x!w$x6Y@hOfH{{*@#;9v14MPQP$6C)b>7z`Hrs+(Bq39 zHHw&i^SiDlN1ls;Mp-SK8#i@QIRdT@3TW!0_IJi!yDh-u^XrtEco9d}XZhVOHluzw z*U@VhN$btJ8v?q?8)rDb6OH3D4>f=eXn&pGcZMKgKSxmZDML1y~K z`t+pqljFzI!UVu~*{3Hh%labFwm`L747_SV1Pko{u*J)gsA zGw{u(oP-=yC*h}agnlvi{Y=qs^-ra%u@rH4f7y1yUII>u|m3Be54hvq2%v!whsW-@inzbd70nn$wH#AJd} zvpf=VWO<`04H@Z~N*RQF#UA#TZwSC@HKKE)ado2O^MLSEul*=WSrKn^K+vUxx3)#Y z0~?reNkB^bRNaKCztL}yl$yWA6kS!BE3|ak4Kgla&V=GRAsmUJq;m+K#^bn3q3IJc zsnDelSzp&E^gqyG~c_bKFJe97ix=J%8BGhi%aBRKoit^mvzm8TL`C^+-t#aPDil%4*-P04r>d^3*G*E%&3OoIJcx{?T+| z7}A+XZnglh-L7YpiF3qlKOH4I^H}!mAV7=(gQIWn24)ax9bwTXg^}HWx`a~F*Wp52Mbk-0#_SjqKlsSEM>csUMw zuR57vopu8rZ}*9uzP@yD(H8nv`AX@%%&cfmU9A>b4^MJx&YjktN0i7bV5qNyQm9Wa zg2s}Pm#3v%PtUn56XO5#OCli~{o(FLlwXz28ELU%(Tt=)5+0Lm&Un(2avYiTc=uB= z6G6-9V088u&<7={B}D(ypErQWb`Yrb@BGXUeQcIt)M~tE0_*$z?zwlthDk?Z1E0S$ zt@*xMkd}(`SPUQG$n_$nFi<{xc$MM}??J0S;Fg817RdT$QvLxtfh*z8$0*b~ykf1^6lv!aUaau$QadwOhtgRhCks9|q;3s0@?sX1Ylyc9LbE z_hZT@h?DUD$l|=3OA)=w7u3e|_E;;}+CRc zkOyI^>hO6I6FUs@js5_heWm*1zXg_0M+n(%uY!K5oF!tZ z#w9{LQVU&UADx9Al0bXYoQ4B${tq8lez&YK9hIzsa}z4er`*( z20N#<2VHcVnpLy~>X*|Qu3bzyGkVq;rOG1RHy{eDUqZ_x$~P~e!%v7Lpm*Hwu}}eO zA6Wml{eO&jom29=v@i#yS^3~*5cNk0AKqCbelw)^b#v{;QRI)5dr~*qt;MRz%X=>* zrKom#riQ*tOU&St4?>!;6Y&^6-KMuR#PHEPI$)zNof_oaw9*Q%s_mUo^OXRcPxdCt zz&FJ>*t_&OV}r9{m*v1luX-9qMJ_5j+Hk=m&HqnCIgts7p#E3&LsFtyc?w#Jx7S3o zLQ4}4Bt#raMdXDQEzIeUWC~*q2^=Tf1z{c}zA(A(#3RFl6vwG9VF0K!!yr4vc6mQj zamB1tl6c~BX(tHAmRS1s6JryZu~#GY4<3-vh$O0R_lL%c#93NM08MV}hQBzqx$siZ zQJo8E+hyWQ?^$eh5h&i_`vdR8XIT2GtJv=61N+F{D@)?zmjekj%GHKhqWf9$F<@1W zq3y4?rT-@jz|JI4RvcuT(zD9huKJt>t*UjtqU52|gN{5(VBOM>(}X;UVO7F^JLuCV za-R*qsa@q{LH1Y6shY)KIj%>Ezc24Y5QzTr+uL3f7DE5UK;Of4SQ#aw+~+74xjLhP z;M}_kuWtVMI<`^G{6Eg#Iw-EUTN6zJM9>fj?k>SCcnBWcoyJ{)HNiu02oAw%oZ#*n z+}+*XyOBok&UfaXnwfiMe&4xO{SOqIqKduVcdchVBK3_D#AJBzFw8mSU?>ik>W`+q zNZyQWR--WLU-SGLxq2Pf67Mx)gSsX)4>Yb*>v+AMev(BEM&>o7_iK{zcAbI5WKEBH zT8)0HxhhsKhJ`T%VTxZSc@yS{-wyl3vxWI-Z-0if1K7#D+99Xwl#*m^%~(-c>(14j z@#s&Mh)+TneU$8t5*@Jp$(r@w#RcUZCUgPNWxhIsiq_ks-*wQD z5}vM-iXH;f^(BBlzN_pNe{p+g|F!LYn*~|&83x|i>M+-=ZX@LapiI+f*fdgG(g1m> zMfB-cTQz3b2i<*+l2<=!I%NgMVg2QDx8m`b1U+y7k?@@+Wh_1)4`rJ$fE1m2KODwh z&Rg!@;jbQlYirmf2?lN#9#hGYFkQ7O2AkyL$8VR@vwJ7LnIP;b*Eb28cqQszIp2M>o6)=j;hvu>T|uui=Sn$~TtU^0H| zztR$m_Rj8RaZi?G)e|~;Qo92FPQuvKm*vzDu)S-``@{86&W;I1O=ngIJaz|gRtp}C z9(KXKkM7&rt)jme(|@Y%)E^;hHF=y6=oDq13Ofp%jC#Wq(B^Xwi%+Tn3H?p3>n@{C zootZ#T4r0M>!ICPoy~$Xi1MY`rJm=6YUZ-%gyX+dagjnVm)8Au!guJnt#YoSb;}ty`n>i}GkqocLMPU2Nk;PIC~aYb z70z*=_IESv!x@zEyRXEbRB1A6dcLc%Um~f3@o2x2I0qB4Ut6p8{Z(q_VG@veDk2`! zNly8D;jmJ>R(ws%7Ya-KvZxe6H`(aL1IH@#}R{yhDxgqj5$!)($Ev4g?^@azVh!JTy%b%3@~B)k`&@?R7Si9n08& z0#~!Ho4@OKXJ%fQ3#bJYBOOa?=^*fag@~_D*FL*51B}Ga`JuK=$LLIe3qe`S zFJR2F+gEfC*E`V`yuu%4jW8R=@NDxw^^g{&2J3d6Sh&0d&k3B=V;v+)q<|YDpPRKK z)i0UE4lk$Jx6Ug&3wV57Aq;N?Z6yNYAdAKx{+WZja6RVh)u(6I9RRJVdX(>w=wYN3 z8j;@+@Nl+HxfDX19;d!o^N+i>w4Qc`B4#q5{d$?7u057d<9fGQSz8-Gt2t{XbmSQX zp-woNSLPu7oF&aHxN|f?kOc;-y(u@njr=5fhh;Vz!(4hf=oSK5D96<5x+y6dkfg)_9TH zk%9ElEpElM^|@PXKnhBeA9&_u}W$#)zwGF*dTRtZ%S%m_WQ$s%6b|5 z%OpPwCd&|V-|W&a`y3veJsmh&j5-Kw9*9u{p0Lfjc)7X;Y~T7tcK+k479s-VW<{}p^a zz$Q-?SM@~+cYzJDQHj`i-^F#?Q)fxrqr?P}qdpTUC)BojoCdwA9Vi^_h`Ip>x(vsduiepHMWdf_5_!aKcZ=u!xljCp zY>N5=OD?cyNNd{5l3B`;jve@Xce)yr1RZH=Kd#?&b;+0DjNvAj3qh63(>w&~-qu8$ z?{Cq@9sF_OM;LXS*973nYyy7fACrIIgdKryEl%mU}y-sp! zFrUbt%O`YHv{RHWca%}TpQlqlsqmyX*(1bRyX>~B=V)^@Q(3iIW4d2ZdIbNyh^=9! z(T#*-eR-EXee?01haVa@*y5yUBT6iT99v+c&#E~^4PkXY#kMy0#4b2*MPgO@H!+Z$ z?#cMTk;Ra=AO273{5?7Z3%*6SYic9BBeClgtn|25(YPn{m%U5rUtya`#x^|5S&#kP zx)zzOPK~~PJDGc5r>winyokUEVzG-}u8~gm{Sh8SEJBcbW~10)Tn8taDm`z3+q0YI zLgjR-VIN5RR7=kSiUh?StRHn9JOt;QW`yb+t9k~nWY8uOtp)P8C}`)eM~$ku&) z4B#+Tz8OwO+ec~DkG^e{Lk%uuJbQS*S@yifFjO`MG)f2(I1^2`$~?>WxtIRv6)JiI z_qZNM(q5ispn}JL@5a%QJ^beJ`Qa)1Q5;9;+Znsvw3>#?Uw4eK50&L9#^_Hxu{5&Z z2E$2(|NO0wiLQ;h;S;HJfXv|{8i)!8kc=owdykKtzL^bY1^MYQG{qM_&-eS>UA%BL zGwKc}^CP(%hJ@~pCg!+D zLB?PmV!xMY&Wt56CSDvDaEtJ$(4DSK(*>7ynNFQuDX6X05q7lXNOk;Sp`6nlhNm$z zl^EgI2>5ll)!l4_@i&7kj662O9WIUpj`iL5+v3q2_VGBNF4rf^xzbJu4MAc3^1jQ& z;FtHnK~ZwawV7w9ckBq_@ooaI-t_P+RSu#@p9c84Q?Y^B|9a3KIo?#>0a&XQ&(YJ6 zy@Zd?*#ik{Mq4vSm8J2A^gDBimqe@R;!`An3`& zt*;9Bzp`+BSz>%iVYgk!ljbL~$hZoLMJ!v_!vcCAmx;9KSh!s%s(`bWZMv zn+qR~2=6xFordhX{+xX(3M)_%c4@Nl$S34*chq(4j(2Y|Tm|)%2vkRMhyJBoovbRz zI^(87i#_hgO%UE3{d67AJ#4hA8pZMA(S-)i{RB_gYq+SP`Do}}Rq}6l(Ppo%+_4;^ zKa5u@^>h>0wbJws2obsTrq@@BLJ4{*Bn5Zun(eCfH-qOUN3}(L>lUk+8a8XUOfg+<*J+l( zW>IJ>{XRjM>yQv-WZkab*lAWRqN9XA;tp<%-uv2#tVbjW&4JK1bd?Ysz1rz{((^O< zh`D8pIw(*G{iys~cMah_X6Mv#NXYtkpQzky;{C7pn-_fMLvaDx};vlBW{qwZ;R10j%QkeqJS)Z zn6O>*Enyc>$kS~%yOBvlbW~+OR~-@31j@G9L|XGE$`jomVGbKVh(%}?UyQVU=Yo07 z6WnUox0qS|)6DQcEC<>X(tW`M*2(W}(Y%K77$B0+*+-9+U7`E(Z!xF@a|7ToKay}0 zU^zRHLTvBECR$NoRCKs=5j`oljk!7k%b=5nxH{to9bFzmY<2>19x^oO!krF z-ru?|>>^tdemc%0opjHnEN%3(?nK^-i|&g1=$8$_dedi0G36rQS?Zci@9|~iSTNsHJS5ql-yK|c^D((-~6x%t* zWh}z7YfV?4+V^Z}j0uFfXbdL$q6JD0a7ACT$$yy%j$0HveYp~qQC8)ms&Pt+9KL^3 zj=K8NJ^ieJe&=ln&(?dc0`c;}zTf;q`ES`K-3PYkw0$do_FU2TFEDt-gRr1+mlK0o z>RxDKvi_G>(wE)^V3X14$bRcc%XCi1&|Y`;3)q`GSFY#+`-oQcnphd865TCR!c%*$^jRtp(W#s##GF*Jz1Y4Rket8$0?F*-E8J#usRkM= z|F;seW9_d`hG^(^2Zt`E>I+FA1Y*`r)=( z&6tCfXhy%ROmq|f6&R1mVLS}IiKH^=bg}3zZQ3HX_b>ao={VjNEGkM2CigsDHc61= zgr~Xu(Z;{_5k9Zo384f}hDWU~+d9;()1a8!9KMDQO%Cfh!f)|~_B6m4V_VmEPBVR+ z&_9pz^V6(?+;bn-c}f&OoBB2lmqtnfX)k-jFNeL9EO9}MFU_Wj;pM`(3xeDEm`2Qk z3iFgp51#7i?wM+re_L{r>rY0{IqSa1si8tOIrYBiCK}GRcCPssG4&X=yb( zx4yvS5-ej^|3MNwXIeSyfx@Of_)g3Q{z{}!F*|>U-da{~=?>TA#vg743uu>hq7#`J z1@`rYMWyeT3=e!fHC6FUwy0*2l5XGmmzd{&e;w$<=TENHbN(h2JM8SdK!H-0%oUYO z?Drqg-8V;KH)MC!FlRt_iD1(XSrHAVf8m3o^sV$^YjO)Ot6sV_jIq%Z#Q)u$_LOJD>_m{T|==rT^J;S%yaTF&N_1|3rtcI z_%7)-SUbS$AK>r*-2r7R)mI!RZBP$h7rs;`kAE<>rosKS>x8}yG>q0}l@b=g_K$mjP=+3tD)5Y3Y zl>vXuDOuNm_-fr^XfCRo9z*?p3)%Qq?x$I zF8m?Vs^YNXA6Iew82J4@MK?V_)+zT_8USFM?)FDJ6=@)F+p_5(1!p5fs!7R=sHoq^ zKs6F}yCQ~SPOVn@G(@o<&vsKL@ZS1-7+GD6SgN6Pjm;k^{ogA4|Jc(f&f}F+x~82V z^4OH!!Dfig9!!^>2cf20+F?axdqKk^m;UY{g(^i?exQu(o5jCu#^(}xfH~=%9@pg^ z$a|u&Omq$}7R_yG)IOST+#Muh0IMGr-BYASeooq7T&MByJQu9h^n;aHN@q+2{v92LSLA>2@?Xk6BC$_&xAy627GxQD?7ZRLFX&^tP znOHXAVeZ|*Ktt55TuC$36(U}x_^Gy4D~IIG>7ubR-a)8)#rTI8>NM!t<<49`M7Kt7 zxhlWtL;7-E?);}gyMP!gwtq-q`}>FAp%_WmC(oTuHgLB82>Bo~;k$8}MsAhK zQGpumpu5yMi66;BJpUAjx(}!&G6b)45@XWwba@i|i~rNE68LdGGg>^};IScFH}o6N z{U#%(fDeOAJp&aeHJ>P2tM(6Mria3stSFCk`!=|+3eCkN*?k~4aYJF3UgpJCesH4f zs0upX&7D9m#79S|U~d0)A{KN~Zu>3Mf)caH)33l+5<7scS;4giJnv`nO*^h4jS6&& z-iR)TOa;>0PWo#`1U1X|A3>M@dFMUkiCQe+{QSBL%5P;%T56u>yJ>NU5k>j!94d@A zS5mgxAqdN#-X61<^I2QEoh-Cp@P1rbHrJ&9mhfUXPSxg?anZ-UZ}<5 zcaI+w1Fw_1{h^h0S@>+pPRVw0URg#bhaboek)fHCtdp!+)~1%BP>4)jL|M=SZJad) z%4_(}Dea*RzLs$EkFEwq*Y~7uEf<|llny^+8$aLly}CqWn_<9RI7SR;bMR!o0H8%c z8g~Cz8YZKdps-JGu80J;sQ7dt`?(L-QA9!seH5#cNA#iqOd!+w9*~o}oI~4jMU{JO zMMi9mWm()D?o|@|43V^dQ9^i<)I0`wf!{`Uz2qr@&Y0P*)dAgwP!xYJWE0piJ)i`i zJ(O(mn0(LUyimvWvilS1SwSL&6zA7x>lWVUMg<{fK~de+e+ z+6sw-;w_>5yJh_^OArGZa|1K$os|ClN*M5r)8X zm7uV7s9}M9DEY6Q6Vbvzc9aVn!%&W4Oq_+ExD?8zkry~$p5Jo6oZ9`uIiN8b} zRhqm!ZR}65F6A^9KEL~c=oN-!a;p$WGShiQI`F>FKbq*}w&r(@*?NbSC~xPm%Y@mq zU7&q=;iXwXuELs*vGqaNmJ$o#LAAdUpF>{xjobPk@<$oP0_lDF1Y_%fXyJFCTcc3e z2L`gdOmp!EGy;{j+bBKEq?Xct;$b@8Lk< zL^n^6$a&)R6)+8*cMF$sCSvTdNLz<#)*yfwJ&mNFum_=xo;%7B1q%WHt+VPs`;&0I zV1AgXYi;ZdBKJ3opwAYHQBu;2XvrLowmciz(C1u%HyONd+@GS!evM(W((Vjr3mB|@ zs_UmAZ2IGu;IQ1}>iTed(}kyNkLty zfLGKXjMRNQ&?!YD6^N7*b$R#o4JkvIN>2%yM&R&GL6mm7qgb2fJ(ayQ`kHSwE}Sy5 zhP4~ApfdBhlLBeMlwDLz-i&-Jo*lE5uR}a8wmh{5yK_q7T&e9l0g8j_4r)yt7L|R- zD?u5>8)QM<%Df?!UtbGZL~#6f7$6qt{aCy7SlvsJUop3flXt@3mTF1_WeiZLQWkdc zh$Is~4Y&93jcl17a7eXs`uDdhX9XZ#T%#o_PO=$QY6n_0R=abBR2u+Nn=jV#y!oQ|)6$C^U%HK1N~ z(Q9;e2xD&i&3TRHY+cfjHv+grU7nnHoVWnHiSGcL>Y6$?%B|}y#cwWCrT2L?O|MGG zy~|x_BR`PMq%c1l(bCQu^2Q2h218_KV|nbcw7w%weT*YFs1C03zir{T>BouL%`6~7 zzOs}Gry}zo4u}*`JI8J6)g)}{|D4&n92)z2)?Z^?#tlWan|NQW;P#!W9q>Mo^e23I z=MR_)L8yLslH;0SZxi|G<{|gfx+?XCsEPK)++wl-Ux%${@M7`=xP_=4Kt-ISf%%fmxpIYVAIr7W|5`Ioea1`sa} zSAEz3f7yg4X)Ibx&=>v(+HMA?OEw3i#%Cq`dXSr}#h10u#~D;;iu8>NlC*<~x4Y5| zDRw$4NNH8t%(gnmo1gD2=Fuf&&rqP;)RGs+ZH7@?#>ptf@wOtfbL117lEJ^cm#wN* zGN!gfik?4s=i4`MS8kkBV&DsWtX~wabk1fDC*DhajO718jGiIsWly zk|S-Bj6aKA32-G zZL3{e18VcG6kR2-3+Gb*8#k89ef4l7DeS!26X8_10#3Qx%ciF$)Q5M)+|rv@C_Y0` zDrP3*DB*+)=8YBaYT5i)$_!IemVbA}!DZS=yI$!Ms7}*gk|%_{m#_SMfQ`+*Ro#pFq00%(;-oQ)(xzrQ-dHw61c*rJSEgcgp#qPNRpm!2fx2(v(Yp0 ztw=(K*QhGGWiA;;ZUbGL;Y}@T9_}eBR|z?YRZfvTlc-~6o25dOtCbsD3Sjjjwm>j& zfT=yW8&`gFw?oY7VgMNHZ)pW9X+kJzZG($GkqT4{0`GvDN(2fbJA=uE`sKaaxg<%7 zQH1cL+utg}*|0~57{BEG=0!;&m0Z!n`9-zfjeztsHFPhi`}T8tE<;7Y<#CBj0Jxk zurZ?f8{`!5?3tdH1F+IM8DK1P#CUulU6^y7GYqP4^}1_3J!y_5X}XIHB5@@3y1~5D z!j29jp(O11{ei7T(>HUZ@Yd-0>#QWCp+WsLj^1Pof-kJG<=S^}jMXQcn^JO1&TQ^sT`V+l4|xQ$=yDV4Dw#NXD?zK~HJ+%s!0?ghJ^9dg;T z@Yp;(m?X4#|FvImNqB@ix~f?0$YdG6ueQxmyqN82Eh+^U^+h+O*w-czHV!ZttuGCh z{d5Ktf)my_?T%1KWzcWGOI5PNVeT>MxQW1b(&S@tN$UUN&VMn%$r0%K(ahb@7N;X> z3#Q`T7???^Wy3y#$7^#SO5L}kz%3($lz)HWfX(WU?)oWw_)DIT>wQ}=65-rPGD$~< za-r2t2vWjx1Nuauwxa7A`?eeW2&yO*jw#?q0s|HjD*8G-{=%2$8$aq*T0;g#{okAH zzhsB-$d%v1iv}s-ouPP-`}A3(^y4bb24SZxZqqTQUITApXxrZ1PypRwdMIEJ>(!QP zr$K{y=>phg)MSjF&+hZzB0b)CtDhHO`2Ba0sQ=;2JN5!N<66Io8EE+>A)4^ZQGO^z zvHtnp;)T**+t3Bi;hGuezpJmRQK6>47DBLHz2&6QIz=*WZIv;_A9DZDLB2Q3*y+NS#EW&6DCuZpW3@;hx?D!@L$%=l)>K;S^X1CNR-L* zBAa)IkE;65=VpQ|M07i~2Ru;?t@&Zf;cs|ASXF+?M+c+5*-wP8mJoXUMf2$448%q7%y^N%n|N_mdX9~3w}1&T<`HeG{1I}sj#G&}yzNSCbZql+q6t|L6s`#(Qu zA^f$PoE`<~k@S>osL)V8Vx*-TJeT3PpQ~Y!z|Gu)GP1eu56h2E0it_5Cok82caA0Cj(@ z0jP}r4J+&a;zvFi18hpeOoz=h&cJdJa+qNGs-Nv!l6f$e;!nW8fA*8mS9Ms1gd=`6 z{t?%zC!jy3@)m`Ivx!(_vAAGQz$dNvYRmdx{U-kCVbDcj|u$`7` z6mmo=2)2W~ol)35h?N!|=JRv=Iw@WJn(`-+1e>nnihbL|5IggFB!^P{k|Xtre41}OT0$FhCju?idWx} zH}az4Vt}zh97n554)Pe%1OyvpkpyJKzd>lAV!s@Y_Owcs-x;Od=9t_OZb5bIOI&kG zuu-0@{~4M8y2iwmd|Q$?<2(8jwxw7hB0cRMoM~XnT=8a-Ydb%9T~-6 z%Em`o(ZY&}#0ssmBj0r@AyVY{=(POubbA982aX3O*_JkoYCkCwENs&+q;3UkjH949 zE-6hvBs_xuyQ=hmMKu2NE5+F7mU}3+*h})iUqJcE#H-5Rrmz*VP1E~w)%?j~yGkxg zIBc6UYUBqJqV6j1K5{}U$PuimmBweDHxNPGu6TopPgr*jrw3i4X+%nh&H1D z$ew%ugIMSOu+5%I6BW-Wk7=Z*yl45rZXnnNoS|YxC7?c*$3Ry(SQz5n^}>%~pdTxZ zIj;HKEsF>cXa$x8454#%y%3u(&+zo!W`|Rfz8)=SGL#KM)BmY5LI}4Cm0KBYytlmk z&2**_r$$-h0h{0CU{oQk=)O+4XaBI>7lZB36$a3>U=38aKbQR5OvqQ-Kg56*qJ=9a zOzC3tf3fwFieIP@a*=O|?KEduNeU+u{{Q?}CHOMi6i*W0>`}K+AH&SYS_sAweKFsL z{nm^CcpcMbLW#}L6Mnl}T1a2~kzdX*yZ0zf{CGHd#TaLtIG4r)pjUDQ&<=6Bp!(&; zT-QAnp5y&bG!`WVek;hBqL0Jnne)4LvEke!oX};@L8gOP8xrBk14kGj3A zusw8d;rl;^CxAu-z)fV&-UzprM-i#d zba3iDoSjUGBD+@peCDOUH@GXY7017PK#>g>po`BQWd<@eFsD+;2Qz1-024Y>x<5gv z@;fL+8)4woS7s!MaX;rY^AMqibdq9r?3^vydrX$AeUtg3gBQE8&GFfsmC{*f#T}X- zQ7AB#W-hiUyAukPD;28agaeDj0x|lm3i47j+8BTujlOrkddtNFL7c!pc0(}>|5mgy z$wNfrS%p5GpWX&s;0)<)dG5@Lgj(gUzqfM10v!Kd!o>e)=4#Mt;7B`Z4+{La+$g0@ z)!|}`&24zNJZ6Ns6}acY;w(Mak0C*lNyraQP2qmudwe@*$ygI9@}q9RF>RcKeL9t; z2v-K~URbVKHi|4`lq*3u*}!M+0AzbGPVw0_!p&Se&f8)RZCc7&xMz-=q0Dv{Ti4U2 zG6~E8K*D_%MxHgZ$md?SM*CvB7IVIv(-SS2`pLRa=F&5Gy_12lTn>YU){`qvDSK2x zI67{C-sCxetV;Hap~R^HeKn=*1R&%X;C#o}Hr(1{GpfStoV$ zRsi11@-pdmCi;yGHq8oV+*hgICkwMjzCE_w{TYeNw+U9TK{pgn9Mdv2uL$7>W?zg; zUYn8pIINq(u;36XO9d^qvyHG%J?t;0M7ZSUJ-FX?FfNMRhzVbGegjtY{z@kZkHQ}I zFU&2~(mYN}3rRA4&GIlU6ov4o41SVr!1NSfe9Tbdl<$|r4sSs3cg3O(39V{q=vkr) zqXe-~A@6iyj_)J3`fX>UxQ_NHGu5(k-o%E;QN zF{nU>2!?2BF*Kkoh+FWHc7R_#E4?pA85BXL@F7@W&UuR1J25xAk#l=PtWi7dT~`O0 z?(b9ImgGWf*bhJrl714^tKhj2JAb-)`@wT0arfxe2rcEe9yEzGBGhW-CBB#wod9yY2q&Ju zI)eOS*84^B%|Nd4pwN0^w(UF|HZ0R>d3Q(wqRF=m|C!@++sk2c663s|n~>}CxRnahfE$PAIeYKDU2RcVF5hO}JXMZ{uVl zI&IipasCs4o2%e`fpu}&!>0nIb#gA+ejxNqRdLev!m z7(2+86veemtoZw0GtULoI#w(ZKkGrc)LaYlJ7~n#Wku&_{FtdYr&n08_+G)_S}|>6 zjY$YvSE#Oai>#Bh56*lyuHLa~+Q|~T8RK$`PjIbO_XT|0wl+DohS;W&9jP6!&lT`S z_^6@Ke&TlTl#gkQWe!8Wg<^Ag^C6{S>Sp~Bfp%yRd`4e>!?7HL`zGqyKYwiO5n-n% zl$718kF|BTS}bpDtPz_N%yf#Z9%m`j49-PDH~smr^U*VN1el0!J~FE|;aA6Zlp)P1 zX8yWcBz)!dt-G`-FTn94l{?cCic|WYQ9WlrDaj&?enJ0>5+*SdT`l(Jwr0}+iAU-3 zV9#mOsgO12VC?pr1JUQ@PJ$I!+TR+hwaXAAE*71Qj5?IZg4BxCa|!M1$MgI1Zn--3 zgARLz9?SMOFZ{k593P81!Z!9a`R<^QnljuGk?sDA?ZHXF+{_~XHVts%*e`p$2HkyC z(yU#*Te;5J6}YRvxTpq_<@;wJNTTEc*`YIhdsWUJkcHIte4G;I84dS(J9q)sQ z=EdiIfdWcgxtbA<_i@1c4>(J)?bm_8U))ceAfU#!!sg4vR9g?XJ!KS4f}msV zX5|vFH#J*X;aULUYw(PPW+e^hF!`@*jS>cCYzvxuC$-4=Aktb}4bC24pFh2)c^xA> z$aaZB1ovm`-*uJ)+X_Z{Nw!7WB-B~jtdTF50v8i^VVqIDRmuY87y&wURrzV)Skn4S zwN=0jnumG5x(8$Fmf@S0SV^uQC~f!aqSH`Y+YbfYUOVBFvfubTpRnhqzrFsf`i|`R zKY!-*UoW|ynk;xliceIPlMTxzJeAhByfsLpDz|+*c3rN2o4#||hlOWtUmVL#ZaMbp z)K6%CvdkCelIHVaRw$J#STD1@Dh~$4gXh4evLogBnODb?o7Icwy48X7GvEE(31=>$ zQczP-LQlIqlhqqahgrd^xn*@g5FQH4!c9x{&IRc(8jjp;;7*QuUxjfp<@ai-ejscN zgN*0Msp&@xXWa&(6Ro5IQJ@KyKtfb4(JDNmF5kKoZrKRD3jQs#yJf+35f(?GOqV^J zlN`dg3h^`z_?G^s#P9;8aJ$8EPnm%ldLr;k(yXe=NeyYOhA zD1q(d)YLD3<5UD!0VfRE%jZHZuJ(Wc?moGB4L+*i1729X5Fl>5J86pb)~n!#Syqh# zX8h?Z4=1js%z! zPZSQ1r*1P>J;(5B6aUbrM`*9`bswO!X^^;9#ntX?;ltnB%o>^0mv9g?cUwN{Gn@)Z zS0~z!e&D}Ouvsi9Cp3sFT8i~MyOmJ##03S#Z0<#D7k!&;s4Mr{VI}lrD+?y(H|)ew zOSo*`r(olhNCVk@;4Hn}-*NS3@p^r;?cUDAe})(^ZF}t}qsNx=37h65iGZC8ToMWh24_ixXP&-2^WXdqQI&_W|G26gWdu1Bu?6mf)^PZ=jet zQ9w>C(fngNP9LsUyF zGb-5#!|o;2)U)^{0s*#Y)O(1SX{LT5+{X{YtM_v52P%=ZG#_n~`A?Tva)2Px31`5f zAeYg{F@Af;mU-bVR$0RDW9=_DX{VkZeD`OaB|?Iir^lz?%p1j8Nikx)AQ`W+<#K zzgO+TQ?hZ(sNbn-t3mbRUS$|cr4<#k?KaZzYq!3OcOCH>^lcqJ6PJID;mIdl%O=m_ zWqGa*SZRZ#NC8`i$*!#&2alhrBi9u^yd1z$M~=r&-;Sxp@~9e*#+=@0HiP zhsD0~6sXEWFc;n!HJ-)MstLle4gw9N%!HXNq?<{_Ij1S|d-v6mU*R-?x65q7gx_lD zJCvmVo$krNgZ%7)@kBwAq=kY>TOfv}XSPHGZhYu{*7q5#a z)4wbns`<+ZigsIZCl~rq1;*s?N*+3|eXS8zGTCYG*VuA`pEV2y!e?uDfXKR5M!9}V z8;ssu+NWcB(0);Vb;**esWyd&w!_}$?}EI&W7e#RBc%!@*Qxm3egYIM?J2_d`x*L~ zJgbh@?x!BBkjD*{$D!o)YH}cumcPe4ZwuCbSlYy#=JN=ja0c5YCyvD;U%o$6kDZg2 zPhMo=IkZGrwbu72OclCu!v7^_avO+7IMK9nnO+T*=hx9)-n6xUfb0+3KLR?N{CN4Q zrnMg^CF5f#=ejJ-XP+%g@55ouyMhWt^ercs`FS!dO+z;sID}C_0NEX3U)K_E>YbpD z5*s)c>wK&@-|g|yT3$~0X@2yg`I3-3&o!;o?IZ^3dARu41x3}LL(q2Z^oC_)RMHQe zu{_O!c4T4btyc@yCF|#rD;GQe>gIIpTd2R#)i0!x+;b{+&&W9%a%)zamb0VtbAs8) z_%Of;3q+7S1*ce5e-*+<^>E?~fw@cyaAsd#U6cws1gM>fX zl%7v&e83I;p~k<|@<37@jL;*{ z0X#N0qB;ZF|6ZG3tMvlZwwDfjWzVOGK8-I;I0LnIt((V94zQg>gdKt}|MO@o&Qu_z zh50iz1v2EtFETaLf0kUcwJPBFZ03@_w!1zFTo=C{H&q~CTvuIO#~m_71`Ul)bhplW ziPQDZFIMG&pa;nhvuhWVvP(T2I71O`-OdWKI`W)Sq9wj!=915I1K%xjEP);`5+<)( zpITsTj~9OX6_H-WX+QFHtTxxlFW%SQLVwjYQ|ny}KYcm%8ofKR_7f~TNtys+)*aLA zX5DtZ`jg={L`Z$X3#Zy0EKEh*RApk;ogYgsX&R9PnZ@q8z@{JrMB>$%=FsiMgt18D4l3{#*MauAN4OxL za2czZ!ff=y7Otp;k3y5lF&0$S1`VRn(x0uL(ttj)*9s&Z!mO%Y$lO^SYwfS-y*8ua1=W0||4aT~E!QSNuBELPeA>;7u=zU*H|y2b z+#1n&JI1LbCs`IE!#_9VK+|r+f@s(3Ali5~=$gB!u)x8zXvkS|H{IzJJbBd->k`xc zi!9?*uLagp{I7$`mrZ!TVC6eG8rwuhrXczZjtXgDTb>l@p#g5;I1G83=55nKtw-D4 zGUJwNBd8~}agX50A5q7~n)6TnhY-`-_f?}n45G!}w1ZO{Xa9CM*VEz75etHEKfTeZ4T_Z^NL-s1wG z^L-p}o|NP1*Y4N*C43$X3d^7`SuGb5gyJiVf*;-xEQ0}?yL)$1N)SBkFrlq^Wus7U zmt9bh36y=;pA2&R)L*#+^gY~!$7&?vpqk!SI^3f;!n}qy_ zzHF`=lRzy}Zq_k;=#~MA^gb5k-qjMjna*~B3WQJ${Q>ETNHDx2C@}C!OlSUyere>iH~XphH`3vj4lq)!dAm){6zY!2Y*o zO0PZ?VU|iYz&2wWHaFCkt_cw}Zvv;cn}_4FmrZ;p4`(+rE}NrR6jv3~xU5R3+~}f5 z-e3HGy#T0-e=I9vE3U{HhcG#<+geQp+V2r_j$KKnh%nK zPoSR6uMg3ahZ2)8n5=e#BShd~fYImOwcpN^zE3B{*LS8?R(vOfS|GO;l?9hlH{_sw ze7LE-oHDPP$A-?GaVrZI6tJFW@;Xp?GNgs=cm16p>z=wHi=)Y0)<@2*98cTEjs#nJ zIO>!ZH;uoz-!N~COS`ZC<_5;==Js!y{MCQPcgQ{eU@XGaZ1Uxl;hzn6zWacYTZ2Qe zt{3VJoBkln>qGs799VALyph^|1pUTJq2P+t*ap?clEkO{Z0m;QwI zM(@x2&2p4W4Mc1Qqg1Ym{w$$`hV9qU-$S?5J)V9TgP6X#)pwL$AoR9|Qq}a&m%jaa zQ1*MV^E;_f#@*RuY7sPwIR4+lfNEJ@xM$6RTJIK|7xteN791KNuZ_dsY4(FH5sv}AjcwdEsA@@A(CX(3kQ6IIKV}|&P9xK{hMMI}yjeDonLg>{ zdHvF%(-c>q&|ZdL4!*6a-GbFnt=Jc(O5zkZn#v(|tKUsJ2i5!2jX(W%7>$29(bQH^xeA|^^;aEB%eUQz*DVc+XI-NU_p<%!*F{G=ldt9Wte&@ zP5HM1u9scyYn~1F#UP7|Y*Z6$J+C2?x+==9_AGT{)@tN*s!=VE4yuDKk(Pzr*f;O* z09{HO*~6Zsu)O;M2tM($54ZJf3zo~0o}v#Q(9n!KxZS9^+%VQ)k=3;tjBHRltUXaD zVVURC$TubetCLP7CgxSKEvKmwLba#!aSjcG4hVG24?H^Ze+ftG^4Wy1u~}Jhk^QjC z*fcVK4=N(YWcoeQD-bzuB_j(x)V-?^ui*B?l;}1_oe5T)w>wh?DHZ$a{T5dkLLOUS@ov8v11gb{NCK- zw{oL*iKB?HmV#3yPUyae#%gDCEs<|Uvy0IBYg%HLg0l7yshj%YK}v%wa~*#1sl#N2 zYLvxf>9>g1CXL;gKHG@G4pyUxS%P=<#*_BxXDOB~smj;D0K@dK_G&euEM*yQ(|aa1 zooq+LqPEkv%CwjpjXMvwQ%N!cxv6m4-Lw)-CeHCW!Bm22&3a6m=a1D~VE#`1c)brh z&}bU~``k`K(uE$9MzsrpHJu!QET_PQFQR>le zLk>HffS_>y&YzSc?QhtYuBwVSh2*mscj4DDyVDwadgZg-uR)XHgxoiVW@pBfN{cAo zf{myN0xj3+9+L(6t;|fi^{j%2TBEX~o;w`d);^I^9w!Y!!vy&F()R9?gp={YaOuX2 zUX6h(ht*Hi-}bkou@`3xIjHGr{G|Q|X2wy|Cdp23V>3zXT#WRPAz8*whzlq2- zsz$;ws+{Sj2tmE_OJItAHP`*d2}v@Xb7@r|nwdh3`IzWWS>`uk?H@7EkF+irZ}>3& z9vZMF364vL(FV&-$n>hzFJfh)oV6fZ1KfqJd|pc@?F4t`?r+^MSxi34+^@~JJh_}B z^k!;rCJY}8MmhND)Mb5QsXr7GUdxF2w{DCpskLICR^DZwRTK9^e)QV1Gu=uPD%%Cl zSehR5Ey5@6{3OeVCPJ2XWWG!ypHgmmdT?^Y!z7O$3V8Qsj}H1hZFUyll}Wjbvf1lK zm%g;_`&}ek+lpifi*h*j`a~#7+O4j+TQp5bI?$M}=fdB-Q5&5YH1F0RJ6UGuHK?5xX?(5k zBj91iFYPp6mdn!ymusZcqm=vRbJ-?LHRPvDr~iDqsI+ll=b#gy95LxgGqe8<)RZn# zFR82`PB={jI^5Ij)4YTg=gII|by9R8&DMq4dei6WV^$9{=>7zhp)9@4p9kHTR~>p` zEvGW+RX~6d`_5XRMxKd+tb9&b>n-F0sy1&c;@$yZ!b11!ZSwrb)v?Eq9&Oi67ku{) zI|Ttoa8_Fz+)D$!s^+X`UORH`d_`+p*2uuwqL%tz_(+j(%FC+uZd$8l^#Tn+7};jB zUO@m9f}qo3% zWPNohe&Mf2McN1*mLkBVVlGGcSV-|>a=fp`0r5hQ&8ARvrW$uJ8T<#W+0mH1{>yq# zot(_Q4YAE4opShM6N_+M^sf1|EqxJfe`!Fd{RD`hQ=+ayr zah5?p6>HfW-J9*Ei6rx-uCnv+nU!t zMWI#B^STw3NIFHG2eUGlf9Dl&Tp+9NUvS1UAuX2|C5)92tY@3K^S)`meut^{9-9G6 z$M(iWb2q4QF}twMXfQR|3y81F@5JCA^47oKz|9BPOY=K>vS~WAv7npJ(1T9E0HGvh zAr-JvCA*8{znVMh{pjp$^P%MsHaYo*Hl2*P4h7m=*6032@c&TumQhi@UEi=Gh=PF9 zk_sqF=g=S`ARr~3LkLI=A>Gmf0wU5~Lo;;OfRvOlbV$bxAsxd2@5%MQuIqW9wVt(Z z?zQH_d^_tn_ObW=#a{h!JY#oty%KfxiT)m0e!V#HRYy-xv?Os{c1?_2oz1j{mT{-? zzM9OJeE%jzKJ8PxNhKz zUQQu7B~JYgbHG%sk>8^A!5c(UdG ztk-hzVPx$kU-L@6*5t&l&&dcsGOdw$i?3`u`9Tr0AG_2mTgUwcxL{x<`MDqEIsaPZMd9zLvrF}}j^Sye@CXx7ZkY{A_6WlIfZ4Z~W`ms1W zQHbU7DRj>XXyih@PYhm0Seha|gc9unyyk368M_f0)#&{M@nMIva!Z~e6rsR78pvI} z=bod4(slVW&rOSxN)4NZuWbk{fo!Ap`FGySMfwr?rbPmzAFj`s_HmcMWt7vQTI9$* z7X!E9pscjsGm4aSV7r$bk5vGjSUYrM>xBd|!p_5yuDi)K^>XkqWnEMx^-07h-(B=X z?z+U)hmK0)i{Qg>Fh*4DxI9Fg?#iu8b|jQJ^#`b!0;<|d*LVge^5S9#x6B^59>wWl zX_4Cear<4xB+$nZeB^Wb>#SPzYR3*iJ%0*Ci6&lg0Mkp;U{?VXdTDNt`St;V0s>Dc zR~42gww-WzWT$U4bR>D=HMeQV3Rc8e9RTAsRFRX*X)(~eJczoo@Tku5SUZTZS8E3~ zv5m?VIu|58iJGdDurY6W>ZJw_Mn1#&Oc;?W_GLXIYU=oBl8daMJ!E;X@chr>$iu7r;ycPk64NSk#>3)#*Fj;BEMF11#%9_tjM z04PD}N6)LLA)&V4_f*+PAwjsdeO!{(PK&x~-)xpc%lBmZRp)$HLDhrB2L7y7!7{zk z`G|lsKRr(NW?zW74ZF}zYlA=aj>M!+_QPHOnjca(!>{_Ou}(>*7^A;|@R1X{C?enx zyG^WuwW0DPg5|dLM&%`rm~&65%A^#(rm+rx*wLH(B60&8jIR9{R9xf{%lHh{)Xcag zVRbNm0x)Vv8a?RR5<@7u`^s`_`Wdhuv`XO0uA|kR9MX4%%q=;GRAlz6+^~9mz(300 zJQ(GD=P2`{jrhlciSOlBC1MkNA{>62&@C#QdKJr=2Y5TMU2LsOC{PR7%14P{b`JxY zMgJsSenSHhEOt>F(Prf{Mhot2d3*`DM$sdsDSrLzp-7-b*7l(Jfh*EvMq8yyuiLGmQCoAXbs2P=b{&HCbU@pI00&i7;Mz!yWX-ih;_ zSVIQpdpk8Vwl#*z2j|_s!n|<`4}MBI;TP3+Zqf+z@}~ZI;(n?2a){Fh+2kZW=s0xf zAET^<`(q!oNpw-&D%zmfR2FZDrWKOgC7s#!{_AOn9BMAse` zYBkG`=zasnfQB4)9t39ob81Hz5r6l`y96<=+vo-z<8e(t5Yr1D=*_OKAAz zeq%)P4%aLZ2b?~%n{{JAgIq4_NTo@F9qv!x?hpPKDAr5Qe`ivIz1hSMs=XLl76e}P zCva7S6P?g*y&l%SCtP;Us+lx?IwsKyFM%yxvi{n)FrW!R!|{I@Q&6kh1Bn&+Njk@y zJ0^j7H-S#SwKXwuG5Ss=Mfb}nO!c0Ln{RRpHC@B^3zHO%&YAuJnAE%RWe;JC? zAH<{v#_=1CYTVLE_pie5t>clNc}-6nsg=D!Rw(p?V-6v@YdV?Avj*FT)RrhMFE7{Z z1D{VJ`LMpU`Z%DGGUoAi)Lv>GGzOu?u?u4r!{PCu-A+qG%$-_i&jNkq(@62wd@9amOvd)Dh`E zift< z%jMDGAYwii$hcd6c~EXnz?AJowueU2TaNe~{1h^4=Uaq@IqcZ2>*$)54zjy}IMxg!!;NT|J_GN-=WlOwz$xKh#D@OQZXj&*XMt zrdLZ;hpm?VFuP4uLzqa-&|-gZYlyBel?C$;6oiyd90%*QP(tOQDIxBXnf#ic){9B zKY~wu<6Q$D;+hWIFS;$*>5W|#B?E_mphCxjg`Ubv=U%mr@wy8s_IVH+QaiJL9NVbb zoNCYX+dQ}8y+n6;F;|Cy$eFy!%;9e@hP0gmt!-DVezg7ZdEsFn*pL%kjV`Hr)nano zt!0R0K73l95JM6~FUh)0tP^0p92~hR_5t*cf8~3mD*aBrGWisbyS?+w0|Rn=L3*(aNT?vRvce@<#8uze*y1e`xku zeo30I;v**aV#1x$92!VUN|BePJNuzqM@96wnr&6`$V*60Ss5{-WhJ(?+c9F>$S_2o z6OjyBh1gWA6@|-BLTTWHvBEK+30tVE(pY72)X4610i8;h>xj3E?0F3W5 zEdhUIxe0woMRfFNmSVJ-?ShW#ED@;E$@d8nYd*2e=Qn<5;{J1)LZ$>zEk)z5FTu46 z>gj9S=;;b*(_jD@r}bD(qV{khnIUn#rRSRid}RzSEtL*Q=$)O4tS6_&u7w&Ta2wX} zEqI?THS26goQ^F|GhF2Lhn+G#jUrni9VPz`@V6m>ch86m%iW*(@D#+(uf2VM!P7Hl z{acuXcx{}Q)Lup4t?Y?+Wm8Ru>k_DmSBJ5s>L;RU9AmB88#$l)XuU(QwZwL|*+f;N zIR18_fas&CWE2&h zSe13?p1r#9@Ay*|EWT;_`#GrDyrkO9R@W{tsISIV<|oJa^m}AR*ufJhVGpI47p%A}PtF6|ATk^Yl`a9(c+}_DHUmn-S z`e4`O_3k%coJ9(T4P7asDtxO`@bV?%-t4|gs@|Q1W>M$L?T!4^$9v_&iYx0BHRsU> z`BXR$$!{O6q-$3tepwg;p?0xhjj>4+-xxFL0FR~QbG8%w&Rn>A%l7;ay6zUnhGg%} zsd3mg7pzPHM}wrB@DACD#k*e^ycx%dHQqVPW8GbZ*01COw(oB?i+W_%mMH6b(Tsd9AN2EmIB_I)!sgE~zADWxdHnxxuZ$ zS}?XM%Ax3u-qi&=Op+cVamS^cis%wrW2b4?zkfEX9!9 z2%{5quz}L6Y$REs;*(s36FwpgW!GUsQAh2ZOObZkQ=XE1r7&T~=GT{Gsp(hh!$64DrV$UlsZ{{2W@x{+9Pkou7vup86k@tHIT$-BC)1upd| z`mm$h(CHv82#KrcIev1UP(p+b`xPX~L?|ukO?r}y^P{egp5J9w@TjazWXwd`<85UQ zrGu{U6dp47t%4R(xN`OOWf+04^y*IZ&v5rL{DGi5ZBHPJ0v|p2RarC3Q`ewcwdi}N z1Zr>EMWYO-Z&MrJs>v6xhBhaZatH58Wt+!m8BufY6;0NZ+Xz!g)20?m9({s*+EW$3 z+3D}~w9LbbX^y{O{-c(@r-I{rq4culaPW`kcmnCyP*7U{L)lwR*mvBEuP?#q$2sZJ zO@-K9`*O;HS@}{9S*leS(mn>mW7ny1qerQt(}`G(StA$C<`G^vDD`RQ2{KEV*vUJA zIXAVWq_lk`abqKq)C|a}Nk#eDmaYM=7<%}atVCG$B;^|{tUCDH3v7f~@Ygo_$d7Z; zbE1qdcn(QML>a@w@5V%8eZGwY%A;@|+YH<;7(;Dy+(LLF{k=YrL$x+#E}HrAoQl6Y zRvI0yAF4+Me)5ji-Qk?4Sm0M##W~rVq^l7efDw6APwr}waW=WH-gas9XIz61PQ!^f z)#6R`zEXhjUi*}tzdSYn1IHiU4-I~1NTri}f_^F3>BS_j)p=olAM{sZ7YWnFDbxxw z7~6jU>?A55uZ2^l$H#&Oh!Dp^t$U;;eoFoX?}zShhQ+SI_BQu!N7zFb!s20qenjep zvkh+J7cHTp{#v_zE=F5RliRWvbPs2DF9Qvp%b&x+0l;!6eK)tQxoKh^3HVbJpb+g z-C47Zy^w&~<49dhacFJY%hLLui1p8XV~FSOq}f<`QE7{Ci9sVriGDo~z;rD~0s|7{ zv$Kx}+JvO^vitah^$k$jl$_?4{XjwJGY!xJY<>YP@YL}VgG~gxBthZ9YM#_w$#TQH z%_DxD0fYT>zIOs+_2utm*=0IGb~c&IWFnO2zTBuGyqS1{axn+x*REERRJmIr2JcCk z4!r6IC(MEfS{uUcRTbU|NOURa;zgA~6YTWdwdpyN6AWeD-1-FErQ(uc5tfD0q_2^akZf8)u9X2YQEG@TiEr*cs27{ScRXL?au#n_nb z5)RrG>HnE{286?dgtogvLM!OK0c2$8(mBV`*RN9X9P+YkiE_EY-`(|b)EI9QC;Y`e ztb8M(c36qCzWZ?yJ(d0Mz}Y6U+OHK5KoaR;C4T$m(()UDH=Uu*0sOgF=(XArM`dB| z676yY;mgzYo|hhdBm5E&GG?hJi1%7o?mY} zsyCs#boAON`%gmzn!R|1u+d^tS8$#3rFm(YG#m$DC4iOqfLwu^(*&n_M~F=g>WkbRkRfuW+a@}gaB`G_THGzwH_e7Q^V(7V%IPTjQn zC0_S6rlF4O8Hw34E7!iQu>7Dd4DC(4^<3FLHJ8x+%Aev-d>J*BD+qH(e(B+js1p77 zSQB5Pa;yaub1uj^`+e7EErzv)KTUl^FG7({ca)LI6fhty^(#qiyZuQx-3Pj1fzJUU z`8`B;@nC6;NrmAV;Q0Pjn6KDaDv9B4A$ApV2Ln)AFjz1&7D%egqCKg`Qi|=X!#sMc28CFOFv?-Bt*`*g5r7y}9 z93}U#kH3{2K`J2i6r!7!0jcNCyxzh1E}0AWZUL$0X(pTs(?71u5Z$mwAx@DI^NfDd zV0K}m-ldadQcOK>1Eg*1l0Zdw-OoeIsX&+0AM9|-pg@}HRX>L?WzT?ayYXg5WNndF zW)zQYymifDm*7^t)t0|K*UadA^Z&1rSCV@v({qyjV7ksaz?2lr@OO>J2C#YlXKJzE z+3N-Kv+21akWw!54p*uR?E$QrCgx8x^G=d)ndAehIT?wYJe;zye! zyZE@ze1+FcXJm+6-x>;Ct+WuH6E&zRHU66PUA5dN=mGlzoUSnP5%b~g3;PlmrG*u7 z2;2Fo&J|1Enn5x!v#|hqU)k-oZi7>=6j~Qhnq63a`o!XmLZr)q(IfGQJ4B*S6ln~c zyT_~j_njW-)kf6>p9YP`G|0$);lq`?AZHSMVEF=GCLON`>f?MjSCnzDQ7<~NMC$fZ z@ubxTze4Bzpcd_Tio^n(##$M8T5vJ$=X=z3eYdi{^)xp$_e)7i2VeGI{IShVDS*jsV^Fq#6XT}5C7(*{ka=H#p@8c-O68w7FP&5w<#`MsN5#1(usq7mBIA80 z`wmbUJ`OYZJ>PG*gns!*RTm80QP$G7pUpp7wXnJzw2c!0wkz4|_{+JQ*vw$utIVAu( zcTbxSKl7dFn9hCk4}O44E)jD-fhO)aZ=o1^?7=e{$L?`!Y5K~%#q|7iyYN+=35=(Jp?Ti=wYH(_kVlG!B`+>pW}Y{rl(2h%{P- z)9IdsJ*)ci#wrHY_lVACG8F|6t1=3aS$d(+r1?d(q1{$3H8TZ+_lJwo-|@TqQtcU8 zY@;kOCkFV66zLYcjIy&2ogVG^##v9QAwm2Tc9K1-a6UAJ5#jnpG?Ti09g1zr;SoDyPEB0FSBzVXDXw^O$43#_Y zuXm~VxW7r_=$WMU4IU~@t1AJ2p^UFPO_HfqJ1+dP82;Lv==WHWokDtampFkgvO9mK z!j9de2y%a%{?pTF_qWa8MA^q>HTR2bbg@+ko30(=c(gq# zu(RM9GW4TM&=2Cjt9B`EA&kBLPR%<$pdE_d$2hn(x~FuUTzD~`nv7tqcsQI}_dM$u zXzJQ+QARCw^xw$0e5MCU#z?QX-%^A>$ zw+e&Bs6q@GqA2Wg5| znvX&8+6RJ9V*Hx&PIGeZOT>-GmpHX8y1U;KbQNZO7eHDAj|mqoo*_R3OhW5?MHx;P zeKwaiD$m~DEW1f=lQ}z|tp!Eq1WZKaExSHeRFG{tGT-a*Kcp7nkXud`fL58a7`#;U z7A>&zX^rcT#9q5|8zO@+Z;6LdmJdC=V1rjXm_Ik*0J_?V+38|U)AxT+KPlp^lI#Gm zl{*@1({)t>`M;DiiTk%yB1&B3oJ*&JemSN?E4^%!A=$Zmnlmn8kH{u7D{8^~)IMsD z`>43vU4}jQox)8TUZTFT@fCCSQ6Z>-w>5Te=g49Xw5Gv_`tr5-t|wt@P)tbhwx_TX zEx_avumNkX``Zsnt;fX^RVpk(QcJ7Tzr;W|t9WEBP<4i-Kr?T_-@wQsB9#h+VJ~!K zuUDDWVRSF&R?N;HHtU!#e8d3@p)ItwNiFz$KVA1y^b@j--@iM*U`!?KmPnCJAuF}Z zo2m@qNO$4pj$rWmbQF77^

&{>snbO_fVN4Gd@W&Qj7 z|Hp5CUQ=Qt9$)+u*)+K^HFT(pm^$b+Hu`7vP~*tby~c1R7UHCj`&Vzw+bDWzd@r&C z$f>&_4wG(i8*6g#Zi->?*{Hui=o}UFd{_S_Gb1$zLxKr^e_`9+f%^Y*6jZLgVg8`$ zsH4npyj;IQzvWt(t}4k@5Vo-V?7~$Sc8WX2h)Ub{Jnol{#33qi8dllYKhIH`(I%hM zHp0g&xkuPe5wHKhEkZ956dj1Gmymn2F~!l`wugK{rO;N7rt9T1M@+4lJ{#(;OJ*qu zd9siwvbDskclAB5SYpwEj8V4~5EK&-xt?s6&|;Ee7tbX-R%m@KFYGSJDT@Cir!axF zw<7*i>C5B-@=AyM>x>vEEC_M<8;k`R9Wre-^?s_y&f4H4Z-3T!`M4}MY(79->|f0E zRSHhCIHmmRPm-j}BYk9#IuYX0UZZ53A=#R4yU#y;hy0G^IMGf~q|68AK>86iknQ=; zH`LMu5=PDMR9xqAAUAqjfRLYz{QgwZ%iI$AKjH0hAm#!|zsFQQ!p%23lN`gX9^*EC z>Yvsg(W5W>N_Qc%<03|eay9Wnj6`M!!lNs?24v?YV}2DZOa2?6^!f6y(kFv3?>cT% zE#IFd%2hL(X$;KB&h7$_IK`!=re@q4!6BrM1qOBr!}*2@z%Di;zM37BVE>tL`VruF zv_U#&T=|okInFcll=%l=e#&-D!TTdY92qr3#?r#$vjO5vf2|!#aJ~QpHqc6!=zm`X zTIoQ`CZm(OmUdW^BiZ&QSK>GJKVq@n$44b!{VTrt4YA#DTYIv#l$la>vBqQPi@4{m z?S1+c&-Gf1p*(#Xc6Rpe#T1`4g%CB@3-LMseHCTyV`6ZYdd#0+q`w&x3r{){{6J`s zSHE_QzZjb#Og}ylR6A(Q-Gk*APwaFd@l_69q`Gfc3NHXVOK}lJbK6pt46HYPWMzFm z2REU7pQBfZ_VV^w0cfC!(vGR$obT!ZW4zt%?RQ*pzsRj)M2YjAQ5ki0hK*SS8-b#g zEnzeX92&{79UUD6JMj}e!HnLP+PRPCu^m&qcH^!vGHT>a_Yq3;{b13%dkzJ3I(ELt zd(C8AIp2zV%2pUdGT`X|I3-c^3XT9dwk*FP(uIW|zHhCR`uIALa@J7;E@Le4GOcEx z_CCt3^xU(*-n0DJZ74@~!9w~dZfRx3Wov(q@$6?nh-=b=m;QApyW{4)iQ@KZ4AR~; zpNDE|Yt5U2i1XHfHyqd1GOAQtAGAMX1=6YKcuB*D%Ua!vn^&)_8?ilbJMRE^{&q)k z>uf&9(FX2~LeQk%1kpZ}htJl+>$yEt!^MkO^o{5R6)0kDqVn6rO2?TO?uXk}$Y1u1 zt$vwOcuLIFQa+~$?F6@Jui+fM^4_SEgFc@jDfX~%!T&n*Opqv60Cd=_zVQFK%Xiqp zKM5vSuUg3h^ry+Tlb}>du^W{k9H?Ak?BF`0?0g~7T%PU%$2D$9C3ZzkCCBx?&9A(A z51KwE*VbbWQg+t)L5kgXpk(#NypQ(8oY)jEH5uFzV#xeLIZZddfyvJHvnSnQAJ)6X=iN1TX$~x zbnSL{EI3G2U(SvfrNN63G6FrJUx0fN2_T7+RVP1RCSJU_hy(m7NAOLBqVC(?IOd6; z-EUy#n~8_P(I3EmzZ_4xo=_yJ6|%gEk9A@y`Ftf7Xa}EXczwMTP%nM5q%moazT_r- zV6YDiRqcTWX?1<5?7z>eFCOSLV#i5+;6d;WuZqI(x5hqCOgBh;fs8J=Ask z^#D7Rr9L|{DlY$%*|eWoACDO-+SRPfrw>oZ7WGK&w&`Ri z-)D6JLTV+Z4R|HqNn&_i7lnCZRniW*4BE*+<*hkMJI+K*P9RJ>w^WD z(Ek0Tji~9f)4f8|+ly&6e_y0XWq?-hz05-X`QXzvaLjJm&zHo5X!Xo7-6}z8pCbHy zhOjH_|2SspAYC6&W7@x`!GywXKsFlxh8rF8vWcd4%+>RR74ISGmbCH7a!>q1}W7=}}@#aNm3t^xU$ zINerM$%;h5N?baqzBJ=eRmRGruQ$dE`Sl}M2VArv$W}6RsUE2^)Z|Y6uw@LHy~l5m zd7#WZb-4XaL&(^O&>hF0h93@<=hXZ}!J!@tW(CW08DA@Yc!XtW+EZ0BdNa+Jf12#U zz52bGV8-}|+1iyer<*Z#6>n+=3WsxaO{aX$ymW{hJkCIf>3+|lkv1rJ@Huub-{-_8 z`V9?LHXBN>`gyM32oygxky-fx`QPBJpE9QU{HidR^5YNq!-eJ<5I^NpF!kSUTqI=G`D_BRuE^NQcSXz~2M<7lZ%RWf*? zl~J9_Mvr2s*su&Q;_t8UM;DKcbw}>xP|+wA@DVEbKZaD4|E|1#aPP=3!VvrYh=ci< zgD=%y=&w7w;||q!0jOhO?pQQdFEj$UxyfPG#oi?6@#UdhAt;6Hez0b7Uy5{}^+n_R zz<*V@z{oG#|IG*JRpv+zg&>Tb><-2=GFhr?CmgSEwe>Y^58w&9L5o>`#1Nr|!|w;Z z%Eg7L~yd;v{?K*hb6aVh)`o(91H8$}{{H?8 zhdawJZM{UGrZbP~spcOsf>!67rbljf7db3g-o8*K+)uNyv$SkCvNM@_q=$aow&Ob& zq4MPZ$;rtA_{sAKnyo4>^~cn)!wvdrYG$L}L18q>0vqe!9K5#@Ml$dg!)yqawwJ!G zAzHMz2_opkXY<%7jlFM2FzoDVYt#oXqiO2)18E8Og3nH-&w8$c=PUlyljmpRGd75t zT(VkT|AAz^A#lcew;VXXRv$nkQcJ^#m9N->oBcXl6rZpZndE(SxCzho6a>pfTl3qt zp55gAid)Y=30C)g^qVnmAHwuJUtdGn6wgZSxwd~g8TPa;BFUDOZ>6a3;Xe-~E36D|)(2M}Z)Zxo&IA{pj8C5q1!lCC{SDlKWQi%9qgb-M|07w()#vEiX#>%; zctT0|ywxY>kD{yQee@VVffy7-5AX5LSRQ;19<#c6m#wRG!vV)7|TsA9`Ng-Q^0r zKq@E63NQ5!`7%=Cx~yI7Fb&f=0jW@TYL1h@{}ItJ**5?T^%>H#-o7Q%A>wz%3@B4s zF#mXQ;SK)mH4ok}f_;=e(cHmYeF9xLu9wWu<^Xgm6k9Nr7zZ&o6etm(a%UvSO$@&2 zA1su?t&?{dPPq-FOW?mTDVd~r)7lFW32Z`T3fY<~Uv&4QX#|G!Sc+O5;I%E%_edSZ z=NF8x_hOMB2E~?*{0Lq=0k>eahNQ?2e6F=GAVzjlt>I3Hiyy&v%-|KkayZ6i3Q)`zeMzJ}sP;vEt2a-0kiX;RONX z>h1bqMQlG}eaYb?n(hq!?^G#bYn2;WjdheqK z^HByaRtmHKW?19(AZL$Ub9-%pd!0m0(yhs1%gF6}* z`Z^Bmsn!{OC4q~(cZKsAq9*p|>S~AHQFF)pj4Fl$&f^)NdF#y}Bf7UJ-}QFc#66ZS z@n78mf1rq4xEY6$J?`QZ(SLdx;i1(~gdHULP#AE6!qL8@bx%794b}MlST6m$#%IfN z0o|x84t7p6GVjMy>6kNocCrmCxwK?S6pcr&ESB~P7fBzZYn_ zmp;l_!tt>UKYfONr=s510zJtE0)EHSgH{*EQzj+EjvFINd{=FYyp0W`gr) zKeMR)JM;ielh^L3h5D=5I7>fb=}0svtBFr7zGV3J(a*!dvP2h81?dvi)#DS`oq7jcN_Tz_a3bO=y$ zR8%91TPq(k%3|@I(@GMJZuULXCHqW{#i#Q;1w_=VUC6l@w{xWh(6=3%@75Bp?*%)na9rO0A>YeLR4(P(Fceb}H@(5l^oKzWl zAEXodzY2oU222Ms@$sGfye<7~k%#YHSOV6E>a{Y}pASB;Lg279xy3Ozd5XC?w$fa4GyMH8cgrDObAh)V93qylr-((c z)Yk_|hwn?+Q?JTAr41C|eRX_9yzOe?aX*rxoLajD04?%;AqA- z%xtTP@wA`kQ9(Wa6`#H8>B8|eTaZ)kHj1eN(*mzvp=)K!%qXB(OLE_vbQ7ql{LM|~ zjPLr;!4M<1Vx0EFa(3>i8x1~U9Za*;y+>O zcf7hI3!nmJ|M&mUC=x(Fz)3f=UcTH2@`wP9O279y>yz+?;qmdg45vnqY1&utX=jNQ z(rLnJKroO}>x|B(mvEr3GeLAU>RRD#XRbK^2N3rY{_4lh1j#mW3Lrm z(6$^Ijmw{a(X^Wq>^r_N@3D3^X4vSv*(^$snV?%HJoRs$oh^%UY6*EXxn4DiM&j}# zTG-*GfRf#NvIB--uEI;qxs>V`J=4O1(#@nxyz$0A`;s!WGKn-X1`h-*Q$obyvvVL{ zpYE9>4!igxWiJF#F7m!Uc_>$pE5IPx!^|prZ(B@^+D^Q!1=dN1_FDIx1{!%jSN#Ly z;L&o28G14U^0!PNu@hxQLy)2lQ{ZLD8B+TRIcY>hxYpZPpFCRK`o%C=@X*il(EaU- z6X+K~vxKMO zas?^Z3V>3Ux|7mn<=vza%*;)lam6(z%A(S?2M{B}6%ZKDB|Pu3oD0DwOzv~p2W%#| z&1(Ou*Ro1-b9;^f1>v%M#Y7Y?olwHS9(EVHE^u>I$I#1+K@$GPO8b>>er9GH(>B*V zq-Ofay6606paZ=~$qv8w2H^vzC7@QrRJDM?o({aJ$k0J!J1Ad|+lzs@x)qM82^tU3 zKM86X=NV|Kxo+1lrcBqJtU8!mT82z6JTl~bzWq}RyirH5lSvJMCHkP{UigyAA?237 zX-Er$e|H^BGoVONtjCQAL_Y}$=x@f;qEiEqMTpUB`z^Qn7Ye(kV@v|v+augW4lDog ziU{-a^18%=l)v|7_9^4qvx)=sNQZ z{kI?Bsm6|V^yZ#+Z7n(aVT9dXDS6*=z$g?y?U-$TejvG=>IFc6$v9%hje<6+_L@$X zKMf1s$AAEu7aA$Mbg=)0nL7VQ0BTys>opX=*7}~TwREKa`JZ!1x1bCXl@Ln_PMS&`kgh8#*<1I z#h;Pry!@yjTqCN!4hWWp4}e&8U-og%cN%N`3de?*O9b>R0hZ7u<`(?3P%`wv)EOYr zZBMsS&R9vhPBj~7&<*!#B%d?Oeh2`X&k&@jxFKbLG@s3kAE}%o9`##;8n`jj)h@Su z&b^8WncdqU0vaORz~rLy@(}Oy1XHhktFt|yvqkL4&p-Cas5%dlG)toRe-s%`Pn+vS zHu$qj-o+>kFU{U$_mTRLql=A*wGo){_hL5qKF)L)qEfr-V1z&iQF0t_4KD(LcTdXc zc4mcrQ70n88+4c=P7>Pd7?_bK$6I~Hhnh-%2L)W1AgHYQfbp+-Nhs<<@|+y>MmFy? z0!OkgG@?!mG^B|g&C#=|<>i?uRS+mrw=6`C?V*C*G*ylxWAKsjO4Hy56;0Lv&0k$x zFJ23<>b3$M)twLN*2-Uj+<$A6hP9XO?HYtU{5K6Fw~eYu(2hynEmrzMteaB?8o> zd35~Nb^EhjiMP1!X!v$TNS*80H#9Uk9Zjv`uH8i|y(wYbpisk`le{$Mp9xuP?{y;!WO)+QW%3ouSas^4H%yM(y>jRS0i%%T;}TlRQwC= zZ?D-S&@zwub@C0&7AVTK)|?78K77`omM^+^6Vu*#_{EEs>nywV4V>*zp7K;w^Z347{?pcrv3hcDg?ou^Mcx z@+1LM4HhnU?uCQP8W4FyycVSJaED#Y2zp1$--6De-!$si^AAelhm6xc%>Lt!PFTzeHG(v8>TnefZ* z&b-}9%Er)E8P(O}u5PPi!a!SUH>4XsMXr*`r_m;P%LC&=t4z@oV{Tl&& zzKNkZ)gGMu)f4E(gX~TwePbBeBZe>5pC!zUu%T>xixsd8e=_G6y?<=mw8;=p!b=(O zwT18!S37}jZ@M7EA=fXzi2Gq9uY4W86YPh(Ltr&e`CTdoPTnFDg!RCTa$At5KAbGN zZ(Olh(6Y?kx$@c6x!H;lXoF)q)MGwG@>*}`{SG204_=t}YL=a1`rj}t!xNp?=9;k= z>?4gESB0*xj+73s#)D~C#{%eZy*#y~nLvXcP2=0}SFbP)bqR+)klE(!_u57=4Jp-% z@7*NTZ#5_vhMRV0nu3XIRu1qPesPM)iF*g9-8MDkq}<8FG>^7G7gN*%@zl@zBjfCM z<$Bx z9v)5{)Iauf69sk+^Q2Sj$I#YND0)VW$;3bQH9n*tOb5`MQne8}yx31!gzUU)b{?cg z8{10f@D6b|a+$(N8DY(9Y47iz1rI*j+i;802awEf|r@PCEYihQMZEep7q2F z>kdl?c%z4KX=5CvPC@0;`6TA^#fTs=lI_>7g(fYbiOYSYg>OO(_j}GG{<*?zM9n3m>qJ zw$p3Nr%`{M&SQ*x6If35>5C_7uKAs9>dV$u3&ZACL|hqY)xGmPJ*WKd8G5smKomLZdf027&l58f(45;xu#rku_griy?O!sSK{P@5X7PSYky z2UpmIbTd7lyM~Y}GtB3Ib`r_oU1-Q(wVEO=jc_Vqz;*?QNh>-;;Bl~f_dI~q zZoLOTydUG?&0u|_8GmN@ebz?xNj223l`VwZ=kQxfmHt6q5{gt zU;ab#(W7y`+QEYqXq?7q6Df4VYgQLiRja20wh2$S+);Y9)~@Wfmuoywifjg|GiDQs z;*-6_SO!SYCTf3GL)UQ?GIiC%(?fss_#pLm^vui$27_h{^U#^XQ*ClUP;5W>crhw9 zH+S;&*4JH9hrqkZbjJ-FjZPpkt+7!oyrS`k$GIHs(hFIv(G`2?LHP)hwNb|YR-n1m zJJ&QaLJNGoaQ4WrwpBaMK-^Y1!;rSET^s?g`T^%NH;9b^8ZDhm8i$EVMDAbBgRIZw-?; zE9un)1eQnBirQCcKF=9%j~=F3Y)7#19<{ozPBce*1>#Co65`nq>&C2H+M1`kQ2pNS z>bdG-_-0sX7JDeIRV>R{NwCDqkm`2*;zeH$zJRj83%v0te9}~FvM)mF$IXYx&v>bN zVRzAQf~MP;ZZ@tzL@(fw8bjAp>5RSKra@qlGj5mRo2Ieqk<79cdw{CFeC%Ce+;mB2 zhz9~w6&(l4w-AI@|zErKOEF~p%#c6qC zu5F8f)_eN4*RdTrM^)4M3Gl3T8Gf?8p7QB#ss=(eXf8EIwT|zwVcKS2g3_mtjqSN`b@~}_Dl*r z+1YIdeDmXC>_A(vm_Kw^j9D+Ear=_N(-di+UZTeWjNhujlM|m`9f%#J@FUx~lFbHh z!~Mo4=>rJ6#;k-cFQ!tx*RS(?)3mYF-ylDv(wR7t1U-|*3y#sa1KplPno5zVn|kyi zKQxEk2v~0PoTh3jCz4DzAO|CbbGi(ipbcD`1AQ={g#P8U z^wmtK2GrNZW?j_f#2ZtEFc0Z;=MnEn>Q3j)3lpD z(k02y6MV7IteXk0bvmTyNfCk1KXt=jj*4EMK)(B`N`rn&*jT}$$^{dwUuVHfr`;)N ztr{%b*Qcrb#^QCdGrZ&MzJ=NjFc51QAVt$Z?@B+;JN zym144DPB|{v!^#Y5t;SyeM8bH8lv{?iJ=%xiuYj_#SdAdBk+=6 zi}yZ-6wST_-ZBeVsfcN`sZ*Nx(#EeMZTg5@Zuc@*r8|&ed zdL2ljS9h=xP?H%pQgVZS)VwQr0HbRTcQ@sh>#ez$4hKc^y$O(AS6A1@3hZ^4I}{Xi z>Lc@vYo}gENi^a*4X5>&Ki^&_=Ls$khb;^6agBgn?-t%hQ}bYRe2xuju+1cnHEkC_ zMDo>h9S3wztT;HFR$4vq#Fq_NQ;$J%Uu&USt`8qA%&^rzgKr3~CO9B_9*o!d)NK*{ z9By#hOdn6Gb`xaS2aFYJ9y%+|p6Cyp>K3v3q|I-Ld2Bx#3KLFL0T1#zhuI0v9Vnf_ znJG{Of(jlM$AHGPxHw)`ocT#?a;-(L35j z5_2!Hj|}S=gfneN#$Rs81O#hlgGPhv3xSp37_k}|;>X1_rhz7mCgoR38#N0_g= zNvuQwi+?l8df6Lppl!CiYF|H;B)BTly&TP(Aat}bOJ|&H5D_#}CSo`7v?(EwVe9bF zUfjWx;yp!1lSlBQ>gP$ssnh||bFp_B_A40q;WIlVkdjyZ9cv1gOMwKTD8ACPa*Eus|Bv3)@T4!CZ7#NNa@noZU-~ zSY`zZ%gfsWE#z_FQ(|sw2&Iq_`<5i!UB-gsn^lG59@XwfO-t;a>Ml{+A2YDwNzXLF zcwE47^1S}^lIJrTI%@hrKPz6+@YVO5JPuggm;p=Pf>*R?sG~F?#ThTLN+U1+z8v-7 z)GZ^QVY#1bp9q1oGihtgv!IpL)lx=%I+ywVJ6Oz)T|1P~LLmeSA3E?+Zr;as1Jl#% zazi5DW@PGd^S#jVx^;C~2`^(8{-z$+BmqdjGc~j9FNnu-E;7xY5pPndotjE+CgWzy zYYLM$ELkMI{0hsMf{HygHy~KbC#PZ+AQIWcOZ?XF@4wfblsOKDy-`v!hzG7gL4d`T zm`?R|*nTbU(d}Up_S2*4mb`{N{JQs8D0cAeAZN*yhU!KjS9x-#72yc|DC-jBG90>u zfy-rQrU_K|EI)Ye!$=WOhh%A=Dja@tetjVpj%~1e7KO0PgAZfJ~JkF+0ENOb17;2W7f$P@S zz@H{;+iHFcjX#v+!x{*gB&k>w)@waMbB%BmIlvRcw%CHv7jJwqhZW3k)2$9HT!%X+ zc^*6q>PRklrY3VPM2|O$6PclOx<(9$5auusd%Mx1mil4=ipCI__wmRHQUGXW{Yjaj z(eIZ4CADiB9M;|WKL%Xxg6q$XAH(&Rus1~J8%A}clzD?|${)|h5gkXEpx1F-p-pxg z8Z5y4Kx^lo@w__9tY@#@jaw*5$^dT?n1jTt#PGMZ6TLnFusP|Dt%=E3#LkXRUM)X= zC*FPzN3~e0u7gJY&X2O8Qvdpuv7P-JmcY1VVbX2dX$M7&9@#Lp_gs3%7T13lZ{TQk zVChY%K=9e=(R#w}uE;Q73NG?nW?v+mn7r5*z@=9@UBV5{ajSB+Pmu1ULLaT8c zm0LFE=d+ur5SVkvj0OjaE7gAXT?d*!7vnb{y==$Jgejhr7!c2-zr|;`0JKWWML-K! zXh4zg7-LHessm@vbALBTpNBC_-7)cFx2v*#Z!ZO96$^h#hThqwCg!K~;Lw5`nhtVk zh1Pkgpjcau@(P;~+UiNaBJaN-!La&|Q!}5X!2h)Fdvfj1F33n>WNz0E0k7(0{z=(= ztjp!6-Tqu+fk~~bMhy*t!N`Z3Y$|M$+f>Vb>zz^A3&0;O(K6cWtadMlGjCG-!qIFO zf6*@UdrnjWYyx;L>XBaG(y#U$BAfto&d!HMSO(u4KhnvycpsQCQBRayCrY8+>27;o zg2uxo^|+(e2M4r$p5L(8r?X>@J+X=K0LJ3n^6J3d%L~0p77KkT4uGPL#OFOeJ|F~i zL0nGsJTQTJxUgCtQE}SZ#?d`&=#w;9p5nJxgGoD7%ugqD3~^k&u%<^wVh@}(H+Wb?OwWxKKJ&CqVw|_4GUp7 z`j1Hz4C4(1^*uC`uP#GH+iw7=f01PXZ@}q9sZETZj^%N9@U#p87&f*=;ojXM)1&9bCM^WRB6AP^#=qE7Ucw6PAbzoMD6+8r zq$MIMDiLIRcMI9fTuTcPV=zyyVgj)nR;GE8FkX1LphT>#lLlIVH z`LCH3RgIql#i4J(2(MTQ(F#^6X+aM5qc)&gZ&@9s(cPi7;J2Pc{mJ0gk{dJ;fkiJU zN0=@o@@-lwgs?G{VRv_&hbuUIdk6_#s3NR2>99xRB+Lvh{f?SP%igH zZ0IK4{uIW>@!q84%)vAJQYP+Xbh&J}Vx1$-bK9g73dAUFMyZgqMCn>^EWNR}EK=&@ z;O&h+zuI_%8x@+LgH>3<&=-p zv$!EwhOKKqVmpetuGJ6?3NDlpVF!TpNy2Rh?JAsvY~|>< zy!Az^=bJ?1kJhDrPziNQG@Q2g4u z`UdtIsRrBdmXB>WhIwIZ(l_TIoK_V0bCMeJ4s1xu@(WI8oxQ64Sd%;V#Ezz#A}TNV z^W#n)H3e192M}L{6Og;z#hLF;MZ|9aZL3avns*d8m&|Rm#&HT={{y2)uwRU2w<)^(=270 zz@lHW25bhap`wX9elO4I-p~X1WUix%g(&_$HFaBhd*%HjnR!rE4buvm26nvC}~Kv z_1#}Em|b`YBU2!N!EQ_uX#B69b`yLMO_{XE57?gxr$A&}cew!K))Ej>^Zu#)kk*dh zU^SprQg7-#-NzxNNA{AXis{~|J)Nz55gvVc)?*5GN2FGRX%uTxfcNh0AIobzwX@ss zknRigf<_?TnK=xi62;v?M>=K8gPE;7=hJm3M^Ld8o7nd=GHk7CP0!EkyX;v33AY@1 z`fPyyF!qY|q?$)XVxjg-CCeRfKKp}auue^d-Z!+@FTH0WhQ`NEw{R}&*baYk71=?L zC2m?kCJvXvRs?h{YAHGK*+%ohPWWRJbb>M+&u(yv82@WBvN<4wG|)T!k`2K;C50W> zg3W*9%3xDSl=f(OxyAtRL{6Uj7|@af(`Y99o1@-gL*0cp4s_2kGhtphK33`)t8&cW zYcNJ?LsCw;>4YJT%4tt_aUW&1g3d3{(C?u&w|d9ulx;X81!idHg1j7vc|Oiy$a>Me z5SF*5A&T`AAMb)2>jg-)M6v>Sfbjz@3|Xxsg>=32Uj>}MVlBU)@`%exaD9C7)9I(+Nw%iz^Nj)0c?dt65t-S z)L)GU&gq&M8KFULrj43~7=9E}p)8%ulayI=cGLwYn-xEF7Yca~Fn4wg+93B8t#XrJ zxQj`+wKP#6%Ig1S@PdVqNj5!Dn0n=gNcAS6<0owE@bXq4x5A*e>}yx7dQ?a#0!GBv zydN(Q!0}JBB8JZAyH>0irdzS3;)pJ}ksP{!COVCG{J8z+Q;3XcSK2Aql37Yhd9{Xu zWl5TKYCXDy%XBBU7s+7ar(fw3KusTc&D^%YmF({-=;1$5feoi4wV>}j_!dt)^#O5te1ua zZ*8QEtz(pKd1`3dnb)XIDJ?$a&d>4&y{L_y(2?*Xfwv7!}2 z{7Xnt%@o12sV`rO+&2v>^9N-X;KS)`VGk^OQgTQT(sk!D9O^ia<26ig&#i2lyh4FNEA#*;8ZgAjsLu9PXdIb|68qRMIoM^MwVfI zib+?p5Em-aEZ~YgklfibtoAuYi8+{zkB%-k!VP4!FO7f4hQg(0)r5c^ z%I`kA&l#-#j}9D{-Q9*FYN>fQZj71uOc7K6>nZLRFL92(TXE!cGwD5$%jrxO65D=p9ull4 z%>TTgPZmU|r`<1?pqL4S_ z*Qgkrjs^KqHYRw^l%tPewY4JUIELSa_p4}~528VnqvD%X`ixZ*GaM_;>o9v?b+g_9tHic^3*RMIfpqzMyA?hYUPykftrC{ zc(WEN@Que8&<5g_KVqGsIQv6L;&XrqXPsjTw{6P=dEVp-#buzC9Rlyd5qJp5lS3VY zbSO+>FWgdTZ1s|$DQwU9ZwsnJXcFh#FA^tvXX_A1bl(E9PU}h=r^m*WUzPWbBbq|;C-F9+8S@A-OpP~E61WN68w5@jT1Nj(2Ua-LyB>u^MD>jV-XPHcx!Y%rD~sIv{Q%>%`!r)EDD#7vl` z>|QJdeMZX#UN6Y(^^tC0MMXtT#>?u_BgKnT4D<9~k+B*zH4Vn%-lp)oJ!pB-;U}`S z1q%8x@FLb_@CJDZjZ9C)ika|@6lG=n46T@Ez6`-;FHU)0Ksvm&^6EoF2r0?>bnZbx z_Y0E1|B-=T4TdLzf=gHGwK`KQC9UrtvLMh~%v$%)_`W{`6!CbI`MxoKTUIN~FU(kR z4dQV7k_lch5IB5C*AbJmKTRk#|>CGMU@oB+CQR-T| zpy@egh8I0wfPBDszGHD1`Ia#)d~WrDv5Oei3DL}=84DYRo}J(&X^`eChxlqegtTAx zr7?JG66R~$(0Jbjxne`b=L#1!i<_^tBl`D{`KlO(+jlJsF+y#Sky6uoS?dbZw@;?w zA!Xr%5ax%3o+-*8ejkj>or2_tS|0}TG3Ll6xZZ{ z?ox^WbeCdqIw}gGd)=*vFzLQxst6YDT+91?D`RR~mzu;6kNZ*8*`tc=9G>Xz%W6Kz zxx(O!(s*m)?~B;0b6r+VU0gCF#`yOa5Ql_a-7tYRT8;G0Sd{xyfkZg$?qbfhKb0m0 z#k8*AuGOMx$7pHmH;6VU*ZIUF_2Wf3_&7u+JWI8Z>T-D zna0vNNLk|1OrZ8X&%+lwo;uA8%O9)ad&jD_wX+j}^k^a&R^9tdrdbW$YGZ=-NB~MP0to`v z4q13yWFe>#@OF4JVh}?&J_BOgBJNZjWoG=wZXnqMH=Y-cAuqNMlRUCOZeR5~g^^2E zZ%Rb>WuDJz6yB4Q&cyHegP6|v0mXG+*S1w!T28A1vh`Z(O5%1 z!I`y+7g3SYzf?=QIc54X#+U1~ZEa=cHZ76>pXun@d0VL4%P*%@N~#b^%*x52o0IFS zLN2S$6d~tRgNPFB!s+(u#$dgHrGsz&G{T$#WiN-q6P#(roWOnlzVuzypJW2wd5yb6 z5ITLjQ7zNTmBwvzy)rT~vWxv{bOv|^%p3f2euR76dPy-Mq7JVq{6@%F)>t_da62+^ zoh+{W%nJKS`s^*p2X1j`-2ss^g*1UJl$JJmfWpCZx;^KsFT^g2Kw0#bj(RSo7Kz_w zpwI2X{}u=Y=@;DkSNJ%=PdpcI-$uLMK<~uA2K9JPnWVEhRobw#BQ?7G&%33O;sGgb z_05T)h~4V>R5J9i1EOMuX=3K4-&$Qu?(br2i;@l!)D_**gvTYtIa-PDA0MAZGiDP(nK#0@eb(tx@TR$iINRxk7$rd^u zl`h`}>$)Oc5hXdLq1!c%LVq`IP3Y z-Cye=L?iYn4cUyb>Gx6%SLNClBfa|iGUM%@hN|@9S#p!2dF9C>+^G{KjK_1gQol9n z#$x`5llbAHvKJ{!$hkGoUULs+Oi|3}e-}UVLnDitcz^%uA@J2~2S-mK9CLhy;Iz_=>VfdzvVmMY z3&o4aT5+M4kI-RfoS3J9Xzd46(e@X;dp|s00+}-=^z9TRMNOK`gE7{c*}IbofkLjG zVJDt_RSWlD8(99vo#6BfIJcuhvRGaUhmd zgtC$q8xkcym!s!#$I@e9?2u!iL|@20y$@%;s{XG7b+7vRM)6}{lKh$LzN&BzL$3qD z97V!%K@eeu7h_~-%aJ`h?AvG+PQ-GF9g@kEHmGyGzuWfC>j)2nkqeX*hwz>93NrekBruY96)Osh}2;S6UWHJ~Cb;!4TBrviau`Um}ET=>tKsMwge z`)*`ce^0Lk|D*%T8{#u<<%L)O=Up%U6b7R;u3BESc7XYvkUwdyr={Tiig6{H(IJT)g!mGJE_! z*hnf`CauMDn8+aVnCviLCGn!)Ujznj|L0?x_&E%ETTIBAcN|Fs7FUg6PJ9(a=;e&n ziUDyT>&a5N(D!p6Me|8h$mp_o4O3$q2GHg;j%$C;j}Wrr$;bMb0wdK|pW)1M{r)KK zcMel@0&>=DKkOQw!{JHXe=_C90IwJEZf6Gfou%jU#CXszM+ z@g9JVCWf5ibsEzN$*a%2;m?n055U8dVpII>nHa${DbvaENyw!Tdg7-uVhV6@CR)R= z@2Aa`H=idbET_W#;jXirpjz@hbKZg~PxWcxh(JEXRv-(fHd*o};7}PPqJJ;hvr=-% zE4@IZ&JqD;9cIW!Z%(bcb`JGQx149q^GYcZu<&^$s?pU)x4w?N7)QXUc};@t6zNbS zAOt9rGE<1exS-J7W$>SE`n6+%ufWc{5a#m_{$s2Q48TS;y@#Hxv5=Hmmbya%fFoGU z#;RK@hv)uUMQgB%WsOf^_Npmw_?1?ZDE-o3u)e+zkHe!1V0grgf$|Rjc!`onaTJP$udTS#ecS#==C zZS?gE65qOgSELhKDf~)n`|wJ>F8PIgQH+6*KZ}KSuAd%Uws$~6d-fSgHp-5LUdnvT zP*8{^@1If7O|+mWqErzI@7HFB2uAqoItJyt%vh~_MC=}fv&@t`?5mXF5<1^z1dfJx z;WGLJN7hpOa% z0&AElOogX;`_bx19?x1o-w5;AH=YT_*hxk@zT5=H4JY^_V1$??r!b}ss+{X9Xl++J z7_6d0Oc*j^BvIz~dbLr7K@GB!fw`E=bYhY`ASvQ%|Gk1PfV6q2=#Kx-CjrI=eDrTW z{pq9DuA)y?Sh&k_H6l51&ncL_e_|aAd1#(n#Zio}9-gbyWs%4Cj*k-aKW4^qYvP&n}hgVx$^-YE^mYs2lCK z+}T^0#^Sd8F7Ie-thsUr*p1;zn3M3JJiQ{4<1xICGfCDmmTBYpb;XzzJ*LYuU>|Jw!4ZQW% z(!9>$n)X|*&;SwbQkRUxTaMD|t>2S*U3Kqf9h~HubiSRImRa{0ILTxE98Ji%F2LyZ z=pP1n&TkHVtV8GWaL+8ZA3L~MjMG(Itmv@AuTT`^<*CfSv)^3t_m*Cb9Xc$ZJWpeW zcLxX=VS0E`yg)|^tWe$Ahv=(@5mT_&7{bx=f?Ja9J?BY9tOTF43k_pej= zX~i!7zWh;{{dRfLmk;5l&recBlkH@PeIBpa8bLeM@?6+d^EnO`)ue57T?Y%G^Y`7!7G=^!Y)>RB z%)h7)i_yw+GCjR5ZD<%JN5`~hcL3YAX>RYA5YCn$UYm3@RiY>ElD(p>mpWQ&s&@&@ zjVq#}5oO2cnw1$y(W`b-?0Q(9;+XIw;=}nRMt#Xhu@=Wu zSpQA)>lPKoz&=|-q|9_4!0Yti{k*InIFCNSnEd>iEVa$rMBNSw?Hs1>cp68Zr*qe} z#44D-<9mhGLC!0EdJ&IH_uQAR(EF^IbS)8g31ilId@r?fUFIXa`3C*BQ-@xZwRLsW z%_l+?wjTD=!vo6mXYIi=BF~MEU^!5TRP)y<~lW&wmRuxuUjvmPM0Gl7vK9L zAYq#xO5^)O>R;@#387`U`zaoN&r%VUrp-$&RX+M@ZY~32&>0Jo>zX1OOCnkCxt9KM zbzJR%f>R{{kwkI!dVU!MPKcZ4vyW50nB$lX^}75HEc6rb7Rvf~Ecm~*ySg8%C$l}A zqNLnp%hrh+UBXzt>2ewG>Qth1Wo0n@1_&^yf1i8O`1@8Ln3Y<_<6p~!Yy6P!sqmh8 zbc<~=yIywhX!tdwgvLN!*)qS3m(qCiwrS0mbr+K2cy;UPcg?RqJGw)l<>D#(D;5)7 zS}xL?8p!(IwY6kP=zzea9)WHHZc&zEjDKs>Zug_X&d#w)#t$7}3GJ{uUy zLn_TXknir=?;ldQt}Zbu5U;$M?GdylZsB$hDmp)SZHg_z>oRm`w}q8WwZOjPn4WD> zK6qg8xg(Dl`F|N2EiklvLqz-8Rm?^&mL|&`XL-6=#VcthxiaYBUCW>plA!wZ!zjn_ zxp2ue7fg@wJ5sAH!-66YA6>${r=RVZ&cYuQ*P;72qr{9Gu!iqOUKJsJ;UNRU(ks@?QD!QvT79U=rJ88>WI~hvV8k{(zoTWXJU|_F{|I)MR2NVPvo6Hd#dH3Pc=q9b10o( zM3R$!uxJpc76LhoMc_wC`epl2mRYmSf-PuXQv!XE_1?@@em+zUY%7y?<-dtjy=~_7H2%38gK+8MV2`neTma$*}u`Z8aAG8 z?NXMvO+70;9~sUM$RQ&1r#aFM|(bQrY!KqSS0A3|utT zDwgtW~sIL#a^!X2VJ1QKTg@2gb6#HxzQ9G=ikD_to( zV@<3UAtXJ^g?8xdthee(!?f}wCvL>A)#P$6RPkTW8;|vrT=%8skh8 zjK18a?ddS|QueJxv4X^vdvE#seGCe)`*8l%=NjiQ@i38IG-rGb#A9r_U7BrjPqbZj zx9)T8SF5^Y8#|Y-*r+NpLw?_CM8^-mYA!rDRxdY*0fSF;hKpkYEq7Zg`t-(OtoF{f ztnb6R98F)q(BXzJg1eHjom<`BE*|G$@w0qSZvL3N`>62oH4#*!Y(Ebkr+VcV>!D8^ z5uoMfva@2tEwTT~L5#r*ml28(NS(2aG$wFTTQv5yOSlJ$+t;|8$jx7;@wAlSK%6Hx z(XtY6&}ZPjgHgM7`J;<>ZhU)cmJ5x^(DFM38!(B6UnWub+a$_oG3#P<;T0uUr{r{p zH942wzvbjW=HAfGRXI|9s9$L?d%0rlv`v%qFgJJ|{F(1gT<5bLj(4u6sd69Jsd8fI z%ylN_tGpOejSVFd%mO&a@09L8Q8f`Gn30@**ZyyQAB+xh?A{lPOTUV@h$ZwQ5<7QA zGR*|@@RNoANaUw2ot~^VK!EBtk16Jw-+8rsu@|%2NsGZS>xQqdt?WHQUvVtFAu9c+ z?^rQKF+SR80Wuy>WoN!d#Z8F&%%QOl_WEoXMxjo9o8D|SyRdDnudUspLxsm`OVM0@ zB0sCiC3zeXKID*synN-!2}Xr;Ys!Y3)k-wX4*Ar>Y`9#fLP%7UE~PBMw-D{KrB0G( zHsGgy_M+|cvIV98f8G;hH=JN+9G+QbJ#>E~WPb#9X7Hao^D^02*Qe{LP`!$YXxocz zPkbN(Zl&$J_5R$93r#=R?61#AWQj?N)<6CZ$ICV0Kcii9GZ|b5r=0>JpSgR@zA-x8 z=Wolw<7%EDyH^vv$4e<@*!I#2ZG%V4Ol{qa-qp;=)UopCS?CGjqHRlszg_B|m)Khu zbRI!_i{Py9rJ-MeXQqS6jG;-_1P+2k8_Ywec0Y7LDZ4B}VC_D@0^I3hL!zFQ7Z|8v``5`fEkPzO;n)fGWv_QBGL3MKDlnIZ4RSEPYi2U6O~WKmJ& zh{SX2KZEPtdmYwwpV`oUyj3wb{vRM_}P5}<^>!_x>=H|71m#_f3)FYLcpdBMCRARI=8{wJAA}oB1u?(4RDY9GZi>4|!j0 zUFC}i0reG&3WNTU?-&Ws*C)ndy7i*d&W2t#4UNq<$1NO;H0H6s2uhubXJ0rpg)a^G z>~GWwc`m(;;@IpyU`8`W5-U~+4cXTWC%rYUysq&^eymsB>ua+eADU@>mgn7>B+zR; zdXSfR%g|&&&~Yi-bAQS^yCTRJA@l9I<2Uc(vjND@?DaBuN6n^Wm9v-3BQ|iCl)cJv z*XDahNPTE=zC#@Mc9O4XzC)hNOrG!uwFebIA=b+jOWVlQK+D}#>Wf(Pki(( z3`}Q`9KwHFBS^0+Y>80pj!HR78%l+GwNE>_)p9GX`V)3-7E59p_7=$|tAYM(Y+k9$ zF;j(GTgj`s&COPufxHugRAYFefTOAzzcSoZV?Vfj&EXi!v2nyOioR;JLS}5C78d)K z6PK`zpT=%=$<=26u%BC1Y#?uRA(oJnSb=PFd@GMbd2)Z>jpQ_6yJ}$fz&UShPYo|s zPMcAi%`h?7GFaiB+s+2nfC`If&$uTts5;;CWaXjA&Eht;fI{86DVqy=T<*H-0x@?p zFwO)aKR+rkgHvkpiw4PAz#<+vc}HL_EzaP(vBzVtDFn+p2iS+(CwAV4me26_+*4)m zcZO`$oE%=ET2c17rLQLmuvDV%A?6DAJVgb+-0>EW{?pK3NOxwyKpBMog`!wLfvb5L z9qsH#7dASV3@C%;W5q~47%4KhBx%wR(OJG-4|S{#4Vq}8``t{eHd@!?yq@)@b%pPqb37KJXOD?n< zvOX#sQzaClj(QBEy24ZDUtCN@zYT5=v=2e=NWo2)e~2(A%K4o+kkKFg21vnGBZ$l+ zJhSC~nqX&hgPzE>KG@H=+E>suM@lGb%A6acWl*NTQQ$(ETcwWcbjgpsuu8PBKVMi@ zDc40&C>c}A`h8P(XCuf0{X(R_(8|N>>i^0D_lCfTWEh3+In&wi2fY$~gJI*tG1bS% zST+MI!#3aB0zLOPBp&yu%Lz06VC&o)#6q1Cmn{djwzgWtkB}OU%q9t9Qc9dXuD~^8 z#shXn;e5Bl*?s(i1`wt7m5Jj>q_6iEnA{mCDEY+3G4sS)Rde!{O{;E#dM=|rHf!$2 zH*0`B_uK%8Kv~ky1H67B$VDWj76)&k@mi>hhz%Qdp7+Wda8xRUKF1(2yNZEo{0r(! zen!Qqxxza}w9oD|$a+4h#vj@FF=K5y07cQdrSE}jr`X#>QF!*T!0D54A3Ry<&_sU_jeoIp(60Ra6N5M`(A(fhh%ndR#9iF*}ce(hd9NJ*&2Ah2vA_;|g&7bn9K(#w%TnpY#OC#liY5 z`K6DQbfzy)hCZBGcq@tt6akBydCxuyFa{H}F|dEj!#ZmWP_P2CGqG<~!qe_I88&Eh zlzzjka?;Yx>Suk#@$Q!~+>RHI9ekQv_%W~i(WNYkzFZd()w(16i|{*Nbb2P+L|jII zMJ4imx*IG`jfwny364y1>XbL;YnG;8TG$^l zvFrG0`t7)L^L_uwkHAyv3!;DVg`EAsGlnfb1Ab_ErNeydjZ9U>BZG!CkEKl}dWAA~ zOhvY$gv;FF5`dahySA0~GX{*yD%a^xzMcUAdtl=qF#=DW`{9wcObx%MC?1QF8+Dov;e$M$sjPa3)Lzy>PZ%G z%)F*bW7yonvAL^ty&}xecKova^-z~hi9yvZTp!4FO2V8hI@_(UPZOE-Z_*kkqE|W1 z948+E1wq}MDE7>a@m(B!(s|vBsnfE z%@{lW&3(k<(57jO)9!L6n5ljt4hp8h!NFraJ#*&{rqZPt8->Z1h^*=G5ulMF5?>5R zk!z_y)Sqd-SQCCi%|S-6P~sM93VTJs(Jz*->Ssavs}l4VU=uU4gfN_i)zICJl5yVx zk7{Qy@)6uoSt(cSU70XYDUtubMZGj@Y-mW0uTuQZtH!##yNS#{IxcHWY`Q}vHZ>FS z>CoS99ols<+vySh?QvBx00Ya47s48qVfN*UO8-R2MJRt|WPiiEf1(FqGyk;|C9XxV zPdILp>dcjFj|lWK?M|`(W*A?#?3B+A=4X6!TUIjNDXp7(BaBIXUpiPc8qOC7hl2qz zi&JSZhus`c!CPO)nn%sbgi|Me>^-SE7}0%}B%Q6cn&cvg?Tk+<^t0e|&EOp5GC=&e z{=ds}W?BHc?xwjsqAkfK$5-p1fqJEJEPJKmu^||iWV5@Z(!By2{XldVOhfPU9jGWy z0j02IPVJhhme!Wsdr30;WUyYV-JiuhIjdlCK#N-Cvl=1^xjC!S#|sje@j9i=1 zuw&MIz98AAd29Agm)BB|%;cp#t==ZDxx9GMSPBM8GK&{4UJQ_{4M>#bl{#k4mt33M zYL3&Z_H$SuT6Z{S%mMX#bf(%0X-=OcnVVx5*Rg-1=JhA^=Pmoc@^yA-lY4w_Fv*WI( z1s0>~9d6~H!@oV1ui)k5n=4(9tOC0|0dQ}sGeA5wZAtyWA{ zM@L5+xk@boVS6Vb7c1gAFf3>71+CBoNxeC9SspK#L{#CrPVnp$w4%F!PH^)PqE#l+ zY-Cm6{H??o886H1W&v06sh#7C+%>FAg;~C zS6}tWgMJW;LI*+}Zb^y~$$b9F=(_1m(p%>+i9mvv@&EtoF}{e;PnbUCs)Eyax%(dV zK~AKcm>jB{&3)TsM-Ej`aok9NfPryn5Ps~9b>Qh47*J90A~EIk2?RP6+}^$&5n><(fcJ8xn3 zGr@HHp9fg;a$So}@|A6qItwFxbzLJ1`c!>fXb>9$H@)7~ROVmtR@S;dFXkq4jr$%v zi?>xWjT)5WZ?Zlv8-+mQI8##JP^fFQ{3G=Ih1q_@9a@zFBs;<;8|{k8o6a^GHAdVJ zpC21)K?*l~L{zt6pwaev^ci?+hsh7H5{F3%iHKB$L$xZTmoARSucxPXHJt7kPj@ic z-I9=h65+Bj#Q z;qRUtKj!il2Kc1+ZFk8W(}p8#o9#IT(V0nYejp-Xm%Kg>+Z)^1D59woxDxfE-12+M ze2V8l;ho-Lfn+fshR^0|echmmLR$&-wUwTN+&^LUwAmsEAzEpZ+&oM_7yJ1j`?lg} z>o!7+-h@k?TTgea)-$8|u_{_?F{`ril$>I*YwPz& z`}>vi-jm6@!^hGxGk0e_frK{*LP4`=u;Y_@q>;;C{tQYFi5qlj*o74JmBEZpVia(6w{p z)8wmFvyxgVcVt(S%I}?Is1$*U7ajo12B!f%R&#`cgfXDj+vma-gg1Jp6B`%&) zKgayH6LE{g?Yk|xX8kkew_(0q#1eC74@dpOpYc?6#nFJ47%S)I8q9}lKue=|#Ri@D z1%iHUkLa;3!s#K~Tt-@+%3-!d2#^XE6cFXef@Gn9Z1!9E z?>&Hatm_a#p?rbSO#aSpmz{0RiDvdB%oX8L^MH+VcsO8hBC4?ZPJ6hWw}MO6`;DR>5`9IyK!mP{>d6GFXm`nr)!9gX zU1CRiVYh|7L-(&ytY8zIz=#qx$5+W4rxNf>BC?^})@jM<#&`3*h%0|kR3iH3`qFptY`jGOmP*zMDH)KW3*J9pD?Z}_h_d+p9u79NAmdfD{ zQOQ4jXHkK>AIqsl`uUiuJ9Yb%Fwj@2HR4}rNmpt7Hkrw6npza5>)R%;)TLNEBt|k} z=_S(QPM_JX+Y#ajFrX<+7p6GaF5wfomLIMDqmMg>@x^=X$5|uAUUTuL{^Fg|Z_O5` z(z(WFWQe_T?Tn2jV%6T#BVJ8q_KBVz5infWeC8w}w*8~cZSzoVS1b5a>3sJ`jZZZE zR!%^xj-@=`V0cWv&p3YnDV-?vhbZcZ_fFF`zb@DFI)4*p(jBr>u8_=Z)J6siR;mwD zGSZ%@u)J(n;fCpldLNe}WK&5UMY}SPnhTL?fn{gpJj9=VwfrXW(|{@OrwCV7o5{Kv z^aQ(C&ph|)9@U&5rW+C%q3>WZU3tn*mRhVfT6*NXGZEY>;m;s%Fq&0Qm{r-bFP#;1w5G75i)lzt$VOioD?ai2|d4<+*fPpYlJvZDG4!OQY5! zpJp2m%Vv_UZRVZz97y~UGp>^SNyz-plPv&Yu%4bro0rF>bm69Ii{;gw@w~08ll7AX zwfNC*=UNKVYwf1rm9oiOasVrJ1YrYV6EjoF;fhIX*zl2w+vC0g4y`bRHBm<%k_8u= zfQ@}`a2O0a%%~g#as*8(m4K6kJ>D(r!?FH?cGIz=k^lP);WK8QjW$1>3=~k?sbVJk zQ13J`&07%@-n(_swWGF?FeHzlm~Xn5G$-c1YR6NWI>4!kGOi1hxtZ7rS0leIU4O*Y z9mR?eS?8VQU^Qx&3*T^A9hv2&a&26zvu=OoQG~W2M-jy`QW=fN%O;Ob9Un_0h@|6)EQH zX4hdKoqXa$n@2&WM|(0*(8%#-P}i&Mtufd0FE!b$I_0QKYWbQJ)vGyUTy^_AR+9yv z`+@Z3#*a4Twf26t*E~Kkk-XYfTGdaUJDOkXwllUBo{Le_y)e9*H(v|RYI>vW{sce7 zy>MWHEFLFd&|3g^m*An7$rbww7XkZ}UFJQ*_(d@4!*H21Rx{8U%$3|4CgraJH*Ux- z7V2Gyr11-?o?3F_n>C($x^Bd;q+Tr#2{|7P{opNNn(~|=pkCG6$rtw6xob2ecUV!4 z_k=_F9podJle#k;P(T^Nhz*@Bp&o(1XW4p3<(IOX+An-RRkAA|oWpc%le4>q?!xV_ zD=t=Xhj->w6@2uXNW#=nJ7k7)c_Pmn1< z$t|SeI=^jTVt_^Ba7qR!PRv)4Q2YU>#E&5!ig42}!NK?%`y6k!;3FS}PJXopCR@AFc*$t<)x$ep7`O(~q!n>7j zOrTwAqVQJrVT1{>0{PyEW#OTv3Bh2K_sIc6s=#_(Z0=1gJ$t*Dumc~U`PlfpMzX;I zBs1nCj%*JZ3>O|8JusnV#}~<%e+aVVbs9Q4#ZLC8uLpM~svHNsz=)vNEjyASx|XXd zfG;8K_QdI=mWA}n;fZwhAkW`8x(V6$`fW%zh6^YGW_kYnTp&A?|JcWf{yEQ>#sBcO zPro;M(!dP{!B`4j!Tj1wOPE~xS}j><|{37-;V zY{T6<-^+HF2da!aVh`CK&RZCKO&D51Uz1W?=U&Inr}{K-Xjfj1I9P+pO;go2<9!S> z=I13E`20B#HPuAi)Ei0j-BNcor@XN4MDR|o2k-MbT^|ubkDY~R)J`b^pNw4JNbd{H zJWkMEiu)P78*R3CJZD;p5Jj$^jJ^)260Y{1%zB<2xt}1Qrj7hMdZ-_5fhcZ4y{?bO$+DPr7+l;Uc2ggwEXGdrYokOD zAJ{Mt8<{jRi{3vCp>HvK4brX2(=<0{n{RFMsm5P;BsGiK{8y{zRp0b2YaP|}_ZE7+ zCH%%?M;Ta-M(#LBdl(_k0^>m&7|{0?SRYs+}e0l`tEXwYa-H3KSTl?uo^D$i4&@e^h;Ga-!B24Sa# zm-Q37s?3ho+AF%|6&C%n6(+k0SHHb7B%AcwYRhVNns+f?OcKEI&@R1$5!3b@XerYT z6o*oAdC#xp@UfLGd23(8(j(EPJ*s)zz;!pwyJqLRT-6Nw^JM%NOvY2a*YNL-tNJuD z@ot#AF`|;|Tl#tUGCSnBno$C78!r*EmrVQRqQa zLTK`$R#B0iS8eD%U>Uv&RWg0?F9D+dMU0Lb(+bXqHLmMxv_98+10K!@7Gq)PF{fO< zbtaYTlT5RQK$$L#RM_f0uNp5X&&M_rmc~Ro0Dvs;jODqNb?;U<*?kN@msG1RED-?&S)f%3eLS8iRu^?iJ9szBYE?$f&Hl_3lB3ohhRc z{?vhIB*?< z_^O7jD-WwIE$1OWvTq+U1zN?-T7+eD>#=25fK~zOe26`DR*coXbn_+)Lq|{tkE5X_ zV|WQD=NN#QnDV+ z)8FsAcDKG}M^^N@tc^WhIs6{ZH4c;~!>n^__6=%Mn?mY$>mSkIbWgEbnWz=g4!81} zN9b+%bW_nY2RX;;%&SvBOHM`rp`b8Fkm@?}+g=EAli|B- zIYYK_3eQwo!YMhNz=-X1`@!%v{K1?N$4Fk9I1pb4u|o&8r>3R$4(5Y$E%sL22RJlJ z?h@84G@CJfe@)e;SkZ4gP_PhlcLfa1TiXu6c^#FNr$)YEP7@ts+H0R+rs$_qVyx;j z8xyBwlBsL5<6&&dvjZERoy?P_#QNK~|tr zd`_x*Zl_O!0c!7L3ivQm5%9gk9n&ec^D2gnyMl30S+?3b(@BR{?MTb75L} zY@4ARmMTFaXhh<|2w;U|Ci{9t11geBE^rg`Q$1l2ET1Bn96wo}S26T#vTt|jxbBZON%+jS8%@2o zd+69zpjp+!f zB9#1BBK2y_ig~A#+Ch#o4iK#bMzwDv^@Kh@5bKMde*hK@2hzWM9^ap@_mPIQAX&r5 z8`vPtcu@&d7*(Ufkh5{b`^)wyDU@>Rad*ko2f1&Er_}qb`O4siuw)E+Jzw)+r!gpe zkwnsSvaS}bA(QUCnoys!=LS`=wFbN#UHG2n+f;JWSe=OOFv!k`rSHgr^@j+rCB%XT zAjIhJ;S!Q=EJil{f)SYkjF^ZG9m&BvkOwL~F7=?csk%RZSET7*0L30H2-DH}jg&W2Gpy;!F+18 zUOgy2d-a)c2>Vu^i@W7uV;ywLnCt&>_7zZ7XWiR^7bR30M3fFGQ4mm&Mx~K%kZus^ zE-4WZ5RmTf?vPZv<6c_2yW=|-XGY%tJKww3%q(WDyI?Kvz2|q%K6^j=d7j-7`GD%v zMBPU1(J>(#D;M4e^B;=*QQl*fRz`CpF)!@eR4eQ$i^VqgEAd}M9JaMFxZK`i^G5f! z-);qP(>Rzt%P(JkW3Nbor|iJ9#`K%J`(j&@dKk;v4}nv*Vq^ar2eGd#U({4kJ`~0D@y9SiLDhDXrp=ohoY8^Y?_j)@9PGa zf3VQ%OcfmoJ%IuvQ|6$QkJHX;CBtWoUCn3Kk}?@jm`|OSueUKkoFYHf-_l3WHZX~3s+Sh(db`pM~ty<8ix?^8^RbT#Ww^*3$w zy8W%rAny(l`y$bp3kLMKK%>!KPo6W&alHsnX`e3?L`tG;RV3q-AVe;wSRB7gzMbvb zFI}1{tu1zpDS)0T=O{*B>j5TOKgh1tFg6YTK9lYd0Zo#yFZ1m1M;S|a z$3~yyT-J}s4o=j1tdF)SFUrPS#;WahJQk&9I9G}+m`j&5-C0l`gT2)e7|Ngmo5GqUHzomB%Vn-@5W~;+uKe*Wzsk1J z*fd2&bumOPMm~z`alNz*_Bn%D@J3$c52dx}A+-+outD!dIsh2rbG1T^c`-BOlmWD4 z;`9PCYz4F(RR2qHX9I6Ht1kR7{VM~%2GK+`0iUS{%*lS;j4W2K9dWpggS|bv@!s2U zo;{0NWCe^p4W$Q;Q*=L+!alL6);S!+o-7;1ed|;wjM^_X9^EDp73mf#^Y%8YB!3;4 zTs3~*_Nu)dEo5t%FG!&98Bh98uqpC+%<3n-fLcPt%D4F7@xD=a~8p zmWp#&uE%vcfSIg*4NpNbe>nY`QhrKFjvpH$N5|UTAc`6W4*Q${oM1GkHLkZdZpzk+M%OYi%f=C z{Q~o53Nw4^>C+^|>AjfUivIE!awiWL`)B{)n#a>YvUv(n07j1WIGyh;6i}SBeo>sh z{Y_}Q=C%%}L{xQ!j9&p+n;=lB`tYuJy@TF?MCF1qrpAw5r6+1!3 zG_BhmtBRvR`TFbEcBWiKxgtZI=8w43s2V#VkEoW}&1aGciE5{bh1{eK@#$3-t&Jzu zf^#IC;i=N=>iG5bnkvd7Rdre|=(ldaZWcBZ`CNtPI?-%=(Mu7Y`(w{78cT}6K>20_ z&}Xt~1t64WMxui-Xr>gvCBag%wd`MRuT63u^J^w^c7%9L5 zvV)zCJ_StJv<5t|I5@-oG1vxDwQ=C-DBJ}+qbC@}3+No;>~y;+cr$P3(*@OS4Pz>o z@?dYtw$*tf#tZwbn z7k>Kv{s#y;hYe?iGe=xS2ZrMJqNZdI#Ps3TthH)Y#|tqxbwel^2^G zi*&o+2NH3i4ks%)%K9PplaypBw9l5lbqnnGnIqKVRHur239#7 ztcPm1NZ;)&wiYWeXC@sxJp5W^v0&Pq?GQRsXymX4o$2lEeW$veY<^CuSgmia(3&e< zJNGhIw?4OI4&Lsnogz5(_#Q@!Rx$THPib=&{d>a6qwUD0)R3F|9dDGY2lqrp=_yh-mY zENCOFPHDI;N16QFa;q-m7@>-ky=pGg;pkT|?!_~q6MK`UP$# zNNzvQGaN-Xc8sM6brz*XM|Hzho>Jp?mY^zRWrEVxSOmvi={}lU!$PYXf2d(zj@odx zTrJwpy#l_5B&J=@M?fvNM^An*LIyZPFL7i@dLV$&^*^a8fB(4xFg9t%lsp~7%)8r0 zne`g>iXtat5xHKnsmit8Kaz*Hw-xHY=#_pDEhwWJz)262`a@3|?W*Qr!oPOP8aukc zcoC3?9B`sqj#I6q+)DxROrYz{WmQ$D56vE9>jhjXGUG6J*Nb_YFrebj6a4VErQ{+l zcD7@_(l4X3{j80ZaFcqQ-yiDQpZbVy#=ba(7a-zoF2Fa8D7g=YLHW02Lr8u z{2zs+M-*t>{`vL*o9l_+qa2}(q_qsVc%S}l8#4#Pn~yc(T4HX7D1UuZ_(_5DwoHE# zIOTSu-Tx&nR;7hE^V#m8x#@x&E#?y?_w6MYT8I7+gJNiE7@Yh8 zq}5Px6pTDG;L>Uud9Rvy5*f=H@~bok+JBzoARlVtF=PsnB+U)xb_OR%jOAnKb0Ihh zmlQ(%i?#>8SJ#1O(hh~;bG-7=Ki~d-WALt^6b(U*t3m_ z-Y_e?@HzkjRJlJ-J7AWo#SKfH4B#^DJU3&|(pxP^AUM%1Q%bkaVwRdRlt=>2B>#8j zx7~z5R!8>lzHz@y$hN>b_{Q@;^3y^i)8%`ELrhFy^fg)XYEaGVs5fB#kX?I2vp*<; zrz_E|NiXb92D;01AHuo9*z4cZsqc=`Bi0&M-@Wa244Tqv|2!SS*leb+Os1L(C{40v z$toxa5a%4!rPLPityYd4CChRxsfG?_w;1vp0^;&KWLJq!w1iM^Wq05|xWI4_=l^SS z^7mIixXQl1^fR=BFrk((swmQoE9S7qs$#5WjAJQJ?!(?*XGmyCG~pxZUf~#AkWr@l z)Q|ehV}&<{uZbPvSPj9@2mDB`|K&pRKi)ZT05C{3pZ-ONl#K`0E`T7LQY}UJCjmMu zX3|i1no7NDTe*bGrOd1_=RC7i>YEaWnM3z*9;=>b! zPfIN_g`K7z5G&MjEw=djf*L`dJTvl~XVxlSoRDnxN*abMT&SLZ7ep8Pl!%rjKaq7C z11RzTYbhiBUaLe*VN91`AG){$97xPa@DMvm-cE}AyEoMjQKJ7Gq@5Z`$*&%DpHO3$ z0>MeCXevPb|Ryv3;;BR|>TH60XSqCF^{pyJ&>goLgQz z1QH?j>^b^pdk!r}HJ zuTJe`TaJh@xsbR)2t4CW7cEfmt zU#ltYE5lvY%v+%J?q}8)27|^-X}qx?ShKDk=I?1Pah_fHIg+w>e)y83e8�i3V z@-KfRPMw_Q6~uW7SS@Ghlv+M2jD%q+OVpbbxP`sZ>SZO3AC{lK%)WM4RP~2{jyk;Y zs?8Tn1TF)@2w8PE!Cgf3OuKaC6}T1Y{@wC(DzzsKU}hF4``mIO^YG-M#^^~?FOd7c zS`>~4i2P0_KMZ$n7Xv*dGPXR%*I-wtJb_E``9EIumnFvTcse8POd^C)uWCMqeTC|x zR5KvP+KYTzR712=ldmZa&DO__HA32hf0CroYe1QY6%)hP?={dO2NbY*WcP@8-rfTd zOXc51tV$5ED#&p-?J4s<2p2ZEdGbU74<}WPOmGLKZqLcW-*rvOjTA_R-F``iH~!^! z6*I)De|R6B;B``$`|085*2`8=mO@!6(?wumkhVk&pS(|aXf?GJ+r<* zcQ-NK;PyjF97Fo}_8H39araLSs4~2NcvMU3Xg3e193 zr!&T%DW_5E44@%c2VM#Up8XOCc>l{KPb~q`3zL-V%)2y}qxPkY#0tp8K0L9*^6b6B za>_I>hJWW-s|es5-nP9gQu~Jx?H^u@NF_WZft%E?(ngmh;q`Uc2)&!IMhZ{= zr4)`7JY+hRk{wuDZubRaEb%bvnK|sp+*70`Yh(%MuA!ny?H%wL?%0ZY@&LmoPOQJ4 zGEZcE;!8gj7neFhLP86GFN<@V3OWF~H|P@}tpk>@skU}9DVO<`p6ss}_+J)rm7(AQ z4~sK?g&^{|;o;()j{LMWLo|2@_VcWN3Y1Y9I=`IMemUY<`%H;dt>J-Br7RxoWC>CR z=ifOfiO}1LYP&mn9_aYuVtTp;>_a`6>oX4K zWb!=)%3F*5w6H?GZlW?UGmS(TKFWJc`sCt$8wFy^A{dB#>ul0-$DhOb^f39!kAMn` zg-X!Dsse86RRC4xI8otrJnR{-uxK5xw(D2CQD=zAb8-s|{N^q{J>BUx;_BAEHSm9L z(YJ63Xh=lQ6%elH0UX?Hea`w0e_y1|{b{;2A!8oc@4(MUAt%#X#JGe9_brt6&0dy2 z@Cbops`j7p0uUt)CnMZ+%=P^t?QIn8A|33C4^-u)o{|I`{1D z*W_}dfj7MhF*_@(oQc9~ZlK)O#V8%660NqqI6o_$=mu>17~iezugDuQHWMhow|F;5l{=yEi^fvWEi9LGuBs1t@0)7VEtZ14g{L*OB+UJ^h)tU@AR?-py z|0L|QY%4Mdw{%^&SwHsL48}vpGgPWOrYfjdyROt>2I}ErFzo9pT zfl-{Rpobnd<_sGQLF7W~5>R(JTTxHzNcVO%TTXh4InL<3<@dO!aN+DH@x?=qA1zKB z4wH1KWGvsg`1cj1UWx2QaXK9rp8&Q*uxj(M+x44cUbhMPU|oG&7XRfqlpY9<=JDYZ z!rur=yc0MaMw3MbQrd7M5dFQ5use+KytUOV9;rj2Pzzr4AS<>Q9{c*r_xa_pK?^uE@)5Tst~`BqxZz{~ z2lvTZak81TGSjZr7y|Y?d|)0bt1ML&1fW~FSkM;}r{h)aTB4-k+OtaOsT=|6!c3!% zkqO}A#)G@dL9Cw5W?ki=KkmHvVOta}ELyefxRLlg|Jixm#c3KKAL2FV7L1cj6*V57 zOkS+Ndi9Dn7I-s$)c=S+Vf*toV3=k0oVTl=OYIxZuow-M534yad@7*(1g5re+5pW* zVxT1@4QlaL-PxL1jA~XC{f`cpq@<+vZkKb5?I%{hH|?(w_nj9c;CJ*zuV8YE$Y6uB z&wPy}NdCgEBn`(0sOc;-JNp)kb5_M9BK0|(uZw9nOR2u*$*W^cg*O6&NwZ@5OEWGn zYGBt2SMqWH`m*8G><1unt$UzzVFZ1&hI4$tK%wa)5QxV0;+*8HS5J?2V*FLBZOzNM z268b=vYo@eWk;rW6e1|KaAV(4nlE_Y?6^KsK>ngoRPV>iOR@VUmP=AVv~wLk`u#(R zn5&Kp9=*cU>b(J@;oRr24G`FUPe9AI63kn9j=dRCE;$DTED1otk@Hzr?Cj%UAtv5qu|*NRjdd>T@KAnHM%u_; z#r)(4>$>y3y!OiD9}>#yTC%g|81}Nb9sxa)2Ygw^^$&nHJ}KZz68iBJ1L$ z?!sY<9vq4_A+ow%Tj-U>#O2F3aFfMlN82lQiaiw|ewU1o>R=Z>Y*Z^%d_>U_{4O^I zc^i`JdWjmq&>*{&hIxjd+R8dzQ3+fqemxmBCFaN4SL3Mp0Fg@#5&0>ISa9mhex&Qh z0{4X-hBkpGH<)HFjhbQ{?Ykm6pxy8YTUc>F-%<#*t*<-VWTqGpJ@xy@caFdwX4;jn zN@SxUd)k}eyCrkJHhJC|q0j+w1VTYy2QYYVFTE+UXAQ9W88Ejfk^Ct=lDvF}z_Pe_ z$}tTA!5$I<6ojge{S=2x1=E2pr$2kljFj-ogy(K@AM#=(j9OI1mdkA^1|I+>?7HZS zGVLG1`Ja4O?-0FEu>O$&IEAGSTg~|6;KCg}8ZuZJJ@2QqyHi@LQ%EOIFER!0%$T+D z58+Fi_t!qr6+AAOJg7aW(UkkX>&U^39Whbo!hNRSwjcf6V$9`i*u~SF3c2`zQdRV^ zz9N0j2*&|PhiEvHjX5Ib3W9C->)o!4Zwy?VxLo8J%GDM6^`QJ`j&ThU?iCX{6@SGN zq~|64hV9juhY2&F64{BPxeI%`+Ovnkk6~)BVU-f!FJESm2ifP~rUKZwAdSnVqzvU_ zsB)fl*5WDK>+nmKjOZ`c*#tm&)+iCwr4)1twnPO7eKbd*YW7PhiFECVdJQbt{E9c& zaNBban(@`s35=z1t$L@?`ltr}2a6|I_6l}kO53|oT!*>k zvHJd_kt*uCwlF<+Rzkf|9EOvGtv3Z$Vs9h6C=?#O+A*^T*%4FFlkb5>XwwJb)dJl9sL-Rhw=kl&M3`dOFz>ON4 zz1xSNpIx1J;pZgSwL8}yPAb3d3g)hHRDCR+&>Zcly*S&zA9n;p=%?>VTYY`k&XhA6 znk;uIDxxz8Ni2Vbd}w?d7Ny!q8x*S(>HzpU9}x@T5rR^F6B?cTE(>AWy4J^5#_s?@B{bmr(Dbf*e{q;D&~ zYMydr?O%w(o%8i>F?6p-b51WQukJ5v$|5dddfz+bCJ0RjpG`sW)cZicfOAL{E zEdsZ7HRhE{4jVNrddhCXqJCz`)=c}BA@xt|6oi_2ROPkPA-$EY3%`Zd5-;6Vzwx2i zL&h_t5K}ZhP-ZdSe45Hb!iI2y=<~$3HHwIwkvpxg^i zu+=NF01KY0T{x}7Gtz8y$9X#>E`6zO?Kuq-=lfZoB5v9rD*<#dMa`y0BPHE(&O1?) zqFC~6>d&Kacq8NcAnr?=Wc=8kN=G2Um;#o1Ux>Fm;!-&Pvmwg1Hhyno)iexA9OHxm#bD;BV7y4Rlto^%GP;Nlx-qM z9~GG!$iM~!UVmms0v{Dp997=hvnj%^p)3g2yrMFVm=Bv3arm| zjONT-PNItFoMc5IdYaGZqzn3^lXJjkUbVb9in}1l#Vp+tGLI_(^9)vxWGHFaMg4vT zgMWAU#>KLH9jb`JQ1#@+`9Vk+I49O;`Jrg|k3QJE^jNLbfW@h1o$SNRvK)fNP|w@8lVT?f@jCyOFL@7XmAZ@${|l--+ARHbcyBys+-+;_Xd87aYY*LKKjis;aK0%(P27n0B zfN69nHD!Y|N7~w(OF&HH7a&##id+y?%s`#J4(PLJ*H(|Et8SFU76Rt~0obND@ugJ} zqV7lGP_Zc0%L~0>0U7cE_r(r3>CpR#r9#w0P*cv+Uso?F)M&h6Gga^Qn4&^&MNq9k znWkTvWik}v$l6-is2KK)&f0(T;%xE)H!nl%V|O27^<&bl#;%q^y2v;E*-r{@nbX#t zjBf}7dN44HDz<;-GdxE?0%1C7Iwu7rXOU^&KZu#79= z0RGZG4CFSkoc64D{<=~tV=r@cO%x5Ba(E}N#l6ZfDMcj2UoRv1o0grCnjez|hzz<2G;O!gEJ=>7LROkx?5g|(0fUDvyM1Rmr zQ70NSjrQlUa>t?rpwaCapi>!uXN<=q8x%oH&fY04wRWE*JvX@E~8L)M;Qfnw1} zjzU3$)5XaodTt28wGbo9yhJYB&3NEvZoF--x|gF|#$JUu(uS|@I4vH>r5esn^%scq zYr8C3fqKXO?DpG>zt$(-0bbKq6@|vXbjyHWG4x-vSd}W7Mr~Qa_yR;UxA&0UiazE` zAF|D(FPEi!X$C;ZR<0ss@GdP#x8igXij1^Do#LKdHt7rlUXMP4vhYIG%SaUXEz5Mo z>P0{;$I~I2q0tmb3UGKQte{&s2eB4}$miJNib8%!MwkI5WI+8Ei6a)-(+*J=n*Irl zDrO(4R%-Jz!*|ZS@ls#Px;OW!M(>9D#j(8J=+7HBZ}O{eqpD(`Dwgs9T`BR6t*cDy~YXo6KNwM-H+9PYJM_Ycg|v9xUHJ| zRJV^}@`>3*^=E?K*iqb$um_J-MXUA5xadk-+rt^tynC)1q+SAhw?JgmaczF{SFF3{ z7C_d+idg&Y8>Q)w;0DIH$d{W#Ihbrr@3R!!OP1IHdH@xszbhlbIWe1*!75QN#nr~j z@)pknxb@qQ&+)FE$}xvBO01=E#i<==4`Amhfflin(33le{-9gS@oOs<#YAD4twBo= z_;Tbe;a9A-Zjq4CH>tu4Pz0_63H5E~_A^0UJdR)YXWj8&9^W3|5w3$OL)ON(q~l#_ zY^XTareZbs#ZkA%VQ+32OD{~q~&d$|f=D zr!)Abz*9=&2vje`>+_va(q7wR7TwRQtf9gw-4kH4tn3SrN#Sixe?fTs$EES-4b6iN zw=(wd?h5-WS>*}D&_@G1?&R)0=or?lURSgg_}}0M^a!s+9Xay7=u3Dxk4CVc%#k%{ zSlW^`j+13#@Z^s++YiWYq@m(}?CLP>)tx{3)Jof)iOp%ip*l*f*4CSc23QHgRV*w( zR7V~i^!Qse$^tDeHcdqOccys7Cqc2kd)Z&p+X_o*k|qJPp=Sf|x=s3{#==R({ioPD zibt@?^Le0iP`$6&-BE`!>I_PQP?dH=kKl;wIh^B&wOXwK6(C23Nl~T@8M{%2IFi#O z7KwUN%@%52h?_6=B)sW9P6C-g^Jz%jDTRttlo~k*3%bv;Eg6iN{1T1|i|!E;(pBbA zVkb74hYiBY?4n|+ex5Q>F_qc>ECiHo}c0G>&EK8%y zaev$xaI&E46jVzxGE#T}fTY-`;tzl+!<{&C4s<&B^J;IQ;+kJMsJp01)%xoZz&Ae# zEF{zbFn#{*$?e|-M*JE|u}ZyO#DS%(e3t$wBlLTdystA+v-qk=(O?ohV`V5%L<}XN zF;T{P=EoNgw*A?h5ZLw+M^t*N(h^j#)XQeJ)~}xZt6!@hw{{M!Sl$Bw;ueYMQ@z9& z*di%@s?>%ACml*pB!f^Q=`Et${zUcqA+l6mB6?py=3fV^wzIgar8srI9bTtzpZ~*1 z5qN(K8#cn-9Ic+62zCZ} zR4AQ%6&1Hw%#P?d)C2N7SKb9}#v+NoXu$i=9 z%pWx*1XiTka5)0bCJ?N(pB=VxKhhm!CJTGHTD4JY0m7*%Xvs`R%Cu{zY9?}GFGO5p zR22Q9P0$VphAPFH^oD;%=4S%`xY5B1ET@RYw!+*L=E#WhZUJZ7(iWh^;%lh|;NCO8 zVTe!cR+r^;&if;U z5Y*YLVs#Xs-q`0F39X=t?H{a)oHRy=%ZbAAfSzc(cZ13HH_Vsdm0O4Heyu`<^_mjK zpyw+uVj)sh%7T~*X2}dy8hVY`J^xRi$^p&ZyE_DhO{`jP^qTDIcxkt!6eLRzSj1TG zw|?|J_{9BRHS{tZ4(D?2xN;}xt0S6FP8kVMy=Y(5ql}U4J`QmL$mANsl+k{B$m{DZhdhwjiIV9GS;7C`ZBtsjmKp~?dOXi5y$l) zH?ib=32T!QNk(Zh7r(STXMlVPR;c3#tFp-(^P;n7=vSQxmIa=k6nS1H)>8F)YwyXp zS0wN_{D85JXYS2u)6fPT1=-TrQuo5e|EYtj)k6XG+f%f-sC<-v1&EP`&tM57a3;*XCpRyO5wbi@Av}9Xx+); zJ9caj@FO_rj1V&)rnk+ag_mf3A0gOk*GSkaIItZ1YRz+hcxXr$49&hv>BWarGBKg% zVU>ApJs;wzfcC*!FdWpGrE7^Ws*N9oJ21b{I3!BYhq6jl^i^WAoaLh$Pq|lvZ>JS_-XnIgVt43a)dfh(R z^Ok@lf8;QX+lkdK7ZbUYtcSda6g>a=^Ns`&XY&CvF?Gl_l+S;6KW}0+4->KVwPr<<&o-3=YoFyjf#c~_nWo%ERuTi;-)?)V-RJ?gvN-{CnhQxOw!D(Qn|RG zLxRphr9=f;vb+hZ@zqa?V-g8BUV7RY;GiD%xwg5| zy5AFc?clp_nLDY;l^D!>&HG4@Ad-IOt4nNM08XvX^3C46i9tF^JgccjBO@cvHnH;4 z;O&VabTWc-aC>s*cQ;zP?iseJ2n6_vIXHe@n8-7$(c9W#S!Wq55=4seMGPV*o0;a~ zfwaM^?URo_-X}!em;z4a8|LU6)WJlF8f1e{V>x{|n9aL&+^;+RwSa%T;ORkmQ;)w( z_kHi`>Qazn&>|4CqG%9(0QD2cC&AWS|f|30R92eba9o53^`kqe2>;VT3>H;L(w zHAk3|me%?yAb@CoX_4bP#L&p7GwytsdIhBy%I$Rg1tD+iQD#}yU~7FQ0NY8&i@fIQQp^&$MPqH=zU_pO0Bs0*LrX`;*4ZhxuTt@F%EK0&jLT(d zd0Cw9{m04Ij;fyA?1^hK*eCB*6w=>N^mJA#!=XB9uWqDetV|2|jjQ zHyuoB`O$A3DTm~R`b>-sg?xGG)qu?n1|&y<4?^-3`P2y2cgJSrXr`n|ioIXPr>3@? z0y;qHI;P_7-myMkQ(J|Vq{&&x=ghm3hZrnd`2yjB%8vW1iiA$+87>Fd1&l`@pa1t4 zoTBDIh>N?ia`hZ(kbSm7nDi$cHnC4I<~ut-tFk+>ejFv@!&R1SYrlOM#G6U&au5w^pc!cUm@{bq%G-9^|fhDD2^8y|#ef+@dE+gjm+@^Nvv|=kI&h zOV#7M`+aAC_*_#HG&Rq{*`&dMiemAg4%PweR_=?eippxm`pOD(9Jk9pH2dnR|MmJl z5dwIxKnBjMn@~HPX9$>?n~nz~Be5u^Jl^~1ZFjb8B{w|94R4ZlhSJqRbNBXcOUuYC z4h>Vj9JaVfc>P8`B_LK9mZ1<6^$al%H85B)Cg&%V3o8pY5MrQg9PKKBf7i(B5d#VY z9PahXRc(_siSbvuvqIV2$e&oOCu>(VkZ&<>o=VlH+1z44$(Gc=cJ09fApu?)l>0~s z)og!0t_TX(xbCG}|EUc`N zEiE^ycFcW0lvNfQu6UoBZ_f%@OgGp$M5>4+I4p=)iLHHT2EG2Srz|W40%tsS=heg6 zIXOZM1wC^^Ig_H!=P1k^99pkl)qZ8x%j^VX22lfpjJ3%T1-AbFyM#egN-&g~r>X`_ zIyyQxTJKal83~IBi>a!{tkKcaKaGlt(ls~ebv!=&k)5N(uthm^Q_5fC0q)!!Yaz*L zS7+x-F?u=%w!PcoV!p{Gv=1NVV~P(A4RsFZY0U$>G;{k{Fm3Bz_RTraFw|Av*J4Xn zll38A8yb=ub*UY&?r0Csn~_qC;gF|W;V{FHOo^ZRz_fkIDXA z{l6XqcroGu9*@Jdna97cmCrnHQD(om=79vXqoaceMHD#;3WKdxycep!ISmCh*J`D; zfN1~ds7_>5l&FbG&RSG-^izI*Vk{=UwsC3+BG?nhf^rfUM#19G0!XztZ_K>3#3+Ze zN>CR|%gW|d__uX*{2Ub{zWY59SDIv8e=C47d$6?zW23va>u~q}DL=%Rn-f7pM8wbS zJEJ1_F9@0X?7icx-?4+uMnnj8434gkE7Sg-QNt38Ue{O9*d2Z1gI*QKwHJ_;p8j}P zN7U1G0!(fXV^pjDgpJXHa!3X%E83zoGg(uNOIuv-j_cQb_t;yC?KNXyjusEkoJ-~4 zA7>yLSEKu&8g}zB2_ir0;ch@8rCSnM+)sZjZrI;!aIobYUb-UIzEhQ0_qy_T5jB6;WI=}l6EoPGyz$gw)}lFuX02v~VE6yfD%&w-9u zrYm$$dcgP?uj@QYCvx3^~nyZIyqPk^DRWHbC3LY&!V zi~mY$WhHb4flWZ1{^7%7%yY}BK<)`4%WuTcWKLbkF6*F)5r>5wr_T1RWf7vMC+?q1 zW2qjjSm>SUbJT;~dQJVsBTiSy=8U_X7qcVfIZwlZv%t$#aw<^1d<*nLn4|75rcI zvs$g)>0tpbB=LGfOJ|Oll@3FqGbwEXDt;X2%9EAgdv{ZEN;$@Fozu(Gle zF;o@0Xy-#jAdl}hIF^IdY*RCFOSS7a)%qxJJpY7yOl7jdBB_yIYEyu-xrXS?Px09t z(YAj4k1O`-h4}k5#v_mqc&^yLXZ!s-9z;yU1l-FYJvthZOk+n!>A4l(4av#Z9Q`2MjNx*E zj#UDtlc|BhkKKd1&3XN~wor9S+9`vbodpRGt1SIDtp*;v^>*y!Mq)!l=a$*_!wb@| z0I}92dn~`3_r;VQ*F4JiDvH`(m=Kf0^S8>8F~d6;^=R#X|Iyo8lrb(U>v3CDH_GU?O@z=;mX6tc`qMGpUCQ2BX z=!L5+_-u1&f8}81$qs#TZu4UT4c`8lQ)OlEGrfd9B3Hn*g$Z%u0_Rrkdd(V z@wj{(53|odARr=$k=*)JbdP{A0sVGz`kLMO3*8A5%&AalZD1T%gxO^6OaE3DOSkoU z|CJz_@DAcOExPwn^}DAQA z;^!}UwdN9bR5gQK)3A@p!)u`r9cX*DUUw7TwKXCqc-5sTVaEOLbffOVbOj@G6sKrC zf3o$0w8q%|{ZXHe1@KznVB(;YM7oI~``Elf#^%SsuzIP7g~iVNUes`xTj67Y2QsGJ zv78||6~S%t$GvGZ)(O{_SC^l1z(#zPEgPYDXj`fg$Y_|iF@w%9oEXttg^o_`nt&tk z^V>(Cus7|d42xX-V9WJwcZ6P*qgHQ@(w|>`CI~i zez>~>v7AOoI(NMnbMx|uW%CZnH%&}Ug=WjrCKQa3GR#PM_UuBYgIIVe-7pvYbbjPrXiOJ7IPmPq6$TB~9Vu0k-Yy9($ z-c6KQ90aFhD@myMwM?^&UXHUrc`B#@k z*`oKq7potJ+PA-Q+%YleHY`il9fy9=x5$0pLF~rJnv%mV{QzyAMEE{xlk>Pll`12a zVpljHo8s<^y@RRq>(Vl_$de@dFz7@f|8nC;STOQoZi&i{)D3d6jj}DslF2v{K0a;~ za2!>f%*ryFe=apw3Ci_$4_j;XN18=II!xs_elRU<GWfoB^+*WZ0 zFLh5y_u=JxQ?Tw-U^>79id*39@+T`|Ar$Jw%?WnE~WBggC?m%D+qWN!;FH z#=A1A42M)*t;BpVkUzMhw*%bdqE&ehKwO>FLQnjH18mWEK&EB0HS@B+=S`rF;x|~2 zH>tA3uA591$hk*I{R`7tkB}S}SJs^kOG{Z(QrilBJRjyHBp`T4G&fW3Y|o)7x7tiP zYY>wC^cT^7vHMz=<2_e$oaYES5?^swuDEim_c714yZ{Q!!$;9|Z*x_S2D=oMlnOO@ zyLm-ZmfCPFfHfrSWM`q6;8d&Ud4s9~zf(;{R#uS{;B4QJJYHU5gze7`e6hP&cN(~X z`cmd*5GiU?KuwJklipzI8S!xL%S4DhBG-W{NL^iK9_;}}ppgAI6($$^O@MKH{!)ou z)iL!(0cFu5|U_yLIsg1YM?yzqO7 zh_+kcQX;yEK2{J*yXadg_?M^S9UhyAEWMsGgzu)KO5D8X0A6*SxX4 ze&bEOO^2zeY54DwApjE|0zg|zOiRnd#(-qT139m-PbkOFt)_3@J|ra=)Di$#j|`#q zTib@0yafeME~I`gpQqb6ot^3G*fkSj(@j|q0s1SfDx9e#WwuJ}<}=jXT(H@!cVD|L_c* zQc{4MgM=8J_{HWkCn5shN>)j-=72jAB*?iwcNJ(3s6Ti_VMw+ZUx3Eyd~x!~O9EnI zHgE@<#1Klv;yvToTa?WYIvU|D+#2*|eQ*`92 z(_pE8zuOVG5qu8A=BmOTqaHn++EF(cx|%^W2#`ERDt9hJ6VQh1y|EaE4kIa>%XCR|X%Mn3$wiS9e%X5l5?zkN3JiW0R71I5Ck{ zT0VTQN0@xmc|ZGgRP0M7Wn6T!;A!CaRQ)99DH|JsKzo1TB(meVRYzxc)Nr0!7Mc-h zF|f~!bv#njhM7&=`py#R&+g^_7OQ^8N(Nym8phSA_X(@|2SIU8no#SF9VsIH!9QST zo{x}C&G&xFx3gR~fNOGU_88`cR_o3-bIbO2;;2G+-1KZ{3?uO&frsbs4g5O^o3h2= zu}&~K^1EnZpr?IGNvV^XNVe^A(+_P2YpfpS8YUhYNJ!>{-xFUgI0_($lv9l}*uIBS zxEtRja=~piGLRo2c*{T=)6+E1J>3JIt$OpW-s~k7HimHRP7|AoY)8pSOLH3wR5D}P z-AUwS5F9_A<}ZFGk+iV%B%dx=ZGRz0E$DvN zBn^#a?+S82B17UPD9eY5(7Z9WoX(C1v$N@8R%+$%zD2WJq4LidwQegasTHn`1VW)o z79|zWGYNZ<>OML9F86zJR}y`27VJbLebD4C8=P4_Q1-e5q~fnA*%PaR%5f@9xetqr zRR;SL=2 zppT{fmJ7qEbRME0zhL4G;u3sY2iZh?2Odn4YhH5lz^jQyaniA%Fy< zm6hj+zt5#pG4v4KzFor>5+W@WIL%XzGG({3t1mTdO=a?wcP|?r&~>GF(z??gF9 z&f(h|c%Ks6nHd@iJ3rC-hJ%l{oNI73Q2gG}Bp>S|wI9$jFocVW>Y2EFCEJp$$G6HD z{g1>B(~So_rf=N%5Jw++8vtL9-ytioA`2#hJUMyD5L}DbJN8CbZ=nNl%D=dxOKyFx zEXm1{l`6q|ZP!#mMNR#aY-5R+mbOWXorA-qm|Nh?k6~vAP50fqH;MBmZ5Ts2sL?O5 zSIF&O%n0d)hJ}r$Tir8ZeE;EzpgG6sR+9g<^wyJ{i;*Zc)9+^CvZJ}pFMah7u@IYQ z=Pa8IEcoZs?@9$WP1HF*C<^}xAR-u;iq)4!DV#jgJ3U!DZYtf68|BUx^w`|Qq?5$z zQQ~&NXCBaCifjDdPkdIKHk3!SXWnNWiHH8)5Y2~MjWOW3cmEMUbyTO``9PS&uWj5c zD<6D}a=0l1ksV~Q_Q2SfE}Qp5jd@sGY4ZO`g?%XVYYPmLj~D^}NiZhgNt$NCGUo!yZdq&5^+$Otw}t;KOeGx(lR zjNjJFqZu3C4>lYeFl*wV(Pc_@MB>DSZw>$}PFk`dWe2El_`6lYq1RO0A1M+=?d&{h zJ~O5T5!sq+d`sQf>k88UMw>09YgHIv1k*$FL+y-MW@d#>%*?nar(GwHUVZ!0ovh8Q zGIaEz7ZMV6$Ld(LB9;be`xZ%jS=PE7ETVWBRI{DM0(uko@x=GKBU&tlDIHPfRF1$tv$O5aZ_gA2n=RG z+*D-igVobqI@fX2k{Gu@f(`2$$jq)i!V14jhG^RhGBdB2_3~0uhSK950Q9UFHIOD* zvQ+$ij<4bfB)EuC%F6SWIwk%MW%LA*Vc{Mzq&|qXGPzuVSJMh)EO=*(SCEZ^!-C?J zmM%*aBxs!S<$$;4N8=>$dTM1%E0@-C_pwQurj@C^J#owfx;K62{3VrQoW7;f1?=Hr z5X4tJW)`Z}g{AvxrsT}q6j%=-E%&O-F688GEa6!5m*)(Z-4%S$U1=nn;&7^Ln{wJd zJ7Fs#zZmWM|19(p#`h3))E6%2_(cV^rt|Xw^Bm=tLltq)0rcmM6?iq#M<#R2Mmx;R zq!n{;aF83_J2;4nh#1YzB|Qsy4PgK$Y5qq@>(F4^$K;+he$?^r&mfE#^*oEIl=cJ9 z*;x_eh@x=aqGMG|5|LIKKtn0(Cp4APji2gs*IH(o0aKR9khuwmTz5J=*cyJQd71_r z4*Y+deRn+7d;EWnLxeIyvI%8xl^r58WRH`*vdTVoBxEIoj8akdI#x!?-r3_Anb~A^ zjNkiE_v-uYdw-96|Lf7ck9$Ao^Lf8tbHc+->p2Z!n+n$Q$@@6i8vW6&^YMko&J`Z_(cclw$EL1gRAxKJ54FG0P`N0sGHf+O zg+`~+T?voBmH6?u%De_|x4U=G>GKOhdRn{_SMdb6{aWg-LIB)3ZhonUR-NQqX=6P2 zM$@ft#&4WFn!Jj1z{Y)mgkg<7dr6h-^#Xz2ROSBDp$P7qUQ1jzU|F4g(694s~op5eZz)7VaZI$^@Y}cvB!D_smV8oF#rIBHD~PjjvfF& z;d&$115nSg`l{z5yG#URCt!#Zt)pB}P57SpGM97Q(j73~r*FJ=@(N#a*n!@^S>w8+ zH%)OiNaDIYwZSb9f63m>3=Mmo{BkeRvfmCq0>Nj&n7lr6ejFTnn4rS(cqR3Cyb^Hy zJd-e4=b)nB{wIIYAR@{9@W{Ca-OsPS35FP*#Vo@0M^MP4$uG zmAN?__%)_fyhZGd@~%fwzN4|_CFm(n!~2!b9VXXldZP!}amSrhB#XhD*=%-1e!S$n z{oo^7>v<7oZE{&p%-kLL9%g|~%Qj?7>3t5~^pg{TbM*lz`5lzd4wrtj?(N$f;mUa19 z%@@&pRA((7@lhqyo%M%44m~AD^)R#RDy0yj%5&34BlkyTzsBZrfAtFqpIr?z@A%!! zEXcL}**H;P&{eT?nNUut2BDymRlH{{Xq}^3&LAGDF&3+>bmw79u6b`?o{sPt==A_! zMDbg;YHz`i9uiM2I~2Jzm;4#H@EmN93X61Cb)a@%*ONo+;nLE=_iSKG!@Ke73Y0D~ z!nbnV2shJa8MeUnf>JC~nA&Q#4K_FHwKsQ~`kD_j!7(rCmoX-qohpGM)b^Z3dh@2M zBw421nttAtHHcZ&zwA27y1{vH_-Q8gY9MOwo))Q%Ub-}lDAC` zo1>ZJdnyPvtaX@k0uj9seu_o6OOX~RYf7zxuiB-#L{1vs%4`@(=g6PXiCdHsf6OF% z{SJX%wyHlD^bYNET@%2R1tih`tW0s4P@<+m`M2kWgSD^z(T;RXi#XYLBpm9M&NAL) znN=M52^rXNu(tQMr*WV0o3TT`LW|m*mAt*-!aMfNN^)7!9;(^4yjxcJ`P)F2BlYf) zEQbM(g7*I@40apHjz=W@;_x0(rMG|xU2bKHO30v$KiMt)dc>JwKZ>m)eGWX>= z9I3Oo^z%>8mdsy?&j%0Te?$D^I97BDpME7;Agt(^nF^oy^q(F;J!o)RwZKxFcOw{z z-Y-Zk(J*PsP1jiTPrei7{PT-zSx6?m9l!v}Kc_`5y&aGN7J{U)c|f*H;?F`$5~na| zg)#mn;husVZ;*+noPA+HGoezXxYdBX>9tv+oZJ=^|-ANgFq-0dF_ zclVktBi17dv8&))N*%L|4gcds!YFKEenKw=!=%BWr;mK*VpuSK`dCv zQ(!HzDKf$8<-o6a25bUiT}qHhwSz9ooIAe1y-V{b8VA~gITp_}Mp`Nt80yQ|ofX0g zumZ@xjaR*w2~akh{t=&ph{JY+YH!iLS4BYnM7m@xs?Bb{UUmeS$mqjh)eGOgISSe7 zyOMM2J5-F0P8fQ9lMxc}L=-X7ocv96$1%Z~9s~o<3%DnjA^jeq^{cpxmWZ{_khRHr zU(dw%{H7b%-(ooxJ0L>RFU>R+1+Hf_?$lt_5D;yOz5O#r>M^9^-Hc4(dqF;KWvv^z zCkQlAhju2oi#addrG0*UlGKm~13^Aty!PI8?A+AKc~UCAw?CFOO7G&jRYSE+S-l_l zHAZ|tnyYl8P)bJJkOF7u;Gxfs%E$%<-(;L@uRXGS`e4{+-)Cgl-j>oi0`KJM`x#?< zZUXA6?cUtUjNx|^9da#eCpoKt%s}a$wWh5skQvxiTX>yKrQ~|iQox9S9wajuJM{V! zUqsnk4)N+r>Z$3%R?p@J^4|G`e6BN@eqZ!BG-+Se$kwo2KH7(?tN|GdX9xPa-1d>L zeQyE^*>U(aw-lFz`A&-B;<63bVU5?Of)91Y4bqb_;rN;TbkU1aF?9PUPhqDvxIh9;X!9<9Qtz%oiQ;V zAkz}Xrw#{rDp)&wCNr1oR>Zi-|KJWR5eC+5dT}C`Prh|aZm@emfIYH5!FR@+*ur@J zv7zI8rUYaD-kEp@wcy?!T)qp?b&^gOEhxAaA+Mos>ko#=aDjG?RnTz;^ZFU$deNRi z)f;SwnR?zUtm3%BG~3k&vxnoO$W52QTWv1{hWCf;_re!eR<^eR)ph3J+sfX}L4^Lv z4F78(LKr;MV0;(m$@kudRuPLY8a8IfHR7j0Ut=JIdI>}xER4!G7xlb3H1p4ttI2%P z*u9nwbrRF(_TPIkLHuKk?DgLHxOtESoW({0CA@G4PBR?`kUJ$|WUKq5;)iiElB4a^ z!y~Z$x)hD1&IAtOuyov@f$+ti>G^gTZjeR1M%fJmTqEJh28u#|B=iPH-2^Z!eWe0=sHv-LBS>IM4Dj`la^88mXuzSQoPs zupZy2i;5D%YM&a9lIwx`QF0xo``F`GM# zd&%+qm`OSXd-K*8tVk<>2<}B8BcME-l;g;^51#&a8hpX#D8))OtR1=t+)$&kZ`jDvgW3$3g!M&+n=q(6`L+ zNgf@lD^M*W>se=)=)M<O!gyG1q5HF}(W07_Uj+MV&iT7kiu>J>!(WPOO9o^jU{MP9{-VN2C>F4Cr zT2g`26=tGf`rBhZJVmiHFPWchGNt-j8t?tzFAnq@WFKG1-A$B6AFiXyt#(WEsEUcj z8TTien#E_qc#&dox;g^X7uCo0#rSc35jl^bfQTi2OpEYo+~2S`3{T`Xx-p0w@3zwU z5py|kwyK?|!VK4u=;S#+deqzKuu{x->9_LW;w^BI8NY?M3;>-uq6}RRwCp>s4eolO z_GaA;Ap35aXfp&};7#)Zn`E?VjmuHNc^CHLulJ=;V^R2A#4H5`f-HET@7g8bCz`jIgO|Qy(y7@7xAGRmu`t56=>UQbL zcH`%*ln_Hdr(+uVZ_g8X&%M8 zMD=m9?m;VtC~nU3FZlwztImsQCSR#<)l|WLl@DQf=*{@~gTa-9m0sb`%k8kdPIRtQ zUJD6cvc9&}7XVgXLVd=vwadycd=K^6KrQc;O}tY1U&~N*r~LLn{F%0pRXO>i_#c80 zV19dfp6AkD7sIqg{=BfccNQ^HMa@2LBQ1j<%PRijjpO#u>4G2ou>OjLbLQhO-pRiQd@6@X<23PIi|Xhf14FVxK8;>K9*C;UH z#5_*vg4ClbW)b2?z7kkqw(ES9wV!$v`NI^Z==`Bh-jUB?3Ip;aeVc-Lp!yuA=MHp~ zt`WQZ>rGSZd*`C2eO4nv!jg9r5Bn>3f3V3^>rRs&q{E!qw8mx=N6uDlR&OU(Yku)u zO(wN#`XcFL>$a0MoNuepv@hSDd$>hDQd2|a14s1|1YI0kmGql4vNDd zQ#zRkIw6pkzPWV0x7*V!Y07B~USj**gTC%jzID^23G0y?&W$ zwKsrqz2CQT7*%LupZx+4>T$RpahUpgcWj^5yDQtvQfh68)@Pyw38eZ$yvyW4?|`cG zIjA$nt|G5SeSjZO!Z`Y$*_;f~KPwkg@P)V-xf4$ANv1YI8*BPa$J=O?{mH`E#gjDZ zE1j}i@D};+E8I&Cwt4kszY$aGYx*z|T$-ngOl*gm~8`o=q ze3@_1=kpbheZ4G?V@~71mexVsVH<~mi%R~)uM&%N-_&e<>dG?he)QP=Li2Oy?L|?& z79%a$A0jOh&FW)}2^w z`-M>4#su+QpeBv&w=jh+)JW(ea_JXKW|*T=H_xSB=cA<-y1c%{M+@fA=OC zz$`d?+ao8R`+8mdnJ})SrXqYkd#$I73%y@klGqTTqKX*qA6|H?l%l$IP`xi+H3wWN zug@nNxZPdy0RF3chuR{<{W&_Vq2%oqeCa9`w<@F2jqMAwO@-LQ4cde3;p%PVl$qzr z;P&(5-3R;WaU@j8lch!HC2-$V;yYLencE&2)ni~>aVolV)W0KoJ;I6;oqe2ounoHc z1OoQhHNEl)=Nv#!RXN(P1{ZGJ9wZTdClsRH|HMmm;D&z}k7vsrGc%xg`YDC5I|zs- z=aKUs-@w-;5#qZ>+db(ioJ7MK3ts4S`2BEa1vw$LqG2;bHs&6OLRJ5;$*HccwiZSf zJ@N5DjUCk5j{SJVX>>9?{0w>-=u_zID~EIPSMo=KO6Vd^iRcXlt5<`KDi+^O2fF2m zhZ^mJl}cK_6nY4BA+&v&A1>X53?=L8F~R!3Yu9mBCw-T`^SUOM>K5g98(clF+VbJP zSbR_0eYfZO{X}`^l#dT%llg3W;tJndwl1*NLDxd<%p=2yX@Tu*d(U0~HdNkAoRVqD z+b;B3i5n4R)6{%oBfGlnR(^rpZZ0SgIa~Mv=}sQEcm7C zn|!e$4}~f_W}FA2(Yp4cp|?OLLO0U$$P5F($ychq5%qE$#OTf@yynP-PnhT!iCfnp zSwT8)s|i^wiwME*hF7>xKBByMeNs6|WI{RlYBHB)XUkVkYW?NO_UAm^$g>4YNy0)@ zRO#?$>fP}?aYG?jhwFa|1!&3I_im*pmDBuU(I~>YZ09`g6j7sPyNlBsY9k8Vl`qnv z9^^loz?a~gn1TqX9>JIY8y^{#L!*hK)mZmkDk^PNa@4GnZec$=+nJ^Jp_u7!Uc8bkM-|*n@%qywX1ML@gOG1TV@NF zxEGg}zAI2sP;{w*zEt89&H&i6`eFLpvAA(k}$FfYY%|E3Cd&T9f@h=kwO2$SVv-+^juY0|e+#37zIV%8jN`e1AQK+N58c(r7lE00SO=pS&FQ_wRY{^pbXb&)_X-Z=_o1qjf( zq-LnxkMi(92_TvdKEAfQhYfkl%`V;BErq9)3OUG9o9@y_Cix<&J(@f0W8zhCH`Zm> ziSD1lhr>~OPl3W`5kC;j@8pJTB?tZ6sRbP-3@)C6-O8Dm`o@NL(M-?9p~&2q#!nw} ziiLXMLE)p#9XS1o;FBuP_;bnKSR4YUsnB1^KZ<2Iw z^(DzyqQV7!sf`kBy2{{`F48lN7oxMD6m#}74?0ik25yxRdH&p1xA9o9=k;Jv2DXJY`E%!#^>um z$7A3b*pch_bb*4R>1-ekxb8P0TgH$6?T5E?#|BC|l0sKYv)()drs6a0$<%h=sC0$g z5**@^B|zTh_7ya&U?J0tjl%K+FUXUi>U!>pYI z_h(BrHTTeV?BYfM22Ii1_n1r8gsubref5R8w5@kgCsZ0tP@qXX`Ee_;Duw z#aSx14gvy#FuR^tY=T^gDKRf!7A^xd*1C9hSk(xJZc!%+3}&3{D@hOHZXd`CGN~|q z90!Eh5zKQVw3oW(9Y0xglzXAJ;YLPfb9KSRuhi^rcw~PW(riuSK|8D?D$1L4>sU1> zoK-JPcSNUj|7-~fj$1-;cB5h-Cih^b-IW9~F?xE1)+L%5luRb|f2eRG!)n43OGc0i zvE_Pxk@j<~@9rfHX9-a33@!R`Q~zCi`jrz|f)S9jo<_aIl3T!X7Tv=n@{B+muzB!w zINwCJK4#jAlm5w%X0BrOw~CJE#PzTG?|iKboftVIdq=FmN?p~>^4%cJdw2S2fUbJF zqBEaG`vxXZvaL6$c0~5SvFL8>T^zag0GS|==|y5v=+&@g-PS$EW?)WlmddQz^fp3S z0jDPhz$*Tl>&~JP8jG)ea~wofJ`aRm0$G(zKkn!jwfxUpgnko+<^)$!$$N9M4I@j5 zLdEhR_5C`ef8*PY(y10-Khu4yrC$C~Y_mL4Rv7;Sp=Sd1T-uU;egavOsKmL`SVK;t z{Y);`snYP1un;%*a5fA^=-}Nr2Cn613UNQI5+qiTuG`NP-GQDD(C)$TvF%?*F5ip%$d#nVIpp(z7*a+3(w8e@ zIo+4#pkUn2WkgBR2|P6eBh}T*b>KC4rJEe%=hPn0nO%x zXd}ZDAV4uONCskhzSL>L!i4KG>shr0Prb84Ir@Ee7W0JNR_~VSWmk|<;Z^LeHTZWM zg-P5Q^*O`@w%@eUnTCVuk5-`bS>bEUI z^^K6@?zk+uNLdup66lxUd+x@<$k(BMHQLZ3(cTCIw6%~PYh}>>pvZYZ#eoD zj@=vv<*ht$5}A|IxY-%$-?(kmHy`alwxNQ$KacL{SnGuy#qKHf@vv!hOmD~H z1_#9-V;3t?smH!Yq@q!BN0sa5JgMu%UYWd-@C?wI33tDvc>Zr#n~u>B(O47b*lqv_ zmc#K9?aj%eaAXK+OOlyUe!+B`5VDs|%d2uE;xw&ir$tqT!S$M7o0--vw znYGCVBygM9ivk-@*)Gv6DlXmWDs15vJhC@)+{T8e@rE+*bZ7Q*V8XZuHmvwYzL+VD z^!V<+z7@UaDDQiL2=lvy~uKPgS z9hFpq3|kQL6g~Kq-1K4h`^XbtcK~x$I4`^{yrx}W_wwZ;#hJ=fmzITzf1T~HKM!~C6EDyaCg4yprw7L7c&y8MsMlz zfUEZt9s7kPfjIMw$$?`>^mC6@HxdZX@9*0+R$1Ty7lAFu2Pb9=sdzZ&fg0x>8&!MN zENDygS0i>k%3#0oosq%9)7E%uQY$XkZ}dY=ftLAWSlg0B>-u_2t{cyYKUSbm({=at z*TW_DK7+kOQ5A_o;>#;QPQDK4!uAy`u~(!(%@A8A4Gdi`u4m~KzIAKO&S@GgcWzli zR&-<=RyM=Rfgkd4{v-!-D?dhZ^>Z+Z-QfY|!Kg`usP1_NGRg*4u)=i~8VdJkGg&H0 zzH9fuU(q|$YXu0?VNKd^J1-dq#=x4;%7=ubq~Yo6DWwARqkY-K{{5dAo^X0qdf83Z z6BzPe`;qe?z2k*rG-PdhajJHNz4E63x^@lT>VBCa7avDo%17}Ps$Fc9LMBm zyv%C?U?DKf740no1fY_Kxwlj{`t`CjOOtu-%ljGGuNveTkDUW>R;MLoiv~0@F44Xn znu6}@=Y_oL6|3b))(py>{1iPW7#mJ}k6(Y}PVhAwO(eU-8R@q2HSqg#bIkJ2AuG{p znD?muNpFI)5RQ%-;O;SpeLAlA*$gOr!6%t6>=b|-18;!`uA}Zjw0$#0K&C3C7+BB; z?F+PMZv(B(m?Ta88X;nw9fT&~Dv|_ehb)Lx3gsDFwL>Sk9DqxbWF?yY zytK2v&=^v+1S*Md4P;!p`XZ20y7A!^Grons9K3M91uh!gdtOTC9*FM5-C~ms_q_eo zuLG8~%IJzM#=-Zv!l_BkbsOnQDhsBQhziHaa&ijR$(KmL;{5<$$WDs#p=mJ~ zwp5)^VtlB7e`_%kkN6boP_70xb@~r^crv*rY<&Cb$J}fFV=Jv|4Ko)BTV{ZQ&YK*g zhrYQsG)#CWzKtAuP_B04PC>Atv(vC-jqB<-y$}06>bMx;9>$1!tY>OnmOY0LpZ59N z4i&w->QHI8!+g@QCEoqiopkbvs?fHF%!{<=ZVJgRLA#p_f z8X*toxdWN9NOu+LP>P+}K#_d+2aZof;oIfvEGnct?D`klx}edyAJ(nu&VG1v8(2w+ zVpQg$nH2rfU~WwZdfF<)Sb}0+Ce8o~069ZpK)}yPgd}B`d8)#5_f>`WlE-QXF(=^$ zR+-EuOjjH8Pbjc~QjNF01KWrECE!0? z{@^3m7cZX*!q_lMA?#|0l{meperWmMWl)T)ZUZ^n^Le9&_tHaxIe={Gw4&TD`1>7v zukxTkiKi0xP(SoQ+bUo_v7aS7rTrNjfZaC=K_W1ZGN;11fPp%TKH{0+h+9#31NC&D zRoXLuZicQwv~msC;Q(L*TJ;xZ~)_;)s9_Zf*WHfkNQM)-} zjKz#U?-OF9da1{OIcAE_2||w>xEfdGBqs5AJp$h?+n(X&YqK^smJ6PZ zco*>&_QoGFF0Z13ysBfibDZ$VTDLd5CHpE}w?8Z_G|}#Rd5OVa<&g8OVv)Z+UG3{L z_tN!B%N>`2{N&s4PsR5$p z5kyH1PIenajH5Tellg1mO55jK(IX&)I^q4H1gg2pc$Z~+1m8RE!TyipasD@KIh28L zkJmUm(vTDXdZ#VA;~aA%Ull#rF{y*q*b(rKh3RvW`iOj(FcLDmPd^E?OjpWi_vd7p zP&}ODl(qK-z@$AbE6d@$qlO1xlW0UHfL_&PNW4fAj^olz(d$C>xv^U$s1Y#cm) zgsWV^av&8Go*q+I$_`@(P28LjcZ?&D!IuU7?xbW*I@AABjYSu=HEs;PzV;%bwtau| zkm||(w6UwK{qZGLA2I9}54&Mkt$7A4zbKQuS=Jl)AiTj~oZMxqQPp*B_2qgfeolMBHNLAeTarG9_vtc5%55`q?T1RQGW%c;XtC7~oTo|~9)n%IDU|Hjah+Yav=JzDd)|R{UmNtf;`;UTEv~u3L;svo ziQ>K+fMkI7SB|wwK%?S43-sdY+0iwT_?{lM$8^4xe}ZJoL%~2`*&{jYq@gzh8UT7_ zB~a3LR(3AO0Cm^l($W(}JRgCpU;Dni%6v__s?l5nwoFBUm6AMddqG>}zDs1h-JL5q zCg$xgRL>)1D0a?-6v&wIu3mYvS!Lhm)kRcpSR-^tqbj}1QBMK8sy9=UJc8AGrSjqO zz?#WgC)4IZ)xkK=HqCd3; zH-TK{)0Y+R_jtun$V{HT;*~*Y9MBmnb9JelY(L!*0P$mop0T&-k@6PJenmd&Ez@^| zSvy~=K%EPH`$hUA8^sQk`Uqb*_j7jnXV7*ToTS`}WR}bmY5Fk^6jJrABs9MALye?- zaH?u>?!t5y#9T{GyRQT+jk8H8+{?uB6eVFUZJ>p>ZeFOupPuV7S?+u(RY!9ooK*lP zs#m^ky!+I`E+Y+ji{8LsX%o<4bFQ_pYrPwBpG~qGEO>L^f<9>Icm_NM-l*ACZ$cq8 zbS4uCH|lF|AZnH*eE|ZdzcRf&GD*f|xOf_Pv7w7+Sg`MHzI@B?{#ikpnq<;pi1sDn zGdj4o9m`1W9Q%X%Xus7N#2#i78B(;f}uyp{t5LwcCi;# z(LCXVM@WQjz!QNN%3c06=Ke=P9oVv^XNBB*zD#^IzS{k8akx6SNV1i0V(3HJgMHE# za3U7$KQCY3{!Efs>BHFAY7sxt9790K&Zs{j*I(+}0R`3mR>sPG;pdGlT-C%qEqHpG zxrWm-kG@CdDS71AfwNhccIh~z3AMfNw{EH-PZ#I*<5o=9n5_;#$1ISGr>##hBL?j2Q5%#>xOB_NRgu+@_-q_*7) zwRKu{K3Pui6Rj+?NU7Kqjgo#r#KH24rIl~ud*Y7r%ZYwsGpE!BAl^r*yJsc=JwWbw z!u;p011EAYK0t1Y=$!Qal?Gg+Tb8O#?;kF=H1s``(7)}vvx-`7jAGRI1k_{Q=;jM7 zCPvUD{&Wjt-Btuv{2sINi*YYt>J`al$PC?PA5M`6g4+EwUK^@HR|u1It~u@G342Us z|(_vZ1wf^tJ__D#a^hh zu4`ZFc8I;az6JzioYS-Lo6Q+7g#{CwHa}O2TB*(*NLPEZc}{c+xE^WVBk!o`7k<~@ zc8+(i?QFsAWn^JLvXnw3Ga&Wb$I~<$vWvRDlMN9Sn5ReC>R&>BQ0pg9}voy2dYmhS}= zjw!}~-Prg_VyxK$B73>HF~%6K{u~e>+6NsgSg|lts5$f^TRAQ=VvdDOv-xMa;CXEW zr~tJq%S$B_oK+t@tjoKq^CGBE^nBJ!x-8KBycJJI&>aNd)G2XE0>w_AvT*rUj24W8 zXh3wmk=df7qq!}y#6Qgq*gbx+7{o)NP)N~_s+B;^BN&2R3^Lv30;A(t88D1fhHK^< zGqj;=$NV!UANIF|?c7R>2N_Jd(}pmh8-`Zz*KP7cG~9+sZ)r{U8 z!3GZ{K*;%$o;$?Xi|*gQWjexDrD}tOa`v~+^4RU)er2`2T^|9Nc}H;eY`GsDo(@|G zb&3rGLNjLi;BlY-^S1B@#fo+&q%8w3J`Mqyq$H^LIh8u?QO5@3GQYgVx57RLH|Y2m zoWTkghxxMl!`HsKERBNO+UyH2g1b2NKg>OX7!6G|ML#q#ncdNzw->a*79%+X9|3XU zt0$ddp*t}1X-yKgfCxlmzk4?3BN!oIqlvl+R7B7Axp8KYUy_-pC_#iR?F{Rc*zanR zJY@F-$>(wih0V@x5|XcxLg1}yhi`TPc%*;j;l`UIRO%R;31;*89v^OGr%=8{@(AsX@tDaWko+3*w%;)5I7?j%B)tdpr!J zI8K6o>-Ik7{i&V07>?9+dL&%mU50`8QdsNCb0id_0ws zN}sGP14}^oQD1;(_GK68Ox~|cW7T6xSB)B)!VSL4PA`w{=TKg}$m$YeF~Met&lY>d z&T{UFczG`;6Ikc9?OW6_q`TY|Z=ethV6HNdE>JB14~wm{Te|=zN7{u}-Hd4gzEV;a z$Q)$FQ>mCuFu!RQy!>EovwsY*^I>eG-&Pj3As?(4is~y|md-p+ih*Q&-r81ip``IH zmCnv=G~)dxtRDelb+ zlB7D>Q?o^gGJ)HMneQ^H_sGD3EhZF`ijV?M^0@yn2k$fhb7|-P@1_DL8W6I>z=s~pg3K8+~rbH7fOyLJHWZV)B;SD>U*rzk@I))&0c;Fdq^u-`O~PO zqAihjJC5ViSbI{}S}qxUcOAZ0Ny4IBx{o@S0q@d%TYZ|=E!9mr8=1FjJ6OP!5mtQ8 zAQIQXjt3LQGk1X$0C-*LN{P#w*}B)PlgQ>l)wEm#U%3V(T6E((`931OwhfG2YQ<7W zy9%x(i@1MD5_|A=s&v#1Ta1=(yv(?6eSF|+AXA6@Bn64^byq+O;w2NPzmeL8JJ8=Y zDo%Q|>d-Iat(>TSlFUM4@B((x{6S+KPqx^mm6`0sv?;ji zN^Ms>=xtFRs1M_gpq1pRsc@UP;qYuJW-d#aAXe&hkySTy|Jc|p;|EYYfT74jh-MLU z`3phY1fbe7b2deoJdabfpk(0r8R&iD&Mghsqsb<>ruWA_;%kpDqo*=}Zj^}|o07NO zXWCSwMIv@xijENjMfXn&UUQs)BwW7WUU2cm@aeGx9q<5opK+1t$pvTnISw!vrzGIk zv~_UEa|-~ialU0(1FCqjT8{hj{bFf#{K4dLQSGw(Z-BX}3yX4c=QOdfW3BY|fJp>d z;X>ucC)(H%+U_R6)3LcWL&xtc0SC|Dzc|(3aWiVsOVDp^z^A&-Fz*aRig)!}@bPBC z=s(TN|NPK^s|6uLzVPGn=&`aP&daDoZyYgx)GzMi*$s_rk*=hSGg2{mQjm~g*GT(G zIpJ!P?MUfIr3C(_ZBJ0@A6Oa%^4RF$fw>~NX>Z~@7YvVgr4ryxX%eZ1(E5S5I@6YB zqq1SC6fGTAY&fI$mG00ID{*{V@W2DDpYEw7`UV~h6b(Qq{?E14KR-917e%krXNN(0 zbisIrj~=%DqQQ$lstIu{ka@3JVrn4|HqGzfmI()M-Bg$^=Q;hF*p{X2WSV0-EX z7&l@+Meh&>ZXd6#uwfV^)iQ0mGgZ}RJOtb&YC2*F-S9Y8eIur{C zK+KoLt2NBUm^xc%n`ATSxG!O*Bwsk1Dy=yF6C>r%eH_S$DN1Gz4%`W<(KaroD}#lf zlxT{hAGI(#bp3e6Xjdp5>_P7IWqPWiJz{{Qp40ek zK||}QYA&~tQqenrk|@=+-JMMK_2T{y_0suOQfb*hMNju*#0ZlOGkfC{js4?P1^V)=rEarp_XVBoEr3afn-vDc@mv3*O zjqS%7t`O=VFX5R?84b!aXPRo#Sptr1)8SPA#1^c;0q*rVvrX22-GNh328ii+sP=6( z1qn!;Qy-Lz*+=zOKO1phU^QH8dqz)5n-NU|CG-1zoyY(9u=FuLOdb{1If`y1Ai5=- zil?W$ed+F4%D>O0U}o^v2`7YHWQxf6eED}0NHIx zBqReM1P^p^@#_T4F7U469^W1=^M8LzBK^3GB{|6bo`uA&UY6(GnD$p>!RZ0I;+j~| zuuu(l+y(i4U53*{3Q#AW>e#$DB+s<80Qgh>_0k1sJ>6Z}fdBAYp`P7%7Rj3Dr9azk z1VBP=ysx4QxkPy@6T`_sj0~cKYkBxC1BD53nfmQ#E6Kp&aE`{;(>r z`=?cb0*3l~Sd#jh1_rm_9I3(RkP*;!n{buO^YKTqTasX`I$rbJ(#x-i3t-+qpzgPs z!Ki^kk|Z}X64u5_MFuG*?i5p}LWc}_oJ-Xo=x%4T>TLFT?JDK#zQv9{X0+NWOAPCF zXH6}5xMb2aXR?T=1FRYyS1%vO)d&CiWMJSL_2_tCS9m1m_~}OKE@-CnI5TB?Ob3MLHax4^g5?zh77(P^qeEYmUY4v10#Gp6TsHKVqLZunn9X{W7{@h~bv=ewU-{+EAdnLe^8HNWcM9D)cxM!Ob~71kYgNdM2-59M_3p@gM*H zL#X|8y#?w-2C|;}M3E9Vlcu!_t!-qrhKOQ!16=0Q!MbX1>^ofMZ07e1>%dZ**H2_v zYZ&nqkg2x?j>yyx&deKIOx3qO4|B_7Z#LRDbE0S z>8~_F`5)7Sf{X-&Tp$*`WmEM8K93{@JMRuBcHZA@B!OJ|@;H}*O(HDD%aevlwY!R* zXT~Hz(8R7~;)mV@6yyJZR=);p7};w?1QG<0Vj_?lroSbf=k66eya=Dw@qN^D<0n@K z3Aj4w;?*a4?*+w{{CVFPtVigo_485HTKP{@@_)Juy@3*!BBM;r?@#bY{(pL$2 z*w22E=~Hdr8?hZ<14)(lIOVM3=^Br!t_Ld2f0y?Ri>iI<_m`#w>gR66pH)i!oT9Jr zu40A7G-YPBF@AW=eBuRo5?CktgjIfLmyoii2Pbh3B!+_o1fbQ&?{4%PR>@UXR(i_= z0$Rc^0-DM{NwWO8ZUGAgM0nQka7;;xM$W2f$15u`>Dk8#VZ=VlM9#$L1vnNIclhHF z%E?F!YlI!aZDmP#RScOidoK`|(hQGQ^>sHf!2Ea%^C%Y6KK}P9Q!dJnE8;%GMPGCz zxIKK((ye!cX>e!;X0jrJ*BSY9tDp;7ROy_KUh>NJ=!sR$rDF=mJ+mKRQuPSe*4{qF z9uPT1b=aX7Z`Bxn`1j8MIQF0Ybq#PXJ!2QcihX99#zFC89+E^y*eD}mpLxCIXp8=5 zWyB|yBBqj{O91Zu(b5_(N#2U=zfVEn(3A7W=6xI_+Jyp{*OOA|b9pATuWO$vXz}i@uu4Aho!DUaX>a*0;VGhLL_Km?E z+K>N&2^qv4KvDe1AkZR1mzZa!Z$3hzb>$KI*4>482m^i}dg7^lJfh-V?7i}WJef@s zb4(T#XS~ORxwwD-%8x$#>J3c(+w?E#^9+V47kroW7~S zl_PadkO_}U6p3N5xz>+}cocl%pY+JlMfs_G3A&i}g&HCQ84Tbton!M)gZRBA=^TFV zcXR`GOBB#6l!Py(CE_+7M%m!Qp609I-7*5@0fbnI4u}qHy#myza0`qvKz%`ikqZ*A zZo%@ZFWB+&2WF%%0CIUBFuYtE!l_9(?okqzZjZu|fV$h#K8Loc1#BS0MHhhK9*VRG zE=Gm|@XiH2p%wpiH$j65V5 zC{gWAsw`H-F`u$M(Gj5k=tKm@GzJ^oIw$xj61aZJ@4DZ{9bngd@GoF^(>6jch(U0^ zLYfp3j{^$UXmoA*{hL=$1yhAiOV6cW6+7rL`+28kOH@0O$GL8jTu9#y%`YkGSMdYG zU1Biqc)EW~obI4_zly;Dyg$;_>q2kt9k^9O(cS1H$Mr~kpN z%b?2B{Z68XzGdIl&F40S#(M)1`_BuroUB4{d0-yjm@I0ml-X6p_lpYmt?Qs~5VQ>n zXnd28Cz+IFLiBL&`+)(a&A#{=iTDIoS>Lh(?1x%|7%IQ7$?I=$>u5RN3N%a#Qo(}1 z`Z{nXlF%PNmn5#{g`NUkQmV|CQW2ogRTYaf#b0_4F-;bmU3C|J9XPvp0H3SVzx@#+(O35cr+XrxTYZp4Al zymi&bsiUCG3z*|lGj;M|#N#$)eE>Ku+FfE^O=~#IasK)@Y@oUfyzM{NxqEqewM$2= zeQ9D4BT2{s#@KiR-aDUY%K_3|AJ^Br31*9A9uu`#+e`L7@YW|D0NnG?%e(s9?+2hD z)RV%mi|TLwWU2{zXiSHh5<~j`RotJJZ+f;=)|MhZW;>Ag z@_A)@cyckLrEvc9%U#kT%-qx}OjpJWi>pz~6?XkO1{yp-*e4_?@x&JeM2o9HQNaF% zs6*`E43v5zKWXeLL?n9{LHLW-IX-<<}k`s(RR%QAihT3CncPoc;CuZ^kG-3+3rzS zDFaMfI1bl`)uS8#_}Ksekt}STJ-_jFh^Rl^&D5zaHxE-U*b#KCCtkJs@nELaQT$+1 zd^zQ1ut4?RG}i(d0u$#M$?9Mc2jk3Op#@tGScjJ3ANif`T2BwYsit>RoTfY&Ya3 zL|cg6LXa>kI>d1r+>iaZ2FMO+$uC8}2hn&mM%Xq~>uv!zdofzLA$)szQ;D2idt4{6 z5KJha-g^jm`P;IRl;4lM-2vB*L%+21Fke)VpMNT1L;%sWAM+xp&Dp`BbH#?FR2MGn zF<`8Hm>&{m`#s;n%6Zaw!R>G#ND_UYZJ0OQ@&@B#G`Vpp3?BS#`1x7zhaHK|5Xx34OaWg%~)(THtX0iqQz4}n|$%M{!`M%xf8B1xj`<5~YL`v0myp0vzor)&iP8UtoGIXyC?P#ux;Nx^13rJ$-F7ir#^Lesr zcP8InAyiet2i7yXn!ESmK4wt@mdB zie$rFT-AH`W#|nPER4VNt+D?Pi4h3_Fr#_jHE}{rPJ)HxG4JY|KAqQg7aXDp)1rxZ zwzn8SBdyZ}P(1|QsUm}SYT0ov_FvxHD`YWeeMC39nSp4G=dZY(Ca1%@NLqdAXW(v* zDG;<0MeDfG0B8ZUQ|Qng;W@=9GZAi9#V45; zmV0M)TI$0nkx!WvLXe6V%ymASgPA15J@{s?mKRxp@uyT`^49oBg;#?g*yq`i-VJ+ATB<=0(6GRvs2pYMh#5N;gS#35h5);R!dKU&2|fU z?mU?;><|-{AJG05uRZ4G1Gis{A1HkF3q||6HkBa_qCXR_e$e0RQ*%xbBW$rNa8qF~ zoz`kE9BD|rT<1G4%_i%uKt?vU;`dIX^9GTFK&T+wcGot~H}hlq? zxUJGwnujH-t6&LxRiL8TDcd%-b$n_+(vRY2m%lalsAH>MMY+JgJm7 zSL00<)ii@Acr&df7np0V!?&`^;^l#Qxu^|%Mzd-y%>I1Dj*>7fiK*9|6z#ffi!MG% zRJ?>Lye?c$AS#JE+qy0}8+X-dOxl1st4J-l0v92+l^?My=+cw3sdbBOyl@L~Zpl(J zcwTiQZ22`hT2#c{r4P`~E{J zqLc|q(t^qwD#@Biwvdo@WE;C=-^NlZdt~3Hl#ngP62p)^+t~MgUuMQWV;g>-spoy3 z-uL^w-{biH{&VCwI^6f?{#?s>o#%ONZ`-~N+jR z=On%Q2h=~TMw*|4SjAs$1T>WRUXIj9yb$&HGfEBa=BG5`Gv+lAJ5e&F%bd0DWey;B zia`u?^4-f8%a2;avVmV}Jfc*GJdQiIeecDzY&7`Y&E9-m+Zcf7ONRpU zA7AR7$*E5PcZ+{T~%$`Oe_hhgr*i~-B{*QIHN={_6-B?lovf>~C@uyC;DVN>wf_~dW4(%;>JcNt5$^+gqS$!( zwSsA9!`Q@Tk^MRd@w5bAjI0V*XM&Uue05%*wWim~T1!EUz4@($KMzl|td$FU-C`*dJgz65@%%7T{yA>+p?d$s<0g@-Yz3; zZKO-#I8sF%J_ep^js`N6oe&3?v9LSE#yZtHn#8_q*r*5WqUoYQ_`8{P#6fwbsm{9cA91`6 zE+TV>;vF6X zW{TxG^@msgAkRYp{+U@~PPRn_24}nwzTN#|(_Y{{sSl?2Jvwl>p6EwI4~hcA>?%dI z`739(LCdv&jAd(M8kp^IQ0!g;T#qnq3dHreXH5mu@eh;+7Mw8IZ1GkDi%zwl@oA@e z$$`77r66WNJuW7vxxR=Oro|6MV};A>hSFIYYLyvU>iK;=Lu!e)%wF3!TEiW~r70YeK zc@l7fkOduu^AW6=XW9>`W3{S?Ey9?nXYJ=yrU?TWcrR+z#(6b6h)YITP&dZdUmX&r zn?IGF6?j+0=CdnLd`IqJTr`ze@0Aqi&Xh{C``uFVri?4`@7qQdkhfIDPUucbi}4Ro zrE@c^48+x!>$~qPq*uh<+|KUlm3_yRQfQ1d^dUJz!=)gQ15JqBS)XPOtGXS%bH8C9 z7r?~|reRQgblSOwLFb+|&2+?|MZM`fgoaEi0;pj9FQP)F z^DiX;Bb9T$@H6Dn#*HF601dJjb({v%ov+JsPpTJz*n#G?4x}&sJwC+~f9+Tp)c!d22XuqP>i-N z_u77r7-+|Xs=9~mj#HxuxJ#oROME4u8S;_9gaewPE*|b#Rl0Bo3aGd+w3L+Nu3f;RmHiBGymOpT zlbhs%-SD(t{$1>Skil*SvpZW49OX1*10~IJDM*{ig~~}YvWSHHoD|TTv+jqzR$-~D zUHz_O-hBfO=+l3{&z~`C27oR+@&UiQn~g}nhb+j3~#xSmz-9;%B8mw_@g zBigs(H3(&7tKja0ss<_<1|moJ85N#!y$X*a6fP|5rpixy!_{<_N z?-Jv5uI5LiGp>ex|CvMBYRmJPS8rhE!LUIko;V(6VRt@|va_96E2Vga$#Q^lH~iM> zRNG6}8O6cvH@0auR;&H1*cU%cRBWYy4(^A@ScPW^QcBAyBnNkR$Yj;V-=$I=l#q~w zjCRE$lL+q@LQ+5=HHB5}ef03tlWX-)z%M7gCn1QHhFx7cTnQ*In;&mSgnNDJzamYH~HqNh9ZEnhl2M8wsd0Z^w)QkD*+9r#&|@S{|{7c~s8M`>4G zITcqYH1Q#f#ng-|6y3vsuEi&p>lh?QCz_i&?MZ_X8 z9^X?!Bho%4hxcoV329E%2be$)cKSxZ;&$g|9WL?aS(v|?nQjPeF}ZdFq;f5rJjIVd zO=awve=m4V^s33M{Z@EGu(ykQ~0CDz{*7SLzUf6^UFf${IF^I-+iZ zWZ`cr3;@;C)06R;IUVGqziz_y(SPA=w3aznw+WUn&v3F$8(ma8N@+=eJ~xrCnO!gt z)jeHeSp=pZ(}gF&G=S`I=c=Lshi9ckG6U|}J)p(4pSb6ENfJfv*N<(H zYvNKCVe_r8?uTtxMLCxoPU%G6E3n-=Gr$b>>PQBj5h4maaZ2?(a}B~PGY0k`${&WB zgl@)Tyz1F&Y#jH8DoI1?8o)CkCJ+-u(~3Q#3klZAp9;Y}nKBJTs+wR*n1l#?q>`<(%;0kX-svPZnNRz?+c-rDK>mE1U*;F50N~403S71j zZ$e0RoEw4MQR+!OI1zh^=R#J0q&0X zY>zut0gXvxd!M^%9E&SG@Q%`r_&MR&!+rc!8`YzeM!YB0ROEaln(~anhkp1($ptl6 zN`gNb*uO$C#^yRa!JC-G2vLf+_@cWFkf%lS)`Xcvj_~~u+AYGLouB%LNf~6GH_qBD z+%dF4-MrZC{T4}aYS`z1B&ip_nH4kA7Ditb;_rgR0&Hli=5bELoDpT_9Kr|Qt)9nJ zCHs<#t1wcW;THeams|2&+yRPW2)Fy+@4Y@z3i#qN$4dc3hS+YkBNJvT zHae9)4%P|d$%JW;Rv@;~p7_P#tDxfzhtVk?>$!m*xRT;lt>bcAEMaSR>;PS9wth=6 ziAD_qeHHM{!eraJ^*DkX#MvRaOgk>l@Q(B z{!=K1Ke$Riol=n`ZFHq5rJ2N%XHgwLZV|woVt6U9(lF`17xt48vj1vEznJ9`sUsX7 z#dF9^oax`qJKv)~`?7?eYhL{8G^^aW+J&8Uf%mKK4_+^|*B3IF#T)a?Z~D<4qj3iA zVcdRJyAOByEI<0XduWF-)!FLuVJL5i^2q|S0NZ`(A!rw%o9R{$ru6%b&s-i5D98ck zG1CCg<)HAS2Xmr^ci=XJWUBWAGnIjlQaK}oMb;w{K&13^AU}btsw<+zMUY=h44{_k z{nKJEr6%LQD{q)C#%%tt!sfl!|9CL$ zTNcN7QT7`GKI?{F6*IGcLVt&>7s22S^X}YdRruPwhX;F)uX&o3)BpQH8SR0wnFt&q z!Sgp3G4k+2OI07P+0?uBvKmM%duRFL{7*lP;H)uRPocXEYNZbk8i9XK%&67&VLc^N zxey(*?)C34me#CUK08%AuQrlx!>RnF6)6c6z?Gg&6=uUpvo+FqamE#HO8S?)+2_oSy9|EIWU$S`j_LMG~wf=+hx7D zXF&M3&vwWTHR~0=8y#duc=TBU(le0%o}n-PdZSRE*^gJ|-h7uo1isHcC*jepbN@~= z+WeA8^W*fbnOgm1ZZKdNgu88Y$mc8u*zFQ$G)i~U?%GTIO?FRqu0 z*KWSl|9}D!3izZR2%7fAVtJgw^$#gHbv@TT1BDmDlR90H8))Nq&fSc`ax$BvPE)!(59uftsf`?`cP>+`dE*(Z1LhQy=E@5zAKe z@deJH*p;tzjN8mJB+u{8zsdTqqrp{T9m61c{_+;}vjYzITfhxO&|CI!vZk^RXPT^U z9q}Es_1K3akw6oiL-hqGhAa6LTA!U(l1lcq%QBXnd9BeXZ=K6??VyJ zlmgLOnRL4)w;?$2EYuTMw3Vjr+}sNr=z6RyOPCB6Xks&C|{dEL4qR{U+ywPsMi!lUQsU@rOt2LGS_>2JW!l8CC`Jf56b{jMKEe0mUVQ^J?H zSr{gL>nR=ZC?tM5!vdVhB(32oO4NfXj$`tC7kU8G;$v2%8J-{YyU zVhk}~?~GD;>F$G>u=i|Xyf7?`VLc9XRc>H$@Ofu!&Q7x~lY|(zHcP+q1#&|*UtGdf zE##0Km^N8g00Y8{I#{tV#bZu@IVlK-73me*#4|H4J~2dnHr6R0^;%bPooQk;XtGiH z!%RLz_j9#rKGxc$(5`eV8RXic6DLmWfVK8nIkC(u^G?JcR8I+DT$Y>zbHFF zDj-lU2pY=>1AF5?H+WLvN%U5BuY6nBAinRdG~>m~J()`|05Lnn~c57fNMfF`D*8 z@5UJPYzGpII*UzHK?}YEX+)BgphuO|h9F%Ba;IqfE=%nPe1)3oT|5LOA+DXe2s}=H z_8e21RafZDRT@qFxgjh44hdX$nsk+Kn+`N$&kUOqL_z8MmXyB*!bevBLtOK~jj1P6 z5Y2%yWopxE>D_nt^|kC;p7)Uv4rElkT2t8ejr>P3m))D|uu<0aJzKi@ycS%~myTSF z#xXXF!*=@#K^3$*y=F4fCMKRW1b;Rqg9QVN*D%|Iy{Gb>3DRvTA4r*VVvoXa4hna` zk+7%BI--6y67`pk{9EK`PbO0~=N!#6e;XkAO&TqBTjq~>DVDW+-QXH#J$LS0G^x5E z;GDSI$&1i+c7^2oyaLZMIYOJ?IjBNxNANv#l!>;b0fc-!*rlXQIhcD^1BjfBnX`Xx zwdyUPT&TlX-(=j3g^~&V8lgM#&EfJTbmkL_OeH~Be9@x#J`R3J zM^cI=+H|Pm=hhZ$S?$6}vvHo7>krD*z6MaVW*E57FmAVaHhqI>&xeI%x2nQ$#9^f1vc`fIB}26Z z36Lu{Te-gRgy4N&y7m<7EC^#Wj#~)!3rF~d$CH}Jp%_q^%JEK-QxSM^d!Wo)y z39bA+x~8vv@1NcENndgPDL@GSKwj?$KlDcN@qgVX*RBUH=4S7%smN~^^Dw1h)tvB3 ze5VX&(aB4jf3%*q(SNV~@BuUP7UOZ7_Zkmx_gAglyvGMcx8&#+eX)`1N>^4+dTwGe z1>B~*?dIAH43P{Z8s~vit@guTpS}PWn;OD`!VQ&(_;dydcRTJM^S>J)z-$XFDB4Cl z0EcN0eRKq9)P^%PAb2oHC9Amc@vsz!sq}ir)S}{H|E#OoZ4yL%*WR_6r=jv;=bXVP z2Ws8dY;!W>g>M*2rV(Rz^AU4>a|wHJK#0eTu(Q@qdlGZwEZnDX?DAD$IfA6=cV&&v z`0uOUN&teiltcVs_g9-hcI{22^NM~+Z6!cw;RK)=V2Ae}HJ1`9r=jmdQd&n#NIe@j z8nu^AgXFe*w>k1Z13p?03)z5wwd=tle1Au0i)-MkzLCtlJdA z)V%I~{8cwYcRKwma6v2u5~5esA(m_T-^pYl#P2ps!9q^{h0ipz#$Ep8aS362} zgD4rjg8B`IxO#G)H326KG9iO_M)+QBu}cF_UU@a()j)-}tep@pT-ivh=PH5KzWmx) zdMvjC1tRdvBnv_LI_w}k_QK?Pd>8iEkV{lEKkA0*M`S6xCswcorV2Btv$|BYzrXK0 zJDX@v&{9nNbc@az00x0lKI_lJ4tffuxl+Vtkhs>kj^%)7rJ~&vndvFdhg`97LWwD` zB4z`(2)%F5?w;9izekTE9VNsb*DQwqm@8SsM%&>AZ$8~K6gc8FJt1#3bxn*l^yIu3 z<(+-q%snib06P#B{%OpovFgeiAga9c^?t1$_yyp6|7`2*LG}u zd9BqAEakXcwecP!ir%Ok2{585woM!=FthGp;x!pem7@g)nbsp43tiR1kkygr&9>6X021A*@2dRlCwmKNx*?% z_!tZmapyhv97?|fkCkQvrw%zg;1Ke?#P#`*Z3!x{OOR{RMk)c98qB{zi4OQqONk~i zQhCwr#(&GO*F~_hvIU!0C1p}Mi5DFxq6d*r>Uv$drC>JQXfAG1*68x&+IMZq3%_ z(jR~is@=?bG8hN!=#@GIQTQ%y8~ugXu>AH0h@^A_B(hIo7`qfcg>b2QiZOTI zAb*m##Pmn!$?Dwp94D1&>_E*#nO3tJjIzW5k-uCUIE5d;4UK$w@j8|BF;n9Pk={*x zZt%h<;kzvhUFjno9~-LoUAD5U_<|AliJK~pu?8+WZ$!n##h&ce?PQ6s)}`5&LJ z%anWF%Vxk#x?&_)M;t2gie^1cnkf@H6ZvMU!==`+fn22+UI*B&tI+l9XGXjF`{Q8V zy!tE>ckbwB(`~TomEc9~K4aFH$HL9T#T_P1-&A@M`2kE3mOxTg`&L6l3f=H*GAV79GuE9d z^O<`=TJ(Fq?;GDD>a7YET}(|msL_g^wxfGa^0eEX)LU5Y5$C1e0KSBFV6o_Vuj0>? z@xe~!+8pVrfLBm#qCJ{(S@!@0*iPEoBkQ(l(FQ0NF-S#pOt1jDpO#}TVD>2c@M&3t zH1A1IZg2B_;9WNYpbq`jW23;_rEDD|l{ehpZf;xvXpK^DnzEnnY%Jj2F`#wx@mv8+ zqHknkoi687s}J5auQuCcL+hrFF(14-x*uzr{tc4@twdk4?mCSdF0GN+?$$WQiY>x; z8un|eo3sp|T=P7qJLC;I;kP!jXJGE9=0z_C1rm8p-apfS9$3+r^asK3=y|8vA<=7m z#iPJ{^efi01nn}CXRxc6DZV|ev43a2=WY}%wMEaav?wDhPy&#agapKsHM`HdrnpTi zV6w~Aghs>ffEBtM6<<`~E?E&fAlJxK>s453qAN8Y zCMQrE7k)e6QZO~*il8}3TP@n0DPoV;hYe6o)%BY1CJ35%pxrw~fbEfiByubcV<95( zW*R%;i`oAybn8~G)yZVd=1;N9^E}K3P7!+Z$V#33Qa;+T`8Z6ZcGmQUSb*VZ$&%Y# z%MXJFYkC`Y2qfL#H>bTr)RU+xRlzxCI;AXoW-L6EjU9ut94dx^^rTBlStUjJEoUQ} zsJBvCrYI#%vK-X{N%fw~$&qOe78Z>L4t0*}CVU`0G4Z(GFA}X2xH6993FP!`3YEg$ zmv5k?HDJ$iwU>FQ=t5~0W{tI0=2puY&2w`;p3))trhnO)hOy`eQ}$R)kjUFcAS}D2 z?Bp-~g1Ud1=l`BijjVu|CJ%$2^Typ5<9Fd_^`5B3kPB<|*$QAzF`GBa#-fu*U+OSb z@8yZkKg3-}iH249+AGy*Cj0Df+bwi*PHZDFc0~WY^m`x=cNw8_HwJK+vMykw);rvj z4LI<}j&r>%;8Dg|J&t}vF?u;%{H$4S^JWGYcxHE7DQ>R&!@%?he!O{avvO|R+E$QagB zAyDJTtM&=zWL;EQuh415XBKxpfCu;nOBtBW^Oey51nIPpi?t{Cub`jz9Z!6V%Wnvo zflI+VRfwtgnqR>Nj^y;80~62^G0_CnC6OCDQ2w&^U>fGx+L!ba8()Wfj4IDFzI+h9 zV|g!vFVRmRh>3Ycr|ZYNk9b3YPGpvKP75&AHSk*HG~~4uyGc+#QaK*~?fEOz;+L$o z<@#JLICiyRB%(%MCL9?x(T!VEaB-=$Ef}CtHV>MR|=3OG>pXby*suw+m<|)ceCP# z05`A$Jz5^ednJsUaYbUa_T610&9Zpl?Iln!_|~4Eac;rSz_08=lQfJncgVi-UU>PN ztTo0mm(Uyom~~yj4~bnH2ZE$^c<|P-d`HT7CH_(l>N-HOGC(cmqOup2@TCKXX^&|a zCj5cz)w2(kaKK0%Gd0Z-+r=VZ*e}lz#PH7` zlIzChabJJLT}44NeKBqV#7n9?X)H914F&QEXP)=vCIf?B39I^IUthG03MaW)-+35J z^0>77hA^QsuBPZc_5`+dT{7sr2uOup?@#!dL%!0Ba;tADpIjM`vOa#IZG*-7=&+N( zdjv2Ox%y9@3Ae#Q8Xp*9#V5?9gfVo7ih>Y3(p}Z-9s~bnFT>`QT6g0s+mQVm3Ki*4R>;A~}Ocd@;Q+8Ki-jE2G3M zzc?Wyu&W|dX<}IJXr~nQQDpYb?^6NHxjbcdPa;hDKBkz_B*mQ(=sXmf&9>@a%=lsG zVP*XlgjZ_zXu8k+N~E<(&XZmg3Lj%3c;hM;xADKc05maGu}chazQjz`q0pV^)+%OO zsT4nZFzdlb$g{W7BpEwC*#wk%w2yquMS&|R-6oJ%x<}-Axaf+`%rrGc^N>eP)gK>G zjJ=UU!15XeS=rc*YjeZ~-({tWJb6`ge|uTOWK$f)7lK`{41Z#-vP+V!1WRp|TVDg% zGXZd|Q5mv5hDd=6m%ADD6Pbs1TGDiD|b80e&!WgX=Fi!G)UgqC!MIY^P_ zr zX{XJlHP@_PBVXCmlYn&@A`Kw3Uq{U{d=)Wocqm7PY&O`KcZ0IEwpnu6n)Z%($-(QN z-3?DqOZ#d%u0#=>dom-@*LxhK%L?vsU;-7xnj)-?I)0$gc$649gU4giul9iQ}PuEVr%C!?#i9*Q`P=F7CiWhd&>AdCfJ)Q=~%?KG-xT674 zTlg}eNGXZhcLGL_(bbwZKIG(c-iL9KY^}ao&Kv-DkyxrAj_Nrm7ag4e2Px%K>NZiu z6u>X_1+(m^(`b6zlc0vK4D7(K^tGiVG@2bB{tCaB;*8etZ)z3sT-8$+eS8aP7=PPr zH`?ZcP;KVt2e#3qUhG3JePYax!N5IMqtv*w(98 z=C4~ki#2v>DUP1Nx_0f^-xKz_FZmywuwNw0>y+tU##FnWo3u>4EwtObkg?UNiuKs3 zQ!5U=e^L4Vpz?^81_XmNnZpxms69e|Coeok9iyn<4+GHI4F<>%EnqelM)li6aTBPr?=u!%B%}n4f z|8g3NBN!IjkKyI?f|K*VKA(SEIZC{X8tvP^VK`^=<>m)HOKb4@I_J{Rt+7SC8wZzc zw6WY%p=LM9MG>{@rl$6sPI{ny{83!8wFwyWTV7UQ2_hN4yV6>v9qyaAVKvgfvHc}? zB8P*3%zCYzt2?s;YiSG*)K>oF0rVQXyirrD=8Jq>@AEXen(UJ_KXtMwf<^0=I1zns zd7Ye?)YZ`|hY;_7_2wf0c_1YC3Z%GWsIUM(b$CH4<*gsQ^N)`GZ>lm5mS>SLj00#* zX;dnr0_iCbqd;2v*BAf3kGi|9O53{O+9tzA+t|~P{V#c!pg0Yi9Jy(st8^|lHqG>V_uwp8&q3 z*;J%NJGQaV=qzM+P1MK__vS?BwIBCOh4N-4(Dc4~{d&DGJ#2ev91j{*x02e;Njk5R zsE{r{O(am}dz&0f&iHXZ#{hXtKhIj_DE;~8iMJ%qn7&@hD;L55I${ac)6bjQ@n`vn z(_fhdZt)&Ma0T0Zq4Rp}eFQD^1b7o)Xe@aFV)0CKZ zu_3g3+i}Uvii3_~A~AB2lz!P%P3M-cNqKK1$CPkgzz2JCmA)|@Z{E3o<|r_gHI}jl zUpdXz=UqBaus-{Qk#afA#~S{=vizF_twjAlq>1)Ks``4>0GoY=Rkr@hJ{4fbJz@w3 zLA$J`q`wZ}56Wn2j+QEIOE*|icu2@}UUO((_B-&#+l(p3ZV8Mlad`zV3ugKX@T0Rh znL>g|z_3%W#C3V}x|w+W3wpaIXpz;xh;l8gu2vHSAVi+RB}jq^dXUxyER@*y=(U!S zhxh<^E$42dmf>v;Q3ox{Ba*F2-EE0tB0g#BWH!k=RS8Y!`P6`5879dkr^%O<=&cmg zy#pnFbS*7rHeiSBBHG2(!fR8qcBGp6K&fz*BYxB7K_tAjrOLJSrnVSO>@8c5jMUp3 z*~l0%RLX!N9|d&&G|3ny&d*RZn}`c}{NoY}yQ()g1)ID?=5&@su%?Z7!gU>f_- zJ?7K*mtI;Y&bOGwHlMxnLqBw0gLmB8?ug{>kQTH4Gx(EYl5G|!l|R~izOl<(rX)}S zYNpVZoDz=@kE7IcBEguxw)U`_>#ze1&)qNd77!0{2$gRDrC{6)gkglg44uqiB4vhf?-!iaVJ{x1cOb8Rh$32%@ zr}N>=HJB3j-YIO)dtAjVgy++nMAB}e8b0zQDiJ+!MVR%e^w+ZhM8U9$J})e!-Di=J zZqOTw9=n~$7x^+9_>i@Cl3mWbsQX>dMrRE2P@>%k6?}RrE{BAlOYIgK{3r4LXN8p^ zXVh{~vU78v=^{_X+W=5jxkc|${!Pele?i4yKCZ!iNhjj!W=~41Zhgu2y5ppT-24XC zT^A-%91W-~b3i--wy`2z(|MpG0cG%o#9OTfjzxjl&wbRqw!Si_Nvym-j{<3TX=Qj$ zvadBo;`C0~Zsmw`A5g}0LF)Vq$t!T2mr@`*Q9*}*rV0oA6j@RR1n9+Aq`!rUq?7^t z{FEzUfJcTM(g=V|3AsRAFSK+NY9J;o?lT=BKaBR?4N6(+Zh95QS*h>c(_?4!UaIiC z7<^b_o@jpw-6_PN7c4;*>5jA+h}{!`%>JB=SVQRnyXO4x?MCi^xrz~7E{zhsb+ep+liIb(_jNQfs-pcvj}+O223F(~yj)0b6hHF_CNLGT`jnbGEYsb85wTW9g~GZ-LPH zWJa=Ip4Lit_3O1mxt05zny|rd4koi9UYdtot7^1pw}2<)6mrR6QBJM2m7OS)#Wv)6 z8!{ZfWmgx(=)P)ra$;mg&Mn_sF$>58H%gw?91*$P#9*Sce_~si%rT-*<$-)z(A7!w z25p~Y*Wi?#{rBEmz&N1Yd?(?feE3d_lc#@1s}OZtyl~R;K^!}(q2W#J*3GP#o6ipR z^||f?5#D6fa)S2CmdEz`H^8PmDCyLitI<8zJZ)hu>g`c|oE}4SP|Xv8a6ZS%>gYP` z4vTne8D=I_{;A5t$%)tWRpApZ)1R~v*0v_h`bv%Avu{37uuS8eRNqW2G{zn&)hLoX zRQ|2C{|m=LEcYQqT9?3!bl^g-*HG@hKFk@bA1S5R`?)35<*=RQHBjZaO$69=qy~IQ ztnh?LB>d6!YH%RGu4* zVVx&7g^4#EV~{ps3?7#6&0Y*ufPoQm5mJ)n|HfXWJkyxe81WGgNAP{!*wNFA%h#&^ z9z?Ns2qG%Ew^AeO{nYE;e!KzgIc8ejB+@Ps_4@o8$s|py(%gK!OUMe>ms>BfT<%!2 z3tsU+QKO4QfkBa8PCsJ>am=UkV938A%XvyCnQF4(>xNkKqP0TlYQo)|wWa)^8Q673 zi{1b$eO~>o(ED&kKt|wx=0@fB3Sj6007Lhbt15Zc!GI8SPw+HfVnTQexNepg2mJ@@ z=9fBAfhK9Kgd<0{f{VkdzcTOkMVZbs$(B298y^m{)W?+U69je2|b+^BoFo_fDo`3y!fuF_7V7iC;2Mk*?YqvC;I`=nlx z?h#36wiT8a!0ckGPpl!B{`2eX0GDVya;OAlBI%ft+r$Ts%FV>oU%q)(TNjIck_6@f zkE0k13fcGL6{MwX3q7|7Y`5t=xmeoFMtRtE#!3w?tANHaL8S^^L+<-et?(HZ@Y>i6 z3F`q!XZqtmlyrZ9LXgX=;8k>1@5>LKL~Ij7s!2TnbK8ztO%hv*iBHsDMZRHL0kuYfmC=YAStr z;_~Z}YxX?R!2+fIt>LwrT%UrVQ@VHRYyG$;3zm#k!Sw5J-0RP#8$9PfuE$yzwFo=z zIhVaKJn6DiXz&^(#bB3-7?24p8MM5)8W;G7E!2gCGd($a8u2`|cOeF91v}9O)|>EB z4@^`$mohLQZpX8c=g``70p%|!`IuHX*2R~1Xc{^GBHCW}p+ zC?yY#*&H+^M@NZT*^k}d7 z0;{OQLntY>D^2qv6gKI_-ncI@9b3{A7n|*xpPRj%uATM8xQNd=0*vEqUhARO2n>ki zj)DUn^9mpkE(P>L<{S@Ty8sRLPD{iimvq303*iaso1mTX!f@ZPG_4Dj5x-8BJTAjA%s?sUS1_8XK0zyEDk-Uwz>4GRClY{*cXGz>y61I|y}Q?uwk z@oXkq`x_wfAAJ;a94H``usixidPAWiqo%Jqk5FuF-5ADsAFCXJu+4*u9BDOAq`692`@G8|~Y4Jnu?`2gBs^1ty!&H*x1(!Z^G zcDhA@@Uy>7xPmC|U#xz)hFKai6{m%!JDtHLn-Gb+%RU$0NN2fBKb42H_kEFTvj3!s zO-gwj(F001+efb?!7QKj3oju3f4%+Q9pOc;V|Tvm`$j|*NluOGf`~de4CV~-eZ!xX zX|&GLNeNRlSN$xp?s#;vtt^|)g|XRrm3K^5v@~a#7{wgYkK=E)NH!jjDZJHPU?bg} z{gpzDC#x^pr8$P*IVKQn%K%nQggMv^{jA+ui0UhzIL2eNel925SNn!Ru`>JsR4KrR zl8i5bD&@a3bN<^KFFu%hc+DYlaMrddw^cLW+6g$ETxA}5NA=u4b}gPQJ*7cdXewnC z^{jE3L97*KpOhrdmfM1h5f#NGe%`+b1$6DV4_dr17v1vfAccey32)%SzSsjcunnd`F92mkS6RB@F~F(77dPx+FFXAN5F0f#>Q_jlLl>*T+L+TcKsa?H)Ym)X z|NM7#0#0KQqTByOX^eo(Qc-+SDkr&Pj9uo!I79&mN)@Wm?f)CWQWOwUZ`1tNg`AwX`B&79 zJfT@I_%em;5NSxc@JUeO-BW?q;($1eD#us8OMqRrFx_Xun6>AiWx5#&zLJlI^%IgG zU>~BO&nDcnd!?k0pwFE6LiW1se|;7(C~vZePW(d#n7;%5hBAC~zR}+~%}+RloYEL1 zsYCW^Z#l?I-OH3o?e4qu_2dIZ={Z%>OnUxVJ?N_nnJA{-LKT&3zuv%KbRMmUjV?ua z{_kN6`u}r@zO7tA+!eTT(VvMQ7=}WrTrc_Ap7yhvdpMV4^rOA+D!$fF+JkaO_vWLY zfPQo{W`I0BYieiquiNve-g#m=&I4C+J88jBv1lFjh$NhI{b7c2w(dQ~)XuJ~xBWJ&TVnKGM&yQPKgf`+ zY*O$R+z_h4)`!4CWS81v2CG3LHogmo^gnBLwyWvsdlkV|jKa;b&wlJLlk}*W8v*-` zEKuvki6dh^b3@y6t4&#O?7=euuhr&Bl@Dm!B_?8n&qm!f+(`f1SMnnG@SA^$O#UqN zrMocX+<+F_J*ULO-z9G z2QN4{y;Bry+A3Gbqt2OdM?g!iRb(ODuuPsv4i(SLOMy-ItfoBIFP!SmBGXHA-~DdG|)rg2=&b_U9vV zvEM{0wkzjItE+;pHS%K!qNe-mW}Z`?+vd_V)4=jR4jNE#`ld_fyD0fsyKuAr@vLOR zd=JgriGO=mA-@ekp>u1mp1x8XD7M4Wq;%)TO(x0(n)yA;Ph`j##B{5V-KcJEUA=6k z>>t3GXE7_3Y|K+bGylXoevK7I8?m#8;enhU!sNgK^HcO!M*lOvDA@T_)6VqD$KxZz zz#`h0yOVQv&#r{AtKQ*ouC$^=e~%X)Y48FI;m%r^Eyc9rt)bhUQKF-p=fAK4SRsShN0mNeb2`;G0fF(Rak?YAj+JQ&sCQ`whpTD(#O?&~Tt zSy)Xn23P$j2KSof7wtE40I@#+b&8d6^;Vx7LAjLa`E0Q7Hx1j`+1PaR>7lE2UX?WG z^}l6q8Sp)Hlz(T673~Rz=_? zH^nLu&~^I#nO(fpJ_#DUvk|EgEH8kIuK3ReN}3$#I#*Lg{sv?Jpwd;j01$g!o~Ww3 zq(2Y#B=s@jVs)ysp8IE6bJRVv8RTiTn8^ufO*DwASf2W^7~u|n21_Tjve`&u#5w{7 zx81*D{G*{1*Y9_TvrxD^dWy{MD?zVn61yScGeeWn@ksN4eID(cA0kp4<0QPm!3L{) zWkj?tC0f_9HA%GD8{37zxb9YrZGQq(XX(-O-|)vjd%N2jfF~`cF?wV7<=-RWd98mX zj2RAULi+pY!6E|*@CmC?z{TI585oi?d>y;;i+cCKS3$d5g&k zsjZ4Jmt6ur^G1OA{2q&MBuekld39=7n5{vEYS~D1nx`2O*lEEk_C+zDvpLtu`D%zM z(fmUi0-8A%bNu=>sz^w?Lm%~aD01dL@) z2_+fQ*#7n|o}jnS({fPFT*>=}1eA6DU+wzBaQMImb_bFDAt^CdXzt@l^}#;bKmpGl z>k+fqJfb6=7|N7(U$#thepmy~k&1b&?h4gfGDyvf&b9W9EEkED!E}wte;@-4O zRNd380ew_{ul}Yevmq9~&u35D=67g!WW;rN(s2JvALAxqUQBwHFNNtF*m!F~x!Dqt3`N9Vg8UHtt`l3Uky zO%TPMdzOrUM=oF&$mz=JZls;ezv3FlYP%`0AXa*hUQh4P4cNP(Win*k#ap!4$~+ww@8&}e3yTWkH3q%9BJ_NWA^Cb}k#vgDhus>5V2!Ag5= zbfts%dUor)ZLV94O!E$GDG+w5@Ge*G?w~gMG(GELv|GkhW9b~KWG6dd)p$wNW#dia zEOO=e@mBu9gM0L&%lm7pm8X^;vi%Jh|6vdjCyC=TpfR!vS5C0T>IWGpd3zGSNged|4X2Et)@);;`QJ(1tUi(gXOK%zD>pauW)XUv{B}y0 z$2CquYREYxc1e=(-F0SZHOS!N?u6=IapFzut7CiY2m5*W&+K~|lFg%$Y0bl|V;eE4 zA^ryoc?YBtpB?D7pw_i3~trcD(O0^XQIC$@8AG z0ZucsKcqhWkCbL`4~XFU%DI{TUYL8~*(-(&sY6ix#tRhpxDz?6Sayp0T_Dt;?kEW1 zCy6I~&78i7w2|&8It4s5oNiOFx$K5OTN`>txQ(77YNOkolbnt9KzQJ!rpj4`7aaZ2eFdE};9kB+Kw zZk?p@QQ-hKm7uiWmHxA3GV}ai7CbDl*Ew|WC`x9N9Q|h6SP=a^d2=ZT=Sr;STwJGD zCJNM*9}|`;S10z6opkOF4tl`L!(n0w>{J?#l{{Do@~_v->MJX$SQlBd-iMBnSY3B> z4x))lhrPyj>a|B8;S!NPhPr{v9Vy;BChS)ksOonsXSCsb*NcinUB@Q&@k2i6eXx_e z86542!mhcMgKlZUDbY9z??H^MKEsVu7c=s~)fWOPKV@pQus5Bzh%v6}w>$JuwsW4*usbGyrmj7mr$TPS3& zh(bp8zRQTr5VAK(Mp@aTtjz3rlM)g)vUg?g?Y8oJy=nNI)Au}n=ltg!&bjaR>wUeh z@w~3<`NUfj>IOX7cEmSrzCTL0*~sW5i(1t;Ee(lbqCE5`(ay2iQA1kaXB}@)isL*Lpm|K&2Gk; zORpmws%Eh)>p!X{H%F!?+9394qE?5%fOvD;X48m^)%Pd;F6kQd$Oa(XSAiN{de-~- z>r576^Z2G0neGJ&xwBjTHT&f$gwk*qNvw~2-rn8|dl$-S+;tbRHiy0;_sB+AK8G>< zHl4%bZi)dis%eX(^{pq@Gck57M0=~5H0eiS4m=MmPXU~8L4=Z*TrmVh43!wbdIS`? zPQjRQr(T%8*mcU*pPpsk0BVRUTv|q*_+NIPu5kI`i`%lX-P^%F?sWs85vKqe0f2Om zpLSIVJj3P&!X1H>xIa<3>wR4H44d9pwLEfbW3Yn*p{3G_oCxHX3=nzr+lGF?2Z)PmQWrR9|eZ|yZU9Iu0+L>&hR8c09 zY}d^sa%Oqkj^Df0cNPAys(2J^dwtdpQgrK$8&Lr97Nnmb-c|-4#@mRTfFie5(wg|i zrDz4W#(49k;*mn*la*1`E5!>dta&z(U2M|#{XG^_WZ4}=ckrzUnq{5hm;B6fZLQFv zBWFK64GQuzvnsA}g1d|toM6fAlfprp*KjyZH^&F?g`I-CNHeu#{|5C ze0=%{`9WMC+y*RH(Xp7>dilT@w(gtX<-Us3d4sy;0H|Z|mRGS&ql}k*nEuA%jpiAh zZK_hEFSqbK#Zzv+F?nyzE;9T?LqH-k&yCsQ!wJ{DJ-{MPSqq8s%vA>eOf8I&OQI`O z$emL6@df0!?ka>;eZg$?YV`#hdtr-IPB4qGF*mG9M`s3}cZHRwY=73+jpmZAi_51W zkPfJ8*&z3xH|IXEa`~+7g>X7%&4`cI+v>mIz~R)?yt=~#q|*Q`w6`Tthu@lejDwb8 z{_>ZSe@Y&@0jt$-On=`EPcDD4J&;1Zk;#n0QKyixIUPTmQ7K*As%@yVE9o}- zQNJs#W6~=iRtnTB?8tN}v@Wc_6!*uooGRXZqBpx`SS{oCOn!WF5T-h zj?>*Y)qg|IwLO&XHW|3(HczyaBRr|I*=*(R;6}jfvgT^(;v%#dl~uKJHE&aMPLKFJ z)oRbYTQ{OIt0NQ4!lYfxv1|UU;OnrmrmRo~CaTN8M1=2+{rSn^Iri$^kBT>H8MXd8 zc042pqO?PesM=BTr5(sFicm>spBr8af)>%|ahjf;@t(&$H2b&rn#ve&J)x~(;~BCK zREFEXKi)4MBt39ltU>j2^FhZz)euVHx$Z$JlAUqx8Ktq!lYkcp!;b>$ii$M;D5{5$ zZN~b}5vazr6;UKwv(&kVuv~Q>?8Xc+y6*&9_7~kx9?22iR@gi_vQw#e;b%V8FjBhA zzUeUXeU-YmnO7=eOK)t`jblR@TpFu|s;vd@3wuS8qsZ@F9D<}Js;pL95eQol&*IvQ zdRpffPP*^gZY@AWF_*j}E!v(K5$tZO@7D@fT9~;FEz7vL# ztk$Ly3?w`Jh%OcJSGmVTwllq!=4w6n7B)p4ycPVY476z8HzU>sjLFd|NOYe9Kc&@p zT_A^@=w@I|%8iB37j`_rgmBBw@<%%kmrUpRS$EozPSB5+v-FZ6J+D>1nIJec^4;D2 z%*?pk8#7PQ-2jx&oae^w#D(Fp@6$UYEe`W4m?JyxtIDmpJS8@p@ulU9-&+t9Jvv$e zt75h4GT8sikLe-i0I6}rF9xX|IjJ~)$Z}q@lHhTR*Tjh>w=n^5*Gi5K)ay>TDuNEF zlQ}5H)|k#?EqA{@d>KeO+*P@9>s#0*je*Fn>j#Yj696M34q?R92EoZ5(!LuYxw$O; zDUZ0MCJ`jr9RHhSm$#c{`3;$zU-S(TEvm}d#LtzYQDdW)G_2JpTpbyzzf#G z{5&{9y#6wq?3v2|0!$X-Lg3K=g9QbcyfbvT5Y>r(Y}w1ixA>RphWuiHVw@8$*yk_6 zJ#P2JXm;qD?zdvsV^CA|(ixbplvsmKbM9D{uKjUxv=8{(Ger3u9EYB$v&8<`0`~6d z65EN^W(N`LuaAfvhOB2pp5#{RT5qsyR`7z#xB4F4NDtfzvFFWE7B5&bIgoAh&bVgm zR+91f4biIhz17YAeZ?M*$jmjW#qUYl1rMWRyey(X7VHCZK!pmV$WA)P3o9Ty)l4fhfa% zK?bFL?Q)c1XJ@-bsJm&hlRDI7uNP0Mhj*M)cC{+bE(x7Y2a{(IFzp6vHZw)O>4qI_ zkkx%Ww4~Y}kbLyj<^DY64i;$J+P7m=%507`ky?K3WQLIW=-#}dT>wG%3U4$@q_zOz zmVW0zA2)ypSb~`juRC+ur;RHm1Ea?3ZI<8818P$Wy|w32mFmcihHuTdW+M6SH6zZ6 zs0xRK*m?ep-UQ@QbVwyg^jpU3vC8FxYiP&qO~{5DK5CL-F5hG%N{;Z!uqh- zL%nL-ZlS)XM#)mrjC>Bc5y2tXBxHgm0N9+&oST~UrXl1+vsnMimx*BG((==+>b@d4 zXqJ?(m`9OZ!1tO9(IjN)kp&(ZXyU`d9phY*eyrStck2=RTXBjk31rt6YtF#JLAf1?zvD3SG7EqLKrfXZG8p zM9AFFan7lJyBp6@F=n%=Y~>P0dG_oj3bR%KEDR>@)$D)9-_sk<9eg17$PJ}iTDiEp zj<_`~i}k-}43vh*0HQavj?`fL{hQk88%f{62+RxVsU)`_5UdilDd#2l480<1ixua1 z@e`*MW+_>V$YZly;TF?g(I;R*7n8o_Jzg>EBR3o+1%Ij~R*U=*^Pdm(+m+k5%mbjJ zy3MTCIL5hqez^E^7s-4?Y`cCApK}D)-GSbzjDZTf!h!L6V@>^tz>(|{e%r~4LbdF* zbCDJ8VT?lyLxO{?VD}zCpDi&3sn*6PQPz_Q4sN|8!Se%yT-ph_Ofu%vbuUi*z9ENL zP>eXpca-xq-^}U-=>#s@9~Aad7k_Tc1sG#GxL(#hd$Q zw6?b*wk`TF!o;ch0csKyipT?NG>;ECCF=k6M>8dQDu~C)s5#@I3U5-K!uS!68r#%4 zTt7%8orh^6hh;<~0Vn^MOG^@1w6dssdQbq6T7%BGLM?LgUw6iXP+(c4rb8|x@nEGN z1MZ#TXF-V>-@sjxuMwma_zTmlN_oxJd`}67+sh-kM!$&zs9KWJ9L#$mYyb79g8iq{ zIpr!bq3?gx!F2pqN>7?h1vuvd;E+%nSe$|(VYfOO22#RtYeL#X`1h{y}{(*~!`UVE( z1;+nrXvfPXfp4KNDNdKYN_pG4J)z(x^%K~rSP~&r1UX4X?VX$Hl}<_4$`^oI+h;(o zLE3hus|cD%Roxbz*ma_f3eW&JJxYhh#a$FI4C(<=a}mrPqC+46>~Z}ictLgd80d9< zqdVHfODe?W76G00JvAaB6%uhi(p&KHJBBOB{;*!Hz_0vZMB}E-Fx~Dmw)fp8#eh?^ z%fXae_UbU)D-iF+CH2B`-(aMxq&<^D7u?}6y1NVdk(%;D3F>83Hv== z3F1sELnu(xqQmWfe0a?>qQqisdnWCY!=AhQ1$+)_rSE<1P;VE6D!79?ZaAxj;Y||? zrbDu%8uJ=h)TXUlx1MC{0dzR!gtOc6E#`MXoNf{8aK4@UpQsdq0W+aI?6=#+fD6Qm zt%8lgQzC}VWsHrfBqxhO2R=e<21|$gw(v{AuiQO_p0p%hP zGW&qeLz_n80y+9U=qEy45xoEUGr!ovs#`2kKpt=b+D;e58A5V;^zo-RDXpy!TE3jHmkQ;mGNacCpuyH0AdU;vYwXTEK3y7Dh7Wd7U;*VA+C{oLRFB zpuekiu&hRZ;(4On{>ygdm($XuIVG9QV~0f~F!ndyoZ~%aO|^_E0G{+ZoGqzl7#%=b zWX;YNy0au5yIZWJGIihvR2{OtVE~`te30X^S#B5I@2CHxb9hC2*?PMOB*1cKy*)Ti3kV#k zFU69K;4z?N>Q*01kZrsEULUUExtXYYsz{9 zprTrA8p;4WhujzY#Uz7VqvpRvje`+wouc=0t98}JC6?A)X%|O7n|(NfmHj-+(BRt4 zfX|j)GglXi$X4b@N*RYn31{VwBMF^pE*$~glJ3Hv8;yQ`cukrv(~ANc7y*@kH5kS_ zbpw!AB3<<^2xuxV1l*CY$|uSI>d|=xYl5;fW|HOK!O;O~vGk&kWl=U~fkPDm7Y|V7 zL5Mw=@#nP~hV_VE9<^T>Twq{iD3bl-($h`JB&+R*r7l}|V4rz{kV+ub)I8lzsSo2IaO0gsr z{~jlfA!E|FT%489KtwNq`e29>VRE?Y0hV+tll$H+ECFtSwzqpC_#+SJPyN>LJA${8 z5c7@iD~$rH8-nyUfmX#37_ub^n(dUwK?|(6^Z7z!T2+oP5fy%z}#YvGOgR7f z8k3mB+S#lKU`MTlcyRPNr<475;$oY`FIYy+*3Z9+ZL9i`JEuNpm3smq$m{Wx%uOGhomBZ~0r3EcuB z1L>QdzGAF6y_@I3fVwOICeI*+oi}{4ERSy+n>73}5GzL3_M#6eZNOwsC$#80=UhSz zcQHcn1|3NsgvFA!$kCiLOn6=amoS}1Tk?GgX+RCq%y9Nn7k2UK>#hS<@8at$QtQWn zIBkROKxkq&7o5uyA6oW5@EB}AH2bT@*kNFCFx9V%-`ICGeCy@=rC&$FX1Dh?pmTVWknHV|XRJq0 zd4$4%iKcD$gbO{XytS;)N#9S-NaOn~1qE)A7|Lqbu;82|8H>9{2N;Q`iXpaJSeTx+}zocclutD}Wl9@LM$c6E6)|vA;2d?k$^L6;)2(LTqP?ANkCm z;cxUQ^<{qk>0{1et^26;lWRLQ7<_SL3*;VpAFI;I0D&akQ5EiLsU#4bKYG)ZJQjbB zsWj7g=2)$#7*IPBbYBn3HR#jyH+@UN0gaA|h(4<=c??zu(!!v@>hf=A$6kh<=bMG)jLali~`cSAVze&F7ckg87+qcpEVAAjBD?j2IPZ6J`5+>(dltVvt zsRlDB>;05QqDTIYwhfFWUG+Js%(Zmi17V|R0s>4iSV5hk51kksr;}VJpCuQ*swHF- zHlvka_ak}!5q zq9KMSR{+4GxTY-%)qj0~2lt3^U?S7@h67KiixX&hl2D7a@Kfa~uBzGgy~Kju`uV!j zVv}-#Q2@@&7DXaoD@S*l7Hv0M1$22`jXv}-Q#LSx4FHa>kTtDTKJ{>QJOt_f6MWF*wSplJm>^ik0pxWSx6#GEBw_YAV1$+J z#*zG%(x_85D;reOXmAU_Oup+s&E)@?g4i=tedAc~lpA~!`mXSwC1QdZY zqC8p+IA#5iPL5pXf!O#It15hJU8A05Z~FP_Y{1+_CJDrgSEC@{bRK%jVBjhLEi3Oc zk35x8#i{N(EmL918O%2=58nqH%qI7{f>2##1I^YyPtFtbqJRq|dLV6bR3M5u_+hE? z1G)Ya$B~EFpDE_n2nYxi1g3jAHKosVXt0TqerynjiWNbqSYi35S1>$&%s!?Z4Di$y zEB!J}MHR6tfSGDHu7QXIJ z`})Hl5Hcni*ilwu!4A4r2w;Y0Qte0Trm9iXOiLSYng0iU`isw z6mz&$;q7zwu!}Rb%Nz`u0lt7hu?l7CXKhn3Sf+;GJqDdp*Fkvw0)LoYd~2&1X!BkN z-5jWV=lrKq`pw<{wfSFd_Qh}P{7V5#e;J(&IbX9xCxOL=Gy$~g~7W3C_eAClPwJ6rRGr4L3D z#VNJC9D~MH&LkDbosh6VhwSSExc$)x@poju&;d6Q~^?}9}}>Swv|@^9SI81u4lkS{87 zc+yQOOv;yBHjZq6LaY6_+fOT!z$BXL4JO-he9tj>V{KI2X<-^gQOuodr2ha|CjFT_ zeA~~@k1-zCNM(k2(C4fjcAHE-QKK03(AI493Fqk&-AfN!#G+}48UcNXiorOvNTsqE zy?R=+dd#>e%uVO}WNKa`2X4=ZC=ml#w<`mo9n2PE{)cGW4?_DkPr4ed%L8eb96Ba$ zrIT$Ym*5m)VA-u%I>6@Rg;@lXrj&ZH+T(!&=m@O)A4A;8fEB+qQng9F^2m+<4^a@@ zc1?LM6o!vet@7=D8x*gql=lgGg^q)W-6&80uBYf{Dn`|PW{@@oO=wE3p8-( z7{T7!SoRdI=QeKd$(Vlv>;J5vaQP}$BAj>TA_R;Vc*UAx$zq3Z<2{9{Y3bI)R^7y! zw~k6HsLOXN+VwDzi&)fI|fv09plvT0oVIR--n zG$f;{m?HZw!soDM{(azi5#z}bl%J+Da>nIY8y)oQYy=r#owI-hj0HR##^aIo6VADH zd#toRZNPG&b-3hGxHL`Z{6`a4vI4GkO45@-)bs6fxGxluoNq$ijyF|czwNz)d@}C0Ca1H zKFKzX4?3WETTQrwZ#z}!Qf@y_D$b>1XkiFI65n3m|1mS{Fn9V_gaDb^*T)B31Dii~ zz5Y~_iv1s6+6zXypaG*!v;af`xKPwTwe#EI?=Rtk`i8YfzGa#VP0ikeC>O)((ldN!fOjRX~KLcvw@O$)2}JO~>x4 zOZ|;DLQ_pSKgcR!DY z1izZ9wk+W+jCl$NA29I&v(tTXS7G2Z`wtgv2os2mkvdZJ0|V$ol`Fc?uk7q#i{q1{ zX}Qnha7TE!*8F?lm}Gt&S@(^n^VQ3?PUr$kUS=ZcEg{aZSA2)L&dOTsTW?yV1r4iY zWvmS7XR)c^UnBwGRQ`C}5r_L6vB@upO% zQ_RJO^9|r245zZ9M8464`gtJLf(~d2$`b|pXg4=E{VxNsPwsHb{quh~dLAr9rcQ1r z#|bM5IVU_hwwjbKEKzE6sMB`XUx=|y=g7O9E|nz-!T3;j3*VyH*VHprty#Ge%8|lB zq9U+XpPzl6{*I`|e+bH8$$dYznisQeCL4vc0wS3AdN<>7iR_<;QWeB-x0?+1=eh2b z6ssb%wR8G=su!*-yrFRIdR?qFt7b+@DmN&13n!H5IR>r|+uf1lXYKtoM+JL?QTv}9 zTZMLb1{T#O^jfRGxAL!^hz^{!@}i_PSdX)v)mVb_gr0-ZQ{O=uSZ+Bw49|*Kd>ND~ zzoT*^Nr!TP-tpl@29IXm#pgkVCJ4GaAzAT5GpU~}7B+fn@0F-!k-bPf`QaF;y86jA z(yz6~I!!c+@-Qa^Df8{?wZ>wNe^~MN5L<*Mqa215E81k?PP>>D9^|qc8nBJBZ?!!J zRy350&){nl^hzm@Jy0H@NAT|7NaHXhbhTKK7}M| zPs3hp14YQ%pV;=#?kcpzN=5|cV(~3$ZyfpMO=;>%ECdaVlC&E=$dJFDlb~Q}08ZqR zr%OVmTkE-v70QT9*{t>rl0h7X-%66I8`QwZN8|Q>Gi}zWela*9v&ToqW$W@G$xY-1 zN8{@(>}@0KQLgPVA|^)6>V|-Drj4tZBXfO)L!hV=_5ljl6_Jr=E_TeW-hJm+4(V7V zt^!I%2S9du0tKYAm3Z&g!4d9&EpTvQsPdiJQ0jxN@uH=EU3ttnVG@o z^s+9ckf88~hwJimU-PH1KS~e8dXCEF*TMKTlfyF?P0HKSN&pB8G zbrLVfGm?5F!)WC~#cW*MMEH4^rE5K%o#7ZAJB6TiSZUN8x#gX!UD^sn)~^b!ndz-k z^yDSFQP@Cou9jV|Rli(4P4_)3GZVL{XHpk%Np}>>sHQlF6Ird#bZJJN7j`PD{Jsqq z$t(s+%8SiD+1_*JaymJ;h}?MwB6h=`3quloiEZ8oi>O4D9?Qu=BD*J5OMME*W6ZO?X@%NLHy? zc+b&u*dRnWa;!Cdmcy}0cJMLr#ocx1#cFlA(+amS6VF6>e+7h)oC{c(2q__*Bdbpb zM(3#~5AG#L&D(P)f3-H&?!x%_m!iYeE2?C-qLH+dLLIkr&*3@tT6RUzEOw9HNn}LYkx~sgr1H=O3ppQ$F{6CXMPzz(52w02j)ID33Ux(Y)fHSsO8zpUQ zxSjIIQqi?i?oJT6r`m|v-Wg!skz#3+?BA=_ZGHI`K)0z-(^=D2Fo8{f-NlAdme3QA zG{2!Uve@ZLc}v8$Yf*GgRM%=VxEOBWz~PwHzrXGEv?@V7bkPVTsP^%8DlGdioplNOsVry)EkG#UIBFO#0Cgqt6}!l?LZ zwTI?xkzHVP%S48WUZdaq)uO5t%6nIEPAOnuBfpY!V!>?~lTOB5mpMhebedswmW)qX zA)2#ZE{?CgtE;R0^=lS~nNH@Owzg3~6`jyg-`b|lj%n-aT1^T33^3Vc1JJ)83qHsH zbz^bFYDj5#FRGwo*^Ldn}I zmnbsS)02l-jERZajf>KA%0#8h$5U(!0U;m_w}tY_L5R&DMKW-gycOGWNI`f#++hV@ zupTc8D9lh^zT;u#3Z#@=HHI~!!d3B;Sto`0kHui<%mz5V4$tz)BT4{AYL8FGzSjI? z9E_q3`rwl8Uht*tc2#*i0_bmjgiOuM;upNXXSe{0`4PsC++F;gX@#F&TzN-8CD56u zYY=i?ct+1gl~1zhSOvVs|+4G-_*%crz;KW*H=R^mcAJyn$m}D^!D>)>)o=ntsm*x z*y!Yn#gM2YC4o~bTEd)89t7K{8V?2i%2>;aCISlXMiYi{k~hMD-ZA&hn=6^ZTI7QE z*+2)&tcs7l-_i(oOD$JtT1!hSoB7iu;1LB{(uwxja7!Q^5=!Rp>+K~DXgA=G09p3N zko(TS$o3n+3+a&O)RmQ@{E)?rDqh+68IGd#PUHhNRSJHaSCz{jDEH`b+lth3o8T_S zs06z#^}G!;)9gq4GwL-f;&o`9abS3}=PbOBjAQuC{D09uK@e6h(+aT?M;U`R9sfe~*vnU?S&XzYG_{b6AGj9UCbQ z=apW2l0bc*hlQvy#6#Gf=fLX@(7b5w9C&CH>G1T!U6e+s1T`6KtIBu-Y1C{nwBc6b zRjgHAD@0U%b5d7VxJ}_PR-!e%zZgI6l&c(+njjWnBK*m^Kx1Af$4O?ntzZiey-OFsLBb|O&GhywkP)D)9%~lZnJ*n# z*h~_ENKDDDd=NygMC6_DwG`dyLn#TI_|TvMsRKFIO9Vfbq2w`tfD+xWvfFfIz(g=R znqI-({J!Kb>SL_b`=yzqM(Doi?e>&&CeSNl#1^9u*apG=?W^xLlAT;eJ@ikxjc;7( zDZJN1KetoQ;r48;ie63%EHxiVwxB=*aksfHMB4r)zG^eZd4!3`_3~#=R!R!4^ZiyQ zp1)_#SUjt1qjY9I0{+DDy8ztVFYQI2dGM17U-Mo)iDuS{yJx(`zQE_K8$9zK_&xOz z`~EW{=5W9q0lC&tmpWn|^W*8osG40Prf$yck8*QqD?o5>s1PNRm7)NIrEW7VnVFa@ z-Bq5C87KL8pO8Kvmj0vC^Q-|N%vt3fe{OQD?2H25?9NJ5%^>e$@0)iynuQE=O7bAe z2ME+Nzn{<5t*k3nRqVZkOAV65?7T5FJvhyLCe|+Z&B_tS8`mQuIC0T3P0C;S0~S*( z1GL;h6i80ujOR+e{>9IV?)*r(8 zE8P7!$TeZG@3uWGJo*0D(I({)HI8_4P?9TO9s?2t(I~M~BGOYC;U16yM}Q2kyOhH( zX@O6W9!CX;Do2!9R#X&|Js%jHPvqh8F4hv}j}p6vi!Ji)I-#cxN!w1;fnOK|x3{$L za)ym~7&WWv^T6R|y$w!x=7rY`*CJg0MDS^5YM1qtw8 zCigQgdB%!kCki^qcRhuPjL|lJFte9g`Z1HSL@EeuWew+@vz0GU9GPo7_%X=}c-0=>MZt8xUqn8xo?=tA z#{P1VG-C`m3*P8HCo8!7d2g#K6t`mR)unz`+*6yoeI^nHP*wwKL=j3kCoAtEt!i1G z))cUb4)TaK^D>wxfC;gsY3ZNfpl!&Oq{A7l6FOWshoU&In|tK~L8_6&?`!FLifK#b zd5`K@U82Gm6`Ycz*EzVO9%bd`whER(0T=(oxJ)|Tl~^4ZTZDFPx}9a^e97fk7Tni! z>rToVrsbEC(9gt(&rgJP;G(%V<#>n2{0Jx~(!<*1ym(V@5xO8H=46wF#tWD>D<3I6 z9`wa0+n#usQlDX)Ja|T~?Yu=4S|K-Zy2GwVcd}24it_V%>fa*zHX(F5C-rQVemTar z9-LE)wd#*C7z1qDN$Fa^jou<=n%J7fv5rMuDyd;_PwbPjApH@+nYb{WFIkXhMRAsv z4~*Q1?bFIhKv>GFFlglWfg0Jr~t=96F-d~^gCDVI=5?Z}g zVUcd3z&QFD!#AmVJW@OEy^BnU$aaSE!mA&+=U7 z&4jB+8Rg5MKp@3wbly%u`K-2YVTrextJGkNS7(anP1!Uyd7Zc1$$Wqb3NWo6oKNbyUoA_! ze!KM~F3+!2XaQ98piskZ8~5ma&()qblrFw3_@e$oa<#mi&3@*ou-XCJNH+Zc#P8Z)nD>9lgD0x{k8 zrarl8Pwev#K+?6&ZVeP(vaAB147f-TB2r*Nc0K1R?dMm@#aCpC(q3Jzwwaj4!%XaU zZ<5vfdg*CiYi?*cULvbQ6*{3)v?pAyHr?@*j6Fzn-9AD&I!MUVPA^4-rN?KU#YCvA zm6>+2q&vsSKGz8Udu9gJNkZ6145m6ltfs%eqR~nu-Yn|E!*e||TVqr&E0e;3g}{J? zILjSa2w7Yhy)!PRGjfja;I8;q*YNcF$f_+q7fLi};60b;(1fXR3fB6iwm})gQ--7s z`^Hay!n~VPH_9T69`(-6WZu)j?LL0u?C8!gkRlLS9I2^MKC4F`(7#Z#?}lhyZJN*T^cky~yjYU$+un_!?+sC{) zfZ0IY!$4qaJYB2sUJ&30_m`6;{98iX2o0mfU2excVmR0&AZVfBJoXw{lVJlIiIV^e zmnRWmp{EWVS#=NzEt_F33LlxW_lyske?G`#9;hv>Z0YK__Z05vi_>dxzge?7yu4*7 zVE_WCc5Tj~pI+dHvs@EfG(I@Fj=-f85#xBeS)o}n1Ep3DQ2nGU^ARx6F0faxDUH}K zja~zD*egp;ozV)prp}uS1bLG9KyY<6*p;M4c%|{;cco6HHCruK0=`l~0=?3s zjLC@|b-wu3FJnKFtWya*yjg#_$yHw75!9g@7OAI}q!pPklR6|$3Xf4xQo8aFMVX-0 zXJ78coNe!4X|g@NbYGtTyIeFU{r&ASkGwb`i!b_c7biau2YJ$WUeisA^Pm0j8AzuO zdL6@evDLXuu_*iZ2nH$ByUx1VYWt=7v2?%Jqd>@DCT?W8vKAK=p&t~nSoIe*-RD?7 zWw%pkrXaNJGf?eZs=C^`O1w0EzG}{h!*+xGW&Kwe(q^UT-D$8Ian8=pZXqq!5>Eog z%gv3Rl(TfM=&9f!Ww@0;ZbPE(7tj3vXI7qW#l?2dMqEn#(czchDw#Tp->8`ywZG;a zbSpkfq2@Kq1uqu6lUhG;?>^j{jSj7WTPcax`x+uDu?bzq89wb2JtlcvwI865II|?# z^olhdFCyzfDiEZT;eB7a*jLyf{2l#`d8bixKE^E98t+*QbCZP}t(YuD>BH%cHe6Ky z%W`-CNlxZsrgHjVp4)oXl8uT=DG)gUYRBD6F|99cnfEqIYu1yk-UVK}rhldUWDH+> zuH-Sl?lhfQ)~C7aQGCnDorTpziFUWGaByPxhfQ#_y1qe&)#)TtkB8=N$hiG-kbrkE zN&iEU^*5<>QMzAd^Amvb0Bq&PbVmVxCrT*dtu-qtFBmmtjg^r--n=CJ$a+CXdo=A7 zA4`2scs42jVb)GfO?}rZPCM)MHnzKfi0oMSnC@05BRZ_1L8-CpgC^*GB}SY3xg`sB zL~|LN3jkY8GKZ7A7H&xdSYGo9L690>oWYvpDxa66TI|eSd_(d?cyrK}++8m!U+%8L zcue|YPy54_G3iqK`F^^|nkl=0dEkq??#B(n5?xlL7kkrOBa~{>*Ud~#WBr6A>yUkNhl?y7HX(wa^sMupfEBt}PS~mx_Lag@Y{pGLq$O`>> zyu}wLJ(m!myp9FIB2Q$g7Ha{Z+V;$!#?NH9ejLA&uvV3=S1n+s@eR%QcecD8T#!)h zZN4D=wH4usl&Qr>3m9UT<6bxs8C2+$HW;|MU5w98H)v*N(Snw(y=7}na1buGc`ySc zwz2hzNmry#xaH34lzMn!Axg^#%u`SR(pR6+*45UY^*cfSH9cZUMxSMGF2Ss0)5uqv zitjDIw>$2C z-YH`M|5L>iV*$6!e)>rzzX}d91cPD~ z76QosEvmk3btYM8YV!V(N&wsxT=(iwh1EEG5$zOO(k7>r^NMO5x|Uph%>A=?>lr=( zJfJxM52|HfU4N6uztp$f)GRAz=~_BuAB%XEnb`#80^_=&eShdWOSBFEgj8PT7!05Oy>t9l$00*pJ@Mlw=nC&jRzjEhAq6Q3 zYEjs;3kJkX319hoaw4e;;JetOPgi9myZ3 z+~7|fMw?TXly9>53WT#NnaRp-UaSp1EX*26Lrvrpc_-I3N%@welZ3P_u}j_5tWbq6 zwdI{X)}yj%Hwj?l^r4FL_n%!S#zwA?EXo$55=BPtR|}b}uv~CvYiZd{VI_PlaBzXceLQ?l zcVS^~m-lOFd!b^V-_mZQ<6AoI6LgJ;DO7CC=tiwNwS-^l#Rou!wXC9|V#!8!DdZVY z%vk^-?i~-_kwo$5k1AlH6#4PZJ^J5<` zFM?!zOHJ#lTIWe)qF74fOHjtF8fMN^pkTj7=qW>VGh?GjCFL;|g1&4s=xXF8&9BE? zNEU!p*Lx_uXN<|h zsJl0P!H4U_DVN-<4|0}+ew-pbqhePL3y!VE{E*&&mbR>jdoJjXMzJz)UrRa# zrxpD`JIZ=YapHd=pdW@Z1QCi@I-B*L{f%&lJ%h}I%Qw;D{mivtcQN-78MKbK#9=-; zPD|w1P9Wk=cP_-`-1yvkW9R0v{3yAOV64R3bpB%WI8$;80Byq-!4m&_0t&u@6U3oV zJ?myeapdF)VS2TU$zG}Y@RL0L<9j=$_~;l^LNUY7w4e{?#5wLp)DVS_;M{8;EQIEU@vV)>x&HMiCe0WDAh)_n!Z`Admd74eY1$ExVIy&+pZxB)FtG_4ZM) zN1iw3k2?+>Ufyn2svagbvQx*zSIiN5JCe2P=ih%i!qNFNB>`6#7kZd6seFPX5A&Rq zsTvD$ec9h5Z)`IV_uz_BV}buQN+kG6Q&?0%bavNF6F;HL2mgcC?dC!2cCySvSxz+PM$>3v|<5U%Da zqL37ZmDoh|^eKcq_MAg!2YaAy9*!vhI{vXw(^@gwIyIxQ zimFSgiFkkVo7-^D)k##P?c2oB{amLz#gv?{S_vq-mq!TY6ZjTlVp`W&&fuV(y5`3& zAMvcju=sOm+8(7da#MH6auQf>)Eb8$W|c`KaDWoCyg_z@Vod3kCN_*VDNzi#fVm(T zl19R`dNo0w<%^!dw`XGcWG*$h=eBMh`TzdPbj=3);>2P^#!!q%-`%STJDH@Ya%|vi|;L%eme+$ZB5x zWtvghiY}F3X##M_#GYUzBy${xs=!yJC+LRGl7|PX@&7iIBnN!-TH#vbZ37{pfX%hM z32e2KOk}qv{vPeclA?%AEbp&derNbY}0(HnLF$ z2TgmK>A(w$_2C+lEJb4s@!Vb4w~1wCxzpf@$_SMJFUhIY!)hx3i)C99#RZ0Z=9;@AA^i{Vbn(?`4M#^Dsf{U5yaYvoPd&cYOX|=rf1|6p&eT ztl`J55(`j|;=j3l;1NCXhyZezRlDMbdk)Pa8DmFH4XakKC9@j=081q$Uy^9)5gM+a zu?Nt1NG6pRw}8g-yO3!Db{8DTb<>%zzhh$HE3eSBQTVh_ ziRgzrd=Ye=c_rw&ts?TSQWpW-)IwxF%@H?6Lfkk5coh=b798}w{2p04&*Brh?Cq!@ zb6+N3c>VhIASg+^YIfr`8ZHPu%CB6i>&pcg`BiT2vX#SF1|x&aq_=;1d3pKND(5vv+?(bqs;Q;DU=*TtXYzFwE2nd~2hu@B z{UlB-=m~r8JYdgOZVUnLK5C?~WBr3?-os1LxL^%$O%HQq>B~jk^;%C*n^!NmEL|9o z{@Y6iktK-;w&&%3itlb6T@T4Fa-#Rm2l2Ei9s{B!yIAeFQb$Z(=2ntAKOn^F%+vKB zt2ZDii(m!h^MYu6)FY0;!mD%@j%)4X$O^+IddsP{Wcwz3^v3)ESvNjgXE&jBl&-xd zpN@XwX;w9#^;~uxyRHaegx9|CsO2~f#tS?1WE->G+%*<2P}$SM%5w0L%WOQ=19ZZA zd`Yh-e#w6(u8I38Ua$eA?jkw{ldZZ7^<;<>v!_-rh61T-B2Oos{PTHcrF=`{4yY*t z&#ySp^Jlah?4hD7?H6zcH~aUkuUluICHNIfe?6EOg08LKzEv)sXK3GTyzz_Q`5=(} zgdknb&;JJcKn%(zbRqw+EgKCdim)FI#Cz6?yq@9$x?E#;5{&i$8&^wTTvfY{n3+yYhL;Xm9?gveONmN4}oPHFi6IM-up(wJ;`VP<2;U5RrX} z(5fX91&mmE+NI}>k$f+NX4*H8Vy_K6YAjm#g1juO zR%jtED%aAbKX2eEG|hJolnxS5>2T2N`&xA@(DmJ$m%@T{PjS&33&VZWlk$R`KQN5n z-UZ458>Pf*IAXbtVip0JA|>1Z44x&K;TYPD%0|-jMad2Y>k~d~;rCN4w)UO4O`}u} z+P@kOaJ2#Wvk;VY2A_Sm3iL>3yy4h2&Q z!fsUXRCbO#rXF(<$gjhZW$KORd$<+UXn^(mu{&TQzA0`%30J0QXMtBvrM5@4@||a1 zR%4;%2wmIGF_)cz$wPR_Bq)Fpmz@xYvLf7=DB0iiupy9gfG@ndF_gs{q*@;z9|1 z&W!h)1Hgchu}bTCFcTun8|Hz6PnD!}$wr%5f;8kZl!k!ILeErq{C5)b>+^+UK{}k^ z3V02F|59v`F|-S`dA)Ac`7eyss;jDwGswrCJ%1zFI0OtKb&A~kWO89a?aO@yFr@)T zljcsvT#bty&7-rfAYfeI5dcuEaC6BM|fW7 zEMI-Gj~(mdXFA(b!RNk!QA3wRz*XzqATm#%FgC|~|9NZs`MT1~OlFPM2UW3oS&JYv zcyIYvUh_6}dC>>JmF@3fh)JHGp+95K#Oj?NfgR|`+5pgf<*vs#!;6_q6xuSFBirk< z-p-x;yF*j$FNXkRoT9xxPC&_1=I197-`_>us+@Mq9^j9dfu3&r6%IBx!o%*Cs9ch5 z;aE<8B;&!9Udd$~GYCmMEPrEEVn-+|e|xAVi}&`@wU--t<=~5x&+TO!KLpVF?1Zha zRf+LNXJ%M}Yz0y4G~5L^k7ZP%u2pU_fe*i%Ab?^#*Ws zW#(?`EEX%-uJ(na-X~r2_S!^#6YdsdyppR_v3T0)IK!>87v_vKmPAghZRRB>Cx70= z6P2C|Tu9we)fRj|;yh$K#8rJ`3xr@t#`QfJRILZ*-VkV7*HKOPIe+mbbJfj_Ao-Xk z(*t7V;{RPM9f?JK;8)F3 zk7tkkE21eanCk~mj`Q1Ub?HFA571wpNv*;n35K9UJ@c1@>Uxf;WO}J{aVF-LmiDab zxhuu8?B%`quG#w^f>79XQQm6nTVRNG@EDm+Xy=(6lMn^by{BaNH7k82NSZXCx>!SIrV;PWhE1-TY#CEMn4@rfWUD->&vX()~ZqzC0evwtfFeDzuP@ENQVTD!Z|i zEZO&DooKP|%UA{}5<*$CP6#3UZWxj!`@S1v-wm=1#_+qQ=Xu`O`@HY>pWlCdnolwJ zeO>2roX2sTG9^~jUs}jDZ}d6iR6AQPseQxJSc>pYcrImT9C%*;XdupIxB-k{!jqcK z5t>P0)?&%0S-j_TKA2e|ENOGL6%r8Kzj?=LPC0%g*nKe1XJAmvEANB7{dkqTF&V=J zMVk7w zc7NPdFk+=LDtxZcHrFLCfd*CZ^8J?YA#Z9}<|cHjZ?}nQ>1LI%QhRKPM!3y@hR}R}v647|CcMerjT! zsbRdZmfJ5bDdElpUBb)<8T<5)lAZ{lJWl>2gPlF zl)tKT_gPR<1`P?y5T*O&QrN&C2j+)1W6U4wxOPo2Q(J)Oy?dpGDcY{it@LF@u4p)A ziiEAXj+Rzax$;G))w{+(z4dykY3y?H%s6=)d-<<%2rF%GXEs3NQgc=faxF1wC_LRO@6$kSL_;iYB1NxOvfkMF`@r*mwP1OSD1O`i!(={kvP)M zPNC(wAA`L5kq7Xllti{e-r-s>r0ardUiUO>`-H{lIr)Jy_Jej0{xeKY0bel{)C!S^ z@u=xnTl3k{GiSleP^FhUncGX5(0Mh3-nY(qG^;> zv#)=A`sfBE%^K+E?Ne-x8IT^^OLyMq$UFm;xP_aYz&u!w>|LMeP8Kvh_Di-7Hp#3YPN;QtbpcO}T18=)uD9~TP2 z=jfMkyTL~MpU#S8i`Wbo_AjEEPpRR0hK41zX1g~RnE8bKa&wZ+yudLq7U%l7I@J&y zKAyUZO8~fkN(8;CNd{P_Iw1=ZC};7ngD;+`B`GA5UX-_Y5+mL07JIT+=})wlPKd5C zJ>GqNb_op<$PaI^uyG%!;Y&V=T>IWEV$NVECgmBIH`0<|24_Qe0$TC&9v`XZMF3zs z6JLHz&?TFH#yD^Swq6h!Z@78xY45(#nvsL)WWgq+Ae_|Gk!uZ+vqdyG(@u|8B{n% z>HILf@$KVH`L`}eOhe&&Y1^ZTR6l0L0?7cVG@0bRZ-GfhNrH*7=XGBbfd*XO z-Ymlvl@0rLjfUP)z;7Ju{mX$QSFKIpu4lI zMR5WH^bu7~aqU2J_9O&AJP&^)*KVxk!}fxV%Nz~wU!qNKc-WE-Nu3M7*6Qc6L`SzY z>_L6evVBLYpV$-{JHH&9HqFbuybexm!zvot*&geZ9Dm2;wM{SbmMsQ#^P9l~lB}<< z)NF$tjc!HHe$}{HZIzglYWTX$tp`Hw^6Wju`qFa5DR}1CRoWXa`&)~X#ohL;10psf z+PYAvUH`}0!w2Vlk$;qd=4sAd6Lct4|jPQ32S-WW<;gRG_Qba@?V)-G4 zcUDnWSRy5&tEt;%tNKP19x-;FZKmisNl&>sZ!eM)CVmNSkpw2FbEV=K*gaH?^9A^z z5zIzL;FeiOyRX*goRN>q=pc5{L`C~yBTZtr;#v21w?egd7y(AV%kgR?$5@L0I`-Ej z0PeduZ2up$S~R!`E)!ZqV>;Pa*PJPVFWM@*N*sM@%){D@=4t6N`|mOj@LFHnL6gZ5 zxXk*c_lXifeGDV}`ub)bmg-{+H$n9;=HDB6M?uv&R#TT^cWP3$q!ZM1XQY2NUaMN1 zy8lV|M(==@F~4w~sa}hThHCI$`q!@P-$y#X6mW*&J&^!wbmD*6MmEa8z%T}wi9aeS zHj18KT2H(5ya7!IIucqD`P>cL@H9!QEGJfG?uTi8B&Y?6Kt2cz%Ovc5u$w zzNJ?^#B>625wNb=$XK;K^|}8)a|v5SS26^$?o#qf%{uy4MLp8%h3T!0E-f_)X1{%j zS>y}q_2xj8Q0wTaDKV?g$fgG4*!?Aacu4sjjTE-P7)OPTg5|+HoUOxRW6ODa0BtD5 z*hmyaEpTC2uZNQ=fB*rRo~@)5ja9gxp$&z)pMbI#jC{JA`X;}gxk^P`KeH%Efj6^{ zL=s|_RWfZ>hP%%DP26GX`TA9?2&ZJOEAs zs&wUvAvbZv^%tx00NOERd{C>)Ti8Zi$w>7l+J3yU`75{nx7Oef5_A}l78Q7Ea-ESh zC{2I)fi5_N{%#KtT-@REOWO_%$^wA()T9?bd6+fUocDXYpItZWgV?&*miD}~wEi`X z>#uIdK5brdxR^w~wBnI2E-4iMijNl_KEG}?IYQ7!+|O29`wA5LT8^CYw%!wy3aOS;J(}sTjlx!57my_f1iAcdxyG9T zBb1^wo2s%qvQfIG(*jhn99=vP;l}#8FKnI4=2!WHE5cDQ0Q~qmUh48B zGNUiRPXq0nk^IvEe^sR7@(Q- z>*@4g71zW*rC^4bb@-DauR(;V3# zpo%mA7!yX(@SXe2qk#LZJ8@im(J$ate(pSvzqJ)V&#>CwHo7_CNt7KWKTK>0r86oX zl5L0w^`*mTsf|;Vm=(u;3kD#|a9$(gW^cO6rt7YxbjlmnW~fq>-M(lp-dv)Jb%_RD z-^|XM6jhah4tB&Uui)j;1&RHIUteI&yv9!L_slRn{g+)Pcp4yA=+?pOICZ1F$$IZj z%qul%Nu@=<1lMZh9EeW3t6OC3sgBa6$KJKFrVkG=b@#%lqQft zg^IKcSrCu)gE(lY>b~tt6tK{ocrMI2w%;)klWb!%Usp+?6l1*F)}XKrKi3r;n z%}r`~z>?3|t7nPcm9HwO)2LR@T;tRQl++JCfe$%I)uC zA>FgU#D8Z+FWFvE9JgWtTguK`V>kh|va+hR)al{B0*maup5(Pt(bb<%ZPp)G!Ad^Q zDwbbti>_Qx%2K&e0)(6FfpdlAyE9*Q>Mv#6C?b|62C9S8fr3@EVwJ1G-@Ov&aXN*I zSD?QHOfPBHo`aJhs2RA)TXRtO<-@q=&WZydoND2|d|9vE@sjRT%#u_%$!!P-*k-St zM+^HmiN*he-^IUlNk$rxdbsDna_93%HTJyEJnttLlL23z7^#)3l$jd0GjDWm3-a}}RARu%U3I$r9zB7@9-q)6hMRa69M zn}Wl=EB~%xz+b9fvpa*bhP08b}d$M~i2-W_xaM1m(V z#cRQUbedP?C=;mosPgH~xRL$$QwmN}n{E0qAe$<)pCsWpb6<&C)Y6DNd>@xb!L&bD z34+zo3xt*0(zDFS3vl3$huvD-p^Bv7yOkkaktl0aXKm!)6!rO5Tr{r{!@Fx|{8YpO z>J0&gwquhj7vfCu!>TirL4`BZ@$M}_@9q@Y2lSYa-21GDj%5(|?z_C@TfuaE6bXYZSb#&6os@Ee(i^2ng z$BUZ)>b6_-Xh;-Hc3B6-Rbl}-S`z&5Uu)ff=;}4})FDtZxSOhDDbK!7pDzxOTB~*k6u-0;_3r^#nBY(LG91N1)#2qf=bmf6pX1QoWaRG}u4D=3|_;oVQbr zgjLviO}ApLwY1W0CFbE{?eQ2cef>CelhoGL zqav9rG0*?2#s5iMF>(36;jxL>DtT3)Yj}qywrE6u_?Mg8m^Hyg0_3++cUEd^a}gR>Mv?pxBlp>;M6A=$ zbrn$AgIJpRVk+0KJMCyaK)!D2^{LGWQV-V$Hy+`=ZEaf0tcR(|sFAu0wO|s!%^3!1 zzpP)jSr%4C`>mwf7Mr=lJE}t@9x{O%fmTrmfo7?i=KtOaVb1NMo|o8JcxcLR6A++13l97##QF&yp&t`TruhnG3)yMD7?t1@9Jvw)IqB-+hMptKqfv^;! z1PWcbV_N?RMo=lMJaO`Lxjf4uv&mch)Wh1?V>B#~T5ZAp185nN&6?~u#-%`7D7Ky! z%~34R)yn?r&i6AUsOKjT*!yDzw-$3{xT&LZjPS|}3_uu|kxWh25igt*?Z>4+j;<|5m zy^|yJ`*dl&5vKiy*(hD(NgrPen?=WpO~7OpsWK$iY6$NuIrG;&!hW1*qtGZY*wU}) zWH92<(tAyMcMuuQ3wlp+d*>DVpYM~nbjnw?>qZvF7VFwW>F?G-MCI^ut<*Lx1Wm#% z*;DW|Hx5BNFRx!kUxYw0ju_cO{an3gFoJ~HU7Hw<%Q0xklRpKgg^Cwky8t(mO>)7r zgTmi`9G5mYK4FU_luWJ%_~5K?qfmnQH~F*s)?S+im_>G#SOy`C*C2=CkMAcyxjsw5wF^*pKT@;8P#hl_2X0XPZEeY;*s zG2IyA1O&E!p$ZG~xx%C4)VWtHv$ZYSa{Movm@8R|JU zHmkPILaG&YuAvNq+zMOi5|IxIk5TlccBFuONMtvOFx9rED~1T0v0{2M+tfc;$!RE zgHW>=xJW<9g{LRO=Siiz3QUj`rfj~Gp!bddU~`6Jl3=B3Y2kPT0M zk#!6&ZRHvS-BVzjFesYKyiWreT+|C^;%laUnK0O0k6K;v@O1?tPWJhA9uc*3`cmk_$~K z+|c!pi(V*zq=SLxen(cPgwo>DK#~<;;k*N!e`?aLm%!CP#O}K(#(u>-)oAhK-lu|T z0t&Y}tP@Q*+Gac&Z%^vQR>8TczIky|<-SmKT*9v>BF-Yk?T?Piqgs!s2KZ?O9w%#W zS7=%Hm{obd?CtbRdlUuMfp0nwAP_A4E|Vl5k8Y5BBqIzP>id)|Co z!3KdWYKdZr7R|iXFFVsnq15q?imUJInD|1|-f^F&6$V0Jp9kyw<~c`9-PZz(jE5>4Bz~>ijqT8h9r`Le zPhO#GbN1O2_F0ZEwHcoA-bEZ?{onF=He@HtgixC=7A^n$_zg-6TOb*lT{!%%QL@HfFi+f?<)mpvAl z*<1IaYyZko?P2wyyXQh#&CkWP$H9EYQ?})cX}liB9#y@F? z|DM93LjWpVB;NrxLV3J&+|t-WV`5eU^U8l zkmKY>9h1;tAizQI4f73`jtQfFox-L2xXE)G7oP>2d;15+CRkOKXFaT*MXrr)q~Pat zYd&eZu^8cs5W62DM6^F0G7ptp*D5=ptf5@?r?GV(Ud2{29&uWHm7Y(! zU}%5l6t=|CFgP7?dg>d;v#D()r4bCx)=*WW{3#{AGPz0jN54MPaiW#z93MB0P>-#3eQnRuB)b%;}$|F1~%x_Ah zy$EcW#RVhK%MWwrAbB!+jtNDq*ZadjR$|R43yjDR3CvYyV*l6&%6nVJsZGFY<^3tD zlI)CI8DETFBJqtg+ynKGrP0`%?LLJ%3Zs~S{E5EzCH8m|%7Sjy)I^3MCg+EFU=UeobMcb_}$s=vY4 znMv99;tzUiC)Wghdl78pbTvmTM{|i3{ptKXGn?Cd6%Cc;+P1GeLTQ$U!uQ8Er`M1X z-{FdtYI$zki1OeVLtCRURJG@rE^0S6U-chOKljzH5$9-QY&*w<8(lHv;L60Dk0!s` zr`B;%(XVTpeiu-ew*DXy^nKU`YT=7mZ4-5bo2ko_3@~$!)C4nE1>l*Z80tX9=?9{q z^w;4}O1#x|gbf5C4Gcu2xyh?ovpjgI5Q#RH6nSYphR)3|u%)BWX*7maJ)+j)2vwa} zsTM1Q2JPP3xzW^6XUq3zcW0bkaYit)KthTF)^ZKM&XGX+LUD0yG3A+N6p(E}4-SlB zzhsbZJUTvBp5D_%iRCi>&eZ8%t4au^=KD_X5qFxo#@5R>E*(VT&LqD^JgFEZGDgJqsUDRx=9WwH+vE;^H2&m*D&#A+qwDAE67E>f{~C0$>Ud$8(cx%+#l0_V!gkI z*_p&Fqw%0(U%xui{nynIGeDu-X{Yu%4r5+-KL5zJB4P7z>AcS%m!G+Fv7btq#J;^^ zvQ9Cg9VR_m;O|e+@sxrL6VH}5RBjz&iRjtWw^T{PETYEmA zSu3yJg4#)}6XM{}mZR!y`76GR2M;pxycTm+&E8WivNlF=@)ZdF4sG860cROkezNy-UEKfZ&j+4Jv3Xj=@eU-ac% zGtW>ens0ORAvD%dj`sQw>6{_IhWQl=rrNNOwWI1acrQdHiyED=b6BC~4fti=W4K@+ z4f9Ey_d>^=Dm!lBnqB&TO4=$f5gGW4w)u4brnZ7Lo$MdVP9nU8v#4H2fBOf=8$hRu z-(oD!Gwo_>Bm+6qUnFm$eV}6}t?d?ArtaLDTYcBrPf1YUMDd7+Dxf(ruZsrej$dQ( z9?bFDZ?>-l5C0O27Xsq6@9ZX_|L*N-6mleB9KW+Lo6rKFUa#e4s4JiCXn60{doJPj z$|;bukXv_CWkR|E6N2ktSxZgwYITBkXwW=rBZ|-Ox>^4saKOm1UATksA&g|aaX}>t z2n{M~)5j<-?2J=-i#xAb+1NN>_R8|a{FmAVWsSDCl)aZiDQCn4GBNns33|V0kE!_! zS|e$~agFiNC8Rlq`u;yzl3O%je(TYaXo~pPAnOkjuc%kBiHK`_+_n7l1Gd|6CjkFZ zr%L_K@H7uU(*rL0g^~Toox*@DKnlF+fGp}(bqz7)7QM@f^O%pT6hbdLqVVCeN-Qb7z1s&Evl!d3JrS!=cuZ6yw8Ha zDmd9K69EiR#vk|o3UOTjosa%`++Ca5{{-H z^B%o1YT@YwK6#Vr24n4Is2f1+Oi)ks@$Tq^DG0z%B-3ym)1=z1an|n znR{h4bzX(8PDJd1q2c}{uKK1k^ZT9DbN?c&{2u3gh7jir%xe^$|3P0o<68xM8Q!Mz z#&$i>&ECi165~44k4`Bs>6!o4U(Kk2#|%BpPP^*+icgSE|GGMGMA~inQR4NO@QjIk zZ$^wgIX=yKQjTp0Iae7|&XbE`r&ZcKGy4|*=Z?QYGCmNt;g{x8k*uts47E*#%-~l5u3H`X8_$0uX4B^?{4y4wcKd9Abzx z>tKcO>p_WlSS0DzX%682cM@@e%jPOfB^Xk?IDaTi_yM^`(M{vJwVr%h*t_nFy%Ugv z!&+_foCneNPCsuLe^CE5RFDcV{K<|(V;xX}NFqV-?+h^5otnow1A_3|Z8*g+DO_l9 zR+rahuzKe5nt-{@hN0)~+#uGKBFc)3VSi_ka(wNo`)-*l*Sxs*c&E?)v)qlJlkcZp zC?$6?`TV?sOlVZ4|C!tUL7SXSWgdM@clqkRFKLkLL@O&iA1W|et2==<`BQE;BMUkb zzP!Moh4&|+7uV@2e5(MLtd&vk;>p8B2^PoHruWupPd+NxKbY3 zGBv`+`%tv(#pb3hu7epn;Y-L(OB;szU;?ntKuELa2&G+bc3<Jtqjk0R`EGOG z&Bn(h8P%>cb7xr1T9U^v2WSUQDVIbt z9wsx9E^Kxv4Vz4GxAh<>>uT{2@$SKKxy)E-&DeEb_$cIPIN-%V!+FpWO6_9H!uRL( z1Cwy_7<{RxE4ueefGT<2gBoImfrqc0TsxPv82#TB5sbM19fD!rIeq+E%~zd7h@MGn zJ$uUkRi3)z``=R{UuiN>`F*_j$^#OHBYlMj=bXP5xssgVkW_O7$!mzh4^ucw8#*#dW-NPCwpG4$B zc&qqj(M#T&*)XI85+--oe|E5D@wV;UiYUrh^#mqB@=%oM#!=G|@nB&Dao8DFCo!Y- zPLd-Yftf(z*N);k?KvE#vyJf?xuv$|BD_l<=w=;Q?c4D&wGw$BXe9E+eW8a38CNnY z_Tw1GTA_RT82PnUVgh+js5n*;67iMK5YSx>CSp%}{>OPTBasE;@ub4kG;T8fFF+A_ z=91#?u&ypi0$NPkN+kePhCgE>rMOOYF_A6EudBU7!`9Z(rD$uK1>Th7ImeZq-j3Nm z46D3&Q+{t5zk_vv?oFA&MX%~_d1Cg`J-vVIM{d49*I2{YKI348{+W)-|`Tgq&SuWtDI^a2pafR^OdZemL5Y=141${9JOrKf%tu$rD|# z5JA{FL%HGv-9N~fQquT`#Hq`MNW3g9dmC~*{M7!QB$)c1{FB#249;I}P|>a{wD$7y zn6Jg=+OGP~l%8?Q*D-ocn#OO|v710_`GHMb`)`{##0dpN>+lMJtg5TH1uoc5)WF<=hs81?odCm_{`19Y8kBYz|D`1OCak|-F1kAyc$P3 zz6x>crEC&Z*tz`cgFRZl?SIfCCMP{IxX z)n=stl^hE)JFjAVkcMF|loAD@!2`yFkw-&6c3{+a@$I?H?bkH`Q|{#Y(RG1deN}S5 zIW)iGXq&Jml4zuG-Brp>9_gm-QnBu}QN#jsjCh}M_NCFn_8!T@@hmB08Mfu4RWzHk2|<1dcF-=NE9Bw%O` zqSvVK$ELOm%YTMAH}KIQ3ttB%@$eRsf_keZcdUTn0-X64=Y!7&#GbQd*ADYb&30sK z-+mWNG_c^jy&bKwvl~i(E#qERGpB|IFx0}y|>FM811|>o4Ur}0}4;l^Xt2dcc<8}YDYMXOnlWl71L7l%FQAu zMK%I8eG)seX6n`y$OYq?`IE5n%H$t)rTEu(Dzo3%S9UvtYIlt1 zjhS?vN}5iX#FV!;My-yw8_z_U%t-e-otkxN?L!`=42*xt?5$JFdG*e(X;S#$K_qbg zG1V!X94^6v_~#n_&Tgsr%6D-)2gkG8;r40?x6{PdD33NVXs2aF0k32pLUc6vkJYM5 zC}RJK<)lf^eePq$8S#&m7l{?_!pnTx;}!0gYZJ`7ZK9k;Nv4LXD!}ioPKM+6=bRUP z0X%q*ysy{GIE(oNG|-m4_x?2wP*6D5MW*yF+Wy&=-pq&U3T$pXz%|24<*(jSS^qJ9JI@-yD z1rT&TaISf=fPH#wpTo3$Q10FKcpZ{TH6Tz~!+<#! zyTnKIpOc;IfX)Db<4A2GpAHkzKP!W4&qJ@`%xqdfRmb`+!c8FRGrw3^3w4XvkrZmU zxm{zB^<300FZXF}Pw~LX>LbEKTwg@?R1DlG_Z1OrW_hB&mA8GCV^Ig|MDE?^KDZnCsly?-BM`$t>wATOZp4o5KH+n7705~ zjL_ISE^}?MhNa3ZAOvuNXA@KxLk}Na&2yj#);E&4GwV#vyNWJqC9Gr|t-7v_eJl(U zw9L(pHbQ8gOY8a~wbzX!nXmA1y(t&^>mh5$$nKa2BbFw2E5rvEh8pj4Zba`*;@%EU zooe66#rgCJTZOTBtc^|^6%I7LXPzJ5z*4>?6#9QY4@u{QAMnEhQpybHV{6uL;5d$! z`63c#tSv?959iBju96XKU6go{J;GAkGt*&TfN!Qe;$IcbsY!YhQ}Zhfy&}5# zjf)FYKsbe~^*Wlyy!mqWxJs9J^0tWQ%;RT>Y5cJu;T3(q`vRQ(`JLB~b-`>2h-81W zp4iA{zyxE^+kS$FPH)a16x#cN{J+fLOpe zW+AvA-AxvVYhU1W=ry>dl9H0~sQNqOijDIW(uv&SOW13ynbHa2nwQkSPQ@0zM0P)G ztnl)LA&nrV88l64SB+2uadF>m>%J&FpdTg&rms%6qtPl@^XZS_w>i5Pc7Y-2r-`xo zj*^PToAM+M6RI_jC4(2%5&_P!Gil4V)XR_b!5FW_#dM0lv9yHmq6@y`b#?kNf&xtI zxaqdV-aX}q(Bpv+jH1v)Cl6bg(h$}0Qyfm_c1F@^Tq$Oh3~9SkRpv0 z++GBEkBtu)$k~dLNZyqDEy9ccZMgY=`Bsd8T4P$_?-cm^8ROX1i%&w+r*%%Lk^#7` zT_(`#&l-&T&l-&5Uo{x0ZHXZFe{!6Dmv_I{NR?rQGmcH$7Tife-D?AZ21qc*@HYAK zF<%+^-A4g-0HFM}UGE$y@!)c5H!?C>jS&G>XSZd+H;W_=LJE^#nEvDW5PzlrX+v+U z_}To7)>C#3Y#Z>;s5&epWg(O5ytEPkROu&{p2sNR{k!~ z3olOnW#kfmpX;~Z20>54fH(;KNF0Pxt?RtLXLWq2_}35XDk9c*!?-Z?G0EVT_wTSQ zt=(T!Q!@tNu}-%&{HqL!^dtWF{!9~w_6-* zP(7~t0&x;UWvKzvZsF-?U1ZKpS<&pWE9sIYl@wA?jo7HX0q z{;ri5eZh~N9T5UF{f{qN2UXOq`Z=`1i(+8O5fF`(TyV$q1wA7v@?N;BwKqa6n zxqmeN+`nmo-(kiAH(z3%+nxv+++Ksu>KlxXZFWi_Sg}0MS!O>KeekMpY6GlrFjHO_ z0T(=kQK*q`-iWTqn~-%Nf<}Jjytmd&|A#M`ukXn-l_QnxLEn|L8(fdNa;gEG%hsPtnc9V7fzGSzkXiozI-_EdE zssWdR-c(-MDL5o-SB}p5@Sk@XtnHeQ@Hwsi#%-+CYNGl7AKq%l8gg5~) z=W^dw8{p(o#o`Hc)frOMBWX(Ad%$^m0q`U~gOwWdC(bw`_^I0!Ns2KK7vm0=#yVCUYy(2C&z;-5+^n zo~!JY+EjJr{rU{nGr5ha^61!JvnqVj(#g~3>^JAyw+FYEpNsa+F89rzkw-;7>-f2K zicX0OuwhNh#^o4WzN0n?YY3Spck!E-a*vj0ugPR^UjjMwSc#dZLvQJ zuOR7zHOrYh5=8mQ?8HPYs?W1gNwKR8o#)Xy***2{e$`jM<)@3b>e}YndVps?i;)k^ z1bawGJN0wGq5|cGwv07BMqz8R`cmc#9va_4bKL&mCt7RrH2xIH1M*_a)BU^l!;}7> z?H9UCh(r|g2tN6FC60;U$}Nj7EZWl$2-h+y%zr9hV>tnxi>0UuItiUzp(pn}070@9 zapmU!I{a2d7_J1;;ePD!doU2AoFi)x#m3aOA?5HWDIB-~Zpp`FCy~DN5{*)<%`lU3 zYUn*YdB#xL{r2$RUI0J7zjbrU%K}veVKp+}7CR<7S&wv0b8Uzyn*BChWa#pN2S|UU zs4&bFO|v)3wLn83P|5XRXywFrCu=U9g%#^fq7OB&mK;vE$M2lMTPzHzx%o;zCYc4B z(&tlb>XtT$;(livCX%ssEjf9nYW^9I~lXqOnxcy3z&Sg#C(5-xmq~fZ~)3 zPGI*E*zwRIB5JefA&?nHe(|=rt&&nU(Lrq}r=&#iR)#)D6+PD@b8SYyX$ctCa02Tx zB0K-id9%TAUb`kPjzQSI>;7QR*wlRgK?SQnGcz#8U>S8z=bGs53zT&x%7Z{7waosW zWi7*&j8qAnppDtNr$<088^jx1I#%POV~^dbE<25r6JNc$tY71;<9ki8d@aYuV!q4k zs(|?iMs5C|I;UPpoHcuGHU+0L71UYMr4^^sSxvc}^P)3kjM@cips%06gt2Dn7G3e? zHeAX#c}PeDIv@8K5uK5aQ=4ge!eVN?FAR7v^OF5zdv_F@IK=GA%g*8Cq#a)Jj@UKoQ?#UG>N3x@#_UU<7miib+=`fe8Q%O$;jqh-U%0tV<(?k<^7D%3#P<^v z+}zwhQEw*lP_nvOULw`q=q|LlAd9GhPGVL@$HfG1H;iG@?A*)v(28d_nTy7IfwAG+ zGUZ{)Wy@-CkQ1wtRLYee7ehQ6I}kNb5ePAuzJ>c4YZ<8{<%Q?zhpZ=DU0fR6DUxfvCMEm$z=q?Hvu=KlCN0LButEhGz*<>ZiXx`jk_Yx~GupzfZ~3l)9Tn-h zxdYo=#%MJ9F{}7YD0rfmJnf|D$zPb+^cAMchgFtr&zB@7CKho$VyQU1pvR>)yT5%% zli8A33{_1KF)8k#E~rbHH-U>wvSkfy001O+e|`NSBtQ(GkT6o1ySaJxrJI|GY*!V~ zS4MmK<8(%})6{Ou4P%{Hs$r=2bg+8gW5gbl0f zLWd%l+aypyNximAIQhbPmB@PA5^{LhRmn%*HCtLQ{)bi7AEb_K`7eDQpa_N;*`dG@ zPjKltQux%2d?l6)Zu~sFtMt$j-KRInZloa~5NN=iVUSZh7_K*=^+lxFmV5CzM7Dfc z6!YxDD4Ba~OL3I<+nj?-(av63q5IWt8!4GN=y%$eOV8q(nmF2i{(R)tLT&~qXNsb9 z5+CY;ar%d-_{*BSv=1k=>XE^8o<=pnLQ@zt1g66IR7F`?>!i$fIv53S$YYZ^=RBV%~B&Z?AA`rl%;( z8T63DV)r$;(a#>U>%_*#7p=8>mF4j{5ES-TR##ON5#g#u3PENg-$X3^dzEE7t5eA5 zs0;3BNkw_&Q2FLPagv+hxva473%dUm=njh2HCuK9;+@h!NWj_e`l|FN?JJ%3Zm~X= zdH$85?hBFd4Gh>^3sA)!z2|5wJ1q1n-I;YxB!kZuGrT{h8TkB()G??wJL#I;TCbW!(|HtS`D^!UU?mye@y-~8rMD?lFjWmqXm>x%{E7p`!|i*o|DvV0X2ZGz#chyvEWTtvY3@bd?uGlEP9^Yy!)+@AtE-zgWtLT((3{I!hfi_U>(nze8 z&!$YBx=kKPJ+}32v8?X&{+Y4ug_t{a@wpZU{H_P#G4)zLDH<12Nf0TNJ6p~i$fWpq z*vfzn#b~1p3qydS_MNk*B#j2~*Gr4|i?9_J@z0usp7R>9Ff;RaCfWF<<1Ew!1NQfS zR9Yt)m^gP(7;*=>J^AMR)p){*d6ch05{L4>{(gUde~e+FVr6X&XH;p!Ilm~AFq2_6 zD*ucrf9+X1%}gr#f!ae%LkkD)2f!*eNqx@w{OQ^yw)o#aSoq7KuDz7 zJ;2F!_ORSscfVnMJ^vDM4~U{^nLa6MZthw7K+CuqBJ@+tj+q+8|A^I8Ll=C#b~Zl` z3Y37dx7myk zIcEAQt<4d+aWZV}TyfaaoSgRbcM{m8Teoi`#l%F09eWZiY+UB2Z}_Yhae3z%qNYf1 zYAl6)LEL^@J1@(#&8N{Re@=_R2ysCqG-@ELQ_&mc=a?YH;j7Wz4p-Dlq&y|r9H#hU znXN`6erh{bWt$wX!X+pt&s5$*yL+{k;zfvj9J>N_9l3=XcL_HxIm>I&oy|DSwKiA zt|PbOOTyB!<>6T&hR;d3*x}en9A+f6FabP#Ahat5L; zFYYcaGb(%ixQJ^#)vI->87i>R`@f@b;YBwSAFlkp1qYnc#Mw=!mnJ5X1`&m*&|2Mr z)*lo9iVJ^`Qe69>MT%P8f#zP^#SUrbI9Le&cxT`J&dOB%T`g>*N7kuJPD3Lw;w0K% z09y6)%TJ$^C*w7$S(&bi zL_D9p$-wQAloGa=vf#qZJU=%1EyUJM>XB?#gnTGdL5gM!n*XIkclvmVh32%PRs?N@ z7$hP_T7kPtK3%esgxtp7{^#Me>&+;8&UG%2k%@_?za+iosb>Tk{Z(JIzx~QW|0smL zyq5%u>hwx}FMUE&I;&or)_FY>kSHU*HyNn z23qnrK?$NS8`{5q&E8M8$E^&14Vj8Dn$UtAg(4Sw?V=VZ! zD_7t0b%rqq856d7ad&3lFYKKZuXAv1Sq$R-9BPwvtC9Wp6_g|}d9Ca=@>zN#(@=5D%2hp+bjOesRsIO-y`ef{?rLVO z4WX57_SoObteGkGCxfr9t~N(zF}$fyc8C|+1`GSRaPJ`Nn(CbE{u&Eg?k@Dqyt!fU zPK5)A8C&Jc_&6;#2J$?0-#jF;HPCGd!p*WYuDV|MGGy+u+`JayF{5aHgB+E1GplZe zx3!D_-+~_r6fcUr3U10+qwKm<;waxF|HX8+^QTbdW({R(a#xBk1+cdON}Bhd?@F#uUe6%wWSbP$>XT8%f52-TLzsR&0nzORkpVxI4QCf_c~ zGm=@apa))n;-UvYHJ-OT?o`$suL@Zbx+_`0mXn(|o%UIMLd%DaZ>N$wc5Vj$s7z<1 z{bhXP_B)ksS76fwK{1qd8GCH525|vjd+N~x3ES~82HO18)E@!@)?b)HrRMsr~@&g&6?TQEz zXu26I+6l^ev%Pzh@+Os~O?-U(x2npQ#MFI5W?+!TmCKcFE0fdmONWKgJ|6EB%CN}L z1lQ=RIUOIQ{t>7x_sr^aLliwmFYdCQn+uoL#c7YcMha1XJyc!S5Gaw0z46@gLN%R7 z&d-92&Ankpiym|_m)rYhBBS=x!!y4UwyR6g3ch@3oGdA-dZ+I$2F*qVKdH9zIHHzL zZZe`cM_bq>C`MxH@@s{q&vd7}oi=F&PLLU zxcdGQ$)u?U`9#6Jqty=;yh;WSSKPMFdcLGKC=m?&*<;UE(}mw#ZfpDIzCPibRe!lT zZyzEhAlUa@w<@{WP(pQt}tF5nEJ#bU84i&JKkr{tP zkW^wtX^Jauk^dV6{R@HlN=*_}1r|Dfip0&mG_z)pX~_D-Oaj%pbu;1^#{BL&NClD@ zRn(*PyO~mnu1cgR#sX_Yfv9Iqh5~m2-2{aSA3sScOo)lCBZGr|3qqB{vV*s{&-#0% zjY^Gr4=|NITbHGtn3_t_(=)njC3G)N6VDy8IQb*MFlymbl^>f4XB@)-F4h*we7Eha z+S2CMVy~+;V~yaBwR7KlNyd(lMuk?vVc;-~M0Qqdqcie`6fpc7PW0Se_^4OdX_^-`qMbA(FwkiuwyYVc&*Q4N zzGa80tv$~}nOk9CBR_HWCU-}h{>8P!H#7M^4y(!+_~iTt%~0Y{d@!wMAj;Dv3Cul_Bz=ugzJ%ySE&R#K3m&Kik_7Q3v-NS@FWJ|R#dx$+l42N}XmnNr zbF5l{eTy;-M$EwO?hSxF{n52QkqpHtXx~)f)XaZ9RlStqcRehjG|>9OjE@ZNfA1F) zVKbYieslBxk@ntEO{Uu$sDr2!Q9%#|5u^wN0i`MkC=zC^cFx=RJt@n5s(t9 z^b%@7K%^tR6Oi6f0)&3wIA=!A{AS&??z!{FtgI}7?|aKG&-3iPH`7bEN_2l7Eyrg$ zaO?Uhb=5Yapz*3Y*7+2H@#tE4U73ssUD(L6SemMN0_>wLf}Q~5 z+R}Z2VD#p@g6%%OLfsI8q;zV@@4bZ*Xn+6vAdp>3DH<61_GxeT-H8sAf1!|d6AT+Y zl24wXd?_uG%kl<}j;EMp9Fz#N*?%U&R0u_tUU2@7lpmIo4>4{m7AtvU5nTh1f22(zu$q_9(ZKT^KGCN;d-nd|n=$UChc zn=pfJ{Ms%?Mm-OF4(@q;qAL}#_jpZj4D3GJj(?Veno!}nO2o` z)El!S9D~E`e+z$C`B=9j~Sq9W#=Nf)mVy-iCK z1%>j9J;eJzAgaj|=7&nxpv}Qo^m~Pu$3wusZW;(G%PE`wm7B{@|c&}e}0oEU!WcaK09L_@NpB3hBs%cVxh zgakGN=U#hSXm8~eMxNb5dqDzN45PX+s96ua91E`wG`SBx!ucb?!hOvw8j@<$RyCfUm1;{SmmlcQHX}AfBF?)XPaF=J%h&5^X(7B7m-H`oyK%%n z%aHt@x^GFhvz{*#YGSdF7{nLzz|hTcas6BJXi8?Q#9Kv@Am+hbtd-?bEdQP-b ztn$D>7Pn!fFy>m7iJeMmHK4{dJ~Zkyr5vLIPWtI_dsTmRCtt2%eTK5?+6 zNBhX$n_$(w*Q+VEF4X|=*b>Md@u0n_z+%U>CO#v_)@o_c(9qCAqtbH6<7Q#8ky`5_ zeVz|ja$N?*5Mn^bL4jEr`=qU-S41C3&&R5G-7VbCSwTE1B|A$j`k7us!$mqVx0^q| zWIzVITn>Ae*|n5D6d1)TB&-Cz${mi?<`on~$j@e58`SsWQ_0}DXzL%gsLOszJ8ZAO zm=U&uJ*V!zausdmEzpJ3b@31Hc)hYEDT>jfhbA$l59V!ktf1RY;Xx}-?w~Cc<)WQQ zqvSFzCiv+!61VR)`PufIouK<5xk{ec^cu>V?`r+~OGAwu}-%ju+2sOb&8k1 z(Z+$CvxZ?~m%aD|RsK6(@B*{VFa|odbH7{DZD09=apTOgcb{aousPE}R&a=jAQlI(KV|>Ig$wD@E&xl? zYb@aqFw!w0yR|w*KTKo|nL1$6xp01l)qo1JVR?SkG_4HuUvwPqyTw@NzxeLZ#nwAp zf7P07KR+X{v~ymyQGVF~A+4K`6|$B(uPko+M0|?tL6RNp#XLwmdr96H`X)zF55mAz zwX}HJ%xWF%j z0QF;DJV#J*=^JJSWI52u&4)uL6jOh3-KYGP7@yZ^=`Xj~oJj2jh?$u-cGdP))I?Q8 zbuj{!tf9l zU0%VncDP@#dLO|BlWl#{?U0$s zED4q9g$sx`<}4F^Leoj`^?>OyPU$Ip>{iSz}Bg*k3z`l!ku|qsK6wmfQFc zSN1*I+aT50Qp{Y%aM>agBgG^qHzkI|pRy7ybjU?DauFn* ztN+(*RUHg)K`-ejnVqQjERgw_&A4H!m~*fbrK!GX6)mfoC6Zd-;cCWEAr%fL*)6w& zb#z?QT4j!~1bCOpz$f`9ozQ7YVJe5qwdEky4U za;~jH4RnfK1P)6eL$S2nkPVVFgBrhG)nZY#`FEMK!nVaDxHzP=#| zy@tZU2mzrPRh}BBv2x0a^^K_zH?z9HFMD1YI&F$1@Wrc)8%U-G52C0SrwCx|nLVt( zeZg;$3!4-H0Hn(y!6(NhUL}km$H8Yl>XlVYxMwhJ%nETWX$bf!xA)555b?3O#abrG zbv`vz0q+8=qXjlQI~9BT`W9a6uYT7+<|?p+3}#eo_I(BvnP$(o%^TKt&xjr$e!Eyt zZ$8Sn;bHVAbSepO8w3&j29fUH`jNlFM(}vb`h>uPS&PJ;n9)*q3z$0FqNn*Uh)POJ zS$g-ah5{eXG3E>ty}+kN`U`gvl>e$k?}SCl1NOUwFv6s8~QlFss(SgZl$Q68XUq_ zPETJpGcifid(%?h8uPqI99BKFEa|>J;SHRYR#Pe`+@k8&Sp{)_K9k5p1~&rFO$wGm zIYQBkuTI3uzc(*^x#>xz6z>X*Q9=^){C9qMvj#lJC>mxlPk^Hsf0q&*>T zii)X2@4aT?W)WTF?b1V4ga#17D)NP!%4=x8N06=u-}sO3(I#3+t3%ka{T)C8*F=*2FR%oN zC0fIQJ-DAoVthg%%y!n#dy7oUV69kWxB1cNa5^m!Ij$#s>cKCY5%uEXpI11Hcf3$+ z9Yq9BysAsILik6G2k?+A{~xXBbMO|ohyJW`Az@XP_p`5JyM!x~3v~q)3Akvh%Bd$V z{qHTylmI6wy4))G_qeNv4AcbLXGG~$EQEC#H)e|n`+jYhpAlHTKY2UkC9sfD(MBIm zEacxGKPrRY=ueS$vhjTdMKffBif1DZgxj0Zv$Nur$^W@`c!fFqzF`UlVfI_Ff>fNh z)c*B&Tq9=KFl}sr{x)lVB)1Ck(NoQB-mV0@5<{DtTdM~S&H(FSBM<#W9fArlV2yUy zgM6xw?v1{uto&I2^z38{-xc9s%rE%Ypzu;A0eCQtg17P~sRYLlCoi{v<0BP1{Y5B~Ul@c;44GhM+`_M_|DFaB*}SM!2f#up!r)=Q?6Fc-uVBz^U- zo0s`@oxs}=w~n3u`xl@1(^03vk#c-;rsENLpzdK>yJWFqUbPM(Oe6n#Hxn zyE^l+vD%xHpI=swteed~Q$SVS(Av+7i}U7JG^hq6VeAymb$8a*)&!(N`G)3)V?d|F zI3yBTy_Yq!)n%Pxs)=ubFX^j}?d<66d_PQ-<8%-Ci)&Qsq?f|qwo8BBHoyPm8=Kw-j7^&!1lv>=tC&*vX7JdeabxlO zvDDAeLJLU$I1rh!hB*!6-_q1)R%gCFmUj+FGwj?!3fFGChsX^}EK_55u316)$>Nsi z3sOcZCF5$?eopk~XhjlCR@x3?FiAC27y8)LC)EgRo#q7?ah&;|Vn$JR>vfqyPNcQz z{g4frpFMlo=PzFTDrs2-pDoG~c~;k7;VZ@;5uYNtRH32bX#!mcdM|5myr2hJyy|D~ zrb!C^SMH=mv~t65a=yBe3tR|${&L=b4Y^prYpC`h?N1npab|G8I82`L3wXw~+7ZDk z*PA0*%?@_UU5nqpe}AQS#8XH+KaNmTAv-zw^YsVr-{ch(DzNn}0q=JeOG)ALoe8{B zVFFbeSIfwmGHhp>Ey9U7i0usxKi}r!O4oZ2gg!b+!U*>Ir^r0tRuhhuQ{Zv0od5fo z!2^vOcO{&-@PFqtb)6L8c4<$H{W&1@*Y{87iB@v#@BMVFBH!-g!VNjMWxDYaB%LiT zDzXA#RjH|-18Y5-d8L6Z0c`98$JBKK*qlZyFd$>3T5|Xurc^K9(FQ~S2J;;)wx@zy z?&f577P(n=X^5EMvr-D)Gp-W4t^G@P_EUtei6Bzz4|VFM zyoYuR@b$$fCMHJp0w66wEzrUZw_#XZS-F&wnwy`Wfel~$SXMT0UC6oldZx(J_g4_@ zJv|W$`?PQ(IzB~&_|9{M98WM>dFHUUR7)#6C*|(z>9N|{rgXBrLdH3{;%%dj{%-0H zxoI_>fiK7}AJoVP`}-?g_b;xX!l|{!ssY2luQ0*zH9-%6Z%W2jx@M7mcVS+$agon> zpqahTq9nDQ1}X!?=ki=+w6^kxqtIIc2bJa^GSU*K~t_8q(5Zi?`7k7G_J zQUgwxL;J%XfZ)r78G$Q~NTnkzd(40vCI&>~Da#Yt&~I}J0mD6EUv5*KKH;63BOhw| zDJA(gK^cC|^V+&`07*;allJz`xN|%7CXGD+OM;f4)%uE3VBL_ZUS3%#iRek@^p=hB zJaA`bH?+-qsw92ofmhkMtdR>l!UZOy)Nt`NO4?Y(&)&my_=Bym^_e`fEIGQ0ZOs^3 z8X8$ygQK$)!Jb~+3Y(ZPV5MLDzO{Uqj;Hnn1avCeQ4>R zVann-MIk>W3eC}B0jHIPLe9;BI0)5d-;BEKvCvx*9f}>G^fooEQg;W6GuNXA_GQPd zrT(a`AXm}*_btJUh84vmG2e+kzy$7}7PPz94W_m5%<}T0h@17((ezHe`l&dtiKrvgkZIMrQDLG-4Fc#pavLjl zZ-66&=(%B?ppHH8y5E~HDc3^8un~QplkV|HdEy12TVi$%sGIlu_b{R#3NB{lK;-ZV z=V^lvhHN!EeDj+EMIamk5yOg<++H%Tatgz{FAP~2?cLsKdLEtFBjFbbcb;9MV!a_F zpyOL%xAdus-Jr=rs9zA|l3d@$qmi-Lm3hr@5oUecjG^9&Qw{@Iei((JP%N=;{ALn>$P6oY&8O}#)UWH>9!iA|w;7gBHa3CUMuS`mO zsY6?HN56aj<9w?WVsnc!S9zM$RMnSr3{p9X!@0X>e>@bQ_+s>6v!kO!(^UlFdciYn zer3OB$i1=u(WG2Z_5$@KTwrL_g`3KAgjhj4un8c5y7XrN_4^k6GOQmf!G>uJdh*bo z@C^z8dl&WIzSe4Zbgy^7EyFdSOL07FJg|-xFsbeMs)D8;Ku2+nj&7?#emK!i#8$Di zq})l#wxn#DH8g_?$E9CsL20UB`X!wz;X@1`;E}kZ7l95yH3hddYT=svDc!=5;tkxn zOoPKvK}n%%J0hIveU?U%~DMdEr-St-?*x5nb*6p0PmgpJCMiyEk zHz0sGHPeHlO6PX`9Uv8%d?$B#X@9>o?jJ!I=s6Ozrur?W!hG4^oJ_LiTL z3Z|MbV_p%|YJQMeiF`Vn3fTjSBT*5i3`N^dwakz1CM3oRl%BKFrx*R1uvhCfZzt>A z2p&X4UCJq`)H=1Vkfx!~Sjwd(y1V=C=E^WHDqlJ{LY}Iy3o~6oHO6<23c23z^ofFX zBcMvP-ztydk_H$bsy5&~Aep4zQgURKe{@KbbFt&ma{f^mo$z}&7t5Q8N|&~d4i}r+ zSJn(@FiOESd@oA;iET|?`n=WCrwp?R8{RhNy3JKrN#K=k=&tHCDD+41f?hY~jOW@F zn>1)mn~qycgW;n|Qp+e;U)D3CHJeBK2IVaNc9w%N6F1+MY^u=%g{uuuZ^K2DP|SD-(!oOaG80B0#;ObQD4=u62zciKu2M&dvh{?(aTc>*nW zr2zTww>)m&4y0K)lmARF`*N#kP>`J2vuAfq4OE8N!9*sdF&|(CUp!G#ax0Sgz`&AK zxY{0Tl8{-)`e+r%Wm}dVjMZcf>7$h$Q&PU|Qc&T(H(ermAt%?yMUrfvzk0vQOlox` z>%8uws;YU(tKi3lYFo^c`o-)oG*UL5SXUA9%iMk&*hRIxrMTz|_M`KX7^xx|{OWcy-lWKUdjVt)zrQi>qq$yYpzP7lm&MwENK0 z)ARZy3rEAQb7^uNtH(yVLMqr@9nJCSy^Q!pGhSl7`P7`P8mr!mInqaw z%vsG&-4vm|HY*h#dsxd7*^y~yz*aW-FPf#&0X&Q)wGMg)wY|M<@~XP~E-hV`|7ZGjIO(6fZluV4UU?7v^gQCH47$vQCs( z1X&Bxyq%6g*?cTK{Ne%y!KaQr7-|WHt%lR;&p&^;Rf#{3{ZwD3|dej96+k*<__mw{0YO*V9Yl`X3 zbTpOos^t3uQv%nG)hDaqyN)~}HbNc>-u^q4woKf6ME=Qj2pM_#z-Z0eMDrifZfal* zihFmVB^-^rFM%OFMrS56>O+LmR5#Yrn-PopefJu6m@(j>zMp1g3x$hxgcVu1D@DrVY#M z6kW{YnXeY58ZwQN)#v@wGBam{3SfPR6fb@OfssQUTK`W?fEgU%+bIB|GeFT=+KQ}l zDGgI*U9`>agUbR9pi3TeRyhSpz?7a76)q39t|a5Tyq+BO(c4>Vd@3TO?$)r%tVx@U zQ+jFt>T*y@0g_|D-kF7qM88r%C`oa$%5gUE{Er~1p1lIrvT1oh{MYl`4_xiL&~MrLcOt#v6oHYuJrP$J7b zozhfzJ*A191imY}DHTS?KW{T58Ev!f2y_+E@?n_}c4s>Ogk4oxzb;=GmiNck6WN95 z>C68+np#EYr^HJ%i@K9*3v@{L9ln>x&w%2Dj+vRX(JtnVto*WKTU`^8!8<=$C~-Qu zGXqAZg325CVvhWFk$TiR)OWSl_{@VXkX3eH7ew|P(JU3MdSh=*T>bpt6(KRC#d zujiDJN`T?_5``Evm0s)uT86O)9!22<RlWLJV;t`TXz?<#q^$!_p~}#9XKhLZ62K6v?5x7@O-f69;5)B* za3$2S%48K6GqpTX?WwPSA(v5ER%X`w2K|iPt0t401kRc}bL+E=si#@fd9kaC+mUUG z;EEa&qBVq%<#{4gaO}C+M{HlL@>miw!8jiUU$4pM%aY3(%{~q+!93JdxOyTuNRcAC z9+uFHa6`ClLFlNGhCXL?~+P>V38zy z%8xtxoYbXEA3UN}+thyP-+(6@fU*5oEp?_Q0a&)(=WJlbXzacAwGrEz`xKT@KL;{C zUq>w}gIaO+gu21*ZbK0B_Ca-s*FiOEdhTj)4iLj7KTBgXLD`MFx;P%H<^i#VsEdO` z%UDfSxQ^hU$E+$h_{sipQ)pobHf?8ZT+m5C-&&8@KPR)!ZMP`;l(ispU6tFpj_==% z^r$VnG&~7KYt9XR8p}?>Rt)CDl!OQ2+|sz-{b#_Fuy$qFFj7Na7$zg%xvA`M0bP_D z&zmgN^cIgm5J2VaMutT_3LH}U%pkOK}bCC?KLRM_b8 zh##DBZTBtQ$8+|QpOP_gY5^w~C*W}QZC(|;w2Q&l8U>KNSDf5b>FbjwFwhhFcIUe$ z+lGu;<%k>qwTg|kgetR^P$nI|&b354>YLBHC3n2uz3tP=BS;$90oaor4MiOgT$0nq zDo_Ef-pmraqpqmRP!BO2OdBY29AY0dPnWg;F@yYL@0uKNdH@}19(u#pb+8`Wx+bwP z`#c1jAqD|Lo)&5EFIRAQanTvnkI7Ejszp_%QR0mU_1eh!}&NXN3M0aJy4eFm< zOE-X!)hY>oYxQWA&zJhTD11n-{Fy<&{-eoFX4zVx1^n^s;_pP^B;!E`xM|emj}<3?^t#Z?zmV+|M{pzVgTM1Ry?p##^T7uY z2y{$NeiU;a1@Xhs(b3^KGgnsusoySbELxc-BRT0VBScuD}ABg_WEfCAIfcQY?v|QMq&7c zs;VlR^(N$pwe@wk{jV$KqpLU#O&cq{78{iS?qHu?>>@9(fWX`m@K(dS5sIgOA5av||_b&Uw@+*W4XZkCI zteeBs-YN_NtV`#=vo5Yl0Jd7o|AXnbn&T21ncoWlUTQ8etwT|wLW8o5Mp~BX1;aUr zn(sY*uPtr7gYNCJf}3rW`nGh$!U#gbC%`LgY?f}`esp@@7BVQ=J5(Ot*}p?ag=-XN z9Qvb5BfOE7SUC%}oI5l)G-P3QS!JRT+f--9SLJvGm-1pXh}zoK0QjFx#c!%4y7a5c zn>Vgs=OGoSe46(qKP%=9LDI+@$CywS6Dxg6!@`zy;q8d%yev@0kw7{t?f@%zkvuT_ zB}hXJhM835)PqMSj~Zf4ncaOqZ<|GJ27+8^oOuf{YEjblhI`PUV(w_|TOo6KbhL&q`*azI_LcpVx{3PV_;OKdIGUL?>?}Ee|rdE}OWX%uMQSq>FOeJ@T;2ICT^rxze5D zR#VZ1W<-9PmAeZTFhQ1>)>QEReN%uY&DcdNOp<<``kKD_CwxRGs-X-Sn+U2&=X(2g zo<C>l=R0nL6*Nu_^fO}Pv zC78A#627(b=zE3uWKgPloD&G-r)2XlvB7||o2?QEK2H#>G`TU=AQ0&JGQN3pK3=R% zv%Vc`FMaqSAJ+bZyph9jEchP-WFOuFKODR8>;#7VF@o5H3WqJsocRDRyU}b1om68k z0PxSgAv4Obq|`h$)eJjq@iPvivLuHr)L`aGg7m?9&oO`^(6z@Ol*=QY^Zhhwgi_FL_LmPufuoU><=Ut6FtqOb}~JRv0~pd*`Vjt_<48I;vycBXsq1pC5&^#T~>^hXDc*5uo>PN6`n zZ92%RgE|(wHMDjfPw4k_5aD~)bUyw_3DoI#!7Kg|BYLyIoS2Pd+d98yZtl2Sihh<( z29Emd;^r1FIN{zvHr?fWRP2Et1bZ=H|Acq|kGQhMfPC*W(c)jx6Y%B$w57Za1kpXt zc`0+5*Fw0T9EIW@-KlH{S^Y`ldR(`xF6{B8W^YpGWLgRaWY~ zGJ;-+)XRru$Hd1wbvpz7x^*gJmsGrio*$v;PDNLRbmyLbWbM&b{{6%6E#$O6c6pO_ zgX330p}k(;B*_QQmN%bv7RKE$F5T#_O-=3VzQ_B)JAK^W*o07N6-`Z&D6T!^g&McO z9?pSS)r}=;)d~2f0`)H3%BuBX8Ft+2F6OI3Ucy3?eSkSWgvm-g3z2c!sMQ0w*!p@i zx8`nP;R(V3?-i9vfR#Xgls(zIclP1Or+(bM%-Q!ragB!)Fd)tHlVG!Lor`?~X zZlDqOUL+o)k?p?|_;hS5s`dH_j2-_m^AvbBc2XFMoW{7zj*(y=~8p#^NDH+nH7UYul|IX z#5ksed{-)NJc>sCz%L>FAHRaoIeF? zcNM5**1;Uaxtg5`x&6cv6e=E^-c9xd2xAK4`XZ)2&^=Sy9sMacH};~~!819^_RPAB z{iCkqgD`D9J*lg=>2sJ24fG@=PnC@sxJ&coU2#i$ihx}6YDM%T@gY8k7y9ZO`fKma%Wk6bqUv# zB4eOTqDKsecp^lPaMLrT&oV$>4WFjPNGC>=Wbl=xrlz(y?Nw++U~=-&OA#%!??a5^C*YxD7b7dYO_1b8Q))z=90MYntSj1_uXIHO3wE^%HjY25S?6@Oh%z z^6c5O5iZk&qWbFD%V2ye^D@-UksLSSK265Do1JSSkph!qcRYbY0YXEa0z9m&4rkME zkut-(iy+cP%L_6Qz-|fs*~-e#2(QW#P}zI=umXG{Rht*}-s?M9RPt@Dv=9*ynFFJb z+_ql7d4s=GJ3|6so}Hu%sHY22-GDg8r0k7@L;!j&$ks$j_Nr>5n2f^GF;G#YmzMV1 zQXyBsl$*7%FiO^nMNsjyw)bQDtNsWEba@nZU{`#r>WhyewvP|y#l~wuvm0Zq6#HYA z!o?fY)6*?CW#9eW`8JfEp5BhP8jXz-MT%pgVIR}cEY|&fedX8;(4;1>rU%&+y>PWZ zthRQJEtDo>;I?jDU-^+sCn-FznpF{uo6K7hJNj`^u&mq_U>QEER3VD{m2UZIoc_rU;v_z7Qh69b?t&UOG;-I|)19REz9VL6gS46t( zYqs7C=X$Y^+g6%?Mv*b?gGr{bI~ZRKj3>EHP)uw+Wnr_Q`F1g8vxo z;`hq$*Z*6C;1|dMphNPuMurpqxa<)_PF+SAl*-T^FQl?HhFbht%`z9)H7Vxv=SNPfBm7Q)8Qf5HJO<;hBz?aJnmi0y1;QH#L_*{CDCS5& z)9n1$Oy?}vZmU+rGNtRSyNZ^oy~H|(;|pj|>+sXwcRzmD_jvud0ur(8bF`TxOwKcM zE5433H0f}~Tz_QHLf7|pxY9BO)j<7ygrhz-SSB&@(lxC{^@unL^lFqF##^vr?syA! zOvS;0|9K^zJzzquKr9~Bn>*pNZ_B!zRg~yks7`za4HVLq<`ZJY*{SAiigE4G$zG>} zgmw7WaVegZfzW@HOMO%YvN4UN*1LAUGkQN8ybBl>YQ}es_&abUKvL{oo9I%^2nQ= zCZ3yOirE4Rh5Cw&3sB;Gwu_T0n%{s{FL{-7Oe!1@Z_~>-d_WQllv2ns)#Wq~Ii5}H z%d9W_ow)idEuJRrwwuc%LaOJ31|A+Xn9B`PYO9i;-sBY9>kiYqocr}0J^a$>STQwb zXTpoyc4=&==`JhiLD6(0eL;gpAK4r79$blygg#+hWYPii2-(*YmiLzj`gi@pXM!YA z0R`&hF5iMuBe9Z{|F~>f1ps;Vy;`Ivn3a5LPYRda%yLeG93CFd4dm*c;Z_C!`fd*b z9knu#5BB7wmX)Lp_J1O3KLp3HW=T7Sb0^Gc{A{T6krd~BV8Nv})D6bM@$^C0tj{*WV3Yt^EHlKcv- zKtq$I$LAFjA1rpVC#-*^_x&K>md#g5)3CcaKkgEuKwuD4#xEop@D?A-M5rt?gTm(s zMh(ilii--H>;{azhhL=SYqxUkS@y4Ay?O@#aPo^hk#(%yD&e#6?l`udl&})kVO7;s z1bMW8D-acFxyi##Boc0KS7s`0ahE|TpqC&uVY-$Gon!S^J;6^h%nJTw%zml22SKS^__EKI6p5@Y$#hc z!#}+y5!Gm4A@qc)F)(epxxnco0k!2K3MqwkFg~T){DO)NGGf z+l4b9ux*(o&x##Qi$$o+_sICEv?#H=*UV5+;i8OOjf@ygpG=jrXt8hQgZ3HKKbmM| zh`AwL{*GffT>0hr`ZAiAs)TYSswzdyIY?n4?w9STf^#8TDQP z9p+*>5zoE^G{BN8K--EU*?W@6uNqOc7JStpf~>;US}_NxWIfqr2kfgY|Ba9~goX2G zkopsf1cU*PB>6L`vB?6oQGhP01*C_P&Fcla5D&^bCZ@G0GhmH1mdugQH3Ra3@+0jy z&f>GJ@!9f)u*yq;E`b}Y-G$!(;hoh*O3f9c1@rEA$#;WxrT7jy^Jw|4C%8@ArO?vo zL7s7?-utAdC?i}#$51y(} z5okQZpa10QRK8-0P!e|FpSfPd?w!VbPuTUPC_n2Rk-aBC3Fepa50v|z5_)^Q{s zth5PKhqkDNGf<_AlR*pb-B+?j@Ac=?j7zc5uy=xPPU!vd^-64&=!*og`~}}YyG)9Z zhYQOVw5N1+9if_wkt;cguVg3MNTv9twd>$gBY=@-S#?sZlpGeX0A0M8mjozL( zoTH5IP<4nd{kL_9i=0cp>W9GeuS+-*7HKacbsD_M_Ft5UPTT^K$r;Y4G2;9XbExoz zW!ba{Wh4a&90Z+QF197MS6R4hXb12J=x#kVdQy?S#`Y>17v+}}@;NxYtWu7&9|Ui% zBMIVb^K!#v)0@r24i}Xo5tM!kj)|>a>oxPL8@IS6UF$2SyzB2mzGSQBHc`?4P$r*s z&WFna4&QoXE8lmVO}|jK`5w$KKQFHn`XO>G3)>P{H{W|S0fHHQX1rX;VO~6dKjDD&!uOmMzRxsr$t;ne$(~AA_J9UU zlq?_)`3ypIS>TG}#OQx!KMeTnr{u}`ll9o#1W;v&5{wpnv#{uyDO!4nFX7&>k$ zI}mP{)lsMOc2I`j9yBHMugm14US*PJf;cD>Bm>G4dHExd?|9>;-bjM3D9B5GT~c3y z0=>Jv7I3+!37*{C+%?s!i`-GeJs~O~=-m!`p+|W!1W9|*Z*SfICI_oMK3wk@8j5MT z1vD;my}iB0l$M>xUW(q5a<@S3?*~$Cgzxc=uOO({3BACy>>$c++`w1kna3Aqao>I8 zqsPv;+qfmPT5YCE9Q=Ti_nY;~#ORBnxVnYic8y6=Xz%es*YR!V@{)fv`!4{!3~{bx zB7!Hz2D9DuOCg0%xd+ry_dKQl#WelX2N^=Tlv766ApTieyvS+w@M>;7PRW6?}4_Ptaw1BKnk71UY_})YvA|*4L4} zw`3e`ZAU!+sS0}dUlKOf&i~44vt2o+WQ{`8DiGYTO3F{m%ggsWc7k9BDUloRSGyKP zJq_I4P#)7Ef_nQ(VuyV|BFSnCGh`M-qBI&sqpdFC&^tBj*Puq1)u8rm>iFo5X;*gE zTx>sRhfUV&BbpOiWA5*b%w{ zzFQQ|kY&CMu$8LIj4nxfKm`>UnC1rhl<+%bd6nK+Qe#PQ&e_9fK>Bod_wljv_Wv>9 z6!^&Td-h$k69!!GPv=Pd|Kc1=gp&LC?%a6_(!5xg?x@%5i_#j2V!n1hJ5`v9!;J$_ zOW6UujG&w7S{sNYI`F6#7m&;~EQHDO6TvaKCcy}mxe4E6@8Xh@nYk-FP@^d7Z1Le7 z@D@lfZ+vE2`vlZy&oFLUa&;5IMHBM#ys_OZKDv-LT?yXEOZExRX}oBLRL5 zCR6U3{QlbS1JMlU#-eeL_oKn1dv>7Q;uK}oFB7fo2n-I3R67}ivKhE=;`gP3HbE3W z0+p9TDM!3TZtcBDC6F1u zAnA@>Tm-EQ$p9_;9t*H0t{&}szO|U)VN22d;jYTZNj-fq4r)K8>HB}#@i*_sB+sDf zk2c=etw!J4d3jM(dVthTTtJv}qqL+XhTD5l&hDP!$lNpd$RO{~=&1FrTem*EV(aEi zqUgMvz?QkQAdJ~nR1H1=NY#f+v5TTfAeqHiC*)92E#kScd-9{#Cjcqzw%EhcJ2*I> zeKbvfe8)4L{e+Lge}qKi;g`JY(_8 zm}V65KPUSbgu(yefEg}1QB--c`{%(Bf*5$Ov$J#g;}+S7pOmp2I$(^uexs8_bQZ$a!|n)&2fF0I@3z!ywROkDc*dLmGC@Ba5T(8yJvxpl+4r?j$CXcJ(C ztg|8sq)08gd8Um;jECnoAdl11TOt%E)k+kgYicTcV|r>AS%uBc{WsnJ@EX3_DD}(J zlePI!7G-B3fKJ#W@+N{q^>aQ53y*t_d?+G^sL##Kchn?%-A5rALD1?adkf^_EjeF@ zZh~3{B6vzVWnM%+TwNqVZDbG>P{e!e7k`vU0`Vg)ba@jBq?sw1?M(LKTzsiR{Se47uFW zsxaC6r1o$X^lu2=WPxn>htHR!Q(&8#n#L;Sta?YhJe0gwz(RW6xbN5~vV4Sy<`c~g zN?DazQM1xLhG!qy`)tzk-oKwU{vl`%SF`Tjm76~i`78Yz&Aghm7hw+m8|PLB)L$%U zwM}W~d$ z)WEOOsfK1pp->Vyg$RrNUSD(eWzL8?=I*SO*Z5N=dAOuin>`*3{hoDXlksYqI^;d| zs?wq*)fTsIw{WU@70|2cX1^9sRMp`KG%KSZL1fdiZum1=aasBlk4G;5<0`s>%G;lrH?I$ zBHeyS-obpDeM!4yhH--(GAxMxK{m(-3Ew>u{~^s2nRW{%Ua{10QH(E;;wq=%$TtuO ze!XRfUa#H^?S4R&yK%UK33HtarRr8liBcL};$ZKIYns4dYFWM%EY0vp_D8a1MKujG z)@0e09BjN1a}Mt>$rA(iF$G~92J>3wrcdg~b&hsa{vDquzfwIgSLNf~ewYue!t zXthA^f<^sauNgI?uf*^~)Xe835Uoh6@cthw7z?Z*Oa2Yx6HDJLfwzKc=H1p3lR*^2 zvC~&*z4QAer_^E-5_oskF>d>C{IOGB1&f^R?H@}|n1Ww!iGxB_a|kj|HC>iLRkrJ1 zK*yjGO2Z4P7deF7j!0z=UM*#OA5p2!=j$+Zp-XlueO^j6ZtfF^w@aRcZbm=JDpl!| zMjno@Io&{U*`s&U7Z(puWwD(SsEkm~W;2O>>s$c_@%HB`DGaW59upIxPrmvrSs678x zTU%Rzbo+4vV)^sA8rNW})Qj5KshNX=>Rf7is+)Gn*w4YDeA&Y=W6k$k?L9vuw7m+i zX!R$I+Apt;Y8j_qLCX(}Y87|!ja-E8j9!G!f3l%Id@i-wBXZ$J(N5uh+qP(sobEjN z1ol6o!GyTjSbhKt5^)#*ny6%jcjl`-Ja>uGZeBXjL;Na%%n=shk4-1bzz2>dtPJcM zcxp=Jf|R6WJ09|=QMuNS131fys?{1Q>SMIRgC+t^C8L|dqR~Kd)3o3%=KE+%RN8fwNlEq_#Y-cWEzh%G$<=ZT0KZwI2lP$e{v&iU6TLM3H& zf-^w5H{_gjcp0@t{zKE1p#w;(I!5`Fw%#n;mb`M;yhty~lcAWzbIw-X-+4Ct@T0M# zk@d_K85dhyT1UOgGFdg(>O%PRjy%~m=!AXROOiyE zxxd(fPQk$`k0j*oHDzU4vQkPeKf|YSA8GKrJDttLN@N05N{E09e@z_vFMIfqAG~@_ zdcO(RiLYWvv1<`4x20{3P7(*g7!2 zo?Ts#^~@fK!88RG1ax5L=2AaDq^x$dw-1$+wQcL99`=3+evblWYha8^WJER_C9W?( z)DiTp<=xyq;)dnLYsZUgdHeIEELp-UyY}|tEK7{P-K&nj$5TYEqPztso)v>K;fqFU z8}WT49%=w4BWG#W)bY~Wo6qa0Py4H#c>2FTeuUtcV77>d{kMPnL++#188oQ)itX<1 zP=5qm=N#yZE%Qj}C!Uc6l$yLK5yc^};~#>@+-hnu)p{7*Q+LomqSvjI+r!q#5p=G? z-W%2ww#xVF8>)nK3nkZ~?DpwEaa2X^$V#!{>3oBlxE15RbYahJY%CW`TcI&f=PDfM zq;zk=P}6;{C}zPh$!*Un;lR+(gNAsQ{9jvDu)7(ypWLj8FGse%BT~vA;h3IS{tvSM zKhTKs1USL1Ufx&fej6ijfYp(8fJwIloKl%`IQG`A0#s#nZM+JF?DU@?o!dx$ymkNz zNVE$U-8DjW*w^&L19i2v?}9-AGU0Q2EPyphq^6T%+Yl*LorsCvOhHyu3_Cl2aLS;j zMzjMDn5r@6@Mq7L@7oOyOA?zZqhBjRM0=3KE@Z!wrjM=oxMKJP4;_&S3pjdI7!LtVe5`*XSwf2nYGOzc@GD@$~J z>|w=(4LL);cYy2E{;`@#HL3pk^;+!it_O-f(f0@rl)OJ16TR?u|rP3rg&Ob*tFGgAAe+` zfdn;QRV&ot@zW}>(!XlwfpPoi%Y5v?zwb!kU4!4}%uf$5Dln~7>EI%UN2;medp7F6 zz5+s=4Q3Qnj_sR20Zd6LEF@2BJ^LbX_5l3oPH&kGLU6^sba7e3t&Ml^)qp1!iP#n`s7u z-2Upyb}|A7!WZ;W6jf>8LZ%ykz1E54{`FCL7rY$Amn`;=->>!%l$fK55J0L37^M5o z3mwW~10;4EVOn}1 zz8$t%Z?{9If}6{he}&8Pdyicn+_!swqyS>w+10iD|6%Mc!=m24zhOZX5G6%Kx+SDT z8kLX+k(Q8FN*J0UEgI<(20=5!i8fSY2qxX#h7{er`QcBr!<6 zNb|5NC9f49NR=NOx|75l@4FN2J9H>OOZxGDD3S}9n)d<2Dcp#B_UFVnHgsyA8?wTc zg`&$s;U`7qN4d9O7qGZ)FRDYfH^^~TpxP|x`#m@ z4=;KY-kIOUT?G7=s^4FeIsPRYo*}-NVtI9LPbIPSc-q?)Eo^P`{{YIrkN+9*OAXTN zl;~ql%|(M!gf^Zla#E_ppl1y$noxj zzKg6w+f|$6tM6;}@Q%VWtd@{Sfw%ZnPFaPZIR-3s%Fi{Ghi2)kCg~l0vC(mYkta3o z1tvduAD<=synqdbhi75+q7{ikbEs4qnrC)NExZW>h==t-<8hq_#g6V4^*Q$a^L$N2 z@0u#OCADMdX+Udz5Cs2EC?fS1&g0OA3W{Kdh9GB!XSvxd#7nW-v7L%ZKgx%jr!1%7 zUKZx&%_nUx;d%hn%<35$c4@`@aza0$GoS+;OeB6%VW60;hPYDO^% zo9e(a1ol;O(8h($n$8Rt&B{lpMt}yla*M=I{Yzk)<^M^m z2XO*h{+Q;-ltp9FBI)+fFYKIph}Q9ExA-35d?e2H2FkluNKnvX0b$vBkK$RvIUM~* zAJ5=$jD@IQyB3<6kUc#P!PmzvK6*)tBHWf{l|!vn*6j zZJvku2i2n&=gVz7H&Ko6=>sNTNj=g6p5hiT;H^-|Fp%mp^h%wq2FYw8}Due@@8 zuG!yW6;Uy;bB6mU zzg6x(t?U@xXN%^#T}X1l5?DMmwv=Ww3X;g3kGKi{oXC$JXf}3Uwd!B}KYkN{H!3_= ztN5^7-b(G@K^el|bb?H|3pSVQxzNNv;yi;}3qANzTIO2m4uta9k@p-5@nZw%T{{D> zy%fy}t1{q5JRJrSP?OARCzw-FEd+bJ#C)EAPVUSWO#7Mu@ZgG$@m=PPY5U@`%B zO`AB+>37Xq4X7rx7s`gH;;f=8??^v%4yxc~8R3TUU`quUbYADeIi^Ah?FZqiZxR<>2Zv0;ykF{UIOW(D6MDwBBh z>w`a>il)C>6&iNCBEib}e>@5>$r)Uq&|rctI+s060)At+iI-0v2MfHyyt(=-!~O4n zbHPssd`FSa-SflI{fg0q7F7Hq_3K~%nZU&cHhUUntj}H5UHaY`$SV_?H&_27OziOh) za={b8p(#TH_l0Z!u+Kl#kXi%Z=4dISeEu3%FQZu{wM+cBF<}J1qTnB+LZ|i(eKa?R zo42q|B|Q-sFXS~RPf&x%8k?uCeiJh9E(!Pt=}3C62i+1dSxv*ep_aIvdHu^|jch27 zI!QW@Y+wH{hRmhtat>!dq}SALvgO+Q1k0{yQ9jo-eIJz9s`&gfgb;)){$O4BJP-Yn zBtQB47ciz6tB9h{&(iUu1bY)58@PXG)iuJw^2{99?(CbG$wXkWIk{x*e=vJIE?BeI z`KqSl*0~QedBJiC}sUv`E3m2%i&b^K}S_{Z@wLNfGF^HzyPCvTzq>{R09_DpPrZ27dUOjqX-i zvVdo~`viq5cVlls~^@D+8i7gpCvXcY_XGglyC`;EaA(SFVmhSwkukYb#d3E zsk61`sG3|K4T|2=cJ27M+GEX#vvBVXamXyJF#M4JA3j10jNckDAi4ou`kZ?9mC6E- z>#RWN^ZViX(GQ=fe~*svCVI{JvcGp@REkB)=6f>fHP5{@0kRY?h5o`Hgmlw=DF@@N z=G`e13uzFQ;KSJoo$@nB$PBBc%rma4X{8d=mfh^BP+8S*O}sZl!|@)R6SS~d+37qy zPJt53ZrrVt2{H-N)lx(x&C!o~UIL#v(P5AZr13fBhuz)*w#6hpCa>RqIvbAgnGc zLGM(zINsMWDejrZb3Q5r@cSNmtva3*_lue?t?{h%SvjrLoW2IF+pBWjOrhK`rv9`RL6 z-z1ZaPFGvLsMk!~b|}W%pKBeDQW0elIn=uu0{W7KRrFugQmoeuQD@ZjP`dRzM-8`# zx2;+tcXq;k&gOr}Egv?@lOeFrcBxQNX9p20TjzB$296UL2?^(HWa9s$@GoH9q6Hg% zF#=xwRwQlrfJo0(59RJiZneVPY-wfH>I{*z>`XM@T|?%{ z3d=gXxwQsd$cs{3)2PoMlk_js$Ao{fwx6k51b$(07w=x?mG%~~wZMfcE;so($4>h~ z{;B=ZxHNCWuT%2tWG>iW*H2NB^9k6qTQHfFM?MB49%J`G) zMo#mSi`J@V%PlUx?cKtH(&trA=V>TVu^)CI;5}lefvU;_2)upi+uNT_smX`i*1T!p zGc(cQ)P!_nZINAMyym&VAkimp&WW>hFso!R*T;T5Hj_28y zYL$ub$j*jlp|}K&Yu_~=UY|2pn2@6?Y$G}gyU6VR+Pu4EE&J!TV#zH!xuo=P_h{k$ zcMn3j)y)xamO=)NXFwNDTM<4Bf^*OW4VR-zyb2eq) z43*tdY7%f;xyciZROEM^a({c!RZ&kwIdqHB2Gz1Gu*cW!F&VsCRFE5jgE3G1Vcxc) z0B>fz3>o({5r71wITW zqJup-b)6Vl?3Np`L>zD(wi`c8Nk(cT?Qx6e z0mNc7PzoxzGrt#nM*&9sOvLIajhZN%YA;df5@f5TMZztos{KmE7AKL1_}Osmw44oR-69A3 z^RZaVlv`X3(>0651ajVSbqE{Cj~q)m|Ib$U1y0xSUO*4N%QRZYFbMclSCg{ z#FmQ|WVqaAM(>3NSgjZ#*DSP8ml4lP2gGLle4d^jI@{xmM9zLUI_VHYCUh$fKf{38 zpTQ*eQ{0!>Peq;shuw|Tsv=j=V|uMim`jDGy_LjE2qY2ir`}fsT{NW z58-u7WY`*B{WqlOLffPen#q4%ry#&;6U<7`UpDEc5V-Mg*8~D-x#htx=Xx@f`mXQp zR3v&mIO_PYXGHOex9S5%|7CdQOXjVO##c!e{^XuXnomVWSX zJWIl6Z~_{|$A{Mb7DyrjC1eB3=^F9V^njn+JC!UFOv59};qsoXlNT#;-=`eSSV~eO z0}$WJXuCs~REbJLL#`&Fy2XTV4(=A4Ca?Ol?8$HnmutJUMe(=>c82=EyC^psu(2N$ zd+Wxn_9I+wJCz$9js;H7R{ zz!vmrQWMeU(0gG>I%sS!=By|e!Gx2jh;>rFn7$XtYlbY=pRGMWk?cL(^4h)_cWdOJ z+rSwXJXE)Y1vx8|tK{yryuno^S!|uMnxehqvCNlZnsQufdCBfk{b~RUY@+f8r=FRL zII8jXHkky9he1@9^GPX;s-E_itADSR@8y5X=3Q`ap$ts4=ij{r@N%L0d#vBCbs!@^ z&-6=C6qqEyN*ft0!+qDWr_RFMza~xHcuj%z)yOhhSl-e!o83C{tatfrUqgkg26- zawE(7WqH7e;fvMwkkx1er?Bi0*=*bUfRnjlE!Sk{NrJNz z&)tWE>@N*2o1YL!EI<7ck*=b~Qp+iE7BYQPlS~b7Ydju@sQ!p+>S~jdBZ0IP%St4B zyZ1?cMZ7%}skm!3sO&e5WL5QXVO(|OnMeJy;M$%|IVA4lTRh=-!*`Q7A~O2DM@PuW zM>@L<&h}={1hr2V;w-*SxLz*H7oWMeFdPS`r%O3*J>tS$NDhZmo4n3A9Jx+ybQUz8 z8*8PeLyc-}i6^VwpO1LaeV|Rc@ysEqY1nP5?n{C9Va>+7w^SsnhKp-IK`p60d_N() zCc4)$1~Ic}N^NU+T&yh%2Me(Iixp?ed@7j`iOKZnxlOd89|{brw41B9TDoX zvxTRJI}2Q4P%G||wb-N%OUca-S92}i%vH{|i2r20$L&6tocj2(iU`t%VI{I1*+J&C z|L;k-i&p?M7<^Gs`z6GGA!~kF<52(!n-x?GPg-8pD3uB(T3w~}L#u=iH%u)_22oT< zf;ykzb4gpzG)^oiiA+i@Vf<~(zG!f$Yq|Jt)Q$ zi=@YE_dVhDz^2DT$GdFoYlms;H@5f2?2CjCLQv_#!sSkT1qQD%B}UX$T?QdTmJ+A; zAS=~L2119>W3+>E@SY6I>tHVs$J-3Mm`z&~aAKdtW<-0Zf$MmR0)yPyccKQzHap98 z@%0JTB)0qcLZ_Xg9VhrzK7GcWq==i5Ld23s{uc{nAdap29ac!%2RG+8IjZ@;QyN6FGz)mcZ;&_UE#& zy+*#Q`A0Q}P4D(*bgBDpOAvHZ3-(|fj#yWq|R z&Edn7$i1?kf;u)0#kp?&R*Fd4(0lX1&zF;^-(~x7{y=O!WdEVArT%=?J1Vw`wP4Y5 zdp_+aj`u7Kg_#ckn0TW|grgv%qc<;d`YNg;@g)K7lTqXwT_(F&Bss#sW}z#YOsTDC z+)=EeW}ANTnxs?B)USrGc~xJoD5Kc`frKNq5uN~OTc%=c9_bZP4%5MREXZFhl@ z`Io9-#0?pV`@BW(LjMYivmd$VPmPr+3E0PZ-67Uj6-$?1DKht=8mcj_wo#0JJfRC& z?z(Y;f9Lv!d`BNL%mziq5uG{V06bX&qm%nRgFf$_K25|}>so6Uh;7D~cRvS0Vt^WB zf0?{kY;s^CL-hQ>zp?oK9irEPYVCnr@WYJm#FbMwWvx+Tr6wzSg($@^tCI~TpzU%lUW)()|5m=h!4U-lGy11CFC7lrH-hJFKVnEABxLChI`6#M}ZY z!yT(=gKPC?6Y-WRDu2%cuxEL0J>-s9LL@RN#$L8)d=&38t5#apQ~W#%vb#=uRx~a#H;}SfTNg1GGSIVFQ?}1)S0%1EXW(ObdHwUd}(~WP+Gzn^rOw8Ow*N&1n~(IZtpdl`=z%) z-K5arX9i7BJoM0%hTCyF4-Tb!6dSL&8t$>!yI@`jwVh@I>{dr=pf^0f?wEB6O79`M zH^IV$<>WnHybI^!Pi3AmLv(zB?5%dJL>~I+!W6Hm<={6+bj0KH=+8vbm?&8 zH)=IW&vtFc**CH1EMuFZg`=e~J+qZvG6Z(YI-TrOqyHZft6C?&lE)z}>c5n17xDK1OGmJt02_h{zb;5UtLg8PVf(^EXT$HtwS|R}#8Pd(0o!2vk-zYrR!9x) zWfEbZ=(4>_PT3>#Y+dKYmp>2?xTun4 z6?z>&7DgqHIX8yn1{SEEQZf}^6OP<-+6i%Hn~s{Gov$2u2|TY?AHYr@0W>rRi^rWt zr*S5#MfpxU$5aKe^YuuYqSm7~*sABKsQ@ta3#24n^N|aNnyDSS^t-d?gPs?#5?KJYbI+81g^mvX6?>M7 z!pe;E<$@r@-zv7NIZjOUt50H zO)n~xg*?&G^+Lo6XuEa{yxVq72(r|d82xs@q-lN!4-49;*r&j&+SSAurF9x*UKbgr z9;Oq3xH=Q>z|I@~qshBhZTN+Qo-p8mTmC$W)|NarQgz@+Px&PgH+d8 z2Q^uBvvYi%AmoYF=doAFE4mRFb%WqQZZ5^~+kr)|cks*M`a|ICyTVUGQw?^)fv78T z-tAi*E)o|~*1&|Lex~_P46BGVKCL)vs;Z^ zo$DJ}E@B=VaW@#88PTHp>)wK2`KmriF2b8Wlu6^Z)F--k+6TLOJ%;w{y@J(OfecP1 z%Ki-wVpFZ_EP>50B6sAu!dS&ASV%t!yxU*88e-C2IdFw8VmxLWlD@{L!pw8HN>iMx zRKfL^cc>(Yx$MehLqE;#8V-U&Gbder-2#fS9M>>UK&VHDs6XpvInEy1QSF8vzg!q} z7Q&t=#stGfJ_Uq#iOwc}=`B=@<>XrzLsF8B)}ljtnW1|!Cv2f@Y}0*mL0Y=uB?GnX zSGL~U>mD(Kpi?EuPlE}?^})=9{J-MN*|x)|NlzK4CI|qGs|9<5Q7U}Jxh9iLH4i2| zyC*CLmR~YNsQ@~&XRNB|A|lVqMUF~cA3F}nZLCe!wbvrX``8cScq9PS@=wNVAAX*M z94k*$3ygM*GIM=z*xwy?b>&$0-$uqeOuLqcr8`Pcxj6{Xr^}X@0vpnQN$5 z3%SqoiX%|v2jut?)LiT5*j)<;q+L@*$Q>K&(JT8`v~9`O7ICiG=8o}ZaUs)NGLq*J zV@D?(G?I2%UXqsVDeX_h#)=07ySUo8LUOKZ@)=64Qihr9m|tzi*wR0!$B~Cg<0e$; zy^QeXTB6=2=1FsxjGrPi8A(wO_#9DM?C|J=-o;Cjx|uBVvzA3qqXP9Vr|8&!t``#7 z<)Zok3csP9MU2E)nU^tk7)S+)HezZZGMI2VbfDxl2$T>$#JW$G4EaRV`=j0PKo8RY zARPajtId=JXVpgDZCzaq*s)LzW&V=O!=poOxbf+W&VdEtZl5Ce)mhl}rm@mz>F#Gt z2)UwMLFQav)k5{AVAzov6w9_oAm{{HF>x#KC%Dxo!15~N?Bfe>bEDo=)J|mJ53=sW z)vdvgR7zaCQyQM|pcZl@04G%rC*GY$@5#Vt7O_$dDGz6&i z7$oEDPo5U=b!?Hczf}9%Z=G)}KN+_TFN9luHLyjNe);g0%FfW|SU>#(fsunl#!WCp zfUnT|t3IYrRUtb3$2V4C8$5HcN1J$iWFL5cJQS;Z4VV6v(&I;`Buc~r&)2g0W#TH~ zVZZ`r=Ju1l9xw!jYeZL))f5yeHD;DP?4AqX?LzcAS{*6zHW<-z_!y!U z8%!g}?ip(&>*kYP;M<)MtY{tDWForMQW7aN0*R@7=@IYXtt+E~M$IwAuZfs^iE_kZ_zXC znX;Z+d{hNLo3N)Cd7Zx|pbLT*L3;b$n7>{+9@abA`ow^tQ(lnD)O5*ug6Pnse_)-*dtP&*^ckD!%mt4dbrmk&u|Z#vcwn?;fLRiE{&&S{7?3V0Ua?% zo3wLTs>NG=&*-LCkSk?1Zrd@}H`>M~KISn&r}S|hdHucIKVTCln+>tXY=(4@m{NNnKBkS2pH`nDDQ zW9PNg=0q?hRC8~fHkMuqXm%+`t=zB7z=OEhb*u+ZbB<|PY-i+0^6jqNx;i}YoB>H$ zo^*X9G%PH>H)2b4!z{Yb1qZ`OU;3t$aUzjgz1>q145KRjCm?Zz!{t5VumD06q*!BB zkhce*H_#94xiuu-HXq6d@xtb-*P7Fk*)ZV`*6Igqe|FmAnFL-~jH0P(JO;of>=0xV zKaEt_+xHZrTBPyzyS(<~6Kc9R4a)0Kw~VSGcUKV4Zxg*MXSPGf`@BElUE zJdaUX9k7BU)Bd<`GI7nKG=`2}5-eK6kYA3`VSdQC_2hLBYZ_#&>i%%!M$iLt45LZN z=01zWfEcQZ>*`imNQln8@fu#4mj&FewS}wrI(vuh^&VyJtzW|e$LoO`iY0nY_M&j; z2xK9?udAAy_-w-M>&`+j?7*$@&_JuUYIst$3Pe3zP(=g=vGLu@wa1l1i3~K3PTT_g zrCfxUEJk?Fs|F05el$Xp5EVO@38&=--t}wW!otF-?d@G145J8c>AGpO8npa% z+%Y9~i0jvenEUT4t6;!5KKTg@nn!K0e`0ubbC_&|33I_U=>Fnk?^orR@YRNqbnlH2 zxMOtj6EX~=;24~JtRM-KJ1R>+B0=GRV#iT3qJEL9GoAX#&1X1z0+(Yx`|>ya29}&M+Rbm0 zM)vUSDpfOTinA9rqT@v_ad%y9%jr2r0`0?Ho3cL>$*yg=imL zx{E2CDo#z6U1E>sBPU_Kf%Jbi&8wgMYW59|o#o{q8_(m+#?s z5P*P=Anv=IMp0dua0aQ?V*k#1#nrjnXGwd_T%H-izyWl%Sn!-Wu(*Q(!+J-xZ^k0w zW#EHc?<6=yiY`og3QB*a*NOJr0A@pc)LoVN%xQvV75^KCoqA}(vI7sL|pF(wQFU|c|JZXl`4!b2QZaqJpZoK%Z6>jjS(_d z#{rTJnRU+xaG9Xg9%%_EUzurA@s*^aO}DiMvg_noDjfXOE?n^02&a?HfD-&c8fQJ! z+9d;Z$X1T8ZrzFgH>BftUPpq@+%~Un^rl=hyVfF{b`@ zq~dTY9cDrF+#&GZSPt8?ez8-6JK`CFu`!_a=$KEn>pGn2>X;Mr{f52o+V#C+i(lkq zV%qd}*Cwp(s(*GbP#7JV@N-@pd8Xt-*%!BZ|8`CH&hBo4X6}%5&30fY&IiuAjl8A; zC-Y10oN~HHnOM-sy*5?PSa*Z1wYy}M5cpH zbjtk1K1B?}2(T7bNEQsD&S(~mIS02Nb%IrSo#b2iO_Vw8eA!dPSv13jw{uBweJWF# zUF!CRyU#?yQXFFtu0vf07K5uJtm+?c+E*T_u#44k(3M6z+|jYAh)Nw^X-D2=H7#}# zZqy0uoByAH039$lYxvya2oLZdkVFq3j&i?lz4u)xx4?jl83}XpN=cxj9K^{pH z-bdYA(?mV6QjlACtT_{}BV@P(p~r%<6Wr|q>CW|_Fh*yA_RWfQ;XS9JYZB%xWkdA` z`M4i+8l{}2vv)yFi#h78b%9p;H#F+V0;uE4KI0x=p42KXIVO*G+-b+?W>;rBQMaE%pBNTj`cDEz*rP6>p!TT@7MP1*)ks`~5y=*|1Y*?G)d_?-05) zE%!I$4qrH31`+5Y1;i@8vqx4fM-8tjf%qZO0uz^yW+pdJyHQxj32>C&4P&UU;)}1o zKpoCb-Kv5DtzXnKeJZhBVZGn7?owQ1T=S&kd~uL5GpKeFB3T!)KIe?aD_~_N_^Q@5 zg|7KiKw$ZSW?a1G*X}&;oh7%mO(cXa1%5OV!h*Jy%^|{uZs0*92g=rEs(61y6K#}r zr{1Y$RClzVRW7S7^$XJ|&No?RaMGXLG#ighs1}Y=SJ2Wi)~X2ee;2AWkgtf^G+8VV zM6G~GzpyE8=F9z~Z^AXiuxd{8H7w}!?9_xjrfzQ07z$^Y`=s3ygrjMG_eZNjn_9E0 zFtZo03Iv{F!x>pTK;=^wR=@pYG-wE0GNm~)L%m1PP~4m{3C{&{mj;;xP1xgBzcbaC z0LYrDWG*K>qN`E>+OXn-yCoUSX9-%njEXPD*A#~>I72ig0IPA|Y3~&h$`kgzE3KYAm$Q6z`sP1z08@?l$Q;A=26Mj z<1Hl+uM=8$f=|93tqB+%Z6W*(CW?L z4}q>2NctjZ)E~(^n2EEWcU9q{eD5co>E=G6uB7LehAt;(JZR8aaTxhDfSoi6H)MCIZfV`Dl!*&i*foMTa_CmqgYiR@JT)WK;UW{9BQo|N zD-(jlaq(U}>HW!)pKD6@ta?YWS5+#|MHn0<9dlfl^D5*BTwlhG%e67gw0P~_o!eQl z=b>1uE^(~0yQ7(cS466%7}dh3rhVd$N&pU>h~1i zFAOK!hxHXOlvEg0LI^lq0y20hPPWGDx2r_+Z^-bwSn~fX6rAA8<@G*}AlErBo#l!8 z#K#xSds=T!AD5?bm}?GlAhYFuI7{EUze6o*n_+srR5AN1lQMGuQckXnX7HVm9A?El zW!;KIqVawuF}34q9Z|(x*(wKr&a&rIO^Ly6qywa+kNC7Xiv>4Fl`P-pPk&U>)Ofuk zdt%w1q!spQDP*f^p*x$qJSV(yM^RqSL!9f&w3Lx?15q_K3n<2xdW$u_o_vi2KuzZW zr}yKqom#SlU+HZ@;n?juMEzJu%bLk-so0P6DY4(r%S;Nean!Pl+SNay?+aLufRBz# z%*4-nBm4GO{_p({7o^k!l-}ljaeDXAG;`84E5F#pJS2v&NN5?-;+t4Mk1N>!QbecN^pIuk^r7x}j>0I0ym0Ad=GVTe3ar`n#%z|F&6`jbQX_$w z7@=iJ{mD|t$I6z`J}*(0k8h4iH^j}UXSU!&&2K-w=$DC8IVDQL1;V4&LAEG|l+9H{ zlGo90!UJT)M^MM<7CkM5E-ysbdyD^X$TgqjLBjM$^F z3a&@E}WaN6C z`k7o?QdepoJz{G5IKfOB3o1`-?g5OiTH|F*Wg<1nAarm*!zL-T1gKERs4iKCKRy9L z!d{B&8`52*awpH8^%F^p%&+^z)OQGvBXh%q!i6mC900@16jLvhkKte-ZRlByMsrV5>&%n%H0Q7jIf}%BH)C6-*B>Nnm-5n7V=bv zUe+txl7e(F(3mc8=~xNcS9j;t%rm3w$A!RXz|aM{o989uug7}^cYd-QUS7b52L2FPo-53~YvVW|Kjt4_ zrQwpM(kdeH$cCz(o+dD%MliwV@VT~<3S7^w?7ia^DLwaKH5_-Pg8>OJmI%s9Wz|#x^s3X^80JeV=10kkF4lDeBws zld>ORS_RQY)sJA48=b;uTd-w{NXHqRiR+Q&7grmGZV+82w0h@zD1H?H>RU~Ux6kX2 zzm#a^C7?O`W(13I{(R{7ObO_fx+?iih2pIBllb!O&i*4)Bm?r*v$R?LZ(fpsD)FJE zgd0rmAwJzc_Z79&&_dYe59LeB)vDH0!P$o%U)u(WeRLIgLp1&0v~#}5ik^1yN0xrQ z^m70Oes&DwQKIvLS2bhxy)O^7dTj9QkFHpyXY4lMHt<>>+dIPcGENGU+cp zP-zvoy66)p-QUWzEznzfF06bD!-zU`(Cu_|dx(|vt7p$;>_g0`pC3L%Ka08u6z@lQ z4jj-JzAVHBG5q=j zo7E$XW(*OUAJ`M0Ak%_KL-B(+zpD|J$Lin7@~02VwE6WMbkpqBqyh-SjRCB;puUIW zFG*4!Ns|Bhe+Uoi_XB|_ar!ZF{E;Mda*Lbc60{jJbIxY1sA}2EA;vSJ=QZhF=B=P) z&h~ly7QIA%`_Hs4gV8AbM=^JJ+0_=}IVDdOmrXn zG{AGPNq>>jwS7Wg*wp@=DvWL#{(X`y485qmKpS;E-#$4Ez zc5(x|*$;^L@tDt6H}g~JkXzVwO`Xb81(_S>ZMcuW zW{~ETo2t;ce-%{Ce_ZySaASVr4gNP^{Vot_<0#34iasG56(Ni%kdAwP=;4_)H}S#h zk3RSZ-ZG~&v@T}rmK{!~5`uC-A4#x(;v84$qH7K8-S`dDy#n5J}OsgUS2e#NBs`I1pe!-Q@gSPg|tk!X`K=K2HN^H1Tr~)06Axo_Su^x1vNx9vG*p~sPSZWL-%j1pnF@jov$lR|8?cBNxw^l(7*kMapl6h3? zOunETYR_lB^?bDBppD{t1X-#yyll9Cv}nnm>;M@(4&_iY7ZYNw@n(UHjkQkU1+~NK@C>BpVuhA^dab}xjI&V zz0#_l$>L|@Ym1>SDvP0lWD-5qtTw=jfA_5YHVJJCzyf8x&?xkq^<3aL0#R+`oK1cO zh1LUyj?@^*S@OZv-vrnFUxKq^K@Zy;>hbe=u%L;`mbO^XS{04*p__AK-8k{5M+2!4rA>oVq7CI$l(fqq z;qY4nmYmAg3|3`rl2ipj|51)nq(dk+@mJ+td# zBN2$2uVVdT_9;jV7X3j|ZLF7oKmEx0HvM#8c*qfF1<0;E6HG1xMEOQwkE0|G#FO7f zg$x5W9*pi8)Ge{VuGz3HK9k$ky?9Y${f0Wv{~`7TOp^P?>pkyuP0k!sSK$?|>(nJ) zV}rOk>1`kXGH3sIQGRWpF9Y_dvdzQ#bVoyw`A*TSmFDHmZL6@fwLlVN|k6F0RnkKVlL90$7yz|tR@xn%sB^|t$j8=)(v z(!A$L?*Qu8yEXiCh8jLRRFaSBHw(X|6423K$s2B$lUQyFPTjBb_1n5jkaRvEdG)*s zW3kqX6N5$B6^jDrK_U9LvW@(`Z4NKKYT6`+A6^|74f)VGFBB!5`3cl16tYw?ij$UN zW9!RF;*ZtujCA5*7zr&AQ(#6#_#STJCiTfTurz_eTWF+xvw@6gsw;U6WHNXqg8I)# z1b%DJct$KUM4db8hV)Dw)mTM>xTlM1H`Cp2n8lQoQ?Vb6oRz68@OSh@(xxn(Ivw19M|ZwwgC z#c3GlO4x%+j4dl3e4tBZrA~%lq0JnL1gMa}I~}Yot*{-l5VW5(^FW5X`WPuv-kE*! ze}o5AklSE>Wni%AKb?}h!DUEHnZ(ZTf*gP9f*cjLZ2--6f)$ak|6xH495b{1Ilxg z*u!KMaUM^{b1OUXst3uegq2lvUY)*tanF&bG{#%+N%o8?Qv3we{kRzMhx!)o2O0wu znhgv%T8G`9CK2&qkyr|TXFpUxWnne-E~37q*ZM4bd&-;m72bbnT~N!^`r3P zOPhXQFpkJBAmkdwb^D!0-Mc3kv7ljC=QmOHg*Jo`Z7fm5U60-Wk#v>(9iRGoK*=Qw z5k;4=*WXhH(&z7#X{R+gO!}!J1_jCt0tEr=nfqZ{&R&GHewKh+SZiY^v98h5S`y)4 zt1YChew=Vu+s_nmuDov_-xsPrBRlbg4YoxriFryAtwV>+#+AsKoL76V)*Hx%Vg?ij z6U}?=lx~9VM!7(DFp!EGV~2uNFbkC8>~D`y?JaaA*;{lb8W4~f{>LpUd18V-VO*C< ziXzc1(LPtJ4kB)n)}|LZZxcheZA zOZJ)@?>8XCZ#vOk@Oy)kZ8ZB?IQbG3KN06Zx=Dze+v@P}NEwXtN}Bn1jooh>LN03z zy8J?}5+r^2;3eDS*{5EKuw%uPkn>kPr$d%xjrDN%cdvymOu~4WIuxyKe=u;WZE)W8 z8BK^e<)Hago1s!*XsRtL+lh-{)M0aeE|nEB>XN>joljv~SLTxtgEi!{L`tz=RnNtO<>x{P7uuc*bMYMf-AL>YXWtKi6LH7+`NMsaUS@E0dQHs@m9wqv?i^c5ZoI zxw5~SIDzRuA7?)O{(HlnAYJ|}Q|-2_6AO(Yur+$94 z8(>6LO_Xmop|3AJ;Ykwhp*;>3^a{bh1}6MNl~6QQWQC$K{(cA84@Mj%Q&8m^l3}9Cj|bkRjsnL1O7!&Xb~_mMlF7zTu(Jo`>HEEvlw zSvA~`?w7!ok#)~?Lq?w9XDB8evWWJf9udI-)^tw z9qmdEEi9a!QrSQNAy(%;1!D4| ztFosi-;1=?PZd?kbw*JyX}wS1(j@?uSswx?fFZ-6!(9>Slf6uhFM+KNgm(NR(?pd{MWlO~{!V z07TNBosYEh9i)(J&~{@;1idWu`CsoSQK}SQG$L0R2K+UEo9#n}j=~SH&YYi#@y{tT z!8|~y#!pUlhCgUbiVBnOVZ#uyM$S+zQQ<n>DEv4fcZPC;OuU8HD$T((9$FL_hz|9mc&eVSdQpdu)M z0F*Oznt@Q%VuJnmU7`4-C%9GdL8{^C>v)%)zd_Otw17ax}DMFT^+K>{|;ilRBIl}tPWH5IZwZYNtDe(8r# zPCXwN<+b&XMbWyKngkphJI%)Ezla37gf7elBuDXDMtB+M5HHY**Cv2)Bxe>e?;qdz zuSath0JsDbPO0ku$Ziq>dc=00@6Yv!mL5|PUGazky$DEI99Dxp>U%MM9kE{fL7OY1 zCO_Vg@QmJGINJ#h_75cpQq8`Q+0tvhTWnq|qpi#)yFEaM)n%<()efHc*I;@>hgwr2 zfUnB{D&F!QgW9&T=l@g0;{f)SjsZX0;y*Nhwl+MkGNj1#oUw^NkJiDkfBXAo%V(tc z6DuS<7K6>>cQ!DF?qYSSH%b$jKfS*Th*i$cx^9&aRO}TBw1?#yBYE)4I@hySW|U_C z%C)fHnv!nI9p@>^a$VEdInV(t5=yTf0Db)sr#ZDA)1uK&|CcJ3GOu~uw}n&Ot3U8# znt{s_5p0R3q>Qi6OUA?QtJGULce&xaGHUsiWEIKL(6`P?;eMZ`EV827)t|$LT3QO zB2s{!(F1}Potlr^7m)hqkGu9S_zfNaB8O{M9ir2JL^H#A4; z2qp|hBY0S*92u3<2f}x~EL&OFDP`Nw)I-O;d7cH>o=Rw|&#K-Qz#ROoi&7UY+#AEg zW<8L~7;oTJbObXUSO;~v^nv5HSYKcaZPtmrJC9McXAyNBwR_d!NR0?yFmB;ql;pw< zS!wt85$q-a;7Sqqg=GHY%HeS-|0jevJ?fJGVU!v?kE|>?f0A${K)|5B0~~y{$wDHv z)Z=2$oC;2lR%{1L@`J|0kG*(v)w^?YbFYlyN|lsn@)VR)2~ zU2W2y*elC9tg#Iz9Y+D>4=RH4fS324g_|}8aH(S+G0wN_$)AKS|GLK70G@S}1pF@k zBP2nS1^I!0hEI4iFseY2_cJ` zcQ}nVU02tqPvlvCgbUv3Nky6HM4yMauKP2i8AonKEWVG0@!1t!KMO7xl0F7;4&^ z$Ey4%jwK$v6xTFfOaeGYJnUNb$tQRzKZ9)SN@t+JQMWdfn}3{QMeAJ)@@3Lsk}(y0 z$J1!%Yk=A&j-#3u3P@o&aF$tPpCtY#;88sSUi5uG%O8Q*N#HXBr&LaT6-yT0N!j=> z+{&p1`ixNraz4524#OD6TSZ`x^cP)eEya*f4nvjFam*~E zWm~P$5b3i*a*h>)hG{ZiIfKSHN|!!YhU+uPr(88P#XWe4%>g-BtXQLFTaL|DM23da z+7+<;a$63WgM)RYwu~_K?=-0Y2-zNn9MG$%9tJK z^q8eDBqhN4Z}$gy4{Tt~jC}zBbK<`*{tlX|2V55CvjOCnW)OXjK=0WyO-a+5tRsVx zSV?H;(E$E1gX2-A@#iP6m}s$;pFC~j^*O>A4hOg4Hm`6SwYPny#$q=fp0)kivKqOI z%#zG}5xM&_!g<9FOF+(%YFFh+&$qZz{#Ciz0sX!{Ep@RzqGH=y>lHIf9_DKG3@`9k zwsPjciF8xrW#^By4TR6EcqHH@)IJITxjrDDWb~L;=2u8k{A26?^=QrmC?CO;6Xg1T zy$?VVqXYy+3WR+T!R`)m_$gML!sVt0;g$!=xAx(#JiPMuT%20HO`$2=UwKIyybcnB zI0Zj%K4fe%Hg!bd*H19!z*W|M!-yNm2#|7_Xd)(yt1uUseA1x~f5*K1yD0W=y9Z&gs z6;W*5Hf>)t$QyIA3`NIsoiQ<~ylo3Fi>r)^-VP7apdl2qlk-?`KKG&ZH;twPxQ2?d zP!@6b08i40_%VkXEfD*MU-B=phsZt_EXDp9_=5>;Tn&Co6{3$bBa04$uTInb9uXB~ zNSkwf^}}#Q^AM}Z^lqWJE;jM6AS6(VBZ4H{Mip>e5WEM^nS4*Mnz7Sqg;J zp}V=YszUOaWM6ClqvX7tSC-O43&=EE@;50O6_LL_0AuNAALh^w&CKs(0?65yFzjiT?VpJQZ&N0yOC7ofP#kYJ<)qN~e ze2Hz@rNN-hbDYhXukXjzb%CP;R-Hkz-}Z6n9Iu=MTk55>ji+Tm^e71#vW(tHaf3KH zB{@G(W6g83TD#!5CSremLR#B;{(9fEl=AdADOTruxMl0l8mg7ii<{ms+@=?qLt6(? zKCxaGGw0Runx(G za>y@}__v~i|BKw41Je)y!|4R|>W>}ZlLPKI!-D*-9;78K{d=gJM4nzKuhsREONB5L zvTgHw8>8IQv52(Z^5j70ZT$Gx=4=LunbNbmddGqp$jo34&qCorD5)cdWESPYF)3e~ z;4%NrO6#}fMz=Jg^Q-v`*d6?DJuf-_1K~M!TXl|!1qOxprd>L{?|9%@ z#1{7qUGZ`mKWP!Pzmk{Hi(t&63qY&g&lgcG_pVu89)Gs3Jy~gT&@cXtUC`EMTrWsS zwUpn+Pwh9vm^F%&S8(M`(n3c-*41n)aW7SQRp1)K)TUg*YtdZ?N$dG$VS+h*o4AU7 z`-JY?G=5XvSvZ}(qPY4JaK(PIl363ce7c*(3$Miy)+vFJi^g(h+X>?|`0m#q>4rq^ zurQba|1TWh5_s`l!1yqDbe@HE>Havwe?0~dC_dVqZLEJrUdIuEE1PIR31xK`{?>U#Ek)ieI#O@Vv$&1*}Dzb!hrkNyaa}|o$GKjEa z2o@db@}d%@!oD?^(0l20go?kJM~CgatlkV-u=3e3dV45tb84E=HM4C2dnj`|KHZtI z9c>2!Fi#Tf8`jfFMafdu{*MbFFDe>K$8>wgn!TS%`@~H-r2x6R$$t5^CBl9XE8&){ zvo04=&cphvoo!r1G~g6){?jRN`Kw|2|C>_)#Kpf1P1)SOm|@+R)rqp~2pUr!^OMu( zbKDsr=ez0rtz7H+s#09Qr;?PClt-Md$^$-2ho>|3`a$QD5+~FnoYNHWC{;B&fj?;= zB|G31Tx;ucTwqhsHEc@JH#HWoc&%hKc5A}FyKL28&+CvZ`~K_CJG#b}!xDs&sOaVB z)Id2wEoqU!lCzRv+%IH49oSi^?lRUAL!9Nz&nJviSQZzaZqh>?`ojMill)6V&(MGV zJHgaHc z89t8H&2o?=B%X?PCM~mDzt*FJT%_-`-4yE)yM-fdCCt+yg7|V#J_-MTsiD&4HY2SV zjY2-jT>}<<5of<1q+#_<8hNbz*EvF8-u|2XSfO|31tcP~e>h&Ok0u58>un($PsQ2$E zFWT6?mZp|0@}RJY*5z8YT9+j9)DmMCTIxqG)lgH`zxG2p((I`nHt}(3?Avp00Nv|4 zXFMC#RDqDRemtKEQn$37QJs)*{yK_g#~Aj5c>K!!V5@Y~l0*xT-SQTiEY;V6qqRB} zp36TzVI*htjwC9RJRz}WPW4C;xmE2|fXtz(fB|VJ{d(@~R!Xj;if>&Wp{7IY1oKW8Dre$vbABV*T)!io$pLu20)g?TNtfjQY zcbvn8U%uLWZ5R$7#4cxEa5nf_FkBY;et&*ua}ck^k`7vH-`^2zu#@TUoo3{`N(fYY zXIi0QFJk?UP?3f(En84s$vLyg7uejP*`1p9^~tkWx?d_Y1NSpE>yj;jl~PcA1Ky^{ zt+rqisaK9PY{$4zT_WxrFnPN1&48H)SwVN@Xuw6ec+LGk$`U|`|G{(m7hXx>1(R|@ zhbEvzK&-geJv|%|OiyoFSowCk%(!}-DyMZaBEqo|zT*|^0fBBz@#Hd5N2q#dk~i|P zWP*$T<~-eTV!=!IYiEw*ZMJ3GhR{nNJ!=X7va<$CalO5aZcOmcN*={ ziFT%fqQR1eLrU%mCTT87>d92GbODl`XV(D}rwi?vYQLezK+SK)&a9DuL7)}ZviQT|uxX~Z;Qi|)`k$UF z*mMmK$a)~s^mxkIjgAw8g2-pRt5Yx4Ig`;1No08gfieuikVj(*@2}#YQAD`4)c3o| zOyW+TedoEu0m`#1OJYt^)ZaXc^e@nOB2oLz{1)0?_b-E|oIS2w8d87XPB7N~nq8T) z3uXIT&;O&;+W=Ed!MyvBA1H>4?K`txo|A@_az6WeB=NAnBAW!=1ibJd(DNv71&O(fxj%%@c)gVPP&!0b=G22TNmTn}P zvDJs;`5ga>iC*7=c|DJZF=G17bKaCrh%0;%%ibuy zuFYqD0%X&^bppw`YgMwN7R>dcL+|(;wHS07ul%+?HRYLna4Y)$^j9w%{^f?0)7`lO znf*KKbb3#I%17JL12Ca<=F_9#JM=r(X*_J+y6ydsxLVK#f|x3rI;9 zUYS9#(r<^fBl--_$#Kb4X{Xelz4R(|FH+z!1x-llL3*E&Z39{a&^$yeBPKmz%zg`47jt? zhbP6oO%s75-+#H~Hzg3%`eideh3`O>JC+xxeF=0}X?5te9tlL9H33LE{co zc!zZjtmx{E~!!r!*Lg)@7DfeCF8j?KUf4x`k4$fxL6Cb5NN$p5-cbb;9m@?VQ32V?a`4#p zNww15oz+b|vDw0RH!G{@Sz;1)g@Ss=2%wQ3n?+~p>&C@M4>lNEy2*TCZfVK(@Cn+% zc)cpnHF*@af4Y_YjTr*48&sozsMj5Bq^k>O4`}tf;f&JPG4tbC8>>{gr-Sm^+&G8e z-lb$?1)l((x#lYm5j3Eme9Z9jhbgJarxViJ|F2dZCQeEG49@PdcK7{+z;Q{ zu5xK}S2_R3Q9kkx0bmqME|>BL7$pGqBde_5Q;lbys%kbEFunOr4({**BpZ;yByUtHFCjJN>Oh_I?3lVaoW=G2)(m{v2@oHF}(ql875p8c}&CliRjEl#~XHqDI+hqQdJp&`tU@e7zu2(Q;tV z%5%i8;*^0x^(K48z*>(6x>WCw)O=f*Hawcq3U5?W9`$6H{BNOh7%Bgx?I!3Vs6P1@cjv#-j(;MJmSVwSC!GfbqA48ExT<5*o;P#5QAb!gqAN0A~KJ$d}TRXHmk4ISm|V zsk~oi6YOEl`0ATI81Y*9bPnO`g)&Z%9S9l%J$daj4tiPo6s88cSHf%`3@4E(bNUpyQt->q1i*|M%G z4%Rodp%1`dX6&7OaS1w!oA?kQJzP$E(u+LAR{Cv@ic0M>>hago3LgLKBX0Lf%c1_K z3;lkeFT_NCw+jaa1JU}%I!F53ub)Ez`Vv^P1u@XL^672fa`X>Ryt4o(0S-^}n`t_r z_^oQ8(Wg!JOl^f^1K^%}U+XvWF7yFlDP6W#ze{r{(%PT?uaF9F1b~^O-ro#3{uT5~ zehwfB(dyA(5X&Fu$-Lr+Px$$HPqC&hk?3PfvCPyU zyR)Qn%>7@|FT{!24Xv;x!R7oledUW)Ja0!%18sde$k7oUMq7o~GsErP<+xVT+Y}oc3#ArTzG+x;#*hWm6^lZH5QdfSHE8(i9%9#NSx;IQ9IHh)KWEMN zOB(3MDyph1Slvhp%Qtm)j#0SvARJY9csQvpe0F7<-#=YEtl-aU=s0g(ro@mm5o`>a zmqG+P%ni0jR+d(@@d%~9e1m#AOPS=GgL{8q<4Dj~vZ_@rzMJd6nex>+Pz<1jhU zipL}&)sh?3m@NzLfVjS~WA4jIS?@Ba?Pbu=tbfoGW1RznR^h|RfUJ_y;{KLzURwvM zMemb-ziA>`$03UvbJ}`Ns|W|@6LHcDbU~3wY!1S!6#lo?A^<3M)_N|O{xK)wAO6z~ zY6!dpld@aZ$kU@^2Q-1}tL$mU$L`9Fe9=sOKs_ytMD{1qs zVS*ua(SwIZ-qO1i%vi-QmU zUJ1MY@L>ysix|)%n|XTKg0|O=wTma+jcXg<<-ONhcQdiBo7Vh?tLl$y-?b)IsaJBK zlK!TMiH3FX5)B{u;c95geVC7dfm(F#rn1I=IyMpFZM zw@+nyJo>?Jt(XNgnOLpt*=iap;-n!YCy)8202AV~&s54G{x_{_T{cnT68fe!Q4vwe z{-@1zRN?*(O>w5f?F=+WXi+mna6wB2m5ur#^>|8^l=PgO&{_?ZVm-pHv?F+Ch1(V| zJ~w{zg17Oj^wNbyBO|~!XjZa#FAbMvV&s^D$HtwqXZ0kBbTB%n&dnM=RN(eJ?ET|D zWw7AGnQ_0e0iqY`s6CyUCklRm3Jmm{v4rOW>MMLD&e&Ce+u|;MvX_@DhDIhQTJ80;##iX^V85xB+F}YIrKY0den5EW zQuk%wDyQH`8lvy`G87P2$->0UT2=qPLb=3vk)HmWH<2FS{2Vz&9;@5do0V*22b~?} z6+LGXVMUT(w3giTq>kHO4bG!ieeVo6Sag%CNZ;0h?J;1+gUsgkG^x+l`lHv^qTRVK zH;L~10;6231B6P$fTD)5C-Q(7!VZ7#5`UkB58q)(}* zXG$0_KR<=xFrv$mS05?OzpIHJNy>EL<@Zwg9&lWVEMggi>gb8vv)P5&4vE6Ff1&m! zWDGZ|Zp`x=(ZvpSEH`B-_O7IZTYPU)C`YJ?oW_f{xrO$k##gLlu;%Rq3NfnlPW@3{1#lhf8C(aCPN^ zG2t#5Xzo@KbqwG&c2#)k*)jF4iOi(W52x@7eiEGn!aElLctapkIu{?X$bqR9Y30o( z?I!ntxxw~Pul@b3^K98dPC3z!g(m--BP>U`mn2m+g_hpNAs#jUnc%Q!@byAR4`p@z z=l1D&5%t-Y#anJs#%6g1c?2T^{Z8>z{gY_pZ{K9D71wegv#CozpVyeHFS?gLEhmYvj-{1ATKR{^^*BwWAypx*_dz|5GHrbE4n(>5co7x)}C00HB(l{gN+&Lu#{^o!Hj&xOf7c({PtRl@*PC5 zX~1*+lPu1RSi}1A`p@Wth6)qB<6+uX6JdMX7|1Kh;15okv`8b@cwPk?0>X%3;sW-a zREI#9P@8+h(z?TxPV-=(zFv(+F|Ny`)jLJ>q=_Ck_Sn{E!l>;{HPL`UPD+5c_4WlN zko0IJT07=T6L7{vwB6W^Y8Bu3gz{2zF-VRw5u znjU}$J~;TLS|*0@&P`#ObIm(GRz||-#?eQ!OcnyHEOl4?c^zq{qxJ7v0yX!Q zNQ28iLA@Q?n`d$m-pfW9nY12)r@pleuQ&1;YRTrz>6tar z>ZCwwQ*<|EtaS>+!@M?>xqYj(i9IA^;keSmfIFc?g}2&VIycKH4UrHP@E>)og}9s5 z*-5rWA;E=9S=nhTm*wQF2USmZTJ}W+WlZNe7}_I&KQaMTMmvM7mFQ0#M3W@%FcXO? z*~!N2>`IAOF!Ppk=8bZO>t_jo+TO^MhLz4Z@6*+l71_txL~Ow@p9y}vvvYH)Y!Tq( zXHwSxtA1`1n8>mQ<7N7zbPfV|BLFcWqa1|fGUA8(3P7ipcK8Bs+ApKr)V{Bv&QSCD zuaF;?KP{RyGvz4Q8zTGix6wT>1+?C5xlC3xF>Mqi2Dx-J-=AdIth7Wn9Gx!)y8yZz zwyqgWcXSs3!0(lFaL{Rt47L&~?4)^@sumJ9Lu^!?dZbh2lNV=BR~+{iU>|g*Z?Nog z8*(RfiuQ#dP~(1DDO+U2O;=LKTSHSn$J0!kSGqqat%&NiQfPj!SB~!870s3kqizaTsww`X?j9Nm-c~yl> z?lV2hBDzNjKI_thH1b&hQ?H2APLY>L-Wmmu>{l@888=yME2nulb3M&%H#ZS*aouyV z60s35oLCVjKjB{Tal~2KzKx~4zI#u0Q~RzzfmI(7UcwhF*UgeEQPRl(bJ$K2u|D=$ z^;M{HcvUr(!`dInVRCQ^5wyvrgvFbDC7mWCN>80dSR4$%_yKkkz1Cw6H|aJ&1Q&4e zTWoazv`}PSO1P+XfKA6Sc-mp%&+VfV_CBP3QeJ@K$0H zC&Wsif*?^2o?i5s(}EDk{5kvJp29P2g*I$}6%cb&kQ^Rh-^_7{_D>+HSLGogK7SU+ z@`_-t#k@<}Kcs@_OexdcNe^;!{{}_E&B)v*Nc2aHjH(&)hb2onOaCJde~g_m9N7ST zHSg3*PQ0E-Oso{6xk^ERg|1<$yS9(QcRChOukL+TMdHFOv&UkB7SWYh-rKd_?l^(| zS2H>NW69e?H!f(fvShW2mykx*JyEwMJOv8pov@fuVga5-{NsTWZ~yC)YU!p9sG{M( z%H3~qJ;cVLW$$~ZVAP6w%vRoPr?Q4t>=T#Jpp(Tm-?--U59Hr=M?N$vT!q=WO0qsN zZuhHC;cxY7J1r(!L?gh1Lnkuu_#w8iXr1(Yf&UbM6oGGv(N8`<(TG|m;@$$3qm9kd zORe`kuhEc>M}xfQ#0~N&4q217sH*#jPHS!~AIck3M-ts2+4ZQk!$5XK&vW74ZAMpr zAX@WQ+gPqBCu=$j)UeCcYEaLvx^vPYBwor}$~%@%84ID!pk12acEiv!o9 z={+g=B>>aO1_-t`JZ7m4x@FTyA60zB{qUcK>wmedUVvm2-cjZU{##~(#emN)`Vlwf zF5;#8rmcSXEqrypKmuFL)I=PaP!0qOb?E1!W|hUW;0k?)Fu@ecoanLf`j@S^KGD-| zG@BP6Q@{4d`=pew_xyQ7KXXi=fue-0jw!iXG>loD`jnLn<|1+22xIx+%?HnZ2L}g~y&dCo=7X~{F0G}>6l{^rUx>Xmlq-~w#@BK0 z96Uv=&`nMueV5D#%d;~xq0^0NxLF7{s7;YHk*80VFQ3qBR5mnVKZx*~_6~UMh55XJ zR*Aqg-#db+X?w)|p^(0M7?S8#;QqA!`yb7o14hVgeLQF;sMB~Y4tB+JbuCy|Sc)@4 zo-IMwRarTkGVZXmS0-70_{L&4=^jMMTR*`k$t*s0cBuQGiWsQ!m#qzF;Kj2(#gl&lWt)(Uai|gP#5UM->$zSCET%`j_u^ zfBW@|FnBn~E`+SWQHzGq%xrKP6bmiNO|jrBw87lPjr zz_A8->R{3mTT)IgN)t?welEUhEXv_B1@@*TrbBmgJh&nrZg0fDN5Mg_hJ9kd= z<4>3Fpb(UgLc}K_TohBA_)Xd<;>%MHkyU1#lgqu(*)!zh%^ey|OusB#D+QZoOGGgh6`T{<_ZiR4$qog#EHUj`QuN zDNC^Gy7&y@!`@M2z&-YBCkLXIhwAZ(X!Vb^yu4tZ`lpnzcVuiA#%g6!R z5_PRv3Ib5ca75=QpJ3!-dw4U}c*^5)gN_{U)T0*vPT73rrEY-cGtW6>sDsvCB>o%oG2ycUcrfBjaWf~t z+Tm{H`a*lZMnXL%f{=K$u+b;3uA$*soqUy3V4!Kn4h6;T=!Xh7tnru!g+!9Hx(Nb(8mN~yV&n)nVI2VH2r9sHh$LMj~0s2%sBPi-m$5$ zbv24oRL4Dx7t6KsH}v^~m06-UC{Pnc!doDS^JWZzLTMDArtMX0!8ley6^1s1@TE2q zon+oS6$IFc%QO zb@ldybjPQIc5{lB1Gwz()VJO8>778#b$AtyQ?SO6A9;us-KLQ6FLUeh#dJNg<0bIw zHf*fc2{q}(F}K3c52i^;sZyobUr9J^>BocOFa&aaSTQD-wOCD7*tPVHu#5QLg(j2t zP>(ErG0(u>mF_}%&edy(t;j+fr;VYgF9K(W!$k^x9_2ae+$2jFk(70(QAwZ}X-MyM ze5L4b$dCZK9jtbFXN>Oos?8{TvxYDO!GxbLe9Ei$!A=_1zoZ@{`=1b zCRSa|_5y@8^`=?hH_`XHK{#jWl@9jr5Y`%=LP+|4A){aqx#b5H7*RCtWArsP)GKjH ziM|U+w|woUv~t|r=bPD4CRNM0P-7jggJ5SV8*-4Wm3ZPck&ISe?FkP(T$l!~Dm&fC zX-E4#Va-+xBGmh2@!1G@Dv{@=hY+tQ{rluNTv}T3B*Ua#bgB5=5Vw-=Bb#s?QN;+< zQmyU&*Y-Zx4ySfWnVD22VYGoqaoMXhT1eCigGHh+`N^fZ6NzSdT=y<*Q7`lpD({G2Y=g_b^X!{+B2kgZXV!{VM1b5>F`_?x z%h6&6FAInZ!7HaPwW@Fku+bWX#^cog29qjv0BBq?sM157{stvgUja3=9n;^A&4?VI z#>5(dr6S`GV7-`Jakz+3XM+3s=UEaelv4l4Y<(%{7kQH1z0s~#&epCCSO<%@h`@1YX@ z&UZQ+lc~0;4mHR{ict$BQMNMu5*MN{AMra01Db|%J|MJL*oY@(GS(Z}LR2vtz`zv< zf3|{Ye2|_;XM6*?obZkIaF8TQZuPKyaN7gfM;lTYH4E+_YO3fV9ryj>YKjS^xvx5f z2Yn|D!WpXTLYe?|Oj|-dw!%fx-X{I#6^RnZf(}(C)dQy}RRWx`{4KRU@>#;yf=JOc z;1Ew8B?6XO|HEQy%?fb*XnGcd^iJE{P72MFB51B0J_d#5yc8W8X*OVxIurm5=1 zd=S3BZm)%iJ2(HP?dRI&S0`Rv*BWT(%+12wg3n=o&4fW?-~1yGrn(w2xpWwUs+EO3 z?PTQ@c8P2(MV2mjiU3m4VCA;!ae^GO*)IusOJt;V?)ejuv>DF+3iQADK_c&C6kW*K zin2~rkY?GECSnbQI%rKejBlhHCDlJ&k;>G_R>svYKPN?GRoUFM5V(J$87 zf+VB^czJ6jJi!;s=c>pcYLja)ZBUcXsi}G%#Qbz;75B_?g>91kbg6OdA>vcdY2Rhs zL$So%xNTyBsa-pA1G+-@hdV!{EBhGJCiJ`Uf|&d4Oo z#c%If@q)%O1WkVLK@{FhWRT_!Xw|in#}#;Cm40!6?uD`Z?BFbrecndVIws=eNg?_K zlBCO6%7>&H9H&QfQOn-M7j&90SC2L-4X71S44jn)$G-uuR$F)nNxM>r0fkn2H{ z;+Lr}GKt|eVY?=gn1L3|?6E;+2AIOIXECXQmd!tN{drtNoEd{pvXdKD=kv4)5r<+?Q`jie`bh;`$= z!gVOEE!9ov7!IhMc*HtEr+b*`({#@~7p62~tieK>nc@6!u$Y5c(K9@#sQVKTb&%LW zNw%?7K;ibv>|D`3lV<~BQR_EPXgCPG%u5LqpvQ7lQ{(4SxBFz+()EUu;W@h!9-^!iIy6P|WVP-H0p^VuvJJj_a(njH#yH zzFuw|DTz$+G0d@U8%U@oN=NmC=0fA!PEq|~`Qq5)Wyvu=GA?MQxIZ7ibFr@#^}u^i za!cyWPF9YFyF299E-rDsALPYwxO;|9Q39mu$nQNUXvGT03Jz&3OTJPe?Oe^OPKDmEhbjVjK<0dJe}(&*GM$T8?=5sYCwc^t`)_&`zf0ipQhOq z0j5VVyr>4Joy~{zMUv#IS-6l?;r{$F8xAOn@}#&L zA>cp%_;r}>qgfKxJlB=2j{a0nOSpRYIbe`TIaqJI?Y}!*9?c+!<5AnBp6tU935Vy5 zV5J~5S4}4F$A`8n@1IIyzj47c$Lpi@Vn@JQITacgE_wYkWTP%)Utt34H{sxvU$;B< z^v01^17=LAx}TrnbOLAfySf6`D-{s_(J6J}Id{vjZZ4Bs_Lk&_q4o6T0%j!B57iZ4 zCg2V>shSz@t0A|QnCfp;H`6%lliGTZ~ zsc>AaVg)o_+1RLWzs}Rg*O=Z12QDe`%>$X?Xl?Oiuno~!EO)weiX5D$=fd-@I0gh{ z@bU2}%2>V^ncw%weei6OC_=nVH1`n}7N%7|js}HT9+;==5eK;-K6{TtA(UN3Wt)v) zW@}rNiA9Z6xVuv86Wy{dXE~t|hfw9!c%P36a`}fe&>}+g6J&H0GUN$3jR})}ByL zhS|56bo+PUUKna-S5)MvHaI(cBqyKT;VAFVdCz3!$Airk7SI$%PI5pPq+JyvBQoVK z1k)6S2csR~NiD+r>(M4S=83^piprGn!k=03|LmE{-Ky ztLA-6iy_jTy~E*jO7y;W0E>~x0wr>Me|@vd=q?59%QH^}^@!pj%DLURW;_rjoCJI+ zBI+*54%~-p6kJN5lQ78x9Yyv#J}G|BU9dR0Kc5ZdXE+&|K5Hva#8lp*267n`*+Tx+ zW)IsZ4yb2p8YrdcT6+!3N}#MPT7Gl0)(=@qSYak%YxM<$nQ5E@1Q-0i67+DX2xe3n zWdi_2sA~mpjWPe;90Ya5#ZQ08N_g~F^{85%7XJ%BRD-=9<>K(9pUwPF{7?;sCqe~D zSdfC@QV(k(3zIDgC?}Sl5RruMt(0Aajw50Il$hcGvZymac4e|TO{BkWUoYLSb0C{* zJY#yZbk4h;zKV*X*Sj$}vA|q@e1)Bl08ub^K?>;YE3|TS)G7qL-&i-yMX9;*1&zw; z4;#L$wUd*2Sj83EQ8`Pf@&54S`mjPn z5YmVM%Ify(T0dG1NRsx8h`M4zI(s!WBgq&d=+ybA4A&e9Ep&5Xu4oA5D=BynG0s(w ztiEXKBp}T}YbwG|7kZL7GPxRy2$P39qm)WDtQh+ha?{e%>WULomy3B$Q_pp+1XWMM zX!siK?K&c^qpSPcU#x>|N_*-cQz5DSqxjJ)Eev*i#T%8Nm{cr!#)f^+v>QjSd{DG& zCJKo-M37W1X9+&YrSIC@TC6=(cOWRibd`bH zTXciH8@yA6Qhtks<3`W&YL;Dtvk%dOvMnfKs5A+9koWIba=y{K|Cr}9KH59#MHS{A zr)VnI)vKUEvQKe5a6*!j_vwHHs|rHzs!zMSYa*gXEHd4i4!d4sRRmfe^eXg+KkQXB zBBE+=*@ku-cuueq{Lp5q7lJT?jP}%BUF3G4ZL_o)$7*{7YJGoLJZ>ZAzDH~8f%R0c%_r==xbi0vn3$+0EJ5|cPX>ak5R|>BinnYkAlUV{U>8$L7ghe6p^c$1OF zi+!ar5c`dHa?+4p)Eho|ZQ*T{d(-WiZe4>}9AnLbS0fXAVWPuflJ>+5i zI!AdMotB(DE-BP}yOY%qm~85XMJN}DNoIkhzmgBSTE6?AG%IvG9J@%yG&=b6{-;U| z_WJq=d_SOUj(-O}T|n4z@a0S&3Q>2ULUkzd%INn6Ubkln{W``pdtX6jNLqW{w3Xw8 zEg><3LoC*>s-;hwPd}-C`>viNYSOJnp~0r8;!*y?>GaD>M^Xsk+fjs`(rJqM* zD$NXyT%%ssm#*3zar4lb{oLQggodNqCOyV!KA_76G9o7d)^kpqaN*sm&)qh{+%MwM z!Q10X&USEV+rhy{rJLRs3f}Up1MwSm=nYQe+A8}METHeVL|x!@4Cmw(=9%~=sYa3t zN3-l(!O_OP=Rdhek~)79J+$+hb=KA&Usb-%5DD=3{SzTwBk)4owv@2JE^o{7pSW^MP~&&c&l3e)3fYNl5X99JYYYj+bY!Y(KpYl2=LHh;ucok)3#A zOpkQ}+p3`u<72tJ#B7mX7klRtvSXp^CVca}9Tfjb_k5c!{g)6@4&{our^Gah6s7he zHWew#3zDR5A<-J@mBrxBr;COB_uE*PNo?usOXd5^NGx< zZbqg1qnzKoe?Q6)Q$;;>EfU0;BJJbosAC4gpU$JF3h$0wYM@PUFA(*Iyhq$ZJsTMv zH6IBP`OPmVxJl~J?GcdyrKXipTM+eBUAca88kHexEu$T0AB6??G#SX4eK;2$GV(Og zgjSW7Vw}WZEk=)#&!l|ZG?O${S69>EW@9&i>sSH7K&1BPe3h*px|lsl@HEYeE|C*B z>_2%$WY+VlZs|mrS_{QW2khH(dz+Q-gb-lv&#bQiX>@f5q_F`Bkj9Mk+*|oeNrtz- z&qcQ|vO1Z}8si&g8|-fvu}D-DY@L)J{91i`<2u77jgzOUDjy)0TQ!m^4XX_?f~!}k zXXiKHI`2w5<548%n|rrc%*XrJ3?yM)I0I*AuCyy-UnPKV(Cu?di9W0e)(TDhZ zaYVVY3;GZ0cN`TQl1^<`K;?|+sN#Zyxuq;F=MkoEc!+zET}$CzE%n(!eIoe*S69!b zLIoXg&g6ce=?}EoIXb!m5s8coi}$L$^@RCHPwi$wADhdUKqXz)QK3!>F?R{i+<5h# zBdzm@OyL#N+ZBxZA^rlQ7{WMn*VtghokS28KGgE7A<>tNcimpeqlp~e*oFuY6x?IT zF9ZN;NwU~oo0bsuC9`ZADQxR0%#fKyDzhm%aV&JXLt&^V+yd~vKmul-U~(6}V^a)l z)8M%9WdlM24@Qq@iElVsSe*!NYQZJZl0hMJ$F5L$C?>z@+wJ`p%sa*V#u?cP`NTiu z?jgsBp3a7nvQv9n7wduHfpvWzrRQ@KFq)C}#PHPqOgJO=TxHx4L5WBy;#s3(- z22{^_sZ;KD;DKuc3xn*JhgldF=}~-05KNH6eTl5HJR% zs4sdTnxL`d_-wh2m!u_lelcj?MLJ*ig!OakDI(vmCK`z81%!C zID)xgoT$Qyw>&TilNt^gSJp|r5;{D}vMNwZ?Uen-UXYMOz(S*}wZu8zwpbhDY+Srk_QMuO+xAOd*^5=6T)Ex!zv za^w^S>(d$@>1_T=;Gqv({dDv?(++osdyn04x6U#R?+9>qDJSbE3k5$0<3IY!VAAcL zef?Z#s*8_xsU}gYP7JZ$PnFrsAQy#NlcMeo^=1S$EB^_!e)Qt>#F=f9!J$V=yM4t$ zZ~6=GQLw}!is0b@ta>P6VnPc8^;Q&d9wI)+q3A&QwvC(O>%sRY&+UIguqo$ds<15B zTV7c*zk^&*k#b`iUWUhNsdrPfX(xZ-?*nd0Ee(J~eGZVQ_Iv{h*5c3)dg;!+1nQW+ zS0`kBE1bJ31uFwLP=kfb_1RSbWa7`3dW4!GOu|)7D?~h z9peOjyL!IdNP!!($jO%Tk6XLD4`%I}&$KQPzDQ5^`(K&n{o4)j54SIU&+T^$>Bj!Q zxP8`W%tH@_{EN>&Bitnb#noP|H)Z*VlHkw<6+WxU)+WFO{KwcqO2<3L%6xNu?;NKc zRq!$^cmVHEVt}hlCtBvl7uuEmo@3@jv>*7rswj$@y{oHVs01CT@U4T=soWnwz|RX+ zWUG0aQd`ycsjU2<=ie-Vb=(5K6I%L49*`%#bXe1?D10Tf3v6r^m0vM^E+m;x{3}3* zqq@MY{Gvh@Z6EZ56y=Zz^8thWyxp_pa=Dzy1R<=PGeuPBXAsv)5|F3cynQHZ5)Lw! zmX?0fR?8+AMHPbsg6&CW0-> zZ7-Ou=tvpWy#$%WpK>z8t{G-OXahC@OIwI@2i1)@czifFCpT9n`ANzc4i~jat}u<^ z;igWvHyd{e+X@VZ+mFFTO)qFHg(bEL^Y(0u+(X~5vo|ERa-ayD%|pWz;-nWYby@y} zV>l$~hu`Py9BXQjTlI8bOAtp(Q=66ThZpQdsasg+^O1vD7V)Mu%`qVv){MI^At(dT z8c=xSTUuJ+gWhwF-LxcaV^i5rv6@e>dyLJZwirD|N`b=I% zk5%08Z7yGlQ_7Qk6lhV8#Q?DKYTr>~GWgnaQJ{fVzgMc@iFogXgRBvi;o%Ug$y|1^_0WIQ!19;b1c&$c1vVX|e zRq5{VnrONu`}M*}dw0;S2T@d6k1uld$ITFDh`ED6`vJv*u*G1R7J-3_R3t|Snf|0a{3;%eE4>A z*-sVjezyXy+~(q~WD~#Gr=Rx5q6#Azk~j3u-38a`(wv8C)gL~+vy11Mw`$e3XMq@B z_G$N&8a7JJw;V;-_i*|g^&g7e25|hIG`hA6zMPUJYpHEoE7_Vqy;~yitxI)VU^v3! zF#KuSfqC1UG&m}byyRR3+PL4~_3vTnIjxpIkK9_X)8;&PkedgwQP5R}mz|ux2lKV| zw5e$aU+;~wJ5<98cUk?NWa7$cRVjyF$K-d+>uvtGKP`u7(xj1yR}hIAKHm-RW#SCF z8#5Zza3+;-;7Q@~ebWygm`iFK0k==_Po3Pq?udJPPpauXHTH=*G}!EKX5&3>4#1l5 zm#LV8jPuf=(=d{TPE=^X+scru{AgJ>qH+?H=PkLe$ihNx^GP9FcW!wS0(&%+!+N)X zUyCAb-8x_GaVbJtHr~61Kl+Sf{%E=pL2kl`>LPEun8mr){vbMehHsEOP#Q9g3Lt^O0B3t7d3XauT*n1#$864 zTo74kixm`pI@zK0pbJ66!LN+6dns;eT{cjh9}-WN%?c-ln$VxYJFROwo$97@TVB22 zo)+|LL?8JX&nxbrc7r#kQ;h4m{0lW7oY%_<#idIt2e`}C*9g@I%%I*6~U-Q#i# z?^@kj%5g^g1AHz#5Ke1(YBtu4UopxObz5Xzn2URK@w2Kahm$iQ=4XPxgCS}_YDVyh zW9i4u@BR&(4cevo)>~HFc5~#vU{W8rKRJ$7;hH@47l}+tNzvR8F6}rgDASN+oT%{0 zfZ&^7Ep2aq^nTr2x15T$A*B;jo;4ZJ@W%IJyBN){)gU9|G%90vEfK5<4Wo>P$=VZM z+&T}@?7d#<#+g+X40Rb{G6;2ARwhb2EH@%-zbth851)%D+Qk=*Ay2@vA(8bjcp)t` zT)M>`G=$vM2B|&i*WlcWi}KkH&}6#Uuf1BMc33`H6Goo>hDW_b$MucgI4MT1iyET$6cYBJk>!lUvV{OjMf>YX5+@0@ahV#|Okq8mJ^urt_If?Ve zTQ`Q|EW{lLI&QYvEgv=N7RhG+p9-O@6Qh=6fillfgR{brJjmslZHLnts}Id~+(>AO zT*e~3y%&PEzh*CDOF4hfM-&BmleW)5ds%*GC*K}PE6zcC(T1fxzMnJ%{bb(X*}>fNm(3Q zT+5Ca7CnqI5WDPEl}XwAPlPhB)IF6LYF1A7w^XI#e{YlHA`kg?xMz9QY&<=AeSMPw z7$>%Y)UOYIsyKA0&=sDS=vXbUg1@Vwo0BvJ5HF~JpvubV<=F3+9!Q6B@?uU9_AR|8 zCSXM?u6@AN1mOK95t%PWbw@-$SUU_%>0ioA*jpIs&03qEtUm^Q47wmh%jA^$a2SZ! zsJPkJ{Q@yZ2sfig;}_QFK+Fq-3+Jg?2(NdaTKJ(iHWYIE62I4%63vE)o}wBXJQSe#>3^5wY!su{Sv^cC*Y{Wp*rE z7BE%CQk`9-w`T1b-k0a3WWJE&TF=y9n=zODoxRsv##*~M@>l)GMR_b={Fp*iPK}k9 zeq|EV#VJ4uBe^HllmSxBIOfsgKevchQF>0_;Q`a3@i_#v8zX1r3?Eu7ydgQDt}TaH zd+S$LU7`md^Qr~k&!|w|QN`n9q<7_Ry&FtmQW|Z72v#;5o%T2|jaJy`CV*z^PqLHZa_uygEZa9Hx%SOygX< z=<=e=?Q!H56XQ7WTD;Z()iK}5 zx`{U|tg+V4IfX%QcaSl|jMO~8HwoW5M6}+{5`ajQP)lwM@A%3*`0fZlT9=xd-lnKnQ?7Mcz!{Zy*MIa=>H(^iv85`Qv-Z?0-6lw&WKk_|Rxx_r(-?8*urz z5&CDJ)IVxBv*5s2iY-W;PB+7;C{hE2DFFG#<;NsEA&0C@UsV;2jty(PfPp5fxGMBJ z7rw@k6V0H&%a@ED9ix6b(Oo1G#(rONBi^%9Pd(15tVAi$O+h)Rf7!rYm%*r&${H4_ z+3>mO8oT@_V4~s0%nui$5PXS$j$@4iI=y|-x13mO)No{P5nO6Ltr~JI?*wnhLjgZw|deR@uw0Gs>^x7sbi^ z)JK#BZJ3vzZntfOh^{RwCr8E?*d*S8l2%>t_?+9+8rlPic8TTe{opN zs4>N5S7M;{^DQ#S$W=(QzT6~CWx?X{X+CjiYS%3FYuSx+ZDv?gtzv?aO^&) zltT9-=)y7SEx!`6rvn)Xr_LrT}T%;A8Wa8P{VmEF@!W36``Nz&c-ApiWst`Fz z8hWs1^1=YsmPy0t_-jH>HjRsspp36?YhFt8^?oBC2FK{MtE=m$y^Pyk@xErn0_B3- zl7Mk610P&>o1jI_EqTd<`Fsc~r-;izGlE z>fT6d^6)|K_ir%Ibnst$^#2>8yfS&pDW&Q};S5*Q)EMv7|MdW?MNoa1M~2C0^_e1x z-1l0;`tT@rdfO>xbUa~ui zO=8L*o4%Z=`E?enI-Lk2pDmw`4|uUOUSI zJac;7d~n)7yO^ld;WfX(@mv0zVn{P9^0bS~f_)UuL(S2DI`-878Rgbrc4w*My2$-v z(g)7%G@W5L%8y*j7od(QGERaxG%jHcMcaB8Y}qC$OiBk#ufq){TW%+hOYEusSQU)6 z`rHKd6;@jB|E?&poCX^g6CbT`JN+Eo4pb%j3FkQI*_2Ojz7^`VHux zK$>TO>&1aloQ)QF(XEkZWosMf*0i!`Iv?c={RTxezW%|B+gdR?DZi_5+tX@9&LHn`cjM$sw{qgupHvj|qAia(vE8v`aQ|A!AB>In!7 zGueC1&Ym{p=gTb|etJfjIA9u8>IZyHzvBpCu#OiHEvnroivMijpHu&TH}E~ihSUI- zc+HnNaF>FnJZV8TFg)B&NRl@Mice*>4Y2UfmH+Ff)rc%S!q>{nYi3X3`d zEak6=J9cLC5xrc7j<6^fy^S(*g{fQfo!A@qgI|Z?Y#iJT3f|nYI`rt9S4&c6>v#+k zTloPJ{pt_9N=r(N8XEK=x5v0x1Yi~H6&KvDrIjFGV*`>pVbAb=FZqlxL9It0u-fF^ z#8E?MYg_<69Lr4X!A9Sfj9Y+*nWp9AwgmQx)2XofeB73t-)T<7r=hOrfm*k0R%-jY zX!2~c#ar~2JKs_Tr<27vrt=e75vz?Mk5&Q%!;(-`trXnQF4R|hoPc*L`Jc2U$UH3q zY#aW3YX34D56zWRmNjS_rCSa!y{h<=XZTC>-_*YGQ#CxW3*0f3+4i*-S}H2Ls=q;~ zMsCj`cY=jiZ4d6Ui+65177yZwystQH8&8i*j#~)QGKTG~Scn?dWGI=K$kx7}d{cQ( zd%22nT$PWIZS467C@Jrx(w*9Cr9%$`X}wZKZbt@KoG&Qz7~bo>i+5{A4m+IeoB&|- zzNq@%PWtASx|4))xY+xg=uapKph9jIt!TfDDV8+OE~T|dL@sgOVd z1HBo3fZKuhfftNhDXaf&0~>+&rt}&o@|Y9G5AzKIjrIf1?bYLcPJ$xw>*=A7PvFdB zbxlod00K>c(3*C`mv2sJ(Gpr&&p4=k!uQ)jEs(X{g}>C2d+*aA$-S9QLj|_{w@pgN z8UxiYinIS>f_F0Cc%t?mcUlU!B`8xnNpH7lqqkuRi+*>;ZF)#UlVB!?a?4n#wxO{V zPanrVx7|mUQ|lHe<-+}B7R4{y%~+?L-J!}KtM?g~DbZ=IPo6zla)kbeHI zFFMcd(GHI$XX;(R+h!cWJ58;p@HmWLMvVIWwWcL9)KQ$KZ$1&ar6w5<{UT|YJJ2Jm zHAc)Q@wl~g-ekt26wSxJWOh~;Gs`bF*+2Crt4sAd*FH#Puy*c>1YicnuBhlu_-E}B z9d82Nd}g{Dn-!6(#1eL2!+UCXO}k(3-gEXAa1vSHJBbv=c@To&DMQ3(;c7IEvAaX2 zp~3n3ws_{Y1kSi!V&ugq!Y_@dKTD2NS!>=K`WHB~UZ`^9ZhefV_ivWQ%3reMXF|Ij z1^60*F~?(s_XTuGZ}=xb9QhvPh#X8K1*nco5u$qh=VQT$VZ5$hcU_|^vW>oRd-*)A zi1SAAvPt4L#4;JO{$`j~D4Lfhij}Q)LQhj$yFZ>?|D`R5#zwmHpwP(tJSm6s<{$dY zUrcu#O;Ip=Vq)UseK%vu8W~Qp^NOftU+ZCI!__WI-)D=+JH*-57gmmhFpdWKvdcB< z1NVF-Rn-tgkzv!8vi&RQ{7gjaiO-(3aX&aGE9*`AN$M)%pmE{ME-5v2tYujA-n%Jw z@7?^%VW;HJD{36}i^Bu`w-^^yfg>=C^twoefiO@S!8kAXWeYoUWTq z(a<~C=0j=xL&_)c@7ilHbqnosxtQrBMheQbn9sc)x_YobT(%tVMhhPKp(I#bpYvON zeCi!K1%axYp+bi%zsFPHLsQv=&`)v_HXnEh=Mk`N`s`UM?F*Uhhkua|9k!J%JTZ<3 z_Fvy4$%@~fe~!n}WOta%r(R}OeM7l`{=$EE=2nn#8OdI4S=#uBkNL>p*eZ@yN;~78 zKD!+MsRan2%$oi^L&@+FP>Xu?Z_)kPMG@u$pPe!oerxmf(4nxYyZ(p_3EXSpq!ze{ zPr4~i*f@TzRYcvqm-VJ6ZJoYtRj0Z=pA(>8Y!|b;S&~S^6_^ys1wm`)Jq_;GEyM@- zEC#Ot67G%I*)-F-O>66u3F0=lt=t5_UUxpGmTX<>VR(r3%2e|;+1}os(@`f`KhSK4 z{;}eme02$GfgaAviC@KVDcb>m!*st<-i}kVdgd$e_2pPY{kuUeq$(2947?Di4*>1{ zyy)@2-E}~}(Uz147!53EKI@45-JDqGO5kIOiHk1&mN5#y+C~*0@aNR{0r=sSvx+v< z{K>%F6jX`o2oXAa+@qtQIpMd@CUU=}u{{;lG5EOi0&dg&7!|taFr$wWT8r(+;cp%7 z&AO=wB1CS+Y0K7%30}q}u$#^Ow3%ICcX1haut<#emu52e_`EaB5@j}DDT(#@RVp3r z{8fB~UDDghw=10_GjTx*ZS7GzT}Q7$<&XBg`e(Z8`s-T)Wco)UAx$ZsF{pJ=qBHbI z^QC{36`$YR3C{k!lLf{`I$zESPd>ynzYP@|@(_Mc-K@7ZGlcCCAj7*p_#^by29`{r zRx5BTu2(Szyh|dsC=!|`pTB^r>1Bavvrj5>2OhI=13P)%h6d`CjKgM!I%v zx1ZtSy(gg2dmpJi$mv#pmTcuRou03;8b`*1WKLHAdmLPFN6%e+f$7Uqf!C!W9?kNa5H0ARF|kTBW2 zf41+N63lnWxo}qM1`}%56=vt)c#)Xk8)V&lGB|(H!ExhA3QRt#5MO`%Uo6Of&A3|D z0P26*^oH5+-_$uP9V7r(U62VOwFg*Ekx1y%Qe!xE(XN2X=` z%7j4|@yDo85loDA`D@T8#b+-p@L3>;Jt16yMqFJL!c}MMN1vTHDOoR~HprWXyW&{i zRAFAEslUR0aQouL^1X>^WU4EN2NThRZnSA~EI5&rY7j3S(hZ{0qQfM^o4+N&e1Q5V z$pvu2twZ26EAMcYB|ki&hc~~dyWImdX;1n!mmGGoyc@ZkVo)Ekdk7Ev@XaU5XLV~& z_dxMUY-+(P2{s`~dhK7m&{Qh|^iTN{7e1Hk>^Z9D(8&GX#HZesMtLgHPwZ#>#!6=r z_2N7e_`xSNzfM@7_63TvzJ2ALpq97ZyMqAGoKOI6EZ9HgX@uV;eeyQLxKCLC|5M!J z^-*PxrG~eA#@_OteS>lfV$a96u&gXLW5G4p*-BQK9z=^Jw$i)!aQ^6S*&f)Eo_pKy zOb&8r{gOC-kJrM{PWkpHS`q2?=5kcBurM5tU4}c};ujcjVNY|d^t0H5U}xz16;m&U z>L%{N&}kUJxV`DGZ8>8f86GC;yNZc|zKx_3dbD8K7>fGwW>L%Dy@Qg^(AId7-vg*h z)cBVG6-S3WGZy%SxO@HB(n*BtDuzIjj*d*eh~R?e+h;lWoLT~QHoB3UXKvF@}%a+5CSR5=m7QIuCc`*LdcG3HYjx%y$( zu<)Ry3<&zr3NU%-o3*1gCed)YYr5)lDP8)p)Sv$EFw;_oNw3N{u4*gArNFg?M+_-~)D- z*Ju~$1s%X$e^yW~tO0+^On9k#KY#A_0`j zC-}1dq9EO5izv?E?Lor+*U8qkrgHr((4w69q1R zhoFgj+}*pm`9X)Q+5NmSgI(2oTLV@o>UG{@DRx5O={qb#)=R2wKvQGk+*(vp5(kjF zh!Ag}j#*n-#kjScP%qsC5#ccAC0L5?=mIcIb@ZcD=zRw`CduhdFlmUeny$4szH$)6 zwu=WI#EYa7gX-W@2{Jdj9cYEdPy^F>(fu#}M&kE(?SuOnD&9jiwr77i@BI1R(1oBa zCjWj&*Pp9oVBoOzW8(e9Z(V2uOeW!$sj{Px&x1R8H`_)2XayL&j9o_oZ7e7|8wxHm zzA&dMunmb+?fd6$?u>+ctyi1(?=qJ4vypEmI2~b1WMN9Wb4FTr zpafFyDd}rvyM$W?mwM|kDP`;|Nr-3ZOSXcs#6VCv%T*I3^MoZ8v+h*`rjH8|psKy#$e>j;4}jv3A!J|^}o!GSQ^51EALI4 zjFE$k4#{1dt&+eD9Gd&V`k%F^@o7*?LhI)H%UgTZ%^xSUlPr_ocT%Q$@DGC z3)hY1+iSkJbRK7X1Ox{jN4~A%boMRl6XpAc2fkGXM@=n(4eUa);4o>!<_W@%E!%yuMaQ!F7TKwqqgChfN7yIs(Z#&taGnf zI6&E5!}#ygdqwf_pBwU0h$E)|{K>RdE4x?Qe^yoHAOH$^WcEKWaP9XhHzsXl@cX~6 zeh2k?yxEr!IZTpSfY0KSigvLqpEaxY7S}N33Cr^!csYlWIC7 z(fS6coqnM7G4v7dJ9_d}zh?omkOuv)R}BhQHicb^zn|O`VZ7a#LH9G{dhw7874nKn zv^YgRmOgi1WFoa4?1Fu`c z1;yO5Ry?gE(94P_Q$t6EtgSo2rxcwq;Und4+U)zrYb2M}zW0D)>1%Iy8BU#LiGA&% z*)(U!v;n>BHHlkVy)2~3II7uwpz?4-Qr+Xuc^Q9rJ*iMkb zJk90PMDLZLgB!ZJM&53>XEQ?a89_n`jsuZR=V+TBU*{&B7dM5sv87<2IyRwQ3mOSq zL3%k0m|{H>cH>sQcrjUk%`lDpu;FanAWw5LH5khsj0&at^|DE+oAMtMUBli(s^oa&Rl7vh>z3>y+>{Ny$HETDay?(#h2pG1+%0*+i3q((oa`Hg$bj_49BVr1bBgWH_g)7BPS!PLOW0OVzJeu!0Y$EQ(; z3L2DqaH^cEZy^I2mxjxk1F0S-Uf+f6wK{MXD7cXu6)DSiO~)*EeI zikmDouI;xVsEdosaim)lwZlhca!TLs97@`qnVA`wrxElh%s6(|9x1IO*LHBBGY#Y^kqI5?1O9n#89CAm+E95~A?rZ5tni+Eb{_e`jNB zi;H?ojcYt{nERIPu|{n)xXtU~L+*mIGR!)xX9W8`IDX#vZxz6yTku1?7%EH>C@P_W zp28-0bkq;4;v5Eh)Rq&(#?H`b2U^kuDHN7QzP42+^=norDC%fe2S+8cr-vrsma&IC*me={5XwKKa>&uF~wI}rjwnD$uCl_ejA_;?)y2DW+Oia z=B0X%R8mFRrYT}%SxXCz*)~Z}7}jk9NrNJ)j~JJauj8Jl2qkF{;zgf@$LGZmhXMnG zkxT3&B3yG*8>mWQ(V^%Yjj)5)4UZWiB}vn|1NV86lh_%t^^G#y7n9i2?Y z79P13+52A49#>}Ey2%>nO*W9omuXF6%k}(0AE1(G z$c}n!h^iZ1jU>Du%h%>==Fq^F^Id!iO!vh7Cw}?W{Z1rS?R@w5fTa!|#&3UB&C@AW zqOaT0%iY5=SyXU6OKk?Ki-yAybG>#ZDLYman}pY1OA(Orx8T4)gc>ux`cuMJZcP^E zl0aMzN)9@+>c*-&I8rFI>^mx4-v)#8(`HqOOLdZ2AWYGaQ+?wFlt9K)P#{a9AqK~! zrBkN3Q65Vo58pz2!@aAZjrTR<&$!{HfHs=6u0FU}*V~pP>)?KLvS}AFY7i~jOpBSE zr(Ye`dQij=8h#2@Ms(7265(z?jdwf?BwiwNcc7qpi&!p-wK{*Hf+9+SX5TsvXJq4- zk5GUe-HiY*@3*gcVe`DwN~P_VWf#j`OqQ?H=)o&Iey|rHrxNxOd7}Ae+%76h2nvu! z74YU*o1_z)5K3oz`isNzn(CTfOu!!X9ff%XHLfGAPY!)+UaL&v zVqYuh{OkHN8kI|-y``~lYlkD>_#FiMwrDJzp3BLkR2q$bK2StL%gmiYISh+Ci=OG= z9Sh1ETH|@9jAlExPm1u|1lzdDmMx;=;CbJhWtk;W&d2b`+uWUlIA3IKGsO{dgMwYaNmvnub$zM04O;)&Bzuxe}w zAll8m0s%w;Ah?9V0PE0xoT~2?uc`j&)9q8l?SZecT@!Z_%?x6;%Icd4^3pf{>v@9h z&Ac;^4Tf;sNP8_HFFxoib{rEG-Otgeq^Ga%t$ESgJm=6Mz)OWao%KgF=-YqLr4v!} zB?10hC2+GQ=P%K^?e@EbKRz_K^Bqu;8;&{^J%m6lgCZc>5R}s+uCHFSd&X+lGoZyc z%uFLm*<+U+Nn#0Vk1U;yg@j6BRn<+ZrJdHTkIGI+Rdy1YjJVRuRIhuAd+&i z(~aGBTq@|JwN;cB*o2#~gYdhn;xu{H&b{Hdh>hNaPsMbx@`OM~@w%(K8znTNum~e% zI;4$3e0sJ$zI|OYQi51(3tAd+;!(>FZgdp!`k1VBzGBWC&VXW4jCyngZoUu{WnRDL zN@GJ*J=m_K(h5%3NdUj!L@^@WjMYk3+bmVa5nO;55-K=1u@+xquK)_jMi~p>fe+#xf9~;D7=K@a$m@2yA@9M)?%Su92c0`=C$du z{&!niJMm;ABWkd}J7nGb;zHz3pZuG03MELQUVOPn{O9QeV1a9Ro|f4tF!5U3&G4eJ z<6|X0bqaCbd@kkLL`&CKI&i75AQu{WtHI?VUSKt7R;U!PMN>qSh9$hld3j)oR;=C&~2rTd>!SuB6vGhV&< zW)*)kUa8@Lc9Xwt;ky;DtwXJTBN!lv54ZM1GZv8e!3Jc^Ora@-(;t5XGd#lpG+8gU zVr6RDQ^k^B0lfvIDPP%zO1b>ZzOURs0LvO^%{=5gGm}#yaN;4jp+Auy>p0^ zE?}j`b$8sDWAY!5kAHmIZA&dK#>NDnlHCm7c;&shFU$UY7N5_lCb)O+N~Il?#`H)1 z?Chx-Iwwy3QRM>(-3upG0!9!PH|=$u#~-4})MPtH^h=$(9I1d0@}N008@B!W;6^j- zt9s8GmNu+fV({n@WBww6nVMyyRGg^$d4j`3DNZ`4EnRfrf*AjByMIc!wh{Xhsc@z5Zxe zgq-6nXf}V?4bu!ks2eU1+9e*tJZG=2qU{52Te|7j_qjUNW9>6c4(zcW`9Y zG1Xr9V;<__&M#*?p)|#f{SH)l{d?yd3wS26($F6ZAYf}UviBDM4~A6o$7%o;T=b9X z)VbyV>Vev(izI&e4~4bWX8bbwa(QZ|aWBGX5-bc4u#Nji4eC1}QKyLW{>X?A*Tdi5QtDlXdkQ4g8t%C}KUzaaiP#qY>nUCT21%2t=T_EmtTt|U&JGfyLWu&n5 zbwe2&XD4YmL$s{zjX`@5*s}OV-j*&aw<`+AQ#|>Nh z?+!1=U&aw6rQsHij<4ILjEKPub+ugLWnRU_#h@mwTo9!%8yDm5^3zGzYm4wL5bgY0 z;Zi`C`#RjN7JW0yYbEq&n}6hrAlA-iV%OVRHi*1w;Y_S0`k9iiVn|z1p22(E&BO^J zr?7KnSw?yPMoIpsGJC&IU#6Z%e%faZFUrc2cJ!PayA)d*~Lt()EhDHR$xYhXuGYgt}d*^nOs8f4ki0@N9emDWW~sxCJh?{>tE5g zcXi1MHl%`{xf={6T02sMK|K5o$7i&=1QYG%`$$bD1Y^UAyi2L#Z({{+zcTmn-~MIp z12#b{Y7KxF-}c^%pIc-Fgd*M}Hm{)t*S{y%|0`a{^PZkOgXldj`s)Id;J$B*3rRbD zaAQ?NNW>$fRXi@8o(0?CfM}(|o61}T>dhPtM`x;ecyQY2jh|Mxyg*uV(aqLjJ#DLX z-cZ5V1l$a`e)bbqXtzxP)h^Y34GrT1wjVYV!&AxMs6|?;5|-81%NWkO55ZLP9I0t( z1H(s7~si`~AM-=50A_d5aY-G~JJN~Ec&tdtfXug7=(V;Ge=ySe#8 zDtK2lGnz|JLnE6CBechH0JQJ|)XUDnj_R56Mj~e434IBB)$sxKZsHf4Cu*t2wM9i5 zl6+G34A~6014LI0RdR_DgHQu6J3AGGgnR^CpL!&q+6^KvI^tR3-~;n{!uryzL0`Mi zTz`?@^a=N%wDOafN8y!oZj0UyL(VGhg}Ph;wCE&B;P9PCpBU77rQ~Cr&rWUB5$(6v z2-Z2dPzMdwD46$HP^m`{LWi8!R2IC=owi?LChedjQVKT{HIV=#h}Kt)rYDisc2@B; zf(S?3fB;;pcZ0YAF%GEaqI?Qq!sl-l8$c?OD}h+}ABE2p*r!`&)xFH;FoyJHZ(ooC zgJ@6H;@<|RSXk888U&P;kiTE@U040I|ftCIV zQu!ZOsKggkA}q0%vuDq~?(teEwF|7bC9uT7G}as?w1V^h45TvZRzCT*vS5+lA>Mmb zWQcJ9)85J3^Dz6YLW0xH=*|A&DqJPM-=7l$o|1;QvRu>DL6x?+S-w8n_vp{l^6}|; z#)qJ`O;5S<@FBD%K~$5VdQ1XZE#|1jFAz^_`vbM|NER*8Vr>lUa!eMjt#x-GM)mgq zaX71-VRZvi)0B$(YAQp;L8)6oFrtDGoJ~oK!V^JsI6XJl6yO3m&mJ`-Z4(%j^NT2d zvO#a49YJ2tPv0Va8&V#EfiVIW7AEB}fTbrsiXTEjNWr63+#u&G2Hla=qlsHNa&>mR zCW0{clWv6Fa~A`PbzQ4#%F{?aWh zJ4_kDc7CalF$M{FHMLI3Od7A@Z|&p5Bn0rZ zs5>w&YyGVVkYNn^bedTlUI3Y$O81$a!ldBYR00Ta)V(q@%J+u;Q~CdNU;eoUhh0to zSNZp2i7xOHIxKij6W&Y0Y#9M?U~|c6&<9+{`(RO{$+yr{pL7w8YmTLjLTGdb+oQoN z^b1$eTm4uwzwY-aOP4TPq8Wu}T4ORL5BFX06!Dx)kSM`Z*go93FP17-x11{;F6zLGjvU}c7YL*vNMvMgfPUw$bt133i+7#=R`Mn{_6KHXxEoH|H-^G@ zq@I;jVAkie6USdzl5|zhz?biUAkPf&#CzQ0>VK=ebxFm58$a`XM3zHejog1Y>JzQN z(w884tEm6ynBU8u=Gt`2Z5zUedrYrm-ih5#ji~}A+VMcQ*M4PhT=#cTbzYXR@UVh> zh~$rR$#s}$6IR}{rQN)iU1jJ;CUM5wFibK47yAajE_$1s!(gDLkNujUpp*rBi68Jz z#F_9`ix=Xe7$|67cpv~r$DgVc! zp{Vn+Ng)q$ZZUekYCdrKz6Tb97PMIt+Tsw^K|ZJoj{?z;j`G;S-a$MW+617>K~j*- zyc6PQ=6VJJ&dKMbCtMFXyKNZdLrB^g$fesNcbtvUiMJZuKrF^MDwi9dIG~V{>~FND zB2v(xlTC16z=gRn?9>cld%lZc3j??}h_KsPuLl^HFWQ@gf6p20bt;XoUV zc0t~{C~%gZlr-V~gA`$;@z9Up+Sw|AfT2{V1Yv#ntuz=imfb;L-K%*j0>a_pJKF3C zg}IAhjSC)o4_fAu4k;Y08_hET@6~Qe^bkb^TOaOLqlqi9+kO2mN7<%bW&RFie3U$m zt&s@<;?H(&eW3u`WT;H(asJ|dZN1KGod46>e!E}W{L!B}f1516ytx+`OLi|*jp*+c z9Fn&qzyKE@NBk6snVfFtA2A!)T|(%yz16m{@uBwF)~lEP?5b>pr7r}eUZnCECam(@ zeG#pbgK48XQ?=EC2=~biPT^Gf8V?>0Z*Q^UfXCJi4ZYK-#CAvOx53!I{7oe1F5tYK6}!ft$LdluOvn`j z{8uvET+KwT&-d^o`B8&`YCIlWo|=%GHQXK)zP8}CKYmF;I9p2y57d|kCNFQgVct%y z=tF??m097n8AkU`U%v>|=bOW zjb)Jj(Ne@2&U)l$lgLtT2axFh)OP*a5G(%-*?Sllu{=BSw}a}xKVbj~dB*MPx__U3 zf0sM}+eg`pl5+MQZ@I0_-g@5wN4$RwONj_xU?KRO2)={)fe%B+lA=KIMEG#c(td=9 z66>8sX?o-H<15OvFO(VLHFMTKg9(jZV{}Yl!cU4eA_Ljy7%o_`4);uO=P@uAsoL^I zGoRe44smB$nF!c?z+~p?lnw=u)4b%71@ zxCqC083&Cuq0#O%f{OTRU$W-psp+qpE~o1yr?_we7D)MV;b&*^w>uk5YVreh#=#E* zZ5@qZ_7K*b3E`RpweI$c3diyJy`c!RxoKQCm6A*6&;tMZ_huU3*w{IG+uG>U60S^G zMCWuYlxl2e3$Nezy~{(m>^!qv1gN7t@cS>bcXxN?{yPq35USm+>6~b~d5SI9y3ndt z5jKLQt$Z<6gG4fe1#hIr$@|Um*~ZtSytKiybS@6Tx4KVJ8^6F>j_EnFa*z-fQ(S7` zz!&sQ3j(LQr|jQG&Zo0@oTTU8FE{tf0nC`A(=G(u#~sWukDBx)KGW^XsP#pX#WU2m%k2>tzq>GQRd#Wr8Gb-uoj<4MOW%^US7av9>J(6eDOSm|4e~e z9i0FlAJ<=+VBXO+(qem2uWl`Zj-6vk%2?!O?>XjfR2yU3!;STI7yH!it)5DgUC=rD z4yIa~&$}IT_AT@}Y85|H(zvT#F3k#7pKeB<4T`pnsGV3}J=}Q>jtX`Y+*kkNudp7o zgggm<08wjas!jZzV)Ngbl<=ziGHw;O_*mdCAFW_8E(mTN-gLRD&~%n5f4VSfd2QbM z`<^;XPWANT^mI+y*(iMNjeY!^Xp6l5H{V|2*$xq$!9Yg4+Ds`6FM$tnyF5l0K8c=C zdw$LzypD;93HPl1K}a@Q_9#*~ykTpL0$ODHpbh*O)rORG-_rvpG8_e6M_W5z#X;I{ z0=r|2@RUiZ%NM;h9{x^lvp73jdIx)WcsjCE+APkm9s78AEz-o`5xhv7&W>u(mF`Ybe0reRI24SfCi-oVd?AXjm<{^>M#149ClYHvEy`&EoEjc805GjRrd!C zdUFYLk?)z8#-1Xa`*Vv4VQtcsZs~1uIalVm&KJh$fa$zCzLa#b~ z&@+hM`-`bvqSyQ1n(`L2^8;hG%E>f>xSNh#?V{kr3R=GOw6t-d%iszPWMrgk9S2YI z@te4!;x)ry*4Af8=5OaB|@VKs`Dc`+L#kKw^)8_;39B;&_>WjZgct_F1} zInu}ettel&1^-7&|ySW6vIRNkxLb_fg?b!0w2)x zr$02K>=fghFIgn)dKAgPEbsR-t9>s`gGPwwM>New!52*&L~m7(2v(lZIU!xO`EP3K zG~9=e)KibF>)0SjacPk=1{6#GQ(8*zDPS_rY&;QA<=G{8*hA>kuO( zlb8qgGzL+NsSr4phH6A`7?1&7{hz!vMJkbz_He=W@^sqdM7S zBqyt9vSP~B=H!$j#L#W(JQKzQkU96mKa_Fc)P&aIUR`X#cujuzWD#p_LX5( zE^WBP0zo7M0i`8X8l?q9MH*D3q`SMMStue>(y>SpknXMpDBTE)4w3F|ID>l&e0%S6 zUFXmF!}U_{ntA4a?k8vF#)2{l`xW8*n=zw2+>?TJ#(qAUB*qoRCEf3Io1WZsF;8DJ5`t!Tame*o>Zc6ouMrat>3e*Pm2-4 zq>r6^2Pio|SCAu%CAe@vaxKwiyli`ht6jZ26tBTWALW)f6nHxN`bvUUwzAy!S6Jj9 zWZviEx`$=?>X%%n()?!xMpbxt1k!-NN#&1<#6)#9WXzH4pSH$1ZFiFnDRx_3Wl_g` z-L6>G{0Lrw+D=a$P%!=C+>X{W<*|vA2RA>&MO{T>PlKYO$?4lB5+C*{!WP)EOiM>K(puncJkd3KC`Rc zpDm@J_s)u&L5X)+Ro zsa2gcX73(y`t?1ULXp&p>1m#k^%UJ}@SEVkS(+^orEIk46pdwe6F=X3LuFjwZP8;y zCPMSd_80q#a?q)6YH@~JKa|44^5qD)QB2^`bW@5RKKpVm-~BGqIQk=pcfFA$k$7O+ z4MwV!J7nl#+gxv6zW*XmN!7hkRIU1tEmva=u31@I90^X4@jv#kxTdM0h2xTy#avhT zooNB%gRC()i#*Ag8dMjyD&NGt3ihC_eS+Jw|D)mE9n8aS~V zaSPbi5}v!)`ACiPqbUW!rUj$Y9iH@}3#i21KD5e_B9~IKv9*PyMH9bO4&I!HxNT?) zZXV+`-wzZjc&K*OIR8dDTC;8}SfK<%v^|0ccg`}K>Uf|@{_5Fc))nQ){ijQuDtlI& zi{B~!-;=}PY4S)&8alt)8HlHtwLsX*%TfT25>KIrxU{qeJub1qMyj5OtV7*u3@2oWY+&BCY9dOBl3f87& z;@jaEx5YeYd*u6L9dI}nnhsJ;c$dTV0IPQ!WVSPW_t98V5GO^J%Ttw^I+T1}AcLW0 z^}68&_VcV@I9U%eYvO2xQs&Fyfj}8(OfPYV3Nl83<}D~!hlafW9ugP+OC15VUvD(j zXAatvD4|b?Vy|jE;A%i3zxjl4r!n#?s@l>({3o)-fe4&8kP)TMeHWj1GZ`rR3SUT! zEN+qduJF&b?cc;q0ehM%^&W?Ob&%I1A<#)WyuD4MB-(CZFnc3+%c@%~k3`02#3H-S zj;AF1?Xea1Gx+g0JRRnaL=-qp{FOLnIZ8QHLD6eHyRsdf-E=ob9oE5FgpBI<0r9He zKPzTr10VS8Y)p-L&te_Z2af+q}d zjj9@7ZVrD#T!T7^y6SC3=eU2Ta6qsD*m@;}zQ)uTT1IM(-8GK{YW_GbB;pjxFR8J) zqA6YO*>VVNp6aZQJvJNc|DKH~ZD&VBN7%s@%W<7SmWALU)xBq1;x25D)o*M|)8e6A zp_TRgb^9vyS6u478}CqsF@C~6Rzv)7e}-s372(kij{Rl2GiEc&YLm^|ND{&OemNsO zXTc=vwMk#P)Ar(?L&t0R<((phnuV&)GR0Gw4EnEr#`ycujdjM06LY37S#y%5CnUF} z`xz`!su}1erTgz)w{7@Am1Ti{Be}$H`?xSL`>Rh{P*L$Joq<`ikRjq*p6o=gONmo} z<>zmPHRT%88m#Lu&1g7+7M;tLF0WuLs+&+J3C1%Y?iSY+rT+ZOUB&5fZ`Dp0QcM>| z%GcK)X=Z!u%b3cFPryu?OAnbIp^Up$AFA@BU{HA={rQqBghIQv+*zfaeDTv>$N)5F zCpswh{{0M5{Jnq?8e5@o(K&le7sR%X`09wc-hnZGeBlq;2iwUzZCQzwx9wg|BCa(Q z67H+t3T%T*$yF8WI_KXmI^Y|rlAP$RpkBRwd(&Y8E3-HZuDD9?pel5t&_7rSPPX>_ zp>4ytVQwyny3#V#h{Y}N(gIJ~tCweIlS*gE>LhWMjJLojWm{DIL|#MA23tB`O;@up zJ(kCC5u9esP+O=a=_u2TIkn)=S1!J{0-$W7!K0yQrdG|H;Y)(xS8!`V#<&S(S=z-9(N3Zw4 zy%1QahvbB_w%fj+SD3yyZ?JWqFG}Qca{-hg-kP)&rY5Qn>o*05CarV*fUs+3@-nwaZ%m$fClbm4#6AwGd6(yu@d zwJ?o^miT_;#VfB75;$dee6~FE}+y{^6=KWsLl|i>v%` z#_7gso|u&9B@F$RRxS=Q{$78ggcJnt5fbv*7pNMZ=9TILmT$qj&&*{7bQgFcqNjol zb+1$hj^Mb|5U;=)Fu9fkJEMD(GCs_VmCi4&Y_O7d1t6@{;MJc6No_ZW?jyp;dB_YZ zhHWg$b>AW~SPOf<5$vhz?BwOz=TABviXRjR=Ln08mk1Wfm3~aPY0JWFd_y3>Z#W1d zsHRu5a3VF_5V(Akw`n;x6wc5+3K#DUu~sgy1@!K$U+EJ%?5vWjaT>UaBk66<~#n2Mdk{ZAl~-k^e7yd9A8y1>y3C>K=rrPMFQ&K{jXl0hh| zZSbp`5pahe0H#snhu@aJZs^!K_XL`#M}PwNU$3w2wHx zCjF#a=%As>tMjSDF{Vo%r`|$}y86S=XWcrLii#C8km{&1O>;-D#Z{K4GDGavpN3W3 zWjV>MySJ=L?NDB4>kzaYIcM4&qW`dq3OX?&NNr{CzjnVQtwKuZS>}V{>Vcbz+?y#u z@QAgxR|TjV=-%`YBI0vx`d)KXuz-8o(wWg3Z=OM^F~-Cq`UvuBVm+jH;b_uoTh#qn zv2Xl{w5HoQ;DTQMdRmG>!UUHFNGjo-%L@J&WeKkM#8|%_(&y9!b}_f+A2!mhxvtet zE$p5yrLqvte=aX8vxPN?YikI(yQdq8xx)6-%5%0lhPut_WYXO$t8Wc=uA;yKW`4lf z6>m~bwTENLmxu?)E$O~dBv(vju#oSJugP>fT%=STHBv(?!6TyWhE&TV9h0KF)4~jw z@^yqmJz46@^s!0a-_4G?A5W^|9R*8lb}1fQWx~R0FhDGbw%9Wpllc%o7}n*riFz9~ z^Xn&ejX1hi5~00xH;z{rm;#0fHw4_1s#z`ems)|nVd*D}rz`R40&o0QzLlVj`l4;E zmvKytA0bY178KpBUpx%|mxN4TdqAqCeeY9V2q*>0@ZCmw9R4-0 zxQ^VhfW=~`qrDNjwc|{uH!Bpr_S@-vyjE#q-I+1;{tT`m_(p>C3g)JT%&%{$OFEWe zMJO4E#Dp0aZf+5klsNRw57sXn9F!ik=hS3W?=RTJ!WmZk_$Ke%Vj0wAXo-t>I+x8$ zdbf|qW-C*x06m#V@THIq%ceRG1CMcm`f=0io+MH|nd6(y=rzL<$!%mQcO&i)SI=_L zHirenBfcnCLdo}t80e@_ZXvJw7Opq|m9l0(t#vKyQ5-NZ>S;zS;GU9~vP z%E>rg8$Wc;K+}0}KJ~x##)JsyQ9Jyd=wB2AcxE6PiGQtcOUp^B_V}xJ+pXCiTXTzy zf`X|9;?n`qK5xou`6|cF9=f$Mr+w`5WAgGqCWD#AdA_K8wfL+6rZOY@Q;IE{w1>x# z`k=Qb^(@WNnwdhfrY~>dWgu=H6!Y1Rj%J;L0wTZbt25O<-dH^?F0ZV#LpZ*~HKs_) zn5x&IWHlX(wf0ad&sDD1$G)fbqRV1Nm2S|ud)Rp9e(K5RU~IRNyqDzqMM|`5{p~R2d3T@`=oKl0!Q%@a#>Onfbm2M_aXSv( z2-R^ZT7nZ>Sru;34Eh}2-g%2lAz!oiy&Qp_T+)tCvu%tJ+t3!uNsb%iW)gUqd#^bA#ay3lzLZ3fqesu8OYf z`wrRD165|DN>R^of|}Yb32J;xOc>bHJUKf^xJ;hcYHO?Mcl1@c>#z@(&zW&L(r=GYkeKI;NZ3+yxrXxm{Bq&n4X>Op6)PPVS_2zXzpFMGoR4T*S6aG zGAM3P7Incoej&vEmGjz@=nta_`U^eoi$!+FoHDk8%X%|?=_`gqBihp~GBPrY?%CM^ zBP-4b^WCc1n4N(g_T8_&dz?j#9b75d#{CJea)S;WZN5`7 zk4p84Jg^9JyRK%k&^}QfEqDyyksA68y&?c(D^ohg8*Y8JD^%v{&RcN&C6khwm(_K8 zOtI`{ncZ}Qm)Wd2;)P?Dv%y3By~mC%7-Z!h`wC{VxXe)5l?jcbR-ufOwVb2M>Zk~z zQH30hsBsP38d>LVRf*lw9sCr`;N-^4r{}4Hn_?A3pq(#508fMR6wJ zgtjv^pquPiE1#G^6BBXjC*M?Uc>T%sTz( z>)R2Agf%JlX@dH6h5(eakj01i1^Ck`9`dZ<@9K)Koh}LOdoNW+ zyh=hom*H=2($`weQ~_E(W1v*rrSs&g1<8&Waol8AoZ(#G>g6X zL$=jhhV{N?6l+GQKx`wD#T(s0Rb*zB7AhdIr3d-v2Z1@xjItW-WML^&OMDX^( zZ==~mc_OntdsdH=XR$ z=>9>tP4iYyl*GE(nS<{Q%Di1tSX=kS$HJ!|W%lH(LkKr0jES zTU=nf>A?=MLM{_`cFmlvJ3+Nfk4fWJ^G9hB!BApa0mN&SBSL+}FKW^ZStLyCJ(f2r za8u%Wv+A24XsHRwmM5a*J{*m96BT=rEl40u1{_ddtY@F z-A=pqJv&eN3Z~1+al$(!6iLj;)!3aaLE1IuWKptzGCZK3__O6tt@sW?-#_j_3PvfU znqelQbKtpAe_>pY4uLoMo_3sY>{Q=V@WD(SB**KBrCROlN+jmd{*UZK&^oNuMTf(0eVE_(k0| z*loVtaa?P>itH}8_5O{aS7bIp>bb8@bJbgXZh~oki4rcqB0u&c*^BSlz31s;xD-1Q zs^S74AcEr^;S@3Pi0`mP6P2p&&EA3nr)pm;3hB}pZ|EyhQD%k<1n8ivap1~K(|^sH z=M4zEa88J9pntd-UPX8ocJfOczeD}$ym|Ctw|b5tb#y!&5wL~7cVM_Pwo_yu@Fr{dg?-#d9hM%f&;^Ud z?T6Q&!0Jr}=EsU0Lu43#u)l;3IjOz=tfG`Ps)KbK%9_&i14IkOiD=OJ8*Jlo%Xcwd zyd6`^?)_`vk31lPW2k=yjfCQT4{s1E>vsGjGrUJ92CULg7QG_jg8;>?t2C1-TmD{G z8@;F9{1Dcb{A*DV=t=NsltZ7oWcfs6%d@qL{$4Nn(T73kLeQM$`RxKUce>)_TfCX` zGjX;Ye!XoYsrQ{G>r9Kxqw0CacvR-f?HP*gwm11q@7brjofO^{7yt5ZWv*+jyLuma z-emfExg+o2`I9lDzw#$M|DJ$m$r(d0AJ#8iF!T%-@G8s@dXO;5{wMl=jB&R=EE87M ziG924s*_l^u2n`kRrCptsK3@Bl@B%99I2~zQ^eo(L@ljI9crCED4p=#Q;WHy8T?T=v(o z9Vz_t14O)O^(oq^3$vY4C>lcnkm^EgW(=|vkNp5MARPWS{&xA>e=;WL;{j=2ai;+1dl_I)qOxrq4@T&^3RzR=d`QzT|E-cn}`?2;!15m#=e z$A0zM600ag8eWY3&l5Zw;}g7u(ZSR1f<2j-{|2g5e2tLYK12gS&*d~%r)f%4CC)m?{dFmuKfn|;%0>M)fgS#LKQvq8(mAv^M=xsb> z%RJIL>kHHn5%7E^-vcigCl0<7DnWGha7WMmsT_w;;4V2auL@OihlZuSJXTw{zeSbV zPi12~OqaV+)nj}q7Dbg$>if5=Ob+{s3`B0(mB(4el1L91#Rw8f6JKM1vLY$#tZyx4 z2Dn*ShCd+e{An{SLv=5So5Om<5oRP7G$5XU(vw1#zOFRI2@^5Cps4qlH4N@A!zj{I$-iSOPkl%3L zc<};7Bll*Ai$RD*e>|Kxo5tm){?Eq-@)5qU__^aK&uMg#njCg)5>IXG;sgz)C4&+l z1Ff9x(AjLq4&#{)PMwh$)1rf5{WebT#|>@jNwK*uRW>OFyMoF1_>axRQ+k%5c|~xa^HtA- z6f)TNJXDRT=dD3-gyyvqX_RpfU3(E&8JqJ_DAZ;)n%!Kc__gcZ`!msxH4i(~lZd|& z<C_!V`YwW zxx%XmfFYY$-I|`)on9r}7br8mBItjMNg|y_eu&>SRM-Z+<5q~eNHraEoODeK6MJu{ zvINgPerI}_@dpge>6GL`A)+e{>Wh&k0*5RO2+E3-Z1bJ(?U5NU+n>!#oI{Q+2v{5o zIgN|=aFoq1A36K!avhF~yq%TRwH{`6W?}c_89W){G4KnBbs7nS z2r4@)luzTxxF?5XrZfg$Z&$ff9iBYfLTB5qQWfwqM?)p4agdl>CwmU1u0?D_OrFQM zQk8;MCYUnb$$@)OB2c>Iix4}02t*KnuVH+1>yhSN=ngDh0MJ$_qt$;1dlVn6cgf0? z4B?CQmhm9p^UMslbai(0*gNK$ zqT%PH81-5;iXHUpy=POHm4=bx>>zWsuQ{~cci`X>*tIZ|v@jcS7K zGH^G3UmTxcU^04)s3UxT-Hb$z>0R-#)oX_1zx zq)9Yjg_RO*Y~kSqqOtkrJ6F4r^C)B<4mr3@i&X~AtUKx;7j_I){NTyTerpWN$ds*W zFdv#sanX<2>5T(1dS8A3#0ShG8Xis|B8i;wX~JuYnjz+K>@+ArAWUYH>$8roI+2`qyU4N=bZCqsn~ zALgUR7uo2Cw{wNXP`2M<(vfHk+hJ5*3Kd)rO*r7*!<5`8?|(bY`35_i1;M2^__ms4 zK<2Amk7F~Wy7rfy$UUg6;+Kq|{5S^c?-`2O?VSr=yX8)3IV#m`HZkNWZ?>Nn-{#m9 zv(bI}T%JVJAJe7w;}=7M^`G(mO$kn#?gGKMVkjDQKE}XqK1w*QHo^sV^N|F`e=OmZ zGq0}}Ru_DsTtwFaU$P2|_GEf~6p5t!;9DVKh`*QbP?xm4`TqS(S@F^}9eYwXRM1pWR7*{eb(UE zu8x;Or;-Z>MyBFT9uZ5`r*t-~(1af$@QB_-Z0Hk0!y2Jsu=3tc@ntOkl2+*|!29T~ z0}|q#BgwKK<)X&xW`xoQ`6YdV8~6`NQL)}`Dh`b4l$q!)m7|aAQJl)LCX2H8qO8AD zK2Va2nBbckQYd@Jk{inwX2@yq*=_Pbp>#20$fLL}TgOz8-#pVo{19cm5>Gu*7uhU6 zYHEosu$${?IC~G-t;uu=baBdxPiwA(PqQnGN8CobC$MSEhFCvneKhBi0~hb4MFon^ zkvx_G^-^q<<=t1#fFH5Hz5ADlksp+8&iL9AMpi* z?ixSEVV(D#yw|FQL9%fz*pXv2|Jc(6^JCf9*5Y5K2WZn$n;+9Q`_Dxn^lX<1Y&QhZi6pOElbLD>VZKMv|_EXdm>>CPAOhpLX6euGg+FPDT)0u#&PYl+sKlnPh4gV7`8va78kpNGHihbmEXGQ3$MOfIL>`$ z%Ur9#4#|J(XcN{ac*JfZ;rVYg-O+$43$Mb%-=mI8jxq>Jbd@*ql+M=ZBD!%{*6+$? z@$+Sa3w2z_C<93lyrkuLg&cNAOSuYbX6?O`muKye-WU)59{mVIasY*^JO18hu~*a{ zpq9A2D}5&6>#zP*K?Ky!&j3)|F^W$F!u`LkK<=kUwKy&tCSPf7rFgkAfMa1DA#uNx z`pIE>4+N%KlfZmu$0qC0bnIKQA4so{)^H7LWvaYzzRAcWTZ$Nap7XpgIHkAJigr!9 zRCcgp@(>{R`{(P(5OBhDjl~&hF=}z#JfHTtVht#tk=9OsF55Y(p@e7y&`#uV`nQ}u zeiEh&#ttf-OFCwieO>p(BN zNV%$^N9T?7-NRxHLSeq?nkm?}DwV$Dc2b|$G8VBrpHikK6Q?^Gxl7xVD zlsldSsx$q!*m6_@;{L-r3St6tFYDl2bYUK)uHPAeS}?^Ny}oC}Tn`*EktHCt%0wH` z^6s|@n9+i+m3XFIzC{dWe1P1ffV`ocu*if-;Qd>UT|Uk)I6-FD7}%#Br(R;ZMD@XV zQ{#3_XrUJAYL%yNH#f_HHQ*c5LM=))FxX}yCMG70^uLSuC}E%ftBqmJOW@QC{J%Q& zj=OW+Q-W`GwXOr4B>W^pCB@QN2YT=QZD7d{m(%zWhQ_&{+ z`Qh!>Y@@Kvk@DrDAzo`8)0(x1+$??JuirMv_({IvPRjQudD8=I{$17SlO;I!_poXV zDmLkaV-{n;>(aeR|EkY|NRSm!)pBdBcI<_K<U-VedfrD)%XIjo;4^$rY#1RmNw0b$*e$5lOp72<^c{hUf#=Q{+rt zl|Nj&aLmt5s=Yd3qSzV{CcJatYNkA@K#iwopSRL4)Vzu5g8bozFTq~87_r1Ru~)kp zRs^9%;53Kn&$jQSPXwbBhzHhwCoLeh@Y4?-S7m<==*OOB|7CNOuCKQ>I#q;0x4 z)I?A;4C!9=-|HEZ58GKpe=38|j^F3%(T(GZ2)=zfSboAqdQBG6Gf(th6$A?x{JCkH_hK zj!tnSv|kFIJqBS$gj-u-SQ|MpOwWl4e@{E$2T1L6pe#GQJR_}J@}DpA0OwEt*(3rM zWBldh5fAO!K80Nx&!(x*kHn{b34BuDd0XhzL|BZ9(lyz=YCqn>n#xL2aeS=cWZ#Fm z`r)Kt(+ z(5*S1@(wXBb$BXY?t$?-Gj7d+pLbZRUsDKyRK09}sMDay+F>Ze+hm=+>-Up?HWNj* zR#@muCnbvVM`~uob-*$rt@@_3*s6h!#?vzVtf@Z^rleEMzyC#NKwY}9dR2{U-GYas zoCF)8-`sbFJl)JZK`6rh(}xr}TTfLzFsH#rh#;dbnv3W#$Lz?x<~Mg!_04~Vz!5xa z7Qj3620cyIAghs89~pU}sehi}J7?b6iGU{BpPwM1EM7Nsm6p7b};5xxOr>??{9s-aAy8Zv0@}sge-ai&9Wm~1d&>} zD$9$Gct!$?o~)i`@3*Fs=4$mpHpT~oE#s`mk(SRg2#WUuv=)C@J7K4Zf%Kj3S5YKr zA6lD3@R|JWUQnN-=3;ymcYx7j86)h!Wc1#h89kleroa>~v!|^Ngka1SKilq`kod^G z3i}ZBb>&Hb{ai)13ztQa#`sA%tI(IPQ=GK`-J$V-TcgbIH^+kXKnzpRAKg4B70|beIu0TPYd{;7gHkl$m_KJ}5ik~q}?KA!@HAO)fw<7yg%OZ?2;S2{f4Ea*{ z;jy)}0(-5IQE&qt$ww+UGd-V8ZDvn8cM2tMsTb`0Kq_{acLeLNb)`BqRbFCyeG&Mg z0%x@~P#phjj9-}Z{$q@z*TEPaR?rwPjZxu@Nj7NG=)0Pt;{i!TbtP$(|?>PJ}`sU!sR4TqB!8q$&yABpMzbwVB}e*t!%ne z^}tA3c&S#&tYlYl5k0nm&_U-`D4z(PdPYI*+Xnilcz5Oq7>CLl!iNKQXY<$(1oH~C z?&)SCay#NJ2GkXvplC!9Q~^>9@Ys(#gKs;#?zKNI&Us8rm3w$*giZvsy)NLf2^k{a zqeXk_b|ghUiv~RRpU+S4Kw zc-~P6$hp)qD}QO7A5XvaZLAd%Rm90wmbzHtuZ2pP{pA4UGB>rp$ek$6I&tghE zc@_IJ*{VBw-b}YvZBl5jFbk@zA!Z}2QCppd?r4q8zP-X=w^>fGC^k{x03!Ys-`^{G zx<`3LuyPvl>+8Yf;pz$&62j-)g*{*25iBSlwDY)e>vT8plyX$^OVvuxDZV>vWU1JN zs0D5q+E2g=E%$?doQNp3*3$spA1GpIjB?hISquxMSIctszaG&nKlxo6C)WV=*Jjas z#RsM;xAZj!=OxD_?WJ5PVlBH`b0Y7*2NvMDM0Jt|$ej0n%zV9=dp3I3alDO&qv3`SojIM|E&5SK%9Y~nA+0CMODD@K*r9-RqnW|=CJWZ zHf(G)Tt%7UQdWj4H~7pAp?%UE81M8WQcHQUHGpj2?Q(Y-w+=P<1?KwY|_7 z(U)`bi!vHgJ+jKYJM5Qn(LXaliR=#Yp8PA7s@OK)@e?qgqQq-;_nyiAG*Me-ao$E; zv0RWh+tuGbzif8$d%J%@hgBJ_ocVE?6;@6Jq#D_9rQ;f3386z2E5J{g%48@1>Gkr> zG3Cu?L2yNR;3%JDB>|QFv z!tVPFvWf?*0->cXhJJ>6)Q=qPwuZFpnLn7YmR%ESV{>K2xMjcEnxex3?Xl7mH7PvyGImB73qvq7pbp5ID;-@%}v?p z(bXIso@&_HIf|o%Up@4S z_%c=Jq!Q5ZL1E}cK?foNp1LUC4DQ@6eoCBOpWJOr3uR5`EPILX@XM~?d!v3_xhQXw zFZrG^`iU3(J!FU#v9mU~dQ|B&8|yIWW%1-d>Y_vVT-`I}9yyF3PI|9qjGr7Rw!a#6 z*I1S5FN0{)oc{?`t^(8^V6HXm=w}pPhf4ji^hCieKIo`sMNRUlx7XQ<$s0aa$o*12 zN2lS1y6m9}TP|7IR0F5(#zr|)+K;{*Y~f5Z@ZnrM6d5CRic=}rr3endM|9B3+q0Mz z*e!obXz7!2YnPpnl%~ioVfCgdq$@WZ9<<#u^n|9sO!AOD1I*aRXw*pqHBDL@u+3|* zCp$nhDpKMHBor*H!g2ZK#4)c`2lw$~cH3XUMjG7UoNBC2vHz%tB0;yYn%rj{7qdzh z$BEtcTWf|-9pYAmVjLJ2HLl&i%19Kv{Uy*e*ktQ0;#AM<+xxV+s@rFrNnB8O~ z@2G7_QtJ|ptz1yxuaePQIU@->2%Y5~qD67^5Tn#vk{@u`*V~LnIV0Xp>y5udU4B}| zHEc0DTah2I#<$##Gi;w^I{guUPaY1aj?bxO%26y_d_!wlU>S=ijZpm`{xXg4B3%7^PmJW z#*T1Y$`;vb=Fmq2(8cY9y$#uSg)oN73Vmap*dpvd%5Wt0e7m1&M}@zq|3-#f+hXTO z9&FxXoTwLn?7?6)> z2dh%j(c#g!LPuW@){Sc8s4!w-1f3|#s_dxA1n3$C# z`wJ+%;V0`IoQ01xFYqGiyW9NO>3*YQ?mvf!9AKN_PcP!6ERjkAR!$RP{BU!pYQ@VR^ zSUith<2+Okg6V=&dlaY2n2)N_o_kPJd1_beRQjFz9k)v!+!rn18hH3hI=e5X3$p;2 zo`L2kGA`rPrta0Dh{`uXR&-z+Lf9SVUT;XX9+{6P+!ngyTyT1@bV6e9=B5tLXSdq! zs92T3ZT*ilGZNGv>uBwGw-2G={z6S%z2C<9G`5n_mVs1*lHk&c<$ifofEs^vtl+lv zBdG%~yr_EZjf=JFZl&?5wHlA9HMewlX=MO5XU$KEf`>D`D^F*$*PBjHhkelQekEXX zMBD7M8&V)fKPBV1FRmp__)rO-CgE)*kqs&Y^tdxM%xU282sO!adSBl*;0 z>AC30Qnn9Lx`;d7L{X|JXgOM{hlOL7gtZfBAM5ueJ%>0O%wAf-7$wvch0=vg`U%4A z!qUWsvKxQAG2?DbSloXbQocUJcOYVho^5{sr<-pw8QuJ)kmgRmjxid8Z-$Zi1n#o_ zO_ovom-E3^?80&hW!a{8-~4>qVN&`Qza_Z|J^eZIE->h^ROn!1GZnn;mabmoCSUbt z{YgYA1K*f?l{m4-rEIRI1sXo6OWFujBA zHwkxEE(gKaeXfD=_AYn)rn8%@?5O-vrOF#-+{S6R%pm%YS8-@svtDb~SP<9y{c( z%=?_@%BeiyLuk?DdkWFd+=zj2wgd*)IvCZ9IK6~MMyui*?uefBV0|rOERml9QK?s zxUn{{Mfj_w>%o_j+S1x<(0iEtTL=Dc>XB)_fEthgH;b+Fj`7oTdtJ;AT;=? z7yYt(2GI#KHAm6di~XeTP?Nm_W9u&3vKeR$d6f3z#Ew%Abe<=qk|0C+sWhuIex{m4 zhJ57wyp$ZtJ&Sk*_a$?V;J_}c_OCZv32ZEESnI#b*8*A3 z_J=+YL8Ho$*xjw7aEKr_i|DGm$iVx#GG*o7?A^rW9aPkyKW71u(=RT`plH0|?ai*J z8DQ&hWyKx4zK9wn&^H3LX-vl8Sm%&VGu&L9m7ZZJ|E~RQA%&KFcM1^p5_O+z(;^_!pMeQP`B)jI&hM`ORE&d+&^H+bW_%v{P%ghTw7(ay877@zZX9UXk-#`NX&mhmAG_g>2YNQ-`ox{`< z7wax3q7GTQz%+W~n>yonSleD#XK;mseslW?8_CjgnbRB2Y?v+~D`8cv1n3=PGc~vp zvoHbWd5H4>>#?Bvk#@eE9_f9_D1H_Kj=|6<#@^6t+!b15y56zySy)VbZ2x{ZH#dmL z-C*n>ovIJQPHG!tRJwFC;*Nj&ssK)RJ{=`DnXFwkQN>QY^alf#kF?JalY11CCaR{S z)PJyNC5P$4z>wP4y&fbvQNfATUDLGKnJ--?^Q$1R%Z?^sE2>a`YfCORhjLIlN%B+K z!Axz`JW*kp_Z&D)qw4TyrtrSVPA!dr%?#{5J;(N#Lh|atGnTu2u1dGU_4M)%i55$; zGrG!b$+ZUC7Y!Qeh(1r57Bm#v>CEQw=;+kZ&1nA`>e(D%j4DRec$ngfzn|b8+r~MD zb~1}AlTk5TvCs~K)ppS_f=Yq7wDxUF43wbNPO-46o*@0ht-T1Imi#tOBsMG8=)FPW~3Xew@+T>vP#W)>~ayvyv z-2LA(&`d>Jau12C>N5OfIK6cD=4Bry8&hfoYB99IU4$CHl;B|PL;~VX6SEWR8bD~} zvAedIJ{oW8Ps@VlW~`IJ4mJ{#9;>mhQ6Xhv?NJsTk>VKqL&~egWKU4dLXy4BurvZ< z)3LI`oR&!N8Oj?HYF=HD_d%lRE2Ekmc^zJ6Go=b!Bw3tX<_xQ%D&{9O|}-w*(Dae3{-pa^C{xyR>VTWz3ZA^_=vxCWX+nDvb}AC zCHu^~DyUV&S2Cb_Myg*^Y0B!}+3c)uY&*y*e!yC-c02^S*~+fYg)ippWjk3q{iKM8 z9S0W^KRk?qR1eyMX7D(Sy>XdA-?%PLQUk9Ba;3Vf83uR$ekCUA(ej9zo+UOYh6>%DSfp(2880BM_jhWpO z;y2sE67HtUqSsP)bpV`i4DFJf;v6dK3|p__yT7W|)rpSNLRT66;<{~kAS!F;pL|Rs zT$f1Fqav%T8mT$^ef?_f1PI?2n7?sBW&vMnoy8-{)We%>oE?D!p$7u|hjv+@gEihH zmp)>^;b*m>4TAsX{Q}@BM_FEbGNFD|7hK4el;CSW+HZv$Udl`|BXXYn`YT$V7{i!z ze=;_Y#qwJBMQUud6p{BO8$tHlrXA)U9YpXM>zW}pnyf-V$G0RepOv^vnh2-+yhSw3 zW?391UZPMmp24t_yL29&TVNmmPBcT z@TQ#+clSum8CwL{FT98qX`suJF&7G{rl#k+?eU0#ZK}ek0UR()&d2+yb>Q}kaLCHtLmD>jR}a@^_W7`?+pFX6ZXgA)lEtY(i} zaq2V>2^5%L3G0b>J22nsPNfgq7K~9Z>kKo4>5$0fvr8YU)2=l;5iG901h;f-lslr? zbeFvmE@5*U7zwknv5Q4#fJsk;%+F@Y5ogOb_2s)uH41j%Zq;WhQ9~_69=)gW@E{O# zkJoe5$7yXCc|JwK>iXpIze0Za0VMo@P}7yM?P*-q-XQ9I-$YQ#`(x&y$AloU*Sp<1 z9-(-GCX4a_S`3mx8WL3m<7=#^+sW7&qsBC0#=$%@kq^{kNvHW_0x6}izW=IdN|#n1<8ItGvnZ)>*Hyn%gk`2f3i0#-q1|b&DxZa^zgA|GXG1#uyE~3Y zCi8t;tvzV(Xo{*=dF}O=H(iehCfoM&dMYU6ImBJ#-X9+-l{qGrIgHf}^QiHdRc3IN zZN{mCiuk=+V4i2NY&8rwp9}zQnz?U*B@V+tiJ z@gq2I7hhvzx-16Mv7lfK&@Oy`&}69M7yRg7UR&;G_-pHhetg^SSbCS8p$Z1zCZsyP zNlVIB87_Kg{ZP;-corn7MV+#9z($;a5w7Pfu{kmeDux9G+su(o;KlH2%u>h=@&1Yo z)t<2|{%{NN(mk+ev4rO?^7ThljJeQjmDo~2RZmGSS^B?JP4g6uD_FE7NPOp1-SSeo z3F9f`s>6h@AJf;N85|e1)+DSmQi4N4jov|%JG50;lNG}CNvi~UcgHhYMm%$u zxG>Qug~P_0zL(tI+n{BxBTOy92iqdYQa{~p#R6?^cf7afV7gmnd zcFA4&i*#hJE~&wz+>N`DAwna{<9qBeiv2ekf;+yLk7mlpzo zqT=&J#+1A*`-JLbV|Die6uaUHrdO(?s6lTAL4elppBI1*PuTYcDlk^?#tsku3CUrf z5***l?>hrc4qSM)n0)Jd)~>7YbZIlhQiP7Xt%Na3ZuNSv3{a26Gwg4)ZZ$g^NA= zmKta+fWj*)f3PPu;<#YmO#jUa{nVg<`&tR}BN7TJF_oOz)Gw(^e&t_KtGZ6*xH>js z%yQ#gJen3~TP1aNv9#{pmtEX;s>|gj7bXEsyEWrHF*$e6NdkO^=vW2xURWIk}OZihoT{%jhp6R07cS62=6s znllTSbKLl&@Jl(M-vIKsPG!`oX$c_q2Lo_nOfmtdqi?5r7H-vJNbkw_&}m=&9!Ta3 z@IKC;_#hF0^AvuXaSBzv5%JH4tTTg@`IkYu&{!(Q3Hu4>CAaU4qsp>}dOG(0OK`*s z%irEwE;1+!b9uDgz@W0!M4{axAHbfzw0GpUG2D%084Xr7xubT~5#*0;eQK4N@CO=W?031nxVKnD@4RCye9 z^U|BBaw(v0SE}ziI(wObo`}bH%75dJ>5Oft{XiZ6Z>9Y$`Txt8|5Mtx$1~mj{};-w zgNnN4cIwVh6rE6p=|nSHp&T+(NIE#%8XK+S?M~FBRYH>Fe5jmetW+8y#~EhC9A}f$ zu<*O4`~KYB-R|%0@%Z&ekCD8u*Xw$nuIu%DzTU)@QU^ph>&B19>5SnCz(=SLQx&P1 zrY=I%U)|yNqv`%lH-D~%W+i48p$xlYQ8bf?!#N~yHkVufA)4g4pXy6zE9i<0Z_{<-#L5F z!VtBI{ARVG3w;O0*!S8W%tOZbAx!{{f<8LndWnibr~A3*a9tmy@v0`f=0e66O`yUj zk0kalNQJth0LX;}T^R2#VKkzc-2+uqsFuoaG@fz5T z*y`WsmU3<#2!H8C5`VSL=lcbJd=E6vHj3cUkD*^YU|Uy3Q1ZpuOs0K6V4%Y+n7(I2 zEuf}*wjQ<=HKbTEj{Cok4Rw_EQw8iyg^-CEVgJ|w<4bt`#;hloigY+CIKZhE6g&E) zTv7C#?h^B2x#Rmq!~GTB81-%{igd4zJ@#-*kM8|95jtoa9jBsQx&yEVUAkZ@*9qJn zZpHoMv^?MTJI~JT6RFA}azMVDb1aHiL^jBkro05GhIW8|cxnI*T1`ceo{kK^yV+l+ z5)zhMGS+y)NsOIpoB3q=`2pu+MBppO_(eibB~#KtT&AV$tKc2OBR$m`YF}a=DcY)p z414JJtzw7t@LqRlaAV`*7z}){@@)9a(2KPKaWc(zcxuoq*t+&YwlUbZTZr}w;8#tL zPJ%YzzBT0wF^CPfWqt$2rhJgWfr^5J@v#UBV1q_#ARUL>tV4W4Ymstt4d8tu`b}eD z62%hh8*VOdlGr6P@odBaCO`f8h6*XPAiK9i@Q#o#sYdA|jEpfFI2<=ibt(Mkr*z-# zX6Y>sVk*#~zOC&)7CQelPEmk?ZUMg8`L@Kovp<|>wf}4Qejj|(-+vO zDcY}fTpADN#5S0zgtVr^UQuHGpUaN61yvg<+ci2JgB3!+@Txn7QyYm$wcQyfXzGuZ z0*9Lnwxq|s&!d!iptzgpMf{Kr`z`52`&Z z7N_a+UBUhLHT~VIu78WaVMU{;TYMnPJ=2#bW=n$dEc?>kXakyW_REH(!#6-C;s|#x4z}wnbZH%oH~~*zXi(`9q&45o6Q>pX(>4 z`k?^=D<`0JZqdJFx*uXL@sS8YIkIyiw*WXU9Y58V#0n1_KGbSw7547Vb`^?}(4U22 zWRN6`;Wi=^N6HJmll1q+#l5ML9`2Jg!~uu z4LQaSPB1cvZrljij2%qRZeTYr_mZWF0zw&qqHFSRNUo|%0sfU)3xPmyK;8rk2lHyK z)>j(~(`JfT`CU8vRH00d9m#Je-Wa_acC; zSg8gBqw;VZ?CVfzFE)BSLdh0%BGveyCz|7+cKZA+>wb`H4#{-g-JLqxP%SNmPu;X* zK}l8kD{y4p=##p(hA_0(hTKY}32wqRFI4TP9&Oz7u0*IK9L;>)R~da;K*9gG zq#*%E4((4F#oY?MOucTajXOr_>{@61GgNV=UX5lhmR`ioZ!)sujCf|ENo!RKyG{sm zr0~P6p?INF&DCu!$ZAe7zE9?^A7#da-Q?q$gVMwyyYDOP%q>n10L+1P39uh))Oo}4 zd22vUEY9X6?ws-0-_2AzTc;BZv7Vav*!s%_E1UbDRH0bHXpI@G3YR0!JV(B-N{NC$ zi3n>zO`f9b=`oKqyD_#ilaZJ<($iuMPwWl?d`G0=DQk4j^7|0!{(;Y91N|C;{3Ez6 z$%e)gcY?NLL9FQr%-AWjO;OFP1WS|U>~k)uPMqlt5oe|kU>=`i>yRAP`D*a`NWny8 z60%iTfK&A3-l=~`OFDP=tv#*;Rq$n4`mP@i-CTW|#b}uB1!HTpLsC3hj8MGtt~-aD z-EQoGKi4AI!-49-}?FWBV-LKtYWH&Zq zoFA-z6K_UWy{;yOoT-U17<8c}I>{&}S{B=O-C;j$(qK#FRGi^9a|7O2^*~xUB!O%A zp6xE@qOHxu*owOE7gn6+&SmV4@)!Ha-8~+ww#q5y6^OIJQd$PNy166woE&)f!OX^S zu6-h0mDB{GL|zNsby9^HibRu~pHjRDgZ;WVvlchWY%C~P2R_ZSt;*qlnIO2e<;MU8ViuX2K$Sd(1r{)>cy z;d)m}c9+ou#I0v-lvV>o%P7STb0nP`=Sezvwjyz{`)J);bD3xE?b{cU42ePNN5BM& zz0aJeCHDpyn>_s_jic9+&2K;O&Af0q!m>9R3%H+k26rKYgfH)U8ZHQ%PzvZN0+$r$ zdP4`-*Li^BNb>f-QEVp`HyTQ;i25NaKTWeDMuSFQ&diTsTNKDVC zqL}gi_{&hi70a;csZ<@*lV}9#ELxAK)4JJ8_@PEUi>@8QE{yrLlnhBCOflU9#_pOq zS1cOPpa%>eVn?{S?-h{V8iHAzIzsucUq^Zxn0@vFW{$u)v^t1BRx#yji?ozL5Io(; zRS__c;t*|?^mR6V+VY|YIKxQc)#yP6@kJ^eHRy8B;RY}xE=DD9tX60$#?Iv}8u{+F zV%}4csMZ1VQ!T~NBUc+vH|VWGVz>MPRnNdiLx(PC603RM`nfH435w4wHSzrzMxD|d zh}6)vmc`u9p96NS`D6tPfZpv(Fm<8uJCDYneD~&@`KZl15Wl(xqfeXGO|P72Rl~9j58gl%{2SG^t2G zU?pN)<69^AU&a0IA83Ul3a`S6eFmLgKwxU8a=cck;jlxGsy{opOBp)lInq>P%lq;Q zmS5KN%t`Mkata=TqpQMUQ@#81pm9OFl5td@h|0UDS576x&m(VJSQDmVgGMvBE1v7X zf$>1(5258U(FJA+!I=lcp__nW&JQ;=S&;)_h8Mk$$H4Ht%0|Mh!;hgDe%zFiYnxfl zJsVIjw@g|n3myhCC32fO{Q@2tW(Y<{Uj{q!y=(!AObXZ0Q_nt@g}eG{(CZJqfa&iP zyhd*Z(TY5E9uYl_uK@3eP%=qG_a6hD03CXe?=4Wh@^+2Q8|#0JQCTzLf=_k zm=3sz>dpsg@;u3c_a!IL-leQw)!$9hkU44Lq*tTyb2aa(occQRH{o2*@lTL0=KA6F zHDJUp3RCt19B2aQnz>#){CP61)vj4jb(=oXt3hxDa@pt(YXd8&uxp)qT%R-^jD>l# z9@C~KI|0dnyruV8kUEU9&<6U^j7e*pL@u;E0aG&Z`DUP0vP7|(F@K!0Iba%NYjSP} zW+o~q?aM1%+84VJ4;^^>3qmk{^39;k)DC$EZdJ94s}Lfo^XZe?5G&uTw;9Ir*I+K` zUcVe1P0OyHSp@NFe zIjjcQJvbola=;5R^GtG@V&22RhoXeLIBt<6!NO?vfgAmRenSsxMqa+kk2uq=YXgQK z^Qe?`IVpS#$=&Jimp4C@o_~Bfj&#l!kL%|2y*jf8TVMQI+Ds%qFHNmN*gR+va4c(Q zLlB>8t5HqA59+5dbxNYl1cc6;UKI-$Ol{9YhfD_$l!XjQ75pbP7@QlYt$m7BWDq(# z+6RrY{HexO8E#5?3c)eWh65LG;>MV0CZFf-J5GT4L)!{Mi>JGz`!&ckx#G4UKC3@H zFWSudhLi&(mZm|^j>|_)xaJwL)Uqh2$*ogGtSDs0o+w)0+a4-}m^m{u#eMM*E#no3 zym;07V)grSH7UHy_LnU6p<8OgzWa$0C^0lR$JffbeP;3pEcCw{Q1^e;=EM|G5^YcP zKh4$yYCl#oJ0oPNdZ?Z3NzE)y!Nwy{HCH58rMRmE+v&3lP-(6VV|eTxTTNo-;bkN< z@A8VVDDZcFQC$irRW8Tse2g~$i?}EC~Jx>gi3QkennPnd4T%Bf?#Gv+- z0<%u@9k;9Ep~(%h!Hw6J8}K zwt!zUn-M5r3HnDEp86m8tc?3p=4wOsNd<8NaA2@6GgBedtMR&JZgXC2jq|~=^2-(> z2}FJ*B zMR{tNTu0_MkG>Z21L$xabkTFCVtjHXUBbA}8QXYMZJD`mB?uKMJINb1=|rD*m%R)j z@+%IBJ+@RQp@gmiV;tO(d6fHMaEp4T3M&wuAJ9S`y>q~nz)gm1r3Q~RV><9<5&+tj zJ{3GsulA%o2;O#s1o=fh(l`KWT(0Ur_9_C5(33x&xj%fk;04`le5YXlQ2xL%WBv|X z53xAAn*~LX_=yUg5=Drl5MI{zw!+}hXS8HAEeYHZRAmL)+{j8BTdv3?dM!S%@5gBQ zT|)Wa)qyusG`XPeqv5(5UtZHF3!KJtmPJdby1}nbekoHK0K58x1Q|V)Q&pPRM(UnY zBe-f9Mbqv!6Ol^~$;5K+B{H-qU4T)6LQ#|+LyE(U_847oDe(#2jmCxURx$L8Xfz73 z%d2Rz^(2sO$pMpJiH7?G9^|X*jhpM$hdwNVOW!q%Gv7h_xS5ej;a{UHYm^^WCxk``d)#aypdLR%m>9y@YFQoAB zz9?3zG~tWG6}lX~Xd{>IRngK006pu}zjzS91%x3xSa=JObxzqUl>nAdYewpVY(Io8 zt@9b*By|N{fO^S2jIPy&2j}cZd!~&>mf_7w;cv5bguON=ysF(kGPL1v(lXp2IM%jn z*(bNQh>8qG08e<5OV~8xSlD&M62oFh6z8!(x(|q`ZD3$M%@FXg7nzQr@;kv9F;*iY zF~`1sGHN^_`-c0=Aa3F(=N3K8VKMgoPoo$rxMzm9-J26+=_}Bv(k~*@H_YU5TjZRMa57Smv>%rv(F9jZK5N)nJ7qa8snd#L)htoWFY$|r!NkQ6=?X@i z0;dh)@cJLzPsprdJ$Y4Vd=IaGQGDZ)XmCa5W?JZ;8f#3jG77FOg3Tr86-?N5L#X#_ zQ`TlHW%uHAa`381T3$Mo_K)u1e9GlU(7eIP^i|Txn4@o~!ue*bo1}3Nob(tHs_%Q( zbv+zRNiz`UJGO*W6+o8KUCag~ekGe|g!);3M!X3RBfnLHf4bw+hxmv@J}et6FM2(L!6@(~O>Bj3%)J&1MGs$o-aNcrH zRTr;95uGY3!S&|O5aoan~HM#y56Ml>nG$XnDU@+Ad)r}uo&+Syh zct{op1;-WOL1x~d>5Nqf!`wewkj@ggCZj}Axia5x#ljjUmdnHVG~3ur2A{@odZ*2! z<#{-Fiy8$OlnH49)I|OfB{38yoXtc-1LwGMOzJtF%!I$B@r9;#a7(WDTcyoHszh!9 zElg?ReMWxugbT=uTFrB}^7qz)yLu5A^Z0x`?SKAW+Cz!=*mi~J{A$Jkw*6e(^9oS4 zTzvVh$FUidZJ;*%qERFWaoV~ErvT_nbEBqzNJH~|DQzR7&prsFmRH{eSzDaI@U{n! zr-d&AjUI59o`C($?Jp$8e0KK7_b#nl&!Z(x;+hc^*5QM8pe=FWyS9YCWU-~iFCW20 z-D1(iy1!p}&imz|Wgo#nMETSUy*sCYqCWnP5&bu!+LA&E(DOJ!in9Bsmgcb`KtSpM zWwS>A$XH6dRN*?1w%5;VuLmw@c|R@r87wd6 zHRzB3s_!rnY6P^D~f_C9RrwmGQ|ep^~n z!f3U|*32)Up>^)9+CN65&!+%M^(-)DD*m_AUylL)z|;6J(enWHOq&QAP>uZ--V2h> z&eRzXVh3&)TE`dkIJX;qXSKisSU8=4dipC=g_bDSFEPBnpfpx3AyOHsz*hIc>M{)t z-5$_sFmmDe&N)QxufT|b3iKu($S$a+QeOtVmt0ky+H6Se0{*Dpwz6=}9nv7*+(GML zwElgiiSB~!%NFnpiNZ}H#r+x$6bCr?@hks-_VkwJ)5*X)fE)Fri&o0ABBAfJ_vF0? zAjhZ$wp3iimV+J&z4csNdJx{%syZY9wqtf7`x~47i;8 zZeN`Xy_;m_qFd&Nn}_GK(SLj|3q|Y$&BJsC_Y=4cT>tan+)p4x{*(-c>|GtpDx#eN zL15ukrHD#XXcw7nJ2_`-0bQvT6;Y?1w|%?QRRit?Qbm+^jpPDM15l#3Yy*hA?w-DV zuN=MWl_oMWGg2r}dD=G~8gc9=MJ1(U?yHn-qJ*8@-IW1^6~pC>oj$9h{%WTFL*^fL z>-O3qfOTCtN@6AHDymQ}X~%zlZ&W@sUOD*k_2@U^yYuBskXv!Fu?#X zaYk45qm~x^FG>@;jv56xUILu9C99==1eJVmQh&-uGg}{UEfQ^m<~9Q8c~{qYI~-O7)8yj}P06T< zwSS-+YQ+kLZ80qbex*X5(CO?AYF2RHwfu_!P_;N}UKY@wtNl{~#pi%mht`bWJ7AkX zVGxqZx`xCYOp(<({#)6RZ;DN$(dqC2-#`c33qb-Sd%zVO=XrKpVng4slpC}+z=O=n%(OlD zPZ6z=v8<|~B_YxQcjPV}z{_dv2GgSFSjIo9eje4qMZk4S*G~zURTU1fzUT7mDmRcr zI+T-6%$~DaYw!&R=DdXG$}kdCXQ*9@q`C8Dz>tF<+-bfqZ_A1zpZ3F-laql2`+=5( zuBDBk_#LJ)Qy0HgIJafJLxS_C9R{u%!P_E7xLOl_Nj&Y4)~ro-^E$hQp8@XPkfJ>C$3!T7XG-+#y$zoH+bv_QU zzV+FYxB80ms0vTql$7qh3QjkpTErX>EgAC~=wkUPnFVE5aXAqh{^QMhpQ93$X`dbg zWZ^5Fvcx66{VraT7tn#0%!`H20C4j;0rN=4MCi%+J-|0ya`R(;S&k}nbg(QMVBDtj zk!gRudg9;v=ip6Lb_7tlq;9G}(7mR2>6zscs>E^@dpPbj;a|W0Nd%g~ZX{^u9YHRRZGXwa% z>)Lji78UQxK8Jf=-?o4AmVu4CHy+V^%!dtTa&kH!UENDy^dEI^D?h4Zt-%oK0yP98 z$L0H1zr#-d>n^m@L{!#YvZ?`&YfqY=zNUSqW=ZRSb4unA zS`vm*9JF3?yg=au+@yBNz_qgl6LzgNm8+dj+BF{ZKJeJanJHjv)|lHCoq?gUmNtlF zjqwHp@Wg&bEl9gPB0l`@S@-bqn;*!Wv%loTq8e7!Fes19(%)1TEJAq`7Hdg{6i!Y8FW`wEqHoyWl&%=?+Mqxbp;G0ZaMpndF6o#4Ond)#df+_}(b3hlpN9YbWYEE>>wZPr zC#llTjk2ZoOXv=!B`%*`|1}rISmq11#NQ*Jt0CC;yh^ z+D#;mgR*7Cz7gw}adXa>mT>s#l~;zG=PrA+w{GKTpZWYakcsxWtDg}`C@>J28B7A+Q& z`02+F)?z(g?G?{2FTG~*penoSH%IULb*aB>M>>bjq!%h6q*p&2+?yiz;Vg+JMl9^% zS5Z&ul-;uFCw**%KKf;XH&po|V4mOlx9515ij8@-BV0`NVhbTVu}8c2J$M8@*k)`! z;wx9XJAYjH_r{9rJ2#KnojxB>>ijcF;@+|_qvw;ddLLP@c0k!rwdo%(kkk}b?$|Wx%NMw`dB0x0`Sb`AAOAtj7savw{sJhq<)Z@He5=7b_pSUd!^T^BQH$m zo>y-e63wfk#(RCR@%!50koUZihP~-|J^e>@{Y@~SQsN2iBeP43lf|FyRqeDQyLM}r zJ8p`!1|P~_Eivc4$vWw6mr2c|4!D(0ZXb(c&Sv#t1HTC0-3Y$+$XU~GJN)tS$Gpi3 zE_Y)9{IqA}7Ur25yVD7!25dfjB|hi~{^0z(_T4hL>zcp zz1EQ@#zoVmg&3U|-R`CGB86k4)nua|O;A{xyl4~V2w9(dF#h~Fj(w(EkFKUrr9yFy zyv0D-hyx%D^ScMktAh615{)6^=wI}n+z;Hc6BBj)mgA_Q)#dqWY1}=<4J~QAFD)(JVE$j5 zYT|6}JgYEKo9}(>bOYGcqt8k=e$%!CQD&@TP^Ixz&;wnVLREYHi=EmX=cqROgwvBOD6dwm+f$|?OR=OE$2*s_D8#d zT$B12o_`8AIMRY_8dcHmM&Wz&;w16+_t+OBw@TG7`-qzvZdJoF9CtudA=p&iiI-iA znB5;1?;2VH|F6d{7PA%;vT6Fdsl5XKL#|eH8>+dQ^AUj}J!pZvsBttL<9?*QTkiS< zl6Bc6whY&|GDz#TzTG}?w75SR@-MFbzdgm;Scaw8E?Oj>1wXLY#(7$QsB!>NFuF7c z;j8Mkt8mxZ&n|!sCX$=eEauW*z_KnFkNv$-%h*JH)Rw8d1vskNokJoi!;G-Fw(A9y z)0Nz`!V~GQlT0N)(HQMc6v%wB=6?$SAMz7KB9g0arusIN>h)*Yjjh09vwM3ak`X)n zqFwbK-b{*(k=*@->wWxT3YO*Qu1GRMBFd8`&=6sSmGh*u8j5^sjDt|6#Nx5uJ`OIP$qY; zRM1t(S0?Rude!Z@tB*~;?pJ43UBwg^YOO%-PJ1B*cg`@0EeS&!>5zA==uWomF1OrK z_VJx4xc&TeX|dRr{ZjMBhQC4g0CatB2AROrH34vkxvv@XP z&tz>(@Bmby7PnpB_TZMjv=2*dS+u=6KTmJ?7WSEEv|~jPM!4I}x!3~eM+=x;*PaRk zk$LK~NY^PWE+2i7%=g+=7XF}wcjLjzZejgOYjN~`JX!s}JR#4<`32J-;3;{*_~}An z2R-t_NEyO{f} wAlyJ(1z9I=)}IF&(1o3_U_RidQf3!9Rpraijwx(e1pdGe9zKw<&-wEI17x>?tN;K2 literal 0 HcmV?d00001 diff --git a/docs/images/platform/pki/ca-create-root.png b/docs/images/platform/pki/ca-create-root.png new file mode 100644 index 0000000000000000000000000000000000000000..3c954b833dc05db60b95799b61c2e172bdc05f1f GIT binary patch literal 425806 zcmbSz1z3~q|L;Jigb0d&hyo@`DN>$qA!llz`IRFuGwQ zwgF>s9(;fCUgv+V^K#CvYum&2#O`l=KA-RRz8~JJDl1S^UZn(qK-ABk%Bq7v6c`Zb ztUmc!;FDyPo=gyk5^gOcqxwunhE3JQ(Zbr!90Yp$J}Ty%s>TXKz_G8RPa60p+nwFJ zPuT;$(&~f2D{LG$C}^L*yH7q6)l6?lb@QgKwi~@{gZxD?1}?79TE~xaQbvqaLYhKr+jz1I)3jj&L3t^R33L!f>cW@Uph17pOq?mdiVYLZL^>3w;y7Npfk$>=dXZf zw!gj9mX*CCW!`vXBryT*`Ce--7Qco%K8B}vF+TMMNnN~`jmfOB`x=>ckjx(a3nXQu zTKD@&oYz+|)uFGc)am(G7D}A`B-`$reYo+VSyrJ~ZRkvZ)Qrm=Ymh3Jn&hpRn74~* zWEpn6vs7~TmeSUfl9HMfD#7N80`ecWt^6$7Alu)F+?Jsa*<%v2=C|}(-c0j;4MkM! zA1}@Ap*|7Opi&7CPs;r7JC$=19m_Nf z9|Jgg$VBTwu^>egs%wFq7&0Uq=uLnVE%l}P$Mt7c*qEQzKlyPbA0(GbW(P`;zB5AM z5p>mw_8Lj&^zBFIcmi#w&sLmaAptLgc^laFKyPo5H_B+fJG&zF_9N4)Ga^r3{9>jI zXiR;2kL3B=KDLXuLl|W8QZIeKocqQ@y0pi1`H|a&DpGf8np6iXkPj6s@M0{fZR5cY zk;m698o3@_j(EG&XpJGQ0P(yTZlHG(gn}GicQ*`Ai~S(=qoBC~x^c_xCwY-vEIBiU z!lh4|vah-1LO;2DyPBh*|H)&XAzjM&M#_Un=c$|OM_xXD&=7m&JPiVbxQt-Xc%RcC zV9I0SU|RJcC>E{Dp-p2Ogspe^u{9#F{>1KL*|loM@prZFYJ)bK{px3&+!DcE)Qle# z>&>SbW`<_V=B_$fIvZ86Owh7K4mXTX*J5V8c#PljHaa%5)~7U}e&S~(Fa9Evd421~ z$B$2GFKS${r*qvPw}7Hv+gf>onyZ#7qfYPN`J=m zjs6>@y7eo^t!fwz-S&KEGVhOC?i{&-Yx~MB60V^xDp} ziE%{PC}T74s+$kE59qIYuWGEa)5nJp7Xj8eW zHn^4xA9!c8Xk#Z>IHq38Q95UXA9y=py?SAFW_5Jcb`YNjQ9}>c+s4|GSz!bz1wCvN zhnLfC2+&xXNtcQe@;+L@LZ`tNn+{C((RJm5@qZA%jA=Z zU1^rR!~Kyx=)Sray(x|HH)D$}o)f<&Xh_(o4B`eEtQc*Dtx&y3=}kQpJ--J=zxU_w z$TDWw7Kj;mrfpuB46A}?0b@&SOVEFe{WTEc^CP*`_}kRY+DV`5J~9Vq52O!X5(^HN zun?vmYAE%?^KIvqna^M8J6}s3{MP)f<#`BS$rUbnhK$$Ffe);{SzflgEj(sEU@c&0 zXL`-7rmv!5?>)uuH`bqR)Ghif9$ML0iT1k{StqT?@TW8Nb4}WX=~a&^xKiyr+8JEz zTqH7#F1kBRns>$D&$k zSYTZMZ=G&E*uOcdZl_mPS>|3g>ETw*R~_Zi=>gA9P*zDqI{OfI(KsHQ9?o~2RmAGi zn@9O>R_7xfp-J@czm2oLdJHdDk6#b2=~JU-ej!FKFUphqQ}UcNPHNoEo^ zZZS558yQnNzV$4|cTZ8W-eN6ODedNm&_R%BW0XWRJ!g=60Cucix&x%TmSmzGsp3hz0>Yt1G2~q4( zqP<&kdzQ|O4uAJTCq*p6TiNlmqPkk&WF>>^&Z2Q#wivJNRL*|xPUTMIU9&H9pYiPe z3vXTXDrN2`ezm_J^jOG|3VjC^18HHU^`dwVhUFONWabd9jja><&i29j+WR3Cqm9pJ z5>y!5ti(#bs|`QJn9jhu%(I5afKy`B3Mus?X1Sr464qt6j>l%E-gJzJFsm zr0QnW&1b!}gUNZGNALF4_RN;9W(yh&LwOe&A>2j0_j&iLqRVlsDiMre zhOuHo(?airCMK5=MOm7)C8;Hr{T)h5<{ye@i}49dj!5-QL!>K}br>`({bqi;dEUwp zwLzVBmd;epcAm{hR=Is=S>*WsxZ@^fQmszI-|}}CuOyW}vX0YAN2Ao+ecxeXb7Ha^ z|8vv&ICx)i!+5gxj&I!t-G;`1?2zGi_q>8hc)369x*T853D$K!o>V!P1JcNuqtEXI=i1N0>9}4@0VGhaF z3;t_;_FWsco)(iURm`sVquOu2p@c&Mk*1iX#yghawAZ`cI?~##GLZaLa?n?wm@w!_ zO{vqI<8ZtgVX4;5g2nh4AMp^0wvIEdt2^5gO~^67)}t?H0?!B=cX;;_)DKPD8OqzKZD+uy7N9nF5}s&0TCKQN@By+yp~$;2&SUsIz-a7r|hfPRlWhwF-Lb zZ9&=nHVu;I(3oRI)NzSa9M%yBDd(hqVE_wc1{7?lx$ZLyB_$9CuuTpkBe@C!16w4( zQ-Xx~Kil#o_dsX!=DS%|93%Kz(d;4kr;R&H)iqP)DG zo}N6O{5*~>mb?!{L_~P`9`ZhX$PMhl?dt8|X6nW5;Ckz?ll=QUvgWR4F4j(N){YKr zC+9VN>FDkze)HzZh5qyS>vx)aS^xJ+4zB+i7BE2GlW%w*@bK~e=iI=dk54`oRkijq zx6_lgwg+qmTtni4&_kiee-8K`U;X!ze>+t7zlS~)6cG6Pp?~}8e?L^q)!aqK(H^*{ zo5X(|_OFBg{^h?8e9U_?_P^QUFGK(N6tJ`emc^!8*~L)i;FM8cQ_ zydb7@EggxvxE^UOSQC-QTI%zBhW8p)ziMN1g`$DSp36i{}@CnkDPYeHi}(PaVclyBNBPAGVb)drvn?Ok~^cL zrdY2U`IaH@Ecr5QuwZ}}uGRA+^<_$(VPL~^12C0)Qs)OyN-_=iKU)^K*4ImbNuGcI z9l@EEZk+>B$}5_s>eJ#cmhZ5k_o8xG1@w2P{Vv$*q7<7->Ry-@t<}yQ&Y(<7SN-P6 zvBS01$Z^{>^rf1?qoCKe&k9H#-rG-ouzV5&LcQ<`g`WE-8=tu0>Mf}N_=7G4j)(Gq zoDB$|sPd{O?mGi2qa3PNUc?5ZB{OrAVlO`3Pga&AZvv&02CtC5-EWWqQQZaLL}Xz$$sMnpy%lC8rgA^-LL^(cwLJJM8~yVg0X z*YDRwQIN$$1QN>V#>)rhz~wpX9l(w2L2O_LveLRalqhXb(`m}kKZ{}`et=6g;- zJI#4#V7`^!tXE(VZk|`vqbjufhQ z1uA>0i=_je3*GLh2?}jkPWTg~+f>uRL>u{J{V#oIDa-Qx1e+|VV>B962-X*+Or8UQ zs!bc)4j;${C9!gUpU6hCY6n)R+h6`l<)8K{`GudP>#H%zi_-}>h5FNkD6JI}FkJ4P z?-on4^sIg5Dyz2s3-*hY+|;>aF!R#f9>y0RfjFh(CJn#%tESGp7B2l#=eJ~?zz@=3 zzhdh%Z}&-L2~%WyS9f+RsZNuY{L%p+NSI{v>MWyPQB<;R%EUyT^j#w%aji(RTX<9fpI-motJw)PcEx^QOsWli|{jg8>2d2{? zEuRr!=PX6P=qa788!#BQzr0EvTRz~=qCL=-SCP4_wxx}@Wpa-~pKSG3Dqbri4`Q5W zk~X#U18(e1A_J!SqTiYSIp78f@@Y8DKce~x&Z#~DhDnjCEt!Ai15!a9Lg+8KTFpaG zaEbno^?c6X;PmqOo^@3)vE!n|4L(Ki?(3DcJXREkRLsaCm)aTxBKbmHRhdBlwH<9+ zXQAB_dEvz|5LW%i=VM7uW95RIK%QzP4{#-Azmz#RSj~3Sic{II-Mt0AHBWXvXC!+` zHcSdewu`iJ!?xSf3us>2^A7!sPyT-(Hj=X}-TE%JR1yGLtzXK-A4>e`@@W2L4`GUY_&vGNFHG`v^8vJ@G+nimYe@C(Ee`D zonF=Msjym|hkev7HB*)UjXL;{jsNl9i`Kzz2MUb2Er#h-*b{n!Jz4xz5mAg`YS*%A zwCzkuxF@B32USLg_*Jv-_uUMr{~9o*5%`_83>+xJ$fH((x-804ip?L%zAq%L7yzeW zA=Nkq7fYqek&$Cce+9jaPYalp*;bW=<#A39P$sX2NZ+PnS$V3*O(G+HRiErCTPj|o zT>V4=G~RQHy=n6OIds%s$5VwbZDz()>BH$TmG&Jy!2RugqGI$Ky&wJ#s^f|E39S4J zd?LfvHl`F(*b`p#QIq{dXrw0_JKVQF@*jirERszfuC0Z%Unp+IW`8d3^4No?PJ4z&1ErFzu32sn06|~*s0FvNdcZb+_AP3_P21~AT)|qIJz%5=$ zK2Z+fsY9a;7cdRj15!ZgePmZX1ap#iG;6Q-+pco%XOa)xzsCq(-VKunXg?tha41tU zsq3i*D0t$~7T5SvgeLSU=oxGSUejrqmia`h8h-e1n7MlEqql#%KP2j~zpp;ty6PnN zY`C39CMW66i#~pw-*7r(f&z5`_%7lqsMc_1fStkSSqnzL~WO#MppVsza}_ye7a@eOi?uh**yXLCVgi zoGwOUff#uyikOal$#;;uI$SvTbl>wAdaZ`i0KCdk!}Yy`5u&b2mmvoVT$Z~ix5Ze% z#(AM{tFLMlWn0$q# z@z$kmE0dkySCdPPAobyOr^5D^nu65KGO4cUnhM$EpP|o=U&X`W~r{wfw+Sq*gt5#WU@?Hq(qoQ=tpYq~y2BFZ=gC*B(&R|2%}^ z_G%|$^lh~5z1R>C;!h#d#m<@pN@(YyTP(2aKh+r^(#|`;_$rfI^Ao}W$ISvJEpYkv zEx?qUJ-_HL1ze0TXZr&ysix|Asc8{QN{^N=O^0civYzJrKzsp1(}f5kOZ~3`vaLU$i~BS&W2JVYV-BV*)=B^!gVzCIG~g5IySPu6ANPGK)+c@I zBLK)mDJgWGL#Cg1!Rz4AyV(?17SCNMKn+gPy|D7~(mjc%Q<1|v^PrQZxZSpJIIf!e{=&3Ly95{}rTFn(G?D$mzRetFM&) z2nS}V3_!26oLh#POK5Fs1WQO7Vh9a18El4?1sr>F1z8M7jcV{TZW82M7gzq%z_q?U zpqLaTCGNsUKHeTsLEY6^4;wo8@cGGea(ZiuE33UdH+w)Nwfj|32P;0GAHUF@?bkn_n6LvQN(lE~a+yx4Z90&9?jspc=0z~d}Q0HzFP)zvdLfW;> zhD%>U1nIhxQhlBunjb))oM!`mX#h;u`ITKnu`c9aGSfYC+ZSLSts>rqg|5Q>=(;ynevqZ!n|!w5-E<16 z6I!RH;=t{<(_i7r-dNqFxXTBy-TR)Kr|BJlNQ;0GzSOhmQf}7X4IlV>NeG^PJp+BI zMEu%BPyO?xB<#>9snsPtDbuF8i?o8pB@I6cW1GHG*5`aq?mF>d>D>!I)B{y$-k(l6 z{Z)tNnRO!W6dy2R|J@(}PpKQTeBJKToMq3? z0OTEQ4PV@^_~>{o=CfnFH-iJU!3J~sc_qWWqfDBUd3QFy!CQnMNNnDProx$oIWU5A z8m7vp`4s}$fKXY4@*q64+g5<^26`{guoXaq=MvvQM!Fo^rSCdUyj2YY=fL}S*|~qk zP%uPOUXyRtQtPfe8l~TTJv>IEqnszQ;+3GpuP0H{$H!jrG@COsWxC$s(Rftj5Wur1XC?%-opQ1Ah1Co;P57H!-0jf#>*~5 z*D)g<9pBg+ITl{5*O-_S+*DFtR5dg_@I-fgXJ$#}@|A7Ya|`@a2q34m1aB=x#?lA$ zE7^+Fw0r}kpX^|%46cA#k+Uyo=vWdf3FvY;U-Q~ zLI!Hn0qw^Sc8i8uEnDBo**lZ&S8APpiIpo%VmX`W!TXd7)?MPEG}az~7VG@*HMh~Y z>uU917L1g-GG*I=u5!_8ZIPdx{{~LrM|)o3>DUM%kxd$8&_uUuPV5kfE6((|&<(t| z{IC)j>B36CbmJ5t%C`oj&ETGb$x5+9`BtV#IIrwN&|SuEN#}Bhh@oBP`acasO}(Nt=#s2@a^~7iXi#8)BB!|M{z2G z1tT#`LWQca&)+nc`%uPL8~`duEw!Mw)7?{VL7dQF+pid}gwyEv7zYR?d71AXXCqX4v(cX%JP$xrDgWo^0M7~ z$HxyIY__zv9vZ@$A0JERB{FFZ>;T9r!uu%RP>t8ClW6W-@KysXA#Xu)0j7ArT|zqLg8!oVj) zr1QhgVU6uWczD(O_wU~-#eyJB-zzVkMkI0beq^53Finp>)(9E?+P;G>7+)JlS*}N4iW|2nPNhs ztDZVIWLCk5Wjocl(BsF~N)9PbCGTmUUiw9ixsx;)Ky+Q|!nR*{tF``?g{HEX&8|0q zS;sp}%hqQy-W{eDp`OwXH@@mI3>W7V^)h#k-k#;HGHuryNud0J!{H7xAEs1)`g9RS zuTN%?6W}NF22w|#hhAwAET&|o-}|O~x~eggEdFM_o&5qthTj<`#criGnq(|*snMUyd-b66IkBWr93=y{9{#{ zj_yctz{GbZm~kTF`gqW%&8ga@t|T$W@OWl+4qnyoji0ydEo8-z&U0tWUp9wM`{}@q z-DBW}TPbt!50j8NN?#(3xY^7IaU&98h1uEc3DFm{J>1G*UHp9$YY+Sac*hoK*i#RX_L?JaE#$(@9V-CUWkXV<5VtogNY`PG_VZk zF+54H{fzt3$W5_zIQN$?8q#J9d#ik&9GF3ps2iu^*fdhp02S%8r3c0PK-Wl(nQ;n{ zR&ZdP$CXxnya6_?&!hbEerstn14X6|bXju8MDz01KU}*m9*fbEP=IN5G=$JhA}q@; zJ1iuCG4jdcd54XZ@KjPrut{RXDfpx~TW|R|M@HX3|oI zA11b*o+^4x`s9w2V}j;Md0+hYW?X1{)>c-WZHK;II1Z19s9cjgn!oFkyJB53Tfm(` zIIQH(u#FPXQghA4q8+o+lO+q0wL?BhiY2(Cb{j9RioI8lPE!$qND;=VGbG5k%TtJy zWScY4TitgjW+I!OJ2H$hv#@yLHzW2kt;Z+E(cGRJ*CnXco3-r&R2~Q^NfXbUqp9#n zv5MOzVa$7%$%pbp`J)|BRY`j4eGn^@)UbKEE6l`xs%9Vg*{~YogI81a?j;p$=D>`K zS65ZNUilCaewKu}x{2z{&g6vm&cyU|Dzneyd4;&De$CXvVI3MorgMQ!5_dQ=SMN3c zB3v16VvF5A(P?crs##Q2^tG=A@77@>)tMvTj-4I#l?;|Izy|$ zmIxMc2F*K)SARdz^2H-(xOQJ9bgqmPb-O4FbM7R?COXZT&Ge;BPEI;(&B{raHl#RA zIDMh3+$lwiOp6l;OMA~PyC-Chq4YP;Q;%hzrwj@f5zgi}BU@iWBKV=`=dk;P$`U>s z+|Yu5*1Ba^nZXghNp?zXd;a&A=@?m$0CY>Ifd;x9@_Fd^TKATzR-RN&+m|m#lQq!& z=d_3INS&PSxj8fM_T}iR^zAv#>AZ;#oTr+TE&#BMSMt|w>J6Q`Hjk`e{D+J&5GqPh zX0s6=6u6!&%s{9gsDLO7=ckvs4u?7XE=J}K%0asCM4Ebs3SQUI~IpL%CuM55TjQ4&!C^4G;3}d9DtuEI+Px z`2D$A`uK2vrz?8fsQA@0TKWEG41Qw1I78KNhs~Nwhw-5TwO`zX#QtoR>X4vF7t*)P z!VYen+FUfs)zJOoYM+gGNr$Ma#PJyVXu>?kw7lKll4?`Wkiw*v5Grm7N}c=#p&05*JH}c?)Z43{RE2-=f5?Y`2xowOMHkjv@F$&8A&YNvkEFu{)Z;w8}J2*I1a%cK(jA1L%F5!bsht&KH{R27c zs5x=g%kz{lBaK1IoO*Un{nOO^fCRGA1ta6GOz{r@8K)pwxo}2v&hNJz>-07~{%#BV zWGm|gdGc_2bFIU$E!CG~BRzs5c<(ZAzsV}2ExyJgYPONmfL$fYg@*O98v$QOubGW- zj<_bW+5&s0Ty!Pe-rgSqAD@eP-$_$zo?@0JuCD1jH2552Y&Cb}dt#VP>826R_D5yc(6zq!*EX*?b@adA(|E8o|64b8@5NfR5BVMK zGgcK$a!j}x86OYoK(Nv+-VMf7f__A-uxQi$`t0jMmQ-Bv)!cGEgXb=DPvH9$<5@bY#N4aU!fr%&$%lQL* zk4_$!D}uu(1KE~cYho%VUaR{6c1&odw383CIKHtQW0g~{v)D8(aHE_R|RB~X=u>qz2(AI5tp znxx#vzQXWTyrb3{2vy~7JGnYIqaMp(Ear-{qg`9U)9>d$OtHtEkAUI4e@Idy_lO3@ zQ`fjWZI^U0n*bqKXE&Lu_TuzDv_xB#)@PT!q~BXl)IhdP5ea4UPG0PJ=f8W8Y;A2( z-~l;aQRJN0WBx30Nm|umZHU`rBs@I4I-@mWb$gEzs#?1?st310fnR^BMVYy@-Oza z9i4v;=Qi_FzAwXeerPQ0qeGs1K(|Ga^W0muHwU{bKL}f`DIBpQu5}$HG#I7YVR}Pd zTn>;z388eBu>r)w*nSlHEG*VA3X;9XIR=5Bg+>_@2mxvAGbmf7VZ#dEf2=H3U$C9W z-2e4)fPp#f=L0IVo>#`j1aRvn0i$uNyo3a~oJN!UE}bgt+ICrDdBW>6n}#=2)1p<{vVG{@jYJ z?;*8=(MSjm@yP(tER*Bi6T<9`KW18D7OUNv8}FzJ;t|;_6)Aq_&p0tmBiJDE1)2fy z&wHU-gQE!c{9?=YK7Ca#!a*VbdjWk8X=)9U`#^&Bipn7hem`HRY-_f}wB zl9)#on5xl#%Q&ADrDc#ie6C?Tq)0>`(_Ti$u3XW|@NhsNYmDevOV7RFyZo`U+0jpQ z##5KYjTeHv#`S>N?J%X76C>9?w>qt9OF~D*F{aIRUfA7dU__7-vw#v7y+6~GE*CaY zW^W4OWv^fA)&WZxh~hCbDrO2JHQoq__M`J3^{>nVR9Lj6SFycOP9xu%OMw|>%X|Xe zpAoNK9LVV(`XTs&4Qd+ypuXH?f%3R(cOQg`rCBj9csf6dc(KqO%EPtuiUSixLGP+x z2YEa3q$iA#H{!_WqN{!bPae)f@%}NUDKquJpn+ojdqO~PwP#%wrw5c^+uh2_>T-)- zQ(@|dU#&s4hte)9)z1s-p8EID!*%=i4KtpHknG|ZM7Ko4(N)jSbrG+={PXgic&XG) z5($F~?uGDF4Rpa^bdUH-%&*#wn6}c5aA8J5y`F;gb6(i=iu1;Sw?qHpehxXH zUO1TC+M~H8G>h(4%qP=4H?DBHvE*VPiXP1IfA4tQcLb2EY-_>I2(2N6(oEg5$y7+G z?QoT#ZKJtQnAWtI|IzE}nHb;BNRqKjRb^ib?aLDL!7JO_z72+U%4OFN=AC-R9tG3y z~EHU&$}7_7(TvVCs}%&8N>C6>Fou3kzU?9F2g6o9g)|z6v3@_qk*mbmR)Hv7@hIUT@bhof9qQpO<%b{6mR9M+Q$kO=K0P7AZOKnOJ*&m` zHeH5?jB$5*-w&SMyR3pBp?Rg%6Xu{g-?Y+inHb#5#bTy7x-n6C>yfXQ*9dHDK}XF_ zUgph%_$7y}^k%Q^bPw5ku|h&RB9H2<4<{-=4yF+c~j4r`~c9l#R5q z10!>05S$qBj9~Sz!uBz)09x=~GLRNa67@PQ7Bj!@C^DS0)K;(T<{7CaXbC%V+!lNE zXcn&k&ys2(vjv@8~_?8dO_j8qPO!xV&@N{O z!+bcaT9gZg>a&@7b`@_pj%(NChIeTZmU}bqy%_qW71tFl`XcwN<#3@v`A~tekueyV zfFy++;q+gCC6Y3v(!uhYfxPGEf+cZ4+7v2?q`-Vp?||Z5u*^J~{DK0{_j*RMz1^G5 zB^rT^3+>TjdEYDzN+#?(R-{e%9P7Ymu||cEIu@=QOy}pjeU~=MgCd(rp$Wou^D#Zt zF%m$J^DV;U)r5BErK-_6da7l5v1swLDa@QbgOeL${kPv`XX&khQn)*jm}YRpGQcLw z`IL~#@%f!+!VKI?IVkdlQZPMmOVZkoq6XYN>m|_BZS%d#%cD!nB~q9<*j}Amj9AC# zaCW@Ao1^6uT^=4dcoQh>vB6Unk_j)LCpm%E1Z@(S#lcird@12zvI@Ep*x?p4= zTKSoqryhThEZ%kGmpS6GxGv(k5wA6Du6XIk@$$=^0o0eDNjtxe&ple|f-!o&gZ)!~ z?c5x8*Gli?V&Ul zI#Q!ako!AJa`a^_uq%6gG%@XQPu#kG&dX{C@QxYv(*U{DS?M=f6?(=XQ$a~$E^m%~ zB1tUMKl^SZA0px~nP!rnN;w(pPhABx{PZAI1G)^0k}kWty+u47)iGP|OlA;Kl0Hv6R zH0Eo)Z|`GGwgwRV3{)kgWwKYr5gb5eyzUIIExO0lFB#Sp;&8CQ!v5NIia6>5Our^W z{W?CWlOSUiDLwSQcSLtY-MXdjVpf#+1Nyxz7hg4! z>TOPpUQ{xsd8FLaQ5lTHX#KuknM#@xJk$8X_)$dg(QfiWDZI8!OxIy7WjX(O8hB+L z@|iKwk$tbTk&%I8;B%StOtlLs)WV@#XMD06KM}`oIY2!YNWyw~_eR%xK|ClWoQ`p} zoh1chT-LJdSC;artIKI+UVuMGsD5~Gl3tT4p}H_Toy#Y)pBn+)#LbB~#Zz&E>++AQW)> zp3dOJqjBCkQDZl24}$F|um9Fgg`z7?Pq4W)G9;0k-_c+4WfW04sq2s!m}KWK4nH5qKi;5#~sBo%{6tS z)d)i9QyG=y`JYz#KF0q3Ew_RGdySo~bU?SxbURan&a|(+N{N7pZeVxxaAN$5Wp2b=1o)hmJ0GlD#B5q|cUtJT`ffVFUM5h%2_J@+yG**1OL zEe5+XR2aivv1$%c?YG4Zq)dp!mX=;S#HI4{mchyd(2`mAMZ@OY@v~vUio?dcro?aN zqYHwLn}(K(4UFSw&z+lGIzo$c{nW8RdmR86qW14-p%9ge*~)bcuy}5Gm{Dk%w%RJChUz|o^q3hu%k#u7gD}*he;O{ z>=?G`yH>X>=2&{E=d4xaTqn&2!;#8h? ziNvtMy#j78W)9%Sh2;W+>bn(~b9M6t;G)^G&18piA@mYtX*6=I0-lK9+cLvr8cb%d zh)Ncg;@t;AydEY@DQu_#%M^1?cynHFMBiP2i2a7KnqeWVHI2HWM5vq=9BYp(T{fyp z9k97t$S1EXk7h=W&PW>fJ)9|G?C41yQ4jx{&3w0Yy%LkFBg3~Uov7JkL0gg>? zvG2)n_{*%&J+)cq3;$F!N|}@P1M9~$5-DyViH?N&FLxT-Mp!18om=Z_m=i0#p22<1 z@r@4)T{dGOF8KElpW!m1Bd;rrXs&&Io9XMVl*zg!BagWW4Ys)5})Gi`f> zb2Aze+RfchOv?bN^p@(iJ-ya6mAp%!Ob$k05I|{%xuJv9etp(?PEW-1SBzbdcjC1Z zl+Y?KpyKg+KPx9PBPC|hJ(EZSv>}K#mytPgV2R0LeQ|^fDeLI)R^2V z1OD7Yo-(&WEvG!ZJQ(RU!_DjH0kjdqBxB2mbKfUpwB$lUh-maBgAf|4jdA?j1WA9t z_xw#w3Xv?XLEeMU+pC<;CTT{3Ao|IrwnG)%$SQ|E3&}GfSxPpw$DZ#hMNrXA)|FBWRiDXK^A$45^+k@eDzOylTkNpn4 zFqH!-`RQGYoxI>|J(ERXY9?KAu{&ky*qj*s{d2+vT{%Xo1HGv7jq&nx)o7Iev~r3> zfyP9;1Ss7Jg-4}$3d0se+Epyhk>hL1#3+M+`2a?w%jDB8XR+f>VU%0h`2u@s+RpMa z|G5@whvrcFvT-ATlZ~qVCjBYVKOE6hR$Wzh@m=;3(*v6q)={j6j%jD8Xcy0&r@EVX z42B+q>+A|T<T4uN_k>!jJ-?vn!F%~WQ@t6@oEU4bysuX6hGVSSwN6%6zm{$) zjZEP7IRYjdmh{iLiJ}D%BIa!2qF>qkR{de13Aw@8K=i%v zaW0G#W;&2<&twVKR#y{g7T-&#f_fop3u@|J5YjIsQqIS8D;;1}n#p7U^N9?5QIvSSbse4?;jzQ z+LnO~8LM<%Jgb=Md0=wz9pXSl!sCH9s>XF5D+A7Y;pH>XvTHDRgDYdUG`YXJl7xqO z;bQFM3!ZL!xh>!Ja+?-x{-xky1`w+ z@;6IcFp!^t?gzd-L?Q!md61@|T%XRQY`&Od#%YO;LCW!5!CHsTs%?%H!2^O}?c?=A z2yAG1TnJ12I^2JIPz7aCxa$suvhekHlaXU*ZB;9GYYlG(I^)9IN*d<@^n~$iKf?Rg#DT}gvry{ z$!0?Gh2R>qu%o=p=ypD*&f6#l`|RNUFz>Ngpx0P8>aqs$i!z|EXg#i-N5Xum9@~A` za%NR!^;vCU-#$)*6Io1T{trv|WBo`7mhc&i;|Gg#3X#yFNHGVmpXc@|k46i-fQ60! zah{0?*!>kFH4)ie@Z5%vr}60fjQ9p!C4KNCG_w)1~l>6z+5iet?m z^IsnA9bL#@4zb6fqX1T3VR>8u!LUZ3Wyi4pEyFC{NkPF#rtO8RSV1AjxH$%HisNqC zj7_~&2~UT}s-30euc8GDk(@Evyq^b#kJ=23(tLb?74-D?&flGQOd^vPP~wYsfRyGc ze0{&Mzr#2Y&MbT>($&O*>cqS+u(fSd<3Adc(_7;xeP{0J!Rneg&|rAEV@`bx;exJL z$CFphWduCBx*Ntf2FJW|BJKt4rhD+|F}!3)f!cFSgoR^=vLHftEy_%s+mr+ z_6UNYLrY61HKSF#s2V{?sMXqgM~vE%*a?y3ey8UgJ>UCx?tkw8a$T-m@_CQfem*`O zOlT!7nO*w!A#KdCXwf}o+R+FWrpsJ}mz(sv3GKF>2HceYJL42O#rqY`jRgZUEE``A z;woXtN1vEY#+{?4Yfk*>k2)!6u%ZusSYPug#pbv1@Y|l-pFejv@WZd#*!Si*T`x%8 z9q-)D;)mya`<;Ft${Y=w#wIVB)#KBtS;ebEs+nJnx5BK6qnLh=W$0xkvl>C1_~0e69M{?Z1`kcFzmFw(m?4vC>%fJ zSP`;4X1js>$fSm0p$J1l6&w@tfICtb4Hy^Y=4KrOlkFL<&1~fUKM(!qlcjc*+2h&y zc@q61vIUFwsZq#+wb7jqP=u8KJ+aw*A{6xUI8PrfKHcuIX77RWwul}oEyEmVkq@SK zW6PB~_jx(4>zKS9>WYTD=I}XN7Z}u}JFfAbHCodxqM|>&F`X(*^Ug9eVRjZ2b$ycN z?J_$&9x7647!U$vJ_;k*cM${qcDhD|N+e|P8cgfJ0;wq^qg~Vtw?qNE<-ztjLZ4?o_w8^+!$B&kY{mVMdZ*SDAE{INTb6X=iYy4O_gQwtV`BDTSrVGTzHxqo==nD8poK}OTO=IVzz$iTnz3v{A*QAj2 z^#F3ZHKr*sYVo)L`LsGuWo0Fy5{mn|@N8psaqKd5p|I^<)Qz^hjg_e~Dg~E4)S`X$ zDi+jB-(65+LSKnb+-Y`T9f_fc+vBRXHo#S{tVW|qqUB@u60Y~}*Q&1ckp6pL%~Sf! z#~340(Ns=Nbz97J0d#NByJq3-)ezSd2L;dXKNsZXcumG(Kh4LTz0>R1dgPN4LGMZL z+PdB{w9R&(&(jTSIu|&(V}_i3X@Sg7zo#TIG2_wSEzHetx#SI?Tl+seAxUi&H3k`Q zwQf#nO4Y{O;Y&P-nCJb=`n>+{;5g8TyDQs;lG9KtZ$O zv?~kI1qG)_z~b(%2jebzL&eVat(8+7ukIFrv4aO)g^GvhXT*w{^R4~9ewXxi@t+Wo zjnTer^`k4hQgEnQ84g?i^_)_#pp#g698}gxuA6hP^;T}x;Ind?BMbgZ|7m@dfv@ZE znr`8t4fLf&PGbvS55s*;u`|{$|1=V+R=EsA^SRqnfI1-8a%f&q;kd|-%sM=ASQK;x zcT*-0N;{vj*1C6p+@+`X{=QcnR(j$ux@Nc;1eEjA8nFVIx=Pls7CO4$(Txy-p%&up zFAl3cAuafr2OBV%vPr^l8CIst zF8N>S);mdFNT`A4)6XSeJ}UhT3*-`lZe(Ay$%99kW;^lJ9PMc*Yc%%ve}-+|@7%*3 zRR)9B2fDXq-za!5k#aG*)l@xbUeo{e-ErBL^*_$xgl7QV@n?J2`S4~7M zuy&8?fe58evQ5cwzUgD#!4nmvrH=+-lW}ib3#gMPYA9F|dU-Uhi4};v`ewrt6y3`6 zF&k#sh{2mAhqWCzyb1~XW99=LmiBQJdP(a-;)_2AX8Tk7JLZyz%NU5ucUoNAd)e4{ z&!`)m+xK-xXc050Psu9k=E*A5zp>I(;J1H{Qz&1&2+#m;HwPhiaw1>?wlVL2bk&}& zE^8JAaEB(=)w>&gHL<1htMnadl`U-VGwvh+nLs`D8=`lRa>#VJ%X&3ZhpG&ctEN$O z`Mdz~;lQ`%s1F7@?`Q7n=g#MiB#V+pU_`;nhCW>21em-qT@@A?E(k(d6+5Msv*O=M z8(^iwd4v`e1o8^G2w2oKn!KD7=G=reniI_x9i`0HC#95+O=v$lfv_U*u>O}$L{I)U z{qRP`#!lC}fx|&`>VOnNuIpd1X3FW%Wtm0O^HTN_CtaB1E*M>41qvXiqmvuI#ZHMO z2mx1Xu~5dGc}Ir@qMH9|5)d0r(8LD!xdPqv6##?z3<4Af^msBHF0ilJ6^x>}O^^5m zMO&4+-?7tf&Y%<3smgY46Hpgyd0nneq0~}+O-&8Z0Mzm?bKlDB3G?iga=}osY^>_2 zwC_GFn~c3<_o(1Y^*b331pQ_glDPvsaGm@02$%K zIp%f9C10{Qq%vp8qF9xZFDES}y)|C>GqilPxOYCOPw<3hZpJ=_2KEz}d_Rz94#h7E zkYgB@;@e5fjV95C-G-?)MD$9@{QSJGFk|?FfFia@i$<%sk5&aMx)Fv;FIS`UqY&<3 zR{N)tt&Fv~S}KOj|ZAZ)Nhl^@2fqboC!)YDl$zu`5{Hjh{_rMGyWCYX{sbnHSkhOI`bOm z^6^r0N_(vBiBp*ni=iH@$nM*kIRj`HfB!-&q^ph5)0*(;(vQ-Ywb~qOt07xk_N_A4 zq+EpLt-adp**JS{_pN=FI&pcWkZ|a`<^Z=4V-YCs+mE(HxU^EB`m< z1l%PCrHHR_c<1)Ty{*gwq+23$dVvOYCTF#ND}IMV64uT9rCEo=#@H)#-V26qGN@BC zbK$u$DK5@#ULtsryvkGw_R_h9>z0R{J?|dLEKyWCbwJKW<^4Ok8E3e6^rDb{ckVPB zkQaIPeX+ooxM1T4_*RbRaoRLH`ru4uy3L|FtSbY0l9XWb_A@tEE_h9S0b`|>t>@nR zMqq1Vo|Z)Tn#NhZ6mLUb6wHkB70 z4!_d?=Z`5j)UZ;4F z0$H!1DdX(VDa=oc6H=}=-jFT~H(+n}WU9=+YX~SWnl*U@!tEWP-JKtI9TT`rX8(FUOfd8~Lr`t> zm!Nu$=&YpMyDNXKdp`Giz}lCu8E&!NH$xT7r-an$aX@j}jE(Cnl<^j{1KE^k9VhZ$ z!#YSh&ypEQr}D^HtT$~^0nWE}Xzil~80s8Tr4Zh;khz8XiBqj{Z?E}IHul`E_{`s% zXERY!vE|u$NAdLOakWjd;rP!511=Z#*{n9T9rJ^ zYQF~*FvRkFw6ZAdL`y3P2kTo~ecX1KuvwZ7$81(YHm4nbE|Bp+Mzh40-A@^%?Iig* z9J7CXRpDcT*ht~ev!|<&b}ddwFb*sHXhA=X39UHdhoyS2xSp&XtzjFu{NG`29gt}j zlXu<+;JAP8$8$#P@p(++AXDA#zw_Z+JMsl3>|bVb236-BWSjFo1g5(`>^(-K39?KD za@??bbB?o}HE3-xFtlYs18Y*PS6R=I`&8DVAV16=6z{FSfNnSnjF-is&ZLuOUrP{{ zCWcR1H9JZ|>g@w*8X}EkbtS9tLj)LjQ5JjKam*8p$f`NTEQR@v-BthwSpE_?hM8QpDgv z91MfisW0xxQQ9zjT!Ann7`Q`4#I&e#fS6I;j7cJ`li_n&7 z1}tlFnDrm))cyr5yK}E}*U^=mfm&Tg3=t@|)n9-e0Y6=T|5ptiCMINAkdFQZ9dH29 z0f63_bA)T=L{r7d|8GITD()OGwQCb=}@a=OAp|B0(&LgJQtTgfr%-jfBH_vW8;Ua{K$xk-RW_f{-h#ok7RKyny z^Y4+_luY{i_m%ow6D8@*?|9*#JM!nYus16Mi&sc^z4GLrr3tlQR23{%G7qh22|Vh+ zcIT(}+~Vw=T+cZ$5S_Wh=A?reCjO3>bfzdMAM9h`cQ~27&`0eO=!o^9WrSv$s=Dh} zNRav$Fzo15^ULO>#)qyh;T8Cp1N?xT0D1hiFQI?TEYF$`e$tJ|@PUfB;CU%2spY6z zXy2Fh!(Vf)w!DyR=7B0pYl?*4T&n`<_nd92KtCC~K|Q)YxRtar-3F!L0?xpp`t+S* zM}^lyzc1u=3!};7x=g|2h77E%$B>Yd~=M9BC015M-1~EiKm7(@F zjxG3S37A;Yjm3>a4GNDXXBZy-G;G!fU?+E(H$D1_82O8TLfNJ2)GSLITFf8p%E>*< zaU|py(z#n+s220ldG4v}tmt8FJIqcToUYo3#lDA$f3#=P;~Gp-@+uMkWfxmS`8pCI zAUjMT_* zA$jk7d~mVDH9|+KHsMFdJ=S|?k5rMseJ&kI{(AF%HOp2MIAdkeLB-Xc=a~a1k9lza zUq=w4AqPA`&!yL={#4oGjY0q~iEI+@ryo)15HV-o<#eL1-;>hwLio&GeeqUYR!oia zIABGblmsX+V@cJ@XLEo(I44WY0yGa*KNNLQz`VaJpS9S>&kPvit0If0vm-J_@8t<| zI$|*l0eXyaaT){&$E>4yQr;VTD8MRG8`QiWJ$f{N@>FYE(yc}ZEo!u)OQTG8Rrun| zQSM8h4vC5J=+7>$ST2q;BYi>D(XZoEX_M!AkPj#)cuniKs?9T=e+pgcTBV?5{g5%Q zPgx%_R?ECq!FdEgvLb~4m8ETaz05SA;kI--Ex5fl8fQ4bjIKbN#W793l9tsyAGnyc zSXS@l8o&8#+m8Sqn7C%5Wh%!CNCslqBE!{|sFB<0*Vq%tiAfjiOKv44a z+W`Uc-41Mti&c`G|IiG+DE}7}KUn+*8RXcNo{|mu$)BPB)%~LjcpC~7j2n1}1+RK6 z%)Vq_#19v!X4>vo39U#HG)(;Pl}H{A8qX1$G8a8s70Y&2Xggfreh!TkSI`cgyV_Ls z=VEuA0GHS?c*hy)dPD<*bAvLI=vn4Im{ZTBtZuDuYk>R+Sc9A<>$L3Ch$CK%O^oO0 zW-Yr_+3KHb_RUNZ0}42LtPEz|Vv*OHJt~d zWMz`HxfEH|EZ82I=9U$_RFZ>IDFw&bGtv#nkO{T}WvSy2+$XekM_^0iJOp4le@fR1 z&*JeuZ0i_-6FrB#F09F0?b-xtWpw|f8mZtW zox2`S+4kw|XDz|MektfyKsgS`y3&7PA17As{l=K(PQNKCe~I1!Ea)$QoP&GGPCM!h zegQC6%?B6Nop}9BaXdK@{u?futg4k6PUmU>(6cWEjAU&*TbXM00Xi?Aq@<)th{;r3 z$qoDx7{D7%)qY_68fF;|*$ZW)MpacBgwS`YITg^Y+CBm(cW7xln1r}hb1AUk@@MWZ zbC+BSAp#*r=^-S6^$Zy15GNjL|5q1mdv6>b00)t~wfaG2dvi2SF#r|fmv83q{f^h; ztu>Yo>oJ(Rrcqb^ViP;^W-d@oM-3(IbK@_ciYz$rGvxO8|d16aQo(@6zvco zUq9q=Re;?!-0(TMRn)<)OeV z8cGM&e{Og%=p1@&zL!-Kot%6!#lp#tQHFxH1yS%iipuBB=2mCO3c<9(PXZh+93w@h ztf>k2gTBfDj zug9&N75;sqXX-j#*CLSsG*QiJGWynP(giRIcsUE*2NKJ?tl<#MJbr%9u5W2BF8QRN3lN2~ZqiA8uGU%bm0fMgRQC(Kj`H?!2;K^Xycv6`}f3uO+%C=9F!P z!)s6w`k{8V7TOULAJoG^Wip$wDKs=34-<-9w$qMtG%lPtDh$Z=~3O($& z`-cN&iZYm%gYx!%cm_I_6QE;5HYbZY1!Zn#hTJiSme$IEv9ars8uvhibFMc5^&i>C zOF#hcJLX9Eb9LGsm;ji?GB5^faB6=L{xf<#!||N&2k9R6-|%y$@`HO~`BNlz$eMy@ zV_8k+yh0_LF_qVv32bh;SIEj%E z!FLmkjq+PCXf@uPz6&2;%1l4O7`{tvDT=q;V+HsYyl+49UIRrp1=fSH+xPI#zRQV& zU&AW8*Z5Dyb&YWp-h}PZq4>y(n1h=r#cybRt?N1iKb@OrD0+?hE|>X9^a%i!hE^C8IELncjVlZOLBYuIp6%23$H+5qvsZPz#Qv=R zRYr5DW4v%77;y5Ob0C0|7oK~ymti4`cenHT^;`x4#B~i~n#P;Wv0&CI89+@}P%zCh zXaHEdIcFz<-`jrh|Npk9U(}M!y_zGwn4;^z=O7h&J$PYl!nUI4*}1&_j5}RL%zd>z zfANx^?7afm(KXxtK2^eSL*I=?$h`V)vaFxsNZl0lTf%U&n`eeoDl9cbsBgVz?mcbB86GJ<@Yj1|Q zp*A?tKD7@VwpVm})o&jJmr+kb4S98Y{WBQ}XJJZM$?(M|W-=#6<}4XiF!7dXl&9)a z?$s|IPgKjC$P9>?LW-IkKs{(E#E3J<|2tlT9#E>*?Enye=tZkQ|HFgN$$@Pj`TpWh zvJN=kCZh@R8x{eOy4$O3J&Xiz!@uY&q~%BO<3!FN3#v@`9+|aCgIkct0Q;BD5`l5x zY(9P`FSvV?q?lPdt?j%*hb4C*0xH)mrHdYzFEj<%fpXLLQ3>WQaEkvwc(MRY$sD*x zV@mMPneRH%-rI+B<9Pl{Z-XQ0W3XgyUYb@)9SFJe7$Fm8`Mj4F@5x4;_2XmapY=HR zPZ?bBI`n?m2~5u|;Gthh^V08vVqWxfdFDNWz>3{=ckSzB29c5L-MdHF%aE%=cb5PB zv)`Wz8Gi4JUvr?&KO1w~j1x#K%+%HggJ#L(h`Bpy&gW17bgAOt22PdiLxGT-#czp; zN$Kf{Nx&R82Y>=!7=xHNd67D0sE+LE_!1EiT$<8pd&A0?wet74MAu3>V^8d?Lh@5n zYb@BCEQe0KI7gs=*e`}iW~;KXx|C8`iQQAN7&cVo@fO9vH>^6e@8RJ=)(%_wzp2Ro z-+&9)$+M5Z4Yl**Y-ZX%M=7EV5Ki@zA{SM=`VZ{gnxJaBCpQ>x`SLR}^fxPd&Ir`+ z*qAC~4_Y$ncU%I;cT-w@Kv`nv-p8+G0j*x(!yYCzE~b{aGYvizoT99Gp7){iuI?ae z@p=39Eur2(y-YV&0VO7H>&@W&{Cq22O{-U9CBz)P-Ikk?(ZJS*r~7SS!uoOZbq`BO zW$@(n8wgd{6c{hO*Loe}OnthCfS`liAL!~24NuUw%;}9Jdi3f}&j+70Qb)`wW#14A z)Q1CYFDvQ)p5hR1Ph`f^=tBBZTk!9m_7CZB2{Jv(G|HGjjUT(n9N4nB@59b*H=>~m z`WEIqru8pa_C4x|`o~|XZ~Lp;7vOAb#@s?Cgs$#=A50m|Y6V~=dFL9COH9g;xHh`N ztv7?1e9Z@HAUDGC#F`W+z%joGt!BTdY0QXMpqnKc8YemmVmtIu(X1p1w^fOm_9YA- zc;d5MELTBVd(KbDr_CYCz#2Bki$_0+Ek~gwxV^seS{FW~FGkaTP-#SZ=sc0glYaK} z>Afa;%?Lz`KbSSemU%T$G4v(%axk;+3uMRKm*O_2(`V_k2x=URPDNEI30xm$1xoWGLFib_A?ibF3vTNrr2)RB{>$LG+V;ADV{@Z0gq5U>Dj(k3 z*r|DL)q_IMJUi#FnZ#@Z|Bcvzx2xf z-?uXdfllHS++gzB8Gc;b1hlud37;TpPR&6K`RcK1XI4oA=;uM%lg3~a!rJod?NCaW zIt4MDXM<|ITFmK2A5-5drr>DH3RKK~Ka+Kz+<@__st^iQo&3mQQ(KLC_STW}gQr@= zXtDG)g<*6MMJD+P>jLeU0j)MDfc!T8gb&4lzSV{e-N}~f|Ki0(FJdLdwcD+ir-c?c z**in(iMc|<(D4{AS+g(g`@+6XGve!bbGH|+RsZuUk86@&8LX>&_EYpeP%Z7mVxY)R zyoe_xUqWDA3yCh)Uozj9R}K`rpW_X3Y_5dl_ayIM`D1L4nS*3+^16rZmyo-%${)ap z+F1a>Q}BClcje_f#(PxW^yJ(1kMs93;z#!DH|;8;{ew(9n`}OnlykzeKWAKr0Y-ds zM0#2GvE5tXpf$Yb?pj<)pl)z}?jYvKrBU6$N$kU?t{Vi+tmM-->CZR+r@<0BE96&4 z*Y@WUJkcC?P4X~$YcYAx>ej|*mDMF}rF*U2`chS-TzW(q9pRrIY>yV&KEzcEyvM#& z#Y&YP&5>c|IS4u|S2<@IY)B^mexHFO?==$bW~kdiQ32!?@x347n9z*oRX)9i{+@p% z;ll@ao}g<>Kzc)XgbNx)QwWJx6@CRn^EoJde?b?1q;klj_}jvcejx;$K&w_K6P-$S zJJ*g}5sOzHeJ?gj0iv%hFX3jsg?YSBllciKU~O<`%R80XsQmmM3}4lzx0{cvBzoz^ zw}KWm7DpR`&$K40PDF{Q#@ju63h7#C>(fY|2%-|{9qOKNayZ?hdZpBTER2#*YoZ@H zf7H_bw8}pL3d6pq9A*aa0FQaahl_N0rRsF>fP%ht;sxMp~L z;N@*MR>E*&C2AW|8zZyhr?MLaaC13N{BQpCI)=TO{73)6&Qs|NNo*nawR%dNJ^Qf( ziTyUdv69ypDOad_j!B(7oN`o4lOv2d;(1EQG0tZp%$$2)>_7QR^NP-qsaow;t^^4c zN9k~CTNc5K;@gJ5a7MLD)gbpwMz$-!IUvfR0Ujek(Z#6~ejW=op>6At?4bqXhQZ8g z0;3}EttCSLL=;a*_RvUbwA!3L<@+>%@!7YFbJH%_55X%*XJbBVw|b&p0bA?;r&YLk{58E zsItHKjCVg5^Q81>f~tKKYGcZZSu^S;m4u;B>Qh%Uu%n~5um13PBf6%oPJ3=u?(KNe zwJTkZAkGJW(pAzMIg#*u>ug$1a2BslQf;=RfZKzMFP+WJV-5Na-4M*5DO2w4M9&%2 zXnL@l95w>4cIzy@*{0_*ZyirF$9SvRgtw+*Ud`a~krnn|0OYgxgxgz3`-z~VE6VG?_g<++`%0saXg8w%hg1U4Gyx}+N?45wYKPiS5D5(E6f)K-c8 zubu1L6(*^w%^C>G8oTw?r~2>N7#qKJ%PGVmM8TVv5)|7+HpZe$vA#n+pcaPZS`H?s zij|{+DMOuI;)Vwu+yIllo}~WN=u$X!9^#tH&TD05`Q}O}fOtW* z;j5{^gGs)FI<>m_-0~l%X)6di`yiY?gu|-SmPjcs0s_8{*@INvhCY&%vmUdrWN5?J zYef+0idQC~Q1I#Gz;TYgkrA~MharcV)odmtV{PX~$n`-F%aZ5QVy%UXR^Bq1Z$kM1=mGP-0p*F~kwza|3Obnh@Axx{&E!tbtJn=p_C=i};Jk68z8y^nqDPm{j%PvSA?79csk|#u!crjx(pi96< z5k(wi9M0G^d)p&|N?>}{&-N)9Dx3QGE$c{^fpJNeu+IRn^cF>a zquZJErkmb=nWwDFfO6?3?z7HY>{z%MK`TV&m#(=9yAQ1oGxfyIh~PQf%0&{A8CAK$ z@&e1#*n}6=pfL*w0Rg>i-On+A?duUbT%82hJdsxT@_7WDPQhW#TdAI%g{Kp#Jy3_a z?kqx4SDQNpbh=*ID_86i5J?W|wE&){xVlh4EjiZ~^xrDDeRM0PM<~qD`uBjuA;GPF z;}&FeWW5B*c3FLSOajZLP{CW2_1pSyTlI->4JkeZO(H{;G~9IVC%o@*(-qx>Lue>V z;GKir|2hzj&l#qqC_&O)LF!RKnkDRLYKsVe|I6Cuj|a4k4eetOU)sU!!5oK!@HfY? zLA-~eo(gZ?_oc6BrpMyuBfIoB9m0GM+2h5pE(mZ3@)^#AX>_o^iw$vWe0Q8cf|p8P z^UA(kid>*feQ|ZjDiu0$Yt)v$smOw*Q;G1p9{Iyl9Fdsr0@u9Kw|aY#r)B5n(#DSp zP=hE|xMd$I>-R}>>oMaugBM0T>1MB{@pyoA~6}mDOuD*2#+W9l%DE?zqhrL!L!RxAn`dok zG#d-^J)M*amcY6F>n|hG2X+L_ro|42tNC4N7tOkUYwLkmcIkCv9O(8xo5}0x(TV7W z3@>s)hjNkEuXi07AMw?F<7Z&pI30lu9TUSQv{?Ic-bVNnz>m;E% z*4Ec_vuDcGOuv<%v~+ZJjd|BDw%C@kHn}%)4LxXSl1M5

@@ -83,7 +82,7 @@ export const SecretOverviewTableRow = ({ {environments.map(({ slug }, i) => { const secret = getSecretByKey(slug, secretKey); - const isSecretImported = isImportedSecretPresentInEnv(secretPath, slug, secretKey); + const isSecretImported = isImportedSecretPresentInEnv(slug, secretKey); const isSecretPresent = Boolean(secret); const isSecretEmpty = secret?.value === ""; @@ -108,8 +107,8 @@ export const SecretOverviewTableRow = ({ isSecretPresent ? "Present secret" : isSecretImported - ? "Imported secret" - : "Missing secret" + ? "Imported secret" + : "Missing secret" } >
Date: Wed, 12 Jun 2024 00:28:11 +0200 Subject: [PATCH 098/187] Improvements --- backend/src/services/user/user-dal.ts | 9 +++ backend/src/services/user/user-service.ts | 70 ++++------------------- 2 files changed, 19 insertions(+), 60 deletions(-) diff --git a/backend/src/services/user/user-dal.ts b/backend/src/services/user/user-dal.ts index f2da0df0e..d0b03019f 100644 --- a/backend/src/services/user/user-dal.ts +++ b/backend/src/services/user/user-dal.ts @@ -94,6 +94,14 @@ export const userDALFactory = (db: TDbClient) => { } }; + const findMergeableUsers = async (email: string, tx?: Knex) => { + const users = await (tx || db)(TableName.Users).where((builder) => { + void builder.where({ email, isEmailVerified: true }).orWhere({ email, isAccepted: false }); + }); + + return users; + }; + const updateUserEncryptionByUserId = async (userId: string, data: TUserEncryptionKeysUpdate, tx?: Knex) => { try { const [userEnc] = await (tx || db)(TableName.UserEncryptionKey) @@ -154,6 +162,7 @@ export const userDALFactory = (db: TDbClient) => { findUsersByProjectMembershipIds, upsertUserEncryptionKey, createUserEncryption, + findMergeableUsers, findOneUserAction, createUserAction }; diff --git a/backend/src/services/user/user-service.ts b/backend/src/services/user/user-service.ts index b2f3910c0..f04e0b35f 100644 --- a/backend/src/services/user/user-service.ts +++ b/backend/src/services/user/user-service.ts @@ -12,6 +12,7 @@ type TUserServiceFactoryDep = { userDAL: Pick< TUserDALFactory, | "find" + | "findMergeableUsers" | "findOne" | "findById" | "transaction" @@ -86,13 +87,7 @@ export const userServiceFactory = ({ ); // check if there are users with the same email. - const users = await userDAL.find( - { - email, - isEmailVerified: true - }, - { tx } - ); + const users = await userDAL.findMergeableUsers(email, tx); if (users.length > 1) { // merge users @@ -134,59 +129,14 @@ export const userServiceFactory = ({ ); } } else { - const existingUserWithUsername = await userDAL.findOne({ - username: email - }); - - if (existingUserWithUsername && existingUserWithUsername.id !== user.id) { - // merge users - const mergeUserOrgMembershipSet = new Set( - (await orgMembershipDAL.find({ userId: existingUserWithUsername.id }, { tx })).map((m) => m.orgId) - ); - - const myOrgMemberships = (await orgMembershipDAL.find({ userId: user.id }, { tx })).filter( - (m) => !mergeUserOrgMembershipSet.has(m.orgId) - ); - - const userAliases = await userAliasDAL.find( - { - userId: user.id - }, - { tx } - ); - - // delete current user - await userDAL.deleteById(user.id, tx); - - if (myOrgMemberships.length) { - await orgMembershipDAL.insertMany( - myOrgMemberships.map((orgMembership) => ({ - ...orgMembership, - userId: existingUserWithUsername.id - })), - tx - ); - } - - if (userAliases.length) { - await userAliasDAL.insertMany( - userAliases.map((userAlias) => ({ - ...userAlias, - userId: existingUserWithUsername.id - })), - tx - ); - } - } else { - // update current user's username to [email] - await userDAL.updateById( - user.id, - { - username: email - }, - tx - ); - } + // update current user's username to [email] + await userDAL.updateById( + user.id, + { + username: email + }, + tx + ); } }); }; From 7626dbb96eb2b628c15ef66e430d81c9bab4c440 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 00:55:33 +0200 Subject: [PATCH 099/187] Fix: Permission error page displayed after user sign up if organization enforces SAML auth --- backend/src/services/auth/auth-signup-service.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts index be7f5777d..528cb44fa 100644 --- a/backend/src/services/auth/auth-signup-service.ts +++ b/backend/src/services/auth/auth-signup-service.ts @@ -231,7 +231,7 @@ export const authSignupServiceFactory = ({ const accessToken = jwt.sign( { - authMethod: AuthMethod.EMAIL, + authMethod: authMethod || AuthMethod.EMAIL, authTokenType: AuthTokenType.ACCESS_TOKEN, userId: updateduser.info.id, tokenVersionId: tokenSession.id, @@ -244,7 +244,7 @@ export const authSignupServiceFactory = ({ const refreshToken = jwt.sign( { - authMethod: AuthMethod.EMAIL, + authMethod: authMethod || AuthMethod.EMAIL, authTokenType: AuthTokenType.REFRESH_TOKEN, userId: updateduser.info.id, tokenVersionId: tokenSession.id, From 7b444e91a838c04b4fc8874c56a4c6d8a2dee66f Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 01:58:35 +0200 Subject: [PATCH 100/187] Helm --- .../templates/infisicalsecret-crd.yaml | 120 ++++++++++++++++++ helm-charts/secrets-operator/values.yaml | 2 +- 2 files changed, 121 insertions(+), 1 deletion(-) diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index edc3eaaae..57fe8270b 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -37,6 +37,126 @@ spec: properties: authentication: properties: + awsIamAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + required: + - identityId + - secretsScope + type: object + azureAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + required: + - identityId + - secretsScope + type: object + gcpIamAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + serviceAccountKeyFilePath: + type: string + required: + - identityId + - secretsScope + - serviceAccountKeyFilePath + type: object + gcpIdTokenAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + required: + - identityId + - secretsScope + type: object + kubernetesAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + serviceAccountTokenPath: + type: string + required: + - identityId + - secretsScope + type: object serviceAccount: properties: environmentName: diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml index 8564e79f5..7d42f7f06 100644 --- a/helm-charts/secrets-operator/values.yaml +++ b/helm-charts/secrets-operator/values.yaml @@ -32,7 +32,7 @@ controllerManager: - ALL image: repository: infisical/kubernetes-operator - tag: v0.5.2 # fixed to prevent accidental upgrade + tag: v0.5.2 resources: limits: cpu: 500m From b7f5fa2cec8a886d55f39d3ce7081829cb251869 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 01:58:45 +0200 Subject: [PATCH 101/187] Types --- .../api/v1alpha1/infisicalsecret_types.go | 54 +++++++++++++++++++ .../api/v1alpha1/zz_generated.deepcopy.go | 17 ++++++ 2 files changed, 71 insertions(+) diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index f6a7ef022..b0cc49a8f 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -11,6 +11,16 @@ type Authentication struct { ServiceToken ServiceTokenDetails `json:"serviceToken"` // +kubebuilder:validation:Optional UniversalAuth UniversalAuthDetails `json:"universalAuth"` + // +kubebuilder:validation:Optional + KubernetesAuth KubernetesAuthDetails `json:"kubernetesAuth"` + // +kubebuilder:validation:Optional + AwsIamAuth AWSIamAuthDetails `json:"awsIamAuth"` + // +kubebuilder:validation:Optional + AzureAuth AzureAuthDetails `json:"azureAuth"` + // +kubebuilder:validation:Optional + GcpIdTokenAuth GCPIdTokenAuthDetails `json:"gcpIdTokenAuth"` + // +kubebuilder:validation:Optional + GcpIamAuth GcpIamAuthDetails `json:"gcpIamAuth"` } type UniversalAuthDetails struct { @@ -20,6 +30,50 @@ type UniversalAuthDetails struct { SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` } +type KubernetesAuthDetails struct { + // +kubebuilder:validation:Required + IdentityID string `json:"identityId"` + // +kubebuilder:validation:Optional + ServiceAccountTokenPath string `json:"serviceAccountTokenPath"` + + // +kubebuilder:validation:Required + SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` +} + +type AWSIamAuthDetails struct { + // +kubebuilder:validation:Required + IdentityID string `json:"identityId"` + + // +kubebuilder:validation:Required + SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` +} + +type AzureAuthDetails struct { + // +kubebuilder:validation:Required + IdentityID string `json:"identityId"` + + // +kubebuilder:validation:Required + SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` +} + +type GCPIdTokenAuthDetails struct { + // +kubebuilder:validation:Required + IdentityID string `json:"identityId"` + + // +kubebuilder:validation:Required + SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` +} + +type GcpIamAuthDetails struct { + // +kubebuilder:validation:Required + IdentityID string `json:"identityId"` + // +kubebuilder:validation:Required + ServiceAccountKeyFilePath string `json:"serviceAccountKeyFilePath"` + + // +kubebuilder:validation:Required + SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` +} + type ServiceTokenDetails struct { // +kubebuilder:validation:Required ServiceTokenSecretReference KubeSecretReference `json:"serviceTokenSecretReference"` diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 23251a194..2f2e58a5e 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -32,6 +32,7 @@ func (in *Authentication) DeepCopyInto(out *Authentication) { out.ServiceAccount = in.ServiceAccount out.ServiceToken = in.ServiceToken out.UniversalAuth = in.UniversalAuth + out.KubernetesAuth = in.KubernetesAuth } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Authentication. @@ -158,6 +159,22 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KubernetesAuthDetails) DeepCopyInto(out *KubernetesAuthDetails) { + *out = *in + out.SecretsScope = in.SecretsScope +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesAuthDetails. +func (in *KubernetesAuthDetails) DeepCopy() *KubernetesAuthDetails { + if in == nil { + return nil + } + out := new(KubernetesAuthDetails) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *MachineIdentityScopeInWorkspace) DeepCopyInto(out *MachineIdentityScopeInWorkspace) { *out = *in From 70e022826ef4abf6de66758bacc46b7d8f7ef05c Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:00:59 +0200 Subject: [PATCH 102/187] Update zz_generated.deepcopy.go --- .../api/v1alpha1/zz_generated.deepcopy.go | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 2f2e58a5e..39f8622c9 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -26,6 +26,22 @@ import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AWSIamAuthDetails) DeepCopyInto(out *AWSIamAuthDetails) { + *out = *in + out.SecretsScope = in.SecretsScope +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AWSIamAuthDetails. +func (in *AWSIamAuthDetails) DeepCopy() *AWSIamAuthDetails { + if in == nil { + return nil + } + out := new(AWSIamAuthDetails) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Authentication) DeepCopyInto(out *Authentication) { *out = *in @@ -33,6 +49,10 @@ func (in *Authentication) DeepCopyInto(out *Authentication) { out.ServiceToken = in.ServiceToken out.UniversalAuth = in.UniversalAuth out.KubernetesAuth = in.KubernetesAuth + out.AwsIamAuth = in.AwsIamAuth + out.AzureAuth = in.AzureAuth + out.GcpIdTokenAuth = in.GcpIdTokenAuth + out.GcpIamAuth = in.GcpIamAuth } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Authentication. @@ -45,6 +65,54 @@ func (in *Authentication) DeepCopy() *Authentication { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AzureAuthDetails) DeepCopyInto(out *AzureAuthDetails) { + *out = *in + out.SecretsScope = in.SecretsScope +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AzureAuthDetails. +func (in *AzureAuthDetails) DeepCopy() *AzureAuthDetails { + if in == nil { + return nil + } + out := new(AzureAuthDetails) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GCPIdTokenAuthDetails) DeepCopyInto(out *GCPIdTokenAuthDetails) { + *out = *in + out.SecretsScope = in.SecretsScope +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GCPIdTokenAuthDetails. +func (in *GCPIdTokenAuthDetails) DeepCopy() *GCPIdTokenAuthDetails { + if in == nil { + return nil + } + out := new(GCPIdTokenAuthDetails) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GcpIamAuthDetails) DeepCopyInto(out *GcpIamAuthDetails) { + *out = *in + out.SecretsScope = in.SecretsScope +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GcpIamAuthDetails. +func (in *GcpIamAuthDetails) DeepCopy() *GcpIamAuthDetails { + if in == nil { + return nil + } + out := new(GcpIamAuthDetails) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *InfisicalSecret) DeepCopyInto(out *InfisicalSecret) { *out = *in From d20b897f28d8aea189ecbf824fe79f82fdf9521a Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:01:03 +0200 Subject: [PATCH 103/187] Update secrets.infisical.com_infisicalsecrets.yaml --- ...ecrets.infisical.com_infisicalsecrets.yaml | 120 ++++++++++++++++++ 1 file changed, 120 insertions(+) diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index 855bff7a9..bea031896 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -37,6 +37,126 @@ spec: properties: authentication: properties: + awsIamAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + required: + - identityId + - secretsScope + type: object + azureAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + required: + - identityId + - secretsScope + type: object + gcpIamAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + serviceAccountKeyFilePath: + type: string + required: + - identityId + - secretsScope + - serviceAccountKeyFilePath + type: object + gcpIdTokenAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + required: + - identityId + - secretsScope + type: object + kubernetesAuth: + properties: + identityId: + type: string + secretsScope: + properties: + envSlug: + type: string + projectSlug: + type: string + recursive: + type: boolean + secretsPath: + type: string + required: + - envSlug + - projectSlug + - secretsPath + type: object + serviceAccountTokenPath: + type: string + required: + - identityId + - secretsScope + type: object serviceAccount: properties: environmentName: From 89644703a0795249313df69cbe1c3190e013c042 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:10:11 +0200 Subject: [PATCH 104/187] Update sample.yaml --- k8-operator/config/samples/sample.yaml | 70 +++++++++++++++++++++++--- 1 file changed, 64 insertions(+), 6 deletions(-) diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 1c8a9a3f0..5d14401a5 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -12,26 +12,84 @@ spec: authentication: # Make sure to only have 1 authentication method defined, serviceToken/universalAuth. # If you have multiple authentication methods defined, it may cause issues. + + # (Deprecated) Service Token Auth serviceToken: serviceTokenSecretReference: secretName: service-token secretNamespace: default secretsScope: envSlug: - secretsPath: # Root is "/" - recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false + secretsPath: + recursive: true + # Universal Auth universalAuth: secretsScope: - projectSlug: - envSlug: # "dev", "staging", "prod", etc.. - secretsPath: "" # Root is "/" + projectSlug: new-ob-em + envSlug: dev # "dev", "staging", "prod", etc.. + secretsPath: "/" # Root is "/" recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false - credentialsRef: secretName: universal-auth-credentials secretNamespace: default + # Native Kubernetes Auth + kubernetesAuth: + identityId: + serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # AWS IAM Auth + awsIamAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # Azure Auth + azureAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # GCP ID Token Auth + gcpIdTokenAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # GCP IAM Auth + gcpIamAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + managedSecretReference: secretName: managed-secret secretNamespace: default From c3f7c1d46bdea0f26bce525ec083ff33ce451621 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:10:26 +0200 Subject: [PATCH 105/187] Install Infisical Go SDK --- k8-operator/go.mod | 71 ++++++++++++++++++++------ k8-operator/go.sum | 122 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 177 insertions(+), 16 deletions(-) diff --git a/k8-operator/go.mod b/k8-operator/go.mod index 3a5396dc3..7e2c2255c 100644 --- a/k8-operator/go.mod +++ b/k8-operator/go.mod @@ -1,6 +1,8 @@ module github.com/Infisical/infisical/k8-operator -go 1.19 +go 1.21 + +toolchain go1.21.4 require ( github.com/onsi/ginkgo/v2 v2.6.0 @@ -10,26 +12,63 @@ require ( sigs.k8s.io/controller-runtime v0.14.4 ) +require ( + cloud.google.com/go/auth v0.5.1 // indirect + cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect + cloud.google.com/go/compute/metadata v0.3.0 // indirect + cloud.google.com/go/iam v1.1.8 // indirect + github.com/aws/aws-sdk-go-v2 v1.27.2 // indirect + github.com/aws/aws-sdk-go-v2/config v1.27.18 // indirect + github.com/aws/aws-sdk-go-v2/credentials v1.17.18 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.5 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.9 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.9 // indirect + github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.11 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.20.11 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.5 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.28.12 // indirect + github.com/aws/smithy-go v1.20.2 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect + github.com/go-logr/stdr v1.2.2 // indirect + github.com/google/s2a-go v0.1.7 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect + github.com/googleapis/gax-go/v2 v2.12.4 // indirect + github.com/infisical/go-sdk v0.1.4 // indirect + go.opencensus.io v0.24.0 // indirect + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect + go.opentelemetry.io/otel v1.24.0 // indirect + go.opentelemetry.io/otel/metric v1.24.0 // indirect + go.opentelemetry.io/otel/trace v1.24.0 // indirect + golang.org/x/sync v0.7.0 // indirect + google.golang.org/api v0.183.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20240521202816-d264139d666e // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect + google.golang.org/grpc v1.64.0 // indirect +) + require ( github.com/beorn7/perks v1.0.1 // indirect - github.com/cespare/xxhash/v2 v2.1.2 // indirect + github.com/cespare/xxhash/v2 v2.2.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/emicklei/go-restful/v3 v3.9.0 // indirect github.com/evanphx/json-patch/v5 v5.6.0 // indirect github.com/fsnotify/fsnotify v1.6.0 // indirect - github.com/go-logr/logr v1.2.3 // indirect + github.com/go-logr/logr v1.4.1 // indirect github.com/go-logr/zapr v1.2.3 // indirect github.com/go-openapi/jsonpointer v0.19.5 // indirect github.com/go-openapi/jsonreference v0.20.0 // indirect github.com/go-openapi/swag v0.19.14 // indirect - github.com/go-resty/resty/v2 v2.10.0 + github.com/go-resty/resty/v2 v2.13.1 github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect - github.com/golang/protobuf v1.5.2 // indirect + github.com/golang/protobuf v1.5.4 // indirect github.com/google/gnostic v0.5.7-v3refs // indirect - github.com/google/go-cmp v0.5.9 // indirect + github.com/google/go-cmp v0.6.0 // indirect github.com/google/gofuzz v1.1.0 // indirect - github.com/google/uuid v1.1.2 // indirect + github.com/google/uuid v1.6.0 // indirect github.com/imdario/mergo v0.3.12 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect @@ -47,16 +86,16 @@ require ( go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect go.uber.org/zap v1.24.0 // indirect - golang.org/x/crypto v0.14.0 - golang.org/x/net v0.17.0 // indirect - golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect - golang.org/x/sys v0.13.0 // indirect - golang.org/x/term v0.13.0 // indirect - golang.org/x/text v0.13.0 // indirect - golang.org/x/time v0.3.0 // indirect + golang.org/x/crypto v0.23.0 + golang.org/x/net v0.25.0 // indirect + golang.org/x/oauth2 v0.21.0 // indirect + golang.org/x/sys v0.20.0 // indirect + golang.org/x/term v0.20.0 // indirect + golang.org/x/text v0.15.0 // indirect + golang.org/x/time v0.5.0 // indirect gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect - google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.28.1 // indirect + google.golang.org/appengine v1.6.8 // indirect + google.golang.org/protobuf v1.34.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/k8-operator/go.sum b/k8-operator/go.sum index 52e2e46b2..af09fd222 100644 --- a/k8-operator/go.sum +++ b/k8-operator/go.sum @@ -13,14 +13,24 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs= cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc= cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY= +cloud.google.com/go v0.114.0 h1:OIPFAdfrFDFO2ve2U7r/H5SwSbBzEdrBdE7xkgwc+kY= +cloud.google.com/go/auth v0.5.1 h1:0QNO7VThG54LUzKiQxv8C6x1YX7lUrzlAa1nVLF8CIw= +cloud.google.com/go/auth v0.5.1/go.mod h1:vbZT8GjzDf3AVqCcQmqeeM32U9HBFc32vVVAbwDsa6s= +cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4= +cloud.google.com/go/auth/oauth2adapt v0.2.2/go.mod h1:wcYjgpZI9+Yu7LyYBg4pqSiaRkfEK3GQcpb7C/uyF1Q= cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE= cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc= cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= +cloud.google.com/go/compute v1.25.1 h1:ZRpHJedLtTpKgr3RV1Fx23NuaAEN1Zfx9hw1u4aJdjU= +cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc= +cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= +cloud.google.com/go/iam v1.1.8 h1:r7umDwhj+BQyz0ScZMp4QrGXjSTI3ZINnpgU2nlB/K0= +cloud.google.com/go/iam v1.1.8/go.mod h1:GvE6lyMmfxXauzNq8NbgJbeVQNspG+tcdL/W8QO1+zE= cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw= cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA= @@ -38,6 +48,32 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho= +github.com/aws/aws-sdk-go-v2 v1.27.2 h1:pLsTXqX93rimAOZG2FIYraDQstZaaGVVN4tNw65v0h8= +github.com/aws/aws-sdk-go-v2 v1.27.2/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM= +github.com/aws/aws-sdk-go-v2/config v1.27.18 h1:wFvAnwOKKe7QAyIxziwSKjmer9JBMH1vzIL6W+fYuKk= +github.com/aws/aws-sdk-go-v2/config v1.27.18/go.mod h1:0xz6cgdX55+kmppvPm2IaKzIXOheGJhAufacPJaXZ7c= +github.com/aws/aws-sdk-go-v2/credentials v1.17.18 h1:D/ALDWqK4JdY3OFgA2thcPO1c9aYTT5STS/CvnkqY1c= +github.com/aws/aws-sdk-go-v2/credentials v1.17.18/go.mod h1:JuitCWq+F5QGUrmMPsk945rop6bB57jdscu+Glozdnc= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.5 h1:dDgptDO9dxeFkXy+tEgVkzSClHZje/6JkPW5aZyEvrQ= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.5/go.mod h1:gjvE2KBUgUQhcv89jqxrIxH9GaKs1JbZzWejj/DaHGA= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.9 h1:cy8ahBJuhtM8GTTSyOkfy6WVPV1IE+SS5/wfXUYuulw= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.9/go.mod h1:CZBXGLaJnEZI6EVNcPd7a6B5IC5cA/GkRWtu9fp3S6Y= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.9 h1:A4SYk07ef04+vxZToz9LWvAXl9LW0NClpPpMsi31cz0= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.9/go.mod h1:5jJcHuwDagxN+ErjQ3PU3ocf6Ylc/p9x+BLO/+X4iXw= +github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU= +github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.11 h1:o4T+fKxA3gTMcluBNZZXE9DNaMkJuUL1O3mffCUjoJo= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.11/go.mod h1:84oZdJ+VjuJKs9v1UTC9NaodRZRseOXCTgku+vQJWR8= +github.com/aws/aws-sdk-go-v2/service/sso v1.20.11 h1:gEYM2GSpr4YNWc6hCd5nod4+d4kd9vWIAWrmGuLdlMw= +github.com/aws/aws-sdk-go-v2/service/sso v1.20.11/go.mod h1:gVvwPdPNYehHSP9Rs7q27U1EU+3Or2ZpXvzAYJNh63w= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.5 h1:iXjh3uaH3vsVcnyZX7MqCoCfcyxIrVE9iOQruRaWPrQ= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.5/go.mod h1:5ZXesEuy/QcO0WUnt+4sDkxhdXRHTu2yG0uCSH8B6os= +github.com/aws/aws-sdk-go-v2/service/sts v1.28.12 h1:M/1u4HBpwLuMtjlxuI2y6HoVLzF5e2mfxHCg7ZVMYmk= +github.com/aws/aws-sdk-go-v2/service/sts v1.28.12/go.mod h1:kcfd+eTdEi/40FIbLq4Hif3XMXnl5b/+t/KTfLt9xIk= +github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q= +github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E= github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= @@ -48,6 +84,8 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE= github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= +github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= @@ -68,6 +106,8 @@ github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMi github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84= github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww= github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= +github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= +github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= @@ -85,6 +125,10 @@ github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbV github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ= +github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.2.3 h1:a9vnzlIBPQBBkeaR9IuMUfmVOrQlkoC4YfPoFkX3T7A= github.com/go-logr/zapr v1.2.3/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= @@ -97,6 +141,8 @@ github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5F github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= github.com/go-resty/resty/v2 v2.10.0 h1:Qla4W/+TMmv0fOeeRqzEpXPLfTUnR5HZ1+lGs+CkiCo= github.com/go-resty/resty/v2 v2.10.0/go.mod h1:iiP/OpA0CkcL3IGt1O0+/SIItFUbkkyw5BGXiVdTu+A= +github.com/go-resty/resty/v2 v2.13.1 h1:x+LHXBI2nMB1vqndymf26quycC4aggYJ7DECYbiz03g= +github.com/go-resty/resty/v2 v2.13.1/go.mod h1:GznXlLxkq6Nh4sU59rPmUw3VtgpO3aS96ORAI6Q7d+0= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= @@ -131,6 +177,8 @@ github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= +github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54= @@ -142,10 +190,13 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g= github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -159,15 +210,33 @@ github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hf github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= +github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o= +github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw= github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y= github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs= +github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= +github.com/googleapis/gax-go/v2 v2.12.4 h1:9gWcmF85Wvq4ryPFvGFaOgPIs1AQX0d0bcbGw4Z96qg= +github.com/googleapis/gax-go/v2 v2.12.4/go.mod h1:KYEYLorsnIGDi/rPC8b5TdlB9kbKoFubselGIoBMCwI= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU= github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA= +github.com/infisical/go-sdk v0.1.0 h1:tbnrqKlnzci8Fa1DLphwsuZj1DKL1LMEaxDAexkLrCE= +github.com/infisical/go-sdk v0.1.0/go.mod h1:yQ1CPw7DahTcVDcgH07IsFREnoHf1NXhTNmSae0CphE= +github.com/infisical/go-sdk v0.1.1 h1:EkT2MmbsEkbA/MDL4JbRdd8jcAuqAcP4MR0V3Z/h88w= +github.com/infisical/go-sdk v0.1.1/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= +github.com/infisical/go-sdk v0.1.2 h1:Ns4Qhvq2eTKljUYVsd3RAUpm7asmo4GeBhUew55kgCo= +github.com/infisical/go-sdk v0.1.2/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= +github.com/infisical/go-sdk v0.1.3 h1:pXj7OcEutoTrn8xPMxa7ZNQteVdjfYsMWeR7wuvcbF8= +github.com/infisical/go-sdk v0.1.3/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= +github.com/infisical/go-sdk v0.1.4 h1:0msuDTY/WB8kboaWrrGHnzyLZfXRtaayw40T1x5Aj5w= +github.com/infisical/go-sdk v0.1.4/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= @@ -257,13 +326,18 @@ github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= @@ -274,6 +348,18 @@ go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= +go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 h1:4Pp6oUg3+e/6M4C0A/3kJ2VYa++dsWVTtGgLVj5xtHg= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw= +go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo= +go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo= +go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI= +go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco= +go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI= +go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU= go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= @@ -292,6 +378,9 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= +golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= +golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI= +golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -353,6 +442,7 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= @@ -362,6 +452,9 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= +golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= +golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac= +golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -370,6 +463,8 @@ golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b h1:clP8eMhB30EHdc0bd2Twtq6kgU7yl5ub2cQLSdrv1Dg= golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc= +golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs= +golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -382,6 +477,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M= +golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -428,12 +525,18 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= +golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= +golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= +golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw= +golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -441,15 +544,21 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= +golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk= +golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk= +golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= @@ -517,6 +626,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM= google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc= +google.golang.org/api v0.183.0 h1:PNMeRDwo1pJdgNcFQ9GstuLe/noWKIc89pRWRLMvLwE= +google.golang.org/api v0.183.0/go.mod h1:q43adC5/pHoSZTx5h2mSmdF7NcyfW9JuDyIOJAgS9ZQ= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= @@ -525,6 +636,7 @@ google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCID google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= @@ -555,6 +667,11 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20240528184218-531527333157 h1:u7WMYrIrVvs0TF5yaKwKNbcJyySYf+HAIFXxWltJOXE= +google.golang.org/genproto/googleapis/api v0.0.0-20240521202816-d264139d666e h1:SkdGTrROJl2jRGT/Fxv5QUf9jtdKCQh4KQJXbXVLAi0= +google.golang.org/genproto/googleapis/api v0.0.0-20240521202816-d264139d666e/go.mod h1:LweJcLbyVij6rCex8YunD8DYR5VDonap/jYl3ZRxcIU= +google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 h1:Zy9XzmMEflZ/MAaA7vNcoebnRAld7FsPW1EeBB7V0m8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -567,6 +684,9 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= +google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc= +google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY= +google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= @@ -581,6 +701,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg= +google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 32dd47889497827ee815dea8bdd3578d3e9b2c19 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:10:35 +0200 Subject: [PATCH 106/187] Fix: Local ETag computation --- k8-operator/packages/crypto/crypto.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/k8-operator/packages/crypto/crypto.go b/k8-operator/packages/crypto/crypto.go index e8633e273..810382af1 100644 --- a/k8-operator/packages/crypto/crypto.go +++ b/k8-operator/packages/crypto/crypto.go @@ -3,6 +3,8 @@ package crypto import ( "crypto/aes" "crypto/cipher" + "fmt" + "hash/crc32" "golang.org/x/crypto/nacl/box" ) @@ -33,3 +35,8 @@ func DecryptAsymmetric(ciphertext []byte, nonce []byte, publicKey []byte, privat plainTextToReturn, _ := box.Open(nil, ciphertext, (*[24]byte)(nonce), (*[32]byte)(publicKey), (*[32]byte)(privateKey)) return plainTextToReturn } + +func ComputeEtag(data []byte) string { + crc := crc32.ChecksumIEEE(data) + return fmt.Sprintf(`W/"secrets-%d-%08X"`, len(data), crc) +} From 928d5a5240dfce3c1ec4615c08cc54551922dbf2 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:10:37 +0200 Subject: [PATCH 107/187] Delete machine-identity-token.go --- .../packages/util/machine-identity-token.go | 170 ------------------ 1 file changed, 170 deletions(-) delete mode 100644 k8-operator/packages/util/machine-identity-token.go diff --git a/k8-operator/packages/util/machine-identity-token.go b/k8-operator/packages/util/machine-identity-token.go deleted file mode 100644 index 055e869ad..000000000 --- a/k8-operator/packages/util/machine-identity-token.go +++ /dev/null @@ -1,170 +0,0 @@ -package util - -import ( - "fmt" - "os" - "sync" - "time" - - "github.com/Infisical/infisical/k8-operator/packages/api" - "github.com/go-resty/resty/v2" -) - -type MachineIdentityToken struct { - accessTokenTTL time.Duration - accessTokenMaxTTL time.Duration - accessTokenFetchedTime time.Time - accessTokenRefreshedTime time.Time - - mutex sync.Mutex - - accessToken string - clientSecret string - clientId string -} - -func NewMachineIdentityToken(clientId string, clientSecret string) *MachineIdentityToken { - - token := MachineIdentityToken{ - clientSecret: clientSecret, - clientId: clientId, - } - - go token.HandleTokenLifecycle() - - return &token -} - -func (t *MachineIdentityToken) HandleTokenLifecycle() error { - - for { - accessTokenMaxTTLExpiresInTime := t.accessTokenFetchedTime.Add(t.accessTokenMaxTTL - (5 * time.Second)) - accessTokenRefreshedTime := t.accessTokenRefreshedTime - - if accessTokenRefreshedTime.IsZero() { - accessTokenRefreshedTime = t.accessTokenFetchedTime - } - - nextAccessTokenExpiresInTime := accessTokenRefreshedTime.Add(t.accessTokenTTL - (5 * time.Second)) - - if t.accessTokenFetchedTime.IsZero() && t.accessTokenRefreshedTime.IsZero() { - // case: init login to get access token - fmt.Println("\nInfisical Authentication: attempting to authenticate...") - err := t.FetchNewAccessToken() - if err != nil { - fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err) - - // wait a bit before trying again - time.Sleep((30 * time.Second)) - continue - } - } else if time.Now().After(accessTokenMaxTTLExpiresInTime) { - fmt.Printf("\nInfisical Authentication: machine identity access token has reached max ttl, attempting to re authenticate...") - err := t.FetchNewAccessToken() - if err != nil { - fmt.Printf("\nInfisical Authentication: unable to authenticate universal auth because %v. Will retry in 30 seconds", err) - - // wait a bit before trying again - time.Sleep((30 * time.Second)) - continue - } - } else { - err := t.RefreshAccessToken() - if err != nil { - fmt.Printf("\nInfisical Authentication: unable to refresh universal auth token because %v. Will retry in 30 seconds", err) - - // wait a bit before trying again - time.Sleep((30 * time.Second)) - continue - } - } - - if accessTokenRefreshedTime.IsZero() { - accessTokenRefreshedTime = t.accessTokenFetchedTime - } else { - accessTokenRefreshedTime = t.accessTokenRefreshedTime - } - - nextAccessTokenExpiresInTime = accessTokenRefreshedTime.Add(t.accessTokenTTL - (5 * time.Second)) - accessTokenMaxTTLExpiresInTime = t.accessTokenFetchedTime.Add(t.accessTokenMaxTTL - (5 * time.Second)) - - if nextAccessTokenExpiresInTime.After(accessTokenMaxTTLExpiresInTime) { - // case: Refreshed so close that the next refresh would occur beyond max ttl (this is because currently, token renew tries to add +access-token-ttl amount of time) - // example: access token ttl is 11 sec and max ttl is 30 sec. So it will start with 11 seconds, then 22 seconds but the next time you call refresh it would try to extend it to 33 but max ttl only allows 30, so the token will be valid until 30 before we need to reauth - time.Sleep(t.accessTokenTTL - nextAccessTokenExpiresInTime.Sub(accessTokenMaxTTLExpiresInTime)) - } else { - time.Sleep(t.accessTokenTTL - (5 * time.Second)) - } - } -} - -func (t *MachineIdentityToken) RefreshAccessToken() error { - httpClient := resty.New() - httpClient.SetRetryCount(10000). - SetRetryMaxWaitTime(20 * time.Second). - SetRetryWaitTime(5 * time.Second) - - accessToken, err := t.GetToken() - - if err != nil { - return err - } - - response, err := api.CallUniversalMachineIdentityRefreshAccessToken(api.MachineIdentityUniversalAuthRefreshRequest{AccessToken: accessToken}) - if err != nil { - return err - } - - accessTokenTTL := time.Duration(response.ExpiresIn * int(time.Second)) - accessTokenMaxTTL := time.Duration(response.AccessTokenMaxTTL * int(time.Second)) - t.accessTokenRefreshedTime = time.Now() - - t.SetToken(response.AccessToken, accessTokenTTL, accessTokenMaxTTL) - - return nil -} - -// Fetches a new access token using client credentials -func (t *MachineIdentityToken) FetchNewAccessToken() error { - - loginResponse, err := api.CallUniversalMachineIdentityLogin(api.MachineIdentityUniversalAuthLoginRequest{ - ClientId: t.clientId, - ClientSecret: t.clientSecret, - }) - if err != nil { - return err - } - - accessTokenTTL := time.Duration(loginResponse.ExpiresIn * int(time.Second)) - accessTokenMaxTTL := time.Duration(loginResponse.AccessTokenMaxTTL * int(time.Second)) - - if accessTokenTTL <= time.Duration(5)*time.Second { - fmt.Println("\nInfisical Authentication: At this time, k8 operator does not support refresh of tokens with 5 seconds or less ttl. Please increase access token ttl and try again") - os.Exit(1) - } - - t.accessTokenFetchedTime = time.Now() - t.SetToken(loginResponse.AccessToken, accessTokenTTL, accessTokenMaxTTL) - - return nil -} - -func (t *MachineIdentityToken) SetToken(token string, accessTokenTTL time.Duration, accessTokenMaxTTL time.Duration) { - t.mutex.Lock() - defer t.mutex.Unlock() - - t.accessToken = token - t.accessTokenTTL = accessTokenTTL - t.accessTokenMaxTTL = accessTokenMaxTTL -} - -func (t *MachineIdentityToken) GetToken() (string, error) { - t.mutex.Lock() - defer t.mutex.Unlock() - - if t.accessToken == "" { - return "", fmt.Errorf("no machine identity access token available") - } - - return t.accessToken, nil -} From cc8119766a097b131a6190eb0caa826cccba9640 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:10:56 +0200 Subject: [PATCH 108/187] Feat: Implementation of Go SDK --- k8-operator/packages/util/secrets.go | 30 +++++++++++----------------- 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/k8-operator/packages/util/secrets.go b/k8-operator/packages/util/secrets.go index ee0666ea8..c46617a23 100644 --- a/k8-operator/packages/util/secrets.go +++ b/k8-operator/packages/util/secrets.go @@ -12,6 +12,7 @@ import ( "github.com/Infisical/infisical/k8-operator/packages/crypto" "github.com/Infisical/infisical/k8-operator/packages/model" "github.com/go-resty/resty/v2" + infisical "github.com/infisical/go-sdk" ) type DecodedSymmetricEncryptionDetails = struct { @@ -51,29 +52,26 @@ func GetServiceTokenDetails(infisicalToken string) (api.GetServiceTokenDetailsRe return serviceTokenDetails, nil } -func GetPlainTextSecretsViaUniversalAuth(accessToken string, etag string, secretScope v1alpha1.MachineIdentityScopeInWorkspace) ([]model.SingleEnvironmentVariable, model.RequestUpdateUpdateDetails, error) { +func GetPlainTextSecretsViaMachineIdentity(infisicalClient infisical.InfisicalClientInterface, etag string, secretScope v1alpha1.MachineIdentityScopeInWorkspace) ([]model.SingleEnvironmentVariable, model.RequestUpdateUpdateDetails, error) { - httpClient := resty.New() - httpClient.SetAuthScheme("Bearer") - httpClient.SetAuthToken(accessToken) - - secretsResponse, err := api.CallGetDecryptedSecretsV3(httpClient, api.GetDecryptedSecretsV3Request{ + secrets, err := infisicalClient.Secrets().List(infisical.ListSecretsOptions{ ProjectSlug: secretScope.ProjectSlug, Environment: secretScope.EnvSlug, Recursive: secretScope.Recursive, SecretPath: secretScope.SecretsPath, + IncludeImports: true, ExpandSecretReferences: true, - ETag: etag, }) if err != nil { return nil, model.RequestUpdateUpdateDetails{}, err } - var secrets []model.SingleEnvironmentVariable + var environmentVariables []model.SingleEnvironmentVariable - for _, secret := range secretsResponse.Secrets { - secrets = append(secrets, model.SingleEnvironmentVariable{ + for _, secret := range secrets { + + environmentVariables = append(environmentVariables, model.SingleEnvironmentVariable{ Key: secret.SecretKey, Value: secret.SecretValue, Type: secret.Type, @@ -81,15 +79,11 @@ func GetPlainTextSecretsViaUniversalAuth(accessToken string, etag string, secret }) } - // No need to do expansion for Machine Identity auth as this is handled on server-side. - mergedSecrets := MergeRawImportedSecrets(secrets, secretsResponse.Imports) - if err != nil { - return nil, model.RequestUpdateUpdateDetails{}, err - } + newEtag := crypto.ComputeEtag([]byte(fmt.Sprintf("%v", environmentVariables))) - return mergedSecrets, model.RequestUpdateUpdateDetails{ - Modified: secretsResponse.Modified, - ETag: secretsResponse.ETag, + return environmentVariables, model.RequestUpdateUpdateDetails{ + Modified: etag != newEtag, + ETag: newEtag, }, nil } From 1eae7d0c30abb047612cb8e8f5b292ca45bb94ef Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:12:54 +0200 Subject: [PATCH 109/187] Feat: Full auth method support --- .../controllers/infisicalsecret_controller.go | 4 +- .../controllers/infisicalsecret_helper.go | 208 +++++++++++++----- 2 files changed, 158 insertions(+), 54 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 5eba262ac..5d57dd831 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -10,7 +10,6 @@ import ( ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" - "github.com/Infisical/infisical/k8-operator/api/v1alpha1" secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/packages/api" ) @@ -32,8 +31,9 @@ type InfisicalSecretReconciler struct { // move the current state of the cluster closer to the desired state. // For more details, check Reconcile and its Result here: // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.13.1/pkg/reconcile + func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { - var infisicalSecretCR v1alpha1.InfisicalSecret + var infisicalSecretCR secretsv1alpha1.InfisicalSecret requeueTime := time.Minute // seconds err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR) diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index f0b510a3c..7a1dfc1dd 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -6,8 +6,10 @@ import ( "strings" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" + "github.com/Infisical/infisical/k8-operator/packages/api" "github.com/Infisical/infisical/k8-operator/packages/model" "github.com/Infisical/infisical/k8-operator/packages/util" + infisicalSdk "github.com/infisical/go-sdk" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -15,6 +17,34 @@ import ( ctrl "sigs.k8s.io/controller-runtime" ) +type AuthStrategyType string + +var AuthStrategy = struct { + SERVICE_TOKEN AuthStrategyType + SERVICE_ACCOUNT AuthStrategyType + UNIVERSAL_MACHINE_IDENTITY AuthStrategyType + KUBERNETES_MACHINE_IDENTITY AuthStrategyType + AWS_IAM_MACHINE_IDENTITY AuthStrategyType + AZURE_MACHINE_IDENTITY AuthStrategyType + GCP_ID_TOKEN_MACHINE_IDENTITY AuthStrategyType + GCP_IAM_MACHINE_IDENTITY AuthStrategyType +}{ + SERVICE_TOKEN: "SERVICE_TOKEN", + SERVICE_ACCOUNT: "SERVICE_ACCOUNT", + UNIVERSAL_MACHINE_IDENTITY: "UNIVERSAL_MACHINE_IDENTITY", + KUBERNETES_MACHINE_IDENTITY: "KUBERNETES_AUTH_MACHINE_IDENTITY", + AWS_IAM_MACHINE_IDENTITY: "AWS_IAM_MACHINE_IDENTITY", + AZURE_MACHINE_IDENTITY: "AZURE_MACHINE_IDENTITY", + GCP_ID_TOKEN_MACHINE_IDENTITY: "GCP_ID_TOKEN_MACHINE_IDENTITY", + GCP_IAM_MACHINE_IDENTITY: "GCP_IAM_MACHINE_IDENTITY", +} + +type AuthenticationDetails struct { + authStrategy AuthStrategyType + machineIdentityScope v1alpha1.MachineIdentityScopeInWorkspace // This will only be set if a machine identity auth method is used (e.g. UniversalAuth or KubernetesAuth, etc.) + isMachineIdentityAuth bool +} + const SERVICE_ACCOUNT_ACCESS_KEY = "serviceAccountAccessKey" const SERVICE_ACCOUNT_PUBLIC_KEY = "serviceAccountPublicKey" const SERVICE_ACCOUNT_PRIVATE_KEY = "serviceAccountPrivateKey" @@ -28,20 +58,103 @@ const OPERATOR_SETTINGS_CONFIGMAP_NAME = "infisical-config" const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system" const INFISICAL_DOMAIN = "https://app.infisical.com/api" -type AuthStrategyType string +var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) +var authDetails AuthenticationDetails + +func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + + // Legacy support, service token auth + infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err) + } + + // Legacy support, service account auth + serviceAccountCreds, err := r.GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err) + } + // Machine Identities: + universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get machine identity creds from kube secret [err=%s]", err) + } + + universalAuthSpec := infisicalSecret.Spec.Authentication.UniversalAuth + kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth + awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth + azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth + gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth + gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth + + if serviceAccountCreds.AccessKey != "" || serviceAccountCreds.PrivateKey != "" || serviceAccountCreds.PublicKey != "" { + return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_ACCOUNT}, nil + } else if infisicalToken != "" { + return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil + } + + if universalAuthKubeSecret.ClientId != "" && universalAuthKubeSecret.ClientSecret != "" { + _, err := infisicalClient.Auth().UniversalAuthLogin(universalAuthKubeSecret.ClientId, universalAuthKubeSecret.ClientSecret) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with machine identity credentials [err=%s]", err) + } + + fmt.Println("Successfully authenticated with machine identity credentials") + + return AuthenticationDetails{authStrategy: AuthStrategy.UNIVERSAL_MACHINE_IDENTITY, machineIdentityScope: universalAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + + } + if kubernetesAuthSpec.IdentityID != "" { + _, err := infisicalClient.Auth().KubernetesAuthLogin(kubernetesAuthSpec.IdentityID, kubernetesAuthSpec.ServiceAccountTokenPath) + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with Kubernetes native auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.KUBERNETES_MACHINE_IDENTITY, machineIdentityScope: kubernetesAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + } + if awsIamAuthSpec.IdentityID != "" { + _, err := infisicalClient.Auth().AwsIamAuthLogin(awsIamAuthSpec.IdentityID) + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with AWS IAM auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.AWS_IAM_MACHINE_IDENTITY, machineIdentityScope: awsIamAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + } + if azureAuthSpec.IdentityID != "" { + _, err := infisicalClient.Auth().AzureAuthLogin(azureAuthSpec.IdentityID) + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with Azure auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.AZURE_MACHINE_IDENTITY, machineIdentityScope: azureAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + } + if gcpIdTokenSpec.IdentityID != "" { + _, err := infisicalClient.Auth().GcpIdTokenAuthLogin(gcpIdTokenSpec.IdentityID) + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP Id Token auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY, machineIdentityScope: gcpIdTokenSpec.SecretsScope, isMachineIdentityAuth: true}, nil + } + if gcpIamSpec.IdentityID != "" && gcpIamSpec.ServiceAccountKeyFilePath != "" { + _, err := infisicalClient.Auth().GcpIamAuthLogin(gcpIamSpec.IdentityID, gcpIamSpec.ServiceAccountKeyFilePath) + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP IAM auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.GCP_IAM_MACHINE_IDENTITY, machineIdentityScope: gcpIamSpec.SecretsScope, isMachineIdentityAuth: true}, nil + } + + return AuthenticationDetails{}, nil -var AuthStrategy = struct { - SERVICE_TOKEN AuthStrategyType - SERVICE_ACCOUNT AuthStrategyType - UNIVERSAL_MACHINE_IDENTITY AuthStrategyType -}{ - SERVICE_TOKEN: "SERVICE_TOKEN", - SERVICE_ACCOUNT: "SERVICE_ACCOUNT", - UNIVERSAL_MACHINE_IDENTITY: "UNIVERSAL_MACHINE_IDENTITY", } -var machineIdentityTokenInstance *util.MachineIdentityToken - func (r *InfisicalSecretReconciler) GetInfisicalConfigMap(ctx context.Context) (configMap map[string]string, errToReturn error) { // default key values defaultConfigMapData := make(map[string]string) @@ -244,36 +357,21 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context } func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error { - infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) - if err != nil { - return fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err) - } + // We can't set these values when instantiating the client because we can't be sure that the variables have been populated yet. So instead we're updating the configuration here. This will happen on each reconcile, which is fine. + infisicalClient.UpdateConfiguration(infisicalSdk.Config{ + SiteUrl: api.API_HOST_URL, + UserAgent: api.USER_AGENT_NAME, + }) - var authStrategy AuthStrategyType + if authDetails.authStrategy == "" { + fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") + details, err := r.HandleAuthentication(ctx, infisicalSecret) - serviceAccountCreds, err := r.GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret) - if err != nil { - return fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err) - } + if err != nil { + return fmt.Errorf("unable to authenticate [err=%s]", err) + } - infisicalMachineIdentityCreds, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) - if err != nil { - return fmt.Errorf("ReconcileInfisicalSecret: unable to get machine identity creds from kube secret [err=%s]", err) - } - - if serviceAccountCreds.AccessKey != "" || serviceAccountCreds.PrivateKey != "" || serviceAccountCreds.PublicKey != "" { - authStrategy = AuthStrategy.SERVICE_ACCOUNT - } else if infisicalToken != "" { - authStrategy = AuthStrategy.SERVICE_TOKEN - } else if infisicalMachineIdentityCreds.ClientId != "" && infisicalMachineIdentityCreds.ClientSecret != "" { - authStrategy = AuthStrategy.UNIVERSAL_MACHINE_IDENTITY - } else { - return fmt.Errorf("no authentication method provided. You must provide either a valid service token or a service account details to fetch secrets\n") - } - - r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, err) - if err != nil { - return fmt.Errorf("unable to load Infisical Token from the specified Kubernetes secret with error [%w]", err) + authDetails = details } // Look for managed secret by name and namespace @@ -292,15 +390,20 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context secretVersionBasedOnETag = managedKubeSecret.Annotations[SECRET_VERSION_ANNOTATION] } - if authStrategy == AuthStrategy.UNIVERSAL_MACHINE_IDENTITY && machineIdentityTokenInstance == nil { - // Create new machine identity token instance - machineIdentityTokenInstance = util.NewMachineIdentityToken(infisicalMachineIdentityCreds.ClientId, infisicalMachineIdentityCreds.ClientSecret) - } - var plainTextSecretsFromApi []model.SingleEnvironmentVariable var updateDetails model.RequestUpdateUpdateDetails - if authStrategy == AuthStrategy.SERVICE_ACCOUNT { // Service Account + if authDetails.authStrategy == AuthStrategy.SERVICE_ACCOUNT { // Service Account // ! Legacy auth method + serviceAccountCreds, err := r.GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret) + if err != nil { + return fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err) + } + + r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, err) + if err != nil { + return fmt.Errorf("unable to load Infisical Token from the specified Kubernetes secret with error [%w]", err) + } + plainTextSecretsFromApi, updateDetails, err = util.GetPlainTextSecretsViaServiceAccount(serviceAccountCreds, infisicalSecret.Spec.Authentication.ServiceAccount.ProjectId, infisicalSecret.Spec.Authentication.ServiceAccount.EnvironmentName, secretVersionBasedOnETag) if err != nil { return fmt.Errorf("\nfailed to get secrets because [err=%v]", err) @@ -308,7 +411,12 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context fmt.Println("ReconcileInfisicalSecret: Fetched secrets via service account") - } else if authStrategy == AuthStrategy.SERVICE_TOKEN { // Service Tokens (deprecated) + } else if authDetails.authStrategy == AuthStrategy.SERVICE_TOKEN { // Service Tokens // ! Legacy / Deprecated auth method + infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) + if err != nil { + return fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err) + } + envSlug := infisicalSecret.Spec.Authentication.ServiceToken.SecretsScope.EnvSlug secretsPath := infisicalSecret.Spec.Authentication.ServiceToken.SecretsScope.SecretsPath recursive := infisicalSecret.Spec.Authentication.ServiceToken.SecretsScope.Recursive @@ -319,15 +427,11 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } fmt.Println("ReconcileInfisicalSecret: Fetched secrets via service token") - } else if authStrategy == AuthStrategy.UNIVERSAL_MACHINE_IDENTITY { // Machine Identity + } else if authDetails.isMachineIdentityAuth { // * Machine Identity authentication, the SDK will be authenticated at this point - accessToken, err := machineIdentityTokenInstance.GetToken() + fmt.Println("ReconcileInfisicalSecret: Fetching secrets via machine identity") - if err != nil { - return fmt.Errorf("%s", "Waiting for access token to become available") - } - scope := infisicalSecret.Spec.Authentication.UniversalAuth.SecretsScope - plainTextSecretsFromApi, updateDetails, err = util.GetPlainTextSecretsViaUniversalAuth(accessToken, secretVersionBasedOnETag, scope) + plainTextSecretsFromApi, updateDetails, err = util.GetPlainTextSecretsViaMachineIdentity(infisicalClient, secretVersionBasedOnETag, authDetails.machineIdentityScope) if err != nil { return fmt.Errorf("\nfailed to get secrets because [err=%v]", err) From 9197530b436f3dc8fdc8947b4d77f54322882c60 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 02:37:09 +0200 Subject: [PATCH 110/187] Docs --- docs/integrations/platforms/kubernetes.mdx | 350 ++++++++++++++++++--- k8-operator/config/samples/sample.yaml | 1 + 2 files changed, 316 insertions(+), 35 deletions(-) diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx index 41a41726c..4a68f7365 100644 --- a/docs/integrations/platforms/kubernetes.mdx +++ b/docs/integrations/platforms/kubernetes.mdx @@ -58,46 +58,106 @@ Once you apply the manifest, the operator will be installed in `infisical-operat Once you have installed the operator to your cluster, you'll need to create a `InfisicalSecret` custom resource definition (CRD). ```yaml example-infisical-secret-crd.yaml + apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: - name: infisicalsecret-sample - labels: - label-to-be-passed-to-managed-secret: sample-value - annotations: - example.com/annotation-to-be-passed-to-managed-secret: "sample-value" + name: infisicalsecret-sample + labels: + label-to-be-passed-to-managed-secret: sample-value + annotations: + example.com/annotation-to-be-passed-to-managed-secret: "sample-value" spec: - hostAPI: https://app.infisical.com/api - resyncInterval: 10 - authentication: - # Make sure to only have 1 authentication method defined, serviceToken/universalAuth. - # If you have multiple authentication methods defined, it may cause issues. - universalAuth: - secretsScope: - projectSlug: - envSlug: # "dev", "staging", "prod", etc.. - secretsPath: "" # Root is "/" - recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false. - - credentialsRef: - secretName: universal-auth-credentials - secretNamespace: default + hostAPI: https://app.infisical.com/api + resyncInterval: 10 + authentication: + # Make sure to only have 1 authentication method defined, serviceToken/universalAuth. + # If you have multiple authentication methods defined, it may cause issues. + + # (Deprecated) Service Token Auth + serviceToken: + serviceTokenSecretReference: + secretName: service-token + secretNamespace: default + secretsScope: + envSlug: + secretsPath: + recursive: true + + # Universal Auth + universalAuth: + secretsScope: + projectSlug: new-ob-em + envSlug: dev # "dev", "staging", "prod", etc.. + secretsPath: "/" # Root is "/" + recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false + credentialsRef: + secretName: universal-auth-credentials + secretNamespace: default + + # Native Kubernetes Auth + kubernetesAuth: + identityId: + serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # AWS IAM Auth + awsIamAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # Azure Auth + azureAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # GCP ID Token Auth + gcpIdTokenAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + # GCP IAM Auth + gcpIamAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + + managedSecretReference: + secretName: managed-secret + secretNamespace: default + creationPolicy: "Orphan" ## Owner | Orphan + # secretType: kubernetes.io/dockerconfigjson - # Service tokens are deprecated and will be removed in the near future. Please use Machine Identities for authenticating with Infisical. - serviceToken: - serviceTokenSecretReference: - secretName: service-token - secretNamespace: default - secretsScope: - envSlug: - secretsPath: # Root is "/" - recursive: true # Fetch all secrets from the specified path and all sub-directories. Default is false. - managedSecretReference: - secretName: managed-secret - secretNamespace: default - creationPolicy: "Orphan" ## Owner | Orphan (default) - # secretType: kubernetes.io/dockerconfigjson ``` ### InfisicalSecret CRD properties @@ -156,7 +216,7 @@ When `hostAPI` is not defined the operator fetches secrets from Infisical Cloud. -{" "} + Make sure to also populate the `secretsScope` field with the project slug @@ -187,6 +247,226 @@ spec: + + The Kubernetes machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalSecret resource. This authentication method can only be used within a Kubernetes environment. + + + + You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about Kubernetes machine identities here](/documentation/platform/identities/kubernetes-auth). + + + Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.kubernetesAuth.identityId` field, add the identity ID of the machine identity you created. See the example below for more details. + + + + + + Make sure to also populate the `secretsScope` field with the project slug + _`projectSlug`_, environment slug _`envSlug`_, and secrets path + _`secretsPath`_ that you want to fetch secrets from. Please see the example + below. + + +## Example + +```yaml example-kubernetes-auth.yaml +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample-crd +spec: + authentication: + kubernetesAuth: + identityId: + serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + ... +``` + + + + + The AWS IAM machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalSecret resource. This authentication method can only be used within an AWS environment like an EC2 or a Lambda function. + + + + You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about AWS machine identities here](/documentation/platform/identities/aws-auth). + + + Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.awsIamAuth.identityId` field, add the identity ID of the machine identity you created. See the example below for more details. + + + + + + Make sure to also populate the `secretsScope` field with the project slug + _`projectSlug`_, environment slug _`envSlug`_, and secrets path + _`secretsPath`_ that you want to fetch secrets from. Please see the example + below. + + +## Example + +```yaml example-aws-iam-auth.yaml +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample-crd +spec: + authentication: + awsIamAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + ... +``` + + + + + The Azure machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalSecret resource. This authentication method can only be used within an Azure environment. + + + + You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about Azure machine identities here](/documentation/platform/identities/azure-auth). + + + Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.azureAuth.identityId` field, add the identity ID of the machine identity you created. See the example below for more details. + + + + + + Make sure to also populate the `secretsScope` field with the project slug + _`projectSlug`_, environment slug _`envSlug`_, and secrets path + _`secretsPath`_ that you want to fetch secrets from. Please see the example + below. + + +## Example + +```yaml example-azure-auth.yaml +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample-crd +spec: + authentication: + azureAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + ... +``` + + + + + The GCP ID Token machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalSecret resource. This authentication method can only be used within GCP environments. + + + + You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about GCP machine identities here](/documentation/platform/identities/gcp-auth). + + + Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.gcpIdTokenAuth.identityId` field, add the identity ID of the machine identity you created. See the example below for more details. + + + + + + Make sure to also populate the `secretsScope` field with the project slug + _`projectSlug`_, environment slug _`envSlug`_, and secrets path + _`secretsPath`_ that you want to fetch secrets from. Please see the example + below. + + +## Example + +```yaml example-gcp-id-token-auth.yaml +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample-crd +spec: + authentication: + gcpIdTokenAuth: + identityId: + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + ... +``` + + + + + + + The GCP IAM machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalSecret resource. This authentication method can only be used both within and outside GCP environments. + + + + You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about GCP machine identities here](/documentation/platform/identities/gcp-auth). + + + Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.gcpIamAuth.identityId` field, add the identity ID of the machine identity you created. + You'll also need to add the service account key file path to your InfisicalSecret resource. In the `authentication.gcpIamAuth.serviceAccountKeyFilePath` field, add the path to your service account key file path. Please see the example below for more details. + + + + + + Make sure to also populate the `secretsScope` field with the project slug + _`projectSlug`_, environment slug _`envSlug`_, and secrets path + _`secretsPath`_ that you want to fetch secrets from. Please see the example + below. + + +## Example + +```yaml example-gcp-id-token-auth.yaml +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample-crd +spec: + authentication: + gcpIamAuth: + identityId: + serviceAccountKeyFilePath: "/path/to-service-account-key-file-path.json" + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: your-project-slug + envSlug: prod + secretsPath: "/path" + recursive: true + ... +``` + + + Service tokens are being deprecated in favor of [machine identities](/documentation/platform/identities/machine-identities). diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/sample.yaml index 5d14401a5..6652b8160 100644 --- a/k8-operator/config/samples/sample.yaml +++ b/k8-operator/config/samples/sample.yaml @@ -82,6 +82,7 @@ spec: # GCP IAM Auth gcpIamAuth: identityId: + serviceAccountKeyFilePath: "/path/to-service-account-key-file-path.json" # secretsScope is identical to the secrets scope in the universalAuth field in this sample. secretsScope: From cb9dabe03f0bf6f40dd22e70b278db7cb22b356e Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Tue, 11 Jun 2024 18:41:35 -0700 Subject: [PATCH 111/187] Delete unaccepted users upon merge user op --- backend/src/services/user/user-dal.ts | 9 --------- backend/src/services/user/user-service.ts | 21 ++++++++++++++++++--- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/backend/src/services/user/user-dal.ts b/backend/src/services/user/user-dal.ts index d0b03019f..f2da0df0e 100644 --- a/backend/src/services/user/user-dal.ts +++ b/backend/src/services/user/user-dal.ts @@ -94,14 +94,6 @@ export const userDALFactory = (db: TDbClient) => { } }; - const findMergeableUsers = async (email: string, tx?: Knex) => { - const users = await (tx || db)(TableName.Users).where((builder) => { - void builder.where({ email, isEmailVerified: true }).orWhere({ email, isAccepted: false }); - }); - - return users; - }; - const updateUserEncryptionByUserId = async (userId: string, data: TUserEncryptionKeysUpdate, tx?: Knex) => { try { const [userEnc] = await (tx || db)(TableName.UserEncryptionKey) @@ -162,7 +154,6 @@ export const userDALFactory = (db: TDbClient) => { findUsersByProjectMembershipIds, upsertUserEncryptionKey, createUserEncryption, - findMergeableUsers, findOneUserAction, createUserAction }; diff --git a/backend/src/services/user/user-service.ts b/backend/src/services/user/user-service.ts index f04e0b35f..693078fbd 100644 --- a/backend/src/services/user/user-service.ts +++ b/backend/src/services/user/user-service.ts @@ -12,7 +12,6 @@ type TUserServiceFactoryDep = { userDAL: Pick< TUserDALFactory, | "find" - | "findMergeableUsers" | "findOne" | "findById" | "transaction" @@ -22,6 +21,7 @@ type TUserServiceFactoryDep = { | "findOneUserAction" | "createUserAction" | "findUserEncKeyByUserId" + | "delete" >; userAliasDAL: Pick; orgMembershipDAL: Pick; @@ -86,8 +86,14 @@ export const userServiceFactory = ({ tx ); - // check if there are users with the same email. - const users = await userDAL.findMergeableUsers(email, tx); + // check if there are verified users with the same email. + const users = await userDAL.find( + { + email, + isEmailVerified: true + }, + { tx } + ); if (users.length > 1) { // merge users @@ -129,6 +135,15 @@ export const userServiceFactory = ({ ); } } else { + await userDAL.delete( + { + email, + isAccepted: false, + isEmailVerified: false + }, + tx + ); + // update current user's username to [email] await userDAL.updateById( user.id, From e6ed1231cd99d946009273aa72bc52627cf538b8 Mon Sep 17 00:00:00 2001 From: ShubhamPalriwala Date: Wed, 12 Jun 2024 10:24:36 +0530 Subject: [PATCH 112/187] feat: custom rate limit for self hosters --- backend/src/@types/fastify.d.ts | 2 + backend/src/@types/knex.d.ts | 4 + ...327_custom-rate-limits-for-self-hosting.ts | 28 +++ backend/src/db/schemas/index.ts | 1 + backend/src/db/schemas/models.ts | 1 + backend/src/db/schemas/rate-limit.ts | 26 ++ backend/src/server/app.ts | 2 +- backend/src/server/config/rateLimiter.ts | 53 ++-- backend/src/server/routes/index.ts | 7 + backend/src/server/routes/v1/index.ts | 2 + .../src/server/routes/v1/rate-limit-router.ts | 58 +++++ .../src/services/rate-limit/rate-limit-dal.ts | 7 + .../services/rate-limit/rate-limit-service.ts | 44 ++++ .../services/rate-limit/rate-limit-types.ts | 16 ++ frontend/src/hooks/api/rateLimit/index.ts | 2 + frontend/src/hooks/api/rateLimit/mutation.ts | 21 ++ frontend/src/hooks/api/rateLimit/queries.ts | 34 +++ frontend/src/hooks/api/rateLimit/types.ts | 10 + .../admin/DashboardPage/DashboardPage.tsx | 237 +++++++++++++++++- 19 files changed, 535 insertions(+), 20 deletions(-) create mode 100644 backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts create mode 100644 backend/src/db/schemas/rate-limit.ts create mode 100644 backend/src/server/routes/v1/rate-limit-router.ts create mode 100644 backend/src/services/rate-limit/rate-limit-dal.ts create mode 100644 backend/src/services/rate-limit/rate-limit-service.ts create mode 100644 backend/src/services/rate-limit/rate-limit-types.ts create mode 100644 frontend/src/hooks/api/rateLimit/index.ts create mode 100644 frontend/src/hooks/api/rateLimit/mutation.ts create mode 100644 frontend/src/hooks/api/rateLimit/queries.ts create mode 100644 frontend/src/hooks/api/rateLimit/types.ts diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index 3f1ca94e9..81fc0c541 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -48,6 +48,7 @@ import { TProjectEnvServiceFactory } from "@app/services/project-env/project-env import { TProjectKeyServiceFactory } from "@app/services/project-key/project-key-service"; import { TProjectMembershipServiceFactory } from "@app/services/project-membership/project-membership-service"; import { TProjectRoleServiceFactory } from "@app/services/project-role/project-role-service"; +import { TRateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; import { TSecretServiceFactory } from "@app/services/secret/secret-service"; import { TSecretBlindIndexServiceFactory } from "@app/services/secret-blind-index/secret-blind-index-service"; import { TSecretFolderServiceFactory } from "@app/services/secret-folder/secret-folder-service"; @@ -147,6 +148,7 @@ declare module "fastify" { projectUserAdditionalPrivilege: TProjectUserAdditionalPrivilegeServiceFactory; identityProjectAdditionalPrivilege: TIdentityProjectAdditionalPrivilegeServiceFactory; secretSharing: TSecretSharingServiceFactory; + rateLimit: TRateLimitServiceFactory; }; // this is exclusive use for middlewares in which we need to inject data // everywhere else access using service layer diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index 117a74e76..fbcaa3528 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -149,6 +149,9 @@ import { TProjectUserMembershipRoles, TProjectUserMembershipRolesInsert, TProjectUserMembershipRolesUpdate, + TRateLimit, + TRateLimitInsert, + TRateLimitUpdate, TSamlConfigs, TSamlConfigsInsert, TSamlConfigsUpdate, @@ -343,6 +346,7 @@ declare module "knex/types/tables" { TSecretFolderVersionsUpdate >; [TableName.SecretSharing]: Knex.CompositeTableType; + [TableName.RateLimit]: Knex.CompositeTableType; [TableName.SecretTag]: Knex.CompositeTableType; [TableName.SecretImport]: Knex.CompositeTableType; [TableName.Integration]: Knex.CompositeTableType; diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts new file mode 100644 index 000000000..196b8cdb3 --- /dev/null +++ b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts @@ -0,0 +1,28 @@ +import { Knex } from "knex"; + +import { TableName } from "../schemas"; +import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; + +export async function up(knex: Knex): Promise { + if (!(await knex.schema.hasTable(TableName.RateLimit))) { + await knex.schema.createTable(TableName.RateLimit, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.integer("readRateLimit").defaultTo(600).notNullable(); + t.integer("writeRateLimit").defaultTo(200).notNullable(); + t.integer("secretsRateLimit").defaultTo(60).notNullable(); + t.integer("authRateLimit").defaultTo(60).notNullable(); + t.integer("inviteUserRateLimit").defaultTo(30).notNullable(); + t.integer("mfaRateLimit").defaultTo(20).notNullable(); + t.integer("creationLimit").defaultTo(30).notNullable(); + t.integer("publicEndpointLimit").defaultTo(30).notNullable(); + t.timestamps(true, true, true); + }); + + await createOnUpdateTrigger(knex, TableName.RateLimit); + } +} + +export async function down(knex: Knex): Promise { + await knex.schema.dropTableIfExists(TableName.RateLimit); + await dropOnUpdateTrigger(knex, TableName.RateLimit); +} diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index 1eaa86c87..5771cb669 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -48,6 +48,7 @@ export * from "./project-roles"; export * from "./project-user-additional-privilege"; export * from "./project-user-membership-roles"; export * from "./projects"; +export * from "./rate-limit"; export * from "./saml-configs"; export * from "./scim-tokens"; export * from "./secret-approval-policies"; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index f9c8436df..5d2213003 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -18,6 +18,7 @@ export enum TableName { IncidentContact = "incident_contacts", UserAction = "user_actions", SuperAdmin = "super_admin", + RateLimit = "rate_limit", ApiKey = "api_keys", Project = "projects", ProjectBot = "project_bots", diff --git a/backend/src/db/schemas/rate-limit.ts b/backend/src/db/schemas/rate-limit.ts new file mode 100644 index 000000000..86b8776cc --- /dev/null +++ b/backend/src/db/schemas/rate-limit.ts @@ -0,0 +1,26 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const RateLimitSchema = z.object({ + id: z.string().uuid(), + readRateLimit: z.number().default(600), + writeRateLimit: z.number().default(200), + secretsRateLimit: z.number().default(60), + authRateLimit: z.number().default(60), + inviteUserRateLimit: z.number().default(30), + mfaRateLimit: z.number().default(20), + creationLimit: z.number().default(30), + publicEndpointLimit: z.number().default(30), + createdAt: z.date(), + updatedAt: z.date() +}); + +export type TRateLimit = z.infer; +export type TRateLimitInsert = Omit, TImmutableDBKeys>; +export type TRateLimitUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index 51cef185a..21721bd5d 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -69,7 +69,7 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { // Rate limiters and security headers if (appCfg.isProductionMode) { - await server.register(ratelimiter, globalRateLimiterCfg()); + await server.register(ratelimiter, await globalRateLimiterCfg(db)); } await server.register(helmet, { contentSecurityPolicy: false }); diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 8c41eb2fa..48d7e41b1 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -1,22 +1,10 @@ import type { RateLimitOptions, RateLimitPluginOptions } from "@fastify/rate-limit"; import { Redis } from "ioredis"; +import { Knex } from "knex"; import { getConfig } from "@app/lib/config/env"; - -export const globalRateLimiterCfg = (): RateLimitPluginOptions => { - const appCfg = getConfig(); - const redis = appCfg.isRedisConfigured - ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) - : null; - - return { - timeWindow: 60 * 1000, - max: 600, - redis, - allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status", - keyGenerator: (req) => req.realIp - }; -}; +import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal"; +import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; // GET endpoints export const readLimit: RateLimitOptions = { @@ -74,3 +62,38 @@ export const publicEndpointLimit: RateLimitOptions = { max: 30, keyGenerator: (req) => req.realIp }; + +async function fetchRateLimitsFromDb(db: Knex) { + try { + const rateLimitDAL = rateLimitDALFactory(db); + const rateLimits = await rateLimitServiceFactory({ rateLimitDAL }).getRateLimits(); + + readLimit.max = rateLimits.readRateLimit; + publicEndpointLimit.max = rateLimits.publicEndpointLimit; + writeLimit.max = rateLimits.writeRateLimit; + secretsLimit.max = rateLimits.secretsRateLimit; + authRateLimit.max = rateLimits.authRateLimit; + inviteUserRateLimit.max = rateLimits.inviteUserRateLimit; + mfaRateLimit.max = rateLimits.mfaRateLimit; + creationLimit.max = rateLimits.creationLimit; + } catch (error) { + console.error("Error fetching rate limits:", error); + } +} + +export const globalRateLimiterCfg = async (db: Knex): Promise => { + const appCfg = getConfig(); + const redis = appCfg.isRedisConfigured + ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) + : null; + + await fetchRateLimitsFromDb(db); + + return { + timeWindow: 60 * 1000, + max: 600, + redis, + allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status", + keyGenerator: (req) => req.realIp + }; +}; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 00590386a..f6fe80efe 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -121,6 +121,8 @@ import { projectMembershipServiceFactory } from "@app/services/project-membershi import { projectUserMembershipRoleDALFactory } from "@app/services/project-membership/project-user-membership-role-dal"; import { projectRoleDALFactory } from "@app/services/project-role/project-role-dal"; import { projectRoleServiceFactory } from "@app/services/project-role/project-role-service"; +import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal"; +import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; import { dailyResourceCleanUpQueueServiceFactory } from "@app/services/resource-cleanup/resource-cleanup-queue"; import { secretDALFactory } from "@app/services/secret/secret-dal"; import { secretQueueFactory } from "@app/services/secret/secret-queue"; @@ -185,6 +187,7 @@ export const registerRoutes = async ( const incidentContactDAL = incidentContactDALFactory(db); const orgRoleDAL = orgRoleDALFactory(db); const superAdminDAL = superAdminDALFactory(db); + const rateLimitDAL = rateLimitDALFactory(db); const apiKeyDAL = apiKeyDALFactory(db); const projectDAL = projectDALFactory(db); @@ -444,6 +447,9 @@ export const registerRoutes = async ( orgService, keyStore }); + const rateLimitService = rateLimitServiceFactory({ + rateLimitDAL + }); const apiKeyService = apiKeyServiceFactory({ apiKeyDAL, userDAL }); const secretScanningQueue = secretScanningQueueFactory({ @@ -859,6 +865,7 @@ export const registerRoutes = async ( secret: secretService, secretReplication: secretReplicationService, secretTag: secretTagService, + rateLimit: rateLimitService, folder: folderService, secretImport: secretImportService, projectBot: projectBotService, diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts index cbf67ce79..fd8255e63 100644 --- a/backend/src/server/routes/v1/index.ts +++ b/backend/src/server/routes/v1/index.ts @@ -17,6 +17,7 @@ import { registerProjectEnvRouter } from "./project-env-router"; import { registerProjectKeyRouter } from "./project-key-router"; import { registerProjectMembershipRouter } from "./project-membership-router"; import { registerProjectRouter } from "./project-router"; +import { registerRateLimitRouter } from "./rate-limit-router"; import { registerSecretFolderRouter } from "./secret-folder-router"; import { registerSecretImportRouter } from "./secret-import-router"; import { registerSecretSharingRouter } from "./secret-sharing-router"; @@ -43,6 +44,7 @@ export const registerV1Routes = async (server: FastifyZodProvider) => { await server.register(registerPasswordRouter, { prefix: "/password" }); await server.register(registerOrgRouter, { prefix: "/organization" }); await server.register(registerAdminRouter, { prefix: "/admin" }); + await server.register(registerRateLimitRouter, { prefix: "/rate-limit" }); await server.register(registerUserRouter, { prefix: "/user" }); await server.register(registerInviteOrgRouter, { prefix: "/invite-org" }); await server.register(registerUserActionRouter, { prefix: "/user-action" }); diff --git a/backend/src/server/routes/v1/rate-limit-router.ts b/backend/src/server/routes/v1/rate-limit-router.ts new file mode 100644 index 000000000..1ea14d0b4 --- /dev/null +++ b/backend/src/server/routes/v1/rate-limit-router.ts @@ -0,0 +1,58 @@ +import { z } from "zod"; + +import { RateLimitSchema } from "@app/db/schemas"; +import { readLimit } from "@app/server/config/rateLimiter"; +import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin"; +import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { AuthMode } from "@app/services/auth/auth-type"; + +export const registerRateLimitRouter = async (server: FastifyZodProvider) => { + server.route({ + method: "GET", + url: "/", + config: { + rateLimit: readLimit + }, + schema: { + response: { + 200: z.object({ + rateLimit: RateLimitSchema + }) + } + }, + handler: async () => { + const rateLimit = await server.services.rateLimit.getRateLimits(); + return { rateLimit }; + } + }); + + server.route({ + method: "PATCH", + url: "/", + config: { + rateLimit: readLimit + }, + onRequest: (req, res, done) => { + verifyAuth([AuthMode.JWT, AuthMode.API_KEY])(req, res, () => { + verifySuperAdmin(req, res, done); + }); + }, + + schema: { + body: RateLimitSchema.omit({ + id: true, + createdAt: true, + updatedAt: true + }), + response: { + 200: z.object({ + rateLimit: RateLimitSchema + }) + } + }, + handler: async (req) => { + const rateLimit = await server.services.rateLimit.updateRateLimit(req.body); + return { rateLimit }; + } + }); +}; diff --git a/backend/src/services/rate-limit/rate-limit-dal.ts b/backend/src/services/rate-limit/rate-limit-dal.ts new file mode 100644 index 000000000..7279ff8ea --- /dev/null +++ b/backend/src/services/rate-limit/rate-limit-dal.ts @@ -0,0 +1,7 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TRateLimitDALFactory = ReturnType; + +export const rateLimitDALFactory = (db: TDbClient) => ormify(db, TableName.RateLimit, {}); diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts new file mode 100644 index 000000000..d510cb056 --- /dev/null +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -0,0 +1,44 @@ +import { BadRequestError } from "@app/lib/errors"; + +import { TRateLimitDALFactory } from "./rate-limit-dal"; +import { TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types"; + +type TRateLimitServiceFactoryDep = { + rateLimitDAL: TRateLimitDALFactory; +}; + +export type TRateLimitServiceFactory = ReturnType; + +export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFactoryDep) => { + const initRateLimits = async (): Promise => { + const rateLimit = await rateLimitDAL.create({}); + return rateLimit; + }; + + const getRateLimits = async (): Promise => { + let rateLimit = (await rateLimitDAL.find({}))[0]; + if (!rateLimit) { + rateLimit = await initRateLimits(); + } + return rateLimit; + }; + + const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise => { + const rateLimit = await rateLimitDAL.findOne({}); + if (!rateLimit) throw new BadRequestError({ name: "Rate Limit Update", message: "Rate Limit does not exist yet" }); + + const updateData: Record = {}; + for (const [key, value] of Object.entries(updates)) { + updateData[key] = value; + } + + const updatedRateLimit = await rateLimitDAL.updateById(rateLimit.id, updateData); + return updatedRateLimit; + }; + + return { + initRateLimits, + getRateLimits, + updateRateLimit + }; +}; diff --git a/backend/src/services/rate-limit/rate-limit-types.ts b/backend/src/services/rate-limit/rate-limit-types.ts new file mode 100644 index 000000000..19519aafb --- /dev/null +++ b/backend/src/services/rate-limit/rate-limit-types.ts @@ -0,0 +1,16 @@ +export type TRateLimitUpdateDTO = { + readRateLimit: number; + writeRateLimit: number; + secretsRateLimit: number; + authRateLimit: number; + inviteUserRateLimit: number; + mfaRateLimit: number; + creationLimit: number; + publicEndpointLimit: number; +}; + +export type TRateLimit = { + id: string; + createdAt: Date; + updatedAt: Date; +} & TRateLimitUpdateDTO; diff --git a/frontend/src/hooks/api/rateLimit/index.ts b/frontend/src/hooks/api/rateLimit/index.ts new file mode 100644 index 000000000..f3f81b1c9 --- /dev/null +++ b/frontend/src/hooks/api/rateLimit/index.ts @@ -0,0 +1,2 @@ +export { useUpdateRateLimit } from "./mutation"; +export { useGetRateLimit } from "./queries"; diff --git a/frontend/src/hooks/api/rateLimit/mutation.ts b/frontend/src/hooks/api/rateLimit/mutation.ts new file mode 100644 index 000000000..e2cccf78f --- /dev/null +++ b/frontend/src/hooks/api/rateLimit/mutation.ts @@ -0,0 +1,21 @@ +import { useMutation, useQueryClient } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { rateLimitQueryKeys } from "./queries"; +import { TRateLimit } from "./types"; + +export const useUpdateRateLimit = () => { + const queryClient = useQueryClient(); + + return useMutation>({ + mutationFn: async (opt) => { + const { data } = await apiRequest.patch<{ rateLimit: TRateLimit }>("/api/v1/rate-limit", opt); + return data.rateLimit; + }, + onSuccess: (data) => { + queryClient.setQueryData(rateLimitQueryKeys.rateLimit(), data); + queryClient.invalidateQueries(rateLimitQueryKeys.rateLimit()); + } + }); +}; diff --git a/frontend/src/hooks/api/rateLimit/queries.ts b/frontend/src/hooks/api/rateLimit/queries.ts new file mode 100644 index 000000000..5a52ff74b --- /dev/null +++ b/frontend/src/hooks/api/rateLimit/queries.ts @@ -0,0 +1,34 @@ +import { useQuery, UseQueryOptions } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { TRateLimit } from "./types"; + +export const rateLimitQueryKeys = { + rateLimit: () => ["rate-limit"] as const +}; + +const fetchRateLimit = async () => { + const { data } = await apiRequest.get<{ rateLimit: TRateLimit }>("/api/v1/rate-limit"); + return data.rateLimit; +}; + +export const useGetRateLimit = ({ + options = {} +}: { + options?: Omit< + UseQueryOptions< + TRateLimit, + unknown, + TRateLimit, + ReturnType + >, + "queryKey" | "queryFn" + >; +} = {}) => + useQuery({ + queryKey: rateLimitQueryKeys.rateLimit(), + queryFn: fetchRateLimit, + ...options, + enabled: options?.enabled ?? true + }); diff --git a/frontend/src/hooks/api/rateLimit/types.ts b/frontend/src/hooks/api/rateLimit/types.ts new file mode 100644 index 000000000..5697fc298 --- /dev/null +++ b/frontend/src/hooks/api/rateLimit/types.ts @@ -0,0 +1,10 @@ +export type TRateLimit = { + readRateLimit: number; + writeRateLimit: number; + secretsRateLimit: number; + authRateLimit: number; + inviteUserRateLimit: number; + mfaRateLimit: number; + creationLimit: number; + publicEndpointLimit: number; +}; diff --git a/frontend/src/views/admin/DashboardPage/DashboardPage.tsx b/frontend/src/views/admin/DashboardPage/DashboardPage.tsx index ce1b117f3..ae243c130 100644 --- a/frontend/src/views/admin/DashboardPage/DashboardPage.tsx +++ b/frontend/src/views/admin/DashboardPage/DashboardPage.tsx @@ -18,12 +18,15 @@ import { Tab, TabList, TabPanel, - Tabs} from "@app/components/v2"; + Tabs +} from "@app/components/v2"; import { useOrganization, useServerConfig, useUser } from "@app/context"; import { useUpdateServerConfig } from "@app/hooks/api"; +import { useGetRateLimit, useUpdateRateLimit } from "@app/hooks/api/rateLimit"; enum TabSections { - Settings = "settings" + Settings = "settings", + RateLimit = "rate-limit" } enum SignUpModes { @@ -35,13 +38,22 @@ const formSchema = z.object({ signUpMode: z.nativeEnum(SignUpModes), allowedSignUpDomain: z.string().optional().nullable(), trustSamlEmails: z.boolean(), - trustLdapEmails: z.boolean() + trustLdapEmails: z.boolean(), + readRateLimit: z.number(), + writeRateLimit: z.number(), + secretsRateLimit: z.number(), + authRateLimit: z.number(), + inviteUserRateLimit: z.number(), + mfaRateLimit: z.number(), + creationLimit: z.number(), + publicEndpointLimit: z.number() }); type TDashboardForm = z.infer; export const AdminDashboardPage = () => { const router = useRouter(); const data = useServerConfig(); + const { data: rateLimit } = useGetRateLimit(); const { config } = data; const { @@ -56,7 +68,15 @@ export const AdminDashboardPage = () => { signUpMode: config.allowSignUp ? SignUpModes.Anyone : SignUpModes.Disabled, allowedSignUpDomain: config.allowedSignUpDomain, trustSamlEmails: config.trustSamlEmails, - trustLdapEmails: config.trustLdapEmails + trustLdapEmails: config.trustLdapEmails, + readRateLimit: rateLimit?.readRateLimit ?? 600, + writeRateLimit: rateLimit?.writeRateLimit ?? 200, + secretsRateLimit: rateLimit?.secretsRateLimit ?? 60, + authRateLimit: rateLimit?.authRateLimit ?? 60, + inviteUserRateLimit: rateLimit?.inviteUserRateLimit ?? 30, + mfaRateLimit: rateLimit?.mfaRateLimit ?? 20, + creationLimit: rateLimit?.creationLimit ?? 30, + publicEndpointLimit: rateLimit?.publicEndpointLimit ?? 30 } }); @@ -65,6 +85,7 @@ export const AdminDashboardPage = () => { const { user, isLoading: isUserLoading } = useUser(); const { orgs } = useOrganization(); const { mutateAsync: updateServerConfig } = useUpdateServerConfig(); + const { mutateAsync: updateRateLimit } = useUpdateRateLimit(); const isNotAllowed = !user?.superAdmin; @@ -101,6 +122,42 @@ export const AdminDashboardPage = () => { } }; + const onRateLimitFormSubmit = async (formData: TDashboardForm) => { + try { + const { + readRateLimit, + writeRateLimit, + secretsRateLimit, + authRateLimit, + inviteUserRateLimit, + mfaRateLimit, + creationLimit, + publicEndpointLimit + } = formData; + + await updateRateLimit({ + readRateLimit, + writeRateLimit, + secretsRateLimit, + authRateLimit, + inviteUserRateLimit, + mfaRateLimit, + creationLimit, + publicEndpointLimit + }); + createNotification({ + text: "Successfully changed rate limits. Please restart your server", + type: "success" + }); + } catch (e) { + console.error(e); + createNotification({ + type: "error", + text: "Failed to update rate limiting setting." + }); + } + }; + return (
@@ -117,6 +174,7 @@ export const AdminDashboardPage = () => {
General + Rate Limit
@@ -233,6 +291,177 @@ export const AdminDashboardPage = () => { + +
+
+
+ Set Rate Limits for your Infisical Instance +
+ ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> +
+ +
+
)} From 579948ea6da5be3108ce94eda4aaad752ee03b4d Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 12 Jun 2024 20:18:39 +0800 Subject: [PATCH 113/187] feat: added projects list view --- .../src/pages/org/[id]/overview/index.tsx | 377 +++++++++++------- 1 file changed, 237 insertions(+), 140 deletions(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index 17cf8537c..e5d4ffc3c 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -17,10 +17,14 @@ import { faClipboard, faExclamationCircle, faHandPeace, + faList, faMagnifyingGlass, faNetworkWired, faPlug, faPlus, + faProjectDiagram, + faTableCells, + faTableColumns, faUserPlus } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; @@ -34,6 +38,9 @@ import onboardingCheck from "@app/components/utilities/checks/OnboardingCheck"; import { Button, Checkbox, + DropdownMenu, + DropdownMenuContent, + DropdownMenuTrigger, FormControl, Input, Modal, @@ -86,6 +93,11 @@ type ItemProps = { link?: string; }; +enum ProjectsViewMode { + GRID = "grid", + LIST = "list" +} + function copyToClipboard(id: string, setState: (value: boolean) => void) { // Get the text field const copyText = document.getElementById(id) as HTMLInputElement; @@ -309,8 +321,9 @@ const LearningItem = ({ href={link} >
null} @@ -321,10 +334,11 @@ const LearningItem = ({ await registerUserAction.mutateAsync(userAction); } }} - className={`group relative flex h-[5.5rem] w-full items-center justify-between overflow-hidden rounded-md border ${complete + className={`group relative flex h-[5.5rem] w-full items-center justify-between overflow-hidden rounded-md border ${ + complete ? "cursor-default border-mineshaft-900 bg-gradient-to-r from-[#0e1f01] to-mineshaft-700" : "cursor-pointer border-mineshaft-600 bg-mineshaft-800 shadow-xl hover:bg-mineshaft-700" - } text-mineshaft-100 duration-200`} + } text-mineshaft-100 duration-200`} >
@@ -402,8 +416,9 @@ const LearningItemSquare = ({ href={link} >
null} @@ -414,10 +429,11 @@ const LearningItemSquare = ({ await registerUserAction.mutateAsync(userAction); } }} - className={`group relative flex w-full items-center justify-between overflow-hidden rounded-md border ${complete + className={`group relative flex w-full items-center justify-between overflow-hidden rounded-md border ${ + complete ? "cursor-default border-mineshaft-900 bg-gradient-to-r from-[#0e1f01] to-mineshaft-700" : "cursor-pointer border-mineshaft-600 bg-mineshaft-800 shadow-xl hover:bg-mineshaft-700" - } text-mineshaft-100 duration-200`} + } text-mineshaft-100 duration-200`} >
@@ -431,8 +447,9 @@ const LearningItemSquare = ({
)}
{complete ? "Complete!" : `About ${time}`}
@@ -496,6 +513,9 @@ const OrganizationPage = withPermission( const createWs = useCreateWorkspace(); const { user } = useUser(); const { data: serverDetails } = useFetchServerStatus(); + const [projectsViewMode, setProjectsViewMode] = useState( + (localStorage.getItem("projectsViewMode") as ProjectsViewMode) || ProjectsViewMode.GRID + ); const onCreateProject = async ({ name, addMembers }: TAddProjectFormData) => { // type check @@ -551,6 +571,90 @@ const OrganizationPage = withPermission( const isWorkspaceEmpty = !isWorkspaceLoading && orgWorkspaces?.length === 0; + const projectsGridView = ( +
+ {isWorkspaceLoading && + Array.apply(0, Array(3)).map((_x, i) => ( +
+
+ +
+
+ +
+
+ +
+
+ ))} + {orgWorkspaces + .filter((ws) => ws?.name?.toLowerCase().includes(searchFilter.toLowerCase())) + .map((workspace) => ( + // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events +
{ + router.push(`/project/${workspace.id}/secrets/overview`); + localStorage.setItem("projectData.id", workspace.id); + }} + key={workspace.id} + className="min-w-72 group flex h-40 cursor-pointer flex-col justify-between rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4" + > +
{workspace.name}
+
+ {workspace.environments?.length || 0} environments +
+ +
+ ))} +
+ ); + + const projectsListView = ( +
+ {isWorkspaceLoading && + Array.apply(0, Array(3)).map((_x, i) => ( +
+ +
+ ))} + {orgWorkspaces + .filter((ws) => ws?.name?.toLowerCase().includes(searchFilter.toLowerCase())) + .map((workspace) => ( + // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events +
{ + router.push(`/project/${workspace.id}/secrets/overview`); + localStorage.setItem("projectData.id", workspace.id); + }} + key={workspace.id} + className="min-w-72 group flex h-12 cursor-pointer flex-row items-center justify-between border border-mineshaft-600 bg-mineshaft-800 px-6 hover:bg-mineshaft-700" + > +
+ +
{workspace.name}
+
+
+ {workspace.environments?.length || 0} environments +
+
+ ))} +
+ ); + return (
@@ -580,7 +684,44 @@ const OrganizationPage = withPermission(
)}
-

Projects

+
+

Projects

+ + + + + +
+ + +
+ + +
-
- {isWorkspaceLoading && - Array.apply(0, Array(3)).map((_x, i) => ( -
-
- -
-
- -
-
- -
-
- ))} - {orgWorkspaces - .filter((ws) => ws?.name?.toLowerCase().includes(searchFilter.toLowerCase())) - .map((workspace) => ( - // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events -
{ - router.push(`/project/${workspace.id}/secrets/overview`); - localStorage.setItem("projectData.id", workspace.id); - }} - key={workspace.id} - className="min-w-72 group flex h-40 cursor-pointer flex-col justify-between rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4" - > -
{workspace.name}
-
- {workspace.environments?.length || 0} environments -
- -
- ))} -
+ {projectsViewMode === ProjectsViewMode.LIST ? projectsListView : projectsGridView} {isWorkspaceEmpty && (
-

Onboarding Guide

-
- - {orgWorkspaces.length !== 0 && ( - <> - - - - )} -
- -
-
+
+

Onboarding Guide

+
+ {orgWorkspaces.length !== 0 && ( -
-
-
- - {false && ( -
- -
- )} -
-
Inject secrets locally
-
- Replace .env files with a more secure and efficient alternative. -
+ <> + + + + )} +
+ +
+
+ {orgWorkspaces.length !== 0 && ( +
+
+
+ + {false && ( +
+ +
+ )} +
+
Inject secrets locally
+
+ Replace .env files with a more secure and efficient alternative.
-
- About 2 min -
- - {false &&
} +
+ About 2 min +
- )} - {orgWorkspaces.length !== 0 && ( - - )} -
- )} + + {false &&
} +
+ )} + {orgWorkspaces.length !== 0 && ( + + )} +
+ )} { From 0f266ebe9e9e5d61c5290d56128c5a4f8d0d6b40 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 12 Jun 2024 20:45:57 +0800 Subject: [PATCH 114/187] fix: resolved secret name mismatch for cli release action --- .github/workflows/release_build_infisical_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release_build_infisical_cli.yml b/.github/workflows/release_build_infisical_cli.yml index af8e28f4d..ed49e3bdd 100644 --- a/.github/workflows/release_build_infisical_cli.yml +++ b/.github/workflows/release_build_infisical_cli.yml @@ -24,7 +24,7 @@ jobs: CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }} CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }} CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }} - INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }} + CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }} goreleaser: runs-on: ubuntu-20.04 From 12e217d20037a6f43db5ed33037009e2428d5607 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 12 Jun 2024 21:54:35 +0800 Subject: [PATCH 115/187] misc: hardcoded goreleaser version --- .github/workflows/release_build_infisical_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release_build_infisical_cli.yml b/.github/workflows/release_build_infisical_cli.yml index ed49e3bdd..fe9d1ac13 100644 --- a/.github/workflows/release_build_infisical_cli.yml +++ b/.github/workflows/release_build_infisical_cli.yml @@ -59,7 +59,7 @@ jobs: - uses: goreleaser/goreleaser-action@v4 with: distribution: goreleaser-pro - version: latest + version: v1.26.2 args: release --clean env: GITHUB_TOKEN: ${{ secrets.GO_RELEASER_GITHUB_TOKEN }} From e27d273e8f2a14fa4cb0db32e7f345d89c985e0c Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 12 Jun 2024 22:00:14 +0800 Subject: [PATCH 116/187] misc: resolved goreleaser hardcoded version --- .github/workflows/release_build_infisical_cli.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release_build_infisical_cli.yml b/.github/workflows/release_build_infisical_cli.yml index fe9d1ac13..02c349237 100644 --- a/.github/workflows/release_build_infisical_cli.yml +++ b/.github/workflows/release_build_infisical_cli.yml @@ -59,7 +59,7 @@ jobs: - uses: goreleaser/goreleaser-action@v4 with: distribution: goreleaser-pro - version: v1.26.2 + version: v1.26.2-pro args: release --clean env: GITHUB_TOKEN: ${{ secrets.GO_RELEASER_GITHUB_TOKEN }} From dcf315a5249e1702d66a2b50de3f349b85cd5c2b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 00:09:35 +0800 Subject: [PATCH 117/187] misc: addressed ui comments --- frontend/src/hooks/api/workspace/types.ts | 3 +- frontend/src/lib/fn/date.ts | 46 ++++++++++ .../src/pages/org/[id]/overview/index.tsx | 85 +++++++++---------- 3 files changed, 86 insertions(+), 48 deletions(-) create mode 100644 frontend/src/lib/fn/date.ts diff --git a/frontend/src/hooks/api/workspace/types.ts b/frontend/src/hooks/api/workspace/types.ts index 8be9beed0..be4ed938c 100644 --- a/frontend/src/hooks/api/workspace/types.ts +++ b/frontend/src/hooks/api/workspace/types.ts @@ -14,6 +14,7 @@ export type Workspace = { orgId: string; version: ProjectVersion; upgradeStatus: string | null; + updatedAt: string; autoCapitalization: boolean; environments: WorkspaceEnv[]; slug: string; @@ -128,4 +129,4 @@ export type TUpdateWorkspaceGroupRoleDTO = { temporaryAccessStartTime: string; } )[]; -}; \ No newline at end of file +}; diff --git a/frontend/src/lib/fn/date.ts b/frontend/src/lib/fn/date.ts new file mode 100644 index 000000000..66423b3cb --- /dev/null +++ b/frontend/src/lib/fn/date.ts @@ -0,0 +1,46 @@ +export const timeAgo = (inputDate: Date, currentDate: Date): string => { + const now = new Date(currentDate).getTime(); + const date = new Date(inputDate).getTime(); + const elapsedMilliseconds = now - date; + const elapsedSeconds = Math.abs(Math.floor(elapsedMilliseconds / 1000)); + const elapsedMinutes = Math.abs(Math.floor(elapsedSeconds / 60)); + const elapsedHours = Math.abs(Math.floor(elapsedMinutes / 60)); + const elapsedDays = Math.abs(Math.floor(elapsedHours / 24)); + const elapsedWeeks = Math.abs(Math.floor(elapsedDays / 7)); + const elapsedMonths = Math.abs(Math.floor(elapsedDays / 30)); + const elapsedYears = Math.abs(Math.floor(elapsedDays / 365)); + + if (elapsedYears > 0) { + return `${elapsedYears} year${elapsedYears === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; + } + if (elapsedMonths > 0) { + return `${elapsedMonths} month${elapsedMonths === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; + } + if (elapsedWeeks > 0) { + return `${elapsedWeeks} week${elapsedWeeks === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; + } + if (elapsedDays > 0) { + return `${elapsedDays} day${elapsedDays === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; + } + if (elapsedHours > 0) { + return `${elapsedHours} hour${elapsedHours === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; + } + if (elapsedMinutes > 0) { + return `${elapsedMinutes} minute${elapsedMinutes === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; + } + return `${elapsedSeconds} second${elapsedSeconds === 1 ? "" : "s"} ${ + elapsedMilliseconds >= 0 ? "ago" : "from now" + }`; +}; diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index e5d4ffc3c..2c9338bb7 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -12,6 +12,8 @@ import { faFolderOpen } from "@fortawesome/free-regular-svg-icons"; import { faArrowRight, faArrowUpRightFromSquare, + faBorderAll, + faBoxesStacked, faCheck, faCheckCircle, faClipboard, @@ -22,9 +24,6 @@ import { faNetworkWired, faPlug, faPlus, - faProjectDiagram, - faTableCells, - faTableColumns, faUserPlus } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; @@ -38,10 +37,8 @@ import onboardingCheck from "@app/components/utilities/checks/OnboardingCheck"; import { Button, Checkbox, - DropdownMenu, - DropdownMenuContent, - DropdownMenuTrigger, FormControl, + IconButton, Input, Modal, ModalContent, @@ -66,6 +63,7 @@ import { // import { fetchUserWsKey } from "@app/hooks/api/keys/queries"; import { useFetchServerStatus } from "@app/hooks/api/serverDetails"; import { usePopUp } from "@app/hooks/usePopUp"; +import { timeAgo } from "@app/lib/fn/date"; const features = [ { @@ -478,7 +476,6 @@ const formSchema = yup.object({ type TAddProjectFormData = yup.InferType; // #TODO: Update all the workspaceIds - const OrganizationPage = withPermission( () => { const { t } = useTranslation(); @@ -641,14 +638,19 @@ const OrganizationPage = withPermission( localStorage.setItem("projectData.id", workspace.id); }} key={workspace.id} - className="min-w-72 group flex h-12 cursor-pointer flex-row items-center justify-between border border-mineshaft-600 bg-mineshaft-800 px-6 hover:bg-mineshaft-700" + className="min-w-72 group grid h-14 cursor-pointer grid-cols-6 border border-mineshaft-600 bg-mineshaft-800 px-6 hover:bg-mineshaft-700" > -
- +
+
{workspace.name}
-
- {workspace.environments?.length || 0} environments +
+
+ {workspace.environments?.length || 0} environments +
+
+ last update: {timeAgo(new Date(workspace.updatedAt), new Date())} +
))} @@ -686,41 +688,30 @@ const OrganizationPage = withPermission(

Projects

- - - - - -
- - -
- - +
+ { + localStorage.setItem("projectsViewMode", ProjectsViewMode.GRID); + setProjectsViewMode(ProjectsViewMode.GRID); + }} + ariaLabel="grid" + className="mr-1 min-w-[2.8rem]" + > + + + { + localStorage.setItem("projectsViewMode", ProjectsViewMode.LIST); + setProjectsViewMode(ProjectsViewMode.LIST); + }} + ariaLabel="list" + className="min-w-[2.8rem]" + > + + +
Date: Wed, 12 Jun 2024 10:12:51 -0700 Subject: [PATCH 118/187] style updates --- .../src/pages/org/[id]/overview/index.tsx | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index 2c9338bb7..255a1c699 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -13,11 +13,11 @@ import { faArrowRight, faArrowUpRightFromSquare, faBorderAll, - faBoxesStacked, faCheck, faCheckCircle, faClipboard, faExclamationCircle, + faFileShield, faHandPeace, faList, faMagnifyingGlass, @@ -618,7 +618,7 @@ const OrganizationPage = withPermission( ); const projectsListView = ( -
+
{isWorkspaceLoading && Array.apply(0, Array(3)).map((_x, i) => (
- -
{workspace.name}
+ +
{workspace.name}
{workspace.environments?.length || 0} environments
- last update: {timeAgo(new Date(workspace.updatedAt), new Date())} + Updated {timeAgo(new Date(workspace.updatedAt), new Date())}
@@ -688,7 +688,16 @@ const OrganizationPage = withPermission(

Projects

-
+
+
+ setSearchFilter(e.target.value)} + leftIcon={} + /> +
{ @@ -696,7 +705,8 @@ const OrganizationPage = withPermission( setProjectsViewMode(ProjectsViewMode.GRID); }} ariaLabel="grid" - className="mr-1 min-w-[2.8rem]" + size="xs" + className={`${projectsViewMode === ProjectsViewMode.GRID ? "bg-mineshaft-500" : "bg-transparent"} hover:bg-mineshaft-600 min-w-[2.4rem] border-none`} > @@ -707,20 +717,12 @@ const OrganizationPage = withPermission( setProjectsViewMode(ProjectsViewMode.LIST); }} ariaLabel="list" - className="min-w-[2.8rem]" + size="xs" + className={`${projectsViewMode === ProjectsViewMode.LIST ? "bg-mineshaft-500" : "bg-transparent"} hover:bg-mineshaft-600 min-w-[2.4rem] border-none`} >
-
-
- setSearchFilter(e.target.value)} - leftIcon={} - /> {(isAllowed) => (
))} - {orgWorkspaces - .filter((ws) => ws?.name?.toLowerCase().includes(searchFilter.toLowerCase())) - .map((workspace) => ( - // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events -
{ - router.push(`/project/${workspace.id}/secrets/overview`); - localStorage.setItem("projectData.id", workspace.id); - }} - key={workspace.id} - className="min-w-72 group flex h-40 cursor-pointer flex-col justify-between rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4" - > -
{workspace.name}
-
- {workspace.environments?.length || 0} environments -
- + {filteredWorkspaces.map((workspace) => ( + // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events +
{ + router.push(`/project/${workspace.id}/secrets/overview`); + localStorage.setItem("projectData.id", workspace.id); + }} + key={workspace.id} + className="min-w-72 group flex h-40 cursor-pointer flex-col justify-between rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4" + > +
{workspace.name}
+
+ {workspace.environments?.length || 0} environments
- ))} + +
+ ))}
); @@ -628,32 +629,32 @@ const OrganizationPage = withPermission(
))} - {orgWorkspaces - .filter((ws) => ws?.name?.toLowerCase().includes(searchFilter.toLowerCase())) - .map((workspace) => ( - // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events -
{ - router.push(`/project/${workspace.id}/secrets/overview`); - localStorage.setItem("projectData.id", workspace.id); - }} - key={workspace.id} - className="min-w-72 group grid h-14 cursor-pointer grid-cols-6 border border-mineshaft-600 bg-mineshaft-800 px-6 hover:bg-mineshaft-700" - > -
- -
{workspace.name}
+ {filteredWorkspaces.map((workspace, ind) => ( + // eslint-disable-next-line jsx-a11y/no-static-element-interactions, jsx-a11y/click-events-have-key-events +
{ + router.push(`/project/${workspace.id}/secrets/overview`); + localStorage.setItem("projectData.id", workspace.id); + }} + key={workspace.id} + className={`min-w-72 group grid h-14 cursor-pointer grid-cols-6 border-t border-l border-r border-mineshaft-600 bg-mineshaft-800 px-6 hover:bg-mineshaft-700 ${ + ind === filteredWorkspaces.length - 1 && "border-b" + }`} + > +
+ +
{workspace.name}
+
+
+
+ {workspace.environments?.length || 0} environments
-
-
- {workspace.environments?.length || 0} environments -
-
- Updated {timeAgo(new Date(workspace.updatedAt), new Date())} -
+
+ Updated {timeAgo(new Date(workspace.updatedAt), new Date())}
- ))} +
+ ))}
); @@ -697,7 +698,7 @@ const OrganizationPage = withPermission( onChange={(e) => setSearchFilter(e.target.value)} leftIcon={} /> -
+
{ @@ -706,7 +707,9 @@ const OrganizationPage = withPermission( }} ariaLabel="grid" size="xs" - className={`${projectsViewMode === ProjectsViewMode.GRID ? "bg-mineshaft-500" : "bg-transparent"} hover:bg-mineshaft-600 min-w-[2.4rem] border-none`} + className={`${ + projectsViewMode === ProjectsViewMode.GRID ? "bg-mineshaft-500" : "bg-transparent" + } min-w-[2.4rem] border-none hover:bg-mineshaft-600`} > @@ -718,7 +721,9 @@ const OrganizationPage = withPermission( }} ariaLabel="list" size="xs" - className={`${projectsViewMode === ProjectsViewMode.LIST ? "bg-mineshaft-500" : "bg-transparent"} hover:bg-mineshaft-600 min-w-[2.4rem] border-none`} + className={`${ + projectsViewMode === ProjectsViewMode.LIST ? "bg-mineshaft-500" : "bg-transparent" + } min-w-[2.4rem] border-none hover:bg-mineshaft-600`} > From a0770baff2942cc87c3af59e51038db3b372284d Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 12 Jun 2024 19:40:58 +0200 Subject: [PATCH 120/187] Update go.mdx --- docs/sdks/languages/go.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/sdks/languages/go.mdx b/docs/sdks/languages/go.mdx index e60a578bc..a8affa154 100644 --- a/docs/sdks/languages/go.mdx +++ b/docs/sdks/languages/go.mdx @@ -9,7 +9,7 @@ icon: "golang" If you're working with Go Lang, the official [Infisical Go SDK](https://github.com/infisical/go-sdk) package is the easiest way to fetch and work with secrets for your application. - [Package](https://pkg.go.dev/github.com/infisical/go-sdk) -- [Github Repository](https://github.com/infiscial/go-sdk) +- [Github Repository](https://github.com/infisical/go-sdk) ## Basic Usage @@ -282,7 +282,7 @@ Retrieve all secrets within the Infisical project and environment that client is -### client.Secrets().Get(options) +### client.Secrets().Retrieve(options) ```go secret, err := client.Secrets().Retrieve(infisical.RetrieveSecretOptions{ @@ -294,7 +294,7 @@ secret, err := client.Secrets().Retrieve(infisical.RetrieveSecretOptions{ Retrieve a secret from Infisical. -By default, `Secrets().Get()` fetches and returns a shared secret. +By default, `Secrets().Retrieve()` fetches and returns a shared secret. #### Parameters From 2a005d26543a81f86c70bc97a075a597a296501b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 02:40:08 +0800 Subject: [PATCH 121/187] misc: added rounding to list view --- frontend/src/pages/org/[id]/overview/index.tsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index 46daf7b4e..0f13bee16 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -638,8 +638,8 @@ const OrganizationPage = withPermission( }} key={workspace.id} className={`min-w-72 group grid h-14 cursor-pointer grid-cols-6 border-t border-l border-r border-mineshaft-600 bg-mineshaft-800 px-6 hover:bg-mineshaft-700 ${ - ind === filteredWorkspaces.length - 1 && "border-b" - }`} + ind === 0 && "rounded-t-md" + } ${ind === filteredWorkspaces.length - 1 && "rounded-b-md border-b"}`} >
From 0e5f0eefc100626a218d467ce9b2028f16429f37 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 02:56:48 +0800 Subject: [PATCH 122/187] misc: added rounded design to loading entries --- frontend/src/pages/org/[id]/overview/index.tsx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index 0f13bee16..b189beeb8 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -624,7 +624,9 @@ const OrganizationPage = withPermission( Array.apply(0, Array(3)).map((_x, i) => (
From 30f3dac35ff780671a1987d13497845623230ae7 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 12 Jun 2024 15:56:47 -0400 Subject: [PATCH 123/187] rephrase input and filer for resvered folder --- .../services/secret-snapshot/snapshot-dal.ts | 21 ++++++++++++++++++- .../PointInTimeVersionLimitSection.tsx | 8 +++---- 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts index e45098132..92c6b611d 100644 --- a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts +++ b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts @@ -327,6 +327,24 @@ export const snapshotDALFactory = (db: TDbClient) => { } }; + /** + * Prunes excess snapshots from the database to ensure only a specified number of recent snapshots are retained for each folder. + * + * This function operates in three main steps: + * 1. Pruning snapshots from root/non-versioned folders. + * 2. Pruning snapshots from versioned folders. + * 3. Removing orphaned snapshots that do not belong to any existing folder or folder version. + * + * The function processes snapshots in batches, determined by the `PRUNE_FOLDER_BATCH_SIZE` constant, + * to manage the large datasets without overwhelming the DB. + * + * Steps: + * - Fetch a batch of folder IDs. + * - For each batch, use a Common Table Expression (CTE) to rank snapshots within each folder by their creation date. + * - Identify and delete snapshots that exceed the project's point-in-time version limit (`pitVersionLimit`). + * - Repeat the process for versioned folders. + * - Finally, delete orphaned snapshots that do not have an associated folder. + */ const pruneExcessSnapshots = async () => { const PRUNE_FOLDER_BATCH_SIZE = 10000; @@ -337,6 +355,7 @@ export const snapshotDALFactory = (db: TDbClient) => { while (true) { const folderBatch = await db(TableName.SecretFolder) .where("id", ">", uuidOffset) + .where("isReserved", false) .orderBy("id", "asc") .limit(PRUNE_FOLDER_BATCH_SIZE) .select("id"); @@ -345,7 +364,7 @@ export const snapshotDALFactory = (db: TDbClient) => { if (folderBatch.length) { try { - logger.info(`Pruning snapshots in range ${batchEntries[0]}:${batchEntries[batchEntries.length - 1]}`); + logger.info(`Pruning snapshots in [range=${batchEntries[0]}:${batchEntries[batchEntries.length - 1]}]`); await db(TableName.Snapshot) .with("snapshot_cte", (qb) => { void qb diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/PointInTimeVersionLimitSection/PointInTimeVersionLimitSection.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/PointInTimeVersionLimitSection/PointInTimeVersionLimitSection.tsx index f3035922b..0ce5c7058 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/PointInTimeVersionLimitSection/PointInTimeVersionLimitSection.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/PointInTimeVersionLimitSection/PointInTimeVersionLimitSection.tsx @@ -56,12 +56,10 @@ export const PointInTimeVersionLimitSection = () => { return (
-

Point in Time Recovery

+

Version Retention

- This defines the maximum number of folder snapshots, secret versions, and folder versions - that are retained by the system. The cleanup of excess snapshots and versions happens once a - day on midnight of UTC. + This defines the maximum number of recent secret versions to keep per folder. Excess versions will be removed at midnight (UTC) each day.

@@ -73,7 +71,7 @@ export const PointInTimeVersionLimitSection = () => { From 6c86db7d4e8fbaa4af64d6cd7e09625ead4a3507 Mon Sep 17 00:00:00 2001 From: github-actions Date: Wed, 12 Jun 2024 20:05:18 +0000 Subject: [PATCH 124/187] chore: renamed new migration files to latest timestamp (gh-action) --- ...t-version-limit.ts => 20240612200518_add-pit-version-limit.ts} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename backend/src/db/migrations/{20240531042507_add-pit-version-limit.ts => 20240612200518_add-pit-version-limit.ts} (100%) diff --git a/backend/src/db/migrations/20240531042507_add-pit-version-limit.ts b/backend/src/db/migrations/20240612200518_add-pit-version-limit.ts similarity index 100% rename from backend/src/db/migrations/20240531042507_add-pit-version-limit.ts rename to backend/src/db/migrations/20240612200518_add-pit-version-limit.ts From f5322abe8587853c0f963b7101732d70eb9dcc95 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 12 Jun 2024 13:11:21 -0700 Subject: [PATCH 125/187] Resolve PR issues --- backend/src/@types/knex.d.ts | 14 +- .../20240607032218_certificate-mgmt.ts | 13 +- .../src/db/schemas/certificate-authorities.ts | 1 + ...ificate-certs.ts => certificate-bodies.ts} | 8 +- backend/src/db/schemas/certificates.ts | 1 + backend/src/db/schemas/index.ts | 2 +- backend/src/db/schemas/models.ts | 2 +- backend/src/server/routes/index.ts | 8 +- .../routes/v1/certificate-authority-router.ts | 16 +- .../server/routes/v1/certificate-router.ts | 12 +- .../certificate-authority-service.ts | 17 +- .../certificate-authority-types.ts | 4 +- .../certificate/certificate-body-dal.ts | 10 + .../certificate/certificate-cert-dal.ts | 10 - .../certificate/certificate-service.ts | 8 +- frontend/src/hooks/api/ca/types.ts | 6 +- frontend/src/hooks/api/certificates/types.ts | 1 + .../CertificatesPage/CertificatesPage.tsx | 2 +- .../components/CaTab/components/CaModal.tsx | 26 +- .../components/CaTab/components/CaTable.tsx | 4 +- .../components/CertificateContent.tsx | 231 ++++++++---------- .../components/CertificateModal.tsx | 67 +++-- .../components/CertificatesTable.tsx | 4 +- .../ProjectRoleModifySection.tsx | 16 +- .../ProjectRoleModifySection.utils.ts | 2 + .../SingleProjectPermission.tsx | 2 + 26 files changed, 244 insertions(+), 243 deletions(-) rename backend/src/db/schemas/{certificate-certs.ts => certificate-bodies.ts} (56%) create mode 100644 backend/src/services/certificate/certificate-body-dal.ts delete mode 100644 backend/src/services/certificate/certificate-cert-dal.ts diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index e04ef8a28..e5068ae91 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -44,9 +44,9 @@ import { TCertificateAuthoritySecret, TCertificateAuthoritySecretInsert, TCertificateAuthoritySecretUpdate, - TCertificateCerts, - TCertificateCertsInsert, - TCertificateCertsUpdate, + TCertificateBodies, + TCertificateBodiesInsert, + TCertificateBodiesUpdate, TCertificates, TCertificateSecrets, TCertificateSecretsInsert, @@ -299,10 +299,10 @@ declare module "knex/types/tables" { TCertificateAuthorityCrlUpdate >; [TableName.Certificate]: Knex.CompositeTableType; - [TableName.CertificateCert]: Knex.CompositeTableType< - TCertificateCerts, - TCertificateCertsInsert, - TCertificateCertsUpdate + [TableName.CertificateBody]: Knex.CompositeTableType< + TCertificateBodies, + TCertificateBodiesInsert, + TCertificateBodiesUpdate >; [TableName.CertificateSecret]: Knex.CompositeTableType< TCertificateSecrets, diff --git a/backend/src/db/migrations/20240607032218_certificate-mgmt.ts b/backend/src/db/migrations/20240607032218_certificate-mgmt.ts index 3edac7a72..a738a6b64 100644 --- a/backend/src/db/migrations/20240607032218_certificate-mgmt.ts +++ b/backend/src/db/migrations/20240607032218_certificate-mgmt.ts @@ -24,6 +24,7 @@ export async function up(knex: Knex): Promise { t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE"); t.string("type").notNullable(); // root / intermediate t.string("status").notNullable(); // active / pending-certificate + t.string("friendlyName").notNullable(); t.string("organization").notNullable(); t.string("ou").notNullable(); t.string("country").notNullable(); @@ -31,7 +32,6 @@ export async function up(knex: Knex): Promise { t.string("locality").notNullable(); t.string("commonName").notNullable(); t.string("dn").notNullable(); - t.unique(["dn", "projectId"]); t.string("serialNumber").nullable().unique(); t.integer("maxPathLength").nullable(); t.string("keyAlgorithm").notNullable(); @@ -80,6 +80,7 @@ export async function up(knex: Knex): Promise { t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE"); t.string("status").notNullable(); // active / pending-certificate t.string("serialNumber").notNullable().unique(); + t.string("friendlyName").notNullable(); t.string("commonName").notNullable(); t.datetime("notBefore").notNullable(); t.datetime("notAfter").notNullable(); @@ -88,8 +89,8 @@ export async function up(knex: Knex): Promise { }); } - if (!(await knex.schema.hasTable(TableName.CertificateCert))) { - await knex.schema.createTable(TableName.CertificateCert, (t) => { + if (!(await knex.schema.hasTable(TableName.CertificateBody))) { + await knex.schema.createTable(TableName.CertificateBody, (t) => { t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); t.timestamps(true, true, true); t.uuid("certId").notNullable().unique(); @@ -102,7 +103,7 @@ export async function up(knex: Knex): Promise { await createOnUpdateTrigger(knex, TableName.CertificateAuthorityCert); await createOnUpdateTrigger(knex, TableName.CertificateAuthoritySecret); await createOnUpdateTrigger(knex, TableName.Certificate); - await createOnUpdateTrigger(knex, TableName.CertificateCert); + await createOnUpdateTrigger(knex, TableName.CertificateBody); } export async function down(knex: Knex): Promise { @@ -115,8 +116,8 @@ export async function down(knex: Knex): Promise { } // certificates - await knex.schema.dropTableIfExists(TableName.CertificateCert); - await dropOnUpdateTrigger(knex, TableName.CertificateCert); + await knex.schema.dropTableIfExists(TableName.CertificateBody); + await dropOnUpdateTrigger(knex, TableName.CertificateBody); await knex.schema.dropTableIfExists(TableName.Certificate); await dropOnUpdateTrigger(knex, TableName.Certificate); diff --git a/backend/src/db/schemas/certificate-authorities.ts b/backend/src/db/schemas/certificate-authorities.ts index 9f0e7f677..16f303b5c 100644 --- a/backend/src/db/schemas/certificate-authorities.ts +++ b/backend/src/db/schemas/certificate-authorities.ts @@ -15,6 +15,7 @@ export const CertificateAuthoritiesSchema = z.object({ projectId: z.string(), type: z.string(), status: z.string(), + friendlyName: z.string(), organization: z.string(), ou: z.string(), country: z.string(), diff --git a/backend/src/db/schemas/certificate-certs.ts b/backend/src/db/schemas/certificate-bodies.ts similarity index 56% rename from backend/src/db/schemas/certificate-certs.ts rename to backend/src/db/schemas/certificate-bodies.ts index b02ef8ab4..75afbddbd 100644 --- a/backend/src/db/schemas/certificate-certs.ts +++ b/backend/src/db/schemas/certificate-bodies.ts @@ -9,7 +9,7 @@ import { zodBuffer } from "@app/lib/zod"; import { TImmutableDBKeys } from "./models"; -export const CertificateCertsSchema = z.object({ +export const CertificateBodiesSchema = z.object({ id: z.string().uuid(), createdAt: z.date(), updatedAt: z.date(), @@ -17,6 +17,6 @@ export const CertificateCertsSchema = z.object({ encryptedCertificate: zodBuffer }); -export type TCertificateCerts = z.infer; -export type TCertificateCertsInsert = Omit, TImmutableDBKeys>; -export type TCertificateCertsUpdate = Partial, TImmutableDBKeys>>; +export type TCertificateBodies = z.infer; +export type TCertificateBodiesInsert = Omit, TImmutableDBKeys>; +export type TCertificateBodiesUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/certificates.ts b/backend/src/db/schemas/certificates.ts index b487483d0..b635420d5 100644 --- a/backend/src/db/schemas/certificates.ts +++ b/backend/src/db/schemas/certificates.ts @@ -14,6 +14,7 @@ export const CertificatesSchema = z.object({ caId: z.string().uuid(), status: z.string(), serialNumber: z.string(), + friendlyName: z.string(), commonName: z.string(), notBefore: z.date(), notAfter: z.date(), diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index d8c5e4eca..499447018 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -12,7 +12,7 @@ export * from "./certificate-authorities"; export * from "./certificate-authority-certs"; export * from "./certificate-authority-crl"; export * from "./certificate-authority-secret"; -export * from "./certificate-certs"; +export * from "./certificate-bodies"; export * from "./certificate-secrets"; export * from "./certificates"; export * from "./dynamic-secret-leases"; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index de478755a..2a0a77f8c 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -7,7 +7,7 @@ export enum TableName { CertificateAuthoritySecret = "certificate_authority_secret", CertificateAuthorityCrl = "certificate_authority_crl", Certificate = "certificates", - CertificateCert = "certificate_certs", + CertificateBody = "certificate_bodies", CertificateSecret = "certificate_secrets", Groups = "groups", GroupProjectMembership = "group_project_memberships", diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 9bd64bc0a..30fce0272 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -71,7 +71,7 @@ import { authPaswordServiceFactory } from "@app/services/auth/auth-password-serv import { authSignupServiceFactory } from "@app/services/auth/auth-signup-service"; import { tokenDALFactory } from "@app/services/auth-token/auth-token-dal"; import { tokenServiceFactory } from "@app/services/auth-token/auth-token-service"; -import { certificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; +import { certificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal"; import { certificateDALFactory } from "@app/services/certificate/certificate-dal"; import { certificateServiceFactory } from "@app/services/certificate/certificate-service"; import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; @@ -521,11 +521,11 @@ export const registerRoutes = async ( const certificateAuthorityCrlDAL = certificateAuthorityCrlDALFactory(db); const certificateDAL = certificateDALFactory(db); - const certificateCertDAL = certificateCertDALFactory(db); + const certificateBodyDAL = certificateBodyDALFactory(db); const certificateService = certificateServiceFactory({ certificateDAL, - certificateCertDAL, + certificateBodyDAL, certificateAuthorityDAL, certificateAuthorityCertDAL, certificateAuthorityCrlDAL, @@ -552,7 +552,7 @@ export const registerRoutes = async ( certificateAuthorityCrlDAL, certificateAuthorityQueue, certificateDAL, - certificateCertDAL, + certificateBodyDAL, projectDAL, kmsService, permissionService diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts index 2520850d3..ff84e86f1 100644 --- a/backend/src/server/routes/v1/certificate-authority-router.ts +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -1,3 +1,4 @@ +import ms from "ms"; import { z } from "zod"; import { CertificateAuthoritiesSchema } from "@app/db/schemas"; @@ -21,7 +22,8 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { body: z .object({ projectSlug: z.string().trim(), - type: z.enum([CaType.ROOT, CaType.INTERMEDIATE]), + type: z.nativeEnum(CaType), + friendlyName: z.string().optional(), commonName: z.string().trim(), organization: z.string().trim(), ou: z.string().trim(), @@ -32,14 +34,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { notBefore: validateCaDateField.optional(), notAfter: validateCaDateField.optional(), maxPathLength: z.number().min(-1).default(-1), - keyAlgorithm: z - .enum([ - CertKeyAlgorithm.RSA_2048, - CertKeyAlgorithm.RSA_4096, - CertKeyAlgorithm.ECDSA_P256, - CertKeyAlgorithm.ECDSA_P384 - ]) - .default(CertKeyAlgorithm.RSA_2048) + keyAlgorithm: z.nativeEnum(CertKeyAlgorithm).default(CertKeyAlgorithm.RSA_2048) }) .refine( (data) => { @@ -342,8 +337,9 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { }), body: z .object({ + friendlyName: z.string().optional(), commonName: z.string().trim().min(1), - ttl: z.number().int().min(0).optional(), + ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"), notBefore: validateCaDateField.optional(), notAfter: validateCaDateField.optional() }) diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 408cd4d64..257edec1f 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -52,17 +52,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { serialNumber: z.string().trim() }), body: z.object({ - revocationReason: z.enum([ - CrlReason.UNSPECIFIED, - CrlReason.KEY_COMPROMISE, - CrlReason.CA_COMPROMISE, - CrlReason.AFFILIATION_CHANGED, - CrlReason.SUPERSEDED, - CrlReason.CESSATION_OF_OPERATION, - CrlReason.CERTIFICATE_HOLD, - CrlReason.PRIVILEGE_WITHDRAWN, - CrlReason.A_A_COMPROMISE - ]) + revocationReason: z.nativeEnum(CrlReason) }), response: { 200: z.object({ diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index 32839cccc..a97e2df7e 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -2,11 +2,12 @@ import { ForbiddenError } from "@casl/ability"; import * as x509 from "@peculiar/x509"; import crypto, { KeyObject } from "crypto"; +import ms from "ms"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { BadRequestError } from "@app/lib/errors"; -import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; +import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; @@ -50,7 +51,7 @@ type TCertificateAuthorityServiceFactoryDep = { certificateAuthorityCrlDAL: Pick; certificateAuthorityQueue: TCertificateAuthorityQueueFactory; // TODO: Pick certificateDAL: Pick; - certificateCertDAL: Pick; + certificateBodyDAL: Pick; projectDAL: Pick; kmsService: Pick; permissionService: Pick; @@ -64,7 +65,7 @@ export const certificateAuthorityServiceFactory = ({ certificateAuthoritySecretDAL, certificateAuthorityCrlDAL, certificateDAL, - certificateCertDAL, + certificateBodyDAL, projectDAL, kmsService, permissionService @@ -75,6 +76,7 @@ export const certificateAuthorityServiceFactory = ({ const createCa = async ({ projectSlug, type, + friendlyName, commonName, organization, ou, @@ -127,6 +129,7 @@ export const certificateAuthorityServiceFactory = ({ : new Date(new Date().setFullYear(new Date().getFullYear() + 10)); const serialNumber = crypto.randomBytes(32).toString("hex"); + const ca = await certificateAuthorityDAL.create( { projectId: project.id, @@ -136,6 +139,7 @@ export const certificateAuthorityServiceFactory = ({ country, province, locality, + friendlyName: friendlyName || dn, commonName, status: type === CaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE, dn, @@ -642,6 +646,7 @@ export const certificateAuthorityServiceFactory = ({ */ const issueCertFromCa = async ({ caId, + friendlyName, commonName, ttl, notBefore, @@ -688,8 +693,7 @@ export const certificateAuthorityServiceFactory = ({ if (notAfter) { notAfterDate = new Date(notAfter); } else if (ttl) { - // ttl in seconds - notAfterDate = new Date(new Date().getTime() + ttl * 1000); + notAfterDate = new Date(new Date().getTime() + ms(ttl)); } const caCertNotBeforeDate = new Date(caCertObj.notBefore); @@ -760,6 +764,7 @@ export const certificateAuthorityServiceFactory = ({ { caId: ca.id, status: CertStatus.ACTIVE, + friendlyName: friendlyName || commonName, commonName, serialNumber, notBefore: notBeforeDate, @@ -768,7 +773,7 @@ export const certificateAuthorityServiceFactory = ({ tx ); - await certificateCertDAL.create( + await certificateBodyDAL.create( { certId: cert.id, encryptedCertificate diff --git a/backend/src/services/certificate-authority/certificate-authority-types.ts b/backend/src/services/certificate-authority/certificate-authority-types.ts index d9fa0f59d..d6e17159e 100644 --- a/backend/src/services/certificate-authority/certificate-authority-types.ts +++ b/backend/src/services/certificate-authority/certificate-authority-types.ts @@ -23,6 +23,7 @@ export enum CaStatus { export type TCreateCaDTO = { projectSlug: string; type: CaType; + friendlyName?: string; commonName: string; organization: string; ou: string; @@ -72,8 +73,9 @@ export type TImportCertToCaDTO = { export type TIssueCertFromCaDTO = { caId: string; + friendlyName?: string; commonName: string; - ttl?: number; + ttl: string; notBefore?: string; notAfter?: string; } & Omit; diff --git a/backend/src/services/certificate/certificate-body-dal.ts b/backend/src/services/certificate/certificate-body-dal.ts new file mode 100644 index 000000000..9ddc98966 --- /dev/null +++ b/backend/src/services/certificate/certificate-body-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TCertificateBodyDALFactory = ReturnType; + +export const certificateBodyDALFactory = (db: TDbClient) => { + const certificateBodyOrm = ormify(db, TableName.CertificateBody); + return certificateBodyOrm; +}; diff --git a/backend/src/services/certificate/certificate-cert-dal.ts b/backend/src/services/certificate/certificate-cert-dal.ts deleted file mode 100644 index b2dd0001b..000000000 --- a/backend/src/services/certificate/certificate-cert-dal.ts +++ /dev/null @@ -1,10 +0,0 @@ -import { TDbClient } from "@app/db"; -import { TableName } from "@app/db/schemas"; -import { ormify } from "@app/lib/knex"; - -export type TCertificateCertDALFactory = ReturnType; - -export const certificateCertDALFactory = (db: TDbClient) => { - const certificateCertOrm = ormify(db, TableName.CertificateCert); - return certificateCertOrm; -}; diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index 3e9dc5160..b5a44b748 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -3,7 +3,7 @@ import * as x509 from "@peculiar/x509"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal"; +import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; import { TCertificateAuthorityCrlDALFactory } from "@app/services/certificate-authority/certificate-authority-crl-dal"; @@ -19,7 +19,7 @@ import { CertStatus, TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO, TRevokeCertDT type TCertificateServiceFactoryDep = { certificateDAL: Pick; - certificateCertDAL: Pick; + certificateBodyDAL: Pick; certificateAuthorityDAL: Pick; certificateAuthorityCertDAL: Pick; certificateAuthorityCrlDAL: Pick; @@ -33,7 +33,7 @@ export type TCertificateServiceFactory = ReturnType
-

Certificates

+

Internal PKI

Certificates diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx index 353211c99..28fd1adbe 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaModal.tsx @@ -35,6 +35,7 @@ const getDateTenYearsFromToday = () => { const schema = z .object({ type: z.enum([CaType.ROOT, CaType.INTERMEDIATE]), + friendlyName: z.string(), organization: z.string(), ou: z.string(), country: z.string(), @@ -81,6 +82,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { resolver: zodResolver(schema), defaultValues: { type: CaType.ROOT, + friendlyName: "", organization: "", ou: "", country: "", @@ -99,6 +101,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { if (ca) { reset({ type: ca.type, + friendlyName: ca.friendlyName, organization: ca.organization, ou: ca.ou, country: ca.country, @@ -112,6 +115,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { } else { reset({ type: CaType.ROOT, + friendlyName: "", organization: "", ou: "", country: "", @@ -127,6 +131,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { const onFormSubmit = async ({ type, + friendlyName, commonName, organization, ou, @@ -143,6 +148,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { await createMutateAsync({ projectSlug: currentWorkspace.slug, type, + friendlyName, commonName, organization, ou, @@ -170,12 +176,6 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { } }; - // const getDefaultNotAfterDate = () => { - // const date = new Date(); - // date.setFullYear(date.getFullYear() + 10); - // return date; - // }; - return ( { )} /> + ( + + + + )} + /> { - + @@ -71,7 +71,7 @@ export const CaTable = ({ handlePopUpOpen }: Props) => { data.map((ca) => { return ( - + diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx index 42746d91a..8c40af74f 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateContent.tsx @@ -1,9 +1,9 @@ -import { useEffect } from "react"; import { faCheck, faCopy, faDownload } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; +import FileSaver from "file-saver"; -import { IconButton } from "@app/components/v2"; -import { useToggle } from "@app/hooks"; +import { IconButton, Tooltip } from "@app/components/v2"; +import { useTimedReset } from "@app/hooks"; type Props = { serialNumber: string; @@ -18,42 +18,28 @@ export const CertificateContent = ({ certificateChain, privateKey }: Props) => { - const [isSerialNumberCopied, setIsSerialNumberCopied] = useToggle(false); - const [isCertificateCopied, setIsCertificateCopied] = useToggle(false); - const [isCertificateChainCopied, setIsCertificateChainCopied] = useToggle(false); - const [isCertificateSkCopied, setIsCertificateSkCopied] = useToggle(false); - - useEffect(() => { - let timer: NodeJS.Timeout; - if (isSerialNumberCopied) { - timer = setTimeout(() => setIsSerialNumberCopied.off(), 2000); + const [copyTextSerialNumber, isCopyingSerialNumber, setCopyTextSerialNumber] = + useTimedReset({ + initialState: "Copy to clipboard" + }); + const [copyTextCertificate, isCopyingCertificate, setCopyTextCertificate] = useTimedReset( + { + initialState: "Copy to clipboard" } + ); + const [copyTextCertificateChain, isCopyingCertificateChain, setCopyTextCertificateChain] = + useTimedReset({ + initialState: "Copy to clipboard" + }); - if (isCertificateCopied) { - timer = setTimeout(() => setIsCertificateCopied.off(), 2000); - } - - if (isCertificateChainCopied) { - timer = setTimeout(() => setIsCertificateChainCopied.off(), 2000); - } - - if (isCertificateSkCopied) { - timer = setTimeout(() => setIsCertificateSkCopied.off(), 2000); - } - - return () => clearTimeout(timer); - }, [isSerialNumberCopied, isCertificateCopied, isCertificateChainCopied, isCertificateSkCopied]); + const [copyTextCertificateSk, isCopyingCertificateSk, setCopyTextCertificateSk] = + useTimedReset({ + initialState: "Copy to clipboard" + }); const downloadTxtFile = (filename: string, content: string) => { - const blob = new Blob([content], { type: "text/plain" }); - const url = URL.createObjectURL(blob); - const a = document.createElement("a"); - a.href = url; - a.download = filename; - document.body.appendChild(a); - a.click(); - document.body.removeChild(a); - URL.revokeObjectURL(url); + const blob = new Blob([content], { type: "text/plain;charset=utf-8" }); + FileSaver.saveAs(blob, filename); }; return ( @@ -61,51 +47,48 @@ export const CertificateContent = ({

Serial Number

{serialNumber}

- { - navigator.clipboard.writeText(serialNumber); - setIsSerialNumberCopied.on(); - }} - > - - - Click to copy - - -
-
-

Certificate Body

-
+ { - navigator.clipboard.writeText(certificate); - setIsCertificateCopied.on(); + navigator.clipboard.writeText(serialNumber); + setCopyTextSerialNumber("Copied"); }} > - - - Copy - - - { - downloadTxtFile("cert.pem", certificate); - }} - > - - - Download - + + +
+
+

Certificate Body

+
+ + { + navigator.clipboard.writeText(certificate); + setCopyTextCertificate("Copied"); + }} + > + + + + + { + downloadTxtFile("cert.pem", certificate); + }} + > + + +
@@ -116,33 +99,31 @@ export const CertificateContent = ({

Certificate Chain

- { - navigator.clipboard.writeText(certificateChain); - setIsCertificateChainCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("chain.pem", certificateChain); - }} - > - - - Download - - + + { + navigator.clipboard.writeText(certificateChain); + setCopyTextCertificateChain("Copied"); + }} + > + + + + + { + downloadTxtFile("chain.pem", certificateChain); + }} + > + + +
@@ -155,33 +136,31 @@ export const CertificateContent = ({

Certificate Private Key

- { - navigator.clipboard.writeText(privateKey); - setIsCertificateSkCopied.on(); - }} - > - - - Copy - - - { - downloadTxtFile("private_key.txt", privateKey); - }} - > - - - Download - - + + { + navigator.clipboard.writeText(privateKey); + setCopyTextCertificateSk("Copied"); + }} + > + + + + + { + downloadTxtFile("private_key.txt", privateKey); + }} + > + + +
diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx index 99756f8c5..03e70a80c 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx @@ -1,7 +1,6 @@ import { useEffect, useState } from "react"; import { Controller, useForm } from "react-hook-form"; import { zodResolver } from "@hookform/resolvers/zod"; -import { format } from "date-fns"; import { z } from "zod"; import { createNotification } from "@app/components/notifications"; @@ -21,21 +20,11 @@ import { UsePopUpState } from "@app/hooks/usePopUp"; import { CertificateContent } from "./CertificateContent"; -const isValidDate = (dateString: string) => { - if (dateString === "") return true; - const date = new Date(dateString); - return !Number.isNaN(date.getTime()); -}; - const schema = z.object({ caId: z.string(), + friendlyName: z.string(), commonName: z.string().trim().min(1), - ttl: z.string().trim().optional(), - notAfter: z - .string() - .trim() - .refine(isValidDate, { message: "Invalid date format" }) - .transform((val) => (val === "" ? undefined : val)) + ttl: z.string().trim() }); export type FormData = z.infer; @@ -80,31 +69,30 @@ export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { if (cert) { reset({ caId: cert.caId, + friendlyName: cert.friendlyName, commonName: cert.commonName, - ttl: "", - notAfter: format(new Date(cert.notAfter), "yyyy-MM-dd") + ttl: "" }); } else { reset({ caId: "", + friendlyName: "", commonName: "", - ttl: "", - notAfter: "" + ttl: "" }); } }, [cert]); - const onFormSubmit = async ({ caId, commonName, ttl, notAfter }: FormData) => { + const onFormSubmit = async ({ caId, friendlyName, commonName, ttl }: FormData) => { try { if (!currentWorkspace?.slug) return; const { serialNumber, certificate, certificateChain, privateKey } = await createCertificate({ projectSlug: currentWorkspace.slug, caId, + friendlyName, commonName, - ttl: ttl ? Number(ttl) : undefined, - notBefore: new Date().toISOString(), - notAfter + ttl }); reset(); @@ -175,6 +163,20 @@ export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => { )} /> + ( + + + + )} + /> { name="ttl" render={({ field, fieldState: { error } }) => ( - - - )} - /> - ( - - + )} /> diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx index db02f2386..371c432a1 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx @@ -53,7 +53,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
SubjectFriendly Name Status Type Valid Until
{ca.dn}{ca.friendlyName} {caStatusToNameMap[ca.status]} {caTypeToNameMap[ca.type]} {ca.notAfter ? format(new Date(ca.notAfter), "yyyy-MM-dd") : "-"}
- + - + {isLoading && } {!isLoading && - data && - data.length > 0 && - data.map((certificate) => { + data?.certificates.map((certificate) => { return ( @@ -177,7 +184,16 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { })}
Common NameFriendly Name Status Valid Until @@ -67,7 +67,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { data.map((certificate) => { return (
{certificate.commonName}{certificate.friendlyName} {certStatusToNameMap[certificate.status]} {certificate.notAfter diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.tsx b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.tsx index cd2eaeee0..2140887de 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.tsx +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.tsx @@ -4,6 +4,7 @@ import { faAnchorLock, faArrowLeft, faBook, + faCertificate, faCog, faKey, faLock, @@ -13,8 +14,7 @@ import { faShield, faTags, faUser, - faUsers -} from "@fortawesome/free-solid-svg-icons"; + faUsers} from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { zodResolver } from "@hookform/resolvers/zod"; @@ -117,6 +117,18 @@ const SINGLE_PERMISSION_LIST = [ subtitle: "IP allowlist management control", icon: faNetworkWired, formName: "ip-allowlist" + }, + { + title: "Certificate Authorities", + subtitle: "CA management control", + icon: faCertificate, + formName: "certificate-authorities" + }, + { + title: "Certificates", + subtitle: "Certificate management control", + icon: faCertificate, + formName: "certificates" } ] as const; diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.utils.ts b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.utils.ts index 4d4d45e64..0b534347d 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.utils.ts +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.utils.ts @@ -48,6 +48,8 @@ export const formSchema = z.object({ tags: generalPermissionSchema, "audit-logs": generalPermissionSchema, "ip-allowlist": generalPermissionSchema, + "certificate-authorities": generalPermissionSchema, + certificates: generalPermissionSchema, // akhilmhdh: refactor all keys like below [ProjectPermissionSub.SecretApproval]: generalPermissionSchema, workspace: z diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx index fd65cfd58..adfae81b1 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx @@ -25,6 +25,8 @@ type Props = { | "audit-logs" | "ip-allowlist" | "identity" + | "certificate-authorities" + | "certificates" | ProjectPermissionSub.SecretApproval; isNonEditable?: boolean; setValue: UseFormSetValue; From 34338720e5fd08384e067b071d2a57495e4222bc Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 12 Jun 2024 13:13:42 -0700 Subject: [PATCH 126/187] Rename all certcert to certbody --- backend/src/server/routes/v1/certificate-router.ts | 2 +- .../src/services/certificate/certificate-service.ts | 10 +++++----- backend/src/services/certificate/certificate-types.ts | 2 +- frontend/src/hooks/api/certificates/index.tsx | 2 +- frontend/src/hooks/api/certificates/queries.tsx | 6 +++--- .../components/CertificateCertModal.tsx | 4 ++-- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 257edec1f..3d9993695 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -132,7 +132,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { certificate, certificateChain, serialNumber } = await server.services.certificate.getCertCert({ + const { certificate, certificateChain, serialNumber } = await server.services.certificate.getCertBody({ serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index b5a44b748..569b38791 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -15,7 +15,7 @@ import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns import { getCaCertChain, rebuildCaCrl } from "../certificate-authority/certificate-authority-fns"; import { revocationReasonToCrlCode } from "./certificate-fns"; -import { CertStatus, TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO, TRevokeCertDTO } from "./certificate-types"; +import { CertStatus, TDeleteCertDTO, TGetCertBodyDTO, TGetCertDTO, TRevokeCertDTO } from "./certificate-types"; type TCertificateServiceFactoryDep = { certificateDAL: Pick; @@ -141,7 +141,7 @@ export const certificateServiceFactory = ({ * Return certificate body and certificate chain for certificate with * serial number [serialNumber] */ - const getCertCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => { + const getCertBody = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertBodyDTO) => { const cert = await certificateDAL.findOne({ serialNumber }); const ca = await certificateAuthorityDAL.findById(cert.caId); @@ -155,7 +155,7 @@ export const certificateServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); - const certCert = await certificateBodyDAL.findOne({ certId: cert.id }); + const certBody = await certificateBodyDAL.findOne({ certId: cert.id }); const keyId = await getProjectKmsCertificateKeyId({ projectId: ca.projectId, @@ -165,7 +165,7 @@ export const certificateServiceFactory = ({ const decryptedCert = await kmsService.decrypt({ kmsId: keyId, - cipherTextBlob: certCert.encryptedCertificate + cipherTextBlob: certBody.encryptedCertificate }); const certObj = new x509.X509Certificate(decryptedCert); @@ -189,6 +189,6 @@ export const certificateServiceFactory = ({ getCert, deleteCert, revokeCert, - getCertCert + getCertBody }; }; diff --git a/backend/src/services/certificate/certificate-types.ts b/backend/src/services/certificate/certificate-types.ts index cb7cf5466..93f72afe3 100644 --- a/backend/src/services/certificate/certificate-types.ts +++ b/backend/src/services/certificate/certificate-types.ts @@ -38,6 +38,6 @@ export type TRevokeCertDTO = { revocationReason: CrlReason; } & Omit; -export type TGetCertCertDTO = { +export type TGetCertBodyDTO = { serialNumber: string; } & Omit; diff --git a/frontend/src/hooks/api/certificates/index.tsx b/frontend/src/hooks/api/certificates/index.tsx index df3f39fc7..dd922fd6a 100644 --- a/frontend/src/hooks/api/certificates/index.tsx +++ b/frontend/src/hooks/api/certificates/index.tsx @@ -1,2 +1,2 @@ export { useDeleteCert, useRevokeCert } from "./mutations"; -export { useGetCert, useGetCertCert } from "./queries"; +export { useGetCert, useGetCertBody } from "./queries"; diff --git a/frontend/src/hooks/api/certificates/queries.tsx b/frontend/src/hooks/api/certificates/queries.tsx index 86ae3d4be..50c751c06 100644 --- a/frontend/src/hooks/api/certificates/queries.tsx +++ b/frontend/src/hooks/api/certificates/queries.tsx @@ -6,7 +6,7 @@ import { TCertificate } from "./types"; export const certKeys = { getCertById: (serialNumber: string) => [{ serialNumber }, "cert"], - getCertCert: (serialNumber: string) => [{ serialNumber }, "certCert"] + getCertBody: (serialNumber: string) => [{ serialNumber }, "certBody"] }; export const useGetCert = (serialNumber: string) => { @@ -24,9 +24,9 @@ export const useGetCert = (serialNumber: string) => { }); }; -export const useGetCertCert = (serialNumber: string) => { +export const useGetCertBody = (serialNumber: string) => { return useQuery({ - queryKey: certKeys.getCertCert(serialNumber), + queryKey: certKeys.getCertBody(serialNumber), queryFn: async () => { const { data } = await apiRequest.get<{ certificate: string; diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx index 97c56b0ec..01c79589c 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateCertModal.tsx @@ -1,5 +1,5 @@ import { Modal, ModalContent } from "@app/components/v2"; -import { useGetCertCert } from "@app/hooks/api"; +import { useGetCertBody } from "@app/hooks/api"; import { UsePopUpState } from "@app/hooks/usePopUp"; import { CertificateContent } from "./CertificateContent"; @@ -10,7 +10,7 @@ type Props = { }; export const CertificateCertModal = ({ popUp, handlePopUpToggle }: Props) => { - const { data } = useGetCertCert( + const { data } = useGetCertBody( (popUp?.certificateCert?.data as { serialNumber: string })?.serialNumber || "" ); From 9977329741f83b4708d788f5970606f13a80c65a Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 12 Jun 2024 18:25:18 -0400 Subject: [PATCH 127/187] add sample resources for k8s auth --- .../k8s-auth/cluster-role-binding.yaml | 13 ++++++++ .../k8s-auth/infisical-service-account.yaml | 5 ++++ .../config/samples/k8s-auth/sample.yaml | 30 +++++++++++++++++++ .../k8s-auth/service-account-token.yaml | 7 +++++ 4 files changed, 55 insertions(+) create mode 100644 k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml create mode 100644 k8-operator/config/samples/k8s-auth/infisical-service-account.yaml create mode 100644 k8-operator/config/samples/k8s-auth/sample.yaml create mode 100644 k8-operator/config/samples/k8s-auth/service-account-token.yaml diff --git a/k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml b/k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml new file mode 100644 index 000000000..c1adb56e4 --- /dev/null +++ b/k8-operator/config/samples/k8s-auth/cluster-role-binding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: role-tokenreview-binding + namespace: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - kind: ServiceAccount + name: infisical-auth + namespace: default diff --git a/k8-operator/config/samples/k8s-auth/infisical-service-account.yaml b/k8-operator/config/samples/k8s-auth/infisical-service-account.yaml new file mode 100644 index 000000000..60c7f14fd --- /dev/null +++ b/k8-operator/config/samples/k8s-auth/infisical-service-account.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: infisical-auth + namespace: default \ No newline at end of file diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml new file mode 100644 index 000000000..e4082a9ae --- /dev/null +++ b/k8-operator/config/samples/k8s-auth/sample.yaml @@ -0,0 +1,30 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: infisicalsecret-sample + labels: + label-to-be-passed-to-managed-secret: sample-value + annotations: + example.com/annotation-to-be-passed-to-managed-secret: "sample-value" +spec: + hostAPI: https://app.infisical.com/api + resyncInterval: 10 + authentication: + # Native Kubernetes Auth + kubernetesAuth: + identityId: 8c0c9823-7249-4043-b292-a861fb9b1b50 + # serviceAccountTokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + + # secretsScope is identical to the secrets scope in the universalAuth field in this sample. + secretsScope: + projectSlug: dsf-gpb-t + envSlug: dev + secretsPath: "/" + recursive: true + + + managedSecretReference: + secretName: managed-secret + secretNamespace: default + creationPolicy: "Orphan" ## Owner | Orphan + # secretType: kubernetes.io/dockerconfigjson diff --git a/k8-operator/config/samples/k8s-auth/service-account-token.yaml b/k8-operator/config/samples/k8s-auth/service-account-token.yaml new file mode 100644 index 000000000..894c98b06 --- /dev/null +++ b/k8-operator/config/samples/k8s-auth/service-account-token.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +type: kubernetes.io/service-account-token +metadata: + name: infisical-auth-token + annotations: + kubernetes.io/service-account.name: "infisical-auth" \ No newline at end of file From 7ccf752e0c68d696299384d5e253f45d393a59bf Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 12 Jun 2024 16:49:29 -0700 Subject: [PATCH 128/187] Add pagination for certificates table --- .../src/server/routes/v2/project-router.ts | 14 ++++-- .../services/certificate/certificate-dal.ts | 26 +++++++++- .../src/services/project/project-service.ts | 28 +++++++---- backend/src/services/project/project-types.ts | 6 +++ frontend/src/hooks/api/ca/mutations.tsx | 2 +- .../src/hooks/api/certificates/mutations.tsx | 4 +- frontend/src/hooks/api/workspace/queries.tsx | 47 +++++++++++++++---- .../components/CertificatesTable.tsx | 30 +++++++++--- 8 files changed, 126 insertions(+), 31 deletions(-) diff --git a/backend/src/server/routes/v2/project-router.ts b/backend/src/server/routes/v2/project-router.ts index 1b36a689e..e1c7c2e69 100644 --- a/backend/src/server/routes/v2/project-router.ts +++ b/backend/src/server/routes/v2/project-router.ts @@ -356,15 +356,20 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { params: z.object({ slug: slugSchema.describe("The slug of the project to list certificates.") }), + querystring: z.object({ + offset: z.coerce.number().min(0).max(100).default(0), + limit: z.coerce.number().min(1).max(100).default(25) + }), response: { 200: z.object({ - certificates: z.array(CertificatesSchema) + certificates: z.array(CertificatesSchema), + totalCount: z.number() }) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const certificates = await server.services.project.listProjectCertificates({ + const { certificates, totalCount } = await server.services.project.listProjectCertificates({ filter: { slug: req.params.slug, orgId: req.permission.orgId, @@ -373,9 +378,10 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { actorId: req.permission.id, actorOrgId: req.permission.orgId, actorAuthMethod: req.permission.authMethod, - actor: req.permission.type + actor: req.permission.type, + ...req.query }); - return { certificates }; + return { certificates, totalCount }; } }); }; diff --git a/backend/src/services/certificate/certificate-dal.ts b/backend/src/services/certificate/certificate-dal.ts index 2f049fcc8..415bfabf9 100644 --- a/backend/src/services/certificate/certificate-dal.ts +++ b/backend/src/services/certificate/certificate-dal.ts @@ -1,10 +1,34 @@ import { TDbClient } from "@app/db"; import { TableName } from "@app/db/schemas"; +import { DatabaseError } from "@app/lib/errors"; import { ormify } from "@app/lib/knex"; export type TCertificateDALFactory = ReturnType; export const certificateDALFactory = (db: TDbClient) => { const certificateOrm = ormify(db, TableName.Certificate); - return certificateOrm; + + const countCertificatesInProject = async (projectId: string) => { + try { + interface CountResult { + count: string; + } + + const count = await db(TableName.Certificate) + .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`) + .join(TableName.Project, `${TableName.CertificateAuthority}.projectId`, `${TableName.Project}.id`) + .where(`${TableName.Project}.id`, projectId) + .count("*") + .first(); + + return parseInt((count as unknown as CountResult).count || "0", 10); + } catch (error) { + throw new DatabaseError({ error, name: "Count all project certificates" }); + } + }; + + return { + ...certificateOrm, + countCertificatesInProject + }; }; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 1cf2c2f71..1a8e65a41 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -39,6 +39,7 @@ import { TDeleteProjectDTO, TGetProjectDTO, TListProjectCasDTO, + TListProjectCertsDTO, TToggleProjectAutoCapitalizationDTO, TUpdateProjectDTO, TUpdateProjectNameDTO, @@ -68,7 +69,7 @@ type TProjectServiceFactoryDep = { projectUserMembershipRoleDAL: Pick; secretBlindIndexDAL: Pick; certificateAuthorityDAL: Pick; - certificateDAL: Pick; + certificateDAL: Pick; permissionService: TPermissionServiceFactory; orgService: Pick; licenseService: Pick; @@ -569,12 +570,14 @@ export const projectServiceFactory = ({ * Return list of certificates for project */ const listProjectCertificates = async ({ + offset, + limit, actorId, actorOrgId, actorAuthMethod, filter, actor - }: TListProjectCasDTO) => { + }: TListProjectCertsDTO) => { const project = await projectDAL.findProjectByFilter(filter); const { permission } = await permissionService.getProjectPermission( @@ -589,12 +592,21 @@ export const projectServiceFactory = ({ const cas = await certificateAuthorityDAL.find({ projectId: project.id }); - const certificates = await certificateDAL.find({ - $in: { - caId: cas.map((ca) => ca.id) - } - }); - return certificates; + const certificates = await certificateDAL.find( + { + $in: { + caId: cas.map((ca) => ca.id) + } + }, + { offset, limit, sort: [["updatedAt", "desc"]] } + ); + + const count = await certificateDAL.countCertificatesInProject(project.id); + + return { + certificates, + totalCount: count + }; }; return { diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts index 39e047748..e2d145d3d 100644 --- a/backend/src/services/project/project-types.ts +++ b/backend/src/services/project/project-types.ts @@ -86,3 +86,9 @@ export type TListProjectCasDTO = { status?: CaStatus; filter: Filter; } & Omit; + +export type TListProjectCertsDTO = { + filter: Filter; + offset: number; + limit: number; +} & Omit; diff --git a/frontend/src/hooks/api/ca/mutations.tsx b/frontend/src/hooks/api/ca/mutations.tsx index 3a8f18e17..bb018f71a 100644 --- a/frontend/src/hooks/api/ca/mutations.tsx +++ b/frontend/src/hooks/api/ca/mutations.tsx @@ -102,7 +102,7 @@ export const useCreateCertificate = () => { return data; }, onSuccess: (_, { projectSlug }) => { - queryClient.invalidateQueries(workspaceKeys.getWorkspaceCertificates(projectSlug)); + queryClient.invalidateQueries(workspaceKeys.forWorkspaceCertificates(projectSlug)); } }); }; diff --git a/frontend/src/hooks/api/certificates/mutations.tsx b/frontend/src/hooks/api/certificates/mutations.tsx index cb366e4e1..4c0f92339 100644 --- a/frontend/src/hooks/api/certificates/mutations.tsx +++ b/frontend/src/hooks/api/certificates/mutations.tsx @@ -17,7 +17,7 @@ export const useDeleteCert = () => { return certificate; }, onSuccess: (_, { projectSlug }) => { - queryClient.invalidateQueries(workspaceKeys.getWorkspaceCertificates(projectSlug)); + queryClient.invalidateQueries(workspaceKeys.forWorkspaceCertificates(projectSlug)); } }); }; @@ -37,7 +37,7 @@ export const useRevokeCert = () => { return certificate; }, onSuccess: (_, { projectSlug }) => { - queryClient.invalidateQueries(workspaceKeys.getWorkspaceCertificates(projectSlug)); + queryClient.invalidateQueries(workspaceKeys.forWorkspaceCertificates(projectSlug)); } }); }; diff --git a/frontend/src/hooks/api/workspace/queries.tsx b/frontend/src/hooks/api/workspace/queries.tsx index d3d30e420..7f94bb498 100644 --- a/frontend/src/hooks/api/workspace/queries.tsx +++ b/frontend/src/hooks/api/workspace/queries.tsx @@ -48,8 +48,18 @@ export const workspaceKeys = { [{ projectSlug }, "workspace-cas"] as const, specificWorkspaceCas: ({ projectSlug, status }: { projectSlug: string; status?: CaStatus }) => [...workspaceKeys.getWorkspaceCas({ projectSlug }), { status }] as const, - getWorkspaceCertificates: (projectSlug: string) => - [{ projectSlug }, "workspace-certificates"] as const + allWorkspaceCertificates: () => ["workspace-certificates"] as const, + forWorkspaceCertificates: (slug: string) => + [...workspaceKeys.allWorkspaceCertificates(), slug] as const, + specificWorkspaceCertificates: ({ + slug, + offset, + limit + }: { + slug: string; + offset: number; + limit: number; + }) => [...workspaceKeys.forWorkspaceCertificates(slug), { offset, limit }] as const }; const fetchWorkspaceById = async (workspaceId: string) => { @@ -526,16 +536,37 @@ export const useListWorkspaceCas = ({ }); }; -export const useListWorkspaceCertificates = (projectSlug: string) => { +export const useListWorkspaceCertificates = ({ + projectSlug, + offset, + limit +}: { + projectSlug: string; + offset: number; + limit: number; +}) => { return useQuery({ - queryKey: workspaceKeys.getWorkspaceCertificates(projectSlug), + queryKey: workspaceKeys.specificWorkspaceCertificates({ + slug: projectSlug, + offset, + limit + }), queryFn: async () => { + const params = new URLSearchParams({ + offset: String(offset), + limit: String(limit) + }); + const { - data: { certificates } - } = await apiRequest.get<{ certificates: TCertificate[] }>( - `/api/v2/workspace/${projectSlug}/certificates` + data: { certificates, totalCount } + } = await apiRequest.get<{ certificates: TCertificate[]; totalCount: number }>( + `/api/v2/workspace/${projectSlug}/certificates`, + { + params + } ); - return certificates; + + return { certificates, totalCount }; }, enabled: Boolean(projectSlug) }); diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx index 371c432a1..c83d47507 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx @@ -1,3 +1,4 @@ +import { useState } from "react"; import { faBan, faCertificate, @@ -17,6 +18,7 @@ import { DropdownMenuItem, DropdownMenuTrigger, EmptyState, + Pagination, Table, TableContainer, TableSkeleton, @@ -25,8 +27,7 @@ import { Th, THead, Tooltip, - Tr -} from "@app/components/v2"; + Tr} from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; import { useListWorkspaceCertificates } from "@app/hooks/api"; import { certStatusToNameMap } from "@app/hooks/api/certificates/constants"; @@ -45,8 +46,16 @@ type Props = { }; export const CertificatesTable = ({ handlePopUpOpen }: Props) => { + const [page, setPage] = useState(1); + const [perPage, setPerPage] = useState(25); + const { currentWorkspace } = useWorkspace(); - const { data, isLoading } = useListWorkspaceCertificates(currentWorkspace?.slug ?? ""); + const { data, isLoading } = useListWorkspaceCertificates({ + projectSlug: currentWorkspace?.slug ?? "", + offset: (page - 1) * perPage, + limit: perPage + }); + return (
@@ -62,9 +71,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
{certificate.friendlyName}
- {!isLoading && data?.length === 0 && ( + {!isLoading && data?.totalCount !== undefined && ( + setPage(newPage)} + onChangePerPage={(newPerPage) => setPerPage(newPerPage)} + /> + )} + {!isLoading && !data?.certificates?.length && ( )} From 81513e4a750d58b6b93d6b800ff39bbeb5c36f75 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 12 Jun 2024 20:17:09 -0400 Subject: [PATCH 129/187] remove time ago --- frontend/src/pages/org/[id]/overview/index.tsx | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index b189beeb8..177a6586b 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -63,7 +63,6 @@ import { // import { fetchUserWsKey } from "@app/hooks/api/keys/queries"; import { useFetchServerStatus } from "@app/hooks/api/serverDetails"; import { usePopUp } from "@app/hooks/usePopUp"; -import { timeAgo } from "@app/lib/fn/date"; const features = [ { @@ -647,13 +646,10 @@ const OrganizationPage = withPermission(
{workspace.name}
-
-
+
+
{workspace.environments?.length || 0} environments
-
- Updated {timeAgo(new Date(workspace.updatedAt), new Date())} -
))} From bd6a89fa9a98f99d73a6691c7df580ad5d803489 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 02:25:49 +0200 Subject: [PATCH 130/187] Feat: Improved authentication handler --- .../controllers/infisicalsecret_auth.go | 137 ++++++++++++++++++ .../controllers/infisicalsecret_helper.go | 132 ++++------------- 2 files changed, 169 insertions(+), 100 deletions(-) create mode 100644 k8-operator/controllers/infisicalsecret_auth.go diff --git a/k8-operator/controllers/infisicalsecret_auth.go b/k8-operator/controllers/infisicalsecret_auth.go new file mode 100644 index 000000000..912ff9b12 --- /dev/null +++ b/k8-operator/controllers/infisicalsecret_auth.go @@ -0,0 +1,137 @@ +package controllers + +import ( + "context" + "errors" + "fmt" + + "github.com/Infisical/infisical/k8-operator/api/v1alpha1" +) + +type AuthStrategyType string + +var AuthStrategy = struct { + SERVICE_TOKEN AuthStrategyType + SERVICE_ACCOUNT AuthStrategyType + UNIVERSAL_MACHINE_IDENTITY AuthStrategyType + KUBERNETES_MACHINE_IDENTITY AuthStrategyType + AWS_IAM_MACHINE_IDENTITY AuthStrategyType + AZURE_MACHINE_IDENTITY AuthStrategyType + GCP_ID_TOKEN_MACHINE_IDENTITY AuthStrategyType + GCP_IAM_MACHINE_IDENTITY AuthStrategyType +}{ + SERVICE_TOKEN: "SERVICE_TOKEN", + SERVICE_ACCOUNT: "SERVICE_ACCOUNT", + UNIVERSAL_MACHINE_IDENTITY: "UNIVERSAL_MACHINE_IDENTITY", + KUBERNETES_MACHINE_IDENTITY: "KUBERNETES_AUTH_MACHINE_IDENTITY", + AWS_IAM_MACHINE_IDENTITY: "AWS_IAM_MACHINE_IDENTITY", + AZURE_MACHINE_IDENTITY: "AZURE_MACHINE_IDENTITY", + GCP_ID_TOKEN_MACHINE_IDENTITY: "GCP_ID_TOKEN_MACHINE_IDENTITY", + GCP_IAM_MACHINE_IDENTITY: "GCP_IAM_MACHINE_IDENTITY", +} + +var ErrAuthNotApplicable = errors.New("authentication not applicable") + +func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + + // Machine Identities: + universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) + universalAuthSpec := infisicalSecret.Spec.Authentication.UniversalAuth + + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get machine identity creds from kube secret [err=%s]", err) + } + + if universalAuthKubeSecret.ClientId == "" && universalAuthKubeSecret.ClientSecret == "" { + return AuthenticationDetails{}, ErrAuthNotApplicable + } + + _, err = infisicalClient.Auth().UniversalAuthLogin(universalAuthKubeSecret.ClientId, universalAuthKubeSecret.ClientSecret) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with machine identity credentials [err=%s]", err) + } + + fmt.Println("Successfully authenticated with machine identity credentials") + + return AuthenticationDetails{authStrategy: AuthStrategy.UNIVERSAL_MACHINE_IDENTITY, machineIdentityScope: universalAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + +} + +func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth + + if kubernetesAuthSpec.IdentityID == "" { + return AuthenticationDetails{}, ErrAuthNotApplicable + } + + _, err := infisicalClient.Auth().KubernetesAuthLogin(kubernetesAuthSpec.IdentityID, kubernetesAuthSpec.ServiceAccountTokenPath) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with Kubernetes native auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.KUBERNETES_MACHINE_IDENTITY, machineIdentityScope: kubernetesAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + +} + +func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth + + if awsIamAuthSpec.IdentityID == "" { + return AuthenticationDetails{}, ErrAuthNotApplicable + } + + _, err := infisicalClient.Auth().AwsIamAuthLogin(awsIamAuthSpec.IdentityID) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with AWS IAM auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.AWS_IAM_MACHINE_IDENTITY, machineIdentityScope: awsIamAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + +} + +func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth + + if azureAuthSpec.IdentityID == "" { + return AuthenticationDetails{}, ErrAuthNotApplicable + } + + _, err := infisicalClient.Auth().AzureAuthLogin(azureAuthSpec.IdentityID) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with Azure auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.AZURE_MACHINE_IDENTITY, machineIdentityScope: azureAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil + +} + +func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth + + if gcpIdTokenSpec.IdentityID == "" { + return AuthenticationDetails{}, ErrAuthNotApplicable + } + + _, err := infisicalClient.Auth().GcpIdTokenAuthLogin(gcpIdTokenSpec.IdentityID) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP Id Token auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY, machineIdentityScope: gcpIdTokenSpec.SecretsScope, isMachineIdentityAuth: true}, nil + +} + +func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { + gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth + + if gcpIamSpec.IdentityID == "" && gcpIamSpec.ServiceAccountKeyFilePath == "" { + return AuthenticationDetails{}, ErrAuthNotApplicable + } + + _, err := infisicalClient.Auth().GcpIamAuthLogin(gcpIamSpec.IdentityID, gcpIamSpec.ServiceAccountKeyFilePath) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP IAM auth [err=%s]", err) + } + + return AuthenticationDetails{authStrategy: AuthStrategy.GCP_IAM_MACHINE_IDENTITY, machineIdentityScope: gcpIamSpec.SecretsScope, isMachineIdentityAuth: true}, nil +} diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 7a1dfc1dd..e0b618994 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -2,6 +2,7 @@ package controllers import ( "context" + "errors" "fmt" "strings" @@ -9,36 +10,16 @@ import ( "github.com/Infisical/infisical/k8-operator/packages/api" "github.com/Infisical/infisical/k8-operator/packages/model" "github.com/Infisical/infisical/k8-operator/packages/util" + + "k8s.io/apimachinery/pkg/types" + infisicalSdk "github.com/infisical/go-sdk" corev1 "k8s.io/api/core/v1" - "k8s.io/apimachinery/pkg/api/errors" + k8Errors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/types" ctrl "sigs.k8s.io/controller-runtime" ) -type AuthStrategyType string - -var AuthStrategy = struct { - SERVICE_TOKEN AuthStrategyType - SERVICE_ACCOUNT AuthStrategyType - UNIVERSAL_MACHINE_IDENTITY AuthStrategyType - KUBERNETES_MACHINE_IDENTITY AuthStrategyType - AWS_IAM_MACHINE_IDENTITY AuthStrategyType - AZURE_MACHINE_IDENTITY AuthStrategyType - GCP_ID_TOKEN_MACHINE_IDENTITY AuthStrategyType - GCP_IAM_MACHINE_IDENTITY AuthStrategyType -}{ - SERVICE_TOKEN: "SERVICE_TOKEN", - SERVICE_ACCOUNT: "SERVICE_ACCOUNT", - UNIVERSAL_MACHINE_IDENTITY: "UNIVERSAL_MACHINE_IDENTITY", - KUBERNETES_MACHINE_IDENTITY: "KUBERNETES_AUTH_MACHINE_IDENTITY", - AWS_IAM_MACHINE_IDENTITY: "AWS_IAM_MACHINE_IDENTITY", - AZURE_MACHINE_IDENTITY: "AZURE_MACHINE_IDENTITY", - GCP_ID_TOKEN_MACHINE_IDENTITY: "GCP_ID_TOKEN_MACHINE_IDENTITY", - GCP_IAM_MACHINE_IDENTITY: "GCP_IAM_MACHINE_IDENTITY", -} - type AuthenticationDetails struct { authStrategy AuthStrategyType machineIdentityScope v1alpha1.MachineIdentityScopeInWorkspace // This will only be set if a machine identity auth method is used (e.g. UniversalAuth or KubernetesAuth, etc.) @@ -63,30 +44,17 @@ var authDetails AuthenticationDetails func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { - // Legacy support, service token auth + // ? Legacy support, service token auth infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) if err != nil { return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err) } - // Legacy support, service account auth + // ? Legacy support, service account auth serviceAccountCreds, err := r.GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret) if err != nil { return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err) } - // Machine Identities: - universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) - - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get machine identity creds from kube secret [err=%s]", err) - } - - universalAuthSpec := infisicalSecret.Spec.Authentication.UniversalAuth - kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth - awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth - azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth - gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth - gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth if serviceAccountCreds.AccessKey != "" || serviceAccountCreds.PrivateKey != "" || serviceAccountCreds.PublicKey != "" { return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_ACCOUNT}, nil @@ -94,64 +62,28 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil } - if universalAuthKubeSecret.ClientId != "" && universalAuthKubeSecret.ClientSecret != "" { - _, err := infisicalClient.Auth().UniversalAuthLogin(universalAuthKubeSecret.ClientId, universalAuthKubeSecret.ClientSecret) - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("unable to login with machine identity credentials [err=%s]", err) - } - - fmt.Println("Successfully authenticated with machine identity credentials") - - return AuthenticationDetails{authStrategy: AuthStrategy.UNIVERSAL_MACHINE_IDENTITY, machineIdentityScope: universalAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil - - } - if kubernetesAuthSpec.IdentityID != "" { - _, err := infisicalClient.Auth().KubernetesAuthLogin(kubernetesAuthSpec.IdentityID, kubernetesAuthSpec.ServiceAccountTokenPath) - - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("unable to login with Kubernetes native auth [err=%s]", err) - } - - return AuthenticationDetails{authStrategy: AuthStrategy.KUBERNETES_MACHINE_IDENTITY, machineIdentityScope: kubernetesAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil - } - if awsIamAuthSpec.IdentityID != "" { - _, err := infisicalClient.Auth().AwsIamAuthLogin(awsIamAuthSpec.IdentityID) - - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("unable to login with AWS IAM auth [err=%s]", err) - } - - return AuthenticationDetails{authStrategy: AuthStrategy.AWS_IAM_MACHINE_IDENTITY, machineIdentityScope: awsIamAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil - } - if azureAuthSpec.IdentityID != "" { - _, err := infisicalClient.Auth().AzureAuthLogin(azureAuthSpec.IdentityID) - - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("unable to login with Azure auth [err=%s]", err) - } - - return AuthenticationDetails{authStrategy: AuthStrategy.AZURE_MACHINE_IDENTITY, machineIdentityScope: azureAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil - } - if gcpIdTokenSpec.IdentityID != "" { - _, err := infisicalClient.Auth().GcpIdTokenAuthLogin(gcpIdTokenSpec.IdentityID) - - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP Id Token auth [err=%s]", err) - } - - return AuthenticationDetails{authStrategy: AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY, machineIdentityScope: gcpIdTokenSpec.SecretsScope, isMachineIdentityAuth: true}, nil - } - if gcpIamSpec.IdentityID != "" && gcpIamSpec.ServiceAccountKeyFilePath != "" { - _, err := infisicalClient.Auth().GcpIamAuthLogin(gcpIamSpec.IdentityID, gcpIamSpec.ServiceAccountKeyFilePath) - - if err != nil { - return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP IAM auth [err=%s]", err) - } - - return AuthenticationDetails{authStrategy: AuthStrategy.GCP_IAM_MACHINE_IDENTITY, machineIdentityScope: gcpIamSpec.SecretsScope, isMachineIdentityAuth: true}, nil + authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error){ + AuthStrategy.UNIVERSAL_MACHINE_IDENTITY: r.handleUniversalAuth, + AuthStrategy.KUBERNETES_MACHINE_IDENTITY: r.handleKubernetesAuth, + AuthStrategy.AWS_IAM_MACHINE_IDENTITY: r.handleAwsIamAuth, + AuthStrategy.AZURE_MACHINE_IDENTITY: r.handleAzureAuth, + AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY: r.handleGcpIdTokenAuth, + AuthStrategy.GCP_IAM_MACHINE_IDENTITY: r.handleGcpIamAuth, } - return AuthenticationDetails{}, nil + for authStrategy, authHandler := range authStrategies { + authDetails, err := authHandler(ctx, infisicalSecret) + + if err == nil { + return authDetails, nil + } + + if err != nil && !errors.Is(err, ErrAuthNotApplicable) { + return AuthenticationDetails{}, fmt.Errorf("authentication failed for strategy [%s] [err=%w]", authStrategy, err) + } + } + + return AuthenticationDetails{}, fmt.Errorf("no authentication method provided") } @@ -167,7 +99,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalConfigMap(ctx context.Context) ( }, kubeConfigMap) if err != nil { - if errors.IsNotFound(err) { + if k8Errors.IsNotFound(err) { kubeConfigMap = nil } else { return nil, fmt.Errorf("GetConfigMapByNamespacedName: unable to fetch config map in [namespacedName=%s] [err=%s]", OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE, err) @@ -216,7 +148,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context. Name: secretName, }) - if errors.IsNotFound(err) { + if k8Errors.IsNotFound(err) { return "", nil } @@ -236,7 +168,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalUniversalAuthFromKubeSecret(ctx Name: infisicalSecret.Spec.Authentication.UniversalAuth.CredentialsRef.SecretName, }) - if errors.IsNotFound(err) { + if k8Errors.IsNotFound(err) { return model.MachineIdentityDetails{}, nil } @@ -259,7 +191,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKub Name: infisicalSecret.Spec.Authentication.ServiceAccount.ServiceAccountSecretReference.SecretName, }) - if errors.IsNotFound(err) { + if k8Errors.IsNotFound(err) { return model.ServiceAccountDetails{}, nil } @@ -380,7 +312,7 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace, }) - if err != nil && !errors.IsNotFound(err) { + if err != nil && !k8Errors.IsNotFound(err) { return fmt.Errorf("something went wrong when fetching the managed Kubernetes secret [%w]", err) } From b94db5d6744615f9f4f2410ee11c52a4e9f70591 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 02:55:00 +0200 Subject: [PATCH 131/187] Standalone infisical SDK instance --- .../controllers/infisicalsecret_auth.go | 13 +++++++------ .../controllers/infisicalsecret_controller.go | 10 +++++++++- .../controllers/infisicalsecret_helper.go | 18 ++++++------------ 3 files changed, 22 insertions(+), 19 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_auth.go b/k8-operator/controllers/infisicalsecret_auth.go index 912ff9b12..a2930b330 100644 --- a/k8-operator/controllers/infisicalsecret_auth.go +++ b/k8-operator/controllers/infisicalsecret_auth.go @@ -6,6 +6,7 @@ import ( "fmt" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" + infisicalSdk "github.com/infisical/go-sdk" ) type AuthStrategyType string @@ -32,7 +33,7 @@ var AuthStrategy = struct { var ErrAuthNotApplicable = errors.New("authentication not applicable") -func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { // Machine Identities: universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) @@ -57,7 +58,7 @@ func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, inf } -func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth if kubernetesAuthSpec.IdentityID == "" { @@ -73,7 +74,7 @@ func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, in } -func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth if awsIamAuthSpec.IdentityID == "" { @@ -89,7 +90,7 @@ func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisi } -func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth if azureAuthSpec.IdentityID == "" { @@ -105,7 +106,7 @@ func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisic } -func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth if gcpIdTokenSpec.IdentityID == "" { @@ -121,7 +122,7 @@ func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, in } -func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth if gcpIamSpec.IdentityID == "" && gcpIamSpec.ServiceAccountKeyFilePath == "" { diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 5d57dd831..0bbd3b89b 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -12,6 +12,8 @@ import ( secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/packages/api" + infisical "github.com/infisical/go-sdk" + infisicalSdk "github.com/infisical/go-sdk" ) // InfisicalSecretReconciler reconciles a InfisicalSecret object @@ -80,7 +82,13 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ api.API_HOST_URL = infisicalSecretCR.Spec.HostAPI } - err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR) + // Initialize the SDK client with the necessary configuration + infisicalClient := infisical.NewInfisicalClient(infisicalSdk.Config{ + SiteUrl: api.API_HOST_URL, + UserAgent: api.USER_AGENT_NAME, + }) + + err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR, infisicalClient) r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err) if err != nil { diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index e0b618994..ebd94a1e8 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -7,7 +7,6 @@ import ( "strings" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" - "github.com/Infisical/infisical/k8-operator/packages/api" "github.com/Infisical/infisical/k8-operator/packages/model" "github.com/Infisical/infisical/k8-operator/packages/util" @@ -39,10 +38,10 @@ const OPERATOR_SETTINGS_CONFIGMAP_NAME = "infisical-config" const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system" const INFISICAL_DOMAIN = "https://app.infisical.com/api" -var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) +// var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) var authDetails AuthenticationDetails -func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { // ? Legacy support, service token auth infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) @@ -62,7 +61,7 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil } - authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error){ + authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error){ AuthStrategy.UNIVERSAL_MACHINE_IDENTITY: r.handleUniversalAuth, AuthStrategy.KUBERNETES_MACHINE_IDENTITY: r.handleKubernetesAuth, AuthStrategy.AWS_IAM_MACHINE_IDENTITY: r.handleAwsIamAuth, @@ -72,7 +71,7 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in } for authStrategy, authHandler := range authStrategies { - authDetails, err := authHandler(ctx, infisicalSecret) + authDetails, err := authHandler(ctx, infisicalSecret, infisicalClient) if err == nil { return authDetails, nil @@ -288,16 +287,11 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context return nil } -func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error { - // We can't set these values when instantiating the client because we can't be sure that the variables have been populated yet. So instead we're updating the configuration here. This will happen on each reconcile, which is fine. - infisicalClient.UpdateConfiguration(infisicalSdk.Config{ - SiteUrl: api.API_HOST_URL, - UserAgent: api.USER_AGENT_NAME, - }) +func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) error { if authDetails.authStrategy == "" { fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") - details, err := r.HandleAuthentication(ctx, infisicalSecret) + details, err := r.HandleAuthentication(ctx, infisicalSecret, infisicalClient) if err != nil { return fmt.Errorf("unable to authenticate [err=%s]", err) From a70043b80d2ba825bc7bdcc2fada81e58b240476 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 03:05:22 +0200 Subject: [PATCH 132/187] Conditioning --- k8-operator/controllers/conditions.go | 4 ++-- k8-operator/controllers/infisicalsecret_helper.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/k8-operator/controllers/conditions.go b/k8-operator/controllers/conditions.go index dea822088..312b1d699 100644 --- a/k8-operator/controllers/conditions.go +++ b/k8-operator/controllers/conditions.go @@ -40,7 +40,7 @@ func (r *InfisicalSecretReconciler) SetReadyToSyncSecretsConditions(ctx context. return r.Client.Status().Update(ctx, infisicalSecret) } -func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, errorToConditionOn error) { +func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, authStrategy AuthStrategyType, errorToConditionOn error) { if infisicalSecret.Status.Conditions == nil { infisicalSecret.Status.Conditions = []metav1.Condition{} } @@ -50,7 +50,7 @@ func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.C Type: "secrets.infisical.com/LoadedInfisicalToken", Status: metav1.ConditionTrue, Reason: "OK", - Message: "Infisical controller has located the Infisical token in provided Kubernetes secret", + Message: fmt.Sprintf("Infisical controller has loaded the Infisical token in provided Kubernetes secret, using %v authentication strategy", authStrategy), }) } else { meta.SetStatusCondition(&infisicalSecret.Status.Conditions, metav1.Condition{ diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index ebd94a1e8..f0d021a97 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -292,6 +292,7 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context if authDetails.authStrategy == "" { fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") details, err := r.HandleAuthentication(ctx, infisicalSecret, infisicalClient) + r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, details.authStrategy, err) if err != nil { return fmt.Errorf("unable to authenticate [err=%s]", err) @@ -325,7 +326,6 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context return fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err) } - r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, err) if err != nil { return fmt.Errorf("unable to load Infisical Token from the specified Kubernetes secret with error [%w]", err) } From da7da27572b5586d1075fc0ceb1f607f19d28566 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 12 Jun 2024 18:37:02 -0700 Subject: [PATCH 133/187] Add ca / cert audit logs --- .../ee/services/audit-log/audit-log-types.ts | 152 +++++++++++++++++- .../routes/v1/certificate-authority-router.ts | 144 ++++++++++++++++- .../server/routes/v1/certificate-router.ts | 69 +++++++- .../certificate-authority-service.ts | 19 ++- .../certificate/certificate-service.ts | 17 +- .../src/hooks/api/auditLogs/constants.tsx | 17 +- frontend/src/hooks/api/auditLogs/enums.tsx | 16 +- frontend/src/hooks/api/auditLogs/types.tsx | 136 +++++++++++++++- .../AuditLogsPage/components/LogsTableRow.tsx | 24 +++ 9 files changed, 567 insertions(+), 27 deletions(-) diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 415814998..8a0d2aef9 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -1,5 +1,6 @@ import { TProjectPermission } from "@app/lib/types"; import { ActorType } from "@app/services/auth/auth-type"; +import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types"; import { TIdentityTrustedIp } from "@app/services/identity/identity-types"; export type TListProjectAuditLogDTO = { @@ -104,7 +105,21 @@ export enum EventType { SECRET_APPROVAL_MERGED = "secret-approval-merged", SECRET_APPROVAL_REQUEST = "secret-approval-request", SECRET_APPROVAL_CLOSED = "secret-approval-closed", - SECRET_APPROVAL_REOPENED = "secret-approval-reopened" + SECRET_APPROVAL_REOPENED = "secret-approval-reopened", + CREATE_CA = "create-certificate-authority", + GET_CA = "get-certificate-authority", + UPDATE_CA = "update-certificate-authority", + DELETE_CA = "delete-certificate-authority", + GET_CA_CSR = "get-certificate-authority-csr", + GET_CA_CERT = "get-certificate-authority-cert", + SIGN_INTERMEDIATE = "sign-intermediate", + IMPORT_CA_CERT = "import-certificate-authority-cert", + GET_CA_CRL = "get-certificate-authority-crl", + ISSUE_CERT = "issue-cert", + GET_CERT = "get-cert", + DELETE_CERT = "delete-cert", + REVOKE_CERT = "revoke-cert", + GET_CERT_BODY = "get-cert-body" } interface UserActorMetadata { @@ -843,6 +858,125 @@ interface SecretApprovalRequest { }; } +interface CreateCa { + type: EventType.CREATE_CA; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCa { + type: EventType.GET_CA; + metadata: { + caId: string; + dn: string; + }; +} + +interface UpdateCa { + type: EventType.UPDATE_CA; + metadata: { + caId: string; + dn: string; + status: CaStatus; + }; +} + +interface DeleteCa { + type: EventType.DELETE_CA; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCaCsr { + type: EventType.GET_CA_CSR; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCaCert { + type: EventType.GET_CA_CERT; + metadata: { + caId: string; + dn: string; + }; +} + +interface SignIntermediate { + type: EventType.SIGN_INTERMEDIATE; + metadata: { + caId: string; + dn: string; + serialNumber: string; + }; +} + +interface ImportCaCert { + type: EventType.IMPORT_CA_CERT; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCaCrl { + type: EventType.GET_CA_CRL; + metadata: { + caId: string; + dn: string; + }; +} + +interface IssueCert { + type: EventType.ISSUE_CERT; + metadata: { + caId: string; + dn: string; + serialNumber: string; + }; +} + +interface GetCert { + type: EventType.GET_CERT; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + +interface DeleteCert { + type: EventType.DELETE_CERT; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + +interface RevokeCert { + type: EventType.REVOKE_CERT; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + +interface GetCertBody { + type: EventType.GET_CERT_BODY; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + export type Event = | GetSecretsEvent | GetSecretEvent @@ -910,4 +1044,18 @@ export type Event = | SecretApprovalMerge | SecretApprovalClosed | SecretApprovalRequest - | SecretApprovalReopened; + | SecretApprovalReopened + | CreateCa + | GetCa + | UpdateCa + | DeleteCa + | GetCaCsr + | GetCaCert + | SignIntermediate + | ImportCaCert + | GetCaCrl + | IssueCert + | GetCert + | DeleteCert + | RevokeCert + | GetCertBody; diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts index ff84e86f1..d013bfdad 100644 --- a/backend/src/server/routes/v1/certificate-authority-router.ts +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -2,6 +2,7 @@ import ms from "ms"; import { z } from "zod"; import { CertificateAuthoritiesSchema } from "@app/db/schemas"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -63,6 +64,19 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, ...req.body }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.CREATE_CA, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { ca }; @@ -95,6 +109,19 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.GET_CA, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { ca }; @@ -131,6 +158,20 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, ...req.body }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.UPDATE_CA, + metadata: { + caId: ca.id, + dn: ca.dn, + status: ca.status as CaStatus + } + } + }); + return { ca }; @@ -163,6 +204,19 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.DELETE_CA, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { ca }; @@ -188,13 +242,26 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const csr = await server.services.certificateAuthority.getCaCsr({ + const { ca, csr } = await server.services.certificateAuthority.getCaCsr({ caId: req.params.caId, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.GET_CA_CSR, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { csr }; @@ -222,13 +289,26 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { certificate, certificateChain, serialNumber } = await server.services.certificateAuthority.getCaCert({ + const { certificate, certificateChain, serialNumber, ca } = await server.services.certificateAuthority.getCaCert({ caId: req.params.caId, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.GET_CA_CERT, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { certificate, certificateChain, @@ -265,7 +345,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { certificate, certificateChain, issuingCaCertificate, serialNumber } = + const { certificate, certificateChain, issuingCaCertificate, serialNumber, ca } = await server.services.certificateAuthority.signIntermediate({ caId: req.params.caId, actor: req.permission.type, @@ -274,6 +354,20 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, ...req.body }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.SIGN_INTERMEDIATE, + metadata: { + caId: ca.id, + dn: ca.dn, + serialNumber + } + } + }); + return { certificate, certificateChain, @@ -307,7 +401,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - await server.services.certificateAuthority.importCertToCa({ + const { ca } = await server.services.certificateAuthority.importCertToCa({ caId: req.params.caId, actor: req.permission.type, actorId: req.permission.id, @@ -316,6 +410,18 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { ...req.body }); + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.IMPORT_CA_CERT, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { message: "Successfully imported certificate to CA", caId: req.params.caId @@ -364,7 +470,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } = + const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber, ca } = await server.services.certificateAuthority.issueCertFromCa({ caId: req.params.caId, actor: req.permission.type, @@ -374,6 +480,19 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { ...req.body }); + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.ISSUE_CERT, + metadata: { + caId: ca.id, + dn: ca.dn, + serialNumber + } + } + }); + return { certificate, certificateChain, @@ -403,13 +522,26 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { crl } = await server.services.certificateAuthority.getCaCrl({ + const { crl, ca } = await server.services.certificateAuthority.getCaCrl({ caId: req.params.caId, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.GET_CA_CRL, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + return { crl }; diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 3d9993695..27da18431 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -1,6 +1,7 @@ import { z } from "zod"; import { CertificatesSchema } from "@app/db/schemas"; +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -26,15 +27,29 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const certificate = await server.services.certificate.getCert({ + const { cert, ca } = await server.services.certificate.getCert({ serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.GET_CERT, + metadata: { + certId: cert.id, + cn: cert.commonName, + serialNumber: cert.serialNumber + } + } + }); + return { - certificate + certificate: cert }; } }); @@ -63,7 +78,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { revokedAt } = await server.services.certificate.revokeCert({ + const { revokedAt, cert, ca } = await server.services.certificate.revokeCert({ serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, @@ -71,6 +86,20 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, ...req.body }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.REVOKE_CERT, + metadata: { + certId: cert.id, + cn: cert.commonName, + serialNumber: cert.serialNumber + } + } + }); + return { message: "Successfully revoked certificate", serialNumber: req.params.serialNumber, @@ -98,15 +127,29 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const certificate = await server.services.certificate.deleteCert({ + const { deletedCert, ca } = await server.services.certificate.deleteCert({ serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.DELETE_CERT, + metadata: { + certId: deletedCert.id, + cn: deletedCert.commonName, + serialNumber: deletedCert.serialNumber + } + } + }); + return { - certificate + certificate: deletedCert }; } }); @@ -132,13 +175,27 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { } }, handler: async (req) => { - const { certificate, certificateChain, serialNumber } = await server.services.certificate.getCertBody({ + const { certificate, certificateChain, serialNumber, cert, ca } = await server.services.certificate.getCertBody({ serialNumber: req.params.serialNumber, actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.DELETE_CERT, + metadata: { + certId: cert.id, + cn: cert.commonName, + serialNumber: cert.serialNumber + } + } + }); + return { certificate, certificateChain, diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index a97e2df7e..7d753f879 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -373,7 +373,10 @@ export const certificateAuthorityServiceFactory = ({ attributes: [new x509.ChallengePasswordAttribute("password")] }); - return csrObj.toString("pem"); + return { + csr: csrObj.toString("pem"), + ca + }; }; /** @@ -407,7 +410,8 @@ export const certificateAuthorityServiceFactory = ({ return { certificate: caCert, certificateChain: caCertChain, - serialNumber + serialNumber, + ca }; }; @@ -535,7 +539,8 @@ export const certificateAuthorityServiceFactory = ({ certificate: intermediateCert.toString("pem"), issuingCaCertificate, certificateChain: `${issuingCaCertificate}\n${caCertChain}`.trim(), - serialNumber: intermediateCert.serialNumber + serialNumber: intermediateCert.serialNumber, + ca }; }; @@ -639,6 +644,8 @@ export const certificateAuthorityServiceFactory = ({ tx ); }); + + return { ca }; }; /** @@ -797,7 +804,8 @@ export const certificateAuthorityServiceFactory = ({ certificateChain: `${issuingCaCertificate}\n${caCertChain}`.trim(), issuingCaCertificate, privateKey: skLeaf, - serialNumber + serialNumber, + ca }; }; @@ -841,7 +849,8 @@ export const certificateAuthorityServiceFactory = ({ const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`; return { - crl: crlPem + crl: crlPem, + ca }; }; diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index 569b38791..0a7548df8 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -59,7 +59,10 @@ export const certificateServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates); - return cert; + return { + cert, + ca + }; }; /** @@ -80,7 +83,11 @@ export const certificateServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates); const deletedCert = await certificateDAL.deleteById(cert.id); - return deletedCert; + + return { + deletedCert, + ca + }; }; /** @@ -134,7 +141,7 @@ export const certificateServiceFactory = ({ kmsService }); - return { revokedAt }; + return { revokedAt, cert, ca }; }; /** @@ -181,7 +188,9 @@ export const certificateServiceFactory = ({ return { certificate: certObj.toString("pem"), certificateChain: `${caCert}\n${caCertChain}`.trim(), - serialNumber: certObj.serialNumber + serialNumber: certObj.serialNumber, + cert, + ca }; }; diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index 348700374..082bff02c 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -26,7 +26,6 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET]: "Create universal auth client secret", [EventType.REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET]: "Revoke universal auth client secret", [EventType.GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS]: "Get universal auth client secrets", - [EventType.GET_IDENTITY_UNIVERSAL_AUTH]: "Get universal auth", [EventType.CREATE_ENVIRONMENT]: "Create environment", [EventType.UPDATE_ENVIRONMENT]: "Update environment", [EventType.DELETE_ENVIRONMENT]: "Delete environment", @@ -43,7 +42,21 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.UPDATE_SECRET_IMPORT]: "Update secret import", [EventType.DELETE_SECRET_IMPORT]: "Delete secret import", [EventType.UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS]: "Update denied permissions", - [EventType.UPDATE_USER_WORKSPACE_ROLE]: "Update user role" + [EventType.UPDATE_USER_WORKSPACE_ROLE]: "Update user role", + [EventType.CREATE_CA]: "Create CA", + [EventType.GET_CA]: "Get CA", + [EventType.UPDATE_CA]: "Update CA", + [EventType.DELETE_CA]: "Delete CA", + [EventType.GET_CA_CSR]: "Get CA CSR", + [EventType.GET_CA_CERT]: "Get CA certificate", + [EventType.SIGN_INTERMEDIATE]: "Sign intermediate", + [EventType.IMPORT_CA_CERT]: "Import CA certificate", + [EventType.GET_CA_CRL]: "Get CA CRL", + [EventType.ISSUE_CERT]: "Issue certificate", + [EventType.GET_CERT]: "Get certificate", + [EventType.DELETE_CERT]: "Delete certificate", + [EventType.REVOKE_CERT]: "Revoke certificate", + [EventType.GET_CERT_BODY]: "Get certificate body" }; export const userAgentTTypeoNameMap: { [K in UserAgentType]: string } = { diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index f6ccd8f81..ad49998c5 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -56,5 +56,19 @@ export enum EventType { UPDATE_SECRET_IMPORT = "update-secret-import", DELETE_SECRET_IMPORT = "delete-secret-import", UPDATE_USER_WORKSPACE_ROLE = "update-user-workspace-role", - UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions" + UPDATE_USER_WORKSPACE_DENIED_PERMISSIONS = "update-user-workspace-denied-permissions", + CREATE_CA = "create-certificate-authority", + GET_CA = "get-certificate-authority", + UPDATE_CA = "update-certificate-authority", + DELETE_CA = "delete-certificate-authority", + GET_CA_CSR = "get-certificate-authority-csr", + GET_CA_CERT = "get-certificate-authority-cert", + SIGN_INTERMEDIATE = "sign-intermediate", + IMPORT_CA_CERT = "import-certificate-authority-cert", + GET_CA_CRL = "get-certificate-authority-crl", + ISSUE_CERT = "issue-cert", + GET_CERT = "get-cert", + DELETE_CERT = "delete-cert", + REVOKE_CERT = "revoke-cert", + GET_CERT_BODY = "get-cert-body" } diff --git a/frontend/src/hooks/api/auditLogs/types.tsx b/frontend/src/hooks/api/auditLogs/types.tsx index 92611c814..3b607e596 100644 --- a/frontend/src/hooks/api/auditLogs/types.tsx +++ b/frontend/src/hooks/api/auditLogs/types.tsx @@ -1,3 +1,4 @@ +import { CaStatus } from "../ca"; import { IdentityTrustedIp } from "../identities/types"; import { ActorType, EventType, UserAgentType } from "./enums"; @@ -462,6 +463,125 @@ interface UpdateUserDeniedPermissions { }; } +interface CreateCa { + type: EventType.CREATE_CA; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCa { + type: EventType.GET_CA; + metadata: { + caId: string; + dn: string; + }; +} + +interface UpdateCa { + type: EventType.UPDATE_CA; + metadata: { + caId: string; + dn: string; + status: CaStatus; + }; +} + +interface DeleteCa { + type: EventType.DELETE_CA; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCaCsr { + type: EventType.GET_CA_CSR; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCaCert { + type: EventType.GET_CA_CERT; + metadata: { + caId: string; + dn: string; + }; +} + +interface SignIntermediate { + type: EventType.SIGN_INTERMEDIATE; + metadata: { + caId: string; + dn: string; + serialNumber: string; + }; +} + +interface ImportCaCert { + type: EventType.IMPORT_CA_CERT; + metadata: { + caId: string; + dn: string; + }; +} + +interface GetCaCrl { + type: EventType.GET_CA_CRL; + metadata: { + caId: string; + dn: string; + }; +} + +interface IssueCert { + type: EventType.ISSUE_CERT; + metadata: { + caId: string; + dn: string; + serialNumber: string; + }; +} + +interface GetCert { + type: EventType.GET_CERT; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + +interface DeleteCert { + type: EventType.DELETE_CERT; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + +interface RevokeCert { + type: EventType.REVOKE_CERT; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + +interface GetCertBody { + type: EventType.GET_CERT_BODY; + metadata: { + certId: string; + cn: string; + serialNumber: string; + }; +} + export type Event = | GetSecretsEvent | GetSecretEvent @@ -504,7 +624,21 @@ export type Event = | UpdateSecretImportEvent | DeleteSecretImportEvent | UpdateUserRole - | UpdateUserDeniedPermissions; + | UpdateUserDeniedPermissions + | CreateCa + | GetCa + | UpdateCa + | DeleteCa + | GetCaCsr + | GetCaCert + | SignIntermediate + | ImportCaCert + | GetCaCrl + | IssueCert + | GetCert + | DeleteCert + | RevokeCert + | GetCertBody; export type AuditLog = { id: string; diff --git a/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx b/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx index 7fc69400e..f4b740e35 100644 --- a/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx +++ b/frontend/src/views/Project/AuditLogsPage/components/LogsTableRow.tsx @@ -320,6 +320,30 @@ export const LogsTableRow = ({ auditLog }: Props) => { })}
+

{`CA DN: ${event.metadata.dn}`}

+ 		+

{`Cert CN: ${event.metadata.cn}`}

+ 		; } From cf5e367aba84e39b4bffb2de6c2bab4396a8e9fb Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:08:11 +0200 Subject: [PATCH 134/187] Update SDK --- k8-operator/go.mod | 2 +- k8-operator/go.sum | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/k8-operator/go.mod b/k8-operator/go.mod index 7e2c2255c..ca3c165df 100644 --- a/k8-operator/go.mod +++ b/k8-operator/go.mod @@ -35,7 +35,7 @@ require ( github.com/google/s2a-go v0.1.7 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect github.com/googleapis/gax-go/v2 v2.12.4 // indirect - github.com/infisical/go-sdk v0.1.4 // indirect + github.com/infisical/go-sdk v0.1.9 // indirect go.opencensus.io v0.24.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect diff --git a/k8-operator/go.sum b/k8-operator/go.sum index af09fd222..8737b4932 100644 --- a/k8-operator/go.sum +++ b/k8-operator/go.sum @@ -237,6 +237,12 @@ github.com/infisical/go-sdk v0.1.3 h1:pXj7OcEutoTrn8xPMxa7ZNQteVdjfYsMWeR7wuvcbF github.com/infisical/go-sdk v0.1.3/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= github.com/infisical/go-sdk v0.1.4 h1:0msuDTY/WB8kboaWrrGHnzyLZfXRtaayw40T1x5Aj5w= github.com/infisical/go-sdk v0.1.4/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= +github.com/infisical/go-sdk v0.1.7 h1:Bl68n5/ySXF2w1beqzAMtlZ/ON5soHIRuWWxRP0QQs8= +github.com/infisical/go-sdk v0.1.7/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= +github.com/infisical/go-sdk v0.1.8 h1:F82p6/R1usVOnv/4PHs7iu57A2kiUwwKjdEjROZ2Uh4= +github.com/infisical/go-sdk v0.1.8/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= +github.com/infisical/go-sdk v0.1.9 h1:o9LUj0Tyn6OHusTEKEKQ4+PulJViAxgOrFa+SlwGJFc= +github.com/infisical/go-sdk v0.1.9/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= From 4f3835276563c969ae93a7e5ca32f351a5ba4875 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:09:04 +0200 Subject: [PATCH 135/187] Create auth.go --- k8-operator/packages/util/auth.go | 37 +++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 k8-operator/packages/util/auth.go diff --git a/k8-operator/packages/util/auth.go b/k8-operator/packages/util/auth.go new file mode 100644 index 000000000..93569b31f --- /dev/null +++ b/k8-operator/packages/util/auth.go @@ -0,0 +1,37 @@ +package util + +import ( + "context" + "fmt" + + corev1 "k8s.io/api/core/v1" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +func GetServiceAccountToken(k8sClient client.Client, namespace string, serviceAccountName string) (string, error) { + if namespace == "" { + namespace = "default" + } + + sa := &corev1.ServiceAccount{} + err := k8sClient.Get(context.TODO(), client.ObjectKey{Name: serviceAccountName, Namespace: namespace}, sa) + if err != nil { + return "", err + } + + if len(sa.Secrets) == 0 { + return "", fmt.Errorf("no secrets found for service account %s", serviceAccountName) + } + + secretName := sa.Secrets[0].Name + + secret := &corev1.Secret{} + err = k8sClient.Get(context.TODO(), client.ObjectKey{Name: secretName, Namespace: namespace}, secret) + if err != nil { + return "", err + } + + token := secret.Data["token"] + + return string(token), nil +} From 5aadc41a4a2867b2110e98b483c666c7af74b54a Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:19:33 +0200 Subject: [PATCH 136/187] Feat: Resource Variables --- .../controllers/infisicalsecret_controller.go | 54 ++++++++++++++++--- .../controllers/infisicalsecret_helper.go | 50 +++++++++++++---- 2 files changed, 86 insertions(+), 18 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 0bbd3b89b..6d23fa049 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -9,10 +9,10 @@ import ( "k8s.io/apimachinery/pkg/runtime" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/packages/api" - infisical "github.com/infisical/go-sdk" infisicalSdk "github.com/infisical/go-sdk" ) @@ -34,6 +34,40 @@ type InfisicalSecretReconciler struct { // For more details, check Reconcile and its Result here: // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.13.1/pkg/reconcile +type ResourceVariables struct { + infisicalClient infisicalSdk.InfisicalClientInterface + authDetails AuthenticationDetails +} + +// Maps the infisicalSecretCR.UID to a infisicalSdk.InfisicalClientInterface and AuthenticationDetails. +var resourceVariablesMap = make(map[string]ResourceVariables) + +const finalizerName = "secrets.finalizers.infisical.com" + +func (r *InfisicalSecretReconciler) addFinalizer(ctx context.Context, infisicalSecret *secretsv1alpha1.InfisicalSecret) error { + if !controllerutil.ContainsFinalizer(infisicalSecret, finalizerName) { + controllerutil.AddFinalizer(infisicalSecret, finalizerName) + if err := r.Update(ctx, infisicalSecret); err != nil { + return err + } + } + return nil +} + +func (r *InfisicalSecretReconciler) handleFinalizer(ctx context.Context, infisicalSecret *secretsv1alpha1.InfisicalSecret) error { + if controllerutil.ContainsFinalizer(infisicalSecret, finalizerName) { + // Cleanup deployment variables + delete(resourceVariablesMap, string(infisicalSecret.UID)) + + // Remove the finalizer and update the resource + controllerutil.RemoveFinalizer(infisicalSecret, finalizerName) + if err := r.Update(ctx, infisicalSecret); err != nil { + return err + } + } + return nil +} + func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { var infisicalSecretCR secretsv1alpha1.InfisicalSecret requeueTime := time.Minute // seconds @@ -60,8 +94,18 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ fmt.Printf("\nRe-sync interval set. Interval: %v\n", requeueTime) } + // Add the finalizer if it does not exist + if err := r.addFinalizer(ctx, &infisicalSecretCR); err != nil { + return ctrl.Result{}, err + } + // Check if the resource is already marked for deletion if infisicalSecretCR.GetDeletionTimestamp() != nil { + // Handle the finalizer logic + if err := r.handleFinalizer(ctx, &infisicalSecretCR); err != nil { + return ctrl.Result{}, err + } + return ctrl.Result{ Requeue: false, }, nil @@ -82,13 +126,7 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ api.API_HOST_URL = infisicalSecretCR.Spec.HostAPI } - // Initialize the SDK client with the necessary configuration - infisicalClient := infisical.NewInfisicalClient(infisicalSdk.Config{ - SiteUrl: api.API_HOST_URL, - UserAgent: api.USER_AGENT_NAME, - }) - - err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR, infisicalClient) + err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR) r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err) if err != nil { diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index f0d021a97..4653bd419 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -7,6 +7,7 @@ import ( "strings" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" + "github.com/Infisical/infisical/k8-operator/packages/api" "github.com/Infisical/infisical/k8-operator/packages/model" "github.com/Infisical/infisical/k8-operator/packages/util" @@ -19,12 +20,6 @@ import ( ctrl "sigs.k8s.io/controller-runtime" ) -type AuthenticationDetails struct { - authStrategy AuthStrategyType - machineIdentityScope v1alpha1.MachineIdentityScopeInWorkspace // This will only be set if a machine identity auth method is used (e.g. UniversalAuth or KubernetesAuth, etc.) - isMachineIdentityAuth bool -} - const SERVICE_ACCOUNT_ACCESS_KEY = "serviceAccountAccessKey" const SERVICE_ACCOUNT_PUBLIC_KEY = "serviceAccountPublicKey" const SERVICE_ACCOUNT_PRIVATE_KEY = "serviceAccountPrivateKey" @@ -38,9 +33,6 @@ const OPERATOR_SETTINGS_CONFIGMAP_NAME = "infisical-config" const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system" const INFISICAL_DOMAIN = "https://app.infisical.com/api" -// var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) -var authDetails AuthenticationDetails - func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { // ? Legacy support, service token auth @@ -287,7 +279,41 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context return nil } -func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) error { +func (r *InfisicalSecretReconciler) GetResourceVariables(infisicalSecret v1alpha1.InfisicalSecret) ResourceVariables { + + var resourceVariables ResourceVariables + + if _, ok := resourceVariablesMap[string(infisicalSecret.UID)]; !ok { + + client := infisicalSdk.NewInfisicalClient(infisicalSdk.Config{ + SiteUrl: infisicalSecret.Spec.HostAPI, + UserAgent: api.USER_AGENT_NAME, + }) + + resourceVariablesMap[string(infisicalSecret.UID)] = ResourceVariables{ + infisicalClient: client, + authDetails: AuthenticationDetails{}, + } + + resourceVariables = resourceVariablesMap[string(infisicalSecret.UID)] + + } else { + resourceVariables = resourceVariablesMap[string(infisicalSecret.UID)] + } + + return resourceVariables + +} + +func (r *InfisicalSecretReconciler) UpdateResourceVariables(infisicalSecret v1alpha1.InfisicalSecret, resourceVariables ResourceVariables) { + resourceVariablesMap[string(infisicalSecret.UID)] = resourceVariables +} + +func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error { + + resourceVariables := r.GetResourceVariables(infisicalSecret) + infisicalClient := resourceVariables.infisicalClient + authDetails := resourceVariables.authDetails if authDetails.authStrategy == "" { fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") @@ -299,6 +325,10 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context } authDetails = details + r.UpdateResourceVariables(infisicalSecret, ResourceVariables{ + infisicalClient: infisicalClient, + authDetails: authDetails, + }) } // Look for managed secret by name and namespace From 023a0d99ab221027dc1b99a2d47735926ce97ce8 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:20:23 +0200 Subject: [PATCH 137/187] Fix: Kubernetes native auth --- k8-operator/api/v1alpha1/infisicalsecret_types.go | 11 +++++++++-- k8-operator/controllers/infisicalsecret_auth.go | 14 +++++++++++++- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/k8-operator/api/v1alpha1/infisicalsecret_types.go b/k8-operator/api/v1alpha1/infisicalsecret_types.go index b0cc49a8f..6ea7e4c7b 100644 --- a/k8-operator/api/v1alpha1/infisicalsecret_types.go +++ b/k8-operator/api/v1alpha1/infisicalsecret_types.go @@ -33,13 +33,20 @@ type UniversalAuthDetails struct { type KubernetesAuthDetails struct { // +kubebuilder:validation:Required IdentityID string `json:"identityId"` - // +kubebuilder:validation:Optional - ServiceAccountTokenPath string `json:"serviceAccountTokenPath"` + // +kubebuilder:validation:Required + ServiceAccountRef KubernetesServiceAccountRef `json:"serviceAccountRef"` // +kubebuilder:validation:Required SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"` } +type KubernetesServiceAccountRef struct { + // +kubebuilder:validation:Required + Name string `json:"name"` + // +kubebuilder:validation:Required + Namespace string `json:"namespace"` +} + type AWSIamAuthDetails struct { // +kubebuilder:validation:Required IdentityID string `json:"identityId"` diff --git a/k8-operator/controllers/infisicalsecret_auth.go b/k8-operator/controllers/infisicalsecret_auth.go index a2930b330..44861df87 100644 --- a/k8-operator/controllers/infisicalsecret_auth.go +++ b/k8-operator/controllers/infisicalsecret_auth.go @@ -6,6 +6,7 @@ import ( "fmt" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" + "github.com/Infisical/infisical/k8-operator/packages/util" infisicalSdk "github.com/infisical/go-sdk" ) @@ -31,6 +32,12 @@ var AuthStrategy = struct { GCP_IAM_MACHINE_IDENTITY: "GCP_IAM_MACHINE_IDENTITY", } +type AuthenticationDetails struct { + authStrategy AuthStrategyType + machineIdentityScope v1alpha1.MachineIdentityScopeInWorkspace // This will only be set if a machine identity auth method is used (e.g. UniversalAuth or KubernetesAuth, etc.) + isMachineIdentityAuth bool +} + var ErrAuthNotApplicable = errors.New("authentication not applicable") func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { @@ -65,7 +72,12 @@ func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, in return AuthenticationDetails{}, ErrAuthNotApplicable } - _, err := infisicalClient.Auth().KubernetesAuthLogin(kubernetesAuthSpec.IdentityID, kubernetesAuthSpec.ServiceAccountTokenPath) + serviceAccountToken, err := util.GetServiceAccountToken(r.Client, kubernetesAuthSpec.ServiceAccountRef.Namespace, kubernetesAuthSpec.ServiceAccountRef.Name) + if err != nil { + return AuthenticationDetails{}, fmt.Errorf("unable to get service account token [err=%s]", err) + } + + _, err = infisicalClient.Auth().KubernetesRawServiceAccountTokenLogin(kubernetesAuthSpec.IdentityID, serviceAccountToken) if err != nil { return AuthenticationDetails{}, fmt.Errorf("unable to login with Kubernetes native auth [err=%s]", err) } From a9ce3789b00df166c319e509c50f725a2f8389dc Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:21:40 +0200 Subject: [PATCH 138/187] Helm --- .../templates/infisicalsecret-crd.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 57fe8270b..f1152c619 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -151,11 +151,20 @@ spec: - projectSlug - secretsPath type: object - serviceAccountTokenPath: - type: string + serviceAccountRef: + properties: + name: + type: string + namespace: + type: string + required: + - name + - namespace + type: object required: - identityId - secretsScope + - serviceAccountRef type: object serviceAccount: properties: From c63d57f086da91458047fd0eec9ce821dda414ae Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:21:48 +0200 Subject: [PATCH 139/187] Generated --- .../api/v1alpha1/zz_generated.deepcopy.go | 16 ++++++++++++++++ .../secrets.infisical.com_infisicalsecrets.yaml | 13 +++++++++++-- 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go index 39f8622c9..75d46d28b 100644 --- a/k8-operator/api/v1alpha1/zz_generated.deepcopy.go +++ b/k8-operator/api/v1alpha1/zz_generated.deepcopy.go @@ -230,6 +230,7 @@ func (in *KubeSecretReference) DeepCopy() *KubeSecretReference { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KubernetesAuthDetails) DeepCopyInto(out *KubernetesAuthDetails) { *out = *in + out.ServiceAccountRef = in.ServiceAccountRef out.SecretsScope = in.SecretsScope } @@ -243,6 +244,21 @@ func (in *KubernetesAuthDetails) DeepCopy() *KubernetesAuthDetails { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KubernetesServiceAccountRef) DeepCopyInto(out *KubernetesServiceAccountRef) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesServiceAccountRef. +func (in *KubernetesServiceAccountRef) DeepCopy() *KubernetesServiceAccountRef { + if in == nil { + return nil + } + out := new(KubernetesServiceAccountRef) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *MachineIdentityScopeInWorkspace) DeepCopyInto(out *MachineIdentityScopeInWorkspace) { *out = *in diff --git a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml index bea031896..e14aa3993 100644 --- a/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml +++ b/k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml @@ -151,11 +151,20 @@ spec: - projectSlug - secretsPath type: object - serviceAccountTokenPath: - type: string + serviceAccountRef: + properties: + name: + type: string + namespace: + type: string + required: + - name + - namespace + type: object required: - identityId - secretsScope + - serviceAccountRef type: object serviceAccount: properties: From 7057d399bc618096db4c8c34600a53e3bd2e247f Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 07:23:36 +0200 Subject: [PATCH 140/187] Fix: Naming convention --- k8-operator/packages/util/auth.go | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/k8-operator/packages/util/auth.go b/k8-operator/packages/util/auth.go index 93569b31f..d3ee0ce3b 100644 --- a/k8-operator/packages/util/auth.go +++ b/k8-operator/packages/util/auth.go @@ -9,21 +9,18 @@ import ( ) func GetServiceAccountToken(k8sClient client.Client, namespace string, serviceAccountName string) (string, error) { - if namespace == "" { - namespace = "default" - } - sa := &corev1.ServiceAccount{} - err := k8sClient.Get(context.TODO(), client.ObjectKey{Name: serviceAccountName, Namespace: namespace}, sa) + serviceAccount := &corev1.ServiceAccount{} + err := k8sClient.Get(context.TODO(), client.ObjectKey{Name: serviceAccountName, Namespace: namespace}, serviceAccount) if err != nil { return "", err } - if len(sa.Secrets) == 0 { + if len(serviceAccount.Secrets) == 0 { return "", fmt.Errorf("no secrets found for service account %s", serviceAccountName) } - secretName := sa.Secrets[0].Name + secretName := serviceAccount.Secrets[0].Name secret := &corev1.Secret{} err = k8sClient.Get(context.TODO(), client.ObjectKey{Name: secretName, Namespace: namespace}, secret) From 8d6f7babff657f88c4331c93ce6f57285857bef5 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Wed, 12 Jun 2024 23:36:17 -0700 Subject: [PATCH 141/187] Add descriptions for ca cert endpoints --- backend/src/lib/api-docs/constants.ts | 79 +++++++++++++++++++ .../routes/v1/certificate-authority-router.ts | 73 +++++++++-------- .../server/routes/v1/certificate-router.ts | 13 +-- .../endpoints/certificate-authority/cert.mdx | 4 + .../certificate-authority/create.mdx | 4 + .../endpoints/certificate-authority/crl.mdx | 4 + .../endpoints/certificate-authority/csr.mdx | 4 + .../certificate-authority/delete.mdx | 4 + .../certificate-authority/import-cert.mdx | 4 + .../certificate-authority/issue-cert.mdx | 4 + .../endpoints/certificate-authority/read.mdx | 4 + .../sign-intermediate.mdx | 4 + .../certificate-authority/update.mdx | 4 + 13 files changed, 166 insertions(+), 39 deletions(-) create mode 100644 docs/api-reference/endpoints/certificate-authority/cert.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/create.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/crl.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/csr.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/delete.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/import-cert.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/issue-cert.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/read.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/sign-intermediate.mdx create mode 100644 docs/api-reference/endpoints/certificate-authority/update.mdx diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts index 1637b266a..ef5c22a23 100644 --- a/backend/src/lib/api-docs/constants.ts +++ b/backend/src/lib/api-docs/constants.ts @@ -728,6 +728,85 @@ export const AUDIT_LOG_STREAMS = { } }; +// TODO +export const CERTIFICATE_AUTHORITIES = { + CREATE: { + projectSlug: "Slug of the project to create the CA in.", + type: "The type of CA to create (root or intermediate)", + friendlyName: "A friendly name for the CA", + organization: "The organization (O) for the CA", + ou: "The organization unit (OU) for the CA", + country: "The country name (C) for the CA", + province: "The state of province name for the CA", + locality: "The locality name for the CA", + commonName: "The common name (CN) for the CA", + notBefore: "The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format", + notAfter: "The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format", + maxPathLength: + "The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.", + keyAlgorithm: + "The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA. This should be one of RSA_2048, RSA_4096, EC_prime256v1, or EC_secp384r1." + }, + GET: { + caId: "The ID of the CA to get" + }, + UPDATE: { + caId: "The ID of the CA to get", + status: "The status of the CA to update to. This can be one of active or disabled" + }, + DELETE: { + caId: "The ID of the CA to delete" + }, + GET_CSR: { + caId: "The ID of the CA to generate CSR from" + }, + GET_CERT: { + caId: "The ID of the CA to get the certificate body and certificate chain from" + }, + SIGN_INTERMEDIATE: { + caId: "The ID of the CA to sign the intermediate certificate with", + csr: "The CSR to sign with the CA", + notBefore: "The date and time when the intermediate CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format", + notAfter: "The date and time when the intermediate CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format", + maxPathLength: + "The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain." + }, + IMPORT_CERT: { + caId: "The ID of the CA to import the certificate for", + certificate: "The certificate body to import", + certificateChain: "The certificate chain to import" + }, + ISSUE_CERT: { + caId: "The ID of the CA to issue the certificate from", + friendlyName: "A friendly name for the certificate", + commonName: "The common name (CN) for the certificate", + ttl: "The time to live for the certificate such as 1m, 1h, 1d, 1y, ...", + notBefore: "The date and time when the certificate becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format", + notAfter: "The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format" + }, + GET_CRL: { + caId: "The ID of the CA to get the certificate revocation list (CRL) for" + } +}; + +export const CERTIFICATES = { + GET: { + serialNumber: "The serial number of the certificate to get" + }, + REVOKE: { + serialNumber: + "The serial number of the certificate to revoke. The revoked certificate will be added to the certificate revocation list (CRL) of the CA.", + revocationReason: + "The reason for revoking the certificate. This can be one of UNSPECIFIED, KEY_COMPROMISE, CA_COMPROMISE, AFFILIATION_CHANGED, SUPERSEDED, CESSATION_OF_OPERATION, CERTIFICATE_HOLD, PRIVILEGE_WITHDRAWN, or A_A_COMPROMISE." + }, + DELETE: { + serialNumber: "The serial number of the certificate to delete" + }, + GET_CERT: { + serialNumber: "The serial number of the certificate to get the certificate body and certificate chain for" + } +}; + export const PROJECT_ROLE = { CREATE: { projectSlug: "Slug of the project to create the role for.", diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts index d013bfdad..7bbaa8373 100644 --- a/backend/src/server/routes/v1/certificate-authority-router.ts +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -3,6 +3,7 @@ import { z } from "zod"; import { CertificateAuthoritiesSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; +import { CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -22,20 +23,23 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { description: "Create CA", body: z .object({ - projectSlug: z.string().trim(), - type: z.nativeEnum(CaType), - friendlyName: z.string().optional(), - commonName: z.string().trim(), - organization: z.string().trim(), - ou: z.string().trim(), - country: z.string().trim(), - province: z.string().trim(), - locality: z.string().trim(), + projectSlug: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.projectSlug), + type: z.nativeEnum(CaType).describe(CERTIFICATE_AUTHORITIES.CREATE.type), + friendlyName: z.string().optional().describe(CERTIFICATE_AUTHORITIES.CREATE.friendlyName), + commonName: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.commonName), + organization: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.organization), + ou: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.ou), + country: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.country), + province: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.province), + locality: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.locality), // format: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format - notBefore: validateCaDateField.optional(), - notAfter: validateCaDateField.optional(), - maxPathLength: z.number().min(-1).default(-1), - keyAlgorithm: z.nativeEnum(CertKeyAlgorithm).default(CertKeyAlgorithm.RSA_2048) + notBefore: validateCaDateField.optional().describe(CERTIFICATE_AUTHORITIES.CREATE.notBefore), + notAfter: validateCaDateField.optional().describe(CERTIFICATE_AUTHORITIES.CREATE.notAfter), + maxPathLength: z.number().min(-1).default(-1).describe(CERTIFICATE_AUTHORITIES.CREATE.maxPathLength), + keyAlgorithm: z + .nativeEnum(CertKeyAlgorithm) + .default(CertKeyAlgorithm.RSA_2048) + .describe(CERTIFICATE_AUTHORITIES.CREATE.keyAlgorithm) }) .refine( (data) => { @@ -93,7 +97,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Get CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET.caId) }), response: { 200: z.object({ @@ -138,10 +142,10 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Update CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.UPDATE.caId) }), body: z.object({ - status: z.enum([CaStatus.ACTIVE, CaStatus.DISABLED]).optional() + status: z.enum([CaStatus.ACTIVE, CaStatus.DISABLED]).optional().describe(CERTIFICATE_AUTHORITIES.UPDATE.status) }), response: { 200: z.object({ @@ -188,7 +192,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Delete CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.DELETE.caId) }), response: { 200: z.object({ @@ -278,7 +282,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Get cert and cert chain of a CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET_CERT.caId) }), response: { 200: z.object({ @@ -327,13 +331,13 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Create intermediate CA certificate from parent CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.caId) }), body: z.object({ - csr: z.string().trim(), - notBefore: validateCaDateField.optional(), - notAfter: validateCaDateField, - maxPathLength: z.number().min(-1).default(-1) + csr: z.string().trim().describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.csr), + notBefore: validateCaDateField.optional().describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.notBefore), + notAfter: validateCaDateField.describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.notAfter), + maxPathLength: z.number().min(-1).default(-1).describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.maxPathLength) }), response: { 200: z.object({ @@ -387,11 +391,11 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Import certificate and chain to CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.IMPORT_CERT.caId) }), body: z.object({ - certificate: z.string().trim(), - certificateChain: z.string().trim() + certificate: z.string().trim().describe(CERTIFICATE_AUTHORITIES.IMPORT_CERT.certificate), + certificateChain: z.string().trim().describe(CERTIFICATE_AUTHORITIES.IMPORT_CERT.certificateChain) }), response: { 200: z.object({ @@ -439,15 +443,18 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Issue certificate from CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.caId) }), body: z .object({ - friendlyName: z.string().optional(), - commonName: z.string().trim().min(1), - ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"), - notBefore: validateCaDateField.optional(), - notAfter: validateCaDateField.optional() + friendlyName: z.string().optional().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.friendlyName), + commonName: z.string().trim().min(1).describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.commonName), + ttl: z + .string() + .refine((val) => ms(val) > 0, "TTL must be a positive number") + .describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.ttl), + notBefore: validateCaDateField.optional().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.notBefore), + notAfter: validateCaDateField.optional().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.notAfter) }) .refine( (data) => { @@ -513,7 +520,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Get CRL of the CA", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET_CRL.caId) }), response: { 200: z.object({ diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 27da18431..056cc74b9 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -2,6 +2,7 @@ import { z } from "zod"; import { CertificatesSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; +import { CERTIFICATES } from "@app/lib/api-docs"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -18,7 +19,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { schema: { description: "Get certificate", params: z.object({ - serialNumber: z.string().trim() + serialNumber: z.string().trim().describe(CERTIFICATES.GET.serialNumber) }), response: { 200: z.object({ @@ -64,10 +65,10 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { schema: { description: "Revoke", params: z.object({ - serialNumber: z.string().trim() + serialNumber: z.string().trim().describe(CERTIFICATES.REVOKE.serialNumber) }), body: z.object({ - revocationReason: z.nativeEnum(CrlReason) + revocationReason: z.nativeEnum(CrlReason).describe(CERTIFICATES.REVOKE.revocationReason) }), response: { 200: z.object({ @@ -118,7 +119,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { schema: { description: "Delete certificate", params: z.object({ - serialNumber: z.string().trim() + serialNumber: z.string().trim().describe(CERTIFICATES.DELETE.serialNumber) }), response: { 200: z.object({ @@ -162,9 +163,9 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { - description: "Get certificate of certificate", + description: "Get certificate body of certificate", params: z.object({ - serialNumber: z.string().trim() + serialNumber: z.string().trim().describe(CERTIFICATES.GET_CERT.serialNumber) }), response: { 200: z.object({ diff --git a/docs/api-reference/endpoints/certificate-authority/cert.mdx b/docs/api-reference/endpoints/certificate-authority/cert.mdx new file mode 100644 index 000000000..3706e0b11 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/cert.mdx @@ -0,0 +1,4 @@ +--- +title: "Retrieve certificate / chain" +openapi: "GET /api/v1/pki/ca/{caId}/certificate" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/create.mdx b/docs/api-reference/endpoints/certificate-authority/create.mdx new file mode 100644 index 000000000..35e758e4b --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/create.mdx @@ -0,0 +1,4 @@ +--- +title: "Create" +openapi: "POST /api/v1/pki/ca" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/crl.mdx b/docs/api-reference/endpoints/certificate-authority/crl.mdx new file mode 100644 index 000000000..a7b7755de --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/crl.mdx @@ -0,0 +1,4 @@ +--- +title: "Retrieve CRL" +openapi: "GET /api/v1/pki/ca/{caId}/crl" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/csr.mdx b/docs/api-reference/endpoints/certificate-authority/csr.mdx new file mode 100644 index 000000000..2477a629e --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/csr.mdx @@ -0,0 +1,4 @@ +--- +title: "Get CSR" +openapi: "GET /api/v1/pki/ca/{caId}/csr" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/delete.mdx b/docs/api-reference/endpoints/certificate-authority/delete.mdx new file mode 100644 index 000000000..f79b8f458 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/delete.mdx @@ -0,0 +1,4 @@ +--- +title: "Delete" +openapi: "DELETE /api/v1/pki/ca/{caId}" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/import-cert.mdx b/docs/api-reference/endpoints/certificate-authority/import-cert.mdx new file mode 100644 index 000000000..7f0e40f95 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/import-cert.mdx @@ -0,0 +1,4 @@ +--- +title: "Import certificate" +openapi: "POST /api/v1/pki/ca/{caId}/import-certificate" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/issue-cert.mdx b/docs/api-reference/endpoints/certificate-authority/issue-cert.mdx new file mode 100644 index 000000000..045cada58 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/issue-cert.mdx @@ -0,0 +1,4 @@ +--- +title: "Issue certificate" +openapi: "POST /api/v1/pki/ca/{caId}/issue-certificate" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/read.mdx b/docs/api-reference/endpoints/certificate-authority/read.mdx new file mode 100644 index 000000000..54dc26392 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/read.mdx @@ -0,0 +1,4 @@ +--- +title: "Retrieve" +openapi: "GET /api/v1/pki/ca/{caId}" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/sign-intermediate.mdx b/docs/api-reference/endpoints/certificate-authority/sign-intermediate.mdx new file mode 100644 index 000000000..310bbea26 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/sign-intermediate.mdx @@ -0,0 +1,4 @@ +--- +title: "Sign intermediate certificate" +openapi: "POST /api/v1/pki/ca/{caId}/sign-intermediate" +--- diff --git a/docs/api-reference/endpoints/certificate-authority/update.mdx b/docs/api-reference/endpoints/certificate-authority/update.mdx new file mode 100644 index 000000000..d18a728bf --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authority/update.mdx @@ -0,0 +1,4 @@ +--- +title: "Update" +openapi: "PATCH /api/v1/pki/ca/{caId}" +--- From 9e24050f1798130b61cbd4c8ab34a2bc3e1a84c0 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 15:42:15 +0800 Subject: [PATCH 142/187] misc: addressed review comments --- ...327_custom-rate-limits-for-self-hosting.ts | 2 +- backend/src/server/app.ts | 7 +- backend/src/server/config/rateLimiter.ts | 33 +-- .../src/server/routes/v1/rate-limit-router.ts | 13 +- .../services/rate-limit/rate-limit-service.ts | 25 +- frontend/src/hooks/api/index.tsx | 1 + .../admin/DashboardPage/DashboardPage.tsx | 231 +--------------- .../admin/DashboardPage/RateLimitPanel.tsx | 248 ++++++++++++++++++ 8 files changed, 287 insertions(+), 273 deletions(-) create mode 100644 frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts index 196b8cdb3..32bb55a61 100644 --- a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts +++ b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts @@ -6,7 +6,7 @@ import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; export async function up(knex: Knex): Promise { if (!(await knex.schema.hasTable(TableName.RateLimit))) { await knex.schema.createTable(TableName.RateLimit, (t) => { - t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.uuid("id", { primaryKey: true }).defaultTo("00000000-0000-0000-0000-000000000000"); t.integer("readRateLimit").defaultTo(600).notNullable(); t.integer("writeRateLimit").defaultTo(200).notNullable(); t.integer("secretsRateLimit").defaultTo(60).notNullable(); diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index 21721bd5d..fe94d7ac0 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -17,6 +17,8 @@ import { Logger } from "pino"; import { TKeyStoreFactory } from "@app/keystore/keystore"; import { getConfig } from "@app/lib/config/env"; import { TQueueServiceFactory } from "@app/queue"; +import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal"; +import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; import { TSmtpService } from "@app/services/smtp/smtp-service"; import { globalRateLimiterCfg } from "./config/rateLimiter"; @@ -69,8 +71,11 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { // Rate limiters and security headers if (appCfg.isProductionMode) { - await server.register(ratelimiter, await globalRateLimiterCfg(db)); + const rateLimitDAL = rateLimitDALFactory(db); + const rateLimits = await rateLimitServiceFactory({ rateLimitDAL }).getRateLimits(); + await server.register(ratelimiter, globalRateLimiterCfg(rateLimits)); } + await server.register(helmet, { contentSecurityPolicy: false }); await server.register(maintenanceMode); diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 48d7e41b1..cc62fd08c 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -1,10 +1,8 @@ import type { RateLimitOptions, RateLimitPluginOptions } from "@fastify/rate-limit"; import { Redis } from "ioredis"; -import { Knex } from "knex"; +import { TRateLimit } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; -import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal"; -import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; // GET endpoints export const readLimit: RateLimitOptions = { @@ -63,31 +61,20 @@ export const publicEndpointLimit: RateLimitOptions = { keyGenerator: (req) => req.realIp }; -async function fetchRateLimitsFromDb(db: Knex) { - try { - const rateLimitDAL = rateLimitDALFactory(db); - const rateLimits = await rateLimitServiceFactory({ rateLimitDAL }).getRateLimits(); - - readLimit.max = rateLimits.readRateLimit; - publicEndpointLimit.max = rateLimits.publicEndpointLimit; - writeLimit.max = rateLimits.writeRateLimit; - secretsLimit.max = rateLimits.secretsRateLimit; - authRateLimit.max = rateLimits.authRateLimit; - inviteUserRateLimit.max = rateLimits.inviteUserRateLimit; - mfaRateLimit.max = rateLimits.mfaRateLimit; - creationLimit.max = rateLimits.creationLimit; - } catch (error) { - console.error("Error fetching rate limits:", error); - } -} - -export const globalRateLimiterCfg = async (db: Knex): Promise => { +export const globalRateLimiterCfg = async (rateLimits: TRateLimit): Promise => { const appCfg = getConfig(); const redis = appCfg.isRedisConfigured ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) : null; - await fetchRateLimitsFromDb(db); + readLimit.max = rateLimits.readRateLimit; + publicEndpointLimit.max = rateLimits.publicEndpointLimit; + writeLimit.max = rateLimits.writeRateLimit; + secretsLimit.max = rateLimits.secretsRateLimit; + authRateLimit.max = rateLimits.authRateLimit; + inviteUserRateLimit.max = rateLimits.inviteUserRateLimit; + mfaRateLimit.max = rateLimits.mfaRateLimit; + creationLimit.max = rateLimits.creationLimit; return { timeWindow: 60 * 1000, diff --git a/backend/src/server/routes/v1/rate-limit-router.ts b/backend/src/server/routes/v1/rate-limit-router.ts index 1ea14d0b4..be38afb73 100644 --- a/backend/src/server/routes/v1/rate-limit-router.ts +++ b/backend/src/server/routes/v1/rate-limit-router.ts @@ -39,10 +39,15 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => { }, schema: { - body: RateLimitSchema.omit({ - id: true, - createdAt: true, - updatedAt: true + body: z.object({ + readRateLimit: z.number().optional(), + writeRateLimit: z.number().optional(), + secretsRateLimit: z.number().optional(), + authRateLimit: z.number().optional(), + inviteUserRateLimit: z.number().optional(), + mfaRateLimit: z.number().optional(), + creationLimit: z.number().optional(), + publicEndpointLimit: z.number().optional() }), response: { 200: z.object({ diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index d510cb056..4d4511127 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -10,34 +10,23 @@ type TRateLimitServiceFactoryDep = { export type TRateLimitServiceFactory = ReturnType; export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFactoryDep) => { - const initRateLimits = async (): Promise => { - const rateLimit = await rateLimitDAL.create({}); - return rateLimit; - }; - const getRateLimits = async (): Promise => { - let rateLimit = (await rateLimitDAL.find({}))[0]; - if (!rateLimit) { - rateLimit = await initRateLimits(); - } - return rateLimit; + return rateLimitDAL.findOne({ id: "00000000-0000-0000-0000-000000000000" }); }; const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise => { - const rateLimit = await rateLimitDAL.findOne({}); - if (!rateLimit) throw new BadRequestError({ name: "Rate Limit Update", message: "Rate Limit does not exist yet" }); + const rateLimit = await rateLimitDAL.findOne({ + id: "00000000-0000-0000-0000-000000000000" + }); - const updateData: Record = {}; - for (const [key, value] of Object.entries(updates)) { - updateData[key] = value; + if (!rateLimit) { + throw new BadRequestError({ name: "Rate Limit Update", message: "Rate Limit does not exist yet" }); } - const updatedRateLimit = await rateLimitDAL.updateById(rateLimit.id, updateData); - return updatedRateLimit; + return rateLimitDAL.updateById(rateLimit.id, updates); }; return { - initRateLimits, getRateLimits, updateRateLimit }; diff --git a/frontend/src/hooks/api/index.tsx b/frontend/src/hooks/api/index.tsx index 61e8cb666..19fd5f594 100644 --- a/frontend/src/hooks/api/index.tsx +++ b/frontend/src/hooks/api/index.tsx @@ -17,6 +17,7 @@ export * from "./keys"; export * from "./ldapConfig"; export * from "./organization"; export * from "./projectUserAdditionalPrivilege"; +export * from "./rateLimit"; export * from "./roles"; export * from "./scim"; export * from "./secretApproval"; diff --git a/frontend/src/views/admin/DashboardPage/DashboardPage.tsx b/frontend/src/views/admin/DashboardPage/DashboardPage.tsx index ae243c130..52fddb22c 100644 --- a/frontend/src/views/admin/DashboardPage/DashboardPage.tsx +++ b/frontend/src/views/admin/DashboardPage/DashboardPage.tsx @@ -22,7 +22,8 @@ import { } from "@app/components/v2"; import { useOrganization, useServerConfig, useUser } from "@app/context"; import { useUpdateServerConfig } from "@app/hooks/api"; -import { useGetRateLimit, useUpdateRateLimit } from "@app/hooks/api/rateLimit"; + +import { RateLimitPanel } from "./RateLimitPanel"; enum TabSections { Settings = "settings", @@ -38,22 +39,13 @@ const formSchema = z.object({ signUpMode: z.nativeEnum(SignUpModes), allowedSignUpDomain: z.string().optional().nullable(), trustSamlEmails: z.boolean(), - trustLdapEmails: z.boolean(), - readRateLimit: z.number(), - writeRateLimit: z.number(), - secretsRateLimit: z.number(), - authRateLimit: z.number(), - inviteUserRateLimit: z.number(), - mfaRateLimit: z.number(), - creationLimit: z.number(), - publicEndpointLimit: z.number() + trustLdapEmails: z.boolean() }); type TDashboardForm = z.infer; export const AdminDashboardPage = () => { const router = useRouter(); const data = useServerConfig(); - const { data: rateLimit } = useGetRateLimit(); const { config } = data; const { @@ -68,15 +60,7 @@ export const AdminDashboardPage = () => { signUpMode: config.allowSignUp ? SignUpModes.Anyone : SignUpModes.Disabled, allowedSignUpDomain: config.allowedSignUpDomain, trustSamlEmails: config.trustSamlEmails, - trustLdapEmails: config.trustLdapEmails, - readRateLimit: rateLimit?.readRateLimit ?? 600, - writeRateLimit: rateLimit?.writeRateLimit ?? 200, - secretsRateLimit: rateLimit?.secretsRateLimit ?? 60, - authRateLimit: rateLimit?.authRateLimit ?? 60, - inviteUserRateLimit: rateLimit?.inviteUserRateLimit ?? 30, - mfaRateLimit: rateLimit?.mfaRateLimit ?? 20, - creationLimit: rateLimit?.creationLimit ?? 30, - publicEndpointLimit: rateLimit?.publicEndpointLimit ?? 30 + trustLdapEmails: config.trustLdapEmails } }); @@ -85,7 +69,6 @@ export const AdminDashboardPage = () => { const { user, isLoading: isUserLoading } = useUser(); const { orgs } = useOrganization(); const { mutateAsync: updateServerConfig } = useUpdateServerConfig(); - const { mutateAsync: updateRateLimit } = useUpdateRateLimit(); const isNotAllowed = !user?.superAdmin; @@ -122,42 +105,6 @@ export const AdminDashboardPage = () => { } }; - const onRateLimitFormSubmit = async (formData: TDashboardForm) => { - try { - const { - readRateLimit, - writeRateLimit, - secretsRateLimit, - authRateLimit, - inviteUserRateLimit, - mfaRateLimit, - creationLimit, - publicEndpointLimit - } = formData; - - await updateRateLimit({ - readRateLimit, - writeRateLimit, - secretsRateLimit, - authRateLimit, - inviteUserRateLimit, - mfaRateLimit, - creationLimit, - publicEndpointLimit - }); - createNotification({ - text: "Successfully changed rate limits. Please restart your server", - type: "success" - }); - } catch (e) { - console.error(e); - createNotification({ - type: "error", - text: "Failed to update rate limiting setting." - }); - } - }; - return (
@@ -292,175 +239,7 @@ export const AdminDashboardPage = () => { -
-
-
- Set Rate Limits for your Infisical Instance -
- ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> - ( - - field.onChange(Number(e.target.value))} - /> - - )} - /> -
- -
+
diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx new file mode 100644 index 000000000..f29a9d52b --- /dev/null +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -0,0 +1,248 @@ +import { Controller, useForm } from "react-hook-form"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { z } from "zod"; + +import { createNotification } from "@app/components/notifications"; +import { Button, FormControl, Input } from "@app/components/v2"; +import { useGetRateLimit, useUpdateRateLimit } from "@app/hooks/api"; + +const formSchema = z.object({ + readRateLimit: z.number(), + writeRateLimit: z.number(), + secretsRateLimit: z.number(), + authRateLimit: z.number(), + inviteUserRateLimit: z.number(), + mfaRateLimit: z.number(), + creationLimit: z.number(), + publicEndpointLimit: z.number() +}); + +type TRateLimitForm = z.infer; + +export const RateLimitPanel = () => { + const { data: rateLimit } = useGetRateLimit(); + const { mutateAsync: updateRateLimit } = useUpdateRateLimit(); + + const { + control, + handleSubmit, + formState: { isSubmitting, isDirty } + } = useForm({ + resolver: zodResolver(formSchema), + values: { + // eslint-disable-next-line + readRateLimit: rateLimit?.readRateLimit ?? 600, + writeRateLimit: rateLimit?.writeRateLimit ?? 200, + secretsRateLimit: rateLimit?.secretsRateLimit ?? 60, + authRateLimit: rateLimit?.authRateLimit ?? 60, + inviteUserRateLimit: rateLimit?.inviteUserRateLimit ?? 30, + mfaRateLimit: rateLimit?.mfaRateLimit ?? 20, + creationLimit: rateLimit?.creationLimit ?? 30, + publicEndpointLimit: rateLimit?.publicEndpointLimit ?? 30 + } + }); + + const onRateLimitFormSubmit = async (formData: TRateLimitForm) => { + try { + const { + readRateLimit, + writeRateLimit, + secretsRateLimit, + authRateLimit, + inviteUserRateLimit, + mfaRateLimit, + creationLimit, + publicEndpointLimit + } = formData; + + await updateRateLimit({ + readRateLimit, + writeRateLimit, + secretsRateLimit, + authRateLimit, + inviteUserRateLimit, + mfaRateLimit, + creationLimit, + publicEndpointLimit + }); + createNotification({ + text: "Successfully changed rate limits. Please restart your server", + type: "success" + }); + } catch (e) { + console.error(e); + createNotification({ + type: "error", + text: "Failed to update rate limiting setting." + }); + } + }; + + return ( +
+
+
+ Set Rate Limits for your Infisical Instance +
+ ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> + ( + + field.onChange(Number(e.target.value))} + /> + + )} + /> +
+ +
+ ); +}; From d5658d374ab1a051f0ef075e1a01ec772c029678 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 16:27:13 +0800 Subject: [PATCH 143/187] misc: finalized backend flow --- ...327_custom-rate-limits-for-self-hosting.ts | 3 +++ backend/src/server/config/rateLimiter.ts | 20 ++++++++------- .../src/server/routes/v1/rate-limit-router.ts | 25 ++++++++++++------- .../services/rate-limit/rate-limit-service.ts | 20 ++++++--------- frontend/src/hooks/api/rateLimit/mutation.ts | 4 +-- 5 files changed, 39 insertions(+), 33 deletions(-) diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts index 32bb55a61..cb8007d9f 100644 --- a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts +++ b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts @@ -19,6 +19,9 @@ export async function up(knex: Knex): Promise { }); await createOnUpdateTrigger(knex, TableName.RateLimit); + + // create rate limit entry + await knex(TableName.RateLimit).insert({}); } } diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index cc62fd08c..e5bec1c6c 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -61,20 +61,22 @@ export const publicEndpointLimit: RateLimitOptions = { keyGenerator: (req) => req.realIp }; -export const globalRateLimiterCfg = async (rateLimits: TRateLimit): Promise => { +export const globalRateLimiterCfg = async (rateLimits?: TRateLimit): Promise => { const appCfg = getConfig(); const redis = appCfg.isRedisConfigured ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) : null; - readLimit.max = rateLimits.readRateLimit; - publicEndpointLimit.max = rateLimits.publicEndpointLimit; - writeLimit.max = rateLimits.writeRateLimit; - secretsLimit.max = rateLimits.secretsRateLimit; - authRateLimit.max = rateLimits.authRateLimit; - inviteUserRateLimit.max = rateLimits.inviteUserRateLimit; - mfaRateLimit.max = rateLimits.mfaRateLimit; - creationLimit.max = rateLimits.creationLimit; + if (rateLimits) { + readLimit.max = rateLimits.readRateLimit; + publicEndpointLimit.max = rateLimits.publicEndpointLimit; + writeLimit.max = rateLimits.writeRateLimit; + secretsLimit.max = rateLimits.secretsRateLimit; + authRateLimit.max = rateLimits.authRateLimit; + inviteUserRateLimit.max = rateLimits.inviteUserRateLimit; + mfaRateLimit.max = rateLimits.mfaRateLimit; + creationLimit.max = rateLimits.creationLimit; + } return { timeWindow: 60 * 1000, diff --git a/backend/src/server/routes/v1/rate-limit-router.ts b/backend/src/server/routes/v1/rate-limit-router.ts index be38afb73..f2f200228 100644 --- a/backend/src/server/routes/v1/rate-limit-router.ts +++ b/backend/src/server/routes/v1/rate-limit-router.ts @@ -1,6 +1,7 @@ import { z } from "zod"; import { RateLimitSchema } from "@app/db/schemas"; +import { BadRequestError } from "@app/lib/errors"; import { readLimit } from "@app/server/config/rateLimiter"; import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; @@ -22,12 +23,18 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => { }, handler: async () => { const rateLimit = await server.services.rateLimit.getRateLimits(); + if (!rateLimit) { + throw new BadRequestError({ + name: "Get Rate Limit Error", + message: "Rate limit configuration does not exist." + }); + } return { rateLimit }; } }); server.route({ - method: "PATCH", + method: "PUT", url: "/", config: { rateLimit: readLimit @@ -40,14 +47,14 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => { schema: { body: z.object({ - readRateLimit: z.number().optional(), - writeRateLimit: z.number().optional(), - secretsRateLimit: z.number().optional(), - authRateLimit: z.number().optional(), - inviteUserRateLimit: z.number().optional(), - mfaRateLimit: z.number().optional(), - creationLimit: z.number().optional(), - publicEndpointLimit: z.number().optional() + readRateLimit: z.number(), + writeRateLimit: z.number(), + secretsRateLimit: z.number(), + authRateLimit: z.number(), + inviteUserRateLimit: z.number(), + mfaRateLimit: z.number(), + creationLimit: z.number(), + publicEndpointLimit: z.number() }), response: { 200: z.object({ diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index 4d4511127..5f1e75b95 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -1,5 +1,3 @@ -import { BadRequestError } from "@app/lib/errors"; - import { TRateLimitDALFactory } from "./rate-limit-dal"; import { TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types"; @@ -10,20 +8,16 @@ type TRateLimitServiceFactoryDep = { export type TRateLimitServiceFactory = ReturnType; export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFactoryDep) => { - const getRateLimits = async (): Promise => { - return rateLimitDAL.findOne({ id: "00000000-0000-0000-0000-000000000000" }); + const getRateLimits = async (): Promise => { + try { + return await rateLimitDAL.findOne({ id: "00000000-0000-0000-0000-000000000000" }); + } catch (error) { + return undefined; + } }; const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise => { - const rateLimit = await rateLimitDAL.findOne({ - id: "00000000-0000-0000-0000-000000000000" - }); - - if (!rateLimit) { - throw new BadRequestError({ name: "Rate Limit Update", message: "Rate Limit does not exist yet" }); - } - - return rateLimitDAL.updateById(rateLimit.id, updates); + return rateLimitDAL.updateById("00000000-0000-0000-0000-000000000000", updates); }; return { diff --git a/frontend/src/hooks/api/rateLimit/mutation.ts b/frontend/src/hooks/api/rateLimit/mutation.ts index e2cccf78f..22a7f9898 100644 --- a/frontend/src/hooks/api/rateLimit/mutation.ts +++ b/frontend/src/hooks/api/rateLimit/mutation.ts @@ -8,9 +8,9 @@ import { TRateLimit } from "./types"; export const useUpdateRateLimit = () => { const queryClient = useQueryClient(); - return useMutation>({ + return useMutation({ mutationFn: async (opt) => { - const { data } = await apiRequest.patch<{ rateLimit: TRateLimit }>("/api/v1/rate-limit", opt); + const { data } = await apiRequest.put<{ rateLimit: TRateLimit }>("/api/v1/rate-limit", opt); return data.rateLimit; }, onSuccess: (data) => { From d3932d8f08e85feb3410d5d12069ea20f5587fac Mon Sep 17 00:00:00 2001 From: = Date: Thu, 13 Jun 2024 15:16:00 +0530 Subject: [PATCH 144/187] fix(ui): broken permission page fixed --- .../ProjectRoleModifySection/MultiEnvProjectPermission.tsx | 3 ++- .../ProjectRoleModifySection/SecretRollbackPermission.tsx | 1 + .../ProjectRoleModifySection/SingleProjectPermission.tsx | 1 + .../ProjectRoleModifySection/WsProjectPermission.tsx | 1 + 4 files changed, 5 insertions(+), 1 deletion(-) diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/MultiEnvProjectPermission.tsx b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/MultiEnvProjectPermission.tsx index 188d81c65..40b841e0f 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/MultiEnvProjectPermission.tsx +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/MultiEnvProjectPermission.tsx @@ -70,6 +70,7 @@ export const MultiEnvProjectPermission = ({ }, [allRule]); const handlePermissionChange = (val: Permission) => { + if(!val) return switch (val) { case Permission.NoAccess: { const permissions = getValue("permissions"); @@ -106,7 +107,7 @@ export const MultiEnvProjectPermission = ({ className={twMerge( "rounded-md bg-mineshaft-800 px-10 py-6", (selectedPermissionCategory !== Permission.NoAccess || isCustom) && - "border-l-2 border-primary-600" + "border-l-2 border-primary-600" )} >
diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SecretRollbackPermission.tsx b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SecretRollbackPermission.tsx index 03fa41b68..8d1fb1db3 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SecretRollbackPermission.tsx +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SecretRollbackPermission.tsx @@ -53,6 +53,7 @@ export const SecretRollbackPermission = ({ isNonEditable, setValue, control }: P }, [selectedPermissionCategory]); const handlePermissionChange = (val: Permission) => { + if(!val) return; if (val === Permission.Custom) setIsCustom.on(); else setIsCustom.off(); diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx index fd65cfd58..51a17d7fe 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/SingleProjectPermission.tsx @@ -98,6 +98,7 @@ export const SingleProjectPermission = ({ }, [selectedPermissionCategory]); const handlePermissionChange = (val: Permission) => { + if(!val) return; if (val === Permission.Custom) setIsCustom.on(); else setIsCustom.off(); diff --git a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/WsProjectPermission.tsx b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/WsProjectPermission.tsx index 9b04c5236..c13a6abde 100644 --- a/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/WsProjectPermission.tsx +++ b/frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/WsProjectPermission.tsx @@ -52,6 +52,7 @@ export const WsProjectPermission = ({ isNonEditable, setValue, control }: Props) }, [selectedPermissionCategory]); const handlePermissionChange = (val: Permission) => { + if(!val) return; if (val === Permission.Custom) setIsCustom.on(); else setIsCustom.off(); From d0ffb94bc78447ed7ebea63ebc3adbbe7d40ad44 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 18:19:46 +0800 Subject: [PATCH 145/187] misc: added handling of automatic config sync --- backend/package-lock.json | 15 ++++++ backend/package.json | 1 + backend/src/main.ts | 4 +- backend/src/server/app.ts | 12 ++++- backend/src/server/config/rateLimiter.ts | 47 ++++++++++++------- .../services/rate-limit/rate-limit-service.ts | 34 +++++++++++++- 6 files changed, 91 insertions(+), 22 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index b6f9a37c1..a2a4d0a6e 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -36,6 +36,7 @@ "bcrypt": "^5.1.1", "bullmq": "^5.4.2", "cassandra-driver": "^4.7.2", + "cron": "^3.1.7", "dotenv": "^16.4.1", "fastify": "^4.26.0", "fastify-plugin": "^4.5.1", @@ -4806,6 +4807,11 @@ "long": "*" } }, + "node_modules/@types/luxon": { + "version": "3.4.2", + "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-3.4.2.tgz", + "integrity": "sha512-TifLZlFudklWlMBfhubvgqTXRzLDI5pCbGa4P8a3wPyUQSW+1xQ5eDsreP9DWHX3tjq1ke96uYG/nwundroWcA==" + }, "node_modules/@types/mime": { "version": "1.3.5", "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz", @@ -6689,6 +6695,15 @@ "integrity": "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==", "dev": true }, + "node_modules/cron": { + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/cron/-/cron-3.1.7.tgz", + "integrity": "sha512-tlBg7ARsAMQLzgwqVxy8AZl/qlTc5nibqYwtNGoCrd+cV+ugI+tvZC1oT/8dFH8W455YrywGykx/KMmAqOr7Jw==", + "dependencies": { + "@types/luxon": "~3.4.0", + "luxon": "~3.4.0" + } + }, "node_modules/cron-parser": { "version": "4.9.0", "resolved": "https://registry.npmjs.org/cron-parser/-/cron-parser-4.9.0.tgz", diff --git a/backend/package.json b/backend/package.json index 3d1937964..66e720dcf 100644 --- a/backend/package.json +++ b/backend/package.json @@ -97,6 +97,7 @@ "bcrypt": "^5.1.1", "bullmq": "^5.4.2", "cassandra-driver": "^4.7.2", + "cron": "^3.1.7", "dotenv": "^16.4.1", "fastify": "^4.26.0", "fastify-plugin": "^4.5.1", diff --git a/backend/src/main.ts b/backend/src/main.ts index 86681ef33..5de0cccc4 100644 --- a/backend/src/main.ts +++ b/backend/src/main.ts @@ -22,12 +22,13 @@ const run = async () => { const queue = queueServiceFactory(appCfg.REDIS_URL); const keyStore = keyStoreFactory(appCfg.REDIS_URL); - const server = await main({ db, smtp, logger, queue, keyStore }); + const { server, jobs } = await main({ db, smtp, logger, queue, keyStore }); const bootstrap = await bootstrapCheck({ db }); // eslint-disable-next-line process.on("SIGINT", async () => { await server.close(); await db.destroy(); + jobs.forEach((job) => job.stop()); process.exit(0); }); @@ -35,6 +36,7 @@ const run = async () => { process.on("SIGTERM", async () => { await server.close(); await db.destroy(); + jobs.forEach((job) => job.stop()); process.exit(0); }); diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index fe94d7ac0..5d94de94c 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -10,6 +10,7 @@ import fastifyFormBody from "@fastify/formbody"; import helmet from "@fastify/helmet"; import type { FastifyRateLimitOptions } from "@fastify/rate-limit"; import ratelimiter from "@fastify/rate-limit"; +import { CronJob } from "cron"; import fasitfy from "fastify"; import { Knex } from "knex"; import { Logger } from "pino"; @@ -41,6 +42,7 @@ type TMain = { // Run the server! export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { const appCfg = getConfig(); + const cronJobs: CronJob[] = []; const server = fasitfy({ logger: appCfg.NODE_ENV === "test" ? false : logger, trustProxy: true, @@ -72,7 +74,13 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { // Rate limiters and security headers if (appCfg.isProductionMode) { const rateLimitDAL = rateLimitDALFactory(db); - const rateLimits = await rateLimitServiceFactory({ rateLimitDAL }).getRateLimits(); + const rateLimitService = rateLimitServiceFactory({ rateLimitDAL }); + const rateLimits = await rateLimitService.getRateLimits(); + + if (rateLimits) { + cronJobs.push(rateLimitService.initializeBackgroundSync()); + } + await server.register(ratelimiter, globalRateLimiterCfg(rateLimits)); } @@ -92,7 +100,7 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { await server.ready(); server.swagger(); - return server; + return { server, jobs: cronJobs }; } catch (err) { server.log.error(err); await queue.shutdown(); diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index e5bec1c6c..8e0e17bfe 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -4,17 +4,28 @@ import { Redis } from "ioredis"; import { TRateLimit } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; +export const rateLimitMaxConfiguration = { + readLimit: 60, + publicEndpointLimit: 30, + writeLimit: 200, + secretsLimit: 60, + authRateLimit: 60, + inviteUserRateLimit: 30, + mfaRateLimit: 20, + creationLimit: 30 +}; + // GET endpoints export const readLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 600, + max: () => rateLimitMaxConfiguration.readLimit, keyGenerator: (req) => req.realIp }; // POST, PATCH, PUT, DELETE endpoints export const writeLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 200, // (too low, FA having issues so increasing it - maidul) + max: () => rateLimitMaxConfiguration.writeLimit, // (too low, FA having issues so increasing it - maidul) keyGenerator: (req) => req.realIp }; @@ -22,25 +33,25 @@ export const writeLimit: RateLimitOptions = { export const secretsLimit: RateLimitOptions = { // secrets, folders, secret imports timeWindow: 60 * 1000, - max: 60, + max: () => rateLimitMaxConfiguration.secretsLimit, keyGenerator: (req) => req.realIp }; export const authRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 60, + max: () => rateLimitMaxConfiguration.authRateLimit, keyGenerator: (req) => req.realIp }; export const inviteUserRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 30, + max: () => rateLimitMaxConfiguration.inviteUserRateLimit, keyGenerator: (req) => req.realIp }; export const mfaRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 20, + max: () => rateLimitMaxConfiguration.mfaRateLimit, keyGenerator: (req) => { return req.headers.authorization?.split(" ")[1] || req.realIp; } @@ -49,7 +60,7 @@ export const mfaRateLimit: RateLimitOptions = { export const creationLimit: RateLimitOptions = { // identity, project, org timeWindow: 60 * 1000, - max: 30, + max: () => rateLimitMaxConfiguration.creationLimit, keyGenerator: (req) => req.realIp }; @@ -57,25 +68,25 @@ export const creationLimit: RateLimitOptions = { export const publicEndpointLimit: RateLimitOptions = { // Shared Secrets timeWindow: 60 * 1000, - max: 30, + max: () => rateLimitMaxConfiguration.publicEndpointLimit, keyGenerator: (req) => req.realIp }; -export const globalRateLimiterCfg = async (rateLimits?: TRateLimit): Promise => { +export const globalRateLimiterCfg = async (customRateLimits?: TRateLimit): Promise => { const appCfg = getConfig(); const redis = appCfg.isRedisConfigured ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) : null; - if (rateLimits) { - readLimit.max = rateLimits.readRateLimit; - publicEndpointLimit.max = rateLimits.publicEndpointLimit; - writeLimit.max = rateLimits.writeRateLimit; - secretsLimit.max = rateLimits.secretsRateLimit; - authRateLimit.max = rateLimits.authRateLimit; - inviteUserRateLimit.max = rateLimits.inviteUserRateLimit; - mfaRateLimit.max = rateLimits.mfaRateLimit; - creationLimit.max = rateLimits.creationLimit; + if (customRateLimits) { + rateLimitMaxConfiguration.readLimit = customRateLimits.readRateLimit; + rateLimitMaxConfiguration.publicEndpointLimit = customRateLimits.publicEndpointLimit; + rateLimitMaxConfiguration.writeLimit = customRateLimits.writeRateLimit; + rateLimitMaxConfiguration.secretsLimit = customRateLimits.secretsRateLimit; + rateLimitMaxConfiguration.authRateLimit = customRateLimits.authRateLimit; + rateLimitMaxConfiguration.inviteUserRateLimit = customRateLimits.inviteUserRateLimit; + rateLimitMaxConfiguration.mfaRateLimit = customRateLimits.mfaRateLimit; + rateLimitMaxConfiguration.creationLimit = customRateLimits.creationLimit; } return { diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index 5f1e75b95..ec69b1e95 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -1,3 +1,8 @@ +import { CronJob } from "cron"; + +import { logger } from "@app/lib/logger"; +import { rateLimitMaxConfiguration } from "@app/server/config/rateLimiter"; + import { TRateLimitDALFactory } from "./rate-limit-dal"; import { TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types"; @@ -20,8 +25,35 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto return rateLimitDAL.updateById("00000000-0000-0000-0000-000000000000", updates); }; + const initializeBackgroundSync = () => { + const rateLimitSync = async () => { + try { + const rateLimit = await getRateLimits(); + if (rateLimit) { + rateLimitMaxConfiguration.readLimit = rateLimit.readRateLimit; + rateLimitMaxConfiguration.publicEndpointLimit = rateLimit.publicEndpointLimit; + rateLimitMaxConfiguration.writeLimit = rateLimit.writeRateLimit; + rateLimitMaxConfiguration.secretsLimit = rateLimit.secretsRateLimit; + rateLimitMaxConfiguration.authRateLimit = rateLimit.authRateLimit; + rateLimitMaxConfiguration.inviteUserRateLimit = rateLimit.inviteUserRateLimit; + rateLimitMaxConfiguration.mfaRateLimit = rateLimit.mfaRateLimit; + rateLimitMaxConfiguration.creationLimit = rateLimit.creationLimit; + } + } catch (error) { + logger.error(`Error syncing rate limit configurations: %o`, error); + } + }; + + // sync rate limits configuration every 10 minutes + const job = new CronJob("*/10 * * * *", rateLimitSync); + job.start(); + + return job; + }; + return { getRateLimits, - updateRateLimit + updateRateLimit, + initializeBackgroundSync }; }; From 20fea1e25f6f232abb3dabdfbb7269513ce039f8 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 18:37:29 +0800 Subject: [PATCH 146/187] misc: added flag to disable rate limit updates via API --- .env.example | 2 ++ backend/src/lib/config/env.ts | 3 ++- backend/src/services/rate-limit/rate-limit-service.ts | 9 +++++++++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.env.example b/.env.example index 67110d69a..6670a0a3a 100644 --- a/.env.example +++ b/.env.example @@ -67,3 +67,5 @@ CLIENT_SECRET_GITLAB_LOGIN= CAPTCHA_SECRET= NEXT_PUBLIC_CAPTCHA_SITE_KEY= + +ALLOW_RATELIMIT_UPDATES= diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts index 80a2111fc..7c02ebdbf 100644 --- a/backend/src/lib/config/env.ts +++ b/backend/src/lib/config/env.ts @@ -123,7 +123,8 @@ const envSchema = z .optional(), INFISICAL_CLOUD: zodStrBool.default("false"), MAINTENANCE_MODE: zodStrBool.default("false"), - CAPTCHA_SECRET: zpStr(z.string().optional()) + CAPTCHA_SECRET: zpStr(z.string().optional()), + ALLOW_RATELIMIT_UPDATES: zodStrBool.default("false") }) .transform((data) => ({ ...data, diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index ec69b1e95..a697f1afd 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -1,5 +1,7 @@ import { CronJob } from "cron"; +import { getConfig } from "@app/lib/config/env"; +import { ForbiddenRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { rateLimitMaxConfiguration } from "@app/server/config/rateLimiter"; @@ -22,6 +24,13 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto }; const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise => { + const appCfg = getConfig(); + if (!appCfg.ALLOW_RATELIMIT_UPDATES) { + throw new ForbiddenRequestError({ + name: "Rate limit Updates Disabled", + message: "Changes to rate limits are disabled" + }); + } return rateLimitDAL.updateById("00000000-0000-0000-0000-000000000000", updates); }; From 5cee228f5f3531049500f9f951ab7f3b54f8c783 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 18:45:15 +0800 Subject: [PATCH 147/187] misc: updated rate limit update message --- frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx index f29a9d52b..0868367dd 100644 --- a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -66,7 +66,7 @@ export const RateLimitPanel = () => { publicEndpointLimit }); createNotification({ - text: "Successfully changed rate limits. Please restart your server", + text: "Rate limits have been successfully updated. Please allow at least 10 minutes for the changes to take effect.", type: "success" }); } catch (e) { From 4de63b61400b60fe622d298cbd9cb398dcb34ec8 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 13 Jun 2024 19:00:33 +0800 Subject: [PATCH 148/187] fix: updated test --- backend/e2e-test/vitest-environment-knex.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/e2e-test/vitest-environment-knex.ts b/backend/e2e-test/vitest-environment-knex.ts index 09ab05443..c287172f6 100644 --- a/backend/e2e-test/vitest-environment-knex.ts +++ b/backend/e2e-test/vitest-environment-knex.ts @@ -43,7 +43,7 @@ export default { const smtp = mockSmtpServer(); const queue = mockQueue(); const keyStore = mockKeyStore(); - const server = await main({ db, smtp, logger, queue, keyStore }); + const { server } = await main({ db, smtp, logger, queue, keyStore }); // @ts-expect-error type globalThis.testServer = server; // @ts-expect-error type From 44956c6a374e03a1a3cc66a868cbcfbf7a38ae33 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 00:58:54 +0800 Subject: [PATCH 149/187] misc: reorganized cron structure and removed unnecessary checks --- .env.example | 2 -- backend/e2e-test/vitest-environment-knex.ts | 2 +- ...327_custom-rate-limits-for-self-hosting.ts | 2 +- backend/src/lib/config/env.ts | 3 +-- backend/src/main.ts | 4 +-- backend/src/server/app.ts | 9 +------ backend/src/server/routes/index.ts | 7 +++++ .../services/rate-limit/rate-limit-service.ts | 27 ++++++++++--------- 8 files changed, 27 insertions(+), 29 deletions(-) diff --git a/.env.example b/.env.example index 6670a0a3a..67110d69a 100644 --- a/.env.example +++ b/.env.example @@ -67,5 +67,3 @@ CLIENT_SECRET_GITLAB_LOGIN= CAPTCHA_SECRET= NEXT_PUBLIC_CAPTCHA_SITE_KEY= - -ALLOW_RATELIMIT_UPDATES= diff --git a/backend/e2e-test/vitest-environment-knex.ts b/backend/e2e-test/vitest-environment-knex.ts index c287172f6..09ab05443 100644 --- a/backend/e2e-test/vitest-environment-knex.ts +++ b/backend/e2e-test/vitest-environment-knex.ts @@ -43,7 +43,7 @@ export default { const smtp = mockSmtpServer(); const queue = mockQueue(); const keyStore = mockKeyStore(); - const { server } = await main({ db, smtp, logger, queue, keyStore }); + const server = await main({ db, smtp, logger, queue, keyStore }); // @ts-expect-error type globalThis.testServer = server; // @ts-expect-error type diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts index cb8007d9f..84ad9b560 100644 --- a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts +++ b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts @@ -6,7 +6,7 @@ import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; export async function up(knex: Knex): Promise { if (!(await knex.schema.hasTable(TableName.RateLimit))) { await knex.schema.createTable(TableName.RateLimit, (t) => { - t.uuid("id", { primaryKey: true }).defaultTo("00000000-0000-0000-0000-000000000000"); + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); t.integer("readRateLimit").defaultTo(600).notNullable(); t.integer("writeRateLimit").defaultTo(200).notNullable(); t.integer("secretsRateLimit").defaultTo(60).notNullable(); diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts index 7c02ebdbf..80a2111fc 100644 --- a/backend/src/lib/config/env.ts +++ b/backend/src/lib/config/env.ts @@ -123,8 +123,7 @@ const envSchema = z .optional(), INFISICAL_CLOUD: zodStrBool.default("false"), MAINTENANCE_MODE: zodStrBool.default("false"), - CAPTCHA_SECRET: zpStr(z.string().optional()), - ALLOW_RATELIMIT_UPDATES: zodStrBool.default("false") + CAPTCHA_SECRET: zpStr(z.string().optional()) }) .transform((data) => ({ ...data, diff --git a/backend/src/main.ts b/backend/src/main.ts index 5de0cccc4..86681ef33 100644 --- a/backend/src/main.ts +++ b/backend/src/main.ts @@ -22,13 +22,12 @@ const run = async () => { const queue = queueServiceFactory(appCfg.REDIS_URL); const keyStore = keyStoreFactory(appCfg.REDIS_URL); - const { server, jobs } = await main({ db, smtp, logger, queue, keyStore }); + const server = await main({ db, smtp, logger, queue, keyStore }); const bootstrap = await bootstrapCheck({ db }); // eslint-disable-next-line process.on("SIGINT", async () => { await server.close(); await db.destroy(); - jobs.forEach((job) => job.stop()); process.exit(0); }); @@ -36,7 +35,6 @@ const run = async () => { process.on("SIGTERM", async () => { await server.close(); await db.destroy(); - jobs.forEach((job) => job.stop()); process.exit(0); }); diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index 5d94de94c..da1bca3e2 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -10,7 +10,6 @@ import fastifyFormBody from "@fastify/formbody"; import helmet from "@fastify/helmet"; import type { FastifyRateLimitOptions } from "@fastify/rate-limit"; import ratelimiter from "@fastify/rate-limit"; -import { CronJob } from "cron"; import fasitfy from "fastify"; import { Knex } from "knex"; import { Logger } from "pino"; @@ -42,7 +41,6 @@ type TMain = { // Run the server! export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { const appCfg = getConfig(); - const cronJobs: CronJob[] = []; const server = fasitfy({ logger: appCfg.NODE_ENV === "test" ? false : logger, trustProxy: true, @@ -76,11 +74,6 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { const rateLimitDAL = rateLimitDALFactory(db); const rateLimitService = rateLimitServiceFactory({ rateLimitDAL }); const rateLimits = await rateLimitService.getRateLimits(); - - if (rateLimits) { - cronJobs.push(rateLimitService.initializeBackgroundSync()); - } - await server.register(ratelimiter, globalRateLimiterCfg(rateLimits)); } @@ -100,7 +93,7 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { await server.ready(); server.swagger(); - return { server, jobs: cronJobs }; + return server; } catch (err) { server.log.error(err); await queue.shutdown(); diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 0b79085cc..2f2de829f 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -1,3 +1,4 @@ +import { CronJob } from "cron"; import { Knex } from "knex"; import { z } from "zod"; @@ -907,6 +908,11 @@ export const registerRoutes = async ( secretSharing: secretSharingService }); + const cronJobs: CronJob[] = []; + if (appCfg.isProductionMode) { + cronJobs.push(rateLimitService.initializeBackgroundSync()); + } + server.decorate("store", { user: userDAL }); @@ -961,6 +967,7 @@ export const registerRoutes = async ( await server.register(registerV3Routes, { prefix: "/api/v3" }); server.addHook("onClose", async () => { + cronJobs.forEach((job) => job.stop()); await telemetryService.flushAll(); }); }; diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index a697f1afd..e458a9310 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -1,7 +1,5 @@ import { CronJob } from "cron"; -import { getConfig } from "@app/lib/config/env"; -import { ForbiddenRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { rateLimitMaxConfiguration } from "@app/server/config/rateLimiter"; @@ -15,23 +13,28 @@ type TRateLimitServiceFactoryDep = { export type TRateLimitServiceFactory = ReturnType; export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFactoryDep) => { + const DEFAULT_RATE_LIMIT_CONFIG_ID = "00000000-0000-0000-0000-000000000000"; + const getRateLimits = async (): Promise => { + let rateLimit: TRateLimit; + try { - return await rateLimitDAL.findOne({ id: "00000000-0000-0000-0000-000000000000" }); - } catch (error) { + rateLimit = await rateLimitDAL.findOne({ id: DEFAULT_RATE_LIMIT_CONFIG_ID }); + if (!rateLimit) { + // rate limit might not exist + rateLimit = await rateLimitDAL.create({ + // @ts-expect-error id is kept as fixed because there should only be one rate limit config per instance + id: DEFAULT_RATE_LIMIT_CONFIG_ID + }); + } + return rateLimit; + } catch (err) { return undefined; } }; const updateRateLimit = async (updates: TRateLimitUpdateDTO): Promise => { - const appCfg = getConfig(); - if (!appCfg.ALLOW_RATELIMIT_UPDATES) { - throw new ForbiddenRequestError({ - name: "Rate limit Updates Disabled", - message: "Changes to rate limits are disabled" - }); - } - return rateLimitDAL.updateById("00000000-0000-0000-0000-000000000000", updates); + return rateLimitDAL.updateById(DEFAULT_RATE_LIMIT_CONFIG_ID, updates); }; const initializeBackgroundSync = () => { From 46b48cea633269ae5e6c7ddc603977df66b31170 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 01:14:26 +0800 Subject: [PATCH 150/187] misc: added loader --- frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx index 0868367dd..a3c39e7e4 100644 --- a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -3,7 +3,7 @@ import { zodResolver } from "@hookform/resolvers/zod"; import { z } from "zod"; import { createNotification } from "@app/components/notifications"; -import { Button, FormControl, Input } from "@app/components/v2"; +import { Button, ContentLoader, FormControl, Input } from "@app/components/v2"; import { useGetRateLimit, useUpdateRateLimit } from "@app/hooks/api"; const formSchema = z.object({ @@ -20,7 +20,7 @@ const formSchema = z.object({ type TRateLimitForm = z.infer; export const RateLimitPanel = () => { - const { data: rateLimit } = useGetRateLimit(); + const { data: rateLimit, isLoading } = useGetRateLimit(); const { mutateAsync: updateRateLimit } = useUpdateRateLimit(); const { @@ -78,7 +78,9 @@ export const RateLimitPanel = () => { } }; - return ( + return isLoading ? ( + + ) : (
Date: Thu, 13 Jun 2024 10:16:27 -0700 Subject: [PATCH 151/187] Expose ca / cert endpoints to public api ref --- backend/src/lib/api-docs/constants.ts | 41 +++++++++++++------ .../routes/v1/certificate-authority-router.ts | 33 ++++++++------- .../server/routes/v1/certificate-router.ts | 10 ++--- .../cert.mdx | 0 .../create.mdx | 0 .../crl.mdx | 0 .../csr.mdx | 0 .../delete.mdx | 0 .../import-cert.mdx | 0 .../issue-cert.mdx | 0 .../read.mdx | 0 .../sign-intermediate.mdx | 0 .../update.mdx | 0 .../endpoints/certificates/cert-body.mdx | 4 ++ .../endpoints/certificates/delete.mdx | 4 ++ .../endpoints/certificates/read.mdx | 4 ++ .../endpoints/certificates/revoke.mdx | 4 ++ docs/mint.json | 24 +++++++++++ 18 files changed, 92 insertions(+), 32 deletions(-) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/cert.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/create.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/crl.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/csr.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/delete.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/import-cert.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/issue-cert.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/read.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/sign-intermediate.mdx (100%) rename docs/api-reference/endpoints/{certificate-authority => certificate-authorities}/update.mdx (100%) create mode 100644 docs/api-reference/endpoints/certificates/cert-body.mdx create mode 100644 docs/api-reference/endpoints/certificates/delete.mdx create mode 100644 docs/api-reference/endpoints/certificates/read.mdx create mode 100644 docs/api-reference/endpoints/certificates/revoke.mdx diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts index ef5c22a23..3dbf02f99 100644 --- a/backend/src/lib/api-docs/constants.ts +++ b/backend/src/lib/api-docs/constants.ts @@ -728,11 +728,10 @@ export const AUDIT_LOG_STREAMS = { } }; -// TODO export const CERTIFICATE_AUTHORITIES = { CREATE: { projectSlug: "Slug of the project to create the CA in.", - type: "The type of CA to create (root or intermediate)", + type: "The type of CA to create", friendlyName: "A friendly name for the CA", organization: "The organization (O) for the CA", ou: "The organization unit (OU) for the CA", @@ -745,23 +744,27 @@ export const CERTIFICATE_AUTHORITIES = { maxPathLength: "The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.", keyAlgorithm: - "The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA. This should be one of RSA_2048, RSA_4096, EC_prime256v1, or EC_secp384r1." + "The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA." }, GET: { caId: "The ID of the CA to get" }, UPDATE: { - caId: "The ID of the CA to get", + caId: "The ID of the CA to update", status: "The status of the CA to update to. This can be one of active or disabled" }, DELETE: { caId: "The ID of the CA to delete" }, GET_CSR: { - caId: "The ID of the CA to generate CSR from" + caId: "The ID of the CA to generate CSR from", + csr: "The generated CSR from the CA" }, GET_CERT: { - caId: "The ID of the CA to get the certificate body and certificate chain from" + caId: "The ID of the CA to get the certificate body and certificate chain from", + certificate: "The certificate body of the CA", + certificateChain: "The certificate chain of the CA", + serialNumber: "The serial number of the CA certificate" }, SIGN_INTERMEDIATE: { caId: "The ID of the CA to sign the intermediate certificate with", @@ -769,7 +772,11 @@ export const CERTIFICATE_AUTHORITIES = { notBefore: "The date and time when the intermediate CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format", notAfter: "The date and time when the intermediate CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format", maxPathLength: - "The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain." + "The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.", + certificate: "The signed intermediate certificate", + certificateChain: "The certificate chain of the intermediate certificate", + issuingCaCertificate: "The certificate of the issuing CA", + serialNumber: "The serial number of the intermediate certificate" }, IMPORT_CERT: { caId: "The ID of the CA to import the certificate for", @@ -782,10 +789,16 @@ export const CERTIFICATE_AUTHORITIES = { commonName: "The common name (CN) for the certificate", ttl: "The time to live for the certificate such as 1m, 1h, 1d, 1y, ...", notBefore: "The date and time when the certificate becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format", - notAfter: "The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format" + notAfter: "The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format", + certificate: "The issued certificate", + issuingCaCertificate: "The certificate of the issuing CA", + certificateChain: "The certificate chain of the issued certificate", + privateKey: "The private key of the issued certificate", + serialNumber: "The serial number of the issued certificate" }, GET_CRL: { - caId: "The ID of the CA to get the certificate revocation list (CRL) for" + caId: "The ID of the CA to get the certificate revocation list (CRL) for", + crl: "The certificate revocation list (CRL) of the CA" } }; @@ -796,14 +809,18 @@ export const CERTIFICATES = { REVOKE: { serialNumber: "The serial number of the certificate to revoke. The revoked certificate will be added to the certificate revocation list (CRL) of the CA.", - revocationReason: - "The reason for revoking the certificate. This can be one of UNSPECIFIED, KEY_COMPROMISE, CA_COMPROMISE, AFFILIATION_CHANGED, SUPERSEDED, CESSATION_OF_OPERATION, CERTIFICATE_HOLD, PRIVILEGE_WITHDRAWN, or A_A_COMPROMISE." + revocationReason: "The reason for revoking the certificate.", + revokedAt: "The date and time when the certificate was revoked", + serialNumberRes: "The serial number of the revoked certificate." }, DELETE: { serialNumber: "The serial number of the certificate to delete" }, GET_CERT: { - serialNumber: "The serial number of the certificate to get the certificate body and certificate chain for" + serialNumber: "The serial number of the certificate to get the certificate body and certificate chain for", + certificate: "The certificate body of the certificate", + certificateChain: "The certificate chain of the certificate", + serialNumberRes: "The serial number of the certificate" } }; diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts index 7bbaa8373..b0d39df6a 100644 --- a/backend/src/server/routes/v1/certificate-authority-router.ts +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -237,11 +237,11 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { schema: { description: "Get CA CSR", params: z.object({ - caId: z.string().trim() + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET_CSR.caId) }), response: { 200: z.object({ - csr: z.string() + csr: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CSR.csr) }) } }, @@ -286,9 +286,9 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { }), response: { 200: z.object({ - certificate: z.string(), - certificateChain: z.string(), - serialNumber: z.string() + certificate: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CERT.certificate), + certificateChain: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CERT.certificateChain), + serialNumber: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CERT.serialNumber) }) } }, @@ -341,10 +341,13 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { }), response: { 200: z.object({ - certificate: z.string().trim(), - certificateChain: z.string().trim(), - issuingCaCertificate: z.string().trim(), - serialNumber: z.string().trim() + certificate: z.string().trim().describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.certificate), + certificateChain: z.string().trim().describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.certificateChain), + issuingCaCertificate: z + .string() + .trim() + .describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.issuingCaCertificate), + serialNumber: z.string().trim().describe(CERTIFICATE_AUTHORITIES.SIGN_INTERMEDIATE.serialNumber) }) } }, @@ -468,11 +471,11 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { ), response: { 200: z.object({ - certificate: z.string().trim(), - issuingCaCertificate: z.string().trim(), - certificateChain: z.string().trim(), - privateKey: z.string().trim(), - serialNumber: z.string().trim() + certificate: z.string().trim().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.certificate), + issuingCaCertificate: z.string().trim().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.issuingCaCertificate), + certificateChain: z.string().trim().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.certificateChain), + privateKey: z.string().trim().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.privateKey), + serialNumber: z.string().trim().describe(CERTIFICATE_AUTHORITIES.ISSUE_CERT.serialNumber) }) } }, @@ -524,7 +527,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { }), response: { 200: z.object({ - crl: z.string() + crl: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CRL.crl) }) } }, diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts index 056cc74b9..938fbf7fe 100644 --- a/backend/src/server/routes/v1/certificate-router.ts +++ b/backend/src/server/routes/v1/certificate-router.ts @@ -73,8 +73,8 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { response: { 200: z.object({ message: z.string().trim(), - serialNumber: z.string().trim(), - revokedAt: z.date() + serialNumber: z.string().trim().describe(CERTIFICATES.REVOKE.serialNumberRes), + revokedAt: z.date().describe(CERTIFICATES.REVOKE.revokedAt) }) } }, @@ -169,9 +169,9 @@ export const registerCertRouter = async (server: FastifyZodProvider) => { }), response: { 200: z.object({ - certificate: z.string().trim(), - certificateChain: z.string().trim(), - serialNumber: z.string().trim() + certificate: z.string().trim().describe(CERTIFICATES.GET_CERT.certificate), + certificateChain: z.string().trim().describe(CERTIFICATES.GET_CERT.certificateChain), + serialNumber: z.string().trim().describe(CERTIFICATES.GET_CERT.serialNumberRes) }) } }, diff --git a/docs/api-reference/endpoints/certificate-authority/cert.mdx b/docs/api-reference/endpoints/certificate-authorities/cert.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/cert.mdx rename to docs/api-reference/endpoints/certificate-authorities/cert.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/create.mdx b/docs/api-reference/endpoints/certificate-authorities/create.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/create.mdx rename to docs/api-reference/endpoints/certificate-authorities/create.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/crl.mdx b/docs/api-reference/endpoints/certificate-authorities/crl.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/crl.mdx rename to docs/api-reference/endpoints/certificate-authorities/crl.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/csr.mdx b/docs/api-reference/endpoints/certificate-authorities/csr.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/csr.mdx rename to docs/api-reference/endpoints/certificate-authorities/csr.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/delete.mdx b/docs/api-reference/endpoints/certificate-authorities/delete.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/delete.mdx rename to docs/api-reference/endpoints/certificate-authorities/delete.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/import-cert.mdx b/docs/api-reference/endpoints/certificate-authorities/import-cert.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/import-cert.mdx rename to docs/api-reference/endpoints/certificate-authorities/import-cert.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/issue-cert.mdx b/docs/api-reference/endpoints/certificate-authorities/issue-cert.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/issue-cert.mdx rename to docs/api-reference/endpoints/certificate-authorities/issue-cert.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/read.mdx b/docs/api-reference/endpoints/certificate-authorities/read.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/read.mdx rename to docs/api-reference/endpoints/certificate-authorities/read.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/sign-intermediate.mdx b/docs/api-reference/endpoints/certificate-authorities/sign-intermediate.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/sign-intermediate.mdx rename to docs/api-reference/endpoints/certificate-authorities/sign-intermediate.mdx diff --git a/docs/api-reference/endpoints/certificate-authority/update.mdx b/docs/api-reference/endpoints/certificate-authorities/update.mdx similarity index 100% rename from docs/api-reference/endpoints/certificate-authority/update.mdx rename to docs/api-reference/endpoints/certificate-authorities/update.mdx diff --git a/docs/api-reference/endpoints/certificates/cert-body.mdx b/docs/api-reference/endpoints/certificates/cert-body.mdx new file mode 100644 index 000000000..e4c3b0123 --- /dev/null +++ b/docs/api-reference/endpoints/certificates/cert-body.mdx @@ -0,0 +1,4 @@ +--- +title: "Get Certificate Body / Chain" +openapi: "GET /api/v1/pki/certificates/{serialNumber}/certificate" +--- diff --git a/docs/api-reference/endpoints/certificates/delete.mdx b/docs/api-reference/endpoints/certificates/delete.mdx new file mode 100644 index 000000000..27042af42 --- /dev/null +++ b/docs/api-reference/endpoints/certificates/delete.mdx @@ -0,0 +1,4 @@ +--- +title: "Delete" +openapi: "DELETE /api/v1/pki/certificates/{serialNumber}" +--- diff --git a/docs/api-reference/endpoints/certificates/read.mdx b/docs/api-reference/endpoints/certificates/read.mdx new file mode 100644 index 000000000..ce6463dde --- /dev/null +++ b/docs/api-reference/endpoints/certificates/read.mdx @@ -0,0 +1,4 @@ +--- +title: "Retrieve" +openapi: "GET /api/v1/pki/certificates/{serialNumber}" +--- diff --git a/docs/api-reference/endpoints/certificates/revoke.mdx b/docs/api-reference/endpoints/certificates/revoke.mdx new file mode 100644 index 000000000..e4da73a19 --- /dev/null +++ b/docs/api-reference/endpoints/certificates/revoke.mdx @@ -0,0 +1,4 @@ +--- +title: "Revoke" +openapi: "POST /api/v1/pki/certificates/{serialNumber}/revoke" +--- diff --git a/docs/mint.json b/docs/mint.json index d9914f373..840649d03 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -565,6 +565,30 @@ { "group": "Audit Logs", "pages": ["api-reference/endpoints/audit-logs/export-audit-log"] + }, + { + "group": "Certificate Authorities", + "pages": [ + "api-reference/endpoints/certificate-authorities/create", + "api-reference/endpoints/certificate-authorities/read", + "api-reference/endpoints/certificate-authorities/update", + "api-reference/endpoints/certificate-authorities/delete", + "api-reference/endpoints/certificate-authorities/csr", + "api-reference/endpoints/certificate-authorities/cert", + "api-reference/endpoints/certificate-authorities/sign-intermediate", + "api-reference/endpoints/certificate-authorities/import-cert", + "api-reference/endpoints/certificate-authorities/issue-cert", + "api-reference/endpoints/certificate-authorities/crl" + ] + }, + { + "group": "Certificates", + "pages": [ + "api-reference/endpoints/certificates/read", + "api-reference/endpoints/certificates/revoke", + "api-reference/endpoints/certificates/delete", + "api-reference/endpoints/certificates/cert-body" + ] } ] }, From bc3f21809e8aa4ff8c06b496c0efe4e30ec5b018 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 02:32:21 +0800 Subject: [PATCH 152/187] misc: migrated to structured singleton pattern --- backend/src/server/app.ts | 4 +- backend/src/server/config/rateLimiter.ts | 42 +++--------- .../services/rate-limit/rate-limit-service.ts | 65 +++++++++++++------ 3 files changed, 56 insertions(+), 55 deletions(-) diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index da1bca3e2..19f5986fb 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -73,8 +73,8 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { if (appCfg.isProductionMode) { const rateLimitDAL = rateLimitDALFactory(db); const rateLimitService = rateLimitServiceFactory({ rateLimitDAL }); - const rateLimits = await rateLimitService.getRateLimits(); - await server.register(ratelimiter, globalRateLimiterCfg(rateLimits)); + await rateLimitService.syncRateLimitConfiguration(); + await server.register(ratelimiter, globalRateLimiterCfg()); } await server.register(helmet, { contentSecurityPolicy: false }); diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 8e0e17bfe..0e406da88 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -1,31 +1,20 @@ import type { RateLimitOptions, RateLimitPluginOptions } from "@fastify/rate-limit"; import { Redis } from "ioredis"; -import { TRateLimit } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; - -export const rateLimitMaxConfiguration = { - readLimit: 60, - publicEndpointLimit: 30, - writeLimit: 200, - secretsLimit: 60, - authRateLimit: 60, - inviteUserRateLimit: 30, - mfaRateLimit: 20, - creationLimit: 30 -}; +import { getRateLimiterConfig } from "@app/services/rate-limit/rate-limit-service"; // GET endpoints export const readLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.readLimit, + max: () => getRateLimiterConfig().readLimit, keyGenerator: (req) => req.realIp }; // POST, PATCH, PUT, DELETE endpoints export const writeLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.writeLimit, // (too low, FA having issues so increasing it - maidul) + max: () => getRateLimiterConfig().writeLimit, keyGenerator: (req) => req.realIp }; @@ -33,25 +22,25 @@ export const writeLimit: RateLimitOptions = { export const secretsLimit: RateLimitOptions = { // secrets, folders, secret imports timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.secretsLimit, + max: () => getRateLimiterConfig().secretsLimit, keyGenerator: (req) => req.realIp }; export const authRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.authRateLimit, + max: () => getRateLimiterConfig().authRateLimit, keyGenerator: (req) => req.realIp }; export const inviteUserRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.inviteUserRateLimit, + max: () => getRateLimiterConfig().inviteUserRateLimit, keyGenerator: (req) => req.realIp }; export const mfaRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.mfaRateLimit, + max: () => getRateLimiterConfig().mfaRateLimit, keyGenerator: (req) => { return req.headers.authorization?.split(" ")[1] || req.realIp; } @@ -60,7 +49,7 @@ export const mfaRateLimit: RateLimitOptions = { export const creationLimit: RateLimitOptions = { // identity, project, org timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.creationLimit, + max: () => getRateLimiterConfig().creationLimit, keyGenerator: (req) => req.realIp }; @@ -68,27 +57,16 @@ export const creationLimit: RateLimitOptions = { export const publicEndpointLimit: RateLimitOptions = { // Shared Secrets timeWindow: 60 * 1000, - max: () => rateLimitMaxConfiguration.publicEndpointLimit, + max: () => getRateLimiterConfig().publicEndpointLimit, keyGenerator: (req) => req.realIp }; -export const globalRateLimiterCfg = async (customRateLimits?: TRateLimit): Promise => { +export const globalRateLimiterCfg = (): RateLimitPluginOptions => { const appCfg = getConfig(); const redis = appCfg.isRedisConfigured ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) : null; - if (customRateLimits) { - rateLimitMaxConfiguration.readLimit = customRateLimits.readRateLimit; - rateLimitMaxConfiguration.publicEndpointLimit = customRateLimits.publicEndpointLimit; - rateLimitMaxConfiguration.writeLimit = customRateLimits.writeRateLimit; - rateLimitMaxConfiguration.secretsLimit = customRateLimits.secretsRateLimit; - rateLimitMaxConfiguration.authRateLimit = customRateLimits.authRateLimit; - rateLimitMaxConfiguration.inviteUserRateLimit = customRateLimits.inviteUserRateLimit; - rateLimitMaxConfiguration.mfaRateLimit = customRateLimits.mfaRateLimit; - rateLimitMaxConfiguration.creationLimit = customRateLimits.creationLimit; - } - return { timeWindow: 60 * 1000, max: 600, diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index e458a9310..a76102ac2 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -1,11 +1,27 @@ import { CronJob } from "cron"; import { logger } from "@app/lib/logger"; -import { rateLimitMaxConfiguration } from "@app/server/config/rateLimiter"; import { TRateLimitDALFactory } from "./rate-limit-dal"; import { TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types"; +let rateLimitMaxConfiguration = { + readLimit: 60, + publicEndpointLimit: 30, + writeLimit: 200, + secretsLimit: 60, + authRateLimit: 60, + inviteUserRateLimit: 30, + mfaRateLimit: 20, + creationLimit: 30 +}; + +Object.freeze(rateLimitMaxConfiguration); + +export const getRateLimiterConfig = () => { + return rateLimitMaxConfiguration; +}; + type TRateLimitServiceFactoryDep = { rateLimitDAL: TRateLimitDALFactory; }; @@ -37,27 +53,33 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto return rateLimitDAL.updateById(DEFAULT_RATE_LIMIT_CONFIG_ID, updates); }; - const initializeBackgroundSync = () => { - const rateLimitSync = async () => { - try { - const rateLimit = await getRateLimits(); - if (rateLimit) { - rateLimitMaxConfiguration.readLimit = rateLimit.readRateLimit; - rateLimitMaxConfiguration.publicEndpointLimit = rateLimit.publicEndpointLimit; - rateLimitMaxConfiguration.writeLimit = rateLimit.writeRateLimit; - rateLimitMaxConfiguration.secretsLimit = rateLimit.secretsRateLimit; - rateLimitMaxConfiguration.authRateLimit = rateLimit.authRateLimit; - rateLimitMaxConfiguration.inviteUserRateLimit = rateLimit.inviteUserRateLimit; - rateLimitMaxConfiguration.mfaRateLimit = rateLimit.mfaRateLimit; - rateLimitMaxConfiguration.creationLimit = rateLimit.creationLimit; - } - } catch (error) { - logger.error(`Error syncing rate limit configurations: %o`, error); - } - }; + const syncRateLimitConfiguration = async () => { + try { + const rateLimit = await getRateLimits(); + if (rateLimit) { + const newRateLimitMaxConfiguration: typeof rateLimitMaxConfiguration = { + readLimit: rateLimit.readRateLimit, + publicEndpointLimit: rateLimit.publicEndpointLimit, + writeLimit: rateLimit.writeRateLimit, + secretsLimit: rateLimit.secretsRateLimit, + authRateLimit: rateLimit.authRateLimit, + inviteUserRateLimit: rateLimit.inviteUserRateLimit, + mfaRateLimit: rateLimit.mfaRateLimit, + creationLimit: rateLimit.creationLimit + }; + logger.info(`Rate limit configuration: %o`, newRateLimitMaxConfiguration); + Object.freeze(newRateLimitMaxConfiguration); + rateLimitMaxConfiguration = newRateLimitMaxConfiguration; + } + } catch (error) { + logger.error(`Error syncing rate limit configurations: %o`, error); + } + }; + + const initializeBackgroundSync = () => { // sync rate limits configuration every 10 minutes - const job = new CronJob("*/10 * * * *", rateLimitSync); + const job = new CronJob("*/10 * * * *", syncRateLimitConfiguration); job.start(); return job; @@ -66,6 +88,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto return { getRateLimits, updateRateLimit, - initializeBackgroundSync + initializeBackgroundSync, + syncRateLimitConfiguration }; }; From 08a77f6ddbf3972cef9ec168b149da69cf81bfb9 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 02:37:01 +0800 Subject: [PATCH 153/187] misc: added missing auth check for rate-limit endpoint --- backend/src/server/routes/v1/rate-limit-router.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/backend/src/server/routes/v1/rate-limit-router.ts b/backend/src/server/routes/v1/rate-limit-router.ts index f2f200228..2b08a0c32 100644 --- a/backend/src/server/routes/v1/rate-limit-router.ts +++ b/backend/src/server/routes/v1/rate-limit-router.ts @@ -21,6 +21,11 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => { }) } }, + onRequest: (req, res, done) => { + verifyAuth([AuthMode.JWT])(req, res, () => { + verifySuperAdmin(req, res, done); + }); + }, handler: async () => { const rateLimit = await server.services.rateLimit.getRateLimits(); if (!rateLimit) { @@ -40,7 +45,7 @@ export const registerRateLimitRouter = async (server: FastifyZodProvider) => { rateLimit: readLimit }, onRequest: (req, res, done) => { - verifyAuth([AuthMode.JWT, AuthMode.API_KEY])(req, res, () => { + verifyAuth([AuthMode.JWT])(req, res, () => { verifySuperAdmin(req, res, done); }); }, From c9e56e4e9f833e1229d5711c028bdbcd072d3be9 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 02:46:51 +0800 Subject: [PATCH 154/187] misc: updated rate limit labels --- .../views/admin/DashboardPage/RateLimitPanel.tsx | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx index a3c39e7e4..85bef017f 100644 --- a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -95,7 +95,7 @@ export const RateLimitPanel = () => { defaultValue={300} render={({ field, fieldState: { error } }) => ( { name="writeRateLimit" render={({ field, fieldState: { error } }) => ( { name="secretsRateLimit" render={({ field, fieldState: { error } }) => ( { name="authRateLimit" render={({ field, fieldState: { error } }) => ( { name="inviteUserRateLimit" render={({ field, fieldState: { error } }) => ( { name="mfaRateLimit" render={({ field, fieldState: { error } }) => ( { name="creationLimit" render={({ field, fieldState: { error } }) => ( { name="publicEndpointLimit" render={({ field, fieldState: { error } }) => ( Date: Fri, 14 Jun 2024 02:55:25 +0800 Subject: [PATCH 155/187] misc: added error log --- backend/src/services/rate-limit/rate-limit-service.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index a76102ac2..aac10db08 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -45,6 +45,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto } return rateLimit; } catch (err) { + logger.error("Error fetching rate limits %o", err); return undefined; } }; From e600b686846233f2e5de5d638aa017f87b9f7e7b Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 22:15:57 +0200 Subject: [PATCH 156/187] Docs: Updated kubernetes --- docs/integrations/platforms/kubernetes.mdx | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx index 4a68f7365..e9cb548e9 100644 --- a/docs/integrations/platforms/kubernetes.mdx +++ b/docs/integrations/platforms/kubernetes.mdx @@ -98,7 +98,9 @@ spec: # Native Kubernetes Auth kubernetesAuth: identityId: - serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + serviceAccountRef: + name: + namespace: # secretsScope is identical to the secrets scope in the universalAuth field in this sample. secretsScope: @@ -257,6 +259,11 @@ spec: Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.kubernetesAuth.identityId` field, add the identity ID of the machine identity you created. See the example below for more details. + + When you configured your Kubernetes machine identity, you would have created a service account token if you followed the [Kubernetes machine identity guide](/documentation/platform/identities/kubernetes-auth). If you did not create a service account token, please follow the guide to do so. + + You will need to enter the name of the service account and the namespace where the service account lives. The example below shows how to add the service account token to the InfisicalSecret resource. + @@ -278,7 +285,9 @@ spec: authentication: kubernetesAuth: identityId: - serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + serviceAccountRef: + name: + namespace: # secretsScope is identical to the secrets scope in the universalAuth field in this sample. secretsScope: From 68818beb38bbb52355a6a5b5e6a30f45d7fb5866 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 22:36:59 +0200 Subject: [PATCH 157/187] Update infisicalsecret_helper.go --- k8-operator/controllers/infisicalsecret_helper.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 4653bd419..873ca93be 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -317,14 +317,13 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context if authDetails.authStrategy == "" { fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") - details, err := r.HandleAuthentication(ctx, infisicalSecret, infisicalClient) - r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, details.authStrategy, err) + authDetails, err := r.HandleAuthentication(ctx, infisicalSecret, infisicalClient) + r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, authDetails.authStrategy, err) if err != nil { return fmt.Errorf("unable to authenticate [err=%s]", err) } - authDetails = details r.UpdateResourceVariables(infisicalSecret, ResourceVariables{ infisicalClient: infisicalClient, authDetails: authDetails, From df71ecffa04cacdbe0a2689bfc3b96e2587cf54f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 13 Jun 2024 16:37:45 -0400 Subject: [PATCH 158/187] uppercase for constants --- k8-operator/controllers/infisicalsecret_controller.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 6d23fa049..e24089956 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -42,11 +42,11 @@ type ResourceVariables struct { // Maps the infisicalSecretCR.UID to a infisicalSdk.InfisicalClientInterface and AuthenticationDetails. var resourceVariablesMap = make(map[string]ResourceVariables) -const finalizerName = "secrets.finalizers.infisical.com" +const FINALIZER_NAME = "secrets.finalizers.infisical.com" func (r *InfisicalSecretReconciler) addFinalizer(ctx context.Context, infisicalSecret *secretsv1alpha1.InfisicalSecret) error { - if !controllerutil.ContainsFinalizer(infisicalSecret, finalizerName) { - controllerutil.AddFinalizer(infisicalSecret, finalizerName) + if !controllerutil.ContainsFinalizer(infisicalSecret, FINALIZER_NAME) { + controllerutil.AddFinalizer(infisicalSecret, FINALIZER_NAME) if err := r.Update(ctx, infisicalSecret); err != nil { return err } @@ -55,12 +55,12 @@ func (r *InfisicalSecretReconciler) addFinalizer(ctx context.Context, infisicalS } func (r *InfisicalSecretReconciler) handleFinalizer(ctx context.Context, infisicalSecret *secretsv1alpha1.InfisicalSecret) error { - if controllerutil.ContainsFinalizer(infisicalSecret, finalizerName) { + if controllerutil.ContainsFinalizer(infisicalSecret, FINALIZER_NAME) { // Cleanup deployment variables delete(resourceVariablesMap, string(infisicalSecret.UID)) // Remove the finalizer and update the resource - controllerutil.RemoveFinalizer(infisicalSecret, finalizerName) + controllerutil.RemoveFinalizer(infisicalSecret, FINALIZER_NAME) if err := r.Update(ctx, infisicalSecret); err != nil { return err } From 3472be480a7846d8e11fb9136da90b6dcd463afd Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 22:53:54 +0200 Subject: [PATCH 159/187] Fix: Only add finalizer if not marked for deletion --- k8-operator/controllers/infisicalsecret_controller.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 6d23fa049..b678c4f30 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -94,9 +94,11 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ fmt.Printf("\nRe-sync interval set. Interval: %v\n", requeueTime) } - // Add the finalizer if it does not exist - if err := r.addFinalizer(ctx, &infisicalSecretCR); err != nil { - return ctrl.Result{}, err + // Add the finalizer if it does not exist, and only add it if the resource is not marked for deletion + if infisicalSecretCR.GetDeletionTimestamp() == nil || infisicalSecretCR.GetDeletionTimestamp().IsZero() { + if err := r.addFinalizer(ctx, &infisicalSecretCR); err != nil { + return ctrl.Result{}, err + } } // Check if the resource is already marked for deletion From 90dae6215850244b9ac508dd8740360015e712a8 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Thu, 13 Jun 2024 14:00:53 -0700 Subject: [PATCH 160/187] Add examples for ca cert ops via api call --- .../platform/pki/certificates.mdx | 102 +++++++++++- .../documentation/platform/pki/private-ca.mdx | 146 +++++++++++++++++- 2 files changed, 244 insertions(+), 4 deletions(-) diff --git a/docs/documentation/platform/pki/certificates.mdx b/docs/documentation/platform/pki/certificates.mdx index f1a025a8d..fe5546681 100644 --- a/docs/documentation/platform/pki/certificates.mdx +++ b/docs/documentation/platform/pki/certificates.mdx @@ -37,7 +37,10 @@ The typical workflow for managing certificates consists of the following steps: ## Guide to Issuing Certificates -In the following steps, we explore how to issue a X.509 certificate under a CA using the Infisical UI. +In the following steps, we explore how to issue a X.509 certificate under a CA. + + + @@ -52,6 +55,7 @@ In the following steps, we explore how to issue a X.509 certificate under a CA u Here's some guidance on each field: - Issuing CA: The CA under which to issue the certificate. + - Friendly Name: A friendly name for the certificate; this is only for display and defaults to the common name of the certificate if left empty. - Common Name (CN): The (common) name of the certificate. - TTL: The lifetime of the certificate in seconds. - Valid Until: The date until which the certificate is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`. @@ -68,16 +72,51 @@ In the following steps, we explore how to issue a X.509 certificate under a CA u + + + To create a certificate, make an API request to the [Create Certificate](/api-reference/endpoints/certificate-authorities/sign-intermediate) API endpoint, + specifying the issuing CA. + + ### Sample request + + ```bash Request + curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca//issue-certificate' \ + --header 'Content-Type: application/json' \ + --data-raw '{ + "commonName": "My Certificate", + }' + ``` + + ### Sample response + + ```bash Response + { + certificate: "...", + certificateChain: "...", + issuingCaCertificate: "...", + privateKey: "...", + serialNumber: "..." + } + ``` + + + Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time. + + + + ## Guide to Revoking Certificates -In the following steps, we explore how to revoke a X.509 certificate under a CA and obtain a Certificate Revocation List (CRL) for a CA using the Infisical UI. +In the following steps, we explore how to revoke a X.509 certificate under a CA and obtain a Certificate Revocation List (CRL) for a CA. + + Assuming that you've issued a certificate under a CA, you can revoke it by selecting the **Revoke Certificate** option for it and specifying the reason - for revocation. Image 1 Image 2 + for revocation. ![pki revoke certificate](/images/platform/pki/cert-revoke.png) @@ -102,6 +141,63 @@ openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem + + + + + Assuming that you've issued a certificate under a CA, you can revoke it by making an API request to the [Revoke Certificate](/api-reference/endpoints/certificate-authorities/revoke) API endpoint, + specifying the serial number of the certificate and the reason for revocation. + + ### Sample request + + ```bash Request + curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates//revoke' \ + --header 'Authorization: Bearer ' \ + --header 'Content-Type: application/json' \ + --data-raw '{ + "revocationReason": "UNSPECIFIED" + }' + ``` + + ### Sample response + + ```bash Response + { + message: "Successfully revoked certificate", + serialNumber: "...", + revokedAt: "..." + } + ``` + + + In order to check the revocation status of a certificate, you can check it against the CRL of the issuing CA. + To obtain the CRL of the CA, make an API request to the [Get CRL](/api-reference/endpoints/certificate-authorities/crl) API endpoint. + + ### Sample request + + ```bash Request + curl --location --request GET 'https://app.infisical.com/api/v1/pki/ca//crl' \ + --header 'Authorization: Bearer ' + ``` + + ### Sample response + + ```bash Response + { + crl: "..." + } + ``` + + To verify a certificate against the CRL with OpenSSL, you can use the following command: + + ```bash + openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem + ``` + + + + + ## FAQ diff --git a/docs/documentation/platform/pki/private-ca.mdx b/docs/documentation/platform/pki/private-ca.mdx index e7ff2d6dd..0ebb31e2c 100644 --- a/docs/documentation/platform/pki/private-ca.mdx +++ b/docs/documentation/platform/pki/private-ca.mdx @@ -39,8 +39,10 @@ A typical workflow for setting up a Private CA hierarchy consists of the followi ## Guide In the following steps, we explore how to create a simple Private CA hierarchy -consisting of a root CA and an intermediate CA using the Infisical UI. +consisting of a root CA and an intermediate CA. + + To create a root CA, head to your Project > Internal PKI > Certificate Authorities and press **Create CA**. @@ -56,6 +58,7 @@ consisting of a root CA and an intermediate CA using the Infisical UI. - Valid Until: The date until which the CA is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`. - Path Length: The maximum number of intermediate CAs that can be chained to this CA. A path of `-1` implies no limit; a path of `0` implies no intermediate CAs can be chained. - Key Algorithm: The type of public key algorithm and size, in bits, of the key pair that the CA creates when it issues a certificate. Supported key algorithms are `RSA 2048`, `RSA 4096`, `ECDSA P-256`, and `ECDSA P-384` with the default being `RSA 2048`. + - Friendly Name: A friendly name for the CA; this is only for display and defaults to the subject of the CA if left empty. - Organization (O): The organization name. - Country (C): The country code. - State or Province Name: The state or province. @@ -95,6 +98,147 @@ consisting of a root CA and an intermediate CA using the Infisical UI. + + + + + To create a root CA, make an API request to the [Create CA](/api-reference/endpoints/certificate-authorities/create) API endpoint, specifying the `type` as `root`. + + ### Sample request + + ```bash Request + curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca' \ + --header 'Authorization: Bearer ' \ + --header 'Content-Type: application/json' \ + --data-raw '{ + "projectSlug": "", + "type": "root", + "commonName": "My Root CA" + }' + ``` + + ### Sample response + + ```bash Response + { + ca: { + id: "", + type: "root", + commonName: "My Root CA", + ... + } + } + ``` + + By default, Infisical creates a root CA with the `RSA_2048` key algorithm, validity period of 10 years, with no restrictions on path length; + you may override these defaults by specifying your own options when making the API request. + + + + 2.1. To create an intermediate CA, make an API request to the [Create CA](/api-reference/endpoints/certificate-authorities/create) API endpoint, specifying the `type` as `intermediate`. + + ### Sample request + + ```bash Request + curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca' \ + --header 'Authorization: Bearer ' \ + --header 'Content-Type: application/json' \ + --data-raw '{ + "projectSlug": "", + "type": "intermediate", + "commonName": "My Intermediate CA" + }' + ``` + + ### Sample response + + ```bash Response + { + ca: { + id: "", + type: "intermediate", + commonName: "My Intermediate CA", + ... + } + } + ``` + + 2.2. Next, get a certificate signing request from the intermediate CA by making an API request to the [Get CSR](/api-reference/endpoints/certificate-authorities/csr) API endpoint. + + ### Sample request + + ```bash Request + curl --location --request GET 'https://app.infisical.com/api/v1/pki/ca//csr' \ + --header 'Authorization: Bearer ' \ + --data-raw '' + ``` + + ### Sample response + + ```bash Response + { + csr: "..." + } + ``` + + 2.3. Next, create an intermediate certificate by making an API request to the [Sign Intermediate](/api-reference/endpoints/certificate-authorities/sign-intermediate) API endpoint + containing the CSR from step 2.2, referencing the root CA created in step 1. + + ### Sample request + + ```bash Request + curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca//sign-intermediate' \ + --header 'Content-Type: application/json' \ + --data-raw '{ + "csr": "", + "notAfter": "2029-06-12" + }' + ``` + + ### Sample response + + ```bash Response + { + certificate: "...", + certificateChain: "...", + issuingCaCertificate: "...", + serialNumber: "...", + } + ``` + + + The `notAfter` value must be within the validity period of the root CA that is if the root CA is valid until `2029-06-12`, the intermediate CA must be valid until a date before `2029-06-12`. + + + 2.4. Finally, import the intermediate certificate and certificate chain from step 2.3 back to the intermediate CA by making an API request to the [Import Certificate](/api-reference/endpoints/certificate-authorities/import-cert) API endpoint. + + ### Sample request + + ```bash Request + curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca//import-certificate' \ + --header 'Authorization: Bearer ' \ + --header 'Content-Type: application/json' \ + --data-raw '{ + "certificate": "", + "certificateChain": "" + }' + ``` + + ### Sample response + + ```bash Response + { + message: "Successfully imported certificate to CA", + caId: "..." + } + ``` + + Great! You’ve successfully created a Private CA hierarchy with a root CA and an intermediate CA. Now check out the Certificates page to learn more about how to issue X.509 certificates using the intermediate CA. + + + + + ## FAQ From 561992e5cf160cec94ab3a59570a55651515af3e Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Thu, 13 Jun 2024 14:28:31 -0700 Subject: [PATCH 161/187] Display pagination for certs when reached per page init --- .../CertificatesTab/components/CertificatesTable.tsx | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx index c83d47507..f23299aa8 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificatesTable.tsx @@ -27,7 +27,8 @@ import { Th, THead, Tooltip, - Tr} from "@app/components/v2"; + Tr +} from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; import { useListWorkspaceCertificates } from "@app/hooks/api"; import { certStatusToNameMap } from "@app/hooks/api/certificates/constants"; @@ -45,9 +46,11 @@ type Props = { ) => void; }; +const PER_PAGE_INIT = 25; + export const CertificatesTable = ({ handlePopUpOpen }: Props) => { const [page, setPage] = useState(1); - const [perPage, setPerPage] = useState(25); + const [perPage, setPerPage] = useState(PER_PAGE_INIT); const { currentWorkspace } = useWorkspace(); const { data, isLoading } = useListWorkspaceCertificates({ @@ -184,7 +187,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => { })}
- {!isLoading && data?.totalCount !== undefined && ( + {!isLoading && data?.totalCount !== undefined && data.totalCount >= PER_PAGE_INIT && ( Date: Thu, 13 Jun 2024 17:57:15 -0400 Subject: [PATCH 162/187] nits: update logs format --- k8-operator/config/samples/k8s-auth/sample.yaml | 8 +++++--- .../controllers/infisicalsecret_controller.go | 14 +++++++------- k8-operator/controllers/infisicalsecret_helper.go | 9 +++------ 3 files changed, 15 insertions(+), 16 deletions(-) diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml index e4082a9ae..6dcbae13a 100644 --- a/k8-operator/config/samples/k8s-auth/sample.yaml +++ b/k8-operator/config/samples/k8s-auth/sample.yaml @@ -12,8 +12,10 @@ spec: authentication: # Native Kubernetes Auth kubernetesAuth: - identityId: 8c0c9823-7249-4043-b292-a861fb9b1b50 - # serviceAccountTokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token + identityId: <> + serviceAccountRef: + name: infisical-auth + namespace: default # secretsScope is identical to the secrets scope in the universalAuth field in this sample. secretsScope: @@ -24,7 +26,7 @@ spec: managedSecretReference: - secretName: managed-secret + secretName: managed-secret-k8s secretNamespace: default creationPolicy: "Orphan" ## Owner | Orphan # secretType: kubernetes.io/dockerconfigjson diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 0d6ef9952..73da45034 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -9,7 +9,7 @@ import ( "k8s.io/apimachinery/pkg/runtime" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" + controllerUtil "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/packages/api" @@ -45,8 +45,8 @@ var resourceVariablesMap = make(map[string]ResourceVariables) const FINALIZER_NAME = "secrets.finalizers.infisical.com" func (r *InfisicalSecretReconciler) addFinalizer(ctx context.Context, infisicalSecret *secretsv1alpha1.InfisicalSecret) error { - if !controllerutil.ContainsFinalizer(infisicalSecret, FINALIZER_NAME) { - controllerutil.AddFinalizer(infisicalSecret, FINALIZER_NAME) + if !controllerUtil.ContainsFinalizer(infisicalSecret, FINALIZER_NAME) { + controllerUtil.AddFinalizer(infisicalSecret, FINALIZER_NAME) if err := r.Update(ctx, infisicalSecret); err != nil { return err } @@ -55,12 +55,12 @@ func (r *InfisicalSecretReconciler) addFinalizer(ctx context.Context, infisicalS } func (r *InfisicalSecretReconciler) handleFinalizer(ctx context.Context, infisicalSecret *secretsv1alpha1.InfisicalSecret) error { - if controllerutil.ContainsFinalizer(infisicalSecret, FINALIZER_NAME) { + if controllerUtil.ContainsFinalizer(infisicalSecret, FINALIZER_NAME) { // Cleanup deployment variables delete(resourceVariablesMap, string(infisicalSecret.UID)) // Remove the finalizer and update the resource - controllerutil.RemoveFinalizer(infisicalSecret, FINALIZER_NAME) + controllerUtil.RemoveFinalizer(infisicalSecret, FINALIZER_NAME) if err := r.Update(ctx, infisicalSecret); err != nil { return err } @@ -75,12 +75,12 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR) if err != nil { if errors.IsNotFound(err) { - fmt.Printf("Infisical Secret CRD not found [err=%v]", err) + fmt.Printf("\nInfisical Secret CRD not found [err=%v]", err) return ctrl.Result{ Requeue: false, }, nil } else { - fmt.Printf("Unable to fetch Infisical Secret CRD from cluster because [err=%v]", err) + fmt.Printf("\nUnable to fetch Infisical Secret CRD from cluster because [err=%v]", err) return ctrl.Result{ RequeueAfter: requeueTime, }, nil diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index 873ca93be..9ae6ad69a 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -381,20 +381,17 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context return fmt.Errorf("\nfailed to get secrets because [err=%v]", err) } - fmt.Println("ReconcileInfisicalSecret: Fetched secrets via service token") + fmt.Println("ReconcileInfisicalSecret: Fetched secrets via [type=SERVICE_TOKEN]") } else if authDetails.isMachineIdentityAuth { // * Machine Identity authentication, the SDK will be authenticated at this point - - fmt.Println("ReconcileInfisicalSecret: Fetching secrets via machine identity") - plainTextSecretsFromApi, updateDetails, err = util.GetPlainTextSecretsViaMachineIdentity(infisicalClient, secretVersionBasedOnETag, authDetails.machineIdentityScope) if err != nil { return fmt.Errorf("\nfailed to get secrets because [err=%v]", err) } - fmt.Println("ReconcileInfisicalSecret: Fetched secrets via universal auth") + fmt.Printf("ReconcileInfisicalSecret: Fetched secrets via machine identity [type=%v]\n", authDetails.authStrategy) } else { - return fmt.Errorf("no authentication method provided. You must provide either a valid service token or a service account details to fetch secrets") + return errors.New("no authentication method provided yet. Please configure a authentication method then try again") } if !updateDetails.Modified { From 3947e3dabfb6f06c8eb21b1b8af9b9c7fb326451 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Fri, 14 Jun 2024 00:23:40 +0200 Subject: [PATCH 163/187] Helm versioning --- helm-charts/secrets-operator/Chart.yaml | 2 +- helm-charts/secrets-operator/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index 91632c97d..03fa9e41e 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: v0.5.2 +version: v0.6.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml index 7d42f7f06..716cec7dc 100644 --- a/helm-charts/secrets-operator/values.yaml +++ b/helm-charts/secrets-operator/values.yaml @@ -32,7 +32,7 @@ controllerManager: - ALL image: repository: infisical/kubernetes-operator - tag: v0.5.2 + tag: v0.6.0 resources: limits: cpu: 500m From 2605987289aa01cc804f488008896e0fb36fb5b9 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Fri, 14 Jun 2024 00:25:41 +0200 Subject: [PATCH 164/187] Helm versioning --- helm-charts/secrets-operator/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index 03fa9e41e..1588f9c12 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -18,4 +18,4 @@ version: v0.6.0 # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "v0.5.2" +appVersion: "v0.6.0" From 8fca6b60b351270fdb3401e8992d01b77df5ca17 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Thu, 13 Jun 2024 15:38:32 -0700 Subject: [PATCH 165/187] Move crl functionality under ee --- backend/src/@types/fastify.d.ts | 2 + .../v1/certificate-authority-crl-router.ts | 86 +++++++++ backend/src/ee/routes/v1/index.ts | 8 + .../certificate-authority-crl-dal.ts | 0 .../certificate-authority-crl-service.ts | 172 ++++++++++++++++++ .../certificate-authority-crl-types.ts | 5 + .../services/license/__mocks__/licence-fns.ts | 3 +- .../src/ee/services/license/licence-fns.ts | 3 +- .../src/ee/services/license/license-types.ts | 1 + backend/src/server/routes/index.ts | 13 +- .../routes/v1/certificate-authority-router.ts | 77 -------- .../certificate-authority-queue.ts | 2 +- .../certificate-authority-service.ts | 134 +------------- .../certificate-authority-types.ts | 10 +- .../certificate/certificate-service.ts | 2 +- frontend/src/hooks/api/subscriptions/types.ts | 17 +- .../components/CaTab/components/CaSection.tsx | 10 +- .../components/CaTab/components/CaTable.tsx | 27 ++- 18 files changed, 332 insertions(+), 240 deletions(-) create mode 100644 backend/src/ee/routes/v1/certificate-authority-crl-router.ts rename backend/src/{services/certificate-authority => ee/services/certificate-authority-crl}/certificate-authority-crl-dal.ts (100%) create mode 100644 backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts create mode 100644 backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-types.ts diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index fb91e58e7..4c885c3cb 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -6,6 +6,7 @@ import { TAccessApprovalRequestServiceFactory } from "@app/ee/services/access-ap import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service"; import { TCreateAuditLogDTO } from "@app/ee/services/audit-log/audit-log-types"; import { TAuditLogStreamServiceFactory } from "@app/ee/services/audit-log-stream/audit-log-stream-service"; +import { TCertificateAuthorityCrlServiceFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-service"; import { TDynamicSecretServiceFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-service"; import { TDynamicSecretLeaseServiceFactory } from "@app/ee/services/dynamic-secret-lease/dynamic-secret-lease-service"; import { TGroupServiceFactory } from "@app/ee/services/group/group-service"; @@ -141,6 +142,7 @@ declare module "fastify" { auditLogStream: TAuditLogStreamServiceFactory; certificate: TCertificateServiceFactory; certificateAuthority: TCertificateAuthorityServiceFactory; + certificateAuthorityCrl: TCertificateAuthorityCrlServiceFactory; secretScanning: TSecretScanningServiceFactory; license: TLicenseServiceFactory; trustedIp: TTrustedIpServiceFactory; diff --git a/backend/src/ee/routes/v1/certificate-authority-crl-router.ts b/backend/src/ee/routes/v1/certificate-authority-crl-router.ts new file mode 100644 index 000000000..10792f508 --- /dev/null +++ b/backend/src/ee/routes/v1/certificate-authority-crl-router.ts @@ -0,0 +1,86 @@ +import { z } from "zod"; + +import { EventType } from "@app/ee/services/audit-log/audit-log-types"; +import { CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs"; +import { readLimit } from "@app/server/config/rateLimiter"; +import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { AuthMode } from "@app/services/auth/auth-type"; + +export const registerCaCrlRouter = async (server: FastifyZodProvider) => { + server.route({ + method: "GET", + url: "/:caId/crl", + config: { + rateLimit: readLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Get CRL of the CA", + params: z.object({ + caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET_CRL.caId) + }), + response: { + 200: z.object({ + crl: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CRL.crl) + }) + } + }, + handler: async (req) => { + const { crl, ca } = await server.services.certificateAuthorityCrl.getCaCrl({ + caId: req.params.caId, + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: ca.projectId, + event: { + type: EventType.GET_CA_CRL, + metadata: { + caId: ca.id, + dn: ca.dn + } + } + }); + + return { + crl + }; + } + }); + + // server.route({ + // method: "GET", + // url: "/:caId/crl/rotate", + // config: { + // rateLimit: writeLimit + // }, + // onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + // schema: { + // description: "Rotate CRL of the CA", + // params: z.object({ + // caId: z.string().trim() + // }), + // response: { + // 200: z.object({ + // message: z.string() + // }) + // } + // }, + // handler: async (req) => { + // await server.services.certificateAuthority.rotateCaCrl({ + // caId: req.params.caId, + // actor: req.permission.type, + // actorId: req.permission.id, + // actorAuthMethod: req.permission.authMethod, + // actorOrgId: req.permission.orgId + // }); + // return { + // message: "Successfully rotated CA CRL" + // }; + // } + // }); +}; diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts index 16e23eb88..41d3e6bda 100644 --- a/backend/src/ee/routes/v1/index.ts +++ b/backend/src/ee/routes/v1/index.ts @@ -1,6 +1,7 @@ import { registerAccessApprovalPolicyRouter } from "./access-approval-policy-router"; import { registerAccessApprovalRequestRouter } from "./access-approval-request-router"; import { registerAuditLogStreamRouter } from "./audit-log-stream-router"; +import { registerCaCrlRouter } from "./certificate-authority-crl-router"; import { registerDynamicSecretLeaseRouter } from "./dynamic-secret-lease-router"; import { registerDynamicSecretRouter } from "./dynamic-secret-router"; import { registerGroupRouter } from "./group-router"; @@ -54,6 +55,13 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => { { prefix: "/dynamic-secrets" } ); + await server.register( + async (pkiRouter) => { + await pkiRouter.register(registerCaCrlRouter, { prefix: "/ca" }); + }, + { prefix: "/pki" } + ); + await server.register(registerSamlRouter, { prefix: "/sso" }); await server.register(registerScimRouter, { prefix: "/scim" }); await server.register(registerLdapRouter, { prefix: "/ldap" }); diff --git a/backend/src/services/certificate-authority/certificate-authority-crl-dal.ts b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-dal.ts similarity index 100% rename from backend/src/services/certificate-authority/certificate-authority-crl-dal.ts rename to backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-dal.ts diff --git a/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts new file mode 100644 index 000000000..c8b56561e --- /dev/null +++ b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts @@ -0,0 +1,172 @@ +import { ForbiddenError } from "@casl/ability"; +import * as x509 from "@peculiar/x509"; + +import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal"; +import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; +import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; +import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; +import { BadRequestError } from "@app/lib/errors"; +import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { TProjectDALFactory } from "@app/services/project/project-dal"; +import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns"; + +import { TGetCrl } from "./certificate-authority-crl-types"; + +type TCertificateAuthorityCrlServiceFactoryDep = { + certificateAuthorityDAL: Pick; + certificateAuthorityCrlDAL: Pick; + projectDAL: Pick; + kmsService: Pick; + permissionService: Pick; + licenseService: Pick; +}; + +export type TCertificateAuthorityCrlServiceFactory = ReturnType; + +export const certificateAuthorityCrlServiceFactory = ({ + certificateAuthorityDAL, + certificateAuthorityCrlDAL, + projectDAL, + kmsService, + permissionService, + licenseService +}: TCertificateAuthorityCrlServiceFactoryDep) => { + /** + * Return the Certificate Revocation List (CRL) for CA with id [caId] + */ + const getCaCrl = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCrl) => { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) throw new BadRequestError({ message: "CA not found" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + ca.projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + ProjectPermissionSub.CertificateAuthorities + ); + + const plan = await licenseService.getPlan(actorOrgId); + if (!plan.caCrl) + throw new BadRequestError({ + message: + "Failed to get CA certificate revocation list (CRL) due to plan restriction. Upgrade plan to get the CA CRL." + }); + + const caCrl = await certificateAuthorityCrlDAL.findOne({ caId: ca.id }); + if (!caCrl) throw new BadRequestError({ message: "CRL not found" }); + + const keyId = await getProjectKmsCertificateKeyId({ + projectId: ca.projectId, + projectDAL, + kmsService + }); + + const decryptedCrl = await kmsService.decrypt({ + kmsId: keyId, + cipherTextBlob: caCrl.encryptedCrl + }); + + const crl = new x509.X509Crl(decryptedCrl); + + const base64crl = crl.toString("base64"); + const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`; + + return { + crl: crlPem, + ca + }; + }; + + // const rotateCaCrl = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TRotateCrlDTO) => { + // const ca = await certificateAuthorityDAL.findById(caId); + // if (!ca) throw new BadRequestError({ message: "CA not found" }); + + // const { permission } = await permissionService.getProjectPermission( + // actor, + // actorId, + // ca.projectId, + // actorAuthMethod, + // actorOrgId + // ); + + // ForbiddenError.from(permission).throwUnlessCan( + // ProjectPermissionActions.Read, + // ProjectPermissionSub.CertificateAuthorities + // ); + + // const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id }); + + // const alg = keyAlgorithmToAlgCfg(ca.keyAlgorithm as CertKeyAlgorithm); + + // const keyId = await getProjectKmsCertificateKeyId({ + // projectId: ca.projectId, + // projectDAL, + // kmsService + // }); + + // const privateKey = await kmsService.decrypt({ + // kmsId: keyId, + // cipherTextBlob: caSecret.encryptedPrivateKey + // }); + + // const skObj = crypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); + // const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [ + // "sign" + // ]); + + // const revokedCerts = await certificateDAL.find({ + // caId: ca.id, + // status: CertStatus.REVOKED + // }); + + // const crl = await x509.X509CrlGenerator.create({ + // issuer: ca.dn, + // thisUpdate: new Date(), + // nextUpdate: new Date("2025/12/12"), + // entries: revokedCerts.map((revokedCert) => { + // return { + // serialNumber: revokedCert.serialNumber, + // revocationDate: new Date(revokedCert.revokedAt as Date), + // reason: revokedCert.revocationReason as number, + // invalidity: new Date("2022/01/01"), + // issuer: ca.dn + // }; + // }), + // signingAlgorithm: alg, + // signingKey: sk + // }); + + // const { cipherTextBlob: encryptedCrl } = await kmsService.encrypt({ + // kmsId: keyId, + // plainText: Buffer.from(new Uint8Array(crl.rawData)) + // }); + + // await certificateAuthorityCrlDAL.update( + // { + // caId: ca.id + // }, + // { + // encryptedCrl + // } + // ); + + // const base64crl = crl.toString("base64"); + // const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`; + + // return { + // crl: crlPem + // }; + // }; + + return { + getCaCrl + // rotateCaCrl + }; +}; diff --git a/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-types.ts b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-types.ts new file mode 100644 index 000000000..fc31e9eef --- /dev/null +++ b/backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-types.ts @@ -0,0 +1,5 @@ +import { TProjectPermission } from "@app/lib/types"; + +export type TGetCrl = { + caId: string; +} & Omit; diff --git a/backend/src/ee/services/license/__mocks__/licence-fns.ts b/backend/src/ee/services/license/__mocks__/licence-fns.ts index b5cbf103e..ddbffba45 100644 --- a/backend/src/ee/services/license/__mocks__/licence-fns.ts +++ b/backend/src/ee/services/license/__mocks__/licence-fns.ts @@ -25,6 +25,7 @@ export const getDefaultOnPremFeatures = () => { trial_end: null, has_used_trial: true, secretApproval: false, - secretRotation: true + secretRotation: true, + caCrl: false }; }; diff --git a/backend/src/ee/services/license/licence-fns.ts b/backend/src/ee/services/license/licence-fns.ts index 189a3c4e0..9d2c5a472 100644 --- a/backend/src/ee/services/license/licence-fns.ts +++ b/backend/src/ee/services/license/licence-fns.ts @@ -34,7 +34,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({ trial_end: null, has_used_trial: true, secretApproval: false, - secretRotation: true + secretRotation: true, + caCrl: false }); export const setupLicenceRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => { diff --git a/backend/src/ee/services/license/license-types.ts b/backend/src/ee/services/license/license-types.ts index 0c8fdc197..e23ff2c84 100644 --- a/backend/src/ee/services/license/license-types.ts +++ b/backend/src/ee/services/license/license-types.ts @@ -52,6 +52,7 @@ export type TFeatureSet = { has_used_trial: true; secretApproval: false; secretRotation: true; + caCrl: false; }; export type TOrgPlansTableDTO = { diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index d9f4bf029..6b050daf6 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -13,6 +13,8 @@ import { auditLogQueueServiceFactory } from "@app/ee/services/audit-log/audit-lo import { auditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service"; import { auditLogStreamDALFactory } from "@app/ee/services/audit-log-stream/audit-log-stream-dal"; import { auditLogStreamServiceFactory } from "@app/ee/services/audit-log-stream/audit-log-stream-service"; +import { certificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal"; +import { certificateAuthorityCrlServiceFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-service"; import { dynamicSecretDALFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-dal"; import { dynamicSecretServiceFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-service"; import { buildDynamicSecretProviders } from "@app/ee/services/dynamic-secret/providers"; @@ -75,7 +77,6 @@ import { certificateBodyDALFactory } from "@app/services/certificate/certificate import { certificateDALFactory } from "@app/services/certificate/certificate-dal"; import { certificateServiceFactory } from "@app/services/certificate/certificate-service"; import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; -import { certificateAuthorityCrlDALFactory } from "@app/services/certificate-authority/certificate-authority-crl-dal"; import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; import { certificateAuthorityQueueFactory } from "@app/services/certificate-authority/certificate-authority-queue"; import { certificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal"; @@ -558,6 +559,15 @@ export const registerRoutes = async ( permissionService }); + const certificateAuthorityCrlService = certificateAuthorityCrlServiceFactory({ + certificateAuthorityDAL, + certificateAuthorityCrlDAL, + projectDAL, + kmsService, + permissionService, + licenseService + }); + const projectService = projectServiceFactory({ permissionService, projectDAL, @@ -945,6 +955,7 @@ export const registerRoutes = async ( auditLogStream: auditLogStreamService, certificate: certificateService, certificateAuthority: certificateAuthorityService, + certificateAuthorityCrl: certificateAuthorityCrlService, secretScanning: secretScanningService, license: licenseService, trustedIp: trustedIpService, diff --git a/backend/src/server/routes/v1/certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-router.ts index b0d39df6a..7573c0bd2 100644 --- a/backend/src/server/routes/v1/certificate-authority-router.ts +++ b/backend/src/server/routes/v1/certificate-authority-router.ts @@ -512,81 +512,4 @@ export const registerCaRouter = async (server: FastifyZodProvider) => { }; } }); - - server.route({ - method: "GET", - url: "/:caId/crl", - config: { - rateLimit: readLimit - }, - onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), - schema: { - description: "Get CRL of the CA", - params: z.object({ - caId: z.string().trim().describe(CERTIFICATE_AUTHORITIES.GET_CRL.caId) - }), - response: { - 200: z.object({ - crl: z.string().describe(CERTIFICATE_AUTHORITIES.GET_CRL.crl) - }) - } - }, - handler: async (req) => { - const { crl, ca } = await server.services.certificateAuthority.getCaCrl({ - caId: req.params.caId, - actor: req.permission.type, - actorId: req.permission.id, - actorAuthMethod: req.permission.authMethod, - actorOrgId: req.permission.orgId - }); - - await server.services.auditLog.createAuditLog({ - ...req.auditLogInfo, - projectId: ca.projectId, - event: { - type: EventType.GET_CA_CRL, - metadata: { - caId: ca.id, - dn: ca.dn - } - } - }); - - return { - crl - }; - } - }); - - // server.route({ - // method: "GET", - // url: "/:caId/crl/rotate", - // config: { - // rateLimit: writeLimit - // }, - // onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), - // schema: { - // description: "Rotate CRL of the CA", - // params: z.object({ - // caId: z.string().trim() - // }), - // response: { - // 200: z.object({ - // message: z.string() - // }) - // } - // }, - // handler: async (req) => { - // await server.services.certificateAuthority.rotateCaCrl({ - // caId: req.params.caId, - // actor: req.permission.type, - // actorId: req.permission.id, - // actorAuthMethod: req.permission.authMethod, - // actorOrgId: req.permission.orgId - // }); - // return { - // message: "Successfully rotated CA CRL" - // }; - // } - // }); }; diff --git a/backend/src/services/certificate-authority/certificate-authority-queue.ts b/backend/src/services/certificate-authority/certificate-authority-queue.ts index fed0a91bb..384f45c09 100644 --- a/backend/src/services/certificate-authority/certificate-authority-queue.ts +++ b/backend/src/services/certificate-authority/certificate-authority-queue.ts @@ -12,7 +12,7 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns"; -import { TCertificateAuthorityCrlDALFactory } from "./certificate-authority-crl-dal"; +import { TCertificateAuthorityCrlDALFactory } from "../../ee/services/certificate-authority-crl/certificate-authority-crl-dal"; import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal"; import { keyAlgorithmToAlgCfg } from "./certificate-authority-fns"; import { TCertificateAuthoritySecretDALFactory } from "./certificate-authority-secret-dal"; diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index 7d753f879..2345180a3 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -13,9 +13,9 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns"; +import { TCertificateAuthorityCrlDALFactory } from "../../ee/services/certificate-authority-crl/certificate-authority-crl-dal"; import { CertKeyAlgorithm, CertStatus } from "../certificate/certificate-types"; import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal"; -import { TCertificateAuthorityCrlDALFactory } from "./certificate-authority-crl-dal"; import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal"; import { createDistinguishedName, @@ -33,10 +33,8 @@ import { TGetCaCertDTO, TGetCaCsrDTO, TGetCaDTO, - TGetCrl, TImportCertToCaDTO, TIssueCertFromCaDTO, - // TRotateCrlDTO, TSignIntermediateDTO, TUpdateCaDTO } from "./certificate-authority-types"; @@ -809,132 +807,6 @@ export const certificateAuthorityServiceFactory = ({ }; }; - /** - * Return the Certificate Revocation List (CRL) for CA with id [caId] - */ - const getCaCrl = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCrl) => { - const ca = await certificateAuthorityDAL.findById(caId); - if (!ca) throw new BadRequestError({ message: "CA not found" }); - - const { permission } = await permissionService.getProjectPermission( - actor, - actorId, - ca.projectId, - actorAuthMethod, - actorOrgId - ); - - ForbiddenError.from(permission).throwUnlessCan( - ProjectPermissionActions.Read, - ProjectPermissionSub.CertificateAuthorities - ); - - const caCrl = await certificateAuthorityCrlDAL.findOne({ caId: ca.id }); - if (!caCrl) throw new BadRequestError({ message: "CRL not found" }); - - const keyId = await getProjectKmsCertificateKeyId({ - projectId: ca.projectId, - projectDAL, - kmsService - }); - - const decryptedCrl = await kmsService.decrypt({ - kmsId: keyId, - cipherTextBlob: caCrl.encryptedCrl - }); - - const crl = new x509.X509Crl(decryptedCrl); - - const base64crl = crl.toString("base64"); - const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`; - - return { - crl: crlPem, - ca - }; - }; - - // const rotateCaCrl = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TRotateCrlDTO) => { - // const ca = await certificateAuthorityDAL.findById(caId); - // if (!ca) throw new BadRequestError({ message: "CA not found" }); - - // const { permission } = await permissionService.getProjectPermission( - // actor, - // actorId, - // ca.projectId, - // actorAuthMethod, - // actorOrgId - // ); - - // ForbiddenError.from(permission).throwUnlessCan( - // ProjectPermissionActions.Read, - // ProjectPermissionSub.CertificateAuthorities - // ); - - // const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id }); - - // const alg = keyAlgorithmToAlgCfg(ca.keyAlgorithm as CertKeyAlgorithm); - - // const keyId = await getProjectKmsCertificateKeyId({ - // projectId: ca.projectId, - // projectDAL, - // kmsService - // }); - - // const privateKey = await kmsService.decrypt({ - // kmsId: keyId, - // cipherTextBlob: caSecret.encryptedPrivateKey - // }); - - // const skObj = crypto.createPrivateKey({ key: privateKey, format: "der", type: "pkcs8" }); - // const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [ - // "sign" - // ]); - - // const revokedCerts = await certificateDAL.find({ - // caId: ca.id, - // status: CertStatus.REVOKED - // }); - - // const crl = await x509.X509CrlGenerator.create({ - // issuer: ca.dn, - // thisUpdate: new Date(), - // nextUpdate: new Date("2025/12/12"), - // entries: revokedCerts.map((revokedCert) => { - // return { - // serialNumber: revokedCert.serialNumber, - // revocationDate: new Date(revokedCert.revokedAt as Date), - // reason: revokedCert.revocationReason as number, - // invalidity: new Date("2022/01/01"), - // issuer: ca.dn - // }; - // }), - // signingAlgorithm: alg, - // signingKey: sk - // }); - - // const { cipherTextBlob: encryptedCrl } = await kmsService.encrypt({ - // kmsId: keyId, - // plainText: Buffer.from(new Uint8Array(crl.rawData)) - // }); - - // await certificateAuthorityCrlDAL.update( - // { - // caId: ca.id - // }, - // { - // encryptedCrl - // } - // ); - - // const base64crl = crl.toString("base64"); - // const crlPem = `-----BEGIN X509 CRL-----\n${base64crl.match(/.{1,64}/g)?.join("\n")}\n-----END X509 CRL-----`; - - // return { - // crl: crlPem - // }; - // }; - return { createCa, getCaById, @@ -944,8 +816,6 @@ export const certificateAuthorityServiceFactory = ({ getCaCert, signIntermediate, importCertToCa, - issueCertFromCa, - getCaCrl - // rotateCaCrl + issueCertFromCa }; }; diff --git a/backend/src/services/certificate-authority/certificate-authority-types.ts b/backend/src/services/certificate-authority/certificate-authority-types.ts index d6e17159e..3ba7624c0 100644 --- a/backend/src/services/certificate-authority/certificate-authority-types.ts +++ b/backend/src/services/certificate-authority/certificate-authority-types.ts @@ -3,9 +3,9 @@ import { TCertificateDALFactory } from "@app/services/certificate/certificate-da import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; +import { TCertificateAuthorityCrlDALFactory } from "../../ee/services/certificate-authority-crl/certificate-authority-crl-dal"; import { CertKeyAlgorithm } from "../certificate/certificate-types"; import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal"; -import { TCertificateAuthorityCrlDALFactory } from "./certificate-authority-crl-dal"; import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal"; import { TCertificateAuthoritySecretDALFactory } from "./certificate-authority-secret-dal"; @@ -80,14 +80,6 @@ export type TIssueCertFromCaDTO = { notAfter?: string; } & Omit; -export type TGetCrl = { - caId: string; -} & Omit; - -export type TRotateCrlDTO = { - caId: string; -} & Omit; - export type TDNParts = { commonName?: string; organization?: string; diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts index 0a7548df8..ba865caa1 100644 --- a/backend/src/services/certificate/certificate-service.ts +++ b/backend/src/services/certificate/certificate-service.ts @@ -1,12 +1,12 @@ import { ForbiddenError } from "@casl/ability"; import * as x509 from "@peculiar/x509"; +import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; -import { TCertificateAuthorityCrlDALFactory } from "@app/services/certificate-authority/certificate-authority-crl-dal"; import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; import { TCertificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; diff --git a/frontend/src/hooks/api/subscriptions/types.ts b/frontend/src/hooks/api/subscriptions/types.ts index 45414292d..66959ad1b 100644 --- a/frontend/src/hooks/api/subscriptions/types.ts +++ b/frontend/src/hooks/api/subscriptions/types.ts @@ -25,14 +25,15 @@ export type SubscriptionPlan = { ldap: boolean; groups: boolean; status: - | "incomplete" - | "incomplete_expired" - | "trialing" - | "active" - | "past_due" - | "canceled" - | "unpaid" - | null; + | "incomplete" + | "incomplete_expired" + | "trialing" + | "active" + | "past_due" + | "canceled" + | "unpaid" + | null; trial_end: number | null; has_used_trial: boolean; + caCrl: boolean; }; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx index ef18f9d57..86e617a56 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaSection.tsx @@ -3,7 +3,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { createNotification } from "@app/components/notifications"; import { ProjectPermissionCan } from "@app/components/permissions"; -import { Button, DeleteActionModal } from "@app/components/v2"; +import { Button, DeleteActionModal, UpgradePlanModal } from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; import { CaStatus, useDeleteCa, useUpdateCa } from "@app/hooks/api"; import { usePopUp } from "@app/hooks/usePopUp"; @@ -25,7 +25,8 @@ export const CaSection = () => { "installCaCert", "deleteCa", "caStatus", // enable / disable - "caCrl" // enable / disable + "caCrl", // enable / disable + "upgradePlan" ] as const); const onRemoveCaSubmit = async (caId: string) => { @@ -124,6 +125,11 @@ export const CaSection = () => { onUpdateCaStatus(popUp?.caStatus?.data as { caId: string; status: CaStatus }) } /> + handlePopUpToggle("upgradePlan", isOpen)} + text={(popUp.upgradePlan?.data as { description: string })?.description} + />
); }; diff --git a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx index 2fe5826b1..a35a4e432 100644 --- a/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx +++ b/frontend/src/views/Project/CertificatesPage/components/CaTab/components/CaTable.tsx @@ -27,7 +27,11 @@ import { Tooltip, Tr } from "@app/components/v2"; -import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; +import { + ProjectPermissionActions, + ProjectPermissionSub, + useSubscription, + useWorkspace} from "@app/context"; import { CaStatus, useListWorkspaceCas } from "@app/hooks/api"; import { caStatusToNameMap, caTypeToNameMap } from "@app/hooks/api/ca/constants"; import { UsePopUpState } from "@app/hooks/usePopUp"; @@ -35,17 +39,19 @@ import { UsePopUpState } from "@app/hooks/usePopUp"; type Props = { handlePopUpOpen: ( popUpName: keyof UsePopUpState< - ["installCaCert", "caCert", "ca", "deleteCa", "caStatus", "caCrl"] + ["installCaCert", "caCert", "ca", "deleteCa", "caStatus", "caCrl", "upgradePlan"] >, data?: { caId?: string; dn?: string; status?: CaStatus; + description?: string; } ) => void; }; export const CaTable = ({ handlePopUpOpen }: Props) => { + const { subscription } = useSubscription(); const { currentWorkspace } = useWorkspace(); const { data, isLoading } = useListWorkspaceCas({ projectSlug: currentWorkspace?.slug ?? "" @@ -144,11 +150,18 @@ export const CaTable = ({ handlePopUpOpen }: Props) => { !isAllowed && "pointer-events-none cursor-not-allowed opacity-50" )} - onClick={async () => - handlePopUpOpen("caCrl", { - caId: ca.id - }) - } + onClick={async () => { + if (!subscription?.caCrl) { + handlePopUpOpen("upgradePlan", { + description: + "You can use the certificate revocation list (CRL) feature if you upgrade your Infisical plan." + }); + } else { + handlePopUpOpen("caCrl", { + caId: ca.id + }); + } + }} disabled={!isAllowed} icon={} > From dd0399d12e7d88feb790100e1afa94ce433d5b9c Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Fri, 14 Jun 2024 00:48:59 +0200 Subject: [PATCH 166/187] Fix: Remove go toolchain and go mod tidy --- k8-operator/go.mod | 5 +---- k8-operator/go.sum | 50 ++++------------------------------------------ 2 files changed, 5 insertions(+), 50 deletions(-) diff --git a/k8-operator/go.mod b/k8-operator/go.mod index ca3c165df..f71321607 100644 --- a/k8-operator/go.mod +++ b/k8-operator/go.mod @@ -2,9 +2,8 @@ module github.com/Infisical/infisical/k8-operator go 1.21 -toolchain go1.21.4 - require ( + github.com/infisical/go-sdk v0.1.9 github.com/onsi/ginkgo/v2 v2.6.0 github.com/onsi/gomega v1.24.1 k8s.io/apimachinery v0.26.1 @@ -35,7 +34,6 @@ require ( github.com/google/s2a-go v0.1.7 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect github.com/googleapis/gax-go/v2 v2.12.4 // indirect - github.com/infisical/go-sdk v0.1.9 // indirect go.opencensus.io v0.24.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect @@ -94,7 +92,6 @@ require ( golang.org/x/text v0.15.0 // indirect golang.org/x/time v0.5.0 // indirect gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect - google.golang.org/appengine v1.6.8 // indirect google.golang.org/protobuf v1.34.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff --git a/k8-operator/go.sum b/k8-operator/go.sum index 8737b4932..bf3bb421e 100644 --- a/k8-operator/go.sum +++ b/k8-operator/go.sum @@ -13,7 +13,6 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs= cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc= cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY= -cloud.google.com/go v0.114.0 h1:OIPFAdfrFDFO2ve2U7r/H5SwSbBzEdrBdE7xkgwc+kY= cloud.google.com/go/auth v0.5.1 h1:0QNO7VThG54LUzKiQxv8C6x1YX7lUrzlAa1nVLF8CIw= cloud.google.com/go/auth v0.5.1/go.mod h1:vbZT8GjzDf3AVqCcQmqeeM32U9HBFc32vVVAbwDsa6s= cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4= @@ -24,7 +23,6 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= -cloud.google.com/go/compute v1.25.1 h1:ZRpHJedLtTpKgr3RV1Fx23NuaAEN1Zfx9hw1u4aJdjU= cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc= cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= @@ -82,7 +80,6 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE= github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= @@ -104,6 +101,7 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ= github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84= +github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww= github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= @@ -123,8 +121,6 @@ github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= -github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ= github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= @@ -139,8 +135,6 @@ github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXym github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= -github.com/go-resty/resty/v2 v2.10.0 h1:Qla4W/+TMmv0fOeeRqzEpXPLfTUnR5HZ1+lGs+CkiCo= -github.com/go-resty/resty/v2 v2.10.0/go.mod h1:iiP/OpA0CkcL3IGt1O0+/SIItFUbkkyw5BGXiVdTu+A= github.com/go-resty/resty/v2 v2.13.1 h1:x+LHXBI2nMB1vqndymf26quycC4aggYJ7DECYbiz03g= github.com/go-resty/resty/v2 v2.13.1/go.mod h1:GznXlLxkq6Nh4sU59rPmUw3VtgpO3aS96ORAI6Q7d+0= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= @@ -175,7 +169,6 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= -github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= @@ -193,8 +186,6 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= -github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -212,7 +203,6 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o= github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw= -github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y= github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= @@ -227,20 +217,6 @@ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU= github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA= -github.com/infisical/go-sdk v0.1.0 h1:tbnrqKlnzci8Fa1DLphwsuZj1DKL1LMEaxDAexkLrCE= -github.com/infisical/go-sdk v0.1.0/go.mod h1:yQ1CPw7DahTcVDcgH07IsFREnoHf1NXhTNmSae0CphE= -github.com/infisical/go-sdk v0.1.1 h1:EkT2MmbsEkbA/MDL4JbRdd8jcAuqAcP4MR0V3Z/h88w= -github.com/infisical/go-sdk v0.1.1/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= -github.com/infisical/go-sdk v0.1.2 h1:Ns4Qhvq2eTKljUYVsd3RAUpm7asmo4GeBhUew55kgCo= -github.com/infisical/go-sdk v0.1.2/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= -github.com/infisical/go-sdk v0.1.3 h1:pXj7OcEutoTrn8xPMxa7ZNQteVdjfYsMWeR7wuvcbF8= -github.com/infisical/go-sdk v0.1.3/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= -github.com/infisical/go-sdk v0.1.4 h1:0msuDTY/WB8kboaWrrGHnzyLZfXRtaayw40T1x5Aj5w= -github.com/infisical/go-sdk v0.1.4/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= -github.com/infisical/go-sdk v0.1.7 h1:Bl68n5/ySXF2w1beqzAMtlZ/ON5soHIRuWWxRP0QQs8= -github.com/infisical/go-sdk v0.1.7/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= -github.com/infisical/go-sdk v0.1.8 h1:F82p6/R1usVOnv/4PHs7iu57A2kiUwwKjdEjROZ2Uh4= -github.com/infisical/go-sdk v0.1.8/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= github.com/infisical/go-sdk v0.1.9 h1:o9LUj0Tyn6OHusTEKEKQ4+PulJViAxgOrFa+SlwGJFc= github.com/infisical/go-sdk v0.1.9/go.mod h1:vHTDVw3k+wfStXab513TGk1n53kaKF2xgLqpw/xvtl4= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= @@ -341,9 +317,10 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= +github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= @@ -370,6 +347,7 @@ go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk= +go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo= go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI= @@ -382,8 +360,6 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= -golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= @@ -456,8 +432,6 @@ golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= -golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= @@ -467,7 +441,6 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b h1:clP8eMhB30EHdc0bd2Twtq6kgU7yl5ub2cQLSdrv1Dg= golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc= golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs= golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= @@ -529,8 +502,6 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= -golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= @@ -538,8 +509,6 @@ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9sn golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= -golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= -golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= @@ -550,19 +519,14 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= -golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= -golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= -golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk= golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -640,9 +604,6 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= -google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= -google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= -google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= @@ -673,7 +634,6 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20240528184218-531527333157 h1:u7WMYrIrVvs0TF5yaKwKNbcJyySYf+HAIFXxWltJOXE= google.golang.org/genproto/googleapis/api v0.0.0-20240521202816-d264139d666e h1:SkdGTrROJl2jRGT/Fxv5QUf9jtdKCQh4KQJXbXVLAi0= google.golang.org/genproto/googleapis/api v0.0.0-20240521202816-d264139d666e/go.mod h1:LweJcLbyVij6rCex8YunD8DYR5VDonap/jYl3ZRxcIU= google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 h1:Zy9XzmMEflZ/MAaA7vNcoebnRAld7FsPW1EeBB7V0m8= @@ -705,8 +665,6 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= -google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg= google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= From ec7fe013fdfa33b9c8fd3424d30267a7b58e171c Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 13 Jun 2024 19:08:45 -0400 Subject: [PATCH 167/187] temporary: increase daily clean up interval --- backend/src/services/resource-cleanup/resource-cleanup-queue.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/services/resource-cleanup/resource-cleanup-queue.ts b/backend/src/services/resource-cleanup/resource-cleanup-queue.ts index 2e01e3549..72874b41c 100644 --- a/backend/src/services/resource-cleanup/resource-cleanup-queue.ts +++ b/backend/src/services/resource-cleanup/resource-cleanup-queue.ts @@ -60,7 +60,7 @@ export const dailyResourceCleanUpQueueServiceFactory = ({ await queueService.queue(QueueName.DailyResourceCleanUp, QueueJobs.DailyResourceCleanUp, undefined, { delay: 5000, jobId: QueueName.DailyResourceCleanUp, - repeat: { pattern: "0 0 * * *", utc: true } + repeat: { every: 60000 } }); }; From ed5044a102df9536f314d48f894afa42f22c48cb Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 13 Jun 2024 19:59:08 -0400 Subject: [PATCH 168/187] Revert "temporary: increase daily clean up interval" This reverts commit ec7fe013fdfa33b9c8fd3424d30267a7b58e171c. --- backend/src/services/resource-cleanup/resource-cleanup-queue.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/services/resource-cleanup/resource-cleanup-queue.ts b/backend/src/services/resource-cleanup/resource-cleanup-queue.ts index 72874b41c..2e01e3549 100644 --- a/backend/src/services/resource-cleanup/resource-cleanup-queue.ts +++ b/backend/src/services/resource-cleanup/resource-cleanup-queue.ts @@ -60,7 +60,7 @@ export const dailyResourceCleanUpQueueServiceFactory = ({ await queueService.queue(QueueName.DailyResourceCleanUp, QueueJobs.DailyResourceCleanUp, undefined, { delay: 5000, jobId: QueueName.DailyResourceCleanUp, - repeat: { every: 60000 } + repeat: { pattern: "0 0 * * *", utc: true } }); }; From fa77dc01df115265eefe1959ee5328c521af2dca Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 13 Jun 2024 21:01:18 -0400 Subject: [PATCH 169/187] apply nits for rate limits --- ...327_custom-rate-limits-for-self-hosting.ts | 2 +- backend/src/server/config/rateLimiter.ts | 30 +++++++++---------- .../services/rate-limit/rate-limit-service.ts | 2 +- .../admin/DashboardPage/RateLimitPanel.tsx | 18 +++++------ 4 files changed, 26 insertions(+), 26 deletions(-) diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts index 84ad9b560..c34b2d196 100644 --- a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts +++ b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts @@ -20,7 +20,7 @@ export async function up(knex: Knex): Promise { await createOnUpdateTrigger(knex, TableName.RateLimit); - // create rate limit entry + // create init rate limit entry with defaults await knex(TableName.RateLimit).insert({}); } } diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 0e406da88..819aa617f 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -4,6 +4,21 @@ import { Redis } from "ioredis"; import { getConfig } from "@app/lib/config/env"; import { getRateLimiterConfig } from "@app/services/rate-limit/rate-limit-service"; +export const globalRateLimiterCfg = (): RateLimitPluginOptions => { + const appCfg = getConfig(); + const redis = appCfg.isRedisConfigured + ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) + : null; + + return { + timeWindow: 60 * 1000, + max: 600, + redis, + allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status", + keyGenerator: (req) => req.realIp + }; +}; + // GET endpoints export const readLimit: RateLimitOptions = { timeWindow: 60 * 1000, @@ -60,18 +75,3 @@ export const publicEndpointLimit: RateLimitOptions = { max: () => getRateLimiterConfig().publicEndpointLimit, keyGenerator: (req) => req.realIp }; - -export const globalRateLimiterCfg = (): RateLimitPluginOptions => { - const appCfg = getConfig(); - const redis = appCfg.isRedisConfigured - ? new Redis(appCfg.REDIS_URL, { connectTimeout: 500, maxRetriesPerRequest: 1 }) - : null; - - return { - timeWindow: 60 * 1000, - max: 600, - redis, - allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status", - keyGenerator: (req) => req.realIp - }; -}; diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/services/rate-limit/rate-limit-service.ts index aac10db08..742628061 100644 --- a/backend/src/services/rate-limit/rate-limit-service.ts +++ b/backend/src/services/rate-limit/rate-limit-service.ts @@ -69,7 +69,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto creationLimit: rateLimit.creationLimit }; - logger.info(`Rate limit configuration: %o`, newRateLimitMaxConfiguration); + logger.info(`syncRateLimitConfiguration: rate limit configuration: %o`, newRateLimitMaxConfiguration); Object.freeze(newRateLimitMaxConfiguration); rateLimitMaxConfiguration = newRateLimitMaxConfiguration; } diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx index 85bef017f..eacb26203 100644 --- a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -87,7 +87,7 @@ export const RateLimitPanel = () => { >
- Set Rate Limits for your Infisical Instance + Configure rate limits
{ defaultValue={300} render={({ field, fieldState: { error } }) => ( { name="writeRateLimit" render={({ field, fieldState: { error } }) => ( { name="secretsRateLimit" render={({ field, fieldState: { error } }) => ( { name="authRateLimit" render={({ field, fieldState: { error } }) => ( { name="inviteUserRateLimit" render={({ field, fieldState: { error } }) => ( { name="mfaRateLimit" render={({ field, fieldState: { error } }) => ( { name="creationLimit" render={({ field, fieldState: { error } }) => ( { name="publicEndpointLimit" render={({ field, fieldState: { error } }) => ( Date: Fri, 14 Jun 2024 01:08:46 +0000 Subject: [PATCH 170/187] chore: renamed new migration files to latest timestamp (gh-action) --- ...g.ts => 20240614010847_custom-rate-limits-for-self-hosting.ts} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename backend/src/db/migrations/{20240611151327_custom-rate-limits-for-self-hosting.ts => 20240614010847_custom-rate-limits-for-self-hosting.ts} (100%) diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240614010847_custom-rate-limits-for-self-hosting.ts similarity index 100% rename from backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts rename to backend/src/db/migrations/20240614010847_custom-rate-limits-for-self-hosting.ts From 2d8a2a6a3a54b1b853b8917a11df14ad8ccf4694 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 13 Jun 2024 23:32:41 -0400 Subject: [PATCH 171/187] remove dragon --- .../src/views/ShareSecretPublicPage/ShareSecretPublicPage.tsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/frontend/src/views/ShareSecretPublicPage/ShareSecretPublicPage.tsx b/frontend/src/views/ShareSecretPublicPage/ShareSecretPublicPage.tsx index 2da836eaa..cd4d8b5c3 100644 --- a/frontend/src/views/ShareSecretPublicPage/ShareSecretPublicPage.tsx +++ b/frontend/src/views/ShareSecretPublicPage/ShareSecretPublicPage.tsx @@ -7,7 +7,7 @@ import { decryptSymmetric } from "@app/components/utilities/cryptography/crypto" import { useTimedReset } from "@app/hooks"; import { useGetActiveSharedSecretByIdAndHashedHex } from "@app/hooks/api/secretSharing"; -import { DragonMainImage, SecretTable } from "./components"; +import { SecretTable } from "./components"; export const ShareSecretPublicPage = () => { const router = useRouter(); @@ -68,7 +68,7 @@ export const ShareSecretPublicPage = () => { A secret has been shared with you securely via Infisical

- + {/* */}

Shared Secret From 3411185d60add1b5d0003769f33581126ec152b6 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 14:06:49 +0800 Subject: [PATCH 172/187] misc: migrated custom rate limits to enterprise --- backend/src/@types/fastify.d.ts | 2 +- backend/src/ee/routes/v1/index.ts | 2 ++ .../routes/v1/rate-limit-router.ts | 0 .../services/rate-limit/rate-limit-dal.ts | 0 .../services/rate-limit/rate-limit-service.ts | 0 .../services/rate-limit/rate-limit-types.ts | 0 backend/src/server/app.ts | 4 ++-- backend/src/server/config/rateLimiter.ts | 2 +- backend/src/server/routes/index.ts | 4 ++-- backend/src/server/routes/v1/index.ts | 2 -- .../admin/DashboardPage/RateLimitPanel.tsx | 20 +++++++++++++++---- 11 files changed, 24 insertions(+), 12 deletions(-) rename backend/src/{server => ee}/routes/v1/rate-limit-router.ts (100%) rename backend/src/{ => ee}/services/rate-limit/rate-limit-dal.ts (100%) rename backend/src/{ => ee}/services/rate-limit/rate-limit-service.ts (100%) rename backend/src/{ => ee}/services/rate-limit/rate-limit-types.ts (100%) diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index 81fc0c541..126cc0bad 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -14,6 +14,7 @@ import { TLdapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-con import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-service"; +import { TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service"; import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service"; import { TScimServiceFactory } from "@app/ee/services/scim/scim-service"; import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service"; @@ -48,7 +49,6 @@ import { TProjectEnvServiceFactory } from "@app/services/project-env/project-env import { TProjectKeyServiceFactory } from "@app/services/project-key/project-key-service"; import { TProjectMembershipServiceFactory } from "@app/services/project-membership/project-membership-service"; import { TProjectRoleServiceFactory } from "@app/services/project-role/project-role-service"; -import { TRateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; import { TSecretServiceFactory } from "@app/services/secret/secret-service"; import { TSecretBlindIndexServiceFactory } from "@app/services/secret-blind-index/secret-blind-index-service"; import { TSecretFolderServiceFactory } from "@app/services/secret-folder/secret-folder-service"; diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts index 16e23eb88..e7c8f2dfe 100644 --- a/backend/src/ee/routes/v1/index.ts +++ b/backend/src/ee/routes/v1/index.ts @@ -10,6 +10,7 @@ import { registerLicenseRouter } from "./license-router"; import { registerOrgRoleRouter } from "./org-role-router"; import { registerProjectRoleRouter } from "./project-role-router"; import { registerProjectRouter } from "./project-router"; +import { registerRateLimitRouter } from "./rate-limit-router"; import { registerSamlRouter } from "./saml-router"; import { registerScimRouter } from "./scim-router"; import { registerSecretApprovalPolicyRouter } from "./secret-approval-policy-router"; @@ -45,6 +46,7 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => { await server.register(registerAccessApprovalPolicyRouter, { prefix: "/access-approvals/policies" }); await server.register(registerAccessApprovalRequestRouter, { prefix: "/access-approvals/requests" }); + await server.register(registerRateLimitRouter, { prefix: "/rate-limit" }); await server.register( async (dynamicSecretRouter) => { diff --git a/backend/src/server/routes/v1/rate-limit-router.ts b/backend/src/ee/routes/v1/rate-limit-router.ts similarity index 100% rename from backend/src/server/routes/v1/rate-limit-router.ts rename to backend/src/ee/routes/v1/rate-limit-router.ts diff --git a/backend/src/services/rate-limit/rate-limit-dal.ts b/backend/src/ee/services/rate-limit/rate-limit-dal.ts similarity index 100% rename from backend/src/services/rate-limit/rate-limit-dal.ts rename to backend/src/ee/services/rate-limit/rate-limit-dal.ts diff --git a/backend/src/services/rate-limit/rate-limit-service.ts b/backend/src/ee/services/rate-limit/rate-limit-service.ts similarity index 100% rename from backend/src/services/rate-limit/rate-limit-service.ts rename to backend/src/ee/services/rate-limit/rate-limit-service.ts diff --git a/backend/src/services/rate-limit/rate-limit-types.ts b/backend/src/ee/services/rate-limit/rate-limit-types.ts similarity index 100% rename from backend/src/services/rate-limit/rate-limit-types.ts rename to backend/src/ee/services/rate-limit/rate-limit-types.ts diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index 19f5986fb..a115f6d04 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -14,11 +14,11 @@ import fasitfy from "fastify"; import { Knex } from "knex"; import { Logger } from "pino"; +import { rateLimitDALFactory } from "@app/ee/services/rate-limit/rate-limit-dal"; +import { rateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service"; import { TKeyStoreFactory } from "@app/keystore/keystore"; import { getConfig } from "@app/lib/config/env"; import { TQueueServiceFactory } from "@app/queue"; -import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal"; -import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; import { TSmtpService } from "@app/services/smtp/smtp-service"; import { globalRateLimiterCfg } from "./config/rateLimiter"; diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 819aa617f..ef0ad891f 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -1,8 +1,8 @@ import type { RateLimitOptions, RateLimitPluginOptions } from "@fastify/rate-limit"; import { Redis } from "ioredis"; +import { getRateLimiterConfig } from "@app/ee/services/rate-limit/rate-limit-service"; import { getConfig } from "@app/lib/config/env"; -import { getRateLimiterConfig } from "@app/services/rate-limit/rate-limit-service"; export const globalRateLimiterCfg = (): RateLimitPluginOptions => { const appCfg = getConfig(); diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 2f2de829f..4077021a3 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -34,6 +34,8 @@ import { permissionDALFactory } from "@app/ee/services/permission/permission-dal import { permissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { projectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal"; import { projectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-service"; +import { rateLimitDALFactory } from "@app/ee/services/rate-limit/rate-limit-dal"; +import { rateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service"; import { samlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-dal"; import { samlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service"; import { scimDALFactory } from "@app/ee/services/scim/scim-dal"; @@ -122,8 +124,6 @@ import { projectMembershipServiceFactory } from "@app/services/project-membershi import { projectUserMembershipRoleDALFactory } from "@app/services/project-membership/project-user-membership-role-dal"; import { projectRoleDALFactory } from "@app/services/project-role/project-role-dal"; import { projectRoleServiceFactory } from "@app/services/project-role/project-role-service"; -import { rateLimitDALFactory } from "@app/services/rate-limit/rate-limit-dal"; -import { rateLimitServiceFactory } from "@app/services/rate-limit/rate-limit-service"; import { dailyResourceCleanUpQueueServiceFactory } from "@app/services/resource-cleanup/resource-cleanup-queue"; import { secretDALFactory } from "@app/services/secret/secret-dal"; import { secretQueueFactory } from "@app/services/secret/secret-queue"; diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts index fd8255e63..cbf67ce79 100644 --- a/backend/src/server/routes/v1/index.ts +++ b/backend/src/server/routes/v1/index.ts @@ -17,7 +17,6 @@ import { registerProjectEnvRouter } from "./project-env-router"; import { registerProjectKeyRouter } from "./project-key-router"; import { registerProjectMembershipRouter } from "./project-membership-router"; import { registerProjectRouter } from "./project-router"; -import { registerRateLimitRouter } from "./rate-limit-router"; import { registerSecretFolderRouter } from "./secret-folder-router"; import { registerSecretImportRouter } from "./secret-import-router"; import { registerSecretSharingRouter } from "./secret-sharing-router"; @@ -44,7 +43,6 @@ export const registerV1Routes = async (server: FastifyZodProvider) => { await server.register(registerPasswordRouter, { prefix: "/password" }); await server.register(registerOrgRouter, { prefix: "/organization" }); await server.register(registerAdminRouter, { prefix: "/admin" }); - await server.register(registerRateLimitRouter, { prefix: "/rate-limit" }); await server.register(registerUserRouter, { prefix: "/user" }); await server.register(registerInviteOrgRouter, { prefix: "/invite-org" }); await server.register(registerUserActionRouter, { prefix: "/user-action" }); diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx index eacb26203..6327998de 100644 --- a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -3,7 +3,9 @@ import { zodResolver } from "@hookform/resolvers/zod"; import { z } from "zod"; import { createNotification } from "@app/components/notifications"; -import { Button, ContentLoader, FormControl, Input } from "@app/components/v2"; +import { Button, ContentLoader, FormControl, Input, UpgradePlanModal } from "@app/components/v2"; +import { useSubscription } from "@app/context"; +import { usePopUp } from "@app/hooks"; import { useGetRateLimit, useUpdateRateLimit } from "@app/hooks/api"; const formSchema = z.object({ @@ -21,7 +23,9 @@ type TRateLimitForm = z.infer; export const RateLimitPanel = () => { const { data: rateLimit, isLoading } = useGetRateLimit(); + const { subscription } = useSubscription(); const { mutateAsync: updateRateLimit } = useUpdateRateLimit(); + const { handlePopUpToggle, handlePopUpOpen, popUp } = usePopUp(["upgradePlan"] as const); const { control, @@ -44,6 +48,11 @@ export const RateLimitPanel = () => { const onRateLimitFormSubmit = async (formData: TRateLimitForm) => { try { + if (subscription && !subscription.customRateLimits) { + handlePopUpOpen("upgradePlan"); + return; + } + const { readRateLimit, writeRateLimit, @@ -86,9 +95,7 @@ export const RateLimitPanel = () => { onSubmit={handleSubmit(onRateLimitFormSubmit)} >

-
- Configure rate limits -
+
Configure rate limits
{ + handlePopUpToggle("upgradePlan", isOpen)} + text="You can configure custom rate limits if you switch to Infisical's Enterprise plan." + /> ); }; From dd6fb4232e49951a3eeae8b0c95c32fc80329427 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 14:24:33 +0800 Subject: [PATCH 173/187] misc: addressed formatting issue --- frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx index 6327998de..3979e002b 100644 --- a/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx +++ b/frontend/src/views/admin/DashboardPage/RateLimitPanel.tsx @@ -255,7 +255,7 @@ export const RateLimitPanel = () => { handlePopUpToggle("upgradePlan", isOpen)} - text="You can configure custom rate limits if you switch to Infisical's Enterprise plan." + text="You can configure custom rate limits if you switch to Infisical's Enterprise plan." /> ); From 3dd024c90a36ec2ac66a9b9f3014c4a29bc03bbe Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 18:32:50 +0800 Subject: [PATCH 174/187] misc: added license check in backend for custom rate limits --- .../src/ee/services/license/license-service.ts | 3 +++ .../ee/services/rate-limit/rate-limit-service.ts | 15 +++++++++++++-- backend/src/server/app.ts | 5 ----- backend/src/server/routes/index.ts | 8 ++++++-- 4 files changed, 22 insertions(+), 9 deletions(-) diff --git a/backend/src/ee/services/license/license-service.ts b/backend/src/ee/services/license/license-service.ts index 47b46d010..46931468f 100644 --- a/backend/src/ee/services/license/license-service.ts +++ b/backend/src/ee/services/license/license-service.ts @@ -575,6 +575,9 @@ export const licenseServiceFactory = ({ getInstanceType() { return instanceType; }, + get onPremFeatures() { + return onPremFeatures; + }, getPlan, updateSubscriptionOrgMemberCount, refreshPlan, diff --git a/backend/src/ee/services/rate-limit/rate-limit-service.ts b/backend/src/ee/services/rate-limit/rate-limit-service.ts index 742628061..f483b0610 100644 --- a/backend/src/ee/services/rate-limit/rate-limit-service.ts +++ b/backend/src/ee/services/rate-limit/rate-limit-service.ts @@ -2,6 +2,7 @@ import { CronJob } from "cron"; import { logger } from "@app/lib/logger"; +import { TLicenseServiceFactory } from "../license/license-service"; import { TRateLimitDALFactory } from "./rate-limit-dal"; import { TRateLimit, TRateLimitUpdateDTO } from "./rate-limit-types"; @@ -24,11 +25,12 @@ export const getRateLimiterConfig = () => { type TRateLimitServiceFactoryDep = { rateLimitDAL: TRateLimitDALFactory; + licenseService: Pick; }; export type TRateLimitServiceFactory = ReturnType; -export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFactoryDep) => { +export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateLimitServiceFactoryDep) => { const DEFAULT_RATE_LIMIT_CONFIG_ID = "00000000-0000-0000-0000-000000000000"; const getRateLimits = async (): Promise => { @@ -78,7 +80,16 @@ export const rateLimitServiceFactory = ({ rateLimitDAL }: TRateLimitServiceFacto } }; - const initializeBackgroundSync = () => { + const initializeBackgroundSync = async () => { + if (!licenseService.onPremFeatures.customRateLimits) { + logger.info("Current license does not support custom rate limit configuration"); + return; + } + + logger.info("Setting up backround sync process for rate limits"); + // initial sync upon startup + await syncRateLimitConfiguration(); + // sync rate limits configuration every 10 minutes const job = new CronJob("*/10 * * * *", syncRateLimitConfiguration); job.start(); diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts index a115f6d04..863162c2b 100644 --- a/backend/src/server/app.ts +++ b/backend/src/server/app.ts @@ -14,8 +14,6 @@ import fasitfy from "fastify"; import { Knex } from "knex"; import { Logger } from "pino"; -import { rateLimitDALFactory } from "@app/ee/services/rate-limit/rate-limit-dal"; -import { rateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service"; import { TKeyStoreFactory } from "@app/keystore/keystore"; import { getConfig } from "@app/lib/config/env"; import { TQueueServiceFactory } from "@app/queue"; @@ -71,9 +69,6 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => { // Rate limiters and security headers if (appCfg.isProductionMode) { - const rateLimitDAL = rateLimitDALFactory(db); - const rateLimitService = rateLimitServiceFactory({ rateLimitDAL }); - await rateLimitService.syncRateLimitConfiguration(); await server.register(ratelimiter, globalRateLimiterCfg()); } diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 4077021a3..1b6317290 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -449,7 +449,8 @@ export const registerRoutes = async ( keyStore }); const rateLimitService = rateLimitServiceFactory({ - rateLimitDAL + rateLimitDAL, + licenseService }); const apiKeyService = apiKeyServiceFactory({ apiKeyDAL, userDAL }); @@ -910,7 +911,10 @@ export const registerRoutes = async ( const cronJobs: CronJob[] = []; if (appCfg.isProductionMode) { - cronJobs.push(rateLimitService.initializeBackgroundSync()); + const rateLimitJob = await rateLimitService.initializeBackgroundSync(); + if (rateLimitJob) { + cronJobs.push(rateLimitJob); + } } server.decorate("store", { From b7326bf4c63a38f6208ecac499a9e9628f9db56b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 18:34:46 +0800 Subject: [PATCH 175/187] misc: addressed typo --- backend/src/ee/services/rate-limit/rate-limit-service.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/ee/services/rate-limit/rate-limit-service.ts b/backend/src/ee/services/rate-limit/rate-limit-service.ts index f483b0610..df90ca03f 100644 --- a/backend/src/ee/services/rate-limit/rate-limit-service.ts +++ b/backend/src/ee/services/rate-limit/rate-limit-service.ts @@ -86,7 +86,7 @@ export const rateLimitServiceFactory = ({ rateLimitDAL, licenseService }: TRateL return; } - logger.info("Setting up backround sync process for rate limits"); + logger.info("Setting up background sync process for rate limits"); // initial sync upon startup await syncRateLimitConfiguration(); From d4ef92787d4c0ba817142ec51e005fd6d05c8db5 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 14 Jun 2024 18:37:15 +0800 Subject: [PATCH 176/187] misc: renamed rate limit sync job --- backend/src/server/routes/index.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 1b6317290..395f6fbf4 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -911,9 +911,9 @@ export const registerRoutes = async ( const cronJobs: CronJob[] = []; if (appCfg.isProductionMode) { - const rateLimitJob = await rateLimitService.initializeBackgroundSync(); - if (rateLimitJob) { - cronJobs.push(rateLimitJob); + const rateLimitSyncJob = await rateLimitService.initializeBackgroundSync(); + if (rateLimitSyncJob) { + cronJobs.push(rateLimitSyncJob); } } From 345edb3f15abc6f738119a97f4dbed74081b41ba Mon Sep 17 00:00:00 2001 From: = Date: Fri, 14 Jun 2024 18:31:54 +0530 Subject: [PATCH 177/187] feat: allow secret tag api for machine identity and raw secret endpoint tag support --- .../20240614115952_tag-machine-identity.ts | 25 +++++++++++++ backend/src/db/schemas/secret-tags.ts | 3 +- backend/src/lib/api-docs/constants.ts | 6 ++-- .../src/server/routes/v1/secret-tag-router.ts | 6 ++-- backend/src/server/routes/v3/secret-router.ts | 21 ++++++++--- .../services/secret-tag/secret-tag-service.ts | 3 +- backend/src/services/secret/secret-dal.ts | 35 +++++++++++++++++++ backend/src/services/secret/secret-fns.ts | 13 ++++++- backend/src/services/secret/secret-service.ts | 14 +++++--- backend/src/services/secret/secret-types.ts | 2 ++ 10 files changed, 111 insertions(+), 17 deletions(-) create mode 100644 backend/src/db/migrations/20240614115952_tag-machine-identity.ts diff --git a/backend/src/db/migrations/20240614115952_tag-machine-identity.ts b/backend/src/db/migrations/20240614115952_tag-machine-identity.ts new file mode 100644 index 000000000..fd11928b6 --- /dev/null +++ b/backend/src/db/migrations/20240614115952_tag-machine-identity.ts @@ -0,0 +1,25 @@ +import { Knex } from "knex"; + +import { ActorType } from "@app/services/auth/auth-type"; + +import { TableName } from "../schemas"; + +export async function up(knex: Knex): Promise { + const hasCreatedByActorType = await knex.schema.hasColumn(TableName.SecretTag, "createdByActorType"); + await knex.schema.alterTable(TableName.SecretTag, (tb) => { + if (!hasCreatedByActorType) { + tb.string("createdByActorType").notNullable().defaultTo(ActorType.USER); + tb.dropForeign("createdBy"); + } + }); +} + +export async function down(knex: Knex): Promise { + const hasCreatedByActorType = await knex.schema.hasColumn(TableName.SecretTag, "createdByActorType"); + await knex.schema.alterTable(TableName.SecretTag, (tb) => { + if (hasCreatedByActorType) { + tb.dropColumn("createdByActorType"); + tb.foreign("createdBy").references("id").inTable(TableName.Users).onDelete("SET NULL"); + } + }); +} diff --git a/backend/src/db/schemas/secret-tags.ts b/backend/src/db/schemas/secret-tags.ts index f94e1e262..04bb7b752 100644 --- a/backend/src/db/schemas/secret-tags.ts +++ b/backend/src/db/schemas/secret-tags.ts @@ -15,7 +15,8 @@ export const SecretTagsSchema = z.object({ createdAt: z.date(), updatedAt: z.date(), createdBy: z.string().uuid().nullable().optional(), - projectId: z.string() + projectId: z.string(), + createdByActorType: z.string().default("user") }); export type TSecretTags = z.infer; diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts index 1637b266a..5c67c489e 100644 --- a/backend/src/lib/api-docs/constants.ts +++ b/backend/src/lib/api-docs/constants.ts @@ -343,7 +343,8 @@ export const RAW_SECRETS = { secretValue: "The value of the secret to create.", skipMultilineEncoding: "Skip multiline encoding for the secret value.", type: "The type of the secret to create.", - workspaceId: "The ID of the project to create the secret in." + workspaceId: "The ID of the project to create the secret in.", + tagIds: "The ID of the tags to be attached to the created secret." }, GET: { secretName: "The name of the secret to get.", @@ -364,7 +365,8 @@ export const RAW_SECRETS = { skipMultilineEncoding: "Skip multiline encoding for the secret value.", type: "The type of the secret to update.", projectSlug: "The slug of the project to update the secret in.", - workspaceId: "The ID of the project to update the secret in." + workspaceId: "The ID of the project to update the secret in.", + tagIds: "The ID of the tags to be attached to the updated secret." }, DELETE: { secretName: "The name of the secret to delete.", diff --git a/backend/src/server/routes/v1/secret-tag-router.ts b/backend/src/server/routes/v1/secret-tag-router.ts index 1715aa3c3..ccbb4572d 100644 --- a/backend/src/server/routes/v1/secret-tag-router.ts +++ b/backend/src/server/routes/v1/secret-tag-router.ts @@ -23,7 +23,7 @@ export const registerSecretTagRouter = async (server: FastifyZodProvider) => { }) } }, - onRequest: verifyAuth([AuthMode.JWT]), + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const workspaceTags = await server.services.secretTag.getProjectTags({ actor: req.permission.type, @@ -57,7 +57,7 @@ export const registerSecretTagRouter = async (server: FastifyZodProvider) => { }) } }, - onRequest: verifyAuth([AuthMode.JWT]), + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const workspaceTag = await server.services.secretTag.createTag({ actor: req.permission.type, @@ -88,7 +88,7 @@ export const registerSecretTagRouter = async (server: FastifyZodProvider) => { }) } }, - onRequest: verifyAuth([AuthMode.JWT]), + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const workspaceTag = await server.services.secretTag.deleteTag({ actor: req.permission.type, diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 05db617b9..d620e1fac 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -306,7 +306,16 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }), response: { 200: z.object({ - secret: secretRawSchema + secret: secretRawSchema.extend({ + tags: SecretTagsSchema.pick({ + id: true, + slug: true, + name: true, + color: true + }) + .array() + .optional() + }) }) } }, @@ -404,6 +413,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())) .describe(RAW_SECRETS.CREATE.secretValue), secretComment: z.string().trim().optional().default("").describe(RAW_SECRETS.CREATE.secretComment), + tagIds: z.string().array().optional().describe(RAW_SECRETS.CREATE.tagIds), skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.CREATE.skipMultilineEncoding), type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.CREATE.type) }), @@ -427,7 +437,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { type: req.body.type, secretValue: req.body.secretValue, skipMultilineEncoding: req.body.skipMultilineEncoding, - secretComment: req.body.secretComment + secretComment: req.body.secretComment, + tagIds: req.body.tagIds }); await server.services.auditLog.createAuditLog({ @@ -492,7 +503,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .transform(removeTrailingSlash) .describe(RAW_SECRETS.UPDATE.secretPath), skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.UPDATE.skipMultilineEncoding), - type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.UPDATE.type) + type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.UPDATE.type), + tagIds: z.string().array().optional().describe(RAW_SECRETS.UPDATE.tagIds) }), response: { 200: z.object({ @@ -513,7 +525,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretName: req.params.secretName, type: req.body.type, secretValue: req.body.secretValue, - skipMultilineEncoding: req.body.skipMultilineEncoding + skipMultilineEncoding: req.body.skipMultilineEncoding, + tagIds: req.body.tagIds }); await server.services.auditLog.createAuditLog({ diff --git a/backend/src/services/secret-tag/secret-tag-service.ts b/backend/src/services/secret-tag/secret-tag-service.ts index ed8f5fec7..916e812e6 100644 --- a/backend/src/services/secret-tag/secret-tag-service.ts +++ b/backend/src/services/secret-tag/secret-tag-service.ts @@ -42,7 +42,8 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe name, slug, color, - createdBy: actorId + createdBy: actorId, + createdByActorType: actor }); return newTag; }; diff --git a/backend/src/services/secret/secret-dal.ts b/backend/src/services/secret/secret-dal.ts index 1a2e414dd..790b403dd 100644 --- a/backend/src/services/secret/secret-dal.ts +++ b/backend/src/services/secret/secret-dal.ts @@ -311,6 +311,40 @@ export const secretDALFactory = (db: TDbClient) => { } }; + const findOneWithTags = async (filter: Partial, tx?: Knex) => { + try { + const rawDocs = await (tx || db)(TableName.Secret) + .where(filter) + .leftJoin(TableName.JnSecretTag, `${TableName.Secret}.id`, `${TableName.JnSecretTag}.${TableName.Secret}Id`) + .leftJoin(TableName.SecretTag, `${TableName.JnSecretTag}.${TableName.SecretTag}Id`, `${TableName.SecretTag}.id`) + .select(selectAllTableCols(TableName.Secret)) + .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId")) + .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor")) + .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")) + .select(db.ref("name").withSchema(TableName.SecretTag).as("tagName")); + const docs = sqlNestRelationships({ + data: rawDocs, + key: "id", + parentMapper: (el) => ({ _id: el.id, ...SecretsSchema.parse(el) }), + childrenMapper: [ + { + key: "tagId", + label: "tags" as const, + mapper: ({ tagId: id, tagColor: color, tagSlug: slug, tagName: name }) => ({ + id, + color, + slug, + name + }) + } + ] + }); + return docs?.[0]; + } catch (error) { + throw new DatabaseError({ error, name: "FindOneWIthTags" }); + } + }; + return { ...secretOrm, update, @@ -318,6 +352,7 @@ export const secretDALFactory = (db: TDbClient) => { deleteMany, bulkUpdateNoVersionIncrement, getSecretTags, + findOneWithTags, findByFolderId, findByFolderIds, findByBlindIndexes, diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index 6758f4815..aa112e6b0 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -356,7 +356,17 @@ export const interpolateSecrets = ({ projectId, secretEncKey, secretDAL, folderD }; export const decryptSecretRaw = ( - secret: TSecrets & { workspace: string; environment: string; secretPath: string }, + secret: TSecrets & { + workspace: string; + environment: string; + secretPath: string; + tags?: { + id: string; + slug: string; + color?: string | null; + name: string; + }[]; + }, key: string ) => { const secretKey = decryptSymmetric128BitHexKeyUTF8({ @@ -396,6 +406,7 @@ export const decryptSecretRaw = ( _id: secret.id, id: secret.id, user: secret.userId, + tags: secret.tags, skipMultilineEncoding: secret.skipMultilineEncoding }; }; diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index d6682a253..a5a469a8f 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -608,7 +608,7 @@ export const secretServiceFactory = ({ } const secret = await (version === undefined - ? secretDAL.findOne({ + ? secretDAL.findOneWithTags({ folderId, type: secretType, userId: secretType === SecretType.Personal ? actorId : null, @@ -1120,7 +1120,8 @@ export const secretServiceFactory = ({ secretPath, secretValue, secretComment, - skipMultilineEncoding + skipMultilineEncoding, + tagIds }: TCreateSecretRawDTO) => { const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1148,7 +1149,8 @@ export const secretServiceFactory = ({ secretCommentCiphertext: secretCommentEncrypted.ciphertext, secretCommentIV: secretCommentEncrypted.iv, secretCommentTag: secretCommentEncrypted.tag, - skipMultilineEncoding + skipMultilineEncoding, + tags: tagIds }); return decryptSecretRaw(secret, botKey); @@ -1165,7 +1167,8 @@ export const secretServiceFactory = ({ type, secretPath, secretValue, - skipMultilineEncoding + skipMultilineEncoding, + tagIds }: TUpdateSecretRawDTO) => { const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1185,7 +1188,8 @@ export const secretServiceFactory = ({ secretValueCiphertext: secretValueEncrypted.ciphertext, secretValueIV: secretValueEncrypted.iv, secretValueTag: secretValueEncrypted.tag, - skipMultilineEncoding + skipMultilineEncoding, + tags: tagIds }); await snapshotService.performSnapshot(secret.folderId); diff --git a/backend/src/services/secret/secret-types.ts b/backend/src/services/secret/secret-types.ts index 18a0077fe..1aac324c5 100644 --- a/backend/src/services/secret/secret-types.ts +++ b/backend/src/services/secret/secret-types.ts @@ -164,6 +164,7 @@ export type TCreateSecretRawDTO = TProjectPermission & { secretName: string; secretValue: string; type: SecretType; + tagIds?: string[]; secretComment?: string; skipMultilineEncoding?: boolean; }; @@ -174,6 +175,7 @@ export type TUpdateSecretRawDTO = TProjectPermission & { secretName: string; secretValue?: string; type: SecretType; + tagIds?: string[]; skipMultilineEncoding?: boolean; secretReminderRepeatDays?: number | null; secretReminderNote?: string | null; From d6060781e42d471401eeac5a7aba979883193bdd Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 09:10:29 -0400 Subject: [PATCH 178/187] Revert "GH Action: rename new migration file timestamp" --- ...g.ts => 20240611151327_custom-rate-limits-for-self-hosting.ts} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename backend/src/db/migrations/{20240614010847_custom-rate-limits-for-self-hosting.ts => 20240611151327_custom-rate-limits-for-self-hosting.ts} (100%) diff --git a/backend/src/db/migrations/20240614010847_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts similarity index 100% rename from backend/src/db/migrations/20240614010847_custom-rate-limits-for-self-hosting.ts rename to backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts From 61d60498a9226f94e68afb644d1fe626086d6075 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 09:13:29 -0400 Subject: [PATCH 179/187] Revert "Revert "GH Action: rename new migration file timestamp"" --- ...g.ts => 20240614010847_custom-rate-limits-for-self-hosting.ts} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename backend/src/db/migrations/{20240611151327_custom-rate-limits-for-self-hosting.ts => 20240614010847_custom-rate-limits-for-self-hosting.ts} (100%) diff --git a/backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts b/backend/src/db/migrations/20240614010847_custom-rate-limits-for-self-hosting.ts similarity index 100% rename from backend/src/db/migrations/20240611151327_custom-rate-limits-for-self-hosting.ts rename to backend/src/db/migrations/20240614010847_custom-rate-limits-for-self-hosting.ts From c493f1d0f636152aa6c1948e8978113a22ba5cc6 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 10:01:15 -0400 Subject: [PATCH 180/187] Improve k8s docs I think it would be clearer if the Kubernetes documentation included all the steps. The existing link to the guide is mostly applicable if using REST endpoints, not the operator. I have copied the documentation from the Kubernetes authentication docs page and made some modifications. --- docs/integrations/platforms/kubernetes.mdx | 120 +++++++++++++++++++-- 1 file changed, 113 insertions(+), 7 deletions(-) diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx index e9cb548e9..dbdd81227 100644 --- a/docs/integrations/platforms/kubernetes.mdx +++ b/docs/integrations/platforms/kubernetes.mdx @@ -253,16 +253,122 @@ spec: The Kubernetes machine identity authentication method is used to authenticate with Infisical. The identity ID is stored in a field in the InfisicalSecret resource. This authentication method can only be used within a Kubernetes environment. - - You need to create a machine identity, and give it access to the project(s) you want to interact with. You can [read more about Kubernetes machine identities here](/documentation/platform/identities/kubernetes-auth). + + 1.1. Start by creating a service account in your Kubernetes cluster that will be used by Infisical to authenticate with the Kubernetes API Server. + + ```yaml infisical-service-account.yaml + apiVersion: v1 + kind: ServiceAccount + metadata: + name: infisical-auth + namespace: default + + ``` + + ``` + kubectl apply -f infisical-service-account.yaml + ``` + + 1.2. Bind the service account to the `system:auth-delegator` cluster role. As described [here](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#other-component-roles), this role allows delegated authentication and authorization checks, specifically for Infisical to access the [TokenReview API](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-review-v1/). You can apply the following configuration file: + + ```yaml cluster-role-binding.yaml + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: role-tokenreview-binding + namespace: default + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator + subjects: + - kind: ServiceAccount + name: infisical-auth + namespace: default + ``` + + ``` + kubectl apply -f cluster-role-binding.yaml + ``` + + 1.3. Next, create a long-lived service account JWT token (i.e. the token reviewer JWT token) for the service account using this configuration file for a new `Secret` resource: + + ```yaml service-account-token.yaml + apiVersion: v1 + kind: Secret + type: kubernetes.io/service-account-token + metadata: + name: infisical-auth-token + annotations: + kubernetes.io/service-account.name: "infisical-auth" + ``` + + + ``` + kubectl apply -f service-account-token.yaml + ``` + + 1.4. Link the secret in step 1.3 to the service account in step 1.1: + + ```bash + kubectl patch serviceaccount infisical-auth -p '{"secrets": [{"name": "infisical-auth-token"}]}' -n default + ``` + + 1.5. Finally, retrieve the token reviewer JWT token from the secret. + + ```bash + kubectl get secret infisical-auth-token -n default -o=jsonpath='{.data.token}' | base64 --decode + ``` + + Keep this JWT token handy as you will need it for the **Token Reviewer JWT** field when configuring the Kubernetes Auth authentication method for the identity in step 2. + - - Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. In the `authentication.kubernetesAuth.identityId` field, add the identity ID of the machine identity you created. See the example below for more details. + + + To create an identity, head to your Organization Settings > Access Control > Machine Identities and press **Create identity**. + + ![identities organization](/images/platform/identities/identities-org.png) + + When creating an identity, you specify an organization level [role](/documentation/platform/role-based-access-controls) for it to assume; you can configure roles in Organization Settings > Access Control > Organization Roles. + + ![identities organization create](/images/platform/identities/identities-org-create.png) + + Now input a few details for your new identity. Here's some guidance for each field: + + - Name (required): A friendly name for the identity. + - Role (required): A role from the **Organization Roles** tab for the identity to assume. The organization role assigned will determine what organization level resources this identity can have access to. + + Once you've created an identity, you'll be prompted to configure the authentication method for it. Here, select **Kubernetes Auth**. + + + To learn more about each field of the Kubernetes native authentication method, see step 2 of [guide](/documentation/platform/identities/kubernetes-auth#guide). + + + ![identities organization create auth method](/images/platform/identities/identities-org-create-kubernetes-auth-method.png) + + + + + To allow the operator to use the given identity to access secrets, you will need to add the identity to project(s) that you would like to grant it access to. + + To do this, head over to the project you want to add the identity to and go to Project Settings > Access Control > Machine Identities and press **Add identity**. + + Next, select the identity you want to add to the project and the project level role you want to allow it to assume. The project role assigned will determine what project level resources this identity can have access to. + + ![identities project](/images/platform/identities/identities-project.png) + + ![identities project create](/images/platform/identities/identities-project-create.png) + + + + Once you have created your machine identity and added it to your project(s), you will need to add the identity ID to your InfisicalSecret resource. + In the `authentication.kubernetesAuth.identityId` field, add the identity ID of the machine identity you created. + See the example below for more details. - When you configured your Kubernetes machine identity, you would have created a service account token if you followed the [Kubernetes machine identity guide](/documentation/platform/identities/kubernetes-auth). If you did not create a service account token, please follow the guide to do so. - - You will need to enter the name of the service account and the namespace where the service account lives. The example below shows how to add the service account token to the InfisicalSecret resource. + Add the service account details from the previous steps under `authentication.kubernetesAuth.serviceAccountRef`. + Here you will need to enter the name and namespace of the service account. + The example below shows a complete InfisicalSecret resource with all required fields defined. From 2780414fcbdbf26bc47b0f937ada173fd13b64da Mon Sep 17 00:00:00 2001 From: = Date: Fri, 14 Jun 2024 20:10:00 +0530 Subject: [PATCH 181/187] fix: resolved root key not found for kms service error --- .github/workflows/check-api-for-breaking-changes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-api-for-breaking-changes.yml b/.github/workflows/check-api-for-breaking-changes.yml index 914f23fc2..b6d698af4 100644 --- a/.github/workflows/check-api-for-breaking-changes.yml +++ b/.github/workflows/check-api-for-breaking-changes.yml @@ -35,7 +35,7 @@ jobs: echo "SECRET_SCANNING_GIT_APP_ID=793712" >> .env echo "SECRET_SCANNING_PRIVATE_KEY=some-random" >> .env echo "SECRET_SCANNING_WEBHOOK_SECRET=some-random" >> .env - docker run --name infisical-api -d -p 4000:4000 -e DB_CONNECTION_URI=$DB_CONNECTION_URI -e REDIS_URL=$REDIS_URL -e JWT_AUTH_SECRET=$JWT_AUTH_SECRET --env-file .env --entrypoint '/bin/sh' infisical-api -c "npm run migration:latest && ls && node dist/main.mjs" + docker run --name infisical-api -d -p 4000:4000 -e DB_CONNECTION_URI=$DB_CONNECTION_URI -e REDIS_URL=$REDIS_URL -e JWT_AUTH_SECRET=$JWT_AUTH_SECRET -e ENCRYPTION_KEY=$ENCRYPTION_KEY --env-file .env --entrypoint '/bin/sh' infisical-api -c "npm run migration:latest && ls && node dist/main.mjs" env: REDIS_URL: redis://172.17.0.1:6379 DB_CONNECTION_URI: postgres://infisical:infisical@172.17.0.1:5432/infisical?sslmode=disable From 400b4121961993104ca39f6117d9969b4d3d4627 Mon Sep 17 00:00:00 2001 From: Benjamin Daschel Date: Fri, 14 Jun 2024 07:52:23 -0700 Subject: [PATCH 182/187] correct spelling in local-development.mdx --- docs/documentation/guides/local-development.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/documentation/guides/local-development.mdx b/docs/documentation/guides/local-development.mdx index c2651cb58..9ffc0fca0 100644 --- a/docs/documentation/guides/local-development.mdx +++ b/docs/documentation/guides/local-development.mdx @@ -13,11 +13,11 @@ There is a number of issues that arise with secret management in local developme ## Solution -One of the main benefits of Infisical is the facilitation of secret management workflows in local development use cases. In particular, Infisical heavily follows the "Security Shift Left" principle to enable developers to effotlessly follow secure practices when coding. +One of the main benefits of Infisical is the facilitation of secret management workflows in local development use cases. In particular, Infisical heavily follows the "Security Shift Left" principle to enable developers to effortlessly follow secure practices when coding. ### CLI -[Infisical CLI](/cli/overview) is the most frequently used Infisical tool for secret management in local development environments. It makes it easy to inject secrets right into the local application environments based on the permissions given to corresponsing developers. +[Infisical CLI](/cli/overview) is the most frequently used Infisical tool for secret management in local development environments. It makes it easy to inject secrets right into the local application environments based on the permissions given to corresponding developers. ### Dashboard @@ -31,4 +31,4 @@ By default, all the secrets in the Infisical environments are shared among proje ### Secret Scanning -In addition, Infisical also provides a set of tools to automatically prevent secret leaks to git history. This functionlality can be set up on the level of [Infisical CLI using pre-commit hooks](/cli/scanning-overview#automatically-scan-changes-before-you-commit) or through a direct integration with platforms like GitHub. \ No newline at end of file +In addition, Infisical also provides a set of tools to automatically prevent secret leaks to git history. This functionality can be set up on the level of [Infisical CLI using pre-commit hooks](/cli/scanning-overview#automatically-scan-changes-before-you-commit) or through a direct integration with platforms like GitHub. \ No newline at end of file From 56506b5a47f10bcfc43b526fc24569c31981060b Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 10:57:08 -0400 Subject: [PATCH 183/187] Add missing RBAC to k8s Missing RBAC for service accounts --- helm-charts/secrets-operator/templates/manager-rbac.yaml | 8 ++++++++ k8-operator/config/rbac/role.yaml | 8 ++++++++ k8-operator/config/samples/k8s-auth/sample.yaml | 2 +- k8-operator/controllers/infisicalsecret_controller.go | 2 +- 4 files changed, 18 insertions(+), 2 deletions(-) diff --git a/helm-charts/secrets-operator/templates/manager-rbac.yaml b/helm-charts/secrets-operator/templates/manager-rbac.yaml index 758bc7dfe..ca6fd36e1 100644 --- a/helm-charts/secrets-operator/templates/manager-rbac.yaml +++ b/helm-charts/secrets-operator/templates/manager-rbac.yaml @@ -27,6 +27,14 @@ rules: - list - update - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - watch - apiGroups: - apps resources: diff --git a/k8-operator/config/rbac/role.yaml b/k8-operator/config/rbac/role.yaml index 68ea375b7..10c2af414 100644 --- a/k8-operator/config/rbac/role.yaml +++ b/k8-operator/config/rbac/role.yaml @@ -27,6 +27,14 @@ rules: - list - update - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - watch - apiGroups: - apps resources: diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml index 6dcbae13a..44f2d86ee 100644 --- a/k8-operator/config/samples/k8s-auth/sample.yaml +++ b/k8-operator/config/samples/k8s-auth/sample.yaml @@ -12,7 +12,7 @@ spec: authentication: # Native Kubernetes Auth kubernetesAuth: - identityId: <> + identityId: 8c0c9823-7249-4043-b292-a861fb9b1b50 serviceAccountRef: name: infisical-auth namespace: default diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 73da45034..2078341d8 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -28,6 +28,7 @@ type InfisicalSecretReconciler struct { //+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;delete //+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;delete //+kubebuilder:rbac:groups=apps,resources=deployments,verbs=list;watch;get;update +//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch // Reconcile is part of the main kubernetes reconciliation loop which aims to // move the current state of the cluster closer to the desired state. @@ -75,7 +76,6 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR) if err != nil { if errors.IsNotFound(err) { - fmt.Printf("\nInfisical Secret CRD not found [err=%v]", err) return ctrl.Result{ Requeue: false, }, nil From 96fffd3c0356604a9a113a5f419d1c1c617d9ad3 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 10:58:58 -0400 Subject: [PATCH 184/187] remove hard code identiy id --- k8-operator/config/samples/k8s-auth/sample.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml index 44f2d86ee..6dcbae13a 100644 --- a/k8-operator/config/samples/k8s-auth/sample.yaml +++ b/k8-operator/config/samples/k8s-auth/sample.yaml @@ -12,7 +12,7 @@ spec: authentication: # Native Kubernetes Auth kubernetesAuth: - identityId: 8c0c9823-7249-4043-b292-a861fb9b1b50 + identityId: <> serviceAccountRef: name: infisical-auth namespace: default From bde40e53e35a4ec79ef8776466a5bed788cfe0c3 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 11:01:28 -0400 Subject: [PATCH 185/187] Update Chart.yaml --- helm-charts/secrets-operator/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index 1588f9c12..28bc3403f 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -13,7 +13,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: v0.6.0 +version: v0.6.1 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. From 44928a2e3c5336cf4513d3ec6c18dbb6a0ea565f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Fri, 14 Jun 2024 11:22:54 -0400 Subject: [PATCH 186/187] Update kubernetes.mdx --- docs/integrations/platforms/kubernetes.mdx | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx index dbdd81227..9f3a63f8c 100644 --- a/docs/integrations/platforms/kubernetes.mdx +++ b/docs/integrations/platforms/kubernetes.mdx @@ -24,14 +24,13 @@ The operator can be install via [Helm](https://helm.sh) or [kubectl](https://git **Install the Helm chart** - For production deployments, it is highly recommended to set the chart version and the application version during installs and upgrades. - This will prevent the operator from being accidentally updated to the latest version and introduce unintended breaking changes. - - View application versions [here](https://hub.docker.com/r/infisical/kubernetes-operator/tags) and chart versions [here](https://cloudsmith.io/~infisical/repos/helm-charts/packages/detail/helm/secrets-operator/#versions) + To select a specific version, view the application versions [here](https://hub.docker.com/r/infisical/kubernetes-operator/tags) and chart versions [here](https://cloudsmith.io/~infisical/repos/helm-charts/packages/detail/helm/secrets-operator/#versions) ```bash - helm install --generate-name infisical-helm-charts/secrets-operator --version= --set controllerManager.manager.image.tag= + helm install --generate-name infisical-helm-charts/secrets-operator + ``` + ```bash # Example installing app version v0.2.0 and chart version 0.1.4 helm install --generate-name infisical-helm-charts/secrets-operator --version=0.1.4 --set controllerManager.manager.image.tag=v0.2.0 ``` From 0ee792e84b18aa04f21ba06f6ebacdaee408310a Mon Sep 17 00:00:00 2001 From: github-actions Date: Fri, 14 Jun 2024 15:42:12 +0000 Subject: [PATCH 187/187] chore: renamed new migration files to latest timestamp (gh-action) --- ...737_certificate-mgmt.ts => 20240614154212_certificate-mgmt.ts} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename backend/src/db/migrations/{20240612201737_certificate-mgmt.ts => 20240614154212_certificate-mgmt.ts} (100%) diff --git a/backend/src/db/migrations/20240612201737_certificate-mgmt.ts b/backend/src/db/migrations/20240614154212_certificate-mgmt.ts similarity index 100% rename from backend/src/db/migrations/20240612201737_certificate-mgmt.ts rename to backend/src/db/migrations/20240614154212_certificate-mgmt.ts