From 4d22030bb89b92b024d48b4dacf10fb5e63ae639 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 4 Sep 2025 03:37:31 +0800 Subject: [PATCH] doc: added platform dcs --- docs/cli/commands/network.mdx | 2 +- docs/docs.json | 10 +- .../gateways-deprecated/gateway-security.mdx | 91 +++++ .../images/gateway-highlevel-diagram.png | Bin .../gateways-deprecated/networking.mdx | 168 +++++++++ .../platform/gateways-deprecated/overview.mdx | 352 ++++++++++++++++++ .../platform/gateways/gateway-security.mdx | 142 ++++--- .../platform/gateways/networking.mdx | 183 ++++----- .../platform/gateways/overview.mdx | 138 +++++-- .../gateways/gateway-highlevel-diagram.png | Bin 0 -> 113242 bytes 10 files changed, 916 insertions(+), 170 deletions(-) create mode 100644 docs/documentation/platform/gateways-deprecated/gateway-security.mdx rename docs/documentation/platform/{gateways => gateways-deprecated}/images/gateway-highlevel-diagram.png (100%) create mode 100644 docs/documentation/platform/gateways-deprecated/networking.mdx create mode 100644 docs/documentation/platform/gateways-deprecated/overview.mdx create mode 100644 docs/images/platform/gateways/gateway-highlevel-diagram.png diff --git a/docs/cli/commands/network.mdx b/docs/cli/commands/network.mdx index 4e4cdbfe3..0ed19a224 100644 --- a/docs/cli/commands/network.mdx +++ b/docs/cli/commands/network.mdx @@ -18,7 +18,7 @@ description: "Network-related commands for Infisical including gateway and proxy ## Description -Network-related commands for Infisical that provide secure access to private resources through a three-tier proxy system: +Network-related commands for Infisical that provide secure access to private resources: - **Gateway**: Lightweight agent deployed within your VPCs to provide access to private resources - **Proxy**: Identity-aware relay infrastructure that routes encrypted traffic (can be instance-wide or organization-specific) diff --git a/docs/docs.json b/docs/docs.json index 2f1bb225d..dc73fdb48 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -174,7 +174,15 @@ "pages": [ "documentation/platform/gateways/overview", "documentation/platform/gateways/gateway-security", - "documentation/platform/gateways/networking" + "documentation/platform/gateways/networking", + { + "group": "Gateway (Deprecated)", + "pages": [ + "documentation/platform/gateways-deprecated/overview", + "documentation/platform/gateways-deprecated/gateway-security", + "documentation/platform/gateways-deprecated/networking" + ] + } ] } ] diff --git a/docs/documentation/platform/gateways-deprecated/gateway-security.mdx b/docs/documentation/platform/gateways-deprecated/gateway-security.mdx new file mode 100644 index 000000000..93a7f662f --- /dev/null +++ b/docs/documentation/platform/gateways-deprecated/gateway-security.mdx @@ -0,0 +1,91 @@ +--- +title: "Gateway Security Architecture" +sidebarTitle: "Architecture" +description: "Understand the security model and tenant isolation of Infisical's Gateway" +--- + +# Gateway Security Architecture + +The Infisical Gateway enables Infisical Cloud to securely interact with private resources using mutual TLS authentication and private PKI (Public Key Infrastructure) system to ensure secure, isolated communication between multiple tenants. +This document explains the internal security architecture and how tenant isolation is maintained. + +## Security Model Overview + +### Private PKI System +Each organization (tenant) in Infisical has its own private PKI system consisting of: + +1. **Root CA**: The ultimate trust anchor for the organization +2. **Intermediate CAs**: + - Client CA: Issues certificates for cloud components + - Gateway CA: Issues certificates for gateway instances + +This hierarchical structure ensures complete isolation between organizations as each has its own independent certificate chain. + +### Certificate Hierarchy +``` +Root CA (Organization Specific) +├── Client CA +│ └── Client Certificates (Cloud Components) +└── Gateway CA + └── Gateway Certificates (Gateway Instances) +``` + +## Communication Security + +### 1. Gateway Registration +When a gateway is first deployed: + +1. Establishes initial connection using machine identity token +2. Allocates a relay address for communication +3. Exchanges certificates through a secure handshake: + - Gateway receives a unique certificate signed by organization's Gateway CA along with certificate chain for verification + +### 2. Mutual TLS Authentication +All communication between gateway and cloud uses mutual TLS (mTLS): + +- **Gateway Authentication**: + - Presents certificate signed by organization's Gateway CA + - Certificate contains unique identifiers (Organization ID, Gateway ID) + - Cloud validates complete certificate chain + +- **Cloud Authentication**: + - Presents certificate signed by organization's Client CA + - Certificate includes required organizational unit ("gateway-client") + - Gateway validates certificate chain back to organization's root CA + +### 3. Relay Communication +The relay system provides secure tunneling: + +1. **Connection Establishment**: + - Uses QUIC protocol over UDP for efficient, secure communication + - Provides built-in encryption, congestion control, and multiplexing + - Enables faster connection establishment and reduced latency + - Each organization's traffic is isolated using separate relay sessions + +2. **Traffic Isolation**: + - Each gateway gets unique relay credentials + - Traffic is end-to-end encrypted using QUIC's TLS 1.3 + - Organization's private keys never leave their environment + +## Tenant Isolation + +### Certificate-Based Isolation +- Each organization has unique root CA and intermediate CAs +- Certificates contain organization-specific identifiers +- Cross-tenant communication is cryptographically impossible + +### Gateway-Project Mapping +- Gateways are explicitly mapped to specific projects +- Access controls enforce organization boundaries +- Project-level permissions determine resource accessibility + +### Resource Access Control +1. **Project Verification**: + - Gateway verifies project membership + - Validates organization ownership + - Enforces project-level permissions + +2. **Resource Restrictions**: + - Gateways only accept connections to approved resources + - Each connection requires explicit project authorization + - Resources remain private to their assigned organization diff --git a/docs/documentation/platform/gateways/images/gateway-highlevel-diagram.png b/docs/documentation/platform/gateways-deprecated/images/gateway-highlevel-diagram.png similarity index 100% rename from docs/documentation/platform/gateways/images/gateway-highlevel-diagram.png rename to docs/documentation/platform/gateways-deprecated/images/gateway-highlevel-diagram.png diff --git a/docs/documentation/platform/gateways-deprecated/networking.mdx b/docs/documentation/platform/gateways-deprecated/networking.mdx new file mode 100644 index 000000000..6acdc1993 --- /dev/null +++ b/docs/documentation/platform/gateways-deprecated/networking.mdx @@ -0,0 +1,168 @@ +--- +title: "Networking" +description: "Network configuration and firewall requirements for Infisical Gateway" +--- + +The Infisical Gateway requires outbound network connectivity to establish secure communication with Infisical's relay infrastructure. +This page outlines the required ports, protocols, and firewall configurations needed for optimal gateway usage. + +## Network Architecture + +The gateway uses a relay-based architecture to establish secure connections: + +1. **Gateway** connects outbound to **Relay Servers** using UDP/QUIC protocol +2. **Relay Servers** facilitate secure communication between Gateway and Infisical Cloud +3. All traffic is end-to-end encrypted using mutual TLS over QUIC + +## Required Network Connectivity + +### Outbound Connections (Required) + +The gateway requires the following outbound connectivity: + +| Protocol | Destination | Ports | Purpose | +|----------|-------------|-------|---------| +| UDP | Relay Servers | 49152-65535 | Allocated relay communication (TLS) | +| TCP | app.infisical.com / eu.infisical.com | 443 | API communication and relay allocation | + +### Relay Server IP Addresses + +Your firewall must allow outbound connectivity to the following Infisical relay servers on dynamically allocated ports. + + + + ``` + 54.235.197.91:49152-65535 + 18.215.196.229:49152-65535 + 3.222.120.233:49152-65535 + 34.196.115.157:49152-65535 + ``` + + + ``` + 3.125.237.40:49152-65535 + 52.28.157.98:49152-65535 + 3.125.176.90:49152-65535 + ``` + + + Please contact your Infisical account manager for dedicated relay server IP addresses. + + + + + These IP addresses are static and managed by Infisical. Any changes will be communicated with 60-day advance notice. + + +## Protocol Details + +### QUIC over UDP + +The gateway uses QUIC (Quick UDP Internet Connections) for primary communication: + +- **Port 5349**: STUN/TURN over TLS (secure relay communication) +- **Built-in features**: Connection migration, multiplexing, reduced latency +- **Encryption**: TLS 1.3 with certificate pinning + +## Understanding Firewall Behavior with UDP + +Unlike TCP connections, UDP is a stateless protocol, and depending on your organization's firewall configuration, you may need to adjust network rules accordingly. +When the gateway sends UDP packets to a relay server, the return responses need to be allowed back through the firewall. +Modern firewalls handle this through "connection tracking" (also called "stateful inspection"), but the behavior can vary depending on your firewall configuration. + + +### Connection Tracking + +Modern firewalls automatically track UDP connections and allow return responses. This is the preferred configuration as it: +- Automatically handles return responses +- Reduces firewall rule complexity +- Avoids the need for manual IP whitelisting + +In the event that your firewall does not support connection tracking, you will need to whitelist the relay IPs to explicitly define return traffic manually. + +## Common Network Scenarios + +### Corporate Firewalls + +For corporate environments with strict egress filtering: + +1. **Whitelist relay IP addresses** (listed above) +2. **Allow UDP port 5349** outbound +3. **Configure connection tracking** for UDP return traffic +4. **Allow ephemeral port range** 49152-65535 for return traffic if connection tracking is disabled + +### Cloud Environments (AWS/GCP/Azure) + +Configure security groups to allow: +- **Outbound UDP** to relay IPs on port 5349 +- **Outbound HTTPS** to app.infisical.com/eu.infisical.com on port 443 +- **Inbound UDP** on ephemeral ports (if not using stateful rules) + +## Frequently Asked Questions + + +The gateway is designed to handle network interruptions gracefully: + +- **Automatic reconnection**: The gateway will automatically attempt to reconnect to relay servers every 5 seconds if the connection is lost +- **Connection retry logic**: Built-in retry mechanisms handle temporary network outages without manual intervention +- **Multiple relay servers**: If one relay server is unavailable, the gateway can connect to alternative relay servers +- **Persistent sessions**: Existing connections are maintained where possible during brief network interruptions +- **Graceful degradation**: The gateway logs connection issues and continues attempting to restore connectivity + +No manual intervention is typically required during network interruptions. + + + +QUIC (Quick UDP Internet Connections) provides several advantages over traditional TCP for gateway communication: + +- **Faster connection establishment**: QUIC combines transport and security handshakes, reducing connection setup time +- **Built-in encryption**: TLS 1.3 is integrated into the protocol, ensuring all traffic is encrypted by default +- **Connection migration**: QUIC connections can survive IP address changes (useful for NAT rebinding) +- **Reduced head-of-line blocking**: Multiple data streams can be multiplexed without blocking each other +- **Better performance over unreliable networks**: Advanced congestion control and packet loss recovery +- **Lower latency**: Optimized for real-time communication between gateway and cloud services + +While TCP is stateful and easier for firewalls to track, QUIC's performance benefits outweigh the additional firewall configuration requirements. + + + +No inbound ports need to be opened. The gateway only makes outbound connections: + +- **Outbound UDP** to relay servers on ports 49152-65535 +- **Outbound HTTPS** to Infisical API endpoints +- **Return responses** are handled by connection tracking or explicit IP whitelisting + +This design maintains security by avoiding the need for inbound firewall rules that could expose your network to external threats. + + + +If your firewall has strict UDP restrictions: + +1. **Work with your network team** to allow outbound UDP to the specific relay IP addresses +2. **Use explicit IP whitelisting** if connection tracking is disabled +3. **Consider network policy exceptions** for the gateway host +4. **Monitor firewall logs** to identify which specific rules are blocking traffic + +The gateway requires UDP connectivity to function - TCP-only configurations are not supported. + + + +The gateway connects to **one relay server at a time**: + +- **Single active connection**: Only one relay connection is established per gateway instance +- **Automatic failover**: If the current relay becomes unavailable, the gateway will connect to an alternative relay +- **Load distribution**: Different gateway instances may connect to different relay servers for load balancing +- **No manual selection**: The Infisical API automatically assigns the optimal relay server based on availability and proximity + +You should whitelist all relay IP addresses to ensure proper failover functionality. + + +No, relay servers cannot decrypt any traffic passing through them: + +- **End-to-end encryption**: All traffic between the gateway and Infisical Cloud is encrypted using mutual TLS with certificate pinning +- **Relay acts as a tunnel**: The relay server only forwards encrypted packets - it has no access to encryption keys +- **No data storage**: Relay servers do not store any traffic or network-identifiable information +- **Certificate isolation**: Each organization has its own private PKI system, ensuring complete tenant isolation + +The relay infrastructure is designed as a secure forwarding mechanism, similar to a VPN tunnel, where the relay provider cannot see the contents of the traffic flowing through it. + \ No newline at end of file diff --git a/docs/documentation/platform/gateways-deprecated/overview.mdx b/docs/documentation/platform/gateways-deprecated/overview.mdx new file mode 100644 index 000000000..f81809f7b --- /dev/null +++ b/docs/documentation/platform/gateways-deprecated/overview.mdx @@ -0,0 +1,352 @@ +--- +title: "Gateway" +sidebarTitle: "Overview" +description: "How to access private network resources from Infisical" +--- + +![Alt text](/documentation/platform/gateways-deprecated/images/gateway-highlevel-diagram.png) + +The Infisical Gateway provides secure access to private resources within your network without needing direct inbound connections to your environment. +This method keeps your resources fully protected from external access while enabling Infisical to securely interact with resources like databases. +Common use cases include generating dynamic credentials or rotating credentials for private databases. + + + Gateway is a paid feature available under the Enterprise Tier for Infisical + Cloud users. Self-hosted Infisical users can contact + [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise + license. + + +## How It Works + +The Gateway serves as a secure intermediary that facilitates direct communication between the Infisical server and your private network. +It’s a lightweight daemon packaged within the Infisical CLI, making it easy to deploy and manage. Once set up, the Gateway establishes a connection with a relay server, ensuring that all communication between Infisical and your Gateway is fully end-to-end encrypted. +This setup guarantees that only the platform and your Gateway can decrypt the transmitted information, keeping communication with your resources secure, private and isolated. + +## Deployment + +The Infisical Gateway is seamlessly integrated into the Infisical CLI under the `gateway` command, making it simple to deploy and manage. +You can install the Gateway in all the same ways you install the Infisical CLI—whether via npm, Docker, or a binary. +For detailed installation instructions, refer to the Infisical [CLI Installation instructions](/cli/overview). + +To function, the Gateway must authenticate with Infisical. This requires a machine identity configured with the appropriate permissions to create and manage a Gateway. +Once authenticated, the Gateway establishes a secure connection with Infisical to allow your private resources to be reachable. + +### Get started + + + + 1. Navigate to **Organization Access Control** in your Infisical dashboard. + 2. Create a dedicated machine identity for your Gateway. + 3. **Best Practice:** Assign a unique identity to each Gateway for better security and management. + ![Create Gateway Identity](../../../images/platform/gateways/create-identity-for-gateway.png) + + + + You'll need to choose an authentication method to initiate communication with Infisical. View the available machine identity authentication methods [here](/documentation/platform/identities/machine-identities). + + + + Use the Infisical CLI to deploy the Gateway. You can run it directly or install it as a systemd service for production: + + + + For production deployments on Linux, install the Gateway as a systemd service: + ```bash + sudo infisical gateway install --token --domain + sudo systemctl start infisical-gateway + ``` + This will install and start the Gateway as a secure systemd service that: + - Runs with restricted privileges: + - Runs as root user (required for secure token management) + - Restricted access to home directories + - Private temporary directory + - Automatically restarts on failure + - Starts on system boot + - Manages token and domain configuration securely in `/etc/infisical/gateway.conf` + + + The install command requires: + - Linux operating system + - Root/sudo privileges + - Systemd + + + + + + The Gateway can be installed via [Helm](https://helm.sh/). Helm is a package manager for Kubernetes that allows you to define, install, and upgrade Kubernetes applications. + + For production deployments on Kubernetes, install the Gateway using the Infisical Helm chart: + + ### Install the latest Helm Chart repository + ```bash + helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' + ``` + + ### Update the Helm Chart repository + ```bash + helm repo update + ``` + + ### Create a Kubernetes Secret containing gateway environment variables + + The gateway supports all identity authentication methods through the use of environment variables. + The environment variables must be set in the `infisical-gateway-environment` Kubernetes secret. + + + #### Supported authentication methods + + + + The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical. + + + + + Your machine identity client ID. + + + Your machine identity client secret. + + + The authentication method to use. Must be `universal-auth` when using Universal Auth. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=universal-auth --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID= --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET= + ``` + + + + The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical. + + + + + Your machine identity ID. + + + Path to the Kubernetes service account token to use. Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`. + + + The authentication method to use. Must be `kubernetes` when using Native Kubernetes. + + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=kubernetes --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + + The Native Azure method is used to authenticate with Infisical when running in an Azure environment. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `azure` when using Native Azure. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=azure --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `gcp-id-token` when using Native GCP ID Token. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=gcp-id-token --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + + The GCP IAM method is used to authenticate with Infisical with a GCP service account key. + + + + + Your machine identity ID. + + + Path to your GCP service account key file _(Must be in JSON format!)_ + + + The authentication method to use. Must be `gcp-iam` when using GCP IAM. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=gcp-iam --from-literal=INFISICAL_MACHINE_IDENTITY_ID= --from-literal=INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH= + ``` + + + + + The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc. + + + + + Your machine identity ID. + + + The authentication method to use. Must be `aws-iam` when using Native AWS IAM. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=aws-iam --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + + The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC. + + + + + Your machine identity ID. + + + The OIDC JWT from the identity provider. + + + The authentication method to use. Must be `oidc-auth` when using OIDC Auth. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=oidc-auth --from-literal=INFISICAL_MACHINE_IDENTITY_ID= --from-literal=INFISICAL_JWT= + ``` + + + + The JWT Auth method is used to authenticate with Infisical via a JWT token. + + + + + The JWT token to use for authentication. + + + Your machine identity ID. + + + The authentication method to use. Must be `jwt-auth` when using JWT Auth. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=jwt-auth --from-literal=INFISICAL_JWT= --from-literal=INFISICAL_MACHINE_IDENTITY_ID= + ``` + + + You can use the `INFISICAL_TOKEN` environment variable to authenticate with Infisical with a raw machine identity access token. + + + + + The machine identity access token to use for authentication. + + + + + ```bash + kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_TOKEN= + ``` + + + + + #### Other environment variables + + + + The API URL to use for the gateway. By default, `INFISICAL_API_URL` is set to `https://app.infisical.com`. + + + + + ### Install the Infisical Gateway Helm Chart + ```bash + helm install infisical-gateway infisical-helm-charts/infisical-gateway + ``` + + ### Check the gateway logs + After installing the gateway, you can check the logs to ensure it's running as expected. + + ```bash + kubectl logs deployment/infisical-gateway + ``` + + You should see the following output which indicates the gateway is running as expected. + ```bash + $ kubectl logs deployment/infisical-gateway + INF Provided relay port 5349. Using TLS + INF Connected with relay + INF 10.0.101.112:56735 + INF Starting relay connection health check + INF Gateway started successfully + INF New connection from: 10.0.1.8:34051 + INF Gateway is reachable by Infisical + ``` + + + + + For development or testing, you can run the Gateway directly. Log in with your machine identity and start the Gateway in one command: + ```bash + infisical gateway --token $(infisical login --method=universal-auth --client-id=<> --client-secret=<> --plain) + ``` + + Alternatively, if you already have the token, use it directly with the `--token` flag: + ```bash + infisical gateway --token + ``` + + Or set it as an environment variable: + ```bash + export INFISICAL_TOKEN= + infisical gateway + ``` + + + + For detailed information about the gateway command and its options, see the [gateway command documentation](/cli/commands/gateway). + + + Ensure the deployed Gateway has network access to the private resources you intend to connect with Infisical. + + + + + + To confirm your Gateway is working, check the deployment status by looking for the message **"Gateway started successfully"** in the Gateway logs. This indicates the Gateway is running properly. Next, verify its registration by opening your Infisical dashboard, navigating to **Organization Access Control**, and selecting the **Gateways** tab. Your newly deployed Gateway should appear in the list. + ![Gateway List](../../../images/platform/gateways/gateway-list.png) + + diff --git a/docs/documentation/platform/gateways/gateway-security.mdx b/docs/documentation/platform/gateways/gateway-security.mdx index 93a7f662f..668d69c3a 100644 --- a/docs/documentation/platform/gateways/gateway-security.mdx +++ b/docs/documentation/platform/gateways/gateway-security.mdx @@ -6,86 +6,124 @@ description: "Understand the security model and tenant isolation of Infisical's # Gateway Security Architecture -The Infisical Gateway enables Infisical Cloud to securely interact with private resources using mutual TLS authentication and private PKI (Public Key Infrastructure) system to ensure secure, isolated communication between multiple tenants. +The Infisical Gateway enables secure access to private resources using SSH reverse tunnels, certificate-based authentication, and a comprehensive PKI (Public Key Infrastructure) system. The architecture provides end-to-end encryption and complete tenant isolation through multiple certificate authorities. This document explains the internal security architecture and how tenant isolation is maintained. ## Security Model Overview -### Private PKI System -Each organization (tenant) in Infisical has its own private PKI system consisting of: +### Certificate Architecture -1. **Root CA**: The ultimate trust anchor for the organization -2. **Intermediate CAs**: - - Client CA: Issues certificates for cloud components - - Gateway CA: Issues certificates for gateway instances +The gateway system uses multiple certificate authorities depending on deployment configuration: -This hierarchical structure ensures complete isolation between organizations as each has its own independent certificate chain. +**For Organizations Using Infisical-Managed Proxies:** + +- **Instance proxy SSH Client CA & Server CA** - Gateway ↔ Infisical Proxy Server authentication +- **Instance proxy PKI Client CA & Server CA** - Platform ↔ Infisical Proxy Server authentication +- **Organization Gateway Client CA & Server CA** - Platform ↔ Gateway authentication + +**For Organizations Using Customer-Deployed Proxies:** + +- **Organization proxy SSH Client CA & Server CA** - Gateway ↔ Customer Proxy Server authentication +- **Organization proxy PKI Client CA & Server CA** - Platform ↔ Customer Proxy Server authentication +- **Organization Gateway Client CA & Server CA** - Platform ↔ Gateway authentication ### Certificate Hierarchy + ``` -Root CA (Organization Specific) -├── Client CA -│ └── Client Certificates (Cloud Components) -└── Gateway CA - └── Gateway Certificates (Gateway Instances) +Instance Level (Shared Proxies): +├── Instance Proxy SSH CA (Gateway ↔ Proxy) +├── Instance Proxy PKI CA (Platform ↔ Proxy) + +Organization Level: +├── Organization Proxy SSH CA (Gateway ↔ Org Proxy) +├── Organization Proxy PKI CA (Platform ↔ Org Proxy) +└── Organization Gateway CA (Platform ↔ Gateway) ``` ## Communication Security ### 1. Gateway Registration + When a gateway is first deployed: -1. Establishes initial connection using machine identity token -2. Allocates a relay address for communication -3. Exchanges certificates through a secure handshake: - - Gateway receives a unique certificate signed by organization's Gateway CA along with certificate chain for verification +1. Authenticates with Infisical using machine identity token +2. Receives SSH certificates for proxy server authentication +3. Establishes SSH reverse tunnel to assigned proxy server +4. Certificate issuance varies by proxy configuration: + - **Infisical-managed proxy**: Receives Instance proxy SSH client certificate + Instance proxy SSH Server CA + - **Customer-deployed proxy**: Receives Organization proxy SSH client certificate + Organization proxy SSH Server CA -### 2. Mutual TLS Authentication -All communication between gateway and cloud uses mutual TLS (mTLS): +### 2. SSH Tunnel Authentication + +Gateway ↔ Proxy Server communication uses SSH certificate authentication: - **Gateway Authentication**: - - Presents certificate signed by organization's Gateway CA - - Certificate contains unique identifiers (Organization ID, Gateway ID) - - Cloud validates complete certificate chain -- **Cloud Authentication**: - - Presents certificate signed by organization's Client CA - - Certificate includes required organizational unit ("gateway-client") - - Gateway validates certificate chain back to organization's root CA + - Presents SSH client certificate (Instance or Organization proxy SSH Client CA) + - Certificate contains gateway identification and permissions + - Proxy server validates certificate against appropriate SSH Client CA -### 3. Relay Communication -The relay system provides secure tunneling: +- **Proxy Server Authentication**: + - Presents SSH server certificate (Instance or Organization proxy SSH Server CA) + - Gateway validates certificate against appropriate SSH Server CA + - Ensures gateway connects to legitimate proxy infrastructure -1. **Connection Establishment**: - - Uses QUIC protocol over UDP for efficient, secure communication - - Provides built-in encryption, congestion control, and multiplexing - - Enables faster connection establishment and reduced latency - - Each organization's traffic is isolated using separate relay sessions +### 3. Application Traffic Security -2. **Traffic Isolation**: - - Each gateway gets unique relay credentials - - Traffic is end-to-end encrypted using QUIC's TLS 1.3 +End-to-end encryption for application data: + +1. **mTLS Layer**: + + - Infisical platform establishes mTLS connections directly with gateways + - Uses Organization Gateway certificates for authentication + - Application traffic is encrypted end-to-end between platform and gateway + +2. **SSH Tunnel Layer**: + + - mTLS-encrypted application traffic travels through SSH reverse tunnels + - Creates double encryption: mTLS payload within SSH tunnel + - Proxy servers cannot decrypt either encryption layer + +3. **Traffic Isolation**: + - Each gateway maintains separate SSH tunnels - Organization's private keys never leave their environment + - Complete cryptographic isolation between organizations ## Tenant Isolation -### Certificate-Based Isolation -- Each organization has unique root CA and intermediate CAs -- Certificates contain organization-specific identifiers -- Cross-tenant communication is cryptographically impossible +### Multi-Layer Certificate Isolation -### Gateway-Project Mapping -- Gateways are explicitly mapped to specific projects -- Access controls enforce organization boundaries -- Project-level permissions determine resource accessibility +The architecture provides tenant isolation through multiple certificate authority layers: + +- **Instance-level CAs**: Shared proxy infrastructure uses instance-level certificates +- **Organization-level CAs**: Each organization has unique certificate authorities +- **Proxy deployment flexibility**: Organizations can choose shared or dedicated proxy infrastructure +- **Cryptographic separation**: Cross-tenant communication is cryptographically impossible + +### Authentication Flows by Deployment Type + +**Infisical-Managed Proxy Deployments:** + +- Gateway authenticates with proxy using Instance proxy SSH certificates +- Platform authenticates with proxy using Instance proxy PKI certificates +- Platform authenticates with gateway using Organization Gateway certificates + +**Customer-Deployed Proxy Deployments:** + +- Gateway authenticates with proxy using Organization proxy SSH certificates +- Platform authenticates with proxy using Organization proxy PKI certificates +- Platform authenticates with gateway using Organization Gateway certificates ### Resource Access Control -1. **Project Verification**: - - Gateway verifies project membership - - Validates organization ownership - - Enforces project-level permissions -2. **Resource Restrictions**: - - Gateways only accept connections to approved resources - - Each connection requires explicit project authorization - - Resources remain private to their assigned organization +1. **Certificate Validation**: + + - All connections require valid certificates from appropriate CAs + - Embedded certificate details control access permissions + - Ephemeral certificate validation ensures time-bound access + +2. **Network Isolation**: + + - Each organization's traffic flows through isolated certificate-authenticated channels + - Proxy servers route traffic based on certificate validation without content access + - Gateway validates all incoming connections against Organization Gateway Client CA diff --git a/docs/documentation/platform/gateways/networking.mdx b/docs/documentation/platform/gateways/networking.mdx index 6acdc1993..c7ab95fd9 100644 --- a/docs/documentation/platform/gateways/networking.mdx +++ b/docs/documentation/platform/gateways/networking.mdx @@ -3,16 +3,17 @@ title: "Networking" description: "Network configuration and firewall requirements for Infisical Gateway" --- -The Infisical Gateway requires outbound network connectivity to establish secure communication with Infisical's relay infrastructure. +The Infisical Gateway requires outbound network connectivity to establish secure SSH reverse tunnels with proxy servers. This page outlines the required ports, protocols, and firewall configurations needed for optimal gateway usage. ## Network Architecture -The gateway uses a relay-based architecture to establish secure connections: +The gateway uses SSH reverse tunnels to establish secure connections with end-to-end encryption: -1. **Gateway** connects outbound to **Relay Servers** using UDP/QUIC protocol -2. **Relay Servers** facilitate secure communication between Gateway and Infisical Cloud -3. All traffic is end-to-end encrypted using mutual TLS over QUIC +1. **Gateway** connects outbound to **Proxy Servers** using SSH over TCP +2. **Infisical platform** establishes mTLS connections with gateways for application traffic +3. **Proxy Servers** route the doubly-encrypted traffic (mTLS payload within SSH tunnels) between the platform and gateways +4. **Double encryption** ensures proxy servers cannot access application data - only the platform and gateway can decrypt traffic ## Required Network Connectivity @@ -20,65 +21,69 @@ The gateway uses a relay-based architecture to establish secure connections: The gateway requires the following outbound connectivity: -| Protocol | Destination | Ports | Purpose | -|----------|-------------|-------|---------| -| UDP | Relay Servers | 49152-65535 | Allocated relay communication (TLS) | -| TCP | app.infisical.com / eu.infisical.com | 443 | API communication and relay allocation | +| Protocol | Destination | Ports | Purpose | +| -------- | ------------------------------------ | ----- | ------------------------------------------ | +| TCP | Proxy Servers | 2222 | SSH reverse tunnel establishment | +| TCP | app.infisical.com / eu.infisical.com | 443 | API communication and certificate requests | -### Relay Server IP Addresses +### Proxy Server Connectivity -Your firewall must allow outbound connectivity to the following Infisical relay servers on dynamically allocated ports. +**For Instance Proxies (Infisical Cloud):** Your firewall must allow outbound connectivity to Infisical-managed proxy servers. + +**For Organization Proxies:** Your firewall must allow outbound connectivity to your own proxy server IP addresses. + +**For Self-hosted Instance Proxies:** Your firewall must allow outbound connectivity to proxy servers configured by your instance administrator. - - ``` - 54.235.197.91:49152-65535 - 18.215.196.229:49152-65535 - 3.222.120.233:49152-65535 - 34.196.115.157:49152-65535 - ``` + + Infisical provides multiple managed proxy servers with static IP addresses. + You can whitelist these IPs ahead of time based on which proxy server you + choose to connect to. **Firewall requirements:** Allow outbound TCP + connections to the desired proxy server IP on port 2222. - - ``` - 3.125.237.40:49152-65535 - 52.28.157.98:49152-65535 - 3.125.176.90:49152-65535 - ``` + + You control the proxy server IP addresses when deploying your own + organization proxies. **Firewall requirements:** Allow outbound TCP + connections to your proxy server IP on port 2222. For example, if your proxy + is at `203.0.113.100`, allow TCP to `203.0.113.100:2222`. - - Please contact your Infisical account manager for dedicated relay server IP addresses. + + Contact your instance administrator for the proxy server IP addresses + configured for your deployment. **Firewall requirements:** Allow outbound + TCP connections to instance proxy servers on port 2222. - - These IP addresses are static and managed by Infisical. Any changes will be communicated with 60-day advance notice. - - ## Protocol Details -### QUIC over UDP +### SSH over TCP -The gateway uses QUIC (Quick UDP Internet Connections) for primary communication: +The gateway uses SSH reverse tunnels for primary communication: -- **Port 5349**: STUN/TURN over TLS (secure relay communication) -- **Built-in features**: Connection migration, multiplexing, reduced latency -- **Encryption**: TLS 1.3 with certificate pinning +- **Port 2222**: SSH connection to proxy servers +- **Built-in features**: Automatic reconnection, certificate-based authentication, encrypted tunneling +- **Encryption**: SSH with certificate-based authentication and key exchange -## Understanding Firewall Behavior with UDP +## Firewall Configuration for SSH -Unlike TCP connections, UDP is a stateless protocol, and depending on your organization's firewall configuration, you may need to adjust network rules accordingly. -When the gateway sends UDP packets to a relay server, the return responses need to be allowed back through the firewall. -Modern firewalls handle this through "connection tracking" (also called "stateful inspection"), but the behavior can vary depending on your firewall configuration. +The gateway uses standard SSH over TCP, making firewall configuration straightforward. +### TCP Connection Handling -### Connection Tracking +SSH connections over TCP are stateful and handled seamlessly by all modern firewalls: -Modern firewalls automatically track UDP connections and allow return responses. This is the preferred configuration as it: -- Automatically handles return responses -- Reduces firewall rule complexity -- Avoids the need for manual IP whitelisting +- **Established connections** are automatically tracked +- **Return traffic** is allowed for established outbound connections +- **No special configuration** needed for connection tracking +- **Standard SSH protocol** that enterprise firewalls handle well -In the event that your firewall does not support connection tracking, you will need to whitelist the relay IPs to explicitly define return traffic manually. +### Simplified Firewall Rules + +Since SSH uses TCP, you only need simple outbound rules: + +1. **Allow outbound TCP** to proxy servers on port 2222 +2. **Allow outbound HTTPS** to Infisical API endpoints on port 443 +3. **No inbound rules required** - all connections are outbound only ## Common Network Scenarios @@ -86,83 +91,87 @@ In the event that your firewall does not support connection tracking, you will n For corporate environments with strict egress filtering: -1. **Whitelist relay IP addresses** (listed above) -2. **Allow UDP port 5349** outbound -3. **Configure connection tracking** for UDP return traffic -4. **Allow ephemeral port range** 49152-65535 for return traffic if connection tracking is disabled +1. **Allow outbound TCP** to proxy servers on port 2222 +2. **Allow outbound HTTPS** to the Infisical API server on port 443 +3. **No inbound rules required** - all connections are outbound only +4. **Standard TCP rules** - simple and straightforward configuration ### Cloud Environments (AWS/GCP/Azure) Configure security groups to allow: -- **Outbound UDP** to relay IPs on port 5349 + +- **Outbound TCP** to proxy servers on port 2222 - **Outbound HTTPS** to app.infisical.com/eu.infisical.com on port 443 -- **Inbound UDP** on ephemeral ports (if not using stateful rules) +- **No inbound rules required** - SSH reverse tunnels are outbound only ## Frequently Asked Questions The gateway is designed to handle network interruptions gracefully: -- **Automatic reconnection**: The gateway will automatically attempt to reconnect to relay servers every 5 seconds if the connection is lost +- **Automatic reconnection**: The gateway will automatically attempt to reconnect to proxy servers if the SSH connection is lost - **Connection retry logic**: Built-in retry mechanisms handle temporary network outages without manual intervention -- **Multiple relay servers**: If one relay server is unavailable, the gateway can connect to alternative relay servers -- **Persistent sessions**: Existing connections are maintained where possible during brief network interruptions +- **Persistent SSH tunnels**: SSH connections are automatically re-established when connectivity is restored +- **Certificate rotation**: The gateway handles certificate renewal automatically during reconnection - **Graceful degradation**: The gateway logs connection issues and continues attempting to restore connectivity No manual intervention is typically required during network interruptions. + - -QUIC (Quick UDP Internet Connections) provides several advantages over traditional TCP for gateway communication: + +SSH over TCP provides several advantages for enterprise gateway communication: -- **Faster connection establishment**: QUIC combines transport and security handshakes, reducing connection setup time -- **Built-in encryption**: TLS 1.3 is integrated into the protocol, ensuring all traffic is encrypted by default -- **Connection migration**: QUIC connections can survive IP address changes (useful for NAT rebinding) -- **Reduced head-of-line blocking**: Multiple data streams can be multiplexed without blocking each other -- **Better performance over unreliable networks**: Advanced congestion control and packet loss recovery -- **Lower latency**: Optimized for real-time communication between gateway and cloud services +- **Firewall-friendly**: TCP is stateful and handled seamlessly by all enterprise firewalls +- **Standard protocol**: SSH is a well-established protocol that network teams are familiar with +- **Certificate-based security**: Uses SSH certificates for strong authentication without shared secrets +- **Automatic tunneling**: SSH reverse tunnels handle all the complexity of secure communication +- **Enterprise compatibility**: Works reliably across all enterprise network configurations + +TCP's reliability and firewall compatibility make it ideal for enterprise environments where network policies are strictly managed. -While TCP is stateful and easier for firewalls to track, QUIC's performance benefits outweigh the additional firewall configuration requirements. No inbound ports need to be opened. The gateway only makes outbound connections: -- **Outbound UDP** to relay servers on ports 49152-65535 -- **Outbound HTTPS** to Infisical API endpoints -- **Return responses** are handled by connection tracking or explicit IP whitelisting +- **Outbound SSH** to proxy servers on port 2222 +- **Outbound HTTPS** to Infisical API endpoints on port 443 +- **SSH reverse tunnels** handle all communication - no return traffic configuration needed This design maintains security by avoiding the need for inbound firewall rules that could expose your network to external threats. + - -If your firewall has strict UDP restrictions: + +If your firewall has strict outbound restrictions: -1. **Work with your network team** to allow outbound UDP to the specific relay IP addresses -2. **Use explicit IP whitelisting** if connection tracking is disabled -3. **Consider network policy exceptions** for the gateway host +1. **Work with your network team** to allow outbound TCP connections on port 2222 to proxy servers +2. **Allow standard SSH traffic** - most enterprises already have SSH policies in place +3. **Consider network policy exceptions** for the gateway host if needed 4. **Monitor firewall logs** to identify which specific rules are blocking traffic -The gateway requires UDP connectivity to function - TCP-only configurations are not supported. - -The gateway connects to **one relay server at a time**: + +The gateway connects to **one proxy server**: -- **Single active connection**: Only one relay connection is established per gateway instance -- **Automatic failover**: If the current relay becomes unavailable, the gateway will connect to an alternative relay -- **Load distribution**: Different gateway instances may connect to different relay servers for load balancing -- **No manual selection**: The Infisical API automatically assigns the optimal relay server based on availability and proximity +- **Single SSH connection**: Each gateway establishes one SSH reverse tunnel to its assigned proxy server +- **Named proxy assignment**: Gateways connect to the specific proxy server specified by `--proxy-name` +- **Automatic reconnection**: If the proxy connection is lost, the gateway automatically reconnects to the same proxy +- **Certificate-based authentication**: Each connection uses SSH certificates issued by Infisical for secure authentication -You should whitelist all relay IP addresses to ensure proper failover functionality. - -No, relay servers cannot decrypt any traffic passing through them: + +No, proxy servers cannot decrypt any traffic passing through them due to end-to-end encryption: -- **End-to-end encryption**: All traffic between the gateway and Infisical Cloud is encrypted using mutual TLS with certificate pinning -- **Relay acts as a tunnel**: The relay server only forwards encrypted packets - it has no access to encryption keys -- **No data storage**: Relay servers do not store any traffic or network-identifiable information -- **Certificate isolation**: Each organization has its own private PKI system, ensuring complete tenant isolation +- **Client-to-Gateway mTLS**: Clients establish mTLS connections directly with gateways, encrypting all application traffic +- **SSH tunnel encryption**: The mTLS-encrypted traffic is then transmitted through SSH reverse tunnels to proxy servers +- **Double encryption**: Traffic is encrypted twice - once by client mTLS and again by SSH tunnels +- **Proxy acts as a relay**: The proxy server only routes the doubly-encrypted traffic without access to either encryption layer +- **No data storage**: Proxy servers do not store any traffic or sensitive information +- **Certificate isolation**: Each connection uses unique certificates, ensuring complete tenant isolation -The relay infrastructure is designed as a secure forwarding mechanism, similar to a VPN tunnel, where the relay provider cannot see the contents of the traffic flowing through it. - \ No newline at end of file +The proxy infrastructure is designed as a secure routing mechanism where only the client and gateway can decrypt the actual application traffic. + + diff --git a/docs/documentation/platform/gateways/overview.mdx b/docs/documentation/platform/gateways/overview.mdx index 127e544b7..58701c41b 100644 --- a/docs/documentation/platform/gateways/overview.mdx +++ b/docs/documentation/platform/gateways/overview.mdx @@ -4,33 +4,53 @@ sidebarTitle: "Overview" description: "How to access private network resources from Infisical" --- -![Alt text](/documentation/platform/gateways/images/gateway-highlevel-diagram.png) +![Architecture Overview](../../../images/platform/gateways/gateway-highlevel-diagram.png) + +The Infisical Gateway provides secure access to private resources within your network without needing direct inbound connections to your environment. This method keeps your resources fully protected from external access while enabling Infisical to securely interact with resources like databases. + +**Architecture Components:** + +- **Gateway**: Lightweight agent deployed within your VPCs that provides access to private resources +- **Proxy**: Identity-aware relay infrastructure that routes encrypted traffic (instance-wide or organization-specific) -The Infisical Gateway provides secure access to private resources within your network without needing direct inbound connections to your environment. -This method keeps your resources fully protected from external access while enabling Infisical to securely interact with resources like databases. Common use cases include generating dynamic credentials or rotating credentials for private databases. - **Note:** Gateway is a paid feature. - **Infisical Cloud users:** Gateway is - available under the **Enterprise Tier**. - **Self-Hosted Infisical:** Please - contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an - enterprise license. + Gateway is a paid feature available under the Enterprise Tier for Infisical + Cloud users. Self-hosted Infisical users can contact + [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise + license. ## How It Works -The Gateway serves as a secure intermediary that facilitates direct communication between the Infisical server and your private network. -It’s a lightweight daemon packaged within the Infisical CLI, making it easy to deploy and manage. Once set up, the Gateway establishes a connection with a relay server, ensuring that all communication between Infisical and your Gateway is fully end-to-end encrypted. -This setup guarantees that only the platform and your Gateway can decrypt the transmitted information, keeping communication with your resources secure, private and isolated. +The Gateway system uses SSH reverse tunnels for secure, firewall-friendly connectivity: + +1. **Gateway Registration**: The gateway establishes an outbound SSH reverse tunnel to a proxy server using SSH certificates issued by Infisical +2. **Proxy Routing**: The proxy server acts as an identity-aware relay that routes encrypted traffic between the Infisical platform and gateways +3. **Resource Access**: The Infisical platform connects to your private resources through the established gateway connections + +**Key Benefits:** + +- **No inbound firewall rules needed** - all connections are outbound from your network +- **Firewall-friendly** - uses standard SSH over TCP +- **Certificate-based authentication** provides enhanced security +- **Automatic reconnection** if connections are lost ## Deployment -The Infisical Gateway is seamlessly integrated into the Infisical CLI under the `gateway` command, making it simple to deploy and manage. +The Infisical Gateway is integrated into the Infisical CLI under the `network gateway` command, making it simple to deploy and manage. You can install the Gateway in all the same ways you install the Infisical CLI—whether via npm, Docker, or a binary. For detailed installation instructions, refer to the Infisical [CLI Installation instructions](/cli/overview). -To function, the Gateway must authenticate with Infisical. This requires a machine identity configured with the appropriate permissions to create and manage a Gateway. -Once authenticated, the Gateway establishes a secure connection with Infisical to allow your private resources to be reachable. +**Prerequisites:** + +1. **Proxy Server**: Before deploying gateways, you need a running proxy server: + - **Infisical Cloud**: Instance proxies are already available - no setup needed + - **Self-hosted**: Instance admin must set up shared instance proxies, or organizations can deploy their own +2. **Machine Identity**: Configure a machine identity with appropriate permissions to create and manage gateways + +Once authenticated, the Gateway establishes an SSH reverse tunnel to the specified proxy server, allowing secure access to your private resources. ### Get started @@ -46,6 +66,36 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t You'll need to choose an authentication method to initiate communication with Infisical. View the available machine identity authentication methods [here](/documentation/platform/identities/machine-identities). + + You have two options for proxy infrastructure: + + + + **Infisical Cloud:** Instance proxies are already running and available - **no setup required**. You can immediately proceed to deploy gateways using these shared proxies. + + **Self-hosted:** If your instance admin has set up shared instance proxies, you can use them directly. If not, the instance admin can set them up: + ```bash + # Instance admin sets up shared proxy (one-time setup) + export INFISICAL_PROXY_AUTH_SECRET= + infisical network proxy --type=instance --ip= --name= + ``` + + + **Available for all users:** Deploy your own dedicated proxy infrastructure for enhanced control: + ```bash + # Deploy organization-specific proxy + infisical network proxy --type=org --ip= --name= --auth-method=universal-auth --client-id= --client-secret= + ``` + + **When to choose this:** + - You need lower latency (deploy closer to your resources) + - Enhanced security requirements + - Compliance needs (data sovereignty, air-gapped environments) + - Custom network policies + + + + Use the Infisical CLI to deploy the Gateway. You can run it directly or install it as a systemd service for production: @@ -53,7 +103,7 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t For production deployments on Linux, install the Gateway as a systemd service: ```bash - sudo infisical gateway install --token --domain + sudo infisical network gateway install --token --domain --name --proxy-name sudo systemctl start infisical-gateway ``` This will install and start the Gateway as a secure systemd service that: @@ -81,7 +131,7 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t ### Install the latest Helm Chart repository ```bash - helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' + helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/' ``` ### Update the Helm Chart repository @@ -116,7 +166,12 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t ```bash - kubectl create secret generic infisical-gateway-environment --from-literal=INFISICAL_AUTH_METHOD=universal-auth --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID= --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET= + kubectl create secret generic infisical-gateway-environment \ + --from-literal=INFISICAL_AUTH_METHOD=universal-auth \ + --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID= \ + --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET= \ + --from-literal=INFISICAL_PROXY_NAME= \ + --from-literal=INFISICAL_GATEWAY_NAME= ``` @@ -283,6 +338,29 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t + #### Required environment variables + + In addition to the authentication method above, you **must** include these required variables: + + + + The name of the proxy server that this gateway should connect to. + + + The name of this gateway instance. + + + + **Complete example with required variables:** + ```bash + kubectl create secret generic infisical-gateway-environment \ + --from-literal=INFISICAL_AUTH_METHOD=universal-auth \ + --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID= \ + --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET= \ + --from-literal=INFISICAL_PROXY_NAME= \ + --from-literal=INFISICAL_GATEWAY_NAME= + ``` + #### Other environment variables @@ -306,14 +384,12 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t You should see the following output which indicates the gateway is running as expected. ```bash - $ kubectl logs deployment/infisical-gateway - INF Provided relay port 5349. Using TLS - INF Connected with relay - INF 10.0.101.112:56735 - INF Starting relay connection health check - INF Gateway started successfully - INF New connection from: 10.0.1.8:34051 - INF Gateway is reachable by Infisical + $ kubectl logs deployment/infisical-gateway + INF Starting gateway + INF Starting gateway certificate renewal goroutine + INF Successfully registered gateway and received certificates + INF Connecting to proxy server infisical-start on 152.42.218.156:2222... + INF Proxy connection established for gateway ``` @@ -321,27 +397,31 @@ Once authenticated, the Gateway establishes a secure connection with Infisical t For development or testing, you can run the Gateway directly. Log in with your machine identity and start the Gateway in one command: ```bash - infisical gateway --token $(infisical login --method=universal-auth --client-id=<> --client-secret=<> --plain) + infisical network gateway --token $(infisical login --method=universal-auth --client-id=<> --client-secret=<> --plain) --proxy-name= --name= ``` Alternatively, if you already have the token, use it directly with the `--token` flag: ```bash - infisical gateway --token + infisical network gateway --token --proxy-name= --name= ``` Or set it as an environment variable: ```bash export INFISICAL_TOKEN= - infisical gateway + infisical network gateway --proxy-name= --name= ``` - For detailed information about the gateway command and its options, see the [gateway command documentation](/cli/commands/gateway). + For detailed information about the network commands and their options, see the [network command documentation](/cli/commands/network). - Ensure the deployed Gateway has network access to the private resources you intend to connect with Infisical. + **Requirements:** + - Ensure the deployed Gateway has network access to the private resources you intend to connect with Infisical + - The gateway must be able to reach the proxy server (outbound connection only) + - Replace `` with the name of your proxy server and `` with a unique name for this gateway + diff --git a/docs/images/platform/gateways/gateway-highlevel-diagram.png b/docs/images/platform/gateways/gateway-highlevel-diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..0555cfadd422942006109b41c81872abab9bb0d3 GIT binary patch literal 113242 zcmaHT2Rzl^|9_;qLhiL?Ut2b%!X>Vim8gueWrQdr*=1Z@Zbn9BZz+4rUZG@W%N}u! z?D;#l_36|1^Z$46gWJ9D`#$Hq=JWMDuOr}^ngYq`v!{<8J4T|Uh`fI6*a^*J$MDZX zPJ(xaK3nk~I|e`^{EtG*DA3+8AG?6oo_9qUJZ^s>-f2v zzh~s#i3Mz`-02&`jtA8p4EXi=6}*Uwy)&;=Im#Yj!(W=N%}jB;)?$J|@&4!O{X$K8 ziTwNf+5`moD*wKy#RC6<8Ua%JpQrFsuZEuX{xfSb1jvLmvTGH8e)#*f6|wi}#-6j? zGUt*1eD(LI$OIXDT^4*eGd}#9BR-kt>yKBt<^CKa$g2|e=TyDfuSy#)kTt$(#odFM zB_R`n^7@~rv?HtFk+GHIy~KUWKfnF!b+jjb>yJ?dsqq3bAF_1f{~-?V1vTlzpg-?g zGr`O(Ye6p<=-xpnv3B) znKqg6LYGaV74@%W|EY9sG6F4soZxyM0lDAX=eT+NPr=WqN^}2f4ThrxY-t}~hF-^s zTly~fGiRJA{^zOeQ*)hCGfI)@M!^4Q1$?pQI(tGZZk&WP=(A{D&Ek~7AA0z4quh&- z43$4Lfd`A01M23bc!4tl?-%mYOaHQlUklTYAQ0A6xf8*srSrd20`J5qN$ca}C4HWi zS*YlRjbPciKj!|7mSD>FkJ(Bu;jY@Wd06zHlKr7jLp+F#Aj>|n?yTix?2IAzYndp-CMv-W~$sU)PKGAT>0 z-TRkve%YASX}ls?+zldmfLSY3R`dL+`wU5fp6h=|7iZ_dNyeV68GQc^0bcK)%J{8Y z!}Izoy%(tdnEr1=%Ge?3k-^;(m=jwXKVfUu_u+p}j)x=R{Ga0K^#L)%DnD^54Yznx z4m_9d{_y7|;B}F|^b)1!y^aevmH)KKpLb2zB)iszd*2X7_AI&_VwA=8$D+VgA_%l1 z|CH@r*t6&tIzzIf-%VGQCBf-GWGfvElm(5m=j%$n;g;BJ|Qw^DImzvfDqG5sI6y>^FCQRU5Uq~_Is-R!4yyK3}($t`JcMJ_Kh&Z z_xn_ZZn*z4s~>{5Lf{o$`yCbun zHKCstuaX9;75fjt<|2W_?j)6l zw~GE}{Qos52q?x@szXUun12n*dm5kTPdhf`2O)A+Ch4bX^u~Ja|LIr1^woF;n8rjx z`4=;u^ncy&r{1JLa3)X%0w>nQWx9F4@S%TAJ=Xz}aq}O2WxN9()i-LB6NwWlh)D@l z{~_HP8Ju*XE0Lx*d;iOo;J*|aqY9RK_db&g=O2-e8Nb)pYyTfB@jeTz+bVdh!7AbV z0%|G=x&DldKQs!o@)EeQi%9Dt#oE6y!7mq`A-_fhY*Y9NxDMS<`~X0NKa9zWAFt?p zocr-6h*|-e=gpL}7=Fkj=&4uhKXdwRzur2y3?!q`eYc14A2I!7PQUy`I}8_!lm@eu z|1~Jm@B-e4A4&6j9QZ30{G9}T8t?x<6(syzC)IJB>)~Yu{xxlF8vNEjG7U&WKnJ$e zKZ71{|Camzvl8#K$~Ya26n+~Moc?EZzr_HO$B&@veFEpnwFBIL8Cy*ld&1y9;x^30 zMM7cAM-~T#A1{MhI<`!Qm+y1SeYWSCNGUNY@fP(5cUkFen{AYykniU34 z@dG^K=IqUm^M$a4?8`qdOEAXQW&M}s;ckCT6{4u}!HeXEuC7&Y_f$#o%YR{^Kar92 zhvnmgO)~KU2{k)mGPva!zqtsY4J(7xKr17xTS_hsOrlLA2?K^4JVs|3-U~wTN|X^ ze>|8s@nXpx)U=qc{m(;j_gHynLjbwW?)to6+!R*mB55$8@;Ya?c^*y!G^-r3(Pv`& zr{0Gzm5g~5Y>m2hfGbT(Mx0*WaqPX}G+-8`lcWF6Dln5_F!I-A|M&O#YElb2fpHtO zM^ATo2AWQ(24-4!l7oTgVw%Y23n3YoE?p8@ zTd!EID)47~+`?bAZ7hDY|1J5>qj6si#dp(@dW&(c*u1^v>M=&Ql`Anc8Ki$dcsCIV zVp7A;gu$5#7)Bw*<<(}Ul6a5Z_iNw2kw~8Q zKJAX15y-{mbJ|T|VQN>?r#lbC#@xF3%cjW0XJ0*BTx$~$yNuAtlseik2&TW(m8KSJ z)!5i5B;eU1aITlAZ2h|M1|E2Lx9)oNWqSTSy$sTxR)m+6Pl%{lD+L|Gt@L1}o^*3_ z=>CxV)(G{9-hz*p+uoK=1k&WS+8rw^E4z99I+;%Bt>P72ypX8ZVP}3q7OZ>i8dTio zfwPymWW490%ijk!AyJ(>)DV>47785KqCdp$|xXlIsbZ+jB6H0rusRM3GK zdc3)4Ii~@+HFsl9qrHtP1jJC^NwITc3}oIBA+AeBpLMseBTF&naRHMzSDtWV&x%@n zs<|-c_KUZ01uc~bFWZJmoK_yXtzGJT{_)}@@sM3T$s3P@U7^#@GkOg?4|+evL5q|+qO%}5 zbD9MWydQX>z=4Q-Y(A<$GP(BS-PQtPA1`FuLk&+J#R{3oFE+f<0rnAl3B87#1Pp$@$@DTMe`9B<>h%|w&$g-Pb zLGkt5@+`-t!QRa=&!cS*#wKOChwukQF5hM}FcU&Yc*jrnlZXu)D$v{eu;li=(Gz?7 zQgfiIWCw@MJS?7vQ?c}pEHzRa6eeR3gQK2D2itYr5r<8|bVGT~jQ0ep_w(;~9&8jZ z6%RE*7v+P`emD!EfkleF>3!VxG35R$^8Xd-ui0N?%BXdh{(KaKJd##_;5^Aa&!PH4 zd-h|j&F4GLMdH{}Rs^?u4c@7CSmrLaV!3JKe&woPZ>A>a=`7+~Iw3u&a^IMroyTnG z-XX+ml1lAHtbb}hC(r+j3y{@NWVm3hy@=)o`q)?+_h%~ByZ^2?dKPxH9)6{3{v5ad z>%ZeO%Io&e+R0mm)vL;9G(v^$g0+R7b)H;L3bty`R?ohXk|g$Y_0i$peetPhvJ;a> zkSsFIMByV2A;-g*MtWpi*XrT&(P4+$rD+P21cS>0lbX=P-KlW(K}Od_BOmqdOFFYy zp`62?c&CPpBVpmMX;@vvBe;RSo20|?s_Jm}s}P*>PM}v!re=Cml;()@n7fcnB6%e~z7jkCU@G?$HFH_`!PjhmlE>y*B;|>-~>JsgN8FhFF@H&vit;DM`Qo z6AAww69-xCG+>GjT=;mmbS>Fk7c$cqeaO`W^`#rjmBKk_1@a#s?#!AzpSxu*@0o=J ziTAnS2Q}m=+4o0t$(Y4z4!_F zOlk0(F`?;mHznlUzkLv+E2pf#R$dWIBUJZz3u}Y(jzojdkL#IaxE0n#Ttzm+c^`jD zxZ*VGGCSZyNN$Ye5qNR=aCnCU&gSrcpu%@xld(ZS@CzUU zUdi=p&P2ch2(_P!`;CcYRpgNF8@;!J$9Z?+Xh-iBQv>*%>khr{QhAh9eVE_O0jOJao67REh?cnXxfa?pUCDVSvp^;@*Nw_#vj|gp{5pMQ$C;8l>3~3l!}T<_vr9o3B>uJ&MfR{s%&(2Lr?3R zk0UantMl++%fNLu*4cW0do|DGP1(!~r*@%cMMVI>04;6NjN+9ttsr^;_tdmLD=&vmYfKh}QL8D9o)RxHu`VWMHltZ&Cp5~DOS9k_h7 z7?;gQ?*twU_Z0ph=MwIcUHdz50MR*%5%k`;b*Fc;-vqNQ%#)-kwKGLdchN3k)jq24 zg#Vg~v6YKfS7c{dn(E8D4jC|3d8AO0X1bcjJLj$b9hLZnE7JO)?)g{w`onMB@U6xr z2umx@+YVnuV8_ZH&PIE*JY(4e2x$;aD>C7Hz#R|L-&$EiDl%4B#JXQ_4}3)YJZ@Qh zsW80AdO#R~UFJ_^htV-pWn`4HMVwVUf#EEj~24m zZbMS*T|d-{dJGB+6Xh~jV*A6{c+aFqtu>WHHYKsWZ}e_yWPUSD@BM*=ivqpQ{sHHI zBG^*bo}$4*OOvl}O5$)K91(o*twU-kLn9fDslbPfU+ZH_i)0Vm92rUWx*9FQkXc&V zKUi{~>D26p4YQR|llUc@p_u-o$pSt!A2v5aT!V1+0dmO@FSD*4OUtd-{KyCP2HCygxl5$Xi-T zDWJ%9WDq1_=+l$w>hX*?T5_Mpu#_e%dsFVJN^CR7tBdv%*?I6`O%tURl$7yTiF~V~ z-@1$;eDeGC_ZQN4$?Tl(btcJCXpxg10ehC!Qmwjo8OKdLT#KHhd%|tJkfIcRmydHX z#-45Xyln$7*Li1ozP|#(kHQC3I#xDBBO_eoaSq5_dG=S3=I6&{zkX(<5lj{Tl6H+Tj*=FVz7hJnP9u_)cKJIEGK+xl|Dk;eo|APB zZ-?*SA@C0yD~beerdu)JYxkEU4Ju08{HFf2?LhHI{VMjsZ*S(+!Ov3t+s1ygk2!xa zj=xp{s9eBpWzPfP-M7w{z4@2EP|`ObT*1FrDgl-d%L!-yT@1H4;IFCw&!7ar#FU@p zFF?Hm2`zqq`_HiRoq*|sf;HT0@zWCdCz}3<*oLdnYni{LNeFI7NT~W-pjM1{MT&n9 z3K)G*J3`X}$-LzN{q^@ceg`?D4LIO;AKM7H{E8oxWL$iFZ|q`!k$OO%3GknTCG>$R zN%!jom%A5e@Dfr|8oGkbwC_HCrK4Y)nRPRCc1obFI=?U_C-8=r{J``L?jTXKZ}WR$ z?74zNUX}CiXqQO70ji$iL9)pAg)_wt8bvD8f5+aMeNY-+K5CCJfstp-)k*2ZsZiS& z^_G-gmGHk|c2mEP?O^{ct9w{UCHL3YR!SaSoZqHZbp(`QirXnwe23LNx3siOeSLjb z)0+2t6!o){B(m#ybaSQ)2x|ymzBApVpI9%opR{g5)85p0F_3xw->eh-*($-5p*$#y zUxdC)-Mskx_KJF(#DK^4_$k-rcUz0WVxzfL?t6nZ-p6s(bkV6MnL>xI6eS$azhP1D zPb!9s-x|cqSy#8IDJc4vtB-7%+*Z8b0Z7@GV<5HnHK)3L#H5Rj!5}awh@^G~e2=dL zu~55W4l?WW)AyCiK(Guj`|!G5BUzqyW76OHJ=BoSs5?!y0MsUZIHU%?@{T1NKKh}J zXpO^i&eOns@6Zq6piw zeZKurl|n};=*H8#eD>5ZYEVgAicg|N79%v(xIe2Qc1-JSD_7WEl9i<^&=N*F?tQl3irt$^~^xp}SiHRdrHE5rPIe+{*AcEqPsEt>i+ye14z z^QlqtEG3osU2SjXzajnM78nL`r!)3$_QiBU8@|-~g1ev8r4A@gd~&hzH6{JVv$*Nc66_lr8DjwJGzhsz#L9pNw^7qS@7MG-SSJ3I8*z>|Sh8+L_T z{2l*{j^Dxlw+_E!S}^felaVjAPeBQ;A9TpM6T=~|(;sEvVcDY|H)ye9Jd`&A_=VFr zIB8Skh4*b(jEeFcfkaYcz}47WG22&PbS5hd0ev%WO{T{^Zk;24?-9bh575Zq2eC10 z>N^ghoeJ+2=-yXk1m{zyw4eA;!tD4w%754B3F-sM30qN?$goI96{GUnlXTh@PD|F) z&uT#hf#X$M18h?|ERsj%;W>Lj4_- z&dvz+vA0F9y{nwgt`FNt8Fw{yYwr47(ZOfM_BAFfin~f^+VuvXxVZRfPVvQD*{PPv zejw+{R2*|+eoNma)p4PRJFpM+$_|I=-{=(F)mVXttw-wF1`Lg7B!>iIcBQ_xi>$7C zy49@^j{D6EHPf3wOe13TZwYs>HUpd+P*v73;?Y_&EV*0w@$y$1eAlq*MGB3#pzhC; zAY!61+4g-NJL{@=6MMww9>#GX{%t;HTkSG>Cw~ZKmR;ZVEw!V7KhM-?yTbhNt4BtCPK0n`=Iy)}zqBt8j*c_b`$nK6la0BI9 z@nnej;8Rir%^ug@CHGT8@rb(QqxE;oReStYs_*PM_Kg_h$)xI%F1iu4X*X{2ukJOG71MNY#E3xdsk+ z#OW}n()0yAv*$OgU%x4SaYOw&r=!umoOi`}2QA_P51sV@rJ5W+rP^xT>P+1E&UU1{ zAn?JKPUWzqEs?VrVmpxil};p0+puIBCrR7L?7rIBNE2+q=d!)*%i*Hnh29CK1^cb& z&v!kv{XXpLVlQtExO*2uW&t>CidY5&V!=%KgXoEu70tpUBiqkLCC_(k1<0`MlZ79$D%Cs z6C$)^FJTe>>QsnrAKw8k2Vqr^#2)umbi|d!Fhza{zp}i3 z=BrR-S^8Q<$EXLddUmBmHmlSOLY!%AVAR@qMyN`paahw47F<5=M|ZY!Iy=46;o(+G z<6Vzo_r9(Cp+3nXer~Cli4xZ=1QAn}ztWqX9KYY#?iXfg(Aw~3S7R>YV!HIe)UCEh z_ud=I6B7Kbuw#Ng}4KjD|QLc!Wur}a|ur;J{<#} zq$;0P+-X;j7ObVYwSr;|$vrw)_AKsJ6K`CVfjI|M!AUIhqVykgzja-0q)yHW_)>GZ zYps7jGd=F?SGMcuN>+I^3iCk(!6xu|eyAje!E=8#kH6`FjbvwJL~+maXv@>7g~cC< z=K!jXl9#sS-10tQCt2NZ1g~Qm!|Scm$>G>J)IlZ7V& zQ35#7e!$l;vZl{7tv}_Adjt;=dbv(c#MH_x6Fzr`u`PXh)g4rCtE*0aWnc0Rz=++C z9O40|rV>96+rEa}SC5%8Qap*SI?u9hmUM}mIx)-!Y24MN)^!_j!}doB!Tt)mNQLFv|mCour3YU4`%St8O*WlEs=xMaiRF6majisa>*>wlxSuK};eS2|6 zsI!Hhv!(e_!Mgomrx^V`L!^|i)Q-?XGJS)Mo6M(~e&@MF|FatP>y}#sh%miNyWQhF-^EUaJbM><0Tnov#3)206rpe%)`NPo2a>4b1?BxOMELIkp=&E~ zrfqTxMT(-uZSOGH)!;b+qoxyRW8rJs1rS#Zq4q&L6hg(@e9CQVS``IDZ^cZ>&M}t* zA{HBj>DA=NT+r+T85(wwNZ*8#`;ObY2@mvg@iG)4D-C;LUtg#2TRHq10550 zxC%Vs`WU#eIf#UVytU6CgBhow0#ODKeQSZW0)&uTa!Bifa@S4At1j9uW@(?*&-z&S zup&7K9O17lNrxz4kSouOh@o#*&c8nb=x0FRb%`=L9;Ri~VKRfVY1b7FOLX9jNE1V_`c@N&lTC?_m!)>Ye^(_i> zn83UU>MLq3K)Xp5zl*g!EFPgWmVTh!r8d}l=)LlMk*P4W63471hg@#$UshDui=Gha z9GgmX-;Ttd!c3~ax+o-H8&(WYmLSes1IQ4abYAAXj1@eA!)0W|u(QxoQ`X1SfE6AK znPwvq<6d#8KG+oTOElb@_zcjWH6#ntfM&nCo5BFehh!2vd!vGC2@_u}HF>B>f-8rz z4??NmJZ(;+oWuro;foHyqz{ugR_}~ z@gN;DPTrgd>Kl2X7nA2~4i;YL*xBEV5NN)zNkVW>pW>vfTfM@jK`$|-!NA&cbT36l{B3=#riK*>UmD?KffR`_Jxns54@w+uB# z5laMyeDbF8{#47_fZ_(lMKEktfpGy;4@bn~VRO8U{&Ms(G}5M5Ac?jFG`#OM0sXNZ z{W$irV^Tkgbl&e%C@Nepru~cF5`n8&FK)PU1ALAQEswwW>px!k2e4n6?$|J$W6B}R1#nk(w#)G7`pLq5Jq0n6M)~x%iq_X#*I#+iJL){t1 zS`=K3daFG>C!0>ga_A?aE(09IjaMY;zxHFdW%an}#>(b9bB*dBiTIcm3e3x{3)za= zllva3(-M<_E!t}2<}d{_sZFvkOgouD@&H1cYZVzifwhUZg+dUIV$YJ@UD<1D;f7eWmh z*nNWE-l;eXKdE6eH4D4tL)t(Ge*@KR!CaJ%piIKkxQ}`T!SC@Wm5^zpNrYsfXdqX6 z{69s|nC0@0X!~hjIXe^X=%yfOgudRO%P7a$`b+^0V}wo#_OT8-ERRYe&Z0lbQVfBt zat~s>trXK!TL@1M&X#3{w^DVYo2$rW-DGoRrCAvKssmOfh1?XF%lFsXf{h@C0bC7_ zoz2O7HP_&8Yt9()X9jU^jGyW(NvSt(x_bEOWW)Ui+BHozP!`Q`t|+&fTtzf+AlZ{B zN(S!Iu}+Z6LS-LuCWU9g+MzSh7U%_7;p2@3N+xqoE7EaF7+E4j2)!AOx%{PWJxrNj zsF=vz7BC_qllx=?LH+V<0{D!W*Wpz43UIvl7@F2xs`n4lQW~k@r&nXRuC%6(G4sN` zU>bqU?Ll?W3t~go1&>&tteWhot+Q%wMI`tt`k|U9zo8Ovsn<>7@CgyWU@@f(?~}8k z=)lJ!CT{-h z8j02q;pZ%=LkqTjJ?T&B7Fn4MOSl|td^QhonMx&glWs|2%FC$_cmNF^kUB+71C`U> z(yCTlV@B8eH-9lg^(&bQFD0nkSts)KJcV36$bL$`cloe0evT8VLY~^T>TjdOWV(HP z({nHg8uX|GA&*G93tK4D@Pc4!T7`maK9X=f>XI55E%Z0Tav!bw3(wyItFVtgvCE{< znEvX)ReIeghbKsruEVavv|#d?QNk^46pX`eUrJwWx7bs~(FS)~iSWKNOLhGggs>??SJ%_#e}ZA%!r})UkAi zp^PBv0W4>QF<&AgCb1elPFtm@{p|oxiMqWyB7uhHBiMDQp5j#8)iw#hhgDxh@IDco zPN$QhHl~?2PRVJ}Ru>;Ao>Jad6~LIG5(MFrX0^Ut5|11g`#ZlV({Tks4Enp{QjVTs z4v{?!#$*RR>ohJeL@mjhOHvKsZmbp>7}u;3iHtX`Y6p`WBSt0ct z|F~)DNZ#M)VPh!zglS*6`R)1U-ekz%FS5k~-u6x}P zj#>3~pfP514=IOjKlWTLgA}M3cU)Z8`4o zRQ!ccPR?R*BTMn2u;NlzinZ0Yk>HoGVPX~%_js<4YyysgH_r|AyE`FviA)kEsEq}h zPj;ozg)R(Fd5bt2t+U&Xe&VO8NcX$Hz56w1QuWlf-K2M+T~mJ_Ivl;N)WbQ!H$-AE z|CQc8%2&RRHTtrS-C z>{M<72F4vL=-~XdCo`O75Iz;||M-2!2Ns$xwUE3XWp@>`pS)KtiZJ8i&$Qmc1;{}W ztA{;|<^aH5M?sLvtElt%%ykUZ`?&ojmSVE!j++DKbjA!%2z{XJP?6H-RFe7I=jQ8-l>0hRDO7Q825x|QmiY_Qg%CK`zLuH zy4~Z49Mf!?3x7g%; z-!pj!mNt}EitUzGnVr2e>ssWd-ZtPDP8U!frt=n)Owiplsw<@I3Ce?1qvjgKkP5}@ zZL6F@(Veq89}#h=$5_TaPInrqVaW%qOk?l;ubp9S2X(gO8M$N5T^vKlN84F*Czyu% z>il;NgL4+e(cz~}v`vs=q}lah6`kdhS0Vf*r22CYg^&77M*!#x_;eIERQ6FB@4h?eZNKphWEw^x>vuSB_z_ zYzBi)825i(eWEA7`WxBBk;@S>;rWa*TmY_Z%% zqVvZKC3Tjuoz3fJR0u5NkbgqZ#Tl%813$inwvEJFbw+}7N#-%m>eKelvg?g2pGV%4 z@hSPoZ_7&AZE4?9xmL?$%lItnP)=0fAizWJ$T*I>Ua|&e6koUdPCn8$Fcc*_aS46L}IsTRlz+G^u=$Y3=+t z?zWNGflI`F5wqBbMb9@`N`+NB8l2Zs1WaCDORu17riV|H_u2W0HFI5jxM*~>V(w`n z(Uq`iY@ELJdVmS^Wca0i)&OtUH(`vTEbVk}^W#3DH(45IjLCOe3$h|*FRzKHitXYxU2dpfcLYpoNAD@# zrAdSsX{&6hiJR&!oq)JZyU#fR!lazFi(*f1>uT6XZgS91J`whu%fV(M>UkE7bwfK5 z&SJZtL9Zgy7R#SWq46Z=*W!9-&k0wo4`dBL8cvhx699j3E3{nSIUV z5-Mx`L%wDBa$z`170w#tPl*s}OkZ2eCw5w=^O5A`zOUb%Rml1dz1F44bXZm))I(r0 zn)Xm_W+2MNg-WAv%3Ey5g1Rb-@8vR_|k8Vs0y`}VGKf12-Qyl_CIskMHw6lRpu zgiGBNIWu+Syxc;ib4 zZIZpqTttbHb1Hor@;a>U`RL6&Pv$z2O>Xxfn-}ZcX}l(_A5M1V-)DBKJ25W89kfd} z>37nkmSZejbXpZ8G%_zCW!M>5lqIX>>Ur*`+%|W|?q=&Gb%MRa+U@IHo8)fBtwQ*< znDu~AjC*7valaa>nZ}WqI~jrArJ3=zz&iBV$zL;T{RE?L>yHmNp&6peyJShOxouc! zhjt>jRM|1(Q)(+*yu78w^pv3)v5UWdNk0@JM01_mJ>szW@QTzqy|^j?DtsQTfA1tG zya0Qlx~gKg9i3kWJ<_*p&`WetzK{g5d9Xzj?3>{)l*T1sb>-0%Jf3^QiuIrM$Z*WCa6AC=@A|jt}tM|-7z#m>nQ|7w5D+{i)-A+GBSNA z;&Fp!(0mS!8hJ)96ok@po2sY~Q7X7(4r?8j4E$IOL9Fs7Aw_|=P2aH{D~pSi*zrbw~k z)V;-Bt|*TNqW92qBeS=giCUmU@7qeVQqvG<0>Mo{d ztD`;IJ!%hYKhe4=TvS+0&E6XG90R+8m`l5&GIW*$)Zq_!UX-T~dI>7T#ELs#Xd*G2 z3v`IXW;!gAqg>FvZFY`+`Nn@Kv_KZBRQc zOE9Xx18La>jB1wrwh|m8M6g&Z^H0#M9_LSxw0Fr``(vEcx7j14;al*w7%2Z`*fFiT1@`LAmE9 zzLm2aj^;tiw^0+}ZS}}WzzH;BP);b~&-$)!+(DrwKSejeY0R1Q5$r13LXH8#QR(&y zxn(13H?n(UzPtI6J*9>ha+?KT$ce?6CNwfaNftT>Eqp|<2kLmyrW2{R2{?T;^>rOb z96!_65r-N_1Sfbwy`T9)S3$2AZ5`wg_AZcS129?b?6=EZDX2#@ZHfv>Cr)S>S3&}v z1fAFgTNoOl%us4ImQW_J*=3NS7BH9TF?prwEasDw zqOx_V?P_GY`pC$m_Y_Gy2T*%xB4*WVL{f4-+XX4>og z{(xkZ2nlN4H1*sEbY4<4I(G}$Al=?sV=njpcl*U(m}ao{u4}@t?>G%Ku594iw0*=5 zD8}ZOAytbQ)DSW$Jg!C6%@}>#Z$H82o$FS}9;eH|=j!c=pwi_@PO+0609N>=c;U;Xd=7o zb|*w~@u;#iaNXK9M5pliVg2Tl6OKmo0`uXEoT!cJ{WaxEp@_m5QBX$@$L7daU+I}C zbppgglaSl^$2`n_&k0u_3;ja{hILkF48V5UYA&8(RbTY&U#zWJ#{ArH=5@l)`qjlr z#p<2is9hXL1x~L)37a1U->zgOW@cNpxCDm^NY*{NO{GC3M2?5H_&7CjP;;DAlo*`B zT?a;YzJYmdH3?484SFp)oQCb2FBbC{AD`fxq=HAlzmRzckmCBeVJGAnks-2YF0qAd zDaP>?_t%v>%o{^AQH;aHUzc~$B#>{Fc_sNZy8vCRaaX4T7-ur`BDRU95ON!0kK`mHX={7f z+7=`joH2v-lS0W9l7tY;UDIb=sQUW0f*9s6q3u#tfL;^y`J$;V+1sKQ2fNgMfs^#4 zNoylW^ymBX(3Zv$k3(wYq@*PpJulWDf=XSqL2$Pf#0n;ZGjfQ2;Z#KHxel4AeC>Iztoa-REx!ENqyh6eIwfo*?6HyM=sl)=k z5?gy>tzEpf{+tkrwU+Hti6Lz1WQfQvwPu3|64!Y!x)MxBQ5gKVf7aq0T=0OLznT6a zIyBv~JFQ@W?cI&>dXnQ!Hf9Fw@U=vLM&U>GFWe!?)vOEQkqYChMBXtImYg;U*Oor# z#0!byA!_}nk+$S{A(&wZGpRh?mk$xkX2H|e%3X%p>8dneqw@g~*L1n7`__o$+q)L0 zN*_E$9pF_P2Ion!Sk#|6X??GC{!`-9&{H#u&g1_+9x(!lQH62yfpz|+9vP68RN5{NacVOBhBmHWiUGvUx^@!w|H!?0X zHX**L2Z@X!bSg^W#a9c6l%xm#A|r)y2iV$25$C(aw;~|5$-BsBWJPkOw3El-T&otM zuq25I^#~@72M`qq8Ng>J;73r{BO@}*0eMW|u>czX3~!Wo##JpUd@A_{O8A-1x5#i9 zWm9q+DuW6E5k|?Qgj1ZICs(ycZ(?Y!c)-~MCS;gR>5&ZrNIoQ4Qjd&~&}q!F#Hb2I zmTT6#?D}C%fm1Ta^apMWiuRn#7rf(}E|1MHN= z;5*wNi9*AKp)xD9wLCBjMTLg5mgJMJkGTamJAZKj2p>DRTP7(>$ObuwN-mrGE(IQ6 zW=>^hMROyvk%fYVS%c9dC8}PctxFE>EaukysQty0Va;hF%zf)qt-i|nIJ~4x4GVx6 zHR$w{!xV?0Wpk$>NmGfuyA;za5XrG~!anTqQ?S(lMRo>!+N#`;<$yBR;kVYucNq@? z9EcgN6td6jgrL+ZSa(*MM@ZBln051+04PU(qy#o|V_k2PFNp(YMjIYsMAE;k-CWh| zl&*p<=MG1_4+?`m2^a(?9HNCbdGJMLX=?D|up!EnFI=r8Hy#!|*+(U9%V@FhUE1S? zWg&yfjXrvuytl7}HaXT=2gyM-N}TQRQ1%8WYZDbF(XuLxNmG0r zXWh>xM%grf!b5ehzXVNf{c|R$((H#@+Eja5pn->2e%;bJ{e_Oa-o>U+j`^dLEe4V@;wDSO={5ts!GJ{-%d;ltiaIqs(r|NiMCWyAv9IEYK6fzKIp$by8P zM?t+kQyNhg$l)u@<3jh4cYLULWD?-`5$ni=>wXmlJfNO4fYw5lX+)^1xv5#hNb-nS zq9Kx711@jcK_T8EYs!UDo+Mi0>Bu-fPH5j&cPbAW8YqDtcwd<0hC)C%S@bBf0Ml)j z(%jlsFT5Zt{j{t?A#O@tY_Qq6fy<5Az{Tu3)z>*XNb{7DxX?O2MwWH0%ynuZE-MI8 zZ!#SbbWzU0P|px01+j;GjR>xdQ?wYAm-=Gwvj5PTRX64VS4Um*Nd4HQBUaNig}Jf{ z7ST=x&>?hp+6}dvEO70Vdki9=Qy)MCtBF$sBa*fclg_UCR|VZiZv+X>#pzd@d0|eN%2Uq8p%q?Pv)xXYG)(blZ?c&>rI_ zwe1_fViMQl;-iVYwWT!#=%wD8Rqw--($RLZO~p1xbbn?ET0oNZd_2oRN7%;f?+&@$km6y=VTKR zlFM$Z%*uXi8zL3zgkptQ5ufmi4uFK--cL6-rLDuSo3(oV<}P|((Ui&CtA#JBH z%s=}yle5@px@G#>p_``ye3yVf;IWxl_nKmUehKYg}!dhqMEe%ZTJ@<%l-n*2EDvfsSEK z*^5ve6px7k_v$~^5&yweItAa^}@R+JeViCI0HBuNgs83Tx8}g?}!n5_i7#VrhI~0 zv$mSiYn3u5u=-5U84DkDxnqS#Bm-l%rAJT!+l@{pd!eM&d`q&PNd{l;yBuIHKD5g}JUqMZ`(TB9bXz8_A%jV38Q1Au|`*X*t!a!42cXZsShwFG|l)S z>f4iubW&{QQV7%bdna?(^7JnIVZ%#HPU?IGEB0IcOxl>EVcr^r1vp<-_etfw+;?1b z9E8b*y`9c9UCS4#(sH`@jo}H#e<#+TC%%h@2>B;~4CUKdbxS)AKjsHQLW?Umcpq*( zD98(OGrN`F?v9lJdxa3?J*cnZCCeZxi%8*Iwt|Z0a-OxutZ`1wJ5F0%5FJ3l7FSd# z9AYzA1Xk1)8Kb z=BLX$^k?)v=#(%6?cj|E!)@yKZ)}&k^45b`F)3k_%;=06s(m-HHlk^1IDrtqbKTFZ z#=rQBy3Q@_8N|@+`Uc<#ZO11O;v_Cy0=#iwt1A>dF2n;a?Rkg$$MTGh^}qidiMKD? zHNAXgl{b8PB$l zA3caalDL4uR47P=xx0A`T8>Y~S$*A~A<~KJ_jJbCykcS+nXSHq&6EI>236C}>V3rP zYd;QxgLC8|1XBe+p}STL07N{=*T4TUkBsPJlVid&Gq`T%%3=Ry$W86X{96&xjjV&{ zqCIf>l@4Qo%f|LrrEmTKgqN2XVe>2j;%gjT@unKUclzbN8U0OxFGZ>PZ2 z>7JW|mg^#LRQ=8MbdQ~B>aUg)O%Cn8{cs17~XwOCOC>iL}hI6Rqg9g^O!xz}hi0L-X+jaG6vuVU^ zU%7+krRm5kLkMux57#lGsGAtfBvmC78L`?pYtTQ}ncVgPV?gs&NiVJzpNUgF?zSy0 zFOq%_a53ks6|SG0S2T#Dq@--DI$5!{Z%FH&3;tCu+UwZc2jE((Dc2ILcMXh;G*k>a z<3Xc#@o<$lX+LPRej_Y(`t)hEySGz#Rd(L1L%EmZ260U50;7^w2J?3;Pqq1zGBFn1 z)H*rz+~(E=sWI-S2QCdL*mPuQ#QR;)sFos=X5g`t8cZv~5vj4MZfR-t9(OFuVe#Sd zQ)fh5O_`?7hCa^Kx_a=25b!L0K5sHEfTl;#4Teli!<@J*;6LnM)!ZlQj_Y7ZSRjbF z{vDkqkl{n6cfWC4uwYbMJ~|x@WA)Qp9(`xx+IsHkTAa%at?Xh_RkZV6y%j>)YfnixjHZ;( z!g=O#E|*W|cVc38xPz7>yt#(oxjM7jgo(xEqth!!J@#x^`CM9FYVR}l@DOByQ|Y|L z?C;ws;&V0C#d{G4i{0AtmKL62@!Y)HV5c!&E+mEXKA>LI5Ywh~5~g-pC+5w3TnO^^ z_h~ml>-xv(M_2)J5Kc*Vp@aMZz~SVuQjDaGrcX?S8OHhCgLy6z0J7&L~{L;tY1H2b-r1y zbzK8tQ|y3^IP`#g@(GauT16>-%KU}f5eQ6makpPA%+>;q z$gQRyE66G-KiV*70JTAW4P1G=zuF99W~B-@M)>=|i-_w?k=r$e zr39VjqN6^S!13orz(o{+O8z|KEgF36yRFdzaHdx4@i#WnYe%nX!BK@?>!?G`U3Y$`u+#f6_R)3~cKFZxo@Oa-kUJg~AIGpFzue(E`i|8P*1 zag8I=?MNU(h|ja`woSm$`6=_uR*R@Pg)q){=u+$UmYxeF^Oox6OB zVN&jwJ-Yhmj;o}fI-2ETb?YEKFzJ~K4K>Lwpid*`z!cSmSzeI*KeFBeD(bCm|5rpn z5eY>k1Pnl0T3SRvq@`P=V@QV%0THC78x^EGh8Rj3hL9Ryh5>1bp*#P3&htF)`@FyZ zTC8){S&8FT{kMET;N zJ#=#gQk-KWGGOhvzn!@$^6|gU_<~dTLAe_CKo4bOTVm(oQHQjf%t3k{ zYayGY^=)U$4WH$h7pHTM=hRVJst~^%aZlBIK9F-aGTmIAxD&NEw+-v7hLXhc+(29WWyTio+s*>14h)EPA^MN`a*LdsxwdgTOPLEQ|f( z=W#s6R?3pylHwff{TU_*m=(<$`iee6sFJ3XY#QpBjjtiOk!F)~^#Q|cB9au#1(kw#l4lB4b=R9mBaR|UFnh_TRk z{ z8q=$-;c4+^{X`s{dMAR(G$<)*zE;8f5k|zjA&HYAu7q(3J6i8|DCRu|m|x!=?@Zp2 ztuL^}M8yhO#3=D`cUU#a?w4x5UTchnaH<-G&L_z0Ca}{qrdC_=@)^UEM<&gyNY4}Z zkAKa?ahqE1tMvYWjJ#~tFBz-g;fBtg+GX{*BJ->ag%dbalDNekF$_5kkEUmd5Ln`b-HD`=xx7V+I!g69z$dGifS6zh&dpD5_|pxP*iO8)r2#wcLA=H9bLDf$szdQmXB(g6YaL z(|rfNAa_G|*F$Z&s|rgttsAopDZpCHP4`89LH<~*(9$rV>;1XT?@~E8_egXh?;P8^ z#&!FcmAx@Mqx?)dYHEf?2y!=wlGvkfi6bj7Zz583u{-&And91JS>qvEAmo*Y%PCne z8;QA~9jYZ#Vzx|YW(xbgF9UY2jK=@UI#W^c@^duzc3a!{-0*w-5{QE6tl3$unT2p7 ze&*ZHq*YF*hA`NQ%t${XP6~cAl-MpvQ)E(CT=~ZFTj)WPM7-ppx(a-2xUy(%X^q;t zC-#UecO$`A;~jg+@FZ6=^Q55sMV!jf(EQv8q#vrqnV9QU5MDiQ$afUo%ZCnL@KO=I zjHwK$on~hG5OmOWV#&jUxVdOoFEg$xJA6Bb)p*OFcd&V{?`d{?T*3q$#HljoH|g%` z0?O!gBSlM=P10jlN_aU4HfpOn{^rfg%bUj>+YkE^KRLTNS77tzZ^PJ28{I90T@sxZ z$_e!wJ>%3mNqcWD{+3(W9aTtIw4}wZTEjQ1V;|mpyG#d3)|JID-glMUTu43-5UV`@ zrnv4WYG;xle&_lzg-azPt6m}FyG&2ycKNO0!Gl=}g(aaWGx1cTXKho`IZynO>J#Tkk$x>*h>R_| z1lqmX*<7pYSHOuoI$cM4oXGQ__@e+K_g_b69)5+AJpgdg)ek8+0XHLNT?+rmDJxGfn?3Dv?`mDO zEura6N@Y1N=d76=b#`%)W=MiNs6N@W(QylevT>R=meEW8JzZe6{rNr0zTx;Ye7pvXwXMaLlw zi+VLQ+Gs~@0w?gVH!r*glX;i0XT9@8mKwcL1^sIb>BTN@&?nw`(Aa-lKOPb1EHvYJ z$F|&H_qSY|;0=#0ah^lf&c2IkOS0ZNVVB{RE)-K@rsepwdvdzlEH!LK$_tfoinZfJ z309oN^hmwF{mAX@#~e!X?!Svb`{udZE&PAh#6QK*@xzZFKW*o1vzOGi`X29Fva_XA z1dX=FtbEU74EfZ2=H^zYUuqvd=R!KCNR}LeVrS#32rYUpn;ioeQ{a58By+4A`6B6! z?)HpFB9DVqPHk;=tLxn$!Pfluq#Q(^79G1!uWi@v@V=3z?w~wTGmw!CeOV9w0=rm` znx9oK8Qw153qBawpk1uae-h%BUnR4c5X7*!s9>x`@#(y`_vuZDyo&MkSwrtTACKeV z#93Q4CPgY4>RlA`5g)hYk|x1g7`rv$+G}Y;O6oOvZSttOGNsq*YQ71T^e%3NckInL z#_NAVCmlIO&yubcTasxBp*mPI{N>3=)d6P{kx z{71ej@bSuf0zrVtfP={ywgkRW0UVcIpyo&Xt{-N6_ennaGP^6LV}m}68pEE!Y|Wlh zubnn7US0B|p$EvgL=Ho9~DZPiu&JAkui{{n-aI` zyS?##{`|>Pum%q9Dp1FD0;JphELHs~9b`!ZEVsB}HMG;T#>hYK>oI3sFgUUWg06J2 z3)S@8$<--k=dOalCQ&#yHsIEUDVg~I@=G`X%L|CF>^ns{@`{En#g+J#;NJmdn(_bVW5L-6TYfNo-1>-vA2l7#5z~sg+TDFpU(}p{g>@+> z7_zWu1&zumNdE*cWhQcU&^cA@dD{WXL3?eqPMR*#Y;`pMV7+n>mBeG(XBc&Ac_J8> zl(M4#`r>~%3jj9~t&O|7M62QBEM+@4zmITfT{%u4&GP3Kk<5P)Yp zUZ0-sxT?0jMEZ3XkOXSLlNQ69BT&OVD;%o#u~1kVK=tZ0;A_EWM^&tyY& zE|zP^;?xJ86H>7A0e!TEzMYxJ{_ekM+1>njbd@<&N;MDM&NBt9Q4^t|VRo&bZXlZh zpKPKTZkd7@o5+;etZyHc8Ps6qKUiRUt5 zxn~Y#14zqnofM9T&l6mhBOgGrl#o$f1=M^N?SD^tVp+Oe*+m52cXvyIebl+KoArP9 z(Yz-7g*x1C!$E@gQ|dV4pFX zq~41bOmSY-gqBWuEN7*ny6s3#1SjxD3IgBFgl9YQd6r~YSPNbvt+D`dnl|6~V>Vq!fQz8Lt0YDiKe<$>RRA{<9ms!3XxAM*!Fn$f#!H zUHVp*Nskc^NXyji{BNq|(5QTrc>C7i{ZFQ!0!_ulBQM-)0Dn<0eX1ddRn{Ys5qCn6 z!3w}vH%|$F^uIv5xKFqq|Lsebms-@s#^kkc*Omw6cFZg-b=7>oDy56{S5(-*ie7m2 zzs2*h{-Y(#N%2I>qZd_%RKUC;z6MAAp15vjs^yvh$ODr`e#a26{V^eclsH9oe|;R` z8_fBxycd>qqt9nlzmKxO{lAvQ|6FYSI~2Zs`_>|Ri^2TzLVW7t)Uutfb4PxjSzlgl z+gsQ_DJeGH)Ko62vQin|eS7lo`P$(xmW0Gq%U2Hvv`vVUC#ZP+G%Mh6rA$F_UOI7` za7rpF&7^)z@wackFGz}lFGYE?IZMXo4<6x5Y)@3WPERIIcscl3?K`h=ZA-kJ?Uc(O zDE?0`pf{Rwoe!AT4-PXgQM0FRmDdi%`;^7XQ*ljRuyL5tYA$?k9}Vrc`e(zy?c(6) zMJGkH=|4*+;Uj$9W}9u+KcwRJsg4_4)-JL%rK8Rqj{N@X*?53Di|E~n^gPt|B? z+WXU5qW9(Xas+qL47<}03d%o!Aie#ml z#0p_-A74;g>&_a>ld;OjFIf6=5o>C}n%LIZ6k=R zb-jo~+8ydPFa62f-nC?LaX}C8dZB+O2JCB(Z^Bm+3L!O(u2lg)@DKw7H;-Lf`O$1A zwO)$SlkzFA6cM-an4nKSbBAlDWSgc?qT)1T?l6R1%)&FVny^+Mec z{R1}=Xd_&otR)Sg-i=jM%H+X#CIOHE|z+dpg+ zmH2tqL!xLcgaBZOdaok4;ZHrXqJ*S0Hpe4iD=|Ra#N*`r$(bZNV;30}%wL2U=*=+o z*a?CHq(sm7^A18cQfOZfJ4a{$R59)Vz%m3y?S$^BQ(=2Ze4elund(~C{!*JH&fB^g zNV{VGNY#+2uhC7LYH;yCaG`%a`8cL;n_vl7M}CCs=PIYKPq_?M8zmlAxp0eMkOr3f z&ey-82nhX4jn3;~t2XRt*;G3#Lm{IX!O5aRY!$-Qb>KJ`mAss87eONgz&R(sB-~4z z$NCFxLyQ63sABdqvdmgNS6ALTKZ1@2MR2wUCpkGMWoP542x!H7JPb|FQJQySho*{{ zr<_ymZ2k3da_TY2!(c)Zeom=<7i$-#ka@_tz#wXoMsfxzJ3ni?LVGvIv@24mhQmeW zOVEaWY=H6QxezaMbHhZ>D*RH!X2B|z$LBK>L$B;8BJ-<*AHlD9UcXcG=m;8tPO&rT zD^HYSnkraVp6&d(R2Xcg*V(U(VZ8emndYI;wiEZ0n?-U4bXXp%(_=38yJlXB2Df)> zw=212j#=*R?m`x})V4cbjp}RYSebT(*UWy$sxzxpNv5w*m)!bLj=jb)Vevw~=NnM7guc6$)Iv zokW*+XC7X}pE1!cMHeFxy)t5Usg!f1Ureg#+=Qa|w#jrJ%{pT)l2AaZQ7X~WlxlC+ zY~!UGGfyq`F>e%%D$uuu&lu6BnTDXLy2#gBs_6IwY=EJmyT#w!>y^0EO!&%vFp62g zu}y~q+h5OzqnF^Ne&HMU7N}4FduyI(>|NZr)0%p4qTqmD6fdnN_A;;^H}G(|+fQ~{ z(lAG`HZ)H`yM@?v66-T=s~Qi|MyJ=jgRj;x&?1 z8}yLY+8YObceqjJR6!yGjbccbS&zi7O>W6UPcnvFLjQ^_k6!rFqFi>X-6n(LsC(gC4Tz%g>)PN;nNd@o)k*WU zG&>?9ql@8@I2vYas&C(ze||pRd|dV9WucgALOOHkZq`HG;$Elz=-uOx zrt>AjuZa05G02@xr7DiWo3|7=xmgB%PcFvG#7isJO6$i$cym@v6xy-wr~QYYMM|EX z)j!(`z&rr^Z1csL*Ioo{SbL|!1sfaHRF<)9Y#t@HWk$z4w~BBGJua!;^E_S5oq6e5 zS;w$0lvUD79dt0IUOEx9Y+&Msx%hZ4yjNN~WwYIdiMUwU$Wd9kqjUGY%~H)VCI{!=oRj-^y!a>~Yuxs98k5}a zd*2cVOZ}#Y6C#|Jdf7-!4kl|Ac6LvOKT@T6CE7X0!J010%bP`K7%=;f$=!$Zyfm>nV||kfBR%5LF6U5P_AOK&7j0~OykL%zEnFq_(QAI zY6+xM=&lm@>OC(kxI@hNeJ1=`)j~i@W5F$Pnqug4-2eI8DxYTEP*xXevzZk3Mr#BjRO-@h39Hf(vW%pLuxtpxV51aZony~)Q zi>~_iuO(fR9ImpOoQiyYz^D&L&>Vn$pO9zEoL0!Q;aA*#`S-;$Cl^ra2)Y}3^z0w} zZj3@l&0JETBse3RPtHb4QJRhRRq();K3Aujr{8WAejVTIG=g+au)BBQrU2pV*~_>a>e%#g$&j=eBJ|eg_e&kEt*e5%-x<75h7u1> z5S#7T$#1?s(%bEs3Iolkji&vpr?s1wvQ;aewqsk*mQ5xDUFD;u59Vtm<@_6-AH~MT zn@R_tQ3n~qR-oEb6tEFmr^zHnjpe~4a>UQ|KNCflU)9SeN2J7>w^Kyd(WT8b2UwII z90rjd9@bs4K`Yiipb=EDCTmczP_m^BTt!Y7tuB?F^?T#dG1g5$!HRPH!BGLY+2bdN zn+`rFd*whq*;7)#$_58sdGq(*Bvh47S}3&*OmKb$48YJG0C7ADRNQuev=??-3-7vi z=M;1)7|3g*Z$s0sOj;~8k>@)jS7`T6835Pa z(rW`AW*+ZJHsV`GxVd8bNtHUovN(Tf7%gz38f<(jE!XL#jV zE1u|1Z6G!h?NHGVn|K}8Mwa$Bxb@@h7ALgY}%O%guxLM=TU88Jf;}Ztf7< ztwDr@K0}l4+4ae!c{lj3KkfQzDtC2teG$E4AarobV!G<5d9U6!*=1kz9=^VB9@KDX;i^JWohn1K|mg51iV`VL-iu zx=v;A4tN5p0m|0hXtulEK_Lg!+aN9E1^;^^Wy3=4Twk)QYx;qn`^8Ryooau)&%Rnl z5WOaC{VSVlPxhpASoJF*-(x&zF;uIDZ&0KIh(O%*9onFF{ngr)dx>80F=E-wWVOD5 zp0I5T+D;MQQ)u-0?(){t0cWln)h9zgz_+4&zrF+qM2-Yv1`_~k3{U@X!sBYaxr?2M zy*!TM&pn;B(~B;_vzf0_ zTm6yECenOt=f*UDNAuOYTv1T?(Qq-3X(y_URLuU`Oa021jeKfxtZl{5LW&vu_Ue4L zCxu`e1Zxv3mLDnsk8W5??`LH(`~roXKjX7Y#n#*sif5k4I+V1Q>F7Y_$xG`)iZzQ2 zgJB8j=@1fHfvR|IES*fRR*RObD$wd01;#c6?M*?UQ)g%USn&8``cftBM-{1v&*O_aUi#RLf$x`Q0H8=U zxt=7mbV3;jW|IU*3$+JBIVq3(dFss(ORjo{_O1)$!Lm|bSjKEY!<-d5y1&=zrn~7I zHn;Bw8PI(?r>AnO2_(h1Gql_Prx!53Dp*AOhCOqdE@-rcd(Wh^3^MNP;kDHxiru!P zkNm|>3#n3DM--L%_m_|>_3EV+t4>yjT_JpXIC_2a@_goU5(oaz&GhvQmt_jD0@yOa z_w6B$b2JZ>@6MagcYJ($S9gDf@YS_Q8i8H_+GjWgYaI)GC@^4|834%~lDJ-Kc_uvA zxOet<7irG3AwP1RcX(;)-Rm0%b79=F-xqh(2Gp~WlgiY^6XN2B-1?9 zXw0KpZ~y868gMnc&XdlQS&}vyc9lhUx*yMzz=fvWAKw(-Fk<=|I3I+&1kvG1VPCbJ z9VZ&E?+!Ls4N9K&o*bTzX80X2iOy%!yGn1OBN8be2H3;Tk%B-Whq!rpBqN8vBC=Lu z4qA+%9$X5&tdhDKHVKQ9uqB#8nO_dC$@Y9{x8R`fr=x6N5<%ScSLMXdzJbHK^xU~smS*|zN%fNi|ofNjvMUEi*;zZ*@c@A#6G*|hD9AtauW_mamwDS}pD zdZ+b7s+pu5+{ms!bi1w(t&T6s%YG`m#cS6F_SZ7LM zr|FKIk7V_FS^AxKM^jDeqG-ER&^k8KnqYg#ts6mFY-xjJEZf{2HFfP@6r$y>uiq=6 zcl{%Es^f~Wdz^x_0m^MXR4-sXoPF<3KD`pDT*T^ZUPGS&9^HgO ztNbtq3$k2b58S4PLU@mWzAPe4U)gtRY=Lpmuo}=+b-F;KJ%~~(8bmd|5LmeeOr$WN z!{~f{?ZEB8a^uHN-X%Z9B=JF44>ga>83%TO+shn;_VUN8@I}V2AAbn{gUnUuR0ZBA=F2+`( zO9sJgQZ*AWcYoZtJ+9HtEU)$u+hcg#uvAKXQkG)vzy6WWp+dRRr({$97C8_N^cn1O2bJE9i`@WlkL@NzwQQP-*337G2o`VL#tZgfb2 z!kaJ%7CK%f9W^l%Lg91JlZcHNpD7=3Lj#{3EUcBR)F+UGlCjxaQh*Xlgxc-*3J=84P_B#!(dUIWvM*=;k;P z^jeoN5SOb5{C5?sFm|2<_DnJ^LHD9)0b0MeEiercLiW_{9rK2l|B1J_(x@ zeSj@5P+6nW>D3jvv9Wz+pcaaQijwnu>TV^a_NC(n;}xFPKft^f`qehP8lY(-g;{UU zl{xyn>)AbB1Up}G&2)tVS6w^KF1fy@BVYUdWjkBcIbSv*wqnb~Bk6B5k;a!R%Xd%0 z;a%k(!2je0bgav_{DYur>h4u`Ae=&QKzOPpONCjsIhONyJ|HRVH~>)Y3?ID(Ssb2d zi&V(_QFUkKS?drS=kVgQH*k@LlXhJNYxZdrXh^wg!M5LKb&}BP+S`|`m`ZK&B5t=D z#4<-jbd~E@S=obH(mq|ptqiAfC}}+A^}2}YD)I?-)l$`o4jrzlliZLvY~5or5ok3z zC)f{2s?Vs_^%XwdPxKd@n^9ZZ=v0VeR!Xu%Z`Q^`ZN`6D^gRthKZg})%`0OxA-!cy$DA+u;=ga9QddX%E+TbhW2Y&-q^fH4p0PoUU1eHZ9 zZq6-vSsy_yE*P0E!buc%&s)Xe&Ejr;`%fbq_-17+w&CtNj7pr1;$o z<0OVx?W}^3)xGYkne<*y7gaK!`TT9_0*iJ!qN`C z5;5P2`z=?|N>cJULFt!9w8dnC`Kuv|>*bzvM_+yo#?-=iFW(1jvDm|-qdmKTp!oXr zpo88phY1I1!gk&;X)kHsb5eYsG*-1OuNo3dessnm~%I6`2BLOBDeLjShe~{=4wIf~N(>@lV3!Q(U1-wQ}QXek@A0|x$?SiZZ z3JBaOeWxsG&ux;;6UzAp#YS**KrJJP3P=?<* zkLdp1e6g}o$s*MPp&FO%_p2V(3B~ojZ;4+#c20bzC{$K zQu!t>wVQV6Ql;5!dhh*c+@5tg&}yDMu$Wn1uRhF#1!vYHU^CWhM_yx%HUimGThY1g zG@}mhx}c)1$Qeh&)5FYJ*Zyj7SPsA8W~&-qU0BdPKiMZCKWzvb43U^^DuJG;N5s|M;qqLx_494|dtHf(ZpWUq zMWzTr{Z1`?A9LF=8(~v}F-ZcFYRTYp2ng-K)n6tfmVISYMPjzU%bLh35m51=;+3(w zAef$fLwWyZd8ZPszVcu7Y^RGpAWbXSYTn-|USAR|6?o*~$M9@|OJv!ZR>-wsaVZ-% zCKftmL*D%yk8(4edbxnE_X(cC*8A92OfgP8A88^4X3Kvcy{;{bWi2MBW7nIMUHD_s}B`hVS#>#>y zbbl3D9#Q|HIzkA;DCfcuphP-X5O`Cv~E{drvRRvC^uoWNk7>-;N)h+h32e z0DWxz511*znRk4)6J`G7<-&4sYpZ7|p}D}u<5I6Up934a6s#PMd3(CE>o7l&-=6@X zIaYUDrWDobqD0Yhr=Og~mbM8dQ*?PkMhY~$jjbj#D6?WL@wZ)nw@BK}wf7`YCX}m~ z>=Bn7>uN_Ezk{HIATgBqzlk2Gun9f)c*N;FM(F z>F%p(zs|YTTwqgGz=ab1Y$hovCJf01CYNR$N5At+bgVY0XRs-@B|P+q_h%x$bR#cr zw}x;iVlY$Y{|cuJ3;OjQ-8B)+b71MaS2pw59Sic-4!R#lwNni`EvNH?uVf`)g8w1_ zv_xMGwwLjy-;2CKH{g|9r##LPZnx0=wVV{J@=;s@gcoQw;8Klb{o1C)Ws8OfrwYd< z7P$N{9W92prZC`T23R-f51rg<02P>RI$IRH&0>&yw(b7RtUKCWnu%IDbpA7lxUt5c z!W=2R%zTq$U1)o52L|>s>^DXj_pTcbh#}^WM==mJ?of-b!&{Ea7e;w1%U|>7>BZz1E@28$ScHrO;v~GQJ`X}92(78R& z{Z<(-*Q4R>)OVoz)lyX@yWTSQgTi*W7Szjb5L*g-)N+PzhcEq6B{@_S+FNy>TGYH( z<8-zwbG=^Q9_Gd1{`=x=%>mKVTYgcH zf~>yJyL&5qz3+%rU#4&dCg~Zx1!vY?g3s_JvF%Vr5N>LV;ASgJDAos+0oLx%$6vr- z>(GV$4ISApR-TaEubhzroS*D&9&Ddx>T5X_*nenTpR+qX3LL~HW)dU? z^QSsgf1!-OM<@xt%6huTiJt!b;W0z7E+bJiZuk~=K37@V`SAXm&^OW^@yn%@wrxw< z>3cHa9=b~uNzLN#%4?)4H3;$6Ck*y>c*#1Y9thZIh#h}epWwO4B9_wgB?1OS4ymVo zS$M=|U>qp$8Qi|Kj?{v5kBZ7WX*!egPYE6jOZ=x7fUPn1j_bi-K@zHD$faj zqWKux?c`6p2g0;`z1K5MB!Ex(L5CBbN&Gy)iVYpUfYo=R-z=j-ORw&iwzpo~;p)BR zLVVeJxHZFeUYqQ7WJ>8b)!H1*e3toG&04ir%K&s?%8>;J`&2WNYf|sb;C6NUITm&I z{3Lf8r5aC=!bBx^0vu0}`kT7V7Yyh;zpndH*^(CvF39C_OS`k$8{0xJp7Lr2r+Ory zdHYjn#K~EB?}vV< zQ-}RZBPs(^Fb>iWH-ZhTe(OJ-rymZwG*=&9uBfP7{}dZlQIcBZ;30M2mGnk=^!qNiTzt=gR>VE8@o37{^&+`(J*RN9%%SOQfM&Fi3V)db z$U$ey{Kty5$1m=me6r*fS%;ACl#h{Vr zG1Qdy9e3kS3dVB;13G5pod;;MkrK5lgS36gD*Yp&T? zmp>bw2pD}sX_U_v;2;ebJuTBxeG_4j4r$^u=)1v^_Kqd}LyYDAI;;2#E$^A4*Eho}XMm#ah=Q$C&HNaIWKtTd3YquD9i_UIi~MMn`Bs1D zsQ~+pAE~-Yten-y^&;#{+WGMbaT>4vtzL5-KX*g-4TEA%_dP<;!D6kX8MaO9G&OMp zGzo1d*$Rv9`_b0tikZ~k zzK6JdJ6X3c#gK*p1EgBWgVT>vu0tM)XkiRDtW@F>c{41`E`Cg_!c;}96^SlWAiFPF zb05Y*Z!+T7-XdLe%3vw zI+OX&+t=UK=?a^O#u5AyK!aN#WgsPaCHwWSa3E6TxjBI`6<12Mw!;jHPYO<08Paa8 zZMqsADy)y%FUyJ^hAY^$a9@L*x9k+r=jwowjA_R2vgbdc;WfR7I~=-%q(V{htH@H* z+)U^XNckAE;9is@Hba!5!lC*2VKt1OIbXo;UG6z*% zTr&s=qA^V%&tKi>e2l(D$m@ONc>eTCv>i~7%s#@kiv%-V|D4Tjz(8xe-HN~Sz6+Rz z3Ge(3145~OmOmS6(N^On>D!_%VVtm#AGf&8S4MK90A}7n>gm%j%ak~z!Z!oFh!pQ?j3e1OkpdlfG7)E%LsZM?TO|rn!ov=?`6iTQ75^Ne2)v9M*86>n5g}O zppm`TBEw5&%M+bIxZ#DZDa1)#?PjhWRxvBl=7%~m=w|6pol`+z~OdXwwSSyx* zN8|7+ZgI}Vfv0IEsSb7J>16mLShwj;*p2no@lskJ+1Gvjh-$;biC>;Z9vKgu+kIiq zWZvR;-LRr6KAB^J)1#D6LOOKnq z3L;+B7&&1(q&`WAMcSsOrkV=>vfAZgp|{XB@N*)|9lz1)^3~kZJlOh6HDspqqNYs? zh7>8J9jYt$3fh^nPQK32Pxke)rY!-<6VfWfBmI`J@=?mdvV@G3vq$Pct6sO6vnTC{{`S0k_9?+U_cJW>Q9G`_Fv_SeR_ zo5Djy=jh}T%Jd7kuHE=eT80an0@<$b#9(2m>_ue(Jj##At-*Me6oI1-SA#xGmn`s- zueyQ^;`^-yaJh%^M4I+3j&xtXfQknX#Jnz(fO+SP?HbTUC^^i0Pd9Wv_W1m?uC+J) z77qf%#xOtKRMAP-78*a8u%ue^@lip0jAKFUlUHP1NJ=;$2A<$#x&#c|<+k<>qg;(Yf+1x?o~&P=J(-;- zn@pgc3~C&xu(c;ze0u;*Y~QmqcC-nvdR25wM)PO}BMrYFjFnN){`!)<5< zS+MV{r4jC!O!;c?y={e}sp!d(blVAH{rBU8$|=vfCF>tQ;dkJ6wx#gT={~=#WyKpy z;iDzDUHg?1QNkvZU=%?;9G3#8_1F#DHGRSf`MEwdrNLheRKM8YS+~myUouQe5Y3H* z< z+rd*fF+{FPD)N_c?f3V#qHFVSKd5K|y|URAkO52IHRZ9KUJN3kw&lh_GYFTQ%`cvi ze3kZTn*n3}IsoBBP`y5DnZ~7igNQW2M@B~(CL6sE$dd@K78{L%nLIryY}(Tn4fxLU zV$E{Ko-0hIQ@*S7Lage#SmqZX`sIbc^$ine@B9v}TxFwhvsVU%>NU#o^6q4)`>}Cy zNbadhu8ueY%#gvjmwIa3YUuFMQ6^JDXwatIN%b;MsM{fh6QS>k-Cp>+J$GO z01OjwOF|LR&BYI=2?V%%Vknf_YVL8S5|UR`Lf5Ax&Mxf868bI%iA%ulL^Zy9Ura3_ zU3>jLf{lYKExjy2_>l1=$oJDnRFkQw?PNjFHu}k5BbP-Y`3P6=6j+Yn4b`?YoxqUw zvR=amplG;n&)Lk&M$8faKw{oKSgV*u$xcpA>Q?#^2Psxw2Cs(zS)D)##K0+j02q7C z=QeFA>IfO6e~|>#Dhd||M5n~Zo12gqX4QF-xhCG&uOex+xl{QkH2(P06HwTgL0@M2 zGtIFg%hd@B@0{FTn^LF7NT>TNfR?IhvK=_i>Ulf#c9;4=&lHBNwVrRu9i38NnG&n` zWF4%`3frS9>;T-6Vr~cHQ1(5RETT`199d^y`KaG~d_Y4BSPu_#DB?p4!F;X+Qak%u z3rta5RIq3N*g-V-@WOr@xGdjhtw@5bl&~`k(LKk6Il;=9nV6( z?B#0R$-DEa2wAL;-hm|6AR&6Xjf_9WY#6_9uhRxeF+P6t^|&mr_mVuDIP7LI&ch`p zV7yqAi&n zVEt*V97xUNC~&pzJlWY{HU}|b&hLW!j^tCPmJf=vpLD>U+RbN&SB(5f-cP{4M3l^n zKH~JH)CBYko4{Yxg(Q&T8<3)d_clrsL}Ncm)+cazR#Z)NpN=1fsSbmQ($mP=L7$Js zT#(pIut$d_Td8a7r^ap z%eov#A~?|^;qx)Q|@GFg8Upt=in- zTCXFmZE!C5dTQCEWPixq^{Nm{uFplny(+8*taa8m5(Fv@+(`E)y#1znmNk2qH@@F4 zeGbuC+*msLRHvQhx<#`t`uxm-O;QiYGQjY#E(Z+tp3vKY4lWS+C&{;9=AHbV zHb5BjokZuUBjD2tPvr@*cKUuXYJ(S&A4o_VIVZAwe}I*Sy;{rdOUjgcHRK_93J8DO5=!s5cHI2}J}|Z^aVJ>ENoe?o?K0kFf!wm`ECI=YK_NuKWD$m{JGJ|bE{Bx zWBiS_ZAp?IyU_BSEx)LXiOF~J3|{Qyv){Ip)M2df0T0x#r#jEAl^nk zu`&I=oGK`t?Cm9QEewVN3?v`SM@#kyhC1aGJazoV7NNKYG6hYAp)lP^Uq)2 z5V3zDMc~hv%lj4Q1A5VU=Z}FF=mN4AjrK@fEGeCybg5v$Iam#(A6yb09Vg)quQ;Kq z?`=3STg1b5zS-~Pja=>A&JE<L{%Pzyp_aUJae+C$y9TT(p<1^e=OVhme_kVCJKdMUiB|lYKW65F ze92RtVn%7izS&CYql*~a>fGKq_3Z|*CB^p7YOys^M5DtI_8@x!6# z8JeV}wxx-H@4pGtM*Q3N^N)XlH~!-pScOU4cp;>>m^3tW?skM6_ZGF|UZ5=QMs1Lv z1UjKYw7?gaDm8E|TI*jPr9OtMKmRBDnarO_=^aRvKiFaC*3Xn`&;#DCKq5zj z`(o~8`wg|Z>8?A;$hB76^4Uk64=VT+U$9 zc?ZbDNAuJUK;qa0=<_<@0MR}G&~pH4IW(@DkPB!?O+J7o^G{?wnDg5K{tyt4?73^F zSH$urt8nP%PJ>CYrpHOPuzf#G^g03{1=BQ+nm!2Q{ zs2dm<7#fsT`@T^uZq3oAAWx$5ub{H0y9M+MwA?2~?z7kbF$RNFp>mf2VHOm)%vnwx zFK0SX894g$C>6;?(K})4mNRU@{S9XLVMxZcjYMbyhd0F8%5bsk!=xpnny?Fx<3bQ; z{m<$wtGyBD<~w&5lzF**&*ce1H#2*_!4ptg zsh4$M=?uVEAZ(=N5J3R>1wT&KI^XeFtpp@rFJ;u9W*qS$$VX!4 zJ6b?`);f5B@MZ1+)3iY{HQ{Ce*fu;ERafcQHEs4ipNo(l2u`CK8H`F368394K-nI& z-%*(WA`}xG`xzvP)PVe=P(zQ!_|6l*i({4yT8!=3G5Ny(IOqIrUVfZW1Q$y|`zd!X z++4ZIiyoJmEGE(4D^irg{}WjU4kaYSS-{=ohT{wAst4Py83FxonSf|TVc z>@-H=DKs2=0CZWtNGm|h6{Go*lfKk-C9dZxoO$g=v6KCh@7PUJWjIzv#2DnA=#9ta z_+}ZClc2u`Jt@6mxRJ#6$NXj0-tSB6YpZ>UD-H3keUW@TV4nG-9(aOVhUOA&hwO6o z8NdOPec)xIV_QN@OhO(A10$VB^6t8&_v9)d{J7nLYVDH;O1&aj2QZe|PvmoVxqMNGmH zxateSGsS_w72Yp+i!T=mr@CFJCf>`wqY%0ij&+d)15z)=TO2_yA>97DYsncdYFiQS zy^J$OAXvF(h!rPrVm|If-)IKo-raCMUYuINJ4wv%=0a~nfnEom&?yE?;>=e$+RK_K z&Fq#BmMuP1fd?Ul6YC-N41A{7yhZ>FoxdHmDNRiP2JqdG~Et<=uw|zG7 z5F%j2(4a!s8q4pO*HBEo!LscR{z8$Y;d1SV{84~I(tGmc$;Fbk1DyB=M8Ge2@-;&O zQGBuj0pR#&$Qt^e(q4N0b`+B3oO{`{7ZuqDw?03c^E4J)4rACId^8f(fh>M=*a4Tg z&cLHCd(`IOts}_ljFn;Y{EY8$4^o+gn-RZ7= zygfqG@9YN`>4d#Aa?(*}-$Jo^t}r9++Mzqf#ss`NdiLy@IH}u8{GUfV_v^B49LA59%?zRtk!`5=rjeX#|>O zBVQAWmBSI}*`K>DosKEckdwND2-xzYB2#)30>tE=6VDl27W3UYpdaIn+2}^4G24Q2 ze6skYUt0wihygy(JjoU)WgxZsQ(+ZLF5SRGR}bhaKJfkqK5JyZpuu=!l5z#EM}4UF z)mB5xAq;-Bo5!1svBGx;fR2T;%<^N)E!-6EY0IooRzHKPB$QyW$IsO-OY+TYD!fzR zy&lDrU=~IhtRkoS^2$XL9@M=Th)x~WvFvEyfs;IaCx7=e==)w`G-kz$EWo6?2^q37)kU`$#lSaS5y@KHr*=}a zVzp{u0t@sMOk4w}bv0kR@`Ij(nM585n->n%N>OrO%plPJhp{~eVyD{vkLxV&$EQ$` z`a(W5^(c^dzb7KKj=Jv_E;5jFr3+09?^QZs9pe!{Ynibt3u#)4j>3}ijFnogCtF2= znCD>00SI$(Yroqw>a?IEtqxe5Ua&Hdz6&dpn-&K-?MGuu)ZP}Xh$x!aEo8>0c|o}R z4vVdU&+2iy6xopK?+3=y=G%KDJpAOM3UAC~M40DQZa_T1N+c~f z>JObnmmjT^^A8J;RYpljS`DUcBDXuSLhr$WE#*Ue3&{|2qDF>*)`Js`N2_?YNj0b(!= zw>2!`OYK@KPdo();z;d$K}X0=#JcrX)|Uw^*&LL3v)V+yWfkQ&$>k)>3Pq_ z_b}^?pswfo-;vXN6Nl#uu+qz!9j8muYp6c>Ym~sG9zb)RB^HW9N%9nCw0{D&Qx|1; zmc5tE+dp{mx!6J-<`)G$!ZfD)SpII6RVhtA;!>{MMMl2N`n5V=jQB)TQlGhew~&y$ zKl!2FjgOLb0I&IS=V@c%b)p8>gL)rqb_{=DjKwB2#;vkN(QHLL{C0**2yxC0_q>teZ9e^6e%Chy3vbW-+P0ns!V`5SSTy z5$Xq3hL#)E$5*Y-l>O4*DJMP+0Tn`Kll8|QS1j;`ysubQ5wH|SJQ;Y-f_R-?7+v=tD~UCDUf4+L9dX*{0j^jtvHKcjNr)U911T5 z6Yc`V4&V15^NckAc6CKB20kxkIcrOAD9+_Tj_-{KAkN$z7Yy<081RJqxFye_P1j%1 z%SSrYe{04{@|4YE*W9Lzp6&b@{qbsK4{wHP1LS#(fmn8{xfqEb)P9E#uFXezIfi-E z_S#Js9&w&JmfWw^VYZ0DwN*ULzk23<&$}-6lK~em9#K+mysg$B=n4)q7ilEPlsuBb z0m7H;^aX;;i<>U=9TQMe|`P#fEL=fO_L*c}&WP(HpEZB~Kf@9kFpGTo?s(Pr@rt zpGVz7Uzhvx3%n_T_o|7~wi-%M>&D@m!Cz5nj6I3VAIvC4H`RR>=X-WnSBAg-8EGCg z@?KKC-uQBFc0$#|@R<+5yId^#YH9uTDe)yVT2tuLPE}PwooiMd_ms9y-_CNf7rv!F zblWU>)#G^nD{mo`>^j#+F%F^-l0+yzHsaT!Qq9bVACc;M?89EG?f)oQdeb(2JL85R zkV!UxMo=z~mh;%g41^sozwpx=e)<#WSFLmmJ)TEtIZl>7CxQWE9IFSZ%H0E{KbQB% zglWB^!nj%AYgOgPF&3z~VBFH`p!qV;aAF0s>8$_7-tRB| zyg3mo(@IHF2a?ku650Xag>~P~W(U9s&w|Ny?-?ZMO=sTtZ2+B*mwGQVrIQ)Qml{{9 z3?4BtCePcm9qFdanWo*@N8FX9x!yzFvDqg3C8=`Oorv_pZG0bCXKmQnxu^y_Lm}YEJHlU^Xasgv0G7wG>1gy}Ouvl*G zINHt7(2zhVi-~wWLyT~H{i28G--!^A!u!aG_HAB7p32o_xqKh^#c;@n7I7GzY@-LR zMj=B!1s7U^J+WqxnVee@EkmOjj@^HmMRN`=&WlYc(vq4Wx1|6? zpACP%IHnB;%smq6uWLPkK#xm;hNE`Aj3(uR%4Sw8On4|dUq(u&~W$6o<= z+@9h`@D9%Qa8s}D@(+N|f5Keq-c0=dm*MbT}4J6cMD_vZ2_O zpfVpb0!&Rd&Bkoe6*CgKasZ_yhSpDGpZwc}hj=rs3urtZ#v(aZ)|S8PD_4LTeZN-h z<@cX=R9BuSWqQ?C-PbtW4XXt3K%G4RU)I67OSt+RBv3V1eg_^JeC?l0ik88!s4b0& z{}O5<;74EiRx(}_9!Qz0oFL;0x7L66^rRFqtC8?sAapUN;`d5BLJ~gvQLniji!q1} zoL~MRDl6HOAnqGI3f%MvHIh- zoJt|58ZW5E9elMOH7K70fJfoUDV){XpI#!g1^x=v7#{^dP4h=K@8ic_GR$>=D1QZA zaaXxq0l`+=Wu@cqug|1Ca=D=0a+ABjg+2CntvzYJ(}?g&lvic9h}Yp_n|$yz*p-fQ zO)lbf!Zj8a=3dIq{#T$o?`Kxc zqMFk)4Iz$N!I6!|Z>>D;=jh=p*4xSv<^J3L>hdBP+`E4BSqwz)wtw>yiJ_*-SS^dU z&&cmC+BwT>`tH`pt9jnILZ8I(^SJQ3+tvpztwJtA@Gz57&OFtsh|uFiA!s`UZ~s?i zo^Oxk3mSczk>L(!lq)SD37GE=!Oggy<}p=83EonQ_qmq$zGRv2dBcXS@K&FK-@4w{ zy!Cy)9q@)**Th#I)RS2)!D}3Ke$W9MorGWMa{o(<_-KeCeCPIk$x=m}{T#q$-3pf8 zkan=l4swOAKjI^a&L_MJ8wsH^G832^@+i2$=DIha@$0T%fun6MlA)>|PG4?F12doj zw~4I*z{3kTOK$z}@YW)PGo&KgZAMPg(s0dSL7W0PtcZyUz_Js4-^@taAnk{vN%QdrB!k zUqwg0Triu@y~`@(rxyU?4Aj*Oc=`R%+`99kQFx5=G&%gIe1dq}dfd#Df4arC2mhX`F z*PyDH1|2*3$WT^Lr7Kp+8rGyQq?ZU--^IF$J8BevKfOLAZ2FUO?Qm7I1ySEn%g)d1 zSh;~m*WV27<%r&OqQJK@sEX=~&$vA6fb4%7S8Nym%e~Mq3&LvWFP7~W;Zqy$i-A%` zvTl62g7(JPB6-C63Du(_wR9`ZB9&U(C9k%FFPEG$eW|=~<0i8D(ie>=7cR+UpdR}E zCSNxl3{iu5r^LS!{`^C)t$mgC->kVobmS1*be5_$FhE-akJy~y)Wo>y&^j1R`7+z8;*dKcRCEhz-emvj{*=u5td&CQk~#%!o7?Er>|rA z-5DVrR@GJm-Ai&_E;Kw}*F@VS%6Z`)^CT?5w85|2uWnNN#jma6+?UPj!J_xqp1~3~ zt%QQU7mDUmwM;i)>9F|jFR!J<)<-q>DuQBgGuqhBz-&+V0_6?vi+1jkMs|2G!c&d( zR26D23`AU@NsX1f`UnC6S*Y_^-yLas`MQ`gz}Rw+FI*nGuJ-Eoz~_;h4!$?hWk|vi z84zyQy_o`-*$y(+dpM{{Y7MONgs6+DMBP8abxhs5pXJKpN*2Zbvy+NuYV}50DVhUXs+Ug9 zNAgq*Np9Fe=k<`@ACy_YXEir+GcY^m^7Hx!jPc_Did5&t4e*LaxG($}JdM!I{Qt`f zg+f0Wy)^W>OV`=GcJhztA?keYH$VeM@qmUP`=aUhH!B+TfhYNZIgm~#1sd3%ofjyR z@NvI-`3+`1OJFjRde-K1I|LnsD!0>+aMP`v>%i^4(#5;3-W-O%x$tYbK;h6w+DVC{ zEVV+!047lgHvKS(2hO~32ctk_bP6OUQu&%-g?Z2m_Ir7yZCpi~8)PDm&*0Z=dU~iCr zANF}dVUFx_qi0rvd4tb?W&wB)=HqZ$9Qu85o_#aLpEB_8BCz8Q#FM8| zo>qbpAvh|Rm6hcMfw{eqY67{LzniYM%P2dRoI8^L?1E}Fiqw^l3U{IMSHoi+I>b+a z-BASeX=T5JN~*~>rRP+nK+xbY80<2&v1HBZFYkB5HI(Rt&C`8Ix8GK0qC^d^N>i}G ze*NBqV-`9y4Ky9*U8t9+XS0bszb+~XIjN)_wtU4|8>X4^hQ4YbfB!Un)IG*fQNgblrJklGGM2+flJqg z7u{vaJ2uFt)dkz)?B)D4U|*_tY1jqsY{fYQ&exI{l5a9Zq)-q8Y z(9Y=rzNCRO(g7=Cz*4mWXa%i=78*wDK}q=+@`Y&C20ndFIVT~X=vX}@_-c@^M;8#2 z4CqD%-r)VCXlLK>gv$6H}q`Y~8qq^<0+dneF|E<0g&2z8b#v(FV9N zYQWH^LVWPTg7Pfia{wUXgN}Vvd9L0R8b_dRR~73A{KL-X&ZQ`XWTDU$2X{Mn&YQN_ z&UT&K5ob77>x;}4;L{JoMZ|@2%D1lay;_Gz)lHjWi2<}>`QZxcrKxNK8IO~hib%Jv zxvwS&RO$jInHJ*oN(C&WrWl{G*;@0jvHiYvQ`mQY)WzL2Yd;24$ zx$76-dbP6fV@R=i_QufxX60PCd)ss2jrEO}K^(G_WxNyov%te7Qdag|SdqHz3*V4A zCj7?>iX&y=dHVw9#W*&4McnPUkL5Q2c&Je2zV{H770m)R6DECPYgSJSyTF;H=}A>P>LeE`_B!Giu78Iz z*ehoO^h-*AlmhHuU~>i7AMR#3z^#D&4*VUoH=j|ajnF4IlfW-WETPwq_WbBjPoeII zOGl?iD?L5P764W?Lt#ZKZ0Zry`qL4L_3`HBM)<2OsFintoi0ChpF-AZ&n#$vt>t{q zfbIp}2AUg;gPOXh5hBUg&uY)vqpK!jFbKmn|2Plmqwc(4Q3o;-H`4Gy4YLVs$fsuE zh~^q^znOMa`mOuiZ`BBKWsUO}msaNZjG?GlxLpE7EQQm#%Nnd21&VCkU0n5q7}~7+ z+IjU&O)ml%r31_mWyG8AFX#GxI|x=)_wDZv?hEy$v-}*so!|X-;0F%OBM!#?Zl*Ty z$Wu8$pOT#m>qiAZc#-7uJZPnjpX9bNhpPxK$H>EY$LavhjW$K0cRwm>H(Rf-2z}uE zuEQ=K1c!>o51ibV(_VtEH4$4R+V}rhK(b!MDi4DRiarsdQlNdp{oQ%X(G7=s&%<*= znw=Zd(}cU|@uIIz3zFaO@7{S`fATax+2ngB@mW+CI$Ngmr65wvMn|8Blk_FZj4)F3 zZ$&7YY9!BhFRiswq_Sh+Iwj%v@XlWA`SV)xV1qGRg;tC08uN`L;#(G4{kolq>XQa)JQ%OKwetxLA`+`hjc|a>SY2m zM`S(5+7#(N!z_#BR@`U9Cba4q{4ACnFEdUMeQK*Gc|HZ% z8T#mkUU5d5g_m|!_>LL| zmOTu44cgV>wF^LgnpW9a287W30DyL3^anUd>7ILm-HcyyQ8lUnyL-x+YSq(=zBT{N zX9j=eLnL_8Q<>!;t71^|X*iRa0a9L_K6eazG7Qy=p za373iS`<$y6v~x+PB!DqVTH@a4vMiA1$V%0B?2g9+2gZULnc`Vj(!5R-vmG6>~TNr z=rYj?O3#)|e2IrV58RFT)BtE0KonZPM$O1B_Qx1xw{9`v8piu3pxrB@O7v|2RsqxM zOi9dnu@xSGjbv8arb5;BZx^v6A91&;=P3C-B#>zV|jj-zB~ZIZ%F zDDM)I=1C9BLOs}T8E&sLoxYP_q$d-V)7p06H*Cx2IpD`7&F~QQ=en?#uo}_r@`&U zrNhI#Bl;(vV9RQ@%7>?HAtZ@x9d#6Pv_DO-6?l<|BM^|EYSHjpD4G~v0wlbk4Oenx zdNte`O}3LwzABI))4d{a0)8jRy&MK*VIS-S&}PcYH+_-5h3mFAjD@ZY_vygYIw2EL zutneIeMkZ-hu;f2EhjKU=^JIEr4TSbK`8ZU_hqk$pYAV|9bhr7=pFc?f7)2S6~0&+ z@ff2q3>O4F>>faeQgYv_vkm&M9JG7bpA%E!2f9YKN+k!D)$-bPqsDLPz7KABG8Ibl z-|&IE?{z4#z?fk zKebx2`EO0ck(i>Dn$&!N@926r>Hv1idG+`c_7fha=cR*KiI^5!Am^B@TzU&gRq6AL zf!)yKrQU1Q`cNtG-`B7r-8{4^ySD#OGjLNP%rvE?v%#WstaFK_#4OuR!=UjUW7J={ z^m&}>iX9KsU8ZUBv*Gic{7s5EA9uVnXx|wxTRbMW6$L(Tx+qSbh|(HuKy5F$(8<8D zv&?vCg&$1ll?DCbOrl9hAr#DXQk?VJt{JosTZI_y@rAd*SissOo4v$B&aS9Vi+b-xs#tM~F3uw48Xtnf;c!<#g^%_ea>aFvz4TXLJ74`!m-=Xh-Lkcw3u8_v` zzWDv$Ny0&#aTd%m3m3gDC@?_|1x*x}UZJ-B8)ym70WLT--W4}7u9e%COp4|#TuS!v zeL;?|5$uY2r%jCM|M!kc4nRnhHa|MgN)^@J(kZzh8{kf6sS16d=xl+c$?msYC2nWI6(zkR6L3BW z%qcq$7eaduAq;PKW+<*Y{~n)pjMar!f@0c|L4n%Wv?lz-M4X>U5HVW8SeEcNl_!E` z$)bM-9~H}&ra>Rs(9eUsIWjmBZqnBgN&X#rl-d6bHg*}W;})hh`W~pj+g$IHwe{I1 z$!`w;e(SYeQk)Rer9aGTVnN7tv++bS5f|$x0BKnu)kDwFH*EiV1n5U6JZ(lG28)ZD zRQz#6&uG#08s{h0YQNrW>gc_$1CtMo#$hL^3vbR1x2;P!rd?~`Ctn}s;&&(4BrD{J&{qJ>gL_HSuk4i;S==EwAYZVz57MgTpOPz{Wsvizt}+ObIH-zxvoKfrmeNkjmoU53-CvknE)KUX6de6&i7&G$bgxIKyv= zvT6Uo5WEA4ku>uUbZ-%JW=GmZ>i+!_P#ax)0aSN6r|BS4f!d26ykQ>v%&ebCxQF21 zX_Oga&G?5f47}E&aUqW(DVj&GQ76S&}UaM5= zFujzkpfbjhlhp0NMk?^9N42ivr-k~EHw5ftv<0CTCsTlSB^vO9%&NF4$}OQeCx#v& zk{=CDWbu^7fUIMJR7OL#po${2=j|O87r6G4s1ffZ1D^6>V-=qtB z^nsg9pZ}wwMhV2kTdb3YM~hR(7(7%+Qr55z93tD%b8vSX|J4lu9WD#KYw~k#rA%Eu z4YNbJELTDb(~}ooOCjc9>Ps<2f%A#)O0*CX$BPrDEOWm0n67$-I3jEkx{pT>GflNr zs6AFLX8(N#eYC*xxo%_jTZCIOi*1-P*CapYBnNRe{uQ4ftej($ow!`4`t^jeQI)b% zxSVAnW~0nW43!A~JZQQTwie(1EAYV^8Q8B7aGrzvP^_~U8Lc~m!;z?rvrgWjW=#GF zbjZan;!DX!15>3feG^kx7Qdapky%s*AAw(@&iJt)K+&>Q(Ok|;_7ET4)LVQ?3_B$b zpoAjA3F@-mHSWS!2Y^lKJH~iJms)L^oj{=#dxBBV)wubgWFDKW&3tq8eTfT8b6eE^ z3!8o<#FEjoYR2rdOu;u_e_2JMlIYUL2f^r?nUV@~KNu+X)y===0LGCt;GF2}f>NP! zMDn^5;8@hUegtX;CoF!-VOp)WZK$MCM&Di+67$w0T>%G?1kq-e0z!Xsa4Ym-=z798 zgtQWV91(*;R21IAz3{yMK~Rm3vfw;-I1;x-2K;SOtq^(EKp%(m8SKT>R%`a3*mh*Q z?px!9HnoNA(huy_$~E=urh(R37o2-d>eY0${u7QLu{ck4i$(%2!99pkZbf$ZUU1qu zD?t$&v;&G5k?E{puL8uM0HS7#FPW_d=NA4K5uxL?G~A@5r3Yy3Em8O+#YwD6hKnr0 zy96xJXle=3(`R6VJCy^7+67ErF(RE7Wxk96c07!bGT@eHL8Vn6yU!*0AeGEvf0FldTTy~H~M)5Xh2J1X`6px=0dyU67b{j#1Ew_GM3?2@0H=z zuSR;d@1P8*KWxWBZckow0#%vf?H{cwr>}X~Jj|TcGHJfIfNRrNDOSOwiI#q$K%2_K z#Mn~&^>iU{#|ecUGcZHZ+;Kh<_yN7qPyTf1&aBCCgQ$Po$IvRxNjYlbjr;(!l9l+} ztc&)6f0?eSD>s|Ap~vK^TP=)2sD!s^vdQznL>d#OTZ~I3%!_mKk@TE`K=8nfe6zfI zIO9V?58%?q7scidQ{k%%E({4Iz08qdvNEg+uRP-{@Tk2|@pLy^1CmW~2#{R*elm7a zvXzOeP}%e;l%cr;w0tK(n@B*Qf@>89Q*KHr%1dX~Og|D=QkmqPl!@?TF8Mqz`d0QT zH~}~H;vTPZU9=@uWIanFW5ubG%WOxK^6!3X?F4sfHW{Arb77Gy8tAL+##j>)TC~t!b52@I_aj^Z?=wtESjTA` zrc1^4&@7{L0X@0eswJp?;1|ZRd|puzGn?Xqyg$NakHrd=+hF{D>Q$s9im9#mord0n zx44_#Z-#fU&LK*O@82t=OZ^`Ucnt_ilvUpI?H@-SmO@-O-I4Mx3XOyjd#=>>!kiA?Ob zs4qOV%HC@!)z;c9V>o8xhJxI&<+^@ik0 zEFQ$S46JjN80~+54FA+B=twns7;vF5RVEalicoLMab!d*xHW0~vNt*d? z<-cz^z;Fn7&Pnzs_tL+IaY}05P~M_bLYFeL?ob|5FukfX!(3@;u2UGw0&!$4GOYm$xq)zm|$uuJ*wp||30?N6gV^qK;>kAg`G zl$bnarR)7rN)B_B3=BkDnU0P{EB&fu=3#UFKj|q|nW8wW)+sEVHm~N>%;&C@?Nner z0{>1V|C2mF8jU(fp4y1GxN_gL9M>1GtEwga60Uo;ymQp-QS@1mJ}1K$$z&Vj&`;2O zgWRkr-3nW~>)7wnDG{!tEecqc6GG=p)ffaENHm@TzjaYDcY5!)(BL+R+_=iifcceyKz-{OrQKFuhDP)gWCk`{OMB-=*%2vWYw@lTl$y@U!NCiY3A7 z`zGi*7Gtyg?DQjKHoVuB)mPxoqq^=$G@+_-vjcPATVQl zd+}DLRDAe-{BuX*G1a245j~qw3k*eQ(IKb(2-@Qd9`gzY;`XX~P0{fHNOuv{uRJ$U zQMAG2+VR^tp3th&$pCNNo&xT)LH+?wTiMU<`Mo@75%7m2T1<|;p4TQx%L2DBdVTy~ zEo5?xF3`_}g;IC!U@Jt^9fC#5z z$8fe-u`BJ9>Oi%|u~yP8NV#RNEbIm-9gYA7i!${nSRn4H9*XsAv*d_<)~WP||eS4IpW1!KDQsu8SP_ z@#u-)kECkZooafkX!F~KtDQuu=oTUTt%qPJUI%YL9bs1X>1#x-&b_Qd-LKC_Cxj!U zbD!k~d<{zByQURGixt2Y94Bphd*H#0Bto)H!?B?yq?09oOdxofl=xT0l30rs#K8GT z>Uy`@q;(=qoO!6$-E)-i5_qx_KsebZ-@SIB0hY>2TTDa)nGUVdlQ`365XO@CoK!FW z>x%*cv~0eBF5s*H=M6%cAiV2wpR50}70X3@0&qePGtgq;T{&VXl{ouDnG{2u!=|%e z&9J2yxb{t`D}`KZLVr%2x5bLT!zOR1+d?S$ov#qPu%>}X!d_{* zuZySa8*o1tCzds~k%{dH zeVpIZqAB8jk4Vz&yPLCXAvSy{x}lOiRBi=Bw03rONc;jXiiS@oh!T_DRxTPix1l1_ zyf5$ui~|AR0G57)#=3C=!R0lOhO(%ZAbV_2mg&$(7RpFyE)soL40_HUvM39l_JgAsx`-q9_!j$ng=D`RT2e&7aDwV2!l~nWC!Kh#Cbl!W)GIB^u1P zr{Gf(1Jg-m=i$}dg4G}*SCsb$A&jOn_{XQ<+Qqr5u~`}c6?EET1a)T0Ertd<;_dE+ z!ejirZ!78aSvp2IGezCv9697LO+&&V(v<$$gOPPVE8WpGJ29rIz5(}o;=+~2RWpre9G*|32 zxKX?u>v4kMvsM14yqrz!aQMk&**m=NcU9bGV4Gw>RauMlrF{>0fPsnDM`@P$F$AbrVlJg)(-U>yo?uI3Ef{b9hzAPDLylpAk>nM3 z#r#Al^!9P*CK#fk1lo>RuCLSde&E&Wesch=JR=<6?nsI zvKCZ30%ZOPytK`9bBgLz&Xl|+2*qrB;(rDS9fq0M=IkFDe+~gF<^fqep!q9bY`MR6 z62IEaKLRrkPrv@cH9akS`8qe11xfFB3z!-xJj=3Y9^h}u2C>GQ= zf-eDCA(xc{KE2CUVQM$s0^OKnfK}DIiFt{`R^%ffd@FtxThX1mNc8^~yeJ0Y7VF>%LuhQ2 zkg*TTyw~j~FTmQq{T^0PQv7POhJp8%O|?i(Ds=cgHpE0D=;?q%^-xL;&8Qr}u}h~v-1*W{^y;7>Q4Mnyya4K} z?Lau4i-E@Z)y8dGIbFMWsEmotv;t_sSdcVei+GuWl0KnqGFZM!sB@#pu;e?^Wg_EJ zcr(daGb;0BA;vBt;V!E#c$DS?i)3FLUYQoBpWe_o!Bzd>GGwvAQigrlwkJ*aH86HX zLOM0RztYJ9N_Q7P(e}Uxjp{|{sbwf4AvVuY4C>)Wf&g(XiP?g@j-mNQu#{yqs3fcW z#I;}QLl#3)nF2U*3iv2Q-EA_KO#4KG@{sBj4+B0c#mN$S6ytjRO(Xp| z>H`wh7&kRjc>!JUQgM_F>x_{S%# z-b>bJfKLB1=Y=KZqkBUjFXAX|(8Vktuz>5YV8KCr*DYL^#DWA{A|H!c7DOG8_Wiib zl3+OvKC@94utjz0V@fS}Ks6)ZD>6f!BT&1nd!FHwlJZ0v=9gzoctJE$&RQwiO&`mk zf7C4ewLlSCz~0iNQqb1m0XZ||>uwsg;5?-Gmc zRylIkY`*Oqk35foDK@=ouqiI>Wh1@&4_kRkuTeApaw{^lAHso(sI*l`Y7Y~vFi{fa z8I3DRHx~X(SsJTF=KktnUgFiX>ARW|lps;xxEz;ma$9lHK^jUVQ4ulC{!e67tbxt^WcNEaIHjZ%j2n-;6!?j;D)zhj5)*!NH+p{C{+tQEk3ghqa*ad(ZK3>4bv}yIde)V zlLqlnp(;W69*pQBBM}e04%1`~u=!F^-b4DhEX8KT=4U~B6U|m{&{^!OxU*kxv@g$| zi_-*q-p$>8eL>~b>sPsxBi3you@Oe&f5GN=F@UEVr5mE9CBzb&MXQlvxG64<$;#v~TY@ zKkNMR|FHnL-!$BRm5E323sD1k3mJZ*L_s&$pSecM_1&c@5964a_=9|K9t2^e`199? zCM6SrnNy!*nt}1rUVp~5mfHmkqF96$IzK7=mtgP}s?R+<<_b-sMB`jjIE;t>*1Ko> zAy11cU|`QcW{i|-_wctMl3x3DR40Ai75`YVNMhqA+ZX&{F2LNq@Ge5Ia(2dU=aI|3Qp=BnW5?@sx7MDW+ z+6)3*`&D_6bc?tvI|*zLV?5e`ZiE#3qHvjl70?dp`#{OW==`u1OKhNZ+A!^g@u|Fp z+L!M?GN`i|yWn_0FV;;!JSnBTiB0#?fAB?#CynzT$sCpESl`0aGmX%5R2q;$GsV|w!Z>0$9R165jI#S(~ZSnIS#wRfkxahU5XM%8&PjinCKw*HR_-uwhhi*^nEUP{z zA*Iul36&6MznVRNq&pTq2~R#Ee(E58Kge+etT4MkvYQdVw}|l+*2s4P+3z=kq9fBH zm$TV3P7cr(i3K?Fu}7ytD9{%|dq7-6N%fl=bIow&Y9?LfQ*79m7pMS2+v*8b2HG(* zcQ6lQ*aGlJ+e@)k2AGPacRDlm-5T5$ZYFTOH4r&b06xr~dHk{jji(HK0Eb+>f*kwm z!w6trvN`Q+u zYf|wkI6p~%sn=yd>qY}1fxz@)j8{Qr5-wuS0Dv4RF2;+rwCP7ZrE`?KPKgWb?U7zi zTmtj)NPviQ>H&{9;AUM?d(1Qo6Gchu3}pQVoM4xMZY&DUoal8+fuY2<_4FDkafTW4 zlEdHYjqVhU1uzC$wr^$Yc$elS$~*(d9;5Q!$z*`=@ z4+%L;7N84JksgOatCb4nh?f(O;l8!_-#~HZHI8GS4j(GS1p>WRp&Tt=S(TiE79f9E z20a&a%G^P;7AO*Z8VF2Y!0}^z#2E#~NLJz*T1By0G;u(N+wxU$W%n;%P2XTh zOM8H-`|j|a6rQ`b~Gg24afMyGcpV-k` zXVHcY2TA2*n6HP*WlGPwE1V^VEN=Fq)|y}Bhcrxd?XvJMm+%*^V10zLSqI{?DSY<7 zDer#!NgeJ6*I^tJ%0OXO+xppXhU+0-Fy1Fp#FU~hHRI55t%8*M%Mt&#YsIjYUUf93 z=K9=MGq#nWG(ityH5#Ua;fd{5nBYUH&Z{_n91&MHl&a_VD2*7x~3uZ zU>T6lQD8^Wyq7R^v~akB!oJTmg;xfu+_f=j;K6h4`^h8-Los9_el=ffp6u}jFJ%}l zo8H0LXI>@bXFc&u>rMNO_BUJV{+Pa`F@R>cVdFxoIaf&n2`#tAub*v@kH+#T>FTSp z=RZD_(d49V3$tH^bL}U)zaFVtKJJ^&a*fF1_l4TYS=; zJR?ovaZld$#f*R?Mm&Ch6BS7Y&`}zrT^}wfpiD^!oq!w|JkTm|I-VhM1m0(PWMdmrI8Q3(mCA=2Y z4;*AP?j5!X#k-`(#wVND1BalkNOREUnV|BK-hQ{06cG=x^I|g{9o{h*GPnOhAkXRJ zlHA%&0YsQDTwQ31bB$%!L_oTF>p|*5hNS_$Nk0TV2O{%gYTCG@Kp!bt@IjUP#or9z|& zpf6?nceYeYqx&Y5_>Qu*g8`ZnTv2LZnfyF~!Ha^`7sSvZ;1Kf|cWLXvGF+?{`;N5~ z^?|laF9Hi8<@btmv@gVHGh)c!?x>e#-~gx}!ohte22Uq3`GK#fuJq&~oqOdlt>kM} zu8~GlJ>TO{hZIbYE_UJ_J~X0)ZRVo}hz$`Ew#{YsQb#?o1~Fwb#s)`&8pBT@(ount z2^MZWh^9$Z={pNLY-Hn-nx>0K!53+!q2x$d&wEP_i=P5j($ynDyI_q%snztQ<&e90 z!Iq~)_VuGAkuLYQ=f!D^cHL#yq#b{%H&N8gK}_5L=#~DW-xi!21Kgw( zuulKI+W+>j+;CY>i5(My;daHzOg(Fz?39}V>mnUMJc&;7M)eP<@)B#CuR3N zefD&L##aXf55+uG&`4h@L|#2|WBkiGJf%0`ucfESOn!-t)Z7aTnk7G2;$V6iomz9M2>k4p`Xgmj-t&!r$&xe&p z_y|A8H~!2blu~{-e1T*xa=&nQR=1j#aWnP~u~VMXkqF2>EEmf&n(Id@b>EBkeg>j< zNmlf?DXBj|cPm<<#za%%q8s0xK)1L8%9S4ry-!IEiFBFG5QoNG4cqgxoELx5!nHG; zpt97wJ%Wb33KR@}l@AV9B@nrwazCqBemAXa|EU%Z1Vg7{YwSAoY!euFz|@lNo}e++lxODnr4qfsd%FUNkX$?9+mIDt z^Pb1A=a&V-Na)5SkmIZprg>(7ku7mG(XE1MxcS?>_lD|0V5h91k}WLo58(7vFBaLi zqaF=o%*YmG&DienyDaqm5m}9sMH0dTb3cB*0;^@yuGjaGclVN9+^q2@O*a!4AZ4%n zit4za>DhUo58bMeJQds? zjeq?D^dvvz&|KoyVIj@&>-`It6oIy~dCa-keKa>MyO7@GZ=u?w7>^N=65c+cM`4kC z+Lw^J2Wrkohmal*b7Ldije`)pGl~YhyxJ}jg<69S^|#GQE=%H zko5mq>NFT@BINV=Y3Nx`ZPbRW9-R3unAdLZ>N34;a=Vu{IK$H6cxF)ZD+ zGw=-mTb22o8^)NPRXUT6a^;CAm^BIdN(7#axFN4FS&HDVB=NJM6ZbwgTlPvNG(oKG zq8{N)DT?f4q`=w4(w08<0e+4-ChMOsMcT2iHT`F|7K@evC#LFO4cPnVm~xaYdqvzo zFIA;LAzH~!%-rIgB3=gPP*iW=<#wMT!5%4hCT+Lv&#JFwe!q3jGnzRCww&G@IQQnL zuS&t*8zv@UGXr1t%wCcCfy@{3vDAd--O=IO8E+RRnnmx7(F1qS+ud3vD9UKbq>k=d z7w8GA$`A9uStg@M##TS}sIpDaEIAajO&H7yhuF}gBn_-B47k?r*%MmsIAlBsGG?%t_uWxCdig`i#Ppw@+^ z5m#z)3JyvUko1;ew@#ODhcUz`4h*XSXF_2xg7DVTVzV6!^=SH|C4lWQQ{;dP#7_9? zDie(>VdNMor(Dgey_saQrL*8s#DU6{%?+Y5 zbWfL%bZ<9<3{i=&RzX}xsqd6pq1NalYOwPNlYY z)`JjGGN~1gQ!z+2lAyj|mI<(aYvSGC-2gB865nI|kE^qei)!uOKF!cwQZsZ6jkI(P z?N9?E(x{+>pn!CD3^0hKI)Dfwr2--)jf5kDfzncnfN%(j_uii8dEejr`}cf~jx&4j zd#`n^>-sKt{-bl7^8$1nI%fw1TCtr*pPl=!?&{!6#NJ$Mfiu*)&H`6Y3naY)BR;hq zpP8PWg&Wy@R^rd~^T5_uBh$eoqq&bhy3weXuY2${usM&PV}78Tpp^s6m|QoX zPLT81{e~_br);AtHL2k_$@o8gz_E(uJ7h5JhpQrt5T*^E9RcAhS1|k>YUg{!97toP zL;t>Qz>HCsQdO6+Omzl>gcxDQ5y>)ei+0IyE4;*FeMoj7lky@kG@C3*YF(~g}H<#v3-1r zF8e9YQth*nQ<1EzzPfIOaK#HN^ntZ1(Ed*-?LvL^_mZ@Z5l@%qTAjgR57uMc5vh@; zXv(*)S$m(?W<3l1>xi2GB-&-KdLoxgeaW}Mz_-4eqI;I&f9ThB=wTDf*p)tx7(D{BYXK?~E-fFxGs zp`v@#7O+vqQi?jMM>~6~c?_U&KO65;5|?_u`sb(Hp#7DB?mv9IU{#ubeHaO$Ocoz% za=Y$*n)b~w1^+NXD{=7kNez{B<_$u@ccW4J&Ln7vAHBjUtAixCATpj7;Pc1=iFb%c z*lNu`b&+pKIS+4}4)oh9yp`1pD=eVChVD5oz~kLP`YqP8z&AX)Ptwi>xgx6NtPNLh zNE{VKZ3_oDHd}R?@rA8E@Hj~w7ueG71de6tpOL1C=*1n844_`d3`0NOrTY4T`+ROO z#Pqp(2UZm)<%w94FSrCPwuERrUdFU!dt@{)s=B^3AI!uLk_u+i8$smv?$ z)r2oF4S=*mS2Ln(mTRgU0FY>$(&WB%ZIO|(I+5!XyX6m?sLm8L1PGt{eHz>Wpb6M# zkDbSt)TWKU-YvexFyCHhY~rp(dlgfXyv+YI;;TyV_)wgG=H9RA&VmHXwMh4#jg{`b zrCqpX5964^yjt#$Z+V%0{YB`o*|JEo5DKi@c3g$(-v<7dFfiY1nwl3mI&UYNK#w4O+g zlsT{XF^G`ej=b~6oVYM-i-=lERQeOFS&^hs|@qpSw*=tqY64 zeuaASv<=_oShU~U_UrOV5%0 z;&GaDPLzX1-7;Hmm?qPg-1L_H2mTf0WOJ@#mkW4XQAMNQSTOav*^SufKf#Osqs(Wu z47t5en;-by?!0;Y!wDToPIPE;%GmCJxh*6(Hk8!3X4GPTrNy$?Ea_<8iN%nQr*%vp zeeRJi*(1umK6r9qiuJxRm+|eats$x-D|Uj_%uvPt>q-M{iDMBkO<3Hj?0cyi=tD36 zTy;07)UbSraqyf7?yVk=+dRr!9*_g0F(89O`My?|+`?x-K>UnEw9&YShQ!njAr75< zRTaqW>TEnFh7TAGx^oIK&V2RP`*?{*q`109!JJE+A0>XJ+TTo>`_Q07h`f#h?hCo; zCslLlO#j^Z=t^l}t-99xH>nV#K|*MLseZV0dgVLl+E+}=2DNVkiHw1weYf!7r2sjwAUpV{Eai-K03?z=9qF6F#pnqI$)<1x_ z(+kYP9O?G*gshcxZ85K#r1yTfJ)^QC$d@AU-Af4nR6rVmiP4=k;@O$IdX1RuxM3;dQGkEqg$lkuYL`i}r zjL63eYZ?nzjFprKHc&)>VV||Av0kE?&(jKBRYI?kGxNO&&**-6j@t#x$>e0*X0CK1 zYy{ctituXx(ZgmFJC0+Bm+j=@1{pidm8As+gv6M7-% z`+GwP4If;?d;U4E#M9J#_FZnU2+XA&Xb;tA_}QzP<|g^S;{!P{1S9!($$l;roACtu z-*wS07lhel1>O?cn6i&+CD*7-6U_TC^TAHDj~1h&HhDWQUEkKXut8sN%&lv#o=g%x zGDGWFEGWgX9)@ zXdc=g!`mx;qTz~7_JR@@FfeFfC&oT%)+7_Epr<~oMn3hvon?{EWl52WY^sV|y8mZz z_aU5ZSct#cUz#nm-58FZcVvEt&BPMqzTWGX*{zBbQYAH5AD|Ug#{_EKGU#d?GhBf$C@ zCo8RQq+-S08YhCJwns+Q(R8km#eJ9|ru4#Hihg47+*_>0_7B68=(d2%sn_ zz;{mBD`>jE0*3nf$L}_$65{^37l67ATqECUV77J?NZ^Uk(Gn7W`Z#VWzSx6Q+>TDW zO;^qBDM}5dYm6~=s+IoqK30>i#`YgzdQ~cY6U&lj33EQW5EL8jxhGIW@@OAyRm_D= zLSr=lI6Y@bQnmUH^pLXkSarsK+O&<5381Og%;}s=(m-IZfXmmV%O>y}1hdRmRuODR z>_MJ!$gS?@+>46HFuC3C)Y}gd*iE>Xbg11~A?m1kMxS9q`Nu<1C4H& z=u4ZCl1u+(BB9^F#*!N(JOkwpw_$mCW>U^l1BxW0S}v-O!#hj4mQ#-So4|)Y)JJrBxmyo? zL#^yTW4$kW+Gqi*H4aQ>GQaH+BWg&VjiwMd{Y2?HR=IOb^u^y75sSqI9v5^1>vXjQ zEw16M=g@Nd@3Eq-?7W_1aLKhp1-kAcJV~#|o@5)fNgb76b!S3qIz*1CvR5)@ z6;In+peOiDO>Ri9m|fpCa}d@!x9OS><^RYG<)C<#wzM0M9{1QVNwUE|1LaQ1hAD zg+rTvJ^c&#^PuI~snFLx*3HD8rApRuf-nKbe{=~RUyav4dMN5S7f95I3)$V~dLgb5 z^_-R@b-L~zxxG$SDdxD>PaIbpoFM!IQ%-QsrJ(V! z`#4`mTSK_{wXNc|dVy#;{K}_Cv7;mi_6DnpUjn@Dyv84DI|Z~*#I2^BVRGN!%u2AA zf$?KteJ8oJbE7}Z3F!)6O@H*`x)A*!?4NxmuJ27j*=*Sv9?OtTTG}8%xTXEg$%4$ zYG2KvGm+6BvR)XLuL08&4v7pHpib7|j-U~iz50eEc~psWmyl#*Z!bE+(KBMZO8Sl^ zf~y=Fgj}nCTb|pI9a*X)uen?Ah-K~l*Vzao+p)QRwY~Dm1@5RfN$fh&N(C_KBe>G{gqB`TAwe~SzQR18U1j=8eFxqb zRV`JOG5$H|TF-^*iCG;@dLYuYGIznqcN9lB1lSj_?FgkcL9oz?0iT)os)t&VY}=ok z<&eSifwJlGO7X2R$Qws$Pnlhnmz#w>U92jKOs0GJF+8nkm4RZC?G69VXb`c{5pwX- zx;`)B25R7Yj;|Z71!J{K8ecr3*2*K@^z!Pj7E!iR$`u?zpsR^XAZ-`w}H+@p=&#{(N*x7qi(-%Rko9 zRA>uBsnv-!F_fr=Z8vuNil2Uil#J$X_F&h4atcT<&E$QGYf}5`(v#PZ<_JAvqqvC_ z^a#u$=G*6N+3p$tZgvptJ~12-ANjcWNu1_tLcQZ6kT}eys(ioaBwRFFANVdzYuIXe zGE&Vq_17w5bq!X(%PYY6dfUiE-O1YejptL@x>z&(XntP5XR-T*6xq6zZGHj^zb+$< zmC~gicp@7MXV#o|KHa0$+^YjQ+bC`g7hY4f;r*+Vo#`pF~D86S9 zV8!kL2PD0*UBB~zW#1if{k3yGwM>k?yJgwMb1`V-fOq=gpV>3b`sRvEbhj2VQO;K) z7 zjLpnl{#E!vL?H^2i|bhzqDkptV{2Q2XAia?y&o=n@iA(6e7D?szzue?oizMI@JQjn zlY-4u0BPIMTd|loqy6$@+^v7@lhoSL9kG##9q}CrLn^f%oI(#Z;~b7B8W1p2%_GE- zQ2Z8-b=Q!A;v22VHY#acHGD}fyW-|*(w@}m>SJ!4*33wc%6Ko7ZW-o|xj%PBXMoB( z!6)h^EeXb0R~D^?D`pHU7DT)9#GaRsB!TASEns4Sox3je1(|x9bkMxUSa87n)h$hm zd5!E-$}4tUk6v`+F+V!51%EAF`{qObpIV1=-ziFDYpW#>Y&_j8(4UQ|OT?<~{QB1I z!9ylFRmq6oRcGu3%s}e!96c9#`Zv_L{Hzw)t}DvRZtZd3b{$}wL~zRh2BOfgg%nW{ z{szVxP=C3&%$x8VeF`QgMJSC4SRSd_iJDL=bv$(1Y%<9SLpy(M*7V~d3(3@C_#+(2 zdmh=Ev~}xR;mX84w0Wfxg%nsj3^S%i#ROB6zJaDMADMCrh|~hqOw_L9)EdPp@e&=u zSC3b>uI|cTyIJ2DC|1dTD)ujplz&$T^R zOYGkVW=&UHVwa0Hc^{0zT_#56GEZ~5IZ1VumLavBG>unjy8OyRKYZEn5i;|Ag)vi# zIOzkY;eoK^n04TxHFvRcZKaRTWK;c|{j~tPT=zkl6$?7E=l< zS%rpJ<$Q1F2%k(%WR&06crbr zX!QsrX{N{U474%7KddgYzipukQotwjgIjv z^QWo;A3l5-x+3n*bCe4U^TuYdLVf#}5Wnz5=yXsxr-B;OdoCDfo zi|j;k{0q|@vT;_P)nHpVhqqcodU3`RF;fYRs-v|CV6*O;1QsB*;Ber>W6I7`yZJ;5 zaPs?ejQF?!Cc(=WSS`ArN1=KLz=a- zAyA(>TpR>s=vR{&cwm>+{KGrst-z}H_>;;OrlaHk)wv%_9J zII}3!kqYG=jBmelBdd~ZJhOpZuwS{H04|y71jh%q;kvtD@BKzfMF_5d=Z=mdgI0T6 z%IIvcE4LdtB87-;;5qtTcE$sAI#Zk(t(bT&mGRC!kpKbkC<08(X`%yjL@$$3FJIIb z_0!g~hV6AzzsZjAmyZK)wD_0OL{QjOWtRb2^=r~|4+@$9m4ZBxA6L^5=lFp(+2zJ^ z<&p1a{WIo626y;^_PvEzIv>lO(RksXq?Gh#e+-r$RcR)l6xLnuFO_&CSazycv$mdh3M`l56{BSTqi#Z#CNGfY2)wBVr&m}@9uIN@` zGc~~hya50PFej?|0NX@M|Yl%_wJaPP`|rb2O_R-}PK*B)o|(63B0B9>TY zxh-mm3TWe=g4%bZY3laBMQCY;pXDBeuFB+JeqdJ~G4(<>QFpGvm!D({OdE|CIcB=8 z%s;!5?Et^E7Oj$UIKWa86^;GH&YNUK#+paaH2c3ww;ZUOcet-5nd+lxkmU-SR zJoz*5QfpOYsPUuLs2hWT7lN+dJs*a9%J^#L4IA-^;$hX`sRRw#_3KZ5$E%}rwWjhC zEbQEdVM~=fHd6?@F<2g;gjDN2()N-#+bQV8R|p*}xpECb9&`$K+V!owdR56FIHMZh zEzGSsPd^6?^)x+PPCE~^lPFNBmON@+YC&Gt18giPQ&@tJm+I#!4`msJEe9QI(S;2j zUf8j0odswz629+39)F%OUM9?xWxeb9-wF{pl)82W;O48BI8_#I<>fPCV&&I90t5ME z)YRl8Sp*NMJ23935enqijLs4ntiy4Q4=C07-ZK#Rv5BWSkyszluUQ^lJhB#%bBNH< zTpGZd?nHrg2(c9pCbM)DxQkp;Ql0aRW=DG;;T6U5Sx;@)fzsv&AakA7UsI$Sbx-w#35zvT0_t^MWm zTP&ZS`%Hh1RhsdCqhGn;lehg5w8|WK??nlb;Xz7){C~=3`r)WQnu%2V<%6l;yM~B?t5-fe=oNm|a?Jp){FJI>4Ay)e z=u6&$;!=B{$NWhOtjzHTBi*hlaSCb*FpFecFK4bTojUnscU7TyF;WyxOMv#&ILm)D zGb5fQtAGl56>b!&(?!T1%l>4%H6V~Y#zn*9%*WZgz@I;6f4^KN;Qs~SWGG)zYZ@sZ5)eDk$$;hH$} z-DkBQT@onBB;xdjyGdXh0(Sng#3(0zr_mKD*I#s7IPwtwWAki!7dT`D& zMT<;uykJP~pBNVn2)8bZ&XHqZ63`dCp>-|Ul7~Pf;;sm@!@ZShdMh9EMUn8H@-n!h zLls1wyiSjD__-Bb*Qirc_+SAITOI~;Ky_j{pc@D=keJK~WQ3V!=2@OmJ{UT$=I;UE zZu~+DN3N|j-KfJ}9hkQ*rM@If%C6^X0^b}3Dvdt-{SwMC6TnF*m6etAVkZ{2~;mL6PwmEx+|Bw_lk);3^TqzVN39MV^CMc#*t%GK1=IEn)jsI|Ow) z(?;%>zxP<9R!DBQ%C?j)pi%3C5HvR`yWy?v!ZaV@sa>5>E`xSN5E zC%W1D6S4=5xeiZ>gQk4)`e1+((b!%bNvw?IjGi;fLot26HK^Hdxyx%ds8g$Zbw^pc z`b8Fkol3DRSLzR7d{(R2`!KHo zhwq}JrBGOnw)8(@9Cp#AmoNB}-uajz)Wqa*ZYfLubx^lomeq6@U?^LdDWKlweD;95 zU$qwLafLqFb^(qhDS$DKuMX$jX5i(Fa$BY`bht1?8mnYF!lc8W?pyD_90tvn*WuOd zmYbIx>50F&9$X0jz4!9n{znC1wEZJ89s8@}&rNjdR?xz;M!oV6In|y?^=#MkVa6!_fKhR_(b3kyi(Dn?}#Ec zU1v7$$neOZM}?5(=J|#w=ag-PchK>6kXLl(o&>2i#o+EMv<^qLKhlrv>DN49oQthL z_XP;7ze&g3b0sf##*8K2|bTV|CZ_gUviBqD83sD@{UkPMn_UdGBB$n z1quRfbU>2c*44p3^cG{llL;H5+M5=(loKY64@sBFoM=(A3}D%|XSp2tFxz@~owL&9j4P=0RUl&3sw zN#xe}OVF3yqW~8mvt&$xMNLx8N)4?h>&%Y1c`)61dj6idXZ9d7Q~0b)18H@t@P_oO zAI!)vF7`%herf>}NkOYY=}Y4mCGy0tom0HcEGR1lQ_1)%W`=;jvg0E9vyC2FK%J9_ z@Jx=#BicC1sB=I_$S!F&3FMmP36_K_1i!|~9N_{mX$qUrB6JeQ39}{%?Q4P+RLhB4 zPpOHK!Rsb9Pl_cKF2h_>l6;W0JO0G6MNij;CsK;Y!TVG5y`3PdK#JbFOiPk+!d>z5 zZw2_t0>)<@`lq>H-P`jzi>kL=Dpu@89s;H?DkQ^#x&F zMIA?)q5U4%@PosHLXvG(TT}*glRoKDMA3>NP)v19Uhu*j_($o-Ns6#(?9QFz+5hkb zw3iV;bKf%ROthk@t{;&<;V-&2!9kGm>N$TR;<}rKM(`5^H~Dn{74ow*Fq2&jIwfBj z$e(uRTX71yUc2*$?fvH34UYVsx>md+xo}0tgMSQjM6uW1O<2ZStHY*eYGknIkoE-q zA$-a+QR>=Ti0a4f!XHo{4y;knm$fTT!Avmb3z>)r0{tn9)SWN9WdUu3UZe@222Gua z4#08>WgjFmT?HdNbNzaGc&!XAH4_8voByQ#uabhtfK=z`!cphZiQ8>+&H%jb@f3B& z2AI_VTSv5H&ZzPijnlUGnGIk6xn%H+{Cm-h^x|O{$faXrQAXi8i_9({Flcf&WKNf! zgWQ4N@xh0t&xYl-0Be)4WY_=iuOz`nya8J1zid+|FU_tOE!>FQ7IWC_S{jNf~R!HYFIbMN{E5w7Jf;~>0aO|}h<&_EE3EbEyI#~$pi-e)#DVJbf8SS% z(a~{#p$6dH)yzu5Soz2>BNcL6Is-L^Q!_k7V5ud`!gp*3xTWx00B_w7oIFYwRRU7k zcJ$Z#tJ*o7Ll6*uFX&ZdNZY5LD}|6cZvB^v1r#xnjK)7}4^uiCH9iTg0H0_U^rx4L zzglwS9v*>6*dj=jp|%n2+^JfH$nd``RV(mfOI;86FeDLN^Yo1Mi|=z!U$A@nU6Z$E zZnfurvxwcG$9iwbG}2KFIae+q&7dL4wY2hS{zp`jk^%Nuk=`v(NV< z+{jY3yDp|{kHE`~Z+xz2>g?N+6QurW-@)s{<>_?20pw1k*u@7FpmO8?eRt2KXtw)2 zB-z&o0cL?6e0XSTBM2nxPuE?}-4owG-Oh^Y1s}}~O%Q8AT175wceMq4w?(i5H04>x z(UaTSrkZkv4EqW(#lT2?X%X<5%yA{z5%I5qLqN`BFdGB9BkM?Xv1l~3pQ*Qxh&en9IBIkW(K8w_2J*Kmr}b-m9d^_T9ui#SaeAd%{Tnp;Dx zW8%=e9C>@Gy#s){1(Hi_`QHfA>l^cK)W zG65G@Koc~eAs|J)0B#Dnqjsh4+-;CPT88E-6)I%9$DXmzg*Pc+Mk_#266(+7ErRJU z_-EF{f*Y?4kD4I&!R)?Sz!k;kvcDt&zVoO>a1*8j*TD35J!jaFPAT-O4c%w2h3u62 zN4Gbor1}a(_}=Ey*MK?Kw=9hvV?YSt7mKpZ~a14F0MWXuBN%c!%{ zAyG-P1&|421aM-Lk#~qd#05)$&Q$@G@*}X4H2~ZjLXEiaiQhn`v1EVx*D(7f22$DS z0r)?%h2M*w&FB`u3@=20f&Bv?f3=%3Li z?TTf-mf9yfUIBWZlx$%cnBDM$vAH`SI@|{~2jnaO775=4lAb*OL7Rm@{`q1J@n5Tg zS!vcsrM!Nf+c%%k%(Dy1UVy1Qg>KezO>o?A2rl^iujBp@)_i!*F6Ar!j-IZhn158PL!bU(BQ8?@}+s8~gmp6NzOVjanlp1AhoNJ?JN|4Ig{SC>KLt$=Kau7u_quQ-d+S*3)paq7HL31_p{l=Sf4y z0YQs}=`*;KSG#_ng59x;zsD*1>RmfO(EaoGO;BFT^ti6tLQ>%Bt!uxB9UUY&M66E) z|8`{%maA+1zlY^LO)~ftpa`jNr%*Eu&#`V84YmP6QGu=NBnW$k&BINx&<`cKyi*NY zoxp%6FSk!(AFk~XnB^%f^c~aTEwMBMJ zn5Ks-AoX&8cShq1W%4}4lB+-M`#`)6uLtQhX7CV2Jt2+X;0Hc)kIU4dX2rl%E@K%) zZ;D4AG|iMLx|pj-lfa|8i`BFrKBPQ)R3P-wTmT!pb$|W7e%Q*+^uIa3@)@SbDU-KH zC#!G0{TP`z8Htj(^Ylx5q=QbN^+50ErzY>=G?hu-o;x@PFO;2?6BwZ1Yo9Pjd+@IlHKYYg*mYzN#E*h~ zO+ykK{FQk+YG9PS`PC(kj`@(*!Q?^;O(|ZFa`z|1%t@&J1z5`W2EBI&B-m=4lRazW zg)7>&er%OcC*}#8PssI0wPfj+77w2BM@>@-PME<|E(yw(z$Tn+pVy@R>imN^+JA)v zr&XC9^+Xk8qM0|7#Wyo>2Hy~IDfxR){J)pGm=W3MSc~ky?BeYB><}z7Q>w7|65mwC z!MAuZeU*VTaa;|pGc5Y4?r0e_Qq@p(I4p@fkD@Wh5B^9hwO+< z{2;{=wDQMMAd6f)3@g*dm=!qaQ(b{GArr%7^XsY{>ELxe9+K`e?iyGkjjBcW;Sq?0 z?vmqb{$4Q;={*C#<6+&>hw9_8f%Uoul)Ic?W<&q01@uuOrHMY$rppVFk5fz&gE@1Q zK;ckP5ahf|*A^Dkenka-apv2$WAS2mqR2)!eYK(HgE8{(HWJwyWrIRbN!a_Ix_DKb_7UWa5I5##W~ zaHTc@ty=fi%rO38LFr9;u_P5IciTUpRIC_%4KD(SE3C0gvQ=aBRxhETy_*qRK-bk3 zozV$@@$MpeZZW^b*Pomzvxao=QV)|8sY_w1pQEfu)W4*>^FTqleqA6ji!-Ne_grZK z)6)lzPdn&EtW9^4FDL)+dbvWEsF8u03C)DIL`#H0Z*AN#fAHi*s8XVs%8sLCpf_%Z zu&+{C-tUEACWD$gp6rwNQ4|m@B%wuIH(klF3ELB$mYV1wD|srw|9z zv1d%g6dFl2W_vD*4qD^d7G?GT5}U!;t~O`O)ueDWc~2zOnq5uX85kvt0)To+S>&RF zb~`k=05^U|BcHDb8`*RiV|bUgC$@wv^4EdsS-Fv?N@MQ1y-u~ruEHCrP?8c*sgUoq z6x8=2pgeH{gCb*Y#|ADoOb)-kk6|U2kA&5%D|e@xH1>X@v0iBJoBM3EkTbLE*AI|y zxqDNzR;UlqTR5|)KxWd;N^94IX+0ce;vpAmXSHk7>V>GOpz}pzX5Il{164Q`!v659o7AUH(2X83k-Pv@xN9uJgS}5*e3q!kc&2EE zGI9vy>->U-7hv0pMdYT1#&&PCjiPZt&7b@Qv{b5xk_k5P8p8a8 zPR9DlZ#p9WRE|CfY;_VK2cq#-^JD~IThJcoxEZ8*N=m~fC|}oK?dxG-<|-LtSzx=2 zklwZ)PP72%GIJ+jG3fR}L&1I*;?xgf_?vdlCuJmII`&u=Q#iKjZly zk*PK-Y2JpIDhuAHWuDO}+B6=H4hl4P4R zT-deJ0L6SRY$V}X+xn9(W(FGh+LfzGrd1`T*EfJtu_Q<)cxvi^&a|}tMlK{A0;dDA z@g}sWVF9oiQo&}7J_yMHDw#_H6e(mwqT)~@If$ReVgcF)-~B5JWJFNQ+MK#X&LGl0 z6t)9c#x%9E(8dV(CoD-(mp`LFSw-wMLJ40hu=WNOucH9o=wLoqx6_{gVXm#v(1%NzRr;jQ+*>cdnLH`LD9R?zLBy3I0Bd1 z^wcdLTBa+-B)Xi}X&dSjpT3KvAyeN~rn*>XITXef^CFGtr|k12*%;(gNh7evTc8YP z1Q~Xt=jMTN*(8O?v>UM;GTl>FjkjsHQE_9VdiN64K$N&_49@NK(A@-^WId8Phgf>5 zcva9P&bn>9=@yCTavVak7E<$g~62vK0M*w%UK`7nRRA;6bTi zju>2%t&;IJ^mfhJ*aIa`7I9-InEQei-_$eAoxqIj(v}0;Wk=?urC<4KF0LjH*`2E< zU(xa6;W_*s$hC?5Mqy#J$_~Hr^&q(Osr*`cDcB$p6wR<-Us-`HWthf{>0Wn7&>(1C zsWs!@O=*Yeecl8U<(SS(J2>h+xW#21{uwa<&c5QdaYHHXFl_Xa^2Zg!avsKddPA2~ zaA*Il#EbU_XdgnCD7-Y`JV;c8IJ}uZ12-lca-gRn(z;sb8(17nhjVq^izX+Hd{K{y zwn_N$W|~c5E8aChJDhOdka9tAauF0h#&I9@7%nIt<}YXx?j2VuOE2pi(c~Y zF?E?ks<>mJ+KI86!lKf2_}I^B`Hf?5lK`YJ{r_rPwT4q|pBgOBgw zlI?XJqv2zKpjGZQdC9ti;HCI8u0v>Z#cGzvi2WjG!00VudVL|`aO&o*2QBcMdd z_!k6`rQM zJR8oY3ym){q}KuMgz!P?Q6x{@#=!i!A%gdclXuSrp;tJOsib=FKj*5OnA~H2Syzg^ z{)i=U^4nmUe+lX|P=KeU|BmDhvQ4TGzce$|Bf2 zIQ^W0L?o{qGUQpQlg8}d8U-XY&sTpPS*HHU|I^`c?P|ulKz7aD`CEb$IL7iAU5s74 zEs4b`*Kt5rLGN03tcG!xU}W)8Q}H_J#i(%i5ttjgGmSsemYtDlcwetM)HLVNa8K$s z*hxh_>`{2Gqe&=#<_hbPi}?@*DUvG=*5~%3A^4#t60z9olF^l>h*uyD4o_{Er1cRq zzO;p(sihrj_~9YWr{=;t@*3Ihl(m{%-%S?Qlt-`I>a_P1_PQ3ric7^3+1-Y=qu%&* z;86Q|D}_l67%v^U$|Wdkm)`>P02Ldc_*4nN!((s!*CQ; zS0yCVzNO2Ul@U?NIw=1UzF%S?mM+o`93Y>Xty&cI$z z>3sZqewi*XOYo(t*L3hW)kypwm|Z0;iNnMADDh;S;~P(##?;;c`$w})3LPa_klL&b z0er~F$`u3RP@&N4ThJjCOZaiYL*i9!;}Fr<{-^V{67ik^s$QY~`hzs{#arT3^9~wg zIX~JW&jA)N)7Zv9;mrAM2q)Y82FXs1snS)kmXUqv3=8&Hxdd}J-hwzMTh+ENkvnc% zPW#R$@+o>MJ*wD}>8zs5ESZeTuk6o^IRmnfTt5Y~Ckg60WyarHIye6rBwc_3QJ)NM zq42tpXQ4RbDk#G~Q0NPHus9@U_}Rv*z?Q_=eSWl9+#RRRA_YDsvva!bbKW^2g>$C~ zmnYZk9oBNbj%S*AK|mQDzFOKC8v};hSF2`+7Cu}64{-Cnke1A9?(e@H$xI@9?sDf& znrQ^)DH`w!RooFmS*I^X@91dX-&IAK{8}a8UH{X4_b_F%F813Fm?@02M$Pzt{pkNl z%Me(!NPNOk)eJRT5-%M008ja|(MBp;ns!4k+jeE%%2JOIxxPd^r(HhdV?sOy=ppjT zVg%R=0KdHOaf6U$yu5J0V>VRoL9qa%B%A^Z7@*7rEL5QgmalKG7_;mcP9Hx_InAXg zT=jaLHdIl=QPFKW-1U-8)9cgo{1`>MS3ngFk8>M2-mm9g|Q6?b@=WXGJu`D`3%$_ASus73b$T zU_2trx2@@0Q;OIZCO8^n<9^S-NuuPQnX?C+P@%t!KtMk1@sxenFLE9LkGT(J2#Y>) zQRi9`x#T@yRVcVcgX1!oV*9Phv>Jl(Gd+Fopt@t0A68eOuaxi+(I*u4Wt7{~!DVCFvh%99UrX(`I z>D+_onsS#DKw)jK0iY7y+BqB=wa$%qfh=b(U|bD%<=HMsp$F;N0ITmHNS%voZtCS- z$Wd`{8vB$-72zO16ddt@9uiI48XVZT-7kY~IL6On&~(Ax-u~7-V@#qd2)K4}_;f~| zV5O0*`uo0Jj`mq8%p9RQt+d(o(r)j?jR_E4SqZEb^XQWl&lyF}C-Xmrmbr0;$B}Qc zZe6%!7O*NI-o-KU7!pjo*hfTbD>?Bx@wprUO@hmeWiiTjCQd9k6gvktx?4TcvO9AN znJ&1WdoRC8%;Uv5AmwVJs!@lo?((XhLke+Bf2Dn%xdu{YFz!~5 zSlR937wkSZn|i~9g22qXymhLbAhQ#Dn)BNXGd14JHw`tQAf9~7bOfP&hFa6G{?-?g zG#{#4cT0-e-4u%WO)@8$3#vaoJc}Oa+M?@c8NZ%a;rB z2CFTmE5sh7vOb7$>v@uT4I?hQCj<%!6Ar62Vx+|DwG)i{Ue?-#sNzI;8Ww(l4Pf(DUd902(+YFe&uxfT{Kr1 zLsiEkmbCR_@DPBrS)eS_7834Dr8gM2Tyc#1xSQ@jtl!0+{^@agMOrVk=Lq=lxrmLe z?VKmsoSG&?yzMF&%Ro%|n@5e#7t_0@#YmDHV!6Ri?-^WP4~L2X%WcTSzW=Du99XY5 zd<_dp*_mMdaM0M&3h2eSeVyLW)!HG<*Q{GA%er0@tz-x6ojlk5tUJtHy4>Ab5khuf zP^6PV1WyS-&}KXG4@&m>MlY8BuH_*+xZ!dy`oWt{>DL-JTfR>n9KYAewXRaFM%t- zzxkZh-caw+MKd(i1;CsIwBb|p&scj7!A*z~QV264m(ShJU|OeZO*fE;{jdi5Ob!=e zHrV9RA&Q#f4Gpqhdlw8y>c1smJm1vZ>q!cPkz7eO#gzj~mH0?GFLQKQlP}}QWr}4N zlQy$1`t+thOZHbj(x$0kgyOX3dAeC>Y<8BpbZvgW!UTV?eRS#N&22~q>ecy9lP!<( z5f>+sehcRBBHGcOySwhq!I%sSY18n8=}ya6g!K{)M)A|~JJZjM$=$S6NSpErVZ1-ApX+)QW*EI-J3F2+F? zlGJN8x0Gv<)?~TC|Eqm3GE7;94aJN;`bZ;$^Iueb9X<$8Ytbke+LX?t z%fVa_1j>tZZcHiT%E@L6I_)|1IeAEh3Mz=xSJdvLJ0maVVMTRuL|#?trU0!x0|yap zWW!E2E9q|!xg#w7!X7kH#sBauxQtT@cWYt@AK%{j3>2T;o>acc3OU_#>!}q~Q)OUz zISg3>H>4_ZbpHAIx#`k*?whV(g~aI^MG8blXv`XjJm1J5^&600)mr1Q#$4f&)oukc z_fkm@Kb+{HF?o8^-QX;&NEm&5&UYyP+ba|I2XeRPY~>Byif-=L&0jeJ`=4@!mUAHI zAv8$UBZIKj<usnS*Ij0cr%<)k`Cml0K7Y*j8O4aW`1U z#MnvC%?>tqKF^boo`&TS5p%qI!uU94DKPmqZNQn`spYiC^+PQ|pN~DTiF@-Kbf#9d z99+k8*>OMKU|D)tJN=N{-k&ZkeS;SB9ES&H9%aWe#^XH&C6G7pBwY3{ALQl1hJebX z4F4^*58}LLc4?TGZVjz~k4;HxFlbxr_p#T6xlgFNh+kh~3V-0^8J&7w0+)sC?nT2Q z>K|6{0WS_mLp|_Ip{>4yE%w>C_QlfZ5^@BxT5F97ryF6mUyB1G1!4v^Z1)hp6>F` zKa~gfKP4wNmcvaq@st)Q7^}n=oF5#7a7hljx{d-^H0iznL)Ul5Q{Db?Th&3bMJSGy zy=PYT$lj54P)0IBvLlYY_sk|)Wf!t%h-}#-WM$9i`qu6K-S_=G&+Fxn>eV^EDQ$8%A*#NTi=sS_W zj$aZv;(Wp6!O_djj z%j2er7U2ubjQDdAb)e(Cr2UfZQqY9&6-umtuyG0pSw4@LwUbPLql5#2mx9E6vR;Vk&(0miIfrz_quJYWRb=zi}&+ggy+rxJ<6 zrkc+m9e|hm0Op{iAF{ax=HaiqGwwVDsl%Wkp&dY3>4+m8(2a(wRZOm+vDsG#JX?iC zI0geT(r3nK;c@RUqOS4_rRXcX_U`6H8w8pQ^d9`_o}nqezmsc77p2gl259$raGXnh z7p7nvmz75cx#NYN+XW`5+FCO4f6x>K$V%dMAkC5wD^u8{g3qzgUXiNcUe@* zuzHcz$FA~)pJH31=_k9<=;$N}-%`n2{-R-F3>TO~8YhY+2Z>{tUTJCk1$c7^@nZ`% zR4%wc?ko+X6NRp|y6n~F7^T!~d8c>!81{G_24QkjTgS`BsuzZmBRGqC4~|)I!xDL7 zzRVK8^8N-Ks50d78*#AeKX>i|t+DI$Tcc)p>BAr+yj_I=lbK*dm>_-XFDH=Rw1EBB z3aIPpo=lGx8cLPT-xr-)&JZT|q6qf+om&HnK_A;7qy?rd`x_MP3ftmmRXRH>+p#ha zg%rkmVM9YwA(Z#n*b##=njts!9X<3Vr$Bb#pC=INWLLfeAi4c7;4DsN^Ldce<0wzy zXS(hiWSVn|VRR7@Z(C9gp3+_!PGfOt87F+3#@PDK?T#tI+YzAc%CYq(=$USj>IEnQ zu87KR0)5bq=MZ@_x=+i{fFVzk^ME!-m;@kV8kq>KA6{*RDm+$_=LJ{G3)&mO*QO^V^*o0vn&z5YmT9@zfrSfaMpBnl0FORRJT zOE2UEVhcJol?cm+3aJ1_EJA-EO9E8dQ$$&U zk>+A8%b;&d^kI3-W3u0_9*hKJr*e)bn?GTZ6dZ~!C)GzF9)0fOt!uma(qcPl>em3s z<#uFIjLskQuz&23;Oui3LHLv1i*5Ki+z*SvL%j(pZVZBQxZ+3Yb7k;e@ksAE+svdB zN#M`nl;eoyF&C9e7&AITV#~kLC7u%b@Rmp{TBApF)!`*WS9WL@fxjM_*P95x$-WNp zFj)Q41{h!%lhOLBcZ@(5xva5GnE_l-zA-}=E4=+PF=t*b&8geAr$&=1f|}Ld93>H3 z{uGFc$jCg1@_O{EiY0$}8W9;~J<&!bJJ&C_4cr8c7aaI#zc)!f??NKRvFGjHNGpHrU!un<{Dxc$ds zG|!REtDK9&!=5=uzZKtgvj}Yb4qp2_E!rz2vS3^#4`KE!uSpi!la)Ts=5p2GYZCNb z1((lXY7Eja!E~%FkH$u*x*ioYCDD2%xb_lN;mj8RTiKFgw})`i8lqp%K;7 z8d-rejAaN{z=Vyet^TfJ|6$qrRj-hWkw-L336A?+h29ka^PBM#o`Ez_cI~9Y^y<0| zl%~utkPpQ_^XX=1cSc32&(>!%X2KbBVtM2# z=)=jnxnS^6X{je1CwEwtWfOO%!KXMw%>sH9t0?JU7%%*kUYe5oj;s0`Vflj7BAyN< zbcSIyhj&Mt5Yalsq?a=AWkVMJB8JE(R4?-xoxs?2LjB$#}@$ZVDv6Z#r8y5vm4>gt1 z|1|nKr=aIk0EC*I3bzDGS*ap;bt$MP%7q+5?H(P7jwIrxy|xb+tU%1kx5rPnO^3z&73!Y&W29z>DvJ}u5~aQ4y28r1 z7%m!vOF~h@$oQic^sd`2lAn_3`v2Co1Q5h)q#6+IJMpxHE5V{*8Ax9zt#320zUhKdHoBr)=TF@+ky0Tn;Gux-uQEZ8rfd8~^kg0Q-h`XsU}AxBkQ7p> zNyueGcV`GTh za}49ehN&4Z`M`C^dTSn_KVcp6JMCU9*-WDQTR)D$X#L8$0yQtS7xn$^XgcDpV2}qY z+lgP}=$Td!ux|;lnXdOhM}3EnPahzc0O*CVebo*+ch`c z9KnR+0{~}ZxIP2O_Rd(ezF7b@zTrMy3|x>IZ2(jd zdsjwI_NC%miN;t+CoKdoL!@nUAE0F;uCkkFCuvue%Zi&Nsytf z=5ab%NEw;6;%m+)%*CG4I=yCA(qi@M%+s}9(J^w;aZjhgnze_>U81biB@w_*na(tr zqoYMRRVe3>^IVdmqYU75MUm*+`~Zu~(4?#mx3Gjk00VF1Xw76pbvOmLAWvzZzw7(N}QGvrE%;~ z_1Uju6g=-ow0OVEmBCe*ES-c*a0_`<4O1;b*)D%a!vb)!A!VF-F z1rg6gUld-@(J89(dB8V8mrx*|Uvcv@q2d%|wA23vV2T4V+NOLoJAgOXCM0MBD7H8s zxNPX?*1dr78lCl{UHThNlEnZE-q_j%2Bx>5!mvwGeJe7i<0;Hg&cKcqr_cWvHd{4S zsaY#8imPcaw!hxP=ibi)RC`y&r|{;Y8HPU#>z8J2km0ivKc`~<-QWh*BqiF1y$3S` z&v+gcf9V992qgZ`th*NB0)cXb%Z8RQ*P1SviF}4j_`K4`m}IPyyF)ML7c-?Kj#7o3 zkRxd0;YkyBOpNsQ3NpGBm3J4E3CK z+p$v|+bB26%9@o}uEEgtYpejCvu={YYk`*K+phBgF@EaQEcfz+Ve+s?ECMy*P$G$0 z7UkzY0c5h#jWU549wwhu6Fjck>55SvUM5R#iCem(eBewgQ?$SWCjND`Q%C@a%3?q- zNmmv*aOI`}M``6LB<_&yW86wW6s#hrvV$(xA<+d-hs5!m0%(itPSdvhrPN>YW$T0T z2A#6(mMNpia3WC3Ra1e=2?BsOF~5p?N@!*=FEE;1@A`}p{9UM1!}C=6g@26n%QR-!$go3U z8c&TC+%~7dlS?29Nc>SyuT{xoP|@1C@;Xme=c`1-VBvkcYmx9qLvzu=QsVZVGa#R? z&vg6j>+j>~i9N=lo0RTPq<-~-H($7WNqNVlF~eg7i!BU>@`WlWqZD*&gOf-w90sF0 zfMSoeq_;m&ff4%#HKZgo98EQ{ol@(ntaima(49|P9}?^5Z<^78Qs zJ&&!-6$^XQKQ@vGXG?gh&yq$T$rUOk=g{C5M98R@OCcHEvn7Og^Bw>#CQxi>Y7B}< zZ|S_1YK;98?x7AvE)J@Eb z?5`Hj9}qc^OBu(r^LWUNh8KIs>(qX{dNBeW7m#@b=nTD%dZP&7Q3TZ7eWxN>ZsE3p z;#W3-ek#uo>Oe&(N|?WD?1-e9KRcKX2cPA%{LuL7muz2}W6R0_VsP4~_6Iu+#}$Zo zj!HVs_xr2{>=!u~YkaL37Y3_{}B9^tyflqEM zb#q@K>Qx@bW(>7I3he}uQH~nbr^*oRi=D{T zncAA}qI5CyN)4@|iN~QUldf&RzSQG7AYef}8>vw|L$T13P;qOC41!fS6>Ft?Cpdv3^(gaOgv@swV-h!rAB9oob|gR^fcrw0~Y;qWasJom&B5GSfD@IQlQN zCDiHv4fyS+1(dPKd6`x#>tX_I)^c&U%}&)EP*VJ3nUt5L`jj9)H4s069^>#t(hmC- zb{M14)Ow0wY%ja!-%8ftPOXYTu}9+o;2YnDofTBbrh?B^SkC zuSKU6!aXVnlZS%rc0s&2bvPn zJKOAxkvL2#!D&E`F^^QxLer*xkG^b#50?yqQaF^0E8(w!ZK!tw%sLAqEL}-O}r~zAi14HJ+ z5OFowLQv46oJ@upteWcbsxGexl30}sg3epWfJ|V%XK?P2FdVt4ty_C|J&AEC0lc-5 zDHr6_{v_vk#j|+6?3V!YIR~0~!BFDzl*^Zwwe@ieuB@UGyeU*tzwwRb8q76lYohbK z7$Ry`1J>3&XqSY6zEIl4fNSoTvR1z2mP)TNxWxvS<3fep!I?QmkTei6Dw7jTg9^9H zUH`j^L&0D%4?u}4fI2(7=Vx7IyE}?9Bew4=^TVQc{EVGGY>tYa+c(}WTNZN;BfHm! zhiDHCMMb~b0?9-}P!R(l-w*ix8B!k{Cu-+_5_C znl4{avqELgkX=nH4cHzpiYNyE+M(jDG&5L#ug6dTi}aIo8fqC`wGX7S{P9u&t7xIt zIh}W3#IA2a(y6#+XF(^ z@%3BBIHjEv>Cb>d4?E`V=q5MYRLhKcNtR)d>DGmUL%9kbYsWNF0}*xls3c=c5R4PrTpnfJ?r4d*@_c=dpQqdy57_u-aZSFn>_Xl4*@7321@DLLfZJI?zEa17>k;P`L?A zpj>SLKa2#?ukD2{J(Ao&c5ZlBHwH8cO#y@%lg|yfueATRXCox+VvKv_Ss<{zOM^&9 zKR^OhSmZeyUBwe_YR1v$SXJn6ODe32YKB(_>RdJxK=)R{N^j~RQ3BT8Ni(Y}!nALn zKy#9REF^I{Dr3sf#%!2e1e|xEOr!m<`Pf?aLa{Flp)AZp^2mJ_nIvb1tL+4l*2*7v z0EqJ(sF0LNoOQ?aZgY^}lKOU@QBHy-@uTYVbT=e9dB=V0zWdR)`0c^|^e8QXxU^qi zM!0VXKi@n&a5_T-zdI-5{=$RM19lEXQBjL~?!Wp7N2X6ps*iHl(BLl?V|A3x3gb_G z)m?)+hj!fAhPy6Tj3vIE<=;C%{5`NkiKO8TO0cdML^Svw1WlZ~DWy1lmLFhHDV=MN z%=rYvz>|$*({H0Kuc5G;Njw~j>H9Uq|Czg!R{yq`bI)i(f#b67)86m)U1RNSBH`a} z$=-33>#1t|$jMgt%PZhW?APfu;=GRK98q(_a=gs3J)x}oIs}^oi%n8*#eyyu2u60@ zzrl$X>*HMkn(6=Aof%JQP^dpIDI?mKeni=SQ+uTGD9(GqAt>piZB~0o7_U##$Gn2P2PU-w9+T1l~Y%YuXC-`IsIEEqWuP{34e14 zcS{g6`%SNLQ%SLOVZNO6RORB2y_M$;hie-X?fC7Kq&m~?_QGeYXZ9C_Rc$`kep3GG z8R7O1CyVrQo`2QQP;NuIqi{ce$w5m^ODmSaJ+@)~VlhO#I3@PI?Z58<+>np9xA)ur z9?-lWYN-~EOnTeddj01;={kct3pV@l_wg|dP7bKsC*7q+2+cIz)RK{pWsBNgL7;AA zVXIkBsh+Luo?p6G^5Fx=RsNivk|6FcVw|;Lha7_LrHy@~&jnI{qgu$e_Sdwh3}#l` z**in8HFNtP=F4rE3>0J&Hg&EnrTwRzrY-r0KjPmUHM}pQzk4+M5E!pS7bs!nabJ?J zefqp$M98&JBm-~%Rhj}wxY9L%+xyqn25^F#7)7#!RQ-SryaHfG3t%_}GK~+< zjOx2j{{rb!g76i))8eu4s*{@bl+hXlySTmiGKb4`&_#mEZ1L9@XV~C*yBisrmlPzj}6lI?nQasa02*D=6^5m zPZ;tU4i`Tfj*!1&K_$8>GA%)_mf!%$`8lqB_b-F!{hdVLJ_)oY0-@7aX zuaxP}#r7BC%b8i#6&_ly^w|$OxwJTqOp-!g2-k1%beLHsin&G?n4fzWT^^)93X+Y- zf7GdNL}b_7%-!ZWrc2Ke?Yg4M7&Y@@?)2g zR2B43nVoi520D|hK?|t!n#mRIW+pJ*R~5qODx@va{JB|Ebh}eCmNQXE>jlMsqcHgW z3>Zb-3wQ~DEsBWM(hi(18NR2z{>flB;hh^?o8jij!R6C?fD0}p@0v*7|1>dzWE(jz zQ#>AY(1j{%B?*S`w#D^JK`UO{dIKj1%zTpaU%p<3Qol~k3#<@ve3(GcKTiW_{VWEH zgH#y-0)1G`QX+G0?{_+(=j*EVT@N8$jILWgQOtSB!otFbk(v&~2FCMv9lUI{h~Gel z%S-%otc#Pu`*XFTpbZz*kseTk+{)XA%~UxkaH-kyMo!8-VB3(|b~nKY5=SvAK(vKm znyrtP`CKf+qXZSOp=A2XXP1G?br^yIgOo^rKko-(XkFa-x6(s*mgiMGIMAfQNibgZ z><*>S^8~5tlISp0?KPKM`3_XA5s|yB% zh&0zFOvaN|;`DSx+zk*?a+=5KDr7JW82-D7!7tB$f&oS^KIvY3cfWgWX1%zW!o}YC z9E)(tbaoy2EfMZ7xjAbN92iR2XB--0|C3>i(8*kwl1{ zhCD;;o|`V;T|6MPn*GsYd^=za--?3AbDQ5ZKi-aJ9K438xV+!XED015KH~bFS)~iL zsuM~1j46i`Fd`q6hSU^??akogK&6ohwqYYguxFJNG6K0%x{HxT+bTogO zfUIw`Ea7?BpaaB*6Rk%1v)_VHi zXxLQlT}W4LJVLY}BRQ=W@<|iL;90Vv%A)GO)CTdV<0fU1{O*TaPe$q=tyiz5XBB!7 z53tB&sKGQB3!_e8MQU`sOz&voZ~GYh2!0+YlL1O#q5o^|F=6Oto`KY=wf{~45JkBW zUWUL@ELYU3?=G+bW@@b+Wm%?+TH45plcL*)qP=pg^3;}5SPBXUj)GUpKVO_tzdSJH zlnJ3oY~cGw@N{*)tCAPv^yc^BwCevyOhxh0rUi7&FsSRPEcUZ!#pO$@&vdu8rie}s z2F!SDvbd0`@?ve6vpwbgNF1_)Tip$DD(_rUTT8F^-nL<0d!Qb1B2^j|J_n%&-a*IM zyWP*V4=)$`LvFO<&vjI}cM!U@7%=3j^DlDjf5!5+=cT*bsxzZ^v}fWq5;!d+ zsFi_Qq6L^WCSROM84_un$i3bYv;APp($G}SS^Uz**D^OQy%{JH9lGYSN{+K(#cDVL zZ{A-;MV4#gjTM(6>@uy*2*l4XEDQpsZ#f2KY(<4Ts{B5)B{I|~k+I#2rg>A9;ZWWT zyoKA3jiRD1h6IOG8sUrsx@H%G1vWB61dbFwM0-$nzkVETOZFPu)Y#6mR4|jbNNug zPI__!BPH+e)eD+&gg&cDNuy4EsiymarONLxElr~|nGE_w`V7jp>DSte9z9O{LXi5A z72b%UdT9`b>Ln(8UN(XXNn*5sygdy$tR_fF3JI1;&`Q|UATt)iO!La5>K+QIc~Bx?_+4-chJ@sK;^3o#8b?>peZ1rB%Vl<@705@N2igLsQj? z4F;X3oSgGtJ%ik5X%4P)n(95=Mtz6#SJ&EX9Czg~>Un&gq$Twr}_5Fh40lzVa%rQoOG<^V-1{{?;Ect*mF(`|7r{K znqd1Tr(Ujbc6RG+OQCC^>LF0D6Q7U-PjA9)skrR#MaO}Pn*OJcDb6hJy;wG1*xrg% zqnV30X?U6F#rz_7QT4S!tf|4bYTakP6O@u6 zfX7-tgpBu6-1kCes2XRQ9)Cq+Sv%4E_Z2BauU8m0na%;KI3`h}7l zde&6-#}uzrl(MI_fDLDLP*|!^TS)3X*@eyc_Z!1czfRxmV-aa_I8m3uEd@a9_?+jMqcFeF|w#RcS#6 z+Cf0riJz8^5m)J*vJ8bvf{gd$+L|WU07Pf!oJ;!GimJb4B1HMRD#Z&nRfxA4kQ{{AIrR))hUK zWKNty0eNhQeR@UQCG!7{A(cQKZ&)-Ej~8F7OZvq5C%R()lh3%vcjJT05N&Nw`M;CN zQaYQacn#BS_eA%#H}+k<<~JEGc1k3s%Y^3pMhquZjYhT|gyx-gwe9Y{hO2$J+uSS{ z)0|$ zXbYhv1Tr7@4Td(S?FTEW+S$d-QIXslxX&NeZl-{vz)c?iY_G854sQpoc;zlK#{nI2|aMQg3 z?;J1Z4VMcWD!|*Q`&ULI=zfd2?Ja0*&z#{x=Yo--#Ja zC$|Zw6g`L3%qWN1z|i!sjrHUktopA)uwNaxPw=@F78J;5BZs)O3u2~$2J?#_uXW~A ztG=rUX(h`66C3dw(0rxyDq$D9c=+*b|HO4KhJo99r~T_iJQ1+`4!ZI4UQE4Rynqr= z?q-Z71hJ~W7SHbK-$CQ|?*%^6D4ef8JmK9jxSnkEX}8Im(_(i;YP~XFlnqQ3eHZ~4 z%OB^2^}E}NZ$6o?)(TM;pFWV=bo)`yp;H%f{9$> z@jo8w-=U*7RGe;sow02wB#`~87x9(uDuw=Wp<6zcp^XtG^_?o7A)y^A{xJlYW@4f7`cPwECxB-sn;L=6QsDH7_?Ap{+0q4yi@ga5xR zWFV7!2hBB9_r^VN(n#fNhrbP5J#{^=ytv#7PaHt5!6%sgrT_0`!GYFFJ)`^QCi{6{ zpy;K6)Rsog215~Np(ibqzxHjCLQ?E-~rI4Ifn6Wf=Ik;Jl{O&w&?tHH13{R0ZWmt$^_H@t=+a)&|9`3|!tv|aX4wsZbI zTL1TIHR;jt@>!19*J(5ool1wnWddPv`tSK+&PDI2RW0{;6CYZt^!#1-gB1J@>c~HD zPA20U4T^oC0h`6j5Tnpy4x(Kdw8_4$u08re%#--=hf4o3`M*T0{__?zWX07>?G3{> zrc6sbTtYo?58c*l*VxK{^`}lx)J4Ha>7IYmgQuVRhIuc0SO2?uQeaiSMG2j2;=wdj zi=9Jd^O^1IQ}Yot2ca}!qCCL=yg}EdtQCxX4+j%#p@kh5F8PmKNmT}>OZ?|tOd$B{ zn2F{~GySn1Gj~)EJukp#h=4NlU;y}*4Y=`>CZ1bMN4f8@L+v4^(hXvW8lUk4-!AMQ zs~Gwe8NTY>aV;(B_8XLNoy9k{zmuF+st9`To#^|-S$2{^l{t6o*qfiVR z4*NZG1w|85<(fMQy4W3xhO^@d9<8y!->ZPt*L$ZGe&l-*F9PnV`y5~I{@;f?nCv0F zX@0MQaTYY)=br#hs|?71v}q@w3GRf$lW|I4(F^#I+ifm0xe!v$%&~4K)In%E`=hz90IUcg1Do>xzZ+y8 zKvO}R1WEQd#lD=Y`8u~0$o`_W^bs&EdB)x*Y<3FBwQ~381pgASUwN+b_3&%*0TrX( zLTnS0Hq&j{T}%+=xv3i$qyxf!&JUuZBYtY}1#0Q&a`SzEG5-SK+Xo%Invx4v9C|7< zpLc1+RB8|ZBXIn^FvQ2G`cH%86r|=KaQ6}c6%>R4P+YVJB>OgqWEcr#Qi<&WFk2R= zTKiV3+e_W`qh448_(ozd3z1z10Om5Fei$3`;AuL84;Xa-Kh<4i809?~M~{4Fb7;I` z4`#Vae$(LFQj5VLXh#6djtIk2@3|{2;SB?-oVU17cVB7~zC!cNb&#f8veXaOEM?w{Q(%tD=`y7b` zO@U#Y?k{w$64o!x|#6Ow?xu&i6HO)v1d$1(bPr4#f-bbiN+mdw0_4cNK0KG+Jeg!SvP{Om5d) z_4L8gg*Q=MF8n{C&!-k9E+Nk6ydjKuzB*K<6;*i1X+Flj14!2GV4+2JXcVcb2rkA{ zua|evffo|W_NcanI)EaoNO$`TlP`+E0B9xC5Qq6i-f@@@ob_Y#(3&2T7V^F9-PPeNw;3Wk@SVd?Q2$5B+yL)!x>0?-x+|ybMykh8Evc7!v zTRXOYZ*3_-VLA7UMR_WVhgx~+1kmMi0VyM%UW9=au5^oDsaiJW7_J11r%xFP*SUDe z)WS*v41}1slNvT3FsWTE4b@Qm;!AuOrqU|(-?9t}@B^?Oz}hWaE3Rw%ezH#NHRW-l z`(ogV6)SV_muyQKK1JIof&l@DL5>znchLdaYyo#G-BTc28V-Dj=OyT3Li}<%1A-Jpe=cSwz0VRjmy`kyG3o!^rvB@J^ee!cJJaRT38)vL%GN zn)9sV80t-PBy>d|`d;K<+CzRD3w*Nx<)PTF$W}ue28b$+IE_HFH=eJsX%Ds9Cz6Mn z^`-hVj@&TaQuRCX(JNHM8%{vDbqS0psg(NCM9_QWxaD7+;>iEdBMdl>vH)H?MII#T z)P1BEsQPx@yQE%q`zUckz5*@1XpP}7Rl~9u;IED|rZ3*R+(uE?(zzq{*n*tpk+^22 zF?Nt?u!yc{3BI)`cF-dPi&|Ehlq#axRyCRwjUEeb98Ndf^6C+SUk1Mj#`0-%IG?$IdG*|AE^j{mzMyoY$-x4?}(d!%U;HSLERPLQivy!}c zBI&UX-`5xssYu_euFk8R#rDX-@nE=7Fu%c~DV6aJQ|`gjJ?aQ_I2GDIf0X3Jb9X|# z>&VAK%(M)hTXUR;UGwzP>&cgRu3)gVaQZR1;7Y{TP2Ai3h-mi5!Oo;LwFC%P--Mti z5P4_<0HSR{fQh99SdjgR>2p4VhkX(31>gDDYY z)~IyH6v$HFp3c00X8w3D02$lHH%lUJ8OX)jkU#yPRyw<3!i1JfD**Hvnv_cL_HKZ! zR|i;GA+@mZjoa&Ab;@;WcGK4NZ06X{A@r#h|1?$``5{L8kO=Q(FF@8$`e2B2QbUo; zeG|ycQdz)J;I~b`ic~b{lo(PYh-Zn#fChbezfSHA@pUJc!hpGr`z#h#sK-H@lMBI% zV5L%)+jkZ^t5nz@^c%I97 z?4NQh&=;Jz8CW2A@55>W4CxI+itpn`wEz8rL+NJfANbk*YD?-2ayFB9sCn7jv=98Z zJC=HrZ?;Hd2ntF0PqTY&V*|yN!B;Eor`Zr?Kf#MQGDrya73P9OK$PQG>sQHb@N5-c z8wcTFD7o;v>){Owu;))jDACasz)-YqrDQS=Zt#-v($in*azeb z;Ko}LStciA3jCm-f|JJITahHE?%MrLpt)OaU0g$tbcHmzM#Y}=Q%TxLW}krW%B|z| zw4L5tTi!ZCl7@9|E7Jg@fX`CxR@#ky3{h<+fL{0=zb7x?*BzSKa)p|FdPKtzF zA*&cNDJq>$Tg6^8dvV*bhm(3O&K^N-%2Ypa1C=liHV?vF0!Rf6Wt^GzR=DR*04nQd zi*{Sg_WhJkfI*CN2j6r`BqX+u{AuYG!a0-+lh*LtqxXsEzp%XQzsBW(pOt8Z8kurV zEk1aaa~}*=xK1;R>tx?K{P4=bcl$vX|1v(hQUD25=sw`+jPCvzdZWad zE73J%!$v{$Z*bR)65kVt8?;dIctyZ>{2A~=71D!HhibwDeR%y9}%GbQ7Y-+3R!cpJ)LHvL(v;8Ee-Gq(w<_@_@QgZB7TZ(} zqC9~vB-z{|0QlJgcEQ_7=^&IEAn`}O7w`P$KK8*~+qgJ0F0vNMrDXG3)C5SNeINW^ z|09h=Wp5VEQ%JknhJVsda%CD2G@b&#^D@XI`M#=*K(-f$lmGzu_?hT(w6l63Qu$zC z9xyjf<_t01i+^C0D_~rNrwWl?MiV#@O}%9uw&uk;Z0{JjN2bV!RG4Z;4C6hUFTg^( zPWEAYn_el&3^oSa3SpfO^u{>>q>_O1_n}A5op)u{b8$hkp7pb={Witd4vCyE08h}I zFmT(jg=nl0=&~Ck8Mu<%4mO?wa+KIPXA6q`{RaH7SrL;aKMrDXjudp24co!^`&O~rIm{ckrKJ2s zrIfg?;x|r;AdP@?D;L|lWnEZiFbQk9-g^tO{Tc&`GCX{Ove@|uryyj9P-5_|k7Uig zV5`x5Im zht$rGM;gXKYKJg0k75i$QP8Gqm!yzZr9at)bm7rB$!d0S{mnYQKOa<*p=U-&T&3&T zel6jKVPc!>C#P5kYLR=$P~>Zfs)yG%6GVCh)*U4BX9nzd>pzp|kIJahYD8~KmS#7+ z(RjP%C)R=mXGF+&ZG|J?s*YI&kZA-g#f#{8O=cM5h_T%(iFI^)0RT#sfM>#bLs`)O>KvcHkBn3@!XjOZnU{^I=Z0T zd)oNsWa3Q#E^JUIVs>qV`ZiaSnqV0PYG6S(^?-ja9hLRp2jO3T=s(3^Vqz}J%>2r7 z8lIMP5%JCe!-b#gO6M1;j!ddo)L0IByrz`EjhY0W;ihofqE~(nRz0&MigZL~>8HxM z4Sy8>gdjQp2qdZ8qjAnW3jj=z)LsGEO#2emF?FR{z8f%-Ad7e7o~9ow?HLPv;y=^I z#S@fPdXu&AJg>pxC2Bb@GZT|U9Bq7ObZVz?64BCkT17(C2peUoZYIgSB0EOj#9RZb zFXksiws9ExevNr)FT0@1fJ%6t*`PD+`GMVghH?pn*j8YZK_)C6`RY(g49~37R$AO5 zOskx$lh2$@Rf-!!&rkEz<$&XW(ID}mx8iXbzKgFDhCGH=i{^N9;@QR*(;Te*yQ3|* zQYwZT92hPwh;j@3neD)z>*3uWEC+2)54Z0>IRjcCk``=m#;5ouiOl>VYy~a<)M~W6Kqi;6W6tlF+t&aE@Z~8Ar>E`zsr70Y|dY|JEwlp%7`|1X|GBBc-Qd<@NO{z^_9xV&i3BCs~|6g>6)RyU*sUf z8zrdT)rfpjJ{H>Rz{rj`l6Pi;leyRU5S(;I(MrZV{V??;EA%>be33%A2)LGPZ|Cwv?{sv3o)5v(U&8Y2;#eF-P`Iw)` zU>G0^9W>DR)WfUWiLlIkzN)Z2e$3W48va854!*?p&B*>Kob9BLhg>`+0VO?egGiON zSqF(Y{3!;fa0X)0=dKN6&M=qEH?1*h(sti_RT80d6DeX!B&KRgRVfoE}KWGb>iiT$b0j7@8M3s@3 z^{?gLK1&t@Z50yQIr@0b_HLl_)tQjK19D^R_&J*Ayd+YSaf%0>MN$tYK)TSJl8Jn1 zaE@~TM7G2zu(z+PMcAm7^WAe=B`Oz6ydby_kqK|ae;B-~R`tfSH<_P(l%YFLP@!{G z>d=e{6>H6mBWfG@Lh&k1y~gUjt8;Xwj2{#FVqa|+L4I}MV6EJz$@Je~PmOW-WQ zlNN>p|Hqzu*})|rcY^F0g&gA@e(>?T!3l{XV-*LcG&Im6V!MRXkTnK{9#HJ)1}Sk{ zM@!3%^MQczF!E#l9bUsuP_u$6di9Ky=>Nk-T2-d+u@$7rcZ+x8%KJx2*cJ;xm;XM7SyvrRx-2%f#F z0-Jr1+}N9l_coC~=Ev3iKI<^dX<&Eo{vkzOUNzNSxb2tJd;C4tiVaUBKZ~)&hPTSN z;DSCT`B()-v-TEpje`|Kcy<~ze>nPVUTV1DR?bSwaJ08vRQH0)?g{b-lpOGC+huNs z&~cg#_#&DDZ49I|FBb`qJ9uMu$xCE9v3Ud3}83%H9!w(mqp-rziSQVD#u9**69KO(F6 zr2Gu#(DPZr%j;~-h#U@gx;wPI2byQ*0Mwllnb@5(ztKJ3zHhDX@Zd%3YoW=O;B`$G zekrvuA31sV0fyn4?O`Abgy%kccqq|OZIZl;|vYXKLHxX*f-Bd9S$1DGq2SH z0X_?v%2K!H(Q3CX>~mPQ8C|q|ci9$Za)=c8rQ$v15K5IC_uKGzxl>J>Y{ z#UwabM)4EbGDJbC>!kQ6w)A1J*dl*;$6BajRKU&37bPR@VfB^^6#AZtoW}WS1Lg@OdelM6XLWs+^Y<1U8stw zQ`DZw+Pg^h(Ef@(5=;z_VUhEb_u~)iRI03QxlIm)7Pwjj{O&K&N#`%@oP#;q6fh-; zj}ZA`SY@2>g~}sUbOu*q$q1-F0ub0BLj)IA2?EVqz8)XN=@oXTCjsK! z?r+U5zWOKYeZG-a$`BlXU2{F^rvkYyC8Xi`u|;RqA!YX!t3vP7j~0eHEzg%Y%{_IF zdq!0St`73g;CfO?ARvz`ehjT#k7|I93MKb&+L#msR$wo>o@0StX$hy76=*FtyWOOA zI^3G&vl_Y!?(^*Wv)I8!^x- zTTgS_z|?z#3>bw6UKm@z%s5?G{^%LB10 zn%v6|!xOr!!#Y#4N@qzAyNA%tD%BZ2O>f*jCVl4U^58YWv#dKHJUY=v` zO;~!5{V{l1}dCN{C#n)!Sc zeVx++)`NTndxPv7VwjIPdW=uBP5GI`=m|P*8+bobQf=sJH6YcJ;k%3QtCn|W&}%&G zu?L!H$h^be#q$TO;?8%`_#I>5+VG$@PI3L?Ev ztYu|+Tt+}gj3MgFm*-;x_s)1#`f603Zw@r_iMfdJD@MPZ*B&>EVu8HpmMM`0`QF%V zcD={249t6V7KpfOfYfa3xjG_r=}zloIjFm_A+NZ(Ce3mB(VB8E{Q{UI%1DLXKoQ zx1`)_!2#c#QcQ72tW013GfDh_BMozyWE@?)atV1ALpPz<))mympQEykQlxZsQT5l! zxLUSiU&87~b8QVuaS2yVajD~u!RW2P1YH?ccldwmx(cYM)~>Ax2!cu|A=2Ffib^9$ z2na|>cf)|FfOL1Gw1h}1IWW{vg1|^4HN=2~io~EOUH^O3YuxYtYt3?v!^}DFd2{b) zKl|AvHLp}z@l$rZz#X*6LUBDMU_5Ri-?A4WC=% zu6I2uk1f`pn5CIxo%bi`ws***T$(*w(K(F&EpXnP=4kQ6jq4Bc?p);q2PyG9U@r8| z2}e=G&>?ZBlw!`;Fya?>qu)v5TyMCBKWSd^bhoNIoa{hH&B(~K(z>?-ILS0?Une>k z*>}@qGU8IwWCBya8mgcCAL#514gn8VNr?5qXAxgPt~WZeaSQ9Vg1d_kXs^8x)(G8E zfdouth9iX-=1;9y)0z@Z5`9wWTE(kycGNew&h@698os||3`cQjjkA#v`=uN#vjAoF+hgepjtEH6uMg1aEpG0w( zo0w6pWWH$nF(qU9Y%hTFoHnJ5PpZ>=(~}py_g1GsT61nQidKTzYkmyK%bqnCBl%Rj zpXoguo)*;fcqhX6QaG%pedwQh`E) zx$*u){8Vx7k-gt`8~TFhK6HE|IJdQ^rKubn#Rl+?=b`d_;r|$9Kg}}o<2w@~xFn3V z#dTFxB?#DLM*`lPQD+vSm?i9n$0wtsLl2s<$_F=@bY!-Wcenb*H#}~xE<3~W+(z7Z zf<{9wJal@xb}{Siz`R;NrWd0N(=2iq+p?@i%NNPcWH`V9Hc!rFT{FU@;N;Cb{ z23+5G`Razt3|1q7&qJ%b@xv~W!qtxPv-@c@N@N|#Dq=;Rq%FH3Ohq?1Kf%yO#?K^J z9orIGg-&TF>vHQ@J#{8tZy0?_v&dX)a7pl=Zfd8tk( z92`N$zYp)Ye%#s<+oYlNrh&Jw0mJgXU&)Z?s#nLerbwwXx zte8MkQd_!;e_GuOr;cyP{6wMQ0WEKX_+E!8B%w|vzt4rfQHwk;CyA@REubJPm<8rg%Q2h`crG!limKDJ6~l1m+y(;g+4%c6-ePe&bJU)nAJtyFXFOuOOc(jve=! zs@h_y=f+yTLw6rj*^kw~o+x$mW^iIslHQS_TX}}tCnum66YT9Y@y5M&_j77McGpM3yr$iWWMkYgq6lirox30IejL#U-eNIpi@W`7 zYjCyA;9T*lOw;vDRLz-}&C%>F$s@qJ#Agh;>Zz-n+M6L-^95hOBJT_@4%2`jxT) z@sl~5z?C6+4w?N2TMRj%#AL6?!$p#&77#?O>7dkeYaA4^NLdIWupmBunDQzW!kri1 zJbrGhOZnxk2S8T6q{FsCqdmGraj=dAO9Vw;rM1W}CjcVsZEdiTy^TV~sfFImmd3s2 z^f^_~y6>r4Gr(iDW`H)!`ku{VLFNTHlg*X!O+ZfQWK(`LGVL*Mm@ZLLYBAG`P{lcb2fPzAdk}$pqMDLD8o!$;So5NyUC?U_CTuq3OJ0;NVe1>LAl5N zS{c^8B&TP*bu!t9nU@aF33fsC4skc#zkV2p95Gp~P4%UkoJR2bof`}i^iV!8#E=-@ z-}&0+HVE_~&?#KF@mGv>3bPR84000N?@rKMwuw9NYL;2aHSepsYvd*VT5*-PO6%up zxu7a#W;Z|n-cYG2w-|tjoAdNX*Y;<-Es>CMsFEtkYC%;Yx%{jUio~ki@cVlFJ*cn) zhmtD7idb1$tAX%dsHE4M+pvTaZxq0Ow)OcWpKehYBf-kUphw~DZbmPm9au`)um1@s zA}YBb*AMn|0Lx1lTyM8OPx`J4KR+r}+`bxk%AK_`)rH@`-H0n_$Np99Zb);wU>EOo z4Q>FEBFqLm(r~9Ve7BkMA=@p4<3TGWZ5rBe;D3gVYlN`YQ(^mFY?8Y3nA_}F1O_CJs%JxJLaM!guwZC`5LS&&W;NgG2*_;$yZ?UP-ej zI0UY=o#Y_LECWOXL{V>R8yH-iemCD4dllYaTgB#vH==xzaEApaRo;&u_neQ7`{J|E z7lL8X%7KaqqwM6Ry2bk6t1FS;+qzdISy2HBrc!+^s7C@A;z-aZH(k`t5hY=7+x$=r zEb|`5mXCy%6IHey)~8aJ8?fk#=d|}xjEqPOMyS)&o$31q9G8Kcw8vqa>i9V|iAQ1L z$yz@8e6o>sGtwr^&~w#g6R0QPokY`Xe|zGL%aU(36=zW@gQYwC{QiCq5J2MY$%v@w z3Ed8r+fXFYefDlgAU1RSN)V=)SaUD@GYWI_lWpSS4Tl@Gmh<@$OEz3#Z zMA`y*NoIWnGLVD*78=&Kb!XSSf1Vlfd zAbKzX`TJcAUFkM9kK{2Lz9#q0W#B!dz^V95-D)remPwvB_{pmj+z~%%Ri?PRxZBFJ zC$Be|uRlKkq6&1oK=NdH63~CX2i8AEmaD5Wl|MP=+~$^0%Y&K9A&N0H39bgx`e30Z z`3xfp&x(M!zSIdq&HHWal~+cWO!02wSsB@ueEn>fWs98_aa=4s4Ve+I3N-~Xq(aZo zu7G$-m7(i+d&+#EFEIP6P>E>44--OrW@pUfc+f+x^lY^8th zmHE0tyQIPh>alajr$3$x()^(CzH=7}7%A@!HhFuBf{JR<^czG(L~V6U1tMjA#bn2u zte+$$U2wiLQF_^euPotJhj2{OlBP~D3^_kKyT&5Xe8K+KDwrr~v3^MX+&n$xqF04t zb2P7diVf=Ht;*}K>zMd@T}h}N1#!aJDp_RQWm+(8idKMLhkziUY5+xq^4Ee>Tu|^W ziS8RFDK)%P#$lXKsUDSpy)`$+O@AmJL!?JD1DGuXdYK$&Yo4WEHF@Pre+#u%HGns@nBVg4xjk)>D2qaH^*d!=)V~XPP2;enU6$n{Y^2bd2L284YbOwkEAi;UYux;<&tP6ft~eMN|V>;54Yb( zV&APR;eOsE}II~MD_SToQ@GRcw7cDQ1O5`4`dM_?$0^hAU2&fy|fYi$)U6NW%B_=kX1^mPT4IV6;=tO({+T<5tRWnW~z zbS;`4^wyV^^(Iz!hNdY{^S#v6=XKWp0{bix|77#gp(hgXO`~j&@zpOfc>)fg!>a(i z*;sQyqV;Emv3P9wb)9}&4ak#&4~GlYtNSJP&>%5m1uDa}<{YH$c*pG(9wn9UH&=l1 zc`@GGYLK)(C3OJKT7g!rvr~RcpcooKMVob3PpS|^tdO=4|CIZ91z@<?=7Gcgl+0mY$ggn=x zB5o37Fw~jEGXyB~yOG)FopcuWedRT2IdyW7&w3bnQDpm`or%w8&F0lyyqI$S#hma-hh(zQDAGrd{9Y)y@uH@|p z*V&BEae**q4g2k4Y^=@9R8QD(Grv6Myb(gx69qwPXU|@{R%d8XHegJEIN5hQXjN&B@(ps7b|P$=rKu==&{=?le=2bp&z}==7Ny z%t0)Z5PD0Li8=k%D@Z_230v!zlFO<}@%p zqx+u#J*}BTaDdTV6?~}boqvz--7WS~uXp$^WH}ceav6@_x~?^Yd5IfuQ=+xk@o{v; zy>d18G5!RtZ=--k*SZ_oZTD8*cx7Dm&{}Q9h?{qa)AqdIVHuSg;P6(D;);4hu>~>F zFHiin-{xO)sL}S4E!A~)jz53?eDKx{?)n^=t8r2}{u`PqxJxW8ie-YkczM9=Wqc6E z-)d1rK}i`Z8SsX0_UtUg`snctt?i<32G!`3io*P%C-LJM0vH1tMdbyazV%{Jk9}&G zkJ_v_#K8#d7K9W{L_vk1=vC}smVkQE*M(=aOlm}6NcDFFuUnwv;({;qBbAE3q{;*X zJ7xTNtc2bEwXO7-eKw05%U%hzAIYO1cZ5^DI~4+wM#oVK2Y~U=N*~+M?4IQY90#wY zOU8ndeZZ?1Ca}O3eLeB<*m+VEKF;fJJ$02UsOM)8p_vyg*`InumDET(Eu$-BYCoOU zI9^zFnmS;P;Y=^>36Nb=ZnRtqlc#qJI!%A2=e8Iu`#c3@$V+>S{>QJu&8ZZ;2Iu;S z`Wtr(8`nFCfLL#$)dzG^WfDCg>xwli@DMX^v>Avg;0FkE-clv!NfJJTt zF|JXUmIj^$I;T7o$p zULT{#nthL5hm@)5GvHK)Y+V^I=t1^Z(d}OYafnGROQO1(KKlB6d2Q0d%ZGUeM%76k z7`^^*i`EZ(Dc0V?(=8#>4}-lVmF*HO&i*ZRNR+5#n*|Dmer_YY>h-QsRgvY}V1i7+ruK3KGSqk> zoKseV?-RX%S&%p=S2xS1)$^%~u~W`*=i5%@iT@ zr0yA{F>k^}2p9RMMFwr;%?UqS`d^g{b{M90MZc<*-G;R3N$z&W($gmauc`U_GV?U^ zTLIf^kL8<(v<7`MfHHUQ#k&K*sM{A5m(3<5%=OJ@C}l`3kS$$3C`S`qc`}Q$`17H45fcu#Jj02R;ldN)K_|ah z0gyr1=};_P$QOh#3z+aD{FB1`uMc`gZ_%zvy7i-)b;&X>MR+b5n0i=T_Lr6OWd8_H z0<>IXza7DgltvGz@5a)J7X!6gM(>Psu8A8-@PRuOapM9l?~@HC`YjK?>`ml^B15;3 zpBQm^Wm_;ZQFR4;N9>1FnA+j2oqErWrM$0;9;x1k13QNE8bbIf@aOhprKT4+BIz2+ zp5H{FW<{SPzuvitdqLSR{hZ**wQc9KtEpED<&9Z%cUE^4xEY6)f zH=PG?1mYBe=r8k_)7@uDCuD(-yYFP~;7&Czbq9EE@V9%}Y8MgvUJeVqX5m4sGjYP0 zd@z|b!gFKGMej;Ugj6L71C|5JX?jJ1z_}>rK@qg+G5E~DEqZ`)WBkzV;F-PdXOt9W z_;YZ$_V@se*757jB4Z&2UL}otn|l!j#22~iSRikwP6{~Od{Jf;8?VGSSjRDK$ySF9 z+TlLI`drH4!8#Up#I^jMYxPjaq)Guxk-iH%o!$RL+1vLGf5zTdUi_)#MmG!w*c$l^ zE$@*aR0WK`hw19VZD5NUK4)e59S743IwpClJ@4k3!a!ich8MjIQjNZueUo630W{&y z*9HkVfZNh;o^`8{)l@zU!7V5pfQ$f0N?S+GuZBxkiXk3PqU$E~m%m>AQEUUdeR91@h8{0!%J#UbUqBV5fDyC+gB?F)%4=?CZ z{&PK)B+gRBPaqHS{{0B5F8MR$vpoi0%w^=)>eh)vAAK>?FE{Z|Ois2=3B4~5Ax2AV@35vGWLv}gMJ{8* znaT{H3(4iAB|sFAbif~c;rEMSi=fssMd(Vr4x2&>9W>|SW^uW=xk_qlQ9ccWyXxZu z!f2BdU|AcIXy3)S=-Ti>T$aetr6^X*&} z|NaRP!9A>A`8|JLF5`yb$*#O^D}B^wE;5B;GtVo(=J_8pl!BprPNuf5H>HQMIZ#-}tV*UySxi_yo7yS-wlMiTA9r+rAx)Y$o>6!BsOh%6+62%abio-ZpQ1NyJ?)c90eA5i1QuZzxNC1n#3&cu-bR-n2CFCR?Q`tLBP8A z;kYc&+3zpOX=pW2G@`y{cV7`#){j2mmeMVNjh%lK@BU3y6CMbzxkAP6{tL2?dyG5G z`D3=`gGo^hd?H|Mz#OoSl~#QqguR>G`&78Q7|t2PKm+yJKoIU!Yn|P;p>O5Z^bTs` zyj!>t^Wdi-OWn^Vx$qX1Iu0;FopBf9{#sEM1Yj?jZuFdld^$WlJZ%urQ}!`BI^<+=(6ZvCm0yL(+C1p-0H-{cs`U*F;5Jn+T!1GV)e0C?##UgpgB3OeU} z6r-<9!z8EZJq|Pa83g)cvRj-6CUJl*NGXH?sxtzVXb&E<9I`?ix=q1`d^su$Ya`c>Ps)WmHn%(ml`ld9qxJCOOo-He@)`EG1Qo z`JXf-#FdSh1EQT6VBcIMJn0Nvd!;-I5wCG?WGokaYQT`Bw29 z2Wc2J)v(El7XK4405?QkytiEO0iey%!sRyB-)2<4pFB3FaR~CUj(CI3lTLs!z2D6- zfB%S8DJdxZqal#D*WC?NwI6UeFu$b?I}nIF`Rk#6y?Lq7f(bO4C{U#r1tvNS$Pc*g zl}n-rf{6Jzp z27c#R+|EriyAQGPV!x^K{#-bE-|=G7!gN1mXvRspN7<+8C8jnfx1_lF7HxvV=gKj~ z_dnhL)T*Hb@37-8YTS?<8|9nU_U#^?u5~o*)-2i0TDGHcDrnX zt{IyVL0m1>9~0DidHAt@qGNK|DPw|Wti(R`h1S*s!_~P}mm1|s@?d*|=1ogIjEJ_q z(_Lyp_o6%Um3HZt&o9Jqxw<$P8HtK4YijD5!doP~*34<#X4-_kJ#;nOPctS)4F{eP z;jk#Wr4U_i@dog4bOqJ!YvA7Z^Q-^cCg{E0f++#fq+3c#ys651il(CW#>1G1$9W$* zvRdMAoDYA|^Q_)xc8(#6gS6z0Zc9?Y&3$**N!f<4(;G|qQ`*o%O% zkcVrnw_%oHSy8*zq~iLo0zEbo&tHy>dB^>&t{We(CiJeuaOWoaf!i|rnM`ff(bETg6+m25$Y44vs!uCPKlUkBh4=Z> zp#!at&<_6hYu)ddt~oY7f^-AHpnj3?1*RCLPRae*?13s8P*bhjj<(%AAMTTHPV3X7 zbNQR#oHK_eLp~{vL;1=zOzYVmyYgQ>l{ zdvI@>z+|E7D~jL^wfx&P0N6|qoj{1!CGvCDz-@)1TtBf^#d@VlAbLLZ>#OO{m-mWW z26}v2)$Nqixy@bK9!U|r>mtsp+weMHexuM>|J7jv>h4y(XQj!j0F%J^J9ZPV@V_e8 zkHO4+UPpRV6}%SKDd^!yw?vnF6!v8ZU7fqm8>KXr$-1iBmwBC?z(l*>yl-U}){`N` zPq5>XT3A>}EP(owf76^QY4A~qAW0Zy>2jHqXH$)%oJmm=;BkvCV7zRXc8Qtzl6%bg(;27`=JmCW#(ioRSv5 zwPc-sYo6>Vh*B?hWVAv%ibP_L;syX$?4BRWlzbs1jk~@aAX-UW)YHDigNK3zMI&zG_Ji@GY zkB52JW4EqOHfQ;cU$e5I-=R-Jx5Qes=HJe^fGC(Ln(u&VbU$;&tT|PjmE2~rtEjR} zi|#^&xaXw8Pi=4A8x<7%EOv+S)G(*|4Qj)oe-cGam9cjD0^ zK0R&m(a+-fWnS*A?{Q3*hIN^rm9)J1rj_ALfo@ob2V z;X2Jqo$ujf#Hmx!O?N9vD>xO{R?`>dLq(4+iNVzyy{8J6%j$ZK4#!?{W~%cHS4r>t z?zCGV?G!L#P7SUpz{~P9C4M_u8Dku7Q+&8JPU*7S;+eG7GN$fDt^M{OOecTk2{?+I zsK==;B6z2UkK3I>u1lpI(G@{Yj^$fXIiohNi3DHSoy=P zxK*PkHs-KXqPn3u*g+ix!f5$hwGv+wI!0uP1Efa?(qa2*AcbhBpU1BTMe8p*?x`ekv@ZNj@w^RRC-o$@$?_8*iI7#|}p zshf4*a;`FRAo|ExL3rfDJS=~i)@4g4l4!N!YpW2yJkG6jHDBF5RFXXFcn3v~E?KxP z|Ao~x75i9PT;$%GH)`5rRZ^R3gjf0ARH0!SfBWEOT_puN(40PUU&qyJ;-qJMim2O@!$VAPRP-N-UcV41PfYi0*yR3<_*rzTyHb=7|4f#dOs&UJ zMl5W~o0Ep~sPn>M&_E(_Z+atYacfF4Y(ZK9&50c4DFU!Oqx&GIWD3 z5i=buDKa*<;9B$Uy1p#^e#wJ7=V<1c@#k|A%=~#f%#~l0 z8@1!Xm?iDdVRNVDDsu!p=i;pc=>2CgoHVB5OWlyco8|RcGSItMV75{FsRNB!U)3^Es=qqvux_N=klh-=l$Bf=&r@Mxal*(P>wO9SxbMMJjL^Cd4ShRC zBUaox@?$C@+NYM2*MQgJ^;hOIYo=R4b?JbO+kWcQsT`NH?dvP?L>QHY8|=d;|C)0@ zta%%Pk{w>?v+n;e#`#V>3;c%C`g8AmHUc(Sk#lK{=n)9~W zS-w(a!kkbTZb|QxX20SNG2C4Yg~o2Iv-#$=1HvN2`(bcg_7(SD8wKr#ra1x?k={ zA!~K=bZz00h;T1QW6dGCuCrwv@UDnk&sDsphCS@`ndS@=7S)i^b77%w)m`hjD&X81 zj5j(>b{>yKanzQXy8ZTLxV9eJQUO7kVUr%K-D*nb?+%?#2x_#(zLtl?x%uDMfMDfy%j_mg45Re z<{L64%S#mehDowGis3HU;gLI)|ty~{qSrzQDz zRd!jCA3h@DQc12VCIEN7!%evbCd8)b7NqHo1kn(hL1`@u!zEz3!~e!@K*CdV6nghs->ag$3}Jhu!Mj%y_;%A+&vQ zMKiKY)7Uk}f#tcx-Dp^1bizCR*pacS6PuFdXK2{R2}%1`YbFO1w22}M>0ftT5cilc z4W*?s6UD?nIsj1yM3w^rq3%{Ez^U+MpY7b?$Uj)Xpx$zjc{}X3(FCQD2L73gHZ&Wb z?4KPu)6ZEh$V(4*x{MlKU6OxImia`_;T<;*(OfkTa}t`D&%ypc7{ddPk06TCA3FQ! zVOTAt>=!L$v~YFXrl|G?E2hJ?AcNwA)ccS-h9V_a;R;eNWrmkr%Dj=E;;%sTi(a)i z>ZB+coF({QKHlXM{uY9^AeX)#O8%$@VR~w_zA~Q;Zc#v3Sq0)$a3%i6;h61q($Q*| z{#V@APWT))DXiM%)7$nlpqf0GONc}uxZlw;HHGO(IuALFAi_;;rU`?MLsAW+n=`(? zLJul0v}4+m=+q@^<4)cU2e-0>j8jP^v=B+V}SL_vedrZUO9#8Ckd7+`f6b6m&G`H;5yk}VAy2#vMqc?PR3ni!NvAJSP5PT6Z zUOlY}GVXkNkF}!G*CU%n=z?(d();jekTX8zV2k{ghfMcu9X0lC)Y~K3d+ligLe7_k zmXNwtQISY}5axk_l=+Pbh9*!C$(jP;Qsx*4Ge~Rhr1M0BnzRj1X{!g%`aA(5IxoN6 z>%_O`I?WV!Gx5=wRXpmAt2GPn8sfiN(8ipr~RuwaiuF|-q zFG0K}ghRiQVYK2j&4znKG|0FLomZD^e7M%+L2^JcwN&Zf68Pxxw6J%^VHHgOLTX_n z{ot9lSZsVt$~2!hEzKpkf(2ZJE=+4!$tk%h#(QaaP|N{%PSGVOIi`4Gmt_wwUS5^) zun#ddxBv z`CLtIt_m-2G7JQWUu<{>(4TWSM{$nNUd_B06TQ9E6mTunGdf?3AA@-ZV6~MuNN;p`F)wonSS2^ls_P=;oBgb zv1$PE2^mBQQTG2~f{^%6u@BgZKS`OeTXZq`pD+0DGiTHNz``tqz&*#sJk||=yKZ_3 zele_nBjnI6Gf(=}^8*s3)WL6X<~zpw!|XwMXkk47xrBdr z(m(5sDUKU=7+|0N`>cL(5z`2ZHwnj{RaFfG+rG6vGYJfti#wZ^{uBmCpi$mx_yY1& zF9i^fNKEJd^(-$z@a4}IUXVTpixhOj8gO%S6Qvem9bcAIr-A3X(rV^&IX>m|291fZqiqF01&HCIM;m<@_( zg%@qF<3y8dBnv(Eq?yuqAj6PPCfh^lpRx<8`%VIOH%~lC{S=MMhQj|`G5f;t@5EMH z92-MO;>8WNcjFPZLu|_KsY4k~79Vp7Mo+}h+!nBgQVvh6k6>1T

A) z>OtDL20DX}{~Xm0(m0tvyLki9R2gz_KfNX}#ayVA%vU|_u}rNPyiwCL(+EMutB5093bw&RM_Kf@{$OHpsoAX5`r5o%BCP z?C0efk_ii)K>Np)8AfX%9T5=Hkwe{baRWI4y~Ut7!ZUm9+eVzQ3m_xU{+OcgCoE%1 zijWHwFWg+6Jn6gv$lwSNg61h^F3qnQtpBrXLdfGh|LhvZy(gY0phQIJBXHy*pkM$f zczf|OKjRB1L_1NZ3A@ST;FW zzhYckj3m~15GjB2HMuG}idraO8UZTBqCpYh3qhJo#a#mT>tIR%h3<~qVIs&bsh;4< z6`?$Lj%rd4sG&Q`wTlGUkGiVG{BM{fOlpWUjui?gvHSID85ubOT3*ZnAg&WoznHpb zSCHWfhXjPeim>&sn@dffr07wmR;}Vv74@CKCoYFddK|3F&Eo1qGq+0!X9cRP?*uZp85u}h`kjM!%>dmxoY zqJeP<_w{CG6+lRc*zTp!BxWDwaLRaxW2vQE^BxTW$?#Q)sE`fkAw18js_o8Y265mxG&g%ql-z?Tyne+N}z?f z;nF46TTsH9MWGL%CO2FT;4cP5L9jmbGW;(7@5z9&#;Lfy0dir{Kpe)-B0u3W0Q^si zf@KMVl-vjdcY16rcQfnEmb$*>1VajCYNDk?!uwcl6*L^NAKk!}Ko%r!#d^fWasdLDbcRb9ztuLHCvm6MxjAi=leqzXFd#pGK)>vR|L{qTqdp<_Q zvw02y#IxMDKy{BqDOGh2=xZVXo2vSj8tWzBy~&x0&$DeXkc#^3{BdQI5Xv9PI6Vvu z{QutH0P{Ucs#v-Xsgf?->)5nog#-e;ZM{Qp6!MTDWS9X_B-7Z>Q$=&=a^wr=B=-&k z9b?(6GH&(}c0gYO-@pX4)Zd%E0dcQ^ZY3YlsUx72Vg(68B_EOxoFjbMdx=5tS2*|g z(lf^$26@K*AtX}PH=J^^?+Vbq2SR8jU{$9Xf_i(KKy@#OMe1R3;})R**3O@i>Cb6G z3f`e&8k@v(rUDqZPZ9qNL4{#&kmIKu6`aP(gkW@ntiAIz9SpP z7P;aI1i#B8+2=}R!v`!gHDV6@b0;E>w@Zz7O67H^nHT=?(NO2HT~a*p@YZ@{X!q9O zbA=_*<>E@>=!j1o-CbQb66jq>@5)C}nL;{F14dJz1DH##k98=5>K_a zG`^>Tvc`1Kz9{;S<4pJ-vG3F@F3q7NDSh_#!53X zKo+^MRN0Fwxw#oT$_Ldt)Trt9NbWj zjmwUb`Xy|lssg|RY*UXSSX;UFNX&I#T#f<9REM*EX(BQd2BpCPhnWe`mBGFY2m8}^ zhzpoy+G=VfN#8Z(b{C(U8jZ-Dxy~{r9o=Hx6rpkzGpzagujWaWcKGe)p|$^+2!3YS zUj)j5PQV0^%P;}=?!PtLgC#X0LE z4$7KT02(W!&24}>hw#0}n%Z?G#vwFa@PMUWdQ8pS4e6DT40NGPg$M=Ne=?&1%540XcEP_31qMN?a~$hu|yjMS}qnr%5H#o-3NAu zn0rH%j3)iK(iWb~~H%0!fp6#9Rz#F;DD1 z1Q6)Qdm1mGMG2vx5XcEpJOMwP;)ICPr>TBXeLmb!k~0mQKZ^h6epkQUVJV6?=|vc$)vI3 zf4hn}#P$tRy}M=OR(5MaNIVTP&#dGP_KpLCTbrTu1xstX(Z8^yjz2!oC|loQTU<8M3X*U=5qV?e^)nF8VerDB2aEJz&RP=iinkje}a z9q02Vejig{ACIHPUHH?(0|F7i4V*){Nd3pD`j30(zye&I_i`%#<-~%cD9g_S@N+<} z1X)~)9ybN-FZ0RYft8{8Ph&bQ613|B6F2flySP=Qc>ni!lVu2mNOU=`;;H|uT>!Mm zrh}+9S0UG5{P3@Sk~$<&Q~mRf+VS9yTDXNDe%z54Sa|SA)Rqg8W)!%pl@Xx70!%olV>izgus-l$9zmnde;RL)q(D`PC_H+tA z^Ns)26F<8)P6@i{TbmdBf8BK839iLIX|2!?fzK9RG;(k8$M{N>lBh}k>w4e6RRr~{ zUCv8KRf_-k^Y14O1~;{u&38E?fl;lCRO4^C;S6U?jH+ByF*G{ zT|MyJ6n_~5%rDtGZUP7y4 zNrvI%Up@3sGyk~>5i~5V952rP_yDZl>Obe*&)+hT#HC!gw6OGe_iw1|pR4TQ4$AIfa3QEpqKy;v(lz~;l=lzLCT6W?&`mO0RFpk6FjC*wA++E z?|(Gt*ANf91`i-CpqBbCpTy=A4*WZV@W+)?<=-70KX&ZsNI_Xc``EE#_>ft1;#g{Q Wwjs-fDIxI5F~ys=WlL|E1pFUUG~`48 literal 0 HcmV?d00001